Здравейте, моля екипа за помощ. Не знам каква е гадината. Постоянно дръгне нещо по харда и натоварва процесора. Не знам дали има връзка, защото стана по-късно, но ми спря и безжичния адаптор и не намира никакви мрежи. Освен това в c:\ има папка ComboFix с икона на My Computer и като я отворя все едно отварям My Computer. Логовете: DDS (Ver_2011-09-30.01) - NTFS_x86 Internet Explorer: 8.0.6001.18702 Run by Jonny at 17:59:56 on 2012-10-19 Microsoft Windows XP Professional 5.1.2600.3.1251.359.1033.18.1014.613 [GMT 3:00] . AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D} FW: avast! Internet Security *Enabled* . ============== Running Processes ================ . C:\Program Files\AVAST Software\Avast\AvastSvc.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\SUPERAntiSpyware\SASCORE.EXE C:\Program Files\TuneUp Utilities 2012\TuneUpUtilitiesService32.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\AVAST Software\Avast\avastUI.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Datecs\FlexType 2K\FType2K.exe C:\Program Files\TuneUp Utilities 2012\TuneUpUtilitiesApp32.exe C:\WINDOWS\System32\alg.exe C:\DOCUME~1\Jonny\LOCALS~1\Temp\RtkBtMnt.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\WINDOWS\system32\svchost.exe -k DcomLaunch C:\WINDOWS\system32\svchost.exe -k rpcss C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup C:\WINDOWS\system32\svchost.exe -k netsvcs C:\WINDOWS\system32\svchost.exe -k NetworkService C:\WINDOWS\system32\svchost.exe -k LocalService C:\WINDOWS\system32\svchost.exe -k netsvcs C:\WINDOWS\system32\svchost.exe -k imgsvc . ============== Pseudo HJT Report =============== . uStart Page = about:blank BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - c:\program files\microsoft office\office14\GROOVEEX.DLL BHO: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - c:\program files\avast software\avast\aswWebRepIE.dll BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - c:\program files\microsoft office\office14\URLREDIR.DLL BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - c:\program files\avast software\avast\aswWebRepIE.dll uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uRun: [Google Update] "c:\documents and settings\jonny\local settings\application data\google\update\GoogleUpdate.exe" /c uRun: [DAEMON Tools Lite] "c:\program files\daemon tools lite\DTLite.exe" -autorun uRun: [sUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe mRun: [RTHDCPL] RTHDCPL.EXE mRun: [skyTel] SkyTel.EXE mRun: [Alcmtr] ALCMTR.EXE mRun: [AzMixerSel] c:\program files\realtek\installshield\AzMixerSel.exe mRun: [synTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe mRun: [avast] "c:\program files\avast software\avast\avastUI.exe" /nogui mRun: [KernelFaultCheck] c:\windows\system32\dumprep 0 -k mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe" dRunOnce: [iE8] rundll32 advpack.dll,LaunchINFSection IE8.INF,FirstUserStart dRunOnce: [showDeskFix] regsvr32 /s /n /i:u shell32 StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\flexty~1.lnk - c:\program files\datecs\flextype 2k\FType2K.exe uPolicies-Explorer: NoDriveTypeAutoRun = dword:255 uPolicies-Explorer: NoDriveAutoRun = dword:67108863 mPolicies-Explorer: NoDriveTypeAutoRun = dword:255 mPolicies-Explorer: NoDriveAutoRun = dword:67108863 mPolicies-Explorer: NoDriveTypeAutoRun = dword:323 mPolicies-Explorer: NoDriveAutoRun = dword:67108863 IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office14\EXCEL.EXE/3000 IE: Se&nd to OneNote - c:\progra~1\micros~2\office14\ONBttnIE.dll/105 IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office14\ONBttnIE.dll IE: {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - c:\program files\pokerstars\PokerStarsUpdate.exe IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - c:\program files\microsoft office\office14\ONBttnIELinkedNotes.dll IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab DPF: {A996E48C-D3DC-4244-89F7-AFA33EC60679} - hxxps://ebb.ubb.bg/CAPICOM/capicom.cab DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\common files\microsoft shared\office14\MSOXMLMF.DLL Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\program files\common files\skype\Skype4COM.dll Notify: igfxcui - igfxdev.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\wpdshserviceobj.dll SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - c:\program files\microsoft office\office14\GROOVEEX.DLL SEH: SABShellExecuteHook Class - {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - c:\program files\superantispyware\SASSEH.DLL . ============= SERVICES / DRIVERS =============== . R1 aswKbd;aswKbd;c:\windows\system32\drivers\aswKbd.sys [2012-4-6 24408] R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2011-5-3 612184] R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2011-5-3 337880] R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2011-7-22 12880] R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2011-7-13 67664] R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2011-5-3 20696] R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\tuneup utilities 2012\TuneUpUtilitiesDriver32.sys [2012-5-8 10064] S3 A0380VID;USB2.0 PC Camera;c:\windows\system32\drivers\a0380vid.sys --> c:\windows\system32\drivers\A0380Vid.sys [?] S3 AVerPola;AVerMedia USB Polaris Series Capture Service;c:\windows\system32\drivers\AVerPola.sys [2011-7-26 314752] S3 AVPolCIR;AVerMedia USB Polaris Series Custom IR Service;c:\windows\system32\drivers\AVPolCIR.sys [2011-7-26 32896] S3 CAM1690;USB 2.0 Compliance JPEG Video Camera;c:\windows\system32\drivers\cam1690.sys --> c:\windows\system32\drivers\cam1690.sys [?] S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\drivers\ggflt.sys [2011-6-21 13224] S3 NPF;WinPcap Packet Driver (NPF);c:\windows\system32\drivers\npf.sys [2012-10-15 50704] S3 PCAMp50;PCAMp50 NDIS Protocol Driver;c:\windows\system32\drivers\PCAMp50.sys [2012-3-18 28224] S3 s0017bus;Sony Ericsson Device 0017 driver (WDM);c:\windows\system32\drivers\s0017bus.sys [2011-6-20 86824] S3 s0017mdfl;Sony Ericsson Device 0017 USB WMC Modem Filter;c:\windows\system32\drivers\s0017mdfl.sys [2011-6-20 15016] S3 s0017mdm;Sony Ericsson Device 0017 USB WMC Modem Driver;c:\windows\system32\drivers\s0017mdm.sys [2011-6-20 114600] S3 s0017mgmt;Sony Ericsson Device 0017 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s0017mgmt.sys [2011-6-20 108328] S3 s0017nd5;Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (NDIS);c:\windows\system32\drivers\s0017nd5.sys [2011-6-20 26024] S3 s0017obex;Sony Ericsson Device 0017 USB WMC OBEX Interface;c:\windows\system32\drivers\s0017obex.sys [2011-6-20 104616] S3 s0017unic;Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (WDM);c:\windows\system32\drivers\s0017unic.sys [2011-6-20 109736] . =============== Created Last 30 ================ . 2012-10-19 01:43:22 -------- d-----w- c:\documents and settings\jonny\application data\SUPERAntiSpyware.com 2012-10-19 01:41:06 -------- d-----w- c:\documents and settings\all users\application data\SUPERAntiSpyware.com 2012-10-19 01:27:32 -------- d-----w- c:\program files\SUPERAntiSpyware 2012-10-15 17:27:56 50704 ----a-w- c:\windows\system32\drivers\npf.sys 2012-10-15 17:27:56 281104 ----a-w- c:\windows\system32\wpcap.dll 2012-10-15 17:27:55 100880 ----a-w- c:\windows\system32\Packet.dll 2012-10-05 07:33:05 -------- d-----w- c:\documents and settings\jonny\application data\Applian FLV and Media Player 2012-10-03 15:58:26 -------- d-----w- c:\documents and settings\all users\application data\Spybot - Search & Destroy 2012-10-02 19:30:55 98816 ----a-w- c:\windows\sed.exe 2012-10-02 19:30:55 256000 ----a-w- c:\windows\PEV.exe 2012-10-02 19:30:55 208896 ----a-w- c:\windows\MBR.exe 2012-10-02 19:30:50 -------- d-s---w- C:\ComboFix . ==================== Find3M ==================== . . ============= FINISH: 18:01:05.21 =============== . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2011-09-30.01) . Microsoft Windows XP Professional Boot Device: \Device\HarddiskVolume1 Install Date: 5/2/2011 11:06:01 PM System Uptime: 10/19/2012 4:19:00 PM (2 hours ago) . Motherboard: Acer | | Grapevine Processor: Intel® Celeron® M CPU 440 @ 1.86GHz | U1 | 1862/133mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 75 GiB total, 13.493 GiB free. D: is CDROM () F: is Removable . ==== Disabled Device Manager Items ============= . ==== System Restore Points =================== . RP485: 10/5/2012 10:25:11 AM - Removed QuickTime RP486: 10/6/2012 3:29:24 PM - System Checkpoint RP487: 10/7/2012 11:08:17 PM - System Checkpoint RP488: 10/8/2012 11:53:19 PM - System Checkpoint RP489: 10/9/2012 11:54:33 PM - System Checkpoint RP490: 10/11/2012 1:20:59 PM - System Checkpoint RP491: 10/12/2012 7:36:57 PM - System Checkpoint RP492: 10/13/2012 7:58:06 PM - System Checkpoint RP493: 10/14/2012 8:00:13 PM - System Checkpoint RP494: 10/15/2012 8:22:22 PM - System Checkpoint RP495: 10/16/2012 8:50:41 PM - System Checkpoint RP496: 10/17/2012 9:29:36 PM - System Checkpoint RP497: 10/19/2012 4:30:34 AM - Installed Windows XP KB950582. . ==== Installed Programs ====================== . Acer Updater Adobe Flash Player 11 ActiveX Adobe Reader X (10.1.4) Advanced IP Scanner v1.5 Advanced LAN Scanner v1.0 BETA 1 Atheros for Acer Driver 5.3.0.35_Foxconn Installation Program avast! Free Antivirus Bullzip PDF Printer 7.2.0.1338 calibre Canon LBP3010/LBP3018/LBP3050 CCleaner Counter-Strike 1.6: New Era DAEMON Tools Lite Definition update for Microsoft Office 2010 (KB982726) 32-Bit Edition FlexType 2K GoldWave v5.57 Google Chrome Google Earth Google Update Helper HDAUDIO Soft Data Fax Modem with SmartCP Holdem Manager Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595) Hotfix for Windows XP (KB954550-v5) Hotfix for Windows XP (KB970653-v3) Hotfix for Windows XP (KB976002-v5) Intel® Graphics Media Accelerator Driver Java Auto Updater Java™ 6 Update 29 Java™ SE Runtime Environment 6 Update 1 K-Lite Codec Pack 4.7.0 (Full) Launch Manager LG_MobileSync Microsoft .NET Framework 2.0 Service Pack 2 Microsoft .NET Framework 3.0 Service Pack 2 Microsoft .NET Framework 3.5 SP1 Microsoft .NET Framework 4 Client Profile Microsoft .NET Framework 4 Extended Microsoft Kernel-Mode Driver Framework Feature Pack 1.7 Microsoft Office 2010 Service Pack 1 (SP1) Microsoft Office Access MUI (English) 2010 Microsoft Office Access Setup Metadata MUI (English) 2010 Microsoft Office Excel MUI (English) 2010 Microsoft Office Groove MUI (English) 2010 Microsoft Office InfoPath MUI (English) 2010 Microsoft Office OneNote MUI (English) 2010 Microsoft Office Outlook MUI (English) 2010 Microsoft Office PowerPoint MUI (English) 2010 Microsoft Office Professional Plus 2010 Microsoft Office Proof (English) 2010 Microsoft Office Proof (French) 2010 Microsoft Office Proof (Spanish) 2010 Microsoft Office Proofing (English) 2010 Microsoft Office Publisher MUI (English) 2010 Microsoft Office Shared MUI (English) 2010 Microsoft Office Shared Setup Metadata MUI (English) 2010 Microsoft Office Word MUI (English) 2010 Microsoft Silverlight Microsoft Software Update for Web Folders (English) 14 Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2005 Redistributable - KB2467175 Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 MSVC90_x86 MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) Nero Burning ROM 10 Nero BurningROM 10 Help (CHM) Nero BurnRights 10 Nero BurnRights 10 Help (CHM) Nero Control Center 10 Nero ControlCenter 10 Help (CHM) Nero Core Components 10 Nero Update Picasa 3 PokerStars PostgreSQL 8.4 Realtek High Definition Audio Driver Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473) Security Update for Microsoft Excel 2010 (KB2553070) Security Update for Microsoft Office 2010 (KB2553091) Security Update for Microsoft Office 2010 (KB2553096) Security Update for Microsoft SharePoint Workspace 2010 (KB2566445) Security Update for Windows Internet Explorer 8 (KB2497640) Security Update for Windows Internet Explorer 8 (KB2510531) Security Update for Windows Internet Explorer 8 (KB2530548) Security Update for Windows Internet Explorer 8 (KB2544521) Security Update for Windows Internet Explorer 8 (KB2559049) Security Update for Windows Internet Explorer 8 (KB2586448) Security Update for Windows Media Player 11 (KB954154) Security Update for Windows XP (KB941569) Security Update for Windows XP (KB950582) Sereby's Updatepack - IE8 Addon Version 1.0.7 Skype™ 5.10 Stellarium 0.11.1 SUPERAntiSpyware Synaptics Pointing Device Driver System Requirements Lab CYRI TuneUp Utilities 2012 TuneUp Utilities Language Pack (en-US) Unibet Update for Microsoft .NET Framework 3.5 SP1 (KB963707) Update for Microsoft Office 2010 (KB2553065) Update for Microsoft Office 2010 (KB2553092) Update for Microsoft Office 2010 (KB2553181) 32-Bit Edition Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition Update for Microsoft Office 2010 (KB2553455) 32-Bit Edition Update for Microsoft Office 2010 (KB2566458) Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition Update for Microsoft Outlook 2010 (KB2553323) 32-Bit Edition Update for Microsoft Outlook Social Connector (KB2583935) VLC media player 1.1.11 WebFldrs XP Winamp Windows Media Player Firefox Plugin WinRAR 4.00 (32-bit) µTorrent . ==== Event Viewer Messages From Past Week ======== . 10/19/2012 4:25:15 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the IMAPI CD-Burning COM Service service to connect. 10/19/2012 4:25:15 AM, error: Service Control Manager [7000] - The IMAPI CD-Burning COM Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion. 10/18/2012 1:04:04 PM, error: atapi [11] - The driver detected a controller error on \Device\Ide\IdePort0. 10/18/2012 1:01:47 PM, error: atapi [9] - The device, \Device\Ide\IdePort0, did not respond within the timeout period. 10/16/2012 7:12:13 PM, error: Service Control Manager [7031] - The avast! Antivirus service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 5000 milliseconds: Restart the service. 10/15/2012 11:32:49 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the TuneUp.UtilitiesSvc service. 10/12/2012 10:30:10 PM, error: System Error [1003] - Error code 1000008e, parameter1 c0000005, parameter2 bf955569, parameter3 a8fbbc00, parameter4 00000000. . ==== End Of File ===========================

Редактирано 23 октомври 201213 г. от B-boy[StyLe] (преглед на промените)

Направете снимка на Task Manager => Processes и я прикачете към коментара в следващия си пост.

Благодаря

Не се виждат зловредни процеси и натоварен CPU?

Иначе има излишни програми като цяло. Деинсталирайте TuneUp Utilities и вижте дали после има подобрение.

Деинсталирайте и SUPERAntiSpyware, защото макар и безплатна и тя има модул в реално време използван от сканиращия енджин.

Avast! макар и даван като доста лек антивирус, на по-стари системи особено с XP, го намирам за доста тегав...

Все пак да проверим и за рууткити:

Моля изтеглете последната версия на TDSSKiller оттук и я запазете на вашия декстоп.

• Стартирайте TDSSKiller.exe за да стартирате приложението. След това кликнете върху бутона Change parameters.

  

• Сложете отметка през Loaded Modules.

  

• Необходим е рестарт за осъществяване на промените. Направете го!
• TDSSKiller ще стартира автоматично след рестарта. Важно е да се отбележи, че вашия компютър може да изглежда по-бавен, на моменти неизползваем и с по-ниска производителност. Това е нормално и ще трае само един рестарт. Дайте му достатъчно време да зареди приложенията стартиращи с Операционната Система във фонов режим.
• След това натиснете Change parameters в TDSSKiller отново.
• Сложете всички отметки (този път рестарт не се изисква).

  

• Натиснете бутона Start Scan.

  

• Проверката не би трябвало да отмене повече от 2 minutes.
• Ако подозрителен обект бъде засечен, действието по подразбиране ще бъде Skip, кликнете върху Continue.

  

• Ако зловредни обекти бъдат намерени, тогава от падащото меню ще имате три възможности.

  Бъдете сигурни, че избраното действие е Cure и натиснете върху Continue > Рестартирайте за да бъде завършена поправката.

  

  Забележка: Ако Cure бутона не е наличен от възможностите, тогава моля изберете Skip бутона, не избирайте Delete освен ако не сте инструктирани затова.

• Лог файл ще бъде създаден в свободната директория на дял C: . Потърсете за лог с името "TDSSKiller.[Version]_[Date]_[Time]_log.txt" и копирайте съдържанието му в следващия си пост.

Изтеглете Gmer

• Временно спрете Интернета си,всички работещи програми,както и антивирусната си програма.
• Стартирате програмата.
• След завършването на автоматичната проверка,махнете отметките от следните позиции:

  - IAT/EAT

  - Show all

  - махнете отметките от всички локални дискове. Маркирайте само системния дял (обикновенно това е C: )

  

• Натиснете бутона Scan
• Изчакайте програмата да завърши сканирането,след което натиснете бутона Save и запишете (save as) резултатите на десктопа с име Gmer.log.
• Включете Интернета си и прикачете Gmer.log в следващия си коментар.

  Забележка:

• Не предприемайте никакви действия върху редовете маркирани с "<--- ROOТKIT" ,защото това може да доведе до проблеми с Windows.

SUPERanti я сложих днес да чистя а с TuneUp си работеше добре. Махнах ги и няма промяна. Рестартира се много бавно и накъсва звука на Windows. Ето лога: Закачвам го защото дава грешка прекалено дълъг.

TDSSKiller.2.8.13.0_19.10.2012_21.44.36_log.txt

Редактирано 19 октомври 201213 г. от Nikolai Lulchev (преглед на промените)

Лога на TDSSKiller е чист. Очаквам лога на GMER. Публикувайте и лога от Combofix (трябва да е или в C:Combofix.txt или в папката C:Qoobox). Защо сте го използвали без инструкции? Ако лог лиспва просто го деинсталирахте с командата: Start => Run => Combofix /Uninstall После вижте дали има промяна.

Combofix нямах причина да го инсталирам. Да видя какво е, в един Хирен'с го намерих. Лог липсва.

Start => Run => Combofix /Uninstall=> windows cannot find 'combofix' и въпреки това има папка c:\ComboFix с иконата на моя комп.

gmer.log

Не можете да качвате такъв тип файл

gmer.log.txt

Лога от Gmer е ужасен...сигурно сте имали доста отворени програми и сте ползвали интензивно компютъра по време на проверката...

А щом така или иначе Combofix вече е бил стартиран, да опитаме с нова проверка за да видим какво е положението и дали забавянето се дължи изобщо на зловреден софтуер...

После ще го деинсталираме по-правилния начин:

1. Изтеглете ComboFix от BleepingComputer

и го запазете (бутон Save -> Save as) ComboFix на вашия десктоп:

След приключване на изтеглянето на ComboFix, иконката на програмата би трябвало да изглежда така:

2. Затворете всички работещи приложения, отворени прозорци и програми работещи във фонов режим. Спрете временно защитата в реално време на антивирусната програма и на другите програми за сигурност, ако има такива.

3. Стартирайте с двоен клик Combofix.exe. Изберете YES, за да се съгласите с условията за използване на програмата. Важно: По време на работата на ComboFix не бива да се движи мишката и да се натискат клавиши от клавиатурата. Просто търпеливо оставете ComboFix да си свърши работата, без да използвате компютъра за други цели.

4. ComboFix ще провери дали Windows Recovery Console e инсталиранa.

*Ако Windows Recovery Console не е инсталирана, ще е необходимо да използвате YES за инсталация на Windows Recovery Console

*Ако Windows Recovery Console е инсталирана, ComboFix ще продължи работата си.

Забележка: Необходимо е да сте свързани към Интернет за да може Windows Recovery Console да се изтегли.

След инсталация на Windows Recovery Console потвърдете с YES, за да продължите напред. Снимка:

5. ComboFix ще спре временно Интернет връзката, но след като приключи работата на програмата тази връзка ще бъде възстановена автоматично. ComboFix ще сканира за проблеми и за заразени файлове, като това може да отнеме известно време. Моля да бъдете търпеливи. Ако има проблем с Интернет връзката след приключване на работата на ComboFix, моля да прочетете това: Manually restoring the Internet connection section.

6. Когато работата на ComboFix приключи, ще се появи текстов документ (log) в Notepad:

Копирайте с (Copy) и поставете с (Paste) съдържанието на лога в следващия си коментар.

лога ComboFix 12-10-19.01 - Jonny 10/20/2012 2:03.2.1 - x86 Microsoft Windows XP Professional 5.1.2600.3.1251.359.1033.18.1014.517 [GMT 3:00] Running from: c:documents and settingsJonnyDesktopComboFix.exe AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D} FW: avast! Internet Security *Enabled* {7591DB91-41F0-48A3-B128-1A293FD8233D} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:windowsReadme.txt c:windowssystem32driversnpf.sys c:windowssystem32Packet.dll c:windowssystem32wpcap.dll . . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . . -------Legacy_NPF -------Service_NPF . . ((((((((((((((((((((((((( Files Created from 2012-09-19 to 2012-10-19 ))))))))))))))))))))))))))))))) . . 2012-10-19 01:41 . 2012-10-19 01:41 -------- d-----w- c:documents and settingsAll UsersApplication DataSUPERAntiSpyware.com 2012-10-19 01:27 . 2012-10-19 18:31 -------- d-----w- c:program filesSUPERAntiSpyware 2012-10-05 07:33 . 2012-10-05 07:33 -------- d-----w- c:documents and settingsJonnyApplication DataApplian FLV and Media Player 2012-10-03 15:58 . 2012-10-19 09:41 -------- d-----w- c:documents and settingsAll UsersApplication DataSpybot - Search & Destroy . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . . . ------- Sigcheck ------- Note: Unsigned files aren't necessarily malware. . [-] 2009-11-05 . 600D58665D16BFBB776EFEFB0E80532D . 1614848 . . [5.1.2600.5512] . . c:windowssystem32sfcfiles.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionexplorershelliconoverlayidentifiers00avast] @="{472083B0-C522-11CF-8763-00608CC02F24}" [HKEY_CLASSES_ROOTCLSID{472083B0-C522-11CF-8763-00608CC02F24}] 2012-03-06 23:15 123536 ----a-w- c:program filesAVAST SoftwareAvastashShell.dll . [HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun] "DAEMON Tools Lite"="c:program filesDAEMON Tools LiteDTLite.exe" [2012-02-13 3481408] . [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun] "RTHDCPL"="RTHDCPL.EXE" [2006-06-28 16248320] "SkyTel"="SkyTel.EXE" [2006-05-16 2879488] "AzMixerSel"="c:program filesRealtekInstallShieldAzMixerSel.exe" [2005-12-21 53248] "SynTPEnh"="c:program filesSynapticsSynTPSynTPEnh.exe" [2006-03-03 761946] "avast"="c:program filesAVAST SoftwareAvastavastUI.exe" [2012-03-06 4241512] "Adobe ARM"="c:program filesCommon FilesAdobeARM1.0AdobeARM.exe" [2012-07-27 919008] . [HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRunOnce] "ShowDeskFix"="shell32" [X] "IE8"="advpack.dll" [2009-11-05 128512] . c:documents and settingsAll UsersStart MenuProgramsStartup FlexType 2K.lnk - c:program filesDatecsFlexType 2KFType2K.exe [2011-5-3 95232] . [HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootMinimalWdf01000.sys] @="Driver" . [HKLM~startupfolderC:^Documents and Settings^All Users^Start Menu^Programs^Startup^BlueSoleil.lnk] path=c:documents and settingsAll UsersStart MenuProgramsStartupBlueSoleil.lnk backup=c:windowspssBlueSoleil.lnkCommon Startup . [HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregSunJavaUpdateSched] 2011-06-09 11:06 254696 ----a-w- c:program filesCommon FilesJavaJava Updatejusched.exe . [HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionrun-] "CNAP2 Launcher"=c:windowsSystem32spoolDRIVERSW32X863CNAP2LAK.EXE "ctfmon.exe"=c:windowssystem32ctfmon.exe "DAEMON Tools Lite"="c:program filesDAEMON Tools LiteDTLite.exe" -autorun "Google Update"="c:documents and settingsJonnyLocal SettingsApplication DataGoogleUpdateGoogleUpdate.exe" /c . [HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionrun-] "LManager"=c:progra~1LAUNCH~1LManager.exe "Adobe ARM"="c:program filesCommon FilesAdobeARM1.0AdobeARM.exe" "igfxtray"=c:windowssystem32igfxtray.exe "igfxhkcmd"=c:windowssystem32hkcmd.exe "igfxpers"=c:windowssystem32igfxpers.exe . [HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList] "%windir%Network Diagnosticxpnetdiag.exe"= "%windir%system32sessmgr.exe"= "c:Program FilesCounter-Strikecstrike.exe"= "c:Program FilesJavajre1.6.0_01binjavaw.exe"= "c:Program FilesCounter-Strikehl.exe"= "c:Program FilesGoogleGoogle Earthclientgoogleearth.exe"= "c:Program FilesGoogleGoogle Earthplugingeplugin.exe"= "c:Program FilesJavajre6binjavaw.exe"= "c:Program FilesuTorrentuTorrent.exe"= "c:Program FilesMicrosoft OfficeOffice14GROOVE.EXE"= "c:Program FilesMicrosoft OfficeOffice14ONENOTE.EXE"= "c:Program FilesMicrosoft OfficeOffice14OUTLOOK.EXE"= "c:Documents and SettingsJonnyDesktopbelot (2).exe"= "c:Program FilesSkypePhoneSkype.exe"= "c:Program FilesJavajre6launch4j-tmpaTunes.exe"= . [HKLM~servicessharedaccessparametersfirewallpolicystandardprofileGloballyOpenPortsList] "5432:TCP"= 5432:TCP:postgres . R0 sptd;sptd;SystemRootSystemRootSystem32Driverssptd.sys --> SystemRootSystemRootSystem32Driverssptd.sys [?] R1 aswKbd;aswKbd;c:windowssystem32driversaswKbd.sys [4/6/2012 3:26 PM 24408] R1 aswSnx;aswSnx;c:windowssystem32driversaswSnx.sys [5/3/2011 8:09 PM 612184] R1 aswSP;aswSP;c:windowssystem32driversaswSP.sys [5/3/2011 12:45 AM 337880] R2 aswFsBlk;aswFsBlk;c:windowssystem32driversaswFsBlk.sys [5/3/2011 12:45 AM 20696] R2 Live Updater Service;Live Updater Service;c:program filesAcerAcer UpdaterUpdaterService.exe [5/6/2012 5:00 PM 255376] R2 NAUpdate;@c:program filesNeroUpdateNASvc.exe,-200;c:program filesNeroUpdateNASvc.exe [5/4/2010 12:07 PM 503080] R2 postgresql-8.4;postgresql-8.4 - PostgreSQL Server 8.4;c:/postgreSQL/bin/pg_ctl.exe runservice -N "postgresql-8.4" -D "c:/postgreSQL/data" -w --> c:/postgreSQL/bin/pg_ctl.exe runservice -N postgresql-8.4 [?] S2 gupdate;Ус»уі° Ѕ° Google рєту°»ё·°цёя (gupdate);c:program filesGoogleUpdateGoogleUpdate.exe [5/4/2011 11:04 PM 136176] S2 SkypeUpdate;Skype Updater;c:program filesSkypeUpdaterUpdater.exe [7/3/2012 1:19 PM 160944] S3 A0380VID;USB2.0 PC Camera;c:windowssystem32DRIVERSA0380Vid.sys --> c:windowssystem32DRIVERSA0380Vid.sys [?] S3 AVerPola;AVerMedia USB Polaris Series Capture Service;c:windowssystem32driversAVerPola.sys [7/26/2011 6:54 PM 314752] S3 AVPolCIR;AVerMedia USB Polaris Series Custom IR Service;c:windowssystem32driversAVPolCIR.sys [7/26/2011 6:54 PM 32896] S3 CAM1690;USB 2.0 Compliance JPEG Video Camera;c:windowssystem32Driverscam1690.sys --> c:windowssystem32Driverscam1690.sys [?] S3 ggflt;SEMC USB Flash Driver Filter;c:windowssystem32driversggflt.sys [6/21/2011 1:27 AM 13224] S3 gupdatem;Ус»уі° Ѕ° Google рєту°»ё·°цёя (gupdatem);c:program filesGoogleUpdateGoogleUpdate.exe [5/4/2011 11:04 PM 136176] S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:program filesMicrosoft OfficeOffice14GROOVE.EXE [6/12/2011 11:15 AM 31125880] S3 osppsvc;Office Software Protection Platform;c:program filesCommon FilesMicrosoft SharedOfficeSoftwareProtectionPlatformOSPPSVC.EXE [1/9/2010 9:37 PM 4640000] S3 PCAMp50;PCAMp50 NDIS Protocol Driver;c:windowssystem32driversPCAMp50.sys [3/18/2012 7:46 PM 28224] S3 s0017bus;Sony Ericsson Device 0017 driver (WDM);c:windowssystem32driverss0017bus.sys [6/20/2011 11:19 PM 86824] S3 s0017mdfl;Sony Ericsson Device 0017 USB WMC Modem Filter;c:windowssystem32driverss0017mdfl.sys [6/20/2011 11:19 PM 15016] S3 s0017mdm;Sony Ericsson Device 0017 USB WMC Modem Driver;c:windowssystem32driverss0017mdm.sys [6/20/2011 11:19 PM 114600] S3 s0017mgmt;Sony Ericsson Device 0017 USB WMC Device Management Drivers (WDM);c:windowssystem32driverss0017mgmt.sys [6/20/2011 11:19 PM 108328] S3 s0017nd5;Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (NDIS);c:windowssystem32driverss0017nd5.sys [6/20/2011 11:19 PM 26024] S3 s0017obex;Sony Ericsson Device 0017 USB WMC OBEX Interface;c:windowssystem32driverss0017obex.sys [6/20/2011 11:19 PM 104616] S3 s0017unic;Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (WDM);c:windowssystem32driverss0017unic.sys [6/20/2011 11:19 PM 109736] . Contents of the 'Scheduled Tasks' folder . 2012-10-19 c:windowsTasksGoogleUpdateTaskMachineCore.job - c:program filesGoogleUpdateGoogleUpdate.exe [2011-05-04 20:04] . 2012-10-19 c:windowsTasksGoogleUpdateTaskMachineUA.job - c:program filesGoogleUpdateGoogleUpdate.exe [2011-05-04 20:04] . 2012-10-19 c:windowsTasksGoogleUpdateTaskUserS-1-5-21-602162358-1614895754-1417001333-1003Core.job - c:documents and settingsJonnyLocal SettingsApplication DataGoogleUpdateGoogleUpdate.exe [2011-06-28 06:09] . 2012-10-19 c:windowsTasksGoogleUpdateTaskUserS-1-5-21-602162358-1614895754-1417001333-1003UA.job - c:documents and settingsJonnyLocal SettingsApplication DataGoogleUpdateGoogleUpdate.exe [2011-06-28 06:09] . . ------- Supplementary Scan ------- . uStart Page = about:blank IE: Add to Google Photos Screensa&ver - c:windowssystem32GPhotos.scr/200 IE: E&xport to Microsoft Excel - c:progra~1MICROS~2Office14EXCEL.EXE/3000 IE: Se&nd to OneNote - c:progra~1MICROS~2Office14ONBttnIE.dll/105 TCP: DhcpNameServer = 192.168.15.15 8.8.8.8 TCP: Interfaces{A9D3989D-DCD4-4F36-884F-82C9D1BEC0CD}: NameServer = 192.168.15.15 . - - - - ORPHANS REMOVED - - - - . SafeBoot-51115604.sys SafeBoot-61690923.sys MSConfigStartUp-MSMSGS - c:program filesMessengermsmsgs.exe MSConfigStartUp-PC Suite Tray - c:program filesNokiaNokia PC Suite 7PCSuite.exe MSConfigStartUp-QuickTime Task - c:program filesQuickTimeqttask.exe MSConfigStartUp-Sony Ericsson PC Companion - c:program filesSony EricssonSony Ericsson PC CompanionPCCompanion.exe AddRemove-unibetpoker (Poker) - c:microgamingPokerunibetpokerMPPinstall.exe . . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2012-10-20 02:23 Windows 5.1.2600 Service Pack 3 NTFS . scanning hidden processes ... . scanning hidden autostart entries ... . scanning hidden files ... . scan completed successfully hidden files: 0 . ************************************************************************** . [HKEY_LOCAL_MACHINESystemControlSet002Servicespostgresql-8.4] "ImagePath"="c:/postgreSQL/bin/pg_ctl.exe runservice -N "postgresql-8.4" -D "c:/postgreSQL/data" -w" . [HKEY_LOCAL_MACHINESystemControlSet002Servicespostgresql-8.4] "ImagePath"="c:/postgreSQL/bin/pg_ctl.exe runservice -N "postgresql-8.4" -D "c:/postgreSQL/data" -w" . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_LOCAL_MACHINEsoftwareMicrosoftCryptographyRNG*] "Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d, bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99, "Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d, bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99, "Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d, bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99, "Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d, bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99, "Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d, bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99, "Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d, bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99, "Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d, bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99, "Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d, bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99, . --------------------- DLLs Loaded Under Running Processes --------------------- . - - - - - - - > 'explorer.exe'(2128) c:windowssystem32WININET.dll c:windowssystem32newdll.dll c:windowssystem32msi.dll c:progra~1COMMON~1MICROS~1OFFICE14Culturesoffice.odf c:progra~1MICROS~2Office141033GrooveIntlResource.dll c:windowssystem32ieframe.dll c:windowssystem32webcheck.dll c:windowssystem32wpdshserviceobj.dll c:windowssystem32portabledevicetypes.dll c:windowssystem32portabledeviceapi.dll . ------------------------ Other Running Processes ------------------------ . c:program filesAVAST SoftwareAvastAvastSvc.exe c:program filesJavajre6binjqs.exe c:postgresqlbinpg_ctl.exe c:postgresqlbinpostgres.exe c:postgresqlbinpostgres.exe c:postgresqlbinpostgres.exe c:postgresqlbinpostgres.exe c:postgresqlbinpostgres.exe c:windowsRTHDCPL.EXE c:windowssystem32wscntfy.exe c:docume~1JonnyLOCALS~1TempRtkBtMnt.exe . ************************************************************************** . Completion time: 2012-10-20 02:31:02 - machine was rebooted ComboFix-quarantined-files.txt 2012-10-19 23:30 . Pre-Run: 14,631,878,656 bytes free Post-Run: 14,935,195,648 bytes free . WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)WINDOWS [operating systems] c:cmdconsBOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons UnsupportedDebug="do not select this" /debug multi(0)disk(0)rdisk(0)partition(1)WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect . - - End Of File - - 79DE084892A1DE7E8A4EAD9589238069

Изтеглете този файл и го запазете на десктопа.

Отворете notepad и с copy/paste въведете следната информация:

@echo Unpacking files ...

@echo (This window will close when it's done)

@echo off

MKdir C:\SP3

WindowsXP-KB936929-SP3-x86-ENU.exe -x: C:\SP3 /quiet

cd C:\SP3\i386

expand sfcfiles.dl_ C:\SP3\sfcfiles.dll

Запазете файла с името expand.bat и го стартирайте.

Ще се създаде папка на C:\ с името SP3.

След това:

• Отворете notepad и с copy/paste въведете следната информация).

  Fcopy::

  C:\SP3\sfcfiles.dll | c:\windows\system32\sfcfiles.dll

  Folder::

  c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com

  c:\program files\SUPERAntiSpyware

  Registry::

  [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

  "ShowDeskFix"=-

  ClearJavaCache::

• Запазете файла с име CFScript и го провлачете и пуснете в Combofix (както е показано на картинката отдолу).

  

• По време на сканиране от страна на ComboFix не стартирайте никакви други приложения, не натискайте клавиши от клавиатурата и не местете мишката !
• Публикувайте лог файла, който ще се създаде след рестарта на компютъра в следващия си пост.

След като стартирах expand.bat това продължава безкрай. Да продължа ли със скрипта за ComboFix ...... (This window will close when it's done) A subdirectory or file C:SP3 already exists. 'WindowsXP-KB936929-SP3-x86-ENU.exe' is not recognized as an internal or externa l command, operable program or batch file. The system cannot find the path specified. Unpacking files ... (This window will close when it's done) A subdirectory or file C:SP3 already exists. 'WindowsXP-KB936929-SP3-x86-ENU.exe' is not recognized as an internal or externa l command, operable program or batch file. The system cannot find the path specified. Unpacking files ... (This window will close when it's done) A subdirectory or file C:SP3 already exists. 'WindowsXP-KB936929-SP3-x86-ENU.exe' is not recognized as an internal or externa l command, operable program or batch file. The system cannot find the path specified. c:sp3 е празна

Редактирано 20 октомври 201213 г. от Nikolai Lulchev (преглед на промените)

С какво име сте запазили сваления на дескоп файл?

Моя грешка. Това със свалянето съм го изпуснал. Може би заради малките часове. Свалянето ще отнеме около 40 мин. Нека продължим "утре" по светло, след като публикувам лог файла. Благодаря.

ComboFix 12-10-19.01 - Jonny 10/20/2012 13:17:48.3.1 - x86 Microsoft Windows XP Professional 5.1.2600.3.1251.359.1033.18.1014.629 [GMT 3:00] Running from: c:documents and settingsJonnyDesktopComboFix.exe Command switches used :: c:documents and settingsJonnyDesktopCFScript.txt AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D} FW: avast! Internet Security *Enabled* {7591DB91-41F0-48A3-B128-1A293FD8233D} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:documents and settingsAll UsersApplication DataSUPERAntiSpyware.com c:documents and settingsAll UsersApplication DataSUPERAntiSpyware.comSUPERAntiSpywareSDDLLSSD10005.dll c:documents and settingsAll UsersApplication DataSUPERAntiSpyware.comSUPERAntiSpywareSDDLLSSD10006.dll c:documents and settingsAll UsersApplication DataSUPERAntiSpyware.comSUPERAntiSpywareSDDLLSSD10007.dll c:documents and settingsAll UsersApplication DataSUPERAntiSpyware.comSUPERAntiSpywareSDDLLSUIREPAIR.DLL c:program filesSUPERAntiSpyware . . --------------- FCopy --------------- . c:sp3sfcfiles.dll --> c:windowssystem32sfcfiles.dll . ((((((((((((((((((((((((( Files Created from 2012-09-20 to 2012-10-20 ))))))))))))))))))))))))))))))) . . 2012-10-20 00:09 . 2012-10-20 09:47 -------- d-----w- C:SP3 2012-10-05 07:33 . 2012-10-05 07:33 -------- d-----w- c:documents and settingsJonnyApplication DataApplian FLV and Media Player 2012-10-03 15:58 . 2012-10-19 09:41 -------- d-----w- c:documents and settingsAll UsersApplication DataSpybot - Search & Destroy . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionexplorershelliconoverlayidentifiers00avast] @="{472083B0-C522-11CF-8763-00608CC02F24}" [HKEY_CLASSES_ROOTCLSID{472083B0-C522-11CF-8763-00608CC02F24}] 2012-03-06 23:15 123536 ----a-w- c:program filesAVAST SoftwareAvastashShell.dll . [HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun] "DAEMON Tools Lite"="c:program filesDAEMON Tools LiteDTLite.exe" [2012-02-13 3481408] . [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun] "RTHDCPL"="RTHDCPL.EXE" [2006-06-28 16248320] "SkyTel"="SkyTel.EXE" [2006-05-16 2879488] "AzMixerSel"="c:program filesRealtekInstallShieldAzMixerSel.exe" [2005-12-21 53248] "SynTPEnh"="c:program filesSynapticsSynTPSynTPEnh.exe" [2006-03-03 761946] "avast"="c:program filesAVAST SoftwareAvastavastUI.exe" [2012-03-06 4241512] "Adobe ARM"="c:program filesCommon FilesAdobeARM1.0AdobeARM.exe" [2012-07-27 919008] . [HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRunOnce] "IE8"="advpack.dll" [2009-11-05 128512] . c:documents and settingsAll UsersStart MenuProgramsStartup FlexType 2K.lnk - c:program filesDatecsFlexType 2KFType2K.exe [2011-5-3 95232] . [HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootMinimalWdf01000.sys] @="Driver" . [HKLM~startupfolderC:^Documents and Settings^All Users^Start Menu^Programs^Startup^BlueSoleil.lnk] path=c:documents and settingsAll UsersStart MenuProgramsStartupBlueSoleil.lnk backup=c:windowspssBlueSoleil.lnkCommon Startup . [HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregSunJavaUpdateSched] 2011-06-09 11:06 254696 ----a-w- c:program filesCommon FilesJavaJava Updatejusched.exe . [HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionrun-] "CNAP2 Launcher"=c:windowsSystem32spoolDRIVERSW32X863CNAP2LAK.EXE "ctfmon.exe"=c:windowssystem32ctfmon.exe "DAEMON Tools Lite"="c:program filesDAEMON Tools LiteDTLite.exe" -autorun "Google Update"="c:documents and settingsJonnyLocal SettingsApplication DataGoogleUpdateGoogleUpdate.exe" /c . [HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionrun-] "LManager"=c:progra~1LAUNCH~1LManager.exe "Adobe ARM"="c:program filesCommon FilesAdobeARM1.0AdobeARM.exe" "igfxtray"=c:windowssystem32igfxtray.exe "igfxhkcmd"=c:windowssystem32hkcmd.exe "igfxpers"=c:windowssystem32igfxpers.exe . [HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList] "%windir%Network Diagnosticxpnetdiag.exe"= "%windir%system32sessmgr.exe"= "c:Program FilesCounter-Strikecstrike.exe"= "c:Program FilesJavajre1.6.0_01binjavaw.exe"= "c:Program FilesCounter-Strikehl.exe"= "c:Program FilesGoogleGoogle Earthclientgoogleearth.exe"= "c:Program FilesGoogleGoogle Earthplugingeplugin.exe"= "c:Program FilesJavajre6binjavaw.exe"= "c:Program FilesuTorrentuTorrent.exe"= "c:Program FilesMicrosoft OfficeOffice14GROOVE.EXE"= "c:Program FilesMicrosoft OfficeOffice14ONENOTE.EXE"= "c:Program FilesMicrosoft OfficeOffice14OUTLOOK.EXE"= "c:Documents and SettingsJonnyDesktopbelot (2).exe"= "c:Program FilesSkypePhoneSkype.exe"= "c:Program FilesJavajre6launch4j-tmpaTunes.exe"= . [HKLM~servicessharedaccessparametersfirewallpolicystandardprofileGloballyOpenPortsList] "5432:TCP"= 5432:TCP:postgres . R0 sptd;sptd;SystemRootSystemRootSystem32Driverssptd.sys --> SystemRootSystemRootSystem32Driverssptd.sys [?] R1 aswKbd;aswKbd;c:windowssystem32driversaswKbd.sys [4/6/2012 3:26 PM 24408] R1 aswSnx;aswSnx;c:windowssystem32driversaswSnx.sys [5/3/2011 8:09 PM 612184] R1 aswSP;aswSP;c:windowssystem32driversaswSP.sys [5/3/2011 12:45 AM 337880] R2 aswFsBlk;aswFsBlk;c:windowssystem32driversaswFsBlk.sys [5/3/2011 12:45 AM 20696] R2 Live Updater Service;Live Updater Service;c:program filesAcerAcer UpdaterUpdaterService.exe [5/6/2012 5:00 PM 255376] R2 NAUpdate;@c:program filesNeroUpdateNASvc.exe,-200;c:program filesNeroUpdateNASvc.exe [5/4/2010 12:07 PM 503080] R2 postgresql-8.4;postgresql-8.4 - PostgreSQL Server 8.4;c:/postgreSQL/bin/pg_ctl.exe runservice -N "postgresql-8.4" -D "c:/postgreSQL/data" -w --> c:/postgreSQL/bin/pg_ctl.exe runservice -N postgresql-8.4 [?] S2 gupdate;Ус»уі° Ѕ° Google рєту°»ё·°цёя (gupdate);c:program filesGoogleUpdateGoogleUpdate.exe [5/4/2011 11:04 PM 136176] S2 SkypeUpdate;Skype Updater;c:program filesSkypeUpdaterUpdater.exe [7/3/2012 1:19 PM 160944] S3 A0380VID;USB2.0 PC Camera;c:windowssystem32DRIVERSA0380Vid.sys --> c:windowssystem32DRIVERSA0380Vid.sys [?] S3 AVerPola;AVerMedia USB Polaris Series Capture Service;c:windowssystem32driversAVerPola.sys [7/26/2011 6:54 PM 314752] S3 AVPolCIR;AVerMedia USB Polaris Series Custom IR Service;c:windowssystem32driversAVPolCIR.sys [7/26/2011 6:54 PM 32896] S3 CAM1690;USB 2.0 Compliance JPEG Video Camera;c:windowssystem32Driverscam1690.sys --> c:windowssystem32Driverscam1690.sys [?] S3 ggflt;SEMC USB Flash Driver Filter;c:windowssystem32driversggflt.sys [6/21/2011 1:27 AM 13224] S3 gupdatem;Ус»уі° Ѕ° Google рєту°»ё·°цёя (gupdatem);c:program filesGoogleUpdateGoogleUpdate.exe [5/4/2011 11:04 PM 136176] S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:program filesMicrosoft OfficeOffice14GROOVE.EXE [6/12/2011 11:15 AM 31125880] S3 osppsvc;Office Software Protection Platform;c:program filesCommon FilesMicrosoft SharedOfficeSoftwareProtectionPlatformOSPPSVC.EXE [1/9/2010 9:37 PM 4640000] S3 PCAMp50;PCAMp50 NDIS Protocol Driver;c:windowssystem32driversPCAMp50.sys [3/18/2012 7:46 PM 28224] S3 s0017bus;Sony Ericsson Device 0017 driver (WDM);c:windowssystem32driverss0017bus.sys [6/20/2011 11:19 PM 86824] S3 s0017mdfl;Sony Ericsson Device 0017 USB WMC Modem Filter;c:windowssystem32driverss0017mdfl.sys [6/20/2011 11:19 PM 15016] S3 s0017mdm;Sony Ericsson Device 0017 USB WMC Modem Driver;c:windowssystem32driverss0017mdm.sys [6/20/2011 11:19 PM 114600] S3 s0017mgmt;Sony Ericsson Device 0017 USB WMC Device Management Drivers (WDM);c:windowssystem32driverss0017mgmt.sys [6/20/2011 11:19 PM 108328] S3 s0017nd5;Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (NDIS);c:windowssystem32driverss0017nd5.sys [6/20/2011 11:19 PM 26024] S3 s0017obex;Sony Ericsson Device 0017 USB WMC OBEX Interface;c:windowssystem32driverss0017obex.sys [6/20/2011 11:19 PM 104616] S3 s0017unic;Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (WDM);c:windowssystem32driverss0017unic.sys [6/20/2011 11:19 PM 109736] . Contents of the 'Scheduled Tasks' folder . 2012-10-19 c:windowsTasksGoogleUpdateTaskMachineCore.job - c:program filesGoogleUpdateGoogleUpdate.exe [2011-05-04 20:04] . 2012-10-20 c:windowsTasksGoogleUpdateTaskMachineUA.job - c:program filesGoogleUpdateGoogleUpdate.exe [2011-05-04 20:04] . 2012-10-19 c:windowsTasksGoogleUpdateTaskUserS-1-5-21-602162358-1614895754-1417001333-1003Core.job - c:documents and settingsJonnyLocal SettingsApplication DataGoogleUpdateGoogleUpdate.exe [2011-06-28 06:09] . 2012-10-20 c:windowsTasksGoogleUpdateTaskUserS-1-5-21-602162358-1614895754-1417001333-1003UA.job - c:documents and settingsJonnyLocal SettingsApplication DataGoogleUpdateGoogleUpdate.exe [2011-06-28 06:09] . . ------- Supplementary Scan ------- . uStart Page = about:blank IE: Add to Google Photos Screensa&ver - c:windowssystem32GPhotos.scr/200 IE: E&xport to Microsoft Excel - c:progra~1MICROS~2Office14EXCEL.EXE/3000 IE: Se&nd to OneNote - c:progra~1MICROS~2Office14ONBttnIE.dll/105 TCP: DhcpNameServer = 192.168.15.15 8.8.8.8 TCP: Interfaces{A9D3989D-DCD4-4F36-884F-82C9D1BEC0CD}: NameServer = 192.168.15.15 . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2012-10-20 13:30 Windows 5.1.2600 Service Pack 3 NTFS . scanning hidden processes ... . scanning hidden autostart entries ... . scanning hidden files ... . scan completed successfully hidden files: 0 . ************************************************************************** . [HKEY_LOCAL_MACHINESystemControlSet002Servicespostgresql-8.4] "ImagePath"="c:/postgreSQL/bin/pg_ctl.exe runservice -N "postgresql-8.4" -D "c:/postgreSQL/data" -w" . [HKEY_LOCAL_MACHINESystemControlSet002Servicespostgresql-8.4] "ImagePath"="c:/postgreSQL/bin/pg_ctl.exe runservice -N "postgresql-8.4" -D "c:/postgreSQL/data" -w" . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_LOCAL_MACHINEsoftwareMicrosoftCryptographyRNG*] "Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d, bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99, "Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d, bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99, "Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d, bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99, "Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d, bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99, "Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d, bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99, "Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d, bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99, "Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d, bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99, "Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d, bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99, . Completion time: 2012-10-20 13:33:26 ComboFix-quarantined-files.txt 2012-10-20 10:33 ComboFix2.txt 2012-10-19 23:31 . Pre-Run: 14,177,939,456 bytes free Post-Run: 14,154,063,872 bytes free . - - End Of File - - 6956856974852C5081B237C88F3DD727

Има ли някаква промяна...логовете са чисти.

СТЪПКА 1

След като излекувахме файла отговорен за Windows File Protection да проваме следното:

Отворете Start Menu => Run => въведете командата: CMD => Натиснсте Enter.

Сега въведете командата sfc /scannow (Преди да натиснете Enter) поставете инсталационния диск на Windows в оптичното устройство.

СТЪПКА 2

Изтеглете OTL.exe и го запазете на десктопа.

• Стартирайте OTL (ако е необходимо, потвърдете през UAC).
• Направете следните настройки:
• Сложете отметка пред Scan All Users
• Под менюто File Age изберете 90 days
• Под менюто Standard Registry променете на ALL
• Сложете отметки пред LOP и Purity Check

Под с Copy/ Paste въведете изцяло следната текстова информация (само това, което е поставено в карето):

netsvcs

msconfig

safebootminimal

safebootnetwork

activex

drivers32

%SYSTEMDRIVE%\*.*

%USERPROFILE%\*.*

%USERPROFILE%\Application Data\*.*

%USERPROFILE%\Application Data\*.

%USERPROFILE%\Local Settings\*.*

%USERPROFILE%\Local Settings\temp\*.exe

%USERPROFILE%\Local Settings\Temporary Internet Files\*.exe

%USERPROFILE%\Local Settings\Application Data\*.*

%AllUsersProfile%\*.*

%AllUsersProfile%\Application Data\*.*

%AllUsersProfile%\Application Data\*.

%AllUsersProfile%\Application Data\Local Settings\*.*

%AllUsersProfile%\Application Data\Local Settings\Temp\*.exe

%ALLUSERSPROFILE%\Documents\My Music\*.exe

%ALLUSERSPROFILE%\Documents\My Pictures\*.exe

%ALLUSERSPROFILE%\Documents\My Videos\*.exe

%ALLUSERSPROFILE%\Documents\*.exe

%USERPROFILE%\My Documents\*.*

%CommonProgramFiles%\*.*

%CommonProgramFiles%\ComObjects*.*

%PROGRAMFILES%\*.*

%PROGRAMFILES%\*.

%systemroot%\system32\config\systemprofile\*.*

%systemroot%\system32\config\systemprofile\Application Data\*.*

%systemroot%\system32\config\systemprofile\\Local Settings\*.*

%systemroot%\system32\config\systemprofile\\Local Settings\Application Data\*.*

%systemroot%\system32\config\systemprofile\\Local Settings\Temp\*.exe

%systemroot%\system32\config\systemprofile\\Local Settings\Temporary Internet Files\*.exe

C:\Documents and Settings\LocalService\Application Data\*.*

C:\Documents and Settings\LocalService\Local Settings\Application Data\*.*

C:\Documents and Settings\LocalService\Local Settings\temp\*.exe

C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\*.exe

C:\Documents and Settings\LocalService\Local Settings\*.*

C:\Documents and Settings\LocalService\*.*

C:\Documents and Settings\NetworkService\Application Data\*.*

C:\Documents and Settings\NetworkService\Local Settings\Application Data\*.*

C:\Documents and Settings\NetworkService\Local Settings\temp\*.exe

C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\*.exe

C:\Documents and Settings\NetworkService\Local Settings\*.*

C:\Documents and Settings\NetworkService\*.*

%windir%\temp\*.exe

%windir%\*.

%windir%\installer\*.

%windir%\system32\*.

%Temp%\smtmp\1\*.*

%Temp%\smtmp\2\*.*

%Temp%\smtmp\3\*.*

%Temp%\smtmp\4\*.*

%systemroot%\system32\*.dll /lockedfiles

%systemroot%\Tasks\*.job /lockedfiles

%systemroot%\system32\drivers\*.sys /90

%systemroot%\system32\drivers\*.sys /lockedfiles

%systemroot%\system32\Spool\prtprocs\w32x86\*.dll

%systemroot%\*. /rp /s

%systemroot%\assembly\tmp\*.* /S /MD5

%systemroot%\assembly\temp\*.* /S /MD5

%systemroot%\assembly\GAC\*.ini

%systemroot%\assembly\GAC_32\*.ini

%SystemRoot%\assembly\GAC_MSIL\*.ini

wsSystemRoot|l,n,u,@;True;False;True;$,{ /fn

%systemdrive%\$Recycle.Bin|@;true;true;true /fp

HKEY_CLASSES_ROOT\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24} /s

HKEY_CLASSES_ROOT\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1} /s

HKEY_CURRENT_USER\Software\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1} /s

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1} /s

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1} /s

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a2a9545d-a0c2-42b4-9708-a0b2badd77c8} /s

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24} /s

HKEY_CLASSES_ROOT\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F} /s

HKEY_CLASSES_ROOT\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9} /s

HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9} /s

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F} /s

HKEY_CURRENT_USER\Software\Classes\clsid\{12d0253a-7c96-815c-11e0-3034bbd97cc0}] /s

HKEY_CURRENT_USER\Software\MSOLoad /s

>C:\commands.txt echo list vol /raw /hide /c

/wait

>C:\DiskReport.txt diskpart /s C:\commands.txt /raw /hide /c

/wait

type c:\diskreport.txt /c

/wait

erase c:\commands.txt /hide /c

/wait

erase c:\diskreport.txt /hide /c

/md5start

eventlog.dll

scecli.dll

netlogon.dll

cngaudit.dll

sceclt.dll

ntelogon.dll

logevent.dll

consrv.dll

services.exe

svchost.exe

explorer.exe

userinit.exe

winlogon.exe

smss.exe

lsass.exe

atapi.sys

iaStor.sys

serial.sys

disk.sys

volsnap.sys

redbook.sys

i8042prt.sys

afd.sys

netbt.sys

tcpip.sys

ipsec.sys

hlp.dat

str.sys

crexv.ocx

/md5stop

• Натиснете маркираният в синьо бутон: Run Scan.
• Като приключи проверката, ще се създадат два файла - OTL.Txt и Extras.Txt. Прикачете тези два файла в следващия си коментар (погледнете опцията Прикачени файлове, когато публикувате мнение).

СТЪПКА 3

Изтеглете Malwarebytes' Anti-Malware

• Кликнете два пъти върху mbam-setup.exe, за да инсталирате програмата.
• Уверете се, че са поставени отметки на Update Malwarebytes' Anti-Malware и Launch Malwarebytes' Anti-Malware. След това кликнете на Finish.
• Ако има намерени обновявания, тя ще ги изтегли и инсталира.
• Стартирайте програмата и изберете "Perform Quick Scan", след това кликнете на Scan.
• Сканирането ще отнеме малко време, затова моля да бъдете търпеливи.
• Когато сканирането завърши, кликнете на OK, след това Show Results, за да видите резултата.
• Уверете се, че на всички редове има отметки, и кликнете на Remove Selected.
• Когато всичко бъде премахнато, в Notepad ще бъде отворен лог.
• Копирайте този лог и го публикувайте в следващия си коментар по темата.

Забележка: Ако MalwareBytes' Anti-Malware се затрудни в премахването на откритите вируси/заплахи, той ще поиска да рестартира компютъра Ви и по време на рестартирането да премахне проблемните вируси/заплахи. Ако бъдете попитани, потвърдете че желаете вашия компютър да бъде рестартиран.

СТЪПКА 4

• Изтеглете MiniToolBox.exe и го запазете на десктопа.
• Сложете последните 4-тири отметки и натиснете Go.
• Копирайте съдържанието на файла Result.txt в следващия си пост.

СТЪПКА 5

Изтеглете Farbar Service Scanner и я стартирайте.

• Сложете всички отметки и натиснете бутона "Scan".
• Ще се създаде лог файл с името (FSS.txt) в папката откъдето стартирате инструмента.
• Копирайте съдържанието на лог файла в следващия си пост.

Стъпка 1 е компрометирана. Трябваше да skip-на доста файлове. Иначе продължава да работи тежко. Бавно зарежда и стартира каквото и да е. Malwarebytes Anti-Malware 1.65.1.1000 www.malwarebytes.org Database version: v2012.10.22.05 Windows XP Service Pack 3 x86 NTFS Internet Explorer 8.0.6001.18702 Jonny :: JONNY [administrator] 10/23/2012 12:12:36 AM mbam-log-2012-10-23 (00-12-36).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 209579 Time elapsed: 25 minute(s), 27 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end) MiniToolBox by Farbar Version: 23-07-2012 Ran by Jonny (administrator) on 23-10-2012 at 00:41:51 Microsoft Windows XP Professional Service Pack 3 (X86) Boot Mode: Normal *************************************************************************** ========================= Devices: ================================ ========================= Memory info: =================================== Percentage of memory in use: 56% Total physical RAM: 1014.05 MB Available physical RAM: 440.18 MB Total Pagefile: 2440.3 MB Available Pagefile: 1762.06 MB Total Virtual: 2047.88 MB Available Virtual: 1975.14 MB ========================= Partitions: ===================================== 1 Drive c: () (Fixed) (Total:74.52 GB) (Free:11.3 GB) NTFS 3 Drive e: (GRTMPVOL_EN) (CDROM) (Total:0.6 GB) (Free:0 GB) CDFS ========================= Users: ======================================== User accounts for \\JONNY Administrator ASPNET Guest HelpAssistant Jonny postgres SUPPORT_388945a0 ========================= Minidump Files ================================== No minidump file found ========================= Restore Points ================================== 05-10-2012 07:25:11 Removed QuickTime 06-10-2012 12:29:24 System Checkpoint 07-10-2012 20:08:17 System Checkpoint 08-10-2012 20:53:19 System Checkpoint 09-10-2012 20:54:33 System Checkpoint 11-10-2012 10:20:59 System Checkpoint 12-10-2012 16:36:57 System Checkpoint 13-10-2012 16:58:06 System Checkpoint 14-10-2012 17:00:13 System Checkpoint 15-10-2012 17:22:22 System Checkpoint 16-10-2012 17:50:41 System Checkpoint 17-10-2012 18:29:36 System Checkpoint 19-10-2012 01:30:34 Installed Windows XP KB950582. 19-10-2012 18:25:22 Removed TuneUp Utilities 2012 19-10-2012 18:29:06 Removed TuneUp Utilities Language Pack (en-US) **** End of log **** Farbar Service Scanner Version: 19-10-2012 Ran by Jonny (administrator) on 23-10-2012 at 00:44:16 Running from "C:\Documents and Settings\Jonny\Desktop" Microsoft Windows XP Professional Service Pack 3 (X86) Boot Mode: Normal **************************************************************** Internet Services: ============ Connection Status: ============== Localhost is accessible. LAN connected. Google IP is accessible. Google.com is accessible. Yahoo IP is accessible. Yahoo.com is accessible. Windows Firewall: ============= Firewall Disabled Policy: ================== System Restore: ============ System Restore Disabled Policy: ======================== Security Center: ============ Windows Update: ============ Windows Autoupdate Disabled Policy: ============================ File Check: ======== C:\WINDOWS\system32\dhcpcsvc.dll => MD5 is legit C:\WINDOWS\system32\Drivers\afd.sys => MD5 is legit C:\WINDOWS\system32\Drivers\netbt.sys => MD5 is legit C:\WINDOWS\system32\Drivers\tcpip.sys => MD5 is legit C:\WINDOWS\system32\Drivers\ipsec.sys => MD5 is legit C:\WINDOWS\system32\dnsrslvr.dll => MD5 is legit C:\WINDOWS\system32\ipnathlp.dll => MD5 is legit C:\WINDOWS\system32\netman.dll => MD5 is legit C:\WINDOWS\system32\wbem\WMIsvc.dll => MD5 is legit C:\WINDOWS\system32\srsvc.dll => MD5 is legit C:\WINDOWS\system32\Drivers\sr.sys => MD5 is legit C:\WINDOWS\system32\wscsvc.dll => MD5 is legit C:\WINDOWS\system32\wbem\WMIsvc.dll => MD5 is legit C:\WINDOWS\system32\wuauserv.dll => MD5 is legit C:\WINDOWS\system32\qmgr.dll => MD5 is legit C:\WINDOWS\system32\es.dll => MD5 is legit C:\WINDOWS\system32\cryptsvc.dll => MD5 is legit C:\WINDOWS\system32\svchost.exe => MD5 is legit C:\WINDOWS\system32\rpcss.dll => MD5 is legit C:\WINDOWS\system32\services.exe => MD5 is legit Extra List: ======= aswTdi(8) Gpc(6) IPSec(4) NetBT(5) PSched(7) Tcpip(3) 0x09000000040000000100000002000000030000000900000008000000050000000600000007000000 IpSec Tag value is correct. **** End of log ****

OTL.Txt

Extras.Txt

Защо сте скипвали файловете от sfc /scannow?

Отделно в логовете не се виждат заради и проблема не се дължи на зловреден софтуер (като цяло не е за този раздел темата).

Деинсталирайте тежките програми и сложете леки алтернативи:

Деинсталирайте avast! и сложете Avira временно...

Деинсталирайте Skype Click to Call добавката (ако не я използвате)...

Деинсталирайте Nero и временно сложете BurnAware...(ако не ви се маха Nero, поне спрете излишните му процеси - Start => run => services => и сложете следните услуги Skype Updater, NAUpdate, Live Updater Service => на Disabled).

Деинсталирайте FlexType 2K и си сложете нормална фонетика: => Вижте http://forums.softvisia.com/index.php/topic/6641-nr-bg-fix-tool-%D0%BE%D1%84%D0%B8%D1%86%D0%B8%D0%B0%D0%BB%D0%BD%D0%B0-%D1%82%D0%B5%D0%BC%D0%B0/

Деинсталирайте Daemon Tools, след това изтеглете SPTDinst-v183-x86.exe (стартирайте го и изберете Uninstall)...Качете наново Daemon Tools без да инсталирате SPTD драйвъра.

Намалете програмите вървящи във фонов режим:

Start => Run => msconfig => Startup => премахнете отметките пред:

Adobe ARM

AzMixerSel

RTHDCPL

SkyTel

DAEMON Tools Lite

SunJavaUpdateSched

След това натиснете Apply

Още един процес, който можете да премахнете са известията от Security Center-a:

Start Menu => Control Panel => Change the way Security Centre alerts me => премахни и 3-те отметки (като се увериш, че все пак имаш актуална антивирусна програма, всички ъпдейти за Windows инсталирани и включена вградената защитна стена или друг алтернативен продукт).

Изтрийте ръчно следния файл: C:\Documents and Settings\All Users\Application Data\mtbjfghn.xbe

Използвайте това приложение - PatchMyPC за да обновите старите програми. Добре е да държите и винаги Windows Update на автоматичен режим (ако минаване Genuine проверката).

А за да почистим използваните от нас инструменти

1. Start => Run => въведете командата: Combofix /Uninstall => Enter

2 Изтеглете OTC.exe и го стартирайте. Натиснете бутона CleanUp!.

Рестартирайте компютъра, ако ви попита!

За финал прочетете тази тема: http://forums.softvisia.com/index.php/topic/13912-%D1%80%D1%8A%D0%BA%D0%BE%D0%B2%D0%BE%D0%B4%D1%81%D1%82%D0%B2%D0%BE-%D0%B7%D0%B0-%D0%BF%D0%BE%D0%B4%D0%B4%D1%80%D1%8A%D0%B6%D0%BA%D0%B0-%D0%BD%D0%B0-windows-xp-vista-%D0%B8-7-revision-20/ (все важни неща като актуализация на драйвърите, премахването на излишните програми, дегфрагментацията на системния дял, премахване на някои визуални ефекти с цел бързодействие на системата и т.н.).

Поздрави!

Благодаря за отделеното време. Направих всичко, но работата е все така тегава. Ще се запозная с темата за Уиндоус и ще пусна една чиста инсталация.