Да разбирам че сме решили проблема ви...?

Ем не виждам да има някаква промяна с зареждането на някои страници.Дал съм пример кои саит ми зарежда твърде бавно.

Редактирано 7 януари 201115 г. от holliwood72 (преглед на промените)

Да ясно..Продължаваме..:

Деинсталирайте OTL. Ето как:

Стартирайте OTL.exe още веднъж и натиснете бутона CleanUp!

Ще последва рестарт на компютъра...!

Деинсталирайте ОТМ аналогично с ОТЛ....стартирате отново програмата и натискате бутона ''CleanUp''

Отново ще последва рестарт..!

И след това...:

Изтеглете ComboFix от тук, тук или тук и го запазете на десктопа си.

• Изключете вашата антивирусна и антишпионска програма, обикновено това става чрез натискане на десния бутон на мишката върху иконата на програма в системния трей.

Бележка: Ако не можете я спрете или не сте сигурни коя програма да изключите, моля прегледайте информацията от този линк: How to Disable your Security Programs

• Стартирайте Combo-Fix.com и следвайте инструкциите.

Бележка: ComboFix ще се стартира без инсталирана Recovery Console.

• Като част от неговата работа, ComboFix ще провери дали Microsoft Windows Recovery Console е инсталирана. Предвид бързо развиващия се зловреден софтуер е силно препоръчително да бъде инсталирана преди премахването на зловредния софтуер. Това ще Ви позволи да влезете в специален recovery/repair режим, който ще ни позволи по-лесно да решите проблем, който би могъл да възникне при премахване на зловредния софтуер.

• Следвайте инструкциите, за да позволите на ComboFix да изтегли и инсталира Microsoft Windows Recovery Console. В един момент ще бъдете попитани дали сте съгласни с лицензното споразумение. Необходимо е да потвърдите, че сте съгласни, за да инсталирате Microsoft Windows Recovery Console.

** Забележете: Ако Microsoft Windows Recovery Console е вече инсталирана, ComboFix ще продължи към процеса по премахване на зловредния софтуер.

След като Microsoft Windows Recovery Console е инсталирана, използвайки ComboFix, Вие ще видите следното съобщение:

Изберете Yes, за да продължи сканирането за зловреден софтуер.

Когато процесът приключи успешно, инструментът ще създаде лог файл. Моля, включете съдържанието на C:\ComboFix.txt в следващия Ви коментар в тази тема.

Бележка:

• Моля, не движете мишката, докато ComboFix работи. Това може да наруши процеса на работа.
• ComboFix ще нулира всички настройки на Microsoft Internet Explorer, включително да направи IE браузър по подразбиране.
• ComboFix ще изключи autorun функцията на ВСИЧКИ CD, Floppy и USB устройства, за да помогне при премахването на зловредния софтуер и Ви защити от бъдещи вируси/заплахи, които поразяват чрез autorun. Ако това е проблем за вас - моля, уведомете ме.
• ComboFix ще изключи вашата интернет връзка. Интернет връзката ще се възстанови автоматично, преди ComboFix да завърши процеса на работа. При проблем, той ще прекрати интернет връзката. За да възстановите интернет връзката си, рестартирайте компютъра си.
• В случай на проблем с ComboFix, той може да създаде лог файл. Моля, включете съдържанието на C:\BUG.txt в следващия Ви коментар в тази тема.

Работата на ComboFix, може да отнеме до 20-30 минути, за да завърши, моля имайте търпение.

Моля, не прикачвайте лог файла/овете от програмата, а го/ги копирайте и поставете в следващия Ви коментар в тази тема.

Деинсталирах OTL.exe веднага ми поиска рестарт ,съгласих,зареди се уинодолса и видях че OTM я няма на десктопа ми.Значи сигурно и тя се премахна автоматично Сега дали да продължа или има проблем щом не стана по описаното от теб И още нещо ако трябва да продължа ще изключвам антивирусната ми после антишпионска програма обаче нз къде се намира "антишпионска програма" мисля че такава нямам

Редактирано 7 януари 201115 г. от holliwood72 (преглед на промените)

Да така е станало...Да продължете с Комбофикс..! п.п.между другото и при мен цитирания сайт се отваря бавно....!

И все пак почти всички ми саитове не зареждат като преди. .Ако направим тази стъпка няма ли да премахмем някои проблеми ако има

Да ще я направим естествено аз само информативно ти споменах...Ти си движи Комбофикса...Така и така сме започнали ....!

обаче "антишпионска програма" такава нямам а и ако имам нз къде се намира http://www.kaldata.com/forums/public/style_emoticons/<#EMO_DIR#>/sad.gif

Ако нямате здраве да е ....продължете ...не се притеснявайте..!

Добро утро!Има проблем излезна неочакван прозорец.Инасталнах Microsoft Windows Recovery Console както се очакваше заредха се двата реда до 100%,и ми излезна "Windows XP Professionals SP2 SD Boot Floppies" (yes или no)

Редактирано 8 януари 201115 г. от holliwood72 (преглед на промените)

Не ...!

ComboFix 11-01-07.01 - stefan 01.2011 г. 10:20:08.1.1 - x86 Microsoft Windows XP Professional 5.1.2600.3.1251.359.1033.18.447.179 [GMT 2:00] Running from: c:\documents and settings\stefan\Desktop\ComboFix.exe AV: ESET NOD32 Antivirus 4.2 *Disabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0} WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\stefan\Application Data\inst.exe c:\documents and settings\stefan\Application Data\PriceGong c:\documents and settings\stefan\Application Data\PriceGong\Data\1.xml c:\documents and settings\stefan\Application Data\PriceGong\Data\a.xml c:\documents and settings\stefan\Application Data\PriceGong\Data\b.xml c:\documents and settings\stefan\Application Data\PriceGong\Data\c.xml c:\documents and settings\stefan\Application Data\PriceGong\Data\d.xml c:\documents and settings\stefan\Application Data\PriceGong\Data\e.xml c:\documents and settings\stefan\Application Data\PriceGong\Data\f.xml c:\documents and settings\stefan\Application Data\PriceGong\Data\g.xml c:\documents and settings\stefan\Application Data\PriceGong\Data\h.xml c:\documents and settings\stefan\Application Data\PriceGong\Data\i.xml c:\documents and settings\stefan\Application Data\PriceGong\Data\J.xml c:\documents and settings\stefan\Application Data\PriceGong\Data\k.xml c:\documents and settings\stefan\Application Data\PriceGong\Data\l.xml c:\documents and settings\stefan\Application Data\PriceGong\Data\m.xml c:\documents and settings\stefan\Application Data\PriceGong\Data\mru.xml c:\documents and settings\stefan\Application Data\PriceGong\Data\n.xml c:\documents and settings\stefan\Application Data\PriceGong\Data\o.xml c:\documents and settings\stefan\Application Data\PriceGong\Data\p.xml c:\documents and settings\stefan\Application Data\PriceGong\Data\q.xml c:\documents and settings\stefan\Application Data\PriceGong\Data\r.xml c:\documents and settings\stefan\Application Data\PriceGong\Data\s.xml c:\documents and settings\stefan\Application Data\PriceGong\Data\t.xml c:\documents and settings\stefan\Application Data\PriceGong\Data\u.xml c:\documents and settings\stefan\Application Data\PriceGong\Data\v.xml c:\documents and settings\stefan\Application Data\PriceGong\Data\w.xml c:\documents and settings\stefan\Application Data\PriceGong\Data\x.xml c:\documents and settings\stefan\Application Data\PriceGong\Data\y.xml c:\documents and settings\stefan\Application Data\PriceGong\Data\z.xml c:\documents and settings\stefan\My Documents\BackupRegistry(20101215).reg c:\documents and settings\stefan\My Documents\BackupRegistry(20101230).reg . ((((((((((((((((((((((((( Files Created from 2010-12-08 to 2011-01-08 ))))))))))))))))))))))))))))))) . 2011-01-08 07:04 . 2011-01-08 07:04 389120 ----a-w- c:\windows\system32\CF24953.exe 2011-01-07 17:26 . 2011-01-07 17:33 -------- d-----w- c:\documents and settings\stefan\Application Data\OpenOffice.org2 2011-01-07 17:24 . 2011-01-07 17:37 -------- d-----w- c:\program files\OpenOffice.org 2.3 2011-01-06 14:45 . 2011-01-06 14:45 -------- d-----w- c:\program files\trend micro 2011-01-06 10:42 . 2011-01-06 10:42 -------- d-----w- c:\documents and settings\stefan\Application Data\Malwarebytes 2011-01-06 10:41 . 2010-12-20 16:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2011-01-06 10:41 . 2011-01-06 10:41 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes 2011-01-06 10:41 . 2011-01-06 10:41 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2011-01-06 10:41 . 2010-12-20 16:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys 2011-01-04 14:45 . 2011-01-04 14:45 -------- d-----w- c:\program files\Subtitles 2011-01-04 14:42 . 2011-01-04 14:43 -------- d-----w- c:\documents and settings\stefan\Application Data\GetRightToGo 2011-01-02 14:15 . 2011-01-02 14:31 -------- d-----w- c:\program files\Tomb Raider - Anniversary 2011-01-01 16:31 . 2011-01-01 16:31 -------- d-----w- c:\documents and settings\All Users\Application Data\ESET 2011-01-01 15:56 . 2011-01-07 17:22 -------- d-----w- c:\program files\Common Files\Java 2011-01-01 15:56 . 2011-01-01 15:56 73728 ----a-w- c:\windows\system32\javacpl.cpl 2011-01-01 13:42 . 2011-01-01 13:42 -------- d-----w- c:\program files\CCleaner 2010-12-28 15:07 . 2010-12-28 16:02 -------- d-----w- c:\documents and settings\All Users\Application Data\FarmFrenzy3_Arctica 2010-12-28 15:07 . 2010-12-28 15:07 -------- d-----w- c:\program files\LeeGTs Games 2010-12-28 13:08 . 2010-12-28 15:01 -------- d-----w- c:\documents and settings\All Users\Application Data\Islands 2010-12-28 13:07 . 2010-12-28 13:07 -------- d-----w- c:\program files\Cybertek Games 2010-12-22 17:44 . 2010-12-22 17:44 -------- d-----w- c:\documents and settings\stefan\Local Settings\Application Data\TimeParadox 2010-12-21 21:20 . 2010-12-21 21:20 -------- d-----w- c:\documents and settings\stefan\Application Data\freshgames 2010-12-21 21:20 . 2010-12-21 21:20 -------- d-----w- c:\documents and settings\All Users\Application Data\freshgames 2010-12-18 14:54 . 2010-12-18 15:27 -------- d-----w- c:\program files\vloader-bg 2010-12-18 14:38 . 2010-12-18 15:04 -------- d-----w- c:\program files\vloader 2010-12-17 17:34 . 2010-12-27 18:29 -------- d-----w- c:\program files\LucasArts 2010-12-17 10:47 . 2010-12-17 10:47 -------- d-----w- c:\program files\iPod 2010-12-16 14:38 . 2010-12-16 14:38 -------- d-----w- c:\program files\Apple Software Update 2010-12-16 14:20 . 2010-12-17 10:47 -------- d-----w- c:\program files\iTunes 2010-12-16 12:01 . 2010-12-16 12:02 -------- d-----w- c:\documents and settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521} 2010-12-16 11:33 . 2011-01-05 18:11 -------- d-----w- c:\documents and settings\stefan\Local Settings\Application Data\AskToolbar 2010-12-15 19:39 . 2010-12-15 19:40 -------- d-----w- c:\documents and settings\stefan\UI 2010-12-15 13:52 . 2010-12-15 13:52 -------- d-----w- c:\program files\Ask.com 2010-12-15 04:55 . 2010-11-06 00:26 11080704 -c----w- c:\windows\system32\dllcache\ieframe.dll 2010-12-15 04:54 . 2010-11-02 15:17 40960 -c----w- c:\windows\system32\dllcache\ndproxy.sys 2010-12-15 04:53 . 2010-10-11 14:59 45568 -c----w- c:\windows\system32\dllcache\wab.exe 2010-12-14 17:21 . 2010-12-14 17:21 -------- d-----w- c:\documents and settings\stefan\Application Data\Silverback Productions 2010-12-14 16:41 . 2010-12-14 16:43 -------- d-----w- c:\documents and settings\stefan\Application Data\Vso 2010-12-14 16:41 . 2010-12-14 16:42 94208 ----a-w- c:\documents and settings\stefan\Application Data\ezplay.sys 2010-12-14 16:41 . 2010-12-14 16:41 94208 ----a-w- c:\windows\system32\drivers\ezplay.sys 2010-12-14 11:45 . 2010-12-14 11:45 -------- d-----w- c:\program files\Alcohol Soft 2010-12-13 14:52 . 2010-12-28 19:48 -------- d-----w- c:\program files\Worms 4 Mayhem 2010-12-13 11:44 . 2010-12-15 11:17 -------- d-----w- c:\documents and settings\stefan\Local Settings\Application Data\Conduit 2010-12-13 11:44 . 2010-12-13 11:44 -------- d-----w- c:\program files\Conduit 2010-12-13 11:44 . 2010-12-15 11:18 -------- d-----w- c:\documents and settings\stefan\Local Settings\Application Data\uTorrentBar 2010-12-13 11:43 . 2010-12-30 14:10 -------- d-----w- c:\program files\uTorrentBar 2010-12-13 11:43 . 2010-12-13 11:43 -------- d-----w- C:\extensions 2010-12-13 11:38 . 2010-12-13 11:45 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Temp 2010-12-09 14:53 . 2010-12-09 14:53 -------- d-----w- c:\program files\Ambient Design . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-01-01 15:56 . 2010-07-09 05:15 472808 ----a-w- c:\windows\system32\deployJava1.dll 2010-12-14 11:43 . 2010-07-07 09:14 436792 ----a-w- c:\windows\system32\drivers\sptd.sys 2010-11-29 15:38 . 2010-11-29 15:38 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx 2010-11-29 15:38 . 2010-11-29 15:38 69632 ----a-w- c:\windows\system32\QuickTime.qts 2010-11-18 18:12 . 2010-07-07 18:21 81920 ----a-w- c:\windows\system32\isign32.dll 2010-11-06 00:26 . 2008-04-14 12:00 916480 ----a-w- c:\windows\system32\wininet.dll 2010-11-06 00:26 . 2008-04-14 12:00 43520 ----a-w- c:\windows\system32\licmgr10.dll 2010-11-06 00:26 . 2008-04-14 12:00 1469440 ------w- c:\windows\system32\inetcpl.cpl 2010-11-03 12:25 . 2008-04-14 12:00 385024 ----a-w- c:\windows\system32\html.iec 2010-11-02 15:17 . 2008-04-14 12:00 40960 ----a-w- c:\windows\system32\drivers\ndproxy.sys 2010-10-29 19:37 . 2010-08-10 05:44 60416 ----a-w- c:\windows\ALCFDRTM.VER 2010-10-28 13:13 . 2008-04-14 12:00 290048 ----a-w- c:\windows\system32\atmfd.dll 2010-10-26 13:25 . 2008-04-14 12:00 1853312 ----a-w- c:\windows\system32\win32k.sys 2010-10-16 18:55 . 2010-11-11 14:02 888424 ----a-w- c:\windows\system32\nvdispco32.dll 2010-10-16 18:55 . 2010-11-11 14:02 813672 ----a-w- c:\windows\system32\nvgenco32.dll 2010-10-16 18:55 . 2010-11-11 14:02 61440 ----a-w- c:\windows\system32\OpenCL.dll 2010-10-16 18:55 . 2010-11-11 14:02 4882432 ----a-w- c:\windows\system32\nvcuda.dll 2010-10-16 18:55 . 2010-11-11 14:02 2932840 ----a-w- c:\windows\system32\nvcuvid.dll 2010-10-16 18:55 . 2010-11-11 14:02 2666600 ----a-w- c:\windows\system32\nvcuvenc.dll 2010-10-16 18:55 . 2010-11-11 14:02 13012992 ----a-w- c:\windows\system32\nvcompiler.dll 2010-10-16 18:55 . 2005-10-17 02:31 9623680 ----a-w- c:\windows\system32\drivers\nv4_mini.sys 2010-10-16 18:55 . 2005-10-17 02:31 6359552 ----a-w- c:\windows\system32\nv4_disp.dll 2010-10-16 18:55 . 2005-10-17 02:31 1462272 ----a-w- c:\windows\system32\nvapi.dll 2010-10-16 18:55 . 2005-10-17 02:31 14532608 ----a-w- c:\windows\system32\nvoglnt.dll 2010-10-16 10:04 . 2010-10-16 10:04 81920 ----a-w- c:\windows\system32\nvwddi.dll 2010-10-16 10:04 . 2010-10-16 10:04 277608 ----a-w- c:\windows\system32\nvmccs.dll 2010-10-16 10:04 . 2010-10-16 10:04 13851752 ----a-w- c:\windows\system32\nvcpl.dll 2010-10-16 10:04 . 2010-10-16 10:04 110696 ----a-w- c:\windows\system32\nvmctray.dll 2010-10-16 10:04 . 2010-10-16 10:04 156776 ----a-w- c:\windows\system32\nvsvc32.exe 2010-10-16 10:04 . 2010-10-16 10:04 145000 ----a-w- c:\windows\system32\nvcolor.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}"= "c:\program files\uTorrentBar\tbuTo1.dll" [2010-12-30 3911776] [HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}] 2010-12-30 14:10 3911776 ----a-w- c:\program files\ConduitEngine\ConduitEngin0.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}] 2010-12-30 14:10 3911776 ----a-w- c:\program files\uTorrentBar\tbuTo1.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}] 2010-09-28 20:44 1400712 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}"= "c:\program files\uTorrentBar\tbuTo1.dll" [2010-12-30 3911776] "{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files\ConduitEngine\ConduitEngin0.dll" [2010-12-30 3911776] "{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-09-28 1400712] [HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}] [HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}] [HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1] [HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] "{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-09-28 1400712] "{BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC}"= "c:\program files\uTorrentBar\tbuTo1.dll" [2010-12-30 3911776] [HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1] [HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd] [HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2010-12-13 395640] "DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMan"="SOUNDMAN.EXE" [2005-10-24 90112] "ZSSnp211"="c:\windows\ZSSnp211.exe" [2007-04-06 57344] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-10-16 110696] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-10-16 13851752] "egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2010-11-04 2219184] "Domino"="c:\windows\Domino.exe" [2006-08-18 49152] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ \0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] @="Driver" HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nokia FastStart HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaMServer [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM] 2010-09-20 21:07 932288 ----a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] 2010-09-23 02:47 35760 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount] 2007-12-22 07:23 221568 ----a-w- c:\program files\Alcohol Soft\Alcohol 120\AxCmd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Bonus.SSR.FR10] 2010-10-08 00:15 941320 ----a-w- c:\program files\ABBYY FineReader 10\Bonus.ScreenshotReader.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate] 2010-09-16 20:04 1164584 ----a-w- c:\program files\DivX\DivX Update\DivXUpdate.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup] 2005-08-11 16:30 249856 ----a-w- c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler] 2005-08-11 16:30 81920 ----a-w- c:\program files\Common Files\InstallShield\UpdateService\issch.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] 2009-06-05 11:39 292136 ----a-w- c:\program files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] 2008-04-14 12:42 1695232 ------w- c:\program files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] 2010-08-25 22:12 1753192 ----a-w- c:\program files\NVIDIA Corporation\nView\nwiz.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] 2010-11-29 15:38 421888 ----a-w- c:\program files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] 2010-05-14 09:44 248552 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent] 2010-12-13 11:40 395640 ----a-w- c:\program files\uTorrent\uTorrent.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [07.7.2010 г. 11:14 436792] R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [29.7.2010 г. 12:31 115008] R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [03.8.2010 г. 12:28 95896] R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [04.11.2010 г. 17:15 810144] R2 LGScsiCommandService;LG SCSI command service;c:\windows\system32\LGScsiCommandService.exe [04.11.2010 г. 13:45 47616] S2 gupdate;Услуга Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [21.10.2010 г. 19:00 135664] S2 RCService;RCService;c:\program files\gigabyte\RCService\RCService.exe [26.4.2006 г. 08:47 538624] S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\MAGIX\Common\Database\bin\fbserver.exe [04.8.2010 г. 02:14 1527900] S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [06.1.2011 г. 12:41 38224] S3 vvftav211;vvftav211;c:\windows\system32\drivers\vvftav211.sys [11.7.2010 г. 03:44 480128] S3 ZSMC30x;USB PC Camera Service ZSMC30x;c:\windows\system32\drivers\ZS211.sys [11.7.2010 г. 03:44 1537024] . Contents of the 'Scheduled Tasks' folder 2011-01-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-10-21 16:59] 2011-01-08 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-10-21 16:59] 2011-01-08 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job - c:\program files\Ask.com\UpdateTask.exe [2010-09-28 20:44] 2011-01-08 c:\windows\Tasks\WGASetup.job - c:\windows\system32\KB905474\wgasetup.exe [2010-07-07 05:18] . . ------- Supplementary Scan ------- . uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2786678 uInternet Settings,ProxyOverride = *.local IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 TCP: {3B222CFD-7437-4250-AFD4-EFD9779BACF9} = 84.238.155.65,84.238.0.0 DPF: {E6F480FC-BD44-4CBA-B74A-89AF7842937D} - hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_cyri_4.3.1.0.cab . - - - - ORPHANS REMOVED - - - - HKLM-Run-SunJavaUpdateSched - c:\program files\Java\jre6\bin\jusched.exe ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2011-01-08 10:27 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\Shell\B20@O=5 *=0 *C*C*l*e*a*n*e*r*& \command] @="c:\\Program Files\\CCleaner\\ccleaner.exe" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . Completion time: 2011-01-08 10:30:25 ComboFix-quarantined-files.txt 2011-01-08 08:30 Pre-Run: 9 279 709 184 bytes free Post-Run: 9 242 972 160 bytes free WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe - - End Of File - - B5D7AFDE72B99991808C8C9877B22CE3 Това е лога дето ми се отвори автоматично! А за C:\BUG.txt това не се намира на местоположението! ComboFix 11-01-07.01 - stefan 01.2011 г. 10:20:08.1.1 - x86 Microsoft Windows XP Professional 5.1.2600.3.1251.359.1033.18.447.179 [GMT 2:00] Running from: c:\documents and settings\stefan\Desktop\ComboFix.exe AV: ESET NOD32 Antivirus 4.2 *Disabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0} WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\stefan\Application Data\inst.exe c:\documents and settings\stefan\Application Data\PriceGong c:\documents and settings\stefan\Application Data\PriceGong\Data\1.xml c:\documents and settings\stefan\Application Data\PriceGong\Data\a.xml c:\documents and settings\stefan\Application Data\PriceGong\Data\b.xml c:\documents and settings\stefan\Application Data\PriceGong\Data\c.xml c:\documents and settings\stefan\Application Data\PriceGong\Data\d.xml c:\documents and settings\stefan\Application Data\PriceGong\Data\e.xml c:\documents and settings\stefan\Application Data\PriceGong\Data\f.xml c:\documents and settings\stefan\Application Data\PriceGong\Data\g.xml c:\documents and settings\stefan\Application Data\PriceGong\Data\h.xml c:\documents and settings\stefan\Application Data\PriceGong\Data\i.xml c:\documents and settings\stefan\Application Data\PriceGong\Data\J.xml c:\documents and settings\stefan\Application Data\PriceGong\Data\k.xml c:\documents and settings\stefan\Application Data\PriceGong\Data\l.xml c:\documents and settings\stefan\Application Data\PriceGong\Data\m.xml c:\documents and settings\stefan\Application Data\PriceGong\Data\mru.xml c:\documents and settings\stefan\Application Data\PriceGong\Data\n.xml c:\documents and settings\stefan\Application Data\PriceGong\Data\o.xml c:\documents and settings\stefan\Application Data\PriceGong\Data\p.xml c:\documents and settings\stefan\Application Data\PriceGong\Data\q.xml c:\documents and settings\stefan\Application Data\PriceGong\Data\r.xml c:\documents and settings\stefan\Application Data\PriceGong\Data\s.xml c:\documents and settings\stefan\Application Data\PriceGong\Data\t.xml c:\documents and settings\stefan\Application Data\PriceGong\Data\u.xml c:\documents and settings\stefan\Application Data\PriceGong\Data\v.xml c:\documents and settings\stefan\Application Data\PriceGong\Data\w.xml c:\documents and settings\stefan\Application Data\PriceGong\Data\x.xml c:\documents and settings\stefan\Application Data\PriceGong\Data\y.xml c:\documents and settings\stefan\Application Data\PriceGong\Data\z.xml c:\documents and settings\stefan\My Documents\BackupRegistry(20101215).reg c:\documents and settings\stefan\My Documents\BackupRegistry(20101230).reg . ((((((((((((((((((((((((( Files Created from 2010-12-08 to 2011-01-08 ))))))))))))))))))))))))))))))) . 2011-01-08 07:04 . 2011-01-08 07:04 389120 ----a-w- c:\windows\system32\CF24953.exe 2011-01-07 17:26 . 2011-01-07 17:33 -------- d-----w- c:\documents and settings\stefan\Application Data\OpenOffice.org2 2011-01-07 17:24 . 2011-01-07 17:37 -------- d-----w- c:\program files\OpenOffice.org 2.3 2011-01-06 14:45 . 2011-01-06 14:45 -------- d-----w- c:\program files\trend micro 2011-01-06 10:42 . 2011-01-06 10:42 -------- d-----w- c:\documents and settings\stefan\Application Data\Malwarebytes 2011-01-06 10:41 . 2010-12-20 16:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2011-01-06 10:41 . 2011-01-06 10:41 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes 2011-01-06 10:41 . 2011-01-06 10:41 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2011-01-06 10:41 . 2010-12-20 16:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys 2011-01-04 14:45 . 2011-01-04 14:45 -------- d-----w- c:\program files\Subtitles 2011-01-04 14:42 . 2011-01-04 14:43 -------- d-----w- c:\documents and settings\stefan\Application Data\GetRightToGo 2011-01-02 14:15 . 2011-01-02 14:31 -------- d-----w- c:\program files\Tomb Raider - Anniversary 2011-01-01 16:31 . 2011-01-01 16:31 -------- d-----w- c:\documents and settings\All Users\Application Data\ESET 2011-01-01 15:56 . 2011-01-07 17:22 -------- d-----w- c:\program files\Common Files\Java 2011-01-01 15:56 . 2011-01-01 15:56 73728 ----a-w- c:\windows\system32\javacpl.cpl 2011-01-01 13:42 . 2011-01-01 13:42 -------- d-----w- c:\program files\CCleaner 2010-12-28 15:07 . 2010-12-28 16:02 -------- d-----w- c:\documents and settings\All Users\Application Data\FarmFrenzy3_Arctica 2010-12-28 15:07 . 2010-12-28 15:07 -------- d-----w- c:\program files\LeeGTs Games 2010-12-28 13:08 . 2010-12-28 15:01 -------- d-----w- c:\documents and settings\All Users\Application Data\Islands 2010-12-28 13:07 . 2010-12-28 13:07 -------- d-----w- c:\program files\Cybertek Games 2010-12-22 17:44 . 2010-12-22 17:44 -------- d-----w- c:\documents and settings\stefan\Local Settings\Application Data\TimeParadox 2010-12-21 21:20 . 2010-12-21 21:20 -------- d-----w- c:\documents and settings\stefan\Application Data\freshgames 2010-12-21 21:20 . 2010-12-21 21:20 -------- d-----w- c:\documents and settings\All Users\Application Data\freshgames 2010-12-18 14:54 . 2010-12-18 15:27 -------- d-----w- c:\program files\vloader-bg 2010-12-18 14:38 . 2010-12-18 15:04 -------- d-----w- c:\program files\vloader 2010-12-17 17:34 . 2010-12-27 18:29 -------- d-----w- c:\program files\LucasArts 2010-12-17 10:47 . 2010-12-17 10:47 -------- d-----w- c:\program files\iPod 2010-12-16 14:38 . 2010-12-16 14:38 -------- d-----w- c:\program files\Apple Software Update 2010-12-16 14:20 . 2010-12-17 10:47 -------- d-----w- c:\program files\iTunes 2010-12-16 12:01 . 2010-12-16 12:02 -------- d-----w- c:\documents and settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521} 2010-12-16 11:33 . 2011-01-05 18:11 -------- d-----w- c:\documents and settings\stefan\Local Settings\Application Data\AskToolbar 2010-12-15 19:39 . 2010-12-15 19:40 -------- d-----w- c:\documents and settings\stefan\UI 2010-12-15 13:52 . 2010-12-15 13:52 -------- d-----w- c:\program files\Ask.com 2010-12-15 04:55 . 2010-11-06 00:26 11080704 -c----w- c:\windows\system32\dllcache\ieframe.dll 2010-12-15 04:54 . 2010-11-02 15:17 40960 -c----w- c:\windows\system32\dllcache\ndproxy.sys 2010-12-15 04:53 . 2010-10-11 14:59 45568 -c----w- c:\windows\system32\dllcache\wab.exe 2010-12-14 17:21 . 2010-12-14 17:21 -------- d-----w- c:\documents and settings\stefan\Application Data\Silverback Productions 2010-12-14 16:41 . 2010-12-14 16:43 -------- d-----w- c:\documents and settings\stefan\Application Data\Vso 2010-12-14 16:41 . 2010-12-14 16:42 94208 ----a-w- c:\documents and settings\stefan\Application Data\ezplay.sys 2010-12-14 16:41 . 2010-12-14 16:41 94208 ----a-w- c:\windows\system32\drivers\ezplay.sys 2010-12-14 11:45 . 2010-12-14 11:45 -------- d-----w- c:\program files\Alcohol Soft 2010-12-13 14:52 . 2010-12-28 19:48 -------- d-----w- c:\program files\Worms 4 Mayhem 2010-12-13 11:44 . 2010-12-15 11:17 -------- d-----w- c:\documents and settings\stefan\Local Settings\Application Data\Conduit 2010-12-13 11:44 . 2010-12-13 11:44 -------- d-----w- c:\program files\Conduit 2010-12-13 11:44 . 2010-12-15 11:18 -------- d-----w- c:\documents and settings\stefan\Local Settings\Application Data\uTorrentBar 2010-12-13 11:43 . 2010-12-30 14:10 -------- d-----w- c:\program files\uTorrentBar 2010-12-13 11:43 . 2010-12-13 11:43 -------- d-----w- C:\extensions 2010-12-13 11:38 . 2010-12-13 11:45 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Temp 2010-12-09 14:53 . 2010-12-09 14:53 -------- d-----w- c:\program files\Ambient Design . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-01-01 15:56 . 2010-07-09 05:15 472808 ----a-w- c:\windows\system32\deployJava1.dll 2010-12-14 11:43 . 2010-07-07 09:14 436792 ----a-w- c:\windows\system32\drivers\sptd.sys 2010-11-29 15:38 . 2010-11-29 15:38 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx 2010-11-29 15:38 . 2010-11-29 15:38 69632 ----a-w- c:\windows\system32\QuickTime.qts 2010-11-18 18:12 . 2010-07-07 18:21 81920 ----a-w- c:\windows\system32\isign32.dll 2010-11-06 00:26 . 2008-04-14 12:00 916480 ----a-w- c:\windows\system32\wininet.dll 2010-11-06 00:26 . 2008-04-14 12:00 43520 ----a-w- c:\windows\system32\licmgr10.dll 2010-11-06 00:26 . 2008-04-14 12:00 1469440 ------w- c:\windows\system32\inetcpl.cpl 2010-11-03 12:25 . 2008-04-14 12:00 385024 ----a-w- c:\windows\system32\html.iec 2010-11-02 15:17 . 2008-04-14 12:00 40960 ----a-w- c:\windows\system32\drivers\ndproxy.sys 2010-10-29 19:37 . 2010-08-10 05:44 60416 ----a-w- c:\windows\ALCFDRTM.VER 2010-10-28 13:13 . 2008-04-14 12:00 290048 ----a-w- c:\windows\system32\atmfd.dll 2010-10-26 13:25 . 2008-04-14 12:00 1853312 ----a-w- c:\windows\system32\win32k.sys 2010-10-16 18:55 . 2010-11-11 14:02 888424 ----a-w- c:\windows\system32\nvdispco32.dll 2010-10-16 18:55 . 2010-11-11 14:02 813672 ----a-w- c:\windows\system32\nvgenco32.dll 2010-10-16 18:55 . 2010-11-11 14:02 61440 ----a-w- c:\windows\system32\OpenCL.dll 2010-10-16 18:55 . 2010-11-11 14:02 4882432 ----a-w- c:\windows\system32\nvcuda.dll 2010-10-16 18:55 . 2010-11-11 14:02 2932840 ----a-w- c:\windows\system32\nvcuvid.dll 2010-10-16 18:55 . 2010-11-11 14:02 2666600 ----a-w- c:\windows\system32\nvcuvenc.dll 2010-10-16 18:55 . 2010-11-11 14:02 13012992 ----a-w- c:\windows\system32\nvcompiler.dll 2010-10-16 18:55 . 2005-10-17 02:31 9623680 ----a-w- c:\windows\system32\drivers\nv4_mini.sys 2010-10-16 18:55 . 2005-10-17 02:31 6359552 ----a-w- c:\windows\system32\nv4_disp.dll 2010-10-16 18:55 . 2005-10-17 02:31 1462272 ----a-w- c:\windows\system32\nvapi.dll 2010-10-16 18:55 . 2005-10-17 02:31 14532608 ----a-w- c:\windows\system32\nvoglnt.dll 2010-10-16 10:04 . 2010-10-16 10:04 81920 ----a-w- c:\windows\system32\nvwddi.dll 2010-10-16 10:04 . 2010-10-16 10:04 277608 ----a-w- c:\windows\system32\nvmccs.dll 2010-10-16 10:04 . 2010-10-16 10:04 13851752 ----a-w- c:\windows\system32\nvcpl.dll 2010-10-16 10:04 . 2010-10-16 10:04 110696 ----a-w- c:\windows\system32\nvmctray.dll 2010-10-16 10:04 . 2010-10-16 10:04 156776 ----a-w- c:\windows\system32\nvsvc32.exe 2010-10-16 10:04 . 2010-10-16 10:04 145000 ----a-w- c:\windows\system32\nvcolor.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}"= "c:\program files\uTorrentBar\tbuTo1.dll" [2010-12-30 3911776] [HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}] 2010-12-30 14:10 3911776 ----a-w- c:\program files\ConduitEngine\ConduitEngin0.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}] 2010-12-30 14:10 3911776 ----a-w- c:\program files\uTorrentBar\tbuTo1.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}] 2010-09-28 20:44 1400712 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}"= "c:\program files\uTorrentBar\tbuTo1.dll" [2010-12-30 3911776] "{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files\ConduitEngine\ConduitEngin0.dll" [2010-12-30 3911776] "{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-09-28 1400712] [HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}] [HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}] [HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1] [HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] "{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-09-28 1400712] "{BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC}"= "c:\program files\uTorrentBar\tbuTo1.dll" [2010-12-30 3911776] [HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1] [HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd] [HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2010-12-13 395640] "DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMan"="SOUNDMAN.EXE" [2005-10-24 90112] "ZSSnp211"="c:\windows\ZSSnp211.exe" [2007-04-06 57344] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-10-16 110696] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-10-16 13851752] "egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2010-11-04 2219184] "Domino"="c:\windows\Domino.exe" [2006-08-18 49152] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ \0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] @="Driver" HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nokia FastStart HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaMServer [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM] 2010-09-20 21:07 932288 ----a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] 2010-09-23 02:47 35760 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount] 2007-12-22 07:23 221568 ----a-w- c:\program files\Alcohol Soft\Alcohol 120\AxCmd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Bonus.SSR.FR10] 2010-10-08 00:15 941320 ----a-w- c:\program files\ABBYY FineReader 10\Bonus.ScreenshotReader.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate] 2010-09-16 20:04 1164584 ----a-w- c:\program files\DivX\DivX Update\DivXUpdate.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup] 2005-08-11 16:30 249856 ----a-w- c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler] 2005-08-11 16:30 81920 ----a-w- c:\program files\Common Files\InstallShield\UpdateService\issch.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] 2009-06-05 11:39 292136 ----a-w- c:\program files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] 2008-04-14 12:42 1695232 ------w- c:\program files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] 2010-08-25 22:12 1753192 ----a-w- c:\program files\NVIDIA Corporation\nView\nwiz.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] 2010-11-29 15:38 421888 ----a-w- c:\program files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] 2010-05-14 09:44 248552 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent] 2010-12-13 11:40 395640 ----a-w- c:\program files\uTorrent\uTorrent.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [07.7.2010 г. 11:14 436792] R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [29.7.2010 г. 12:31 115008] R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [03.8.2010 г. 12:28 95896] R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [04.11.2010 г. 17:15 810144] R2 LGScsiCommandService;LG SCSI command service;c:\windows\system32\LGScsiCommandService.exe [04.11.2010 г. 13:45 47616] S2 gupdate;Услуга Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [21.10.2010 г. 19:00 135664] S2 RCService;RCService;c:\program files\gigabyte\RCService\RCService.exe [26.4.2006 г. 08:47 538624] S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\MAGIX\Common\Database\bin\fbserver.exe [04.8.2010 г. 02:14 1527900] S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [06.1.2011 г. 12:41 38224] S3 vvftav211;vvftav211;c:\windows\system32\drivers\vvftav211.sys [11.7.2010 г. 03:44 480128] S3 ZSMC30x;USB PC Camera Service ZSMC30x;c:\windows\system32\drivers\ZS211.sys [11.7.2010 г. 03:44 1537024] . Contents of the 'Scheduled Tasks' folder 2011-01-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-10-21 16:59] 2011-01-08 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-10-21 16:59] 2011-01-08 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job - c:\program files\Ask.com\UpdateTask.exe [2010-09-28 20:44] 2011-01-08 c:\windows\Tasks\WGASetup.job - c:\windows\system32\KB905474\wgasetup.exe [2010-07-07 05:18] . . ------- Supplementary Scan ------- . uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2786678 uInternet Settings,ProxyOverride = *.local IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 TCP: {3B222CFD-7437-4250-AFD4-EFD9779BACF9} = 84.238.155.65,84.238.0.0 DPF: {E6F480FC-BD44-4CBA-B74A-89AF7842937D} - hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_cyri_4.3.1.0.cab . - - - - ORPHANS REMOVED - - - - HKLM-Run-SunJavaUpdateSched - c:\program files\Java\jre6\bin\jusched.exe ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2011-01-08 10:27 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\Shell\B20@O=5 *=0 *C*C*l*e*a*n*e*r*& \command] @="c:\\Program Files\\CCleaner\\ccleaner.exe" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . Completion time: 2011-01-08 10:30:25 ComboFix-quarantined-files.txt 2011-01-08 08:30 Pre-Run: 9 279 709 184 bytes free Post-Run: 9 242 972 160 bytes free WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe - - End Of File - - B5D7AFDE72B99991808C8C9877B22CE3

Докато преглеждам лога ви направете следното:

• Изтеглете Security Check (автор: screen317) от тук или от тук и го запишете на десктопа.
• Кликнете два пъти върху SecurityCheck.exe и следвайте инструкциите.
• Когато програмата завърши работата си, ще се отвори един текстов документ: checkup.txt.
• Копирайте съдържанието с Копирай (Copy) на checkup.txt и с Постави (Paste) го поставете в следващия си коментар.

Копирайте текста в карето на notepad и го запазваш с име CFScript.txt на десктопа си:

KILLALL::

file:
c:\windows\system32\CF24953.exe

registry::
[-HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
[-HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]

След съхранението премести CFScript.txt на иконата на ComboFix.exe

Генерирания рапорт прикачете в следващия си пост..!

Results of screen317's Security Check version 0.99.8

Windows XP Service Pack 3

Internet Explorer 8

``````````````````````````````

Antivirus/Firewall Check:

Windows Firewall Disabled!

ESET NOD32 Antivirus

Antivirus up to date!

```````````````````````````````

Anti-malware/Other Utilities Check:

Malwarebytes' Anti-Malware

CCleaner

Java 6 Update 22

Java 6 Update 2

Out of date Java installed!

Adobe Flash Player 10.1.85.3

Adobe Reader 9.4.1

Out of date Adobe Reader installed!

````````````````````````````````

Process Check:

objlist.exe by Laurent

``````````End of Log````````````

Какво е състонието на системата ви..?Не виждам активни зарази...!

Изпълнихте ли скрипта ...Не виждам лога..?

1. Инсталирайте последната версия: Java SE Runtime Environment 6 Update 23 .

2. Обновете Adobe Reader до последната версия, ето линк. След обновяването стартирайте Adobe Reader и се съгласете с условията за използване.

ComboFix 11-01-07.01 - stefan 01.2011 г. 12:37:12.2.1 - x86 Microsoft Windows XP Professional 5.1.2600.3.1251.359.1033.18.447.137 [GMT 2:00] Running from: c:\documents and settings\stefan\Desktop\ComboFix.exe Command switches used :: c:\documents and settings\stefan\Desktop\CFScript.txt AV: ESET NOD32 Antivirus 4.2 *Disabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0} WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! . ((((((((((((((((((((((((( Files Created from 2010-12-08 to 2011-01-08 ))))))))))))))))))))))))))))))) . 2011-01-08 07:04 . 2011-01-08 07:04 389120 ----a-w- c:\windows\system32\CF24953.exe 2011-01-07 17:26 . 2011-01-07 17:33 -------- d-----w- c:\documents and settings\stefan\Application Data\OpenOffice.org2 2011-01-07 17:24 . 2011-01-07 17:37 -------- d-----w- c:\program files\OpenOffice.org 2.3 2011-01-06 14:45 . 2011-01-06 14:45 -------- d-----w- c:\program files\trend micro 2011-01-06 10:42 . 2011-01-06 10:42 -------- d-----w- c:\documents and settings\stefan\Application Data\Malwarebytes 2011-01-06 10:41 . 2010-12-20 16:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2011-01-06 10:41 . 2011-01-06 10:41 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes 2011-01-06 10:41 . 2011-01-06 10:41 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2011-01-06 10:41 . 2010-12-20 16:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys 2011-01-04 14:45 . 2011-01-04 14:45 -------- d-----w- c:\program files\Subtitles 2011-01-04 14:42 . 2011-01-04 14:43 -------- d-----w- c:\documents and settings\stefan\Application Data\GetRightToGo 2011-01-02 14:15 . 2011-01-02 14:31 -------- d-----w- c:\program files\Tomb Raider - Anniversary 2011-01-01 16:31 . 2011-01-01 16:31 -------- d-----w- c:\documents and settings\All Users\Application Data\ESET 2011-01-01 15:56 . 2011-01-07 17:22 -------- d-----w- c:\program files\Common Files\Java 2011-01-01 15:56 . 2011-01-01 15:56 73728 ----a-w- c:\windows\system32\javacpl.cpl 2011-01-01 13:42 . 2011-01-01 13:42 -------- d-----w- c:\program files\CCleaner 2010-12-28 15:07 . 2010-12-28 16:02 -------- d-----w- c:\documents and settings\All Users\Application Data\FarmFrenzy3_Arctica 2010-12-28 15:07 . 2010-12-28 15:07 -------- d-----w- c:\program files\LeeGTs Games 2010-12-28 13:08 . 2010-12-28 15:01 -------- d-----w- c:\documents and settings\All Users\Application Data\Islands 2010-12-28 13:07 . 2010-12-28 13:07 -------- d-----w- c:\program files\Cybertek Games 2010-12-22 17:44 . 2010-12-22 17:44 -------- d-----w- c:\documents and settings\stefan\Local Settings\Application Data\TimeParadox 2010-12-21 21:20 . 2010-12-21 21:20 -------- d-----w- c:\documents and settings\stefan\Application Data\freshgames 2010-12-21 21:20 . 2010-12-21 21:20 -------- d-----w- c:\documents and settings\All Users\Application Data\freshgames 2010-12-18 14:54 . 2010-12-18 15:27 -------- d-----w- c:\program files\vloader-bg 2010-12-18 14:38 . 2010-12-18 15:04 -------- d-----w- c:\program files\vloader 2010-12-17 17:34 . 2010-12-27 18:29 -------- d-----w- c:\program files\LucasArts 2010-12-17 10:47 . 2010-12-17 10:47 -------- d-----w- c:\program files\iPod 2010-12-16 14:38 . 2010-12-16 14:38 -------- d-----w- c:\program files\Apple Software Update 2010-12-16 14:20 . 2010-12-17 10:47 -------- d-----w- c:\program files\iTunes 2010-12-16 12:01 . 2010-12-16 12:02 -------- d-----w- c:\documents and settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521} 2010-12-16 11:33 . 2011-01-05 18:11 -------- d-----w- c:\documents and settings\stefan\Local Settings\Application Data\AskToolbar 2010-12-15 19:39 . 2010-12-15 19:40 -------- d-----w- c:\documents and settings\stefan\UI 2010-12-15 13:52 . 2010-12-15 13:52 -------- d-----w- c:\program files\Ask.com 2010-12-15 04:55 . 2010-11-06 00:26 11080704 -c----w- c:\windows\system32\dllcache\ieframe.dll 2010-12-15 04:54 . 2010-11-02 15:17 40960 -c----w- c:\windows\system32\dllcache\ndproxy.sys 2010-12-15 04:53 . 2010-10-11 14:59 45568 -c----w- c:\windows\system32\dllcache\wab.exe 2010-12-14 17:21 . 2010-12-14 17:21 -------- d-----w- c:\documents and settings\stefan\Application Data\Silverback Productions 2010-12-14 16:41 . 2010-12-14 16:43 -------- d-----w- c:\documents and settings\stefan\Application Data\Vso 2010-12-14 16:41 . 2010-12-14 16:42 94208 ----a-w- c:\documents and settings\stefan\Application Data\ezplay.sys 2010-12-14 16:41 . 2010-12-14 16:41 94208 ----a-w- c:\windows\system32\drivers\ezplay.sys 2010-12-14 11:45 . 2010-12-14 11:45 -------- d-----w- c:\program files\Alcohol Soft 2010-12-13 14:52 . 2010-12-28 19:48 -------- d-----w- c:\program files\Worms 4 Mayhem 2010-12-13 11:44 . 2010-12-15 11:17 -------- d-----w- c:\documents and settings\stefan\Local Settings\Application Data\Conduit 2010-12-13 11:44 . 2010-12-13 11:44 -------- d-----w- c:\program files\Conduit 2010-12-13 11:44 . 2010-12-15 11:18 -------- d-----w- c:\documents and settings\stefan\Local Settings\Application Data\uTorrentBar 2010-12-13 11:43 . 2010-12-30 14:10 -------- d-----w- c:\program files\uTorrentBar 2010-12-13 11:43 . 2010-12-13 11:43 -------- d-----w- C:\extensions 2010-12-13 11:38 . 2010-12-13 11:45 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Temp 2010-12-09 14:53 . 2010-12-09 14:53 -------- d-----w- c:\program files\Ambient Design . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-01-01 15:56 . 2010-07-09 05:15 472808 ----a-w- c:\windows\system32\deployJava1.dll 2010-12-14 11:43 . 2010-07-07 09:14 436792 ----a-w- c:\windows\system32\drivers\sptd.sys 2010-11-29 15:38 . 2010-11-29 15:38 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx 2010-11-29 15:38 . 2010-11-29 15:38 69632 ----a-w- c:\windows\system32\QuickTime.qts 2010-11-18 18:12 . 2010-07-07 18:21 81920 ----a-w- c:\windows\system32\isign32.dll 2010-11-06 00:26 . 2008-04-14 12:00 916480 ----a-w- c:\windows\system32\wininet.dll 2010-11-06 00:26 . 2008-04-14 12:00 43520 ----a-w- c:\windows\system32\licmgr10.dll 2010-11-06 00:26 . 2008-04-14 12:00 1469440 ------w- c:\windows\system32\inetcpl.cpl 2010-11-03 12:25 . 2008-04-14 12:00 385024 ----a-w- c:\windows\system32\html.iec 2010-11-02 15:17 . 2008-04-14 12:00 40960 ----a-w- c:\windows\system32\drivers\ndproxy.sys 2010-10-29 19:37 . 2010-08-10 05:44 60416 ----a-w- c:\windows\ALCFDRTM.VER 2010-10-28 13:13 . 2008-04-14 12:00 290048 ----a-w- c:\windows\system32\atmfd.dll 2010-10-26 13:25 . 2008-04-14 12:00 1853312 ----a-w- c:\windows\system32\win32k.sys 2010-10-16 18:55 . 2010-11-11 14:02 888424 ----a-w- c:\windows\system32\nvdispco32.dll 2010-10-16 18:55 . 2010-11-11 14:02 813672 ----a-w- c:\windows\system32\nvgenco32.dll 2010-10-16 18:55 . 2010-11-11 14:02 61440 ----a-w- c:\windows\system32\OpenCL.dll 2010-10-16 18:55 . 2010-11-11 14:02 4882432 ----a-w- c:\windows\system32\nvcuda.dll 2010-10-16 18:55 . 2010-11-11 14:02 2932840 ----a-w- c:\windows\system32\nvcuvid.dll 2010-10-16 18:55 . 2010-11-11 14:02 2666600 ----a-w- c:\windows\system32\nvcuvenc.dll 2010-10-16 18:55 . 2010-11-11 14:02 13012992 ----a-w- c:\windows\system32\nvcompiler.dll 2010-10-16 18:55 . 2005-10-17 02:31 9623680 ----a-w- c:\windows\system32\drivers\nv4_mini.sys 2010-10-16 18:55 . 2005-10-17 02:31 6359552 ----a-w- c:\windows\system32\nv4_disp.dll 2010-10-16 18:55 . 2005-10-17 02:31 1462272 ----a-w- c:\windows\system32\nvapi.dll 2010-10-16 18:55 . 2005-10-17 02:31 14532608 ----a-w- c:\windows\system32\nvoglnt.dll 2010-10-16 10:04 . 2010-10-16 10:04 81920 ----a-w- c:\windows\system32\nvwddi.dll 2010-10-16 10:04 . 2010-10-16 10:04 277608 ----a-w- c:\windows\system32\nvmccs.dll 2010-10-16 10:04 . 2010-10-16 10:04 13851752 ----a-w- c:\windows\system32\nvcpl.dll 2010-10-16 10:04 . 2010-10-16 10:04 110696 ----a-w- c:\windows\system32\nvmctray.dll 2010-10-16 10:04 . 2010-10-16 10:04 156776 ----a-w- c:\windows\system32\nvsvc32.exe 2010-10-16 10:04 . 2010-10-16 10:04 145000 ----a-w- c:\windows\system32\nvcolor.exe . ((((((((((((((((((((((((((((( SnapShot@2011-01-08_08.27.35 ))))))))))))))))))))))))))))))))))))))))) . + 2011-01-08 10:46 . 2011-01-08 10:46 16384 c:\windows\temp\Perflib_Perfdata_c40.dat + 2011-01-08 10:46 . 2011-01-08 10:46 16384 c:\windows\temp\Perflib_Perfdata_274.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}] 2010-09-28 20:44 1400712 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-09-28 1400712] [HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1] [HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] "{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-09-28 1400712] [HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1] [HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2010-12-13 395640] "DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMan"="SOUNDMAN.EXE" [2005-10-24 90112] "ZSSnp211"="c:\windows\ZSSnp211.exe" [2007-04-06 57344] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-10-16 110696] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-10-16 13851752] "egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2010-11-04 2219184] "Domino"="c:\windows\Domino.exe" [2006-08-18 49152] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ \0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] @="Driver" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM] 2010-09-20 21:07 932288 ----a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] 2010-09-23 02:47 35760 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount] 2007-12-22 07:23 221568 ----a-w- c:\program files\Alcohol Soft\Alcohol 120\AxCmd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Bonus.SSR.FR10] 2010-10-08 00:15 941320 ----a-w- c:\program files\ABBYY FineReader 10\Bonus.ScreenshotReader.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate] 2010-09-16 20:04 1164584 ----a-w- c:\program files\DivX\DivX Update\DivXUpdate.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup] 2005-08-11 16:30 249856 ----a-w- c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler] 2005-08-11 16:30 81920 ----a-w- c:\program files\Common Files\InstallShield\UpdateService\issch.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] 2009-06-05 11:39 292136 ----a-w- c:\program files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] 2008-04-14 12:42 1695232 ------w- c:\program files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] 2010-08-25 22:12 1753192 ----a-w- c:\program files\NVIDIA Corporation\nView\nwiz.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] 2010-11-29 15:38 421888 ----a-w- c:\program files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] 2010-05-14 09:44 248552 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent] 2010-12-13 11:40 395640 ----a-w- c:\program files\uTorrent\uTorrent.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [07.7.2010 г. 11:14 436792] R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [29.7.2010 г. 12:31 115008] R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [03.8.2010 г. 12:28 95896] R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [04.11.2010 г. 17:15 810144] R2 LGScsiCommandService;LG SCSI command service;c:\windows\system32\LGScsiCommandService.exe [04.11.2010 г. 13:45 47616] R2 RCService;RCService;c:\program files\gigabyte\RCService\RCService.exe [26.4.2006 г. 08:47 538624] S2 gupdate;Услуга Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [21.10.2010 г. 19:00 135664] S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\MAGIX\Common\Database\bin\fbserver.exe [04.8.2010 г. 02:14 1527900] S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [06.1.2011 г. 12:41 38224] S3 vvftav211;vvftav211;c:\windows\system32\drivers\vvftav211.sys [11.7.2010 г. 03:44 480128] S3 ZSMC30x;USB PC Camera Service ZSMC30x;c:\windows\system32\drivers\ZS211.sys [11.7.2010 г. 03:44 1537024] . Contents of the 'Scheduled Tasks' folder 2011-01-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-10-21 16:59] 2011-01-08 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-10-21 16:59] 2011-01-08 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job - c:\program files\Ask.com\UpdateTask.exe [2010-09-28 20:44] 2011-01-08 c:\windows\Tasks\WGASetup.job - c:\windows\system32\KB905474\wgasetup.exe [2010-07-07 05:18] . . ------- Supplementary Scan ------- . uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2786678 uInternet Settings,ProxyOverride = *.local IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 TCP: {3B222CFD-7437-4250-AFD4-EFD9779BACF9} = 84.238.155.65,84.238.0.0 DPF: {E6F480FC-BD44-4CBA-B74A-89AF7842937D} - hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_cyri_4.3.1.0.cab . - - - - ORPHANS REMOVED - - - - URLSearchHooks-{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - (no file) BHO-{30F9B915-B755-4826-820B-08FBA6BD249D} - (no file) BHO-{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - (no file) Toolbar-{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - (no file) Toolbar-{30F9B915-B755-4826-820B-08FBA6BD249D} - (no file) WebBrowser-{BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} - (no file) ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2011-01-08 12:46 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\Shell\B20@O=5 *=0 *C*C*l*e*a*n*e*r*& \command] @="c:\\Program Files\\CCleaner\\ccleaner.exe" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'explorer.exe'(4064) c:\windows\system32\WININET.dll c:\windows\system32\ieframe.dll c:\windows\system32\webcheck.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . ------------------------ Other Running Processes ------------------------ . c:\windows\system32\nvsvc32.exe c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe c:\windows\SOUNDMAN.EXE c:\windows\system32\RUNDLL32.EXE c:\program files\Bonjour\mDNSResponder.exe c:\program files\Java\jre6\bin\jqs.exe c:\program files\CyberLink\Shared Files\RichVideo.exe c:\program files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe c:\windows\system32\wscntfy.exe c:\program files\Opera\opera.exe . ************************************************************************** . Completion time: 2011-01-08 12:50:32 - machine was rebooted ComboFix-quarantined-files.txt 2011-01-08 10:50 ComboFix2.txt 2011-01-08 08:30 Pre-Run: 9 360 474 112 bytes free Post-Run: 9 349 677 056 bytes free - - End Of File - - BEF5D2D8089683291D1DF882AF69D507

Деинсталирайте ComboFix:

Натиснете Start ==> Run ==> въведете командата Combofix /Uninstall ==> OK

Изтеглете OTCleanIt или от тук,стартирайте и натиснете Clean up

Имате ли още проблеми...?

Побърках малко в ИНТЕРНЕТ и забелязвам малка промяна!

Да разбирам ли че,всичко за сега е наред.....аз не виждам активни зарази ...?!?

Мерси за всичко!Може би забелязвам малка ама много малка промяна.Мисля че факта се дължи заради компютъра тъи като много е натоварен а е малко слаб.А може би и от фирмата е проблема дет съм си поръчал нета!Все пак мерси за всичко което направи!