aleksandra33

ок.много много ви благодаря

мисля,че сега всичко е наред All processes killed ========== OTL ========== C:\ProgramData\mtbjfghn.xbe moved successfully. ========== FILES ========== File\Folder C:\ProgramData\mtbjfghn.xbe not found. ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Public User: user ->Temp folder emptied: 19833211 bytes ->Temporary Internet Files folder emptied: 775419 bytes ->Java cache emptied: 0 bytes ->Google Chrome cache emptied: 89049202 bytes ->Flash cache emptied: 11026 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 3360 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 105,00 mb OTL by OldTimer - Version 3.2.11.0 log created on 09102010_145847 Files\Folders moved on Reboot... Registry entries deleted on Reboot...

готово. OTL.Txt Extras.Txt

да.лека и на вас.предполагам че така трябва да ги копирам защото не ги прикача All processes killed ========== OTL ========== HKU\S-1-5-21-1084254141-558916659-170363730-1000\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully! Registry value HKEY_USERS\S-1-5-21-1084254141-558916659-170363730-1000\Software\Microsoft\Internet Explorer\URLSearchHooks\\{00a6faf6-072e-44cf-8957-5838f569a31d} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00a6faf6-072e-44cf-8957-5838f569a31d}\ deleted successfully. C:\Program Files\MyWebSearch\bar\1.bin\MWSSRCAS.DLL moved successfully. Registry value HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected] deleted successfully. C:\Program Files\MyWebSearch\bar\1.bin\chrome folder moved successfully. C:\Program Files\MyWebSearch\bar\1.bin folder moved successfully. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00a6faf1-072e-44cf-8957-5838f569a31d}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00a6faf1-072e-44cf-8957-5838f569a31d}\ deleted successfully. File C:\Program Files\MyWebSearch\bar\1.bin\MWSSRCAS.DLL not found. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{07b18ea1-a523-4961-b6bb-170de4475cca}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{07b18ea1-a523-4961-b6bb-170de4475cca}\ deleted successfully. File C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{07b18ea9-a523-4961-b6bb-170de4475cca} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{07b18ea9-a523-4961-b6bb-170de4475cca}\ deleted successfully. File C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL not found. Registry value HKEY_USERS\S-1-5-21-1084254141-558916659-170363730-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{07b18ea9-a523-4961-b6bb-170de4475cca} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{07b18ea9-a523-4961-b6bb-170de4475cca}\ not found. File C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\mywebsearch email plugin deleted successfully. File C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\my web search bar search scope monitor deleted successfully. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\WinampAgent deleted successfully. Registry value HKEY_USERS\S-1-5-21-1084254141-558916659-170363730-1000\Software\Microsoft\Windows\CurrentVersion\Run\\mywebsearch email plugin deleted successfully. File C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{1a93c934-025b-4c3a-b38e-9654a7003239}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1a93c934-025b-4c3a-b38e-9654a7003239}\ not found. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet:/pagefile deleted successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ced38442-9b73-11df-a7c8-001e68f13bf1}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ced38442-9b73-11df-a7c8-001e68f13bf1}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ced38442-9b73-11df-a7c8-001e68f13bf1}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ced38442-9b73-11df-a7c8-001e68f13bf1}\ not found. File F:\setup_vmc_lite.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F\ deleted successfully. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F\ not found. File F:\setup_vmc_lite.exe not found. ADS C:\ProgramData\TEMP:38849DE5 deleted successfully. ADS C:\ProgramData\TEMP:FF23EFF2 deleted successfully. ADS C:\ProgramData\TEMP:C4D9B0D5 deleted successfully. ADS C:\ProgramData\TEMP:BF4C5148 deleted successfully. ADS C:\ProgramData\TEMP:F1CD4718 deleted successfully. ========== FILES ========== recycler not found in C:\ recycler not found in D:\ recycler not found in E:\ < ipconfig /flushdns /c > Windows IP Configuration Successfully flushed the DNS Resolver Cache. D:\Users\user\Downloads\cmd.bat deleted successfully. D:\Users\user\Downloads\cmd.txt deleted successfully. C:\Program Files\FunWebProducts\ScreenSaver\Images folder moved successfully. C:\Program Files\FunWebProducts\ScreenSaver folder moved successfully. C:\Program Files\FunWebProducts folder moved successfully. C:\Program Files\MyWebSearch\bar\Settings folder moved successfully. C:\Program Files\MyWebSearch\bar\Overlay folder moved successfully. C:\Program Files\MyWebSearch\bar\Notifier folder moved successfully. C:\Program Files\MyWebSearch\bar\Message folder moved successfully. C:\Program Files\MyWebSearch\bar\icons folder moved successfully. C:\Program Files\MyWebSearch\bar\History folder moved successfully. C:\Program Files\MyWebSearch\bar\Game folder moved successfully. C:\Program Files\MyWebSearch\bar\Avatar folder moved successfully. C:\Program Files\MyWebSearch\bar folder moved successfully. C:\Program Files\MyWebSearch folder moved successfully. C:\Windows\System32\f3PSSavr.scr moved successfully. C:\ProgramData\mtbjfghn.xbe moved successfully. ========== COMMANDS ========== C:\Windows\System32\drivers\etc\Hosts moved successfully. HOSTS file reset successfully [EMPTYTEMP] User: All Users User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Public User: user ->Temp folder emptied: 1037537415 bytes ->Temporary Internet Files folder emptied: 70123571 bytes ->Java cache emptied: 1881651 bytes ->Google Chrome cache emptied: 359309773 bytes ->Flash cache emptied: 33872 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 1180000 bytes RecycleBin emptied: 2755 bytes Total Files Cleaned = 1 402,00 mb OTL by OldTimer - Version 3.2.11.0 log created on 09102010_000709 Files\Folders moved on Reboot... Registry entries deleted on Reboot... ето и другия ESETSmartInstaller@High as downloader log: all ok # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6211 # api_version=3.0.2 # EOSSerial=d9cc48dc98673442954605626587aea9 # end=finished # remove_checked=true # archives_checked=true # unwanted_checked=true # unsafe_checked=true # antistealth_checked=true # utc_time=2010-05-30 05:45:32 # local_time=2010-05-30 08:45:32 ) # country="Bulgaria" # lang=1033 # osver=6.1.7600 NT # compatibility_mode=1797 16775165 100 94 1288371 47890833 49283 0 # compatibility_mode=5893 16776573 100 94 5807340 26860309 0 0 # compatibility_mode=8192 67108863 100 0 179 179 0 0 # scanned=84298 # found=0 # cleaned=0 # scan_time=12414 ESETSmartInstaller@High as downloader log: all ok # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6211 # api_version=3.0.2 # EOSSerial=d9cc48dc98673442954605626587aea9 # end=finished # remove_checked=true # archives_checked=true # unwanted_checked=true # unsafe_checked=true # antistealth_checked=true # utc_time=2010-09-10 02:05:22 # local_time=2010-09-10 05:05:22 ) # country="Bulgaria" # lang=1033 # osver=6.1.7600 NT # compatibility_mode=1797 16775165 100 94 39561 56730821 0 0 # compatibility_mode=5893 16776573 100 94 225357 35700297 0 0 # compatibility_mode=8192 67108863 100 0 8840167 8840167 0 0 # scanned=94664 # found=39 # cleaned=39 # scan_time=15216 D:\Old\Downloads\CursorManiaSetup2.3.50.62.SA.HP.ZCfox000.exe a variant of Win32/Toolbar.MyWebSearch.L application (deleted - quarantined) 00000000000000000000000000000000 C D:\Old\Downloads\SmileyCentralPFSetup2.3.67.1.ZNfox000.exe a variant of Win32/Toolbar.MyWebSearch.K application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C D:\Users\user\Documents\Downloads\ZwinkySetup2.3.67.1.ZJman000.exe Win32/Toolbar.MyWebSearch application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C D:\Users\user\Downloads\SmileyCentralPFSetup2.3.69.8.ZNman000.exe a variant of Win32/Toolbar.MyWebSearch.K application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C D:\_OTL\MovedFiles\09102010_000709\C_Program Files\MyWebSearch\bar\1.bin\F3CJPEG.DLL Win32/Toolbar.MyWebSearch application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C D:\_OTL\MovedFiles\09102010_000709\C_Program Files\MyWebSearch\bar\1.bin\F3DTACTL.DLL Win32/Adware.FunWeb application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C D:\_OTL\MovedFiles\09102010_000709\C_Program Files\MyWebSearch\bar\1.bin\F3HISTSW.DLL Win32/Adware.FunWeb application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C D:\_OTL\MovedFiles\09102010_000709\C_Program Files\MyWebSearch\bar\1.bin\F3HKSTUB.DLL Win32/Toolbar.MyWebSearch.G application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C D:\_OTL\MovedFiles\09102010_000709\C_Program Files\MyWebSearch\bar\1.bin\F3HTMLMU.DLL Win32/Toolbar.MyWebSearch.B application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C D:\_OTL\MovedFiles\09102010_000709\C_Program Files\MyWebSearch\bar\1.bin\F3HTTPCT.DLL Win32/Toolbar.MyWebSearch application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C D:\_OTL\MovedFiles\09102010_000709\C_Program Files\MyWebSearch\bar\1.bin\F3IMSTUB.DLL Win32/Toolbar.MyWebSearch application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C D:\_OTL\MovedFiles\09102010_000709\C_Program Files\MyWebSearch\bar\1.bin\F3POPSWT.DLL Win32/Adware.FunWeb application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C D:\_OTL\MovedFiles\09102010_000709\C_Program Files\MyWebSearch\bar\1.bin\F3PSSAVR.SCR Win32/Toolbar.MyWebSearch application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C D:\_OTL\MovedFiles\09102010_000709\C_Program Files\MyWebSearch\bar\1.bin\F3REGHK.DLL Win32/Toolbar.MyWebSearch.G application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C D:\_OTL\MovedFiles\09102010_000709\C_Program Files\MyWebSearch\bar\1.bin\F3REPROX.DLL a variant of Win32/Toolbar.MyWebSearch.D application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C D:\_OTL\MovedFiles\09102010_000709\C_Program Files\MyWebSearch\bar\1.bin\F3RESTUB.DLL Win32/Toolbar.MyWebSearch application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C D:\_OTL\MovedFiles\09102010_000709\C_Program Files\MyWebSearch\bar\1.bin\F3SCHMON.EXE Win32/Adware.FunWeb application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C D:\_OTL\MovedFiles\09102010_000709\C_Program Files\MyWebSearch\bar\1.bin\F3WPHOOK.DLL Win32/FunWeb application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C D:\_OTL\MovedFiles\09102010_000709\C_Program Files\MyWebSearch\bar\1.bin\M3AUXSTB.DLL Win32/Toolbar.MyWebSearch.H application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C D:\_OTL\MovedFiles\09102010_000709\C_Program Files\MyWebSearch\bar\1.bin\M3DLGHK.DLL Win32/Toolbar.MyWebSearch.I application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C D:\_OTL\MovedFiles\09102010_000709\C_Program Files\MyWebSearch\bar\1.bin\M3HTML.DLL Win32/Toolbar.MyWebSearch application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C D:\_OTL\MovedFiles\09102010_000709\C_Program Files\MyWebSearch\bar\1.bin\M3IMPIPE.EXE Win32/Toolbar.MyWebSearch application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C D:\_OTL\MovedFiles\09102010_000709\C_Program Files\MyWebSearch\bar\1.bin\M3MSG.DLL Win32/Toolbar.MyWebSearch application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C D:\_OTL\MovedFiles\09102010_000709\C_Program Files\MyWebSearch\bar\1.bin\M3OUTLCN.DLL a variant of Win32/Toolbar.MyWebSearch.J application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C D:\_OTL\MovedFiles\09102010_000709\C_Program Files\MyWebSearch\bar\1.bin\M3PLUGIN.DLL Win32/Toolbar.MyWebSearch application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C D:\_OTL\MovedFiles\09102010_000709\C_Program Files\MyWebSearch\bar\1.bin\M3SKIN.DLL Win32/Toolbar.MyWebSearch application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C D:\_OTL\MovedFiles\09102010_000709\C_Program Files\MyWebSearch\bar\1.bin\M3SKPLAY.EXE Win32/Toolbar.MyWebSearch application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C D:\_OTL\MovedFiles\09102010_000709\C_Program Files\MyWebSearch\bar\1.bin\M3SLSRCH.EXE Win32/Toolbar.MyWebSearch.J application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C D:\_OTL\MovedFiles\09102010_000709\C_Program Files\MyWebSearch\bar\1.bin\M3SRCHMN.EXE Win32/Toolbar.MyWebSearch.I application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C D:\_OTL\MovedFiles\09102010_000709\C_Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL Win32/Toolbar.MyWebSearch application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C D:\_OTL\MovedFiles\09102010_000709\C_Program Files\MyWebSearch\bar\1.bin\MWSMLBTN.DLL Win32/Toolbar.MyWebSearch application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C D:\_OTL\MovedFiles\09102010_000709\C_Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE Win32/Toolbar.MyWebSearch application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C D:\_OTL\MovedFiles\09102010_000709\C_Program Files\MyWebSearch\bar\1.bin\MWSOEPLG.DLL Win32/Toolbar.MyWebSearch.J application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C D:\_OTL\MovedFiles\09102010_000709\C_Program Files\MyWebSearch\bar\1.bin\MWSOESTB.DLL Win32/Toolbar.MyWebSearch application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C D:\_OTL\MovedFiles\09102010_000709\C_Program Files\MyWebSearch\bar\1.bin\MWSSRCAS.DLL Win32/Toolbar.MyWebSearch application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C D:\_OTL\MovedFiles\09102010_000709\C_Program Files\MyWebSearch\bar\1.bin\MWSSVC.EXE Win32/Toolbar.MyWebSearch application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C D:\_OTL\MovedFiles\09102010_000709\C_Program Files\MyWebSearch\bar\1.bin\MWSUABTN.DLL Win32/Toolbar.MyWebSearch application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C D:\_OTL\MovedFiles\09102010_000709\C_Program Files\MyWebSearch\bar\1.bin\NPMYWEBS.DLL Win32/Toolbar.MyWebSearch application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C D:\_OTL\MovedFiles\09102010_000709\C_Windows\System32\f3PSSavr.scr Win32/Toolbar.MyWebSearch application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

упс....голям срам.поне се научих снимки да правя май нещо и с прикачените файлове бъркам,но не успях по друг начин checkup.txt Extras.Txt OTL.Txt

тази снимка ме озори

Security Check: ми иска ключ

тъкмо му се чудих Attach.txt

това трябва да е DDS.txt mbam-log-2010-09-09 (21-27-00).txt

готово.оправиха се.сега да си инсталирам ли пак Malwarebytes Anti-Malware.безопасно ли е да я ползвам.

всъщност единствената причина,че въобще успявам да отворя интернет е,че имах икона за фейсбука си на екрана.само от там мога да си отворя гугъла.иначе от иконите не ми го отваря,нито пък интернет експлорер.като кликна излиза пак текстов документ.а иначе явно програмите работят защото u-torrent от екрана не ми се отваря(тоест отваря като текст)а като тръгна да тегля файл-работи.файла се тегли-но като се опитам да го отворя пак текст.

не става!изписва ми това"не може да внася в D\users\user\downloads\fix.reg. не всички данни са успешно записани във registry.some ключ са отворени от системата или други процеси"

всъщност не мога да отворя никаква програма.която и да се опитам и от декстопа и от местоположението на файла ми отваря само такъв документ.мисля че се отнася за всички инсталирани програми.аз изтрих програмата,но преди това се опитвах многократно да я отворя и не може.а сега не мога да я инсталирам

пробвах,обаче проблема е,че като се опитам да го отворя следкато се изтегли пак ми се отваря като notepad

след сканиране с Malwarebytes' Anti-Malware когато запаметих notepad документа и след това ми се рестартира компютъра за да довърши почистването,абсплютно всички изтеглени програми ми се отварят като notepad документ.скайп,гугъл хром,интернет експлорер-абе всичко.за резултатите от сканирането-ми не знам дали са верни...но може би да защото си зареждах телефона на компютара.е та телефона и той май сдаде багажа..пробвах какво ли не да променя с друга програма да ми отваря но не става.дори и иконите на екрана са с картинката на notepad. та въпроса ми е може ли вирус да направи това.посъветваха ме да да деинсталирам Malwarebytes' Anti-Malware.направих го и пак същото. прикачам резултатите от сканирането.благодаря предварително. mbam-log-2010-09-09 (13-40-35).txt