Въпросната програма просто се появи в компютъра ми.Може би ви се струва странно,но е факт.Ако някой знае нещо повече,моля за информация,че в Google не открих съществена информация.

Прочетете тази тема и направете описаното в нея.

Прочетете тази тема и направете описаното в нея.

Онази тема е доста едностранна, а вариантностите са доста. Посочих този линк http://www.nigma.ru/index.php?s=Xvid+1.2.1+final+uninstall&t=web&rg=%D0%9C%D0%BE%D1%81%D0%BA%D0%B2%D0%B0&yn=1&gl=1&rm=1&ms=1&yh=1&av=1&ap=1&nm=1&lang=all&srt=0 Правило ли наруших? Защо бе изтрит? Помислете - свободният избор не е ли най-важен? Нека човек сам си преценява. Според мен трябва да се насърчават самостоятелните преценки.Човек от грешките си си създава най-добрите изводи. Защо ще ме вкарват в някаква тема...Нищо не съм научил от подобни теми! Същевременно много неща са общодостъпни на различни езици в мрежата...На модериращите се извинявам за оффтопика... Поздрави

Здравейте ,тъй като внимателно изчетох предоставената информация ,преди да предприема каквито и да било действия бих искала да допълня темата и преди всичко да се консултирам.Това,което установих е,че въпросната програма се качва при опит да инсталирам Save2pc(от който и да е сайт...странно).Следва невъзможност за стартиране на програмата и новопоявилата се Xvid.Вече сканирах системата с Malwarebyts Anti-Malware и направо се стреснах,то направо си беше нашествие.Изпробвах още няколко неща,но нищо повече не излезе.Въпросът ми е да продължа ли с качването на HIJack...или мога да спра до тук?А ето и резултата от

Malwarebytes' Anti-Malware 1.41

Versione del database: 3197

Windows 5.1.2600 Service Pack 2

19.11.2009 г. 21:32:16

mbam-log-2009-11-19 (21-32-15).txt

Tipo di scansione: Scansione completa (C:\|D:\|)

Elementi scansionati: 172974

Tempo trascorso: 30 minute(s), 49 second(s)

Processi delle memoria infetti: 0

Moduli della memoria infetti: 0

Chiavi di registro infette: 1

Valori di registro infetti: 1

Elementi dato del registro infetti: 3

Cartelle infette: 0

File infetti: 1

Processi delle memoria infetti:

(Nessun elemento malevolo rilevato)

Moduli della memoria infetti:

(Nessun elemento malevolo rilevato)

Chiavi di registro infette:

HKEY_CURRENT_USER\SOFTWARE\fcn (Rogue.Residue) -> Quarantined and deleted successfully.

Valori di registro infetti:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\udcji (Trojan.Agent.H) -> Quarantined and deleted successfully.

Elementi dato del registro infetti:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Cartelle infette:

(Nessun elemento malevolo rilevato)

File infetti:

c:\documents and settings\GIANNA\impostazioni locali\dati applicazioni\udcji.exe (Trojan.Agent.H) -> Delete on reboot.

Здравейте!

Генерирайте и лог файл от HiJackThis, ако успеете и изчакайте, колегата скоро ще се появи и ще Ви помогне.

Ето и исканото от Вас:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 22:47:44, on 21.11.2009 г.

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe

C:\Programmi\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\igfxtray.exe

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\system32\igfxpers.exe

C:\Programmi\Microsoft Office\Office12\GrooveMonitor.exe

C:\Programmi\QuickTime\qttask.exe

C:\WINDOWS\system32\igfxsrvc.exe

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Programmi\File comuni\Ahead\Lib\NMBgMonitor.exe

C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe

C:\Documents and Settings\All Users\Dati applicazioni\Macrovision\FLEXnet Connect\6\ISUSPM.exe

C:\Programmi\uTorrent\uTorrent.exe

C:\Programmi\Your Cottonelle Puppy\Your Cottonelle Puppy.exe

C:\Programmi\File comuni\Ahead\Lib\NMIndexStoreSvr.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Programmi\Broadcom\ASFIPMon\AsfIpMon.exe

C:\Programmi\Bonjour\mDNSResponder.exe

C:\Programmi\Common Files\Motive\McciCMService.exe

C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\mdm.exe

C:\WINDOWS\system32\svchost.exe

C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe

C:\Programmi\Alwil Software\Avast4\ashWebSv.exe

C:\Documents and Settings\GIANNA\Impostazioni locali\Dati applicazioni\Google\Chrome\Application\chrome.exe

C:\Documents and Settings\GIANNA\Impostazioni locali\Dati applicazioni\Google\Chrome\Application\chrome.exe

C:\Documents and Settings\GIANNA\Impostazioni locali\Dati applicazioni\Google\Chrome\Application\chrome.exe

C:\Documents and Settings\GIANNA\Impostazioni locali\Dati applicazioni\Google\Update\1.2.183.13\GoogleCrashHandler.exe

C:\Documents and Settings\GIANNA\Documenti\Downloads\gianna.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://it.msn.com/

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ask.com/?o=13928&l=dis

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti

O2 - BHO: Supporto di collegamento per Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL

O2 - BHO: Guida per l'accesso a Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Programmi\Epson Software\Easy Photo Print\EPTBL.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Programmi\Google\Google Toolbar\GoogleToolbar_32.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programmi\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll

O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Programmi\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll

O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Programmi\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll

O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Programmi\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll

O3 - Toolbar: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Programmi\Epson Software\Easy Photo Print\EPTBL.dll

O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Programmi\Google\Google Toolbar\GoogleToolbar_32.dll

O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe

O4 - HKLM\..\Run: [GrooveMonitor] "C:\Programmi\Microsoft Office\Office12\GrooveMonitor.exe"

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Programmi\File comuni\Ahead\Lib\NeroCheck.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Programmi\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programmi\File comuni\Ahead\Lib\NMBgMonitor.exe"

O4 - HKCU\..\Run: [swg] "C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKCU\..\Run: [iSUSPM] "C:\Documents and Settings\All Users\Dati applicazioni\Macrovision\FLEXnet Connect\6\ISUSPM.exe" -scheduler

O4 - HKCU\..\Run: [uTorrent] "C:\Programmi\uTorrent\uTorrent.exe"

O4 - HKCU\..\Run: [Your Cottonelle Puppy] "C:\Programmi\Your Cottonelle Puppy\Your Cottonelle Puppy.exe" -r

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')

O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: Invia a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: I&nvia a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Programmi\Bonjour\ExplorerPlugin.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w3/resources/MSNPUpld.cab

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL

O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Unknown owner - C:\Programmi\File comuni\Acronis\Schedule2\schedul2.exe (file missing)

O23 - Service: Broadcom ASF IP and SMBIOS Mailbox Monitor (ASFIPmon) - Broadcom Corporation - C:\Programmi\Broadcom\ASFIPMon\AsfIpMon.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: Servizio Bonjour (Bonjour Service) - Apple Computer, Inc. - C:\Programmi\Bonjour\mDNSResponder.exe

O23 - Service: Google Software Updater (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: McciCMService - Motive Communications, Inc. - C:\Programmi\Common Files\Motive\McciCMService.exe

O23 - Service: NBService - Nero AG - C:\Programmi\Nero\Nero 7\Nero BackItUp\NBService.exe

--

End of file - 8671 bytes

Здравейте cervellona,

СТЪПКА 1:

Стартирайте HijackThis още веднъж и изберете "Do a system scan only"

Маркирайте следните обекти: (ако присъстват)

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://it.msn.com/

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ask.com/?o=13928&l=dis

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe"

Натиснете Fix Checked.

Затворете програмата.

СТЪПКА 2:

Отворете Notepad и с copy/paste въведете следната информация:

@ECHO OFF

IF EXIST log.txt DEL log.txt

ECHO Deleting files>>log.txt

FOR %%g in (

C:\Documents and Settings\GIANNA\Documenti\Downloads\gianna.exe) DO (

IF EXIST %%g (

ATTRIB -r -s -h %%g

DEL %%g

IF EXIST %%g (

ECHO %%g not deleted>>log.txt

) ELSE (

ECHO %%g deleted successfully>>log.txt)

) ELSE (

ECHO %%g not found>>log.txt))

START NOTEPAD.EXE log.txt

DEL %0

Запазете файла с име fix.bat и го стартирайте.

Файла трябва да изглежда така -

СТЪПКА 3:

Изтеглете DDS от тук.

Запазете го на десктопа.

Изключете защитата в реално време на антивирусната си програма (ако е инсталирана такава).Накрая, стартирайте инструмента.

• Когато DDS приключи успешно анализа на системата ще отвори два лог файла.

1. 
   
2. DDS.txt
   
3. Attach.txt
   

• Запазете ги на десктопа и след това публикувайте съдържанието им към следващия си пост.

Хайде пак..DDS (Ver_09-10-26.01) - NTFSx86

Run by GIANNA at 20:52:50,71 on 22.11.2009 Ј.

Internet Explorer: 6.0.2900.2180

Microsoft Windows XP Professional 5.1.2600.2.1251.359.1040.18.2038.1312 [GMT 1:00]

AV: avast! antivirus 4.8.1351 [VPS 091122-1] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup

svchost.exe

svchost.exe

C:\WINDOWS\Explorer.EXE

C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe

C:\Programmi\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\igfxtray.exe

C:\WINDOWS\system32\igfxpers.exe

C:\Programmi\Microsoft Office\Office12\GrooveMonitor.exe

C:\Programmi\QuickTime\qttask.exe

C:\WINDOWS\system32\igfxsrvc.exe

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Programmi\File comuni\Ahead\Lib\NMBgMonitor.exe

C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe

C:\Documents and Settings\All Users\Dati applicazioni\Macrovision\FLEXnet Connect\6\ISUSPM.exe

C:\Programmi\uTorrent\uTorrent.exe

C:\Programmi\File comuni\Ahead\Lib\NMIndexStoreSvr.exe

C:\Programmi\Your Cottonelle Puppy\Your Cottonelle Puppy.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Programmi\Broadcom\ASFIPMon\AsfIpMon.exe

C:\Programmi\Bonjour\mDNSResponder.exe

C:\Programmi\Common Files\Motive\McciCMService.exe

C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\mdm.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe

C:\Programmi\Alwil Software\Avast4\ashWebSv.exe

C:\Documents and Settings\GIANNA\Impostazioni locali\Dati applicazioni\Google\Chrome\Application\chrome.exe

C:\Documents and Settings\GIANNA\Impostazioni locali\Dati applicazioni\Google\Chrome\Application\chrome.exe

C:\Documents and Settings\GIANNA\Impostazioni locali\Dati applicazioni\Google\Chrome\Application\chrome.exe

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Documents and Settings\GIANNA\Impostazioni locali\Dati applicazioni\Google\Chrome\Application\chrome.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\Documents and Settings\GIANNA\Documenti\Downloads\dds (1).scr

============== Pseudo HJT Report ===============

uSearch Page = hxxp://www.google.com

uSearch Bar = hxxp://www.google.com/ie

mDefault_Search_URL = hxxp://www.google.com/ie

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

mSearchAssistant = hxxp://www.google.com/ie

BHO: Supporto di collegamento per Adobe PDF Reader: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\programmi\file comuni\adobe\acrobat\activex\AcroIEHelper.dll

BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll

BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\progra~1\micros~2\office12\GRA8E1~1.DLL

BHO: Guida per l'accesso a Windows Live: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\programmi\file comuni\microsoft shared\windows live\WindowsLiveLogin.dll

BHO: Easy Photo Print: {9421dd08-935f-4701-a9ca-22df90ac4ea6} - c:\programmi\epson software\easy photo print\EPTBL.dll

BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\programmi\google\google toolbar\GoogleToolbar_32.dll

BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\programmi\google\googletoolbarnotifier\5.4.4525.1752\swg.dll

BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\programmi\google\google toolbar\component\fastsearch_B7C5AC242193BB3E.dll

BHO: EpsonToolBandKicker Class: {e99421fb-68dd-40f0-b4ac-b7027cae2f1a} - c:\programmi\epson\epson web-to-page\EPSON Web-To-Page.dll

TB: EPSON Web-To-Page: {ee5d279f-081b-4404-994d-c6b60aaeba6d} - c:\programmi\epson\epson web-to-page\EPSON Web-To-Page.dll

TB: Easy Photo Print: {9421dd08-935f-4701-a9ca-22df90ac4ea6} - c:\programmi\epson software\easy photo print\EPTBL.dll

TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\programmi\google\google toolbar\GoogleToolbar_32.dll

TB: {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File

TB: {32099AAC-C132-4136-9E9A-4E364A424E17} - No File

uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe

uRun: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "c:\programmi\file comuni\ahead\lib\NMBgMonitor.exe"

uRun: [swg] "c:\programmi\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"

uRun: [spybotSD TeaTimer] c:\programmi\spybot - search & destroy\TeaTimer.exe

uRun: [iSUSPM] "c:\documents and settings\all users\dati applicazioni\macrovision\flexnet connect\6\ISUSPM.exe" -scheduler

uRun: [uTorrent] "c:\programmi\utorrent\uTorrent.exe"

uRun: [Your Cottonelle Puppy] "c:\programmi\your cottonelle puppy\Your Cottonelle Puppy.exe" -r

mRun: [igfxTray] c:\windows\system32\igfxtray.exe

mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe

mRun: [Persistence] c:\windows\system32\igfxpers.exe

mRun: [GrooveMonitor] "c:\programmi\microsoft office\office12\GrooveMonitor.exe"

mRun: [NeroFilterCheck] c:\programmi\file comuni\ahead\lib\NeroCheck.exe

mRun: [QuickTime Task] "c:\programmi\quicktime\qttask.exe" -atboottime

mRun: [avast!] c:\progra~1\alwils~1\avast4\ashDisp.exe

mRun: [Malwarebytes Anti-Malware (reboot)] "c:\programmi\malwarebytes' anti-malware\mbam.exe" /runcleanupscript

dRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe

IE: E&sporta in Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\programmi\messenger\msmsgs.exe

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll

IE: {7F9DB11C-E358-4ca6-A83D-ACC663939424} - {9999A076-A9E2-4C99-8A2B-632FC9429223} - c:\programmi\bonjour\ExplorerPlugin.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL

IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll

DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - hxxp://gfx2.hotmail.com/mail/w3/resources/MSNPUpld.cab

Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\progra~1\micros~2\office12\GR99D3~1.DLL

Notify: igfxcui - igfxdev.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~1\micros~2\office12\GRA8E1~1.DLL

============= SERVICES / DRIVERS ===============

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-1-19 114768]

R2 ASFIPmon;Broadcom ASF IP and SMBIOS Mailbox Monitor;c:\programmi\broadcom\asfipmon\asfipmon.exe -service --> c:\programmi\broadcom\asfipmon\AsfIpMon.exe -service [?]

R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-1-19 20560]

R3 camfilt2;camfilt2;c:\windows\system32\drivers\camfilt2.sys [2008-12-31 98432]

R3 PAC7302;Hercules Classic Link;c:\windows\system32\drivers\PAC7302.SYS [2008-12-31 457984]

=============== Created Last 30 ================

2009-11-22 17:22:07 0 d-----w- c:\windows\ServicePackFiles

2009-11-20 19:54:56 274288 ----a-w- c:\windows\system32\mucltui.dll

2009-11-20 19:54:56 215920 ----a-w- c:\windows\system32\muweb.dll

2009-11-20 19:54:56 18288 ----a-w- c:\windows\system32\mucltui.dll.mui

2009-11-19 19:11:32 0 d-----w- c:\docume~1\gianna\datiap~1\Malwarebytes

2009-11-19 19:11:28 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-11-19 19:11:27 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-11-19 19:11:27 0 d-----w- c:\docume~1\alluse~1\datiap~1\Malwarebytes

2009-11-19 19:11:26 0 d-----w- c:\programmi\Malwarebytes' Anti-Malware

2009-11-06 13:01:04 0 d-----w- c:\docume~1\gianna\datiap~1\VSRevoGroup

2009-11-06 12:04:30 0 d-----w- c:\programmi\VS Revo Group

==================== Find3M ====================

2009-11-22 17:41:16 70744 ----a-w- c:\windows\system32\perfc010.dat

2009-11-22 17:41:16 440276 ----a-w- c:\windows\system32\perfh010.dat

============= FINISH: 20:53:05,56 ===============

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-10-26.01)

Microsoft Windows XP Professional

Boot Device: \Device\HarddiskVolume1

Install Date: 07.5.2005 г. 17:24:05

System Uptime: 22.11.2009 г. 18:36:02 (2 hours ago)

Motherboard: Acer | | Columbia

Processor: Processore Intel Pentium II | U2E1 | 2128/133mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 112 GiB total, 72,125 GiB free.

D: is CDROM ()

==== Disabled Device Manager Items =============

==== System Restore Points ===================

No restore point in system.

==== Installed Programs ======================

µTorrent

ABBYY FineReader 6.0 Sprint

Adobe AIR

Adobe Flash Player 10 ActiveX

Adobe Flash Player 10 Plugin

Adobe Media Player

Adobe Reader 8.1.3 - Italiano

Aggiornamento della protezione per Windows Media Player (KB952069)

Aggiornamento della protezione per Windows Media Player 11 (KB936782)

Aggiornamento della protezione per Windows Media Player 11 (KB954154)

Aggiornamento della protezione per Windows XP (KB923561)

Aggiornamento della protezione per Windows XP (KB938464)

Aggiornamento della protezione per Windows XP (KB941569)

Aggiornamento della protezione per Windows XP (KB944338-v2)

Aggiornamento della protezione per Windows XP (KB946648)

Aggiornamento della protezione per Windows XP (KB950762)

Aggiornamento della protezione per Windows XP (KB950974)

Aggiornamento della protezione per Windows XP (KB951066)

Aggiornamento della protezione per Windows XP (KB951376-v2)

Aggiornamento della protezione per Windows XP (KB951698)

Aggiornamento della protezione per Windows XP (KB951748)

Aggiornamento della protezione per Windows XP (KB952954)

Aggiornamento della protezione per Windows XP (KB954211)

Aggiornamento della protezione per Windows XP (KB954600)

Aggiornamento della protezione per Windows XP (KB955069)

Aggiornamento della protezione per Windows XP (KB956391)

Aggiornamento della protezione per Windows XP (KB956802)

Aggiornamento della protezione per Windows XP (KB956803)

Aggiornamento della protezione per Windows XP (KB956841)

Aggiornamento della protezione per Windows XP (KB957095)

Aggiornamento della protezione per Windows XP (KB957097)

Aggiornamento della protezione per Windows XP (KB958215)

Aggiornamento della protezione per Windows XP (KB958470)

Aggiornamento della protezione per Windows XP (KB958644)

Aggiornamento della protezione per Windows XP (KB958687)

Aggiornamento della protezione per Windows XP (KB960714)

Aggiornamento per Windows XP (KB898461)

Aggiornamento per Windows XP (KB955839)

Aggiornamento rapido per Windows Media Player 11 (KB939683)

Aggiornamento rapido per Windows XP (KB935448)

Aggiornamento rapido per Windows XP (KB952287)

Aggiornamento rapido per Windows XP (KB970653-v3)

Air Assault 2

Assistente per l'accesso a Windows Live

Atheros for Acer Driver 5.3.0.45_Foxconn Installation Program

AutoUpdate

avast! Antivirus

Bonjour

Broadcom ASF Management Applications

Broadcom Driver v4.170.25.12_Foxconn Installation Program

Broadcom Gigabit Integrated Controller

CCScore

Choice Guard

DivX Codec

DivX Player

DivX Version Checker

DivX Web Player

Epson Easy Photo Print 2

EPSON Scan

EPSON Stylus SX100_TX100 Manuale

EPSON SX100 Series Printer Uninstall

EPSON Web-To-Page

ESSBrwr

ESSCDBK

ESScore

ESSgui

ESShelp

ESSini

ESSPCD

ESSPDock

ESSSONIC

ESSTOOLS

essvatgt

essvcpt

Favorit

Gadwin PrintScreen

GOM Player

Google Chrome

Google Toolbar for Internet Explorer

HDAUDIO Soft Data Fax Modem with SmartCP

Hercules Classic Link Webcam

High Definition Audio Driver Package - KB888111

HijackThis 2.0.2

HLPPDOCK

Hotfix for Windows Media Format 11 SDK (KB929399)

Hotfix for Windows XP (KB926239)

Intel® Graphics Media Accelerator Driver

kgcbaby

kgcbase

kgchday

kgchlwn

kgcinvt

kgckids

kgcmove

kgcvday

KSU

Malwarebytes' Anti-Malware

Microsoft .NET Framework 2.0

Microsoft Application Error Reporting

Microsoft Compression Client Pack 1.0 for Windows XP

Microsoft Kernel-Mode Driver Framework Feature Pack 1.5

Microsoft Office Access MUI (Italian) 2007

Microsoft Office Enterprise 2007

Microsoft Office Excel MUI (Italian) 2007

Microsoft Office Groove MUI (Italian) 2007

Microsoft Office InfoPath MUI (Italian) 2007

Microsoft Office OneNote MUI (Italian) 2007

Microsoft Office Outlook MUI (Italian) 2007

Microsoft Office PowerPoint MUI (Italian) 2007

Microsoft Office Proof (English) 2007

Microsoft Office Proof (French) 2007

Microsoft Office Proof (German) 2007

Microsoft Office Proof (Italian) 2007

Microsoft Office Proofing (Italian) 2007

Microsoft Office Publisher MUI (Italian) 2007

Microsoft Office Shared MUI (Italian) 2007

Microsoft Office Word MUI (Italian) 2007

Microsoft Silverlight

Microsoft Software Update for Web Folders (Italian) 12

Microsoft User-Mode Driver Framework Feature Pack 1.0

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

Microsoft Visual C++ 2005 Redistributable

MSVCRT

MSXML 4.0 SP2 (KB954430)

Nero 7 Ultra Edition

Nokia Connectivity Cable Driver

Notifier

OfotoXMI

OTtBP

OTtBPSDK

QuickTime

Realtek High Definition Audio Driver

Revo Uninstaller 1.83

Segoe UI

SFR

SHASTA

SKIN0001

SKINXSDK

Skype™ 4.1

Software Kodak EasyShare

Spybot - Search & Destroy

staticcr

Strumento di caricamento di Windows Live

Synaptics Pointing Device Driver

Texas Instruments PCIxx21/x515/xx12 drivers.

TIPCI

Upload Photos

VC80CRTRedist - 8.0.50727.762

VPRINTOL

WebFldrs XP

Windows Genuine Advantage Notifications (KB905474)

Windows Installer 3.1 (KB893803)

Windows Live Call

Windows Live Communications Platform

Windows Live Essentials

Windows Live Messenger

Windows Media Format 11 runtime

Windows Media Player 11

WIRELESS

XP Codec Pack

Your Cottonelle Puppy

==== Event Viewer Messages From Past Week ========

22.11.2009 г. 18:38:31, error: Service Control Manager [7022] - Servizio Servizio Bonjour bloccato in partenza.

22.11.2009 г. 18:37:01, error: Service Control Manager [7000] - Il servizio Acronis Scheduler2 Service non e stato avviato per il seguente errore: Impossibile trovare il percorso specificato.

22.11.2009 г. 18:19:19, error: Service Control Manager [7022] - Servizio Servizio Bonjour bloccato in partenza.

22.11.2009 г. 18:18:56, error: Service Control Manager [7000] - Il servizio Acronis Scheduler2 Service non e stato avviato per il seguente errore: Impossibile trovare il percorso specificato.

21.11.2009 г. 13:07:39, error: Service Control Manager [7022] - Servizio Servizio Bonjour bloccato in partenza.

21.11.2009 г. 13:06:09, error: Service Control Manager [7000] - Il servizio Acronis Scheduler2 Service non e stato avviato per il seguente errore: Impossibile trovare il percorso specificato.

20.11.2009 г. 10:37:02, error: Service Control Manager [7022] - Servizio Servizio Bonjour bloccato in partenza.

20.11.2009 г. 10:35:36, error: Service Control Manager [7000] - Il servizio Acronis Scheduler2 Service non e stato avviato per il seguente errore: Impossibile trovare il percorso specificato.

19.11.2009 г. 21:40:46, error: Service Control Manager [7022] - Servizio Servizio Bonjour bloccato in partenza.

19.11.2009 г. 21:39:20, error: Service Control Manager [7000] - Il servizio Acronis Scheduler2 Service non e stato avviato per il seguente errore: Impossibile trovare il percorso specificato.

19.11.2009 г. 15:42:28, error: Service Control Manager [7022] - Servizio Servizio Bonjour bloccato in partenza.

19.11.2009 г. 15:42:09, error: Service Control Manager [7000] - Il servizio Acronis Scheduler2 Service non e stato avviato per il seguente errore: Impossibile trovare il percorso specificato.

19.11.2009 г. 10:46:52, error: Service Control Manager [7022] - Servizio Servizio Bonjour bloccato in partenza.

19.11.2009 г. 10:45:26, error: Service Control Manager [7000] - Il servizio Acronis Scheduler2 Service non e stato avviato per il seguente errore: Impossibile trovare il percorso specificato.

19.11.2009 г. 10:14:12, error: Service Control Manager [7022] - Servizio Servizio Bonjour bloccato in partenza.

19.11.2009 г. 10:12:47, error: Service Control Manager [7000] - Il servizio Acronis Scheduler2 Service non e stato avviato per il seguente errore: Impossibile trovare il percorso specificato.

18.11.2009 г. 14:43:57, error: Service Control Manager [7022] - Servizio Servizio Bonjour bloccato in partenza.

18.11.2009 г. 14:42:32, error: Service Control Manager [7000] - Il servizio Acronis Scheduler2 Service non e stato avviato per il seguente errore: Impossibile trovare il percorso specificato.

18.11.2009 г. 00:33:19, error: Service Control Manager [7022] - Servizio Servizio Bonjour bloccato in partenza.

18.11.2009 г. 00:32:55, error: Service Control Manager [7000] - Il servizio Acronis Scheduler2 Service non e stato avviato per il seguente errore: Impossibile trovare il percorso specificato.

17.11.2009 г. 13:57:40, error: Service Control Manager [7022] - Servizio Servizio Bonjour bloccato in partenza.

17.11.2009 г. 13:56:15, error: Service Control Manager [7000] - Il servizio Acronis Scheduler2 Service non e stato avviato per il seguente errore: Impossibile trovare il percorso specificato.

16.11.2009 г. 15:50:39, error: Service Control Manager [7022] - Servizio Servizio Bonjour bloccato in partenza.

16.11.2009 г. 15:49:12, error: Service Control Manager [7000] - Il servizio Acronis Scheduler2 Service non e stato avviato per il seguente errore: Impossibile trovare il percorso specificato.

15.11.2009 г. 17:47:51, error: Service Control Manager [7022] - Servizio Servizio Bonjour bloccato in partenza.

15.11.2009 г. 17:47:28, error: Service Control Manager [7000] - Il servizio Acronis Scheduler2 Service non e stato avviato per il seguente errore: Impossibile trovare il percorso specificato.

==== End Of File ===========================

Логовете изглеждат чисти.

СТЪПКА 1

Изтеглете OTS.exe и я запазете не десктопа.

Стартирайте я и copy/paste под колонката "Paste Fix Here" въведете това:

[Kill All Processes]

[unregister Dlls]

[Registry - Safe List]

< Internet Explorer ToolBars [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\

YN -> WebBrowser\\"{604BC32A-9680-40D1-9AC6-E06B23A1BA4C}" [HKLM] -> Reg Error: Key error. [Reg Error: Key error.]

YN -> WebBrowser\\"{32099AAC-C132-4136-9E9A-4E364A424E17}" [HKLM] -> Reg Error: Key error. [Reg Error: Key error.]

[Empty Temp Folders]

[start Explorer]

[Reboot]

Натиснете бутона Run Fix

Ще се създаде лог файл след рестарта на машината. Копирайте го в следващия си пост.

СТЪПКА 2

1) Изтеглете: ESET Online Scanner

2) Стартирайте esetsmartinstaller_enu.exe

3) Сложете отметка на YES, I accept the Terms of Use и изберете Start

4) Скенерът ще започне да изтегля компонентите, които са му необходими.

5) Уверете се, че има отметки на следните редове, включително и тези от менюто Advanced Settings:

• 
  
• Remove found threats
  
• Scan archives
  
• Scan for potentially unwanted applications
  
• Scan for potentially unsafe applications
  
• Enable Anti-Stealth technology
  

И накрая изберете Start

6) Скенерът ще започне да изтегля последните дефиниции.

7) След, като сканирането завърши изберете Finish.

8) Отидете в:

C:\Program Files\ESET\ESET Online Scanner

Отворете файла log.txt , копирайте съдържанието му и го поставете в следващия си пост тук.

Доколкото разбрах,сте убедени,че въпросната Xvid e вирус?Явно цялото това теглене и мъки си е казало думата,защото никъде не я виждам.Ако може да ми кажете и дали мога да деинсталирам качените програми,че едно погрешно движение на син ми и хайде мъжо за нов РС?

All Processes Killed

[Registry - Safe List]

Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{604BC32A-9680-40D1-9AC6-E06B23A1BA4C}\ not found.

Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{32099AAC-C132-4136-9E9A-4E364A424E17} not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{32099AAC-C132-4136-9E9A-4E364A424E17}\ not found.

[Empty Temp Folders]

User: Administrator

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

User: All Users

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

User: GIANNA

->Temp folder emptied: 337190 bytes

->Temporary Internet Files folder emptied: 33170 bytes

User: LocalService

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

Windows Temp folder emptied: 16889 bytes

RecycleBin emptied: 8672 bytes

Total Files Cleaned = 0,41 mb

< End of fix log >

OTS by OldTimer - Version 3.1.6.2 fix logfile created on 11232009_154547

Files\Folders moved on Reboot...

File\Folder C:\WINDOWS\temp\_avast4_\Webshlock.txt not found!

C:\WINDOWS\temp\Perflib_Perfdata_1a4.dat moved successfully.

Registry entries deleted on Reboot...

ESETSmartInstaller@High as downloader log:

all ok

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6211

# api_version=3.0.2

# EOSSerial=0c1705fee49c3d4d98f8bef643ec090e

# end=finished

# remove_checked=true

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=true

# antistealth_checked=true

# utc_time=2009-11-23 02:40:50

# local_time=2009-11-23 03:40:50 (+0100, ora solare Europa occidentale)

# country="Bulgaria"

# lang=1033

# osver=5.1.2600 NT Service Pack 2

# compatibility_mode=512 16777215 100 0 0 0 0 0

# compatibility_mode=769 16775125 100 98 5080 195270368 0 0

# compatibility_mode=8192 67108863 100 0 4546 4546 0 0

# scanned=40866

# found=0

# cleaned=0

# scan_time=1642

Последните логове са чисти. Факт е обаче, че почистихме някои остатъци. Трудно е да се прецени от къде, как и кога се е инсталирала програмата, но по принцип Xvid си e кодек. Не че няма и фалшиви кодеци (fake codecs), но това е отделен въпрос. Лично аз не я виждам инсталирана на системата в момента. Имате качен само XP Codec Pack.

За да почистим инструментите с които сме работили направете следното:

Ако още пазите OTS.exe я стартирайте и натиснете CleanUp (както е показано на снимката)

Ако ви попита за рестарт на компютъра, се съгласете.

Приятно сърфиране.

Благодаря за помощта.

Благодаря за помощта.

За нас бе удоволствие.

При нови проблеми пишете отново.

Поздрави и лек ден.