Проблем с вирус worm/Downadup

17 декември 201213 г.

Здравейте преди около 5/6 седмици в компютъра ми влезе вирус Worm/Downadup при което

SD/DVD и Лан картата спряха да работят и си сложих USB-Ланкарта при което отново имах интернет.На другият ден занесох компютъра на преинсталация при Интернет Доставчика си

След около 6 дена си го прибрах.Всички драйвери бяха качени също така този който ми преинсталира компютъра ми каза ,че е качил и драйверите на Дънната Лан Карта но тя не е искала да проработи явно е изгоряла а SD-устройството явно и то си е заминало.След като си занесох компютъра в къщи забелязах ,че ми

липсва Драйверът Directx 9.0.При опит за инсталация от флашПамет излиза следната грешка:
An internal system error occurred.
Pleace refer to DXError.log and DirectX.log in your Windows folder to determine problem.
педи 2/3 дена създадох тема в която ми помагаха как да разреша проблема но и така не се реши.Също така Днес забелязах че SD/DVD устройството ми липсва в Моят Компютър.
Рестартирах влезнах в BIOS на системата и беше включено.След като ми зареди компютъра реших да вляза десен бутон на моят компютър/Свойства/Хардуер/Диспечер на устройствата и там го нямаше.Отворих кутията кабелите на SD си бяха на ред.
И сега се досетих дали този ЧЕРВЕЙ който ми бе влязъл не се е преместил преди преинсталацията в Дял D: тъй като там имам над 5000снимки.

Системата ми е:

Microsoft Windows XP

Profesional

версия 2002
Service Pack 3
DriverPack Solution
NVIDIA AWRDACPI
AMD Athlom™ 64 X2Dual core procesor 4200+
2.21Гхц 1.0ГБ РАМ

Бях намислил отново да го преинсталирам с помощта на по-големият ми брат и неговото SD/DVD устройство но първо реших да опитам с ваша помощ дали ще мога да си реша проблема тъй като мисля ,че не е редно да го преинсталирам 2ри път и то след като е минало едвам 1 месец.

17 декември 201213 г.

Автор

Явно "много хубаво" са ти го преинсталирали... Куцо и сакато преинсталира уиндоуси, без да обърне внимание на елементарни процедури по съхранение на данни и защита от повторно заразяване.
Намери някой кадърен, който да ти преинсталира уиндоуса грамотно.

http://en.wikipedia.org/wiki/Conficker

Ами брат ми друк няма кой.тъйкато живея в малак град и всички са такива уш специалисти а искат по 40лв.за преинсталация другият вариант е да го откарам на София при един мой познат но много бие през джоба

занесох си кошника при доставчика тъй като е безплатно но се оказа с извинение че го казвам напълно пр**бан

17 декември 201213 г.

За да проверим за зарази следвайте това - Системата ми е инфектирана - Какво да правя сега?

За останалите проблеми ще ви пренасоча към съответните раздели - Операционни Системи или Общи хардуерни въпроси...

Ако въпросната Лан карта и SD карта са изгоряли ние няма какво да направим по-въпроса.

DirectX не е драйвър и по-принцип е вграден в самата Операционна Система...добре е да се обнови до послената версия.

Колкото за DVD устройството, щом го няма и в Device Manager-a явно може да не е вързано...можете да отворите кутията и да проверите...не вярвам и 3-те устройства да са заминали, освен ако този, който го е преинсталирал не го е налагал с чук!

Поздрави!

17 декември 201213 г.

Автор

За да проверим за зарази следвайте това - Системата ми е инфектирана - Какво да правя сега?
За останалите проблеми ще ви пренасоча към съответните раздели - Операционни Системи или Общи хардуерни въпроси...
Ако въпросната Лан карта и SD карта са изгоряли ние няма какво да направим по-въпроса.
DirectX не е драйвър и по-принцип е вграден в самата Операционна Система...добре е да се обнови до послената версия.
Колкото за DVD устройството, щом го няма и в Device Manager-a явно може да не е вързано...можете да отворите кутията и да проверите...не вярвам и 3-те устройства да са заминали, освен ако този, който го е преинсталирал не го е налагал с чук!

Поздрави!

мерси за инфото а за SD/DVD устройството то е 1 ама не бачка защото когато ми влезе проблемният Червей напълно отказа да работи приемаше дискове но не ги отваряше също така в началото на темата бях написал ,че съм отварял кутията на компютара извадиха лентовия и захранващият кабел и СД то си работи при натискане на копчето отваря но го няма в моят компютър се тая мисля че като сложа друго СД ще се появи

17 декември 201213 г.

Автор

Здравейте проблемът е следния преди 5/6 седмици в компютърът ми влезе вирус Worm/Downadup. Системата започваше да става бавна и все по-бавна по едно време стигна до тавака степен ,че Windowls не се зареждаше.Стигаше до черният екран който изписвам там нещо си SD... и до там рестартираше се веднагически.Не излизаше иконката на Windows която показва че зарежда. Чудех се как да го оправя и реших макар ,че не разбирам как се борави с настройките на BIOS по някакъв начин цъках тук,там,променях някой работи и настройки и успях да стартирам windols. много мудно и бавно зареди,иконките в стартовата лента лента зареждаха повече от 5мин.При опит да вкарам диск с преинсталация в SD- устройстово не го отваряше.Пробвах с драйверите същата история.Реших да вляза в интернет но нямах.Погледнах зад компютъра и видях ,че Лан-Картата не свети.Сетих се ,че преди известно време си бях закупил USB-ЛанКарта и с нея тръгна интернета. На другият ден реших че ще го нося за преинсталация при Интернет доставчика но тооотално згреших и сажелих.Тъй като си го получих чак след 6дена.Всички драйвери бяха качени но забелязах че ми липсва в стартовата лента иконката на DirectX 9.0.Опитах се да го кача от Флаш памет но ми даде следната грешка An internal system error occurred. Pleace refer to DXError.log and DirectX.log in your Windows folder to determine problem. какво ли не опитвах за да оправя проблема но никакъв резултат дори и тема създадох помогнаха ми няколко потребителя но никакъв ефект.Реших сам да опитам четох най различни форуми и попаднах на един в който казват че старата версия може да се премахне с помощта на програмата Prfect Unninstaler.Изтрих драйверът съответно програмата искаше да рестартирам компютъра.След рестартирането пускам програмата отново и пак си стой там.А без този драйвер системата ми при някой игри от Facebook или други подобни картината леко насича което е доста дразнещо а и не мога си инсталирам никакви игри защото ми показва че ми липсва OPNGL и DirectX 9.0 Ето и ЛОГ файловете нужни а вас: DDS (Ver_2011-09-30.01) - NTFS_x86 Internet Explorer: 6.0.2900.5512 BrowserJavaVersion: 10.9.2 Run by User at 15:57:41 on 2012-12-17 Microsoft Windows XP Professional 5.1.2600.3.1251.359.1033.18.1023.339 [GMT 2:00] . AV: AVG Internet Security 2013 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF} FW: AVG Internet Security 2013 *Disabled* . ============== Running Processes ================ . C:WINDOWSsystem32spoolsv.exe C:WINDOWSExplorer.EXE C:WINDOWSRTHDCPL.EXE C:Program FilesAVGAVG2013avgui.exe C:WINDOWSsystem32RUNDLL32.EXE C:Program FilesSkypePhoneSkype.exe C:WINDOWSDatecsFlex2K.exe C:Program FilesStardockObjectDockFreeObjectDock.exe C:Program FilesAVGAVG2013avgwdsvc.exe C:WINDOWSsystem32cisvc.exe C:WINDOWSMicrosoft.NETFrameworkv4.0.30319mscorsvw.exe C:Program FilesJavajre7binjqs.exe C:WINDOWSsystem32nvsvc32.exe C:WINDOWSSystem32alg.exe C:WINDOWSsystem32cidaemon.exe D:CometBirdcometbird.exe D:CometBirdplugin-container.exe C:DOCUME~1UserLOCALS~1Tempnsv108.tmpMBR.DAT C:WINDOWSsystem32wbemwmiprvse.exe C:WINDOWSSystem32svchost.exe -k netsvcs C:WINDOWSsystem32svchost.exe -k NetworkService C:WINDOWSsystem32svchost.exe -k LocalService C:WINDOWSsystem32svchost.exe -k imgsvc . ============== Pseudo HJT Report =============== . uStart Page = hxxp://search.babylon.com/?affID=109220&tt=4912_4&babsrc=HP_ss&mntrId=0082b1de000000000000000000000000 BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:program filescommon filesadobeacrobatactivexAcroIEHelperShim.dll BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:program filesjavajre7binssv.dll BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:program filesjavajre7binjp2ssv.dll BHO: Yontoo: {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - c:program filesyontooYontooIEClient.dll uRun: [skype] "c:program filesskypephoneSkype.exe" /minimized /regrun mRun: [RTHDCPL] RTHDCPL.EXE mRun: [Adobe Reader Speed Launcher] "c:program filesadobereader 9.0readerReader_sl.exe" mRun: [Adobe ARM] "c:program filescommon filesadobearm1.0AdobeARM.exe" mRun: [AVG_UI] "c:program filesavgavg2013avgui.exe" /TRAYONLY mRun: [Domino] c:windowsDomino.EXE mRun: [NvCplDaemon] RUNDLL32.EXE c:windowssystem32NvCpl.dll,NvStartup mRun: [nwiz] nwiz.exe /install mRun: [NvMediaCenter] RUNDLL32.EXE c:windowssystem32NvMcTray.dll,NvTaskbarInit mRun: [bigDog303] c:windowsVM303_STI.EXE VIMICRO USB PC Camera (ZC0301PLH) mRun: [VMSnap3] c:windowsVMSnap3.EXE dRun: [CTFMON.EXE] c:windowssystem32CTFMON.EXE StartupFolder: c:docume~1userstartm~1programsstartupstardo~1.lnk - c:program filesstardockobjectdockfreeObjectDock.exe StartupFolder: c:docume~1alluse~1startm~1programsstartupflexty~1.lnk - c:windowsdatecsFlex2K.exe uPolicies-Explorer: NoDriveTypeAutoRun = dword:145 mPolicies-WindowsSystem: Allow-LogonScript-NetbiosDisabled = dword:1 mPolicies-Explorer: NoDriveTypeAutoRun = dword:145 IE: {010D1BE6-0F1C-4866-A4B5-81B3D7E553B8} - "c:program filescometmarksCometMarks.exe" IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%Network Diagnosticxpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:program filesmessengermsmsgs.exe TCP: Interfaces{58B5EE52-8C5E-4233-B3DE-C07E5915338C} : NameServer = 77.76.144.10 TCP: Interfaces{99CCDAE5-FE8A-4552-BA90-BA0D33566E4C} : NameServer = 77.76.144.10 Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:program filescommon filesskypeSkype4COM.dll STS: ObjectDockShlExt Class - {1984D045-52CF-49cd-DB77-08F378FEA4DB} - c:program filesstardockobjectdockfreeODMenu.dll . ============= SERVICES / DRIVERS =============== . R0 AVGIDSHX;AVGIDSHX;c:windowssystem32driversavgidshx.sys [2012-10-15 55776] R0 Avglogx;AVG Logging Driver;c:windowssystem32driversavglogx.sys [2012-9-21 177376] R0 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:windowssystem32driversavgmfx86.sys [2012-10-5 93536] R0 Avgrkx86;AVG Anti-Rootkit Driver;c:windowssystem32driversavgrkx86.sys [2012-9-14 35552] R1 AVGIDSDriver;AVGIDSDriver;c:windowssystem32driversavgidsdriverx.sys [2012-10-22 179936] R1 AVGIDSShim;AVGIDSShim;c:windowssystem32driversavgidsshimx.sys [2012-9-21 19936] R1 Avgldx86;AVG AVI Loader Driver;c:windowssystem32driversavgldx86.sys [2012-10-2 159712] R1 Avgtdix;AVG TDI Driver;c:windowssystem32driversavgtdix.sys [2012-9-21 164832] R2 avgwd;AVG WatchDog;c:program filesavgavg2013avgwdsvc.exe [2012-10-22 196664] R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:windowsmicrosoft.netframeworkv4.0.30319mscorsvw.exe [2010-3-18 130384] R3 ADM851X;ADM851X USB To Fast Ethernet Adapter;c:windowssystem32driversADM851X.SYS [2012-11-27 27135] R3 Avgfwdx;Avgfwdx;c:windowssystem32driversavgfwdx.sys [2012-1-12 30944] S2 avgfws;AVG Firewall;c:program filesavgavg2013avgfws.exe [2012-11-2 1340976] S2 AVGIDSAgent;AVGIDSAgent;c:program filesavgavg2013avgidsagent.exe [2012-11-6 5814392] S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:windowssystem32macromedflashFlashPlayerUpdateService.exe [2012-11-27 250808] S3 Ambfilt;Ambfilt;c:windowssystem32driversAmbfilt.sys [2012-11-27 1691480] S3 Avgfwfd;AVG network filter service;c:windowssystem32driversavgfwdx.sys [2012-1-12 30944] S3 vmfilter303;vmfilter303;c:windowssystem32driversvmfilter303.sys [2012-12-7 428160] S3 vvftav303;vvftav303;c:windowssystem32driversVVFTAV303.SYS [2012-12-16 18912] S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:windowsmicrosoft.netframeworkv4.0.30319wpfWPFFontCache_v0400.exe [2010-3-18 753504] S3 ZSMC0303;VIMICRO USB PC Camera (ZC0301PLH);c:windowssystem32driversusbVM303.sys [2012-12-7 391506] . =============== Created Last 30 ================ . 2012-12-17 09:32:42 -------- d-----w- c:program filesYontoo 2012-12-17 09:32:39 -------- d-----w- c:documents and settingsall usersapplication dataTarma Installer 2012-12-16 11:42:03 18912 ----a-w- c:windowssystem32driversVVFTAV303.SYS 2012-12-16 11:42:03 18912 ----a-w- c:windowssystem32driversTBPANEL.SYS 2012-12-16 11:40:48 43520 -c--a-w- c:windowssystem32dllcacheadmwprox.dll 2012-12-16 11:40:48 43520 ----a-w- c:windowssystem32admwprox.dll 2012-12-16 11:37:54 -------- d-----w- C:Rbackup 2012-12-16 11:03:54 -------- d-----w- c:program filesPerfect Uninstaller 2012-12-16 10:47:27 -------- d-----w- c:windowssystem32directx 2012-12-15 15:15:02 306688 ----a-w- c:windowsIsUninst.exe 2012-12-15 15:14:30 -------- d-----w- c:documents and settingsuserDownloads 2012-12-15 12:43:34 -------- d-----w- c:windowssystem32PreInstall 2012-12-15 12:43:33 -------- d--h--w- c:windows$hf_mig$ 2012-12-15 12:39:58 235856 ----a-w- c:windowssystem32xactengine3_3.dll 2012-12-15 12:39:57 23376 ----a-w- c:windowssystem32X3DAudio1_5.dll 2012-12-15 12:39:55 68616 ----a-w- c:windowssystem32XAPOFX1_1.dll 2012-12-15 12:39:55 509448 ----a-w- c:windowssystem32XAudio2_2.dll 2012-12-15 12:38:43 -------- d-----w- c:windowssystem32SoftwareDistribution 2012-12-15 12:38:22 221184 ----a-w- c:windowssystem32wmpns.dll 2012-12-15 12:31:18 2113536 -c--a-w- c:windowssystem32dllcachedxdiagn.dll 2012-12-15 12:31:18 2113536 ----a-w- c:windowssystem32dxdiagn.dll 2012-12-15 12:31:07 386048 -c--a-w- c:windowssystem32dllcacheqdvd.dll 2012-12-15 12:31:07 386048 ----a-w- c:windowssystem32qdvd.dll 2012-12-15 12:30:45 237568 -c--a-w- c:windowssystem32dllcacheqasf.dll 2012-12-15 12:30:45 237568 ----a-w- c:windowssystem32qasf.dll 2012-12-15 12:30:39 203776 -c--a-w- c:windowssystem32dllcachemswebdvd.dll 2012-12-15 12:30:39 203776 ----a-w- c:windowssystem32mswebdvd.dll 2012-12-15 12:30:28 733696 -c--a-w- c:windowssystem32dllcacheqedwipes.dll 2012-12-15 12:30:28 733696 ----a-w- c:windowssystem32qedwipes.dll 2012-12-15 12:29:54 1288192 -c--a-w- c:windowssystem32dllcachequartz.dll 2012-12-15 12:29:54 1288192 ----a-w- c:windowssystem32quartz.dll 2012-12-15 12:29:46 83456 -c--a-w- c:windowssystem32dllcachedpvsetup.exe 2012-12-15 12:29:46 83456 ----a-w- c:windowssystem32dpvsetup.exe 2012-12-15 12:29:45 1298432 -c--a-w- c:windowssystem32dllcachedxdiag.exe 2012-12-15 12:29:45 1298432 ----a-w- c:windowssystem32dxdiag.exe 2012-12-15 12:29:44 19456 -c--a-w- c:windowssystem32dllcachedswave.dll 2012-12-15 12:29:44 19456 ----a-w- c:windowssystem32dswave.dll 2012-12-15 12:29:39 192512 -c--a-w- c:windowssystem32dllcacheqcap.dll 2012-12-15 12:29:39 192512 ----a-w- c:windowssystem32qcap.dll 2012-12-15 12:29:34 1227264 -c--a-w- c:windowssystem32dllcachedx8vb.dll 2012-12-15 12:29:34 1227264 ----a-w- c:windowssystem32dx8vb.dll 2012-12-15 12:28:38 71680 -c--a-w- c:windowssystem32dllcachedsdmoprp.dll 2012-12-15 12:28:38 71680 ----a-w- c:windowssystem32dsdmoprp.dll 2012-12-15 12:28:18 619008 -c--a-w- c:windowssystem32dllcachedx7vb.dll 2012-12-15 12:28:18 619008 ----a-w- c:windowssystem32dx7vb.dll 2012-12-15 12:28:08 1293824 -c--a-w- c:windowssystem32dllcachedsound3d.dll 2012-12-15 12:28:08 1293824 ----a-w- c:windowssystem32dsound3d.dll 2012-12-15 12:27:25 148992 ----a-w- c:windowssystem32mpg2splt.ax 2012-12-15 12:26:39 279040 -c--a-w- c:windowssystem32dllcacheqdv.dll 2012-12-15 12:26:39 279040 ----a-w- c:windowssystem32qdv.dll 2012-12-15 12:26:31 20480 -c--a-w- c:windowssystem32dllcacheencapi.dll 2012-12-15 12:26:31 20480 ----a-w- c:windowssystem32encapi.dll 2012-12-15 12:26:27 212480 -c--a-w- c:windowssystem32dllcachedpvoice.dll 2012-12-15 12:26:27 212480 ----a-w- c:windowssystem32dpvoice.dll 2012-12-15 12:26:25 116736 -c--a-w- c:windowssystem32dllcachedpvvox.dll 2012-12-15 12:26:25 116736 ----a-w- c:windowssystem32dpvvox.dll 2012-12-15 12:24:23 19569 ----a-w- c:windows000001_.tmp 2012-12-15 12:24:20 26488 ----a-w- c:windowssystem32spupdsvc.exe 2012-12-08 18:25:49 73656 ----a-w- c:windowssystem32FlashPlayerCPLApp.cpl 2012-12-08 18:25:49 697272 ----a-w- c:windowssystem32FlashPlayerApp.exe 2012-12-08 13:49:10 -------- d-----w- c:windowsSxsCaPendDel 2012-12-08 11:46:21 -------- d-s---w- c:windowssystem32Microsoft 2012-12-08 11:03:58 238088 ----a-w- c:windowssystem32xactengine3_2.dll 2012-12-08 11:03:58 1493528 ----a-w- c:windowssystem32D3DCompiler_39.dll 2012-12-08 11:03:55 65032 ----a-w- c:windowssystem32XAPOFX1_0.dll 2012-12-08 11:03:55 507400 ----a-w- c:windowssystem32XAudio2_1.dll 2012-12-07 22:15:47 143872 ----a-w- c:windowssystem32javacpl.cpl 2012-12-07 22:15:38 93672 ----a-w- c:windowssystem32WindowsAccessBridge.dll 2012-12-07 21:28:50 238088 ----a-w- c:windowssystem32xactengine3_1.dll 2012-12-07 21:28:49 25608 ----a-w- c:windowssystem32X3DAudio1_4.dll 2012-12-07 21:28:49 1491992 ----a-w- c:windowssystem32D3DCompiler_38.dll 2012-12-07 21:01:35 -------- d-----w- c:windowssystem32appmgmt 2012-12-07 20:26:55 81920 ----a-w- c:windowssystem32VM303STI.dll 2012-12-07 20:26:55 49152 ----a-w- c:windowsVMSnap3.exe 2012-12-07 20:26:55 428160 ----a-w- c:windowssystem32driversvmfilter303.sys 2012-12-07 20:26:55 40960 ----a-w- c:windowssystem32setupfilter.exe 2012-12-07 20:26:55 391506 ----a-w- c:windowssystem32driversusbVM303.sys 2012-12-07 20:26:55 208986 ----a-w- c:windowssystem32VM303Prp.Ax 2012-12-07 20:26:55 102400 ----a-w- c:windowsVM303Cap.exe 2012-12-07 20:26:54 49152 ----a-w- c:windowsDomino.exe 2012-12-07 20:26:54 176128 ----a-w- c:windowsamcap.exe 2012-12-07 20:26:54 -------- d-----w- c:program files301H pc camera driver 2012-12-07 20:19:17 -------- d-----w- c:documents and settingsuserlocal settingsapplication dataPutLockerDownloader 2012-12-07 20:19:02 -------- d-----w- c:windowssystem32searchplugins 2012-12-07 20:19:02 -------- d-----w- c:windowssystem32Extensions 2012-12-07 20:18:33 -------- d-----w- c:documents and settingsuserapplication dataBabylon 2012-12-07 20:18:33 -------- d-----w- c:documents and settingsall usersapplication dataBabylon 2012-12-07 13:39:42 53248 ----a-w- c:windowsStillCap.exe 2012-12-07 13:39:42 307200 ----a-w- c:windowsvidcap32.Exe 2012-12-07 13:39:42 147456 ----a-w- c:windowsVMCap.exe 2012-12-07 12:50:26 -------- d-----w- c:documents and settingsall usersapplication dataDriverGenius 2012-12-07 11:28:44 -------- d-----w- c:program filesBitTorrent 2012-12-07 11:28:00 -------- d-----w- c:documents and settingsuserapplication dataBitTorrent 2012-12-07 09:47:02 -------- d-----w- c:documents and settingsuserapplication dataCometNetwork 2012-12-07 09:27:09 -------- d-----w- c:documents and settingsuserapplication dataCometMarks 2012-12-07 09:27:08 -------- d-----w- c:program filesCometMarks 2012-12-06 13:47:54 -------- d-----w- c:program filesCometBird 2012-12-06 13:28:08 -------- d-----w- c:documents and settingsuserlocal settingsapplication dataGoogle 2012-12-06 13:27:53 -------- d-----w- c:documents and settingsuserlocal settingsapplication dataDeployment 2012-12-06 13:03:27 -------- d-----w- c:documents and settingsuserlocal settingsapplication dataDownTango 2012-12-01 13:21:08 -------- d-----w- c:documents and settingsuserapplication dataYourFileDownloader 2012-12-01 13:18:20 -------- d-----w- c:documents and settingsuserapplication dataRovio 2012-12-01 12:52:04 18912 ----a-w- c:windowssystem32driversNVXBAR.SYS 2012-12-01 12:52:03 18912 ----a-w- c:windowssystem32driversNVCAP.SYS 2012-12-01 12:52:01 32768 ----a-w- c:program filescommon filesinstallshieldengine6intel 32objectps.dll 2012-12-01 12:52:01 225280 ----a-w- c:program filescommon filesinstallshieldiscriptiscript.dll 2012-12-01 12:52:01 176128 ----a-w- c:program filescommon filesinstallshieldengine6intel 32iuser.dll 2012-12-01 12:52:00 614532 ----a-w- c:program filescommon filesinstallshieldengine6intel 32IKernel.exe 2012-12-01 12:44:53 -------- d-----w- c:windowsNV16201704.TMP 2012-12-01 12:43:20 356352 ----a-w- c:windowssystem32nvudisp.exe 2012-12-01 12:43:20 -------- d-----w- c:windowsnview 2012-12-01 12:40:14 356352 ----a-w- c:windowssystem32NVUNINST.EXE 2012-12-01 12:40:11 69715 ----a-w- c:program filescommon filesinstallshieldprofessionalruntime0901intel32ctor.dll 2012-12-01 12:40:11 5632 ----a-w- c:program filescommon filesinstallshieldprofessionalruntime0901intel32DotNetInstaller.exe 2012-12-01 12:40:11 32768 ----a-w- c:program filescommon filesinstallshieldprofessionalruntimeObjectps.dll 2012-12-01 12:40:11 266240 ----a-w- c:program filescommon filesinstallshieldprofessionalruntime0901intel32iscript.dll 2012-12-01 12:40:11 192512 ----a-w- c:program filescommon filesinstallshieldprofessionalruntime0901intel32iuser.dll 2012-12-01 12:40:10 729088 ----a-w- c:program filescommon filesinstallshieldprofessionalruntime0901intel32iKernel.dll 2012-12-01 12:40:05 188548 ----a-w- c:program filescommon filesinstallshieldprofessionalruntime0901intel32iGdi.dll 2012-12-01 12:40:04 311428 ----a-w- c:program filescommon filesinstallshieldprofessionalruntime0901intel32setup.dll 2012-11-29 09:54:00 -------- d-----w- c:documents and settingsuserlocal settingsapplication dataIdentities 2012-11-28 15:53:56 -------- d-----w- c:windowssystem32cache 2012-11-28 15:28:37 -------- d-----w- c:documents and settingsuserapplication dataAIMP3 2012-11-28 12:42:40 -------- d-----w- c:documents and settingsuserlocal settingsapplication dataSun 2012-11-28 12:42:21 821736 ----a-w- c:windowssystem32npDeployJava1.dll 2012-11-28 12:42:21 746984 ----a-w- c:windowssystem32deployJava1.dll 2012-11-28 11:30:12 479752 ----a-w- c:windowssystem32XAudio2_0.dll 2012-11-28 11:18:42 -------- d-----w- c:documents and settingsall usersapplication dataNVIDIA Corporation 2012-11-28 11:17:21 813672 ----a-w- c:windowssystem32nvgenco32.dll 2012-11-28 11:17:20 888424 ----a-w- c:windowssystem32nvdispco32.dll 2012-11-28 11:15:21 -------- d-----w- C:NVIDIA 2012-11-27 16:40:31 -------- d-----w- c:program filesGRETECH 2012-11-27 16:35:00 -------- d-----w- c:windowsLogs 2012-11-27 14:18:36 -------- d-----w- c:documents and settingsuserlocal settingsapplication dataODUI 2012-11-27 14:18:14 -------- d-----w- c:documents and settingsuserlocal settingsapplication dataStardock 2012-11-27 14:17:53 -------- d-----w- c:documents and settingsuserapplication dataStardock 2012-11-27 14:17:49 -------- dc-h--w- c:documents and settingsall usersapplication data{5486EA6B-AF91-4B4B-868E-F80AB4BCD83A} 2012-11-27 14:17:33 -------- d-----w- c:program filesStardock 2012-11-27 14:07:27 -------- d-----w- c:documents and settingsuserlocal settingsapplication dataPackageAware 2012-11-27 13:27:54 -------- d-----w- c:documents and settingsuserapplication dataTeamViewer 2012-11-27 13:11:58 43008 ----a-w- c:windowssystem32ksxbar.ax 2012-11-27 11:34:35 -------- d-----w- c:documents and settingsuserlocal settingsapplication dataCometNetwork 2012-11-27 10:57:20 28672 ----a-w- c:windowssystem32newdll.dll 2012-11-27 10:57:19 6416 ----a-w- c:windowssystem32kbdinori.Dll 2012-11-27 10:57:19 6416 ----a-w- c:windowssystem32kbdinasa.Dll 2012-11-27 10:57:19 6416 ----a-w- c:windowssystem32kbdbp.Dll 2012-11-27 10:57:18 6928 ----a-w- c:windowssystem32kbdhebx.Dll 2012-11-27 10:57:17 7440 ----a-w- c:windowssystem32KBDDLL.DLL 2012-11-27 10:57:16 8992 ----a-w- c:windowssystem32KBDBPH.dLL 2012-11-27 10:57:16 -------- d-----w- c:windowsDatecs 2012-11-27 10:31:47 -------- d-----w- c:documents and settingsuserapplication dataAVG2013 2012-11-27 10:31:06 -------- d-----w- c:documents and settingsuserapplication dataTuneUp Software 2012-11-27 10:30:43 -------- d--h--w- C:$AVG 2012-11-27 10:30:43 -------- d-----w- c:documents and settingsall usersapplication dataAVG2013 2012-11-27 10:30:26 -------- d-----w- c:program filesAVG 2012-11-27 10:29:16 -------- d--h--w- c:documents and settingsall usersapplication dataCommon Files 2012-11-27 10:29:16 -------- d-----w- c:documents and settingsuserlocal settingsapplication dataMFAData 2012-11-27 10:29:16 -------- d-----w- c:documents and settingsuserlocal settingsapplication dataAvg2013 2012-11-27 10:29:16 -------- d-----w- c:documents and settingsall usersapplication dataMFAData 2012-11-27 10:24:05 -------- d-----w- c:program filesCCleaner 2012-11-27 09:23:53 -------- d-----w- c:documents and settingsuserlocal settingsapplication dataMozilla 2012-11-27 08:15:32 -------- d-----w- c:documents and settingsall usersapplication dataAVAST Software 2012-11-27 08:12:10 -------- d-----w- c:documents and settingsuserlocal settingsapplication dataAdobe 2012-11-27 08:11:35 -------- d-----r- c:program filesSkype 2012-11-27 08:10:45 -------- d-----w- c:program filesTeamViewer 2012-11-27 08:03:27 27135 ----a-r- c:windowssystem32driversADM851X.SYS 2012-11-27 07:56:56 -------- d-----w- c:windowssystem32Lang 2012-11-27 07:56:00 6272 -c--a-w- c:windowssystem32dllcachesplitter.sys 2012-11-27 07:56:00 6272 ----a-w- c:windowssystem32driverssplitter.sys 2012-11-27 07:54:45 240592 ----a-w- c:windowssystem32nvdrsdb1.bin 2012-11-27 07:42:20 26368 -c--a-w- c:windowssystem32dllcacheusbstor.sys 2012-11-26 18:04:53 -------- d-----r- c:documents and settingsall usersDocuments 2012-11-26 18:00:02 3072 ----a-w- c:windowssystem32driversaudstub.sys . ==================== Find3M ==================== . 2012-11-28 15:49:00 240592 ----a-w- c:windowssystem32nvdrsdb0.bin 2012-11-28 15:49:00 1 ----a-w- c:windowssystem32nvdrssel.bin 2012-10-22 11:02:46 179936 ----a-w- c:windowssystem32driversavgidsdriverx.sys 2012-10-15 01:48:52 55776 ----a-w- c:windowssystem32driversavgidshx.sys 2012-10-02 01:30:38 159712 ----a-w- c:windowssystem32driversavgldx86.sys 2012-09-21 01:46:06 164832 ----a-w- c:windowssystem32driversavgtdix.sys 2012-09-21 01:46:00 177376 ----a-w- c:windowssystem32driversavglogx.sys 2012-09-21 01:45:54 19936 ----a-w- c:windowssystem32driversavgidsshimx.sys . ============= FINISH: 15:57:57,50 =============== . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2011-09-30.01) . Microsoft Windows XP Professional Boot Device: DeviceHarddiskVolume1 Install Date: 26.11.2012 г. 18:14:38 System Uptime: 17.12.2012 г. 13:06:09 (2 hours ago) . Motherboard: | | MCP61 Processor: AMD Athlon 64 X2 Dual Core Processor 4200+ | Socket M2 | 2210/201mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 49 GiB total, 39,073 GiB free. D: is FIXED (NTFS) - 417 GiB total, 395,684 GiB free. . ==== Disabled Device Manager Items ============= . Class GUID: Description: SM Bus Controller Device ID: PCIVEN_10DE&DEV_03EB&SUBSYS_CB8410DE&REV_A23&2411E6FE&0&09 Manufacturer: Name: SM Bus Controller PNP Device ID: PCIVEN_10DE&DEV_03EB&SUBSYS_CB8410DE&REV_A23&2411E6FE&0&09 Service: . Class GUID: {4D36E96C-E325-11CE-BFC1-08002BE10318} Description: nVidia WDM Video Capture (universal) Device ID: DISPLAYNVCAP5&2FA00F48&1&CA000002&02&00 Manufacturer: nVidia Name: nVidia WDM Video Capture (universal) PNP Device ID: DISPLAYNVCAP5&2FA00F48&1&CA000002&02&00 Service: nvcap . Class GUID: {4D36E96C-E325-11CE-BFC1-08002BE10318} Description: nVidia WDM A/V Crossbar Device ID: DISPLAYNVXBAR5&2FA00F48&1&CA000003&02&00 Manufacturer: nVidia Name: nVidia WDM A/V Crossbar PNP Device ID: DISPLAYNVXBAR5&2FA00F48&1&CA000003&02&00 Service: NVXBAR . ==== System Restore Points =================== . No restore point in system. . ==== Installed Programs ====================== . П°єµт ·° µ·ёєѕІ ёЅтµрфµ№с Ѕ° Windows Adobe Flash Player 11 Plugin Adobe Reader 9.5.2 - Bulgarian AVG 2013 BitTorrent CCleaner CometBird 11.0 (x86 bg) FlexType 2K GOM Player Java 7 Update 9 Java Auto Updater Microsoft .NET Framework 2.0 Microsoft .NET Framework 4 Client Profile Microsoft .NET Framework 4 Extended Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 NVIDIA Control Panel 260.99 NVIDIA Drivers NVIDIA Graphics Driver 260.99 NVIDIA Install Application NVIDIA WDM Drivers ObjectDock Free Realtek High Definition Audio Driver Skype™ 6.0 TeamViewer 7 Update for Windows XP (KB898461) WebFldrs XP WinRAR 4.20 (32-±ётѕІ° Іµрсёя) Yontoo 1.10.03 . ==== Event Viewer Messages From Past Week ======== . 17.12.2012 і. 13:06:58, error: Service Control Manager [7023] - The Help and Support service terminated with the following error: The specified module could not be found. 17.12.2012 і. 13:06:58, error: Service Control Manager [7006] - The ScRegSetValueExW call failed for FailureActions with the following error: Access is denied. 17.12.2012 і. 13:06:58, error: Service Control Manager [7006] - The ScRegSetValueExW call failed for FailureActions with the following error: Access is denied. 17.12.2012 і. 13:01:58, error: Service Control Manager [7023] - The Help and Support service terminated with the following error: The specified module could not be found. 17.12.2012 і. 13:01:58, error: Service Control Manager [7006] - The ScRegSetValueExW call failed for FailureActions with the following error: Access is denied. 17.12.2012 і. 13:01:58, error: Service Control Manager [7006] - The ScRegSetValueExW call failed for FailureActions with the following error: Access is denied. 17.12.2012 і. 11:24:46, error: Service Control Manager [7023] - The Help and Support service terminated with the following error: The specified module could not be found. 17.12.2012 і. 11:24:46, error: Service Control Manager [7006] - The ScRegSetValueExW call failed for FailureActions with the following error: Access is denied. 17.12.2012 і. 11:24:46, error: Service Control Manager [7006] - The ScRegSetValueExW call failed for FailureActions with the following error: Access is denied. 17.12.2012 і. 11:01:30, error: Service Control Manager [7023] - The Help and Support service terminated with the following error: The specified module could not be found. 17.12.2012 і. 11:01:30, error: Service Control Manager [7006] - The ScRegSetValueExW call failed for FailureActions with the following error: Access is denied. 17.12.2012 і. 11:01:30, error: Service Control Manager [7006] - The ScRegSetValueExW call failed for FailureActions with the following error: Access is denied. 16.12.2012 і. 13:42:52, error: Service Control Manager [7023] - The Help and Support service terminated with the following error: The specified module could not be found. 16.12.2012 і. 13:42:52, error: Service Control Manager [7006] - The ScRegSetValueExW call failed for FailureActions with the following error: Access is denied. 16.12.2012 і. 13:42:52, error: Service Control Manager [7006] - The ScRegSetValueExW call failed for FailureActions with the following error: Access is denied. 16.12.2012 і. 13:42:33, error: sr [1] - The System Restore filter encountered the unexpected error '0xC0000001' while processing the file '' on the volume 'HarddiskVolume1'. It has stopped monitoring the volume. 16.12.2012 і. 13:39:16, error: Service Control Manager [7006] - The ScRegSetValueExW call failed for Type with the following error: Access is denied. 16.12.2012 і. 13:39:15, error: Service Control Manager [7006] - The ScRegSetValueExW call failed for Type with the following error: Access is denied. 16.12.2012 і. 13:39:12, error: Service Control Manager [7006] - The ScRegSetValueExW call failed for Type with the following error: Access is denied. 16.12.2012 і. 13:39:11, error: Service Control Manager [7006] - The ScRegSetValueExW call failed for Type with the following error: Access is denied. 16.12.2012 і. 13:39:08, error: Service Control Manager [7006] - The ScRegSetValueExW call failed for Type with the following error: Access is denied. 16.12.2012 і. 13:39:07, error: Service Control Manager [7006] - The ScRegSetValueExW call failed for Type with the following error: Access is denied. 16.12.2012 і. 13:38:55, error: Service Control Manager [7006] - The ScRegSetValueExW call failed for Type with the following error: Access is denied. 16.12.2012 і. 13:38:54, error: Service Control Manager [7006] - The ScRegSetValueExW call failed for Type with the following error: Access is denied. 16.12.2012 і. 13:31:20, error: Service Control Manager [7006] - The ScRegSetValueExW call failed for FailureActions with the following error: Access is denied. 16.12.2012 і. 13:31:20, error: Service Control Manager [7006] - The ScRegSetValueExW call failed for FailureActions with the following error: Access is denied. 16.12.2012 і. 13:27:31, error: Service Control Manager [7006] - The ScRegSetValueExW call failed for FailureActions with the following error: Access is denied. 16.12.2012 і. 13:27:31, error: Service Control Manager [7006] - The ScRegSetValueExW call failed for FailureActions with the following error: Access is denied. 16.12.2012 і. 10:15:16, error: Service Control Manager [7006] - The ScRegSetValueExW call failed for FailureActions with the following error: Access is denied. 16.12.2012 і. 10:15:16, error: Service Control Manager [7006] - The ScRegSetValueExW call failed for FailureActions with the following error: Access is denied. 15.12.2012 і. 16:16:15, error: Service Control Manager [7006] - The ScRegSetValueExW call failed for FailureActions with the following error: Access is denied. 15.12.2012 і. 16:16:15, error: Service Control Manager [7006] - The ScRegSetValueExW call failed for FailureActions with the following error: Access is denied. 15.12.2012 і. 15:52:43, error: Service Control Manager [7006] - The ScRegSetValueExW call failed for FailureActions with the following error: Access is denied. 15.12.2012 і. 15:52:43, error: Service Control Manager [7006] - The ScRegSetValueExW call failed for FailureActions with the following error: Access is denied. 15.12.2012 і. 14:38:21, error: Service Control Manager [7022] - The Windows Firewall/Internet Connection Sharing (ICS) service hung on starting. 15.12.2012 і. 14:36:28, error: Service Control Manager [7006] - The ScRegSetValueExW call failed for FailureActions with the following error: Access is denied. 15.12.2012 і. 14:36:28, error: Service Control Manager [7006] - The ScRegSetValueExW call failed for FailureActions with the following error: Access is denied. 15.12.2012 і. 12:19:33, error: Service Control Manager [7006] - The ScRegSetValueExW call failed for FailureActions with the following error: Access is denied. 14.12.2012 і. 18:10:11, error: Service Control Manager [7006] - The ScRegSetValueExW call failed for FailureActions with the following error: Access is denied. 14.12.2012 і. 18:10:11, error: Service Control Manager [7006] - The ScRegSetValueExW call failed for FailureActions with the following error: Access is denied. 14.12.2012 і. 14:37:27, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the NVSvc service. 14.12.2012 і. 14:36:52, error: Service Control Manager [7006] - The ScRegSetValueExW call failed for FailureActions with the following error: Access is denied. 14.12.2012 і. 14:36:52, error: Service Control Manager [7006] - The ScRegSetValueExW call failed for FailureActions with the following error: Access is denied. 13.12.2012 і. 18:17:30, error: Service Control Manager [7006] - The ScRegSetValueExW call failed for FailureActions with the following error: Access is denied. 13.12.2012 і. 18:17:30, error: Service Control Manager [7006] - The ScRegSetValueExW call failed for FailureActions with the following error: Access is denied. 13.12.2012 і. 15:21:50, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the NVSvc service. 13.12.2012 і. 15:21:14, error: Service Control Manager [7006] - The ScRegSetValueExW call failed for FailureActions with the following error: Access is denied. 13.12.2012 і. 15:21:14, error: Service Control Manager [7006] - The ScRegSetValueExW call failed for FailureActions with the following error: Access is denied. 13.12.2012 і. 08:13:42, error: Service Control Manager [7006] - The ScRegSetValueExW call failed for FailureActions with the following error: Access is denied. 13.12.2012 і. 08:13:42, error: Service Control Manager [7006] - The ScRegSetValueExW call failed for FailureActions with the following error: Access is denied. 12.12.2012 і. 17:14:36, error: Service Control Manager [7006] - The ScRegSetValueExW call failed for FailureActions with the following error: Access is denied. 12.12.2012 і. 09:09:35, error: Service Control Manager [7006] - The ScRegSetValueExW call failed for FailureActions with the following error: Access is denied. 12.12.2012 і. 09:09:35, error: Service Control Manager [7006] - The ScRegSetValueExW call failed for FailureActions with the following error: Access is denied. 11.12.2012 і. 18:40:11, error: Service Control Manager [7006] - The ScRegSetValueExW call failed for FailureActions with the following error: Access is denied. 11.12.2012 і. 18:40:11, error: Service Control Manager [7006] - The ScRegSetValueExW call failed for FailureActions with the following error: Access is denied. 11.12.2012 і. 14:54:23, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the NVSvc service. 11.12.2012 і. 14:53:36, error: Service Control Manager [7006] - The ScRegSetValueExW call failed for FailureActions with the following error: Access is denied. 11.12.2012 і. 14:53:36, error: Service Control Manager [7006] - The ScRegSetValueExW call failed for FailureActions with the following error: Access is denied. 10.12.2012 і. 18:20:41, error: Service Control Manager [7006] - The ScRegSetValueExW call failed for FailureActions with the following error: Access is denied. 10.12.2012 і. 18:20:41, error: Service Control Manager [7006] - The ScRegSetValueExW call failed for FailureActions with the following error: Access is denied. 10.12.2012 і. 15:30:53, error: Service Control Manager [7006] - The ScRegSetValueExW call failed for FailureActions with the following error: Access is denied. 10.12.2012 і. 15:30:53, error: Service Control Manager [7006] - The ScRegSetValueExW call failed for FailureActions with the following error: Access is denied. 10.12.2012 і. 15:30:40, error: sr [1] - The System Restore filter encountered the unexpected error '0xC0000001' while processing the file '' on the volume 'HarddiskVolume1'. It has stopped monitoring the volume. . ==== End Of File ===========================

Редактирано 17 декември 201213 г. от Tsvetelin Kirov (преглед на промените)

17 декември 201213 г.

Автор

Ужасно вирусът отново ме атакува

Ето Лог файл на антивирусната Resident Shield detection "Detection name";"Result";"Detection time";"Object Type";"Process" "Virus identified Win32/ElKern.C, c:Program FilesVimicroVM301BDriver AutoInstallAction FilesAfterCopy.exe";"Secured";"07.12.2012 г., 15:28:44";"File or Directory";"" "Virus identified Win32/ElKern.C, c:System Volume Information_restore{CE5CB6B6-86C1-4479-A4B7-BCF26119B4FB}RP38A0018669.exe";"Secured";"07.12.2012 г., 20:55:12";"File or Directory";"" "Virus identified Worm/Downadup, c:WINDOWSsystem32damkkj.dll";"Moved to Virus Vault";"17.12.2012 г., 16:18:38";"File or Directory";"" "Virus identified Worm/Downadup, c:System Volume Information_restore{CE5CB6B6-86C1-4479-A4B7-BCF26119B4FB}RP1A0000002.dll";"Moved to Virus Vault";"17.12.2012 г., 16:29:20";"File or Directory";"" "Virus identified Worm/Generic_c.ZW, e:autorun.inf";"Moved to Virus Vault";"17.12.2012 г., 16:19:26";"File or Directory";"" "Virus identified Worm/Generic_c.ZW, e:autorun.inf";"Secured";"17.12.2012 г., 16:16:19";"File or Directory";""

18 декември 201213 г.

Здравейте,

Обединих темите ви...няма нужда от две отделни такива за един и същ проблем. Извинявам се за забавянето, но бях на работа вчера...Да почистим вируса, а после ще мислим по-останалите въпроси:

СТЪПКА 1

Изтеглете файла disable_dangerous_services_xp.zip и го разархивирайте на десктопа.
Стартирайте файла disable_dangerous_services_xp.reg и се съгласете с всички предупреждения.
Това ще спре някои потенциално опасни услуги от които червея (а и доста друго гадини) се възползва(т) за да се разпространява(т).

СТЪПКА 2 - Спрете Autorun функцията.

Изтеглете и стартирайте следния файл
Стартирайте го и се съгласете с лицензионното споразумение.
Натиснете Next и изчакайте да си свърпи работата.
Рестартирайте системата ако се наложи.

Отворете и настройките на мрежовата карта и премахнете отметката пред File and Printer Sharing for Microsoft Networks, Client for Microsoft Networks и Qos Packet Scheduler и потвърдете с ОК.

СТЪПКА 3

Добре е да инсталирате всички актуализации за Windows. особено следните 3 кръпки: KB958687, KB957097, KB958644.

След инсталирането им рестартирайте компютъра.

СТЪПКА 4

Изтеглете и разархивирайте следния файл - KidoKiller на десктопа.
Копирайте файла kk.exe в C:
Отворете Start => Run => въведете CMD => натиснете Enter
В конзолата въведете командата:

cd c:

Натиснете Enter

След това въведете:

kk.exe -f -n -y -l report.txt

Натиснете Enter

Ще се генерира текст файл с името report.txt в C:

Копирайте съдържанието на лог файла в следващия си пост.

18 декември 201213 г.

Автор

изпълних всичко ето 15:43:38:875 2092 ================================================================================
15:43:38:875 2092 SystemInfo:

15:43:38:875 2092 OS Version: 5.1.2600 ServicePack: 3.0
15:43:38:875 2092 Product type: Workstation
15:43:38:875 2092 ComputerName: USER-7ABA7E85FB
15:43:38:875 2092 UserName: User
15:43:38:875 2092 Windows directory: C:WINDOWS
15:43:38:875 2092 Processor architecture: Intel x86
15:43:38:875 2092 Number of processors: 2
15:43:38:875 2092 Page size: 0x1000
15:43:38:875 2092 Boot type: Normal boot
15:43:38:875 2092 ================================================================================
15:43:38:875 2092 scanning jobs ...
15:43:38:875 2092
15:43:38:875 2092 scanning processes ...
15:43:39:156 2092
15:43:39:156 2092 scanning threads ...
15:43:41:203 2092
15:43:41:203 2092 scanning modules in svchost.exe...
15:43:41:281 2092 scanning modules in services.exe...
15:43:41:296 2092 scanning modules in explorer.exe...
15:43:41:312 2092
15:43:41:312 2092 scanning C:WINDOWSsystem32 ...
15:45:13:281 2092 scanning C:Program FilesInternet Explorer ...
15:45:14:234 2092 scanning C:Program FilesMovie Maker ...
15:45:14:593 2092 scanning C:Program FilesWindows Media Player ...
15:45:14:812 2092 scanning C:Program FilesWindows NT ...
15:45:15:515 2092 scanning C:Documents and SettingsUserApplication Data ...
15:45:28:750 2092 scanning C:DOCUME~1UserLOCALS~1Temp ...
15:46:56:109 2092 scanning Flash drives ...
15:46:56:109 2092 scanning C: ...
15:58:28:984 2092 scanning D: ...
16:06:08:921 2092
completed
16:06:08:937 2092 Infected jobs: 0
16:06:08:937 2092 Infected files: 0
16:06:08:937 2092 Infected threads: 0
16:06:08:937 2092 Spliced functions: 0
16:06:08:937 2092 Cured files: 0
16:06:08:937 2092 Fixed registry keys: 0
16:06:08:937 2092

1.Също така от сутрин та имам проблем не мога да пусна Скайп или някой музикален плеър дава следната грешка:
http://prikachi.com/images/592/5623592t.jpg -Оправен!

2.също така докато вървеше проверката от последната точка антивирусната пак засече този червей:
http://prikachi.com/images/593/5623593t.jpg

3.Също така като си вляза в браузера постоянно се появява това:
http://prikachi.com/images/733/5623733B.jpg

нито клипове нито игри мога да гледам или играя също не иска да ми се зареди при стартиране на компютъра програмата realtalk -Оправен!

1ви и 3ти проблем ги реших просто прочетох кой са липсващите DLL-файлове и ги изтеглих от тук:
http://www.dlldump.com/download-dll-files_new.php/dllfiles/D/d3d9.dll/5.03.2600.2180/download.html
След това ги поставих в C:WindowsSysytem32 и всичко се управи но точка 2 ме притеснява

Редактирано 19 декември 201213 г. от Tsvetelin Kirov (преглед на промените)

18 декември 201213 г.

1. Изтеглете ComboFix от BleepingComputer
и го запазете (бутон Save -> Save as) ComboFix на вашия десктоп:

След приключване на изтеглянето на ComboFix, иконката на програмата би трябвало да изглежда така:

2. Затворете всички работещи приложения, отворени прозорци и програми работещи във фонов режим. Спрете временно защитата в реално време на антивирусната програма и на другите програми за сигурност, ако има такива.

3. Стартирайте с двоен клик Combofix.exe. Изберете YES, за да се съгласите с условията за използване на програмата. Важно: По време на работата на ComboFix не бива да се движи мишката и да се натискат клавиши от клавиатурата. Просто търпеливо оставете ComboFix да си свърши работата, без да използвате компютъра за други цели.

4. ComboFix ще провери дали Windows Recovery Console e инсталиранa.

*Ако Windows Recovery Console не е инсталирана, ще е необходимо да използвате YES за инсталация на Windows Recovery Console
*Ако Windows Recovery Console е инсталирана, ComboFix ще продължи работата си.

Забележка: Необходимо е да сте свързани към Интернет за да може Windows Recovery Console да се изтегли.

След инсталация на Windows Recovery Console потвърдете с YES, за да продължите напред. Снимка:

5. ComboFix ще спре временно Интернет връзката, но след като приключи работата на програмата тази връзка ще бъде възстановена автоматично. ComboFix ще сканира за проблеми и за заразени файлове, като това може да отнеме известно време. Моля да бъдете търпеливи. Ако има проблем с Интернет връзката след приключване на работата на ComboFix, моля да прочетете това: Manually restoring the Internet connection section.

6. Когато работата на ComboFix приключи, ще се появи текстов документ (log) в Notepad:

Копирайте с (Copy) и поставете с (Paste) съдържанието на лога в следващия си коментар.

18 декември 201213 г.

Автор

ComboFix 12-12-17.02 - User 12.2012 г. 16:58:16.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1251.359.1033.18.1023.605 [GMT 2:00]
Running from: c:documents and settingsUserDesktopComboFix.exe
AV: AVG Internet Security 2013 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
FW: AVG Internet Security 2013 *Disabled* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:windowssystem32avgfwdx.dll
c:windowssystem32Cache
c:windowssystem32Cache272512937d9e61a4.fb
c:windowssystem32Cache287204568329e189.fb
c:windowssystem32Cache28bc8f716fd76a47.fb
c:windowssystem32Cache31a0997e9a5b5eb3.fb
c:windowssystem32Cache32c84fe32bb74d60.fb
c:windowssystem32Cache3917078cb68ec657.fb
c:windowssystem32Cache590ba23ce359fd0c.fb
c:windowssystem32Cache610289e025a3ee9a.fb
c:windowssystem32Cache651c5d3cdbfb8bd1.fb
c:windowssystem32Cache6c59ac5e7e7a3ad0.fb
c:windowssystem32Cache6d03dad1035885d3.fb
c:windowssystem32Cachea8556537add6dfc5.fb
c:windowssystem32Cachead10a52aff5e038d.fb
c:windowssystem32Cachec1a9e325dedf7e29.fb
c:windowssystem32Cachec1fa887b03019701.fb
c:windowssystem32Cachec4d28dca2e7648be.fb
c:windowssystem32Cached201ef9910cd39de.fb
c:windowssystem32Cached2e94710a5708128.fb
c:windowssystem32Cached79b9dfe81484ec4.fb
c:windowssystem32Cachef998975c9cc711ee.fb
c:windowssystem32Thumbs.db
.
.
((((((((((((((((((((((((( Files Created from 2012-11-18 to 2012-12-18 )))))))))))))))))))))))))))))))
.
.
2012-12-18 13:40 . 2010-03-19 08:18 171344 ----a-w- C:KK.exe
2012-11-28 11:15 . 2012-11-28 11:15 -------- d-----w- C:NVIDIA
2012-11-27 10:30 . 2012-11-27 10:30 -------- d-----w- C:$AVG
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-10-22 11:02 . 2012-10-22 11:02 179936 ----a-w- c:windowssystem32driversavgidsdriverx.sys
2012-10-15 01:48 . 2012-10-15 01:48 55776 ----a-w- c:windowssystem32driversavgidshx.sys
2012-10-05 01:32 . 2012-10-05 01:32 93536 ----a-w- c:windowssystem32driversavgmfx86.sys
2012-10-02 01:30 . 2012-10-02 01:30 159712 ----a-w- c:windowssystem32driversavgldx86.sys
2012-09-21 01:46 . 2012-09-21 01:46 164832 ----a-w- c:windowssystem32driversavgtdix.sys
2012-09-21 01:46 . 2012-09-21 01:46 177376 ----a-w- c:windowssystem32driversavglogx.sys
2012-09-21 01:45 . 2012-09-21 01:45 19936 ----a-w- c:windowssystem32driversavgidsshimx.sys
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2012-12-18 . 55E148C01296696588EAFA425782C3E8 . 367616 . . [5.3.2600.2180] . . c:windowssystem32dsound.dll
[7] 2008-04-14 . 4D83ED8BDDEC431FC8AD907B47CFB6E3 . 367616 . . [5.3.2600.5512] . . c:windowsServicePackFilesi386dsound.dll
.
[-] 2012-12-18 . D67BDBBDA86CC9AEEBBAF3217C1717D8 . 1689088 . . [5.03.2600.2180] . . c:windowssystem32d3d9.dll
[7] 2008-04-14 . 0607CBC6FA20114CB491EFE4B2F9EFAD . 1689088 . . [5.03.2600.5512] . . c:windowsServicePackFilesi386d3d9.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
"Skype"="c:program filesSkypePhoneSkype.exe" [2012-11-09 17879216]
.
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
"RTHDCPL"="RTHDCPL.EXE" [2011-10-14 20064872]
"Adobe Reader Speed Launcher"="c:program filesAdobeReader 9.0ReaderReader_sl.exe" [2012-07-31 38872]
"Adobe ARM"="c:program filesCommon FilesAdobeARM1.0AdobeARM.exe" [2012-07-11 919008]
"AVG_UI"="c:program filesAVGAVG2013avgui.exe" [2012-11-06 3143800]
"Domino"="c:windowsDomino.EXE" [2006-06-28 49152]
"VMSnap3"="c:windowsVMSnap3.EXE" [2006-06-28 49152]
"NvMediaCenter"="c:windowssystem32NvMcTray.dll" [2010-10-16 110696]
"NvCplDaemon"="c:windowssystem32NvCpl.dll" [2010-10-16 13851752]
"nwiz"="c:program filesNVIDIA CorporationnViewnwiz.exe" [2010-08-25 1753192]
.
[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
"CTFMON.EXE"="c:windowssystem32CTFMON.EXE" [2008-04-14 15360]
.
c:documents and settingsUserStart MenuProgramsStartup
Stardock ObjectDock.lnk - c:program filesStardockObjectDockFreeObjectDock.exe [2010-10-6 3768176]
.
c:documents and settingsAll UsersStart MenuProgramsStartup
FlexType 2K.lnk - c:windowsDatecsFlex2K.exe [2012-11-27 130048]
.
[hkey_local_machinesoftwaremicrosoftwindowscurrentversionexplorerSharedTaskScheduler]
"{1984D045-52CF-49cd-DB77-08F378FEA4DB}"= "c:program filesStardockObjectDockFreeODMenu.dll" [2010-10-04 511344]
.
[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetcontrolsession manager]
BootExecute REG_MULTI_SZ autocheck autochk *0c:progra~1AVGAVG2013avgrsx.exe /sync /restart
.
[HKLM~servicessharedaccessparametersfirewallpolicystandardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
"%windir%Network Diagnosticxpnetdiag.exe"=
"%windir%system32sessmgr.exe"=
"c:Program FilesTeamViewerVersion7TeamViewer.exe"=
"c:Program FilesTeamViewerVersion7TeamViewer_Service.exe"=
"c:Program FilesSkypePhoneSkype.exe"=
"c:Program FilesAVGAVG2013avgmfapx.exe"=
"c:Program FilesBitTorrentBitTorrent.exe"=
"c:Program FilesAVGAVG2013avgnsx.exe"=
"c:Program FilesAVGAVG2013avgdiagex.exe"=
"c:Program FilesAVGAVG2013avgemcx.exe"=
.
[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileGloballyOpenPortsList]
"2391:TCP"= 2391:TCP:tqctjh
.
[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileIcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
.
R0 AVGIDSHX;AVGIDSHX;c:windowssystem32driversavgidshx.sys [15.10.2012 і. 03:48 55776]
R0 Avglogx;AVG Logging Driver;c:windowssystem32driversavglogx.sys [21.9.2012 і. 03:46 177376]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:windowssystem32driversavgrkx86.sys [14.9.2012 і. 03:05 35552]
R1 AVGIDSDriver;AVGIDSDriver;c:windowssystem32driversavgidsdriverx.sys [22.10.2012 і. 13:02 179936]
R1 AVGIDSShim;AVGIDSShim;c:windowssystem32driversavgidsshimx.sys [21.9.2012 і. 03:45 19936]
R1 Avgldx86;AVG AVI Loader Driver;c:windowssystem32driversavgldx86.sys [02.10.2012 і. 03:30 159712]
R1 Avgtdix;AVG TDI Driver;c:windowssystem32driversavgtdix.sys [21.9.2012 і. 03:46 164832]
R2 avgfws;AVG Firewall;c:program filesAVGAVG2013avgfws.exe [02.11.2012 і. 00:08 1340976]
R2 AVGIDSAgent;AVGIDSAgent;c:program filesAVGAVG2013avgidsagent.exe [06.11.2012 і. 19:00 5814392]
R2 avgwd;AVG WatchDog;c:program filesAVGAVG2013avgwdsvc.exe [22.10.2012 і. 13:05 196664]
R3 ADM851X;ADM851X USB To Fast Ethernet Adapter;c:windowssystem32driversADM851X.SYS [27.11.2012 і. 10:03 27135]
R3 Avgfwdx;Avgfwdx;c:windowssystem32driversavgfwdx.sys [12.1.2012 і. 19:52 30944]
S2 vowndyxb;Update Microsoft;c:windowssystem32svchost.exe -k netsvcs [14.4.2008 і. 13:00 14336]
S3 Ambfilt;Ambfilt;c:windowssystem32driversAmbfilt.sys [27.11.2012 і. 09:55 1691480]
S3 Avgfwfd;AVG network filter service;c:windowssystem32driversavgfwdx.sys [12.1.2012 і. 19:52 30944]
S3 vmfilter303;vmfilter303;c:windowssystem32driversvmfilter303.sys [07.12.2012 і. 22:26 428160]
S3 vvftav303;vvftav303;c:windowssystem32driversVVFTAV303.SYS [16.12.2012 і. 13:42 18912]
S3 ZSMC0303;VIMICRO USB PC Camera (ZC0301PLH);c:windowssystem32driversusbVM303.sys [07.12.2012 і. 22:26 391506]
.
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionSvchost - NetSvcs
vowndyxb
.
Contents of the 'Scheduled Tasks' folder
.
2012-12-18 c:windowsTasksAdobe Flash Player Updater.job
- c:windowssystem32MacromedFlashFlashPlayerUpdateService.exe [2012-11-27 17:49]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://search.babylon.com/?affID=109220&tt=4912_4&babsrc=HP_ss&mntrId=0082b1de000000000000000000000000
IE: {{010D1BE6-0F1C-4866-A4B5-81B3D7E553B8} - "c:program filesCometMarksCometMarks.exe"
TCP: Interfaces{58B5EE52-8C5E-4233-B3DE-C07E5915338C}: NameServer = 77.76.144.10
TCP: Interfaces{99CCDAE5-FE8A-4552-BA90-BA0D33566E4C}: NameServer = 77.76.144.10
.
- - - - ORPHANS REMOVED - - - -
.
WebBrowser-{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - (no file)
HKLM-Run-BigDog303 - c:windowsVM303_STI.EXE
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-12-18 17:03
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
HKLMSoftwareMicrosoftWindowsCurrentVersionRun
BigDog303 = c:windowsVM303_STI.EXE VIMICRO USB PC Camera (ZC0301PLH)????????????????0?????????@??????????????
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINESystemControlSet001Servicesvowndyxb]
"ServiceDll"="c:windowssystem32damkkj.dll"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINEsoftwareClassesCLSID{645FF040-5081-101B-9F08-00AA002F954E}ShellB20@O=5 *=0 *C*C*l*e*a*n*e*r*& command]
@="c:Program FilesCCleanerccleaner.exe"
.
Completion time: 2012-12-18 17:04:34
ComboFix-quarantined-files.txt 2012-12-18 15:04
.
Pre-Run: 42 267 549 696 bytes free
Post-Run: 43 630 968 832 bytes free
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)WINDOWS
[operating systems]
c:cmdconsBOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - F903821E07FCDA838B05D20C4E1864F4

18 декември 201213 г.

Отворете Notepad.exe и се уверете, че пред Format => няма отметка пред Word Wrap (ако има я махнете).

С copy/paste въведете следната информация:

Driver::vowndyxbNetSvc::vowndyxbFile::c:windowssystem32damkkj.dllFCopy::c:windowsServicePackFilesi386dsound.dll | c:windowssystem32dsound.dllc:windowsServicePackFilesi386d3d9.dll | c:windowssystem32d3d9.dllRegistry::[HKLM~servicessharedaccessparametersfirewallpolicystandardprofile]"EnableFirewall"=dword:00000001[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileGloballyOpenPortsList]"2391:TCP"=-[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileIcmpSettings]"AllowInboundEchoRequest"=dword:00000000DDS::uStart Page = hxxp://search.babylon.com/?affID=109220&tt=4912_4&babsrc=HP_ss&mntrId=0082b1de000000000000000000000000

Запазете файла с име CFScript и го провлачете и пуснете в Combofix (както на картинката отдолу):

Публикувайте новия лог файл в следващия си пост.

18 декември 201213 г.

Автор

ComboFix 12-12-17.02 - User 12.2012 г. 17:31:39.2.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1251.359.1033.18.1023.566 [GMT 2:00]
Running from: c:documents and settingsUserDesktopComboFix.exe
Command switches used :: c:documents and settingsUserDesktopCFScript.txt
AV: AVG Internet Security 2013 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
FW: AVG Internet Security 2013 *Disabled* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
FILE ::
"c:windowssystem32damkkj.dll"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
--------------- FCopy ---------------
.
c:windowsServicePackFilesi386dsound.dll --> c:windowssystem32dsound.dll
c:windowsServicePackFilesi386d3d9.dll --> c:windowssystem32d3d9.dll
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------Legacy_VOWNDYXB
-------Service_vowndyxb
.
.
((((((((((((((((((((((((( Files Created from 2012-11-18 to 2012-12-18 )))))))))))))))))))))))))))))))
.
.
2012-12-18 13:40 . 2010-03-19 08:18 171344 ----a-w- C:KK.exe
2012-11-28 11:15 . 2012-11-28 11:15 -------- d-----w- C:NVIDIA
2012-11-27 10:30 . 2012-11-27 10:30 -------- d-----w- C:$AVG
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-10-22 11:02 . 2012-10-22 11:02 179936 ----a-w- c:windowssystem32driversavgidsdriverx.sys
2012-10-15 01:48 . 2012-10-15 01:48 55776 ----a-w- c:windowssystem32driversavgidshx.sys
2012-10-05 01:32 . 2012-10-05 01:32 93536 ----a-w- c:windowssystem32driversavgmfx86.sys
2012-10-02 01:30 . 2012-10-02 01:30 159712 ----a-w- c:windowssystem32driversavgldx86.sys
2012-09-21 01:46 . 2012-09-21 01:46 164832 ----a-w- c:windowssystem32driversavgtdix.sys
2012-09-21 01:46 . 2012-09-21 01:46 177376 ----a-w- c:windowssystem32driversavglogx.sys
2012-09-21 01:45 . 2012-09-21 01:45 19936 ----a-w- c:windowssystem32driversavgidsshimx.sys
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
"Skype"="c:program filesSkypePhoneSkype.exe" [2012-11-09 17879216]
.
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
"RTHDCPL"="RTHDCPL.EXE" [2011-10-14 20064872]
"Adobe Reader Speed Launcher"="c:program filesAdobeReader 9.0ReaderReader_sl.exe" [2012-07-31 38872]
"Adobe ARM"="c:program filesCommon FilesAdobeARM1.0AdobeARM.exe" [2012-07-11 919008]
"AVG_UI"="c:program filesAVGAVG2013avgui.exe" [2012-11-06 3143800]
"Domino"="c:windowsDomino.EXE" [2006-06-28 49152]
"VMSnap3"="c:windowsVMSnap3.EXE" [2006-06-28 49152]
"NvMediaCenter"="NvMCTray.dll" [2010-10-16 110696]
"NvCplDaemon"="c:windowssystem32NvCpl.dll" [2010-10-16 13851752]
"nwiz"="c:program filesNVIDIA CorporationnViewnwiz.exe" [2010-08-25 1753192]
.
[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
"CTFMON.EXE"="c:windowssystem32CTFMON.EXE" [2008-04-14 15360]
.
c:documents and settingsUserStart MenuProgramsStartup
Stardock ObjectDock.lnk - c:program filesStardockObjectDockFreeObjectDock.exe [2010-10-6 3768176]
.
c:documents and settingsAll UsersStart MenuProgramsStartup
FlexType 2K.lnk - c:windowsDatecsFlex2K.exe [2012-11-27 130048]
.
[hkey_local_machinesoftwaremicrosoftwindowscurrentversionexplorerSharedTaskScheduler]
"{1984D045-52CF-49cd-DB77-08F378FEA4DB}"= "c:program filesStardockObjectDockFreeODMenu.dll" [2010-10-04 511344]
.
[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetcontrolsession manager]
BootExecute REG_MULTI_SZ autocheck autochk *0c:progra~1AVGAVG2013avgrsx.exe /sync /restart
.
[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
"%windir%Network Diagnosticxpnetdiag.exe"=
"%windir%system32sessmgr.exe"=
"c:Program FilesTeamViewerVersion7TeamViewer.exe"=
"c:Program FilesTeamViewerVersion7TeamViewer_Service.exe"=
"c:Program FilesSkypePhoneSkype.exe"=
"c:Program FilesAVGAVG2013avgmfapx.exe"=
"c:Program FilesBitTorrentBitTorrent.exe"=
"c:Program FilesAVGAVG2013avgnsx.exe"=
"c:Program FilesAVGAVG2013avgdiagex.exe"=
"c:Program FilesAVGAVG2013avgemcx.exe"=
.
[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileIcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
.
R0 AVGIDSHX;AVGIDSHX;c:windowssystem32driversavgidshx.sys [15.10.2012 і. 03:48 55776]
R0 Avglogx;AVG Logging Driver;c:windowssystem32driversavglogx.sys [21.9.2012 і. 03:46 177376]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:windowssystem32driversavgrkx86.sys [14.9.2012 і. 03:05 35552]
R1 AVGIDSDriver;AVGIDSDriver;c:windowssystem32driversavgidsdriverx.sys [22.10.2012 і. 13:02 179936]
R1 AVGIDSShim;AVGIDSShim;c:windowssystem32driversavgidsshimx.sys [21.9.2012 і. 03:45 19936]
R1 Avgldx86;AVG AVI Loader Driver;c:windowssystem32driversavgldx86.sys [02.10.2012 і. 03:30 159712]
R1 Avgtdix;AVG TDI Driver;c:windowssystem32driversavgtdix.sys [21.9.2012 і. 03:46 164832]
R2 avgfws;AVG Firewall;c:program filesAVGAVG2013avgfws.exe [02.11.2012 і. 00:08 1340976]
R2 AVGIDSAgent;AVGIDSAgent;c:program filesAVGAVG2013avgidsagent.exe [06.11.2012 і. 19:00 5814392]
R2 avgwd;AVG WatchDog;c:program filesAVGAVG2013avgwdsvc.exe [22.10.2012 і. 13:05 196664]
R3 ADM851X;ADM851X USB To Fast Ethernet Adapter;c:windowssystem32driversADM851X.SYS [27.11.2012 і. 10:03 27135]
R3 Avgfwdx;Avgfwdx;c:windowssystem32driversavgfwdx.sys [12.1.2012 і. 19:52 30944]
S3 Ambfilt;Ambfilt;c:windowssystem32driversAmbfilt.sys [27.11.2012 і. 09:55 1691480]
S3 Avgfwfd;AVG network filter service;c:windowssystem32driversavgfwdx.sys [12.1.2012 і. 19:52 30944]
S3 vmfilter303;vmfilter303;c:windowssystem32driversvmfilter303.sys [07.12.2012 і. 22:26 428160]
S3 vvftav303;vvftav303;c:windowssystem32driversVVFTAV303.SYS [16.12.2012 і. 13:42 18912]
S3 ZSMC0303;VIMICRO USB PC Camera (ZC0301PLH);c:windowssystem32driversusbVM303.sys [07.12.2012 і. 22:26 391506]
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - WS2IFSL
.
Contents of the 'Scheduled Tasks' folder
.
2012-12-18 c:windowsTasksAdobe Flash Player Updater.job
- c:windowssystem32MacromedFlashFlashPlayerUpdateService.exe [2012-11-27 17:49]
.
.
------- Supplementary Scan -------
.
IE: {{010D1BE6-0F1C-4866-A4B5-81B3D7E553B8} - "c:program filesCometMarksCometMarks.exe"
TCP: Interfaces{58B5EE52-8C5E-4233-B3DE-C07E5915338C}: NameServer = 77.76.144.10
TCP: Interfaces{99CCDAE5-FE8A-4552-BA90-BA0D33566E4C}: NameServer = 77.76.144.10
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-12-18 17:38
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINEsoftwareClassesCLSID{645FF040-5081-101B-9F08-00AA002F954E}ShellB20@O=5 *=0 *C*C*l*e*a*n*e*r*& command]
@="c:Program FilesCCleanerccleaner.exe"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'explorer.exe'(3700)
c:program filesStardockObjectDockFreeDockShellHook.dll
c:windowssystem32newdll.dll
c:program filesStardockObjectDockFreeODMenu.dll
.
------------------------ Other Running Processes ------------------------
.
c:windowssystem32nvsvc32.exe
c:windowsMicrosoft.NETFrameworkv4.0.30319mscorsvw.exe
c:windowsRTHDCPL.EXE
c:windowssystem32RunDLL32.exe
.
**************************************************************************
.
Completion time: 2012-12-18 17:40:00 - machine was rebooted
ComboFix-quarantined-files.txt 2012-12-18 15:39
ComboFix2.txt 2012-12-18 15:04
.
Pre-Run: 43 706 695 680 bytes free
Post-Run: 43 635 879 936 bytes free
.
- - End Of File - - 7B3C2CEB01FDF2659055E5037B617A0B

18 декември 201213 г.

Отворете notepad и с copy/paste въведете следната информация:

Dequarantine::
C:QooboxQuarantineCWINDOWSsystem32avgfwdx.dll.vir

Quit::
Запазете файла с име CFScript и го провлачете и пуснете в Combofix (както е показано на картинката отдолу).
По време на сканиране от страна на ComboFix не стартирайте никакви други приложения, не натискайте клавиши от клавиатурата и не местете мишката !
Публикувайте лог файла - DeQuarantine.txt, който ще се създаде след рестарта на компютъра в следващия си пост.

18 декември 201213 г.

Автор

ще можели да продължим утре тъй като в момента няма да мога защото на компютърът седи майка ми и няма да ми позволи да седна

18 декември 201213 г.

Разбира се... Няма проблеми!

19 декември 201213 г.

Автор

Здравей отново ето Лог файла но стараното е ,че след като си свърши работата ComboFix не рестартира системата лог файла излезе изчаках 10 мин и рестартирах системата сам ,че нямах Интернет

C:QooboxQuarantineCWINDOWSsystem32avgfwdx.dll.vir -> C:WINDOWSsystem32avgfwdx.dll ( 61280 bytes )

19 декември 201213 г.

Случвате ме на работа...ще пиша след 16.00 с по-подробни инструкции...

Това има ли го като проблем още:

1.Също така от сутрин та имам проблем не мога да пусна Скайп или някой музикален плеър дава следната грешка:

19 декември 201213 г.

Автор

аз след 15:30 няма да ме има тъй като ще ходя на концерт на сестра ми чак към 22:00 ще мога. Извинявам се станала е малка грешка проблем 1 и 3 са решени 2 не е но гледам че антивирусната вече не засича никъде гадината

Редактирано 19 декември 201213 г. от Tsvetelin Kirov (преглед на промените)

19 декември 201213 г.

Мисля, че отново се бъркате...

По-точка 1 имаше проблеми, защото файловете които сте изтеглили от интернет не бяха с валидни MD5 контролни суми:

Просто - сте изтеглили версии за SP2, а вие сте с SP3. След като заместих правилните версии на файловете - това трябва да е решило точка1.

------- Sigcheck ------- Note: Unsigned files aren't necessarily malware. . [-] 2012-12-18 . 55E148C01296696588EAFA425782C3E8 . 367616 . . [5.3.2600.2180] . . c:windowssystem32dsound.dll [7] 2008-04-14 . 4D83ED8BDDEC431FC8AD907B47CFB6E3 . 367616 . . [5.3.2600.5512] . . c:windowsServicePackFilesi386dsound.dll . [-] 2012-12-18 . D67BDBBDA86CC9AEEBBAF3217C1717D8 . 1689088 . . [5.03.2600.2180] . . c:windowssystem32d3d9.dll [7] 2008-04-14 . 0607CBC6FA20114CB491EFE4B2F9EFAD . 1689088 . . [5.03.2600.5512] . . c:windowsServicePackFilesi386d3d9.dll

По-точка 2 не разбирам от снимката къде е проблема, защото не би трябвало вече AVG да засича каквото и да е...

По-точка 3 след почистването на бацила и след затваряне на отворения от бацила порт би трябвало и това да се е оправило...т.е. май всичко е наред вече или?

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileGloballyOpenPortsList] "2391:TCP"= 2391:TCP:tqctjh

19 декември 201213 г.

Автор

Като гледам да но все още си остава проблема с Direct X

при опит за инсталиране се получава ето това:

http://prikachi.com/images/807/5626807D.jpg

Редактирано 19 декември 201213 г. от Tsvetelin Kirov (преглед на промените)

19 декември 201213 г.

С коя версия опитвате?
Пробвайте с тази - Download DirectX 9.29.1974 Redist (June 2010) Offline Installer и пишете за резултатите.

19 декември 201213 г.

Автор

Оново същата грешка

http://prikachi.com/images/899/5626899l.jpg

Първият Лога файл DXError.log съдържа ето това

--------------------
[12/01/12 15:38:18] module: dxupdate(Mar 30 2011), file: dxupdate.cpp, line: 2234, function: RegisterDLL

Failed API: LoadLibraryEx()
Error: (0xc000001d)

Unable to load C:WINDOWSsystem32xactengine3_0.dll.

--------------------
[12/01/12 15:38:19] module: dxupdate(Mar 30 2011), file: dxupdate.cpp, line: 5861, function: DirectXUpdateInstallPlugIn

RegisterDllFromSection() failed.

--------------------
[12/01/12 15:38:19] module: dsetup32(Mar 30 2011), file: dxupdate.cpp, line: 280, function: CSetup::InstallPlugIn

DirectXUpdateInstallPlugIn() failed.

--------------------
[12/01/12 15:38:19] module: dsetup32(Mar 30 2011), file: setup.cpp, line: 1727, function: CSetup::SetupForDirectX

InstallPlugIn() failed.

--------------------
[12/01/12 15:42:07] module: dxupdate(Jun 2 2010), file: dxupdate.cpp, line: 2223, function: RegisterDLL

Failed API: LoadLibraryEx()
Error: (0xc000001d)

Unable to load C:WINDOWSsystem32xactengine3_0.dll.

--------------------
[12/01/12 15:42:07] module: dxupdate(Jun 2 2010), file: dxupdate.cpp, line: 5848, function: DirectXUpdateInstallPlugIn

RegisterDllFromSection() failed.

--------------------
[12/01/12 15:42:07] module: dsetup32(Jun 2 2010), file: dxupdate.cpp, line: 280, function: CSetup::InstallPlugIn

DirectXUpdateInstallPlugIn() failed.

--------------------
[12/01/12 15:42:07] module: dsetup32(Jun 2 2010), file: setup.cpp, line: 1723, function: CSetup::SetupForDirectX

InstallPlugIn() failed.

--------------------
[12/07/12 14:04:46] module: dxupdate(Mar 30 2011), file: dxupdate.cpp, line: 2234, function: RegisterDLL

Failed API: LoadLibraryEx()
Error: (0xc000001d)

Unable to load C:WINDOWSsystem32xactengine3_0.dll.

--------------------
[12/07/12 14:04:46] module: dxupdate(Mar 30 2011), file: dxupdate.cpp, line: 5861, function: DirectXUpdateInstallPlugIn

RegisterDllFromSection() failed.

--------------------
[12/07/12 14:04:46] module: dsetup32(Mar 30 2011), file: dxupdate.cpp, line: 280, function: CSetup::InstallPlugIn

DirectXUpdateInstallPlugIn() failed.

--------------------
[12/07/12 14:04:46] module: dsetup32(Mar 30 2011), file: setup.cpp, line: 1727, function: CSetup::SetupForDirectX

InstallPlugIn() failed.

--------------------
[12/07/12 15:09:32] module: dxupdate(Jun 2 2010), file: dxupdate.cpp, line: 2223, function: RegisterDLL

Failed API: LoadLibraryEx()
Error: (0xc000001d)

Unable to load C:WINDOWSsystem32xactengine3_0.dll.

--------------------
[12/07/12 15:09:32] module: dxupdate(Jun 2 2010), file: dxupdate.cpp, line: 5848, function: DirectXUpdateInstallPlugIn

RegisterDllFromSection() failed.

--------------------
[12/07/12 15:09:32] module: dsetup32(Jun 2 2010), file: dxupdate.cpp, line: 280, function: CSetup::InstallPlugIn

DirectXUpdateInstallPlugIn() failed.

--------------------
[12/07/12 15:09:32] module: dsetup32(Jun 2 2010), file: setup.cpp, line: 1723, function: CSetup::SetupForDirectX

InstallPlugIn() failed.

--------------------
[12/07/12 15:42:21] module: dxupdate(Mar 30 2011), file: dxupdate.cpp, line: 2234, function: RegisterDLL

Failed API: LoadLibraryEx()
Error: (0xc000001d)

Unable to load C:WINDOWSsystem32xactengine3_0.dll.

--------------------
[12/07/12 15:42:21] module: dxupdate(Mar 30 2011), file: dxupdate.cpp, line: 5861, function: DirectXUpdateInstallPlugIn

RegisterDllFromSection() failed.

--------------------
[12/07/12 15:42:21] module: dsetup32(Mar 30 2011), file: dxupdate.cpp, line: 280, function: CSetup::InstallPlugIn

DirectXUpdateInstallPlugIn() failed.

--------------------
[12/07/12 15:42:21] module: dsetup32(Mar 30 2011), file: setup.cpp, line: 1727, function: CSetup::SetupForDirectX

InstallPlugIn() failed.

--------------------
[12/07/12 23:13:00] module: dxupdate(Jun 2 2010), file: dxupdate.cpp, line: 6763, function: CMDXInstall::Install

Failed API: DeleteFile()
Error: (32) - The process cannot access the file because it is being used by another process.

Unable to delete C:WINDOWSsystem32DirectXDX10.tmpMicrosoft.DirectX.Direct3DX.dll.

--------------------
[12/07/12 23:13:38] module: dxupdate(Jun 2 2010), file: dxupdate.cpp, line: 2223, function: RegisterDLL

Failed API: LoadLibraryEx()
Error: (0xc000001d)

Unable to load C:WINDOWSsystem32xactengine3_0.dll.

--------------------
[12/07/12 23:13:38] module: dxupdate(Jun 2 2010), file: dxupdate.cpp, line: 5848, function: DirectXUpdateInstallPlugIn

RegisterDllFromSection() failed.

--------------------
[12/07/12 23:13:38] module: dsetup32(Jun 2 2010), file: dxupdate.cpp, line: 280, function: CSetup::InstallPlugIn

DirectXUpdateInstallPlugIn() failed.

--------------------
[12/07/12 23:13:38] module: dsetup32(Jun 2 2010), file: setup.cpp, line: 1723, function: CSetup::SetupForDirectX

InstallPlugIn() failed.

--------------------
[12/07/12 23:16:51] module: dxupdate(Jun 2 2010), file: dxupdate.cpp, line: 2223, function: RegisterDLL

Failed API: LoadLibraryEx()
Error: (0xc000001d)

Unable to load C:WINDOWSsystem32xactengine3_0.dll.

--------------------
[12/07/12 23:16:51] module: dxupdate(Jun 2 2010), file: dxupdate.cpp, line: 5848, function: DirectXUpdateInstallPlugIn

RegisterDllFromSection() failed.

--------------------
[12/07/12 23:16:51] module: dsetup32(Jun 2 2010), file: dxupdate.cpp, line: 280, function: CSetup::InstallPlugIn

DirectXUpdateInstallPlugIn() failed.

--------------------
[12/07/12 23:16:51] module: dsetup32(Jun 2 2010), file: setup.cpp, line: 1723, function: CSetup::SetupForDirectX

InstallPlugIn() failed.

--------------------
[12/07/12 23:28:50] module: dxupdate(Nov 19 2010), file: dxupdate.cpp, line: 2234, function: RegisterDLL

Failed API: LoadLibraryEx()
Error: (0xc000001d)

Unable to load C:WINDOWSsystem32xactengine3_1.dll.

--------------------
[12/07/12 23:28:50] module: dxupdate(Nov 19 2010), file: dxupdate.cpp, line: 5861, function: DirectXUpdateInstallPlugIn

RegisterDllFromSection() failed.

--------------------
[12/07/12 23:28:50] module: dsetup32(Mar 30 2011), file: dxupdate.cpp, line: 280, function: CSetup::InstallPlugIn

DirectXUpdateInstallPlugIn() failed.

--------------------
[12/07/12 23:28:50] module: dsetup32(Mar 30 2011), file: setup.cpp, line: 1727, function: CSetup::SetupForDirectX

InstallPlugIn() failed.

--------------------
[12/08/12 13:03:59] module: dxupdate(Nov 19 2010), file: dxupdate.cpp, line: 2234, function: RegisterDLL

Failed API: LoadLibraryEx()
Error: (0xc000001d)

Unable to load C:WINDOWSsystem32xactengine3_2.dll.

--------------------
[12/08/12 13:03:59] module: dxupdate(Nov 19 2010), file: dxupdate.cpp, line: 5861, function: DirectXUpdateInstallPlugIn

RegisterDllFromSection() failed.

--------------------
[12/08/12 13:03:59] module: dsetup32(Mar 30 2011), file: dxupdate.cpp, line: 280, function: CSetup::InstallPlugIn

DirectXUpdateInstallPlugIn() failed.

--------------------
[12/08/12 13:03:59] module: dsetup32(Mar 30 2011), file: setup.cpp, line: 1727, function: CSetup::SetupForDirectX

InstallPlugIn() failed.

--------------------
[12/08/12 13:17:38] module: dxupdate(Nov 19 2010), file: dxupdate.cpp, line: 2234, function: RegisterDLL

Failed API: LoadLibraryEx()
Error: (0xc000001d)

Unable to load C:WINDOWSsystem32xactengine3_2.dll.

--------------------
[12/08/12 13:17:38] module: dxupdate(Nov 19 2010), file: dxupdate.cpp, line: 5861, function: DirectXUpdateInstallPlugIn

RegisterDllFromSection() failed.

--------------------
[12/08/12 13:17:38] module: dsetup32(Mar 30 2011), file: dxupdate.cpp, line: 280, function: CSetup::InstallPlugIn

DirectXUpdateInstallPlugIn() failed.

--------------------
[12/08/12 13:17:38] module: dsetup32(Mar 30 2011), file: setup.cpp, line: 1727, function: CSetup::SetupForDirectX

InstallPlugIn() failed.

--------------------
[12/08/12 15:53:06] module: dxupdate(Jun 2 2010), file: dxupdate.cpp, line: 2223, function: RegisterDLL

Failed API: LoadLibraryEx()
Error: (0xc000001d)

Unable to load C:WINDOWSsystem32xactengine3_0.dll.

--------------------
[12/08/12 15:53:06] module: dxupdate(Jun 2 2010), file: dxupdate.cpp, line: 5848, function: DirectXUpdateInstallPlugIn

RegisterDllFromSection() failed.

--------------------
[12/08/12 15:53:06] module: dsetup32(Jun 2 2010), file: dxupdate.cpp, line: 280, function: CSetup::InstallPlugIn

DirectXUpdateInstallPlugIn() failed.

--------------------
[12/08/12 15:53:06] module: dsetup32(Jun 2 2010), file: setup.cpp, line: 1723, function: CSetup::SetupForDirectX

InstallPlugIn() failed.

--------------------
[12/08/12 16:00:57] module: DXSetup(Jun 2 2010), file: dxsetup.cpp, line: 934, function: FindDXSetupWindow

Failed API: GetWindowText()
Error: (183) - Cannot create a file when that file already exists.

--------------------
[12/08/12 16:01:20] module: dxupdate(Jun 2 2010), file: dxupdate.cpp, line: 2223, function: RegisterDLL

Failed API: LoadLibraryEx()
Error: (0xc000001d)

Unable to load C:WINDOWSsystem32xactengine3_0.dll.

--------------------
[12/08/12 16:01:20] module: dxupdate(Jun 2 2010), file: dxupdate.cpp, line: 5848, function: DirectXUpdateInstallPlugIn

RegisterDllFromSection() failed.

--------------------
[12/08/12 16:01:20] module: dsetup32(Jun 2 2010), file: dxupdate.cpp, line: 280, function: CSetup::InstallPlugIn

DirectXUpdateInstallPlugIn() failed.

--------------------
[12/08/12 16:01:20] module: dsetup32(Jun 2 2010), file: setup.cpp, line: 1723, function: CSetup::SetupForDirectX

InstallPlugIn() failed.

--------------------
[12/08/12 16:02:41] module: dxupdate(Jun 2 2010), file: dxupdate.cpp, line: 189, function: GetDXVersion

Failed API: RegQueryValueEx()
Error: (2) - The system cannot find the file specified.

Current DirectX may be a older version which does not have the version value in the registry.

--------------------
[12/08/12 16:02:41] module: dxupdate(Jun 2 2010), file: dxupdate.cpp, line: 4751, function: DirectXUpdateGetSetupInformation

GetDXVersion() failed.

--------------------
[12/08/12 16:02:41] module: dsetup32(Jun 2 2010), file: dxupdate.cpp, line: 280, function: CSetup::InstallPlugIn

DirectXUpdateInstallPlugIn() failed.

--------------------
[12/08/12 16:02:41] module: dsetup32(Jun 2 2010), file: setup.cpp, line: 1723, function: CSetup::SetupForDirectX

InstallPlugIn() failed.

--------------------
[12/12/12 10:01:12] module: dxupdate(Nov 19 2010), file: dxupdate.cpp, line: 192, function: GetDXVersion

Failed API: RegQueryValueEx()
Error: (2) - The system cannot find the file specified.

Current DirectX may be a older version which does not have the version value in the registry.

--------------------
[12/12/12 10:01:12] module: dxupdate(Nov 19 2010), file: dxupdate.cpp, line: 4527, function: DirectXUpdateDownloadPlugIn

GetDXVersion() failed.

--------------------
[12/12/12 10:01:13] module: DXWSetup(Mar 30 2011), file: dxupdate.cpp, line: 386, function: DownloadPlugIn

DirectXUpdateDownloadPlugIn() failed.

--------------------
[12/12/12 10:01:13] module: DXWSetup(Mar 30 2011), file: psheets.cpp, line: 731, function: PreinstDlgProc

DownloadPlugIn() failed.

--------------------
[12/15/12 13:49:05] module: dxupdate(Nov 19 2010), file: dxupdate.cpp, line: 178, function: GetDXVersion

Failed API: RegOpenKeyEx()
Error: (2) - The system cannot find the file specified.

Current DirectX may be a older version which does not have directx key in the registry.

--------------------
[12/15/12 13:49:05] module: dxupdate(Nov 19 2010), file: dxupdate.cpp, line: 4527, function: DirectXUpdateDownloadPlugIn

GetDXVersion() failed.

--------------------
[12/15/12 13:49:06] module: DXWSetup(Mar 30 2011), file: dxupdate.cpp, line: 386, function: DownloadPlugIn

DirectXUpdateDownloadPlugIn() failed.

--------------------
[12/15/12 13:49:06] module: DXWSetup(Mar 30 2011), file: psheets.cpp, line: 731, function: PreinstDlgProc

DownloadPlugIn() failed.

--------------------
[12/15/12 14:39:59] module: dxupdate(Nov 19 2010), file: dxupdate.cpp, line: 2234, function: RegisterDLL

Failed API: LoadLibraryEx()
Error: (0xc000001d)

Unable to load C:WINDOWSsystem32xactengine3_3.dll.

--------------------
[12/15/12 14:39:59] module: dxupdate(Nov 19 2010), file: dxupdate.cpp, line: 5861, function: DirectXUpdateInstallPlugIn

RegisterDllFromSection() failed.

--------------------
[12/15/12 14:39:59] module: dsetup32(Mar 30 2011), file: dxupdate.cpp, line: 280, function: CSetup::InstallPlugIn

DirectXUpdateInstallPlugIn() failed.

--------------------
[12/15/12 14:39:59] module: dsetup32(Mar 30 2011), file: setup.cpp, line: 1727, function: CSetup::SetupForDirectX

InstallPlugIn() failed.

--------------------
[12/15/12 15:06:14] module: dxupdate(Nov 19 2010), file: dxupdate.cpp, line: 2234, function: RegisterDLL

Failed API: LoadLibraryEx()
Error: (0xc000001d)

Unable to load C:WINDOWSsystem32xactengine3_3.dll.

--------------------
[12/15/12 15:06:14] module: dxupdate(Nov 19 2010), file: dxupdate.cpp, line: 5861, function: DirectXUpdateInstallPlugIn

RegisterDllFromSection() failed.

--------------------
[12/15/12 15:06:14] module: dsetup32(Mar 30 2011), file: dxupdate.cpp, line: 280, function: CSetup::InstallPlugIn

DirectXUpdateInstallPlugIn() failed.

--------------------
[12/15/12 15:06:14] module: dsetup32(Mar 30 2011), file: setup.cpp, line: 1727, function: CSetup::SetupForDirectX

InstallPlugIn() failed.

--------------------
[12/15/12 15:20:11] module: dxupdate(Nov 19 2010), file: dxupdate.cpp, line: 2234, function: RegisterDLL

Failed API: LoadLibraryEx()
Error: (0xc000001d)

Unable to load C:WINDOWSsystem32xactengine3_3.dll.

--------------------
[12/15/12 15:20:11] module: dxupdate(Nov 19 2010), file: dxupdate.cpp, line: 5861, function: DirectXUpdateInstallPlugIn

RegisterDllFromSection() failed.

--------------------
[12/15/12 15:20:11] module: dsetup32(Mar 30 2011), file: dxupdate.cpp, line: 280, function: CSetup::InstallPlugIn

DirectXUpdateInstallPlugIn() failed.

--------------------
[12/15/12 15:20:11] module: dsetup32(Mar 30 2011), file: setup.cpp, line: 1727, function: CSetup::SetupForDirectX

InstallPlugIn() failed.

--------------------
[12/15/12 16:09:05] module: dxupdate(Feb 4 2010), file: dxupdate.cpp, line: 189, function: GetDXVersion

Failed API: RegQueryValueEx()
Error: (2) - The system cannot find the file specified.

Current DirectX may be a older version which does not have the version value in the registry.

--------------------
[12/15/12 16:09:05] module: dxupdate(Feb 4 2010), file: dxupdate.cpp, line: 4751, function: DirectXUpdateGetSetupInformation

GetDXVersion() failed.

--------------------
[12/15/12 16:09:05] module: dsetup32(Feb 4 2010), file: dxupdate.cpp, line: 280, function: CSetup::InstallPlugIn

DirectXUpdateInstallPlugIn() failed.

--------------------
[12/15/12 16:09:05] module: dsetup32(Feb 4 2010), file: setup.cpp, line: 1701, function: CSetup::SetupForDirectX

InstallPlugIn() failed.

--------------------
[12/15/12 16:47:44] module: dxupdate(Nov 19 2010), file: dxupdate.cpp, line: 178, function: GetDXVersion

Failed API: RegOpenKeyEx()
Error: (2) - The system cannot find the file specified.

Current DirectX may be a older version which does not have directx key in the registry.

--------------------
[12/15/12 16:47:44] module: dxupdate(Nov 19 2010), file: dxupdate.cpp, line: 4527, function: DirectXUpdateDownloadPlugIn

GetDXVersion() failed.

--------------------
[12/15/12 16:47:45] module: DXWSetup(Jun 2 2010), file: dxupdate.cpp, line: 386, function: DownloadPlugIn

DirectXUpdateDownloadPlugIn() failed.

--------------------
[12/15/12 16:47:45] module: DXWSetup(Jun 2 2010), file: psheets.cpp, line: 498, function: PreinstDlgProc

DownloadPlugIn() failed.

--------------------
[12/15/12 17:27:41] module: dxupdate(Jun 2 2010), file: dxupdate.cpp, line: 189, function: GetDXVersion

Failed API: RegQueryValueEx()
Error: (2) - The system cannot find the file specified.

Current DirectX may be a older version which does not have the version value in the registry.

--------------------
[12/15/12 17:27:41] module: dxupdate(Jun 2 2010), file: dxupdate.cpp, line: 4751, function: DirectXUpdateGetSetupInformation

GetDXVersion() failed.

--------------------
[12/15/12 17:27:41] module: dsetup32(Jun 2 2010), file: dxupdate.cpp, line: 280, function: CSetup::InstallPlugIn

DirectXUpdateInstallPlugIn() failed.

--------------------
[12/15/12 17:27:41] module: dsetup32(Jun 2 2010), file: setup.cpp, line: 1723, function: CSetup::SetupForDirectX

InstallPlugIn() failed.

--------------------
[12/16/12 12:47:35] module: dxupdate(Nov 19 2010), file: dxupdate.cpp, line: 192, function: GetDXVersion

Failed API: RegQueryValueEx()
Error: (2) - The system cannot find the file specified.

Current DirectX may be a older version which does not have the version value in the registry.

--------------------
[12/16/12 12:47:35] module: dxupdate(Nov 19 2010), file: dxupdate.cpp, line: 4527, function: DirectXUpdateDownloadPlugIn

GetDXVersion() failed.

--------------------
[12/16/12 12:47:36] module: DXWSetup(Jun 2 2010), file: dxupdate.cpp, line: 386, function: DownloadPlugIn

DirectXUpdateDownloadPlugIn() failed.

--------------------
[12/16/12 12:47:36] module: DXWSetup(Jun 2 2010), file: psheets.cpp, line: 498, function: PreinstDlgProc

DownloadPlugIn() failed.

--------------------
[12/18/12 14:48:05] module: dxupdate(Jun 2 2010), file: dxupdate.cpp, line: 189, function: GetDXVersion

Failed API: RegQueryValueEx()
Error: (2) - The system cannot find the file specified.

Current DirectX may be a older version which does not have the version value in the registry.

--------------------
[12/18/12 14:48:05] module: dxupdate(Jun 2 2010), file: dxupdate.cpp, line: 4751, function: DirectXUpdateGetSetupInformation

GetDXVersion() failed.

--------------------
[12/18/12 14:48:05] module: dsetup32(Jun 2 2010), file: dxupdate.cpp, line: 280, function: CSetup::InstallPlugIn

DirectXUpdateInstallPlugIn() failed.

--------------------
[12/18/12 14:48:05] module: dsetup32(Jun 2 2010), file: setup.cpp, line: 1723, function: CSetup::SetupForDirectX

InstallPlugIn() failed.

--------------------
[12/18/12 16:16:58] module: dxupdate(Jun 2 2010), file: dxupdate.cpp, line: 189, function: GetDXVersion

Failed API: RegQueryValueEx()
Error: (2) - The system cannot find the file specified.

Current DirectX may be a older version which does not have the version value in the registry.

--------------------
[12/18/12 16:16:58] module: dxupdate(Jun 2 2010), file: dxupdate.cpp, line: 4751, function: DirectXUpdateGetSetupInformation

GetDXVersion() failed.

--------------------
[12/18/12 16:16:58] module: dsetup32(Jun 2 2010), file: dxupdate.cpp, line: 280, function: CSetup::InstallPlugIn

DirectXUpdateInstallPlugIn() failed.

--------------------
[12/18/12 16:16:58] module: dsetup32(Jun 2 2010), file: setup.cpp, line: 1723, function: CSetup::SetupForDirectX

InstallPlugIn() failed.

--------------------
[12/18/12 16:38:22] module: dxupdate(Jun 2 2010), file: dxupdate.cpp, line: 189, function: GetDXVersion

Failed API: RegQueryValueEx()
Error: (2) - The system cannot find the file specified.

Current DirectX may be a older version which does not have the version value in the registry.

--------------------
[12/18/12 16:38:22] module: dxupdate(Jun 2 2010), file: dxupdate.cpp, line: 4751, function: DirectXUpdateGetSetupInformation

GetDXVersion() failed.

--------------------
[12/18/12 16:38:22] module: dsetup32(Jun 2 2010), file: dxupdate.cpp, line: 280, function: CSetup::InstallPlugIn

DirectXUpdateInstallPlugIn() failed.

--------------------
[12/18/12 16:38:22] module: dsetup32(Jun 2 2010), file: setup.cpp, line: 1723, function: CSetup::SetupForDirectX

InstallPlugIn() failed.

--------------------
[12/19/12 11:28:32] module: dxupdate(Jun 2 2010), file: dxupdate.cpp, line: 189, function: GetDXVersion

Failed API: RegQueryValueEx()
Error: (2) - The system cannot find the file specified.

Current DirectX may be a older version which does not have the version value in the registry.

--------------------
[12/19/12 11:28:32] module: dxupdate(Jun 2 2010), file: dxupdate.cpp, line: 4751, function: DirectXUpdateGetSetupInformation

GetDXVersion() failed.

--------------------
[12/19/12 11:28:32] module: dsetup32(Jun 2 2010), file: dxupdate.cpp, line: 280, function: CSetup::InstallPlugIn

DirectXUpdateInstallPlugIn() failed.

--------------------
[12/19/12 11:28:32] module: dsetup32(Jun 2 2010), file: setup.cpp, line: 1723, function: CSetup::SetupForDirectX

InstallPlugIn() failed.

--------------------
[12/19/12 11:58:04] module: dxdllreg(Mar 30 2011), file: dxdllreg.cpp, line: 80, function: ReadInfSection

Unable to load list, C:WINDOWSinfdxdllreg.inf:[DXDllRegister].

--------------------
[12/19/12 11:58:04] module: dxdllreg(Mar 30 2011), file: dxdllreg.cpp, line: 167, function: RegisterSection

Failed API: GetPrivateProfileString()

C:WINDOWSinfdxdllreg.inf [DX8RetailDLLs] doesn't have RegisterOCXs entry.

--------------------
[12/19/12 12:10:29] module: dxupdate(Mar 30 2011), file: dxupdate.cpp, line: 192, function: GetDXVersion

Failed API: RegQueryValueEx()
Error: (2) - The system cannot find the file specified.

Current DirectX may be a older version which does not have the version value in the registry.

--------------------
[12/19/12 12:10:29] module: dxupdate(Mar 30 2011), file: dxupdate.cpp, line: 4764, function: DirectXUpdateGetSetupInformation

GetDXVersion() failed.

--------------------
[12/19/12 12:10:29] module: dsetup32(Mar 30 2011), file: dxupdate.cpp, line: 280, function: CSetup::InstallPlugIn

DirectXUpdateInstallPlugIn() failed.

--------------------
[12/19/12 12:10:29] module: dsetup32(Mar 30 2011), file: setup.cpp, line: 1727, function: CSetup::SetupForDirectX

InstallPlugIn() failed.

Но 2рият DirectX.log е много нещо 3пъти повече от пъврият лог

Редактирано 19 декември 201213 г. от Tsvetelin Kirov (преглед на промените)

19 декември 201213 г.

Ще трябва да се поровите из БИОС-а и да пуснете SSE инструкциите за процесора:

Error 0xC000001D means Illegal instruction
You have to enable the SSE Extensiones to your CPU on the BIOS settings.

After that, you can install Direct x9 smoothly.

След това пробвайте отново.

Ако не се получи - отворете Start => run => regedit и изтрийте този ключ:

HKEY_LOCAL_MACHINESoftwareMicrosoftDirectX

и след това пробяайте отново...

Ако пак не стане - или има повредени системни файлове (ако имате инсталационен диск може да пробваме с командата sfc /scannow) или с RKILL да претърсим за повредени файлове.

И финалното нещо, което се сещам е да се занулят правата на файлловете и регистрите, но това ще е за финал...първо вижте в БИОС-а положението.

19 декември 201213 г.

Автор

На истина в БИОС беше изключено това SSE включих го пробвах отново но не стана.След това Изпълнение/regedit/HKEY_LOCAL_MACHINESoftwareMicrosof но тям нямаше никаква папка или ключ с наименование DirectX а преди имаше

Ето лог файл от Rkill:

Rkill 2.4.5 by Lawrence Abrams (Grinler)
http://www.bleepingcomputer.com/
Copyright 2008-2012 BleepingComputer.com
More Information about Rkill can be found at this link:
http://www.bleepingcomputer.com/forums/topic308364.html

Program started at: 12/19/2012 12:46:00 PM in x86 mode.
Windows Version: Microsoft Windows XP Service Pack 3

Checking for Windows services to stop:

* No malware services found to stop.

Checking for processes to terminate:

* No malware processes found to kill.

Checking Registry for malware related settings:

* No issues found in the Registry.

Resetting .EXE, .COM, & .BAT associations in the Windows Registry.

Performing miscellaneous checks:

* Windows Firewall Disabled

[HKLMSYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyStandardProfile]
"EnableFirewall" = dword:00000000

Checking Windows Service Integrity:

* RpcSs => %SystemRoot%system32svchost.exe -k rpcss [incorrect ImagePath]

* helpsvc => %SystemRoot%PCHealthHelpCtrBinariespchsvc.dllespchsvc.dll [incorrect ServiceDLL]

Searching for Missing Digital Signatures:

* C:WINDOWSSystem32d3d8thk.dll [NoSig]
+-> C:WINDOWSServicePackFilesi386d3d8thk.dll : 8 192 : 04/14/2008 00:41 AM : 31b067c412fa1a9bad3ca2a63d7da440 [Pos Repl]

Checking HOSTS File:

* HOSTS file entries found:

127.0.0.1 localhost

Program finished at: 12/19/2012 12:46:28 PM
Execution time: 0 hours(s), 0 minute(s), and 28 seconds(s)

Редактирано 19 декември 201213 г. от Tsvetelin Kirov (преглед на промените)

19 декември 201213 г.

Изтеглете следните файлове и ги запазете на десктопа:

RpcSs.reg

helpsvc.reg

Стартирайте ги и изберете YES на диалоговия прозорец.

След това изпълнете следния скрипт за Combofix (както преди)

Fcopy::
C:WINDOWSServicePackFilesi386d3d8thk.dll | C:WINDOWSSystem32d3d8thk.dll
Registry::
[HKLMSYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyStandardProfile]
"EnableFirewall" = dword:00000001
[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileIcmpSettings]
"AllowInboundEchoRequest"=dword:00000000

Добре дошли!

Проблем с вирус worm/Downadup

Featured Replies

Архивирана тема

Разглеждащи това в момента 0

Дарение

Бюлетин

Профил

Навигация

Търсене

Конфигуриране на push известия в браузъра

Chrome (Android)

Chrome (Desktop)

Safari (iOS 16.4+)

Safari (macOS)

Edge (Android)

Edge (Desktop)

Firefox (Android)

Firefox (Desktop)