Здравейте, Как мога да изтрия файла WmiPrvSE.exe. Пробвах под сейф мод но не се изтрива нито мога да го преименувам. ОС е Windows 7 имам и инсталиран Windows XP като пробвах и от него да го изтрия. В XP го няма този процес.

Редактирано 2 октомври 201015 г. от nologo (преглед на промените)

Темата е в грешния раздел, ще помоля някой колега да я премести!

Следвайте следната инструкция за работа с OTL:

• Изтеглете програмата от тук и я запазете на десктопа.

• Стартирайте файла с двукратен клик на мишката.

• Направете следните настройки които са очертани в червено:

• Под "Custom Scans/Fixes" с Copy/ Paste въведете следната информация от цитата по-долу:

netsvcs
drivers32 /all
%SYSTEMDRIVE%\*.*
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\*.scr
%systemroot%\*._sy
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.wt
%systemroot%\system32\*.ruy
%systemroot%\system32\*.jpg
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%APPDATA%\Update\*.*
%APPDATA%\Microsoft\*.*
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%PROGRAMFILES%\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\user32.dll /md5
%systemroot%\system32\ws2_32.dll /md5
%systemroot%\system32\ws2help.dll /md5
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs

• Натиснете маркираният в синьо бутон:

•

• Като приключи проверката, ще се създадат два файла - OTL.Txt и Extras.Txt. Прикачете двата файла в следващия си коментар (погледнете опцията "прикачени файлове", когато публикувате мнение).

-=Готово=-

Редактирано 29 септември 201015 г. от Wankata (преглед на промените)

Извинявам се за грешния раздел.

Докато огледам логовете направете следното:

Стъпка 1

Моля качете следните файлове:

C:\Windows\SysWOW64\drivers\nxsIO32.sys ()
C:\Windows\GVTDrv64.sys ()
C:\Program Files (x86)\RivaTuner v2.24\RivaTunerWrapper.exe ()
C:\Windows\SysWow64\cpuz153.exe

на virustotal и дайте линкове от резултатите.

Стъпка 2

Следвайте следната инструкция за работа със Security Check:

• Изтеглете Security Check (автор: screen317) от или от

и го запишете на десктопа.

• Кликнете два пъти върху SecurityCheck.exe и следвайте инструкциите.

• Когато програмата завърши работата си, ще се отвори един текстов документ: checkup.txt.

• Копирайте съдържанието с Копирай (Copy) на checkup.txt и с Постави (Paste) го поставете в следващия си коментар.

Results of screen317's Security Check version 0.99.5

Windows 7 (UAC is disabled!)

Internet Explorer 8

``````````````````````````````

Antivirus/Firewall Check:

Windows Firewall Disabled!

Panda Internet Security 2010

WMI entry may not exist for antivirus; attempting automatic update.

```````````````````````````````

Anti-malware/Other Utilities Check:

CCleaner

Java 6 Update 17

Out of date Java installed!

Adobe Flash Player 10.1.85.3

Adobe Reader 9 Lite

````````````````````````````````

Process Check:

objlist.exe by Laurent

panda security panda internet security 2010 firewall PSHOST.EXE

````````````````````````````````

DNS Vulnerability Check:

GREAT! (Not vulnerable to DNS cache poisoning)

``````````End of Log````````````

Добре, сега очаквам резултатите от сканирането от Стъпка 1.

https://www.virustotal.com/file-scan/reanalysis.html?id=5e0fd9da784c5eea6fe61cb0debabd3f272b35e996cf2a30800f6292f89ddca6-1285781159 https://www.virustotal.com/file-scan/reanalysis.html?id=a58bce904591dd762410e99960fd956fb579c2ce78fa7bf1406075d29537ef82-1285781216 https://www.virustotal.com/file-scan/reanalysis.html?id=95f7422f04b0f275b49ecc9ee35de34d2b4db4f04c1770d3cfda6f8b238a9f86-1285781239 https://www.virustotal.com/file-scan/reanalysis.html?id=783d687501c217db49c42fd8e7d905282da66adb2aee04b56f6b4b4a2026678d-1285781267

Стъпка 1

Стартирайте пак OTL.exe и с Copy/ Paste под колонката Custom Scans/Fixes въведете скриптовия текст от цитата по-долу, като не забравяте да копирате скрипта 1 към 1, както и двете точки преди първия ред на скрипта!

:OTL
DRV:[b]64bit:[/b] - (TVICHW32) -- C:\Windows\SysNative\DRIVERS\TVICHW32.SYS File not found
DRV:[b]64bit:[/b] - (Prot6Flt) -- C:\Windows\SysNative\DRIVERS\Prot6Flt.sys File not found
DRV:[b]64bit:[/b] - (PortTalk) -- C:\Windows\SysNative\Drivers\PortTalk.sys File not found
DRV:[b]64bit:[/b] - (pccsmcfd) -- C:\Windows\SysNative\DRIVERS\pccsmcfdx64.sys File not found
DRV:[b]64bit:[/b] - (PavTPK.sys) -- C:\Windows\SysNative\PavTPK.sys File not found
DRV:[b]64bit:[/b] - (OSCI_DRVX64) -- C:\Windows\SysNative\Drivers\OSCI_DRVX64.sys File not found
DRV:[b]64bit:[/b] - (nxsIO32) -- C:\Windows\SysNative\DRIVERS\nxsIO32.sys File not found
DRV:[b]64bit:[/b] - (btwrchid) -- C:\Windows\SysNative\DRIVERS\btwrchid.sys File not found
DRV:[b]64bit:[/b] - (btwhid) -- C:\Windows\SysNative\DRIVERS\btwhid.sys File not found
DRV:[b]64bit:[/b] - (BTWDNDIS) -- C:\Windows\SysNative\DRIVERS\btwdndis.sys File not found
DRV:[b]64bit:[/b] - (btwaudio) -- C:\Windows\SysNative\drivers\btwaudio.sys File not found
DRV:[b]64bit:[/b] - (BTHidMgr) -- C:\Windows\SysNative\Drivers\BTHidMgr.sys File not found
DRV:[b]64bit:[/b] - (BTHidEnum) -- C:\Windows\SysNative\Drivers\vbtenum.sys File not found
DRV:[b]64bit:[/b] - (BTDriver) -- C:\Windows\SysNative\DRIVERS\btport.sys File not found
DRV:[b]64bit:[/b] - (btaudio) -- C:\Windows\SysNative\drivers\btaudio.sys File not found
DRV:[b]64bit:[/b] - (BT) -- C:\Windows\SysNative\DRIVERS\btnetdrv.sys File not found
DRV - (OSCI_DRVX64) -- C:\Windows\SysWOW64\drivers\OSCI_DRVX64.sys ()
O3 - HKU\S-1-5-21-1753405451-3285328739-950081735-1001\..\Toolbar\WebBrowser: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found.
O4 - HKLM..\Run: []  File not found
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\SysWow64\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\SysWow64\mctadmin.exe File not found
O8:[b]64bit:[/b] - Extra context menu item: Download all links with IDM - C:\Program Files (x86)\Internet Download Manager\IEGetAll.htm ()
O8:[b]64bit:[/b] - Extra context menu item: Download FLV video content with IDM - C:\Program Files (x86)\Internet Download Manager\IEGetVL.htm ()
O8:[b]64bit:[/b] - Extra context menu item: Download with IDM - C:\Program Files (x86)\Internet Download Manager\IEExt.htm ()
O8:[b]64bit:[/b] - Extra context menu item: Send by Bluetooth - C:\Program Files (x86)\IVT Corporation\BlueSoleil\TransSend\IE\tsinfo.htm ()
O8:[b]64bit:[/b] - Extra context menu item: Send via &Message... - C:\Program Files (x86)\IVT Corporation\BlueSoleil\TransSend\IE\tssms.htm ()
O8 - Extra context menu item: Download all links with IDM - C:\Program Files (x86)\Internet Download Manager\IEGetAll.htm ()
O8 - Extra context menu item: Download FLV video content with IDM - C:\Program Files (x86)\Internet Download Manager\IEGetVL.htm ()
O8 - Extra context menu item: Download with IDM - C:\Program Files (x86)\Internet Download Manager\IEExt.htm ()
O8 - Extra context menu item: Send by Bluetooth - C:\Program Files (x86)\IVT Corporation\BlueSoleil\TransSend\IE\tsinfo.htm ()
O8 - Extra context menu item: Send via &Message... - C:\Program Files (x86)\IVT Corporation\BlueSoleil\TransSend\IE\tssms.htm ()
O13 - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O18:[b]64bit:[/b] - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:[b]64bit:[/b] - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:[b]64bit:[/b] - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:[b]64bit:[/b] - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:[b]64bit:[/b] - Protocol\Handler\msdaipp - No CLSID value found
O18:[b]64bit:[/b] - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:[b]64bit:[/b] - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:[b]64bit:[/b] - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found
O18:[b]64bit:[/b] - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - Reg Error: Key error. File not found
O18:[b]64bit:[/b] - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - Reg Error: Key error. File not found
O18:[b]64bit:[/b] - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found
O18:[b]64bit:[/b] - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - Reg Error: Key error. File not found
O20:[b]64bit:[/b] - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21:[b]64bit:[/b] - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O33 - MountPoints2\{20348307-bfe7-11de-93f0-00e04c0bd17e}\Shell - "" = AutoRun
O33 - MountPoints2\{20348307-bfe7-11de-93f0-00e04c0bd17e}\Shell\AutoRun\command - "" = I:\startup.exe -- [2004.02.23 12:44:08 | 000,192,512 | R--- | M] (Terratools/Cyparade)
O33 - MountPoints2\{856d3807-bcb4-11de-9896-00e04c0bd17e}\Shell - "" = AutoRun
O33 - MountPoints2\{856d3807-bcb4-11de-9896-00e04c0bd17e}\Shell\AutoRun\command - "" = H:\autorun.exe -- [2003.04.12 03:22:40 | 000,045,056 | R--- | M] ()
[2010.09.01 12:18:47 | 000,000,000 | ---D | C] -- C:\Windows\45235788142C44BE8A4DDDE9A84492E5.TMP
[2010.09.13 20:06:52 | 000,008,704 | ---- | M] () -- C:\Windows\SysWow64\drivers\OSCI_DRVX64.sys
[2010.09.13 20:06:52 | 000,008,704 | ---- | C] () -- C:\Windows\SysWow64\drivers\OSCI_DRVX64.sys
[2009.10.31 20:33:47 | 000,004,940 | ---- | C] () -- C:\ProgramData\mtbjfghn.xbe
[2009.10.19 17:59:47 | 000,000,008 | RHS- | C] () -- C:\ProgramData\84A33730E7.sys
[2010.09.03 22:28:53 | 000,002,208 | ---- | M] () -- C:\Windows\SysWow64\drivers\nxsIO32.sys
@Alternate Data Stream - 166 bytes -> C:\ProgramData\TEMP:CB0AACC9
@Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:D1B5B4F1

:Services
84A33730E7
OSCI_DRVX64
nxsIO32

:Files
C:\Windows\*.tmp
C:\Windows\SysWow64\*.tmp
recycler /alldrives
ipconfig /flushdns /c

:Commands
[purity]
[resethosts]
[emptyflash]
[emptytemp]
[Reboot]

След като въведете скрипта от цитата по-горе натиснете бутона, маркиран в червено:

Ще се създаде лог файл. Копирайте и поставете този файл в следващия си коментар.

Стъпка 2

Изтеглете и инсталирайте SUPERAntiSpyware Free от .

От падащото меню изберете Bulgarian(BG)

След изтеглянето ще последва обновяване на дефинициите.

После натиснете бутон Проверка за обновления, който се намира в главното меню.

Настройките на програмата трябва да изглеждат ето така (Настройки за сканиране):

После затворете с Затвори, следва Сканиране на компютъра.

Изберете логическите устройства, без флопи, преносими устройства и CD/DVD.

След това направете пълно сканиране.

Ако има намерени зарази, махнете ги. Програмата може да поиска да рестартирате компютъра си, за да изтрие заразените обекти. В този случай потвърдете.

След като изчистите заразите отидете на Настройки. Вижте съдържанието на последния лог в Дневници:

Ще ви се отвори лог в Notepad. Копирайте съдържанието и го публикувайте в следващият си пост.

All processes killed

========== OTL ==========

Error: No service named TVICHW32 was found to stop!

Service\Driver key TVICHW32 not found.

File C:\Windows\SysNative\DRIVERS\TVICHW32.SYS File not found not found.

Error: No service named Prot6Flt was found to stop!

Service\Driver key Prot6Flt not found.

File C:\Windows\SysNative\DRIVERS\Prot6Flt.sys File not found not found.

Error: No service named PortTalk was found to stop!

Service\Driver key PortTalk not found.

File C:\Windows\SysNative\Drivers\PortTalk.sys File not found not found.

Error: No service named pccsmcfd was found to stop!

Service\Driver key pccsmcfd not found.

File C:\Windows\SysNative\DRIVERS\pccsmcfdx64.sys File not found not found.

Service PavTPK.sys stopped successfully!

Service\Driver key PavTPK.sys not found.

File C:\Windows\SysNative\PavTPK.sys File not found not found.

Error: No service named OSCI_DRVX64 was found to stop!

Service\Driver key OSCI_DRVX64 not found.

File C:\Windows\SysNative\Drivers\OSCI_DRVX64.sys File not found not found.

Error: No service named nxsIO32 was found to stop!

Service\Driver key nxsIO32 not found.

File C:\Windows\SysNative\DRIVERS\nxsIO32.sys File not found not found.

Error: No service named btwrchid was found to stop!

Service\Driver key btwrchid not found.

File C:\Windows\SysNative\DRIVERS\btwrchid.sys File not found not found.

Error: No service named btwhid was found to stop!

Service\Driver key btwhid not found.

File C:\Windows\SysNative\DRIVERS\btwhid.sys File not found not found.

Error: No service named BTWDNDIS was found to stop!

Service\Driver key BTWDNDIS not found.

File C:\Windows\SysNative\DRIVERS\btwdndis.sys File not found not found.

Error: No service named btwaudio was found to stop!

Service\Driver key btwaudio not found.

File C:\Windows\SysNative\drivers\btwaudio.sys File not found not found.

Error: No service named BTHidMgr was found to stop!

Service\Driver key BTHidMgr not found.

File C:\Windows\SysNative\Drivers\BTHidMgr.sys File not found not found.

Error: No service named BTHidEnum was found to stop!

Service\Driver key BTHidEnum not found.

File C:\Windows\SysNative\Drivers\vbtenum.sys File not found not found.

Error: No service named BTDriver was found to stop!

Service\Driver key BTDriver not found.

File C:\Windows\SysNative\DRIVERS\btport.sys File not found not found.

Error: No service named btaudio was found to stop!

Service\Driver key btaudio not found.

File C:\Windows\SysNative\drivers\btaudio.sys File not found not found.

Error: No service named BT was found to stop!

Service\Driver key BT not found.

File C:\Windows\SysNative\DRIVERS\btnetdrv.sys File not found not found.

Error: No service named OSCI_DRVX64 was found to stop!

Service\Driver key OSCI_DRVX64 not found.

File C:\Windows\SysWOW64\drivers\OSCI_DRVX64.sys not found.

Registry value HKEY_USERS\S-1-5-21-1753405451-3285328739-950081735-1001\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}\ not found.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ not found.

Registry value HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin not found.

Registry value HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin not found.

Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Download all links with IDM\ not found.

File C:\Program Files (x86)\Internet Download Manager\IEGetAll.htm not found.

Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Download FLV video content with IDM\ not found.

File C:\Program Files (x86)\Internet Download Manager\IEGetVL.htm not found.

Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\ not found.

File C:\Program Files (x86)\Internet Download Manager\IEExt.htm not found.

Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Send by Bluetooth\ not found.

File C:\Program Files (x86)\IVT Corporation\BlueSoleil\TransSend\IE\tsinfo.htm not found.

Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Send via &Message...\ not found.

File C:\Program Files (x86)\IVT Corporation\BlueSoleil\TransSend\IE\tssms.htm not found.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\Prefixes\\gopher|:gopher:// /E : value set successfully!

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\Prefixes\\gopher|:gopher:// /E : value set successfully!

Starting removal of ActiveX control {E2883E8F-472F-4FB0-9522-AC9BF37916A7}

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet:/pagefile deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{20348307-bfe7-11de-93f0-00e04c0bd17e}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20348307-bfe7-11de-93f0-00e04c0bd17e}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{20348307-bfe7-11de-93f0-00e04c0bd17e}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20348307-bfe7-11de-93f0-00e04c0bd17e}\ not found.

File move failed. I:\startup.exe scheduled to be moved on reboot.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{856d3807-bcb4-11de-9896-00e04c0bd17e}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{856d3807-bcb4-11de-9896-00e04c0bd17e}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{856d3807-bcb4-11de-9896-00e04c0bd17e}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{856d3807-bcb4-11de-9896-00e04c0bd17e}\ not found.

File move failed. H:\autorun.exe scheduled to be moved on reboot.

Folder C:\Windows\45235788142C44BE8A4DDDE9A84492E5.TMP\ not found.

File C:\Windows\SysWow64\drivers\OSCI_DRVX64.sys not found.

File C:\Windows\SysWow64\drivers\OSCI_DRVX64.sys not found.

File C:\ProgramData\mtbjfghn.xbe not found.

File C:\ProgramData\84A33730E7.sys not found.

File C:\Windows\SysWow64\drivers\nxsIO32.sys not found.

Unable to delete ADS C:\ProgramData\TEMP:CB0AACC9 .

Unable to delete ADS C:\ProgramData\TEMP:D1B5B4F1 .

========== SERVICES/DRIVERS ==========

Error: No service named 84A33730E7 was found to stop!

Service\Driver key 84A33730E7 not found.

Error: No service named OSCI_DRVX64 was found to stop!

Service\Driver key OSCI_DRVX64 not found.

Error: No service named nxsIO32 was found to stop!

Service\Driver key nxsIO32 not found.

========== FILES ==========

File\Folder C:\Windows\*.tmp not found.

File\Folder C:\Windows\SysWow64\*.tmp not found.

recycler not found in C:\

recycler not found in D:\

recycler not found in E:\

recycler not found in F:\

recycler not found in H:\

recycler not found in I:\

< ipconfig /flushdns /c >

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

C:\Users\Lance\Desktop\cmd.bat deleted successfully.

C:\Users\Lance\Desktop\cmd.txt deleted successfully.

========== COMMANDS ==========

C:\Windows\System32\drivers\etc\Hosts moved successfully.

HOSTS file reset successfully

[EMPTYFLASH]

User: All Users

User: Default

->Flash cache emptied: 41620 bytes

User: Default User

->Flash cache emptied: 0 bytes

User: Desktop

User: Lance

->Flash cache emptied: 47778 bytes

User: Public

Total Flash Files Cleaned = 0,00 mb

[EMPTYTEMP]

User: All Users

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

->Flash cache emptied: 0 bytes

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

->Flash cache emptied: 0 bytes

User: Desktop

User: Lance

->Temp folder emptied: 137223050 bytes

->Temporary Internet Files folder emptied: 2406317 bytes

->Java cache emptied: 33789500 bytes

->FireFox cache emptied: 44164998 bytes

->Flash cache emptied: 0 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32 (64bit) .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 107032988 bytes

%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 67630 bytes

RecycleBin emptied: 1914220 bytes

Total Files Cleaned = 311,00 mb

OTL by OldTimer - Version 3.2.14.1 log created on 09292010_210059

Files\Folders moved on Reboot...

File\Folder I:\startup.exe not found!

File\Folder H:\autorun.exe not found!

C:\Users\Lance\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

Registry entries deleted on Reboot...

В момента сканирам с SUPERAntiSpyware Free. Може ли да работи заедно с Panda Internet Security 2010.

Редактирано 29 септември 201015 г. от cipollini (преглед на промените)

Може, но не е желателно. Изчакайте SAS да приключи.

Сега имате ли някакви проблеми с Windows? Забелязвате ли нещо странно, необичайно ?

В момента не намирам проблеми с Windows, но до тук SAS е открил 29 заплахи.

Добре. Като свърши публикувайте лога.

SUPERAntiSpyware Scan Log http://www.superantispyware.com Generated 09/29/2010 at 10:08 PM Application Version : 4.43.1000 Core Rules Database Version : 5604 Trace Rules Database Version: 3416 Scan type : Complete Scan Total Scan Time : 00:44:39 Memory items scanned : 781 Memory threats detected : 0 Registry items scanned : 14789 Registry threats detected : 0 File items scanned : 53226 File threats detected : 244 Adware.Tracking Cookie C:\Users\Lance\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt C:\Users\Lance\AppData\Roaming\Microsoft\Windows\Cookies\lance@doubleclick[1].txt counter.search.bg [ C:\Users\Lance\AppData\Roaming\Mozilla\Firefox\Profiles\35px0ttj.default\cookies.sqlite ] media.easyads.bg [ C:\Users\Lance\AppData\Roaming\Mozilla\Firefox\Profiles\35px0ttj.default\cookies.sqlite ] media.easyads.bg [ C:\Users\Lance\AppData\Roaming\Mozilla\Firefox\Profiles\35px0ttj.default\cookies.sqlite ] media.easyads.bg [ C:\Users\Lance\AppData\Roaming\Mozilla\Firefox\Profiles\35px0ttj.default\cookies.sqlite ] .doubleclick.net [ C:\Users\Lance\AppData\Roaming\Mozilla\Firefox\Profiles\35px0ttj.default\cookies.sqlite ] unleash2.advertserve.com [ C:\Users\Lance\AppData\Roaming\Mozilla\Firefox\Profiles\35px0ttj.default\cookies.sqlite ] advert.kaldata.com [ C:\Users\Lance\AppData\Roaming\Mozilla\Firefox\Profiles\35px0ttj.default\cookies.sqlite ] .media6degrees.com [ C:\Users\Lance\AppData\Roaming\Mozilla\Firefox\Profiles\35px0ttj.default\cookies.sqlite ] .media6degrees.com [ C:\Users\Lance\AppData\Roaming\Mozilla\Firefox\Profiles\35px0ttj.default\cookies.sqlite ] .imrworldwide.com [ C:\Users\Lance\AppData\Roaming\Mozilla\Firefox\Profiles\35px0ttj.default\cookies.sqlite ] .imrworldwide.com [ C:\Users\Lance\AppData\Roaming\Mozilla\Firefox\Profiles\35px0ttj.default\cookies.sqlite ] .collective-media.net [ C:\Users\Lance\AppData\Roaming\Mozilla\Firefox\Profiles\35px0ttj.default\cookies.sqlite ] .collective-media.net [ C:\Users\Lance\AppData\Roaming\Mozilla\Firefox\Profiles\35px0ttj.default\cookies.sqlite ] .collective-media.net [ C:\Users\Lance\AppData\Roaming\Mozilla\Firefox\Profiles\35px0ttj.default\cookies.sqlite ] .collective-media.net [ C:\Users\Lance\AppData\Roaming\Mozilla\Firefox\Profiles\35px0ttj.default\cookies.sqlite ] .apmebf.com [ C:\Users\Lance\AppData\Roaming\Mozilla\Firefox\Profiles\35px0ttj.default\cookies.sqlite ] .fastclick.net [ C:\Users\Lance\AppData\Roaming\Mozilla\Firefox\Profiles\35px0ttj.default\cookies.sqlite ] .fastclick.net [ C:\Users\Lance\AppData\Roaming\Mozilla\Firefox\Profiles\35px0ttj.default\cookies.sqlite ] .kontera.com [ C:\Users\Lance\AppData\Roaming\Mozilla\Firefox\Profiles\35px0ttj.default\cookies.sqlite ] .smartadserver.com [ C:\Users\Lance\AppData\Roaming\Mozilla\Firefox\Profiles\35px0ttj.default\cookies.sqlite ] .smartadserver.com [ C:\Users\Lance\AppData\Roaming\Mozilla\Firefox\Profiles\35px0ttj.default\cookies.sqlite ] .smartadserver.com [ C:\Users\Lance\AppData\Roaming\Mozilla\Firefox\Profiles\35px0ttj.default\cookies.sqlite ] .smartadserver.com [ C:\Users\Lance\AppData\Roaming\Mozilla\Firefox\Profiles\35px0ttj.default\cookies.sqlite ] .smartadserver.com [ C:\Users\Lance\AppData\Roaming\Mozilla\Firefox\Profiles\35px0ttj.default\cookies.sqlite ] media.easyads.bg [ C:\Users\Lance\AppData\Roaming\Mozilla\Firefox\Profiles\35px0ttj.default\cookies.sqlite ] .apmebf.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] counter.search.bg [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .imrworldwide.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .imrworldwide.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .avgtechnologies.112.2o7.net [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .statcounter.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .adultfriendfinder.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .adultfriendfinder.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .mediaplex.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .mediaplex.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .doubleclick.net [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .3d-sexgames.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .bs.serving-sys.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .serving-sys.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .serving-sys.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .serving-sys.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .serving-sys.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .serving-sys.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .serving-sys.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .revsci.net [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] ad.yieldmanager.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] rotator.adjuggler.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] rotator.adjuggler.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .atdmt.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] ad.yieldmanager.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .tribalfusion.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .statcounter.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .rambler.ru [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .yadro.ru [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .collective-media.net [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .spylog.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .media.photobucket.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .smartadserver.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .adtech.de [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .smartadserver.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .smartadserver.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .xiti.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .kontera.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .chitika.net [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .advertising.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .advertising.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .advertising.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .advertising.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .burstnet.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .burstnet.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .pcworldcommunication.122.2o7.net [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] www3.addfreestats.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .microsoftsto.112.2o7.net [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .cgm.adbureau.net [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .game-advertising-online.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .philips.112.2o7.net [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .specificclick.net [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .ads.pointroll.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .ads.pointroll.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .ads.pointroll.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .ads.pointroll.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .ads.pointroll.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .ads.pointroll.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .ads.pointroll.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .adbrite.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .adbrite.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .adultadworld.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .free.porndirt.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .webmasterplan.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .statcounter.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .fastclick.net [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .fastclick.net [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .statcounter.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .viacom.adbureau.net [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .2o7.net [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .viacom.adbureau.net [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .viacom.adbureau.net [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .viacom.adbureau.net [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] ad.yieldmanager.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .im.banner.t-online.de [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .statcounter.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .apmebf.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .statcounter.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .nextag.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .nextag.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .nextag.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .nextag.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .tacoda.net [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .tacoda.net [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .advertising.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .advertising.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .at.atwola.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .statcounter.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .zedo.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .at.atwola.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .statcounter.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .tribalfusion.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .tribalfusion.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .tribalfusion.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .tribalfusion.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .tribalfusion.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .kontera.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .kontera.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .delivery.trafficjunky.net [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] rts.pgmediaserve.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .bluestreak.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .statcounter.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .realmedia.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .realmedia.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .122.2o7.net [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .specificclick.net [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .mediaonenetwork.net [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .forums.hardwarezone.com.sg [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .forums.hardwarezone.com.sg [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .advertising.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .hardwarezone.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] www.hardwarezone.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] www.hardwarezone.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .pcstats.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .revsci.net [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] imagevenue.advertserve.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] imagevenue.advertserve.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .myfirstsexteacher.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] ads.onmedia.bg [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .youporn.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .youporn.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .youporn.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .matureporntrip.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] ads-dev.youporn.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .smartadserver.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .lfstmedia.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .lfstmedia.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] www.nyloncunts.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .nyloncunts.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] ad.yieldmanager.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] ad.yieldmanager.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] media.easyads.bg [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] ad6.bannerbank.ru [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] ad7.bannerbank.ru [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] ad16.bannerbank.ru [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .tns-counter.ru [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] xxx.artfile.ru [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] ad9.bannerbank.ru [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .bannerbank.ru [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] n.pay-click.ru [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] n.pay-click.ru [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .gotquestions.org [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .gotquestions.org [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .adultadworld.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .adultadworld.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .hornymatches.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .hornymatches.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .hornymatches.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .hornymatches.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .hornymatches.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .hornymatches.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] cn.clickable.net [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] media.easyads.bg [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] media.easyads.bg [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] media.easyads.bg [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] media.easyads.bg [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .hotlog.ru [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .openstat.net [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .at.atwola.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .collective-media.net [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .interclick.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .interclick.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .invitemedia.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .invitemedia.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .content.yieldmanager.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .dmtracker.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .revsci.net [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .revsci.net [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .revsci.net [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .revsci.net [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] media.easyads.bg [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] media.easyads.bg [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] media.easyads.bg [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] media.easyads.bg [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] media.easyads.bg [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] media.easyads.bg [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] delivery.usermedia.net [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .kontera.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .kontera.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] media.easyads.bg [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] media.easyads.bg [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] media.easyads.bg [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] media.easyads.bg [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] media.easyads.bg [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] media.easyads.bg [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .collective-media.net [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .www.burstnet.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .burstnet.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] statse.webtrendslive.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] stats.kvazer.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .hardsextube.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .hardsextube.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .hardsextube.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] adserver.hardsextube.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .adnetxchange.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .adxpansion.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .adnetxchange.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .adnetxchange.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] rem.rezonmedia.eu [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] rem.rezonmedia.eu [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] rem.rezonmedia.eu [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .liveperson.net [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] .liveperson.net [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] banner.prosteergroup.com [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] media.easyads.bg [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] media.easyads.bg [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] media.easyads.bg [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] media.easyads.bg [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] media.easyads.bg [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] stats.mindcraft.biz [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] media.easyads.bg [ D:\Documents and Settings\Lance\Application Data\Mozilla\Firefox\Profiles\5o8jl4ln.default\cookies.sqlite ] Trojan.Agent/Gen-Krpytik C:\PROGRAM FILES (X86)\ELECTRONIC ARTS\NEED FOR SPEED SHIFT\RLD-NFSS.EXE D:\PROGRAM FILES\ELECTRONIC ARTS\NEED FOR SPEED SHIFT\RLD-NFSS.EXE Trojan.Agent/Gen-OnlineGames C:\PROGRAM FILES (X86)\INTERNET DOWNLOAD MANAGER\BULGARIAN LANGUAGE.EXE F:\PROGRAMI\INTERNET DOWNLOAD MANAGER V5.12 (BUILD 6) + ALL\AFTER INSTALL\BULGARIAN LANGUAGE.EXE Trojan.Dropper/Game D:\WINDOWS\SYSTEM32\POINTDLL.DLL Trojan.Agent/Gen F:\PROGRAMI\AV.VOICE.CHANGER.DIAMOND[+KEYGEN]\KEYGEN.EXE

Браво! Напредваме . Сега ето какво следва:

1.Изтеглете програмата AVZ4 и я разархивирайте на десктопа.

• стартирайте AVZ и обновете базата с данни (File - Database Update - Start):

2.Затворете всички програми, временно изключете антивирусната си програма, защитната стена и друг защитен софтуер (ако имате такъв), оставете само вашият браузър отворен (Mozilla Firefox, Internet Explorer, Opera ...).

• докато трае сканирането и формирането на логовете интернетът ви трябва да е изключен.

3.След това отидете на "File => Standard scripts":

4. Поставете отметка на 3-тия скрипт и натиснете "Execute selected scripts".

В резултат на изпълнение на скрипта в папката AVZ\LOG ще се създаде архив virusinfo_syscure.zip.:

Внимание:

• След изпълнение на скрипта рестартирайте компютъра си!

5.Стартирайте AVZ, отидете на "File => Standard scripts" и поставете отметка на 2-рия скрипт. След това натиснете "Execute selected scripts".

В резултат на изпълнение на скрипта в папката AVZ\LOG ще се създаде архив virusinfo_syscheck.zip:

6.Затворете AVZ.Включете си антивирусната програма,защитната стена и интернета.Към темата прикачете:

• virusinfo_syscure.zip
• virusinfo_syscheck.zip

Внимание!!!

• Ако AVZ не се стартира преименувайте файла avz.exe в 123.com (123.pif или 123.cmd)

Това са архивите.

Изключете интернет,антивирусната си програма и защитната си стена.

1. Отворете AVZ

2. Отидете на "File => Custom scripts".

3. В новопоявилото се поле, маркирайте, копирайте (Copy или Ctrl+C) и поставете (Paste или Ctrl+V) следния скрипт (техт):

begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
 DeleteFile('C:\Windows\GVTDrv64.sys');
 DeleteFile('C:\Windows\System32\drivers\wd.sys');
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.

След това натиснете "Run"

4. Когато програмата си свърши работата ще ви се появи следния прозорец:

След изпълнение на скрипта компютъра ви ще се рестартира.

В момента съм на работа, като се прибера довечера ще изпълня указанието. Ще има ли още сканирания или зависи от резултатите. Благодаря много за помощта до тук!

И аз съм в училище. Ами мисля, че това беше вече нямате зарази. Остана да изпълните по- горните стъпки. След това ще остане още малко за оправяне.

Благодаря! Може ли да ми препоръчаш антивирусна и ако може да е безплатна. В момента съм с Панда от 3 дни само я пробвам, преди бях с Авира.

Вижте този коментар

Не мога да изпълня последния скрипт. Когато го стартирам AVZ забива. Пробвах няколко пъти но не става. Спрял съм всички излишни програми, защитна стена и интернет.

Привет, cipollini!

Колегата asdfag е зает и ме помоли да довърша. Затова:

1. Деинсталирайте AVZ. Ето как: Стартирайте отново AVZ. Вижте този коментар -> File -> Standard scripts маркирайте 6 - Delete all AVZ drivers and registry keys и натиснете Execute selected scripts.

2. Стартирайте отново OTL и не правете никакви настройки. Натиснете бутона Quick Scan. След завършване на работата OTL ще генерира лог файл. Прикачете го към следващия си коментар.

Това е файла.

Ето какво следва:

Стъпка 1

Стартирайте пак OTL.exe и с Copy/ Paste под колонката Custom Scans/Fixes въведете скриптовия текст от цитата по-долу, като не забравяте да копирате скрипта 1 към 1, както и двете точки преди първия ред на скрипта!

:OTL

DRV:64bit: - (Prot6Flt) -- C:\Windows\SysNative\DRIVERS\Prot6Flt.sys File not found

DRV:64bit: - (PavTPK.sys) -- C:\Windows\SysNative\PavTPK.sys File not found

O2:64bit: - BHO: (no name) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No CLSID value found.

O13 - gopher Prefix: missing

O18:64bit: - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found

O18:64bit: - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found

O18:64bit: - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found

O18:64bit: - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found

O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found

O18:64bit: - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found

O18:64bit: - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found

O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found

O18:64bit: - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - Reg Error: Key error. File not found

O18:64bit: - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - Reg Error: Key error. File not found

O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found

O18:64bit: - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - Reg Error: Key error. File not found

O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found

O32 - AutoRun File - [2009.08.20 07:35:56 | 000,000,000 | ---- | M] () - D:\AUTOEXEC.BAT -- [ NTFS ]

O32 - AutoRun File - [2003.04.12 03:22:40 | 000,045,056 | R--- | M] () - H:\autorun.exe -- [ CDFS ]

O32 - AutoRun File - [2003.04.12 03:22:42 | 000,000,044 | R--- | M] () - H:\autorun.inf -- [ CDFS ]

O32 - AutoRun File - [2004.02.23 12:44:06 | 000,000,046 | R--- | M] () - I:\AUTORUN.INF -- [ CDFS ]

O33 - MountPoints2\{20348307-bfe7-11de-93f0-00e04c0bd17e}\Shell - "" = AutoRun

O33 - MountPoints2\{20348307-bfe7-11de-93f0-00e04c0bd17e}\Shell\AutoRun\command - "" = I:\startup.exe -- [2004.02.23 12:44:08 | 000,192,512 | R--- | M] (Terratools/Cyparade)

O33 - MountPoints2\{856d3807-bcb4-11de-9896-00e04c0bd17e}\Shell - "" = AutoRun

O33 - MountPoints2\{856d3807-bcb4-11de-9896-00e04c0bd17e}\Shell\AutoRun\command - "" = H:\autorun.exe -- [2003.04.12 03:22:40 | 000,045,056 | R--- | M] ()

O34 - HKLM BootExecute: (autocheck autochk *) - File not found

O34 - HKLM BootExecute: (MACHINE BootExecut) - File not found

:files

recycler /alldrives

sc start "Event Log" /c

ipconfig /flushdns /c

:Commands

[purity]

[emptytemp]

[emptyflash]

[Reboot]

След като въведете скрипта от цитата по-горе натиснете бутона, маркиран в червено:

Ще се създаде лог файл. Копирайте и поставете този файл в следващия си коментар.

Стъпка 2

Направете проверка със Sophos Anti-Rootkit. Eто как: изтеглете Sophos Anti-Rootkit от тук (иска се регистрация), стартирайте sarsfx.exe и го пуснете да сканира (Start scan). Когато сканирането завърши, пуснете Windows Explorer и отидете в папка %temp%. Там трябва да има файл с име sarscan.log. Публикувайте или го прикачете към следващия си коментар.

P.S. Първата стъпка ще почисти малко боклуци по Windows. Втората е за профилактична проверка. Пишете дали след изпълнението на стъпка 1 имате някакви други проблеми с Windows.

Забелязах че заетата рам памет е около 40-50% от общо 4 ГБ без да има стартирани излишни програми освен антивирусната, SAS и utorrent.

All processes killed

========== OTL ==========

Service Prot6Flt stopped successfully!

Service Prot6Flt deleted successfully!

File C:\Windows\SysNative\DRIVERS\Prot6Flt.sys File not found not found.

Error: Unable to stop service PavTPK.sys!

Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PavTPK.sys deleted successfully.

File C:\Windows\SysNative\PavTPK.sys File not found not found.

64bit-Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}\ not found.

64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}\ not found.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\Prefixes\\gopher|:gopher:// /E : value set successfully!

64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\http\0x00000001\ not found.

64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E1D2BF42-A96B-11d1-9C6B-0000F875AC61}\ not found.

File {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found not found.

64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\http\oledb\ not found.

64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E1D2BF40-A96B-11d1-9C6B-0000F875AC61}\ not found.

File {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found not found.

64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\https\0x00000001\ not found.

64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E1D2BF42-A96B-11d1-9C6B-0000F875AC61}\ not found.

File {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found not found.

64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\https\oledb\ not found.

64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E1D2BF40-A96B-11d1-9C6B-0000F875AC61}\ not found.

File {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found not found.

64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\msdaipp\ not found.

File Protocol\Handler\msdaipp - No CLSID value found not found.

64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\msdaipp\0x00000001\ not found.

64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E1D2BF42-A96B-11d1-9C6B-0000F875AC61}\ not found.

File {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found not found.

64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\msdaipp\oledb\ not found.

64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E1D2BF40-A96B-11d1-9C6B-0000F875AC61}\ not found.

File {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found not found.

64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\ms-help\ not found.

64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{314111c7-a502-11d2-bbca-00c04f8ec294}\ not found.

File {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found not found.

64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\mso-offdap\ not found.

64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3D9F03FA-7A94-11D3-BE81-0050048385D1}\ not found.

File {3D9F03FA-7A94-11D3-BE81-0050048385D1} - Reg Error: Key error. File not found not found.

64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\mso-offdap11\ not found.

64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{32505114-5902-49B2-880A-1F7738E5A384}\ not found.

File {32505114-5902-49B2-880A-1F7738E5A384} - Reg Error: Key error. File not found not found.

64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\skype4com\ not found.

64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D}\ not found.

File {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found not found.

64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\text/xml\ not found.

64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{807553E5-5146-11D5-A672-00B0D022E945}\ not found.

64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet:/pagefile deleted successfully.

File D:\AUTOEXEC.BAT not found.

File move failed. H:\autorun.exe scheduled to be moved on reboot.

File move failed. H:\autorun.inf scheduled to be moved on reboot.

File move failed. I:\AUTORUN.INF scheduled to be moved on reboot.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{20348307-bfe7-11de-93f0-00e04c0bd17e}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20348307-bfe7-11de-93f0-00e04c0bd17e}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{20348307-bfe7-11de-93f0-00e04c0bd17e}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20348307-bfe7-11de-93f0-00e04c0bd17e}\ not found.

File move failed. I:\startup.exe scheduled to be moved on reboot.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{856d3807-bcb4-11de-9896-00e04c0bd17e}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{856d3807-bcb4-11de-9896-00e04c0bd17e}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{856d3807-bcb4-11de-9896-00e04c0bd17e}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{856d3807-bcb4-11de-9896-00e04c0bd17e}\ not found.

File move failed. H:\autorun.exe scheduled to be moved on reboot.

Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session manager\\BootExecute:autocheck autochk * deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session manager\\BootExecute:MACHINE BootExecut deleted successfully.

========== FILES ==========

recycler not found in C:\

recycler not found in D:\

recycler not found in E:\

recycler not found in F:\

recycler not found in H:\

recycler not found in I:\

< sc start "Event Log" /c >

[sC] StartService: OpenService FAILED 1060:

The specified service does not exist as an installed service.

C:\Users\Lance\Desktop\cmd.bat deleted successfully.

C:\Users\Lance\Desktop\cmd.txt deleted successfully.

< ipconfig /flushdns /c >

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

C:\Users\Lance\Desktop\cmd.bat deleted successfully.

C:\Users\Lance\Desktop\cmd.txt deleted successfully.

========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

->Flash cache emptied: 0 bytes

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

->Flash cache emptied: 0 bytes

User: Desktop

User: Lance

->Temp folder emptied: 50603473 bytes

->Temporary Internet Files folder emptied: 33921 bytes

->Java cache emptied: 0 bytes

->FireFox cache emptied: 25866538 bytes

->Flash cache emptied: 543 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32 (64bit) .tmp files removed: 12288 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 717 bytes

%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33170 bytes

RecycleBin emptied: 0 bytes

Total Files Cleaned = 73,00 mb

[EMPTYFLASH]

User: All Users

User: Default

->Flash cache emptied: 0 bytes

User: Default User

->Flash cache emptied: 0 bytes

User: Desktop

User: Lance

->Flash cache emptied: 0 bytes

User: Public

Total Flash Files Cleaned = 0,00 mb

OTL by OldTimer - Version 3.2.14.1 log created on 10012010_225524

Files\Folders moved on Reboot...

File\Folder H:\autorun.exe not found!

File\Folder H:\autorun.inf not found!

File\Folder I:\AUTORUN.INF not found!

File\Folder I:\startup.exe not found!

C:\Users\Lance\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

Registry entries deleted on Reboot...

Sophos Anti-Rootkit Version 1.5.4 © 2009 Sophos Plc

Started logging on 1.10.2010 г. at 21:54:37 ч.

User "Lance" on computer "PENTIUM-EXTREME"

Windows version 6.1 SP 0.0 build 7600 SM=0x100 PT=0x1 WOW64

Info: Starting registry scan.

Info: Starting disk scan of C: (NTFS).

Hidden: file C:\Windows\System32\LogFiles\Scm\f322dd38-b1b6-4bbf-ba9a-5427e40776a7

Hidden: file C:\Program Files (x86)\Nero\Nero 9\Nero SoundTrax\AudioPluginMgr\APM_MSAxp.dll

Hidden: file C:\Program Files (x86)\Nero\Nero 9\Nero Burning ROM\AudioPluginMgr\APM_MSAxp.dll

Hidden: file C:\Program Files (x86)\Nero\Nero 9\Nero Burning ROM\SMC\NeroVMRModules.dll

Hidden: file C:\Program Files (x86)\Nero\Nero 9\Nero Express\AudioPluginMgr\APM_MSAxp.dll

Hidden: file C:\Program Files (x86)\Nero\Nero 9\Nero Express\SMC\NeroVMRModules.dll

Hidden: file C:\Program Files (x86)\Nero\Nero 9\Nero Recode\SMC\NeroVMRModules.dll

Hidden: file C:\Program Files (x86)\Nero\Nero 9\Nero ShowTime\NePBPShowtime.DLL

Hidden: file C:\Program Files (x86)\Nero\Nero 9\Nero ShowTime\SMC\NeroVMRModules.dll

Hidden: file C:\Program Files (x86)\Nero\Nero 9\Nero SoundTrax\SMC\NeroVMRModules.dll

Hidden: file C:\Program Files (x86)\Nero\Nero 9\Nero StartSmart\AudioPluginMgr\APM_MSAxp.dll

Hidden: file C:\Program Files (x86)\Nero\Nero 9\Nero StartSmart\SMC\NeroVMRModules.dll

Hidden: file C:\Program Files (x86)\Nero\Nero 9\Nero Vision\Nero.DVDEngine\DVDBlockAcc.dll

Hidden: file C:\Program Files (x86)\Nero\Nero 9\Nero Vision\SMC\NeroVMRModules.dll

Hidden: file C:\Program Files (x86)\Nero\Nero 9\Nero WaveEditor\AudioPluginMgr\APM_MSAxp.dll

Hidden: file C:\Program Files (x86)\Nero\Nero 9\Nero WaveEditor\SMC\NeroVMRModules.dll

Hidden: file C:\Windows\SysWOW64\bass.dll

Hidden: file C:\Windows\SysWOW64\bass_aac.dll

Hidden: file C:\_OTL\MovedFiles\09292010_204158\C_Windows\SysWOW64\drivers\OSCI_DRVX64.sys

Hidden: file C:\Program Files (x86)\IVT Corporation\BlueSoleil\BlueSoleilCS.exe

Hidden: file C:\Program Files (x86)\IVT Corporation\BlueSoleil\BtTray.exe

Hidden: file C:\Users\Lance\Desktop\CPU&Memory\LinX\LinX.exe

Hidden: file C:\Program Files (x86)\Adobe\Adobe Bridge CS5\Photodownloader.exe

Hidden: file C:\Program Files (x86)\Nobilis\Mountain Bike Adrenaline\MTB-EU.exe

Hidden: file C:\Windows\System32\DriverStore\FileRepository\c7_95693.inf_amd64_neutral_7875e8a45e03a010\B_95228\atiumdag.dll

Info: Starting disk scan of D: (NTFS).

Hidden: file D:\WINDOWS\gdrv.sys

Hidden: file D:\Program Files\easetech\EaseAudioConverter\EaseAudioConverter.exe

Hidden: file D:\Documents and Settings\Lance\Application Data\Adobe\Dreamweaver 9\Configuration\Flash Player\authplay.dll

Hidden: file D:\Program Files\Nero\Nero 9\Nero Burning ROM\AudioPluginMgr\APM_MSAxp.dll

Hidden: file D:\Program Files\Nero\Nero 9\Nero Burning ROM\SMC\NeroVMRModules.dll

Hidden: file D:\Program Files\Nero\Nero 9\Nero Express\AudioPluginMgr\APM_MSAxp.dll

Hidden: file D:\Program Files\Nero\Nero 9\Nero Express\CoverEdCtrl\CoverEdCtrl.ocx

Hidden: file D:\Program Files\Nero\Nero 9\Nero Express\SMC\NeroVMRModules.dll

Hidden: file D:\Program Files\Nero\Nero 9\Nero Recode\SMC\NeroVMRModules.dll

Hidden: file D:\Program Files\Nero\Nero 9\Nero ShowTime\NePBPShowtime.DLL

Hidden: file D:\Program Files\Nero\Nero 9\Nero ShowTime\SMC\NeroVMRModules.dll

Hidden: file D:\Program Files\Nero\Nero 9\Nero SoundTrax\AudioPluginMgr\APM_MSAxp.dll

Hidden: file D:\Program Files\Nero\Nero 9\Nero SoundTrax\SMC\NeroVMRModules.dll

Hidden: file D:\Program Files\Nero\Nero 9\Nero StartSmart\AudioPluginMgr\APM_MSAxp.dll

Hidden: file D:\Program Files\Nero\Nero 9\Nero StartSmart\SMC\NeroVMRModules.dll

Hidden: file D:\Program Files\Nero\Nero 9\Nero Vision\Nero.DVDEngine\DVDBlockAcc.dll

Hidden: file D:\Program Files\Nero\Nero 9\Nero Vision\SMC\NeroVMRModules.dll

Hidden: file D:\Program Files\Nero\Nero 9\Nero WaveEditor\AudioPluginMgr\APM_MSAxp.dll

Hidden: file D:\Program Files\Nero\Nero 9\Nero WaveEditor\SMC\NeroVMRModules.dll

Hidden: file D:\Documents and Settings\Lance\Desktop\CPU\LinX\LinX.exe

Hidden: file D:\Program Files\uTorrent\uTorrent.exe

Info: Starting disk scan of E: (NTFS).

Hidden: file E:\CorelDRAW\Program\CorelDRAW Graphics Suite X3 + SP1\CorelDRAWGraphicsSuiteX3.exe

Info: Starting disk scan of F: (NTFS).

Hidden: file F:\Programi\Codec\Windows.7.codec\windows.7.codec.pack.v2.1.0.setup.exe

Hidden: file F:\Programi\CPU&Memory\LinX\LinX.exe

Hidden: file F:\Programi\Players\realplayer10\activator4.exe

Hidden: file F:\Programi\Antivirus&Spyware\Antivirus\Kaspersky Anti-Virus 2009\kav8.0.0.506en.exe

Hidden: file F:\Programi\Codec\DivX_for_Windows_6.8.0.5.exe

Hidden: file F:\Programi\Codec\XP_Codec_Pack_2.3.5.exe

Hidden: file F:\Programi\FlexType-XP-2k\FlexType2k\SETUP.EXE

Hidden: file F:\Programi\HDD\HD Inspector\setup.exe

Hidden: file F:\Programi\Players\Media pleyers\mp10setup.exe

Hidden: file F:\Programi\Players\Smplayer\smplayer-0.6.8-win32-webdl.exe

Hidden: file F:\Games\Dream Sleuth [bG]\Dream Sleuth BG.exe

Hidden: file F:\Games\BounceOut\Bombermania\bass.dll

Hidden: file F:\Games\BounceOut\Bombermania\Bombermania.exe

Hidden: file F:\Games\BounceOut\BounceOut.exe

Hidden: file F:\Games\Fishing Simulator for Relax\FishingSimulatorforRelaxFull.exe

Hidden: file F:\Games\Tabla i Karti\Serious Backgammon v1.24.exe

Hidden: file F:\Games\WildGames - National Geographic - Herod's Lost Tomb - RaBBiT\National Geographic - Herod's Lost Tomb_setup.exe

Hidden: file F:\Programi\Players\КМplayer_HDTV(720p и 1080p)\kmp.exe

Hidden: file F:\Programi\Codec\Codec_Recommended\CoreAVC Professional Edition v1.8.0.0\KEYGEN\keygen.exe

Hidden: file F:\Programi\Codec\Codec_Recommended\DivXInstaller\DivXInstaller.exe

Hidden: file F:\Programi\Players\GOM Player 2.1.18.4762\Gom player setup.exe

Hidden: file F:\Programi\Windows_7\Driver_Win7_64\AT__HD4730_win7_driver\10-7_vista64_win7_64_dd_ccc_enu_634158373315169972\10-7_vista64_win7_64_dd_ccc_enu.exe

Hidden: file F:\Programi\ATI_HD4730_Driver\ATI Catalyst 10.2 Windows XP x32\ATI Catalyst 10.2 Windows XP x32 (kaldata.com).exe

Hidden: file F:\My Document\Stoika\KINGSTON\WildGames - National Geographic - Herod's Lost Tomb - RaBBiT\National Geographic - Herod's Lost Tomb_setup.exe

Hidden: file F:\Programi\Windows_7\Driver_Win7_64\AT__HD4730_win7_driver\10-2_vista64_win7_64\10-2_vista64_win7_64_dd_ccc_wdm_enu.exe

Hidden: file F:\Download\Other\zabavno\STRESSRE.EXE

Stopped logging on 1.10.2010 г. at 22:49:26 ч.

Редактирано 1 октомври 201015 г. от cipollini (преглед на промените)