Някой ми влиза в компютъра помогнете.

14 юни 201214 г.

Някой ми влиза в компютъра и инсталира някакви програми. Няколко пъти трия вече всичко и пак влиза. Помогнете ми.

quickJO

Потребител

Пол:Мъж
Град:София
Интереси:Hardware, MTB, Застраховки, Коли и Жени, Студена биричка и градивният спор

14 юни 201214 г.

Искам да спестя малко време на колегите от раздела:

Системата ми е инфектирана - Какво да правя сега?

Изпълнете сканиранията, описани в линка. Колегите имат нужда да знаят с/у какво са изправени, за да предприемат адекватни мерки.

Поздрави!

14 юни 201214 г.

Автор

Не мога да спра систем ресторе в него има вируси и си ги тегли от там,

ето лог от

Logfile of HijackThis v1.99.1

Scan saved at 19:48:11, on 14.06.2012

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Running processes:

C:WINDOWSSystem32smss.exe

C:WINDOWSsystem32winlogon.exe

C:WINDOWSsystem32services.exe

C:WINDOWSsystem32lsass.exe

C:WINDOWSsystem32svchost.exe

C:WINDOWSSystem32svchost.exe

C:Program FilesAVAST SoftwareAvastAvastSvc.exe

C:WINDOWSsystem32spoolsv.exe

C:WINDOWSMicrosoft.NETFrameworkv2.0.50727mscorsvw.exe

C:System Volume Information_restore{57E7AC28-D97D-42DD-8BED-89BC89C738E1}Rp38452snapshotsystem32unxsssvchost.exe

C:System Volume Information_restore{57E7AC28-D97D-42DD-8BED-89BC89C738E1}Rp38452snapshotsystem32unxsssafesurf.exe

C:WINDOWSsystem32nvsvc32.exe

C:WINDOWSsystem32r_server.exe

C:System Volume Information_restore{57E7AC28-D97D-42DD-8BED-89BC89C738E1}Rp38452snapshotsystem32unxsvchost.exe

C:WINDOWSsystem32cmd.exe

C:Program FilesTeamViewerVersion7TeamViewer_Service.exe

C:WINDOWSExplorer.EXE

C:Program FilesTeamViewerVersion7TeamViewer.exe

C:Program FilesAVAST SoftwareAvastavastUI.exe

C:Program FilesTeamViewerVersion7 v_w32.exe

C:WINDOWSRTHDCPL.EXE

C:WINDOWSSystem32svchost.exe

C:WINDOWSsystem32RUNDLL32.EXE

C:Program FilesUnlockerUnlockerAssistant.exe

C:WINDOWSsystem32ctfmon.exe

C:Program FilesuTorrentuTorrent.exe

C:WINDOWSsystem32ntvdm.exe

C:WINDOWSDatecsFlex2K.exe

C:Program FilesInternet Exploreriexplore.exe

C:Program FilesHijackThisHijackThis.exe

C:WINDOWSsystem32ping.exe

R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelper.dll

O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:Program FilesAVAST SoftwareAvastaswWebRepIE.dll

O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:Program FilesAVAST SoftwareAvastaswWebRepIE.dll

O4 - HKLM..Run: [avast] "C:Program FilesAVAST SoftwareAvastavastUI.exe" /nogui

O4 - HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSsystem32NvCpl.dll,NvStartup

O4 - HKLM..Run: [nwiz] nwiz.exe /install

O4 - HKLM..Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM..Run: [skyTel] SkyTel.EXE

O4 - HKLM..Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM..Run: [NvMediaCenter] RUNDLL32.EXE C:WINDOWSsystem32NvMcTray.dll,NvTaskbarInit

O4 - HKLM..Run: [unlockerAssistant] "C:Program FilesUnlockerUnlockerAssistant.exe"

O4 - HKCU..Run: [CTFMON.EXE] C:WINDOWSsystem32ctfmon.exe

O4 - HKCU..Run: [uTorrent] "C:Program FilesuTorrentuTorrent.exe" /MINIMIZED

O4 - Startup: Microinvest Recover.lnk = C:MICROPALMCOMRECOVER.EXE

O4 - Startup: Microinvest Мениджър.lnk = C:MICROPALMCOMMST_UTIL.EXE

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:PROGRA~1MICROS~2OFFICE11EXCEL.EXE/3000

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:PROGRA~1MICROS~2OFFICE11REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%Network Diagnosticxpnetdiag.exe (file missing)

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%Network Diagnosticxpnetdiag.exe (file missing)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengermsmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengermsmsgs.exe

O11 - Options group: [iNTERNATIONAL] International

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

O17 - HKLMSystemCCSServicesTcpip..{CC934948-51B5-4C83-938B-583D4A40ADED}: NameServer = 192.168.10.1

O20 - Winlogon Notify: dimsntfy - %SystemRoot%System32dimsntfy.dll (file missing)

O20 - Winlogon Notify: WgaLogon - C:WINDOWSSYSTEM32WgaLogon.dll

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:WINDOWSsystem32wpdshserviceobj.dll

O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:WINDOWSsystem32MacromedFlashFlashPlayerUpdateService.exe

O23 - Service: avast! Antivirus - AVAST Software - C:Program FilesAVAST SoftwareAvastAvastSvc.exe

O23 - Service: Microsoft Console Upgrade - Unknown owner - C:System Volume Information_restore{57E7AC28-D97D-42DD-8BED-89BC89C738E1}Rp38452snapshotsystem32unxsssvchost.exe (file missing)

O23 - Service: Microsoft Windows Installer Upgrade - Unknown owner - C:System Volume Information_restore{57E7AC28-D97D-42DD-8BED-89BC89C738E1}Rp38452snapshotsystem32unxsssvchost.exe (file missing)

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:WINDOWSsystem32nvsvc32.exe

O23 - Service: Remote Administrator Service (r_server) - Unknown owner - C:WINDOWSsystem32r_server.exe" /service (file missing)

O23 - Service: TeamViewer 7 (TeamViewer7) - TeamViewer GmbH - C:Program FilesTeamViewerVersion7TeamViewer_Service.exe

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

14 юни 201214 г.

Не мога да спра систем ресторе в него има вируси и си ги тегли от там,

Добър вечер...!Прочетете внимателно още веднъж Системата ми е инфектирана - Какво да правя сега?

Никъде там не се изисква лог от HijackThis ..на всичко отгоре сте сканирали с стара версия.Свободните съчинения не се толерират в този подраздел....Въпрос ....ще вършим ли работа или да затварям темата..?

14 юни 201214 г.

Автор

DDS (Ver_2011-09-30.01) - NTFS_x86 Internet Explorer: 8.0.6001.18702 Run by Office at 20:14:37 on 2012-06-14 Microsoft Windows XP Professional 5.1.2600.3.1251. 359.1033.18.1407.349 [GMT 3:00] . AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D} . ============== Running Processes ================ . C:Program FilesAVAST SoftwareAvastAvastSvc.exe C:WINDOWSsystem32spoolsv.exe C:WINDOWSMicrosoft.NETFrameworkv2.0.50727mscorsvw.exe C:System Volume Information_restore{57E7AC28-D97D-42DD-8BED-89BC89C738E1}Rp38452snapshotsystem32unxsssvchost.exe C:System Volume Information_restore{57E7AC28-D97D-42DD-8BED-89BC89C738E1}Rp38452snapshotsystem32unxsssvchost.exe C:System Volume Information_restore{57E7AC28-D97D-42DD-8BED-89BC89C738E1}Rp38452snapshotsystem32unxsssafesurf.exe C:WINDOWSsystem32nvsvc32.exe C:WINDOWSsystem32r_server.exe C:System Volume Information_restore{57E7AC28-D97D-42DD-8BED-89BC89C738E1}Rp38452snapshotsystem32unxsvchost.exe C:Program FilesTeamViewerVersion7TeamViewer_Service.exe C:WINDOWSExplorer.EXE C:Program FilesTeamViewerVersion7TeamViewer.exe C:Program FilesAVAST SoftwareAvastavastUI.exe C:WINDOWSsystem32wbemwmiprvse.exe C:Program FilesTeamViewerVersion7tv_w32.exe C:WINDOWSRTHDCPL.EXE C:WINDOWSsystem32RUNDLL32.EXE C:Program FilesUnlockerUnlockerAssistant.exe C:WINDOWSsystem32ctfmon.exe C:Program FilesuTorrentuTorrent.exe C:WINDOWSsystem32ntvdm.exe C:WINDOWSDatecsFlex2K.exe C:Program FilesInternet Exploreriexplore.exe C:Program FilesInternet Exploreriexplore.exe C:Program FilesInternet Exploreriexplore.exe C:Program FilesInternet Exploreriexplore.exe C:WINDOWSsystem32ping.exe C:WINDOWSSystem32svchost.exe -k netsvcs C:WINDOWSsystem32svchost.exe -k NetworkService C:WINDOWSsystem32svchost.exe -k LocalService C:WINDOWSsystem32svchost.exe -k LocalService C:WINDOWSSystem32svchost.exe -k HTTPFilter . ============== Pseudo HJT Report =============== . uStart Page = hxxp://www.google.com/ uInternet Connection Wizard,ShellNext = hxxp://www.google.com/ BHO: Adobe PDF Reader Link Helper: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:program filescommon filesadobeacrobatactivexAcroIEHelper.dll BHO: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - c:program filesavast softwareavastaswWebRepIE.dll TB: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - c:program filesavast softwareavastaswWebRepIE.dll uRun: [CTFMON.EXE] c:windowssystem32ctfmon.exe uRun: [uTorrent] "c:program filesutorrentuTorrent.exe" /MINIMIZED mRun: [avast] "c:program filesavast softwareavastavastUI.exe" /nogui mRun: [NvCplDaemon] RUNDLL32.EXE c:windowssystem32NvCpl.dll,NvStartup mRun: [nwiz] nwiz.exe /install mRun: [RTHDCPL] RTHDCPL.EXE mRun: [skyTel] SkyTel.EXE mRun: [Alcmtr] ALCMTR.EXE mRun: [NvMediaCenter] RUNDLL32.EXE c:windowssystem32NvMcTray.dll,NvTaskbarInit mRun: [unlockerAssistant] "c:program filesunlockerUnlockerAssistant.exe" dRun: [CTFMON.EXE] c:windowssystem32CTFMON.EXE StartupFolder: c:docume~1officestartm~1programsstartupmicroi~4.lnk - c:micropalmcomRECOVER.EXE StartupFolder: c:docume~1officestartm~1programsstartupmicroi~3.lnk - c:micropalmcomMST_UTIL.EXE uPolicies-Explorer: NoDriveTypeAutoRun = dword:145 mPolicies-System: EnableLUA = dword:0 mPolicies-System: ConsentPromptBehaviorAdmin = dword:0 mPolicies-Explorer: NoDriveTypeAutoRun = dword:145 IE: E&xport to Microsoft Excel - c:progra~1micros~2office11EXCEL.EXE/3000 IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%Network Diagnosticxpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:program filesmessengermsmsgs.exe DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab TCP: Interfaces{CC934948-51B5-4C83-938B-583D4A40ADED} : NameServer = 192.168.10.1 SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:windowssystem32wpdshserviceobj.dll . ============= SERVICES / DRIVERS =============== . R1 aswSnx;aswSnx;c:windowssystem32driversaswSnx.sys [2012-4-17 612184] R1 aswSP;aswSP;c:windowssystem32driversaswSP.sys [2012-4-17 337880] R2 aswFsBlk;aswFsBlk;c:windowssystem32driversaswFsBlk.sys [2012-4-17 20696] R2 avast! Antivirus;avast! Antivirus;c:program filesavast softwareavastAvastSvc.exe [2012-4-17 44768] R2 Microsoft Console Upgrade;Microsoft Console Upgrade;c:system volume information_restore{57e7ac28-d97d-42dd-8bed-89bc89c738e1}rp38452snapshotsystem32unxsssvchost.exe --> c:system volume information_restore{57e7ac28-d97d-42dd-8bed-89bc89c738e1}rp38452snapshotsystem32unxsssvchost.exe [?] R2 Microsoft Windows Installer Upgrade;Microsoft Windows Installer Upgrade;c:system volume information_restore{57e7ac28-d97d-42dd-8bed-89bc89c738e1}rp38452snapshotsystem32unxsssvchost.exe --> c:system volume information_restore{57e7ac28-d97d-42dd-8bed-89bc89c738e1}rp38452snapshotsystem32unxsssvchost.exe [?] R2 r_server;Remote Administrator Service;c:windowssystem32r_server.exe [2012-6-4 241664] R2 TeamViewer7;TeamViewer 7;c:program filesteamviewerversion7TeamViewer_Service.exe [2012-5-8 2666880] S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:windowssystem32macromedflashFlashPlayerUpdateService.exe [2012-4-17 257224] . =============== Created Last 30 ================ . 2012-06-14 16:14:51 -------- d-----w- c:program filesUnlocker 2012-06-14 15:56:54 -------- d--h--w- c:windowssystem32GroupPolicy 2012-06-14 15:17:02 521728 -c----w- c:windowssystem32dllcachejsdbgui.dll 2012-06-14 15:13:47 -------- d-----w- c:program filesCCleaner 2012-06-14 06:07:21 -------- d-----w- c:documents and settingsofficelocal settingsapplication dataPCHealth 2012-06-13 22:24:27 316928 ----a-w- c:windowssystem32ipz.tmp 2012-06-09 20:56:18 318464 ----a-w- c:windowssystem32ipz.exe 2012-06-04 17:22:32 18944 ----a-w- c:windowssystem32spoolprtprocsw32x86mdippr.dll 2012-06-04 17:22:32 17920 ----a-w- c:windowssystem32mdimon.dll 2012-06-04 17:21:11 -------- d-----w- c:program filesMicrosoft ActiveSync 2012-06-04 17:20:20 -------- d-----w- c:windowsSHELLNEW 2012-06-04 17:16:46 -------- dc-h--w- c:windowsie8 2012-06-04 17:09:29 6144 -c----w- c:windowssystem32dllcacheiecompat.dll 2012-06-04 17:00:27 -------- d-sh--w- c:documents and settingsofficeUserData 2012-06-04 16:57:22 90112 ----a-w- c:windowssystem32admdll.dll 2012-06-04 16:57:22 29408 ----a-w- c:windowssystem32raddrv.dll 2012-06-04 16:57:22 241664 ----a-w- c:windowssystem32r_server.exe 2012-06-04 16:57:21 -------- d-----w- c:program filesRadmin 2012-06-04 16:41:03 -------- d-----w- c:windowssystem32appmgmt 2012-06-04 16:33:28 -------- d-----w- c:documents and settingsofficeapplication dataMalwarebytes 2012-06-04 16:33:18 -------- d-----w- c:documents and settingsall usersapplication dataMalwarebytes 2012-06-04 13:35:30 -------- d-----w- c:windowsie8updates 2012-06-04 12:38:42 17920 -c----w- c:windowssystem32dllcachemsyuv.dll 2012-06-04 12:38:10 8704 -c----w- c:windowssystem32dllcachetsbyuv.dll 2012-06-04 12:38:10 48128 -c----w- c:windowssystem32dllcacheiyuv_32.dll 2012-06-04 12:37:40 55296 -c----w- c:windowssystem32dllcachemsfeedsbs.dll 2012-06-04 12:37:39 743424 -c----w- c:windowssystem32dllcacheiedvtool.dll 2012-06-04 12:37:39 247808 -c----w- c:windowssystem32dllcacheieproxy.dll 2012-06-04 12:37:39 12800 -c----w- c:windowssystem32dllcachexpshims.dll 2012-06-04 12:37:37 629760 -c----w- c:windowssystem32dllcachemsfeeds.dll 2012-06-04 12:37:36 2000384 -c----w- c:windowssystem32dllcacheiertutil.dll 2012-06-04 12:37:08 456320 -c----w- c:windowssystem32dllcachemrxsmb.sys 2012-06-04 12:33:42 293376 ------w- c:windowssystem32browserchoice.exe 2012-06-04 12:32:24 2148352 -c----w- c:windowssystem32dllcachentkrnlmp.exe 2012-06-04 12:32:22 2192640 -c----w- c:windowssystem32dllcachentoskrnl.exe 2012-06-04 12:32:20 2069120 -c----w- c:windowssystem32dllcachentkrnlpa.exe 2012-06-04 12:32:20 2026496 -c----w- c:windowssystem32dllcachentkrpamp.exe 2012-06-04 12:32:03 3072 -c----w- c:windowssystem32dllcacheiacenc.dll 2012-06-04 12:32:03 3072 ------w- c:windowssystem32iacenc.dll 2012-06-04 12:27:01 -------- d-----w- c:windowssystem32SoftwareDistribution 2012-06-04 11:09:28 26368 -c--a-w- c:windowssystem32dllcacheusbstor.sys 2012-06-04 09:31:18 -------- d-----w- c:windowssystem32XPSViewer 2012-06-04 09:30:26 89088 ----a-w- c:windowssystem32spoolprtprocsw32x86filterpipelineprintproc.dll 2012-06-04 09:26:46 89088 -c----w- c:windowssystem32dllcachefilterpipelineprintproc.dll 2012-06-04 09:26:46 117760 ------w- c:windowssystem32prntvpt.dll 2012-06-04 09:26:45 597504 -c----w- c:windowssystem32dllcacheprintfilterpipelinesvc.exe 2012-06-04 09:26:45 597504 ------w- c:windowssystem32spoolprtprocsw32x86printfilterpipelinesvc.exe 2012-06-04 09:26:45 575488 -c----w- c:windowssystem32dllcachexpsshhdr.dll 2012-06-04 09:26:45 575488 ------w- c:windowssystem32xpsshhdr.dll 2012-06-04 09:26:45 1676288 -c----w- c:windowssystem32dllcachexpssvcs.dll 2012-06-04 09:26:45 1676288 ------w- c:windowssystem32xpssvcs.dll 2012-06-04 07:29:14 333312 ------w- c:windowssystem32RWLN.dll 2012-06-04 07:25:07 -------- d-----w- c:windowssystem32wbemappdataCache.Trash 2012-05-31 09:42:57 -------- d-----w- c:documents and settingsofficelocal settingsapplication dataVvtbrse 2012-05-31 09:40:22 -------- d-----w- c:documents and settingsofficeapplication dataVvtbrse 2012-05-31 05:35:17 -------- d-----w- c:windowssystem32wbemappdatastartupCache . ==================== Find3M ==================== . 2012-06-14 16:38:18 70344 ----a-w- c:windowssystem32FlashPlayerCPLApp.cpl 2012-06-14 16:38:18 426184 ----a-w- c:windowssystem32FlashPlayerApp.exe 2012-05-31 13:22:09 599040 ----a-w- c:windowssystem32crypt32.dll 2012-05-16 15:08:26 916992 ----a-w- c:windowssystem32wininet.dll 2012-05-15 13:20:33 1863168 ----a-w- c:windowssystem32win32k.sys 2012-05-11 14:42:33 43520 ------w- c:windowssystem32licmgr10.dll 2012-05-11 14:42:33 1469440 ------w- c:windowssystem32inetcpl.cpl 2012-05-11 11:38:02 385024 ------w- c:windowssystem32html.iec 2012-05-04 15:02:20 2069120 ----a-w- c:windowssystem32ntkrnlpa.exe 2012-05-04 13:12:30 2192640 ----a-w- c:windowssystem32ntoskrnl.exe 2012-05-02 13:46:36 139656 ----a-w- c:windowssystem32driversrdpwd.sys . ============= FINISH: 20:16:46.76 =============== . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2011-09-30.01) . Microsoft Windows XP Professional Boot Device: DeviceHarddiskVolume1 Install Date: 17.04.2012 18:33:03 System Uptime: 14.06.2012 19:21:15 (1 hours ago) . Motherboard: | | K8NF6G-VSTA Processor: AMD Sempron Processor 3100+ | CPUSocket | 1808/200mhz . ==== Disk Partitions ========================= . A: is Removable C: is FIXED (NTFS) - 10 GiB total, 2.13 GiB free. D: is FIXED (NTFS) - 65 GiB total, 50.111 GiB free. . ==== Disabled Device Manager Items ============= . Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318} Description: NVIDIA nForce Networking Controller Device ID: {1A3E09BE-1E45-494B-9174-D7385B45BBF5}NVNET_DEV03EF4&1E6AA3F3&0&00 Manufacturer: NVIDIA Name: NVIDIA nForce Networking Controller PNP Device ID: {1A3E09BE-1E45-494B-9174-D7385B45BBF5}NVNET_DEV03EF4&1E6AA3F3&0&00 Service: NVENETFD . ==== System Restore Points =================== . RP33: 26.05.2012 17:16:34 - Контролна точка на системата RP34: 27.05.2012 18:02:32 - Контролна точка на системата RP35: 28.05.2012 19:06:17 - Контролна точка на системата RP36: 29.05.2012 19:21:44 - Контролна точка на системата RP37: 30.05.2012 19:23:00 - Контролна точка на системата RP38: 31.05.2012 21:47:40 - Контролна точка на системата RP39: 01.06.2012 22:03:38 - Контролна точка на системата . ==== Installed Programs ====================== . Adobe Flash Player 11 ActiveX Adobe Reader 8.1.1 avast! Free Antivirus Bulgarian (Phonetic) by Iliya Dankov CCleaner FileZilla Client 3.5.3 FlexType 2K HijackThis 1.99.1 Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595) Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484) Hotfix for Windows Media Format 11 SDK (KB929399) Hotfix for Windows Media Player 11 (KB939683) Hotfix for Windows XP (KB954550-v5) Hotfix for Windows XP (KB970653-v3) Hotfix for Windows XP (KB976002-v5) IBM Printer Software Uninstall Microinvest Кѕєтµ№» Microsoft .NET Framework 2.0 Service Pack 2 Microsoft .NET Framework 3.0 Service Pack 2 Microsoft .NET Framework 3.5 SP1 Microsoft Office Professional Edition 2003 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 NVIDIA Drivers Realtek High Definition Audio Driver Remote Administrator v2.1 Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473) Security Update for Windows Internet Explorer 8 (KB2510531) Security Update for Windows Internet Explorer 8 (KB2544521) Security Update for Windows Internet Explorer 8 (KB2618444) Security Update for Windows Internet Explorer 8 (KB2647516) Security Update for Windows Internet Explorer 8 (KB2675157) Security Update for Windows Internet Explorer 8 (KB2699988) Security Update for Windows Internet Explorer 8 (KB982381) Security Update for Windows Media Player 11 (KB954154) Security Update for Windows XP (KB2707511) Security Update for Windows XP (KB2709162) Security Update for Windows XP (KB923789) Security Update for Windows XP (KB938464) Security Update for Windows XP (KB941569) Security Update for Windows XP (KB973346) TeamViewer 7 Unlocker 1.9.1 Update for Windows Internet Explorer 8 (KB2598845) WebFldrs XP Windows Internet Explorer 8 WinRAR archiver µTorrent . ==== Event Viewer Messages From Past Week ======== . 14.06.2012 19:18:15, error: sr [1] - The System Restore filter encountered the unexpected error '0xC0000008' while processing the file 'change.log' on the volume 'HarddiskVolume1'. It has stopped monitoring the volume. 14.06.2012 18:52:42, error: Windows Update Agent [20] - Installation Failure: Windows failed to install the following update with error 0x80070002: Windows Malicious Software Removal Tool - June 2012 (KB890830). 14.06.2012 18:25:14, error: Windows Update Agent [20] - Installation Failure: Windows failed to install the following update with error 0x80246007: Microsoft .NET Framework 3.5 SP1 and .NET Framework 2.0 SP2 Update for Windows Server 2003 and Windows XP x86 (KB982524). 14.06.2012 18:12:46, error: Windows Update Agent [20] - Installation Failure: Windows failed to install the following update with error 0x80246007: Security Update for Microsoft .NET Framework 3.0 SP2 on Windows Server 2003 and Windows XP x86 (KB2604110). 14.06.2012 18:12:30, error: Windows Update Agent [20] - Installation Failure: Windows failed to install the following update with error 0x80246007: Security Update for Windows XP (KB2686509). 14.06.2012 18:12:30, error: Windows Update Agent [20] - Installation Failure: Windows failed to install the following update with error 0x80246007: Security Update for Microsoft .NET Framework 3.0 SP2 on Windows Server 2003 and Windows XP x86 (KB2656407). 14.06.2012 18:12:30, error: Windows Update Agent [20] - Installation Failure: Windows failed to install the following update with error 0x80246007: Security Update for Microsoft .NET Framework 2.0 SP2 on Windows Server 2003 and Windows XP x86 (KB2656369). 14.06.2012 18:12:30, error: Windows Update Agent [20] - Installation Failure: Windows failed to install the following update with error 0x80070002: Security Update for Microsoft .NET Framework 2.0 SP2 on Windows Server 2003 and Windows XP x86 (KB2686828). 14.06.2012 18:12:30, error: Windows Update Agent [20] - Installation Failure: Windows failed to install the following update with error 0x80070002: Microsoft .NET Framework 3.5 SP1 and .NET Framework 2.0 SP2 Update for Windows Server 2003 and Windows XP x86 (KB982524). 14.06.2012 08:47:54, error: Windows Update Agent [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Security Update for Microsoft .NET Framework 2.0 SP2 on Windows Server 2003 and Windows XP x86 (KB2656369). 14.06.2012 08:36:21, error: Windows Update Agent [20] - Installation Failure: Windows failed to install the following update with error 0x80070070: Security Update for Microsoft .NET Framework 2.0 SP2 on Windows Server 2003 and Windows XP x86 (KB2686828). 14.06.2012 07:54:01, error: sr [1] - The System Restore filter encountered the unexpected error '0xC000007F' while processing the file '8d80b.rbf' on the volume 'HarddiskVolume1'. It has stopped monitoring the volume. 12.06.2012 07:45:48, error: sr [1] - The System Restore filter encountered the unexpected error '0xC000007F' while processing the file 'da0f.rbf' on the volume 'HarddiskVolume1'. It has stopped monitoring the volume. 11.06.2012 07:42:01, error: Service Control Manager [7034] - The NVIDIA Display Driver Service service terminated unexpectedly. It has done this 1 time(s). 11.06.2012 07:05:51, error: System Error [1003] - Error code 100000be, parameter1 b69217f8, parameter2 1836c121, parameter3 b5ca749c, parameter4 0000000b. 11.06.2012 07:04:56, error: sr [1] - The System Restore filter encountered the unexpected error '0xC000007F' while processing the file 'desktop.ini' on the volume 'HarddiskVolume1'. It has stopped monitoring the volume. 10.06.2012 04:36:11, error: sr [1] - The System Restore filter encountered the unexpected error '0xC000007F' while processing the file 'Components.ini' on the volume 'HarddiskVolume1'. It has stopped monitoring the volume. 10.06.2012 03:00:22, error: Windows Update Agent [20] - Installation Failure: Windows failed to install the following update with error 0x8007f0f4: Security Update for Windows XP (KB2686509). 10.06.2012 00:35:58, error: Service Control Manager [7034] - The TektonIT - R-Server service terminated unexpectedly. It has done this 1 time(s). 10.06.2012 00:35:58, error: Service Control Manager [7023] - The System Restore Service service terminated with the following error: Access is denied. 10.06.2012 00:34:33, error: SRService [104] - The System Restore initialization process failed. 09.06.2012 07:11:07, error: sr [1] - The System Restore filter encountered the unexpected error '0xC000007F' while processing the file 'aswdefs.ini' on the volume 'HarddiskVolume1'. It has stopped monitoring the volume. . ==== End Of File ===========================

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

14 юни 201214 г.

Изтеглете ComboFix от тук или тук и го запазете на десктопа си.

Изключете вашата антивирусна и антишпионска програма, обикновено това става чрез натискане на десния бутон на мишката върху иконата на програма в системния трей.

Бележка: Ако не можете я спрете или не сте сигурни коя програма да изключите, моля прегледайте информацията от този линк: How to Disable your Security Programs

Стартирайте Combo-Fix.com и следвайте инструкциите.

Бележка: ComboFix ще се стартира без инсталирана Recovery Console.

Като част от неговата работа, ComboFix ще провери дали Microsoft Windows Recovery Console е инсталирана. Предвид бързо развиващия се зловреден софтуер е силно препоръчително да бъде инсталирана преди премахването на зловредния софтуер. Това ще Ви позволи да влезете в специален recovery/repair режим, който ще ни позволи по-лесно да решите проблем, който би могъл да възникне при премахване на зловредния софтуер.

Следвайте инструкциите, за да позволите на ComboFix да изтегли и инсталира Microsoft Windows Recovery Console. В един момент ще бъдете попитани дали сте съгласни с лицензното споразумение. Необходимо е да потвърдите, че сте съгласни, за да инсталирате Microsoft Windows Recovery Console.

** Забележете: Ако Microsoft Windows Recovery Console е вече инсталирана, ComboFix ще продължи към процеса по премахване на зловредния софтуер.

След като Microsoft Windows Recovery Console е инсталирана, използвайки ComboFix, Вие ще видите следното съобщение:

Изберете Yes, за да продължи сканирането за зловреден софтуер.

Когато процесът приключи успешно, инструментът ще създаде лог файл. Моля, включете съдържанието на C:ComboFix.txt в следващия Ви коментар в тази тема.

Бележка:

Моля, не движете мишката, докато ComboFix работи. Това може да наруши процеса на работа.
ComboFix ще нулира всички настройки на Microsoft Internet Explorer, включително да направи IE браузър по подразбиране.
ComboFix ще изключи autorun функцията на ВСИЧКИ CD, Floppy и USB устройства, за да помогне при премахването на зловредния софтуер и Ви защити от бъдещи вируси/заплахи, които поразяват чрез autorun. Ако това е проблем за вас - моля, уведомете ме.
ComboFix ще изключи вашата интернет връзка. Интернет връзката ще се възстанови автоматично, преди ComboFix да завърши процеса на работа. При проблем, той ще прекрати интернет връзката. За да възстановите интернет връзката си, рестартирайте компютъра си.
В случай на проблем с ComboFix, той може да създаде лог файл. Моля, включете съдържанието на C:BUG.txt в следващия Ви коментар в тази тема.

Моля, не прикачвайте лог файла/овете от програмата, а го/ги копирайте и поставете в следващия Ви коментар в тази тема.

14 юни 201214 г.

Автор

ComboFix 12-06-14.01 - Office 14.06.2012 20:42:02.2.1 - x86

Microsoft Windows XP Professional 5.1.2600.3.1251. 359.1033.18.1407.974 [GMT 3:00]

Running from: c:documents and settingsOfficeDesktopComboFix.exe

AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:documents and settingsLocalServiceApplication DataVvtbrse

c:documents and settingsLocalServiceApplication DataVvtbrseBrsplusprofiles.ini

c:documents and settingsOfficeApplication DataVvtbrse

c:documents and settingsOfficeApplication DataVvtbrseBrsplusprofiles.ini

c:documents and settingsOfficeWINDOWS

c:windowssystem32AdmDll.dll

c:windowssystem32r_server.exe

c:windowssystem32raddrv.dll

c:windowssystem32wbemconfig.ini

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------Legacy_r_server

-------Service_r_server

.

((((((((((((((((((((((((( Files Created from 2012-05-14 to 2012-06-14 )))))))))))))))))))))))))))))))

.

2012-06-14 16:14 . 2012-06-14 16:17 -------- d-----w- c:program filesUnlocker

2012-06-14 15:56 . 2012-06-14 15:56 -------- d--h--w- c:windowssystem32GroupPolicy

2012-06-14 15:52 . 2012-06-14 15:53 -------- d-----w- c:documents and settingsOfficeApplication DataFileZilla

2012-06-14 15:52 . 2012-06-14 15:52 -------- d-----w- c:program filesFileZilla FTP Client

2012-06-14 15:51 . 2012-06-14 15:51 -------- d-----w- c:program filesReference Assemblies

2012-06-14 15:17 . 2012-05-11 14:42 521728 -c----w- c:windowssystem32dllcachejsdbgui.dll

2012-06-14 15:13 . 2012-06-14 15:13 -------- d-----w- c:program filesCCleaner

2012-06-14 06:07 . 2012-06-14 06:07 -------- d-----w- c:documents and settingsOfficeLocal SettingsApplication DataPCHealth

2012-06-13 22:24 . 2012-06-14 11:51 316928 ----a-w- c:windowssystem32ipz.tmp

2012-06-09 21:33 . 2012-06-09 21:33 -------- d-sh--w- c:documents and settingsLocalServiceIETldCache

2012-06-09 20:56 . 2012-06-09 20:56 318464 ----a-w- c:windowssystem32ipz.exe

2012-06-04 17:22 . 2003-06-18 14:31 18944 ----a-w- c:windowssystem32Spoolprtprocsw32x86mdippr.dll

2012-06-04 17:22 . 2003-06-18 14:31 17920 ----a-w- c:windowssystem32mdimon.dll

2012-06-04 17:21 . 2012-06-04 17:21 -------- d-----w- c:program filesMicrosoft ActiveSync

2012-06-04 17:20 . 2012-06-04 17:21 -------- d-----w- c:windowsSHELLNEW

2012-06-04 17:19 . 2012-06-04 17:19 -------- d-----w- c:program filesMicrosoft.NET

2012-06-04 17:16 . 2012-06-04 17:17 -------- dc-h--w- c:windowsie8

2012-06-04 17:09 . 2011-08-16 10:45 6144 -c----w- c:windowssystem32dllcacheiecompat.dll

2012-06-04 17:00 . 2012-06-14 15:14 -------- d-sh--w- c:documents and settingsOfficeUserData

2012-06-04 16:57 . 2012-06-04 16:57 -------- d-----w- c:program filesRadmin

2012-06-04 16:33 . 2012-06-04 16:33 -------- d-----w- c:documents and settingsOfficeApplication DataMalwarebytes

2012-06-04 16:33 . 2012-06-04 16:33 -------- d-----w- c:documents and settingsAll UsersApplication DataMalwarebytes

2012-06-04 16:09 . 2012-06-04 16:09 -------- d-sh--w- c:documents and settingsNetworkServiceIETldCache

2012-06-04 12:38 . 2009-11-27 17:11 17920 -c----w- c:windowssystem32dllcachemsyuv.dll

2012-06-04 12:38 . 2009-11-27 16:07 8704 -c----w- c:windowssystem32dllcachetsbyuv.dll

2012-06-04 12:38 . 2009-11-27 16:07 48128 -c----w- c:windowssystem32dllcacheiyuv_32.dll

2012-06-04 12:37 . 2012-05-11 14:42 55296 -c----w- c:windowssystem32dllcachemsfeedsbs.dll

2012-06-04 12:37 . 2012-05-11 14:42 247808 -c----w- c:windowssystem32dllcacheieproxy.dll

2012-06-04 12:37 . 2012-05-11 14:42 12800 -c----w- c:windowssystem32dllcachexpshims.dll

2012-06-04 12:37 . 2012-05-11 14:42 743424 -c----w- c:windowssystem32dllcacheiedvtool.dll

2012-06-04 12:37 . 2012-05-11 14:42 629760 -c----w- c:windowssystem32dllcachemsfeeds.dll

2012-06-04 12:37 . 2012-05-11 14:42 2000384 -c----w- c:windowssystem32dllcacheiertutil.dll

2012-06-04 12:37 . 2011-07-15 13:29 456320 -c----w- c:windowssystem32dllcachemrxsmb.sys

2012-06-04 12:33 . 2010-02-12 10:03 293376 ------w- c:windowssystem32browserchoice.exe

2012-06-04 12:32 . 2012-05-04 13:16 2148352 -c----w- c:windowssystem32dllcachentkrnlmp.exe

2012-06-04 12:32 . 2012-05-04 13:12 2192640 -c----w- c:windowssystem32dllcachentoskrnl.exe

2012-06-04 12:32 . 2012-05-04 15:02 2069120 -c----w- c:windowssystem32dllcachentkrnlpa.exe

2012-06-04 12:32 . 2012-05-04 12:32 2026496 -c----w- c:windowssystem32dllcachentkrpamp.exe

2012-06-04 12:32 . 2012-01-11 19:06 3072 -c----w- c:windowssystem32dllcacheiacenc.dll

2012-06-04 12:32 . 2012-01-11 19:06 3072 ------w- c:windowssystem32iacenc.dll

2012-06-04 11:09 . 2008-04-13 18:15 26368 -c--a-w- c:windowssystem32dllcacheusbstor.sys

2012-06-04 09:31 . 2012-06-04 14:00 -------- d-----w- c:windowssystem32XPSViewer

2012-06-04 09:31 . 2012-06-04 09:31 -------- d-----w- c:program filesMSBuild

2012-06-04 09:30 . 2008-07-06 12:06 89088 ----a-w- c:windowssystem32Spoolprtprocsw32x86filterpipelineprintproc.dll

2012-06-04 09:26 . 2008-07-06 12:06 89088 -c----w- c:windowssystem32dllcachefilterpipelineprintproc.dll

2012-06-04 09:26 . 2008-07-06 12:06 117760 ------w- c:windowssystem32prntvpt.dll

2012-06-04 09:26 . 2008-07-06 12:06 575488 -c----w- c:windowssystem32dllcachexpsshhdr.dll

2012-06-04 09:26 . 2008-07-06 12:06 575488 ------w- c:windowssystem32xpsshhdr.dll

2012-06-04 09:26 . 2008-07-06 12:06 1676288 -c----w- c:windowssystem32dllcachexpssvcs.dll

2012-06-04 09:26 . 2008-07-06 12:06 1676288 ------w- c:windowssystem32xpssvcs.dll

2012-06-04 09:26 . 2008-07-06 10:50 597504 -c----w- c:windowssystem32dllcacheprintfilterpipelinesvc.exe

2012-06-04 09:26 . 2008-07-06 10:50 597504 ------w- c:windowssystem32Spoolprtprocsw32x86printfilterpipelinesvc.exe

2012-06-04 07:29 . 2011-01-13 02:27 333312 ------w- c:windowssystem32RWLN.dll

2012-05-31 09:42 . 2012-05-31 09:42 -------- d-----w- c:documents and settingsOfficeLocal SettingsApplication DataVvtbrse

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-06-14 16:38 . 2012-04-17 16:15 426184 ----a-w- c:windowssystem32FlashPlayerApp.exe

2012-06-14 16:38 . 2012-04-17 16:15 70344 ----a-w- c:windowssystem32FlashPlayerCPLApp.cpl

2012-05-31 13:22 . 2008-04-14 09:00 599040 ----a-w- c:windowssystem32crypt32.dll

2012-05-16 15:08 . 2009-09-09 11:13 916992 ----a-w- c:windowssystem32wininet.dll

2012-05-15 13:20 . 2009-09-09 11:13 1863168 ----a-w- c:windowssystem32win32k.sys

2012-05-11 14:42 . 2008-04-14 09:00 43520 ------w- c:windowssystem32licmgr10.dll

2012-05-11 14:42 . 2008-04-14 09:00 1469440 ------w- c:windowssystem32inetcpl.cpl

2012-05-11 11:38 . 2009-09-09 11:13 385024 ------w- c:windowssystem32html.iec

2012-05-04 15:02 . 2009-02-07 19:02 2069120 ----a-w- c:windowssystem32ntkrnlpa.exe

2012-05-04 13:12 . 2009-09-09 11:13 2192640 ----a-w- c:windowssystem32ntoskrnl.exe

2012-05-02 13:46 . 2012-04-17 15:22 139656 ----a-w- c:windowssystem32driversrdpwd.sys

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionexplorershelliconoverlayidentifiers00avast]

@="{472083B0-C522-11CF-8763-00608CC02F24}"

[HKEY_CLASSES_ROOTCLSID{472083B0-C522-11CF-8763-00608CC02F24}]

2012-03-06 23:15 123536 ----a-w- c:program filesAVAST SoftwareAvastashShell.dll

.

[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]

"uTorrent"="c:program filesuTorrentuTorrent.exe" [2012-04-17 879984]

.

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]

"avast"="c:program filesAVAST SoftwareAvastavastUI.exe" [2012-03-06 4241512]

"NvCplDaemon"="c:windowssystem32NvCpl.dll" [2006-10-31 7634944]

"nwiz"="nwiz.exe" [2006-10-31 1622016]

"RTHDCPL"="RTHDCPL.EXE" [2006-08-01 16049664]

"SkyTel"="SkyTel.EXE" [2006-05-16 2879488]

"NvMediaCenter"="c:windowssystem32NvMcTray.dll" [2006-10-31 86016]

"UnlockerAssistant"="c:program filesUnlockerUnlockerAssistant.exe" [2010-07-04 17408]

.

[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]

"CTFMON.EXE"="c:windowssystem32CTFMON.EXE" [2008-04-14 15360]

.

c:documents and settingsOfficeStart MenuProgramsStartup

Microinvest Recover.lnk - c:microPALMCOMRECOVER.EXE [2012-4-17 70177]

Microinvest Мениджър.lnk - c:microPALMCOMMST_UTIL.EXE [2012-4-17 274713]

.

[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionpoliciessystem]

"ConsentPromptBehaviorAdmin"= 0 (0x0)

.

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupreguTorrent]

2012-04-17 15:42 879984 ----a-w- c:program filesuTorrentuTorrent.exe

.

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofile]

"EnableFirewall"= 0 (0x0)

.

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]

"%windir%Network Diagnosticxpnetdiag.exe"=

"%windir%system32sessmgr.exe"=

"c:Program FilesuTorrentuTorrent.exe"=

"c:WINDOWSsystem32ntvdm.exe"=

"c:Program FilesTeamViewerVersion7TeamViewer.exe"=

"c:Program FilesTeamViewerVersion7TeamViewer_Service.exe"=

.

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileGloballyOpenPortsList]

"689:TCP"= 689:TCP:all

.

R1 aswSnx;aswSnx;c:windowssystem32driversaswSnx.sys [17.04.2012 18:44 612184]

R1 aswSP;aswSP;c:windowssystem32driversaswSP.sys [17.04.2012 18:44 337880]

R2 aswFsBlk;aswFsBlk;c:windowssystem32driversaswFsBlk.sys [17.04.2012 18:44 20696]

R2 Microsoft Console Upgrade;Microsoft Console Upgrade;c:system volume information_restore{57E7AC28-D97D-42DD-8BED-89BC89C738E1}Rp38452snapshotsystem32unxsssvchost.exe [04.06.2012 12:18 13312]

R2 Microsoft Windows Installer Upgrade;Microsoft Windows Installer Upgrade;c:system volume information_restore{57E7AC28-D97D-42DD-8BED-89BC89C738E1}Rp38452snapshotsystem32unxsssvchost.exe [04.06.2012 12:18 13312]

R2 TeamViewer7;TeamViewer 7;c:program filesTeamViewerVersion7TeamViewer_Service.exe [08.05.2012 19:52 2666880]

S1 tdx;@%SystemRoot%system32tcpipcfg.dll,-50004;c:windowssystem32DRIVERStdx.sys --> c:windowssystem32DRIVERStdx.sys [?]

S2 iphlpsvc;@%SystemRoot%system32iphlpsvc.dll,-200;c:windowsSystem32svchost.exe -k NetSvcs [14.04.2008 12:00 14336]

S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:windowssystem32MacromedFlashFlashPlayerUpdateService.exe [17.04.2012 19:15 257224]

S3 WinDefend;Windows Defender;c:windowsSystem32svchost.exe -k secsvcs [14.04.2008 12:00 14336]

.

Contents of the 'Scheduled Tasks' folder

.

2012-06-14 c:windowsTasksAdobe Flash Player Updater.job

- c:windowssystem32MacromedFlashFlashPlayerUpdateService.exe [2012-04-17 16:38]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.google.com/

uInternet Connection Wizard,ShellNext = hxxp://www.google.com/

IE: E&xport to Microsoft Excel - c:progra~1MICROS~2OFFICE11EXCEL.EXE/3000

TCP: Interfaces{CC934948-51B5-4C83-938B-583D4A40ADED}: NameServer = 192.168.10.1

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2012-06-14 20:48

Windows 5.1.2600 Service Pack 3 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINEsoftwareClassesCLSID{645FF040-5081-101B-9F08-00AA002F954E}ShellB20@O=5 *=0 *C*C*l*e*a*n*e*r*& command]

@="c:Program FilesCCleanerccleaner.exe"

.

--------------------- DLLs Loaded Under Running Processes ---------------------

.

- - - - - - - > 'explorer.exe'(1736)

c:windowssystem32WININET.dll

c:windowssystem32ieframe.dll

c:windowssystem32wpdshserviceobj.dll

c:windowssystem32webcheck.dll

c:windowssystem32portabledevicetypes.dll

c:windowssystem32portabledeviceapi.dll

.

------------------------ Other Running Processes ------------------------

.

c:program filesAVAST SoftwareAvastAvastSvc.exe

c:windowsMicrosoft.NETFrameworkv2.0.50727mscorsvw.exe

c:system volume information_restore{57E7AC28-D97D-42DD-8BED-89BC89C738E1}Rp38452snapshotsystem32unxsssafesurf.exe

c:windowssystem32nvsvc32.exe

c:system volume information_restore{57E7AC28-D97D-42DD-8BED-89BC89C738E1}Rp38452snapshotsystem32unxsvchost.exe

c:program filesTeamViewerVersion7TeamViewer.exe

c:program filesTeamViewerVersion7tv_w32.exe

c:windowssystem32wscntfy.exe

c:windowsRTHDCPL.EXE

c:windowssystem32RUNDLL32.EXE

c:windowssystem32ping.exe

.

**************************************************************************

.

Completion time: 2012-06-14 20:51:55 - machine was rebooted

ComboFix-quarantined-files.txt 2012-06-14 17:51

.

Pre-Run: 2 218 020 864 bytes free

Post-Run: 2 323 275 776 bytes free

.

- - End Of File - - 7E5192B2DC4F6D4C95A6BFE1E1A4EA9A

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

14 юни 201214 г.

Копирайте текста в карето на notepad и го запазвате с име CFScript.txt на десктопа си:

KILLALL::


Registry::
[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileGloballyOpenPortsList]
"689:TCP"=-

След съхранението преместете CFScript.txt на иконата на ComboFix.exe

Генерирания рапорт прикачете в следващия си пост..!

14 юни 201214 г.

Автор

ComboFix 12-06-14.01 - Office 14.06.2012 21:51:45.3.1 - x86

Microsoft Windows XP Professional 5.1.2600.3.1251. 359.1033.18.1407.977 [GMT 3:00]

Running from: c:documents and settingsOfficeDesktopComboFix.exe

Command switches used :: c:documents and settingsOfficeDesktopCFScript.txt