Премини към съдържанието
Форумът в приложение

По-лесно сърфиране. Научи повече.
Kaldata.com - Форуми

Приложение на форума на цял екран с push известия, значки и други.

За да инсталирате това приложение на iOS и iPadOS
  1. Докоснете Иконата за споделяне в Safari
  2. Превъртете менюто и докоснете Добавяне към началния екран.
  3. Докоснете Добавяне в горния десен ъгъл.
За да инсталирате това приложение на Android
  1. Докоснете менюто с 3 точки (⋮) в горния десен ъгъл на браузъра.
  2. Докоснете Добавяне към началния екран или Инсталиране на приложение.
  3. Потвърдете, като докоснете Инсталиране.
Добави Kaldata.com в предпочитани източници в Google

Добре дошли!

Добре дошли в нашите форуми, пълни с полезна информация. Имате проблем с компютъра или телефона си? Публикувайте нова тема и ще намерите решение на всичките си проблеми. Общувайте свободно и открийте безброй нови приятели.

Моля, регистрирайте се за да публикувате тема и да получите пълен достъп до всички функции.

 

Система, заразена съсCTB-Cryptlocker

DarkEdge
в Премахване на зловреден софтуер

Featured Replies

  • Автор

Добавен горе. Сори, бях го забравил.

Дотук добре...нека да пуснем и тежката артилерия:

 

1. Изтеглете ComboFix от BleepingComputer
и го запазете (бутон Save -> Save as) ComboFix на вашия десктоп:
2exprgh.jpg
След приключване на изтеглянето на ComboFix, иконката на програмата би трябвало да изглежда така:
29eqjuq.jpg


2. Затворете всички работещи приложения, отворени прозорци и програми работещи във фонов режим. Спрете временно защитата в реално време на антивирусната програма и на другите програми за сигурност, ако има такива.



3. Стартирайте с двоен клик Combofix.exe. Изберете YES, за да се съгласите с условията за използване на програмата. Важно: По време на работата на ComboFix не бива да се движи мишката и да се натискат клавиши от клавиатурата. Просто търпеливо оставете ComboFix да си свърши работата, без да използвате компютъра за други цели.



4. ComboFix ще провери дали Windows Recovery Console e инсталиранa.


*Ако Windows Recovery Console не е инсталирана, ще е необходимо да използвате YES за инсталация на Windows Recovery Console
*Ако Windows Recovery Console е инсталирана, ComboFix ще продължи работата си.
33wr6us.jpg


Забележка: Необходимо е да сте свързани към Интернет за да може Windows Recovery Console да се изтегли.


След инсталация на Windows Recovery Console потвърдете с YES, за да продължите напред. Снимка:
m9lvnk.jpg


5. ComboFix ще спре временно Интернет връзката, но след като приключи работата на програмата тази връзка ще бъде възстановена автоматично. ComboFix ще сканира за проблеми и за заразени файлове, като това може да отнеме известно време. Моля да бъдете търпеливи. Ако има проблем с Интернет връзката след приключване на работата на Combofix, моля да прочетете това: Manually restoring the Internet connection section.


6. Когато работата на ComboFix приключи, ще се появи текстов документ (log) в Notepad:
157m978.jpg

Копирайте с (Copy) и поставете с (Paste) съдържанието на лога в следващия си коментар.

  • Автор

Логът:

ComboFix 15-06-09.01 - Administrator 06.2015 г.  19:24:36.1.1 - x86
Microsoft Windows XP Professional  5.1.2600.3.1251.359.1033.18.511.150 [GMT 3:00]
Running from: D:\Desktop\ComboFix.exe
 * Created a new restore point

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))

C:\Documents and Settings\Administrator\Application Data\dach100.dll
C:\Documents and Settings\Administrator\Application Data\Okon
C:\Documents and Settings\Administrator\Application Data\Okon\depy.ohx
C:\Documents and Settings\Administrator\Application Data\Okon\depy.tmp
C:\Documents and Settings\Administrator\Local Settings\Application Data\nvikhom_.dll
C:\WINDOWS\system32\Icons
C:\WINDOWS\system32\Icons\Hard Drive Downloads.ico
C:\WINDOWS\system32\Icons\Hard Drive Movies.ico
C:\WINDOWS\system32\Icons\Hard Drive Music.ico
C:\WINDOWS\system32\Icons\Hard Drive Windows.ico
C:\WINDOWS\system32\Icons\My Documents_.ico
C:\WINDOWS\system32\Icons\Recycle-Empty.ico
C:\WINDOWS\system32\Icons\Recycle-Full.ico
C:\WINDOWS\system32\Packet.dll
C:\WINDOWS\system32\uxtheme.dll.tmp
C:\WINDOWS\system32\wpcap.dll
C:\WINDOWS\XSxS

(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_GLOBALUPDATE
-------\Service_NPF

(((((((((((((((((((((((((   Files Created from 2015-05-09 to 2015-06-09  )))))))))))))))))))))))))))))))

2015-06-09 05:45:36 . 2007-01-24 09:26:14 319456 ----a-w- C:\WINDOWS\system32\DIFxAPI.dll
2015-06-09 05:45:20 . 2015-06-09 05:45:20 -------- d-----w- C:\Program Files\Vimicro Corporation
2015-06-09 05:45:09 . 2015-06-09 05:45:09 -------- d-----w- C:\Documents and Settings\Administrator\Application Data\InstallShield
2015-06-09 05:42:40 . 2015-06-09 05:42:40 -------- d-----w- C:\Program Files\Nokia
2015-06-09 05:30:39 . 2002-10-14 21:00:00 44875 ----a-w- C:\WINDOWS\system32\IPrtCnst.dll
2015-06-09 05:30:39 . 2002-10-14 21:00:00 13891 ----a-w- C:\WINDOWS\system32\drivers\IdeBusDr.sys
2015-06-09 05:30:39 . 2002-10-14 21:00:00 101431 ----a-w- C:\WINDOWS\system32\drivers\IdeChnDr.sys
2015-06-09 05:24:22 . 2015-06-09 05:24:22 -------- d-----w- C:\Program Files\Easeware
2015-06-09 05:24:22 . 2015-06-09 05:24:22 -------- d-----w- C:\Documents and Settings\Administrator\Application Data\Easeware
2015-06-09 01:20:45 . 2015-06-09 01:20:45 -------- d-----w- C:\RegBackup
2015-06-09 00:08:18 . 2015-06-09 00:08:18 -------- d-----w- C:\Documents and Settings\Administrator\Local Settings\Application Data\TeamViewer
2015-06-08 22:13:47 . 2015-06-08 22:13:47 -------- d-----w- C:\PatchMyPCUpdates
2015-06-08 15:45:45 . 2015-06-08 21:00:24 119512 ----a-w- C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys
2015-06-08 15:45:19 . 2015-06-08 15:45:26 -------- d-----w- C:\Program Files\Malwarebytes Anti-Malware
2015-06-08 15:45:19 . 2015-06-08 15:45:19 -------- d-----w- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2015-06-08 15:45:19 . 2015-04-14 06:37:48 120024 ----a-w- C:\WINDOWS\system32\drivers\mbamchameleon.sys
2015-06-08 15:45:19 . 2015-04-14 06:37:42 23256 ----a-w- C:\WINDOWS\system32\drivers\mbam.sys
2015-06-08 14:30:51 . 2015-06-08 14:30:51 -------- d-----w- C:\Program Files\ESET
2015-06-07 15:07:12 . 2015-06-09 14:14:13 -------- d-----w- C:\FRST
2015-05-30 20:51:37 . 2015-06-08 23:08:21 -------- d-----w- C:\Documents and Settings\Administrator\Local Settings\Application Data\Local Weather Beta
.

((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))

2015-06-09 13:56:30 . 2013-09-02 23:19:01 218624 ----a-w- C:\WINDOWS\system32\uxtheme.dll
2015-04-30 23:59:13 . 2014-08-31 10:06:26 424 ----a-w- C:\WINDOWS\system32\drivers\vwifikerneldrv.sys
2015-04-30 23:59:13 . 2014-08-31 10:06:26 424 ----a-w- C:\WINDOWS\system32\d3dx9_11.dll.tmp
2015-04-26 03:40:43 . 2013-09-02 23:18:19 778416 -c--a-w- C:\WINDOWS\system32\FlashPlayerApp.exe
2015-04-26 03:40:43 . 2013-09-02 23:18:19 142512 -c--a-w- C:\WINDOWS\system32\FlashPlayerCPLApp.cpl
2015-04-06 20:18:30 . 2015-05-01 00:06:27 57336 ----a-w- C:\WINDOWS\system32\drivers\adgnetworktdidrv.sys

------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.

[-] 2008-11-18 14:02:08 . 4C51D5275AE8A16999EDFE7E647D00DE . 576384 . . [5.1.2600.5712 (xpsp_sp3_qfe.081118-1720)] . . C:\WINDOWS\system32\drivers\ntfs.sys

[-] 2003-08-18 21:50:17 . E980B5F3397EFC252D62DF5352571C2C . 361600 . . [5.1.2600.6009 (xpsp_sp3_qfe.100708-1621)] . . C:\WINDOWS\system32\drivers\tcpip.sys

[-] 2012-10-10 17:43:35 . FC6D1D80588D371F0321E15A75B2F8F2 . 78336 . . [5.1.2600.6260 (xpsp_sp3_qfe.120706-1617)] . . C:\WINDOWS\system32\browser.dll

[-] 2012-10-10 17:44:47 . 9222562D44021B988B9F9F62207FB6F2 . 401408 . . [5.1.2600.5755 (xpsp_sp3_qfe.090206-1316)] . . C:\WINDOWS\system32\rpcss.dll

[-] 2012-10-10 17:44:49 . C519E15665CD89A91AD383FCE3CB556A . 110592 . . [5.1.2600.5922 (xpsp_sp3_qfe.091223-1723)] . . C:\WINDOWS\system32\services.exe

[-] 2012-10-10 17:45:01 . 258DD5D4283FD9F9A7166BE9AE45CE73 . 58880 . . [5.1.2600.6024 (xpsp_sp3_qfe.100817-1627)] . . C:\WINDOWS\system32\spoolsv.exe

[-] 2012-10-10 17:45:18 . 53A8857723277B1D6D5EE60A9F85B117 . 509440 . . [5.1.2600.5788 (xpsp_sp3_qfe.090402-1315)] . . C:\WINDOWS\system32\winlogon.exe

[-] 2012-10-10 17:43:38 . 93AFB83FBC1F9443CAC722FCA63D73BF . 617472 . . [5.82 (xpsp_sp3_qfe.100823-1643)] . . C:\WINDOWS\system32\comctl32.dll
[-] 2012-10-10 17:42:45 . 736B12B725AEB2B07F0241A9F680CB10 . 1054208 . . [6.0 (xpsp_sp3_qfe.100823-1643)] . . C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll
[7] 2008-04-14 11:00:00 . AEF3D788DBF40C7C4D204EA45EB0C505 . 921088 . . [6.0 (xpclient.010817-1148)] . . C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll

[-] 2012-10-10 17:43:41 . F17F6226BDC0CD5F0BEF0DAF84D29BEC . 253952 . . [2001.12.4414.706] . . C:\WINDOWS\system32\es.dll

[-] 2014-03-12 10:48:50 . 4A45B692D2BAA74124DF57472D5EA2F1 . 993280 . . [5.1.2600.6532 (xpsp_sp3_qfe.140312-0419)] . . C:\WINDOWS\system32\kernel32.dll
[-] 2014-03-12 10:48:50 . 4A45B692D2BAA74124DF57472D5EA2F1 . 993280 . . [5.1.2600.6532 (xpsp_sp3_qfe.140312-0419)] . . C:\WINDOWS\system32\dllcache\kernel32.dll
[-] 2012-10-10 17:43:52 . DA11D9D6ECBDF0F93436A4B7C13F7BEC . 991744 . . [5.1.2600.5781 (xpsp_sp3_qfe.090321-1341)] . . C:\WINDOWS\$NtUninstallKB2758857$\kernel32.dll
[-] 2012-10-03 04:57:29 . 6CBFEEB384F04681AF75F495AA48DD32 . 991744 . . [5.1.2600.6293 (xpsp_sp3_qfe.121001-1624)] . . C:\WINDOWS\$NtUninstallKB2922229$\kernel32.dll

[-] 2014-04-30 08:13:01 . 3DB2624CCB1663BF6D62311B2B9E7B55 . 6022144 . . [8.00.6001.23588 (longhorn_ie8_ldr_escrow.140429-1230)] . . C:\WINDOWS\system32\mshtml.dll
[-] 2014-04-30 08:13:01 . 3DB2624CCB1663BF6D62311B2B9E7B55 . 6022144 . . [8.00.6001.23588 (longhorn_ie8_ldr_escrow.140429-1230)] . . C:\WINDOWS\system32\dllcache\mshtml.dll
[-] 2014-03-06 17:59:22 . 0964EFC80BD54FDF37397A09FDAE8395 . 6021632 . . [8.00.6001.23580 (longhorn_ie8_ldr.140222-1715)] . . C:\WINDOWS\ie8updates\KB2964358-IE8\mshtml.dll
[-] 2014-02-24 11:46:11 . 427C63C2075ABF62FAA897BBD3DE44F4 . 6022144 . . [8.00.6001.23569 (longhorn_ie8_ldr_escrow.140223-0755)] . . C:\WINDOWS\ie8updates\KB2936068-IE8\mshtml.dll
[-] 2014-02-05 23:26:48 . 516E371CC348141277A73EB9D3C25951 . 6021120 . . [8.00.6001.23562 (longhorn_ie8_ldr_escrow.140131-1840)] . . C:\WINDOWS\ie8updates\KB2925418-IE8\mshtml.dll
[-] 2014-02-05 23:26:48 . 516E371CC348141277A73EB9D3C25951 . 6021120 . . [8.00.6001.23562 (longhorn_ie8_ldr_escrow.140131-1840)] . . C:\WINDOWS\SoftwareDistribution\Download\907b0b79dc3a251ab2313dc5216daff8\SP3QFE\mshtml.dll
[-] 2013-10-29 07:57:33 . 680BD97BA5C817BCE79162496D51528D . 6020608 . . [8.00.6001.23543 (longhorn_ie8_ldr.131024-1335)] . . C:\WINDOWS\ie8updates\KB2909921-IE8\mshtml.dll
[-] 2013-10-13 07:25:25 . 0794CD09BE3D1E7A966C95E76FC86F47 . 6021120 . . [8.00.6001.23536 (longhorn_ie8_ldr.131011-1815)] . . C:\WINDOWS\ie8updates\KB2898785-IE8\mshtml.dll
[-] 2013-09-23 18:33:58 . 579017CF9C919429188190DAE79BB8FC . 6017536 . . [8.00.6001.23532 (longhorn_ie8_ldr.130922-1445)] . . C:\WINDOWS\ie8updates\KB2888505-IE8\mshtml.dll
[-] 2013-08-08 06:06:00 . 4C9AFE1AE4112D260A3E7846C60C774D . 6017536 . . [8.00.6001.23520 (longhorn_ie8_ldr.130731-1545)] . . C:\WINDOWS\ie8updates\KB2879017-IE8\mshtml.dll
[-] 2013-07-26 02:47:16 . 17965D48033D1A6E6320AA867351CC21 . 6017536 . . [8.00.6001.23515 (longhorn_ie8_ldr_escrow.130723-1455)] . . C:\WINDOWS\ie8updates\KB2870699-IE8\mshtml.dll
[-] 2012-10-10 17:46:34 . CF6B381C3518AB328382429CAE206D64 . 6010368 . . [8.00.6001.23415 (longhorn_ie8_ldr.120824-1815)] . . C:\WINDOWS\ie8updates\KB2862772-IE8\mshtml.dll

[-] 2012-10-10 17:44:30 . 06B8485FB1DA9A552B10AB978CD1AC85 . 343040 . . [7.0.2600.5701 (xpsp_sp3_qfe.081025-1544)] . . C:\WINDOWS\system32\msvcrt.dll
[-] 2012-10-10 17:42:46 . A4C4A54FD7E31179CB5BDF7896DF3DF7 . 343040 . . [7.0.2600.5701 (xpsp_sp3_qfe.081025-1544)] . . C:\WINDOWS\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.5701_x-ww_40d12c25\msvcrt.dll
[7] 2008-04-14 11:00:00 . 4200BE3808F6406DBE45A7B88DAE5035 . 322560 . . [7.0.2600.0 (xpclient.010817-1148)] . . C:\WINDOWS\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.0.0_x-ww_2726e76a\msvcrt.dll

[-] 2012-10-10 17:44:32 . FCEE5FCB99F7C724593365C706D28388 . 245248 . . [5.1.2600.5625 (xpsp_sp3_qfe.080620-1309)] . . C:\WINDOWS\system32\mswsock.dll

[-] 2012-10-10 17:44:35 . 06CF9EEDB7E827205C6948C9DAF56974 . 407040 . . [5.1.2600.5582 (xpsp_sp3_qfe.080416-1432)] . . C:\WINDOWS\system32\netlogon.dll

[-] 2012-10-10 17:45:07 . E2B32B10ACC5D97623275AAFB67E5F03 . 249856 . . [5.1.2600.5654 (xpsp_sp3_qfe.080806-1410)] . . C:\WINDOWS\system32\tapisrv.dll

[-] 2014-03-06 17:59:23 . 8AF91E4B4C1F5338EBE1548117304296 . 920064 . . [8.00.6001.23580 (longhorn_ie8_ldr.140222-1715)] . . C:\WINDOWS\system32\wininet.dll
[-] 2014-03-06 17:59:23 . 8AF91E4B4C1F5338EBE1548117304296 . 920064 . . [8.00.6001.23580 (longhorn_ie8_ldr.140222-1715)] . . C:\WINDOWS\system32\dllcache\wininet.dll
[-] 2014-02-24 11:46:36 . C29C1990C6CA8D7B098318F5887C3BDC . 920064 . . [8.00.6001.23569 (longhorn_ie8_ldr_escrow.140223-0755)] . . C:\WINDOWS\ie8updates\KB2936068-IE8\wininet.dll
[-] 2014-02-05 23:26:52 . E09551776D365BCA891BBFFB31EE4B4C . 920064 . . [8.00.6001.23562 (longhorn_ie8_ldr_escrow.140131-1840)] . . C:\WINDOWS\ie8updates\KB2925418-IE8\wininet.dll
[-] 2014-02-05 23:26:52 . E09551776D365BCA891BBFFB31EE4B4C . 920064 . . [8.00.6001.23562 (longhorn_ie8_ldr_escrow.140131-1840)] . . C:\WINDOWS\SoftwareDistribution\Download\907b0b79dc3a251ab2313dc5216daff8\SP3QFE\wininet.dll
[-] 2013-10-29 07:57:34 . FBF173582874C30EC5FAF8F8A67D873E . 920064 . . [8.00.6001.23543 (longhorn_ie8_ldr.131024-1335)] . . C:\WINDOWS\ie8updates\KB2909921-IE8\wininet.dll
[-] 2013-10-13 07:25:38 . C5ACAB147F9697F40ECEBB4BC0247EBF . 920064 . . [8.00.6001.23536 (longhorn_ie8_ldr.131011-1815)] . . C:\WINDOWS\ie8updates\KB2898785-IE8\wininet.dll
[-] 2013-09-23 18:33:58 . D73F1BE00684E675571015B3A5880F5B . 920064 . . [8.00.6001.23532 (longhorn_ie8_ldr.130922-1445)] . . C:\WINDOWS\ie8updates\KB2888505-IE8\wininet.dll
[-] 2013-08-08 06:06:00 . F1BD516A4446B737BAEFB9FBAA92F01A . 920064 . . [8.00.6001.23520 (longhorn_ie8_ldr.130731-1545)] . . C:\WINDOWS\ie8updates\KB2879017-IE8\wininet.dll
[-] 2013-07-26 02:47:18 . D46E195D0C76D430D73576CDAC763F78 . 920064 . . [8.00.6001.23515 (longhorn_ie8_ldr_escrow.130723-1455)] . . C:\WINDOWS\ie8updates\KB2870699-IE8\wininet.dll
[-] 2012-10-10 17:46:40 . DCEA3B3193B7181CF818ECC4EAB30A66 . 920064 . . [8.00.6001.23415 (longhorn_ie8_ldr.120824-1815)] . . C:\WINDOWS\ie8updates\KB2862772-IE8\wininet.dll

[-] 2012-10-10 17:43:42 . 2BB75B7F548D82A099125D0C5971DE7D . 1033728 . . [6.00.2900.5634 (xpsp_sp3_qfe.080703-1303)] . . C:\WINDOWS\explorer.exe

[-] 2013-08-05 13:30:32 . 59B408E5B8489B0B36A0D783D150EDCC . 1289728 . . [5.1.2600.6435 (xpsp_sp3_qfe.130803-0418)] . . C:\WINDOWS\system32\ole32.dll
[-] 2012-10-10 17:44:42 . 7D9DDE1AB4B00DDB173F5A16E9206517 . 1289216 . . [5.1.2600.6168 (xpsp_sp3_qfe.111101-1828)] . . C:\WINDOWS\$NtUninstallKB2876217$\ole32.dll

[-] 2013-07-10 10:37:53 . 1D845821F5ADB076831DE4C2818F858B . 406016 . . [1.0420.2600.6421 (xpsp_sp3_qfe.130709-0421)] . . C:\WINDOWS\system32\usp10.dll
[-] 2012-10-10 17:45:12 . F8894BCC961D461674002B4BAE7AECC1 . 406016 . . [1.0420.2600.5969 (xpsp_sp3_qfe.100416-1736)] . . C:\WINDOWS\$NtUninstallKB2850869$\usp10.dll

[-] 2012-10-10 17:45:01 . 888CD7B39C37E13A2419BECFAAF0A28C . 135168 . . [6.00.2900.5853 (xpsp_sp3_qfe.090727-1747)] . . C:\WINDOWS\system32\shsvcs.dll

[-] 2010-12-09 14:15:41 . 15CE4DBC22FAB90B3CA5352AF1FFF81C . 718336 . . [5.1.2600.6055 (xpsp_sp3_qfe.101209-1646)] . . C:\WINDOWS\system32\ntdll.dll

[-] 2012-10-10 17:44:06 . 30B7D847BA9075AA8E1122FB6AF3D1B5 . 177152 . . [5.1.2600.5768 (xpsp_sp3_qfe.090226-1518)] . . C:\WINDOWS\system32\msctfime.ime

[-] 2012-10-10 17:51:16 . E17798E1E6FF1CA9C67B8576570E05EE . 1614848 . . [5.1.2600.5512 (xpsp.080413-2111)] . . C:\WINDOWS\system32\sfcfiles.dll

[-] 2012-10-10 17:45:08 . 5128852A18AE46C387F87BF27DA4C9DD . 296960 . . [5.1.2600.5815 (xpsp_sp3_qfe.090518-1520)] . . C:\WINDOWS\system32\termsrv.dll

[-] 2012-10-10 17:43:46 . 0A878AA66E4DD3E2608192A1ECCD9F8F . 344064 . . [5.1.2600.5589 (xpsp_sp3_qfe.080428-1317)] . . C:\WINDOWS\system32\hnetcfg.dll

[-] 2012-10-10 17:43:57 . 842900DEDBC8E3E8DBCCCB298FD88F65 . 953856 . . [4.1.6151] . . C:\WINDOWS\system32\mfc40u.dll

[-] 2013-07-04 02:08:30 . 4C47B37CF351FFEB1227CED0FF4751D5 . 2070144 . . [5.1.2600.6419 (xpsp_sp3_qfe.130704-0421)] . . C:\WINDOWS\Driver Cache\i386\ntkrnlpa.exe
[-] 2013-07-04 02:08:30 . 4C47B37CF351FFEB1227CED0FF4751D5 . 2070144 . . [5.1.2600.6419 (xpsp_sp3_qfe.130704-0421)] . . C:\WINDOWS\system32\ntkrnlpa.exe
[-] 2012-10-10 17:51:12 . B326D5E256D2F32B23E64F49DEBCE31B . 2069632 . . [5.1.2600.6284 (xpsp_sp3_qfe.120821-1630)] . . C:\WINDOWS\$NtUninstallKB2859537$\ntkrnlpa.exe

[-] 2012-10-10 17:43:40 . D2CF91B2C710E9F666E60AFBF87643EE . 1689088 . . [5.03.2600.5601 (xpsp_sp3_qfe.080513-1258)] . . C:\WINDOWS\system32\d3d9.dll

[-] 2013-07-04 02:59:12 . A4A50A53FFBFEC545CDA85E98AF2106B . 2193536 . . [5.1.2600.6419 (xpsp_sp3_qfe.130704-0421)] . . C:\WINDOWS\Driver Cache\i386\ntoskrnl.exe
[-] 2013-07-04 02:59:11 . A4A50A53FFBFEC545CDA85E98AF2106B . 2193536 . . [5.1.2600.6419 (xpsp_sp3_qfe.130704-0421)] . . C:\WINDOWS\system32\ntoskrnl.exe
[-] 2012-10-10 17:44:40 . ECA5980E1A78DBF9CB7F49F76791C0D1 . 2193024 . . [5.1.2600.6284 (xpsp_sp3_qfe.120821-1630)] . . C:\WINDOWS\$NtUninstallKB2859537$\ntoskrnl.exe

[-] 2012-10-10 17:45:14 . 9F8A0D0CBB2FA265A754516128C00E22 . 175616 . . [5.1.2600.5635 (xpsp_sp3_qfe.080704-1744)] . . C:\WINDOWS\system32\w32time.dll

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\MountOverlayIcon]
@="{0F49CF41-FD97-4942-9F2A-35E8B489E7FB}"
[HKEY_CLASSES_ROOT\CLSID\{0F49CF41-FD97-4942-9F2A-35E8B489E7FB}]
2010-10-20 10:22:48 257024 ----a-w- C:\Program Files\WinMount\WinMTExt.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LClock"="C:\Program Files\LClock\LClock.exe" [2004-09-19 18:27:44 65536]
"SRS Audio Sandbox"="C:\Program Files\SRS Labs\Audio Sandbox\SRSSSC.exe" [2010-01-07 07:43:28 3216664]
"Skype"="C:\Program Files\Skype\Phone\Skype_new.exe" [2014-07-24 15:26:54 21645408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2014-08-31 03:10:00 13529088]
"VMonitorVMUVC"="C:\Program Files\Vimicro Corporation\VMUVC\VMonitor.exe" [2008-08-29 14:27:30 143360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 11:00:00 15360]

C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\
AntiCrash.lnk - C:\Program Files\Dachshund Software\AntiCrash\AntiCrash.exe [2002-12-17 2301798]
Hare.lnk - C:\Program Files\Dachshund Software\Hare\Hare.exe [2002-9-21 1874381]
Zoom.lnk - C:\Program Files\Dachshund Software\Zoom\Zoom.exe [2002-9-21 1446302]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoRecentDocsNetHood"= 01000000

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-602162358-2000478354-842925246-500\Scripts\Logon\0\0]
"Script"=clean_tmp.bat

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, credssp.dll, digest.dll, msnsspc.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=

R0 mv61xxmm;mv61xxmm;C:\WINDOWS\system32\drivers\mv61xxmm.sys [03.9.2013 г. 02:18:45 14184]
R0 mv64xxmm;mv64xxmm;C:\WINDOWS\system32\drivers\mv64xxmm.sys [03.9.2013 г. 02:18:45 5632]
R0 mvxxmm;mvxxmm;C:\WINDOWS\system32\drivers\mvxxmm.sys [03.9.2013 г. 02:18:45 14184]
R1 adgnetworktdidrv;adgnetworktdidrv;C:\WINDOWS\system32\drivers\adgnetworktdidrv.sys [01.5.2015 г. 03:06:27 57336]
R1 prio;Prio;C:\WINDOWS\system32\drivers\prio.sys [08.11.2012 г. 22:29:32 54128]
R1 WMDrive;WMDrive;C:\WINDOWS\system32\drivers\WMDrive.sys [03.9.2013 г. 03:11:54 65856]
R2 ImDisk;ImDisk Virtual Disk Driver;C:\WINDOWS\system32\drivers\imdisk.sys [31.8.2014 г. 07:04:18 34448]
R2 prio_svc;Prio Service;C:\Program Files\Prio\prio_svc.exe [08.11.2012 г. 22:29:12 12656]
R3 MBAMProtector;MBAMProtector;C:\WINDOWS\system32\drivers\mbam.sys [08.6.2015 г. 18:45:19 23256]
S2 MBAMService;MBAMService;C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [08.6.2015 г. 18:45:21 1080120]
S3 AWEAlloc;AWE Memory Allocation Driver;C:\WINDOWS\system32\drivers\awealloc.sys [31.8.2014 г. 07:04:18 17920]
S3 cpudrv;cpudrv;C:\Program Files\SystemRequirementsLab\cpudrv.sys [02.6.2011 г. 11:08:34 11336]
S3 ImDskSvc;ImDisk Virtual Disk Driver Helper;C:\WINDOWS\system32\imdsksvc.exe [31.8.2014 г. 07:04:18 10240]
S3 Revoflt;Revoflt;C:\WINDOWS\system32\drivers\revoflt.sys [03.9.2013 г. 12:03:39 27064]
S4 cpuz136;cpuz136;\??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\cpuz136\cpuz136_x32.sys --> C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\cpuz136\cpuz136_x32.sys [?]
S4 SkypeUpdate;Skype Updater;C:\Program Files\Skype\Updater\Updater.exe [23.10.2013 г. 08:15:08 172192]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - WS2IFSL

Contents of the 'Scheduled Tasks' folder

2015-06-09 C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-09-02 23:18:28 . 2015-04-26 03:40:49]

2015-06-09 C:\WINDOWS\Tasks\Defrag Job 00.job
- C:\Program Files\Disktrix\UltimateDefrag\Udefrag.exe [2011-05-10 22:12:08 . 2011-05-10 22:12:08]

2015-04-01 C:\WINDOWS\Tasks\Defrag Job 01.job
- C:\Program Files\Disktrix\UltimateDefrag\Udefrag.exe [2011-05-10 22:12:08 . 2011-05-10 22:12:08]

2015-06-09 C:\WINDOWS\Tasks\Opera scheduled Autoupdate 1407995545.job
- C:\Program Files\Opera\launcher.exe [2014-08-14 05:52:37 . 2015-04-17 08:13:12]

------- Supplementary Scan -------

uStart Page = https://www.google.bg/
uInternet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch
uSearchAssistant = hxxp://www.google.com
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
TCP: DhcpNameServer = 192.168.137.1 193.68.3.252

- - - - ORPHANS REMOVED - - - -

Toolbar-10 - (no file)
Toolbar-Locked - (no file)
AddRemove-Youtube Downloader HD_is1 - D:\filmi\Youtube Downloader HD\unins000.exe

 

ComboFix.txt

Редактирано от belivakov (преглед на промените)

И този лог файл не е пълен. Combofix затри последните остатъци от гадините, но с тях и един безвреден файл. За да го възстановим направи следното:

 

Отвори Notepad.exe и се увери, че пред Format => няма отметка пред Word Wrap (ако има я махни).

 

menu-format-font-notepad-win7.gif

 

След това с copy/paste постави следната информация:

 

DeQuarantine::
c:\qoobox\quarantine\c\Documents and Settings\Administrator\Application Data\dach100.dll.vir
Quit::

 

Запази файла с име CFScript и го провлачи и пусни в Combofix (както на картинката отдолу):

CFScript.gif
 

След рестарта (ако има такъв) публикувай лог файл в следващия си пост след изпълнението на скрипта.

 

Ако имаш и инсталационен диск с Windows XP SP3 е добре да пуснеш един sfc /scannow, че има доста моднати системни файлове и после ще продължим с финалните гимнастики.

 

Чувства ли се разликата?

 

Поздрави!

  • Автор

Да, има разлика отдавна. Да, направих чек преди час. Пачнати (от мен) са uxtheme, tcpip.sys. След като завърши combofix отвори празен DeQuarantine.

Само 2 са от теб, но поне 50 едва ли са пачнати от теб. :)

Не би трябвало да отвори празен лог... Както и да е...направи нова проверка с Combofix за да видим дали вече са цифрово подписани файловете.

След това провери за файла dach100.dll в C:\Qoobox\Quarantine\c\Documents and Settings\Administrator\Application Data\dach100.dll.vir и копирай файла на правилното му място - C:\Documents and Settings\Administrator\Application Data\dach100.dll като преди това го преименуваш (като премахнеш разширението *.vir).

Като цяло този файл е от AntiCrash. която съм тествал през 2006-та и намирам за буламач и можеш да я деинсталираш, но ти си преценяваш де. :)

Лога изглежда чист (имаме два остатъка за премахване в регистрите), но нещо не ти се е получила проверката с sfc. Ти сложи инсталационния диск и след това я изпълни и по време на диалоговия прозорец натискаше retry всеки път като се появяваше нали така?

 

А иначе за да разкараме и последните остатъци направи това:

 

Отвори Notepad.exe и се увери, че пред Format => няма отметка пред Word Wrap (ако има я махни).

 

menu-format-font-notepad-win7.gif

 

След това с copy/paste постави следната информация:

 

RegLock::
[HKEY_USERS\S-1-5-21-602162358-2000478354-842925246-500\Software\Microsoft\Internet Explorer\Approved Extensions]
Registry::
[HKEY_USERS\S-1-5-21-602162358-2000478354-842925246-500\Software\Microsoft\Internet Explorer\Approved Extensions]
"{4D9101D6-5BA0-4048-BDDE-7E2DF54C8C47}"=-
"{54739D49-AC03-4C57-9264-C5195596B3A1}"=-

 

Запази файла с име CFScript и го провлачи и пусни в Combofix (както на картинката отдолу):

CFScript.gif
 

След рестарта (ако има такъв) публикувай лог файл в следващия си пост след изпълнението на скрипта.

  • Автор

3 подканяния за Retry. В регистратурата буквата на диска със сетъп и СП е указана вярно.
ComboFix 15-06-09.01 - Administrator 06.2015 г. 2:01.3.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1251.359.1033.18.511.189 [GMT 3:00]
Running from: d:\desktop\ComboFix.exe
Command switches used :: d:\desktop\CFScript.txt
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Administrator\Application Data\dach100.dll
c:\windows\system32\uxtheme.dll.tmp
.
.
((((((((((((((((((((((((( Files Created from 2015-05-09 to 2015-06-09 )))))))))))))))))))))))))))))))
.
.
2015-06-09 05:45 . 2007-01-24 09:26 319456 ----a-w- c:\windows\system32\DIFxAPI.dll
2015-06-09 05:45 . 2015-06-09 05:45 -------- d-----w- c:\program files\Vimicro Corporation
2015-06-09 05:45 . 2015-06-09 05:45 -------- d-----w- c:\documents and settings\Administrator\Application Data\InstallShield
2015-06-09 05:42 . 2015-06-09 05:42 -------- d-----w- c:\program files\Nokia
2015-06-09 05:30 . 2002-10-14 21:00 44875 ----a-w- c:\windows\system32\IPrtCnst.dll
2015-06-09 05:30 . 2002-10-14 21:00 13891 ----a-w- c:\windows\system32\drivers\IdeBusDr.sys
2015-06-09 05:30 . 2002-10-14 21:00 101431 ----a-w- c:\windows\system32\drivers\IdeChnDr.sys
2015-06-09 05:24 . 2015-06-09 05:24 -------- d-----w- c:\program files\Easeware
2015-06-09 05:24 . 2015-06-09 05:24 -------- d-----w- c:\documents and settings\Administrator\Application Data\Easeware
2015-06-09 01:20 . 2015-06-09 01:20 -------- d-----w- C:\RegBackup
2015-06-09 00:08 . 2015-06-09 00:08 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\TeamViewer
2015-06-08 22:13 . 2015-06-08 22:13 -------- d-----w- C:\PatchMyPCUpdates
2015-06-08 15:45 . 2015-06-08 21:00 119512 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2015-06-08 15:45 . 2015-06-08 15:45 -------- d-----w- c:\program files\Malwarebytes Anti-Malware
2015-06-08 15:45 . 2015-06-08 15:45 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2015-06-08 15:45 . 2015-04-14 06:37 120024 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2015-06-08 15:45 . 2015-04-14 06:37 23256 ----a-w- c:\windows\system32\drivers\mbam.sys
2015-06-08 14:30 . 2015-06-08 14:30 -------- d-----w- c:\program files\ESET
2015-06-07 15:07 . 2015-06-09 14:14 -------- d-----w- C:\FRST
2015-05-30 20:51 . 2015-06-08 23:08 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Local Weather Beta
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-04-30 23:59 . 2014-08-31 10:06 424 -c--a-w- c:\windows\system32\drivers\vwifikerneldrv.sys
2015-04-30 23:59 . 2014-08-31 10:06 424 -c--a-w- c:\windows\system32\d3dx9_11.dll.tmp
2015-04-26 03:40 . 2013-09-02 23:18 778416 -c--a-w- c:\windows\system32\FlashPlayerApp.exe
2015-04-26 03:40 . 2013-09-02 23:18 142512 -c--a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2015-04-06 20:18 . 2015-05-01 00:06 57336 ----a-w- c:\windows\system32\drivers\adgnetworktdidrv.sys
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2008-11-18 . 4C51D5275AE8A16999EDFE7E647D00DE . 576384 . . [5.1.2600.5712] . . c:\windows\system32\drivers\ntfs.sys
.
[-] 2003-08-18 . E980B5F3397EFC252D62DF5352571C2C . 361600 . . [5.1.2600.6009] . . c:\windows\system32\drivers\tcpip.sys
.
[-] 2012-10-10 . FC6D1D80588D371F0321E15A75B2F8F2 . 78336 . . [5.1.2600.6260] . . c:\windows\system32\browser.dll
.
[-] 2012-10-10 . 9222562D44021B988B9F9F62207FB6F2 . 401408 . . [5.1.2600.5755] . . c:\windows\system32\rpcss.dll
.
[-] 2012-10-10 . C519E15665CD89A91AD383FCE3CB556A . 110592 . . [5.1.2600.5922] . . c:\windows\system32\services.exe
.
[-] 2012-10-10 . 258DD5D4283FD9F9A7166BE9AE45CE73 . 58880 . . [5.1.2600.6024] . . c:\windows\system32\spoolsv.exe
.
[-] 2012-10-10 . 53A8857723277B1D6D5EE60A9F85B117 . 509440 . . [5.1.2600.5788] . . c:\windows\system32\winlogon.exe
.
[-] 2012-10-10 . 93AFB83FBC1F9443CAC722FCA63D73BF . 617472 . . [5.82] . . c:\windows\system32\comctl32.dll
[-] 2012-10-10 . 736B12B725AEB2B07F0241A9F680CB10 . 1054208 . . [6.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll
[7] 2008-04-14 . AEF3D788DBF40C7C4D204EA45EB0C505 . 921088 . . [6.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll
.
[-] 2012-10-10 17:43 . F17F6226BDC0CD5F0BEF0DAF84D29BEC . 253952 . . [2001.12.4414.706] . . c:\windows\system32\es.dll
.
[-] 2014-03-12 . 4A45B692D2BAA74124DF57472D5EA2F1 . 993280 . . [5.1.2600.6532] . . c:\windows\system32\kernel32.dll
[-] 2012-10-10 . DA11D9D6ECBDF0F93436A4B7C13F7BEC . 991744 . . [5.1.2600.5781] . . c:\windows\$NtUninstallKB2758857$\kernel32.dll
[-] 2012-10-03 . 6CBFEEB384F04681AF75F495AA48DD32 . 991744 . . [5.1.2600.6293] . . c:\windows\$NtUninstallKB2922229$\kernel32.dll
.
[-] 2014-04-30 . 3DB2624CCB1663BF6D62311B2B9E7B55 . 6022144 . . [8.00.6001.23588] . . c:\windows\system32\mshtml.dll
[-] 2014-03-06 . 0964EFC80BD54FDF37397A09FDAE8395 . 6021632 . . [8.00.6001.23580] . . c:\windows\ie8updates\KB2964358-IE8\mshtml.dll
[-] 2014-02-24 . 427C63C2075ABF62FAA897BBD3DE44F4 . 6022144 . . [8.00.6001.23569] . . c:\windows\ie8updates\KB2936068-IE8\mshtml.dll
[-] 2014-02-05 . 516E371CC348141277A73EB9D3C25951 . 6021120 . . [8.00.6001.23562] . . c:\windows\ie8updates\KB2925418-IE8\mshtml.dll
[-] 2014-02-05 . 516E371CC348141277A73EB9D3C25951 . 6021120 . . [8.00.6001.23562] . . c:\windows\SoftwareDistribution\Download\907b0b79dc3a251ab2313dc5216daff8\SP3QFE\mshtml.dll
[-] 2013-10-29 . 680BD97BA5C817BCE79162496D51528D . 6020608 . . [8.00.6001.23543] . . c:\windows\ie8updates\KB2909921-IE8\mshtml.dll
[-] 2013-10-13 . 0794CD09BE3D1E7A966C95E76FC86F47 . 6021120 . . [8.00.6001.23536] . . c:\windows\ie8updates\KB2898785-IE8\mshtml.dll
[-] 2013-09-23 . 579017CF9C919429188190DAE79BB8FC . 6017536 . . [8.00.6001.23532] . . c:\windows\ie8updates\KB2888505-IE8\mshtml.dll
[-] 2013-08-08 . 4C9AFE1AE4112D260A3E7846C60C774D . 6017536 . . [8.00.6001.23520] . . c:\windows\ie8updates\KB2879017-IE8\mshtml.dll
[-] 2013-07-26 . 17965D48033D1A6E6320AA867351CC21 . 6017536 . . [8.00.6001.23515] . . c:\windows\ie8updates\KB2870699-IE8\mshtml.dll
[-] 2012-10-10 . CF6B381C3518AB328382429CAE206D64 . 6010368 . . [8.00.6001.23415] . . c:\windows\ie8updates\KB2862772-IE8\mshtml.dll
.
[-] 2012-10-10 . 06B8485FB1DA9A552B10AB978CD1AC85 . 343040 . . [7.0.2600.5701] . . c:\windows\system32\msvcrt.dll
[-] 2012-10-10 . A4C4A54FD7E31179CB5BDF7896DF3DF7 . 343040 . . [7.0.2600.5701] . . c:\windows\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.5701_x-ww_40d12c25\msvcrt.dll
[7] 2008-04-14 . 4200BE3808F6406DBE45A7B88DAE5035 . 322560 . . [7.0.2600.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.0.0_x-ww_2726e76a\msvcrt.dll
.
[-] 2012-10-10 . FCEE5FCB99F7C724593365C706D28388 . 245248 . . [5.1.2600.5625] . . c:\windows\system32\mswsock.dll
.
[-] 2012-10-10 . 06CF9EEDB7E827205C6948C9DAF56974 . 407040 . . [5.1.2600.5582] . . c:\windows\system32\netlogon.dll
.
[-] 2012-10-10 . E2B32B10ACC5D97623275AAFB67E5F03 . 249856 . . [5.1.2600.5654] . . c:\windows\system32\tapisrv.dll
.
[-] 2014-03-06 . 8AF91E4B4C1F5338EBE1548117304296 . 920064 . . [8.00.6001.23580] . . c:\windows\system32\wininet.dll
[-] 2014-02-24 . C29C1990C6CA8D7B098318F5887C3BDC . 920064 . . [8.00.6001.23569] . . c:\windows\ie8updates\KB2936068-IE8\wininet.dll
[-] 2014-02-05 . E09551776D365BCA891BBFFB31EE4B4C . 920064 . . [8.00.6001.23562] . . c:\windows\ie8updates\KB2925418-IE8\wininet.dll
[-] 2014-02-05 . E09551776D365BCA891BBFFB31EE4B4C . 920064 . . [8.00.6001.23562] . . c:\windows\SoftwareDistribution\Download\907b0b79dc3a251ab2313dc5216daff8\SP3QFE\wininet.dll
[-] 2013-10-29 . FBF173582874C30EC5FAF8F8A67D873E . 920064 . . [8.00.6001.23543] . . c:\windows\ie8updates\KB2909921-IE8\wininet.dll
[-] 2013-10-13 . C5ACAB147F9697F40ECEBB4BC0247EBF . 920064 . . [8.00.6001.23536] . . c:\windows\ie8updates\KB2898785-IE8\wininet.dll
[-] 2013-09-23 . D73F1BE00684E675571015B3A5880F5B . 920064 . . [8.00.6001.23532] . . c:\windows\ie8updates\KB2888505-IE8\wininet.dll
[-] 2013-08-08 . F1BD516A4446B737BAEFB9FBAA92F01A . 920064 . . [8.00.6001.23520] . . c:\windows\ie8updates\KB2879017-IE8\wininet.dll
[-] 2013-07-26 . D46E195D0C76D430D73576CDAC763F78 . 920064 . . [8.00.6001.23515] . . c:\windows\ie8updates\KB2870699-IE8\wininet.dll
[-] 2012-10-10 . DCEA3B3193B7181CF818ECC4EAB30A66 . 920064 . . [8.00.6001.23415] . . c:\windows\ie8updates\KB2862772-IE8\wininet.dll
.
[-] 2012-10-10 . 2BB75B7F548D82A099125D0C5971DE7D . 1033728 . . [6.00.2900.5634] . . c:\windows\explorer.exe
.
[-] 2013-08-05 . 59B408E5B8489B0B36A0D783D150EDCC . 1289728 . . [5.1.2600.6435] . . c:\windows\system32\ole32.dll
[-] 2012-10-10 . 7D9DDE1AB4B00DDB173F5A16E9206517 . 1289216 . . [5.1.2600.6168] . . c:\windows\$NtUninstallKB2876217$\ole32.dll
.
[-] 2013-07-10 . 1D845821F5ADB076831DE4C2818F858B . 406016 . . [1.0420.2600.6421] . . c:\windows\system32\usp10.dll
[-] 2012-10-10 . F8894BCC961D461674002B4BAE7AECC1 . 406016 . . [1.0420.2600.5969] . . c:\windows\$NtUninstallKB2850869$\usp10.dll
.
[-] 2012-10-10 . 888CD7B39C37E13A2419BECFAAF0A28C . 135168 . . [6.00.2900.5853] . . c:\windows\system32\shsvcs.dll
.
[-] 2010-12-09 . 15CE4DBC22FAB90B3CA5352AF1FFF81C . 718336 . . [5.1.2600.6055] . . c:\windows\system32\ntdll.dll
.
[-] 2012-10-10 . 30B7D847BA9075AA8E1122FB6AF3D1B5 . 177152 . . [5.1.2600.5768] . . c:\windows\system32\msctfime.ime
.
[-] 2012-10-10 . E17798E1E6FF1CA9C67B8576570E05EE . 1614848 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
[-] 2012-10-10 . 5128852A18AE46C387F87BF27DA4C9DD . 296960 . . [5.1.2600.5815] . . c:\windows\system32\termsrv.dll
.
[-] 2012-10-10 . 0A878AA66E4DD3E2608192A1ECCD9F8F . 344064 . . [5.1.2600.5589] . . c:\windows\system32\hnetcfg.dll
.
[-] 2012-10-10 17:43 . 842900DEDBC8E3E8DBCCCB298FD88F65 . 953856 . . [4.1.6151] . . c:\windows\system32\mfc40u.dll
.
[-] 2013-07-04 . 4C47B37CF351FFEB1227CED0FF4751D5 . 2070144 . . [5.1.2600.6419] . . c:\windows\Driver Cache\i386\ntkrnlpa.exe
[-] 2013-07-04 . 4C47B37CF351FFEB1227CED0FF4751D5 . 2070144 . . [5.1.2600.6419] . . c:\windows\system32\ntkrnlpa.exe
[-] 2012-10-10 . B326D5E256D2F32B23E64F49DEBCE31B . 2069632 . . [5.1.2600.6284] . . c:\windows\$NtUninstallKB2859537$\ntkrnlpa.exe
.
[-] 2012-10-10 . D2CF91B2C710E9F666E60AFBF87643EE . 1689088 . . [5.03.2600.5601] . . c:\windows\system32\d3d9.dll
.
[-] 2013-07-04 . A4A50A53FFBFEC545CDA85E98AF2106B . 2193536 . . [5.1.2600.6419] . . c:\windows\Driver Cache\i386\ntoskrnl.exe
[-] 2013-07-04 . A4A50A53FFBFEC545CDA85E98AF2106B . 2193536 . . [5.1.2600.6419] . . c:\windows\system32\ntoskrnl.exe
[-] 2012-10-10 . ECA5980E1A78DBF9CB7F49F76791C0D1 . 2193024 . . [5.1.2600.6284] . . c:\windows\$NtUninstallKB2859537$\ntoskrnl.exe
.
[-] 2012-10-10 . 9F8A0D0CBB2FA265A754516128C00E22 . 175616 . . [5.1.2600.5635] . . c:\windows\system32\w32time.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\MountOverlayIcon]
@="{0F49CF41-FD97-4942-9F2A-35E8B489E7FB}"
[HKEY_CLASSES_ROOT\CLSID\{0F49CF41-FD97-4942-9F2A-35E8B489E7FB}]
2010-10-20 10:22 257024 ----a-w- c:\program files\WinMount\WinMTExt.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LClock"="c:\program files\LClock\LClock.exe" [2004-09-19 65536]
"SRS Audio Sandbox"="c:\program files\SRS Labs\Audio Sandbox\SRSSSC.exe" [2010-01-07 3216664]
"Skype"="c:\program files\Skype\Phone\Skype_new.exe" [2014-07-24 21645408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2014-08-31 13529088]
"VMonitorVMUVC"="c:\program files\Vimicro Corporation\VMUVC\VMonitor.exe" [2008-08-29 143360]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\Administrator\Start Menu\Programs\Startup\
AntiCrash.lnk - c:\program files\Dachshund Software\AntiCrash\AntiCrash.exe [2002-12-17 2301798]
Hare.lnk - c:\program files\Dachshund Software\Hare\Hare.exe [2002-9-21 1874381]
Zoom.lnk - c:\program files\Dachshund Software\Zoom\Zoom.exe [2002-9-21 1446302]
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoRecentDocsNetHood"= 01000000
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-602162358-2000478354-842925246-500\Scripts\Logon\0\0]
"Script"=clean_tmp.bat
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, credssp.dll, digest.dll, msnsspc.dll
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
.
R0 mv61xxmm;mv61xxmm;c:\windows\system32\drivers\mv61xxmm.sys [03.9.2013 г. 02:18 14184]
R0 mv64xxmm;mv64xxmm;c:\windows\system32\drivers\mv64xxmm.sys [03.9.2013 г. 02:18 5632]
R0 mvxxmm;mvxxmm;c:\windows\system32\drivers\mvxxmm.sys [03.9.2013 г. 02:18 14184]
R1 adgnetworktdidrv;adgnetworktdidrv;c:\windows\system32\drivers\adgnetworktdidrv.sys [01.5.2015 г. 03:06 57336]
R1 prio;Prio;c:\windows\system32\drivers\prio.sys [08.11.2012 г. 22:29 54128]
R1 WMDrive;WMDrive;c:\windows\system32\drivers\WMDrive.sys [03.9.2013 г. 03:11 65856]
R2 ImDisk;ImDisk Virtual Disk Driver;c:\windows\system32\drivers\imdisk.sys [31.8.2014 г. 07:04 34448]
R2 prio_svc;Prio Service;c:\program files\Prio\prio_svc.exe [08.11.2012 г. 22:29 12656]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [08.6.2015 г. 18:45 23256]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes Anti-Malware\mbamservice.exe [08.6.2015 г. 18:45 1080120]
S3 AWEAlloc;AWE Memory Allocation Driver;c:\windows\system32\drivers\awealloc.sys [31.8.2014 г. 07:04 17920]
S3 cpudrv;cpudrv;c:\program files\SystemRequirementsLab\cpudrv.sys [02.6.2011 г. 11:08 11336]
S3 ImDskSvc;ImDisk Virtual Disk Driver Helper;c:\windows\system32\imdsksvc.exe [31.8.2014 г. 07:04 10240]
S3 Revoflt;Revoflt;c:\windows\system32\drivers\revoflt.sys [03.9.2013 г. 12:03 27064]
S4 cpuz136;cpuz136;\??\c:\docume~1\ADMINI~1\LOCALS~1\Temp\cpuz136\cpuz136_x32.sys --> c:\docume~1\ADMINI~1\LOCALS~1\Temp\cpuz136\cpuz136_x32.sys [?]
S4 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [23.10.2013 г. 08:15 172192]
.
Contents of the 'Scheduled Tasks' folder
.
2015-06-09 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-09-02 03:40]
.
2015-06-09 c:\windows\Tasks\Defrag Job 00.job
- c:\program files\Disktrix\UltimateDefrag\Udefrag.exe [2011-05-10 22:12]
.
2015-04-01 c:\windows\Tasks\Defrag Job 01.job
- c:\program files\Disktrix\UltimateDefrag\Udefrag.exe [2011-05-10 22:12]
.
2015-06-09 c:\windows\Tasks\Opera scheduled Autoupdate 1407995545.job
- c:\program files\Opera\launcher.exe [2014-08-14 08:13]
.
.
------- Supplementary Scan -------
.
uStart Page = https://www.google.bg/
uInternet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch
uSearchAssistant = hxxp://www.google.com
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
TCP: DhcpNameServer = 192.168.137.1 193.68.3.252
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2015-06-10 02:09
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-602162358-2000478354-842925246-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,dc,dd,1a,65,92,f1,f0,45,8f,2a,65,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,60,75,ee,d4,1e,52,de,4d,a8,fd,05,\
"6256FFB019F8FDFBD36745B06F4540E9AEAF222A25"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,dc,dd,1a,65,92,f1,f0,45,8f,2a,65,\
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_17_0_0_169_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_17_0_0_169_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,dc,dd,1a,65,92,f1,f0,45,8f,2a,65,\
"6256FFB019F8FDFBD36745B06F4540E9AEAF222A25"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,dc,dd,1a,65,92,f1,f0,45,8f,2a,65,\
.
Completion time: 2015-06-10 02:12:15
ComboFix-quarantined-files.txt 2015-06-09 23:12
ComboFix2.txt 2015-06-09 21:32
.
Pre-Run: 2 121 084 928 bytes free
Post-Run: 2 114 248 704 bytes free
.
- - End Of File - - 2FC2E383809F2BEDB746228F26C315E9
8F558EB6672622401DA993E1E865C861



Това е логът след последнта проверка sfc и последния CFScript

Редактирано от belivakov (преглед на промените)

Чудесно...вече всичко е чисто. Остава малко да покърпим и да видим защо някои файлове все още са цифрово неподписани.

 

Според мен ако е наличен инсталационен диск не е необходим регистри "хак" за да сработи sfc...да, ще дава доста повече пъти Retry, но поне ще свърши работата като хората. Аз регистри "хак" използвам само ако копирам папката i386 на друг дял и така за да не се налага да ползвам инсталационния диск. Както и да е. Все пак провери всички локации в регистрите.

 

A иначе изтегли инструмента => Dial-a-fix-v0.60.0.24

Разархивирай го и стартирай файла Dial-a-fix.exe

Сложи отметка пред Fix SSL/HTTPS/Cryptsvc и премахни останалите и натисни бутона GO!

Dial-a-fix.png

Рестартирай машината.

 

След това за да не използваме повече Combofix =>

 

  • Отвори следния сайт и изтегли RKill.exe и ги запази на десктопа.
  • Стартирай програмата с двоен клик върху файла и изчакай търпеливо.
  • След приключване на проверката ще се генерира лог файл с извършените процедури.
  • Публикувай съдържанието на лог файла в следващия си пост.

 

Поздрави!

  • Автор

Rkill 2.7.0 by Lawrence Abrams (Grinler)
http://www.bleepingcomputer.com/
Copyright 2008-2015 BleepingComputer.com
More Information about Rkill can be found at this link:
 http://www.bleepingcomputer.com/forums/topic308364.html

Program started at: 06/10/2015 03:01:27 AM in x86 mode.
Windows Version: Microsoft Windows XP Service Pack 3

Checking for Windows services to stop:

 * No malware services found to stop.

Checking for processes to terminate:

 * C:\WINDOWS\Integrator.exe (PID: 152) [WD-HEUR]

1 proccess terminated!

Possibly Patched Files.

 * C:\WINDOWS\system32\services.exe
 * C:\WINDOWS\system32\spoolsv.exe
 * C:\WINDOWS\system32\wbem\wmiprvse.exe

Checking Registry for malware related settings:

 * No issues found in the Registry.

Resetting .EXE, .COM, & .BAT associations in the Windows Registry.

Performing miscellaneous checks:

 * Reparse Point/Junctions Found (Most likely legitimate)!

     * C:\WINDOWS\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a => C:\WINDOWS\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_4.0.0.0_x-ww_29b51492 [Dir]

Checking Windows Service Integrity:

 * No issues found.

Searching for Missing Digital Signatures:

 * C:\WINDOWS\System32\browser.dll : 78 336 : 10/10/2012 08:43 PM : fc6d1d80588d371f0321e15a75b2f8f2 [NoSig]

 * C:\WINDOWS\System32\comctl32.dll : 617 472 : 10/10/2012 08:43 PM : 93afb83fbc1f9443cac722fca63d73bf [NoSig]
 +-> C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll : 921 088 : 04/14/2008 02:00 PM : aef3d788dbf40c7c4d204ea45eb0c505 [Pos Repl]
 +-> C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll : 1 054 208 : 10/10/2012 08:42 PM : 736b12b725aeb2b07f0241a9f680cb10 [Pos Repl]

 * C:\WINDOWS\System32\d3d9.dll : 1 689 088 : 10/10/2012 08:43 PM : d2cf91b2c710e9f666e60afbf87643ee [NoSig]

 * C:\WINDOWS\System32\es.dll : 253 952 : 10/10/2012 08:43 PM : f17f6226bdc0cd5f0bef0daf84d29bec [NoSig]

 * C:\WINDOWS\System32\hnetcfg.dll : 344 064 : 10/10/2012 08:43 PM : 0a878aa66e4dd3e2608192a1eccd9f8f [NoSig]

 * C:\WINDOWS\System32\kernel32.dll : 993 280 : 03/12/2014 01:48 PM : 4a45b692d2baa74124df57472d5ea2f1 [NoSig]
 +-> C:\WINDOWS\$NtUninstallKB2758857$\kernel32.dll : 991 744 : 10/10/2012 08:43 PM : da11d9d6ecbdf0f93436a4b7c13f7bec [Pos Repl]
 +-> C:\WINDOWS\$NtUninstallKB2922229$\kernel32.dll : 991 744 : 10/03/2012 07:57 AM : 6cbfeeb384f04681af75f495aa48dd32 [Pos Repl]

 * C:\WINDOWS\System32\mfc40u.dll : 953 856 : 10/10/2012 08:43 PM : 842900dedbc8e3e8dbcccb298fd88f65 [NoSig]

 * C:\WINDOWS\System32\mshtml.dll : 6 022 144 : 04/30/2014 11:13 AM : 3db2624ccb1663bf6d62311b2b9e7b55 [NoSig]
 +-> C:\WINDOWS\ie8updates\KB2862772-IE8\mshtml.dll : 6 010 368 : 10/10/2012 08:46 PM : cf6b381c3518ab328382429cae206d64 [Pos Repl]
 +-> C:\WINDOWS\ie8updates\KB2870699-IE8\mshtml.dll : 6 017 536 : 07/26/2013 05:47 AM : 17965d48033d1a6e6320aa867351cc21 [Pos Repl]
 +-> C:\WINDOWS\ie8updates\KB2879017-IE8\mshtml.dll : 6 017 536 : 08/08/2013 09:06 AM : 4c9afe1ae4112d260a3e7846c60c774d [Pos Repl]
 +-> C:\WINDOWS\ie8updates\KB2888505-IE8\mshtml.dll : 6 017 536 : 09/23/2013 09:33 PM : 579017cf9c919429188190dae79bb8fc [Pos Repl]
 +-> C:\WINDOWS\ie8updates\KB2898785-IE8\mshtml.dll : 6 021 120 : 10/13/2013 10:25 AM : 0794cd09be3d1e7a966c95e76fc86f47 [Pos Repl]
 +-> C:\WINDOWS\ie8updates\KB2909921-IE8\mshtml.dll : 6 020 608 : 10/29/2013 10:57 AM : 680bd97ba5c817bce79162496d51528d [Pos Repl]
 +-> C:\WINDOWS\ie8updates\KB2925418-IE8\mshtml.dll : 6 021 120 : 02/06/2014 02:26 AM : 516e371cc348141277a73eb9d3c25951 [Pos Repl]
 +-> C:\WINDOWS\ie8updates\KB2936068-IE8\mshtml.dll : 6 022 144 : 02/24/2014 02:46 PM : 427c63c2075abf62faa897bbd3de44f4 [Pos Repl]
 +-> C:\WINDOWS\ie8updates\KB2964358-IE8\mshtml.dll : 6 021 632 : 03/06/2014 08:59 PM : 0964efc80bd54fdf37397a09fdae8395 [Pos Repl]
 +-> C:\WINDOWS\SoftwareDistribution\Download\907b0b79dc3a251ab2313dc5216daff8\SP3QFE\mshtml.dll : 6 021 120 : 02/06/2014 02:26 AM : 516e371cc348141277a73eb9d3c25951 [Pos Repl]

 * C:\WINDOWS\System32\msvcrt.dll : 343 040 : 10/10/2012 08:44 PM : 06b8485fb1da9a552b10ab978cd1ac85 [NoSig]
 +-> C:\WINDOWS\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.0.0_x-ww_2726e76a\msvcrt.dll : 322 560 : 04/14/2008 02:00 PM : 4200be3808f6406dbe45a7b88dae5035 [Pos Repl]
 +-> C:\WINDOWS\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.5701_x-ww_40d12c25\msvcrt.dll : 343 040 : 10/10/2012 08:42 PM : a4c4a54fd7e31179cb5bdf7896df3df7 [Pos Repl]

 * C:\WINDOWS\System32\mswsock.dll : 245 248 : 10/10/2012 08:44 PM : fcee5fcb99f7c724593365c706d28388 [NoSig]

 * C:\WINDOWS\System32\netlogon.dll : 407 040 : 10/10/2012 08:44 PM : 06cf9eedb7e827205c6948c9daf56974 [NoSig]

 * C:\WINDOWS\System32\ntkrnlpa.exe : 2 070 144 : 07/04/2013 05:08 AM : 4c47b37cf351ffeb1227ced0ff4751d5 [NoSig]
 +-> C:\WINDOWS\$NtUninstallKB2859537$\ntkrnlpa.exe : 2 069 632 : 10/10/2012 08:51 PM : b326d5e256d2f32b23e64f49debce31b [Pos Repl]
 +-> C:\WINDOWS\Driver Cache\i386\ntkrnlpa.exe : 2 070 144 : 07/04/2013 05:08 AM : 4c47b37cf351ffeb1227ced0ff4751d5 [Pos Repl]

 * C:\WINDOWS\System32\ntoskrnl.exe : 2 193 536 : 07/04/2013 05:59 AM : a4a50a53ffbfec545cda85e98af2106b [NoSig]
 +-> C:\WINDOWS\$NtUninstallKB2859537$\ntoskrnl.exe : 2 193 024 : 10/10/2012 08:44 PM : eca5980e1a78dbf9cb7f49f76791c0d1 [Pos Repl]
 +-> C:\WINDOWS\Driver Cache\i386\ntoskrnl.exe : 2 193 536 : 07/04/2013 05:59 AM : a4a50a53ffbfec545cda85e98af2106b [Pos Repl]

 * C:\WINDOWS\System32\oakley.dll : 278 528 : 10/12/2013 06:56 PM : 584c4da856450cb22ebbe7a68cc6250f [NoSig]
 +-> C:\WINDOWS\$NtUninstallKB2862152$\oakley.dll : 270 336 : 10/10/2012 08:44 PM : 7eadba6d371c60cca9e4db57c28c8045 [Pos Repl]

 * C:\WINDOWS\System32\ole32.dll : 1 289 728 : 08/05/2013 04:30 PM : 59b408e5b8489b0b36a0d783d150edcc [NoSig]
 +-> C:\WINDOWS\$NtUninstallKB2876217$\ole32.dll : 1 289 216 : 10/10/2012 08:44 PM : 7d9dde1ab4b00ddb173f5a16e9206517 [Pos Repl]

 * C:\WINDOWS\System32\psbase.dll : 97 280 : 10/10/2012 08:44 PM : 9c300a0ca0a6cbd50d22b3d725edea30 [NoSig]

 * C:\WINDOWS\System32\rpcss.dll : 401 408 : 10/10/2012 08:44 PM : 9222562d44021b988b9f9f62207fb6f2 [NoSig]

 * C:\WINDOWS\System32\schannel.dll : 153 088 : 10/10/2012 08:44 PM : 26f1193092b9ac2586deb38dd1cbb25c [NoSig]

 * C:\WINDOWS\System32\services.exe : 110 592 : 10/10/2012 08:44 PM : c519e15665cd89a91ad383fce3cb556a [NoSig]

 * C:\WINDOWS\System32\setupapi.dll : 985 088 : 10/10/2012 08:44 PM : ed0ce2deec594778004306e3fa8cac33 [NoSig]

 * C:\WINDOWS\System32\sfcfiles.dll : 1 614 848 : 10/10/2012 08:51 PM : e17798e1e6ff1ca9c67b8576570e05ee [NoSig]

 * C:\WINDOWS\System32\shsvcs.dll : 135 168 : 10/10/2012 08:45 PM : 888cd7b39c37e13a2419becfaaf0a28c [NoSig]

 * C:\WINDOWS\System32\spoolsv.exe : 58 880 : 10/10/2012 08:45 PM : 258dd5d4283fd9f9a7166be9ae45ce73 [NoSig]

 * C:\WINDOWS\System32\tapisrv.dll : 249 856 : 10/10/2012 08:45 PM : e2b32b10acc5d97623275aafb67e5f03 [NoSig]

 * C:\WINDOWS\System32\termsrv.dll : 296 960 : 10/10/2012 08:45 PM : 5128852a18ae46c387f87bf27da4c9dd [NoSig]

 * C:\WINDOWS\System32\usp10.dll : 406 016 : 07/10/2013 01:37 PM : 1d845821f5adb076831de4c2818f858b [NoSig]
 +-> C:\WINDOWS\$NtUninstallKB2850869$\usp10.dll : 406 016 : 10/10/2012 08:45 PM : f8894bcc961d461674002b4bae7aecc1 [Pos Repl]

 * C:\WINDOWS\System32\w32time.dll : 175 616 : 10/10/2012 08:45 PM : 9f8a0d0cbb2fa265a754516128c00e22 [NoSig]

 * C:\WINDOWS\System32\wbem\wmiprvse.exe : 227 840 : 10/10/2012 08:45 PM : f520ab392d58c0a1070268032d809382 [NoSig]

 * C:\WINDOWS\System32\wdigest.dll : 54 272 : 10/10/2012 08:45 PM : bae413e34804ddd5c763b3bec1005fcb [NoSig]

 * C:\WINDOWS\System32\wininet.dll : 920 064 : 03/06/2014 08:59 PM : 8af91e4b4c1f5338ebe1548117304296 [NoSig]
 +-> C:\WINDOWS\ie8updates\KB2862772-IE8\wininet.dll : 920 064 : 10/10/2012 08:46 PM : dcea3b3193b7181cf818ecc4eab30a66 [Pos Repl]
 +-> C:\WINDOWS\ie8updates\KB2870699-IE8\wininet.dll : 920 064 : 07/26/2013 05:47 AM : d46e195d0c76d430d73576cdac763f78 [Pos Repl]
 +-> C:\WINDOWS\ie8updates\KB2879017-IE8\wininet.dll : 920 064 : 08/08/2013 09:06 AM : f1bd516a4446b737baefb9fbaa92f01a [Pos Repl]
 +-> C:\WINDOWS\ie8updates\KB2888505-IE8\wininet.dll : 920 064 : 09/23/2013 09:33 PM : d73f1be00684e675571015b3a5880f5b [Pos Repl]
 +-> C:\WINDOWS\ie8updates\KB2898785-IE8\wininet.dll : 920 064 : 10/13/2013 10:25 AM : c5acab147f9697f40ecebb4bc0247ebf [Pos Repl]
 +-> C:\WINDOWS\ie8updates\KB2909921-IE8\wininet.dll : 920 064 : 10/29/2013 10:57 AM : fbf173582874c30ec5faf8f8a67d873e [Pos Repl]
 +-> C:\WINDOWS\ie8updates\KB2925418-IE8\wininet.dll : 920 064 : 02/06/2014 02:26 AM : e09551776d365bca891bbffb31ee4b4c [Pos Repl]
 +-> C:\WINDOWS\ie8updates\KB2936068-IE8\wininet.dll : 920 064 : 02/24/2014 02:46 PM : c29c1990c6ca8d7b098318f5887c3bdc [Pos Repl]
 +-> C:\WINDOWS\SoftwareDistribution\Download\907b0b79dc3a251ab2313dc5216daff8\SP3QFE\wininet.dll : 920 064 : 02/06/2014 02:26 AM : e09551776d365bca891bbffb31ee4b4c [Pos Repl]

 * C:\WINDOWS\System32\winlogon.exe : 509 440 : 10/10/2012 08:45 PM : 53a8857723277b1d6d5ee60a9f85b117 [NoSig]

 * C:\WINDOWS\explorer.exe : 1 033 728 : 10/10/2012 08:43 PM : 2bb75b7f548d82a099125d0c5971de7d [NoSig]

 * C:\WINDOWS\System32\drivers\afd.sys : 138 496 : 10/10/2012 08:43 PM : f6b7b1ecd7b41736bdb6ff4b092bcb79 [NoSig]

 * C:\WINDOWS\System32\drivers\bthport.sys : 272 128 : 10/10/2012 08:43 PM : 51d05d5a8a7d93ab0b1a8d6a38db3ca4 [NoSig]

 * C:\WINDOWS\System32\drivers\cdrom.sys : 62 592 : 01/03/2014 10:40 PM : 7b53584d94e9d8716b2de91d5f1cb42d [NoSig]

 * C:\WINDOWS\System32\drivers\disk.sys : 36 352 : 05/07/2008 11:12 AM : 47b6aaec570f2c11d8bad80a064d8ed1 [NoSig]

 * C:\WINDOWS\System32\drivers\fs_rec.sys : 9 216 : 10/10/2012 08:43 PM : 30d42943a54704ef13e2562911dbfcea [NoSig]

 * C:\WINDOWS\System32\drivers\hidparse.sys : 25 088 : 07/03/2013 05:12 AM : c569ef030b11f896e123a30ac92678db [NoSig]
 +-> C:\WINDOWS\$NtUninstallKB2862335$\hidparse.sys : 24 960 : 04/14/2008 02:00 PM : 96eccf28fdbf1b2cc12725818a63628d [Pos Repl]
 +-> C:\WINDOWS\Driver Cache\i386\hidparse.sys : 25 088 : 07/03/2013 05:12 AM : c569ef030b11f896e123a30ac92678db [Pos Repl]

 * C:\WINDOWS\System32\drivers\http.sys : 265 728 : 10/10/2012 08:43 PM : 937031c085718c1c04a9c0864625ec6b [NoSig]

 * C:\WINDOWS\System32\drivers\ksecdd.sys : 92 928 : 06/24/2009 12:28 AM : c6ebf1d6ad71df30db49b8d3287e1368 [NoSig]

 * C:\WINDOWS\System32\drivers\mountmgr.sys : 42 752 : 10/10/2012 08:43 PM : 1a1faa5102466f418494e94ff9b0b091 [NoSig]

 * C:\WINDOWS\System32\drivers\mrxdav.sys : 180 096 : 10/10/2012 08:44 PM : 4fefd389d71126ee581b9f9cb2918be4 [NoSig]

 * C:\WINDOWS\System32\drivers\mrxsmb.sys : 457 856 : 10/10/2012 08:44 PM : fb2fccc70f7174c7bf64f48e96d3adf4 [NoSig]

 * C:\WINDOWS\System32\drivers\mup.sys : 105 472 : 10/10/2012 08:44 PM : f7b1ad991491f02af6da70b00b8bf114 [NoSig]

 * C:\WINDOWS\System32\drivers\ndistapi.sys : 10 496 : 10/10/2012 08:44 PM : 091735a5f20acb1dc147383a905ae002 [NoSig]

 * C:\WINDOWS\System32\drivers\ndproxy.sys : 40 960 : 11/27/2013 11:21 PM : 2f597bb467e05b1fe3830eabd821b8e0 [NoSig]
 +-> C:\WINDOWS\$NtUninstallKB2914368$\ndproxy.sys : 40 960 : 10/10/2012 08:44 PM : 816460bd4b4acd27937d1d0813e2e9e9 [Pos Repl]

 * C:\WINDOWS\System32\drivers\ntfs.sys : 576 384 : 11/18/2008 05:02 PM : 4c51d5275ae8a16999edfe7e647d00de [NoSig]

 * C:\WINDOWS\System32\drivers\portcls.sys : 146 048 : 03/21/2008 11:35 AM : aef54bf915bf5c2ed1b856ef94e89721 [NoSig]
 +-> C:\WINDOWS\system32\ReinstallBackups\0004\DriverFiles\i386\portcls.sys : 146 048 : 03/21/2008 11:35 AM : aef54bf915bf5c2ed1b856ef94e89721 [Pos Repl]

 * C:\WINDOWS\System32\drivers\psched.sys : 70 272 : 10/10/2012 08:44 PM : d8e11d311785f89f1d70a28b0e879127 [NoSig]

 * C:\WINDOWS\System32\drivers\rdbss.sys : 174 848 : 10/10/2012 08:44 PM : 77050c6615f6eb5402f832b27fd695e0 [NoSig]

 * C:\WINDOWS\System32\drivers\rdpdr.sys : 195 712 : 09/04/2009 04:43 PM : 47ea20320e3d6fdc7b7bb22b2b881ca6 [NoSig]

 * C:\WINDOWS\System32\drivers\rdpwd.sys : 139 784 : 10/10/2012 08:44 PM : c7d9bc54354b8c706abf172d48313f1b [NoSig]

 * C:\WINDOWS\System32\drivers\rmcast.sys : 203 776 : 10/10/2012 08:44 PM : 21f412dbfffe34d39287e13674db04f1 [NoSig]

 * C:\WINDOWS\System32\drivers\scsiport.sys : 96 384 : 10/10/2012 08:44 PM : d1a72286e21c356960aba52393fc7ec8 [NoSig]

 * C:\WINDOWS\System32\drivers\srv.sys : 357 888 : 10/10/2012 08:45 PM : 9b390283569ea58d43d2586032b892f5 [NoSig]

 * C:\WINDOWS\System32\drivers\tcpip6.sys : 226 880 : 10/10/2012 08:45 PM : f4a3c6abe7818b1b53f58fa1adb605cd [NoSig]

 * C:\WINDOWS\System32\Drivers\tcpip.sys : 361 600 : 08/19/2003 00:50 AM : e980b5f3397efc252d62df5352571c2c [NoSig]

 * C:\WINDOWS\System32\drivers\tdtcp.sys : 22 024 : 10/10/2012 08:45 PM : c0578456f29e5f26285f81b7b71fe57d [NoSig]

 * C:\WINDOWS\System32\drivers\usb8023.sys : 12 928 : 02/12/2013 03:32 AM : 2a7a8ad9d39a2faf9d9293b5daff3a4b [NoSig]
 +-> C:\WINDOWS\$hf_mig$\KB2807986\SP3QFE\usb8023.sys : 12 928 : 02/12/2013 03:43 AM : c74f25c77d6c3edf58221e4060d8cd16 [Pos Repl]
 +-> C:\WINDOWS\$NtUninstallKB2807986$\usb8023.sys : 12 800 : 04/14/2008 02:00 PM : bee793d4a059caea55d6ac20e19b3a8f [Pos Repl]

 * C:\WINDOWS\System32\drivers\usbccgp.sys : 32 384 : 08/09/2013 03:55 AM : 1b611611c28d2df25bc057d79c6f13fc [NoSig]
 +-> C:\WINDOWS\$NtUninstallKB2862330$\usbccgp.sys : 32 128 : 04/13/2008 10:15 PM : 173f317ce0db8e21322e71b7e60a27e8 [Pos Repl]
 +-> C:\WINDOWS\Driver Cache\i386\usbccgp.sys : 32 384 : 08/09/2013 03:55 AM : 1b611611c28d2df25bc057d79c6f13fc [Pos Repl]

 * C:\WINDOWS\System32\drivers\usbd.sys : 5 376 : 08/09/2013 03:55 AM : 04fe5ef6ed4818ec4839ea5c611a6310 [NoSig]
 +-> C:\WINDOWS\$NtUninstallKB2862330$\usbd.sys : 4 736 : 04/14/2008 02:00 PM : 596eb39b50d6ebd9b734dc4ae0544693 [Pos Repl]
 +-> C:\WINDOWS\Driver Cache\i386\usbd.sys : 5 376 : 08/09/2013 03:55 AM : 04fe5ef6ed4818ec4839ea5c611a6310 [Pos Repl]

 * C:\WINDOWS\System32\drivers\usbehci.sys : 30 336 : 03/18/2009 02:02 PM : 4bac8df07f1d8434fc640e677a62204e [NoSig]
 +-> C:\WINDOWS\Driver Cache\i386\usbehci.sys : 30 336 : 03/18/2009 02:02 PM : 4bac8df07f1d8434fc640e677a62204e [Pos Repl]

 * C:\WINDOWS\System32\drivers\usbport.sys : 144 128 : 08/09/2013 03:55 AM : 6df35ca139c3bc15cc74390abb114efe [NoSig]
 +-> C:\WINDOWS\$NtUninstallKB2862330$\usbport.sys : 144 128 : 10/10/2012 08:45 PM : 810834aa294a79b3b718ef55a6a58a48 [Pos Repl]
 +-> C:\WINDOWS\Driver Cache\i386\usbport.sys : 144 128 : 08/09/2013 03:55 AM : 6df35ca139c3bc15cc74390abb114efe [Pos Repl]
 +-> C:\WINDOWS\system32\ReinstallBackups\0005\DriverFiles\i386\usbport.sys : 144 128 : 10/10/2012 08:45 PM : 810834aa294a79b3b718ef55a6a58a48 [Pos Repl]
 +-> C:\WINDOWS\system32\ReinstallBackups\0006\DriverFiles\i386\usbport.sys : 144 128 : 10/10/2012 08:45 PM : 810834aa294a79b3b718ef55a6a58a48 [Pos Repl]

Checking HOSTS File:

 * HOSTS file entries found:

  127.0.0.1       localhost

Program finished at: 06/10/2015 03:03:05 AM
Execution time: 0 hours(s), 1 minute(s), and 38 seconds(s)

 

===========

А буквата на инсталационния диск е, защото монтирам исо файл за проверката. И трябваше да видя на коя буква трябва да е. :)

Редактирано от belivakov (преглед на промените)

Архивирана тема

Темата е твърде стара и е архивирана. Не можете да добавяте нови отговори в нея, но винаги можете да публикувате нова тема, в която да продължи дискусията. Регистрирайте се или влезте във вашия профил за да публикувате нова тема.

Назад

Разглеждащи това в момента 0

  • Няма регистрирани потребители разглеждащи тази страница.

Дарение

  • Подкрепи съществуването на форума - направи дарение
    32%
    Дарени 315 € от нужните 1 000 €

Бюлетин

Получавайте известие, когато има важна промяна или новина свързана с форума.
Абонирайте се

Профил

Навигация

Търсене

Търсене

Конфигуриране на push известия в браузъра
Chrome (Android)
  1. Докоснете иконата на катинар до адресната лента.
  2. Докоснете Разрешения → Известия.
  3. Променете предпочитанията си.
Chrome (Desktop)
  1. Кликнете върху иконата на катинар в адресната лента.
  2. Изберете Настройки на сайта.
  3. Намерете Известия и коригирайте предпочитанията си.