Здравейте..!Понеже съм на работа и нямам възможност да пиша...ще продължим утре...Извинявам се за забавянето ...но положението е разбираемо...!

...Ако борбата с вируси не е забавление за Вас , моля да разрешите един практичен съвет от "новобранец" като мен : Първо се консултирайте с доставчика си на Интернет-връзката . Всеки доставчик е професионално загрижен да Ви дава "чист" сигнал - т.е. още при него превантивно се проверява и чисти от вируси . По тази причина имат интерес да Ви съдействат активно за решаването на Вашия проблем безплатно .Защото иначе представяте ли си как може да се омаже вътрешната (на доставчика) мрежа...Възможно е също да има вътрешен разпространител , който те бързо ще изловят. Ако това не помогне , то е сигурен знак че трябва да смените доставчика си ! Аз съм само с AVG-free (просто за всеки случай) и повече от 10 години не съм имал някакъв проблем.....

...Ако борбата с вируси не е забавление за Вас , моля да разрешите един практичен съвет от "новобранец" като мен :

Първо се консултирайте с доставчика си на Интернет-връзката . Всеки доставчик е професионално загрижен да Ви дава "чист" сигнал - т.е. още при него превантивно се проверява и чисти от вируси . По тази причина имат интерес да Ви съдействат активно за решаването на Вашия проблем безплатно .Защото иначе представяте ли си как може да се омаже вътрешната (на доставчика) мрежа...Възможно е също да има вътрешен разпространител , който те бързо ще изловят.

Ако това не помогне , то е сигурен знак че трябва да смените доставчика си !

Аз съм само с AVG-free (просто за всеки случай) и повече от 10 години не съм имал някакъв проблем.....

А защо си мислите че това не е направено вече..?

Здравейте, аз също съм на работа в момента и довечера след 19:00 ще мога да бъда на компютъра който е заразен и го почистваме. Между другото обърнах се към доставчика ми с молба за помощ като им казах че съм подложен на бот атака точно както ме посъветва icotonev на лично и те ми отговориха че трябва да открия в компютъра си логове на Kaspersky в които трябва да има ip та та на атакуващите компютри и да им ги пратя и да видят как могат да ми помогнат. Колкото и да търсих никъде не открих такива логове, някой има ли представа как и къде да ги открия?

Редактирано 17 август 201214 г. от pranjev (преглед на промените)

Здравейте..!

Стартирайте отново TDSSKiller, съгласно инструкцията по-горе. Този път изтрийте (Delete) следното:

DeviceHarddisk0DR0 ( TDSS File System )

Здравейте, до сега бях на работа и сега се освободих. Изпълних инструкциите ви от коментар #30 и след като Kaspersky TDSSKiler изтри DeviceHarddisk0DR0 ( TDSS File System ), Kaspersky Internet Security засече това като вирус:

Packed.Win.32.TDSS.z

А контролен дневник след повторнато стартиране на TDSSKiler и изтриване на TDSS File System няма ли..? Ще бъде създаден в свободната директория на дял C: .Публикувайте го в следващоия си пост и после направете нова проверка с:

Изтрийте вашето копие на Комбофикс (като изтриете иконата от вашия десктоп)...изтеглете ново свежо копие от тук и го запазете на десктопа си.Направете нова проверка по инструкцията по горе.

Пуснах Combofix да сканира и както сканираше внезапно компютъра се рестартира, мишката стоеше напълно неподвижна докато сканираше. Всъщност ComboFix не успя и да се задържи много време да сканира - 10 15 секунди след пускането му и компютъра се рестартира... След рестарта влезнах в системния дял да потърся дали е създал лог от краткото сканиране и видях някакъв файл който се казва Combofix с размер 33.2 MБ (34,914,579 байта) с тази икона:

http://prikachi.com/...82/5153882Z.jpg

Лог не видях.

Що за файл е това и какво означава?!

Това е съдържанието на последния лог на Kaspersky TDSSKiller след като изтрих DeviceHarddisk0DR0 ( TDSS File System ):

14:05:12.0546 0632 TDSS rootkit removing tool 2.8.6.0 Aug 13 2012 17:24:05

14:05:12.0781 0632 ============================================================

14:05:12.0781 0632 Current date / time: 2012/08/18 14:05:12.0781

14:05:12.0781 0632 SystemInfo:

14:05:12.0781 0632

14:05:12.0781 0632 OS Version: 5.1.2600 ServicePack: 3.0

14:05:12.0781 0632 Product type: Workstation

14:05:12.0781 0632 ComputerName: SPUNKI-69A703F2

14:05:12.0781 0632 UserName: Spunki

14:05:12.0781 0632 Windows directory: C:WINDOWS

14:05:12.0781 0632 System windows directory: C:WINDOWS

14:05:12.0781 0632 Processor architecture: Intel x86

14:05:12.0781 0632 Number of processors: 1

14:05:12.0781 0632 Page size: 0x1000

14:05:12.0781 0632 Boot type: Normal boot

14:05:12.0781 0632 ============================================================

14:05:13.0546 0632 Drive DeviceHarddisk0DR0 - Size: 0x25432CDE00 (149.05 Gb), SectorSize: 0x200, Cylinders: 0x4C01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050

14:05:13.0546 0632 Drive DeviceHarddisk1DR1 - Size: 0x2E93D2DE00 (186.31 Gb), SectorSize: 0x200, Cylinders: 0x5EA22, SectorsPerTrack: 0x3F, TracksPerCylinder: 0x10, Type 'K0', Flags 0x00000050

14:05:13.0562 0632 ============================================================

14:05:13.0562 0632 DeviceHarddisk0DR0:

14:05:13.0562 0632 MBR partitions:

14:05:13.0562 0632 DeviceHarddisk0DR0Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x2711637

14:05:13.0562 0632 DeviceHarddisk0DR0Partition2: MBR, Type 0x7, StartLBA 0x27116B5, BlocksNum 0x1030354B

14:05:13.0562 0632 DeviceHarddisk1DR1:

14:05:13.0562 0632 MBR partitions:

14:05:13.0562 0632 DeviceHarddisk1DR1Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0xB98C041

14:05:13.0578 0632 DeviceHarddisk1DR1Partition2: MBR, Type 0x7, StartLBA 0xB98C0BF, BlocksNum 0xBAE9F61

14:05:13.0578 0632 ============================================================

14:05:13.0625 0632 D: <-> DeviceHarddisk1DR1Partition1

14:05:13.0703 0632 E: <-> DeviceHarddisk0DR0Partition2

14:05:13.0750 0632 F: <-> DeviceHarddisk1DR1Partition2

14:05:13.0765 0632 C: <-> DeviceHarddisk0DR0Partition1

14:05:13.0765 0632 ============================================================

14:05:13.0765 0632 Initialize success

14:05:13.0765 0632 ============================================================

14:06:42.0515 0992 ============================================================

14:06:42.0515 0992 Scan started

14:06:42.0515 0992 Mode: Manual; SigCheck; TDLFS;

14:06:42.0515 0992 ============================================================

14:06:42.0671 0992 ================ Scan services =============================

14:06:42.0859 0992 Abiosdsk - ok

14:06:42.0875 0992 abp480n5 - ok

14:06:42.0937 0992 [ 8fd99680a539792a30e97944fdaecf17 ] ACPI C:WINDOWSsystem32DRIVERSACPI.sys

14:06:50.0656 0992 ACPI - ok

14:06:50.0687 0992 [ 9859c0f6936e723e4892d7141b1327d5 ] ACPIEC C:WINDOWSsystem32driversACPIEC.sys

14:06:51.0609 0992 ACPIEC - ok

14:06:51.0656 0992 [ a9d3b95e8466bd58eeb8a1154654e162 ] AdobeFlashPlayerUpdateSvc C:WINDOWSsystem32MacromedFlashFlashPlayerUpdateService.exe

14:06:52.0468 0992 AdobeFlashPlayerUpdateSvc - ok

14:06:52.0515 0992 adpu160m - ok

14:06:52.0578 0992 [ 8bed39e3c35d6a489438b8141717a557 ] aec C:WINDOWSsystem32driversaec.sys

14:06:53.0468 0992 aec - ok

14:06:53.0515 0992 [ 322d0e36693d6e24a2398bee62a268cd ] AFD C:WINDOWSSystem32driversafd.sys

14:06:54.0437 0992 AFD - ok

14:06:54.0453 0992 Aha154x - ok

14:06:54.0500 0992 aic78u2 - ok

14:06:54.0562 0992 aic78xx - ok

14:06:54.0671 0992 [ 9a6aa923f00d368c8ad3bd7485d5cdca ] ALCXWDM C:WINDOWSsystem32driversALCXWDM.SYS

14:06:55.0281 0992 ALCXWDM - ok

14:06:55.0312 0992 [ a9a3daa780ca6c9671a19d52456705b4 ] Alerter C:WINDOWSsystem32alrsvc.dll

14:06:56.0218 0992 Alerter - ok

14:06:56.0250 0992 [ 8c515081584a38aa007909cd02020b3d ] ALG C:WINDOWSSystem32alg.exe

14:06:56.0906 0992 ALG - ok

14:06:56.0921 0992 AliIde - ok

14:06:56.0984 0992 [ 59301936898ae62245a6f09c0aba9475 ] AmdK8 C:WINDOWSsystem32DRIVERSAmdK8.sys

14:06:58.0234 0992 AmdK8 - ok

14:06:58.0296 0992 amsint - ok

14:06:58.0343 0992 [ d8849f77c0b66226335a59d26cb4edc6 ] AppMgmt C:WINDOWSSystem32appmgmts.dll

14:06:59.0046 0992 AppMgmt - ok

14:06:59.0078 0992 asc - ok

14:06:59.0093 0992 asc3350p - ok

14:06:59.0125 0992 asc3550 - ok

14:06:59.0312 0992 [ d33c507942299753868204cc7642fa27 ] aspnet_state C:WINDOWSMicrosoft.NETFrameworkv2.0.50727aspnet_state.exe

14:06:59.0734 0992 aspnet_state - ok

14:06:59.0796 0992 [ b153affac761e7f5fcfa822b9c4e97bc ] AsyncMac C:WINDOWSsystem32DRIVERSasyncmac.sys

14:07:00.0671 0992 AsyncMac - ok

14:07:00.0703 0992 [ 9f3a2f5aa6875c72bf062c712cfa2674 ] atapi C:WINDOWSsystem32DRIVERSatapi.sys

14:07:01.0625 0992 atapi - ok

14:07:01.0625 0992 Atdisk - ok

14:07:01.0750 0992 [ 29b2874b3956b62c0dbea32d75a8e776 ] Ati HotKey Poller C:WINDOWSsystem32Ati2evxx.exe

14:07:02.0390 0992 Ati HotKey Poller - ok

14:07:02.0468 0992 [ 0fe888957dee9cdbf09642cbcc9779d3 ] ATI Smart C:WINDOWSsystem32ati2sgag.exe

14:07:02.0890 0992 ATI Smart ( UnsignedFile.Multi.Generic ) - warning

14:07:02.0890 0992 ATI Smart - detected UnsignedFile.Multi.Generic (1)

14:07:02.0984 0992 [ a1789368b4a31d2111af7aeda0c8d3fc ] ati2mtag C:WINDOWSsystem32DRIVERSati2mtag.sys

14:07:04.0031 0992 ati2mtag - ok

14:07:04.0093 0992 [ 9916c1225104ba14794209cfa8012159 ] Atmarpc C:WINDOWSsystem32DRIVERSatmarpc.sys

14:07:04.0968 0992 Atmarpc - ok

14:07:05.0015 0992 [ def7a7882bec100fe0b2ce2549188f9d ] AudioSrv C:WINDOWSSystem32audiosrv.dll

14:07:05.0765 0992 AudioSrv - ok

14:07:05.0796 0992 [ d9f724aa26c010a217c97606b160ed68 ] audstub C:WINDOWSsystem32DRIVERSaudstub.sys

14:07:06.0640 0992 audstub - ok

14:07:06.0750 0992 [ 2718dc27571bd1e37813f5759d2dc118 ] AVP C:Program FilesKaspersky LabKaspersky Internet Security 2012avp.exe

14:07:07.0921 0992 AVP - ok

14:07:08.0015 0992 [ da1f27d85e0d1525f6621372e7b685e9 ] Beep C:WINDOWSsystem32driversBeep.sys

14:07:08.0375 0992 Beep - ok

14:07:08.0437 0992 [ 574738f61fca2935f5265dc4e5691314 ] BITS C:WINDOWSsystem32qmgr.dll

14:07:08.0703 0992 BITS - ok

14:07:08.0750 0992 [ a06ce3399d16db864f55faeb1f1927a9 ] Browser C:WINDOWSSystem32browser.dll

14:07:08.0968 0992 Browser - ok

14:07:09.0062 0992 catchme - ok

14:07:09.0125 0992 [ 90a673fc8e12a79afbed2576f6a7aaf9 ] cbidf2k C:WINDOWSsystem32driverscbidf2k.sys

14:07:09.0359 0992 cbidf2k - ok

14:07:09.0390 0992 [ 0be5aef125be881c4f854c554f2b025c ] CCDECODE C:WINDOWSsystem32DRIVERSCCDECODE.sys

14:07:09.0625 0992 CCDECODE - ok

14:07:09.0625 0992 cd20xrnt - ok

14:07:09.0687 0992 [ c1b486a7658353d33a10cc15211a873b ] Cdaudio C:WINDOWSsystem32driversCdaudio.sys

14:07:09.0906 0992 Cdaudio - ok

14:07:09.0968 0992 [ c885b02847f5d2fd45a24e219ed93b32 ] Cdfs C:WINDOWSsystem32driversCdfs.sys

14:07:10.0187 0992 Cdfs - ok

14:07:10.0234 0992 [ 1f4260cc5b42272d71f79e570a27a4fe ] Cdrom C:WINDOWSsystem32DRIVERScdrom.sys

14:07:10.0421 0992 Cdrom - ok

14:07:10.0437 0992 Changer - ok

14:07:10.0484 0992 [ 1cfe720eb8d93a7158a4ebc3ab178bde ] CiSvc C:WINDOWSsystem32cisvc.exe

14:07:10.0703 0992 CiSvc - ok

14:07:10.0750 0992 [ 34cbe729f38138217f9c80212a2a0c82 ] ClipSrv C:WINDOWSsystem32clipsrv.exe

14:07:10.0968 0992 ClipSrv - ok

14:07:11.0000 0992 [ 3c4d595e7f9b747325aef28b4adcaae5 ] clr_optimization_v2.0.50727_32 C:WINDOWSMicrosoft.NETFrameworkv2.0.50727mscorsvw.exe

14:07:11.0046 0992 clr_optimization_v2.0.50727_32 - ok

14:07:11.0093 0992 CmdIde - ok

14:07:11.0125 0992 COMSysApp - ok

14:07:11.0187 0992 Cpqarray - ok

14:07:11.0234 0992 [ 3d4e199942e29207970e04315d02ad3b ] CryptSvc C:WINDOWSSystem32cryptsvc.dll

14:07:11.0453 0992 CryptSvc - ok

14:07:11.0484 0992 dac2w2k - ok

14:07:11.0515 0992 dac960nt - ok

14:07:11.0578 0992 [ 2589fe6015a316c0f5d5112b4da7b509 ] DcomLaunch C:WINDOWSsystem32rpcss.dll

14:07:11.0781 0992 DcomLaunch - ok

14:07:11.0828 0992 [ 5e38d7684a49cacfb752b046357e0589 ] Dhcp C:WINDOWSSystem32dhcpcsvc.dll

14:07:12.0031 0992 Dhcp - ok

14:07:12.0062 0992 [ 044452051f3e02e7963599fc8f4f3e25 ] Disk C:WINDOWSsystem32DRIVERSdisk.sys

14:07:12.0281 0992 Disk - ok

14:07:12.0296 0992 dmadmin - ok

14:07:12.0359 0992 [ d992fe1274bde0f84ad826acae022a41 ] dmboot C:WINDOWSsystem32driversdmboot.sys

14:07:12.0625 0992 dmboot - ok

14:07:12.0656 0992 [ 7c824cf7bbde77d95c08005717a95f6f ] dmio C:WINDOWSsystem32driversdmio.sys

14:07:12.0890 0992 dmio - ok

14:07:12.0937 0992 [ e9317282a63ca4d188c0df5e09c6ac5f ] dmload C:WINDOWSsystem32driversdmload.sys

14:07:13.0140 0992 dmload - ok

14:07:13.0171 0992 [ 57edec2e5f59f0335e92f35184bc8631 ] dmserver C:WINDOWSSystem32dmserver.dll

14:07:13.0390 0992 dmserver - ok

14:07:13.0453 0992 [ 8a208dfcf89792a484e76c40e5f50b45 ] DMusic C:WINDOWSsystem32driversDMusic.sys

14:07:13.0671 0992 DMusic - ok

14:07:13.0703 0992 [ 474b4dc3983173e4b4c9740b0dac98a6 ] Dnscache C:WINDOWSSystem32dnsrslvr.dll

14:07:13.0921 0992 Dnscache - ok

14:07:13.0968 0992 [ 0f0f6e687e5e15579ef4da8dd6945814 ] Dot3svc C:WINDOWSSystem32dot3svc.dll

14:07:14.0171 0992 Dot3svc - ok

14:07:14.0203 0992 dpti2o - ok

14:07:14.0234 0992 [ 8f5fcff8e8848afac920905fbd9d33c8 ] drmkaud C:WINDOWSsystem32driversdrmkaud.sys

14:07:14.0453 0992 drmkaud - ok

14:07:14.0500 0992 [ 2187855a7703adef0cef9ee4285182cc ] EapHost C:WINDOWSSystem32eapsvc.dll

14:07:14.0703 0992 EapHost - ok

14:07:14.0718 0992 [ bc93b4a066477954555966d77fec9ecb ] ERSvc C:WINDOWSSystem32ersvc.dll

14:07:14.0921 0992 ERSvc - ok

14:07:14.0953 0992 [ 0e776ed5f7cc9f94299e70461b7b8185 ] Eventlog C:WINDOWSsystem32services.exe

14:07:15.0171 0992 Eventlog - ok

14:07:15.0203 0992 [ 19a799805b24990867b00c120d300c3a ] EventSystem C:WINDOWSsystem32es.dll

14:07:15.0421 0992 EventSystem - ok

14:07:15.0453 0992 [ 38d332a6d56af32635675f132548343e ] Fastfat C:WINDOWSsystem32driversFastfat.sys

14:07:15.0671 0992 Fastfat - ok

14:07:15.0718 0992 [ 1926899bf9ffe2602b63074971700412 ] FastUserSwitchingCompatibility C:WINDOWSSystem32shsvcs.dll

14:07:15.0906 0992 FastUserSwitchingCompatibility - ok

14:07:15.0937 0992 [ 92cdd60b6730b9f50f6a1a0c1f8cdc81 ] Fdc C:WINDOWSsystem32DRIVERSfdc.sys

14:07:16.0156 0992 Fdc - ok

14:07:16.0187 0992 [ d45926117eb9fa946a6af572fbe1caa3 ] Fips C:WINDOWSsystem32driversFips.sys

14:07:16.0390 0992 Fips - ok

14:07:16.0437 0992 [ 9d27e7b80bfcdf1cdd9b555862d5e7f0 ] Flpydisk C:WINDOWSsystem32DRIVERSflpydisk.sys

14:07:16.0656 0992 Flpydisk - ok

14:07:16.0703 0992 [ b2cf4b0786f8212cb92ed2b50c6db6b0 ] FltMgr C:WINDOWSsystem32DRIVERSfltMgr.sys

14:07:16.0921 0992 FltMgr - ok

14:07:16.0937 0992 [ 3e1e2bd4f39b0e2b7dc4f4d2bcc2779a ] Fs_Rec C:WINDOWSsystem32driversFs_Rec.sys

14:07:17.0125 0992 Fs_Rec - ok

14:07:17.0156 0992 [ 6ac26732762483366c3969c9e4d2259d ] Ftdisk C:WINDOWSsystem32DRIVERSftdisk.sys

14:07:17.0359 0992 Ftdisk - ok

14:07:17.0390 0992 [ 065639773d8b03f33577f6cdaea21063 ] gameenum C:WINDOWSsystem32DRIVERSgameenum.sys

14:07:17.0593 0992 gameenum - ok

14:07:17.0625 0992 [ 0a02c63c8b144bd8c86b103dee7c86a2 ] Gpc C:WINDOWSsystem32DRIVERSmsgpc.sys

14:07:17.0828 0992 Gpc - ok

14:07:17.0890 0992 [ 4fcca060dfe0c51a09dd5c3843888bcd ] helpsvc C:WINDOWSPCHealthHelpCtrBinariespchsvc.dll

14:07:18.0093 0992 helpsvc - ok

14:07:18.0109 0992 HidServ - ok

14:07:18.0171 0992 [ ccf82c5ec8a7326c3066de870c06daf1 ] HidUsb C:WINDOWSsystem32DRIVERShidusb.sys

14:07:18.0375 0992 HidUsb - ok

14:07:18.0421 0992 [ 8878bd685e490239777bfe51320b88e9 ] hkmsvc C:WINDOWSSystem32kmsvc.dll

14:07:18.0625 0992 hkmsvc - ok

14:07:18.0656 0992 hpn - ok

14:07:18.0703 0992 [ f6aacf5bce2893e0c1754afeb672e5c9 ] HTTP C:WINDOWSsystem32DriversHTTP.sys

14:07:19.0125 0992 HTTP - ok

14:07:19.0171 0992 [ 6100a808600f44d999cebdef8841c7a3 ] HTTPFilter C:WINDOWSSystem32w3ssl.dll

14:07:19.0375 0992 HTTPFilter - ok

14:07:19.0406 0992 i2omgmt - ok

14:07:19.0437 0992 i2omp - ok

14:07:19.0500 0992 [ 4a0b06aa8943c1e332520f7440c0aa30 ] i8042prt C:WINDOWSsystem32DRIVERSi8042prt.sys

14:07:19.0703 0992 i8042prt - ok

14:07:19.0718 0992 [ 330a6a0baf4fd945bde14c7b1d88d9b9 ] IDMTDI C:WINDOWSsystem32DRIVERSidmtdi.sys

14:07:19.0750 0992 IDMTDI - ok

14:07:19.0796 0992 [ 083a052659f5310dd8b6a6cb05edcf8e ] Imapi C:WINDOWSsystem32DRIVERSimapi.sys

14:07:20.0078 0992 Imapi - ok

14:07:20.0125 0992 [ 30deaf54a9755bb8546168cfe8a6b5e1 ] ImapiService C:WINDOWSsystem32imapi.exe

14:07:20.0359 0992 ImapiService - ok

14:07:20.0390 0992 ini910u - ok

14:07:20.0437 0992 IntelIde - ok

14:07:20.0468 0992 [ 3bb22519a194418d5fec05d800a19ad0 ] Ip6Fw C:WINDOWSsystem32DRIVERSIp6Fw.sys

14:07:20.0687 0992 Ip6Fw - ok

14:07:20.0718 0992 [ 731f22ba402ee4b62748adaf6363c182 ] IpFilterDriver C:WINDOWSsystem32DRIVERSipfltdrv.sys

14:07:20.0937 0992 IpFilterDriver - ok

14:07:20.0953 0992 [ b87ab476dcf76e72010632b5550955f5 ] IpInIp C:WINDOWSsystem32DRIVERSipinip.sys

14:07:21.0171 0992 IpInIp - ok

14:07:21.0203 0992 [ cc748ea12c6effde940ee98098bf96bb ] IpNat C:WINDOWSsystem32DRIVERSipnat.sys

14:07:21.0437 0992 IpNat - ok

14:07:21.0484 0992 [ 23c74d75e36e7158768dd63d92789a91 ] IPSec C:WINDOWSsystem32DRIVERSipsec.sys

14:07:21.0718 0992 IPSec - ok

14:07:21.0765 0992 [ c93c9ff7b04d772627a3646d89f7bf89 ] IRENUM C:WINDOWSsystem32DRIVERSirenum.sys

14:07:21.0859 0992 IRENUM - ok

14:07:21.0921 0992 [ 05a299ec56e52649b1cf2fc52d20f2d7 ] isapnp C:WINDOWSsystem32DRIVERSisapnp.sys

14:07:22.0140 0992 isapnp - ok

14:07:22.0187 0992 [ 463c1ec80cd17420a542b7f36a36f128 ] Kbdclass C:WINDOWSsystem32DRIVERSkbdclass.sys

14:07:22.0421 0992 Kbdclass - ok

14:07:22.0468 0992 [ 186b54479d98e48aee0e9ada4b3c4d31 ] KL1 C:WINDOWSsystem32DRIVERSkl1.sys

14:07:22.0500 0992 KL1 - ok

14:07:22.0546 0992 [ bf485bfba13c0ab116701fd9c55324d0 ] kl2 C:WINDOWSsystem32DRIVERSkl2.sys

14:07:22.0578 0992 kl2 - ok

14:07:22.0640 0992 [ 5d92a03045a6a98708975b3d77b39a36 ] KLIF C:WINDOWSsystem32DRIVERSklif.sys

14:07:22.0671 0992 KLIF - ok

14:07:22.0718 0992 [ 96a7ec308a93da26dfe481308baac2a2 ] klim5 C:WINDOWSsystem32DRIVERSklim5.sys

14:07:22.0750 0992 klim5 - ok

14:07:22.0781 0992 [ 3959530f69e19da56f1f24f2c89f1e2c ] klmouflt C:WINDOWSsystem32DRIVERSklmouflt.sys

14:07:22.0796 0992 klmouflt - ok

14:07:22.0859 0992 [ 692bcf44383d056aed41b045a323d378 ] kmixer C:WINDOWSsystem32driverskmixer.sys

14:07:23.0093 0992 kmixer - ok

14:07:23.0125 0992 [ 1705745d900dabf2d89f90ebaddc7517 ] KSecDD C:WINDOWSsystem32driversKSecDD.sys

14:07:23.0328 0992 KSecDD - ok

14:07:23.0390 0992 [ f385f4b02c535bffe1d70cab80838123 ] LanmanServer C:WINDOWSSystem32srvsvc.dll

14:07:23.0578 0992 LanmanServer - ok

14:07:23.0640 0992 [ 1b67b632786fef1c1bbaef46c2f3f2e6 ] lanmanworkstation C:WINDOWSSystem32wkssvc.dll

14:07:23.0828 0992 lanmanworkstation - ok

14:07:23.0875 0992 lbrtfdc - ok

14:07:23.0937 0992 [ a7db739ae99a796d91580147e919cc59 ] LmHosts C:WINDOWSSystem32lmhsvc.dll

14:07:24.0375 0992 LmHosts - ok

14:07:24.0421 0992 [ 6dfe7f2e8e8a337263aa5c92a215f161 ] MBAMProtector C:WINDOWSsystem32driversmbam.sys

14:07:24.0437 0992 MBAMProtector - ok

14:07:24.0578 0992 [ 43683e970f008c93c9429ef428147a54 ] MBAMService C:Program FilesMalwarebytes' Anti-Malwarembamservice.exe

14:07:24.0625 0992 MBAMService - ok

14:07:24.0671 0992 [ 986b1ff5814366d71e0ac5755c88f2d3 ] Messenger C:WINDOWSSystem32msgsvc.dll

14:07:24.0890 0992 Messenger - ok

14:07:24.0906 0992 [ 4ae068242760a1fb6e1a44bf4e16afa6 ] mnmdd C:WINDOWSsystem32driversmnmdd.sys

14:07:25.0140 0992 mnmdd - ok

14:07:25.0171 0992 [ d18f1f0c101d06a1c1adf26eed16fcdd ] mnmsrvc C:WINDOWSsystem32mnmsrvc.exe

14:07:25.0406 0992 mnmsrvc - ok

14:07:25.0437 0992 [ dfcbad3cec1c5f964962ae10e0bcc8e1 ] Modem C:WINDOWSsystem32driversModem.sys

14:07:25.0640 0992 Modem - ok

14:07:25.0671 0992 [ 35c9e97194c8cfb8430125f8dbc34d04 ] Mouclass C:WINDOWSsystem32DRIVERSmouclass.sys

14:07:25.0859 0992 Mouclass - ok

14:07:25.0906 0992 [ b1c303e17fb9d46e87a98e4ba6769685 ] mouhid C:WINDOWSsystem32DRIVERSmouhid.sys

14:07:26.0078 0992 mouhid - ok

14:07:26.0109 0992 [ a80b9a0bad1b73637dbcbba7df72d3fd ] MountMgr C:WINDOWSsystem32driversMountMgr.sys

14:07:26.0312 0992 MountMgr - ok

14:07:26.0343 0992 mraid35x - ok

14:07:26.0375 0992 [ 11d42bb6206f33fbb3ba0288d3ef81bd ] MRxDAV C:WINDOWSsystem32DRIVERSmrxdav.sys

14:07:26.0578 0992 MRxDAV - ok

14:07:26.0640 0992 [ 68755f0ff16070178b54674fe5b847b0 ] MRxSmb C:WINDOWSsystem32DRIVERSmrxsmb.sys

14:07:26.0859 0992 MRxSmb - ok

14:07:26.0906 0992 [ a137f1470499a205abbb9aafb3b6f2b1 ] MSDTC C:WINDOWSsystem32msdtc.exe

14:07:27.0078 0992 MSDTC - ok

14:07:27.0125 0992 [ c941ea2454ba8350021d774daf0f1027 ] Msfs C:WINDOWSsystem32driversMsfs.sys

14:07:27.0328 0992 Msfs - ok

14:07:27.0343 0992 MSIServer - ok

14:07:27.0390 0992 [ d1575e71568f4d9e14ca56b7b0453bf1 ] MSKSSRV C:WINDOWSsystem32driversMSKSSRV.sys

14:07:27.0609 0992 MSKSSRV - ok

14:07:27.0640 0992 [ 325bb26842fc7ccc1fcce2c457317f3e ] MSPCLOCK C:WINDOWSsystem32driversMSPCLOCK.sys

14:07:28.0000 0992 MSPCLOCK - ok

14:07:28.0015 0992 [ bad59648ba099da4a17680b39730cb3d ] MSPQM C:WINDOWSsystem32driversMSPQM.sys

14:07:28.0296 0992 MSPQM - ok

14:07:28.0343 0992 [ af5f4f3f14a8ea2c26de30f7a1e17136 ] mssmbios C:WINDOWSsystem32DRIVERSmssmbios.sys

14:07:28.0546 0992 mssmbios - ok

14:07:28.0593 0992 [ e53736a9e30c45fa9e7b5eac55056d1d ] MSTEE C:WINDOWSsystem32driversMSTEE.sys

14:07:28.0796 0992 MSTEE - ok

14:07:28.0828 0992 [ 2f625d11385b1a94360bfc70aaefdee1 ] Mup C:WINDOWSsystem32driversMup.sys

14:07:29.0015 0992 Mup - ok

14:07:29.0062 0992 [ 5b50f1b2a2ed47d560577b221da734db ] NABTSFEC C:WINDOWSsystem32DRIVERSNABTSFEC.sys

14:07:29.0250 0992 NABTSFEC - ok

14:07:29.0281 0992 [ 0102140028fad045756796e1c685d695 ] napagent C:WINDOWSSystem32qagentrt.dll

14:07:29.0546 0992 napagent - ok

14:07:29.0593 0992 [ 1df7f42665c94b825322fae71721130d ] NDIS C:WINDOWSsystem32driversNDIS.sys

14:07:29.0812 0992 NDIS - ok

14:07:29.0828 0992 [ 7ff1f1fd8609c149aa432f95a8163d97 ] NdisIP C:WINDOWSsystem32DRIVERSNdisIP.sys

14:07:30.0031 0992 NdisIP - ok

14:07:30.0062 0992 [ 1ab3d00c991ab086e69db84b6c0ed78f ] NdisTapi C:WINDOWSsystem32DRIVERSndistapi.sys

14:07:30.0265 0992 NdisTapi - ok

14:07:30.0296 0992 [ f927a4434c5028758a842943ef1a3849 ] Ndisuio C:WINDOWSsystem32DRIVERSndisuio.sys

14:07:30.0484 0992 Ndisuio - ok

14:07:30.0546 0992 [ edc1531a49c80614b2cfda43ca8659ab ] NdisWan C:WINDOWSsystem32DRIVERSndiswan.sys

14:07:30.0734 0992 NdisWan - ok

14:07:30.0796 0992 [ 6215023940cfd3702b46abc304e1d45a ] NDProxy C:WINDOWSsystem32driversNDProxy.sys

14:07:30.0968 0992 NDProxy - ok

14:07:31.0015 0992 [ 5d81cf9a2f1a3a756b66cf684911cdf0 ] NetBIOS C:WINDOWSsystem32DRIVERSnetbios.sys

14:07:31.0218 0992 NetBIOS - ok

14:07:31.0250 0992 [ 74b2b2f5bea5e9a3dc021d685551bd3d ] NetBT C:WINDOWSsystem32DRIVERSnetbt.sys

14:07:31.0437 0992 NetBT - ok

14:07:31.0468 0992 [ b857ba82860d7ff85ae29b095645563b ] NetDDE C:WINDOWSsystem32netdde.exe

14:07:31.0671 0992 NetDDE - ok

14:07:31.0718 0992 [ b857ba82860d7ff85ae29b095645563b ] NetDDEdsdm C:WINDOWSsystem32netdde.exe

14:07:31.0890 0992 NetDDEdsdm - ok

14:07:31.0906 0992 [ bf2466b3e18e970d8a976fb95fc1ca85 ] Netlogon C:WINDOWSsystem32lsass.exe

14:07:32.0109 0992 Netlogon - ok

14:07:32.0171 0992 [ 13e67b55b3abd7bf3fe7aae5a0f9a9de ] Netman C:WINDOWSSystem32netman.dll

14:07:32.0359 0992 Netman - ok

14:07:32.0406 0992 [ b4138e99236f0f57d4cf49bae98a0746 ] Nla C:WINDOWSSystem32mswsock.dll

14:07:32.0609 0992 Nla - ok

14:07:32.0656 0992 [ 3182d64ae053d6fb034f44b6def8034a ] Npfs C:WINDOWSsystem32driversNpfs.sys

14:07:32.0859 0992 Npfs - ok

14:07:32.0906 0992 [ 78a08dd6a8d65e697c18e1db01c5cdca ] Ntfs C:WINDOWSsystem32driversNtfs.sys

14:07:33.0156 0992 Ntfs - ok

14:07:33.0187 0992 [ bf2466b3e18e970d8a976fb95fc1ca85 ] NtLmSsp C:WINDOWSsystem32lsass.exe

14:07:33.0375 0992 NtLmSsp - ok

14:07:33.0421 0992 [ 156f64a3345bd23c600655fb4d10bc08 ] NtmsSvc C:WINDOWSsystem32ntmssvc.dll

14:07:33.0640 0992 NtmsSvc - ok

14:07:33.0687 0992 [ 73c1e1f395918bc2c6dd67af7591a3ad ] Null C:WINDOWSsystem32driversNull.sys

14:07:33.0859 0992 Null - ok

14:07:33.0906 0992 [ 46deed4c6c5fa765f9a2c723be60348d ] nvatabus C:WINDOWSsystem32DRIVERSnvatabus.sys

14:07:33.0968 0992 nvatabus - ok

14:07:34.0000 0992 [ a5c77d944410fadee380fb20b432760d ] nvraid C:WINDOWSsystem32DRIVERSnvraid.sys

14:07:34.0046 0992 nvraid - ok

14:07:34.0093 0992 [ 3194e2f6c9000c39dcf9d0580754f714 ] nv_agp C:WINDOWSsystem32DRIVERSnv_agp.sys

14:07:34.0140 0992 nv_agp - ok

14:07:34.0187 0992 [ b305f3fad35083837ef46a0bbce2fc57 ] NwlnkFlt C:WINDOWSsystem32DRIVERSnwlnkflt.sys

14:07:34.0375 0992 NwlnkFlt - ok

14:07:34.0406 0992 [ c99b3415198d1aab7227f2c88fd664b9 ] NwlnkFwd C:WINDOWSsystem32DRIVERSnwlnkfwd.sys

14:07:34.0640 0992 NwlnkFwd - ok

14:07:34.0687 0992 [ 5575faf8f97ce5e713d108c2a58d7c7c ] Parport C:WINDOWSsystem32DRIVERSparport.sys

14:07:34.0875 0992 Parport - ok

14:07:34.0890 0992 [ beb3ba25197665d82ec7065b724171c6 ] PartMgr C:WINDOWSsystem32driversPartMgr.sys

14:07:35.0078 0992 PartMgr - ok

14:07:35.0109 0992 [ 70e98b3fd8e963a6a46a2e6247e0bea1 ] ParVdm C:WINDOWSsystem32driversParVdm.sys

14:07:35.0359 0992 ParVdm - ok

14:07:35.0375 0992 [ a219903ccf74233761d92bef471a07b1 ] PCI C:WINDOWSsystem32DRIVERSpci.sys

14:07:35.0546 0992 PCI - ok

14:07:35.0578 0992 PCIDump - ok

14:07:35.0609 0992 [ ccf5f451bb1a5a2a522a76e670000ff0 ] PCIIde C:WINDOWSsystem32DRIVERSpciide.sys

14:07:35.0843 0992 PCIIde - ok

14:07:35.0875 0992 [ 9e89ef60e9ee05e3f2eef2da7397f1c1 ] Pcmcia C:WINDOWSsystem32driversPcmcia.sys

14:07:36.0171 0992 Pcmcia - ok

14:07:36.0203 0992 PDCOMP - ok

14:07:36.0234 0992 PDFRAME - ok

14:07:36.0265 0992 PDRELI - ok

14:07:36.0296 0992 PDRFRAME - ok

14:07:36.0343 0992 perc2 - ok

14:07:36.0406 0992 perc2hib - ok

14:07:36.0593 0992 [ 0e776ed5f7cc9f94299e70461b7b8185 ] PlugPlay C:WINDOWSsystem32services.exe

14:07:36.0968 0992 PlugPlay - ok

14:07:37.0031 0992 [ bf2466b3e18e970d8a976fb95fc1ca85 ] PolicyAgent C:WINDOWSsystem32lsass.exe

14:07:37.0250 0992 PolicyAgent - ok

14:07:37.0281 0992 [ efeec01b1d3cf84f16ddd24d9d9d8f99 ] PptpMiniport C:WINDOWSsystem32DRIVERSraspptp.sys

14:07:37.0546 0992 PptpMiniport - ok

14:07:37.0609 0992 [ a32bebaf723557681bfc6bd93e98bd26 ] Processor C:WINDOWSsystem32DRIVERSprocessr.sys

14:07:37.0828 0992 Processor - ok

14:07:37.0875 0992 [ bf2466b3e18e970d8a976fb95fc1ca85 ] ProtectedStorage C:WINDOWSsystem32lsass.exe

14:07:38.0046 0992 ProtectedStorage - ok

14:07:38.0093 0992 [ 09298ec810b07e5d582cb3a3f9255424 ] PSched C:WINDOWSsystem32DRIVERSpsched.sys

14:07:38.0296 0992 PSched - ok

14:07:38.0312 0992 [ 80d317bd1c3dbc5d4fe7b1678c60cadd ] Ptilink C:WINDOWSsystem32DRIVERSptilink.sys

14:07:38.0515 0992 Ptilink - ok

14:07:38.0531 0992 ql1080 - ok

14:07:38.0562 0992 Ql10wnt - ok

14:07:38.0609 0992 ql12160 - ok

14:07:38.0640 0992 ql1240 - ok

14:07:38.0671 0992 ql1280 - ok

14:07:38.0718 0992 [ fe0d99d6f31e4fad8159f690d68ded9c ] RasAcd C:WINDOWSsystem32DRIVERSrasacd.sys

14:07:39.0250 0992 RasAcd - ok

14:07:39.0312 0992 [ ad188be7bdf94e8df4ca0a55c00a5073 ] RasAuto C:WINDOWSSystem32rasauto.dll

14:07:39.0906 0992 RasAuto - ok

14:07:39.0953 0992 [ 11b4a627bc9614b885c4969bfa5ff8a6 ] Rasl2tp C:WINDOWSsystem32DRIVERSrasl2tp.sys

14:07:41.0390 0992 Rasl2tp - ok

14:07:41.0437 0992 [ 76a9a3cbeadd68cc57cda5e1d7448235 ] RasMan C:WINDOWSSystem32rasmans.dll

14:07:42.0265 0992 RasMan - ok

14:07:42.0296 0992 [ 5bc962f2654137c9909c3d4603587dee ] RasPppoe C:WINDOWSsystem32DRIVERSraspppoe.sys

14:07:42.0937 0992 RasPppoe - ok

14:07:42.0968 0992 [ fdbb1d60066fcfbb7452fd8f9829b242 ] Raspti C:WINDOWSsystem32DRIVERSraspti.sys

14:07:43.0156 0992 Raspti - ok

14:07:43.0203 0992 [ 7ad224ad1a1437fe28d89cf22b17780a ] Rdbss C:WINDOWSsystem32DRIVERSrdbss.sys

14:07:43.0406 0992 Rdbss - ok

14:07:43.0453 0992 [ 4912d5b403614ce99c28420f75353332 ] RDPCDD C:WINDOWSsystem32DRIVERSRDPCDD.sys

14:07:43.0625 0992 RDPCDD - ok

14:07:43.0703 0992 [ 15cabd0f7c00c47c70124907916af3f1 ] rdpdr C:WINDOWSsystem32DRIVERSrdpdr.sys

14:07:43.0937 0992 rdpdr - ok

14:07:44.0015 0992 [ 6728e45b66f93c08f11de2e316fc70dd ] RDPWD C:WINDOWSsystem32driversRDPWD.sys

14:07:44.0187 0992 RDPWD - ok

14:07:44.0234 0992 [ 3c37bf86641bda977c3bf8a840f3b7fa ] RDSessMgr C:WINDOWSsystem32sessmgr.exe

14:07:44.0421 0992 RDSessMgr - ok

14:07:44.0453 0992 [ f828dd7e1419b6653894a8f97a0094c5 ] redbook C:WINDOWSsystem32DRIVERSredbook.sys

14:07:44.0640 0992 redbook - ok

14:07:44.0671 0992 [ 7e699ff5f59b5d9de5390e3c34c67cf5 ] RemoteAccess C:WINDOWSSystem32mprdim.dll

14:07:44.0875 0992 RemoteAccess - ok

14:07:44.0906 0992 [ 5b19b557b0c188210a56a6b699d90b8f ] RemoteRegistry C:WINDOWSsystem32regsvc.dll

14:07:45.0093 0992 RemoteRegistry - ok

14:07:45.0125 0992 [ aaed593f84afa419bbae8572af87cf6a ] RpcLocator C:WINDOWSsystem32locator.exe

14:07:45.0312 0992 RpcLocator - ok

14:07:45.0343 0992 [ 2589fe6015a316c0f5d5112b4da7b509 ] RpcSs C:WINDOWSSystem32rpcss.dll

14:07:45.0531 0992 RpcSs - ok

14:07:45.0578 0992 [ 471b3f9741d762abe75e9deea4787e47 ] RSVP C:WINDOWSsystem32rsvp.exe

14:07:45.0750 0992 RSVP - ok

14:07:45.0781 0992 [ d507c1400284176573224903819ffda3 ] rtl8139 C:WINDOWSsystem32DRIVERSRTL8139.SYS

14:07:45.0968 0992 rtl8139 - ok

14:07:46.0000 0992 [ bf2466b3e18e970d8a976fb95fc1ca85 ] SamSs C:WINDOWSsystem32lsass.exe

14:07:46.0156 0992 SamSs - ok

14:07:46.0171 0992 [ 86d007e7a654b9a71d1d7d856b104353 ] SCardSvr C:WINDOWSSystem32SCardSvr.exe

14:07:46.0359 0992 SCardSvr - ok

14:07:46.0421 0992 [ 0a9a7365a1ca4319aa7c1d6cd8e4eafa ] Schedule C:WINDOWSsystem32schedsvc.dll

14:07:46.0593 0992 Schedule - ok

14:07:46.0625 0992 [ 90a3935d05b494a5a39d37e71f09a677 ] Secdrv C:WINDOWSsystem32DRIVERSsecdrv.sys

14:07:46.0750 0992 Secdrv - ok

14:07:46.0781 0992 [ cbe612e2bb6a10e3563336191eda1250 ] seclogon C:WINDOWSSystem32seclogon.dll

14:07:46.0984 0992 seclogon - ok

14:07:47.0015 0992 [ 7fdd5d0684eca8c1f68b4d99d124dcd0 ] SENS C:WINDOWSsystem32sens.dll

14:07:47.0187 0992 SENS - ok

14:07:47.0234 0992 [ 0f29512ccd6bead730039fb4bd2c85ce ] serenum C:WINDOWSsystem32DRIVERSserenum.sys

14:07:47.0406 0992 serenum - ok

14:07:47.0437 0992 [ cca207a8896d4c6a0c9ce29a4ae411a7 ] Serial C:WINDOWSsystem32DRIVERSserial.sys

14:07:47.0609 0992 Serial - ok

14:07:47.0625 0992 [ 8e6b8c671615d126fdc553d1e2de5562 ] Sfloppy C:WINDOWSsystem32driversSfloppy.sys

14:07:47.0843 0992 Sfloppy - ok

14:07:47.0875 0992 [ 83f41d0d89645d7235c051ab1d9523ac ] SharedAccess C:WINDOWSSystem32ipnathlp.dll

14:07:48.0093 0992 SharedAccess - ok

14:07:48.0125 0992 [ 1926899bf9ffe2602b63074971700412 ] ShellHWDetection C:WINDOWSSystem32shsvcs.dll

14:07:48.0296 0992 ShellHWDetection - ok

14:07:48.0312 0992 Simbad - ok

14:07:48.0359 0992 [ 866d538ebe33709a5c9f5c62b73b7d14 ] SLIP C:WINDOWSsystem32DRIVERSSLIP.sys

14:07:48.0531 0992 SLIP - ok

14:07:48.0546 0992 Sparrow - ok

14:07:48.0593 0992 [ ab8b92451ecb048a4d1de7c3ffcb4a9f ] splitter C:WINDOWSsystem32driverssplitter.sys

14:07:48.0765 0992 splitter - ok

14:07:48.0781 0992 [ d8e14a61acc1d4a6cd0d38aebac7fa3b ] Spooler C:WINDOWSsystem32spoolsv.exe

14:07:48.0984 0992 Spooler - ok

14:07:49.0031 0992 [ 76bb022c2fb6902fd5bdd4f78fc13a5d ] sr C:WINDOWSsystem32DRIVERSsr.sys

14:07:49.0125 0992 sr - ok

14:07:49.0171 0992 [ 3805df0ac4296a34ba4bf93b346cc378 ] srservice C:WINDOWSsystem32srsvc.dll

14:07:49.0296 0992 srservice - ok

14:07:49.0328 0992 [ 5252605079810904e31c332e241cd59b ] Srv C:WINDOWSsystem32DRIVERSsrv.sys

14:07:49.0531 0992 Srv - ok

14:07:49.0578 0992 [ 0a5679b3714edab99e357057ee88fca6 ] SSDPSRV C:WINDOWSSystem32ssdpsrv.dll

14:07:49.0671 0992 SSDPSRV - ok

14:07:49.0687 0992 [ 8bad69cbac032d4bbacfce0306174c30 ] stisvc C:WINDOWSsystem32wiaservc.dll

14:07:49.0906 0992 stisvc - ok

14:07:49.0953 0992 [ 77813007ba6265c4b6098187e6ed79d2 ] streamip C:WINDOWSsystem32DRIVERSStreamIP.sys

14:07:50.0156 0992 streamip - ok

14:07:50.0171 0992 [ 3941d127aef12e93addf6fe6ee027e0f ] swenum C:WINDOWSsystem32DRIVERSswenum.sys

14:07:50.0359 0992 swenum - ok

14:07:50.0390 0992 [ 8ce882bcc6cf8a62f2b2323d95cb3d01 ] swmidi C:WINDOWSsystem32driversswmidi.sys

14:07:50.0562 0992 swmidi - ok

14:07:50.0593 0992 SwPrv - ok

14:07:50.0625 0992 symc810 - ok

14:07:50.0640 0992 symc8xx - ok

14:07:50.0671 0992 sym_hi - ok

14:07:50.0703 0992 sym_u3 - ok

14:07:50.0750 0992 [ 8b83f3ed0f1688b4958f77cd6d2bf290 ] sysaudio C:WINDOWSsystem32driverssysaudio.sys

14:07:50.0921 0992 sysaudio - ok

14:07:50.0953 0992 [ c7abbc59b43274b1109df6b24d617051 ] SysmonLog C:WINDOWSsystem32smlogsvc.exe

14:07:51.0140 0992 SysmonLog - ok

14:07:51.0171 0992 [ 3cb78c17bb664637787c9a1c98f79c38 ] TapiSrv C:WINDOWSSystem32tapisrv.dll

14:07:51.0390 0992 TapiSrv - ok

14:07:51.0421 0992 [ 93ea8d04ec73a85db02eb8805988f733 ] Tcpip C:WINDOWSsystem32DRIVERStcpip.sys

14:07:51.0609 0992 Tcpip - ok

14:07:51.0625 0992 [ 6471a66807f5e104e4885f5b67349397 ] TDPIPE C:WINDOWSsystem32driversTDPIPE.sys

14:07:51.0828 0992 TDPIPE - ok

14:07:51.0875 0992 [ c56b6d0402371cf3700eb322ef3aaf61 ] TDTCP C:WINDOWSsystem32driversTDTCP.sys

14:07:52.0046 0992 TDTCP - ok

14:07:52.0078 0992 [ 88155247177638048422893737429d9e ] TermDD C:WINDOWSsystem32DRIVERStermdd.sys

14:07:52.0234 0992 TermDD - ok

14:07:52.0296 0992 [ ff3477c03be7201c294c35f684b3479f ] TermService C:WINDOWSSystem32termsrv.dll

14:07:52.0500 0992 TermService - ok

14:07:52.0562 0992 [ 1926899bf9ffe2602b63074971700412 ] Themes C:WINDOWSSystem32shsvcs.dll

14:07:52.0718 0992 Themes - ok

14:07:52.0765 0992 [ db7205804759ff62c34e3efd8a4cc76a ] TlntSvr C:WINDOWSsystem32tlntsvr.exe

14:07:52.0890 0992 TlntSvr - ok

14:07:52.0921 0992 TosIde - ok

14:07:52.0968 0992 [ 55bca12f7f523d35ca3cb833c725f54e ] TrkWks C:WINDOWSsystem32trkwks.dll

14:07:53.0140 0992 TrkWks - ok

14:07:53.0187 0992 [ 5787b80c2e3c5e2f56c2a233d91fa2c9 ] Udfs C:WINDOWSsystem32driversUdfs.sys

14:07:53.0359 0992 Udfs - ok

14:07:53.0359 0992 ultra - ok

14:07:53.0437 0992 [ 402ddc88356b1bac0ee3dd1580c76a31 ] Update C:WINDOWSsystem32DRIVERSupdate.sys

14:07:53.0609 0992 Update - ok

14:07:53.0656 0992 [ 1ebafeb9a3fbdc41b8d9c7f0f687ad91 ] upnphost C:WINDOWSSystem32upnphost.dll

14:07:53.0765 0992 upnphost - ok

14:07:53.0781 0992 [ 05365fb38fca1e98f7a566aaaf5d1815 ] UPS C:WINDOWSSystem32ups.exe

14:07:53.0968 0992 UPS - ok

14:07:54.0015 0992 [ 173f317ce0db8e21322e71b7e60a27e8 ] usbccgp C:WINDOWSsystem32DRIVERSusbccgp.sys

14:07:54.0171 0992 usbccgp - ok

14:07:54.0218 0992 [ 65dcf09d0e37d4c6b11b5b0b76d470a7 ] usbehci C:WINDOWSsystem32DRIVERSusbehci.sys

14:07:54.0390 0992 usbehci - ok

14:07:54.0421 0992 [ 1ab3cdde553b6e064d2e754efe20285c ] usbhub C:WINDOWSsystem32DRIVERSusbhub.sys

14:07:54.0593 0992 usbhub - ok

14:07:54.0625 0992 [ 0daecce65366ea32b162f85f07c6753b ] usbohci C:WINDOWSsystem32DRIVERSusbohci.sys

14:07:54.0765 0992 usbohci - ok

14:07:54.0812 0992 [ a32426d9b14a089eaa1d922e0c5801a9 ] USBSTOR C:WINDOWSsystem32DRIVERSUSBSTOR.SYS

14:07:54.0968 0992 USBSTOR - ok

14:07:55.0015 0992 [ 26496f9dee2d787fc3e61ad54821ffe6 ] usbuhci C:WINDOWSsystem32DRIVERSusbuhci.sys

14:07:55.0171 0992 usbuhci - ok

14:07:55.0203 0992 [ 63bbfca7f390f4c49ed4b96bfb1633e0 ] usbvideo C:WINDOWSsystem32Driversusbvideo.sys

14:07:55.0390 0992 usbvideo - ok

14:07:55.0421 0992 [ 0d3a8fafceacd8b7625cd549757a7df1 ] VgaSave C:WINDOWSSystem32driversvga.sys

14:07:55.0578 0992 VgaSave - ok

14:07:55.0609 0992 ViaIde - ok

14:07:55.0656 0992 [ 4c8fcb5cc53aab716d810740fe59d025 ] VolSnap C:WINDOWSsystem32driversVolSnap.sys

14:07:55.0812 0992 VolSnap - ok

14:07:55.0859 0992 [ 7a9db3a67c333bf0bd42e42b8596854b ] VSS C:WINDOWSSystem32vssvc.exe

14:07:55.0968 0992 VSS - ok

14:07:55.0984 0992 [ 54af4b1d5459500ef0937f6d33b1914f ] W32Time C:WINDOWSsystem32w32time.dll

14:07:56.0171 0992 W32Time - ok

14:07:56.0203 0992 [ e20b95baedb550f32dd489265c1da1f6 ] Wanarp C:WINDOWSsystem32DRIVERSwanarp.sys

14:07:56.0375 0992 Wanarp - ok

14:07:56.0375 0992 WDICA - ok

14:07:56.0437 0992 [ 6768acf64b18196494413695f0c3a00f ] wdmaud C:WINDOWSsystem32driverswdmaud.sys

14:07:56.0593 0992 wdmaud - ok

14:07:56.0625 0992 [ 77a354e28153ad2d5e120a5a8687bc06 ] WebClient C:WINDOWSSystem32webclnt.dll

14:07:56.0781 0992 WebClient - ok

14:07:56.0828 0992 [ 2d0e4ed081963804ccc196a0929275b5 ] winmgmt C:WINDOWSsystem32wbemWMIsvc.dll

14:07:57.0000 0992 winmgmt - ok

14:07:57.0093 0992 [ c7e39ea41233e9f5b86c8da3a9f1e4a8 ] WmdmPmSN C:WINDOWSsystem32mspmsnsv.dll

14:07:57.0250 0992 WmdmPmSN - ok

14:07:57.0296 0992 [ bab489a5fe26f2d0c910cf7af7e4cf92 ] Wmi C:WINDOWSSystem32advapi32.dll

14:07:57.0484 0992 Wmi - ok

14:07:57.0546 0992 [ e0673f1106e62a68d2257e376079f821 ] WmiApSrv C:WINDOWSsystem32wbemwmiapsrv.exe

14:07:57.0703 0992 WmiApSrv - ok

14:07:57.0765 0992 [ 6abe6e225adb5a751622a9cc3bc19ce8 ] WS2IFSL C:WINDOWSSystem32driversws2ifsl.sys

14:07:57.0937 0992 WS2IFSL - ok

14:07:57.0968 0992 [ 7c278e6408d1dce642230c0585a854d5 ] wscsvc C:WINDOWSsystem32wscsvc.dll

14:07:58.0125 0992 wscsvc - ok

14:07:58.0140 0992 [ c98b39829c2bbd34e454150633c62c78 ] WSTCODEC C:WINDOWSsystem32DRIVERSWSTCODEC.SYS

14:07:58.0328 0992 WSTCODEC - ok

14:07:58.0375 0992 [ 35321fb577cdc98ce3eb3a3eb9e4610a ] wuauserv C:WINDOWSsystem32wuauserv.dll

14:07:58.0531 0992 wuauserv - ok

14:07:58.0578 0992 [ 81dc3f549f44b1c1fff022dec9ecf30b ] WZCSVC C:WINDOWSSystem32wzcsvc.dll

14:07:58.0765 0992 WZCSVC - ok

14:07:58.0796 0992 [ 295d21f14c335b53cb8154e5b1f892b9 ] xmlprov C:WINDOWSSystem32xmlprov.dll

14:07:58.0953 0992 xmlprov - ok

14:07:58.0984 0992 ================ Scan global ===============================

14:07:59.0015 0992 (42f1f4c0afb08410e5f02d4b13ebb623) C:WINDOWSsystem32basesrv.dll

14:07:59.0046 0992 (1618f36d4f7f6ccceb3ee44ba95be85c) C:WINDOWSsystem32winsrv.dll

14:07:59.0109 0992 (1618f36d4f7f6ccceb3ee44ba95be85c) C:WINDOWSsystem32winsrv.dll

14:07:59.0125 0992 (0e776ed5f7cc9f94299e70461b7b8185) C:WINDOWSsystem32services.exe

14:07:59.0125 0992 [Global] - ok

14:07:59.0140 0992 ================ Scan MBR ==================================

14:07:59.0156 0992 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) DeviceHarddisk0DR0

14:07:59.0328 0992 DeviceHarddisk0DR0 ( TDSS File System ) - warning

14:07:59.0328 0992 DeviceHarddisk0DR0 - detected TDSS File System (1)

14:07:59.0375 0992 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) DeviceHarddisk1DR1

14:07:59.0406 0992 DeviceHarddisk1DR1 - ok

14:07:59.0437 0992 ================ Scan VBR ==================================

14:07:59.0453 0992 Boot (0x1200) (4a0b50f48d0822f12a1b4e1d68dc791a) DeviceHarddisk0DR0Partition1

14:07:59.0453 0992 DeviceHarddisk0DR0Partition1 - ok

14:07:59.0484 0992 Boot (0x1200) (471db52f2ef084f85bcbfe2fa0a0ed39) DeviceHarddisk0DR0Partition2

14:07:59.0484 0992 DeviceHarddisk0DR0Partition2 - ok

14:07:59.0531 0992 Boot (0x1200) (9f089fdd66120d965e01f82eb3fcb0fd) DeviceHarddisk1DR1Partition1

14:07:59.0531 0992 DeviceHarddisk1DR1Partition1 - ok

14:07:59.0546 0992 Boot (0x1200) (7dbcb875f0ea69be3b1142dbd7420f53) DeviceHarddisk1DR1Partition2

14:07:59.0546 0992 DeviceHarddisk1DR1Partition2 - ok

14:07:59.0562 0992 ============================================================

14:07:59.0562 0992 Scan finished

14:07:59.0562 0992 ============================================================

14:07:59.0734 0960 Detected object count: 2

14:07:59.0734 0960 Actual detected object count: 2

14:08:34.0781 0960 ATI Smart ( UnsignedFile.Multi.Generic ) - skipped by user

14:08:34.0781 0960 ATI Smart ( UnsignedFile.Multi.Generic ) - User select action: Skip

14:08:34.0859 0960 DeviceHarddisk0DR0TDLFSconfig.ini - copied to quarantine

14:08:34.0859 0960 DeviceHarddisk0DR0TDLFStdlcmd.dll - copied to quarantine

14:08:34.0859 0960 DeviceHarddisk0DR0TDLFStdlwsp.dll - copied to quarantine

14:08:34.0859 0960 DeviceHarddisk0DR0TDLFS - deleted

14:08:34.0859 0960 DeviceHarddisk0DR0 ( TDSS File System ) - User select action: Delete

14:09:09.0437 4060 Deinitialize success

Редактирано 18 август 201214 г. от pranjev (преглед на промените)

Това е папка която си създава програмата Комбофикс.Когато свършим,ще изтрием програмата и папката която ви притеснява няма да я има..!

Направете сканирането с Комбофикс в безопасен режим ( Safe Mode).

Пуснах ComboFix да сканира в безопасен режим и въпреки това откри че Kaspersky бил включен...?! Прегледах 3 пъти всички процеси и не видях никакъв процес на Kaspersky и го оставих да си приключи сканирането. Това е лога: ComboFix 12-08-17.03 - Spunki 08/18/2012 17:09:14.4.1 - x86 MINIMAL Microsoft Windows XP Professional 5.1.2600.3.1251.359.1033.18.2047.1684 [GMT 3:00] Running from: c:documents and settingsSpunkiDesktopComboFix.exe AV: Kaspersky Internet Security *Enabled/Updated* {2C4D4BC6-0793-4956-A9F9-E252435469C0} FW: Kaspersky Internet Security *Enabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0} . . ((((((((((((((((((((((((( Files Created from 2012-07-18 to 2012-08-18 ))))))))))))))))))))))))))))))) . . 2012-08-18 11:08 . 2012-08-18 11:08 -------- d-----w- C:TDSSKiller_Quarantine 2012-08-12 13:52 . 2012-08-12 13:52 -------- d-----w- c:program filestrend micro 2012-08-12 13:52 . 2012-08-12 13:52 -------- d-----w- C:rsit 2012-08-11 11:32 . 2012-08-11 11:32 -------- d-----w- c:documents and settingsSpunkiApplication DataMalwarebytes 2012-08-11 11:31 . 2012-08-11 11:31 -------- d-----w- c:documents and settingsAll UsersApplication DataMalwarebytes 2012-08-11 11:31 . 2012-08-11 11:31 -------- d-----w- c:program filesMalwarebytes' Anti-Malware 2012-08-11 11:31 . 2012-07-03 10:46 22344 ----a-w- c:windowssystem32driversmbam.sys . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-08-15 19:37 . 2012-04-14 11:50 426184 ----a-w- c:windowssystem32FlashPlayerApp.exe 2012-08-15 19:37 . 2012-02-19 10:49 70344 ----a-w- c:windowssystem32FlashPlayerCPLApp.cpl . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionexplorershelliconoverlayidentifiersIDM Shell Extension] @="{CDC95B92-E27C-4745-A8C5-64A52A78855D}" [HKEY_CLASSES_ROOTCLSID{CDC95B92-E27C-4745-A8C5-64A52A78855D}] 2011-05-30 14:50 21864 ----a-w- c:program filesInternet Download ManagerIDMShellExt.dll . [HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun] "StartCCC"="c:program filesATI TechnologiesATI.ACECore-StaticCLIStart.exe" [2006-11-10 90112] "Skype"="c:program filesSkypePhoneSkype.exe" [2008-11-07 21633320] . [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun] "NVRaidService"="c:windowssystem32nvraidservice.exe" [2004-06-11 83968] "SoundMan"="SOUNDMAN.EXE" [2005-05-17 77824] "Malwarebytes' Anti-Malware"="c:program filesMalwarebytes' Anti-Malwarembamgui.exe" [2012-07-03 462920] . [HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun] "CTFMON.EXE"="c:windowssystem32CTFMON.EXE" [2008-04-14 15360] . [HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRunOnce] "RunNarrator"="Narrator.exe" [2008-04-14 53760] . [HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregMSMSGS] 2008-04-14 03:42 1695232 ------w- c:program filesMessengermsmsgs.exe . [HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity centerMonitoringKasperskyAntiVirus] "DisableMonitoring"=dword:00000001 . [HKLM~servicessharedaccessparametersfirewallpolicystandardprofile] "EnableFirewall"= 0 (0x0) . [HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList] "%windir%Network Diagnosticxpnetdiag.exe"= "%windir%system32sessmgr.exe"= "c:Program FilesuTorrentuTorrent.exe"= "c:Program FilesSkypePhoneSkype.exe"= . [HKLM~servicessharedaccessparametersfirewallpolicystandardprofileGloballyOpenPortsList] "4196:TCP"= 4196:TCP:pklytw . S1 IDMTDI;IDMTDI;c:windowssystem32driversidmtdi.sys [14.11.2011 г. 16:39 101616] S1 kl2;kl2;c:windowssystem32driverskl2.sys [04.3.2011 г. 14:23 11352] S2 MBAMService;MBAMService;c:program filesMalwarebytes' Anti-Malwarembamservice.exe [11.8.2012 г. 14:31 655944] S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:windowssystem32MacromedFlashFlashPlayerUpdateService.exe [14.4.2012 г. 14:50 250056] S3 klim5;Kaspersky Anti-Virus NDIS Filter;c:windowssystem32driversklim5.sys [10.3.2011 г. 19:34 34608] S3 klmouflt;Kaspersky Lab KLMOUFLT;c:windowssystem32driversklmouflt.sys [02.11.2009 г. 21:27 19472] S3 MBAMProtector;MBAMProtector;c:windowssystem32driversmbam.sys [11.8.2012 г. 14:31 22344] . Contents of the 'Scheduled Tasks' folder . 2012-08-18 c:windowsTasksAdobe Flash Player Updater.job - c:windowssystem32MacromedFlashFlashPlayerUpdateService.exe [2012-04-14 19:37] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.google.bg/ uInternet Connection Wizard,ShellNext = hxxp://www.facebook.com/ IE: Свали всички линкове с IDM - c:program filesInternet Download ManagerIEGetAll.htm IE: Свали с IDM - c:program filesInternet Download ManagerIEExt.htm TCP: DhcpNameServer = 87.121.24.12 . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2012-08-18 17:13 Windows 5.1.2600 Service Pack 3 NTFS . scanning hidden processes ... . scanning hidden autostart entries ... . scanning hidden files ... . scan completed successfully hidden files: 0 . ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_LOCAL_MACHINEsoftwareClassesCLSID{42030738-838e-42a2-8d51-d43d296999c8}] @Denied: (Full) (Everyone) "Model"=dword:000000c1 "Therad"=dword:00000021 "MData"=hex(0):73,d5,cf,b8,a4,07,89,80,31,e4,35,6b,2a,ca,fe,43,b6,1f,81,1f,5a, 1b,4d,36,46,8f,3c,f2,5c,68,ee,21,46,8f,3c,f2,5c,68,ee,21,46,8f,3c,f2,5c,68, . [HKEY_LOCAL_MACHINEsoftwareClassesCLSID{7B8E9164-324D-4A2E-A46D-0165FB2000EC}] @Denied: (Full) (Everyone) "scansk"=hex(0):3d,29,52,a9,aa,0b,5d,c8,d6,d7,c9,e9,5b,56,96,35,98,70,0a,37,21, 01,ef,6f,36,06,29,80,7f,e0,ad,d9,25,17,71,69,7f,aa,65,82,00,00,00,00,00,00, . --------------------- DLLs Loaded Under Running Processes --------------------- . - - - - - - - > 'winlogon.exe'(220) c:windowssystem32Ati2evxx.dll . - - - - - - - > 'explorer.exe'(1388) c:program filesInternet Download ManagerIDMShellExt.dll c:program filesInternet Download ManagerIDMNetMon.DLL . Completion time: 2012-08-18 17:14:13 ComboFix-quarantined-files.txt 2012-08-18 14:14 . Pre-Run: 14,963,470,336 bytes free Post-Run: 14,950,080,512 bytes free . - - End Of File - - 8131A5FB59CD8952916ABDF80676E85A

Копирайте текста в карето на notepad и го запазвате с име CFScript.txt на десктопа си:

KILLALL::

Registry::
[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileGloballyOpenPortsList]
"4196:TCP"=-

След съхранението преместете CFScript.txt на иконата на ComboFix.exe

Генерирания рапорт копирайте и го поставете в следващия си коментар...!

Изпълних инструкциите ви от коментар #36 и след като завлача текстовия документ в иконата на ComboFix той започва да сканира, изписва ми че трябва да изчакам 10 минути и да продължи работата си и тези 10 минути се превръщат в цяла вечност - нито приключва сканирането, нито продължава работата си, нито се случва нещо друго, компютъра блокирва и нищо не мога да направя. 2 пъти го повторих и чаках повече от час и това е резултата.

А скрипта в какъв режим го изпълнявате..?

Ами в нормален. В безопасен режим ли трябва да го изпълня?

Ами да..предполагам разбрахте че Комбофикс по някъква причина не работи коректно в нормален режим...Нали сканирането правихме в безопасен режим..и скрипта направете в този режим..!

Пуснах го да сканира в безопасен режим, това е лога: ComboFix 12-08-18.01 - Spunki 08/19/2012 10:35:24.5.1 - x86 MINIMAL Microsoft Windows XP Professional 5.1.2600.3.1251.359.1033.18.2047.1676 [GMT 3:00] Running from: c:documents and settingsSpunkiDesktopComboFix.exe Command switches used :: c:documents and settingsSpunkiDesktopCFScript.txt AV: Kaspersky Internet Security *Enabled/Updated* {2C4D4BC6-0793-4956-A9F9-E252435469C0} FW: Kaspersky Internet Security *Enabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0} . . ((((((((((((((((((((((((( Files Created from 2012-07-19 to 2012-08-19 ))))))))))))))))))))))))))))))) . . 2012-08-18 11:08 . 2012-08-18 11:08 -------- d-----w- C:TDSSKiller_Quarantine 2012-08-12 13:52 . 2012-08-12 13:52 -------- d-----w- c:program filestrend micro 2012-08-12 13:52 . 2012-08-12 13:52 -------- d-----w- C:rsit 2012-08-11 11:32 . 2012-08-11 11:32 -------- d-----w- c:documents and settingsSpunkiApplication DataMalwarebytes 2012-08-11 11:31 . 2012-08-11 11:31 -------- d-----w- c:documents and settingsAll UsersApplication DataMalwarebytes 2012-08-11 11:31 . 2012-08-11 11:31 -------- d-----w- c:program filesMalwarebytes' Anti-Malware 2012-08-11 11:31 . 2012-07-03 10:46 22344 ----a-w- c:windowssystem32driversmbam.sys . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-08-15 19:37 . 2012-04-14 11:50 426184 ----a-w- c:windowssystem32FlashPlayerApp.exe 2012-08-15 19:37 . 2012-02-19 10:49 70344 ----a-w- c:windowssystem32FlashPlayerCPLApp.cpl . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionexplorershelliconoverlayidentifiersIDM Shell Extension] @="{CDC95B92-E27C-4745-A8C5-64A52A78855D}" [HKEY_CLASSES_ROOTCLSID{CDC95B92-E27C-4745-A8C5-64A52A78855D}] 2011-05-30 14:50 21864 ----a-w- c:program filesInternet Download ManagerIDMShellExt.dll . [HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun] "StartCCC"="c:program filesATI TechnologiesATI.ACECore-StaticCLIStart.exe" [2006-11-10 90112] "Skype"="c:program filesSkypePhoneSkype.exe" [2008-11-07 21633320] . [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun] "NVRaidService"="c:windowssystem32nvraidservice.exe" [2004-06-11 83968] "SoundMan"="SOUNDMAN.EXE" [2005-05-17 77824] "Malwarebytes' Anti-Malware"="c:program filesMalwarebytes' Anti-Malwarembamgui.exe" [2012-07-03 462920] "avp"="c:program filesKaspersky LabKaspersky Internet Security 2012avp.exe" [2011-04-24 202296] . [HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun] "CTFMON.EXE"="c:windowssystem32CTFMON.EXE" [2008-04-14 15360] . [HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRunOnce] "RunNarrator"="Narrator.exe" [2008-04-14 53760] . [HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregMSMSGS] 2008-04-14 03:42 1695232 ------w- c:program filesMessengermsmsgs.exe . [HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity centerMonitoringKasperskyAntiVirus] "DisableMonitoring"=dword:00000001 . [HKLM~servicessharedaccessparametersfirewallpolicystandardprofile] "EnableFirewall"= 0 (0x0) . [HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList] "%windir%Network Diagnosticxpnetdiag.exe"= "%windir%system32sessmgr.exe"= "c:Program FilesuTorrentuTorrent.exe"= "c:Program FilesSkypePhoneSkype.exe"= . R1 IDMTDI;IDMTDI;c:windowssystem32driversidmtdi.sys [14.11.2011 г. 16:39 101616] R1 kl2;kl2;c:windowssystem32driverskl2.sys [04.3.2011 г. 14:23 11352] R2 MBAMService;MBAMService;c:program filesMalwarebytes' Anti-Malwarembamservice.exe [11.8.2012 г. 14:31 655944] R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:windowssystem32driversklim5.sys [10.3.2011 г. 19:34 34608] R3 klmouflt;Kaspersky Lab KLMOUFLT;c:windowssystem32driversklmouflt.sys [02.11.2009 г. 21:27 19472] R3 MBAMProtector;MBAMProtector;c:windowssystem32driversmbam.sys [11.8.2012 г. 14:31 22344] S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:windowssystem32MacromedFlashFlashPlayerUpdateService.exe [14.4.2012 г. 14:50 250056] . Contents of the 'Scheduled Tasks' folder . 2012-08-18 c:windowsTasksAdobe Flash Player Updater.job - c:windowssystem32MacromedFlashFlashPlayerUpdateService.exe [2012-04-14 19:37] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.google.bg/ uInternet Connection Wizard,ShellNext = hxxp://www.facebook.com/ IE: Добави към Защитата от банери - c:program filesKaspersky LabKaspersky Internet Security 2012ie_banner_deny.htm IE: Свали всички линкове с IDM - c:program filesInternet Download ManagerIEGetAll.htm IE: Свали с IDM - c:program filesInternet Download ManagerIEExt.htm TCP: DhcpNameServer = 87.121.24.12 . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2012-08-19 10:42 Windows 5.1.2600 Service Pack 3 NTFS . scanning hidden processes ... . scanning hidden autostart entries ... . scanning hidden files ... . scan completed successfully hidden files: 0 . ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_LOCAL_MACHINEsoftwareClassesCLSID{42030738-838e-42a2-8d51-d43d296999c8}] @Denied: (Full) (Everyone) "Model"=dword:000000c1 "Therad"=dword:00000021 "MData"=hex(0):73,d5,cf,b8,a4,07,89,80,31,e4,35,6b,2a,ca,fe,43,b6,1f,81,1f,5a, 1b,4d,36,46,8f,3c,f2,5c,68,ee,21,46,8f,3c,f2,5c,68,ee,21,46,8f,3c,f2,5c,68, . [HKEY_LOCAL_MACHINEsoftwareClassesCLSID{7B8E9164-324D-4A2E-A46D-0165FB2000EC}] @Denied: (Full) (Everyone) "scansk"=hex(0):3d,29,52,a9,aa,0b,5d,c8,d6,d7,c9,e9,5b,56,96,35,98,70,0a,37,21, 01,ef,6f,36,06,29,80,7f,e0,ad,d9,25,17,71,69,7f,aa,65,82,00,00,00,00,00,00, . --------------------- DLLs Loaded Under Running Processes --------------------- . - - - - - - - > 'winlogon.exe'(832) c:windowssystem32Ati2evxx.dll . - - - - - - - > 'explorer.exe'(3804) c:program filesInternet Download ManagerIDMShellExt.dll c:program filesInternet Download ManagerIDMNetMon.DLL . ------------------------ Other Running Processes ------------------------ . c:windowssystem32Ati2evxx.exe c:windowssystem32Ati2evxx.exe c:windowssystem32wscntfy.exe c:windowsSOUNDMAN.EXE c:program filesATI TechnologiesATI.ACECore-StaticMOM.EXE c:windowssystem32wbemunsecapp.exe c:program filesATI TechnologiesATI.ACECore-Staticccc.exe . ************************************************************************** . Completion time: 2012-08-19 10:46:43 - machine was rebooted ComboFix-quarantined-files.txt 2012-08-19 07:46 ComboFix2.txt 2012-08-18 14:14 . Pre-Run: 14,946,975,744 bytes free Post-Run: 14,935,412,736 bytes free . - - End Of File - - 6D11987EC9235CE304A6A22A8B3BEA20

Пуснах го да сканира в безопасен режим, това е лога:

Предполагам имахте впредвид, че изпълнихте скрипта...!Наблюдавайте сега как ще е положението...!

Да, изпълних скрипта. Значи сега ще го наблюдавам ако открие и засече някакви заплахи - тогава ще пиша отново.

Да ..имаме още работа..но искам да мине малко време за да видим ще има ли проблеми...!

Значи да чакам да пишете вие, така ли?

Имам впредвид ..вие да си наблюдавате системата и ако нямате повече проблеми - пишете - за да направим заключителни стъпки..!

Ами за сега системата ми се държи нормално, касперски не засича никакви вируси и заплахи, дано да сме ги разкарали наистина.

Добре...да направим така:

Деинсталирайте Комбофикс така:

1.Натиснете Start ==> Run ==> въведете командата Combofix /Uninstall ==> OK

2.Изтеглете OTCleanIt или от тук,стартирайте и натиснете

Изтрийете всичко което използвахме в процедурата (което е останало), логове,програмки и фиксове.Оставете си само програмата Malwarebytes' Anti-Malware и периодически сканирайте с нея.Не забравяйте че програмата не заменя антивирусната програма,а само допълва защитата на системата ви.Деинсталирайте ESET Online Scaner.

Няма да затварям темата още ден два..Ако има проблем пишете..!Лека вечер ви пожелавам...!

Деинсталирах ComboFix и изтрих вички програмки които използвахме в процедурата. Благодаря ви за всичко. Да ви попитам понеже имам 2 компютъра и искам да направя и на другия проверка тъй като с него се случват напоследък странни неща тук ли да ви пиша за него и ако да кога, може ли направо в тази тема да продължим или трябва да пусна нова? Лека вечер и на вас също!

Редактирано 19 август 201214 г. от pranjev (преглед на промените)

И аз ви благодаря ..! За другия компютър си създайте нова тема..! Лек ден и поздрави..!