knom

Сърдечни благодарности. Наистина много оценявам помощта.Лека вечер.

Получи се.Рестартирах и не се появи.

Да.Сега пак го рестартирах и пак се появи.

SUPERAntiSpyware Scan Log http://www.superantispyware.com Generated 08/19/2010 at 11:10 PM Application Version : 4.41.1000 Core Rules Database Version : 5383 Trace Rules Database Version: 3195 Scan type : Complete Scan Total Scan Time : 00:22:04 Memory items scanned : 280 Memory threats detected : 0 Registry items scanned : 7129 Registry threats detected : 0 File items scanned : 23574 File threats detected : 9 Adware.Tracking Cookie .statcounter.com [ C:\Documents and Settings\Usr\Application Data\Mozilla\Firefox\Profiles\ln46abpy.default\cookies.sqlite ] .doubleclick.net [ C:\Documents and Settings\Usr\Application Data\Mozilla\Firefox\Profiles\ln46abpy.default\cookies.sqlite ] .smartadserver.com [ C:\Documents and Settings\Usr\Application Data\Mozilla\Firefox\Profiles\ln46abpy.default\cookies.sqlite ] .smartadserver.com [ C:\Documents and Settings\Usr\Application Data\Mozilla\Firefox\Profiles\ln46abpy.default\cookies.sqlite ] .smartadserver.com [ C:\Documents and Settings\Usr\Application Data\Mozilla\Firefox\Profiles\ln46abpy.default\cookies.sqlite ] .imrworldwide.com [ C:\Documents and Settings\Usr\Application Data\Mozilla\Firefox\Profiles\ln46abpy.default\cookies.sqlite ] .imrworldwide.com [ C:\Documents and Settings\Usr\Application Data\Mozilla\Firefox\Profiles\ln46abpy.default\cookies.sqlite ] .smartadserver.com [ C:\Documents and Settings\Usr\Application Data\Mozilla\Firefox\Profiles\ln46abpy.default\cookies.sqlite ] .smartadserver.com [ C:\Documents and Settings\Usr\Application Data\Mozilla\Firefox\Profiles\ln46abpy.default\cookies.sqlite ]

Ами не . Единствено все още излиза онази грешка след като рестартирам компютъра .

Ето файла: Report.txt

All processes killed ========== OTL ========== Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveAutoRun deleted successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully. Registry value HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveAutoRun deleted successfully. Registry value HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully. Registry value HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveAutoRun not found. Registry value HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun not found. Registry value HKEY_USERS\S-1-5-21-1757981266-1336601894-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveAutoRun deleted successfully. Registry value HKEY_USERS\S-1-5-21-1757981266-1336601894-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully. Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\\Authentication Packages:OWS\S deleted successfully. C:\AUTOEXEC.BAT moved successfully. ADS C:\Documents and Settings\All Users\Application Data\TEMP:6FD3C973 deleted successfully. ========== REGISTRY ========== Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall\ deleted successfully. ========== COMMANDS ========== [EMPTYTEMP] User: Administrator ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: All Users User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: LocalService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Usr ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 9042309 bytes ->FireFox cache emptied: 0 bytes ->Flash cache emptied: 434 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 19569 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 1266865 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 10,00 mb OTL by OldTimer - Version 3.2.10.0 log created on 08192010_211118 Files\Folders moved on Reboot... C:\Documents and Settings\Usr\Local Settings\Temporary Internet Files\Content.IE5\NIQ12ZT4\adsCA5CNNM3.htm moved successfully. C:\Documents and Settings\Usr\Local Settings\Temporary Internet Files\Content.IE5\NIQ12ZT4\adsCAUWNRO3.htm moved successfully. C:\Documents and Settings\Usr\Local Settings\Temporary Internet Files\Content.IE5\AF0L3BV8\xd_proxy[1].htm moved successfully. C:\Documents and Settings\Usr\Local Settings\Temporary Internet Files\Content.IE5\045MSFQV\adsCAMRWZUE.htm moved successfully. C:\Documents and Settings\Usr\Local Settings\Temporary Internet Files\Content.IE5\045MSFQV\adsCAYU7TST.htm moved successfully. C:\Documents and Settings\Usr\Local Settings\Temporary Internet Files\Content.IE5\045MSFQV\afr[2].htm moved successfully. C:\Documents and Settings\Usr\Local Settings\Temporary Internet Files\Content.IE5\045MSFQV\index[5].php moved successfully. C:\Documents and Settings\Usr\Local Settings\Temporary Internet Files\Content.IE5\045MSFQV\like[1].htm moved successfully. C:\Documents and Settings\Usr\Local Settings\Temporary Internet Files\AntiPhishing\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat moved successfully. File\Folder C:\WINDOWS\temp\~DF5AAC.tmp not found! File\Folder C:\WINDOWS\temp\~DF5AB7.tmp not found! File\Folder C:\WINDOWS\temp\~DF5B19.tmp not found! File\Folder C:\WINDOWS\temp\~DF5B2E.tmp not found! File\Folder C:\WINDOWS\temp\~DF5C40.tmp not found! File\Folder C:\WINDOWS\temp\~DF5C45.tmp not found! Registry entries deleted on Reboot...

Eто файловете: OTL.Txt Extras.Txt

Направих всичко. P.S.Преди да затворя AVG и да изрегля Service Pack 3 , антивирусната откри и премахна вирус , който намери в файла ff2.exe

Пуснах ff2.exe дадох yes , но след това излезе прозорец на който пишеше само error и после компютърът се рестартира . След рестартирането излезе един син прозорец на който пише: Please wait. ComboFix is preparing to run. А на заден план на desktop-а ми няма нищо. Така е вече 10 минути.Да продължа ли да чакам?

Пуснах програмата преди половин час и още в началото зареди на три чертички и спря.Нормално ли е да работи толкова бавно?

Направих всичко , но докато сканираше изведнъж екранът стана син и ми изписа , че е станала някаква грешка и трябва да рестартирам , а ако след рестартирането не се оправи да вляза в Safe Mode. Рестартирах го и се оправи ( освен че пак излезе онази другата грешка ). И сега не знам , пак ли да повторя сканирането?

Качих файла , а иначе съобщението още се появява. Ето линк: http://www.virustotal.com/file-scan/reanalysis.html?id=73681e7fb6e8b84f1cd9a9e7accec90f4f267ce887c59824e93cfda28455308f-1282224630

Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Database version: 4448 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 19.8.2010 г. 16:08:52 mbam-log-2010-08-19 (16-08-52).txt Scan type: Quick scan Objects scanned: 140037 Time elapsed: 4 minute(s), 19 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) Attach.txt DDS.txt

Компютъра се рестартира и отново излезе същата грешка.А ето го и лог файла: All processes killed ========== OTL ========== Service LiveUpdate stopped successfully! Service LiveUpdate deleted successfully! File C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE File not found not found. Service HidServ stopped successfully! Service HidServ deleted successfully! File C:\WINDOWS\System32\hidserv.dll File not found not found. Service SymEvent stopped successfully! Service SymEvent deleted successfully! File C:\WINDOWS\System32\Drivers\SYMEVENT.SYS File not found not found. Service AmdK8 stopped successfully! Service AmdK8 deleted successfully! File C:\WINDOWS\System32\DRIVERS\AmdK8.sys File not found not found. Registry value HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce\\ deleted successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\HonorAutoRunSetting deleted successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\DisableStatusMessages deleted successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\VerboseStatus deleted successfully. Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\\Authentication Packages:OWS\S deleted successfully. ADS C:\Documents and Settings\All Users\Application Data\TEMP:EBA3B6EA deleted successfully. ADS C:\Documents and Settings\All Users\Application Data\TEMP:B42826C8 deleted successfully. ADS C:\Documents and Settings\All Users\Application Data\TEMP:BD172D58 deleted successfully. Unable to delete ADS C:\Documents and Settings\All Users\Application Data\TEMP:6FD3C . ========== FILES ========== C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\xfer folder moved successfully. C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\Quarantine\16980001 folder moved successfully. C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\Quarantine\16980000 folder moved successfully. C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\Quarantine\0FE00000 folder moved successfully. C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\Quarantine\0F340000 folder moved successfully. C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\Quarantine\0E480000 folder moved successfully. C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\Quarantine\0DBC0001 folder moved successfully. C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\Quarantine\0DBC0000 folder moved successfully. C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\Quarantine\0BA80000 folder moved successfully. C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\Quarantine\0B2C0000 folder moved successfully. C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\Quarantine\0B140000 folder moved successfully. C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\Quarantine\0AD40000 folder moved successfully. C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\Quarantine\0AC80000 folder moved successfully. C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\Quarantine\0A980001 folder moved successfully. C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\Quarantine\0A980000 folder moved successfully. C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\Quarantine\09340000 folder moved successfully. C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\Quarantine\01340000 folder moved successfully. C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\Quarantine folder moved successfully. C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\I2_LDVP.TMP folder moved successfully. C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection folder moved successfully. C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP folder moved successfully. C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC folder moved successfully. C:\Documents and Settings\All Users\Application Data\Symantec\SavSubEng\Temp folder moved successfully. C:\Documents and Settings\All Users\Application Data\Symantec\SavSubEng folder moved successfully. C:\Documents and Settings\All Users\Application Data\Symantec folder moved successfully. ========== COMMANDS ========== [EMPTYTEMP] User: Administrator ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: All Users User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: LocalService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: Usr ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 14649102 bytes ->FireFox cache emptied: 27961477 bytes ->Flash cache emptied: 615 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 10896686 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes RecycleBin emptied: 213930 bytes Total Files Cleaned = 51,00 mb OTL by OldTimer - Version 3.2.10.0 log created on 08192010_153722 Files\Folders moved on Reboot... C:\Documents and Settings\Usr\Local Settings\Temporary Internet Files\Content.IE5\X0G82HYD\adsCAFK9JC9.htm moved successfully. C:\Documents and Settings\Usr\Local Settings\Temporary Internet Files\Content.IE5\T38YK11J\adsCAC4BBIY.htm moved successfully. C:\Documents and Settings\Usr\Local Settings\Temporary Internet Files\Content.IE5\HDANZVO2\adsCA9986T2.htm moved successfully. C:\Documents and Settings\Usr\Local Settings\Temporary Internet Files\Content.IE5\HDANZVO2\adsCAK4LTZL.htm moved successfully. C:\Documents and Settings\Usr\Local Settings\Temporary Internet Files\Content.IE5\HDANZVO2\afr[2].htm moved successfully. C:\Documents and Settings\Usr\Local Settings\Temporary Internet Files\Content.IE5\HDANZVO2\index[1].htm moved successfully. C:\Documents and Settings\Usr\Local Settings\Temporary Internet Files\Content.IE5\6Y9T9GHW\like[3].htm moved successfully. C:\Documents and Settings\Usr\Local Settings\Temporary Internet Files\Content.IE5\6Y9T9GHW\xd_proxy[2].htm moved successfully. C:\Documents and Settings\Usr\Local Settings\Temporary Internet Files\AntiPhishing\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat moved successfully. File\Folder C:\WINDOWS\temp\~DFEEA1.tmp not found! File\Folder C:\WINDOWS\temp\~DFEEA6.tmp not found! File\Folder C:\WINDOWS\temp\~DFEEFC.tmp not found! File\Folder C:\WINDOWS\temp\~DFEF01.tmp not found! File\Folder C:\WINDOWS\temp\~DFEF36.tmp not found! File\Folder C:\WINDOWS\temp\~DFEF3B.tmp not found! Registry entries deleted on Reboot...