MalwareBytes' Anti-Malware - проблеми, дискусии, мнения - Страница 13 - Сигурност и антивирусна защита - Kaldata.com

6 август 200917 г.

Автор

Ще се наложи да обнови инструкциите за RootRepeal. Отвори RootRepeal, в долната част има таб Report, цъкни на него. Там има бутон Scan, кликни върху него. И ще те попита какво да сканира, а ти сложи отметки пред следните редове:

Drivers
Processes
SSDT
Hidden Services

Накрая избери OK и сканирането ще започне. След като, сканирането приключи ще ти се отвори Notepad, копирай съдържанието му и го постави в следващия си пост. Ако не ти отвори Notepad, в текстовото поле ще ти се появи, затова маркирай всичко и го публикувай в следващия си пост. Надявам се, че сега е по-ясно.

Пример за скриптов блокер е No Script add-on на Firefox.

NoScript предпазва чрез блокиране на скриптовете, задействащи се при отваряне на интернет страница. Разширението също предоставя възможност на потребителя да разрешава задействането на скриптове. Посещаването на изглеждащи напълно безобидни сайтове може да запише и активира на компютъра зловреден софтуер, без дори потребителят да знае за това.

6 август 200917 г.

Така, това го направих и ето : ROOTREPEAL © AD, 2007-2009 ================================================== Scan Start Time: 2009/08/06 20:19 Program Version: Version 1.3.3.0 Windows Version: Windows XP SP2 ================================================== Drivers ------------------- Name: dump_atapi.sys Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys Address: 0xAF21F000 Size: 98304 File Visible: No Signed: - Status: - Name: dump_WMILIB.SYS Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS Address: 0xBAE48000 Size: 8192 File Visible: No Signed: - Status: - Name: PCI_PNP8350 Image Path: \Driver\PCI_PNP8350 Address: 0x00000000 Size: 0 File Visible: No Signed: - Status: - Name: rootrepeal.sys Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys Address: 0xAC761000 Size: 49152 File Visible: No Signed: - Status: - Name: splk.sys Image Path: splk.sys Address: 0xBA6A7000 Size: 1048576 File Visible: No Signed: - Status: - Name: sptd Image Path: \Driver\sptd Address: 0x00000000 Size: 0 File Visible: No Signed: - Status: - SSDT ------------------- #: 025 Function Name: NtClose Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xaf23f6b8 #: 041 Function Name: NtCreateKey Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xaf23f574 #: 065 Function Name: NtDeleteValueKey Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xaf23fa52 #: 068 Function Name: NtDuplicateObject Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xaf23f14c #: 071 Function Name: NtEnumerateKey Status: Hooked by "splk.sys" at address 0xba6c6ca2 #: 073 Function Name: NtEnumerateValueKey Status: Hooked by "splk.sys" at address 0xba6c7030 #: 119 Function Name: NtOpenKey Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xaf23f64e #: 122 Function Name: NtOpenProcess Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xaf23f08c #: 128 Function Name: NtOpenThread Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xaf23f0f0 #: 160 Function Name: NtQueryKey Status: Hooked by "splk.sys" at address 0xba6c7108 #: 177 Function Name: NtQueryValueKey Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xaf23f76e #: 204 Function Name: NtRestoreKey Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xaf23f72e #: 247 Function Name: NtSetValueKey Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xaf23f8ae #: 257 Function Name: NtTerminateProcess Status: Hooked by "C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys" at address 0xaf345df0 ==EOF== Обаче хал хабер си нямам как да изключа скрипт, нито знам дали имам No Script add-on на Firefox. Чувствам се много неудобно, че ви занимавам навярно с много елементарни за вас неща, но наистина това го чувам за пръв път. Май ще ви трябва повечко търпение с мен...

6 август 200917 г.

Автор

Точно ми трябваше. No Script е add-on за Firefox и го дадох просто като пример за script blocker. Не успях ли да разбереш определението? Не че е от голяма важност да го знаеш, не се притеснявай пропускаме го. Сега само ми трябва лога от DDS

6 август 200917 г.

Ами за скриптовете си останах невежа, ама засега ще я карам така :speak: = Другото : 1. UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT DDS (Ver_09-07-30.01) Microsoft Windows XP Professional Boot Device: \Device\HarddiskVolume1 Install Date: 06.4.2009 г. 16:04:07 System Uptime: 08.6.2009 г. 01:45:45 (1435 hours ago) Motherboard: FOXCONN | | A690GM2MA/A690VM2MA Processor: AMD Athlon 64 Processor 3200+ | CPU 1 | 2008/200mhz ==== Disk Partitions ========================= C: is FIXED (NTFS) - 98 GiB total, 84,635 GiB free. D: is FIXED (NTFS) - 135 GiB total, 122,273 GiB free. E: is Removable F: is Removable G: is Removable H: is Removable I: is CDROM (CDFS) J: is CDROM () K: is CDROM () L: is CDROM () M: is CDROM () ==== Disabled Device Manager Items ============= ==== System Restore Points =================== RP105: 08.7.2009 г. 21:57:26 - Контролна точка на системата RP106: 09.7.2009 г. 22:34:33 - Контролна точка на системата RP107: 10.7.2009 г. 21:18:32 - Installed SUPERAntiSpyware Professional RP108: 10.7.2009 г. 21:29:06 - Removed SUPERAntiSpyware Professional RP109: 10.7.2009 г. 21:35:22 - Installed SUPERAntiSpyware Free Edition RP110: 11.7.2009 г. 23:46:33 - Контролна точка на системата RP111: 13.7.2009 г. 12:32:49 - Контролна точка на системата RP112: 14.7.2009 г. 14:10:10 - Контролна точка на системата RP113: 15.7.2009 г. 15:39:41 - Контролна точка на системата RP114: 16.7.2009 г. 15:55:49 - Контролна точка на системата RP115: 18.7.2009 г. 11:41:44 - Контролна точка на системата RP116: 19.7.2009 г. 23:02:29 - Контролна точка на системата RP117: 20.7.2009 г. 23:12:22 - Контролна точка на системата RP118: 22.7.2009 г. 00:06:00 - Контролна точка на системата RP119: 23.7.2009 г. 12:18:10 - Контролна точка на системата RP120: 24.7.2009 г. 12:34:08 - Контролна точка на системата RP121: 25.7.2009 г. 13:00:51 - Контролна точка на системата RP122: 26.7.2009 г. 20:29:21 - Контролна точка на системата RP123: 27.7.2009 г. 21:33:13 - Installed Windows XP KB958644. RP124: 28.7.2009 г. 21:37:59 - Контролна точка на системата RP125: 29.7.2009 г. 21:43:15 - Контролна точка на системата RP126: 30.7.2009 г. 23:16:54 - Контролна точка на системата RP127: 31.7.2009 г. 22:58:50 - Установлена Syberia 2 RP128: 01.8.2009 г. 23:31:42 - Контролна точка на системата RP129: 03.8.2009 г. 04:23:32 - Контролна точка на системата RP130: 04.8.2009 г. 04:29:30 - Контролна точка на системата RP131: 05.8.2009 г. 05:02:50 - Контролна точка на системата RP132: 05.8.2009 г. 10:17:04 - Удалена Syberia 2 RP133: 06.8.2009 г. 12:05:38 - Контролна точка на системата ==== Installed Programs ====================== Деинсталлировать игру "Зачарованная Катя и тайна пропавшего мага" Архиватор WinRAR µTorrent Кафе 'Золотые сердца' Пляжный переполох 1.00 ABBYY FineReader 9.0 Professional Edition Adobe Reader 7.0.7 Adobe Shockwave Player 11 AIMP2 AiO_Scan_CDA AiOSoftwareNPI ATI - Software Uninstall Utility ATI Catalyst Control Center ATI Display Driver avast! Antivirus Be Rich (русская версия) Bilbo - The Four Corners of the World BSPlayer BufferChm Catalyst Control Center Core Implementation Catalyst Control Center Graphics Full Existing Catalyst Control Center Graphics Full New Catalyst Control Center Graphics Light Catalyst Control Center Graphics Previews Common ccc-core-preinstall ccc-core-static ccc-utility CCC Help English CCleaner (remove only) CP_Package_Variety1 CP_Package_Variety2 CP_Package_Variety3 CustomerResearchQFolder Destinations DeviceManagementQFolder DocProc Dream Chronicles 3 - The Chosen Child 1.0 eSupportQFolder Extended Language Support Fonts Package F300 F300_Help F300Trb Farm Frenzy 3 Fashion Solitaire Fax_CDA Fox LiveUpdate FOX ONE Free Download Manager 2.1 HijackThis 2.0.2 Home Sweet Home 2 Kitchens and Baths Hotel Mogul HP Extended Capabilities 6.1 HP Imaging Device Functions 6.1 HP Photosmart Essential HP PSC & OfficeJet 6.1.A HP Software Update HP Solution Center and Imaging Support Tools 6.1 HPProductAssistant ImgBurn Kelly Green Garden Queen Lexmark Software Uninstall LG GSM PC Components LG USB Modem Driver MagicFarmUltimate Malwarebytes' Anti-Malware MarketResearch Microsoft .NET Framework 2.0 Microsoft Office Access MUI (Bulgarian) 2007 Microsoft Office Access MUI (English) 2007 Microsoft Office Access Setup Metadata MUI (English) 2007 Microsoft Office Enterprise 2007 Microsoft Office Excel MUI (Bulgarian) 2007 Microsoft Office Excel MUI (English) 2007 Microsoft Office Groove MUI (English) 2007 Microsoft Office Groove Setup Metadata MUI (English) 2007 Microsoft Office InfoPath MUI (English) 2007 Microsoft Office OneNote MUI (English) 2007 Microsoft Office Outlook MUI (Bulgarian) 2007 Microsoft Office Outlook MUI (English) 2007 Microsoft Office PowerPoint MUI (Bulgarian) 2007 Microsoft Office PowerPoint MUI (English) 2007 Microsoft Office Professional 2007 Microsoft Office Proof (Bulgarian) 2007 Microsoft Office Proof (English) 2007 Microsoft Office Proof (French) 2007 Microsoft Office Proof (German) 2007 Microsoft Office Proof (Russian) 2007 Microsoft Office Proof (Spanish) 2007 Microsoft Office Proofing (Bulgarian) 2007 Microsoft Office Proofing (English) 2007 Microsoft Office Publisher MUI (Bulgarian) 2007 Microsoft Office Publisher MUI (English) 2007 Microsoft Office Shared MUI (Bulgarian) 2007 Microsoft Office Shared MUI (English) 2007 Microsoft Office Shared Setup Metadata MUI (English) 2007 Microsoft Office Word MUI (Bulgarian) 2007 Microsoft Office Word MUI (English) 2007 Microsoft Software Update for Web Folders (Bulgarian) 12 Microsoft Software Update for Web Folders (English) 12 Mozilla Firefox (3.5.2) Mystic Emporium NewCopy_CDA Passport to Perfume Posh Boutique 2 ProductContextNPI Readme REALTEK GbE & FE Ethernet PCI NIC Driver Realtek High Definition Audio Driver Recuva (remove only) Scan ScannerCopy Security Update for Windows XP (KB958644) Skins Skype™ 4.0 Software Update for Web Folders SolutionCenter Status SUPERAntiSpyware Free Edition The KMPlayer (remove only) Toolbox TrayApp Unload Unlocker 1.8.5 uTorrent (remove only) WebReg Windows Bulgarian Interface Pack ==== End Of File =========================== 2. DDS (Ver_09-07-30.01) - NTFSx86 Run by emi at 20:42:06,00 on 06.08.2009 Ј. Internet Explorer: 7.0.5730.13 Microsoft Windows XP Professional 5.1.2600.2.1251.359.1033.18.1919.1021 [GMT 3:00] ============== Running Processes =============== C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe C:\WINDOWS\system32\Ati2evxx.exe svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Unlocker\UnlockerAssistant.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\PicPick\picpick.exe C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Free Download Manager\fdm.exe C:\Program Files\uTorrent\uTorrent.exe C:\Program Files\DAEMON Tools Lite\daemon.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\Program Files\Common Files\ABBYY\FineReader\9.00\Licensing\PE\NetworkLicenseServer.exe C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\emi\Desktop\dds.scr ============== Pseudo HJT Report =============== uStart Page = www.google.bg BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\progra~1\micros~2\office12\GRA8E1~1.DLL BHO: FDMIECookiesBHO Class: {cc59e0f9-7e43-44fa-9faa-8377850bf205} - c:\program files\free download manager\iefdmcks.dll TB: {32099AAC-C132-4136-9E9A-4E364A424E17} - No File uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe uRun: [Free Download Manager] c:\program files\free download manager\fdm.exe -autorun uRun: [startCCC] c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe uRun: [uTorrent] "c:\program files\utorrent\uTorrent.exe" uRun: [DAEMON Tools Lite] "c:\program files\daemon tools lite\daemon.exe" -autorun uRun: [skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized uRun: [sUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe mRun: [avast!] c:\progra~1\alwils~1\avast4\ashDisp.exe mRun: [unlockerAssistant] "c:\program files\unlocker\UnlockerAssistant.exe" mRun: [RTHDCPL] RTHDCPL.EXE mRun: [skyTel] SkyTel.EXE mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe" mRun: [PicPick Start] c:\program files\picpick\picpick.exe mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE dRun: [Free Download Manager] c:\program files\free download manager\fdm.exe -autorun dRunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000 IE: Свали всички с Free Download Manager - file://c:\program files\free download manager\dlall.htm IE: Свали избраните с Free Download Manager - file://c:\program files\free download manager\dlselected.htm IE: Свали с Free Download Manager - file://c:\program files\free download manager\dllink.htm IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL TCP: {AE55B42D-39B2-44BD-B217-90B93C8AD2FC} = 91.148.149.1,193.24.240.25 Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\progra~1\micros~2\office12\GR99D3~1.DLL Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll Notify: AtiExtEvent - Ati2evxx.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\wpdshserviceobj.dll SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~1\micros~2\office12\GRA8E1~1.DLL SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\emi\applic~1\mozilla\firefox\profiles\apsx9h11.default\ ---- FIREFOX POLICIES ---- c:\program files\mozilla firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false); c:\program files\mozilla firefox\greprefs\all.js - pref("media.cache_size", 51200); c:\program files\mozilla firefox\greprefs\all.js - pref("media.ogg.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("media.wave.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("media.autoplay.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess"); c:\program files\mozilla firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120); c:\program files\mozilla firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3); c:\program files\mozilla firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true); c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.dpi", -1); c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1); c:\program files\mozilla firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true); c:\program files\mozilla firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0); c:\program files\mozilla firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072); c:\program files\mozilla firefox\greprefs\all.js - pref("geo.enabled", true); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35"); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json"); ============= SERVICES / DRIVERS =============== R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-7-3 114768] R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2009-6-23 9968] R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2009-6-23 72944] R2 ABBYY.Licensing.FineReader.Professional.9.0;ABBYY FineReader 9.0 PE Licensing Service;c:\program files\common files\abbyy\finereader\9.00\licensing\pe\NetworkLicenseServer.exe [2008-10-27 759072] R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-7-3 20560] R2 athsgt;athsgt;c:\windows\system32\drivers\athsgt.sys [2009-5-21 164992] R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast4\ashServ.exe [2009-4-6 138680] R2 limsgt;limsgt;c:\windows\system32\drivers\limsgt.sys [2009-5-21 12544] R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2009-6-20 232720] R3 avast! Mail Scanner;avast! Mail Scanner;c:\program files\alwil software\avast4\ashMaiSv.exe [2009-4-6 254040] R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2009-6-20 19096] R3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2009-6-23 7408] S3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast4\ashWebSv.exe [2009-4-6 352920] S3 FXDrv32;FXDrv32;\??\i:\fxdrv32.sys --> i:\FXDrv32.sys [?] S3 FXExSS;FXExSS;c:\program files\foxconn\fox one\FXExSS32.sys [2009-4-6 21312] =============== Created Last 30 ================ 2009-08-06 10:09 <DIR> --d----- c:\docume~1\emi\applic~1\iWin 2009-08-06 10:09 <DIR> --d----- c:\docume~1\alluse~1\applic~1\iWin 2009-08-06 10:09 <DIR> --d----- c:\docume~1\alluse~1\applic~1\iWin Games 2009-08-06 10:08 <DIR> --d----- c:\windows\Kelly Green Garden Queen 2009-08-06 10:08 <DIR> --d----- c:\program files\Kelly Green Garden Queen 2009-08-02 20:27 <DIR> --d----- c:\docume~1\alluse~1\applic~1\GameHouse 2009-07-27 21:32 <DIR> --d-h--- c:\windows\$hf_mig$ 2009-07-27 18:59 <DIR> --d----- c:\docume~1\alluse~1\applic~1\MumboJumbo 2009-07-26 14:50 <DIR> --d----- c:\docume~1\emi\applic~1\CasualForge 2009-07-26 14:50 <DIR> --d----- c:\docume~1\alluse~1\applic~1\CasualForge 2009-07-26 14:48 <DIR> --d----- c:\program files\Games 2009-07-26 14:03 <DIR> --d----- c:\docume~1\emi\applic~1\cerasus.media 2009-07-23 16:06 <DIR> --d----- c:\docume~1\emi\applic~1\V-Games 2009-07-23 00:00 <DIR> --d----- c:\docume~1\alluse~1\applic~1\FarmFrenzy3 2009-07-22 23:39 <DIR> --d----- c:\program files\Alawar 2009-07-21 13:14 <DIR> --d----- c:\windows\Passport to Perfume 2009-07-21 13:14 <DIR> --d----- c:\program files\Passport to Perfume 2009-07-21 12:58 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Hot Lava Games 2009-07-21 12:58 <DIR> --d----- c:\docume~1\emi\applic~1\Thinstall 2009-07-17 20:16 <DIR> --d----- c:\docume~1\emi\applic~1\Little Games Company 2009-07-17 20:03 <DIR> --d----- c:\docume~1\emi\applic~1\YoudaGames 2009-07-16 22:39 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Fashion Solitaire 1.2 2009-07-16 14:20 <DIR> --d----- c:\windows\Fashion Solitaire 2009-07-16 14:20 <DIR> --d----- c:\program files\Fashion Solitaire 2009-07-15 22:17 <DIR> --d----- c:\docume~1\emi\applic~1\SunRay Games 2009-07-14 17:04 360 a------- C:\123123 2009-07-10 21:35 <DIR> --d----- c:\docume~1\alluse~1\applic~1\SUPERAntiSpyware.com 2009-07-10 21:35 <DIR> --d----- c:\program files\SUPERAntiSpyware 2009-07-10 21:35 <DIR> --d----- c:\docume~1\emi\applic~1\SUPERAntiSpyware.com 2009-07-10 21:35 <DIR> --d----- c:\program files\common files\Wise Installation Wizard 2009-07-10 21:29 <DIR> --d----- c:\windows\system32\appmgmt 2009-07-08 21:56 <DIR> --ds---- C:\ComboFix 2009-07-08 20:58 <DIR> -cd----- c:\windows\system32\dllcache\cache 2009-07-07 22:31 <DIR> --d----- c:\windows\pss 2009-07-07 20:46 <DIR> --d----- c:\windows\system32\wbem\Repository 2009-07-07 20:43 <DIR> --d----- c:\windows\Posh Boutique 2 2009-07-07 20:43 <DIR> --d----- c:\docume~1\emi\applic~1\Enchanted Katya 2009-07-07 20:43 <DIR> --d----- c:\docume~1\emi\applic~1\Temp App Data 2009-07-07 20:43 <DIR> --d----- c:\docume~1\emi\applic~1\UClick ==================== Find3M ==================== 2009-08-03 13:36 38,160 a------- c:\windows\system32\drivers\mbamswissarmy.sys 2009-08-03 13:36 19,096 a------- c:\windows\system32\drivers\mbam.sys 2009-07-05 09:55 170,802 a------- c:\windows\pchealth\helpctr\config\cache\Professional_32_1033.dat 2009-06-22 21:05 62,610,373 a------- c:\program files\Академия Магии 2.exe 2009-04-06 16:05 16,384 a--sh--- c:\windows\system32\config\systemprofile\cookies\index.dat 2009-04-06 16:05 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\index.dat 2009-04-06 16:05 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012009040620090407\index.dat 2009-04-06 16:05 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\temporary internet files\content.ie5\index.dat ============= FINISH: 20:42:31,90 =============== Благодаря за търпението ! Много !

6 август 200917 г.

Автор

Моля! От толкова лог файлове не виждам нищо опасно. Нека проверим за последно с ESET Online Scanner:

Изтеглете: ESET Online Scanner
Стартирайте esetsmartinstaller_enu.exe
Сложете отметка на YES, I accept the Terms of Use и изберете Start
Скенерът ще започне да изтегля компонентите, които са му необходими.
Уверете се, че има отметки на следните редове, включително и тези от менюто Advanced Settings:

Remove found threats

Scan archivesScan for potentially unwanted applicationsScan for potentially unsafe applicationsEnable Anti-Stealth technology

И накрая изберете Start

Скенерът ще започне да изтегля последните дефиниции.
След, като сканирането завърши изберете Finish.
Отидете в:

C:\Program Files\ESET\ESET Online Scanner

Отворете файла log.txt , копирайте съдържанието му и го поставете в следващия си пост тук.

6 август 200917 г.

Това не ми харесва: ESETSmartInstaller@High as downloader log: all ok # version=6 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.5889 # api_version=3.0.2 # EOSSerial=1c4db15a3341d640a8653952c58e7e1a # end=finished # remove_checked=true # archives_checked=true # unwanted_checked=true # unsafe_checked=true # antistealth_checked=true # utc_time=2009-08-06 06:45:25 # local_time=2009-08-06 09:45:25 (+0200, FLE Daylight Time) # country="Bulgaria" # lang=1033 # osver=5.1.2600 NT Service Pack 2 # compatibility_mode=769 61 100 100 43826093750 # scanned=45926 # found=4 # cleaned=4 # scan_time=2654 C:\Program Files\Home Sweet Home\Uninstall.exe probably a variant of Win32/Spy.Agent trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\WINDOWS\system32\autorun.inf INF/Autorun.gen trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\Игри\Home Sweet Home+Travel Agency\Home Sweet Home.exe probably a variant of Win32/Spy.Agent trojan (deleted - quarantined) 00000000000000000000000000000000 C D:\Компютър\Nero 8.3.6.0 Ultra HD Edition-Serials + Plugins-xxrazor\Nero-8.3.6.0_eng_trial.exe Win32/Toolbar.AskSBar application (deleted - quarantined) 00000000000000000000000000000000 C Между другото, пак ми се появи гадното балонче за зараза - тъкмо бях свършила да сканирам. Дам... И какво сега? А, и още - да си пусна ли вече моята защита - колкото и да е скапана.... Ще трябва да помисля за друга антивирусна...

Редактирано 6 август 200917 г. от tdkr (преглед на промените)

6 август 200917 г.

Автор

Явно все пак има нещо или поне е имало.

1) Изтеглете ComboFix от: тук

2) Запазете го на вашия десктоп.

3) Преименувайте ComboFix.exe на tool.exe

4) Кликнете два пъти върху tool.exe

5) ComboFix ще започне да сканира вашата система, докато трае сканирането не барайте нищо. Накрая ще се рестартира компютъра Ви.

6) След рестарта изчакайте да завърши сканирането на ComboFix и да генерира лог файл. Когато сканирането завърши ще Ви изскочи Notepad, копирайте съдържанието му и го публикувайте в следващия си пост тук. Ако не Ви изскочи, влезте в C:\ и намерете файл с името combofix.txt . Отворете го, копирайте съдържанието му и го публикувайте тук. В случай на проблем, ComboFix ще създаде файл с име BUG.txt . Ако съществува, моля копирайте и поставете и неговото съдържание.

6 август 200917 г.

Всичко мина, както казахте, с изключение на това, че ComboFix /ако го написах правилно/ не рестартира компютъра ми. Излезе следният лог файл :

ComboFix 09-08-06.01 - emi 08.2009 г. 22:40.2.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1251.359.1033.18.1919.1076 [GMT 3:00]

Running from: c:\documents and settings\emi\Desktop\tool.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

((((((((((((((((((((((((( Files Created from 2009-07-06 to 2009-08-06 )))))))))))))))))))))))))))))))

.

2009-08-06 17:58 . 2009-08-06 17:58 -------- d-----w- c:\program files\ESET

2009-08-06 07:09 . 2009-08-06 07:09 -------- d-----w- c:\documents and settings\emi\Application Data\iWin

2009-08-06 07:09 . 2009-08-06 07:09 -------- d-----w- c:\documents and settings\All Users\Application Data\iWin

2009-08-06 07:09 . 2009-08-06 07:09 -------- d-----w- c:\documents and settings\All Users\Application Data\iWin Games

2009-08-06 07:08 . 2009-08-06 07:09 -------- d-----w- c:\program files\Kelly Green Garden Queen

2009-08-06 07:08 . 2009-08-06 07:08 -------- d-----w- c:\windows\Kelly Green Garden Queen

2009-08-02 17:27 . 2009-08-02 17:27 -------- d-----w- c:\documents and settings\All Users\Application Data\GameHouse

2009-07-27 18:32 . 2009-07-27 18:32 -------- d--h--w- c:\windows\$hf_mig$

2009-07-27 15:59 . 2009-07-27 15:59 -------- d-----w- c:\documents and settings\All Users\Application Data\MumboJumbo

2009-07-26 11:50 . 2009-07-26 11:50 -------- d-----w- c:\documents and settings\emi\Application Data\CasualForge

2009-07-26 11:50 . 2009-07-26 11:50 -------- d-----w- c:\documents and settings\All Users\Application Data\CasualForge

2009-07-26 11:48 . 2009-07-26 11:48 -------- d-----w- c:\program files\Games

2009-07-26 11:03 . 2009-08-05 07:22 -------- d-----w- c:\documents and settings\emi\Application Data\cerasus.media

2009-07-23 13:06 . 2009-07-23 13:06 -------- d-----w- c:\documents and settings\emi\Application Data\V-Games

2009-07-22 21:00 . 2009-07-22 22:21 -------- d-----w- c:\documents and settings\All Users\Application Data\FarmFrenzy3

2009-07-22 20:39 . 2009-07-22 20:39 -------- d-----w- c:\program files\Alawar

2009-07-21 10:14 . 2009-07-21 10:14 -------- d-----w- c:\program files\Passport to Perfume

2009-07-21 10:14 . 2009-07-21 10:14 -------- d-----w- c:\windows\Passport to Perfume

2009-07-21 09:58 . 2009-07-21 09:58 -------- d-----w- c:\documents and settings\All Users\Application Data\Hot Lava Games

2009-07-21 09:58 . 2009-07-21 09:58 -------- d-----w- c:\documents and settings\emi\Application Data\Thinstall

2009-07-17 17:16 . 2009-07-17 17:16 -------- d-----w- c:\documents and settings\emi\Application Data\Little Games Company

2009-07-17 17:03 . 2009-07-17 17:03 -------- d-----w- c:\documents and settings\emi\Application Data\YoudaGames

2009-07-16 19:39 . 2009-07-17 06:27 -------- d-----w- c:\documents and settings\All Users\Application Data\Fashion Solitaire 1.2

2009-07-16 11:20 . 2009-07-16 21:50 -------- d-----w- c:\program files\Fashion Solitaire

2009-07-16 11:20 . 2009-07-16 11:20 -------- d-----w- c:\windows\Fashion Solitaire

2009-07-15 19:17 . 2009-08-05 07:12 -------- d-----w- c:\documents and settings\emi\Application Data\SunRay Games

2009-07-14 10:14 . 2009-08-04 03:00 3942048 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe

2009-07-13 20:46 . 2009-07-13 20:46 -------- d-----w- c:\documents and settings\emi\Local Settings\Application Data\WMTools Downloaded Files

2009-07-10 18:36 . 2009-08-05 22:47 117760 ----a-w- c:\documents and settings\emi\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL

2009-07-10 18:35 . 2009-07-10 18:35 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com

2009-07-10 18:35 . 2009-07-29 08:29 -------- d-----w- c:\program files\SUPERAntiSpyware

2009-07-10 18:35 . 2009-07-10 18:35 -------- d-----w- c:\documents and settings\emi\Application Data\SUPERAntiSpyware.com

2009-07-10 18:35 . 2009-07-10 18:35 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard

2009-07-08 18:56 . 2009-08-06 19:37 -------- d-s---w- C:\ComboFix

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-08-06 19:43 . 2009-04-06 19:26 -------- d-----w- c:\documents and settings\emi\Application Data\Skype

2009-08-06 19:42 . 2009-04-06 13:13 -------- d-----w- c:\documents and settings\emi\Application Data\Free Download Manager

2009-08-06 19:40 . 2009-04-06 13:12 -------- d-----w- c:\documents and settings\emi\Application Data\uTorrent

2009-08-06 18:12 . 2009-04-27 17:59 -------- d-----w- c:\program files\Home Sweet Home

2009-08-06 05:21 . 2009-04-06 19:00 -------- d-----w- c:\program files\ABBYY FineReader 9.0

2009-08-05 06:52 . 2009-04-11 19:31 -------- d-----w- c:\documents and settings\emi\Application Data\Shape games

2009-08-05 06:30 . 2009-04-07 10:58 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP

2009-08-05 06:14 . 2009-06-21 17:05 -------- d-----w- c:\documents and settings\emi\Application Data\Camel101

2009-08-04 22:58 . 2009-06-20 11:30 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2009-08-03 10:36 . 2009-06-20 11:30 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-08-03 10:36 . 2009-06-20 11:30 19096 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-08-01 18:37 . 2009-05-05 08:32 -------- d-----w- c:\documents and settings\emi\Application Data\Home Sweet Home 2

2009-07-29 07:37 . 2009-04-09 12:48 -------- d-----w- c:\program files\Vogue Tales

2009-07-26 10:46 . 2009-05-11 17:51 -------- d-----w- c:\program files\Lovely Kitchen

2009-07-21 10:14 . 2009-04-17 19:53 -------- d-----w- c:\documents and settings\emi\Application Data\PlayFirst

2009-07-09 16:47 . 2009-07-06 19:15 -------- d-----w- c:\documents and settings\emi\Application Data\Artogon

2009-07-07 17:44 . 2009-04-06 13:29 -------- d--h--w- c:\program files\InstallShield Installation Information

2009-07-07 17:43 . 2009-07-07 17:43 -------- d-----w- c:\documents and settings\emi\Application Data\Enchanted Katya

2009-07-07 17:43 . 2009-07-07 17:43 -------- d-----w- c:\documents and settings\emi\Application Data\Temp App Data

2009-07-07 17:43 . 2009-07-07 17:43 -------- d-----w- c:\documents and settings\emi\Application Data\UClick

2009-07-07 17:43 . 2009-05-20 17:33 -------- d-----w- c:\program files\PlayIT

2009-07-07 17:42 . 2009-06-28 16:42 -------- d-----w- c:\program files\EnchantedKatya

2009-07-07 17:42 . 2009-06-30 18:44 -------- d-----w- c:\program files\Posh Boutique 2

2009-07-06 15:54 . 2009-04-06 13:23 65368 ----a-w- c:\documents and settings\emi\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2009-07-05 06:55 . 2009-07-19 19:22 170802 ----a-w- c:\windows\pchealth\helpctr\Config\Cache\Professional_32_1033.dat

2009-06-30 18:44 . 2009-06-21 16:01 -------- d-----w- c:\documents and settings\emi\Application Data\My Games

2009-06-23 16:54 . 2009-06-23 16:48 -------- d-----w- c:\program files\Bilbo - The Four Corners of the World

2009-06-22 18:05 . 2009-06-26 13:58 62610373 ----a-w- c:\program files\Академия Магии 2.exe

2009-06-22 17:21 . 2009-06-22 17:18 -------- d-----w- c:\program files\AlReader2.win32.ru

2009-06-21 15:48 . 2009-05-31 15:15 -------- d-----w- c:\program files\MagicFarmUltimate

2009-06-20 11:30 . 2009-06-20 11:30 -------- d-----w- c:\documents and settings\emi\Application Data\Malwarebytes

2009-06-20 11:30 . 2009-06-20 11:30 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2009-06-20 10:33 . 2009-04-06 12:55 -------- d-----w- c:\program files\Windows Media Connect 2

2009-06-20 10:23 . 2009-04-06 13:00 -------- d-----w- c:\program files\AIMP2

2009-06-14 05:52 . 2009-06-14 05:52 -------- d-----w- c:\program files\Mystic Emporium

2009-05-21 16:07 . 2009-05-21 16:07 164992 ----a-w- c:\windows\system32\drivers\athsgt.sys

2009-05-21 16:07 . 2009-05-21 16:07 12544 ----a-w- c:\windows\system32\drivers\limsgt.sys

.

------- Sigcheck -------

[-] 2008-01-15 11:15 1580544 B42B1CE3D65F2D34ACE3943CBA380466 c:\windows\system32\sfcfiles.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Free Download Manager"="c:\program files\Free Download Manager\fdm.exe" [2006-08-21 2068527]

"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]

"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2007-12-24 219952]

"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-12-29 687560]

"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-03-27 24103720]

"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-07-29 1830128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]

"UnlockerAssistant"="c:\program files\Unlocker\UnlockerAssistant.exe" [2006-09-07 15360]

"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2005-12-15 49152]

"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]

"PicPick Start"="c:\program files\PicPick\picpick.exe" [2009-06-02 932352]

"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2009-08-03 419088]

"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2007-02-26 16125440]

"SkyTel"="SkyTel.EXE" - c:\windows\SkyTel.exe [2006-05-16 2879488]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]

"Free Download Manager"="c:\program files\Free Download Manager\fdm.exe" [2006-08-21 2068527]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"nltide_3"="advpack.dll" - c:\windows\system32\advpack.dll [2007-12-31 124928]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]

HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-12-15 282624]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]

2008-12-22 09:05 356352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=

"c:\\Program Files\\uTorrent\\uTorrent.exe"=

"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=

"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=

"c:\\WINDOWS\\system32\\LMabcoms.exe"=

"c:\\WINDOWS\\system32\\mmc.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [03.7.2009 г. 07:52 114768]

R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [23.6.2009 г. 11:01 9968]

R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [23.6.2009 г. 11:01 72944]

R2 ABBYY.Licensing.FineReader.Professional.9.0;ABBYY FineReader 9.0 PE Licensing Service;c:\program files\Common Files\ABBYY\FineReader\9.00\Licensing\PE\NetworkLicenseServer.exe [27.10.2008 г. 16:33 759072]

R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [03.7.2009 г. 07:52 20560]

R2 athsgt;athsgt;c:\windows\system32\drivers\athsgt.sys [21.5.2009 г. 19:07 164992]

R2 limsgt;limsgt;c:\windows\system32\drivers\limsgt.sys [21.5.2009 г. 19:07 12544]

R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [20.6.2009 г. 14:30 232720]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [20.6.2009 г. 14:30 19096]

R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [23.6.2009 г. 11:01 7408]

S3 FXDrv32;FXDrv32;\??\i:\fxdrv32.sys --> i:\FXDrv32.sys [?]

S3 FXExSS;FXExSS;c:\program files\FOXCONN\FOX ONE\FXExSS32.sys [06.4.2009 г. 16:42 21312]

.

Contents of the 'Scheduled Tasks' folder

2009-08-06 c:\windows\Tasks\Malwarebytes' Scheduled Scan for emi.job

- c:\program files\Malwarebytes' Anti-Malware\mbam.exe [2009-06-20 10:36]

2009-08-06 c:\windows\Tasks\Malwarebytes' Scheduled Update for emi.job

- c:\program files\Malwarebytes' Anti-Malware\mbam.exe [2009-06-20 10:36]

.

------- Supplementary Scan -------

.

uStart Page = www.google.bg

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

IE: Свали всички с Free Download Manager - file://c:\program files\Free Download Manager\dlall.htm

IE: Свали избраните с Free Download Manager - file://c:\program files\Free Download Manager\dlselected.htm

IE: Свали с Free Download Manager - file://c:\program files\Free Download Manager\dllink.htm

TCP: {AE55B42D-39B2-44BD-B217-90B93C8AD2FC} = 91.148.149.1,193.24.240.25

FF - ProfilePath - c:\documents and settings\emi\Application Data\Mozilla\Firefox\Profiles\apsx9h11.default\

FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll

---- FIREFOX POLICIES ----

c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");

c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true);

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");

c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-08-06 22:43

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(620)

c:\program files\SUPERAntiSpyware\SASWINLO.dll

c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(5044)

c:\windows\system32\wpdshserviceobj.dll

c:\windows\system32\portabledevicetypes.dll

c:\windows\system32\portabledeviceapi.dll

.

Completion time: 2009-08-06 22:44

ComboFix-quarantined-files.txt 2009-08-06 19:44

Pre-Run: 90 511 302 656 bytes free

Post-Run: 90 472 964 096 bytes free

246

Не знам как да ви благодаря, че толкова време се занимавате с мен. :blink:

6 август 200917 г.

Автор

Моля, не се притеснявай. Има какво да се пипне....

Отворете Notepad и чрез комбинацията copy/paste поставете следния текст:

Killall::

FCopy::
c:\windows\system32\dllcache\sfcfiles.dll | c:\windows\system32\sfcfiles.dll

Folder::
c:\program files\ESET

DDS::
TB: {32099AAC-C132-4136-9E9A-4E364A424E17} - No File

Запазете файла с името CFScript.txt и го поставете върху ComboFix.

Публикувано изображение

След като, програмата приключи ще Ви изведе лог файла. Отново чрез комбинацията от Copy/Paste поставете информацията тук.

6 август 200917 г.

Много съжалявам, че пиша толкова късно, може би не сте на линия вече. Но като пуснах копирания файл в ComboFix-а, повече от час не стана нищо, не ми издържаха нервите и прекратих процеса - може би неправилно. Рестартирах . Сега ще опитам пак, да видя какво ще стане, да не би да съм объркала нещо. Malwarebytes' Anti-Malware допълнително ми вдига кръвното с периодични съобщения за зараза - какво е това чудо, по дяволите!

Извинете. Пак ще пробвам, друго не ми остава.

Да, задклавиатурното ми устройство не е първо качество :speak: Успях най-накрая , с мъка, и това е резултатът :

ComboFix 09-08-06.01 - emi 08.2009 г. 8:35.3.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1251.359.1033.18.1919.1208 [GMT 3:00]

Running from: c:\documents and settings\emi\Desktop\tool.exe

Command switches used :: c:\documents and settings\emi\Desktop\CFScript.txt

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\program files\ESET

c:\program files\ESET\ESET Online Scanner\esets_apiA.dll

c:\program files\ESET\ESET Online Scanner\esets_apiW.dll

c:\program files\ESET\ESET Online Scanner\esets_apiW_a.dll

c:\program files\ESET\ESET Online Scanner\ESETSmartInstaller.exe

c:\program files\ESET\ESET Online Scanner\log.txt

c:\program files\ESET\ESET Online Scanner\Modules\data\updfiles\http_update.eset.com\update.ver

c:\program files\ESET\ESET Online Scanner\Modules\data\updfiles\lastupd.ver

c:\program files\ESET\ESET Online Scanner\Modules\data\updfiles\nod01DA.nup

c:\program files\ESET\ESET Online Scanner\Modules\data\updfiles\nod0229.nup

c:\program files\ESET\ESET Online Scanner\Modules\data\updfiles\nod0523.nup

c:\program files\ESET\ESET Online Scanner\Modules\data\updfiles\nod0A32.nup

c:\program files\ESET\ESET Online Scanner\Modules\data\updfiles\nod1826.nup

c:\program files\ESET\ESET Online Scanner\Modules\data\updfiles\nod1E80.nup

c:\program files\ESET\ESET Online Scanner\Modules\data\updfiles\nod285A.nup

c:\program files\ESET\ESET Online Scanner\Modules\data\updfiles\nod28AB.nup

c:\program files\ESET\ESET Online Scanner\Modules\data\updfiles\nod2DAC.nup

c:\program files\ESET\ESET Online Scanner\Modules\data\updfiles\nod34F4.nup

c:\program files\ESET\ESET Online Scanner\Modules\data\updfiles\nod3604.nup

c:\program files\ESET\ESET Online Scanner\Modules\data\updfiles\nod38FD.nup

c:\program files\ESET\ESET Online Scanner\Modules\data\updfiles\nod399D.nup

c:\program files\ESET\ESET Online Scanner\Modules\data\updfiles\nod4C73.nup

c:\program files\ESET\ESET Online Scanner\Modules\data\updfiles\nod5710.nup

c:\program files\ESET\ESET Online Scanner\Modules\data\updfiles\nod6409.nup

c:\program files\ESET\ESET Online Scanner\Modules\data\updfiles\nod6E82.nup

c:\program files\ESET\ESET Online Scanner\Modules\data\updfiles\nod74C5.nup

c:\program files\ESET\ESET Online Scanner\Modules\data\updfiles\temp\em000_32.dat

c:\program files\ESET\ESET Online Scanner\Modules\data\updfiles\temp\em001_32.dat

c:\program files\ESET\ESET Online Scanner\Modules\data\updfiles\temp\em002_32.dat

c:\program files\ESET\ESET Online Scanner\Modules\data\updfiles\temp\em003_32.dat

c:\program files\ESET\ESET Online Scanner\Modules\data\updfiles\temp\em004_32.dat

c:\program files\ESET\ESET Online Scanner\Modules\data\updfiles\temp\em005_32.dat

c:\program files\ESET\ESET Online Scanner\Modules\data\updfiles\temp\em006_32.dat

c:\program files\ESET\ESET Online Scanner\Modules\data\updfiles\upd.ver

c:\program files\ESET\ESET Online Scanner\Modules\em000_32.dat

c:\program files\ESET\ESET Online Scanner\Modules\em001_32.dat

c:\program files\ESET\ESET Online Scanner\Modules\em002_32.dat

c:\program files\ESET\ESET Online Scanner\Modules\em003_32.dat

c:\program files\ESET\ESET Online Scanner\Modules\em004_32.dat

c:\program files\ESET\ESET Online Scanner\Modules\em005_32.dat

c:\program files\ESET\ESET Online Scanner\Modules\em006_32.dat

c:\program files\ESET\ESET Online Scanner\Modules\mod_comp.dat

c:\program files\ESET\ESET Online Scanner\OnlineCmdLineScanner.exe

c:\program files\ESET\ESET Online Scanner\OnlineCmdLineScannerA.exe

c:\program files\ESET\ESET Online Scanner\OnlineScanner.cab

c:\program files\ESET\ESET Online Scanner\OnlineScanner.inf

c:\program files\ESET\ESET Online Scanner\OnlineScanner.ocx

c:\program files\ESET\ESET Online Scanner\OnlineScanner64.ocx

c:\program files\ESET\ESET Online Scanner\OnlineScannerApp.exe

c:\program files\ESET\ESET Online Scanner\OnlineScannerLang.dll

c:\program files\ESET\ESET Online Scanner\OnlineScannerUninstaller.exe

c:\program files\ESET\ESET Online Scanner\unicows.dll

.

((((((((((((((((((((((((( Files Created from 2009-07-07 to 2009-08-07 )))))))))))))))))))))))))))))))