Здравейте!

Моля за помощ.

Сестра ми не е внимавала, какво прави със скайп-а и май се е лепнало нещо. Разрових се по подобни теми и симптомите са същите / изтрита антивирусна и затваряне на всичко свързано с такива програми/. По принцип избягвам да пипам сам, а само се информирам и оставям другото на професионалистите,но сега с ваша помощ се надявам да го оправя.

Направих това:

Изтеглете OTL.exe и го запазете на десктопа.

Стартирайте файла с двукратен клик на мишката.

Направете следните настройки:

...

...Натиснете Run Scan.

Като приключи проверката публикувайте двата лог файла - OTL.Txt и Extras.Txt.

и резултата е това.

Предварително благодаря за помоща!

Extras.Txt

OTL.Txt

Редактирано 2 януари 201016 г. от supertorr (преглед на промените)

Честита нова година! Извинете за забавянето!

Стъпка 1:

Моля, отидете на Start --> Settings --> Control Panel --> Add or Remove Programs, и деинсталирайте следните програми (Ако присъстват в списъка):

Google Toolbar for Internet Explorer

NVIDIA ForceWare Network Access Manager

Acrobat.com

BitComet Toolbar

free-downloads.net Toolbar

Стъпка 2:

• Стартирайте OTL.exe
  
• Под Custom Scans/Fixes поставете следния скрипт:
  

:OTL

PRC - C:\WINDOWS\system32\btmzxslaqkjpxrfvqxf.exe ()

PRC - C:\Documents and Settings\User\Local Settings\Temp\dhmlv.exe ()

O4 - HKLM..\Run: [ajtxmyiovg] C:\WINDOWS\System32\ohbpokeulggnwrgxtbkd.exe ()

O4 - HKLM..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe File not found

O4 - HKU\S-1-5-21-1417001333-1390067357-682003330-1003..\Run: [ajtxmyiovg] C:\Documents and Settings\User\Local Settings\Temp\ohbpokeulggnwrgxtbkd.exe ()

O4 - HKU\S-1-5-21-1417001333-1390067357-682003330-1003..\Run: [rdqxperakyrrt] C:\WINDOWS\System32\hxozvofsgyvzfxjxq.exe ()

O4 - HKLM..\RunOnce: [vfqvlyjqykb] C:\WINDOWS\System32\hxozvofsgyvzfxjxq.exe ()

O4 - HKLM..\RunOnce: [vjyhbshseuprvlv] C:\Documents and Settings\User\Local Settings\Temp\hxozvofsgyvzfxjxq.exe ()

O4 - HKU\S-1-5-21-1417001333-1390067357-682003330-1003..\RunOnce: [sftbukyiticdgv] C:\WINDOWS\System32\dxshhezqiefnxtjbyhrlg.exe ()

O4 - HKU\S-1-5-21-1417001333-1390067357-682003330-1003..\RunOnce: [vfqvlyjqykb] C:\Documents and Settings\User\Local Settings\Temp\apfpkcseriehmdob.exe ()

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: sdpvmamudqih = ohbpokeulggnwrgxtbkd.exe ()

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: hpybpajou = C:\DOCUME~1\User\LOCALS~1\Temp\dxshhezqiefnxtjbyhrlg.exe ()

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1

O7 - HKU\S-1-5-21-1417001333-1390067357-682003330-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1

O32 - AutoRun File - [2010.01.02 11:20:46 | 00,000,817 | RHS- | M] () - C:\AUTORUN.INF -- [ NTFS ]

O32 - AutoRun File - [2010.01.02 11:20:48 | 00,000,806 | RHS- | M] () - D:\AUTORUN.INF -- [ FAT32 ]

O32 - AutoRun File - [2010.01.02 11:20:50 | 00,000,834 | RHS- | M] () - E:\AUTORUN.INF -- [ FAT32 ]

O33 - MountPoints2\{25f46269-9b74-11de-b116-001e8cdab61b}\Shell\AutoRun\command - "" = H:\DUB\WONK\tux.exe -- File not found

O33 - MountPoints2\{25f46269-9b74-11de-b116-001e8cdab61b}\Shell\open\command - "" = H:\DUB\WONK\tux.exe -- File not found

O33 - MountPoints2\{f2f1666f-97b6-11de-b110-001e8cdab61b}\Shell\AutoRun\command - "" = H:\uchoaeo.bat -- File not found

O33 - MountPoints2\{f2f1666f-97b6-11de-b110-001e8cdab61b}\Shell\explore\Command - "" = H:\oajuksgpxlo.bat -- File not found

O33 - MountPoints2\{f2f1666f-97b6-11de-b110-001e8cdab61b}\Shell\open\Command - "" = H:\akraougnt.bat -- File not found

[2010.01.02 15:20:16 | 00,002,408 | -H-- | M] () -- C:\WINDOWS\System32\sftbukyiticdgvepfhkxltmcqalauvynwhxz.pdl

[2010.01.02 15:20:16 | 00,002,408 | -H-- | M] () -- C:\WINDOWS\sftbukyiticdgvepfhkxltmcqalauvynwhxz.pdl

[2010.01.02 15:20:16 | 00,002,408 | -H-- | M] () -- C:\Program Files\sftbukyiticdgvepfhkxltmcqalauvynwhxz.pdl

[2010.01.02 15:20:16 | 00,002,408 | -H-- | M] () -- C:\Documents and Settings\User\Local Settings\Application Data\sftbukyiticdgvepfhkxltmcqalauvynwhxz.pdl

[2010.01.02 15:20:16 | 00,000,280 | -H-- | M] () -- C:\WINDOWS\uxbziosstyizsxwxdvorvtcimm.sct

[2010.01.02 15:20:16 | 00,000,280 | -H-- | M] () -- C:\WINDOWS\System32\uxbziosstyizsxwxdvorvtcimm.sct

[2010.01.02 15:20:16 | 00,000,280 | -H-- | M] () -- C:\Program Files\uxbziosstyizsxwxdvorvtcimm.sct

[2010.01.02 15:20:16 | 00,000,280 | -H-- | M] () -- C:\Documents and Settings\User\Local Settings\Application Data\uxbziosstyizsxwxdvorvtcimm.sct

[2010.01.02 15:19:28 | 00,000,316 | -H-- | M] () -- C:\WINDOWS\System32\hxozvofsgyvzfxjxqvbritpizmasptzrdrkpvlc.jct

[2010.01.02 15:19:28 | 00,000,316 | -H-- | M] () -- C:\WINDOWS\hxozvofsgyvzfxjxqvbritpizmasptzrdrkpvlc.jct

[2010.01.02 15:19:28 | 00,000,316 | -H-- | M] () -- C:\Program Files\hxozvofsgyvzfxjxqvbritpizmasptzrdrkpvlc.jct

[2010.01.02 15:19:28 | 00,000,316 | -H-- | M] () -- C:\Documents and Settings\User\Local Settings\Application Data\hxozvofsgyvzfxjxqvbritpizmasptzrdrkpvlc.jct

[2010.01.02 15:18:36 | 00,577,536 | RHS- | M] () -- C:\WINDOWS\uplbcawohegpaxohfpavrh.exe

[2010.01.02 15:18:36 | 00,577,536 | RHS- | M] () -- C:\WINDOWS\qhzlicuixqotatgvpv.exe

[2010.01.02 15:18:36 | 00,577,536 | RHS- | M] () -- C:\WINDOWS\ohbpokeulggnwrgxtbkd.exe

[2010.01.02 15:18:36 | 00,577,536 | RHS- | M] () -- C:\WINDOWS\hxozvofsgyvzfxjxq.exe

[2010.01.02 15:18:36 | 00,577,536 | RHS- | M] () -- C:\WINDOWS\dxshhezqiefnxtjbyhrlg.exe

[2010.01.02 15:18:36 | 00,577,536 | RHS- | M] () -- C:\WINDOWS\btmzxslaqkjpxrfvqxf.exe

[2010.01.02 15:18:36 | 00,577,536 | RHS- | M] () -- C:\WINDOWS\apfpkcseriehmdob.exe

[2010.01.02 11:20:46 | 00,000,817 | RHS- | M] () -- C:\AUTORUN.INF

[2010.01.02 11:20:19 | 00,577,536 | RHS- | M] () -- C:\WINDOWS\System32\uplbcawohegpaxohfpavrh.exe

[2010.01.02 11:20:19 | 00,577,536 | RHS- | M] () -- C:\WINDOWS\System32\qhzlicuixqotatgvpv.exe

[2010.01.02 11:20:19 | 00,577,536 | RHS- | M] () -- C:\WINDOWS\System32\hxozvofsgyvzfxjxq.exe

[2010.01.02 11:20:19 | 00,577,536 | RHS- | M] () -- C:\WINDOWS\System32\apfpkcseriehmdob.exe

[2010.01.02 11:12:02 | 00,577,536 | RHS- | M] () -- C:\WINDOWS\System32\dxshhezqiefnxtjbyhrlg.exe

[2010.01.02 11:12:02 | 00,577,536 | RHS- | M] () -- C:\WINDOWS\System32\btmzxslaqkjpxrfvqxf.exe

[2010.01.01 23:03:03 | 00,577,536 | RHS- | M] () -- C:\WINDOWS\System32\ohbpokeulggnwrgxtbkd.exe

[2009.12.30 21:36:23 | 00,001,243 | -H-- | M] () -- C:\WINDOWS\System32\qhzlicuixqotatgvpvctlxuogujcafmfshbhofxj.asg

[2009.12.30 21:36:23 | 00,001,243 | -H-- | M] () -- C:\WINDOWS\qhzlicuixqotatgvpvctlxuogujcafmfshbhofxj.asg

[2009.12.30 21:36:23 | 00,001,243 | -H-- | M] () -- C:\Program Files\qhzlicuixqotatgvpvctlxuogujcafmfshbhofxj.asg

[2009.12.30 21:36:23 | 00,001,243 | -H-- | M] () -- C:\Documents and Settings\User\Local Settings\Application Data\qhzlicuixqotatgvpvctlxuogujcafmfshbhofxj.asg

[2009.12.29 21:26:51 | 00,004,248 | -H-- | M] () -- C:\WINDOWS\vjyhbshseuprvlvhybftirlcrcoezbfvfrilp.sbv

[2009.12.29 21:26:51 | 00,004,248 | -H-- | M] () -- C:\WINDOWS\System32\vjyhbshseuprvlvhybftirlcrcoezbfvfrilp.sbv

[2009.12.29 21:26:51 | 00,004,248 | -H-- | M] () -- C:\Program Files\vjyhbshseuprvlvhybftirlcrcoezbfvfrilp.sbv

[2009.12.29 21:26:51 | 00,004,248 | -H-- | M] () -- C:\Documents and Settings\User\Local Settings\Application Data\vjyhbshseuprvlvhybftirlcrcoezbfvfrilp.sbv

[2009.12.29 21:27:30 | 00,002,408 | -H-- | C] () -- C:\WINDOWS\sftbukyiticdgvepfhkxltmcqalauvynwhxz.pdl

[2009.12.29 21:27:30 | 00,002,408 | -H-- | C] () -- C:\Program Files\sftbukyiticdgvepfhkxltmcqalauvynwhxz.pdl

[2009.12.29 21:27:30 | 00,002,408 | -H-- | C] () -- C:\Documents and Settings\User\Local Settings\Application Data\sftbukyiticdgvepfhkxltmcqalauvynwhxz.pdl

[2009.12.29 21:27:29 | 00,002,408 | -H-- | C] () -- C:\WINDOWS\System32\sftbukyiticdgvepfhkxltmcqalauvynwhxz.pdl

[2009.12.29 21:27:07 | 00,001,243 | -H-- | C] () -- C:\WINDOWS\System32\qhzlicuixqotatgvpvctlxuogujcafmfshbhofxj.asg

[2009.12.29 21:27:07 | 00,001,243 | -H-- | C] () -- C:\WINDOWS\qhzlicuixqotatgvpvctlxuogujcafmfshbhofxj.asg

[2009.12.29 21:27:07 | 00,001,243 | -H-- | C] () -- C:\Program Files\qhzlicuixqotatgvpvctlxuogujcafmfshbhofxj.asg

[2009.12.29 21:27:07 | 00,001,243 | -H-- | C] () -- C:\Documents and Settings\User\Local Settings\Application Data\qhzlicuixqotatgvpvctlxuogujcafmfshbhofxj.asg

[2009.12.29 21:27:07 | 00,000,316 | -H-- | C] () -- C:\WINDOWS\System32\hxozvofsgyvzfxjxqvbritpizmasptzrdrkpvlc.jct

[2009.12.29 21:27:07 | 00,000,316 | -H-- | C] () -- C:\WINDOWS\hxozvofsgyvzfxjxqvbritpizmasptzrdrkpvlc.jct

[2009.12.29 21:27:07 | 00,000,316 | -H-- | C] () -- C:\Program Files\hxozvofsgyvzfxjxqvbritpizmasptzrdrkpvlc.jct

[2009.12.29 21:27:07 | 00,000,316 | -H-- | C] () -- C:\Documents and Settings\User\Local Settings\Application Data\hxozvofsgyvzfxjxqvbritpizmasptzrdrkpvlc.jct

[2009.12.29 21:26:51 | 00,004,248 | -H-- | C] () -- C:\WINDOWS\vjyhbshseuprvlvhybftirlcrcoezbfvfrilp.sbv

[2009.12.29 21:26:51 | 00,004,248 | -H-- | C] () -- C:\WINDOWS\System32\vjyhbshseuprvlvhybftirlcrcoezbfvfrilp.sbv

[2009.12.29 21:26:51 | 00,004,248 | -H-- | C] () -- C:\Program Files\vjyhbshseuprvlvhybftirlcrcoezbfvfrilp.sbv

[2009.12.29 21:26:51 | 00,004,248 | -H-- | C] () -- C:\Documents and Settings\User\Local Settings\Application Data\vjyhbshseuprvlvhybftirlcrcoezbfvfrilp.sbv

[2009.12.29 21:26:50 | 00,000,280 | -H-- | C] () -- C:\WINDOWS\uxbziosstyizsxwxdvorvtcimm.sct

[2009.12.29 21:26:50 | 00,000,280 | -H-- | C] () -- C:\WINDOWS\System32\uxbziosstyizsxwxdvorvtcimm.sct

[2009.12.29 21:26:50 | 00,000,280 | -H-- | C] () -- C:\Program Files\uxbziosstyizsxwxdvorvtcimm.sct

[2009.12.29 21:26:50 | 00,000,280 | -H-- | C] () -- C:\Documents and Settings\User\Local Settings\Application Data\uxbziosstyizsxwxdvorvtcimm.sct

[2009.12.29 21:26:02 | 00,577,536 | RHS- | C] () -- C:\WINDOWS\uplbcawohegpaxohfpavrh.exe

[2009.12.29 21:26:02 | 00,577,536 | RHS- | C] () -- C:\WINDOWS\System32\uplbcawohegpaxohfpavrh.exe

[2009.12.29 21:26:02 | 00,577,536 | RHS- | C] () -- C:\WINDOWS\qhzlicuixqotatgvpv.exe

[2009.12.29 21:26:02 | 00,577,536 | RHS- | C] () -- C:\WINDOWS\ohbpokeulggnwrgxtbkd.exe

[2009.12.29 21:26:02 | 00,577,536 | RHS- | C] () -- C:\WINDOWS\hxozvofsgyvzfxjxq.exe

[2009.12.29 21:26:02 | 00,577,536 | RHS- | C] () -- C:\WINDOWS\dxshhezqiefnxtjbyhrlg.exe

[2009.12.29 21:26:02 | 00,577,536 | RHS- | C] () -- C:\WINDOWS\btmzxslaqkjpxrfvqxf.exe

[2009.12.29 21:26:02 | 00,577,536 | RHS- | C] () -- C:\WINDOWS\apfpkcseriehmdob.exe

[2009.12.29 21:26:01 | 00,577,536 | RHS- | C] () -- C:\WINDOWS\System32\qhzlicuixqotatgvpv.exe

[2009.12.29 21:26:01 | 00,577,536 | RHS- | C] () -- C:\WINDOWS\System32\ohbpokeulggnwrgxtbkd.exe

[2009.12.29 21:26:01 | 00,577,536 | RHS- | C] () -- C:\WINDOWS\System32\hxozvofsgyvzfxjxq.exe

[2009.12.29 21:26:01 | 00,577,536 | RHS- | C] () -- C:\WINDOWS\System32\dxshhezqiefnxtjbyhrlg.exe

[2009.12.29 21:26:01 | 00,577,536 | RHS- | C] () -- C:\WINDOWS\System32\btmzxslaqkjpxrfvqxf.exe

[2009.12.29 21:26:01 | 00,577,536 | RHS- | C] () -- C:\WINDOWS\System32\apfpkcseriehmdob.exe


:reg

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

"C:\Program Files\Skype\Phone\Skype.exe" =-


:Commands

[purity]

[emptytemp]

[Reboot]

• След това, кликнете върху бутона Run Fix
  
• Търпеливо изчакайте, докато програмата приключи своята работа. След, като нейната работа приключи, компютърът Ви ще се рестартира.
  

След рестартирането на компютъра, стартирайте отново OTL.exe и кликнете върху бутона Quick Scan. Накрая ще бъде генериран лог файл, който е необходимо да копирате и публикувате в следващия Ви коментар в тази тема.

OTL logfile created on: 02.1.2010 г. 21:22:18 - Run 3

OTL by OldTimer - Version 3.1.20.1 Folder = C:\Documents and Settings\User\Desktop

Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 6.0.2900.2180)

Locale: 00000402 | Country: Bulgaria | Language: BGR | Date Format: dd.M.yyyy 'г.'

2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 71,00% Memory free

4,00 Gb Paging File | 3,00 Gb Available in Paging File | 86,00% Paging File free

Paging file location(s): C:\pagefile.sys 2048 2048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 20,02 Gb Total Space | 11,66 Gb Free Space | 58,24% Space Free | Partition Type: NTFS

Drive D: | 99,99 Gb Total Space | 1,49 Gb Free Space | 1,49% Space Free | Partition Type: FAT32

Drive E: | 178,01 Gb Total Space | 140,76 Gb Free Space | 79,07% Space Free | Partition Type: FAT32

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

Computer Name: COMPUTER

Current User Name: User

Logged in as Administrator.

Current Boot Mode: Normal

Scan Mode: Current user

Company Name Whitelist: On

Skip Microsoft Files: On

File Age = 14 Days

Output = Minimal

Quick Scan

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\User\Desktop\OTL.exe (OldTimer Tools)

PRC - C:\Program Files\Spyware Doctor\pctsTray.exe (PC Tools)

PRC - C:\Program Files\Spyware Doctor\pctsSvc.exe (PC Tools)

PRC - C:\Program Files\Spyware Doctor\pctsAuxs.exe (PC Tools)

PRC - C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\Application\chrome.exe (Google Inc.)

PRC - C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)

PRC - C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)

PRC - C:\Program Files\Adobe\Reader 9.0\Reader\reader_sl.exe (Adobe Systems Incorporated)

PRC - C:\WINDOWS\RTHDCPL.exe (Realtek Semiconductor Corp.)

PRC - C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe (Rocket Division Software)

PRC - C:\Program Files\HP\HP Software Update\hpwuSchd2.exe (Hewlett-Packard Co.)

PRC - C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe (Hewlett-Packard Co.)

PRC - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)

PRC - C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe (Cyberlink Corp.)

PRC - C:\Program Files\CyberLink\Shared files\RichVideo.exe ()

PRC - C:\WINDOWS\system32\nvsvc32.exe (NVIDIA Corporation)

PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)

PRC - C:\Program Files\Datecs\FlexType 2K\FType2K.exe ()

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\User\Desktop\OTL.exe (OldTimer Tools)

MOD - C:\Program Files\Spyware Doctor\smumhook.dll (PC Tools)

MOD - C:\Program Files\Spyware Doctor\klg.dat (PC Tools)

MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll (Microsoft Corporation)

MOD - C:\WINDOWS\system32\newdll.dll ()

========== Win32 Services (SafeList) ==========

SRV - (sdCoreService) -- C:\Program Files\Spyware Doctor\pctsSvc.exe (PC Tools)

SRV - (sdAuxService) -- C:\Program Files\Spyware Doctor\pctsAuxs.exe (PC Tools)

SRV - (JavaQuickStarterService) -- C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)

SRV - (StarWindServiceAE) -- C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe (Rocket Division Software)

SRV - (hpqddsvc) -- C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll (Hewlett-Packard Co.)

SRV - (hpqcxs08) -- C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll (Hewlett-Packard Co.)

SRV - (RichVideo) Cyberlink RichVideo Service(CRVS) -- C:\Program Files\CyberLink\Shared files\RichVideo.exe ()

SRV - (NVSvc) -- C:\WINDOWS\system32\nvsvc32.exe (NVIDIA Corporation)

SRV - (odserv) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE (Microsoft Corporation)

SRV - (ose) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie'>http://www.google.com/ie

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie'>http://www.google.com/ie

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie'>http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.gong.bg/

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie'>http://www.google.com/ie

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

O1 HOSTS File: (734 bytes) - C:\WINDOWS\system32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1 localhost

O2 - BHO: (HP Print Enhancer) - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)

O2 - BHO: (HP Print Clips) - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll (Hewlett-Packard Co.)

O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

O2 - BHO: (WebCGMHlprObj Class) - {56B38F40-4E70-11d4-A076-0080AD86BA2F} - C:\WINDOWS\system32\cgmopenbho.dll (CGM Open Consortium, Inc.)

O2 - BHO: (Java Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)

O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)

O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.

O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)

O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.)

O4 - HKLM..\Run: [apfpkcseriehmdob] C:\DOCUME~1\User\LOCALS~1\Temp\qhzlicuixqotatgvpv.exe File not found

O4 - HKLM..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\hpwuSchd2.exe (Hewlett-Packard Co.)

O4 - HKLM..\Run: [iSTray] C:\Program Files\Spyware Doctor\pctsTray.exe (PC Tools)

O4 - HKLM..\Run: [LanguageShortcut] C:\Program Files\CyberLink\PowerDVD\Language\Language.exe ()

O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)

O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation)

O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()

O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\qttask.exe (Apple Inc.)

O4 - HKLM..\Run: [RemoteControl] C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe (Cyberlink Corp.)

O4 - HKLM..\Run: [RTHDCPL] C:\WINDOWS\RTHDCPL.exe (Realtek Semiconductor Corp.)

O4 - HKLM..\Run: [skyTel] C:\WINDOWS\SkyTel.exe (Realtek Semiconductor Corp.)

O4 - HKLM..\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)

O4 - HKCU..\Run: [AlcoholAutomount] C:\Program Files\Alcohol Soft\Alcohol 52\axcmd.exe (Alcohol Soft Development Team)

O4 - HKCU..\Run: [Google Update] C:\Documents and Settings\User\Local Settings\Application Data\Google\Update\GoogleUpdate.exe (Google Inc.)

O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\FlexType 2K.lnk = C:\Program Files\Datecs\FlexType 2K\FType2K.exe ()

O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableInstallerDetection = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableSecureUIAPaths = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableVirtualization = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 1

O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)

O9 - Extra Button: HP Clipbook - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll (Hewlett-Packard Co.)

O9 - Extra Button: HP Smart Select - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll (Hewlett-Packard Co.)

O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)

O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.

O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} http://www.apple.com/qtactivex/qtplugin.cab (QuickTime Plugin Control)

O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab (Facebook Photo Uploader 5 Control)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)

O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 78.90.118.129 89.190.192.166

O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)

O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2009.06.08 10:22:55 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

O33 - MountPoints2\{d8073d3a-5ee7-11de-95a2-001e8cdab61b}\Shell - "" = AutoRun

O33 - MountPoints2\{d8073d3a-5ee7-11de-95a2-001e8cdab61b}\Shell\AutoRun - "" = Auto&Play

O34 - HKLM BootExecute: (autocheck autochk *) - File not found

O35 - comfile [open] -- "%1" %*

O35 - exefile [open] -- "%1" %*

========== Files/Folders - Created Within 14 Days ==========

[2010.01.02 21:21:27 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\SoftwareDistribution

[2010.01.02 21:21:22 | 00,000,000 | ---D | C] -- C:\WINDOWS\LastGood

[2010.01.02 21:14:35 | 00,000,000 | ---D | C] -- C:\_OTL

[2010.01.02 11:22:40 | 00,513,536 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\User\Desktop\OTL.exe

[2010.01.01 23:00:06 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\appmgmt

[2009.12.28 07:53:40 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\LogFiles

[2009.12.22 22:33:28 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\TEMP

[2009.12.22 22:33:20 | 00,081,288 | ---- | C] (PCTools Research Pty Ltd.) -- C:\WINDOWS\System32\drivers\iksyssec.sys

[2009.12.22 22:33:20 | 00,066,952 | ---- | C] (PCTools Research Pty Ltd.) -- C:\WINDOWS\System32\drivers\iksysflt.sys

[2009.12.22 22:33:20 | 00,042,376 | ---- | C] (PCTools Research Pty Ltd.) -- C:\WINDOWS\System32\drivers\ikfilesec.sys

[2009.12.22 22:33:20 | 00,029,576 | ---- | C] (PCTools Research Pty Ltd.) -- C:\WINDOWS\System32\drivers\kcom.sys

[2009.12.22 22:33:03 | 00,000,000 | ---D | C] -- C:\Program Files\Spyware Doctor

[2009.12.22 22:33:03 | 00,000,000 | ---D | C] -- C:\Documents and Settings\User\Application Data\PC Tools

[2009.06.08 10:27:03 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft

[2009.06.08 10:25:34 | 00,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft

[2009.06.08 10:22:53 | 00,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Application Data\Microsoft

[2009.06.08 10:22:53 | 00,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Application Data\Microsoft

========== Files - Modified Within 14 Days ==========

[2010.01.02 21:20:40 | 00,081,496 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml

[2010.01.02 21:19:58 | 00,000,260 | ---- | M] () -- C:\WINDOWS\tasks\Spyware Doctor.job

[2010.01.02 21:19:58 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT

[2010.01.02 21:19:57 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2010.01.02 21:19:24 | 04,194,304 | -H-- | M] () -- C:\Documents and Settings\User\NTUSER.DAT

[2010.01.02 21:19:24 | 00,000,178 | -HS- | M] () -- C:\Documents and Settings\User\ntuser.ini

[2010.01.02 20:38:00 | 00,001,132 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1417001333-1390067357-682003330-1003UA.job

[2010.01.02 11:22:43 | 00,513,536 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\User\Desktop\OTL.exe

[2010.01.02 11:20:12 | 00,193,776 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT

[2010.01.01 22:38:00 | 00,001,080 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1417001333-1390067357-682003330-1003Core.job

[2010.01.01 22:12:32 | 00,042,496 | ---- | M] () -- C:\Documents and Settings\User\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2009.12.26 09:02:29 | 00,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl

[2009.12.22 22:34:26 | 00,356,120 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI

[2009.12.22 22:34:26 | 00,311,604 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat

[2009.12.22 22:34:26 | 00,039,992 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat

[2009.12.22 22:33:23 | 00,001,637 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Spyware Doctor.lnk

========== Files Created - No Company Name ==========

[2010.01.01 23:01:34 | 00,000,260 | ---- | C] () -- C:\WINDOWS\tasks\Spyware Doctor.job

[2009.12.22 22:33:23 | 00,001,637 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Spyware Doctor.lnk

[2009.11.21 20:55:18 | 00,000,756 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\hpzinstall.log

[2009.11.16 21:47:45 | 00,000,020 | -H-- | C] () -- C:\WINDOWS\akebook.ini

[2009.11.16 21:47:45 | 00,000,004 | -H-- | C] () -- C:\WINDOWS\a3kebook.ini

[2009.11.16 21:47:44 | 00,000,059 | ---- | C] () -- C:\WINDOWS\ANS2000.INI

[2009.10.29 22:54:04 | 00,721,904 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys

[2009.06.13 08:15:50 | 00,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini

[2009.06.08 21:27:48 | 00,042,496 | ---- | C] () -- C:\Documents and Settings\User\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2009.06.08 11:11:55 | 00,045,056 | ---- | C] () -- C:\WINDOWS\System32\newdll.dll

[2009.06.08 11:09:19 | 00,000,000 | ---- | C] () -- C:\WINDOWS\PROTOCOL.INI

[2009.06.08 11:05:22 | 00,164,352 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll

[2009.06.08 11:05:21 | 02,041,363 | ---- | C] () -- C:\WINDOWS\System32\x264vfw.dll

[2009.06.08 11:05:21 | 00,755,027 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll

[2009.06.08 11:05:20 | 03,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll

[2009.06.08 11:05:20 | 00,159,839 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll

[2009.06.08 11:05:20 | 00,007,680 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll

[2009.06.08 11:05:20 | 00,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest

[2009.06.08 11:04:38 | 00,000,643 | ---- | C] () -- C:\WINDOWS\System32\OemInfo.ini

[2009.06.08 10:46:34 | 00,017,493 | ---- | C] () -- C:\WINDOWS\Ascd_log.ini

[2009.06.08 10:46:28 | 00,005,810 | R--- | C] () -- C:\WINDOWS\System32\drivers\ASACPI.sys

[2009.06.08 10:46:25 | 00,017,241 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini

[2009.06.08 10:46:14 | 00,010,288 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS

[2007.11.28 03:32:00 | 01,163,264 | ---- | C] () -- C:\WINDOWS\System32\acAuth.dll

[2006.10.31 00:35:00 | 01,662,976 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll

[2006.10.31 00:35:00 | 01,470,464 | ---- | C] () -- C:\WINDOWS\System32\nview.dll

[2006.10.31 00:35:00 | 01,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll

[2006.10.31 00:35:00 | 00,581,632 | ---- | C] () -- C:\WINDOWS\System32\nvhwvid.dll

[2006.10.31 00:35:00 | 00,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll

[2006.10.31 00:35:00 | 00,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll

[2006.10.31 00:35:00 | 00,196,608 | ---- | C] () -- C:\WINDOWS\System32\nvapi.dll

[2004.08.04 00:56:44 | 00,081,920 | ---- | C] () -- C:\WINDOWS\System32\ieencode.dll

[2004.07.17 11:36:38 | 00,027,440 | ---- | C] () -- C:\WINDOWS\System32\drivers\secdrv.sys

========== LOP Check ==========

[2010.01.02 21:20:42 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP

[2009.11.16 21:48:33 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Ulead Systems

[2009.10.05 21:28:43 | 00,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\Alzex

[2009.07.12 18:56:19 | 00,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\BSplayer Pro

[2004.10.30 07:09:38 | 00,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\ITEDO

[2009.11.16 21:49:23 | 00,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\Ulead Systems

[2010.01.02 21:19:58 | 00,000,260 | ---- | M] () -- C:\WINDOWS\Tasks\Spyware Doctor.job

========== Purity Check ==========

========== Alternate Data Streams ==========

@Alternate Data Stream - 106 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2

< End of report >

Стъпка 1:

1) Изтеглете: ESET Online Scanner

2) Стартирайте esetsmartinstaller_enu.exe

3) Сложете отметка на YES, I accept the Terms of Use и изберете Start

4) Скенерът ще започне да изтегля компонентите, които са му необходими.

5) Уверете се, че има отметки на следните редове, включително и тези от менюто Advanced Settings:

• 
  
• Remove found threats
  
• Scan archives
  
• Scan for potentially unwanted applications
  
• Scan for potentially unsafe applications
  
• Enable Anti-Stealth technology
  

И накрая изберете Start

6) Скенерът ще започне да изтегля последните дефиниции.

7) След, като сканирането завърши изберете Finish.

8) Отидете в:

C:\Program Files\ESET\ESET Online Scanner

Отворете файла log.txt , копирайте съдържанието му и го поставете в следващия си пост тук.

Стъпка 2:

Изтеглете Malwarebytes' Anti-Malware от тук

Кликнете два пъти върху mbam-setup.exe за да инсталирате програмата.

• * Уверете се, че има отметки на Update Malwarebytes' Anti-Malware и Launch Malwarebytes' Anti-Malware, след това кликнете на Finish.
  * Ако има намерени по-нови обновления, тя ще ги изтегли и инсталира.
  * Стартирайте програмата и изберете "Perform Full Scan", след това кликнете на Scan.
  * Сканирането ще отнеме малко време, затова моля бъдете търпеливи.
  * Когато сканирането завърши, кликнете на OK, след това Show Results, за да видите резултата.
  * Уверете се, че на всички редове има отметки, и кликнете Remove Selected.
  * Когато всичко бъде премахнато, логът ще бъде отворен в Notepad. Копирайте лога и го публикувайте в следващия си коментар в темата.

Бележка: Ако MalwareBytes' Anti-Malware се затрудни в премахването на откритите вируси/заплахи, той ще поиска да рестартира компютъра Ви и по време на рестартирането да премахне проблемните вируси/заплахи. Ако бъдете попитани, потвърдете че желаете вашия компютър да бъде рестартиран.

ESETSmartInstaller@High as downloader log:

all ok

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6211

# api_version=3.0.2

# EOSSerial=292e6b585a013142929a8e3ca3c98f11

# end=finished

# remove_checked=true

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=true

# antistealth_checked=true

# utc_time=2010-01-02 08:43:36

# local_time=2010-01-02 10:43:36 (+0200, FLE Standard Time)

# country="Bulgaria"

# lang=1033

# osver=5.1.2600 NT Service Pack 2

# compatibility_mode=2560 16777215 100 0 0 0 0 0

# compatibility_mode=8192 67108863 100 0 3700 3700 0 0

# scanned=65995

# found=41

# cleaned=41

# scan_time=3172

C:\ajtxmyiovg.bat Win32/AutoRun.Agent.UD worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\qxfhuemq.bat Win32/AutoRun.Agent.UD worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\sdpvmamudqih.bat Win32/AutoRun.Agent.UD worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\Documents and Settings\User\update.exe a variant of Win32/Injector.AIB trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\_OTL\MovedFiles\01022010_211435\C_\AUTORUN.INF INF/Autorun.Gen virus (deleted - quarantined) 00000000000000000000000000000000 C

C:\_OTL\MovedFiles\01022010_211435\C_Documents and Settings\User\Local Settings\Temp\apfpkcseriehmdob.exe Win32/AutoRun.Agent.UD worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\_OTL\MovedFiles\01022010_211435\C_Documents and Settings\User\Local Settings\Temp\dxshhezqiefnxtjbyhrlg.exe Win32/AutoRun.Agent.UD worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\_OTL\MovedFiles\01022010_211435\C_Documents and Settings\User\Local Settings\Temp\hxozvofsgyvzfxjxq.exe Win32/AutoRun.Agent.UD worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\_OTL\MovedFiles\01022010_211435\C_Documents and Settings\User\Local Settings\Temp\ohbpokeulggnwrgxtbkd.exe Win32/AutoRun.Agent.UD worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\_OTL\MovedFiles\01022010_211435\C_WINDOWS\apfpkcseriehmdob.exe Win32/AutoRun.Agent.UD worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\_OTL\MovedFiles\01022010_211435\C_WINDOWS\btmzxslaqkjpxrfvqxf.exe Win32/AutoRun.Agent.UD worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\_OTL\MovedFiles\01022010_211435\C_WINDOWS\dxshhezqiefnxtjbyhrlg.exe Win32/AutoRun.Agent.UD worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\_OTL\MovedFiles\01022010_211435\C_WINDOWS\hxozvofsgyvzfxjxq.exe Win32/AutoRun.Agent.UD worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\_OTL\MovedFiles\01022010_211435\C_WINDOWS\ohbpokeulggnwrgxtbkd.exe Win32/AutoRun.Agent.UD worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\_OTL\MovedFiles\01022010_211435\C_WINDOWS\qhzlicuixqotatgvpv.exe Win32/AutoRun.Agent.UD worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\_OTL\MovedFiles\01022010_211435\C_WINDOWS\uplbcawohegpaxohfpavrh.exe Win32/AutoRun.Agent.UD worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\_OTL\MovedFiles\01022010_211435\C_WINDOWS\system32\apfpkcseriehmdob.exe Win32/AutoRun.Agent.UD worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\_OTL\MovedFiles\01022010_211435\C_WINDOWS\system32\btmzxslaqkjpxrfvqxf.exe Win32/AutoRun.Agent.UD worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\_OTL\MovedFiles\01022010_211435\C_WINDOWS\system32\dxshhezqiefnxtjbyhrlg.exe Win32/AutoRun.Agent.UD worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\_OTL\MovedFiles\01022010_211435\C_WINDOWS\system32\hxozvofsgyvzfxjxq.exe Win32/AutoRun.Agent.UD worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\_OTL\MovedFiles\01022010_211435\C_WINDOWS\system32\ohbpokeulggnwrgxtbkd.exe Win32/AutoRun.Agent.UD worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\_OTL\MovedFiles\01022010_211435\C_WINDOWS\system32\qhzlicuixqotatgvpv.exe Win32/AutoRun.Agent.UD worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\_OTL\MovedFiles\01022010_211435\C_WINDOWS\system32\uplbcawohegpaxohfpavrh.exe Win32/AutoRun.Agent.UD worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\_OTL\MovedFiles\01022010_211435\D_\AUTORUN.INF INF/Autorun.Gen virus (deleted - quarantined) 00000000000000000000000000000000 C

C:\_OTL\MovedFiles\01022010_211435\E_\AUTORUN.INF INF/Autorun.Gen virus (deleted - quarantined) 00000000000000000000000000000000 C

D:\qxfhuemq.bat Win32/AutoRun.Agent.UD worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

D:\ajtxmyiovg.bat Win32/AutoRun.Agent.UD worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

D:\sdpvmamudqih.bat Win32/AutoRun.Agent.UD worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

D:\CyberLink\Downloads\Flashget 1.71 Super 1.exe a variant of Win32/HackTool.Patcher.A application (deleted - quarantined) 00000000000000000000000000000000 C

D:\CyberLink\Downloads\FlashGet SuperPack 2006+bghelp.rar a variant of Win32/HackTool.Patcher.A application (deleted - quarantined) 00000000000000000000000000000000 C

D:\System Volume Information\_restore{EC543A03-D4D5-46C5-BEF1-7FF5A001D324}\RP6\A0000371.bat Win32/AutoRun.Agent.UD worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

D:\System Volume Information\_restore{EC543A03-D4D5-46C5-BEF1-7FF5A001D324}\RP6\A0000372.bat Win32/AutoRun.Agent.UD worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

D:\System Volume Information\_restore{EC543A03-D4D5-46C5-BEF1-7FF5A001D324}\RP6\A0000373.bat Win32/AutoRun.Agent.UD worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

D:\System Volume Information\_restore{EC543A03-D4D5-46C5-BEF1-7FF5A001D324}\RP6\A0000374.exe a variant of Win32/HackTool.Patcher.A application (deleted - quarantined) 00000000000000000000000000000000 C

D:\Downloads\Flashget 1.71 Super №1\Patch\twk-flashget171patch.exe a variant of Win32/HackTool.Patcher.A application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

E:\qxfhuemq.bat Win32/AutoRun.Agent.UD worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

E:\ajtxmyiovg.bat Win32/AutoRun.Agent.UD worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

E:\sdpvmamudqih.bat Win32/AutoRun.Agent.UD worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

E:\System Volume Information\_restore{EC543A03-D4D5-46C5-BEF1-7FF5A001D324}\RP6\A0000376.bat Win32/AutoRun.Agent.UD worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

E:\System Volume Information\_restore{EC543A03-D4D5-46C5-BEF1-7FF5A001D324}\RP6\A0000377.bat Win32/AutoRun.Agent.UD worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

E:\System Volume Information\_restore{EC543A03-D4D5-46C5-BEF1-7FF5A001D324}\RP6\A0000378.bat Win32/AutoRun.Agent.UD worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

-------------------------------------------------------------------------------------

Malwarebytes' Anti-Malware 1.43

Database version: 3482

Windows 5.1.2600 Service Pack 2

Internet Explorer 6.0.2900.2180

02.1.2010 г. 23:00:23

mbam-log-2010-01-02 (23-00-23).txt

Scan type: Full Scan (C:\|D:\|E:\|)

Objects scanned: 175777

Time elapsed: 11 minute(s), 6 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 2

Registry Values Infected: 0

Registry Data Items Infected: 3

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{56b38f40-4e70-11d4-a076-0080ad86ba2f} (Trojan.BHO) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{56b38f40-4e70-11d4-a076-0080ad86ba2f} (Trojan.BHO) -> Quarantined and deleted successfully.

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:

(No malicious items detected)

Files Infected:

C:\WINDOWS\system32\cgmopenbho.dll (Trojan.BHO) -> Delete on reboot.

Редактирано 2 януари 201016 г. от supertorr (преглед на промените)

Как е системата в момента?

може би по-бърза

положителна разлика,е че отворих директно часта от форума " премахване на ........-Hi JackThis логове" без да ме изхвърли.

Със рестарта ми се е ъпдейтнал Windows Security Center и ме извести, че нямам защита и активирах Firewall-a, но не съм активирал никаква антивирусна.

Извинявам се ако прибързвам нещо.

Ще очаквам още напътствия

Здравейте,

извинявам се за незнанието, но необходимо ли е още нещо да се прави по моята система?

Ако всичко е наред, мисля че това ще е от мен.

Мисля, че ОК. Не е имало проблеми от вчера, но имам още няколко въпроса:

1. OTL & Malwarebytes' Anti-Malware остават ли инсталирани и ако да как може да са ми от полза?

2. В момента нямам антивирусна моля за насока и имали нещо специфично след инсталирането й?

3. Имам инсталиран от преди това Spyware Doctor 2010- золезен ли е?

4. Какви трябва да са настройките на Windows Security Center?

Благодаря отново за цялата помощ и подкрепа!!!

1. OTL & Malwarebytes' Anti-Malware остават ли инсталирани и ако да как може да са ми от полза?

OTL е специализиран инструмент, Вие няма как да го използвате. За да го премахнете:

За да премахнете всички инструменти, коити използвахме, а също файловете и папките, които те създават, моля, направете следното:

Моля, изтеглете OTCleanIt създаден от OldTimer:

Запезете го на вашия десктоп.

Кликнете два пъти върху OTCleanIt.exe.

Кликнете на бутона CleanUp!.

Ако по време на почистването Ви се появи предложение за рестартиране на компютъра, изберете Yes. Инструментът ще се премахне сам, след като почистването приключи.

Тук обаче MalwareBytes' Anti-Malware, може да Ви е много полезен!

2. В момента нямам антивирусна моля за насока и имали нещо специфично след инсталирането й?

От платените варианти, аз Ви препоръчвам ESET NOD32 Antivirus:

http://www.eset.bg/orders/

http://eset.bg/forum/viewtopic.php?f=3&t=1119&sid=379092a1cadff487852525edcae00353

От безплатните варианти Microsoft Security Essentials:

http://www.kaldata.com/comments.php?catid=1&id=50050

Няма особености, всичко е направено автоматично и не е необходимо да се променя нищо. Не че има и много варианти за настройка, де....

3. Имам инсталиран от преди това Spyware Doctor 2010- золезен ли е?

Може би, но пък MalwareBytes' Anti-Malware е в пъти по-добър във всяко едно отношение.

4. Какви трябва да са настройките на Windows Security Center?

Windows Security Center съдържа няколко компонента, които следят дали всичко е наред от гледна точка на сигурността - дали имате инсталиран и работещ антивирусен софтуер, дали имате инсталирана и работеща защитна стена (в противен случай има вградена, която можете да използвате) и дали обновявате своя Windows.

Необходимо е всички компоненти да работят!

С ТАЗИ ГАДИНА /AutoRun.Agent.DU - worm/ СЕ БОРИМ ОТ 26.12.2009 ГОДИНА баси мазнаия вирус на всякаде кадето имаш права тоест и напълно шарнати папки сере.

1.въпросът ми е на windows 2003 дали онлайн нода ще се справи или ще ми осере базата данни

2.същия въпрос имам за Malwarebytes Anti-Malware.

и въобще маха ли го ако не пиши ако имаш опит

ако ли не смятам да пробвам защото бързам после ще пиша.

Аз от малко повече време!

Отвори нова тема!