Здравейте. Този проблем го имам открай време, но изведнъж попаднах на тази тема http://www.kaldata.com/forums/index.php?showtopic=159385&st=0&p=1752721&hl=+%ED%E8%F2%EE%20+%E5%E4%ED%E0%20+%E0%ED%F2%E8%E2%E8%F0%F3%F1%ED%E0%20+ и видях как сте помогнали на човека. Проблемът ми е абсолютно същият, какъвто е бил на темата, за която дадох линк. Ако може, разбира се и ви се моля от все сърце да помогнете и на мен да се справя с това. Много ви моля. Благодаря предварително..

Редактирано 7 септември 201016 г. от mytlyto (преглед на промените)

Привет, mytlyto!

Следвайте следната инструкция за работа с OTL:

• Изтеглете OTL.exe и го запазете на десктопа.
• Стартирайте файла с двукратен клик на мишката.
• Направете следните настройки:

• Под "Custom Scans/Fixes" с Copy/ Paste въведете изцяло следната информация от цитата по-долу (без думата Цитат):

netsvcs

msconfig

safebootminimal

safebootnetwork

activex

drivers32

%SYSTEMDRIVE%\*.exe

%systemroot%\*. /mp /s

%ALLUSERSPROFILE%\Application Data\*.

%ALLUSERSPROFILE%\Application Data\*.exe /s

%APPDATA%\*.

%APPDATA%\*.exe /s

/md5start

eventlog.dll

scecli.dll

netlogon.dll

cngaudit.dll

sceclt.dll

ntelogon.dll

logevent.dll

iaStor.sys

nvstor.sys

atapi.sys

beep.sys

IdeChnDr.sys

viasraid.sys

AGP440.sys

vaxscsi.sys

nvatabus.sys

viamraid.sys

nvata.sys

nvgts.sys

iastorv.sys

ViPrt.sys

eNetHook.dll

ahcix86.sys

ahcix86s.sys

KR10N.sys

nvstor32.sys

nvrd32.sys

explorer.exe

svchost.exe

userinit.exe

symmpi.sys

qmgr.dll

ws2_32.dll

proquota.exe

imm32.dll

kernel32.dll

ndis.sys

autochk.exe

spoolsv.exe

xmlprov.dll

ntmssvc.dll

mswsock.dll

ntfs.sys

tcpip.sys

termsrv.dll

sfcfiles.dll

st3shark.sys

srsvc.dll

adp3132.sys

mv61xx.sys

/md5stop

CREATERESTOREPOINT

%systemroot%\system32\*.dll /lockedfiles

%systemroot%\Tasks\*.job /lockedfiles

%systemroot%\system32\drivers\*.sys /lockedfiles

%systemroot%\System32\config\*.sav

%systemroot%\system32\drivers\*.sys /90

• Натиснете маркираният в синьо бутон: .
• Като приключи проверката, ще се създадат два файла - OTL.Txt и Extras.Txt.
• Прикачете в следващия си коментар (погледнете опцията "прикачени файлове", когато публикувате мнение) логовете от OTL: OTL.Txt, Extras.Txt.

А не. Успях да изтегля въпросното Cure It. След като я пуснах ме предупреди, за нови версии и т.н. След това стартирах сканирането и намери някакви вируси, но ми изписва, че някакъв лицензионен ключ отсъствал и така нищо не мога да направя. Програмата ме препраща към сайта и, от който мозилата веднага ме изхвърля. Моля помощ по темата.

Привет, mytlyto!

Следвайте следната инструкция за работа с OTL:

• Изтеглете OTL.exe и го запазете на десктопа.
• Стартирайте файла с двукратен клик на мишката.
• Направете следните настройки:

• Под "Custom Scans/Fixes" с Copy/ Paste въведете изцяло следната информация от цитата по-долу (без думата Цитат):

• Натиснете маркираният в синьо бутон: .
• Като приключи проверката, ще се създадат два файла - OTL.Txt и Extras.Txt.
• Прикачете в следващия си коментар (погледнете опцията "прикачени файлове", когато публикувате мнение) логовете от OTL: OTL.Txt, Extras.Txt.

Извинете, не мога да видя изображението, което сте прикачили.

....

Следвайте следната инструкция за работа с OTL:

• Изтеглете OTL.exe и го запазете на десктопа.

mytlyto , изтеглете това / оцветено със зелено / и следвайте съветите на nologo ! Не обръщайте внимание на никой друг освен на колегите от HJTeam

Успехи !

П.П. Извинявай за намесата nologo !

mytlyto , изтеглете това / оцветено със зелено / и следвайте съветите на nologo ! Не обръщайте внимание на никой друг освен на колегите от HJTeam

Успехи !

П.П. Извинявай за намесата nologo !

Благодаря, това ми е ясно. Друг е проблема, че потребител nologo е публикувал/прикачил изображение, в което е показано как да се настрои програмата, а при мен това изображение не се отваря/зарежда.

mytlyto, засега оставете OTL. Оправих снимката, съжалявам за недоразумението.

Ще може ли да изпълните стъпки 3 (*бързо сканиране) и 4 от тази тема?

P.S. Към banshee79, считайте се за официално предупреден! Този раздел има правила. Прочетете ги внимателно. Моля да не се намесвате!

Веднага ми затваря браузера, когато вляза в линка за изтегляне на Malwarebytes' Anti-Malware Free.

Добре, продължете с OTL. Оправих снимката.

Добре, но имам един въпрос. Оправянето на този проблем няма да доведе до други драстични промени в компютъра ми нали ? Ето ги файловете, които се получиха след сканирването.

OTL.Txt

Extras.Txt

Не, няма да доведе до драстични промени. Ще почистим инфекциите по Windows, доколкото можем. Сега само сканирахте с OTL.

Ето какво следва:

Стъпка 1

Стартирайте пак OTL.exe и с Copy/ Paste под колонката Custom Scans/Fixes въведете скриптовия текст от цитата по-долу, като не забравяте да копирате скрипта 1 към 1 (без думата Цитат), както и двете точки преди първия ред на скрипта!

:OTL

PRC - C:\Documents and Settings\Mutlu\Local Settings\Temp\ipvyhq.exe ()

[2010/09/08 00:43:10 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Mutlu\Application Data\Mozilla\Firefox\Profiles\hvuu5hor.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}

[2010/09/08 00:43:10 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Mutlu\Application Data\Mozilla\Firefox\Profiles\hvuu5hor.default\extensions\{7FF99715-3016-4381-84CE-E4E4C9673020}

[2010/09/08 00:43:10 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Mutlu\Application Data\Mozilla\Firefox\Profiles\hvuu5hor.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}

[2010/09/08 00:43:10 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Mutlu\Application Data\Mozilla\Firefox\Profiles\hvuu5hor.default\extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB}

O4 - HKLM..\Run: [ipvyhq] C:\WINDOWS\System32\btkysmyxnxozyhayc.exe ()

O4 - HKLM..\Run: [mzlujyfzkpbh] C:\Documents and Settings\Mutlu\Local Settings\Temp\kdvkfannephttdxwba.exe ()

O4 - HKU\S-1-5-21-1123561945-1965331169-1177238915-1003..\Run: [bluamyctb] C:\WINDOWS\System32\ulbohaljyhxhfnfc.exe ()

O4 - HKU\S-1-5-21-1123561945-1965331169-1177238915-1003..\Run: [ipvyhq] C:\Documents and Settings\Mutlu\Local Settings\Temp\xtogecsvpdynqdackmcgc.exe ()

O4 - HKLM..\RunOnce: [pbmuiwcvfju] C:\Documents and Settings\Mutlu\Local Settings\Temp\ulbohaljyhxhfnfc.exe ()

O4 - HKLM..\RunOnce: [vdkoyik] C:\WINDOWS\System32\xtogecsvpdynqdackmcgc.exe ()

O4 - HKU\.DEFAULT..\RunOnce: [showDeskFix] File not found

O4 - HKU\S-1-5-18..\RunOnce: [showDeskFix] File not found

O4 - HKU\S-1-5-19..\RunOnce: [showDeskFix] File not found

O4 - HKU\S-1-5-20..\RunOnce: [showDeskFix] File not found

O4 - HKU\S-1-5-21-1123561945-1965331169-1177238915-1003..\RunOnce: [ufpwjwbtcf] C:\WINDOWS\System32\btkysmyxnxozyhayc.exe ()

O4 - HKU\S-1-5-21-1123561945-1965331169-1177238915-1003..\RunOnce: [vdkoyik] C:\Documents and Settings\Mutlu\Local Settings\Temp\idxolixzsfznpbxyfgvy.exe ()

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: ktbgrcfv = vpiyuqefxjcpqbwwccq.exe ()

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: xdiks = C:\DOCUME~1\Mutlu\LOCALS~1\Temp\vpiyuqefxjcpqbwwccq.exe ()

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableInstallerDetection = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableSecureUIAPaths = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableVirtualization = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0

O7 - HKU\S-1-5-21-1123561945-1965331169-1177238915-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 1

O7 - HKU\S-1-5-21-1123561945-1965331169-1177238915-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1

O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll File not found

O32 - AutoRun File - [2010/06/29 14:25:56 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

O32 - AutoRun File - [2010/09/08 09:53:14 | 000,000,830 | RHS- | M] () - C:\autorun.inf -- [ NTFS ]

O32 - AutoRun File - [2010/09/08 09:53:15 | 000,000,798 | RHS- | M] () - D:\autorun.inf -- [ NTFS ]

O33 - MountPoints2\{131e1989-9bb4-11df-bb97-00138f730f32}\Shell\AutoRun\command - "" = H:\bluamyctb.bat -- File not found

O33 - MountPoints2\{131e1989-9bb4-11df-bb97-00138f730f32}\Shell\explore\Command - "" = H:\lzmwmckfrxkrm.bat -- File not found

O33 - MountPoints2\{131e1989-9bb4-11df-bb97-00138f730f32}\Shell\open\Command - "" = H:\pbmuiwcvfju.bat -- File not found

O33 - MountPoints2\{2a7c9951-8b44-11df-bb7d-00138f730f32}\Shell\AutoRun\command - "" = H:\bluamyctb.bat -- File not found

O33 - MountPoints2\{2a7c9951-8b44-11df-bb7d-00138f730f32}\Shell\explore\Command - "" = H:\lzmwmckfrxkrm.bat -- File not found

O33 - MountPoints2\{2a7c9951-8b44-11df-bb7d-00138f730f32}\Shell\open\Command - "" = H:\pbmuiwcvfju.bat -- File not found

O33 - MountPoints2\{2a7c9952-8b44-11df-bb7d-00138f730f32}\Shell\AutoRun\command - "" = I:\bluamyctb.bat -- File not found

O33 - MountPoints2\{2a7c9952-8b44-11df-bb7d-00138f730f32}\Shell\explore\Command - "" = I:\lzmwmckfrxkrm.bat -- File not found

O33 - MountPoints2\{2a7c9952-8b44-11df-bb7d-00138f730f32}\Shell\open\Command - "" = I:\pbmuiwcvfju.bat -- File not found

O33 - MountPoints2\{5c8617c4-837f-11df-8355-806d6172696f}\Shell\AutoRun\command - "" = C:\bluamyctb.bat -- [2009/07/18 11:32:51 | 000,573,440 | RHS- | M] ()

O33 - MountPoints2\{5c8617c4-837f-11df-8355-806d6172696f}\Shell\explore\Command - "" = C:\lzmwmckfrxkrm.bat -- [2009/06/14 05:41:44 | 000,573,440 | RHS- | M] ()

O33 - MountPoints2\{5c8617c4-837f-11df-8355-806d6172696f}\Shell\open\Command - "" = C:\pbmuiwcvfju.bat -- [2009/06/03 09:45:14 | 000,573,440 | RHS- | M] ()

O33 - MountPoints2\{5c8617c5-837f-11df-8355-806d6172696f}\Shell\AutoRun\command - "" = D:\bluamyctb.bat -- [2009/04/17 06:16:21 | 000,573,440 | RHS- | M] ()

O33 - MountPoints2\{5c8617c5-837f-11df-8355-806d6172696f}\Shell\explore\Command - "" = D:\lzmwmckfrxkrm.bat -- [2009/07/13 07:42:07 | 000,573,440 | RHS- | M] ()

O33 - MountPoints2\{5c8617c5-837f-11df-8355-806d6172696f}\Shell\open\Command - "" = D:\pbmuiwcvfju.bat -- [2009/06/08 13:24:18 | 000,573,440 | RHS- | M] ()

O34 - HKLM BootExecute: (autocheck autochk *) - File not found

:Files

C:\WINDOWS\xtogecsvpdynqdackmcgc.exe

C:\WINDOWS\vpiyuqefxjcpqbwwccq.exe

C:\WINDOWS\ulbohaljyhxhfnfc.exe

C:\WINDOWS\olhazyptodzpthfirulqnj.exe

C:\WINDOWS\kdvkfannephttdxwba.exe

C:\WINDOWS\idxolixzsfznpbxyfgvy.exe

C:\WINDOWS\btkysmyxnxozyhayc.exe

C:\WINDOWS\xdiksaanrputgdkwoaaouzbjrre.glk

C:\WINDOWS\System32\xdiksaanrputgdkwoaaouzbjrre.glk

C:\Program Files\xdiksaanrputgdkwoaaouzbjrre.glk

C:\Documents and Settings\Mutlu\Local Settings\Application Data\xdiksaanrputgdkwoaaouzbjrre.glk

C:\WINDOWS\1

C:\WINDOWS\0

C:\WINDOWS\System32\kdvkfannephttdxwbanohzojerritlxxhbafersl.sni

C:\WINDOWS\kdvkfannephttdxwbanohzojerritlxxhbafersl.sni

C:\Program Files\kdvkfannephttdxwbanohzojerritlxxhbafersl.sni

C:\Documents and Settings\Mutlu\Local Settings\Application Data\kdvkfannephttdxwbanohzojerritlxxhbafersl.sni

C:\WINDOWS\System32\xtogecsvpdynqdackmcgc.exe

C:\WINDOWS\System32\vpiyuqefxjcpqbwwccq.exe

C:\WINDOWS\System32\ulbohaljyhxhfnfc.exe

C:\WINDOWS\System32\olhazyptodzpthfirulqnj.exe

C:\WINDOWS\System32\kdvkfannephttdxwba.exe

C:\WINDOWS\System32\idxolixzsfznpbxyfgvy.exe

C:\WINDOWS\System32\btkysmyxnxozyhayc.exe

C:\WINDOWS\vpiyuqefxjcpqbwwccqsmfvrnbcugzmnyttzznpjc.oky

C:\WINDOWS\System32\vpiyuqefxjcpqbwwccqsmfvrnbcugzmnyttzznpjc.oky

C:\Program Files\vpiyuqefxjcpqbwwccqsmfvrnbcugzmnyttzznpjc.oky

C:\Documents and Settings\Mutlu\Local Settings\Application Data\vpiyuqefxjcpqbwwccqsmfvrnbcugzmnyttzznpjc.oky

C:\Program Files\ulbohaljyhxhfnfcfcnmdtgzsdbqzpzxfxuxuf.vly

C:\Documents and Settings\Mutlu\Local Settings\Application Data\ulbohaljyhxhfnfcfcnmdtgzsdbqzpzxfxuxuf.vly

C:\Program Files\xdiksaanrputgdkwoaaouzbjrre.glk

C:\Documents and Settings\Mutlu\Local Settings\Application Data\xdiksaanrputgdkwoaaouzbjrre.glk

recycler /alldrives

autorun.inf /s /alldrives

ipconfig /flushdns /c

:Commands

[purity]

[clearallrestorepoints]

[resethosts]

[emptytemp]

[emptyflash]

[Reboot]

След като въведете скрипта от цитата по-горе натиснете бутона, маркиран в червено:

ОТL ще сканира и най-накрая ще рестартира Windows. След това ще се създаде лог файл. Копирайте и поставете този файл в следващия си коментар.

Не, няма да доведе до драстични промени. Ще почистим инфекциите по Windows, доколкото можем. Сега само сканирахте с OTL.

Ето какво следва:

Стъпка 1

Стартирайте пак OTL.exe и с Copy/ Paste под колонката Custom Scans/Fixes въведете скриптовия текст от цитата по-долу, като не забравяте да копирате скрипта 1 към 1 (без думата Цитат), както и двете точки преди първия ред на скрипта!

След като въведете скрипта от цитата по-горе натиснете бутона, маркиран в червено:

ОТL ще сканира и най-накрая ще рестартира Windows. След това ще се създаде лог файл. Копирайте и поставете този файл в следващия си коментар.

А при копирването на скрипта, да копирам ли и това OTL ?

Маркирайте и копирайте (Copy) изцяло текста, който се намира в цитата без думата "Цитат". Ето снимка:

После го поставете (Paste) там, където съм написал в предишния си коментар и натиснете Run Fix.

Извинете, но още един въпрос. Настройките пак ли да са такива http://store.picbg.net/pubpic/D4/82/7518fd045e0fd482.png или само просто копирвам скрипта слагам го там и натискам Run Fix. Извинете отново, невеж съм...

Не се притеснявайте и не настройвайте нищо. Написал съм какво да направите точно и ясно.

All processes killed

========== OTL ==========

No active process named ipvyhq.exe was found!

C:\Documents and Settings\Mutlu\Application Data\Mozilla\Firefox\Profiles\hvuu5hor.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\searchplugin folder moved successfully.

C:\Documents and Settings\Mutlu\Application Data\Mozilla\Firefox\Profiles\hvuu5hor.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\META-INF folder moved successfully.

C:\Documents and Settings\Mutlu\Application Data\Mozilla\Firefox\Profiles\hvuu5hor.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\lib folder moved successfully.

C:\Documents and Settings\Mutlu\Application Data\Mozilla\Firefox\Profiles\hvuu5hor.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\defaults folder moved successfully.

C:\Documents and Settings\Mutlu\Application Data\Mozilla\Firefox\Profiles\hvuu5hor.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components folder moved successfully.

C:\Documents and Settings\Mutlu\Application Data\Mozilla\Firefox\Profiles\hvuu5hor.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\chrome folder moved successfully.

C:\Documents and Settings\Mutlu\Application Data\Mozilla\Firefox\Profiles\hvuu5hor.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822} folder moved successfully.

C:\Documents and Settings\Mutlu\Application Data\Mozilla\Firefox\Profiles\hvuu5hor.default\extensions\{7FF99715-3016-4381-84CE-E4E4C9673020}\components folder moved successfully.

C:\Documents and Settings\Mutlu\Application Data\Mozilla\Firefox\Profiles\hvuu5hor.default\extensions\{7FF99715-3016-4381-84CE-E4E4C9673020}\chrome\skin\searchbar folder moved successfully.

C:\Documents and Settings\Mutlu\Application Data\Mozilla\Firefox\Profiles\hvuu5hor.default\extensions\{7FF99715-3016-4381-84CE-E4E4C9673020}\chrome\skin\options folder moved successfully.

C:\Documents and Settings\Mutlu\Application Data\Mozilla\Firefox\Profiles\hvuu5hor.default\extensions\{7FF99715-3016-4381-84CE-E4E4C9673020}\chrome\skin\lib\weatherbutton\panels\images folder moved successfully.

C:\Documents and Settings\Mutlu\Application Data\Mozilla\Firefox\Profiles\hvuu5hor.default\extensions\{7FF99715-3016-4381-84CE-E4E4C9673020}\chrome\skin\lib\weatherbutton\panels folder moved successfully.

C:\Documents and Settings\Mutlu\Application Data\Mozilla\Firefox\Profiles\hvuu5hor.default\extensions\{7FF99715-3016-4381-84CE-E4E4C9673020}\chrome\skin\lib\weatherbutton\icons folder moved successfully.

C:\Documents and Settings\Mutlu\Application Data\Mozilla\Firefox\Profiles\hvuu5hor.default\extensions\{7FF99715-3016-4381-84CE-E4E4C9673020}\chrome\skin\lib\weatherbutton folder moved successfully.

C:\Documents and Settings\Mutlu\Application Data\Mozilla\Firefox\Profiles\hvuu5hor.default\extensions\{7FF99715-3016-4381-84CE-E4E4C9673020}\chrome\skin\lib\uwa folder moved successfully.

C:\Documents and Settings\Mutlu\Application Data\Mozilla\Firefox\Profiles\hvuu5hor.default\extensions\{7FF99715-3016-4381-84CE-E4E4C9673020}\chrome\skin\lib\radio\images folder moved successfully.

C:\Documents and Settings\Mutlu\Application Data\Mozilla\Firefox\Profiles\hvuu5hor.default\extensions\{7FF99715-3016-4381-84CE-E4E4C9673020}\chrome\skin\lib\radio\css folder moved successfully.

C:\Documents and Settings\Mutlu\Application Data\Mozilla\Firefox\Profiles\hvuu5hor.default\extensions\{7FF99715-3016-4381-84CE-E4E4C9673020}\chrome\skin\lib\radio folder moved successfully.

C:\Documents and Settings\Mutlu\Application Data\Mozilla\Firefox\Profiles\hvuu5hor.default\extensions\{7FF99715-3016-4381-84CE-E4E4C9673020}\chrome\skin\lib\panels\images folder moved successfully.

C:\Documents and Settings\Mutlu\Application Data\Mozilla\Firefox\Profiles\hvuu5hor.default\extensions\{7FF99715-3016-4381-84CE-E4E4C9673020}\chrome\skin\lib\panels\css folder moved successfully.

C:\Documents and Settings\Mutlu\Application Data\Mozilla\Firefox\Profiles\hvuu5hor.default\extensions\{7FF99715-3016-4381-84CE-E4E4C9673020}\chrome\skin\lib\panels folder moved successfully.

C:\Documents and Settings\Mutlu\Application Data\Mozilla\Firefox\Profiles\hvuu5hor.default\extensions\{7FF99715-3016-4381-84CE-E4E4C9673020}\chrome\skin\lib folder moved successfully.

C:\Documents and Settings\Mutlu\Application Data\Mozilla\Firefox\Profiles\hvuu5hor.default\extensions\{7FF99715-3016-4381-84CE-E4E4C9673020}\chrome\skin folder moved successfully.

C:\Documents and Settings\Mutlu\Application Data\Mozilla\Firefox\Profiles\hvuu5hor.default\extensions\{7FF99715-3016-4381-84CE-E4E4C9673020}\chrome\content\widgets\net.vmn.www.3.YouTube.1217 folder moved successfully.

C:\Documents and Settings\Mutlu\Application Data\Mozilla\Firefox\Profiles\hvuu5hor.default\extensions\{7FF99715-3016-4381-84CE-E4E4C9673020}\chrome\content\widgets\net.vmn.www.3.Twitter.1257 folder moved successfully.

C:\Documents and Settings\Mutlu\Application Data\Mozilla\Firefox\Profiles\hvuu5hor.default\extensions\{7FF99715-3016-4381-84CE-E4E4C9673020}\chrome\content\widgets\net.vmn.www.3.Twitter.1255 folder moved successfully.

C:\Documents and Settings\Mutlu\Application Data\Mozilla\Firefox\Profiles\hvuu5hor.default\extensions\{7FF99715-3016-4381-84CE-E4E4C9673020}\chrome\content\widgets\net.vmn.www.3.Twitter.1227 folder moved successfully.

C:\Documents and Settings\Mutlu\Application Data\Mozilla\Firefox\Profiles\hvuu5hor.default\extensions\{7FF99715-3016-4381-84CE-E4E4C9673020}\chrome\content\widgets folder moved successfully.

C:\Documents and Settings\Mutlu\Application Data\Mozilla\Firefox\Profiles\hvuu5hor.default\extensions\{7FF99715-3016-4381-84CE-E4E4C9673020}\chrome\content\modules folder moved successfully.

C:\Documents and Settings\Mutlu\Application Data\Mozilla\Firefox\Profiles\hvuu5hor.default\extensions\{7FF99715-3016-4381-84CE-E4E4C9673020}\chrome\content\lib folder moved successfully.

C:\Documents and Settings\Mutlu\Application Data\Mozilla\Firefox\Profiles\hvuu5hor.default\extensions\{7FF99715-3016-4381-84CE-E4E4C9673020}\chrome\content\data\search folder moved successfully.

C:\Documents and Settings\Mutlu\Application Data\Mozilla\Firefox\Profiles\hvuu5hor.default\extensions\{7FF99715-3016-4381-84CE-E4E4C9673020}\chrome\content\data folder moved successfully.

C:\Documents and Settings\Mutlu\Application Data\Mozilla\Firefox\Profiles\hvuu5hor.default\extensions\{7FF99715-3016-4381-84CE-E4E4C9673020}\chrome\content folder moved successfully.

C:\Documents and Settings\Mutlu\Application Data\Mozilla\Firefox\Profiles\hvuu5hor.default\extensions\{7FF99715-3016-4381-84CE-E4E4C9673020}\chrome folder moved successfully.

C:\Documents and Settings\Mutlu\Application Data\Mozilla\Firefox\Profiles\hvuu5hor.default\extensions\{7FF99715-3016-4381-84CE-E4E4C9673020} folder moved successfully.

C:\Documents and Settings\Mutlu\Application Data\Mozilla\Firefox\Profiles\hvuu5hor.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\searchplugin folder moved successfully.

C:\Documents and Settings\Mutlu\Application Data\Mozilla\Firefox\Profiles\hvuu5hor.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\META-INF folder moved successfully.

C:\Documents and Settings\Mutlu\Application Data\Mozilla\Firefox\Profiles\hvuu5hor.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\lib folder moved successfully.

C:\Documents and Settings\Mutlu\Application Data\Mozilla\Firefox\Profiles\hvuu5hor.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\defaults folder moved successfully.

C:\Documents and Settings\Mutlu\Application Data\Mozilla\Firefox\Profiles\hvuu5hor.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\components folder moved successfully.

C:\Documents and Settings\Mutlu\Application Data\Mozilla\Firefox\Profiles\hvuu5hor.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\chrome folder moved successfully.

C:\Documents and Settings\Mutlu\Application Data\Mozilla\Firefox\Profiles\hvuu5hor.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5} folder moved successfully.

C:\Documents and Settings\Mutlu\Application Data\Mozilla\Firefox\Profiles\hvuu5hor.default\extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB}\META-INF folder moved successfully.

C:\Documents and Settings\Mutlu\Application Data\Mozilla\Firefox\Profiles\hvuu5hor.default\extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB}\defaults\preferences folder moved successfully.

C:\Documents and Settings\Mutlu\Application Data\Mozilla\Firefox\Profiles\hvuu5hor.default\extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB}\defaults folder moved successfully.

C:\Documents and Settings\Mutlu\Application Data\Mozilla\Firefox\Profiles\hvuu5hor.default\extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB}\components folder moved successfully.

C:\Documents and Settings\Mutlu\Application Data\Mozilla\Firefox\Profiles\hvuu5hor.default\extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB}\chrome\skin folder moved successfully.

C:\Documents and Settings\Mutlu\Application Data\Mozilla\Firefox\Profiles\hvuu5hor.default\extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB}\chrome\locale\zh-CN folder moved successfully.

C:\Documents and Settings\Mutlu\Application Data\Mozilla\Firefox\Profiles\hvuu5hor.default\extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB}\chrome\locale\en-US folder moved successfully.

C:\Documents and Settings\Mutlu\Application Data\Mozilla\Firefox\Profiles\hvuu5hor.default\extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB}\chrome\locale folder moved successfully.

C:\Documents and Settings\Mutlu\Application Data\Mozilla\Firefox\Profiles\hvuu5hor.default\extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB}\chrome\content folder moved successfully.

C:\Documents and Settings\Mutlu\Application Data\Mozilla\Firefox\Profiles\hvuu5hor.default\extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB}\chrome folder moved successfully.

C:\Documents and Settings\Mutlu\Application Data\Mozilla\Firefox\Profiles\hvuu5hor.default\extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB} folder moved successfully.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ipvyhq deleted successfully.

C:\WINDOWS\system32\btkysmyxnxozyhayc.exe moved successfully.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\mzlujyfzkpbh deleted successfully.

C:\Documents and Settings\Mutlu\Local Settings\Temp\kdvkfannephttdxwba.exe moved successfully.

Registry value HKEY_USERS\S-1-5-21-1123561945-1965331169-1177238915-1003\Software\Microsoft\Windows\CurrentVersion\Run\\bluamyctb deleted successfully.

C:\WINDOWS\system32\ulbohaljyhxhfnfc.exe moved successfully.

Registry value HKEY_USERS\S-1-5-21-1123561945-1965331169-1177238915-1003\Software\Microsoft\Windows\CurrentVersion\Run\\ipvyhq deleted successfully.

C:\Documents and Settings\Mutlu\Local Settings\Temp\xtogecsvpdynqdackmcgc.exe moved successfully.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce\\pbmuiwcvfju deleted successfully.

C:\Documents and Settings\Mutlu\Local Settings\Temp\ulbohaljyhxhfnfc.exe moved successfully.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce\\vdkoyik deleted successfully.

C:\WINDOWS\system32\xtogecsvpdynqdackmcgc.exe moved successfully.

Registry value HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce\\ShowDeskFix deleted successfully.

Registry value HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\RunOnce\\ShowDeskFix not found.

Registry value HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce\\ShowDeskFix deleted successfully.

Registry value HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce\\ShowDeskFix deleted successfully.

Registry value HKEY_USERS\S-1-5-21-1123561945-1965331169-1177238915-1003\Software\Microsoft\Windows\CurrentVersion\RunOnce\\ufpwjwbtcf deleted successfully.

File C:\WINDOWS\System32\btkysmyxnxozyhayc.exe not found.

Registry value HKEY_USERS\S-1-5-21-1123561945-1965331169-1177238915-1003\Software\Microsoft\Windows\CurrentVersion\RunOnce\\vdkoyik deleted successfully.

C:\Documents and Settings\Mutlu\Local Settings\Temp\idxolixzsfznpbxyfgvy.exe moved successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\HonorAutoRunSetting deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\\ktbgrcfv deleted successfully.

C:\WINDOWS\System32\vpiyuqefxjcpqbwwccq.exe moved successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\\xdiks deleted successfully.

C:\Documents and Settings\Mutlu\Local Settings\Temp\vpiyuqefxjcpqbwwccq.exe moved successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\EnableLUA deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\DisableRegistryTools deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorUser deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\EnableInstallerDetection deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\EnableSecureUIAPaths deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\EnableVirtualization deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\PromptOnSecureDesktop deleted successfully.

Registry value HKEY_USERS\S-1-5-21-1123561945-1965331169-1177238915-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.

Registry value HKEY_USERS\S-1-5-21-1123561945-1965331169-1177238915-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\DisableRegistryTools deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\skype-ie-addon-data\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{91774881-D725-4E58-B298-07617B9B86A8}\ deleted successfully.

File {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll File not found not found.

C:\AUTOEXEC.BAT moved successfully.

C:\autorun.inf moved successfully.

D:\autorun.inf moved successfully.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{131e1989-9bb4-11df-bb97-00138f730f32}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{131e1989-9bb4-11df-bb97-00138f730f32}\ not found.

File H:\bluamyctb.bat not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{131e1989-9bb4-11df-bb97-00138f730f32}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{131e1989-9bb4-11df-bb97-00138f730f32}\ not found.

File H:\lzmwmckfrxkrm.bat not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{131e1989-9bb4-11df-bb97-00138f730f32}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{131e1989-9bb4-11df-bb97-00138f730f32}\ not found.

File H:\pbmuiwcvfju.bat not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2a7c9951-8b44-11df-bb7d-00138f730f32}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2a7c9951-8b44-11df-bb7d-00138f730f32}\ not found.

File H:\bluamyctb.bat not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2a7c9951-8b44-11df-bb7d-00138f730f32}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2a7c9951-8b44-11df-bb7d-00138f730f32}\ not found.

File H:\lzmwmckfrxkrm.bat not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2a7c9951-8b44-11df-bb7d-00138f730f32}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2a7c9951-8b44-11df-bb7d-00138f730f32}\ not found.

File H:\pbmuiwcvfju.bat not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2a7c9952-8b44-11df-bb7d-00138f730f32}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2a7c9952-8b44-11df-bb7d-00138f730f32}\ not found.

File I:\bluamyctb.bat not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2a7c9952-8b44-11df-bb7d-00138f730f32}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2a7c9952-8b44-11df-bb7d-00138f730f32}\ not found.

File I:\lzmwmckfrxkrm.bat not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2a7c9952-8b44-11df-bb7d-00138f730f32}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2a7c9952-8b44-11df-bb7d-00138f730f32}\ not found.

File I:\pbmuiwcvfju.bat not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5c8617c4-837f-11df-8355-806d6172696f}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5c8617c4-837f-11df-8355-806d6172696f}\ not found.

C:\bluamyctb.bat moved successfully.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5c8617c4-837f-11df-8355-806d6172696f}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5c8617c4-837f-11df-8355-806d6172696f}\ not found.

C:\lzmwmckfrxkrm.bat moved successfully.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5c8617c4-837f-11df-8355-806d6172696f}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5c8617c4-837f-11df-8355-806d6172696f}\ not found.

C:\pbmuiwcvfju.bat moved successfully.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5c8617c5-837f-11df-8355-806d6172696f}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5c8617c5-837f-11df-8355-806d6172696f}\ not found.

D:\bluamyctb.bat moved successfully.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5c8617c5-837f-11df-8355-806d6172696f}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5c8617c5-837f-11df-8355-806d6172696f}\ not found.

D:\lzmwmckfrxkrm.bat moved successfully.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5c8617c5-837f-11df-8355-806d6172696f}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5c8617c5-837f-11df-8355-806d6172696f}\ not found.

D:\pbmuiwcvfju.bat moved successfully.

Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session manager\\BootExecute:autocheck autochk * deleted successfully.

========== FILES ==========

C:\WINDOWS\xtogecsvpdynqdackmcgc.exe moved successfully.

C:\WINDOWS\vpiyuqefxjcpqbwwccq.exe moved successfully.

C:\WINDOWS\ulbohaljyhxhfnfc.exe moved successfully.

C:\WINDOWS\olhazyptodzpthfirulqnj.exe moved successfully.

C:\WINDOWS\kdvkfannephttdxwba.exe moved successfully.

C:\WINDOWS\idxolixzsfznpbxyfgvy.exe moved successfully.

C:\WINDOWS\btkysmyxnxozyhayc.exe moved successfully.

C:\WINDOWS\xdiksaanrputgdkwoaaouzbjrre.glk moved successfully.

C:\WINDOWS\System32\xdiksaanrputgdkwoaaouzbjrre.glk moved successfully.

C:\Program Files\xdiksaanrputgdkwoaaouzbjrre.glk moved successfully.

C:\Documents and Settings\Mutlu\Local Settings\Application Data\xdiksaanrputgdkwoaaouzbjrre.glk moved successfully.

C:\WINDOWS\1 moved successfully.

C:\WINDOWS\0 moved successfully.

C:\WINDOWS\System32\kdvkfannephttdxwbanohzojerritlxxhbafersl.sni moved successfully.

C:\WINDOWS\kdvkfannephttdxwbanohzojerritlxxhbafersl.sni moved successfully.

C:\Program Files\kdvkfannephttdxwbanohzojerritlxxhbafersl.sni moved successfully.

C:\Documents and Settings\Mutlu\Local Settings\Application Data\kdvkfannephttdxwbanohzojerritlxxhbafersl.sni moved successfully.

File\Folder C:\WINDOWS\System32\xtogecsvpdynqdackmcgc.exe not found.

File\Folder C:\WINDOWS\System32\vpiyuqefxjcpqbwwccq.exe not found.

File\Folder C:\WINDOWS\System32\ulbohaljyhxhfnfc.exe not found.

File move failed. C:\WINDOWS\System32\olhazyptodzpthfirulqnj.exe scheduled to be moved on reboot.

File move failed. C:\WINDOWS\System32\kdvkfannephttdxwba.exe scheduled to be moved on reboot.

File move failed. C:\WINDOWS\System32\idxolixzsfznpbxyfgvy.exe scheduled to be moved on reboot.

File\Folder C:\WINDOWS\System32\btkysmyxnxozyhayc.exe not found.

C:\WINDOWS\vpiyuqefxjcpqbwwccqsmfvrnbcugzmnyttzznpjc.oky moved successfully.

C:\WINDOWS\System32\vpiyuqefxjcpqbwwccqsmfvrnbcugzmnyttzznpjc.oky moved successfully.

C:\Program Files\vpiyuqefxjcpqbwwccqsmfvrnbcugzmnyttzznpjc.oky moved successfully.

C:\Documents and Settings\Mutlu\Local Settings\Application Data\vpiyuqefxjcpqbwwccqsmfvrnbcugzmnyttzznpjc.oky moved successfully.

C:\Program Files\ulbohaljyhxhfnfcfcnmdtgzsdbqzpzxfxuxuf.vly moved successfully.

C:\Documents and Settings\Mutlu\Local Settings\Application Data\ulbohaljyhxhfnfcfcnmdtgzsdbqzpzxfxuxuf.vly moved successfully.

File\Folder C:\Program Files\xdiksaanrputgdkwoaaouzbjrre.glk not found.

File\Folder C:\Documents and Settings\Mutlu\Local Settings\Application Data\xdiksaanrputgdkwoaaouzbjrre.glk not found.

C:\RECYCLER\S-1-5-21-1123561945-1965331169-1177238915-1003 folder moved successfully.

C:\RECYCLER folder moved successfully.

D:\RECYCLER\S-1-5-21-776561741-725345543-1801674531-500 folder moved successfully.

D:\RECYCLER\S-1-5-21-776561741-682003330-725345543-500 folder moved successfully.

D:\RECYCLER\S-1-5-21-343818398-573735546-1606980848-1003 folder moved successfully.

D:\RECYCLER\S-1-5-21-220523388-527237240-682003330-500 folder moved successfully.

D:\RECYCLER\S-1-5-21-1708537768-1715567821-1417001333-1003 folder moved successfully.

D:\RECYCLER\S-1-5-21-1606980848-1500820517-725345543-500 folder moved successfully.

D:\RECYCLER\S-1-5-21-1454471165-1275210071-682003330-500 folder moved successfully.

D:\RECYCLER\S-1-5-21-1409082233-963894560-682003330-500 folder moved successfully.

D:\RECYCLER\S-1-5-21-1123561945-1965331169-1177238915-1003 folder moved successfully.

D:\RECYCLER\S-1-5-21-1060284298-1417001333-1177238915-1003 folder moved successfully.

D:\RECYCLER folder moved successfully.

autorun.inf not found in C:\

D:\Adobe.Photoshop.CS3.Extended\Autorun.inf moved successfully.

D:\Microsoft Office 2007 Complete Version Incl CD_Key\autorun.inf moved successfully.

D:\Microsoft Office 2007 Complete Version Incl CD_Key\ExpressionWeb\autorun.inf moved successfully.

D:\Microsoft Office 2007 Complete Version Incl CD_Key\Office 2007 Enterprise\autorun.inf moved successfully.

D:\Microsoft Office 2007 Complete Version Incl CD_Key\Office 2007 Project\autorun.inf moved successfully.

D:\Microsoft Office 2007 Complete Version Incl CD_Key\Office 2007 Visio\autorun.inf moved successfully.

D:\MiLaN\Knights Of Honor\Autorun.inf moved successfully.

D:\proshow\pxf\autorun.inf moved successfully.

< ipconfig /flushdns /c >

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

C:\Documents and Settings\Mutlu\Desktop\cmd.bat deleted successfully.

C:\Documents and Settings\Mutlu\Desktop\cmd.txt deleted successfully.

========== COMMANDS ==========

Restore points cleared and new OTL Restore Point set!

C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.

HOSTS file reset successfully

[EMPTYTEMP]

User: All Users

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

User: LocalService

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

User: Mutlu

->Temp folder emptied: 396525444 bytes

->Temporary Internet Files folder emptied: 33135381 bytes

->FireFox cache emptied: 219291088 bytes

->Flash cache emptied: 75677 bytes

User: NetworkService

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 2402044 bytes

%systemroot%\System32 .tmp files removed: 2577 bytes

%systemroot%\System32\dllcache .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 33317788 bytes

%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes

%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes

RecycleBin emptied: 0 bytes

Total Files Cleaned = 653.00 mb

[EMPTYFLASH]

User: All Users

User: Default User

User: LocalService

User: Mutlu

->Flash cache emptied: 0 bytes

User: NetworkService

Total Flash Files Cleaned = 0.00 mb

OTL by OldTimer - Version 3.2.11.0 log created on 09082010_125139

Files\Folders moved on Reboot...

File move failed. C:\WINDOWS\System32\olhazyptodzpthfirulqnj.exe scheduled to be moved on reboot.

File move failed. C:\WINDOWS\System32\kdvkfannephttdxwba.exe scheduled to be moved on reboot.

File move failed. C:\WINDOWS\System32\idxolixzsfznpbxyfgvy.exe scheduled to be moved on reboot.

File move failed. C:\Documents and Settings\Mutlu\Local Settings\Temp\btkysmyxnxozyhayc.exe scheduled to be moved on reboot.

File move failed. C:\Documents and Settings\Mutlu\Local Settings\Temp\idxolixzsfznpbxyfgvy.exe scheduled to be moved on reboot.

C:\Documents and Settings\Mutlu\Local Settings\Temp\ipvyhq.exe moved successfully.

File move failed. C:\Documents and Settings\Mutlu\Local Settings\Temp\kdvkfannephttdxwba.exe scheduled to be moved on reboot.

File move failed. C:\Documents and Settings\Mutlu\Local Settings\Temp\olhazyptodzpthfirulqnj.exe scheduled to be moved on reboot.

File move failed. C:\Documents and Settings\Mutlu\Local Settings\Temp\ulbohaljyhxhfnfc.exe scheduled to be moved on reboot.

File move failed. C:\Documents and Settings\Mutlu\Local Settings\Temp\vpiyuqefxjcpqbwwccq.exe scheduled to be moved on reboot.

File move failed. C:\Documents and Settings\Mutlu\Local Settings\Temp\xtogecsvpdynqdackmcgc.exe scheduled to be moved on reboot.

Registry entries deleted on Reboot...

И да не забравя да кажа.. има и друго. От вчера, всеки път когато компютъра ми се рестартира се рестартирва и Мозила Фирефокс, изцяло. Тоест цялата История отива и все едно току-що съм инсталирал програмата. Сега пак стана същото.

Благодаря, справяте се добре. Сега стартирайте отново OTL, не правете никакви настройки и натиснете Quick Scan. След като OTL завърши сканирането, прикачете лога, който ще се създаде.

Ето го

OTL.Txt

Ето какво следва:

Стартирайте пак OTL.exe и с Copy/ Paste под колонката Custom Scans/Fixes въведете скриптовия текст от цитата по-долу, като не забравяте да копирате скрипта 1 към 1 (без думата Цитат), както и двете точки преди първия ред на скрипта!

:OTL

PRC - C:\DOCUME~1\Mutlu\LOCALS~1\Temp\ipvyhq.exe File not found

PRC - C:\Documents and Settings\Mutlu\Local Settings\Temp\ulbohaljyhxhfnfc.exe ()

O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll File not found

O4 - HKLM..\Run: [ipvyhq] C:\WINDOWS\System32\kdvkfannephttdxwba.exe ()

O4 - HKLM..\Run: [mzlujyfzkpbh] C:\Documents and Settings\Mutlu\Local Settings\Temp\kdvkfannephttdxwba.exe ()

O4 - HKCU..\Run: [ipvyhq] C:\Documents and Settings\Mutlu\Local Settings\Temp\idxolixzsfznpbxyfgvy.exe ()

O4 - HKLM..\RunOnce: [pbmuiwcvfju] C:\Documents and Settings\Mutlu\Local Settings\Temp\vpiyuqefxjcpqbwwccq.exe ()

O4 - HKLM..\RunOnce: [vdkoyik] C:\WINDOWS\System32\btkysmyxnxozyhayc.exe ()

O4 - HKCU..\RunOnce: [ufpwjwbtcf] C:\WINDOWS\System32\btkysmyxnxozyhayc.exe ()

O4 - HKCU..\RunOnce: [vdkoyik] C:\Documents and Settings\Mutlu\Local Settings\Temp\ulbohaljyhxhfnfc.exe ()

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: xdiks = C:\DOCUME~1\Mutlu\LOCALS~1\Temp\ulbohaljyhxhfnfc.exe ()

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: ktbgrcfv = idxolixzsfznpbxyfgvy.exe ()

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableInstallerDetection = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableSecureUIAPaths = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableVirtualization = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 1

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1

:Files

C:\Program Files\xdiksaanrputgdkwoaaouzbjrre.glk

C:\WINDOWS\xdiksaanrputgdkwoaaouzbjrre.glk

C:\WINDOWS\System32\xdiksaanrputgdkwoaaouzbjrre.glk

C:\Documents and Settings\Mutlu\Local Settings\Application Data\xdiksaanrputgdkwoaaouzbjrre.glk

C:\WINDOWS\xtogecsvpdynqdackmcgc.exe

C:\WINDOWS\vpiyuqefxjcpqbwwccq.exe

C:\WINDOWS\ulbohaljyhxhfnfc.exe

C:\WINDOWS\olhazyptodzpthfirulqnj.exe

C:\WINDOWS\kdvkfannephttdxwba.exe

C:\WINDOWS\idxolixzsfznpbxyfgvy.exe

C:\WINDOWS\btkysmyxnxozyhayc.exe

C:\WINDOWS\sqlserver.dll

C:\WINDOWS\System32\kdvkfannephttdxwbanohzojerritlxxhbafersl.sni

C:\WINDOWS\kdvkfannephttdxwbanohzojerritlxxhbafersl.sni

C:\Program Files\kdvkfannephttdxwbanohzojerritlxxhbafersl.sni

C:\Documents and Settings\Mutlu\Local Settings\Application Data\kdvkfannephttdxwbanohzojerritlxxhbafersl.sni

C:\WINDOWS\System32\xtogecsvpdynqdackmcgc.exe

C:\WINDOWS\System32\vpiyuqefxjcpqbwwccq.exe

C:\WINDOWS\System32\ulbohaljyhxhfnfc.exe

C:\WINDOWS\System32\olhazyptodzpthfirulqnj.exe

C:\WINDOWS\System32\kdvkfannephttdxwba.exe

C:\WINDOWS\System32\idxolixzsfznpbxyfgvy.exe

C:\WINDOWS\System32\btkysmyxnxozyhayc.exe

C:\WINDOWS\ulbohaljyhxhfnfcfcnmdtgzsdbqzpzxfxuxuf.vly

C:\WINDOWS\System32\ulbohaljyhxhfnfcfcnmdtgzsdbqzpzxfxuxuf.vly

C:\WINDOWS\xdiksaanrputgdkwoaaouzbjrre.glk

C:\WINDOWS\System32\xdiksaanrputgdkwoaaouzbjrre.glk

C:\Program Files\xdiksaanrputgdkwoaaouzbjrre.glk

C:\Documents and Settings\Mutlu\Local Settings\Application Data\xdiksaanrputgdkwoaaouzbjrre.glk

C:\WINDOWS\xtogecsvpdynqdackmcgc.exe

C:\WINDOWS\System32\xtogecsvpdynqdackmcgc.exe

C:\WINDOWS\vpiyuqefxjcpqbwwccq.exe

C:\WINDOWS\System32\vpiyuqefxjcpqbwwccq.exe

C:\WINDOWS\ulbohaljyhxhfnfc.exe

C:\WINDOWS\System32\olhazyptodzpthfirulqnj.exe

C:\WINDOWS\olhazyptodzpthfirulqnj.exe

C:\WINDOWS\kdvkfannephttdxwba.exe

C:\WINDOWS\System32\idxolixzsfznpbxyfgvy.exe

C:\WINDOWS\idxolixzsfznpbxyfgvy.exe

C:\WINDOWS\btkysmyxnxozyhayc.exe

C:\WINDOWS\System32\ulbohaljyhxhfnfc.exe

C:\WINDOWS\System32\kdvkfannephttdxwba.exe

C:\WINDOWS\System32\btkysmyxnxozyhayc.exe

recycler /alldrives

autorun.inf /s /alldrives

ipconfig /flushdns /c

:Services

ipvyhq

mzlujyfzkpbh

pbmuiwcvfju

vdkoyik

ufpwjwbtcf

:Commands

[purity]

[clearallrestorepoints]

[resethosts]

[emptytemp]

[emptyflash]

[Reboot]

След като въведете скрипта от цитата по-горе натиснете бутона, маркиран в червено:

ОТL ще сканира и най-накрая ще рестартира Windows. След това ще се създаде лог файл. Копирайте и поставете този файл в следващия си коментар.

Пробвах 2-3 пъти и все същото.. отдолу само показваше нещо като "Processing : PRC - C:\DOCUME~1\Mutlu\LOCALS~1\Temp\ipvyhq.exe File not found" и така си стои..

Редактирано 8 септември 201016 г. от mytlyto (преглед на промените)

Хм, странно. Сега следва:

Стъпка 1

Деинсталирайте OTL. Ето как:

Стартирайте OTL.exe още веднъж и натиснете бутона CleanUp!

При дeинсталацията на OTL ще бъдат почистени инструменти и файлове, които използвахме в темата. Ще последва рестарт на Windows.

Стъпка 2

Следвайте следните стъпки за работа с ComboFix:

1. Изтеглете ComboFix от следните миръри: от BleepingComputer или от ForoSpyware.

След изтегляне на файла го запишете (бутон Save -> Save as) ComboFix на вашия десктоп, снимка:

След като изтеглите ComboFix на десктопа, иконката на програмата би трябвало да изглежда така:

2. Затворете всички работещи приложения или отворени прозорци. Прекратете временно работата на антивирусната програма и на други програми за сигурност, ако има такива. За целта може да прегледате информацията от този линк: How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs.

3. Стартирайте с двоен клик ComboFix. За целта използвайте YES, за да се съгласите с условията за използване на програмата. Важно: след като се стартира ComboFix не бива да се движи мишката или да се кликва върху отворения прозорец на програмата. Просто търпеливо оставете ComboFix да си свърши работата, без да използвате компютъра за други цели.

4. ComboFix ще спре временно Интернет връзката, но след като приключи работата на програмата тази връзка ще бъде възстановена автоматично. ComboFix ще сканира за проблеми и за заразени файлове, като това може да отнеме известно време. Моля да бъдете търпеливи. Ако има проблем с Интернет връзката, моля да прочетете това: Manually restoring the Internet connection section.

Забележка: При проблеми с ComboFix копирайте (Copy) и поставете (Paste) съдържанието на C:\BUG.txt в следващия си коментар.

5. Когато работата на ComboFix приключи, ще се появи текстов документ (log) в Notepad, виж снимката:

Копирайте (Copy) и поставете (Paste) съдържанието на лога в следващия си коментар.

ComboFix 10-09-07.03 - Mutlu 09/08/2010 21:30:30.1.1 - x86 Microsoft Windows XP Professional 5.1.2600.3.1251.1.1033.18.511.337 [GMT 3:00] Running from: c:\documents and settings\Mutlu\Desktop\ComboFix.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\autorun.inf C:\bluamyctb.bat c:\docume~1\Mutlu\LOCALS~1\Temp\btkysmyxnxozyhayc.exe c:\docume~1\Mutlu\LOCALS~1\Temp\vpiyuqefxjcpqbwwccq.exe c:\documents and settings\All Users\Application Data\mwmmgr.inc c:\documents and settings\All Users\Application Data\mwmmgr.txt c:\documents and settings\All Users\Start Menu\Programs\Family Keylogger 4 c:\documents and settings\All Users\Start Menu\Programs\Family Keylogger 4\Family Keylogger.lnk c:\documents and settings\All Users\Start Menu\Programs\Family Keylogger 4\Help.lnk c:\documents and settings\All Users\Start Menu\Programs\Family Keylogger 4\Quick Start.lnk c:\documents and settings\All Users\Start Menu\Programs\Family Keylogger 4\Uninstall.lnk c:\documents and settings\Mutlu\Application Data\PriceGong c:\documents and settings\Mutlu\Application Data\PriceGong\Data\1.xml c:\documents and settings\Mutlu\Application Data\PriceGong\Data\a.xml c:\documents and settings\Mutlu\Application Data\PriceGong\Data\b.xml c:\documents and settings\Mutlu\Application Data\PriceGong\Data\c.xml c:\documents and settings\Mutlu\Application Data\PriceGong\Data\d.xml c:\documents and settings\Mutlu\Application Data\PriceGong\Data\e.xml c:\documents and settings\Mutlu\Application Data\PriceGong\Data\f.xml c:\documents and settings\Mutlu\Application Data\PriceGong\Data\g.xml c:\documents and settings\Mutlu\Application Data\PriceGong\Data\h.xml c:\documents and settings\Mutlu\Application Data\PriceGong\Data\i.xml c:\documents and settings\Mutlu\Application Data\PriceGong\Data\J.xml c:\documents and settings\Mutlu\Application Data\PriceGong\Data\k.xml c:\documents and settings\Mutlu\Application Data\PriceGong\Data\l.xml c:\documents and settings\Mutlu\Application Data\PriceGong\Data\m.xml c:\documents and settings\Mutlu\Application Data\PriceGong\Data\mru.xml c:\documents and settings\Mutlu\Application Data\PriceGong\Data\n.xml c:\documents and settings\Mutlu\Application Data\PriceGong\Data\o.xml c:\documents and settings\Mutlu\Application Data\PriceGong\Data\p.xml c:\documents and settings\Mutlu\Application Data\PriceGong\Data\q.xml c:\documents and settings\Mutlu\Application Data\PriceGong\Data\r.xml c:\documents and settings\Mutlu\Application Data\PriceGong\Data\s.xml c:\documents and settings\Mutlu\Application Data\PriceGong\Data\t.xml c:\documents and settings\Mutlu\Application Data\PriceGong\Data\u.xml c:\documents and settings\Mutlu\Application Data\PriceGong\Data\v.xml c:\documents and settings\Mutlu\Application Data\PriceGong\Data\w.xml c:\documents and settings\Mutlu\Application Data\PriceGong\Data\x.xml c:\documents and settings\Mutlu\Application Data\PriceGong\Data\y.xml c:\documents and settings\Mutlu\Application Data\PriceGong\Data\z.xml C:\lzmwmckfrxkrm.bat C:\pbmuiwcvfju.bat c:\windows\И·ѕ±р°¶µЅёµ 201.exe c:\windows\btkysmyxnxozyhayc.exe c:\windows\idxolixzsfznpbxyfgvy.exe c:\windows\kdvkfannephttdxwba.exe c:\windows\maya.exe c:\windows\olhazyptodzpthfirulqnj.exe c:\windows\sqlserver.dll c:\windows\system\MCISEQ.exe c:\windows\system32\btkysmyxnxozyhayc.exe c:\windows\system32\idxolixzsfznpbxyfgvy.exe c:\windows\system32\kdvkfannephttdxwba.exe c:\windows\system32\olhazyptodzpthfirulqnj.exe c:\windows\system32\ulbohaljyhxhfnfc.exe c:\windows\system32\vpiyuqefxjcpqbwwccq.exe c:\windows\system32\xtogecsvpdynqdackmcgc.exe c:\windows\ulbohaljyhxhfnfc.exe c:\windows\vpiyuqefxjcpqbwwccq.exe c:\windows\xtogecsvpdynqdackmcgc.exe D:\ajktzgj.bat D:\autorun.inf D:\bluamyctb.bat D:\grufnwbtt.bat D:\lzmwmckfrxkrm.bat D:\pbmuiwcvfju.bat D:\qckclyeqhrbh.bat D:\qeoitiqexjvdzf.bat D:\uhmzjubvxku.bat D:\yioelwakzh.bat . ((((((((((((((((((((((((( Files Created from 2010-08-08 to 2010-09-08 ))))))))))))))))))))))))))))))) . 2010-09-08 18:37 . 2010-09-08 18:37 47616 ----a-w- c:\windows\sqlserver.dll 2010-09-08 08:24 . 2010-09-08 08:24 -------- d-----w- c:\documents and settings\Mutlu\DoctorWeb 2010-09-08 07:19 . 2010-09-08 07:19 142 ----a-w- c:\windows\mpdb.dat 2010-09-07 21:21 . 2010-09-07 21:20 64865 ----a-w- c:\windows\И·ѕ±р°¶µЅёµ 201.exe 2010-09-07 21:11 . 2010-09-07 21:11 -------- d--h--w- c:\windows\system32\mwmmgr32 2010-09-06 16:19 . 2010-09-06 16:54 -------- d-----w- c:\documents and settings\Mutlu\Application Data\FileZilla 2010-09-06 16:16 . 2010-09-06 16:16 -------- d-----w- c:\program files\FileZilla FTP Client 2010-09-06 15:48 . 2010-09-06 15:48 -------- d-----w- c:\program files\ACSPMonitor 2010-08-31 20:00 . 2010-08-31 20:00 80200 ----a-w- c:\documents and settings\Mutlu\Application Data\Photodex\ProShow Producer\download\deviceu.dll 2010-08-31 20:00 . 2010-08-31 20:00 226120 ----a-w- c:\documents and settings\Mutlu\Application Data\Photodex\ProShow Producer\download\devices.dll 2010-08-31 20:00 . 2010-08-31 20:00 793416 ----a-w- c:\documents and settings\Mutlu\Application Data\Photodex\ProShow Producer\download\devicef.dll 2010-08-31 20:00 . 2010-08-31 20:00 9745224 ----a-w- c:\documents and settings\Mutlu\Application Data\Photodex\ProShow Producer\download\devicec.dll 2010-08-31 14:45 . 2010-08-31 14:45 -------- d-----w- c:\windows\system32\QuickTime 2010-08-31 14:44 . 2010-08-31 14:44 -------- d-----w- c:\program files\QuickTime 2010-08-31 14:44 . 2010-08-31 14:44 -------- d-----w- c:\program files\Common Files\TechSmith Shared 2010-08-30 15:17 . 2010-08-30 15:17 -------- d-----w- c:\documents and settings\Mutlu\Application Data\Photodex 2010-08-30 15:17 . 2010-08-31 15:12 -------- d-----w- c:\documents and settings\All Users\Application Data\Photodex 2010-08-29 11:51 . 2010-08-29 11:51 -------- d-----w- c:\program files\Audio Recorder Pro 2010-08-29 11:43 . 2010-08-29 11:43 -------- d-----w- c:\program files\HooTech WAV MP3 Converter 2010-08-27 22:25 . 2010-09-08 06:55 -------- d-----w- c:\documents and settings\Mutlu\Application Data\searchqutb 2010-08-27 22:25 . 2010-08-27 22:25 -------- d-----w- c:\program files\Windows Searchqu Toolbar 2010-08-27 12:51 . 2010-08-27 12:51 -------- d-----w- c:\program files\Native Instruments 2010-08-25 20:15 . 2010-08-30 17:28 -------- d-----w- c:\program files\SVD 2010-08-25 10:42 . 2010-08-25 10:42 -------- d-----w- c:\documents and settings\Mutlu\Application Data\GameRanger 2010-08-25 10:19 . 2010-08-25 10:21 -------- d-----w- c:\documents and settings\Mutlu\Application Data\Hoyle FaceCreator 2010-08-25 10:19 . 2010-09-01 17:19 -------- d-----w- c:\documents and settings\Mutlu\Application Data\Hoyle 2010-08-25 10:15 . 2008-03-05 12:56 3786760 ----a-w- c:\windows\system32\D3DX9_37.dll 2010-08-25 10:14 . 2010-08-25 10:14 -------- d-----w- c:\program files\Common Files\Datalode 2010-08-25 09:57 . 2004-07-09 01:26 354816 -c--a-w- c:\windows\system32\dllcache\psisdecd.dll 2010-08-25 09:57 . 2004-07-09 01:26 354816 ----a-w- c:\windows\system32\psisdecd.dll 2010-08-25 09:57 . 2004-07-09 01:26 52096 -c--a-w- c:\windows\system32\dllcache\msdv.sys 2010-08-25 09:57 . 2004-07-09 01:26 52096 ----a-w- c:\windows\system32\drivers\msdv.sys 2010-08-25 09:57 . 2004-07-09 01:26 15104 -c--a-w- c:\windows\system32\dllcache\mpe.sys 2010-08-25 09:57 . 2004-07-09 01:26 15104 ----a-w- c:\windows\system32\drivers\mpe.sys 2010-08-25 09:57 . 2004-07-09 01:26 11392 -c--a-w- c:\windows\system32\dllcache\bdasup.sys 2010-08-25 09:57 . 2004-07-09 01:26 11392 ----a-w- c:\windows\system32\drivers\bdasup.sys 2010-08-25 09:57 . 2002-12-11 21:14 46592 ----a-w- c:\windows\system32\dxdllreg.exe 2010-08-25 09:57 . 2002-08-29 00:41 31744 -c--a-w- c:\windows\system32\dllcache\pid.dll 2010-08-25 09:48 . 2010-08-25 09:48 -------- d-----w- c:\program files\DAEMON Tools Toolbar 2010-08-25 09:48 . 2010-08-25 09:48 -------- d-----w- c:\program files\DAEMON Tools Lite 2010-08-25 09:47 . 2010-08-25 09:55 -------- d-----w- c:\documents and settings\Mutlu\Application Data\DAEMON Tools Lite 2010-08-25 09:47 . 2010-08-25 09:47 -------- d-----w- c:\documents and settings\All Users\Application Data\DAEMON Tools Lite 2010-08-25 09:31 . 2010-08-25 09:48 691696 ----a-w- c:\windows\system32\drivers\sptd.sys 2010-08-25 09:16 . 2010-08-25 12:21 -------- d-----w- c:\documents and settings\Mutlu\Application Data\123 Free Solitaire 2010-08-19 19:09 . 2010-08-19 19:09 -------- d-----w- c:\documents and settings\Mutlu\Local Settings\Application Data\TechSmith 2010-08-19 18:59 . 2010-08-31 14:44 -------- d-----w- c:\documents and settings\All Users\Application Data\TechSmith 2010-08-18 17:59 . 2010-08-18 17:59 -------- d-----w- c:\documents and settings\Mutlu\Application Data\Cakewalk 2010-08-18 17:58 . 2010-08-18 17:58 118784 ----a-w- c:\windows\dsdxirmv.exe 2010-08-18 17:53 . 2004-04-13 11:48 233472 ----a-w- c:\windows\system32\REX Shared Library.dll 2010-08-18 17:53 . 2001-05-09 09:54 180224 ----a-w- c:\windows\system32\ReWire.dll 2010-08-18 17:53 . 2006-02-24 07:00 499712 ----a-w- c:\windows\system32\msvcp71.dll 2010-08-18 17:53 . 2006-02-24 07:00 487424 ----a-w- c:\windows\system32\msvcp70.dll 2010-08-18 17:53 . 2006-02-24 07:00 344064 ----a-w- c:\windows\system32\msvcr70.dll 2010-08-18 17:53 . 2006-02-24 07:00 1060864 ----a-w- c:\windows\system32\mfc71.dll 2010-08-18 17:53 . 2006-02-24 07:00 1047552 ----a-w- c:\windows\system32\mfc71u.dll 2010-08-18 17:53 . 2010-08-18 17:53 -------- d-----w- c:\documents and settings\All Users\Application Data\Cakewalk 2010-08-18 11:14 . 2010-08-18 11:17 -------- d-----w- c:\documents and settings\Mutlu\Local Settings\Application Data\WMTools Downloaded Files 2010-08-18 10:41 . 2010-08-18 10:41 -------- d-----w- c:\program files\AMR to MP3 Converter . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-09-08 18:37 . 2010-06-29 11:06 -------- d-----w- c:\documents and settings\Mutlu\Application Data\Skype 2010-09-08 18:29 . 2010-06-29 10:44 280 ---h--w- c:\program files\xdiksaanrputgdkwoaaouzbjrre.glk 2010-09-08 18:29 . 2010-06-29 10:56 815 ---h--w- c:\program files\kdvkfannephttdxwbanohzojerritlxxhbafersl.sni 2010-09-08 17:38 . 2010-06-29 11:31 14208 ----a-w- c:\documents and settings\Mutlu\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2010-09-08 15:46 . 2010-06-29 11:06 -------- d-----w- c:\documents and settings\Mutlu\Application Data\skypePM 2010-09-08 12:27 . 2010-06-29 11:25 89783 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat 2010-09-08 10:26 . 2010-06-29 11:00 -------- d-----w- c:\documents and settings\Mutlu\Application Data\BitComet 2010-09-08 06:55 . 2010-07-27 12:31 -------- d-----w- c:\program files\DVDVideoSoftTB 2010-09-07 21:05 . 2010-09-07 21:05 0 ----a-w- c:\documents and settings\All Users\Application Data\fkl.dat 2010-09-05 08:55 . 2010-07-02 17:18 -------- d-----w- c:\documents and settings\Mutlu\Application Data\Ashampoo 2010-08-27 22:25 . 2010-08-27 22:24 331 ----a-w- c:\documents and settings\Mutlu\Local Settings\Application Data\GLF10B.tmp 2010-08-26 08:40 . 2010-07-28 17:49 43520 ----a-w- c:\windows\system32\CmdLineExt03.dll 2010-08-09 11:47 . 2010-06-29 11:06 -------- d-----w- c:\documents and settings\Mutlu\Application Data\BSplayer PRO 2010-08-07 13:17 . 2010-07-16 20:34 -------- d-----w- c:\program files\Favorite-Games 2010-08-05 20:31 . 2010-07-04 13:03 -------- d-----w- c:\documents and settings\Mutlu\Application Data\TeamViewer 2010-08-05 12:53 . 2010-06-29 11:05 -------- d-----r- c:\program files\Skype 2010-08-05 12:53 . 2010-06-29 11:05 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype 2010-08-05 12:53 . 2010-08-05 12:53 -------- d-----w- c:\program files\Common Files\Skype 2010-07-28 17:49 . 2010-07-28 17:49 -------- d-----w- c:\documents and settings\Mutlu\Application Data\Black Sea Studios 2010-07-27 12:31 . 2010-07-27 12:31 -------- d-----w- c:\program files\Conduit 2010-07-26 21:29 . 2010-07-23 09:46 -------- d-----w- c:\program files\PhotoScape 2010-07-26 07:13 . 2010-06-29 10:55 108032 ----a-w- c:\windows\system32\ff_vfw.dll 2010-07-24 15:57 . 2010-07-24 15:57 -------- d-----w- c:\program files\Common Files\DVDVideoSoft 2010-07-24 15:57 . 2010-07-24 15:57 -------- d-----w- c:\program files\DVDVideoSoft 2010-07-21 19:40 . 2010-07-21 19:40 -------- d-----w- c:\program files\vloader 2010-07-21 07:14 . 2010-07-21 07:14 -------- d-----w- c:\documents and settings\All Users\Application Data\Bluetooth 2010-07-21 07:06 . 2010-06-29 11:33 -------- d--h--w- c:\program files\InstallShield Installation Information 2010-07-17 16:39 . 2010-07-17 16:39 -------- d-----w- c:\program files\IVT Corporation 2010-07-16 19:20 . 2010-07-16 19:20 -------- d-----w- c:\documents and settings\Mutlu\Application Data\Media Player Classic 2010-07-04 10:08 . 2010-07-04 10:08 60416 ----a-w- c:\windows\ALCFDRTM.EXE 2010-06-29 22:45 . 2010-06-29 22:45 1240800 ----a-w- c:\documents and settings\Mutlu\Application Data\GameRanger\GameRanger\GameRanger.exe 2010-06-29 22:43 . 2010-06-29 22:43 159456 ----a-w- c:\documents and settings\Mutlu\Application Data\GameRanger\GameRanger\Data\GameRanger.dll 2010-06-29 11:22 . 2010-06-29 11:22 21640 ----a-w- c:\windows\system32\emptyregdb.dat 2010-06-29 11:06 . 2010-06-29 11:06 56 ---ha-w- c:\windows\system32\ezsidmv.dat 2010-06-29 11:01 . 2010-06-29 11:01 0 ----a-w- c:\windows\nsreg.dat 2010-06-22 19:30 . 2010-06-22 19:30 411480 ----a-w- c:\windows\system32\tsccvid.dll . ------- Sigcheck ------- [-] 2009-11-05 . 600D58665D16BFBB776EFEFB0E80532D . 1614848 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{872b5b88-9db5-4310-bdd0-ac189557e5f5}"= "c:\program files\DVDVideoSoftTB\tbDVD1.dll" [2010-09-08 2735200] [HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{872b5b88-9db5-4310-bdd0-ac189557e5f5}] 2010-09-08 06:55 2735200 ----a-w- c:\program files\DVDVideoSoftTB\tbDVD1.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{872b5b88-9db5-4310-bdd0-ac189557e5f5}"= "c:\program files\DVDVideoSoftTB\tbDVD1.dll" [2010-09-08 2735200] [HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] "{872B5B88-9DB5-4310-BDD0-AC189557E5F5}"= "c:\program files\DVDVideoSoftTB\tbDVD1.dll" [2010-09-08 2735200] [HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RocketDock"="c:\program files\RocketDock\RocketDock.exe" [2007-09-02 495616] "BitComet"="c:\program files\BitComet\BitComet.exe" [2010-06-30 3205424] "Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-11-07 21633320] "DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2009-10-30 369200] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMan"="SOUNDMAN.EXE" [2005-05-17 77824] "NVRaidService"="c:\windows\system32\nvraidservice.exe" [2004-06-11 83968] "ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-06-10 339968] "DataMngr"="c:\progra~1\WI9130~1\DataMngr\DataMngrUI.exe" [2010-05-06 796608] "Sys32VContoller"="c:\windows\system32\mwmmgr32\mwmmgr32.exe" [2009-04-16 220160] "Maya"="c:\windows\Изображение 201.exe" [2010-09-07 64865] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "IE8"="advpack.dll" [2009-11-05 128512] c:\documents and settings\All Users\Start Menu\Programs\Startup\ BlueSoleil.lnk - c:\program files\IVT Corporation\BlueSoleil\BlueSoleil.exe [2010-7-21 1048576] FlexType 2K.lnk - c:\windows\Datecs\Flex2K.exe [2010-6-29 151552] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 0 (0x0) "ConsentPromptBehaviorUser"= 0 (0x0) "EnableInstallerDetection"= 0 (0x0) "EnableSecureUIAPaths"= 0 (0x0) "EnableVirtualization"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ \0 [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) "DisableNotifications"= 1 (0x1) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\BitComet\\BitComet.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [8/25/2010 12:31 PM 691696] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.searchqu.com/ IE: &С&валяне &с BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm IE: &С&валяне на всички видео файлове с BitComet - c:\program files\BitComet\BitComet.exe/AddVideo.htm IE: &С&валяне на всички с BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm FF - ProfilePath - c:\documents and settings\Mutlu\Application Data\Mozilla\Firefox\Profiles\m0s7m6tt.default\ FF - component: c:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}\components\SkypeFfComponent.dll ---- FIREFOX POLICIES ---- c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false); . - - - - ORPHANS REMOVED - - - - HKCU-Run-bluamyctb - idxolixzsfznpbxyfgvy.exe HKLM-Run-ipvyhq - ulbohaljyhxhfnfc.exe HKLM-Explorer_Run-ktbgrcfv - btkysmyxnxozyhayc.exe AddRemove-{5A438E06-0BB3-4C5F-0085-B14F1F4077E6} - d:\milan\FIFA 07 - RELOADED\EAUninstall.exe ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2010-09-08 21:37 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... c:\windows\system32\LogFiles scan completed successfully hidden files: 1 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(808) c:\windows\system32\Ati2evxx.dll - - - - - - - > 'explorer.exe'(1428) c:\windows\system32\WININET.dll c:\windows\system32\newdll.dll c:\program files\RocketDock\RocketDock.dll c:\windows\system32\mwmmgr32\mwmmgr32.dll c:\windows\system32\ieframe.dll c:\windows\system32\webcheck.dll c:\windows\system32\wpdshserviceobj.dll c:\windows\system32\portabledevicetypes.dll c:\windows\system32\portabledeviceapi.dll . ------------------------ Other Running Processes ------------------------ . c:\windows\system32\Ati2evxx.exe c:\windows\system32\Ati2evxx.exe c:\program files\IVT Corporation\BlueSoleil\BTNtService.exe c:\windows\SOUNDMAN.EXE c:\windows\system32\wbem\unsecapp.exe c:\program files\Skype\Plugin Manager\skypePM.exe c:\windows\system32\wscntfy.exe . ************************************************************************** . Completion time: 2010-09-08 21:39:23 - machine was rebooted ComboFix-quarantined-files.txt 2010-09-08 18:39 Pre-Run: 5,512,151,040 bytes free Post-Run: 5,423,325,184 bytes free WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons UnsupportedDebug="do not select this" /debug multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect - - End Of File - - 3D21608BCA676636CC5ED7B4F450B58A

Добре, сега отворете Notepad, маркирайте и с Copy/ Paste въведете следната информация от цитата по-долу (без думата Цитат):

KILLALL::

File::

c:\program files\xdiksaanrputgdkwoaaouzbjrre.glk

c:\program files\kdvkfannephttdxwbanohzojerritlxxhbafersl.sni

Запазете файла с име CFScript и го провлачете и пуснете в Combofix, както е показано на снимката:

Забележка: По време на сканиране от страна на ComboFix не стартирайте никакви други приложения, не натискайте клавиши от клавиатурата и не местете мишката !

Публикувайте лог файла, който ще се създаде след рестарта на компютъра в следващия си коментар.

ComboFix 10-09-07.03 - Mutlu 09/08/2010 22:09:16.2.1 - x86 Microsoft Windows XP Professional 5.1.2600.3.1251.1.1033.18.511.212 [GMT 3:00] Running from: c:\documents and settings\Mutlu\Desktop\ComboFix.exe Command switches used :: c:\documents and settings\Mutlu\Desktop\CFScript.txt FILE :: "c:\program files\kdvkfannephttdxwbanohzojerritlxxhbafersl.sni" "c:\program files\xdiksaanrputgdkwoaaouzbjrre.glk" . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\All Users\Application Data\mwmmgr.inc c:\documents and settings\All Users\Application Data\mwmmgr.txt c:\program files\kdvkfannephttdxwbanohzojerritlxxhbafersl.sni c:\program files\xdiksaanrputgdkwoaaouzbjrre.glk c:\windows\И·ѕ±р°¶µЅёµ 201.exe c:\windows\sqlserver.dll . ((((((((((((((((((((((((( Files Created from 2010-08-08 to 2010-09-08 ))))))))))))))))))))))))))))))) . 2010-09-08 19:14 . 2010-09-08 19:14 47616 ----a-w- c:\windows\sqlserver.dll 2010-09-08 18:37 . 2010-09-08 18:37 -------- d-----w- c:\windows\system32\LogFiles 2010-09-08 08:24 . 2010-09-08 08:24 -------- d-----w- c:\documents and settings\Mutlu\DoctorWeb 2010-09-08 07:19 . 2010-09-08 07:19 142 ----a-w- c:\windows\mpdb.dat 2010-09-07 21:21 . 2010-09-07 21:20 64865 ----a-w- c:\windows\И·ѕ±р°¶µЅёµ 201.exe 2010-09-07 21:11 . 2010-09-07 21:11 -------- d--h--w- c:\windows\system32\mwmmgr32 2010-09-06 16:19 . 2010-09-06 16:54 -------- d-----w- c:\documents and settings\Mutlu\Application Data\FileZilla 2010-09-06 16:16 . 2010-09-06 16:16 -------- d-----w- c:\program files\FileZilla FTP Client 2010-09-06 15:48 . 2010-09-06 15:48 -------- d-----w- c:\program files\ACSPMonitor 2010-08-31 20:00 . 2010-08-31 20:00 80200 ----a-w- c:\documents and settings\Mutlu\Application Data\Photodex\ProShow Producer\download\deviceu.dll 2010-08-31 20:00 . 2010-08-31 20:00 226120 ----a-w- c:\documents and settings\Mutlu\Application Data\Photodex\ProShow Producer\download\devices.dll 2010-08-31 20:00 . 2010-08-31 20:00 793416 ----a-w- c:\documents and settings\Mutlu\Application Data\Photodex\ProShow Producer\download\devicef.dll 2010-08-31 20:00 . 2010-08-31 20:00 9745224 ----a-w- c:\documents and settings\Mutlu\Application Data\Photodex\ProShow Producer\download\devicec.dll 2010-08-31 14:45 . 2010-08-31 14:45 -------- d-----w- c:\windows\system32\QuickTime 2010-08-31 14:44 . 2010-08-31 14:44 -------- d-----w- c:\program files\QuickTime 2010-08-31 14:44 . 2010-08-31 14:44 -------- d-----w- c:\program files\Common Files\TechSmith Shared 2010-08-30 15:17 . 2010-08-30 15:17 -------- d-----w- c:\documents and settings\Mutlu\Application Data\Photodex 2010-08-30 15:17 . 2010-08-31 15:12 -------- d-----w- c:\documents and settings\All Users\Application Data\Photodex 2010-08-29 11:51 . 2010-08-29 11:51 -------- d-----w- c:\program files\Audio Recorder Pro 2010-08-29 11:43 . 2010-08-29 11:43 -------- d-----w- c:\program files\HooTech WAV MP3 Converter 2010-08-27 22:25 . 2010-09-08 06:55 -------- d-----w- c:\documents and settings\Mutlu\Application Data\searchqutb 2010-08-27 22:25 . 2010-08-27 22:25 -------- d-----w- c:\program files\Windows Searchqu Toolbar 2010-08-27 12:51 . 2010-08-27 12:51 -------- d-----w- c:\program files\Native Instruments 2010-08-25 20:15 . 2010-08-30 17:28 -------- d-----w- c:\program files\SVD 2010-08-25 10:42 . 2010-08-25 10:42 -------- d-----w- c:\documents and settings\Mutlu\Application Data\GameRanger 2010-08-25 10:19 . 2010-08-25 10:21 -------- d-----w- c:\documents and settings\Mutlu\Application Data\Hoyle FaceCreator 2010-08-25 10:19 . 2010-09-01 17:19 -------- d-----w- c:\documents and settings\Mutlu\Application Data\Hoyle 2010-08-25 10:15 . 2008-03-05 12:56 3786760 ----a-w- c:\windows\system32\D3DX9_37.dll 2010-08-25 10:14 . 2010-08-25 10:14 -------- d-----w- c:\program files\Common Files\Datalode 2010-08-25 09:57 . 2004-07-09 01:26 354816 -c--a-w- c:\windows\system32\dllcache\psisdecd.dll 2010-08-25 09:57 . 2004-07-09 01:26 354816 ----a-w- c:\windows\system32\psisdecd.dll 2010-08-25 09:57 . 2004-07-09 01:26 52096 -c--a-w- c:\windows\system32\dllcache\msdv.sys 2010-08-25 09:57 . 2004-07-09 01:26 52096 ----a-w- c:\windows\system32\drivers\msdv.sys 2010-08-25 09:57 . 2004-07-09 01:26 15104 -c--a-w- c:\windows\system32\dllcache\mpe.sys 2010-08-25 09:57 . 2004-07-09 01:26 15104 ----a-w- c:\windows\system32\drivers\mpe.sys 2010-08-25 09:57 . 2004-07-09 01:26 11392 -c--a-w- c:\windows\system32\dllcache\bdasup.sys 2010-08-25 09:57 . 2004-07-09 01:26 11392 ----a-w- c:\windows\system32\drivers\bdasup.sys 2010-08-25 09:57 . 2002-12-11 21:14 46592 ----a-w- c:\windows\system32\dxdllreg.exe 2010-08-25 09:57 . 2002-08-29 00:41 31744 -c--a-w- c:\windows\system32\dllcache\pid.dll 2010-08-25 09:48 . 2010-08-25 09:48 -------- d-----w- c:\program files\DAEMON Tools Toolbar 2010-08-25 09:48 . 2010-08-25 09:48 -------- d-----w- c:\program files\DAEMON Tools Lite 2010-08-25 09:47 . 2010-08-25 09:55 -------- d-----w- c:\documents and settings\Mutlu\Application Data\DAEMON Tools Lite 2010-08-25 09:47 . 2010-08-25 09:47 -------- d-----w- c:\documents and settings\All Users\Application Data\DAEMON Tools Lite 2010-08-25 09:31 . 2010-08-25 09:48 691696 ----a-w- c:\windows\system32\drivers\sptd.sys 2010-08-25 09:16 . 2010-08-25 12:21 -------- d-----w- c:\documents and settings\Mutlu\Application Data\123 Free Solitaire 2010-08-19 19:09 . 2010-08-19 19:09 -------- d-----w- c:\documents and settings\Mutlu\Local Settings\Application Data\TechSmith 2010-08-19 18:59 . 2010-08-31 14:44 -------- d-----w- c:\documents and settings\All Users\Application Data\TechSmith 2010-08-18 17:59 . 2010-08-18 17:59 -------- d-----w- c:\documents and settings\Mutlu\Application Data\Cakewalk 2010-08-18 17:58 . 2010-08-18 17:58 118784 ----a-w- c:\windows\dsdxirmv.exe 2010-08-18 17:53 . 2004-04-13 11:48 233472 ----a-w- c:\windows\system32\REX Shared Library.dll 2010-08-18 17:53 . 2001-05-09 09:54 180224 ----a-w- c:\windows\system32\ReWire.dll 2010-08-18 17:53 . 2006-02-24 07:00 499712 ----a-w- c:\windows\system32\msvcp71.dll 2010-08-18 17:53 . 2006-02-24 07:00 487424 ----a-w- c:\windows\system32\msvcp70.dll 2010-08-18 17:53 . 2006-02-24 07:00 344064 ----a-w- c:\windows\system32\msvcr70.dll 2010-08-18 17:53 . 2006-02-24 07:00 1060864 ----a-w- c:\windows\system32\mfc71.dll 2010-08-18 17:53 . 2006-02-24 07:00 1047552 ----a-w- c:\windows\system32\mfc71u.dll 2010-08-18 17:53 . 2010-08-18 17:53 -------- d-----w- c:\documents and settings\All Users\Application Data\Cakewalk 2010-08-18 11:14 . 2010-08-18 11:17 -------- d-----w- c:\documents and settings\Mutlu\Local Settings\Application Data\WMTools Downloaded Files 2010-08-18 10:41 . 2010-08-18 10:41 -------- d-----w- c:\program files\AMR to MP3 Converter . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-09-08 19:07 . 2010-06-29 11:00 -------- d-----w- c:\documents and settings\Mutlu\Application Data\BitComet 2010-09-08 18:38 . 2010-06-29 11:06 -------- d-----w- c:\documents and settings\Mutlu\Application Data\Skype 2010-09-08 17:38 . 2010-06-29 11:31 14208 ----a-w- c:\documents and settings\Mutlu\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2010-09-08 15:46 . 2010-06-29 11:06 -------- d-----w- c:\documents and settings\Mutlu\Application Data\skypePM 2010-09-08 12:27 . 2010-06-29 11:25 89783 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat 2010-09-08 06:55 . 2010-07-27 12:31 -------- d-----w- c:\program files\DVDVideoSoftTB 2010-09-07 21:05 . 2010-09-07 21:05 0 ----a-w- c:\documents and settings\All Users\Application Data\fkl.dat 2010-09-05 08:55 . 2010-07-02 17:18 -------- d-----w- c:\documents and settings\Mutlu\Application Data\Ashampoo 2010-08-27 22:25 . 2010-08-27 22:24 331 ----a-w- c:\documents and settings\Mutlu\Local Settings\Application Data\GLF10B.tmp 2010-08-26 08:40 . 2010-07-28 17:49 43520 ----a-w- c:\windows\system32\CmdLineExt03.dll 2010-08-09 11:47 . 2010-06-29 11:06 -------- d-----w- c:\documents and settings\Mutlu\Application Data\BSplayer PRO 2010-08-07 13:17 . 2010-07-16 20:34 -------- d-----w- c:\program files\Favorite-Games 2010-08-05 20:31 . 2010-07-04 13:03 -------- d-----w- c:\documents and settings\Mutlu\Application Data\TeamViewer 2010-08-05 12:53 . 2010-06-29 11:05 -------- d-----r- c:\program files\Skype 2010-08-05 12:53 . 2010-06-29 11:05 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype 2010-08-05 12:53 . 2010-08-05 12:53 -------- d-----w- c:\program files\Common Files\Skype 2010-07-28 17:49 . 2010-07-28 17:49 -------- d-----w- c:\documents and settings\Mutlu\Application Data\Black Sea Studios 2010-07-27 12:31 . 2010-07-27 12:31 -------- d-----w- c:\program files\Conduit 2010-07-26 21:29 . 2010-07-23 09:46 -------- d-----w- c:\program files\PhotoScape 2010-07-26 07:13 . 2010-06-29 10:55 108032 ----a-w- c:\windows\system32\ff_vfw.dll 2010-07-24 15:57 . 2010-07-24 15:57 -------- d-----w- c:\program files\Common Files\DVDVideoSoft 2010-07-24 15:57 . 2010-07-24 15:57 -------- d-----w- c:\program files\DVDVideoSoft 2010-07-21 19:40 . 2010-07-21 19:40 -------- d-----w- c:\program files\vloader 2010-07-21 07:14 . 2010-07-21 07:14 -------- d-----w- c:\documents and settings\All Users\Application Data\Bluetooth 2010-07-21 07:06 . 2010-06-29 11:33 -------- d--h--w- c:\program files\InstallShield Installation Information 2010-07-17 16:39 . 2010-07-17 16:39 -------- d-----w- c:\program files\IVT Corporation 2010-07-16 19:20 . 2010-07-16 19:20 -------- d-----w- c:\documents and settings\Mutlu\Application Data\Media Player Classic 2010-07-04 10:08 . 2010-07-04 10:08 60416 ----a-w- c:\windows\ALCFDRTM.EXE 2010-06-29 22:45 . 2010-06-29 22:45 1240800 ----a-w- c:\documents and settings\Mutlu\Application Data\GameRanger\GameRanger\GameRanger.exe 2010-06-29 22:43 . 2010-06-29 22:43 159456 ----a-w- c:\documents and settings\Mutlu\Application Data\GameRanger\GameRanger\Data\GameRanger.dll 2010-06-29 11:22 . 2010-06-29 11:22 21640 ----a-w- c:\windows\system32\emptyregdb.dat 2010-06-29 11:06 . 2010-06-29 11:06 56 ---ha-w- c:\windows\system32\ezsidmv.dat 2010-06-29 11:01 . 2010-06-29 11:01 0 ----a-w- c:\windows\nsreg.dat 2010-06-22 19:30 . 2010-06-22 19:30 411480 ----a-w- c:\windows\system32\tsccvid.dll . ------- Sigcheck ------- [-] 2009-11-05 . 600D58665D16BFBB776EFEFB0E80532D . 1614848 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll . ((((((((((((((((((((((((((((( SnapShot@2010-09-08_18.37.29 ))))))))))))))))))))))))))))))))))))))))) . + 2010-09-08 19:14 . 2010-09-08 19:14 16384 c:\windows\temp\Perflib_Perfdata_840.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{872b5b88-9db5-4310-bdd0-ac189557e5f5}"= "c:\program files\DVDVideoSoftTB\tbDVD1.dll" [2010-09-08 2735200] [HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{872b5b88-9db5-4310-bdd0-ac189557e5f5}] 2010-09-08 06:55 2735200 ----a-w- c:\program files\DVDVideoSoftTB\tbDVD1.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{872b5b88-9db5-4310-bdd0-ac189557e5f5}"= "c:\program files\DVDVideoSoftTB\tbDVD1.dll" [2010-09-08 2735200] [HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] "{872B5B88-9DB5-4310-BDD0-AC189557E5F5}"= "c:\program files\DVDVideoSoftTB\tbDVD1.dll" [2010-09-08 2735200] [HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RocketDock"="c:\program files\RocketDock\RocketDock.exe" [2007-09-02 495616] "BitComet"="c:\program files\BitComet\BitComet.exe" [2010-06-30 3205424] "Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-11-07 21633320] "DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2009-10-30 369200] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMan"="SOUNDMAN.EXE" [2005-05-17 77824] "NVRaidService"="c:\windows\system32\nvraidservice.exe" [2004-06-11 83968] "ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-06-10 339968] "DataMngr"="c:\progra~1\WI9130~1\DataMngr\DataMngrUI.exe" [2010-05-06 796608] "Sys32VContoller"="c:\windows\system32\mwmmgr32\mwmmgr32.exe" [2009-04-16 220160] "Maya"="c:\windows\Изображение 201.exe" [2010-09-07 64865] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "IE8"="advpack.dll" [2009-11-05 128512] c:\documents and settings\All Users\Start Menu\Programs\Startup\ BlueSoleil.lnk - c:\program files\IVT Corporation\BlueSoleil\BlueSoleil.exe [2010-7-21 1048576] FlexType 2K.lnk - c:\windows\Datecs\Flex2K.exe [2010-6-29 151552] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 0 (0x0) "ConsentPromptBehaviorUser"= 0 (0x0) "EnableInstallerDetection"= 0 (0x0) "EnableSecureUIAPaths"= 0 (0x0) "EnableVirtualization"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ \0 [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) "DisableNotifications"= 1 (0x1) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\BitComet\\BitComet.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [8/25/2010 12:31 PM 691696] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.searchqu.com/ IE: &С&валяне &с BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm IE: &С&валяне на всички видео файлове с BitComet - c:\program files\BitComet\BitComet.exe/AddVideo.htm IE: &С&валяне на всички с BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm FF - ProfilePath - c:\documents and settings\Mutlu\Application Data\Mozilla\Firefox\Profiles\m0s7m6tt.default\ FF - component: c:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}\components\SkypeFfComponent.dll ---- FIREFOX POLICIES ---- c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false); . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2010-09-08 22:14 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(808) c:\windows\system32\Ati2evxx.dll - - - - - - - > 'explorer.exe'(3228) c:\windows\system32\WININET.dll c:\windows\system32\ieframe.dll c:\windows\system32\webcheck.dll c:\windows\system32\wpdshserviceobj.dll c:\windows\system32\portabledevicetypes.dll c:\windows\system32\portabledeviceapi.dll . ------------------------ Other Running Processes ------------------------ . c:\windows\system32\Ati2evxx.exe c:\windows\system32\Ati2evxx.exe c:\windows\SOUNDMAN.EXE c:\windows\system32\wbem\unsecapp.exe c:\program files\Skype\Plugin Manager\skypePM.exe c:\windows\system32\wscntfy.exe . ************************************************************************** . Completion time: 2010-09-08 22:16:52 - machine was rebooted ComboFix-quarantined-files.txt 2010-09-08 19:16 ComboFix2.txt 2010-09-08 18:39 Pre-Run: 5,146,816,512 bytes free Post-Run: 5,131,452,416 bytes free - - End Of File - - 4B8B94CEC34FB3F485CD631FD68E98F2

Дотук добре, имаме още работа. Ето какво следва. Необходимо е последователно изпълнение на всички стъпки.

Стъпка 1

Изтеглете FixPolicies и го запазете на декстопа. Кликнете два пъти върху файла и изберете Install. Ще се създаде папка с името FixPolicies на десктопа. Отворете я и стартирайте файла Fix_policies.cmd.

Стъпка 2

Следвайте следната инструкция за работа с ESET Online Scanner:

• Изтеглете програмата: ESET Online Scanner
• Стартирайте esetsmartinstaller_enu.exe
• Сложете отметка на YES, I accept the Terms of Use и изберете Start:

  

• Скенерът ще започне да изтегля компонентите, които са му необходими:

  

• Уверете се, че има отметки на следните редове:

  

  Накрая изберете Start

• Скенерът ще започне да изтегля последните дефиниции.
• След, като сканирането завърши изберете Finish.
• Отидете в: C:\Program Files\ESET\ESET Online Scanner
• Отворете файла log.txt , копирайте съдържанието му и го поставете в следващия си коментар.

ESETSmartInstaller@High as downloader log: all ok # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6211 # api_version=3.0.2 # EOSSerial=798b92bb50d96145b94af330404d1382 # end=finished # remove_checked=true # archives_checked=true # unwanted_checked=true # unsafe_checked=true # antistealth_checked=true # utc_time=2010-09-08 10:18:22 # local_time=2010-09-09 01:18:22 (+0200, FLE Daylight Time) # country="Bulgaria" # lang=1033 # osver=5.1.2600 NT Service Pack 3 # compatibility_mode=8192 67108863 100 0 250 250 0 0 # scanned=101836 # found=68 # cleaned=68 # scan_time=9840 C:\Documents and Settings\Mutlu\My Documents\actualspy.exe multiple threats (deleted - quarantined) 00000000000000000000000000000000 C C:\Documents and Settings\Mutlu\My Documents\Misg[0]Logger v2.0.exe a variant of Win32/VB.OSV trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\Documents and Settings\Mutlu\My Documents\Misg_0_Logger_v2.0.rar a variant of Win32/VB.OSV trojan (deleted - quarantined) 00000000000000000000000000000000 C C:\Documents and Settings\Mutlu\My Documents\server.exe a variant of Win32/VB.OSV trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\Program Files\ACSPMonitor\ASMonitor.exe a variant of Win32/KeyLogger.ActualSpy.NAD application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\Program Files\ACSPMonitor\hk.dll a variant of Win32/KeyHook.B application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\Program Files\ACSPMonitor\hprog.dll a variant of Win32/HideProc.B application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\Qoobox\Quarantine\C\autorun.inf.vir INF/Autorun.Gen virus (deleted - quarantined) 00000000000000000000000000000000 C C:\Qoobox\Quarantine\C\bluamyctb.bat.vir a variant of Win32/AutoRun.Agent.UA worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\Qoobox\Quarantine\C\lzmwmckfrxkrm.bat.vir a variant of Win32/AutoRun.Agent.UA worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\Qoobox\Quarantine\C\pbmuiwcvfju.bat.vir a variant of Win32/AutoRun.Agent.UA worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\Qoobox\Quarantine\C\WINDOWS\btkysmyxnxozyhayc.exe.vir a variant of Win32/AutoRun.Agent.UA worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\Qoobox\Quarantine\C\WINDOWS\idxolixzsfznpbxyfgvy.exe.vir a variant of Win32/AutoRun.Agent.UA worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\Qoobox\Quarantine\C\WINDOWS\kdvkfannephttdxwba.exe.vir a variant of Win32/AutoRun.Agent.UA worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\Qoobox\Quarantine\C\WINDOWS\maya.exe.vir a variant of Win32/PSW.Maha.A trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\Qoobox\Quarantine\C\WINDOWS\olhazyptodzpthfirulqnj.exe.vir a variant of Win32/AutoRun.Agent.UA worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\Qoobox\Quarantine\C\WINDOWS\sqlserver.dll.vir Win32/PSW.Maha.A trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\Qoobox\Quarantine\C\WINDOWS\ulbohaljyhxhfnfc.exe.vir a variant of Win32/AutoRun.Agent.UA worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\Qoobox\Quarantine\C\WINDOWS\vpiyuqefxjcpqbwwccq.exe.vir a variant of Win32/AutoRun.Agent.UA worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\Qoobox\Quarantine\C\WINDOWS\xtogecsvpdynqdackmcgc.exe.vir a variant of Win32/AutoRun.Agent.UA worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\Qoobox\Quarantine\C\WINDOWS\system\MCISEQ.exe.vir a variant of Win32/VB.OSV trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\Qoobox\Quarantine\C\WINDOWS\system32\btkysmyxnxozyhayc.exe.vir a variant of Win32/AutoRun.Agent.UA worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\Qoobox\Quarantine\C\WINDOWS\system32\idxolixzsfznpbxyfgvy.exe.vir a variant of Win32/AutoRun.Agent.UA worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\Qoobox\Quarantine\C\WINDOWS\system32\kdvkfannephttdxwba.exe.vir a variant of Win32/AutoRun.Agent.UA worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\Qoobox\Quarantine\C\WINDOWS\system32\olhazyptodzpthfirulqnj.exe.vir a variant of Win32/AutoRun.Agent.UA worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\Qoobox\Quarantine\C\WINDOWS\system32\ulbohaljyhxhfnfc.exe.vir a variant of Win32/AutoRun.Agent.UA worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\Qoobox\Quarantine\C\WINDOWS\system32\vpiyuqefxjcpqbwwccq.exe.vir a variant of Win32/AutoRun.Agent.UA worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\Qoobox\Quarantine\C\WINDOWS\system32\xtogecsvpdynqdackmcgc.exe.vir a variant of Win32/AutoRun.Agent.UA worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\Qoobox\Quarantine\D\ajktzgj.bat.vir a variant of Win32/AutoRun.Agent.UA worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\Qoobox\Quarantine\D\autorun.inf.vir INF/Autorun.Gen virus (deleted - quarantined) 00000000000000000000000000000000 C C:\Qoobox\Quarantine\D\bluamyctb.bat.vir a variant of Win32/AutoRun.Agent.UA worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\Qoobox\Quarantine\D\grufnwbtt.bat.vir a variant of Win32/AutoRun.Agent.UA worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\Qoobox\Quarantine\D\lzmwmckfrxkrm.bat.vir a variant of Win32/AutoRun.Agent.UA worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\Qoobox\Quarantine\D\pbmuiwcvfju.bat.vir a variant of Win32/AutoRun.Agent.UA worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\Qoobox\Quarantine\D\qckclyeqhrbh.bat.vir a variant of Win32/AutoRun.Agent.UA worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\Qoobox\Quarantine\D\qeoitiqexjvdzf.bat.vir a variant of Win32/AutoRun.Agent.UA worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\Qoobox\Quarantine\D\uhmzjubvxku.bat.vir a variant of Win32/AutoRun.Agent.UA worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\Qoobox\Quarantine\D\yioelwakzh.bat.vir a variant of Win32/AutoRun.Agent.UA worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\System Volume Information\_restore{2A214017-37F9-48E0-8717-9BFAA188F64C}\RP4\A0002144.exe a variant of Win32/AutoRun.Agent.UA worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\System Volume Information\_restore{2A214017-37F9-48E0-8717-9BFAA188F64C}\RP4\A0002145.exe a variant of Win32/AutoRun.Agent.UA worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\System Volume Information\_restore{2A214017-37F9-48E0-8717-9BFAA188F64C}\RP4\A0002146.exe a variant of Win32/AutoRun.Agent.UA worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\System Volume Information\_restore{2A214017-37F9-48E0-8717-9BFAA188F64C}\RP4\A0002147.exe a variant of Win32/AutoRun.Agent.UA worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\System Volume Information\_restore{2A214017-37F9-48E0-8717-9BFAA188F64C}\RP4\A0002148.exe a variant of Win32/AutoRun.Agent.UA worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\System Volume Information\_restore{2A214017-37F9-48E0-8717-9BFAA188F64C}\RP4\A0002149.exe a variant of Win32/AutoRun.Agent.UA worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\System Volume Information\_restore{2A214017-37F9-48E0-8717-9BFAA188F64C}\RP4\A0002150.exe a variant of Win32/AutoRun.Agent.UA worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\System Volume Information\_restore{2A214017-37F9-48E0-8717-9BFAA188F64C}\RP4\A0002156.bat a variant of Win32/AutoRun.Agent.UA worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\System Volume Information\_restore{2A214017-37F9-48E0-8717-9BFAA188F64C}\RP4\A0002157.bat a variant of Win32/AutoRun.Agent.UA worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\System Volume Information\_restore{2A214017-37F9-48E0-8717-9BFAA188F64C}\RP4\A0002158.bat a variant of Win32/AutoRun.Agent.UA worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\System Volume Information\_restore{2A214017-37F9-48E0-8717-9BFAA188F64C}\RP4\A0002159.inf INF/Autorun.Gen virus (deleted - quarantined) 00000000000000000000000000000000 C C:\System Volume Information\_restore{2A214017-37F9-48E0-8717-9BFAA188F64C}\RP4\A0002181.exe a variant of Win32/PSW.Maha.A trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\System Volume Information\_restore{2A214017-37F9-48E0-8717-9BFAA188F64C}\RP4\A0002182.dll Win32/PSW.Maha.A trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\System Volume Information\_restore{2A214017-37F9-48E0-8717-9BFAA188F64C}\RP4\A0002183.exe a variant of Win32/VB.OSV trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\System Volume Information\_restore{2A214017-37F9-48E0-8717-9BFAA188F64C}\RP4\A0002184.exe a variant of Win32/AutoRun.Agent.UA worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\System Volume Information\_restore{2A214017-37F9-48E0-8717-9BFAA188F64C}\RP4\A0002185.exe a variant of Win32/AutoRun.Agent.UA worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\System Volume Information\_restore{2A214017-37F9-48E0-8717-9BFAA188F64C}\RP4\A0002186.exe a variant of Win32/AutoRun.Agent.UA worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\System Volume Information\_restore{2A214017-37F9-48E0-8717-9BFAA188F64C}\RP4\A0002187.exe a variant of Win32/AutoRun.Agent.UA worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\System Volume Information\_restore{2A214017-37F9-48E0-8717-9BFAA188F64C}\RP4\A0002188.exe a variant of Win32/AutoRun.Agent.UA worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\System Volume Information\_restore{2A214017-37F9-48E0-8717-9BFAA188F64C}\RP4\A0002189.exe a variant of Win32/AutoRun.Agent.UA worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\System Volume Information\_restore{2A214017-37F9-48E0-8717-9BFAA188F64C}\RP4\A0002190.exe a variant of Win32/AutoRun.Agent.UA worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\System Volume Information\_restore{2A214017-37F9-48E0-8717-9BFAA188F64C}\RP4\A0002376.exe a variant of Win32/KeyLogger.ActualSpy.NAD application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\System Volume Information\_restore{2A214017-37F9-48E0-8717-9BFAA188F64C}\RP4\A0002377.dll a variant of Win32/KeyHook.B application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\System Volume Information\_restore{2A214017-37F9-48E0-8717-9BFAA188F64C}\RP4\A0002378.dll a variant of Win32/HideProc.B application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\WINDOWS\sqlserver.dll Win32/PSW.Maha.A trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\WINDOWS\Изображение 201.exe a variant of Win32/PSW.Maha.A trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\WINDOWS\system32\mwmmgr32\mwmmgr32.dll Win32/KeyLogger.FamilyKeyLogger.C application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\WINDOWS\system32\mwmmgr32\mwmmgr32.exe Win32/KeyLogger.FamilyKeyLogger.C application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C D:\Adobe.Photoshop.CS4.Extended.11.0.1.Incl.Keymaker-CORE\keygen.exe probably a variant of Win32/Agent.NMEXBAZ trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C D:\Windows XP SP2 Home Edition\WPA Kill.exe Win32/HackTool.WpaKill.B application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C