Kaspersky mi nestao i neće da se instalira

Antivirus KASPERSKY (kav8.0.0.506en.exe) je radio k'o sat godinu dana, a pre par dana je jednostavno nestao iako je bio u AUTOSTART režimu. NA manuelni start ne reaguje. Pri ponovnoj instalaciji čak i posle detaljne deinstalacije iz pomoć "Absolute Uninstaller"-a neće opet da se instalira. Odmah pri početku instalacije dobijem grešku "Runtime error! 214701286 System error X....(214701286)", nakon ove poruke se "odradi" instalacija, ali od programa - ništa. Ne može ni Spy Sweeper da se instalira i radi kako treba. Ne reaguje ni "Malwarebytes' Anti-Malware" koji je bio instaliran, a ostali instalirani programi rade korektno. Bar da nisam onemogućio "System Restore"...
Šta da radim, a da to ne bude prelazak na "7-icu", jel XP smatram da više ne bih instalirao isponova.

Kakav crni system restore, to po pravilu treba odmah iskljuciti.

Skini Program DDS http://download.bleepingcomputer.com/sUBs/dds.scr
Dvoklikom pokreni DDS
Sacekaj malo, izbacice ti dva loga
Zakaci mi log DDS.txt

Hvala na pomoći.
Tek sad vidim da mi se PC blokira iz čista mira i sigurno nešto sa XP-om nije kako treba, ali evo linka na kome je .txt fajl generisan iz programa koji ste mi poslali, papogledajte ako možete šta je.

Hvala još jednom!



DDS (Ver_09-12-01.01) - NTFSx86
Run by Administrat”r at 23:32:29,34 on 2009-12-25
Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_17
Microsoft Windows XP Professional 5.1.2600.3.1252.46.1053.18.1023.529 [GMT 1:00]

AV: Kaspersky Anti-Virus Personal *On-access scanning disabled* (Updated) {816CD617-99F4-4B18-828E-80582E4B044D}

============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\Program\HP\Digital Imaging\Smart Web Printing\hpswp_clipbook.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program\Executive Software\Diskeeper\DkService.exe
C:\WINDOWS\system32\ircomm2k.exe
C:\Program\Java\jre6\bin\jqs.exe
C:\Program\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
c:\Program\VoIPProvider\USB VoIP Personal Gateway\VServ.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program\Analog Devices\SoundMAX\DrvLsnr.exe
C:\Program\DU Meter\DUMeter.exe
C:\Program\Java\jre6\bin\jusched.exe
C:\Program\ATI Technologies\ATI.ACE\cli.exe
C:\Program\ATI Multimedia\main\LaunchPd.exe
C:\Program\ATI Multimedia\main\ATIDtct.EXE
C:\Program\ATI Multimedia\MAIN\ATISched.EXE
C:\Program\Microsoft Hardware\Mouse\POINT32.EXE
C:\Program\ATI Technologies\ATI.ACE\cli.exe
C:\Program\ATI Technologies\ATI.ACE\cli.exe
C:\Program\Opera\opera.exe
C:\Program Files\Internet Explorer\Iexplore.exe
C:\L U N A T I C\2009\-12-\Bleeping Comp\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.se/ig?hl=sv
BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\program\hp\digital imaging\smart web printing\hpswp_printenhancer.dll
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - No File
BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program\hp\digital imaging\smart web printing\hpswp_BHO.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -
EB: HP Smart Web Printing: {555d4d79-4bd2-4094-a395-cfc534424a05} - c:\program\hp\digital imaging\smart web printing\hpswp_bho.dll
uRun: [ATI Launchpad] "c:\program\ati multimedia\main\LaunchPd.exe"
uRun: [ATI DeviceDetect] c:\program\ati multimedia\main\ATIDtct.EXE
uRun: [ATI Scheduler] c:\program\ati multimedia\main\ATISched.EXE
mRun: [DrvLsnr] "c:\program\analog devices\soundmax\DrvLsnr.exe"
mRun: [DU Meter] c:\program\du meter\DUMeter.exe
mRun: [SunJavaUpdateSched] "c:\program\java\jre6\bin\jusched.exe"
mRun: [ATICCC] "c:\program\ati technologies\ati.ace\cli.exe" runtime -Delay
StartupFolder: c:\docume~1\admini~1\start-~1\program\autost~1\micros~1.lnk - c:\program\microsoft hardware\mouse\dplaunch.exe
uPolicies-explorer: HideClock = 0 (0x0)
uPolicies-explorer: NoStartMenuSubFolders = 0 (0x0)
uPolicies-explorer: NoCommonGroups = 0 (0x0)
uPolicies-explorer: NoPrinters = 0 (0x0)
uPolicies-explorer: NoRecentDocsNetHood = 0 (0x0)
uPolicies-explorer: NoChangeAnimation = 0 (0x0)
uPolicies-explorer: NoThemesTab = 0 (0x0)
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program\messenger\msmsgs.exe
IE: {44226DFF-747E-4edc-B30C-78752E50CD0C} - {44226DFF-747E-4edc-B30C-78752E50CD0C} - c:\program\ati multimedia\dtv\EXPLBAR.DLL
IE: {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897}
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\program\micros~3\office11\REFIEBAR.DLL
IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program\hp\digital imaging\smart web printing\hpswp_BHO.dll
DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
DPF: {00000055-9980-0010-8000-00AA00389B71} - hxxp://codecs.microsoft.com/codecs/i386/fhg.CAB
DPF: {00000161-9980-0010-8000-00AA00389B71} - hxxp://codecs.microsoft.com/codecs/i386/msaud.cab
DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program\yahoo!\common\yinsthelper.dll
DPF: {33564D57-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/D/0/D/D0DD87DA-994F-4334-8B55-AF2E4D98ED0C/wmv9dmo.cab
DPF: {5BF56AD2-E297-416E-BC49-000004040507} - hxxps://cve.trust.telia.com/TeliaEleg/iidsetup.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - c:\program\belarc\advisor\system\BAVoilaX.dll
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program\delade filer\microsoft shared\web folders\PKMCDO.DLL
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\program\delade~1\skype\SKYPE4~1.DLL
Notify: AtiExtEvent - Ati2evxx.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\admini~1\applic~1\mozilla\firefox\profiles\r568e2va.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://google.se/
FF - prefs.js: network.proxy.type - 255
FF - component: c:\program\hp\digital imaging\smart web printing\mozillaaddon3\components\hpClipBook.dll
FF - component: c:\program\hp\digital imaging\smart web printing\mozillaaddon3\components\hpClipBookDB.dll
FF - component: c:\program\hp\digital imaging\smart web printing\mozillaaddon3\components\hpNeoLogger.dll
FF - component: c:\program\hp\digital imaging\smart web printing\mozillaaddon3\components\hpSaturn.dll
FF - component: c:\program\hp\digital imaging\smart web printing\mozillaaddon3\components\hpSeymour.dll
FF - component: c:\program\hp\digital imaging\smart web printing\mozillaaddon3\components\hpSmartSelect.dll
FF - component: c:\program\hp\digital imaging\smart web printing\mozillaaddon3\components\hpSmartWebPrinting.dll
FF - component: c:\program\hp\digital imaging\smart web printing\mozillaaddon3\components\hpSWPOperation.dll
FF - component: c:\program\hp\digital imaging\smart web printing\mozillaaddon3\components\hpXPLogging.dll
FF - component: c:\program\hp\digital imaging\smart web printing\mozillaaddon3\components\hpXPMTC.dll
FF - component: c:\program\hp\digital imaging\smart web printing\mozillaaddon3\components\hpXPMTL.dll
FF - component: c:\program\hp\digital imaging\smart web printing\mozillaaddon3\components\hpXREStub.dll
FF - component: c:\program\nokia\nokia pc suite 7\bkmrksync\components\BkMrkExt.dll
FF - plugin: c:\program\hp\digital imaging\smart web printing\mozillaaddon3\plugins\nphpclipbook.dll
FF - plugin: c:\program\k-lite codec pack\real\browser\plugins\nppl3260.dll
FF - plugin: c:\program\k-lite codec pack\real\browser\plugins\nprpjplug.dll
FF - plugin: c:\program\mozilla firefox\plugins\npiidplg.dll
FF - plugin: c:\program\opera\program\plugins\nppl3260.dll
FF - plugin: c:\program\opera\program\plugins\nprpjplug.dll
FF - plugin: c:\program\viewpoint\viewpoint media player\npViewpoint.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\program\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
c:\program\mozilla firefox\greprefs\all.js - pref("browser.visited_color", "#551A8B");
c:\program\mozilla firefox\defaults\pref\firefox.js - pref("browser.videoFeeds.handler", "ask");

============= SERVICES / DRIVERS ===============

R0 TLRecAgent;TLRecAgent;c:\windows\system32\drivers\TLRecAgent.sys [2008-4-22 37208]
R2 IrCOMM2kSvc;Virtueller Infrarot-Kommunikationsanschluß, Dienstprogramm;c:\windows\system32\ircomm2k.exe [2007-2-19 53248]
R2 OkiPar;OkiPar;c:\windows\system32\drivers\OkiPar.Sys [2001-10-2 40192]
R2 srenum;srenum;c:\windows\system32\drivers\srenum.sys [2009-11-3 36480]
R2 VService;VService;c:\program\voipprovider\usb voip personal gateway\VServ.exe [2007-1-1 105208]
R3 IrCOMM2k;Virtueller Infrarot-Kommunikationsanschluß;c:\windows\system32\drivers\ircomm2k.sys [2007-2-19 16018]
R3 ndisrd;WinpkFilter Service;c:\windows\system32\drivers\ndisrd.sys [2009-11-3 20480]
R3 TTDec;ATI WDM Teletext Decoder;c:\windows\system32\drivers\atinttxx.sys [2004-12-7 13824]
S3 AEXPAM;Philips SmartManage Service;c:\windows\system32\drivers\aexpamdrv.sys [2004-9-1 21824]
S3 bkn50USB;Belkin 54Mbps Wireless USB Network Adapter;c:\windows\system32\drivers\rt2500usb.sys [2006-1-15 140416]
S3 BRGSp50;BRGSp50 NDIS Protocol Driver;c:\windows\system32\drivers\brgsp50.sys --> c:\windows\system32\drivers\BRGSp50.sys [?]
S3 Camdrv30;Philips ToUcam XS;c:\windows\system32\drivers\camdrv30.sys [2009-1-2 171264]
S3 KS-959;Kingsun KS-959 USB Infrared Adapter;c:\windows\system32\drivers\ks-959.sys [2005-7-23 19034]
S3 r_server;Remote Administrator Service;c:\windows\system32\r_server.exe [2009-11-26 724992]
S3 SIS163u;SiS163 USB Wireless LAN Adapter Driver;c:\windows\system32\drivers\sis163u.sys --> c:\windows\system32\drivers\sis163u.sys [?]
S3 Slnt7554;USB Soft Modem Driver;c:\windows\system32\drivers\slnt7554.sys [2008-4-12 129535]
S3 slusbvip;SL3800 USB Driver;c:\windows\system32\drivers\slusbvip.sys [2008-4-22 592024]
S3 SLVAD_simple;VoIP Virtual Audio Device;c:\windows\system32\drivers\slvad.sys [2008-4-22 85656]

=============== Created Last 30 ================

2722-03-16 12:59:13 0 d-----w- c:\program\Siemens Data Suite
2009-12-24 22:55:06 0 d-----w- c:\docume~1\alluse~1\applic~1\GARMIN
2009-12-24 22:55:06 0 d-----w- c:\docume~1\admini~1\applic~1\GARMIN
2009-12-24 22:52:34 0 d-----w- C:\Garmin
2009-12-24 22:24:34 13480666 ----a-w- C:\GarminMobileXT v5.00.50.rar
2009-12-24 15:36:19 664 ----a-w- c:\windows\system32\krl32mainweq.dll
2009-12-24 15:35:17 206 ----a-w- c:\windows\system32\srcr.dat
2009-12-22 13:43:51 2099675 ----a-w- C:\kampanj2.pdf
2009-12-22 13:10:51 33718677 ----a-w- C:\annehd3.wmv
2009-12-19 00:19:12 26709 ----a-w- C:\kampanj2.pdf
2009-12-16 16:35:12 32369 ----a-w- C:\E2210B_UM_Open_Eng_Rev.1.1_0331.pdf
2009-12-16 16:35:12 26871 ----a-w- C:\FTV_Kacey.torrent
2009-12-15 15:32:53 3884173 ----a-w- C:\d7c96c979c7952ce15e68c17f9146e27.wmv
2009-12-15 15:31:49 103916 ----a-w- C:\St.pdf
2009-12-15 15:30:27 6594564 ----a-w- C:\autozulieferer in der krise - arbeitsplatzbeschaffung bei toyota.mpg
2009-12-14 13:25:01 2615570 ----a-w- C:\Maxi7.12..pdf
2009-12-13 20:28:07 13912 ----a-w- C:\E2210B_UM_Open_Eng_Rev.1.1_0331.pdf
2009-12-13 19:52:15 58316 ----a-w- C:\ILBT_17-24.torrent
2009-12-13 19:20:48 19251 ----a-w- C:\WEBCAM SQUIRTERS.torrent
2009-12-12 16:21:00 696383 ----a-w- C:\E2210B_UM_Open_Eng_Rev.1.1_0331.pdf
2009-12-09 23:55:32 14205 ----a-w- C:\E2210B_UM_Open_Eng_Rev.1.1_0331.pdf
2009-12-09 01:17:48 55741 ----a-w- C:\kampanj2.pdf
2009-12-09 01:04:45 14507 ----a-w- C:\kampanj2.pdf
2009-12-07 17:55:46 19022 ----a-w- C:\kampanj2.pdf
2009-12-02 20:44:33 54156 ---ha-w- c:\windows\QTFont.qfn
2009-12-02 20:44:33 1409 ----a-w- c:\windows\QTFont.for
2009-11-29 13:15:45 1691340 ----a-w- C:\nexanykatalog200920sid.pdf
2009-11-27 00:14:56 373796 ----a-w- C:\internet-cenovnik.pdf
2009-11-26 23:23:17 239616 ----a-w- C:\Vakcina protiv Gripa.pps
2009-11-26 21:09:35 724992 ----a-w- c:\windows\system32\r_server.exe
2009-11-26 21:09:35 29728 ----a-w- c:\windows\system32\raddrv.dll
2009-11-26 21:09:33 0 d-----w- c:\program\Radmin
2009-11-26 16:51:47 14621 ----a-w- C:\kampanj2.pdf
2009-11-26 11:39:01 14512 ----a-w- C:\kampanj2.pdf
==================== Find3M ====================

2009-12-25 18:43:53 7864320 ---ha-w- c:\documents and settings\administratör\NTUSER.DAT
2009-12-24 15:38:54 753696 --sha-w- c:\windows\system32\drivers\fidbox2.dat
2009-12-24 15:38:54 4704 --sha-w- c:\windows\system32\drivers\fidbox2.idx
2009-12-24 15:38:53 4308000 --sha-w- c:\windows\system32\drivers\fidbox.dat
2009-12-24 15:38:53 36832 --sha-w- c:\windows\system32\drivers\fidbox.idx
2009-11-14 22:15:24 2826159 ----a-w- C:\Rolltop.zip
2009-11-03 11:15:27 36480 ----a-w- c:\windows\system32\drivers\srenum.sys
2009-11-03 11:14:47 20480 ----a-w- c:\windows\system32\drivers\ndisrd.sys
2009-10-11 03:17:27 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-10-06 11:37:32 2516 --sha-w- c:\windows\system32\KGyGaAvL.sys
2009-04-11 16:54:04 1487616 ----a-w- c:\program\2009-04-11 18-40-32.mp3
2007-06-18 20:22:24 39444 ----a-w- c:\program\Winam
2001-03-28 10:02:58 122880 ----a-w- c:\windows\inf\agfa\message.exe
2004-08-04 01:34:52 73728 --sha-w- c:\windows\registeredpackages\{dd90d410-1823-43eb-9a16-a2331bf08799}$backup$\system\wmplayer.exe
2005-04-24 19:54:26 56 --sha-w- c:\windows\system32\09BAAC5293.sys
2005-09-10 18:13:13 56 --sh--r- c:\windows\system32\4A063A8207.sys
2008-05-27 19:17:50 32768 --sha-w- c:\windows\temp\history\history.ie5\mshist012008052720080528\index.dat

============= FINISH: 23:33:20,01 ===============


_{[Ovu poruku je menjao brankos dana 26.12.2009. u 00:47 GMT+1]}

Nemoj da instaliras nijedan AV dok ne zavrsimo.
Skini Combofix na Desktop i pokreni ga sa Desktopa
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Klikni na yes ili ok za sve sto te pita.
Po zavrsetku skeniranja izbacice ti log u notepadu, koji ces kopirati ovde.

E, kad bi na mom šlogiranom PC-ju uopšte i mogao pokrenuti ovaj .exe fajl!
Klikom na ikonicu "iskulira" proces i to je to. Možda da skinem HD, pa da ga zakačim preko USB-IDE na laptop da ga kasperski odande skanira?!

Vrlo moguce da imas fajl infektor, zato ti "pojede" Combofix



To bi bila najbolja solucija.

Ni posle skeniranja i brisanja nekih virusa nista se nije promenilo. nista nece da se instalira na racunaru.

Hajde da probamo ovako: skini Sysinternalsov Autoruns, obavezno preimenuj autoruns.exe u nesto (po mogucstvu sto uvrnutije, poput "k7u94yg3.exe" i sl.), pa ako uspes da ga pokrenes, sacekaj da iskenira, otvori jezicak Hijack Images, pa ako tu imas bilo sta osim "Your Image File Name Here without a path" stavke, slobodno desni klik na svaku od njih pa delete. Ako neku od njih nece da obrise, javi pa da ti dam dalje instrukcije. Kad si vec u Autoruns-u, idi na jezicak Everything, klikni na Options > Hide Microsoft and Windows Entries, pa na Options > Verify Code Signatures, pa pritisni F5 ili klikni na Refresh ikonicu, sacekaj da iskenira, pa idi na File > Export As, sacuvaj rezultate u nekom txt fajlu na nekoj lokaciji po tvom izboru, pa nam okaci taj txt fajl ovde. Ako ne uspes da pokrenes Autoruns, javi pa da probamo nesto drugo...

_{[Ovu poruku je menjao valjan dana 28.12.2009. u 03:48 GMT+1]}