TuPuoH

Ами давай тогава всички болни от рак в една газова камера и да не се дават много пари.

Извинявай "Господи" мой . Не видях че си слязъл на земята. Всеки лекар е положил Хипократова КЛЕТВА. Както би трябвало да знаеш клетвата означава че ще я спазваш до живот а хипократовата е една от най-обвързващите. Лекарката е длъжна да помогне и да направи всичко възможно за да спаси човешкия живот. Поне толкова колкото и позволяват нашите закони и правила. Сигурен съм че не само на това дете, а и на много други деца в българия без значение от етноса им са се отнасяли със същото отношение от лекарите. Ще ме извиняваш, но преди всичко сме хора и след това трябва да се разделяме по религии цвят на кожата и така нататъка, и точно заради такива хора като теб Доган дойде на власт. Със здраве и дано детето да получи шанс за живот.

Лог от Spyware Doctor: report_Spyware_doctor.htm Avz нищо не откри Log от a-squared Anti-Malware: a_squared_report.txt

Лог от Rootrepeal: Rootrepeal_log.txt

Ето логът. log2.txt

Ето лог от ComboFix: ComboFix 09-02-12.03 - VASIL 2009-02-14 9:26:33.1 - NTFSx86 Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1251.1.1033.18.1918.1084 [GMT 2:00] Running from: c:\users\VASIL\Desktop\combofix.exe Command switches used :: /killall . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\restore\S-1-5-21-1482476501-1644491937-682003330-1013 c:\restore\S-1-5-21-1482476501-1644491937-682003330-1013\Desktop.ini . ((((((((((((((((((((((((( Files Created from 2009-01-14 to 2009-02-14 ))))))))))))))))))))))))))))))) . 2009-02-13 20:42 . 2009-02-13 20:43 <DIR> d-------- C:\HiJackThis 2009-02-13 19:15 . 2009-02-13 19:16 <DIR> d--h----- C:\$AVG8.VAULT$ 2009-02-13 17:32 . 2009-02-14 02:50 <DIR> d-------- c:\windows\System32\drivers\Avg 2009-02-13 17:32 . 2009-02-13 17:32 325,128 --a------ c:\windows\System32\drivers\avgldx86.sys 2009-02-13 17:32 . 2009-02-13 17:32 107,272 --a------ c:\windows\System32\drivers\avgtdix.sys 2009-02-13 17:32 . 2009-02-13 17:32 12,552 --a------ c:\windows\System32\drivers\avgrkx86.sys 2009-02-13 17:32 . 2009-02-13 17:32 10,520 --a------ c:\windows\System32\avgrsstx.dll 2009-02-13 17:31 . 2009-02-13 17:31 <DIR> d-------- c:\users\All Users\avg8 2009-02-13 17:31 . 2009-02-13 17:31 <DIR> d-------- c:\programdata\avg8 2009-02-13 17:31 . 2009-02-13 17:31 23,832 --a------ c:\windows\System32\drivers\avgfwd6x.sys 2009-02-13 17:27 . 2008-06-20 03:14 781,344 --a------ c:\windows\System32\PresentationNative_v0300.dll 2009-02-13 17:27 . 2008-06-20 03:14 622,080 --a------ c:\windows\System32\icardagt.exe 2009-02-13 17:27 . 2008-06-20 03:14 326,160 --a------ c:\windows\System32\PresentationHost.exe 2009-02-13 17:27 . 2008-06-20 03:14 105,016 --a------ c:\windows\System32\PresentationCFFRasterizerNative_v0300.dll 2009-02-13 17:27 . 2008-06-20 03:14 97,800 --a------ c:\windows\System32\infocardapi.dll 2009-02-13 17:27 . 2008-06-20 03:14 43,544 --a------ c:\windows\System32\PresentationHostProxy.dll 2009-02-13 17:27 . 2008-06-20 03:14 37,384 --a------ c:\windows\System32\infocardcpl.cpl 2009-02-13 17:27 . 2008-06-20 03:14 11,264 --a------ c:\windows\System32\icardres.dll 2009-02-13 17:22 . 2008-07-27 20:03 282,112 --a------ c:\windows\System32\mscoree.dll 2009-02-13 17:22 . 2008-07-27 20:03 158,720 --a------ c:\windows\System32\mscorier.dll 2009-02-13 17:22 . 2008-07-27 20:03 96,760 --a------ c:\windows\System32\dfshim.dll 2009-02-13 17:22 . 2008-07-27 20:03 83,968 --a------ c:\windows\System32\mscories.dll 2009-02-13 17:22 . 2008-07-27 20:03 41,984 --a------ c:\windows\System32\netfxperf.dll 2009-02-13 17:21 . 2008-12-05 06:32 428,544 --a------ c:\windows\System32\EncDec.dll 2009-02-13 17:21 . 2008-12-05 06:32 293,376 --a------ c:\windows\System32\psisdecd.dll 2009-02-13 17:21 . 2008-12-05 06:31 217,088 --a------ c:\windows\System32\psisrndr.ax 2009-02-13 17:21 . 2008-12-05 06:31 177,664 --a------ c:\windows\System32\mpg2splt.ax 2009-02-13 17:21 . 2008-12-05 06:31 80,896 --a------ c:\windows\System32\MSNP.ax 2009-02-13 15:51 . 2009-02-13 15:51 <DIR> d-------- c:\users\VASIL\AppData\Roaming\Malwarebytes 2009-02-13 15:51 . 2009-02-13 15:51 <DIR> d-------- c:\users\All Users\Malwarebytes 2009-02-13 15:51 . 2009-02-13 15:51 <DIR> d-------- c:\programdata\Malwarebytes 2009-02-13 15:51 . 2009-02-13 15:51 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware 2009-02-13 15:51 . 2009-02-11 10:19 38,496 --a------ c:\windows\System32\drivers\mbamswissarmy.sys 2009-02-13 15:51 . 2009-02-11 10:19 15,504 --a------ c:\windows\System32\drivers\mbam.sys 2009-02-13 14:36 . 2009-02-13 14:36 <DIR> d-------- c:\program files\Java 2009-02-13 14:36 . 2009-02-13 14:36 410,984 --a------ c:\windows\System32\deploytk.dll 2009-02-13 14:22 . 2009-02-13 14:22 0 --ah----- c:\users\Default.LOG2 2009-02-13 14:22 . 2009-02-13 14:22 0 --ah----- c:\users\Default.LOG1 2009-02-13 14:22 . 2009-02-13 14:22 0 --ah----- C:\ProgramData.LOG2 2009-02-13 14:22 . 2009-02-13 14:22 0 --ah----- C:\ProgramData.LOG1 2009-02-13 14:09 . 2009-02-13 14:09 170 --a------ C:\install.dat 2009-02-13 12:44 . 2009-02-13 12:44 <DIR> d-------- c:\program files\Alwil Software 2009-02-12 00:02 . 2009-01-15 05:36 1,383,424 --a------ c:\windows\System32\mshtml.tlb 2009-02-12 00:02 . 2009-01-15 08:11 827,392 --a------ c:\windows\System32\wininet.dll 2009-02-11 21:00 . 2009-02-11 21:00 <DIR> d-------- c:\users\Desktop 2009-02-10 14:10 . 2009-02-10 14:10 <DIR> d-------- c:\program files\Skype 2009-02-10 14:10 . 2009-02-10 14:10 <DIR> d-------- c:\program files\Common Files\Skype 2009-02-09 19:41 . 2009-02-09 19:41 <DIR> d-------- c:\windows\Google Earth Pro 4.2 2009-02-09 19:41 . 2009-02-09 19:43 <DIR> d-------- c:\program files\Google Earth Pro 4.2 2009-02-09 16:55 . 2009-02-09 16:55 <DIR> d-------- c:\users\Public\Dictionary 2009-02-08 10:01 . 2009-02-08 21:55 <DIR> d-------- c:\users\VASIL\New Folder 2009-02-02 12:11 . 2009-02-02 12:14 <DIR> d-------- c:\users\VASIL\AppData\Roaming\cr3 2009-01-30 13:22 . 2009-01-30 13:22 <DIR> d-------- c:\users\All Users\Blizzard 2009-01-30 13:22 . 2009-01-30 13:22 <DIR> d-------- c:\programdata\Blizzard 2009-01-30 13:13 . 2009-01-30 13:13 <DIR> d-------- c:\program files\Common Files\Blizzard Entertainment 2009-01-27 16:24 . 2006-07-03 10:31 94,208 --a------ c:\windows\amcap.exe 2009-01-27 16:24 . 2005-11-23 13:55 53,248 --a------ c:\windows\System32\csnp325.dll 2009-01-27 16:24 . 2007-07-11 16:09 20,480 --a------ c:\windows\FixCamera.exe 2009-01-25 11:14 . 2009-01-25 11:14 <DIR> d-------- c:\program files\First Strike Gamepad 2009-01-25 11:14 . 2002-12-26 15:57 86,016 --a------ c:\windows\System32\FCVAP.dll 2009-01-25 11:14 . 2002-12-26 15:57 65,536 --a------ c:\windows\System32\EZFRD.dll 2009-01-20 15:12 . 2009-01-20 15:12 <DIR> d-------- c:\program files\AVG 2009-01-14 18:44 . 2009-02-14 03:51 98,397 --a------ c:\users\All Users\nvModes.dat 2009-01-14 18:44 . 2009-02-14 03:51 98,397 --a------ c:\programdata\nvModes.dat 2009-01-14 08:15 . 2008-12-16 04:42 288,768 --a------ c:\windows\System32\drivers\srv.sys 2009-01-14 02:57 . 2007-09-04 18:56 164,352 --a------ c:\windows\System32\unrar.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-02-13 22:00 --------- d-----w c:\users\VASIL\AppData\Roaming\skypePM 2009-02-13 22:00 --------- d-----w c:\users\VASIL\AppData\Roaming\Skype 2009-02-13 15:09 --------- d-----w c:\programdata\Kaspersky Lab 2009-02-13 13:22 --------- d-----w c:\users\VASIL\AppData\Roaming\uTorrent 2009-02-13 06:20 --------- d-----w c:\program files\Google 2009-02-12 01:00 --------- d-----w c:\program files\Windows Mail 2009-02-11 18:59 --------- d--h--w c:\program files\InstallShield Installation Information 2009-02-11 18:59 --------- d-----w c:\program files\CyberLink 2009-02-10 12:10 --------- d-----w c:\programdata\Skype 2009-02-04 16:19 --------- d-----w c:\users\VASIL\AppData\Roaming\CyberLink 2009-01-17 08:54 --------- d-----w c:\programdata\NVIDIA 2009-01-14 08:40 82,133 ----a-w c:\users\VASIL\AppData\Roaming\nvModes.dat 2009-01-14 00:57 --------- d-----w c:\program files\K-Lite Codec Pack 2009-01-14 00:49 --------- d-----w c:\program files\AviSynth 2.5 2009-01-14 00:47 --------- d-----w c:\program files\Gabest 2009-01-13 12:13 --------- d-----w c:\program files\Xvid 2009-01-11 19:29 --------- d-----w c:\programdata\ESET 2009-01-08 21:22 --------- d-----w c:\programdata\WindowsSearch 2008-12-27 21:15 --------- d-----w c:\program files\AVIConverter 2008-12-27 08:50 --------- d-----w c:\users\VASIL\AppData\Roaming\Teleca 2008-12-27 08:45 --------- d-----w c:\users\VASIL\AppData\Roaming\Sony Ericsson 2008-12-27 08:45 --------- d-----w c:\programdata\Teleca 2008-12-27 08:45 --------- d-----w c:\programdata\Sony Ericsson 2008-12-27 08:45 --------- d-----w c:\program files\Sony Ericsson 2008-12-27 08:45 --------- d-----w c:\program files\Common Files\Teleca Shared 2008-12-27 08:45 --------- d-----w c:\program files\Common Files\Sony Ericsson Shared 2008-12-26 07:27 --------- d-----w c:\users\VASIL\AppData\Roaming\DAEMON Tools 2008-12-22 22:44 --------- d-----w c:\users\VASIL\AppData\Roaming\Thinstall 2008-12-21 12:08 --------- d-----w c:\programdata\Oberon Games 2008-12-19 17:21 --------- d-----w c:\users\VASIL\AppData\Roaming\vlc 2008-12-19 17:20 --------- d-----w c:\program files\VideoLAN 2008-12-18 15:42 --------- d-----w c:\program files\Common Files\InstallShield 2008-12-15 13:56 --------- d-----w c:\programdata\CyberLink 2008-12-01 22:28 174 --sha-w c:\program files\desktop.ini 2008-11-29 15:16 56 ---ha-w c:\users\All Users\ezsidmv.dat 2008-11-29 15:16 56 ---ha-w c:\programdata\ezsidmv.dat 2008-11-29 10:40 2,560 ----a-w c:\windows\AppPatch\AcRes.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Nero\Lib\NMBgMonitor.exe" [2007-09-20 202024] "DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2007-12-14 482760] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-03-28 1045800] "UCam_Menu"="c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2007-08-16 218408] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672] "NeroFilterCheck"="c:\program files\Common Files\Nero\Lib\NeroCheck.exe" [2007-03-01 153136] "{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="c:\program files\Google\Gmail Notifier\gnotify.exe" [2005-07-15 479232] "Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2007-06-13 528384] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-12-04 13556256] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-12-04 92704] "RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2005-12-07 30208] "LanguageShortcut"="c:\program files\CyberLink\PowerDVD\Language\Language.exe" [2006-04-13 49152] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-13 148888] "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-02-13 1601304] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=avgrsstx.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.l3fhg"= mp3fhg.acm "VIDC.X264"= x264vfw.dll "VIDC.HFYU"= huffyuv.dll "vidc.i263"= i263_32.drv "msacm.divxa32"= divxa32.acm [HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "TCP Query User{C58A6455-4DA2-4FB0-A6EB-E66D1BAD9501}c:\\program files\\skype\\phone\\skype.exe"= UDP:c:\program files\skype\phone\skype.exe:Skype "UDP Query User{353D721D-D109-4186-A7AB-1225DC3A3EC0}c:\\program files\\skype\\phone\\skype.exe"= TCP:c:\program files\skype\phone\skype.exe:Skype "TCP Query User{970C7416-913F-42FA-B33D-F5508DE07F35}c:\\program files\\skype\\phone\\skype.exe"= UDP:c:\program files\skype\phone\skype.exe:Skype "TCP Query User{CAC76BA2-27BF-4A1D-A6AC-3EA13173A433}c:\\program files\\utorrent\\utorrent.exe"= UDP:c:\program files\utorrent\utorrent.exe:µTorrent "UDP Query User{DE2AAB45-9A49-4189-98BC-844EFB3ACBF6}c:\\program files\\utorrent\\utorrent.exe"= TCP:c:\program files\utorrent\utorrent.exe:µTorrent "TCP Query User{5BCCA899-3083-4E9C-9AC5-AAFAF0D373BB}d:\\games\\cs\\hl.exe"= UDP:d:\games\cs\hl.exe:Half-Life Launcher "UDP Query User{C64F2FD6-0107-4CF1-8120-F6364DE86770}d:\\games\\cs\\hl.exe"= TCP:d:\games\cs\hl.exe:Half-Life Launcher "TCP Query User{A14BC2C5-C0E4-4DC2-A8C5-26A059387E26}d:\\games\\csinstalated\\hl.exe"= UDP:d:\games\csinstalated\hl.exe:Half-Life Launcher "UDP Query User{D9638914-B46C-439B-9CB0-539F626AE72A}d:\\games\\csinstalated\\hl.exe"= TCP:d:\games\csinstalated\hl.exe:Half-Life Launcher "TCP Query User{5C7D11F3-3851-425E-9FA0-65A4D361D191}d:\\games\\csinstalated\\hl.exe"= UDP:d:\games\csinstalated\hl.exe:Half-Life Launcher "UDP Query User{979A2EFA-3E77-4D85-A95E-0F93BBC71C3A}d:\\games\\csinstalated\\hl.exe"= TCP:d:\games\csinstalated\hl.exe:Half-Life Launcher "{9893AF56-31B2-43DD-B423-C4A52A17F44F}"= UDP:c:\program files\Mozilla Firefox\firefox.exe:Mozilla Firefox "{52707CAE-8386-450E-AFAC-3D7F27E65E8D}"= TCP:c:\program files\Mozilla Firefox\firefox.exe:Mozilla Firefox "TCP Query User{CC76C0B8-4EB6-4251-A2C8-890D4E46EAFF}d:\\games\\quake iii arena\\quake3.exe"= UDP:d:\games\quake iii arena\quake3.exe:quake3 "UDP Query User{5B4107CF-4C7C-4712-906C-F32667A220A5}d:\\games\\quake iii arena\\quake3.exe"= TCP:d:\games\quake iii arena\quake3.exe:quake3 "TCP Query User{83D2192A-E9B0-4831-A9E0-CBC136F02406}c:\\users\\vasil\\appdata\\local\\temp\\blizzard launcher temporary - 9080dbe0\\launcher.exe"= UDP:c:\users\vasil\appdata\local\temp\blizzard launcher temporary - 9080dbe0\launcher.exe:launcher.exe "UDP Query User{7046112C-BEBA-4BF4-9E46-2A3AAE6C5887}c:\\users\\vasil\\appdata\\local\\temp\\blizzard launcher temporary - 9080dbe0\\launcher.exe"= TCP:c:\users\vasil\appdata\local\temp\blizzard launcher temporary - 9080dbe0\launcher.exe:launcher.exe "TCP Query User{BD735BB4-942F-43F6-B2D5-32B2AEF90BFC}c:\\users\\vasil\\appdata\\local\\temp\\blizzard launcher temporary - ffbd6718\\launcher.exe"= UDP:c:\users\vasil\appdata\local\temp\blizzard launcher temporary - ffbd6718\launcher.exe:launcher.exe "UDP Query User{BCB150A5-8E30-4B7B-BAE0-4F5DDD571305}c:\\users\\vasil\\appdata\\local\\temp\\blizzard launcher temporary - ffbd6718\\launcher.exe"= TCP:c:\users\vasil\appdata\local\temp\blizzard launcher temporary - ffbd6718\launcher.exe:launcher.exe "{7C862E97-084B-4A55-9471-BC42296C064F}"= c:\program files\AVG\AVG8\avgam.exe:avgam.exe "{F20A544F-72E5-4602-83ED-4EC2B3CBA67C}"= c:\program files\AVG\AVG8\avgemc.exe:avgemc.exe "{C944EA12-FD7E-427D-8EF6-3EEDD96BBA5E}"= c:\program files\AVG\AVG8\avgupd.exe:avgupd.exe "{FD59EEFA-97CD-48DF-8C3B-680C1E253D6F}"= c:\program files\AVG\AVG8\avgnsx.exe:avgnsx.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile] "EnableFirewall"= 0 (0x0) R0 AvgRkx86;avgrkx86.sys;c:\windows\System32\drivers\avgrkx86.sys [2009-02-13 12552] R1 Avgfwfd;AVG network filter service;c:\windows\System32\drivers\avgfwd6x.sys [2009-02-13 23832] R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\System32\drivers\avgldx86.sys [2009-02-13 325128] R1 AvgTdiX;AVG8 Network Redirector;c:\windows\System32\drivers\avgtdix.sys [2009-02-13 107272] R2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2009-02-13 903960] R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-02-13 298264] R2 avgfws8;AVG8 Firewall;c:\progra~1\AVG\AVG8\avgfws8.exe [2009-02-13 1339600] R3 OA004Ufd;Creative Camera OA004 Upper Filter Driver;c:\windows\System32\drivers\OA004Ufd.sys [2008-06-03 144672] R3 OA004Vid;Creative Camera OA004 Function Driver;c:\windows\System32\drivers\OA004Vid.sys [2008-07-17 269760] S2 gupdate1c98afb3a1af780;Google Update Service (gupdate1c98afb3a1af780);c:\program files\Google\Update\GoogleUpdate.exe [2009-02-09 133104] S3 ADM8511;REPOTEC USB100 To Fast Ethernet Adapter;c:\windows\System32\drivers\ADM8511.SYS [2008-11-29 24427] S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\System32\drivers\mbamswissarmy.sys [2009-02-13 38496] S3 s125bus;Sony Ericsson Device 125 driver (WDM);c:\windows\System32\drivers\s125bus.sys [2008-12-27 83336] S3 s125mdfl;Sony Ericsson Device 125 USB WMC Modem Filter;c:\windows\System32\drivers\s125mdfl.sys [2008-12-27 15112] S3 s125mdm;Sony Ericsson Device 125 USB WMC Modem Driver;c:\windows\System32\drivers\s125mdm.sys [2008-12-27 108680] S3 s125mgmt;Sony Ericsson Device 125 USB WMC Device Management Drivers (WDM);c:\windows\System32\drivers\s125mgmt.sys [2008-12-27 100488] S3 s125obex;Sony Ericsson Device 125 USB WMC OBEX Interface;c:\windows\System32\drivers\s125obex.sys [2008-12-27 98696] --- Other Services/Drivers In Memory --- *Deregistered* - sptd [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\H] \shell\AutoRun\command - H:\LaunchU3.exe -a [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0374278d-c1f9-11dd-9bb9-001b24ec7aa8}] \shell\AutoRun\command - qquq.bat \shell\explore\Command - qquq.bat \shell\open\Command - qquq.bat [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{03742790-c1f9-11dd-9bb9-001b24ec7aa8}] \shell\AutoRun\command - H:\LaunchU3.exe -a [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5942c3c3-c154-11dd-8853-001b24ec7aa8}] \shell\AutoRun\command - F:\Setup.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7fda1069-c793-11dd-be3c-001b24ec7aa8}] \shell\AutoRun\command - H:\LaunchU3.exe -a [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7fda107e-c793-11dd-be3c-001b24ec7aa8}] \shell\AutoRun\command - H:\LaunchU3.exe -a . Contents of the 'Scheduled Tasks' folder 2009-02-14 c:\windows\Tasks\Google Software Updater.job - c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-02-09 23:11] 2009-02-14 c:\windows\Tasks\GoogleUpdateTaskMachine.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-02-09 23:13] . - - - - ORPHANS REMOVED - - - - MSConfigStartUp-Internet Security Service - c:\restore\S-1-5-21-1482476501-1644491937-682003330-1013\dark.exe MSConfigStartUp-WinampAgent - c:\program files\Winamp\winampa.exe . ------- Supplementary Scan ------- . uStart Page = hxxp://google.com/ IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 TCP: {28876572-FB22-44D8-89EE-D4A3640F1EA0} = 192.168.2.1 DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} - hxxp://downloads.ewido.net/ewidoOnlineScan.cab FF - ProfilePath - c:\users\VASIL\AppData\Roaming\Mozilla\Firefox\Profiles\1mnxw8rf.default\ FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll FF - plugin: c:\program files\Google\Update\1.2.141.5\npGoogleOneClick7.dll FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-02-14 09:31:20 Windows 6.0.6001 Service Pack 1 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . c:\windows\System32\nvvsvc.exe c:\windows\System32\audiodg.exe c:\windows\System32\rundll32.exe c:\windows\System32\wlanext.exe c:\program files\CyberLink\Shared files\RichVideo.exe c:\windows\System32\drivers\XAudio.exe c:\progra~1\AVG\AVG8\avgam.exe c:\progra~1\AVG\AVG8\avgrsx.exe c:\progra~1\AVG\AVG8\avgnsx.exe c:\program files\AVG\AVG8\avgcsrvx.exe c:\windows\System32\conime.exe c:\windows\System32\rundll32.exe c:\program files\AVG\AVG8\avgtray.exe c:\program files\Common Files\Nero\Lib\NMIndexingService.exe c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe c:\program files\Common Files\Teleca Shared\Generic.exe c:\program files\Synaptics\SynTP\SynTPHelper.exe c:\program files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe c:\windows\System32\wbem\WMIADAP.exe c:\windows\servicing\TrustedInstaller.exe . ************************************************************************** . Completion time: 2009-02-14 9:36:07 - machine was rebooted ComboFix-quarantined-files.txt 2009-02-14 07:35:55 Pre-Run: 4 281 237 504 bytes free Post-Run: 4,499,898,368 bytes free 277 --- E O F --- 2009-02-13 15:31:19

Malwarebytes' Anti-Malware 1.34 Database version: 1757 Windows 6.0.6001 Service Pack 1 13.2.2009 г. 21:39:39 mbam-log-2009-02-13 (21-39-39).txt Scan type: Full Scan (C:\|D:\|) Objects scanned: 188649 Time elapsed: 2 hour(s), 54 minute(s), 58 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) :S

От Avg report: Scan "Scan whole computer" was finished. Infections;"2";"0";"2" Information;"2" Folders selected for scanning:;"Scan whole computer" Scan started:;"13 февруари 2009 г., 18:44 ч." Scan finished:;"13 февруари 2009 г., 20:36 ч. (1 hour(s) 52 minute(s) 31 second(s))" Total object scanned:;"748655" User who launched the scan:;"VASIL" Infections File;"Infection";"Result" D:\Instalations\Google Earth Pro 4.2.0205.5730\Google Earth Pro 4.2.exe;"Trojan horse Agent.AWJX";"Infected" D:\Instalations\Google Earth Pro 4.2.0205.5730\Google Earth Pro 4.2.exe:\$JF\wmplayer.exe;"Trojan horse Agent.AWJX";"Infected" Warnings File;"Infection";"Result" C:\Users\VASIL\AppData\Local\Microsoft\Windows\Temporary Internet Files\Virtualized\C\Users\VASIL\AppData\Roaming\Mozilla\Firefox\Profiles\1mnxw8rf.default\cookies.sqlite;"Found Tracking cookie.Doubleclick";"Healed" C:\Users\VASIL\AppData\Local\Microsoft\Windows\Temporary Internet Files\Virtualized\C\Users\VASIL\AppData\Roaming\Mozilla\Firefox\Profiles\1mnxw8rf.default\cookies.sqlite:\advertising.com.525a5fb9;"Found Tracking cookie.Advertising";"Moved to Virus Vault" C:\Users\VASIL\AppData\Local\Microsoft\Windows\Temporary Internet Files\Virtualized\C\Users\VASIL\AppData\Roaming\Mozilla\Firefox\Profiles\1mnxw8rf.default\cookies.sqlite:\doubleclick.net.bf396750;"Found Tracking cookie.Doubleclick";"Moved to Virus Vault" C:\Users\VASIL\AppData\Roaming\Microsoft\Windows\Cookies\Low\vasil@doubleclick[1].txt;"Found Tracking cookie.Doubleclick";"Moved to Virus Vault" C:\Users\VASIL\AppData\Roaming\Microsoft\Windows\Cookies\Low\vasil@doubleclick[1].txt:\doubleclick.net.bf396750;"Found Tracking cookie.Doubleclick";"Moved to Virus Vault" C:\Users\VASIL\AppData\Roaming\Mozilla\Firefox\Profiles\1mnxw8rf.default\cookies.sqlite;"Found Tracking cookie.Doubleclick";"Healed" C:\Users\VASIL\AppData\Roaming\Mozilla\Firefox\Profiles\1mnxw8rf.default\cookies.sqlite:\advertising.com.525a5fb9;"Found Tracking cookie.Advertising";"Moved to Virus Vault" C:\Users\VASIL\AppData\Roaming\Mozilla\Firefox\Profiles\1mnxw8rf.default\cookies.sqlite:\atdmt.com.b3e33b5f;"Found Tracking cookie.Atdmt";"Moved to Virus Vault" C:\Users\VASIL\AppData\Roaming\Mozilla\Firefox\Profiles\1mnxw8rf.default\cookies.sqlite:\doubleclick.net.bf396750;"Found Tracking cookie.Doubleclick";"Moved to Virus Vault" C:\Users\VASIL\AppData\Roaming\Mozilla\Firefox\Profiles\1mnxw8rf.default\cookies.sqlite:\m.webtrends.com.b4ca7df0;"Found Tracking cookie.Webtrends";"Moved to Virus Vault" C:\Users\VASIL\AppData\Roaming\Mozilla\Firefox\Profiles\1mnxw8rf.default\cookies.sqlite:\revsci.net.2df99d79;"Found Tracking cookie.Revsci";"Moved to Virus Vault" C:\Users\VASIL\AppData\Roaming\Mozilla\Firefox\Profiles\1mnxw8rf.default\cookies.sqlite:\revsci.net.44927ec;"Found Tracking cookie.Revsci";"Moved to Virus Vault" C:\Users\VASIL\AppData\Roaming\Mozilla\Firefox\Profiles\1mnxw8rf.default\cookies.sqlite:\revsci.net.e9dbeb91;"Found Tracking cookie.Revsci";"Moved to Virus Vault" Information File;"Infection";"Result" D:\Instalations\vajno\Ultimate-kg.exe;"Runtime packed fsg";"" D:\Instalations\WinRAR 3.71 Final + BG + Keygen\patch.exe;"Runtime packed fsg";"" От HiJackThis report : Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 20:43 ч., on 13.2.2009 г. Platform: Windows Vista SP1 (WinNT 6.00.1905) MSIE: Internet Explorer v7.00 (7.00.6001.18000) Boot mode: Normal Running processes: C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe C:\Windows\System32\rundll32.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\AVG\AVG8\avgtray.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe C:\Program Files\DAEMON Tools Lite\daemon.exe C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Program Files\Common Files\Teleca Shared\Generic.exe C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe C:\Program Files\AVG\AVG8\avgui.exe C:\Program Files\AVG\AVG8\avgcsrvx.exe C:\Program Files\Google\Gmail Notifier\gnotify.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Users\VASIL\Downloads\HiJackThis.exe C:\HiJackThis\post.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O1 - Hosts: ::1 localhost O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide O4 - HKLM\..\Run: [synTPEnh] "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" O4 - HKLM\..\Run: [uCam_Menu] "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" update "Software\CyberLink\YouCam\1.0" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [NeroFilterCheck] "C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe" O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] "C:\Program Files\Google\Gmail Notifier\gnotify.exe" O4 - HKLM\..\Run: [sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions O4 - HKLM\..\Run: [NvCplDaemon] "C:\Windows\system32\RUNDLL32.EXE" C:\Windows\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] "C:\Windows\system32\RUNDLL32.EXE" C:\Windows\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKCU\..\Run: [sidebar] "C:\Program Files\Windows Sidebar\sidebar.exe" /autoRun O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O13 - Gopher Prefix: O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} (GMNRev Class) - http://h20270.www2.hp.com/ediags/gmn2/inst...ctDetection.cab O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{28876572-FB22-44D8-89EE-D4A3640F1EA0}: NameServer = 192.168.2.1 O17 - HKLM\System\CS1\Services\Tcpip\..\{28876572-FB22-44D8-89EE-D4A3640F1EA0}: NameServer = 192.168.2.1 O17 - HKLM\System\CS2\Services\Tcpip\..\{28876572-FB22-44D8-89EE-D4A3640F1EA0}: NameServer = 192.168.2.1 O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - AppInit_DLLs: avgrsstx.dll O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: AVG8 Firewall (avgfws8) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgfws8.exe O23 - Service: Google Update Service (gupdate1c98afb3a1af780) (gupdate1c98afb3a1af780) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe -- End of file - 6922 bytes Malwarebytes' Anti-Malware все още сканирва...

На настолния ми компютър е Windows Xp SP3, a на лаптопа ми е Windows Vista Home Basic ; за съжаление не пазя логовете защото преинсталирах настолния компютър на който засякох кейлогъра. Сега проверявам лаптопа си с MalwareBytes' Anti-Malware и с Avg. Единственото засега което знам със сигурност е че е предназначен за записване на пароли на акаунти на World of Warcraft. Първия път когато го засякох беше с Nod 32 и каквото намери го изтрих. След това реших да преинсталирам с пълен формат настолния си компютър като запазя малка част от данните си на лаптопа( предимно снимки и текстови документи). Но отново се опитаха да оберат акаунта ми и явно съм заразил и лаптопа си. Сега чакам да минат сканирванията за да мога да дам лог.

Добър ден, Вчера поради моята "немърливост" съм си свалил keylogger на компютъра. Опитах с 1-2 anti-spaware програми но имам проблем с отстраняването му. Надявам се да ми помогнете със съвети и идеи какво да направя. Благодаря ви предварително.

Значи македонец може да значи няколко неща. 1-во човек роден или живеещ в географската област Македония или 2-ро гражданин на република македония считащ себе си за македонец по националност. Голяма част от българите в географската област в Македония не се смятат за българи, а за македонци, гърци или сърби. Но това си е техен проблем. Лошото е че им се насажда изкуствено омраза към България. Хубавото е че има и много българи в Македония които си знаят че са българи . С две думи ... балканска ни работа...

Здравейте... изчетох доста голямо количество материали за антивирусните и стигнах до извода че незнам коя антивирусна да си сложа. Досега бях с Нод32 и ... еми нз ... общо взето нямах проблеми . Пробвах Касперски но просто беше невъзможно да се работи с нея (компа ми е на вече 2 годинки поостаря миличкия ми но за мен си е идеален). Та може ли някой да ми даде обосновано предложение коя АВ програма да си сложа? Ще съм ви адски благодарен. А да ... също така относно Anti-Spyware програмите... и за тях ако може едно предложение