Вижте тези процеси нормални ли са

svhost го има няколко пъти както и firefox. мисля че някой логва квото правя в пс-то и е undetected

MBAM:

Malwarebytes' Anti-Malware 1.50.1.1100

www.malwarebytes.org

Database version: 5890

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

2/27/2011 9:37:39 AM

mbam-log-2011-02-27 (09-37-39).txt

Scan type: Full scan (C:\|D:\|)

Objects scanned: 305620

Time elapsed: 37 minute(s), 4 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

DDS & Attach:

DDS:

DDS (Ver_10-12-12.02) - NTFSx86

Run by Insaneboy at 9:51:25.76 on ­Ґ¤Ґ«ї 02/27/2011

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_21

Microsoft Windows XP Professional 5.1.2600.3.1251.1.1033.18.2047.1344 [GMT -8:00]

AV: ESET NOD32 Antivirus 4.2 *Enabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

svchost.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

svchost.exe

C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\WINDOWS\system32\rundll32.exe

C:\Program Files\BitComet\BitComet.exe

C:\Program Files\Messenger\msmsgs.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\System32\svchost.exe -k HTTPFilter

C:\Documents and Settings\Insaneboy\Local Settings\Application Data\Google\Update\1.2.183.39\GoogleCrashHandler.exe

C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe

C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe

C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\system32\msiexec.exe

C:\Documents and Settings\Insaneboy\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.bigseekpro.com/hypercam/{DD2814B1-439C-4007-9DCC-07A75417A01E}

uSearch Page =

uSearch Bar =

uInternet Settings,ProxyOverride = *.local

uInternet Settings,ProxyServer = 168.216.36.1:8080

mSearchAssistant =

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: BitComet Helper: {39f7e362-828a-4b5a-bcaf-5b79bfdfea60} - c:\program files\bitcomet\tools\BitCometBHO_1.2.8.7.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

BHO: SMTTB2009 Class: {fcbccb87-9224-4b8d-b117-f56d924beb18} - c:\program files\hyprecam toolbar\tbcore3.dll

TB: DAEMON Tools Toolbar: {32099aac-c132-4136-9e9a-4e364a424e17} - c:\program files\daemon tools toolbar\DTToolbar.dll

TB: HypreCam Toolbar: {338b4dfe-2e2c-4338-9e41-e176d497299e} - c:\program files\hyprecam toolbar\tbcore3.dll

uRun: [bitComet] "c:\program files\bitcomet\BitComet.exe" /tray

uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background

uRun: [Google Update] "c:\documents and settings\insaneboy\local settings\application data\google\update\GoogleUpdate.exe" /c

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRun: [DAEMON Tools Lite] "c:\program files\daemon tools lite\daemon.exe" -autorun

uRun: [PC Suite Tray] "c:\program files\nokia\nokia pc suite 7\PCSuite.exe" -onlytray

uRun: [WeatherClock] c:\program files\weather clock\WeatherClock.exe

uRun: [Taskbar Shuffle] c:\program files\taskbar shuffle\taskbarshuffle.exe

uRun: [ViGlance] c:\program files\viglance\ViGlance.exe

uRun: [skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized

uRun: [HKCU] c:\windows\system32\divxplayer.exe

mRun: [bluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent

mRun: [HKLM] c:\windows\system32\divxplayer.exe

mRunOnce: [Malwarebytes' Anti-Malware] c:\program files\malwarebytes' anti-malware\mbamgui.exe /install /silent

uExplorerRun: [Policies] c:\windows\system32\divxplayer.exe

mExplorerRun: [Policies] c:\windows\system32\divxplayer.exe

StartupFolder: c:\docume~1\insane~1\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe

StartupFolder: c:\docume~1\insane~1\startm~1\programs\startup\esetno~1.lnk - c:\program files\eset\eset nod32 antivirus\egui.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\esetno~1.lnk - c:\program files\eset\eset nod32 antivirus\egui.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\flexty~1.lnk - c:\program files\datecs\flextype 2k\FType2K.exe

IE: &С&валяне &с BitComet - c:\program files\bitcomet\BitComet.exe/AddLink.htm

IE: &С&валяне всички видео с BitComet - c:\program files\bitcomet\BitComet.exe/AddVideo.htm

IE: &С&валяне всички с BitComet - c:\program files\bitcomet\BitComet.exe/AddAllLink.htm

IE: E&xport to Microsoft Excel - c:\progra~1\mi1933~1\office11\EXCEL.EXE/3000

IE: {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://c:\program files\bitcomet\tools\BitCometBHO_1.2.8.7.dll/206

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\mi1933~1\office11\REFIEBAR.DLL

DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL

Notify: AtiExtEvent - Ati2evxx.dll

mASetup: {PE0O0826-CY11-JA5W-838G-C3353E65153W} - c:\windows\system32\vb2008source.exe Restart

mASetup: {V5NAM4N0-Y12E-425C-53D0-88W7JF6LQTI7} - c:\windows\system32\divxplayer.exe

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\insane~1\applic~1\mozilla\firefox\profiles\upnk4r34.default\

FF - prefs.js: browser.search.selectedEngine - BigSeekPro

FF - prefs.js: browser.startup.homepage - hxxp://www.php-proxy.net/index.php?q=aHR0cDovL3phbXVuZGEubmV0L2Jyb3dzZS5waHA%3D

FF - prefs.js: network.proxy.type - 0

FF - plugin: c:\documents and settings\insaneboy\local settings\application data\google\update\1.2.183.39\npGoogleOneClick8.dll

FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}

FF - Ext: Easy Youtube Video Downloader: {c0c9a2c7-2e5c-4447-bc53-97718bc91e1b} - %profile%\extensions\{c0c9a2c7-2e5c-4447-bc53-97718bc91e1b}

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}

FF - Ext: Java Quick Starter: [email protected] - c:\program files\java\jre6\lib\deploy\jqs\ff

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension

============= SERVICES / DRIVERS ===============

R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [2010-7-29 115008]

R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2010-8-3 95896]

R2 ekrn;ESET Service;c:\program files\eset\eset nod32 antivirus\ekrn.exe [2010-8-12 810144]

RUnknown DwProt;DwProt; [x]

S3 ATICDSDr;ATICDSDr;\??\e:\install pack\bin\atiicdxx.sys --> e:\install pack\bin\atiicdxx.sys [?]

S4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\microsoft sql server\100\shared\sqladhlp.exe [2008-7-10 47128]

S4 RsFx0102;RsFx0102 Driver;c:\windows\system32\drivers\RsFx0102.sys [2008-7-10 242712]

S4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files\microsoft sql server\mssql10.sqlexpress\mssql\binn\SQLAGENT.EXE [2008-7-10 369688]

=============== Created Last 30 ================

2011-02-27 05:14:24 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2011-02-27 05:14:21 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-02-27 05:14:20 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2011-02-24 15:13:18 -------- d-----w- c:\docume~1\insane~1\locals~1\applic~1\Temporary Projects

2011-02-19 04:36:08 -------- d-----w- c:\docume~1\insane~1\locals~1\applic~1\Aspyr

2011-02-18 23:13:34 -------- d-----w- C:\ime na papkata

2011-02-05 06:58:21 -------- d-----w- c:\program files\viewet

2011-02-04 17:41:32 -------- d-----w- c:\docume~1\insane~1\applic~1\f-secure

==================== Find3M ====================

2011-01-21 14:44:37 439296 ----a-w- c:\windows\system32\shimgvw.dll

2011-01-07 14:09:02 290048 ----a-w- c:\windows\system32\atmfd.dll

2010-12-31 13:10:33 1854976 ----a-w- c:\windows\system32\win32k.sys

2010-12-22 12:34:28 301568 ----a-w- c:\windows\system32\kerberos.dll

2010-12-20 23:59:20 916480 ----a-w- c:\windows\system32\wininet.dll

2010-12-20 23:59:19 43520 ----a-w- c:\windows\system32\licmgr10.dll

2010-12-20 23:59:19 1469440 ----a-w- c:\windows\system32\inetcpl.cpl

2010-12-20 17:26:00 730112 ----a-w- c:\windows\system32\lsasrv.dll

2010-12-20 12:55:26 385024 ----a-w- c:\windows\system32\html.iec

2010-12-10 08:04:30 107888 ----a-w- c:\windows\system32\CmdLineExt.dll

2010-12-09 15:15:09 718336 ----a-w- c:\windows\system32\ntdll.dll

2010-12-09 14:30:22 33280 ----a-w- c:\windows\system32\csrsrv.dll

2010-12-09 13:42:26 2148864 ----a-w- c:\windows\system32\ntoskrnl.exe

2010-12-09 13:07:07 2027008 ----a-w- c:\windows\system32\ntkrnlpa.exe

2006-07-19 10:27:59 319488 --sh--r- c:\windows\system32\divxplayer.exe

============= FINISH: 9:51:40.81 ===============

Attach:

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_10-12-12.02)

Microsoft Windows XP Professional

Boot Device: \Device\HarddiskVolume1

Install Date: 9/3/2010 9:34:51 AM

System Uptime: 2/26/2011 9:06:38 PM (12 hours ago)

Motherboard: MICRO-STAR INTERNATIONAL CO.,LTD | | MS-7388

Processor: AMD Athlon 64 X2 Dual Core Processor 5000+ | CPU 1 | 2599/200mhz

==== Disk Partitions =========================

A: is Removable

C: is FIXED (NTFS) - 134 GiB total, 2.808 GiB free.

D: is FIXED (NTFS) - 462 GiB total, 382.148 GiB free.

E: is CDROM ()

F: is CDROM ()

==== Disabled Device Manager Items =============

Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}

Description: Audio Device on High Definition Audio Bus

Device ID: HDAUDIO\FUNC_01&VEN_1002&DEV_AA01&SUBSYS_00AA0100&REV_1000\5&AC286C1&0&0001

Manufacturer:

Name: Audio Device on High Definition Audio Bus

PNP Device ID: HDAUDIO\FUNC_01&VEN_1002&DEV_AA01&SUBSYS_00AA0100&REV_1000\5&AC286C1&0&0001

Service:

Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}

Description: SM Bus Controller

Device ID: PCI\VEN_1002&DEV_4385&SUBSYS_73881462&REV_14\3&267A616A&0&A0

Manufacturer:

Name: SM Bus Controller

PNP Device ID: PCI\VEN_1002&DEV_4385&SUBSYS_73881462&REV_14\3&267A616A&0&A0

Service:

==== System Restore Points ===================

RP209: 2/20/2011 2:59:42 PM - System Checkpoint

RP210: 2/21/2011 7:05:34 PM - System Checkpoint

RP211: 2/22/2011 9:00:59 PM - System Checkpoint

RP212: 2/24/2011 7:45:02 AM - System Checkpoint

RP213: 2/24/2011 5:42:05 AM - System Checkpoint

RP214: 2/25/2011 5:52:52 AM - System Checkpoint

RP215: 2/26/2011 6:52:52 AM - System Checkpoint

RP216: 2/27/2011 7:10:57 AM - System Checkpoint

RP217: 2/27/2011 9:49:18 AM - Removed AutoCAD 2007 - English

==== Installed Programs ======================

Adobe Bridge 1.0

Adobe Common File Installer

Adobe Help Center 1.0

Adobe Photoshop CS2

Adobe Stock Photos 1.0

Camtasia Studio 7

DEVIL MAY CRY 4

Google Chrome

Guitar Hero - World Tour v1.0

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)

Hotfix for Windows XP (KB2443685)

Hotfix for Windows XP (KB952287)

Hotfix for Windows XP (KB961118)

Hotfix for Windows XP (KB976002-v5)

HyperCam 2

HypreCam Toolbar

Macromedia Flash Player 8

Malwarebytes' Anti-Malware

Mario Forever 4.0

Microsoft .NET Framework 2.0 Service Pack 2

Microsoft .NET Framework 3.0 Service Pack 2

Microsoft .NET Framework 3.5 SP1

Microsoft Kernel-Mode Driver Framework Feature Pack 1.9

Microsoft Office Professional Edition 2003

Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Mozilla Firefox (3.6.13)

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

Nail'd

Need for Speed Hot Pursuit

PowerArchiver 2010

Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)

Security Update for Windows Internet Explorer 8 (KB2416400)

Security Update for Windows Internet Explorer 8 (KB2482017)

Security Update for Windows Internet Explorer 8 (KB971961)

Security Update for Windows Internet Explorer 8 (KB981332)

Security Update for Windows Media Player (KB2378111)

Security Update for Windows Media Player (KB952069)

Security Update for Windows Media Player (KB954155)

Security Update for Windows Media Player (KB973540)

Security Update for Windows Media Player (KB975558)

Security Update for Windows Media Player (KB978695)

Security Update for Windows XP (KB2079403)

Security Update for Windows XP (KB2115168)

Security Update for Windows XP (KB2121546)

Security Update for Windows XP (KB2229593)

Security Update for Windows XP (KB2259922)

Security Update for Windows XP (KB2286198)

Security Update for Windows XP (KB2296011)

Security Update for Windows XP (KB2296199)

Security Update for Windows XP (KB2347290)

Security Update for Windows XP (KB2360937)

Security Update for Windows XP (KB2387149)

Security Update for Windows XP (KB2393802)

Security Update for Windows XP (KB2419632)

Security Update for Windows XP (KB2423089)

Security Update for Windows XP (KB2436673)

Security Update for Windows XP (KB2440591)

Security Update for Windows XP (KB2443105)

Security Update for Windows XP (KB2476687)

Security Update for Windows XP (KB2478960)

Security Update for Windows XP (KB2478971)

Security Update for Windows XP (KB2479628)

Security Update for Windows XP (KB2483185)

Security Update for Windows XP (KB2485376)

Security Update for Windows XP (KB923561)

Security Update for Windows XP (KB946648)

Security Update for Windows XP (KB950762)

Security Update for Windows XP (KB950974)

Security Update for Windows XP (KB951376-v2)

Security Update for Windows XP (KB951748)

Security Update for Windows XP (KB952004)

Security Update for Windows XP (KB952954)

Security Update for Windows XP (KB954459)

Security Update for Windows XP (KB956572)

Security Update for Windows XP (KB956744)

Security Update for Windows XP (KB956802)

Security Update for Windows XP (KB956803)

Security Update for Windows XP (KB956844)

Security Update for Windows XP (KB958644)

Security Update for Windows XP (KB958869)

Security Update for Windows XP (KB959426)

Security Update for Windows XP (KB960803)

Security Update for Windows XP (KB960859)

Security Update for Windows XP (KB961501)

Security Update for Windows XP (KB969059)

Security Update for Windows XP (KB970430)

Security Update for Windows XP (KB971657)

Security Update for Windows XP (KB972270)

Security Update for Windows XP (KB973507)

Security Update for Windows XP (KB973869)

Security Update for Windows XP (KB973904)

Security Update for Windows XP (KB974112)

Security Update for Windows XP (KB974318)

Security Update for Windows XP (KB974392)

Security Update for Windows XP (KB974571)

Security Update for Windows XP (KB975025)

Security Update for Windows XP (KB975467)

Security Update for Windows XP (KB975560)

Security Update for Windows XP (KB975562)

Security Update for Windows XP (KB975713)

Security Update for Windows XP (KB977816)

Security Update for Windows XP (KB977914)

Security Update for Windows XP (KB978037)

Security Update for Windows XP (KB978338)

Security Update for Windows XP (KB978542)

Security Update for Windows XP (KB978601)

Security Update for Windows XP (KB978706)

Security Update for Windows XP (KB979309)

Security Update for Windows XP (KB979482)

Security Update for Windows XP (KB979687)

Security Update for Windows XP (KB980195)

Security Update for Windows XP (KB980232)

Security Update for Windows XP (KB980436)

Security Update for Windows XP (KB981322)

Security Update for Windows XP (KB981852)

Security Update for Windows XP (KB981997)

Security Update for Windows XP (KB982132)

Security Update for Windows XP (KB982214)

Security Update for Windows XP (KB982665)

Skype Toolbars

Skype™ 3.8

Update for Microsoft .NET Framework 3.5 SP1 (KB963707)

Update for Windows Internet Explorer 8 (KB976662)

Update for Windows XP (KB2141007)

Update for Windows XP (KB2345886)

Update for Windows XP (KB2467659)

Update for Windows XP (KB898461)

Update for Windows XP (KB951978)

Update for Windows XP (KB955759)

Update for Windows XP (KB967715)

Update for Windows XP (KB968389)

Update for Windows XP (KB971737)

Update for Windows XP (KB973687)

Update for Windows XP (KB973815)

viewet

VLC media player 1.0.5

Web Page Maker V3.03

WebFldrs XP

Windows Genuine Advantage Validation Tool (KB892130)

µTorrent

==== Event Viewer Messages From Past Week ========

2/26/2011 9:07:21 PM, error: sr [1] - The System Restore filter encountered the unexpected error '0xC0000001' while processing the file '' on the volume 'HarddiskVolume1'. It has stopped monitoring the volume.

2/23/2011 11:15:45 AM, error: Dhcp [1002] - The IP address lease 94.156.49.225 for the Network Card with network address 001D9284B5A5 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message).

2/22/2011 7:13:17 PM, error: W32Time [17] - Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup again in 15 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751)

==== End Of File ===========================

Редактирано 2 март 201115 г. от The Man Of Steel (преглед на промените)

Здравей!

Аз ще се опитам да ти помогна. Моля те да публикуваш всичките си логове, а не да ги прикачваш, че това забавя и затруднява моята работа.

svhost го има няколко пъти както и firefox. мисля че някой логва квото правя в пс-то и е undetected

Недей така! Между svhost.exe и svchost.exe има една много важна разлика - едното може (а може би не) да е легитимен файл, а svhost.exe със сигурност е зловреден софтуер. При теб е svchost.exe .

Стъпка 1:

Моля, деинсталирай следното приложение: HypreCam Toolbar

Стъпка 2:

Моля, влез в www.virustotal.com и качи следните файлове един по един:

c:\program files\taskbar shuffle\taskbarshuffle.exe

c:\program files\viglance\ViGlance.exe

c:\windows\system32\divxplayer.exe

c:\windows\system32\vb2008source.exe

Моля, публикувай резултатите от анализите в следващия си пост. Извинявам се, че толкова ти давам, но трябва да съм напълно наясно преди да почна да размахвам ножа.

Стъпка 1: Деинсталирано! Стъпка 2: c:\program files\taskbar shuffle\taskbarshuffle.exe - Нямам такава папка c:\program files\viglance\ViGlance.exe - имам ViGlance One Step.exe c:\windows\system32\divxplayer.exe - този го няма c:\windows\system32\vb2008source.exe - само този го има http://www.virustotal.com/file-scan/report.html?id=302b0ef475f1daf157e536c87ca5ed4a4e121edcea5245a7968984f7a0d1b42b-1298818917 когато го качих ми даде че е вече бил сканиран...

Изтеглете ComboFix от някой от следните линкове:

Линк 1

Линк 2

* ВАЖНО !!! Запазете ComboFix.exe на вашия десктоп

• Изключете вашата антивирусна и антишпионска програма, обикновено това става чрез натискане на десния бутон на мишката върху иконата на програма в системния трей.

Бележка: Ако не можете я спрете или не сте сигурни коя програма да изключите, моля прегледайте информацията от този линк: How to Disable your Security Programs

• Преименувайте ComboFix.exe на Tool.exe

• Стартирайте Tool.exe и следвайте инструкциите.

Бележка: ComboFix ще се стартира без инсталирана Recovery Console.

• Като част от неговата работа, ComboFix ще провери дали Microsoft Windows Recovery Console е инсталирана. Предвид бързо развиващия се зловреден софтуер е силно препоръчително да бъде инсталирана преди премахването на зловредния софтуер. Това ще Ви позволи да влезете в специален recovery/repair режим, който ще ни позволи по-лесно да решите проблем, който би могъл да възникне при премахване на зловредния софтуер.

• Следвайте инструкциите, за да позволите на ComboFix да изтегли и инсталира Microsoft Windows Recovery Console. В един момент ще бъдете попитани дали сте съгласни с лицензното споразумение. Необходимо е да потвърдите, че сте съгласни, за да инсталирате Microsoft Windows Recovery Console.

** Забележете: Ако Microsoft Windows Recovery Console е вече инсталирана, ComboFix ще продължи към процеса по премахване на зловредния софтуер.

След като Microsoft Windows Recovery Console е инсталирана, използвайки ComboFix, Вие ще видите следното съобщение:

Изберете Yes, за да продължи сканирането за зловреден софтуер.

Когато процесът приключи успешно, инструментът ще създаде лог файл. Моля, включете съдържанието на C:\ComboFix.txt в следващия Ви коментар в тази тема.

Бележка:

• Моля, не движете мишката, докато ComboFix работи. Това може да наруши процеса на работа.
• ComboFix ще нулира всички настройки на Microsoft Internet Explorer, включително да направи IE браузър по подразбиране.
• ComboFix ще изключи autorun функцията на ВСИЧКИ CD, Floppy и USB устройства, за да помогне при премахването на зловредния софтуер и Ви защити от бъдещи вируси/заплахи, които поразяват чрез autorun. Ако това е проблем за вас - моля, уведомете ме.
• ComboFix ще изключи вашата интернет връзка. Интернет връзката ще се възстанови автоматично, преди ComboFix да завърши процеса на работа. При проблем, той ще прекрати интернет връзката. За да възстановите интернет връзката си, рестартирайте компютъра си.
• В случай на проблем с ComboFix, той може да създаде лог файл. Моля, включете съдържанието на C:\BUG.txt в следващия Ви коментар в тази тема.

Работата на ComboFix, може да отнеме до 20-30 минути, за да завърши, моля имайте търпение.

Моля, не прикачвайте лог файла/овете от програмата, а го/ги копирайте и поставете в следващия Ви коментар в тази тема.

Компютъра ми се рестартира - след това ми даде такава грешка -

и в C: нямам ComboFix имам Tool и като го отворя ми дава C:/Tool

кво става сега имам ли вирус или не и какво е това?

намерих и тва divxplayer - http://www.virustotal.com/file-scan/report.html?id=3fa8dfb5a2eea33f3c358dd70c0e75dfe2424ecafffe38902cc020494af6fdee-1298821653

Явно имаш! Линкът ти не работи. Опитай отново с ComboFix, но в Safe Mode with Networking. http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/boot_failsafe.mspx

Е добре а тея ся тва дето ми създаде в C: да ги изтрия ли с иконката на My Computer - ми създаде Tool

Не, остави го.

Успях да направя скана с ComboFix но ми даде няколко грешки по време на скана, след тва ресна компа но този път с предупреждение Reboot и след тва създаде лога: ComboFix 11-03-02.01 - Insaneboy 03/02/2011 22:49:30.1.2 - x86 Microsoft Windows XP Professional 5.1.2600.3.1251.1.1033.18.2047.1522 [GMT -8:00] Running from: c:\documents and settings\Insaneboy\Desktop\Tool.exe AV: ESET NOD32 Antivirus 4.2 *Disabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0} . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\Insaneboy\Application Data\PriceGong c:\documents and settings\Insaneboy\Application Data\PriceGong\Data\1.xml c:\documents and settings\Insaneboy\Application Data\PriceGong\Data\a.xml c:\documents and settings\Insaneboy\Application Data\PriceGong\Data\b.xml c:\documents and settings\Insaneboy\Application Data\PriceGong\Data\c.xml c:\documents and settings\Insaneboy\Application Data\PriceGong\Data\d.xml c:\documents and settings\Insaneboy\Application Data\PriceGong\Data\e.xml c:\documents and settings\Insaneboy\Application Data\PriceGong\Data\f.xml c:\documents and settings\Insaneboy\Application Data\PriceGong\Data\g.xml c:\documents and settings\Insaneboy\Application Data\PriceGong\Data\h.xml c:\documents and settings\Insaneboy\Application Data\PriceGong\Data\i.xml c:\documents and settings\Insaneboy\Application Data\PriceGong\Data\J.xml c:\documents and settings\Insaneboy\Application Data\PriceGong\Data\k.xml c:\documents and settings\Insaneboy\Application Data\PriceGong\Data\l.xml c:\documents and settings\Insaneboy\Application Data\PriceGong\Data\m.xml c:\documents and settings\Insaneboy\Application Data\PriceGong\Data\mru.xml c:\documents and settings\Insaneboy\Application Data\PriceGong\Data\n.xml c:\documents and settings\Insaneboy\Application Data\PriceGong\Data\o.xml c:\documents and settings\Insaneboy\Application Data\PriceGong\Data\p.xml c:\documents and settings\Insaneboy\Application Data\PriceGong\Data\q.xml c:\documents and settings\Insaneboy\Application Data\PriceGong\Data\r.xml c:\documents and settings\Insaneboy\Application Data\PriceGong\Data\s.xml c:\documents and settings\Insaneboy\Application Data\PriceGong\Data\t.xml c:\documents and settings\Insaneboy\Application Data\PriceGong\Data\u.xml c:\documents and settings\Insaneboy\Application Data\PriceGong\Data\v.xml c:\documents and settings\Insaneboy\Application Data\PriceGong\Data\w.xml c:\documents and settings\Insaneboy\Application Data\PriceGong\Data\x.xml c:\documents and settings\Insaneboy\Application Data\PriceGong\Data\y.xml c:\documents and settings\Insaneboy\Application Data\PriceGong\Data\z.xml c:\documents and settings\Insaneboy\Desktop\DOBRE E c:\documents and settings\Insaneboy\Desktop\DOBRE E \DOBRE E .mp4 c:\documents and settings\Insaneboy\Desktop\DOBRE E \Thumbs.db c:\documents and settings\Insaneboy\Desktop\DOBRE E \windows-7-wallpaper.jpg C:\Thumbs.db c:\windows\system32\divxplayer.exe D:\install.exe . ((((((((((((((((((((((((( Files Created from 2011-02-03 to 2011-03-03 ))))))))))))))))))))))))))))))) . 2011-02-27 05:14 . 2010-12-21 02:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2011-02-27 05:14 . 2010-12-21 02:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys 2011-02-27 05:14 . 2011-02-27 05:14 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2011-02-24 15:13 . 2011-02-24 15:13 -------- d-----w- c:\documents and settings\Insaneboy\Local Settings\Application Data\Temporary Projects 2011-02-19 04:36 . 2011-02-19 04:36 -------- d-----w- c:\documents and settings\Insaneboy\Local Settings\Application Data\Aspyr 2011-02-18 23:13 . 2011-02-18 23:13 -------- d-----w- C:\ime na papkata 2011-02-05 06:58 . 2011-02-17 19:01 -------- d-----w- c:\program files\viewet 2011-02-04 17:41 . 2011-02-04 17:41 -------- d-----w- c:\documents and settings\Insaneboy\Application Data\f-secure . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-01-21 14:44 . 2008-04-14 12:00 439296 ----a-w- c:\windows\system32\shimgvw.dll 2011-01-07 14:09 . 2008-04-14 12:00 290048 ----a-w- c:\windows\system32\atmfd.dll 2010-12-31 13:10 . 2008-04-14 12:00 1854976 ----a-w- c:\windows\system32\win32k.sys 2010-12-22 12:34 . 2008-04-14 12:00 301568 ----a-w- c:\windows\system32\kerberos.dll 2010-12-20 23:59 . 2008-04-14 12:00 916480 ----a-w- c:\windows\system32\wininet.dll 2010-12-20 23:59 . 2008-04-14 12:00 43520 ----a-w- c:\windows\system32\licmgr10.dll 2010-12-20 23:59 . 2008-04-14 12:00 1469440 ----a-w- c:\windows\system32\inetcpl.cpl 2010-12-20 17:26 . 2008-04-14 12:00 730112 ----a-w- c:\windows\system32\lsasrv.dll 2010-12-20 12:55 . 2008-04-14 12:00 385024 ----a-w- c:\windows\system32\html.iec 2010-12-10 08:04 . 2010-12-10 08:04 107888 ----a-w- c:\windows\system32\CmdLineExt.dll 2010-12-09 15:15 . 2008-04-14 12:00 718336 ----a-w- c:\windows\system32\ntdll.dll 2010-12-09 14:30 . 2008-04-14 12:00 33280 ----a-w- c:\windows\system32\csrsrv.dll 2010-12-09 13:42 . 2008-04-14 12:00 2148864 ----a-w- c:\windows\system32\ntoskrnl.exe 2010-12-09 13:07 . 2008-04-14 00:01 2027008 ----a-w- c:\windows\system32\ntkrnlpa.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BitComet"="c:\program files\BitComet\BitComet.exe" [2008-08-22 2567992] "Google Update"="c:\documents and settings\Insaneboy\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2010-09-09 136176] "PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2010-05-14 1479680] "Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-11-07 21633320] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 110592] c:\documents and settings\Insaneboy\Start Menu\Programs\Startup\ Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664] ESET NOD32 Antivirus.lnk - c:\program files\ESET\ESET NOD32 Antivirus\egui.exe [2010-8-12 2215064] c:\documents and settings\All Users\Start Menu\Programs\Startup\ ESET NOD32 Antivirus.lnk - c:\program files\ESET\ESET NOD32 Antivirus\egui.exe [2010-8-12 2215064] FlexType 2K.lnk - c:\program files\Datecs\FlexType 2K\FType2K.exe [2010-9-3 95232] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ \0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] @="Driver" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\BitComet\\BitComet.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\TeamViewer\\Version5\\TeamViewer.exe"= "c:\\Program Files\\Mozilla Firefox\\firefox.exe"= "d:\\Games\\StarCraft II\\StarCraft II.exe"= "c:\\Documents and Settings\\All Users\\Application Data\\Electronic Arts\\Need For Speed World\\Data\\nfsw.exe"= "d:\\Games\\Starcraft II\\Versions\\Base15405\\SC2.exe"= "d:\\Games\\NFSU2\\speed2.exe"= "c:\\Program Files\\Counter-Strike 1.6\\hl.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "d:\\NFS HP\\Launcher.exe"= "d:\\NFS HP\\NFS11.exe"= "c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"= "d:\\Games\\nail\\Naild_x86.exe"= "c:\\Program Files\\Java\\jre6\\bin\\java.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "17938:TCP"= 17938:TCP:BitComet 17938 TCP "17938:UDP"= 17938:UDP:BitComet 17938 UDP R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [10/2/2010 8:41 PM 691696] R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [7/29/2010 12:31 PM 115008] R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [8/3/2010 12:28 PM 95896] R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [8/12/2010 1:16 PM 810144] S3 ATICDSDr;ATICDSDr;\??\e:\install pack\bin\atiicdxx.sys --> e:\install pack\bin\atiicdxx.sys [?] S4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\Microsoft SQL Server\100\Shared\sqladhlp.exe [7/10/2008 4:28 PM 47128] S4 RsFx0102;RsFx0102 Driver;c:\windows\system32\drivers\RsFx0102.sys [7/10/2008 1:49 AM 242712] S4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [7/10/2008 4:28 PM 369688] . Contents of the 'Scheduled Tasks' folder 2011-02-26 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 18:50] 2011-03-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1078081533-926492609-682003330-1003Core.job - c:\documents and settings\Insaneboy\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-09-09 00:56] 2011-03-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1078081533-926492609-682003330-1003UA.job - c:\documents and settings\Insaneboy\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-09-09 00:56] 2011-03-03 c:\windows\Tasks\WGASetup.job - c:\windows\system32\KB905474\wgasetup.exe [2011-01-08 06:18] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.bigseekpro.com/hypercam/{DD2814B1-439C-4007-9DCC-07A75417A01E} uInternet Settings,ProxyOverride = *.local uInternet Settings,ProxyServer = 168.216.36.1:8080 IE: &С&валяне &с BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm IE: &С&валяне всички видео с BitComet - c:\program files\BitComet\BitComet.exe/AddVideo.htm IE: &С&валяне всички с BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000 FF - ProfilePath - c:\documents and settings\Insaneboy\Application Data\Mozilla\Firefox\Profiles\upnk4r34.default\ FF - prefs.js: browser.search.selectedEngine - BigSeekPro FF - prefs.js: browser.startup.homepage - hxxp://www.php-proxy.net/index.php?q=aHR0cDovL3phbXVuZGEubmV0L2Jyb3dzZS5waHA%3D FF - prefs.js: network.proxy.type - 0 FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} FF - Ext: Easy Youtube Video Downloader: {c0c9a2c7-2e5c-4447-bc53-97718bc91e1b} - %profile%\extensions\{c0c9a2c7-2e5c-4447-bc53-97718bc91e1b} FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b} FF - Ext: Java Quick Starter: [email protected] - c:\program files\Java\jre6\lib\deploy\jqs\ff FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension . - - - - ORPHANS REMOVED - - - - HKCU-Run-DAEMON Tools Lite - c:\program files\DAEMON Tools Lite\daemon.exe HKCU-Run-WeatherClock - c:\program files\Weather Clock\WeatherClock.exe HKCU-Run-Taskbar Shuffle - c:\program files\Taskbar Shuffle\taskbarshuffle.exe HKCU-Run-ViGlance - c:\program files\ViGlance\ViGlance.exe ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2011-03-02 22:56 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe,-101" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(740) c:\windows\system32\Ati2evxx.dll c:\windows\system32\atiadlxx.dll - - - - - - - > 'explorer.exe'(2632) c:\windows\system32\WININET.dll c:\windows\system32\newdll.dll c:\windows\system32\msi.dll c:\windows\system32\ieframe.dll c:\windows\system32\webcheck.dll . ------------------------ Other Running Processes ------------------------ . c:\windows\system32\Ati2evxx.exe c:\windows\system32\Ati2evxx.exe c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe c:\program files\Bonjour\mDNSResponder.exe c:\program files\Java\jre6\bin\jqs.exe c:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe c:\windows\system32\rundll32.exe c:\documents and settings\Insaneboy\Local Settings\Application Data\Google\Update\1.2.183.39\GoogleCrashHandler.exe c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe c:\program files\PC Connectivity Solution\ServiceLayer.exe c:\windows\system32\wscntfy.exe c:\program files\PC Connectivity Solution\Transports\NclUSBSrv.exe c:\program files\PC Connectivity Solution\Transports\NclRSSrv.exe . ************************************************************************** . Completion time: 2011-03-02 22:58:49 - machine was rebooted ComboFix-quarantined-files.txt 2011-03-03 06:58 Pre-Run: 2,499,690,496 bytes free Post-Run: 5,081,214,976 bytes free - - End Of File - - F4ADC28D3D30DCCEDEE28811D0DDD27E Какво следва? :?

Редактирано 2 март 201115 г. от The Man Of Steel (преглед на промените)

В момента нямаш софтуер от F-Secure, затова ръчно изтрий следната папка:

c:\documents and settings\Insaneboy\Application Data\f-secure

Сега е хубаво да се направи сканиране с антивирусния софтуер, но твоят беше пачнат, мизериите са вече направени, така че моят съвет е ако искаш да го използваш отново, но пълноценно да деинсталираш ESET NOD32 Antivirus, да се увериш че:

C:\Program Files\ESET

папката е изтрита и да го инсталираш отново. В противен случай се ориентирай към нещо безплатно и направи същото, но вместо NOD32, изтегли и инсталирай нещо от нашия каталог:

http://www.kaldata.com/modules.php?modid=1&action=cat&id=41

Увери се, че е обновен и направи пълно сканиране.

Пиши ми относно резултатите от сканирането, както и как се държи системата след това.

Преинсталирах антивирусната, не съм я пачвал или краквал, само съм и слагал серийни номера от сорта на EAV-213123 сега сканира, но едва ли ще открие нещо защото последно като сканирах не откри нищо, после с mbam ли да сканна, а КомбоФикс не трябва ли да го изтрием :?

Чакай малко, едно по едно. Интересува ме резултата от антивирусната. Другите резултатите ги имам на лице.

И след това сканнах и с MBAM последния ъпдейт: Malwarebytes' Anti-Malware 1.50.1.1100 www.malwarebytes.org Database version: 5940 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 3/3/2011 9:57:19 AM mbam-log-2011-03-03 (09-57-19).txt Scan type: Full scan (C:\|D:\|) Objects scanned: 271929 Time elapsed: 33 minute(s), 48 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)

Реално погледнато системата ви беше инфектирана, но проблемът не беше този, който вие посочихте в началото. Как се държи системата сега?

Ами уж добре, де да знам, с какво беше инфектирана :О освен още няколко скана да направим за по-сигурно, защото аз като сканвам с MBAM и NOD32 все не намира а, вие казвате, че е инфектирана. Да дам ли проверка с DDS да видите как са процесите?

Редактирано 3 март 201115 г. от The Man Of Steel (преглед на промените)

Ще ме вкарате в гроба.

Реално погледнато системата ви беше инфектирана, но проблемът не беше този, който вие посочихте в началото.

Как ще ви "изпиша" с все още инфектирана система?!

Да дам ли проверка с DDS да видите как са процесите?

Това не е преди 5-6 години, това вече не е достатъчно, макар че е и тогава не беше...