Проблем с отварането на папки D,G,H,I ,др.. [РЕШЕН]

s.feradov · Юни 6, 2013

До края на деня би трябвало колегата да пише в темата.

samsonite · Юни 7, 2013

Г-н Ферадов.....Днеска е петък,колегата да не е запразнил от вчера вече и да не влезе до Понеделник :)

B-boy/StyLe/ · Юни 8, 2013

Здравейте,

Нека да започнем така:

СТЪПКА 1 - Спрете Autorun функцията.

Изтеглете и стартирайте следния файл http://support.microsoft.com/library/images/support/EN-US/Button_FixIt_Silver.jpg
Стартирайте го и се съгласете с лицензионното споразумение.
Натиснете Next и изчакайте да си свърпи работата.
Рестартирайте системата ако се наложи.

СТЪПКА 2 - Сканирайте със специализиран инструмент.

1. Изтеглете ComboFix от BleepingComputer и го запазете (бутон Save -> Save as) ComboFix на вашия десктоп:
http://i46.tinypic.com/2exprgh.jpg

След приключване на изтеглянето на ComboFix, иконката на програмата би трябвало да изглежда така:
http://i46.tinypic.com/29eqjuq.jpg

2.Затворете всички работещи приложения, отворени прозорци и програми работещи във фонов режим. Спрете временно защитата в реално време на антивирусната програма и на другите програми за сигурност, ако има такива.

3. Стартирайте с двоен клик Combofix.exe. Изберете YES, за да се съгласите с условията за използване на програмата. Важно: По време на работата на ComboFix не бива да се движи мишката и да се натискат клавиши от клавиатурата. Просто търпеливо оставете ComboFix да си свърши работата, без да използвате компютъра за други цели.

4. Ако получите предупреждение от UAC, съгласете се.

5 ComboFix ще спре временно Интернет връзката, но след като приключи работата на програмата тази връзка ще бъде възстановена автоматично. ComboFix ще сканира за проблеми и за заразени файлове, като това може да отнеме известно време. Моля да бъдете търпеливи. Ако има проблем с Интернет връзката след приключване на работата на Combofix, моля да прочетете това: Manually restoring the Internet connection section.

6 Когато работата на ComboFix приключи, ще се появи текстов документ (log) в Notepad:
http://i49.tinypic.com/157m978.jpg

Копирайте с (Copy) и поставете с (Paste) съдържанието на лога в следващия си коментар.

Забележка: Ако се появи следното съобщение при отварянето на различни програми след завършване на сканирането с Combofix - "illegal operation on a registry key that has been marked for deletion." просто рестартирайте компютъра още веднъж и то ще изчезне.

По време на сканирането не използвайте компютъра си !

samsonite · Юни 8, 2013

Добър ден,за да сваля тия две програми ще трябва да го направя през ubuntu,нали!? Как да спра autorun!?.В момента не съм си вкъщи,няма да мога да направя нищо.

B-boy/StyLe/ · Юни 8, 2013

Защо през Ubuntu? Нали при работа със системния дял C:\ няма проблеми?

И Autorun-a се спира след стартирането на инструмента в стъпка 1, мисля че е обяснено добре.

samsonite · Юни 9, 2013

Добър ден !!!

С първа стъпка нямах проблеми,всичко Ок.....

С втора стъпка след пускане на ComboFix излезнаха 3 прозореца....

1.Еrror You do not appear to be connected to the internet:Kindly connect before clicking "ok"

2.Error Failed to download required files.Aborting..... Shall continue scanning for malware ок

3.Rootkit ComboFix has detected the presence of rootkit activity and needs to reboot the machine

и това беше...Само да поясня,че програмите ги свалих през ubuntu ,защото нямам интернет връзка в Windows също така и usb-та не ги разпознава системата.Единствения начин да сваля някакъв файл на Pc-то е през ubuntu

samsonite · Юни 9, 2013

Значи като се рестартира компютъра след ComboFix ,мислех че програма е свършила работа и спрях Pc-то.Обаче сега го пуснах и ComboFix продължи да сканира и това е резултата.........

ComboFix 13-06-08.01 - User 06.2013 г. 15:43:58.1.2 - x86

Running from: c:\documents and settings\User\Escritorio\ComboFix.exe

.

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\All Users\Datos de programa\1339863827.bdinstall.bin

c:\documents and settings\All Users\Datos de programa\1339863975.bdinstall.bin

c:\documents and settings\All Users\Datos de programa\1339864170.bdinstall.bin

c:\documents and settings\All Users\Datos de programa\1344610344.bdinstall.bin

c:\documents and settings\All Users\Datos de programa\1344614511.bdinstall.bin

c:\documents and settings\All Users\Datos de programa\1344617386.bdinstall.bin

c:\documents and settings\All Users\Datos de programa\1346960952.bdinstall.bin

c:\documents and settings\All Users\Datos de programa\1347211660.bdinstall.bin

c:\documents and settings\All Users\Datos de programa\1347211676.4400.bin

c:\documents and settings\All Users\Datos de programa\1347211676.468.bin

c:\documents and settings\All Users\Datos de programa\1347211676.5420.bin

c:\documents and settings\All Users\Datos de programa\1347211676.5728.bin

c:\documents and settings\All Users\Datos de programa\1347214011.bdinstall.bin

c:\documents and settings\All Users\Datos de programa\1347214130.bdinstall.bin

c:\documents and settings\All Users\Datos de programa\mazuki.dll

c:\documents and settings\All Users\Datos de programa\TEMP

c:\documents and settings\User\Datos de programa\Toolbar4

c:\documents and settings\User\Datos de programa\Toolbar4\{338B4DFE-2E2C-4338-9E41-E176D497299E}\cache\009ad7c78fa16405f84086fbb252845c

c:\documents and settings\User\Datos de programa\Toolbar4\{338B4DFE-2E2C-4338-9E41-E176D497299E}\cache\0404edbd589ae6af09ac9759b8ba03aa

c:\documents and settings\User\Datos de programa\Toolbar4\{338B4DFE-2E2C-4338-9E41-E176D497299E}\cache\0f274b8992fdb64d5e4f1f83668eeee7

c:\documents and settings\User\Datos de programa\Toolbar4\{338B4DFE-2E2C-4338-9E41-E176D497299E}\cache\1aad34453450f3be3dcf8f495ba7c0f2

c:\documents and settings\User\Datos de programa\Toolbar4\{338B4DFE-2E2C-4338-9E41-E176D497299E}\cache\27c746d432b7a753a0af8d7c033b46fe

c:\documents and settings\User\Datos de programa\Toolbar4\{338B4DFE-2E2C-4338-9E41-E176D497299E}\cache\3191c436badf4725efbdf2814434db76

c:\documents and settings\User\Datos de programa\Toolbar4\{338B4DFE-2E2C-4338-9E41-E176D497299E}\cache\44567846e0387d6a62062ab4dbf9ae96

c:\documents and settings\User\Datos de programa\Toolbar4\{338B4DFE-2E2C-4338-9E41-E176D497299E}\cache\4f25c35c815b9d92e42119c9e0d533cc

c:\documents and settings\User\Datos de programa\Toolbar4\{338B4DFE-2E2C-4338-9E41-E176D497299E}\cache\52b66d6979ef2abcea9a736d1b4dbc82

c:\documents and settings\User\Datos de programa\Toolbar4\{338B4DFE-2E2C-4338-9E41-E176D497299E}\cache\5d25dd004ed9512e16e1d76d6deb2a6c

c:\documents and settings\User\Datos de programa\Toolbar4\{338B4DFE-2E2C-4338-9E41-E176D497299E}\cache\757a20d7a75ae93435ac64a6095eab39

c:\documents and settings\User\Datos de programa\Toolbar4\{338B4DFE-2E2C-4338-9E41-E176D497299E}\cache\817e818f50b0554f0006b4c9f4da11e6

c:\documents and settings\User\Datos de programa\Toolbar4\{338B4DFE-2E2C-4338-9E41-E176D497299E}\cache\89c35566d3dfdce78572ff8c2a627ad2

c:\documents and settings\User\Datos de programa\Toolbar4\{338B4DFE-2E2C-4338-9E41-E176D497299E}\cache\8d7129d91fe9f4f63cdc5db9c5b4ccd4

c:\documents and settings\User\Datos de programa\Toolbar4\{338B4DFE-2E2C-4338-9E41-E176D497299E}\cache\9840cd5f73490a37d4f3e47107ced675

c:\documents and settings\User\Datos de programa\Toolbar4\{338B4DFE-2E2C-4338-9E41-E176D497299E}\cache\9d810aab3f7bcbacb07c241f8d726714

c:\documents and settings\User\Datos de programa\Toolbar4\{338B4DFE-2E2C-4338-9E41-E176D497299E}\cache\9e43b23ad10de3e0eceb370efafb39ef

c:\documents and settings\User\Datos de programa\Toolbar4\{338B4DFE-2E2C-4338-9E41-E176D497299E}\cache\acfc834035dccfb94e7f9067f5d48a83

c:\documents and settings\User\Datos de programa\Toolbar4\{338B4DFE-2E2C-4338-9E41-E176D497299E}\cache\b801583e8861fc45946de3f28fe5bb04

c:\documents and settings\User\Datos de programa\Toolbar4\{338B4DFE-2E2C-4338-9E41-E176D497299E}\cache\bbd70e0c6a27130f40bc8806e5252b76

c:\documents and settings\User\Datos de programa\Toolbar4\{338B4DFE-2E2C-4338-9E41-E176D497299E}\cache\bdcf0ed363b85538f740c9b718bf611c

c:\documents and settings\User\Datos de programa\Toolbar4\{338B4DFE-2E2C-4338-9E41-E176D497299E}\cache\c594d37e13c887da6ddc9975fa9aae82

c:\documents and settings\User\Datos de programa\Toolbar4\{338B4DFE-2E2C-4338-9E41-E176D497299E}\cache\c81d0870792eee856f1fa6c4f43ceeee

c:\documents and settings\User\Datos de programa\Toolbar4\{338B4DFE-2E2C-4338-9E41-E176D497299E}\cache\db97ecdde59727f50132d25b008ece4e

c:\documents and settings\User\Datos de programa\Toolbar4\{338B4DFE-2E2C-4338-9E41-E176D497299E}\include_files\3ae80511b6d1e2019f03195e7eeec464

c:\documents and settings\User\Datos de programa\Toolbar4\{338B4DFE-2E2C-4338-9E41-E176D497299E}\include_files\8c63949f0d9cef46d9a270a2e4d1ca2e

c:\documents and settings\User\Datos de programa\Toolbar4\{338B4DFE-2E2C-4338-9E41-E176D497299E}\include_files\c61d9da7bfba33d9318740d8d029fb39

c:\windows\$NtUninstallKB64314$

c:\windows\$NtUninstallKB64314$\1592370643\@

c:\windows\$NtUninstallKB64314$\1592370643\cfg.ini

c:\windows\$NtUninstallKB64314$\1592370643\Desktop.ini

c:\windows\$NtUninstallKB64314$\1592370643\L\ekxihtqa

c:\windows\$NtUninstallKB64314$\3774923835

c:\windows\system32\System32\MASetupCleaner.exe

c:\windows\system32\System32\muzapp.exe

c:\windows\system32\ui

c:\windows\system32\ui\bdidntconp.ui

D:\f1293800

D:\f1320984

D:\f1325176

D:\f1329464

D:\f1332776

D:\f1336056

D:\f1340736

D:\f1343976

D:\f1348088

D:\f1351448

D:\f1355600

D:\f1359000

D:\f1363080

D:\f1366448

D:\f1369720

D:\f1373008

D:\f1376312

D:\f1381056

D:\f1381672

D:\f1382288

D:\f1382904

D:\f1383520

D:\f1384136

D:\f1384752

D:\f1385368

D:\f1385984

D:\f1386600

D:\f1387216

D:\f1387832

D:\f1388448

D:\f1389064

D:\f1389680

D:\f1390296

.

c:\windows\system32\drivers\ipsec.sys was missing

Restored copy from - c:\windows\system32\dllcache\ipsec.sys

.

((((((((((((((((((((((((( Files Created from 2013-05-09 to 2013-06-09 )))))))))))))))))))))))))))))))

.

2013-06-09 13:52 . 2008-04-13 19:19 75264 -c--a-w- c:\windows\system32\dllcache\ipsec.sys

2013-06-04 23:09 . 2013-06-04 23:09 -------- d-----w- c:\archivos de programa\DLLSuite

2013-06-04 21:49 . 2005-08-15 00:56 26496 -c--a-w- c:\windows\system32\dllcache\asc.sys

2013-06-04 21:49 . 2005-08-15 00:56 22400 -c--a-w- c:\windows\system32\dllcache\asc3350p.sys

2013-06-04 21:49 . 2005-08-15 00:58 36224 -c--a-w- c:\windows\system32\dllcache\an983.sys

2013-06-04 21:49 . 2005-08-15 00:56 6272 -c--a-w- c:\windows\system32\dllcache\apmbatt.sys

2013-06-04 21:49 . 2005-08-15 00:56 16969 -c--a-w- c:\windows\system32\dllcache\amb8002.sys

2013-06-04 21:49 . 2005-08-15 00:56 12032 -c--a-w- c:\windows\system32\dllcache\amsint.sys

2013-06-04 21:49 . 2005-08-15 00:56 5248 -c--a-w- c:\windows\system32\dllcache\aliide.sys

2013-06-04 21:49 . 2005-08-15 00:56 27678 -c--a-w- c:\windows\system32\dllcache\ali5261.sys

2013-06-04 21:49 . 2005-08-15 00:56 26624 -c--a-w- c:\windows\system32\dllcache\alifir.sys

2013-06-04 21:49 . 2005-08-15 00:56 56960 -c--a-w- c:\windows\system32\dllcache\aic78xx.sys

2013-06-04 21:49 . 2005-08-15 00:56 55168 -c--a-w- c:\windows\system32\dllcache\aic78u2.sys

2013-06-04 21:49 . 2005-08-15 00:56 12800 -c--a-w- c:\windows\system32\dllcache\aha154x.sys

2013-06-04 10:52 . 2013-06-04 10:52 -------- d-----w- C:\снимки фотоапарат 2010-2013

2013-06-03 12:27 . 2013-06-03 12:27 -------- d-----w- C:\Nueva carpeta

2013-06-03 09:37 . 2013-06-03 09:37 -------- d-----w- c:\documents and settings\User\Datos de programa\SUPERAntiSpyware.com

2013-06-03 09:36 . 2013-06-03 09:36 -------- d-----w- c:\documents and settings\All Users\Datos de programa\SUPERAntiSpyware.com

2013-06-03 08:29 . 2013-06-03 08:29 -------- d-----w- c:\documents and settings\All Users\Datos de programa\BrowserDefender

2013-06-03 08:28 . 2013-06-03 08:28 -------- d-----w- c:\documents and settings\User\Datos de programa\BabSolution

2013-06-03 08:27 . 2013-06-03 08:27 -------- d-----w- c:\documents and settings\User\Datos de programa\Babylon

2013-06-03 08:27 . 2013-06-03 08:27 -------- d-----w- c:\documents and settings\All Users\Datos de programa\Babylon

2013-06-02 07:20 . 2013-06-02 07:20 -------- d-----w- C:\found.003

2013-05-27 10:05 . 2013-05-27 10:05 -------- d-----w- c:\archivos de programa\ConvertHelper

2013-05-27 10:01 . 2013-05-27 10:02 -------- d-----w- c:\documents and settings\User\dwhelper

2013-05-20 09:09 . 2013-05-20 09:09 -------- d-----w- C:\found.002

2013-05-19 12:54 . 2013-05-19 12:54 -------- d-----w- C:\found.001

2013-05-13 08:57 . 2013-05-13 08:57 -------- d-----w- c:\documents and settings\All Users\Datos de programa\SSScanAppDataDir

2013-05-13 08:57 . 2013-05-13 08:57 -------- d-----w- c:\documents and settings\All Users\Datos de programa\MSScanAppDataDir

2013-05-11 17:48 . 2013-05-11 17:48 2099367 ----a-w- c:\windows\system32\bda371.tmp

2013-05-11 10:37 . 2013-05-11 10:37 209472 ----a-w- c:\archivos de programa\Mozilla Firefox\plugins\nppdf32.dll

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-06-04 09:56 . 2012-08-10 17:37 631578 ----a-w- c:\documents and settings\All Users\Datos de programa\bdinstall.bin

2013-05-15 17:23 . 2012-05-18 13:23 692104 ----a-w- c:\windows\system32\FlashPlayerApp.exe

2013-05-15 17:23 . 2011-12-14 15:03 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2013-04-30 12:29 . 2013-04-30 12:29 94112 ----a-w- c:\windows\system32\WindowsAccessBridge.dll

2013-04-30 12:29 . 2011-12-15 18:39 144896 ----a-w- c:\windows\system32\javacpl.cpl

2013-04-30 12:29 . 2012-12-21 16:31 866720 ----a-w- c:\windows\system32\npDeployJava1.dll

2013-04-30 12:29 . 2011-12-15 18:39 788896 ----a-w- c:\windows\system32\deployJava1.dll

2013-04-29 10:28 . 2013-04-29 10:28 2452976 ----a-w- c:\windows\system32\bdaD.tmp

2013-04-23 10:28 . 2013-04-23 10:28 565923 ----a-w- c:\windows\system32\bda33.tmp

2013-04-16 22:26 . 2006-03-20 23:13 920064 ----a-w- c:\windows\system32\wininet.dll

2013-04-16 22:26 . 2004-08-19 14:42 43520 ------w- c:\windows\system32\licmgr10.dll

2013-04-16 22:26 . 2004-08-19 14:43 1469440 ------w- c:\windows\system32\inetcpl.cpl

2013-04-12 23:29 . 2004-08-19 14:23 385024 ------w- c:\windows\system32\html.iec

2013-04-12 14:01 . 2006-03-20 23:12 1876480 ----a-w- c:\windows\system32\win32k.sys

2013-04-09 10:24 . 2013-04-09 10:24 2433512 ----a-w- c:\windows\system32\bdaF.tmp

2013-04-02 14:09 . 2013-04-02 14:09 4550656 ----a-w- c:\windows\system32\GPhotos.scr

2013-03-27 11:15 . 2013-03-27 11:15 2433504 ----a-w- c:\windows\system32\bdaA.tmp

2013-03-24 14:47 . 2013-03-24 14:47 469496 ----a-w- c:\windows\system32\bda17.tmp

2010-07-08 07:37 . 2010-07-08 07:37 101544 ----a-w- c:\archivos de programa\Archivos comunes\LinkInstaller.exe

2012-06-18 17:14 . 2011-12-14 14:33 85472 ----a-w- c:\archivos de programa\mozilla firefox\components\browsercomps.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Skype"="c:\archivos de programa\Skype\Phone\Skype.exe" [2007-09-13 22880040]

"swg"="c:\archivos de programa\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2011-12-13 39408]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RTHDCPL"="RTHDCPL.EXE" [2009-06-12 17887232]

"BigDogPath"="c:\windows\VM_STI.EXE" [2007-09-27 61440]

"Adobe ARM"="c:\archivos de programa\Archivos comunes\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]

"SunJavaUpdateSched"="c:\archivos de programa\Archivos comunes\Java\Java Update\jusched.exe" [2013-03-12 253816]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]

@=""

.

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Inicio^Programas^Inicio^HP Digital Imaging Monitor.lnk]

path=c:\documents and settings\All Users\Menu Inicio\Programas\Inicio\HP Digital Imaging Monitor.lnk

backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\APSDaemon]

2011-11-01 22:25 59240 ----a-w- c:\archivos de programa\Archivos comunes\Apple\Apple Application Support\APSDaemon.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Argente Utilities]

2011-02-10 19:20 2832896 ----a-w- c:\archivos de programa\Argente Utilities\Argente Utilities.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]

2011-11-10 09:17 3514176 ------w- c:\archivos de programa\DAEMON Tools Lite\DTLite.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]

2006-02-19 00:41 49152 ----a-w- c:\archivos de programa\HP\HP Software Update\hpwuSchd2.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]

2011-12-08 00:36 421736 ----a-w- c:\archivos de programa\iTunes\iTunesHelper.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesAirMessage]

2012-09-26 11:58 580096 ----a-w- c:\archivos de programa\Samsung\Kies\KiesAirMessage.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesPDLR]

2012-09-28 11:18 842680 ----a-w- c:\archivos de programa\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesPreload]

2012-09-28 11:18 965560 ----a-w- c:\archivos de programa\Samsung\Kies\Kies.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesTrayAgent]

2012-09-28 11:18 309688 ----a-w- c:\archivos de programa\Samsung\Kies\KiesTrayAgent.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sweetpacks Communicator]

2012-08-15 17:08 231768 ----a-w- c:\archivos de programa\SweetIM\Communicator\SweetPacksUpdateManager.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]

2011-12-09 17:22 74752 ----a-w- c:\archivos de programa\Winamp\winampa.exe

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Archivos de programa\\uTorrent\\uTorrent.exe"=

"c:\\Archivos de programa\\Archivos comunes\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=

"c:\\Archivos de programa\\Bonjour\\mDNSResponder.exe"=

"c:\\Archivos de programa\\iTunes\\iTunes.exe"=

"c:\\Archivos de programa\\Winamp\\winamp.exe"=

"c:\\WINDOWS\\system32\\muzapp.exe"=

"c:\\Archivos de programa\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=

"c:\\Archivos de programa\\HP\\Digital Imaging\\bin\\hpqste08.exe"=

"c:\\Archivos de programa\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=

"c:\\Archivos de programa\\HP\\Digital Imaging\\bin\\hposfx08.exe"=

"c:\\Archivos de programa\\HP\\Digital Imaging\\bin\\hposid01.exe"=

"c:\\Archivos de programa\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=

"c:\\Archivos de programa\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=

"c:\\Archivos de programa\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=

"c:\\Archivos de programa\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=

"c:\\Archivos de programa\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=

"c:\\Archivos de programa\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=

"c:\\Archivos de programa\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=

"c:\\Archivos de programa\\HP\\Digital Imaging\\bin\\hpoews01.exe"=

"c:\\Archivos de programa\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=

"c:\\WINDOWS\\system32\\msiexec.exe"=

"c:\\Archivos de programa\\SweetIM\\Communicator\\SweetPacksUpdateManager.exe"=

"c:\\Archivos de programa\\Skype\\Phone\\Skype.exe"=

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"6881:TCP"= 6881:TCP:utorrent

.

R1 GLogin;GLogin; [x]

R2 !SASCORE;SAS Core Service;c:\archivos de programa\SUPERAntiSpyware\SASCORE.EXE [x]

R3 androidusb;SAMSUNG Android Composite ADB Interface Driver;c:\windows\system32\Drivers\ssadadb.sys [2010-12-21 30312]

R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys [2012-09-20 83168]

R3 dgderdrv;dgderdrv;c:\windows\system32\drivers\dgderdrv.sys [2012-05-23 20032]

R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys [2011-06-02 121064]

R3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys [2011-06-02 12776]

R3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys [2011-06-02 136808]

R3 sscebus;SAMSUNG USB Composite Device V2 driver (WDM);c:\windows\system32\DRIVERS\sscebus.sys [2010-12-21 98560]

R3 sscemdfl;SAMSUNG Mobile Modem V2 Filter;c:\windows\system32\DRIVERS\sscemdfl.sys [2010-12-21 14848]

R3 sscemdm;SAMSUNG Mobile Modem V2 Drivers;c:\windows\system32\DRIVERS\sscemdm.sys [2010-12-21 123648]

R3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys [2012-09-20 181344]

R3 ssudserd;SAMSUNG Mobile USB Diagnostic Serial Port(DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudserd.sys [2012-09-20 181344]

S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2012-03-13 239168]

S3 ZSMC302;PLEOMAX PWC-3800;c:\windows\system32\Drivers\usbvm302.sys [2007-02-01 1664512]

.

Contents of the 'Scheduled Tasks' folder

.

2013-06-05 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-18 17:23]

.

2013-06-01 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\archivos de programa\Apple Software Update\SoftwareUpdate.exe [2011-06-01 16:57]

.

2013-06-05 c:\windows\Tasks\EPUpdater.job

- c:\docume~1\User\DATOSD~1\BABSOL~1\Shared\BabMaint.exe [2013-06-03 10:34]

.

2013-06-09 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\archivos de programa\Google\Update\GoogleUpdate.exe [2011-12-13 21:04]

.

2013-06-05 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\archivos de programa\Google\Update\GoogleUpdate.exe [2011-12-13 21:04]

.

2013-06-09 c:\windows\Tasks\User_Feed_Synchronization-{2161FED7-E680-4D17-B276-180397D94AE3}.job

- c:\windows\system32\msfeedssync.exe [2009-03-08 03:31]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://easy-google-search.blogspot.com

mStart Page = about:blank

uInternet Settings,ProxyOverride = *.local

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: E&xportar a Microsoft Excel - c:\archiv~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

Trusted Zone: gob.es\agenciatributaria

TCP: DhcpNameServer = 192.168.1.1

TCP: Interfaces\{81B63F48-AF6A-42CC-BEC2-7FBAA12B2B14}: NameServer = 87.216.1.65,87.216.1.66

DPF: {2DAB6EF1-66C3-427C-87CD-8DC448C47EAE} - hxxps://www5.aeat.es/es13/h/tgvicab.cab

DPF: {947B00D2-962D-4A35-9E48-98EE6A442B41} - hxxps://www1.agenciatributaria.gob.es/ADUA/internet/aded1503.cab

DPF: {B785FA3C-1DE9-4D20-8396-613C486FE95E} - hxxps://www1.agenciatributaria.gob.es/es13/h/cactivex.cab

.

- - - - ORPHANS REMOVED - - - -

.

Toolbar-10 - (no file)

ShellIconOverlayIdentifiers-{2012DE06-50C0-48BD-ACDE-88F95D4CAD1F} - (no file)

ShellIconOverlayIdentifiers-{C72C6188-BEF2-46E5-A89A-52F0ED75219E} - (no file)

ShellIconOverlayIdentifiers-{C92F6BC2-AF61-4C0E-80E0-939B8282DDB7} - (no file)

ShellIconOverlayIdentifiers-{CB1EFEF8-D5E0-49D1-B768-41B48B1D7803} - (no file)

SafeBoot-Wdf01000.sys

MSConfigStartUp-KiesHelper - c:\archivos de programa\Samsung\Kies\KiesHelper.exe

MSConfigStartUp-LogMeIn Hamachi Ui - c:\archivos de programa\LogMeIn Hamachi\hamachi-2-ui.exe

MSConfigStartUp-msnmsgr - ~c:\archivos de programa\Windows Live\Messenger\msnmsgr.exe

MSConfigStartUp-SweetIM - c:\archivos de programa\SweetIM\Messenger\SweetIM.exe

AddRemove-25_escape - c:\archivos de programa\Samsung\USB Drivers\25_escape\Uninstall.exe

AddRemove-Google Chrome - c:\documents and settings\User\Configuracion local\Datos de programa\Google\Chrome\Application\27.0.1453.94\Installer\setup.exe

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2013-06-09 15:54

Windows 5.1.2600 Service Pack 3 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_7_700_202_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_7_700_202_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\software\Microsoft\DirectPlay\Applications]

@DACL=(02 0000)

.

[HKEY_LOCAL_MACHINE\software\Microsoft\DirectPlay8\Applications]

@DACL=(02 0000)

.

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\ђ•Ђ|яяяя"•Ђ| –Сw*]

"A0C0110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"

.

--------------------- DLLs Loaded Under Running Processes ---------------------

.

- - - - - - - > 'explorer.exe'(3620)

c:\windows\system32\WININET.dll

c:\windows\system32\webcheck.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

------------------------ Other Running Processes ------------------------

.

c:\archivos de programa\Archivos comunes\Apple\Mobile Device Support\AppleMobileDeviceService.exe

c:\windows\RTHDCPL.EXE

c:\archivos de programa\Bonjour\mDNSResponder.exe

c:\archivos de programa\Java\jre7\bin\jqs.exe

c:\archivos de programa\Archivos comunes\Microsoft Shared\VS7DEBUG\MDM.EXE

c:\windows\system32\HPZipm12.exe

c:\windows\system32\wbem\wmiapsrv.exe

c:\windows\system32\wscntfy.exe

.

**************************************************************************

.

Completion time: 2013-06-09 15:58:49 - machine was rebooted

ComboFix-quarantined-files.txt 2013-06-09 13:58

.

Pre-Run: 19 545 931 776 bytes libres

Post-Run: 19 421 155 328 bytes libres

.

- - End Of File - - 03789E32B4C56D45ECCE2076F9ECBBC1

10AE9EB13951B8E206480773F877A330

След отново рестартирване,вече имам интернет но проблема с usb-та продължава.

B-boy/StyLe/ · Юни 10, 2013

Здравейте,

Имали сте сериозна инфекция като ZeroAccess и макар да се чисти лесно вече от повечето инструменти, тя има доста разновидности и прави доста щети и затова искам да направим още малко проверки:

СТЪПКА 1

След като вече имате интернет, изтрийте вашето копие на Combofix и изтеглете ново от линка в предишния ми коментар и стартирайте инструмента.

Този път вече се уверете, че компютъра е свързан с интернет за да може инструмента да изтегли Recovery Console-aта (съгласете се с нейното инсталиране за да може инструмента да провери за по-сериозно инфекции). След това публикувайте новия лог файл.

СТЪПКА 2

Моля изтеглете инструмента Farbar Recovery Scan Tool (според версията на Операционната Система трябва да изтеглите 32 или 64 битова версия) и го запазете на десктопа.
Стартирайте файла FRST.exe.
Програмата ще се стартира. Натиснете YES за да се съгласите с лицензионното споразумение.
Сложете всички отметки.
Натиснете бутона SCAN.
Ще се създадат два лог файл с името - FRST.txt и Addition.txt на десктопа.
Прикачете лог файловете в следващия си коментар.

samsonite · Юни 10, 2013

Здравей !!

Това е новият лог файл след ComboFix......

ComboFix 13-06-08.02 - User 06.2013 г. 18:43:20.2.2 - x86

Running from: c:\documents and settings\User\Escritorio\ComboFix.exe

AV: ESET Smart Security 6.0 *Disabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

FW: Лична защитна стена на ESET *Disabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}

FW: Outpost Firewall Pro *Disabled* {8A20CA2A-9E02-4A64-923B-0A38208EB7FD}

.

((((((((((((((((((((((((( Files Created from 2013-05-10 to 2013-06-10 )))))))))))))))))))))))))))))))

.

2013-06-09 14:51 . 2012-12-05 08:50 785800 ----a-w- c:\windows\system32\drivers\SandBox.sys

2013-06-09 14:51 . 2012-12-03 10:49 285280 ----a-w- c:\windows\system32\drivers\afwcore.sys

2013-06-09 14:51 . 2012-09-03 18:20 33888 ----a-w- c:\windows\system32\drivers\afw.sys

2013-06-09 14:50 . 2013-06-09 14:50 -------- d-----w- c:\archivos de programa\Agnitum

2013-06-09 14:49 . 2013-06-09 14:49 -------- d-----w- c:\documents and settings\All Users\Datos de programa\Agnitum

2013-06-09 14:44 . 2013-06-09 14:44 -------- d-----w- c:\documents and settings\User\Datos de programa\ESET

2013-06-09 14:42 . 2013-06-09 14:42 -------- d-----w- c:\documents and settings\All Users\Datos de programa\ESET

2013-06-09 14:42 . 2013-06-09 14:42 -------- d-----w- c:\archivos de programa\ESET

2013-06-09 14:13 . 2013-06-09 14:13 -------- d-----w- c:\archivos de programa\Dll-Files.com Fixer

2013-06-09 13:58 . 2013-06-10 17:03 -------- d-----w- c:\windows\system32\config\systemprofile\Configuracion local

2013-06-09 13:52 . 2008-04-13 19:19 75264 -c--a-w- c:\windows\system32\dllcache\ipsec.sys

2013-06-09 13:52 . 2008-04-13 19:19 75264 ----a-w- c:\windows\system32\drivers\ipsec.sys