swatta

Добре..! Сега искам да изкажа благодарностите си на групата HJT TEAM, и по-специално на колегата nologo и B-boy[styLe], за проявеното внимание и търпение, радвам се, че всеоще се срещат хора като Вас! Друго освен това , няма какво да кажа! А тези редове пиша за хората попаднали на моята тема, които вероятно вече са разбрали каква ГАД е Security Tool - не си губете времето и нервите, ами просто погледнете раздела "Премахване на зловреден софтуер - HiJackThis логове", където ще намерите отговорите на Вашите въпроси, както сторих аз! Успех!!! Отново искрено Благодаря HJT TEAM!!!

Ами, честно да си призная проблемите ми с Security Tool и като цяло с Windows мисля, че изчезнаха още след използването на програмата ComboFix, като изключим необичайното примигване на монитора отвреме на време, което сигурно не се дължи на Security Tool и сигурно е за някоя друга тема, мисля, че всичко вече трябва да е наред ...

Намерих го, ето го съдържанието: Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Database version: 4918 Windows 6.0.6002 Service Pack 2 Internet Explorer 8.0.6001.18975 22.10.2010 г. 23:37:34 mbam-log-2010-10-22 (23-37-34).txt Scan type: Quick scan Objects scanned: 154948 Time elapsed: 11 minute(s), 52 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 60 Registry Values Infected: 1 Registry Data Items Infected: 0 Folders Infected: 1 Files Infected: 4 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CLASSES_ROOT\smart-shopper.hbax (Adware.SmartShopper) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\smart-shopper.hbax.1 (Adware.SmartShopper) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\smart-shopper.iebutton (Adware.SmartShopper) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\smart-shopper.iebutton.1 (Adware.SmartShopper) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\smart-shopper.iebuttona (Adware.SmartShopper) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\smart-shopper.iebuttona.1 (Adware.SmartShopper) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\smart-shopper.iebuttonb (Adware.SmartShopper) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\smart-shopper.iebuttonb.1 (Adware.SmartShopper) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{07b18eaa-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{07b18eac-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{1093995a-ba37-41d2-836e-091067c4ad17} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{120927bf-1700-43bc-810f-fab92549b390} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{17de5e5e-bfe3-4e83-8e1f-8755795359ec} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{1f52a5fa-a705-4415-b975-88503b291728} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{247a115f-06c2-4fb3-967d-2d62d3cf4f0a} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{2e3537fc-cf2f-4f56-af54-5a6a3dd375cc} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{2e9937fc-cf2f-4f56-af54-5a6a3dd375cc} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{3e1656ed-f60e-4597-b6aa-b6a58e171495} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{3e53e2cb-86db-4a4a-8bd9-ffeb7a64df82} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{3e720451-b472-4954-b7aa-33069eb53906} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{3e720453-b472-4954-b7aa-33069eb53906} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{63d0ed2b-b45b-4458-8b3b-60c69bbbd83c} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{63d0ed2d-b45b-4458-8b3b-60c69bbbd83c} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{6e74766c-4d93-4cc0-96d1-47b8e07ff9ca} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{72ee7f04-15bd-4845-a005-d6711144d86a} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{741de825-a6f0-4497-9aa6-8023cf9b0fff} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{7473d291-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{7473d293-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{7473d295-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{7473d297-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{90449521-d834-4703-bb4e-d3aa44042ff8} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{90f62ef7-58d1-4e8e-bb3e-cfb10ba9e47b} (Adware.SmartShopper) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{991aac62-b100-47ce-8b75-253965244f69} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{a626cdbd-3d13-4f78-b819-440a28d7e8fc} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{b2b92bc9-e149-4ee8-a93e-0b8cfb329808} (Adware.SmartShopper) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{bbabdc90-f3d5-4801-863a-ee6ae529862d} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{cf54be1c-9359-4395-8533-1657cf209cfe} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{d6ff3684-ad3b-48eb-bbb4-b9e6c5a355c1} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{de38c398-b328-4f4c-a3ad-1b5e4ed93477} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{e342af55-b78a-4cd0-a2bb-da7f52d9d25e} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{e342af55-b78a-4cd0-a2bb-da7f52d9d25f} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{e79b1445-dfea-4bef-a786-e0c0f33c863b} (Adware.SmartShopper) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{e79dfbc9-5697-4fbd-94e5-5b2a9c7c1612} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{e79dfbcb-5697-4fbd-94e5-5b2a9c7c1612} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{eb9e5c1c-b1f9-4c2b-be8a-27d6446fdaf8} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{f87d7fb5-9dc5-4c8c-b998-d8dfe02e2978} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{1e0de227-5ce4-4ea3-ab0c-8b03e1aa76bc} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{4cf088bd-be95-40a5-be9b-677f8683edea} (Adware.SmartShopper) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{6fac4823-815e-4361-836e-46d65ed2550b} (Adware.SmartShopper) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{911f251e-34fd-465e-b6ce-df00ff49a6be} (Adware.SmartShopper) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{fe4f1649-8909-49c0-87ba-24d65120db46} (Adware.SmartShopper) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Typelib\{d518921a-4a03-425e-9873-b9a71756821e} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Typelib\{e47caee0-deea-464a-9326-3f2801535a4d} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Typelib\{f42228fb-e84e-479e-b922-fbbd096e792c} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Typelib\{022c671f-6cba-4a03-a8f9-3b3a361b235a} (Adware.SmartShopper) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Typelib\{8ad815fc-607b-419f-8b70-d345a507a54e} (Adware.SmartShopper) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Smart-Shopper (Adware.SmartShopper) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Smart-Shopper (Adware.SmartShopper) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Smart-Shopper (Adware.SmartShopper) -> Quarantined and deleted successfully. Registry Values Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media\WMSDK\Sources\f3popularscreensavers (Adware.MyWebSearch) -> Quarantined and deleted successfully. Registry Data Items Infected: (No malicious items detected) Folders Infected: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SmartShopper (Adware.SmartShopper) -> Quarantined and deleted successfully. Files Infected: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SmartShopper\SmartShopper - Comapre product prices.lnk (Adware.SmartShopper) -> Quarantined and deleted successfully. C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SmartShopper\SmartShopper - Compare travel rate.lnk (Adware.SmartShopper) -> Quarantined and deleted successfully. C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SmartShopper\SmartShopper Help.lnk (Adware.SmartShopper) -> Quarantined and deleted successfully. C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SmartShopper\Uninstall SmartShopper.lnk (Adware.SmartShopper) -> Quarantined and deleted successfully.

Последвах указанията и всичко беше наред! Програмата откри 64 зарази, след което ги изтри и ми създаде Log файл, който аз копирах, за да мога да кача в темата, но междувременно тя ме "подкани" да рестартирам компютъра и след като го направих - изгубих файла.... бихте ли ме посъвтвали къде да го открия, за да мога да го кача тук! Извинявам се за грешката - трябваше първо да постна файла и после да рестартирам системата ... http://www.kaldata.com/forums/public/style_emoticons/<#EMO_DIR#>/sad.gif

Мисля, че това трябва да бъде линка към архива в Rapide Share PS. Аз, Ви благодаря за Вашето търпение! Линк: http://rapidshare.com/.........../Qoobox.zip

Съжалявам, че отново се включвам с лоши новини (за Мен http://www.kaldata.com/forums/public/style_emoticons/<#EMO_DIR#>/sad.gif ), но създадох архив на файла и след опита ми да го кача в Skatafka.com ми се появи съобщение в сайта (Skatafka.com), че не съм избрал файл за качване.... това съобщение се предхожда от друго, което ми казва, че файла се качва и да "Проявиме Търпение" - но до ТУК! Между другото създадох архив и го "сейвнах" на десктопа, честно казано неразбрах коя програма създаде архива.. дали WinRar или посочената от Вас "PeaZip Portable" , но дефакто архива същвствува там и аз успявам да го посоча в сайта "Skatafka.com", но явно имам някакъв проблем с качването .... Хах, поредния опит отново е неуспешен ... поствам и линк, към съобщението Линк: http://skatafka.com/upload.php

Съжалявам за късното си включване, но имах проблем със захранването (тока) - съответно и интернет достъпа, затова чак сега виждам поста Ви, следвайки указанията стигнах до това(Log файла) : All processes killed Error: Unable to interpret <%SYSTEMDRIVE%\*.* > in the current context! Error: Unable to interpret <%systemroot%\Fonts\*.com > in the current context! Error: Unable to interpret <%systemroot%\Fonts\*.dll > in the current context! Error: Unable to interpret <%systemroot%\Fonts\*.ini > in the current context! Error: Unable to interpret <%systemroot%\Fonts\*.ini2 > in the current context! Error: Unable to interpret <%systemroot%\*.scr > in the current context! Error: Unable to interpret <%systemroot%\*._sy > in the current context! Error: Unable to interpret <%systemroot%\REPAIR\*.bak1 > in the current context! Error: Unable to interpret <%systemroot%\REPAIR\*.ini > in the current context! Error: Unable to interpret <%systemroot%\system32\*.wt > in the current context! Error: Unable to interpret <%systemroot%\system32\*.ruy > in the current context! Error: Unable to interpret <%systemroot%\system32\*.jpg > in the current context! Error: Unable to interpret <%systemroot%\system32\spool\prtprocs\w32x86\*.* > in the current context! Error: Unable to interpret <%APPDATA%\Update\*.* > in the current context! Error: Unable to interpret <%APPDATA%\Microsoft\*.* > in the current context! Error: Unable to interpret <%APPDATA%\Adobe\Update\*.* > in the current context! Error: Unable to interpret <%ALLUSERSPROFILE%\Favorites\*.* > in the current context! Error: Unable to interpret <%PROGRAMFILES%\*.* > in the current context! Error: Unable to interpret <%systemroot%\*. /mp /s > in the current context! Error: Unable to interpret <%systemroot%\system32\*.dll /lockedfiles > in the current context! Error: Unable to interpret <%systemroot%\Tasks\*.job /lockedfiles > in the current context! Error: Unable to interpret <%systemroot%\System32\config\*.sav > in the current context! Error: Unable to interpret <%systemroot%\system32\user32.dll /md5 > in the current context! Error: Unable to interpret <%systemroot%\system32\ws2_32.dll /md5 > in the current context! Error: Unable to interpret <%systemroot%\system32\ws2help.dll /md5 > in the current context! Error: Unable to interpret <HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU > in the current context! Error: Unable to interpret <HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs> in the current context! ========== OTL ========== Service SessionLauncher stopped successfully! Service SessionLauncher deleted successfully! File C:\Users\ADMINI~1\AppData\Local\Temp\DX9\SessionLauncher.exe File not found not found. Service Nero BackItUp Scheduler 4.0 stopped successfully! Service Nero BackItUp Scheduler 4.0 deleted successfully! File C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe File not found not found. Service upperdev stopped successfully! Service upperdev deleted successfully! File C:\Windows\System32\DRIVERS\usbser_lowerflt.sys File not found not found. Service NwlnkFwd stopped successfully! Service NwlnkFwd deleted successfully! File C:\Windows\System32\DRIVERS\nwlnkfwd.sys File not found not found. Service NwlnkFlt stopped successfully! Service NwlnkFlt deleted successfully! File C:\Windows\System32\DRIVERS\nwlnkflt.sys File not found not found. Service IpInIp stopped successfully! Service IpInIp deleted successfully! File C:\Windows\System32\DRIVERS\ipinip.sys File not found not found. Service catchme stopped successfully! Service catchme deleted successfully! File C:\Users\Savata\AppData\Local\Temp\catchme.sys File not found not found. Registry value HKEY_USERS\S-1-5-21-302866914-1167575752-134271870-1003\Software\Microsoft\Internet Explorer\URLSearchHooks\\*{0b876028-b388-4f6d-922f-f52faec8535f} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\*{0b876028-b388-4f6d-922f-f52faec8535f}\ not found. Registry value HKEY_USERS\S-1-5-21-302866914-1167575752-134271870-1003\Software\Microsoft\Internet Explorer\URLSearchHooks\\*{9CB65206-89C4-402c-BA80-02D8C59F9B1D} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\*{9CB65206-89C4-402c-BA80-02D8C59F9B1D}\ not found. Registry value HKEY_USERS\S-1-5-21-302866914-1167575752-134271870-1003\Software\Microsoft\Internet Explorer\URLSearchHooks\\*{CFBFAE00-17A6-11D0-99CB-00C04FD64497} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\*{CFBFAE00-17A6-11D0-99CB-00C04FD64497}\ not found. Registry value HKEY_USERS\S-1-5-21-302866914-1167575752-134271870-1003\Software\Microsoft\Internet Explorer\URLSearchHooks\\*{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\*{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}\ not found. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}\ not found. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7632ABCA-B104-4fbc-9C70-419C4147061B}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7632ABCA-B104-4fbc-9C70-419C4147061B}\ deleted successfully. C:\Program Files\Finjan Secure Browsing\bho.dll moved successfully. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9CB65201-89C4-402c-BA80-02D8C59F9B1D}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9CB65201-89C4-402c-BA80-02D8C59F9B1D}\ deleted successfully. C:\Program Files\AskTBar\SrchAstt\1.bin\A5SRCHAS.DLL moved successfully. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FE063DB1-4EC0-403e-8DD8-394C54984B2C}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FE063DB1-4EC0-403e-8DD8-394C54984B2C}\ deleted successfully. C:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL moved successfully. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}\ not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{0BF43445-2F28-4351-9252-17FE6E806AA0} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0BF43445-2F28-4351-9252-17FE6E806AA0}\ not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{3041d03e-fd4b-44e0-b742-2d9b88305f98} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3041d03e-fd4b-44e0-b742-2d9b88305f98}\ deleted successfully. C:\Program Files\AskBarDis\bar\bin\askBar.dll moved successfully. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{B99F805C-F0B1-48EA-8C8B-753BFCBED913} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B99F805C-F0B1-48EA-8C8B-753BFCBED913}\ deleted successfully. File C:\Program Files\Finjan Secure Browsing\bho.dll not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{FE063DB9-4EC0-403e-8DD8-394C54984B2C} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FE063DB9-4EC0-403e-8DD8-394C54984B2C}\ deleted successfully. File C:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL not found. Registry value HKEY_USERS\S-1-5-21-302866914-1167575752-134271870-1003\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{21FA44EF-376D-4D53-9B0F-8A89D3229068} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{21FA44EF-376D-4D53-9B0F-8A89D3229068}\ not found. Registry value HKEY_USERS\S-1-5-21-302866914-1167575752-134271870-1003\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{3041D03E-FD4B-44E0-B742-2D9B88305F98} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3041D03E-FD4B-44E0-B742-2D9B88305F98}\ not found. File C:\Program Files\AskBarDis\bar\bin\askBar.dll not found. Registry value HKEY_USERS\S-1-5-21-302866914-1167575752-134271870-1003\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{B99F805C-F0B1-48EA-8C8B-753BFCBED913} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B99F805C-F0B1-48EA-8C8B-753BFCBED913}\ not found. File C:\Program Files\Finjan Secure Browsing\bho.dll not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\NBKeyScan deleted successfully. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\SearchSettings deleted successfully. Registry value HKEY_USERS\S-1-5-21-302866914-1167575752-134271870-1003\Software\Microsoft\Windows\CurrentVersion\Run\\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} deleted successfully. Registry value HKEY_USERS\S-1-5-21-302866914-1167575752-134271870-1003\Software\Microsoft\Windows\CurrentVersion\Run\\DW6 deleted successfully. Starting removal of ActiveX control {E2883E8F-472F-4FB0-9522-AC9BF37916A7} C:\Windows\Downloaded Program Files\gp.inf not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\\{AEB6717E-7E19-11d0-97EE-00C04FD91972} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AEB6717E-7E19-11d0-97EE-00C04FD91972}\ not found. ========== FILES ========== C:\Program Files\AskTBar\SrchAstt\1.bin folder moved successfully. C:\Program Files\AskTBar\SrchAstt folder moved successfully. C:\Program Files\AskTBar\bar\1.bin folder moved successfully. C:\Program Files\AskTBar\bar folder moved successfully. C:\Program Files\AskTBar folder moved successfully. File/Folder C:\Windows\tasks\at*.job not found. recycler not found in C:\ recycler not found in Q:\ recycler not found in S:\ < ipconfig /flushdns /c > Windows IP Configuration Successfully flushed the DNS Resolver Cache. C:\Users\Savata\Desktop\cmd.bat deleted successfully. C:\Users\Savata\Desktop\cmd.txt deleted successfully. ========== COMMANDS ========== C:\Windows\System32\drivers\etc\Hosts moved successfully. HOSTS file reset successfully [EMPTYTEMP] User: Administrator User: All Users User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Public User: Savata ->Temp folder emptied: 5980778 bytes ->Temporary Internet Files folder emptied: 173793108 bytes ->Java cache emptied: 26424754 bytes ->Google Chrome cache emptied: 18161722 bytes ->Flash cache emptied: 17590 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 3186 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes %systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 46713 bytes %systemroot%\system32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment folder emptied: 25494475 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 238,00 mb [EMPTYFLASH] User: Administrator User: All Users User: Default User: Default User User: Public User: Savata ->Flash cache emptied: 0 bytes Total Flash Files Cleaned = 0,00 mb OTL by OldTimer - Version 3.2.16.0 log created on 10222010_213747 Files\Folders moved on Reboot... File\Folder C:\Users\Savata\AppData\Local\Temp\~DF117F.tmp not found! File\Folder C:\Users\Savata\AppData\Local\Temp\~DF11A6.tmp not found! File\Folder C:\Users\Savata\AppData\Local\Temp\~DF1235.tmp not found! File\Folder C:\Users\Savata\AppData\Local\Temp\~DF1258.tmp not found! File\Folder C:\Users\Savata\AppData\Local\Temp\~DF14AA.tmp not found! File\Folder C:\Users\Savata\AppData\Local\Temp\~DF14D9.tmp not found! File\Folder C:\Users\Savata\AppData\Local\Temp\~DF1602.tmp not found! File\Folder C:\Users\Savata\AppData\Local\Temp\~DF162C.tmp not found! File\Folder C:\Users\Savata\AppData\Local\Temp\~DF164.tmp not found! File\Folder C:\Users\Savata\AppData\Local\Temp\~DF18B.tmp not found! File\Folder C:\Users\Savata\AppData\Local\Temp\~DF1905.tmp not found! File\Folder C:\Users\Savata\AppData\Local\Temp\~DF192C.tmp not found! File\Folder C:\Users\Savata\AppData\Local\Temp\~DF1ADB.tmp not found! File\Folder C:\Users\Savata\AppData\Local\Temp\~DF1B02.tmp not found! File\Folder C:\Users\Savata\AppData\Local\Temp\~DF1CDA.tmp not found! File\Folder C:\Users\Savata\AppData\Local\Temp\~DF1D06.tmp not found! File\Folder C:\Users\Savata\AppData\Local\Temp\~DF1F04.tmp not found! File\Folder C:\Users\Savata\AppData\Local\Temp\~DF1F26.tmp not found! File\Folder C:\Users\Savata\AppData\Local\Temp\~DF222E.tmp not found! File\Folder C:\Users\Savata\AppData\Local\Temp\~DF225F.tmp not found! File\Folder C:\Users\Savata\AppData\Local\Temp\~DF230A.tmp not found! File\Folder C:\Users\Savata\AppData\Local\Temp\~DF2355.tmp not found! File\Folder C:\Users\Savata\AppData\Local\Temp\~DF25B7.tmp not found! File\Folder C:\Users\Savata\AppData\Local\Temp\~DF25DC.tmp not found! File\Folder C:\Users\Savata\AppData\Local\Temp\~DF2875.tmp not found! File\Folder C:\Users\Savata\AppData\Local\Temp\~DF289A.tmp not found! File\Folder C:\Users\Savata\AppData\Local\Temp\~DF2B46.tmp not found! File\Folder C:\Users\Savata\AppData\Local\Temp\~DF2B58.tmp not found! File\Folder C:\Users\Savata\AppData\Local\Temp\~DF371.tmp not found! File\Folder C:\Users\Savata\AppData\Local\Temp\~DF395.tmp not found! File\Folder C:\Users\Savata\AppData\Local\Temp\~DF5D2.tmp not found! File\Folder C:\Users\Savata\AppData\Local\Temp\~DF5F8.tmp not found! File\Folder C:\Users\Savata\AppData\Local\Temp\~DF837.tmp not found! File\Folder C:\Users\Savata\AppData\Local\Temp\~DF85C.tmp not found! File\Folder C:\Users\Savata\AppData\Local\Temp\~DF9E4.tmp not found! File\Folder C:\Users\Savata\AppData\Local\Temp\~DF9F9B.tmp not found! File\Folder C:\Users\Savata\AppData\Local\Temp\~DF9FBF.tmp not found! File\Folder C:\Users\Savata\AppData\Local\Temp\~DFA0A.tmp not found! File\Folder C:\Users\Savata\AppData\Local\Temp\~DFAC92.tmp not found! File\Folder C:\Users\Savata\AppData\Local\Temp\~DFACB5.tmp not found! File\Folder C:\Users\Savata\AppData\Local\Temp\~DFAE0A.tmp not found! File\Folder C:\Users\Savata\AppData\Local\Temp\~DFAE29.tmp not found! File\Folder C:\Users\Savata\AppData\Local\Temp\~DFC1A.tmp not found! File\Folder C:\Users\Savata\AppData\Local\Temp\~DFC3F.tmp not found! File\Folder C:\Users\Savata\AppData\Local\Temp\~DFC4B4.tmp not found! File\Folder C:\Users\Savata\AppData\Local\Temp\~DFC4D4.tmp not found! File\Folder C:\Users\Savata\AppData\Local\Temp\~DFC5E2.tmp not found! File\Folder C:\Users\Savata\AppData\Local\Temp\~DFC607.tmp not found! File\Folder C:\Users\Savata\AppData\Local\Temp\~DFCA75.tmp not found! File\Folder C:\Users\Savata\AppData\Local\Temp\~DFCAC6.tmp not found! File\Folder C:\Users\Savata\AppData\Local\Temp\~DFE0F.tmp not found! File\Folder C:\Users\Savata\AppData\Local\Temp\~DFE37.tmp not found! File\Folder C:\Users\Savata\AppData\Local\Temp\~DFEB38.tmp not found! File\Folder C:\Users\Savata\AppData\Local\Temp\~DFEB49.tmp not found! File\Folder C:\Users\Savata\AppData\Local\Temp\~DFEBBA.tmp not found! File\Folder C:\Users\Savata\AppData\Local\Temp\~DFEBDD.tmp not found! File\Folder C:\Users\Savata\AppData\Local\Temp\~DFEE60.tmp not found! File\Folder C:\Users\Savata\AppData\Local\Temp\~DFEE8A.tmp not found! File\Folder C:\Users\Savata\AppData\Local\Temp\~DFF072.tmp not found! File\Folder C:\Users\Savata\AppData\Local\Temp\~DFF096.tmp not found! File\Folder C:\Users\Savata\AppData\Local\Temp\~DFF253.tmp not found! File\Folder C:\Users\Savata\AppData\Local\Temp\~DFF274.tmp not found! File\Folder C:\Users\Savata\AppData\Local\Temp\~DFFBC1.tmp not found! File\Folder C:\Users\Savata\AppData\Local\Temp\~DFFC16.tmp not found! File\Folder C:\Users\Savata\AppData\Local\Temp\~DFFC50.tmp not found! File\Folder C:\Users\Savata\AppData\Local\Temp\~DFFC73.tmp not found! File\Folder C:\Users\Savata\AppData\Local\Temp\~DFFE0B.tmp not found! File\Folder C:\Users\Savata\AppData\Local\Temp\~DFFE32.tmp not found! File\Folder C:\Users\Savata\AppData\Local\Temp\~DFFFB1.tmp not found! File\Folder C:\Users\Savata\AppData\Local\Temp\~DFFFD8.tmp not found! C:\Users\Savata\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\Z53QEZK4\adsCAIEPAT0.htm moved successfully. C:\Users\Savata\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\XKVS0AE2\adsCA39ZU6F.htm moved successfully. C:\Users\Savata\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\X9H9WMB2\adsCABAR58Y.htm moved successfully. C:\Users\Savata\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\X9H9WMB2\afr[1].htm moved successfully. C:\Users\Savata\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\S7M1N25S\adsCAMLZOFR.htm moved successfully. C:\Users\Savata\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\KDU8MC76\index[1].htm moved successfully. C:\Users\Savata\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\BJ5TNQQ2\like[1].htm moved successfully. C:\Users\Savata\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\BJ5TNQQ2\xd_proxy[1].htm moved successfully. C:\Users\Savata\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\AntiPhishing\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat moved successfully. C:\Users\Savata\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\MSIMGSIZ.DAT moved successfully. C:\Users\Savata\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\SuggestedSites.dat moved successfully. File move failed. C:\Windows\temp\_avast5_\Webshlock.txt scheduled to be moved on reboot. Registry entries deleted on Reboot... Мдааа.. имам проблем със "Стъпка 2" - немога да направя архив на Qoobox! Използвам "врменна" версия на WinRar, която неуспява да създаде архив на въпросния файл .. WinRar ми изписва: "Quoobox.rar - неможе да се създаде, Access denied"! Ако имате предложение, за някаква архивираща програма, моля споделете. Благодаря!

Добре, изляаоха ми двата текстови файла, обемни са и затова ще се опитам да ги прикача в поста си .. OTL.Txt Extras.Txt

Да, открих го! Ето какво е съдържанието му: ComboFix 10-10-21.06 - Savata 10.2010 г. 15:04:06.1.2 - x86 Microsoft® Windows Vista™ Business 6.0.6002.2.1251.359.1033.18.3036.1989 [GMT 3:00] Running from: C:\Users\Savata\Desktop\ComboFix.exe SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46} * Created a new restore point .

Такаа... след няколкото неуспешни опити да стартирам ComboFix, прочетох по-подробно темите на колегите със сищия проблем и на едно място открих съвет Security Tool да се изключи през таск мениджъра още преди да се е стартирал процеса(веднага след включването на компютъра) - опитах се и се получи! Освен това изключих и windows firewall + антивирусната, и в крайна сметка успях да стартирам ComboFix - сканира около един час, след което излезе събщение, че трие определени файлове и апочна да ги изписва, после програмата сама рестартира компютъра - при включването излезе съобщение от ComboFix, че ще изготвя Log файла - да не се включват никакви други приложения, но преди да се появи текстовия документ, екрана на монитора стана син и Windows ми изписа съобщение, което аз неуспях да прочета и компютъра наново се рестартира ... След поредния рестарт видимо няма проблеми с работата на системата и неоткривам следи от Security Tool (иконката ѝ отдясно на таскбара е изчезнала и програмата засега не се влкючва), но аз така и неуспях да копирам Log файла и да го побликувам в темата, въпроса ми е какво да правя оттук на сетне - да стартирам ли наново ComboFix или да оставя нещата така, докато наново не се задейства Security Tool .... ? Благодаря!

Здравейте nologo и мерси за включването! В момента пиша от друго устройство, за да не "докосвам мишката" на заразения компютър, след като кликнах 2 пъти на иконката на ComboFix той се стартира за части от секундата, след което веднага се появи един от прозорците на Securiry Tool, за да ми съобщи, че това е вирус, аз оставих така прозореца, за да не пипам, в последствие започнаха да излизат множество подобни прозорци със съобщения за различни вируси (аз отново не ги затварях), прави ми впечатление обаче, че ComboFix, не е прекъснал връзката към интернет, защото в таскбара иконката показва, че имам такава, затова не съм сигурен дали изобщо ComboFix работи, най вече никъде немога да видя и процеса му на работа, а отделно и компютъра вече "заспа", аз съм с Windows Vista на лаптопа, освен Avast, който изключих според указанията нямам други защитни програми, Windows Defender, който си беше инсталиран на компютъра при закупуването му - също е изключен, трябва ли дa спра и Windows Firewall? Имам още един въпрос - ако ComboFix работи правилно, трябва ли да се вижда някъде този процес? Благодаря!

Благодаря отново, на този етап проблемите са ми, че когато кликна два пъти върху "rkill", както е описано - нищо се се случва, антивирусната ми програма не го засича като вирус (аз съм с Avast Free Edition), също така не се инсталира, изкачат единствено изкачащите прозорци на Security Tool, които казват, че "rkill" e вирус, аз затварям прозореца и след това нищо не се "случва", вече опитах няколко пъти, като също така давам "ОК" на прозореца от Security Tool, или пък не правя нищо - след известно време той сам се скрива и след него излиза друг със съобщение за вирус, вече с друго име и така до безкрайност .... Същото е и положението и с другата програма "МБАМ" ....

Благодаря Ви, за бързото включване! Отговарям чак сега, защото както споменах вече въпрсната програма постоянно ми рестартира компютъра в същото време излизат и изкачащи прозорци, които затрудняват работата ми като цяло. Последвах връзката от Вашия пост и изтеглих посочените там програми както е описано, но неуспявам да ги инсталирам или неизчаквам достатъчно време, когато започна да инсталирам програмата 'МБАМ', стигам до етап "Continue" след което процеса според мен се прекъсва и аз немога да затам отметките, които е нужно да се зададът, посочение в поста, който Вие ми посочихте. Благодаря!

Здравейте, започвам тази тема за пореден път, защото въпросната програма ми рестартира компютъра през 5 минути и аз неуспявам да я побликувам.Този път ще бъда много кратък, защото времето не ми стига, проблема е същият както при другите колеги заразени със Secrity Tool - пуснали теми в раздела на този форум. Започвам да следвам стъпките посочени в темата "Премахване на зловреден софтуер", първата от които беше да пусна нова тема... Благодаря Ви за помощта предварително!