ComboFix 08-12-26.02 - Petio 2008-12-28 16:17:59.3 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.3.1251.1.1033.18.2047.1324 [GMT 2:00]

Running from: c:\documents and settings\Petio\Desktop\Combofix.exe

Command switches used :: c:\documents and settings\Petio\Desktop\CFScript.txt.txt

AV: McAfee VirusScan *On-access scanning enabled* (Updated)

FW: McAfee Personal Firewall *enabled*

* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::

c:\windows\system32\drivers\934c8640.sys

c:\windows\system32\drivers\brorzjo.sys

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\system32\drivers\934c8640.sys

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Service_934c8640

((((((((((((((((((((((((( Files Created from 2008-11-28 to 2008-12-28 )))))))))))))))))))))))))))))))

.

2008-12-28 13:06 . 2008-12-28 13:06 250 --a------ c:\windows\gmer.ini

2008-12-27 20:46 . 2008-12-27 20:46 0 --a------ c:\windows\ativpsrm.bin

2008-12-27 16:28 . 2008-12-27 16:28 <DIR> d-------- C:\Hellothere

2008-12-27 00:17 . 2008-12-27 15:53 <DIR> d-------- c:\program files\SUPERAntiSpyware

2008-12-27 00:17 . 2008-12-27 00:17 <DIR> d-------- c:\documents and settings\Petio\Application Data\SUPERAntiSpyware.com

2008-12-27 00:17 . 2008-12-27 00:17 <DIR> d-------- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com

2008-12-26 23:36 . 2008-12-26 23:36 <DIR> d-------- c:\documents and settings\All Users\Application Data\Yahoo! Companion

2008-12-26 23:32 . 2008-12-26 23:32 <DIR> d-------- c:\program files\Yahoo!

2008-12-26 23:32 . 2008-12-26 23:34 <DIR> d-------- c:\program files\CCleaner

2008-12-26 23:10 . 2008-12-26 23:10 <DIR> d-------- c:\documents and settings\Administrator

2008-12-26 22:43 . 2008-12-26 22:43 <DIR> dr-h----- c:\documents and settings\Petio\Application Data\SecuROM

2008-12-26 21:16 . 2008-12-26 21:20 <DIR> d-------- c:\program files\Ballance

2008-12-26 19:39 . 2008-12-26 19:40 <DIR> d-------- C:\Mercury MaxIM

2008-12-25 22:09 . 2008-12-25 22:09 <DIR> d-------- c:\documents and settings\Petio\Application Data\Activision

2008-12-25 22:08 . 2008-12-25 22:08 286 --a------ c:\windows\game.ini

2008-12-25 21:55 . 2008-12-25 21:55 <DIR> d--hs---- c:\windows\ftpcache

2008-12-25 12:53 . 2008-12-25 12:53 <DIR> d-------- c:\program files\GameSpy

2008-12-25 12:50 . 2008-12-25 12:50 22,328 --a------ c:\documents and settings\Petio\Application Data\PnkBstrK.sys

2008-12-25 12:49 . 2008-12-25 12:49 669,184 --a------ c:\windows\system32\pbsvc.exe

2008-12-24 20:11 . 2008-12-24 20:11 <DIR> d-------- c:\windows\system32\xlive

2008-12-24 20:11 . 2008-12-24 20:26 <DIR> d-------- c:\program files\Microsoft Games for Windows - LIVE

2008-12-24 18:37 . 2008-12-24 18:37 <DIR> d-------- c:\program files\Activision

2008-12-24 13:15 . 2008-11-12 10:29 3,720,832 --a------ c:\windows\system32\drivers\RtHDMI.sys

2008-12-24 13:15 . 2008-09-19 17:48 1,200,128 --a------ c:\windows\RtkUpd.exe

2008-12-24 12:36 . 2008-12-24 12:36 <DIR> d-------- c:\documents and settings\Petio\Application Data\ATI

2008-12-24 12:36 . 2008-12-24 12:36 <DIR> d-------- c:\documents and settings\All Users\Application Data\ATI

2008-12-24 12:31 . 2008-12-01 14:35 593,920 --a------ c:\windows\system32\ati2sgag.exe

2008-12-24 12:30 . 2008-12-24 12:30 <DIR> d-------- C:\ATI

2008-12-24 12:12 . 2008-05-21 01:53 141,824 -ra------ c:\windows\system32\drivers\AtiHdmi.sys

2008-12-24 12:11 . 2008-12-24 12:33 <DIR> d-------- c:\program files\ATI

2008-12-24 12:07 . 2008-12-24 12:32 <DIR> d-------- c:\program files\ATI Technologies

2008-12-21 15:07 . 2008-12-21 15:07 <DIR> d-------- c:\program files\Nu Generation Games Ltd

2008-12-21 14:57 . 2008-12-21 14:57 410,984 --a------ c:\windows\system32\deploytk.dll

2008-12-20 19:18 . 2008-12-20 19:18 <DIR> d-------- c:\documents and settings\All Users\Application Data\Urban FreeStyle Soccer

2008-12-20 19:16 . 2008-12-20 19:16 <DIR> d-------- c:\program files\Acclaim Entertainment

2008-12-11 14:34 . 2008-10-23 14:36 286,720 -----c--- c:\windows\system32\dllcache\gdi32.dll

2008-12-07 10:27 . 2008-12-07 10:27 126 --a------ c:\windows\kaillera.ini

2008-12-04 16:59 . 2008-12-04 16:59 <DIR> d-------- c:\program files\Common Files\DirectX

2008-12-01 22:52 . 2008-12-01 22:52 425,984 --a------ c:\windows\system32\ATIDEMGX.dll

2008-12-01 22:46 . 2008-12-01 22:46 11,304,960 --a------ c:\windows\system32\atioglxx.dll

2008-12-01 22:41 . 2008-12-01 22:41 188,416 --a------ c:\windows\system32\atipdlxx.dll

2008-12-01 22:40 . 2008-12-01 22:40 147,456 --a------ c:\windows\system32\Oemdspif.dll

2008-12-01 22:40 . 2008-12-01 22:40 143,360 --a------ c:\windows\system32\ati2evxx.dll

2008-12-01 22:40 . 2008-12-01 22:40 43,520 --a------ c:\windows\system32\ati2edxx.dll

2008-12-01 22:40 . 2008-12-01 22:40 26,112 --a------ c:\windows\system32\Ati2mdxx.exe

2008-12-01 22:38 . 2008-12-01 22:38 598,016 --a------ c:\windows\system32\ati2evxx.exe

2008-12-01 22:37 . 2008-12-01 22:37 53,248 --a------ c:\windows\system32\ATIDDC.DLL

2008-12-01 22:19 . 2008-12-01 22:19 307,200 --a------ c:\windows\system32\atiiiexx.dll

2008-12-01 22:11 . 2008-12-01 22:11 3,107,788 --a------ c:\windows\system32\ativvaxx.dat

2008-12-01 22:11 . 2008-12-01 22:11 3,107,788 --a------ c:\windows\system32\ativva5x.dat

2008-12-01 22:11 . 2008-12-01 22:11 887,724 --a------ c:\windows\system32\ativva6x.dat

2008-12-01 22:11 . 2008-12-28 16:23 69,112 --a------ c:\windows\system32\ativvaxx.cap

2008-12-01 21:57 . 2008-12-01 21:57 48,640 --a------ c:\windows\system32\amdpcom32.dll

2008-12-01 21:53 . 2008-12-01 21:53 401,408 --a------ c:\windows\system32\atikvmag.dll

2008-12-01 21:53 . 2008-12-01 21:53 45,056 --a------ c:\windows\system32\amdcalrt.dll

2008-12-01 21:53 . 2008-12-01 21:53 45,056 --a------ c:\windows\system32\amdcalcl.dll

2008-12-01 21:52 . 2008-12-01 21:52 86,016 --a------ c:\windows\system32\atiadlxx.dll

2008-12-01 21:52 . 2008-12-01 21:52 17,408 --a------ c:\windows\system32\atitvo32.dll

2008-12-01 21:51 . 2008-12-01 21:51 53,248 --a------ c:\windows\system32\drivers\ati2erec.dll

2008-12-01 21:50 . 2008-12-01 21:50 3,252,224 --a------ c:\windows\system32\Amdcaldd.dll

2008-12-01 21:50 . 2008-12-01 21:50 286,720 --a------ c:\windows\system32\atiok3x2.dll

2008-11-29 18:04 . 2008-11-29 18:04 <DIR> d-------- c:\program files\YouTube Downloader

2008-11-29 18:01 . 2008-11-29 18:01 <DIR> d-------- c:\program files\Spider Video Downloader

2008-11-28 12:19 . 2001-08-17 22:36 8,704 --a------ c:\windows\system32\kbdjpn.dll

2008-11-28 12:19 . 2001-08-17 22:36 8,704 --a--c--- c:\windows\system32\dllcache\kbdjpn.dll

2008-11-28 12:19 . 2001-08-17 22:36 8,192 --a------ c:\windows\system32\kbdkor.dll

2008-11-28 12:19 . 2001-08-17 22:36 8,192 --a--c--- c:\windows\system32\dllcache\kbdkor.dll

2008-11-28 12:19 . 2008-04-14 05:39 6,144 --a------ c:\windows\system32\kbd106.dll

2008-11-28 12:19 . 2001-08-17 14:55 6,144 --a------ c:\windows\system32\kbd101c.dll

2008-11-28 12:19 . 2001-08-17 14:55 6,144 --a------ c:\windows\system32\kbd101b.dll

2008-11-28 12:19 . 2008-04-14 05:39 6,144 --a--c--- c:\windows\system32\dllcache\kbd106.dll

2008-11-28 12:19 . 2001-08-17 14:55 6,144 --a--c--- c:\windows\system32\dllcache\kbd101c.dll

2008-11-28 12:19 . 2001-08-17 14:55 6,144 --a--c--- c:\windows\system32\dllcache\kbd101b.dll

2008-11-28 12:19 . 2001-08-17 14:55 5,632 --a------ c:\windows\system32\kbd103.dll

2008-11-28 12:19 . 2001-08-17 14:55 5,632 --a--c--- c:\windows\system32\dllcache\kbd103.dll

2008-11-28 12:08 . 2008-12-09 18:01 <DIR> d-------- c:\program files\KoZ Mu S4 MaX

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-12-28 14:25 --------- d-----w c:\documents and settings\Petio\Application Data\Skype

2008-12-28 10:45 --------- d-----w c:\documents and settings\All Users\Application Data\Test Drive Unlimited

2008-12-28 09:23 --------- d-----w c:\documents and settings\Petio\Application Data\skypePM

2008-12-26 22:20 --------- d-----w c:\program files\Malwarebytes' Anti-Malware

2008-12-26 22:16 --------- d-----w c:\program files\Common Files\Wise Installation Wizard

2008-12-26 20:39 --------- d-----w c:\documents and settings\Petio\Application Data\uTorrent

2008-12-26 20:30 --------- d--h--w c:\program files\InstallShield Installation Information

2008-12-25 19:22 --------- d-----w c:\program files\TuneUp Utilities 2008

2008-12-25 15:18 138,184 ----a-w c:\windows\system32\drivers\PnkBstrK.sys

2008-12-25 10:33 --------- d-----w c:\program files\Electronic Arts

2008-12-24 19:00 --------- d-----w c:\program files\PC Wizard 2008

2008-12-21 12:56 --------- d-----w c:\program files\Java

2008-12-20 17:16 --------- d-----w c:\program files\Common Files\InstallShield

2008-12-15 06:19 --------- d-----w c:\program files\McAfee

2008-12-03 17:52 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys

2008-12-03 17:52 15,504 ----a-w c:\windows\system32\drivers\mbam.sys

2008-12-03 16:37 --------- d-----w c:\documents and settings\Petio\Application Data\Media Player Classic

2008-12-02 05:24 --------- d-----w c:\documents and settings\LocalService\Application Data\SACore

2008-12-01 22:13 3,452,928 ----a-w c:\windows\system32\drivers\ati2mtag.sys

2008-11-23 18:08 --------- d-----w c:\program files\Lavalys

2008-11-23 17:01 --------- d-----w c:\program files\EA Games

2008-11-23 16:19 --------- d-----w c:\program files\Winamp

2008-11-19 15:05 --------- d-----w c:\program files\SystemRequirementsLab

2008-11-19 15:04 --------- d-----w c:\documents and settings\Petio\Application Data\SystemRequirementsLab

2008-11-18 17:31 --------- d-----w c:\program files\Autoplay Repair

2008-11-18 16:32 --------- d-----w c:\program files\K-Lite Codec Pack

2008-11-17 19:18 --------- d-----w c:\documents and settings\Petio\Application Data\Leadertech

2008-11-17 16:46 --------- d-----w c:\program files\Reference Assemblies

2008-11-17 16:46 --------- d-----w c:\program files\MSBuild

2008-11-13 13:49 --------- d-----w c:\documents and settings\Petio\Application Data\Red Alert 3

2008-11-12 14:01 --------- d-----w c:\program files\MSXML 4.0

2008-11-10 14:26 --------- d-----w c:\program files\Microsoft.NET

2008-11-10 14:25 --------- d-----w c:\program files\Microsoft ActiveSync

2008-11-05 18:28 --------- d-----w c:\program files\NeroInstall.bak

2008-11-05 18:24 --------- d-----w c:\documents and settings\Petio\Application Data\Nero

2008-11-05 18:23 --------- d-----w c:\program files\Common Files\Nero

2008-11-05 18:22 --------- d-----w c:\program files\Nero

2008-11-05 18:22 --------- d-----w c:\documents and settings\All Users\Application Data\Nero

2008-10-11 16:39 720,896 ----a-w c:\windows\iun6002.exe

2008-09-30 15:01 16,864,768 ----a-w c:\windows\RTHDCPL.EXE

2008-09-30 13:38 2,168,320 ----a-w c:\windows\MicCal.exe

.

((((((((((((((((((((((((((((((((((((((( System Restore )))))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\avenger\backup.reg

2008-12-28 13:18 0 {60962BE4-C608-404F-B4A5-C4BE261CEEE1}\RP1\A0000035.reg

C:\cleanup.bat

2008-12-28 13:18 574 {60962BE4-C608-404F-B4A5-C4BE261CEEE1}\RP1\A0000038.bat

2008-12-28 13:26 574 {60962BE4-C608-404F-B4A5-C4BE261CEEE1}\RP1\A0001036.bat

C:\cleanup.exe

2008-12-28 13:18 19286 {60962BE4-C608-404F-B4A5-C4BE261CEEE1}\RP1\A0000037.exe

2008-12-28 13:26 19286 {60962BE4-C608-404F-B4A5-C4BE261CEEE1}\RP1\A0001035.exe

c:\documents and settings\Petio\Desktop\CCleaner 2.14.750.exe

2008-12-26 23:32 2972736 {60962BE4-C608-404F-B4A5-C4BE261CEEE1}\RP1\A0000060.exe

c:\documents and settings\Petio\Desktop\MMIM_0_986_Setup.exe

2008-12-26 19:39 806009 {60962BE4-C608-404F-B4A5-C4BE261CEEE1}\RP1\A0000059.exe

c:\documents and settings\Petio\Desktop\noo.exe

2008-12-26 23:33 6467096 {60962BE4-C608-404F-B4A5-C4BE261CEEE1}\RP1\A0000061.exe

c:\windows\system32\drivers\934c8640.sys

2008-12-28 16:22 112364 {60962BE4-C608-404F-B4A5-C4BE261CEEE1}\RP2\A0002042.sys

c:\windows\system32\drivers\brorzjo.sys

2008-12-28 13:18 61440 {60962BE4-C608-404F-B4A5-C4BE261CEEE1}\RP1\A0000031.sys

c:\windows\system32\drivers\saxtaksa.sys

2008-12-28 13:13 61440 {60962BE4-C608-404F-B4A5-C4BE261CEEE1}\RP1\A0000030.sys

c:\windows\system32\drivers\ukmih.sys

2008-12-28 13:26 61440 {60962BE4-C608-404F-B4A5-C4BE261CEEE1}\RP1\A0001030.sys

C:\zip.exe

2008-12-28 13:18 135168 {60962BE4-C608-404F-B4A5-C4BE261CEEE1}\RP1\A0000036.exe

2008-12-28 13:26 135168 {60962BE4-C608-404F-B4A5-C4BE261CEEE1}\RP1\A0001034.exe

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-11-07 21633320]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2008-02-28 1828136]

"Comrade.exe"="c:\program files\GameSpy\Comrade\Comrade.exe" [2007-06-29 36864]

"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-07-24 490952]

"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-12-27 1809648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2008-07-11 641208]

"McENUI"="c:\progra~1\McAfee\MHN\McENUI.exe" [2008-06-13 1176808]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-21 136600]

"tsnpstd3"="c:\windows\tsnpstd3.exe" [2007-03-30 262144]

"snpstd3"="c:\windows\vsnpstd3.exe" [2006-09-18 843776]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-07 13574144]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-10-07 86016]

"NeroFilterCheck"="c:\program files\Common Files\Nero\Lib\NeroCheck.exe" [2008-02-28 570664]

"NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-02-18 2221352]

"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-29 61440]

"RTHDCPL"="RTHDCPL.EXE" [2008-09-30 c:\windows\RTHDCPL.EXE]

"nwiz"="nwiz.exe" [2008-10-07 c:\windows\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"ShowDeskFix"="shell32" [X]

c:\documents and settings\Petio\Start Menu\Programs\Startup\

Need for SpeedT Undercover Registration.lnk - c:\program files\EA Games\Need for Speed Undercover\Support\EAregister.exe [2008-10-23 4369408]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

FlexType 2K.lnk - c:\program files\Datecs\FlexType 2K\FType2K.exe [2008-10-09 95232]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!saswinlogon]

2008-12-27 15:53 352256 c:\program files\SUPERAntiSpyware\SASWINLO.DLL

[HKLM\~\startupfolder\C:^Documents and Settings^Petio^Start Menu^Programs^Startup^Need for Speed™ Undercover Registration.lnk]

path=c:\documents and settings\Petio\Start Menu\Programs\Startup\Need for Speed™ Undercover Registration.lnk

backup=c:\windows\pss\Need for Speed™ Undercover Registration.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]

--a------ 2008-07-24 17:02 490952 c:\program files\DAEMON Tools Lite\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\WINDOWS\\system32\\usmt\\migwiz.exe"=

"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=

"c:\\Program Files\\uTorrent\\uTorrent.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"d:\\Games\\Deer Hunter Tournament\\DHT.exe"=

"d:\\Games\\Deer Hunter Tournament\\Updater.exe"=

"c:\\Program Files\\Activision\\Spider-Man - Web of Shadows\\image\\pc\\Spider-Man Web of Shadows.exe"=

"c:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"=

"c:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=

"c:\\WINDOWS\\system32\\PnkBstrA.exe"=

"c:\\WINDOWS\\system32\\PnkBstrB.exe"=

"d:\\Games\\fc\\Far Cry 2\\bin\\FarCry2.exe"=

"d:\\Games\\fc\\Far Cry 2\\bin\\FC2Launcher.exe"=

"d:\\Games\\fc\\Far Cry 2\\bin\\FC2Editor.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 sasdifsv;SASDIFSV;\??\c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2008-09-03 8944]

R1 saskutil;SASKUTIL;\??\c:\program files\SUPERAntiSpyware\SASKUTIL.sys [2008-09-03 55024]

R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;"c:\program files\McAfee\SiteAdvisor\McSACore.exe" [2008-10-08 206096]

R3 sasenum;SASENUM;\??\c:\program files\SUPERAntiSpyware\SASENUM.SYS [2008-09-03 7408]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs

UxTuneUp

.

Contents of the 'Scheduled Tasks' folder

2008-12-28 c:\windows\Tasks\1-Click Maintenance.job

- c:\program files\TuneUp Utilities 2008\OneClickStarter.exe [2008-06-20 08:09]

2008-10-08 c:\windows\Tasks\McDefragTask.job

- c:\progra~1\mcafee\mqc\QcConsol.exe [2008-07-09 17:10]

2008-10-08 c:\windows\Tasks\McQcTask.job

- c:\progra~1\mcafee\mqc\QcConsol.exe [2008-07-09 17:10]

.

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.ircdown.com/en/index.php?rvs=hompag&d=79918987

uInternet Settings,ProxyOverride = *.local

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

FF - ProfilePath - c:\documents and settings\Petio\Application Data\Mozilla\Firefox\Profiles\bjoc7deh.default\

FF - component: c:\program files\BS.Player ControlBar\FirefoxDTT\components\BSToolbarFF.dll

FF - component: c:\program files\DAEMON Tools Toolbar\FirefoxDTT\components\DTToolbarFF.dll

FF - component: c:\program files\McAfee\SiteAdvisor\components\McFFPlg.dll

FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll

FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll

FF - plugin: c:\program files\Yahoo!\Common\npyaxmpb.dll

.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-12-28 16:24:12

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(756)

c:\program files\SUPERAntiSpyware\SASWINLO.DLL

c:\windows\system32\Ati2evxx.dll

.

------------------------ Other Running Processes ------------------------

.

c:\windows\system32\ati2evxx.exe

c:\windows\system32\ati2evxx.exe

c:\program files\Bonjour\mDNSResponder.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\progra~1\McAfee\MSC\mcmscsvc.exe

c:\progra~1\COMMON~1\McAfee\MNA\McNASvc.exe

c:\progra~1\COMMON~1\McAfee\McProxy\McProxy.exe

c:\progra~1\McAfee\VIRUSS~1\Mcshield.exe

c:\program files\McAfee\MPF\MpfSrv.exe

c:\program files\McAfee\MSK\msksrver.exe

c:\program files\Nero\Nero8\Nero BackItUp\NBService.exe

c:\windows\system32\IoctlSvc.exe

c:\windows\system32\PnkBstrA.exe

c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

c:\program files\Common Files\Nero\Lib\NMIndexingService.exe

c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

.

**************************************************************************

.

Completion time: 2008-12-28 16:31:11 - machine was rebooted

ComboFix-quarantined-files.txt 2008-12-28 14:31:06

ComboFix2.txt 2008-12-27 14:23:25

Pre-Run: 13,678,563,328 bytes free

Post-Run: 13,594,177,536 bytes free

307 --- E O F --- 2008-12-18 14:00:50

това е от combofix ,а като пусна скан със регсеарч ми се реска компа...

Редактирано 28 декември 200817 г. от SilentScream (преглед на промените)

Знаех, си че Combo няма да ме предаде:

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!


FILE ::

c:\windows\system32\drivers\934c8640.sys

c:\windows\system32\drivers\brorzjo.sys

.


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.


c:\windows\system32\drivers\934c8640.sys


.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.


-------\Service_934c8640

Супер си. Остана само да обновиш дефинициите на MBAM и да сканираш отново с нея. Изчисти след това всички файлове от категорията на програмата Quarantine => Delete all. Изключи отново System Restore и почисти временните файлове с ATF-CLEANER (същите процедури като в миналите постове). Ако можеш архивирай сега папката C:\Qoobox и я качи на удобно за теб място. След това деинсталирай Combofix с командата:

Start => Run => combofix /u

Не се занимавай тогава с RegSearch ...

Предложението ми да замениш McaFee в полза за Avira е още в сила...

Готов си

PS: И имам една последна молба...Можеш ли да ми копираш всички логове от проверките с Malwarebytes' Anti-Malware досега...Намират се в категорията Logs на програмата. Мерси

Както казва и колегата mihnev_sz => ако всички бяха изпълнителни като теб форума щеше да е на много по-високо ниво. За което ти благодаря.

Редактирано 28 декември 200817 г. от B-boy[StyLe] (преглед на промените)

Заразени процеси в паметта: 0

Заразени модули в паметта: 0

Заразени ключове в регистратурата: 0

Заразени стойности в регистратурата: 0

Заразени информационни обекти в регистратурата: 0

Заразени папки: 0

Заразени файлове: 0

Заразени процеси в паметта:

(Нямаше открити заплахи)

Заразени модули в паметта:

(Нямаше открити заплахи)

Заразени ключове в регистратурата:

(Нямаше открити заплахи)

Заразени стойности в регистратурата:

(Нямаше открити заплахи)

Заразени информационни обекти в регистратурата:

(Нямаше открити заплахи)

Заразени папки:

(Нямаше открити заплахи)

Заразени файлове:

(Нямаше открити заплахи)

тва е от мбам

само това има в логовете

а това е тази папка

а,може ли линк да си сваля авира със крак/си ди кей ?

Не ти трябва платената версия. И безплатната ще ти свърши повече работа от McaFee-то...Чудесно конкурира редица комерсиални програми.

А и има тема за промоции...там може би ще намериш и пълната версия на Avira за без пари

http://www.kaldata.com/forums/index.php?showtopic=101309

На дадения от теб лог файла не се вижда важна информация...Като актуализацията на дефинициите...например.

И имах напредвид, всички логове до сега от категорията LOGS на Malwarebytes...Ако може тях да отвориш (един по един) с notepad и да ги запазиш на десктопа с опцията save as.... Даваш им някакви имена (mbam_log1.txt, mbam_log2.txt и т.н.)След това ги вкарай в един архив и го качи някъде.

Това е за последно и повече няма да те тормозя. Обещавам

Редактирано 28 декември 200817 г. от B-boy[StyLe] (преглед на промените)

http://4storing.com/cspum/446e442b65ba57b4...af9fd74315.html

Редактирано 28 декември 200817 г. от SilentScream (преглед на промените)

http://4storing.com/cspum/446e442b65ba57b4...af9fd74315.html

Ако нямаш повече проблеми мисля, че сме готови

Все пак малко имунизация няма да ти навреди:

http://www.kaldata.com/forums/index.php?sh...mp;#entry974317

Приятно сърфиране !

Avira AntiVir Personal

Report file date: 2008-12-29 11:41

Scanning for 1131611 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic

Serial number: 0000149996-ADJIE-0001

Platform: Windows XP

Windows version: (Service Pack 3) [5.1.2600]

Boot mode: Normally booted

Username: SYSTEM

Computer name: PETIO-86439A3F8

Version information:

BUILD.DAT : 8.2.0.337 16934 Bytes 2008-11-18 13:05:00

AVSCAN.EXE : 8.1.4.10 315649 Bytes 2008-11-18 07:21:26

AVSCAN.DLL : 8.1.4.0 40705 Bytes 2008-05-26 06:56:40

LUKE.DLL : 8.1.4.5 164097 Bytes 2008-06-12 11:44:19

LUKERES.DLL : 8.1.4.0 12033 Bytes 2008-05-26 06:58:52

ANTIVIR0.VDF : 7.1.0.0 15603712 Bytes 2008-10-27 10:30:36

ANTIVIR1.VDF : 7.1.1.33 1705984 Bytes 2008-12-24 09:26:48

ANTIVIR2.VDF : 7.1.1.34 2048 Bytes 2008-12-24 09:26:48

ANTIVIR3.VDF : 7.1.1.43 176128 Bytes 2008-12-29 09:26:49

Engineversion : 8.2.0.45

AEVDF.DLL : 8.1.0.6 102772 Bytes 2008-10-14 09:05:56

AESCRIPT.DLL : 8.1.1.19 336252 Bytes 2008-12-29 09:26:56

AESCN.DLL : 8.1.1.5 123251 Bytes 2008-11-07 14:06:41

AERDL.DLL : 8.1.1.3 438645 Bytes 2008-11-04 12:58:38

AEPACK.DLL : 8.1.3.4 393591 Bytes 2008-11-11 08:41:39

AEOFFICE.DLL : 8.1.0.33 196987 Bytes 2008-12-29 09:26:55

AEHEUR.DLL : 8.1.0.75 1524087 Bytes 2008-12-29 09:26:54

AEHELP.DLL : 8.1.2.0 119159 Bytes 2008-12-29 09:26:51

AEGEN.DLL : 8.1.1.8 323956 Bytes 2008-12-29 09:26:51

AEEMU.DLL : 8.1.0.9 393588 Bytes 2008-10-14 09:05:56

AECORE.DLL : 8.1.5.2 172405 Bytes 2008-12-29 09:26:50

AEBB.DLL : 8.1.0.3 53618 Bytes 2008-10-14 09:05:56

AVWINLL.DLL : 1.0.0.12 15105 Bytes 2008-07-09 07:40:05

AVPREF.DLL : 8.0.2.0 38657 Bytes 2008-05-16 08:28:01

AVREP.DLL : 8.0.0.2 98344 Bytes 2008-07-31 11:02:15

AVREG.DLL : 8.0.0.1 33537 Bytes 2008-05-09 10:26:40

AVARKT.DLL : 1.0.0.23 307457 Bytes 2008-02-12 07:29:23

AVEVTLOG.DLL : 8.0.0.16 119041 Bytes 2008-06-12 11:27:49

SQLITE3.DLL : 3.3.17.1 339968 Bytes 2008-01-22 16:28:02

SMTPLIB.DLL : 1.2.0.23 28929 Bytes 2008-06-12 11:49:40

NETNT.DLL : 8.0.0.1 7937 Bytes 2008-01-25 11:05:10

RCIMAGE.DLL : 8.0.0.51 2371841 Bytes 2008-06-12 12:48:07

RCTEXT.DLL : 8.0.52.0 86273 Bytes 2008-06-27 12:34:37

Configuration settings for the scan:

Jobname..........................: Complete system scan

Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp

Logging..........................: low

Primary action...................: delete

Secondary action.................: ignore

Scan master boot sector..........: on

Scan boot sector.................: on

Boot sectors.....................: C:, D:,

Process scan.....................: on

Scan registry....................: on

Search for rootkits..............: on

Scan all files...................: All files

Scan archives....................: on

Recursion depth..................: 99

Smart extensions.................: on

Deviating archive types..........: +BSD Mailbox, +Netscape/Mozilla Mailbox, +Eudora Mailbox, +Squid cache, +Pegasus Mailbox, +MS Outlook Mailbox,

Macro heuristic..................: on

File heuristic...................: high

Deviating risk categories........: +APPL,+GAME,+JOKE,+PCK,+SPR,

Start of the scan: 2008-12-29 11:41

Starting search for hidden objects.

'45204' objects were checked, '0' hidden objects were found.

The scan of running processes will be started

Scan process 'avscan.exe' - '1' Module(s) have been scanned

Scan process 'winamp.exe' - '1' Module(s) have been scanned

Scan process 'avgnt.exe' - '1' Module(s) have been scanned

Scan process 'firefox.exe' - '1' Module(s) have been scanned

Scan process 'avguard.exe' - '1' Module(s) have been scanned

Scan process 'sched.exe' - '1' Module(s) have been scanned

Scan process 'CCC.exe' - '1' Module(s) have been scanned

Scan process 'NMIndexingService.exe' - '1' Module(s) have been scanned

Scan process 'FType2K.exe' - '1' Module(s) have been scanned

Scan process 'alg.exe' - '1' Module(s) have been scanned

Scan process 'SUPERANTISPYWARE.EXE' - '1' Module(s) have been scanned

Scan process 'daemon.exe' - '1' Module(s) have been scanned

Scan process 'NMIndexStoreSvr.exe' - '1' Module(s) have been scanned

Scan process 'ctfmon.exe' - '1' Module(s) have been scanned

Scan process 'MOM.exe' - '1' Module(s) have been scanned

Scan process 'vsnpstd3.exe' - '1' Module(s) have been scanned

Scan process 'tsnpstd3.exe' - '1' Module(s) have been scanned

Scan process 'jusched.exe' - '1' Module(s) have been scanned

Scan process 'RTHDCPL.EXE' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'PnkBstrA.exe' - '1' Module(s) have been scanned

Scan process 'IoctlSvc.exe' - '1' Module(s) have been scanned

Scan process 'explorer.exe' - '1' Module(s) have been scanned

Scan process 'NBService.exe' - '1' Module(s) have been scanned

Scan process 'jqs.exe' - '1' Module(s) have been scanned

Scan process 'mDNSResponder.exe' - '1' Module(s) have been scanned

Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned

Scan process 'spoolsv.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned

Scan process 'lsass.exe' - '1' Module(s) have been scanned

Scan process 'services.exe' - '1' Module(s) have been scanned

Scan process 'winlogon.exe' - '1' Module(s) have been scanned

Scan process 'csrss.exe' - '1' Module(s) have been scanned

Scan process 'smss.exe' - '1' Module(s) have been scanned

39 processes with 39 modules were scanned

Starting master boot sector scan:

Master boot sector HD0

[iNFO] No virus was found!

Start scanning boot sectors:

Boot sector 'C:\'

[iNFO] No virus was found!

Boot sector 'D:\'

[iNFO] No virus was found!

Starting to scan the registry.

The registry was scanned ( '63' files ).

Starting the file scan:

Begin scan in 'C:\'

C:\pagefile.sys

[WARNING] The file could not be opened!

C:\Combofix\hidec.exe

[DETECTION] Contains recognition pattern of the SPR/Tool.Hide.A program

[NOTE] A backup was created as '49bc9c35.qua' ( QUARANTINE )

[NOTE] The file was deleted!

C:\Combofix\NirCmd.cfexe

[DETECTION] Contains recognition pattern of the APPL/NirCmd.E.2.B application

[NOTE] A backup was created as '49ca9c36.qua' ( QUARANTINE )

[NOTE] The file was deleted!

C:\Combofix\nircmd.com

[DETECTION] Contains recognition pattern of the APPL/NirCmd.E.2.B application

[NOTE] A backup was created as '484a9797.qua' ( QUARANTINE )

[NOTE] The file was deleted!

C:\Combofix\NirCmdC.cfexe

[DETECTION] Contains recognition pattern of the APPL/NirCmd.E.1.B application

[NOTE] A backup was created as '49ca9c38.qua' ( QUARANTINE )

[NOTE] The file was deleted!

C:\Hellothere\nircmd.com

[DETECTION] Contains recognition pattern of the APPL/NirCmd.E.2.B application

[NOTE] A backup was created as '49ca9dd1.qua' ( QUARANTINE )

[NOTE] The file was deleted!

C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\934c8640.sys.vir

[DETECTION] Is the TR/Rootkit.Gen Trojan

[NOTE] A backup was created as '498ca7ad.qua' ( QUARANTINE )

[NOTE] The file was deleted!

C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\_934c8640_.sys.zip

[0] Archive type: ZIP

--> 934c8640.sys

[DETECTION] Is the TR/Rootkit.Gen Trojan

[NOTE] A backup was created as '498ba7b3.qua' ( QUARANTINE )

[NOTE] The file was deleted!

C:\System Volume Information\_restore{60962BE4-C608-404F-B4A5-C4BE261CEEE1}\RP2\A0002042.sys

[DETECTION] Is the TR/Rootkit.Gen Trojan

[NOTE] A backup was created as '4988a7ae.qua' ( QUARANTINE )

[NOTE] The file was deleted!

C:\System Volume Information\_restore{60962BE4-C608-404F-B4A5-C4BE261CEEE1}\RP2\A0002071.exe

[DETECTION] Contains recognition pattern of the SPR/Tool.Hide.A program

[NOTE] A backup was created as '480a2b67.qua' ( QUARANTINE )

[NOTE] The file was deleted!

C:\System Volume Information\_restore{60962BE4-C608-404F-B4A5-C4BE261CEEE1}\RP2\A0002079.com

[DETECTION] Contains recognition pattern of the APPL/NirCmd.E.2.B application

[NOTE] A backup was created as '4988a7af.qua' ( QUARANTINE )

[NOTE] The file was deleted!

C:\System Volume Information\_restore{60962BE4-C608-404F-B4A5-C4BE261CEEE1}\RP2\A0002138.exe

[0] Archive type: RAR SFX (self extracting)

--> keygen.exe

[DETECTION] Is the TR/Monder.afor Trojan

--> crack.exe

[DETECTION] Is the TR/Dldr.Agent.axba Trojan

--> install.exe

[DETECTION] Is the TR/Downloader.Gen Trojan

[NOTE] A backup was created as '4988a7b2.qua' ( QUARANTINE )

[NOTE] The file was deleted!

C:\System Volume Information\_restore{60962BE4-C608-404F-B4A5-C4BE261CEEE1}\RP2\A0002148.exe

[DETECTION] Contains recognition pattern of the APPL/NirCmd.E.2.B application

[NOTE] A backup was created as '4988a7b3.qua' ( QUARANTINE )

[NOTE] The file was deleted!

C:\System Volume Information\_restore{60962BE4-C608-404F-B4A5-C4BE261CEEE1}\RP2\A0002149.exe

[0] Archive type: RAR SFX (self extracting)

--> 32788R22FWJFW\hidec.exe

[DETECTION] Contains recognition pattern of the SPR/Tool.Hide.A program

--> 32788R22FWJFW\NirCmd.cfexe

[DETECTION] Contains recognition pattern of the APPL/NirCmd.E.2.B application

--> 32788R22FWJFW\nircmd.com

[DETECTION] Contains recognition pattern of the APPL/NirCmd.E.2.B application

--> 32788R22FWJFW\NirCmdC.cfexe

[DETECTION] Contains recognition pattern of the APPL/NirCmd.E.1.B application

--> 32788R22FWJFW\psexec.cfexe

[1] Archive type: RSRC

--> Object

[DETECTION] Contains recognition pattern of the APPL/PsExec.E application

[NOTE] A backup was created as '4988a7b5.qua' ( QUARANTINE )

[NOTE] The file was deleted!

C:\System Volume Information\_restore{60962BE4-C608-404F-B4A5-C4BE261CEEE1}\RP3\A0002817.exe

[DETECTION] Contains recognition pattern of the SPR/Tool.Hide.A program

[NOTE] A backup was created as '4988a7c4.qua' ( QUARANTINE )

[NOTE] The file was deleted!

C:\System Volume Information\_restore{60962BE4-C608-404F-B4A5-C4BE261CEEE1}\RP3\A0002818.com

[DETECTION] Contains recognition pattern of the APPL/NirCmd.E.2.B application

[NOTE] A backup was created as '480a2b0d.qua' ( QUARANTINE )

[NOTE] The file was deleted!

C:\System Volume Information\_restore{60962BE4-C608-404F-B4A5-C4BE261CEEE1}\RP3\A0002819.exe

[DETECTION] Contains recognition pattern of the APPL/NirCmd.E.2.B application

[NOTE] A backup was created as '4988a7c6.qua' ( QUARANTINE )

[NOTE] The file was deleted!

C:\System Volume Information\_restore{60962BE4-C608-404F-B4A5-C4BE261CEEE1}\RP3\A0002820.com

[DETECTION] Contains recognition pattern of the APPL/NirCmd.E.2.B application

[NOTE] A backup was created as '480a2b0f.qua' ( QUARANTINE )

[NOTE] The file was deleted!

C:\WINDOWS\system32\drivers\sptd.sys

[WARNING] The file could not be opened!

Begin scan in 'D:\'

End of the scan: 2008-12-29 13:12

Used time: 1:31:29 Hour(s)

The scan has been done completely.

7961 Scanning directories

535520 Files were scanned

23 viruses and/or unwanted programs were found

0 Files were classified as suspicious:

17 files were deleted

0 files were repaired

17 files were moved to quarantine

0 files were renamed

2 Files cannot be scanned

535495 Files not concerned

2622 Archives were scanned

2 Warnings

17 Notes

45204 Objects were scanned with rootkit scan

0 Hidden objects were found

това е от авирата

Avira те е почистила много добре. Вече може да се каже, че си чист.

Браво на B-Boy

Благодаря б-бой :Р

Сложих и WoT

Само, че пак си пуснал този System Restore...

Изключи го и го почисти хубавичко...

Вече можеш да изтриеш и папката C:\Qoobox

Файловете и логовете създадени от The_Avenger

Изтеглената програма - RegSearch и изобщо всички с които сме работили.

Накрая вземи използвай CCleaner и забърши всичко без следните няколко отметки:

Почисти и регистрите, като те попита дали искаш да направиш backup, можеш да избереш NO, след това Fix ALL selected issues:

С цел малка оптимизация можеш да дадеш един последен лог от по-новата версия на HijackThis 2.0.2

system restore е спрян ???

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 14:28, on 2008-12-29

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.20935)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\IoctlSvc.exe

C:\WINDOWS\system32\PnkBstrA.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Program Files\Java\jre6\bin\jusched.exe

C:\WINDOWS\tsnpstd3.exe

C:\WINDOWS\vsnpstd3.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe

C:\Program Files\DAEMON Tools Lite\daemon.exe

C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

C:\Program Files\Datecs\FlexType 2K\FType2K.exe

C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ircdown.com/en/index.php?rvs=ho...&d=79918987

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: Yahoo! Toolbar Helper - {02478d38-c3f9-4efb-9b51-7695eca05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: Java Plug-In SSV Helper - {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - C:\Program Files\Java\jre6\bin\ssv.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl Class - {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: BS.Player ControlBar - {2C688203-7EB3-4327-9995-1CB417BA23F9} - C:\Program Files\BS.Player ControlBar\BSToolbar.dll

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [tsnpstd3] C:\WINDOWS\tsnpstd3.exe

O4 - HKLM\..\Run: [snpstd3] C:\WINDOWS\vsnpstd3.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe

O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"

O4 - HKLM\..\Run: [startCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - HKCU\..\Run: [skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [indxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020

O4 - HKCU\..\Run: [Comrade.exe] C:\Program Files\GameSpy\Comrade\Comrade.exe

O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun

O4 - HKCU\..\Run: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

O4 - HKUS\S-1-5-18\..\RunOnce: [showDeskFix] regsvr32 /s /n /i:u shell32 (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\RunOnce: [showDeskFix] regsvr32 /s /n /i:u shell32 (User 'Default user')

O4 - Startup: Need for Speed™ Undercover Registration.lnk = C:\Program Files\EA Games\Need for Speed Undercover\Support\EAregister.exe

O4 - Global Startup: FlexType 2K.lnk = C:\Program Files\Datecs\FlexType 2K\FType2K.exe

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra button: (no name) - cmdmapping - (no file) (HKCU)

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O20 - Winlogon Notify: !saswinlogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL

O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe

O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe

O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

--

End of file - 7932 bytes

Незнам колко е спрян, но половината от заразите намерени от Avira бяха или файловете на Combofix или зарази в System_Volume_Information <(демек System Restore)>.

1. Ами можеш да деинсталираш тези:

YahooToolbar

BSToolbar => незнам дали BSPlayer да спре да работи без него. Ако си свикнал с този плеър и не искаш да го сменяш с (Gom, KMPlayer, MEdia Player Classic HomeCinema) не го барай...

Увери се, че разполагаш с последната версия на Java:

2. Изтегли JavaRa за да почистиш евентуално остарялата версия на Java.

3.1 Стартирай JavaRa.exe

3.2 От падащото меню избери English и натисни Select.

3.3 Натисни YES, при появата на диалогов прозорец.

3.4 Избери Remove Older Versions.

За нова версия на платформата:

http://www.kaldata.com/comments.php?id=396...;highlight=java

3. Изтегли си StartUpLite и премахни с него излишните неща стартиращи с Windows.

Лично за мен това са следните редове.

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE => не правя настройки на звука, стига ми и високо-говорителя на Windows-a

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install => Ати и nVIDIA на една машина или си сменял картата и са останали и драйверите на nVIDIA - ако да направо ги деинсталирай от Control Panel-a => Аdd/remove programs...

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit => Ати и nVIDIA на една машина или си сменял картата и са останали и драйверите на nVIDIA - ако да направо ги деинсталирай от Control Panel-a => Аdd/remove programs...

O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"

O4 - HKCU\..\Run: [indxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020

O4 - HKCU\..\Run: [Comrade.exe] C:\Program Files\GameSpy\Comrade\Comrade.exe => ако не си сигурен дали е безопастна, направо я деинсталирай...Аз не съм голям геймър и незнам...аз и punkbuster-a бих махнал, но явно ти трябва за да играеш онлайн...

O4 - HKUS\S-1-5-18\..\RunOnce: [showDeskFix] regsvr32 /s /n /i:u shell32 (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\RunOnce: [showDeskFix] regsvr32 /s /n /i:u shell32 (User 'Default user')

O9 - Extra button: (no name) - cmdmapping - (no file) (HKCU)

Можеш да стартираш Hijackthis и да избереш опцията : Do a system scan only. След това сложи отметки пред по-горните редове (последните 3 със сигурност можеш да маркираш) и да избереш Fix Checked.

4. Можеш да спреш някои излишни услуги:

Start => Run => напиши services.msc => Enter

Сега от списъка стартирай следните редове с двукратен клик на мишката и избери Disabled (от падащото меню).

Ati HotKey Poller

ATI Smart

Nero BackItUp Scheduler 3

NMIndexingService

Редактирано 29 декември 200817 г. от B-boy[StyLe] (преглед на промените)

готово ,махнах нвидиа драйвърите ( преди 3дни си сложих новата видеокарта от подписа ми и забравих да ги махна :Д ) ,махнах излишните раоти при старта и някой други екстри :Р

Днеска както си ровех в нета за разни програмки (през чичко google разбира се) ми се лепна нещо много странно. При кликане на произволна папка в някой от дяловете на харда и не всеки път ми изкарва прозорец като за системна грешка на операционната система, озаглавен WARNING! VIRUS DETECTED! и отдолу в прозорещ има текст, оказващ, коя антивирусна трябва да се изтегли и да се инсталира. Под текста следват два бутона Yes и No. И това е. Който и от двата да се натисне все се зарежда IE или друг браузър и се стартира някакъв on-line скенер (http://webfreescan.cn/id/4912933/3/1/) , който уж сканира компютъра за вирус. Пробвах с няколко антивирусни (NOD 32, Smart Security, Malware), но май нищо не се получава.

Питането ми е как може да се премеахне такова чудо от машината?!

Благодаря предварително за помощта!!!

Редактирано 3 януари 200917 г. от stanley56 (преглед на промените)

Днеска както си ровех в нета за разни програмки (през чичко google разбира се) ми се лепна нещо много странно. При кликане на произволна папка в някой от дяловете на харда и не всеки път ми изкарва прозорец като за системна грешка на операционната система, озаглавен WARNING! VIRUS DETECTED! и отдолу в прозорещ има текст, оказващ, коя антивирусна трябва да се изтегли и да се инсталира. Под текста следват два бутона Yes и No. И това е. Който и от двата да се натисне все се зарежда IE или друг браузър и се стартира някакъв on-line скенер (http://webfreescan.cn/id/4912933/3/1/) , който уж сканира компютъра за вирус. Пробвах с няколко антивирусни (NOD 32, Smart Security, Malware), но май нищо не се получава.

Питането ми е как може да се премеахне такова чудо от машината?!

Благодаря предварително за помощта!!!

http://www.destroy-malware.com/2008/12/14/...-removal-guide/

На Запад, хората използват за тази цел програмата USB Disc Security.

Официален сайт: http://www.zbshareware.com

Знам, че официалния сайт изглежда, като официалните на програмите мошеници, но тя не е такава.

За доказателство: Virustotal

The USB Disk Security application will provide protection against any malicious programs trying to attack via USB drive. Compare USB Disk Security against other antivirus solutions, you will find out its highlights: USB Disk Security provides 100% protection against any threats via USB drive, however, the majority of other products are unable even to guarantee 90% protection.

USB Disk Security is the best antivirus software to permanently protect offline computer without the need for signature updates, but other antivirus software should update signature database regularly, and they cannot effectively protect offline computer.

This light and easy to use solution is 100% compatible with all software and doesn't slow down your computer at all. You pay USB Disk Security once and get it all, however, other antivirus products should be paid for updates every year.

Дали наистина предлага 100% защита от AutoRun вируси? Аз нямам представа, защото не съм го пробвал, но американците много го хвалят. Ако желаете, можете да го изпробвате.

Безплатната алтернатива на USB Disc Security се казва DriveSentry.

За повече информация:

http://www.kaldata.com/forums/index.php?sh...;hl=drivesentry

Редактирано 30 декември 200817 г. от Fixer (преглед на промените)

След има няма 10-11 чьсь постоянно търчене и нерви, почти оправих компютъра си от проклетите вируси (4 антивирусни, 5 сканера и 3 допълнитемни програмки + 4 спайуаре скенери). Пуснах HiJack This , сканирах лога на сайта им и ми изкара RapidBlaster. Прочетох за него и за премахването му.

Представя се като Spyware Guard 2008. Таа - поиграх си леекичко с регистрите му (изтрих ги направо де). Проблема, е че каквото и да пускам срещу него, той пак се връща. Не мога да му намеря длл файловете, за да го огранича. И като бонус ми показва и фалшив панел за защита (контрол панел).

Някакви идеи, какво да търся и къде да трия, за да го унищожа.

ПС: В момента съм го блокирал чрез Spyware Doctor.

Благодаря Предварително !

Изтеглете ESET SysInspector

http://www.eset.bg/download/sysinspector.html

- Стартирайте програмата чрез SysInspector.exe

Програмата ще започне да събира информация за ситуацията на машината Ви.

- Когато "Инспекторът" е готов и log файлът - генериран , изберете File > Save Log

- Потвърдете желанието си

Изберете да запазите файла някъде и след това го прикачете в:

http://www.4storing.com

И дайте линк.

Междувременно бихте ли изброили програмите, с които сте сканирали?

Естествено !

Ето списък на използваните от мен до сега програми:

Spy Hunter, Spyware Terminator, Simple machine (kaldata), avast, nod 32, ccleaner, Ad-adware.

Това е лога от есет-скана !

http://4storing.com/d1d2m/eaea7de6a6329aff...6aef82b6dc.html

Ако Ви трябва нещо друго, питайте !

Открих източниците на проблемите Ви, само искам да ми прикачите в 4storing следните файлове:

e:\windows\system32\winscenter.exe

e:\windows\system32\webcheck.dll

e:\documents and settings\all users\application data\microsoft\internet explorer\dlls\iemodule.dll

e:\documents and settings\all users\application data\microsoft\internet explorer\dlls\bvnrhwnxyh.dll

e:\documents and settings\nitr0o\desktop\proekti\gta sa mod\menace_westcoastcustomsshopmod\westcoast customs shop mod v.2 by menace\img_tool_v.2.exe

e:\windows\system32\drivers\ati8bhxx.sys

След това ще Ви обясня как да решите проблемите си.

http://4storing.com/wczqh/be0bb24cc0262379...e4f7a443b1.html - winscenter

http://4storing.com/reblf/bf8654bfe12fe6b1...36bf501ea3.html - webcheck

http://4storing.com/ya3u6/4fd0bea1da1082a8...c070e83a61.html - iemodule

http://4storing.com/xzmgi/3703a968135d06a4...11a015f3d9.html - bvnrhwnxyh.dll

http://4storing.com/jdaq5/822b9e468d843f92...6df5328cba.html - IMGtool (това е програма за модифициране на играта Grand Theft Auto San Andreas)

ati8bhxx.sys - няма такъв файл ?!? (пробвах и със Search, такъв файл просто не съществува)

Съжарявам за забавянето, то е причинено от вирусната ситуация !

Изтегли The Avenger

http://swandog46.geekstogo.com/avenger.zip

1. Разархивирай The Avenger в негова собствена папка

2. Изтеглете скрипт файла за програмата от:

http://4storing.com/recpf/f3c5bd5d41036bca...603dcd1823.html

3. Стартирай exe файла на The Avenger

4. Избери Load script и посочи пълният път до script.txt

5. Избери бутона "Execute". Това ще задейства The Avenger

Потвърди рестарт на машината , когато бъдеш попитан за това. След рестартиране , опасните файлове би трябвало да са елиминирани. След рестартиране , The Avenger ще изскочи с един текстов файл . Моля , копирай цялото му съдържание в отговор на този post. Така ние ще можем да проследим какво е свършила програмата.

П.П.: Не се притеснявай ще те изчакам колко е необходимо, стига да не е до вечерта, защото купона предстои

Редактирано 31 декември 200817 г. от Fixer (преглед на промените)

Този драйвер най-вероятно е скрит...За да го намериш ще се наложи да включиш показването на скритите системни файлове:

Start => Run => напиши control folders => View =>

Сложи отметка пред:

Show hidden files and folders

Махни отметката пред:

Hide protected operating system files (recommended)

И избери Apply.

Пробвай пак да го намериш. Ако отново лиспва използвай GMER (най-вероятно е скрит за Windows API => и не се вижда през Windows explorer).

http://www.kaldata.com/forums/index.php?s=...t&p=1221649

Редактирано 31 декември 200817 г. от B-boy[StyLe] (преглед на промените)

http://4storing.com/6v6z0/3c53ea2dd54f9865...a5e644d422.html

Не знам как да ти благодаря!

Няма го, излязох от дупката (стигнах я до сини екрани и грешки в паметта при всяко пускане на ехе файлове) !

Много, много, мнооого благодаря !

Дано да си (не е проблем 2-рото лице, нали)прекараш чудесно купона довечера .

B-boy[styLe]

Да проверих за отметката за скрити файлове, първо там проверих.

Благодаря на всички !

(пускам Spyware doctor и reg cure да оправят пораженията , нали това е добра идея ?)

Не, всъщност не сме приключили до тук. Имаме опасения с колегата, че проблема е по-сериозен, а и има още за доправяне.

Изтрили са се всички без това драйверче. Нека ползваме MalwareBytes:

1. Изтегли: MalwareBytes' Anti-Malware

2. Инсталирайте го.

3. Кликвате на иконата ”Malwarebytes’ Anti-Malware”.Първото и най-важно нещо е да отидете в категорията ”Update” и да изберете бутончето ”Check For Updates”.

4. След това се насочете към секцията ”Scanner” и изберете опцията ”Perform full scan” (особено ако за първи път стартирате приложението.Щраквате на бутончето ”Scan”, посочвате кои дялове ма компютъра да бъдат проверени.Можете да маркирате и само дяла на който е инсталирана Операционната Система и натискате ”Start Scan”.

5. След края на проверката ще получите или съобщение, че вредители не са намерени или ще получите възможност да ги маркирате и изтриете.

6. Най-накрая ще получите лог файл с извършените процедури. Моля, копирайте го и го поставете тук, за да видим какво е станало.

П.П.: Софтуерът, който си използвал, за да решиш проблемите си е възможно най-големия боклук с изключение на NOD32 и Avast, но NOD32 си му сложил и Fix, което го е провалило. Не разчитай на тези програми.

Редактирано 31 декември 200817 г. от Fixer (преглед на промените)