В последно време забелязах че компютъра ми дори когато е в покой процесора му се товари много в повечето случаи и двете ядра са на 80-90%,гаджета ми топ процесите който показва дава странни процеси от 7 които съм нагласил 6 са svchost и един rundll.32 spyware doctor не намира нищо и се вая мая и чудя каква гадинка е тва. Разполагам с инсталационният диск на windows 7 логове от DDS: DDS (Ver_11-03-05.01) - NTFSx86 Run by а е® at 11:29:56,67 on зҐвў 12.05.2011 Ј. Internet Explorer: 8.0.7600.16385 BrowserJavaVersion: 1.6.0_24 Microsoft Windows 7 Ultimate 6.1.7600.0.1251.359.1026.18.2047.1200 [GMT 3:00] . AV: Spyware Doctor with AntiVirus *Disabled/Updated* {2F668A56-D5E0-2DF1-A0AE-CB1284F42AB2} AV: avast! Internet Security *Enabled/Updated* {C37D8F93-0602-E43C-40AA-47DAD597F308} SP: avast! Internet Security *Enabled/Updated* {781C6E77-2038-EBB2-7A1A-7CA8AE10B9B5} SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} SP: Spyware Doctor *Disabled/Updated* {94076BB2-F3DA-227F-9A1E-F060FF73600F} FW: avast! Internet Security *Enabled* {FB460EB6-4C6D-E564-6BF5-EEEF2B44B473} . ============== Running Processes =============== . C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k RPCSS C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k NetworkService C:\Program Files\Alwil Software\Avast5\AvastSvc.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Program Files\Alwil Software\Avast5\afwServ.exe C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe C:\Windows\VMSnap3.EXE C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\Program Files\Alwil Software\Avast5\AvastUI.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Program Files\Skype\Phone\Skype.exe C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Windows\system32\taskhost.exe C:\Program Files\Spyware Doctor\BDT\BDTUpdateService.exe C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Windows\system32\IoctlSvc.exe C:\Windows\system32\svchost.exe -k imgsvc C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\system32\SearchIndexer.exe C:\Windows\System32\svchost.exe -k LocalServicePeerNet C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\plugin-container.exe C:\Windows\explorer.exe C:\Users\рахо\Downloads\dds.scr C:\Windows\system32\conhost.exe . ============== Pseudo HJT Report =============== . uStart Page = uSearch Bar = Preserve BHO: HistoryTriggerBHO Class: {21a88cb9-84d2-4020-a2d1-b25a21034884} - c:\program files\lg electronics\lg pc suite iv\linkair\LinkAirBrowserHelper.dll BHO: PC Tools Browser Guard BHO: {2a0f3d1b-0909-4ff4-b272-609cce6054e7} - c:\program files\spyware doctor\bdt\PCTBrowserDefender.dll BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll TB: PC Tools Browser Guard: {472734ea-242a-422b-adf8-83d1e48cc825} - c:\program files\spyware doctor\bdt\PCTBrowserDefender.dll uRun: [sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun uRun: [skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized mRun: [VirtualCloneDrive] "c:\program files\elaborate bytes\virtualclonedrive\VCDDaemon.exe" /s mRun: [RtHDVCpl] c:\program files\realtek\audio\hda\RtHDVCpl.exe -s mRun: [VMSnap3] c:\windows\VMSnap3.EXE mRun: [NPSStartup] mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe" mRun: [avast5] "c:\program files\alwil software\avast5\avastUI.exe" /nogui mRun: [bigDog303] c:\windows\VM303_STI.EXE VIMICRO USB PC Camera (ZC0301PLH) mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0) mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3) mPolicies-system: EnableLUA = 0 (0x0) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) mPolicies-system: PromptOnSecureDesktop = 0 (0x0) IE: LG Air Sync (R-Click) - Save as Mobile Image - c:\program files\lg electronics\lg pc suite iv\linkair\IEContextMenu.dll/206 IE: LG Air Sync (R-Click) - Save as Mobile Memo - c:\program files\lg electronics\lg pc suite iv\linkair\IEContextMenu.dll/208 IE: LG Air Sync (R-Click) - Save as Mobile Text file - c:\program files\lg electronics\lg pc suite iv\linkair\IEContextMenu.dll/210 IE: LG Air Sync (R-Click) - Set as Mobile Wallpaper - c:\program files\lg electronics\lg pc suite iv\linkair\IEContextMenu.dll/205 IE: LG Air Sync Option - c:\program files\lg electronics\lg pc suite iv\linkair\IEContextMenu.dll/209 LSP: c:\program files\common files\pc tools\lsp\PCTLsp.dll DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL . ================= FIREFOX =================== . FF - ProfilePath - c:\users\c191~1\appdata\roaming\mozilla\firefox\profiles\ggzxq70f.default\ FF - prefs.js: network.proxy.type - 0 FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} FF - Ext: LG Air Sync: {00ADD29A-66F4-4f22-BCC0-4C1D29DA647B} - c:\program files\lg electronics\lg pc suite iv\linkair\{00ADD29A-66F4-4f22-BCC0-4C1D29DA647B} FF - Ext: Forecastfox Weather: {0538E3E3-7E9B-4d49-8831-A227C80A7AD3} - %profile%\extensions\{0538E3E3-7E9B-4d49-8831-A227C80A7AD3} . ============= SERVICES / DRIVERS =============== . R0 aswNdis;avast! Firewall NDIS Filter Service;c:\windows\system32\drivers\aswNdis.sys [2011-4-10 12112] R0 aswNdis2;avast! Firewall Core Firewall Service;c:\windows\system32\drivers\aswNdis2.sys [2011-4-10 189776] R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2011-4-27 207792] R0 TfFsMon;TfFsMon;c:\windows\system32\drivers\TfFsMon.sys [2011-4-27 51984] R0 TfSysMon;TfSysMon;c:\windows\system32\drivers\TfSysMon.sys [2011-4-27 59664] R1 aswFW;avast! TDI Firewall driver;c:\windows\system32\drivers\aswFW.sys [2011-4-10 99792] R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2011-4-10 357968] R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2011-4-10 293968] R1 pctgntdi;pctgntdi;c:\windows\system32\drivers\pctgntdi.sys [2011-4-27 233136] R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2011-4-10 17744] R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2011-4-10 51280] R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast5\AvastSvc.exe [2011-4-10 40384] R2 avast! Firewall;avast! Firewall;c:\program files\alwil software\avast5\afwServ.exe [2011-4-10 119200] R2 Browser Defender Update Service;Browser Defender Update Service;c:\program files\spyware doctor\bdt\BDTUpdateService.exe [2011-4-27 112592] R3 LgBttPort;LGE Bluetooth TransPort;c:\windows\system32\drivers\lgbtport.sys [2009-9-29 12160] R3 lgbusenum;LG Bluetooth Bus Enumerator;c:\windows\system32\drivers\lgbtbus.sys [2009-9-29 10496] R3 LGVMODEM;LGE Virtual Modem;c:\windows\system32\drivers\lgvmodem.sys [2009-9-29 12928] R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\drivers\Rt86win7.sys [2009-6-11 139776] R3 vmfilter303;vmfilter303;c:\windows\system32\drivers\vmfilter303.sys [2010-9-30 428160] S3 Andbus;LGE Android Platform Composite USB Device;c:\windows\system32\drivers\lgandbus.sys [2010-12-7 14336] S3 AndDiag;LGE Android Platform USB Serial Port;c:\windows\system32\drivers\lganddiag.sys [2010-12-7 20736] S3 AndGps;LGE Android Platform USB GPS NMEA Port;c:\windows\system32\drivers\lgandgps.sys [2010-12-7 20096] S3 ANDModem;LGE Android Platform USB Modem;c:\windows\system32\drivers\lgandmodem.sys [2010-12-7 25088] S3 androidusb;ADB Interface Driver;c:\windows\system32\drivers\lgandadb.sys [2010-8-2 25728] S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-14 229888] S3 c2wts;Claims to Windows Token Service;c:\program files\windows identity foundation\v3.5\c2wtshost.exe [2010-1-18 13080] S3 pctplsg;pctplsg;c:\windows\system32\drivers\pctplsg.sys [2011-4-27 70408] S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\spyware doctor\pctsAuxs.exe [2011-4-27 359624] S3 sdCoreService;PC Tools Security Service;c:\program files\spyware doctor\pctsSvc.exe [2011-4-27 1141712] S3 TfNetMon;TfNetMon;c:\windows\system32\drivers\TfNetMon.sys [2011-4-27 33552] S3 ThreatFire;ThreatFire;c:\program files\spyware doctor\tfengine\tfservice.exe service --> c:\program files\spyware doctor\tfengine\TFService.exe service [?] S3 WatAdminSvc;Услуга на технологиите за активиране на Windows;c:\windows\system32\wat\WatAdminSvc.exe [2010-2-2 1343400] . =============== Created Last 30 ================ . 2011-04-28 11:59:52 578611 ----a-w- C:\adb.exe 2011-04-28 11:59:51 96256 ----a-w- C:\AdbWinApi.dll 2011-04-28 11:59:51 60928 ----a-w- C:\AdbWinUsbApi.dll 2011-04-28 11:59:51 336613 ----a-w- C:\fastboot.exe 2011-04-28 09:49:49 25728 ----a-w- c:\windows\system32\drivers\androidusb.sysaddreg\androidusb.sys 2011-04-28 09:49:49 1419232 ----a-w- c:\windows\system32\drivers\androidusb.sysaddreg\WdfCoInstaller01005.dll 2011-04-28 09:45:22 -------- d-----w- c:\windows\system32\drivers\androidusb.sysAddReg 2011-04-28 09:41:01 25728 ----a-w- c:\windows\system\androidusb.sys 2011-04-28 09:40:03 25728 ----a-w- c:\windows\system32\drivers\androidusb.sys 2011-04-28 09:37:28 1419232 ----a-w- C:\WdfCoInstaller01005.dll 2011-04-28 09:33:33 1419232 ----a-w- c:\windows\system32\drivers\WdfCoInstaller01005.dll 2011-04-28 09:32:29 1419232 ----a-w- c:\windows\system\WdfCoInstaller01005.dll 2011-04-28 09:03:34 25728 ----a-w- c:\windows\androidusb.sys 2011-04-28 09:03:14 1419232 ----a-w- c:\windows\WdfCoInstaller01005.dll 2011-04-28 07:36:25 -------- d-----w- c:\users\c191~1\appdata\roaming\Yandex 2011-04-27 07:29:20 -------- d-----w- c:\program files\Disktrix 2011-04-27 06:15:10 59664 --s---w- c:\windows\system32\drivers\TfSysMon.sys 2011-04-27 06:15:10 51984 --s---w- c:\windows\system32\drivers\TfFsMon.sys 2011-04-27 06:15:10 33552 --s---w- c:\windows\system32\drivers\TfNetMon.sys 2011-04-27 06:09:17 767952 ----a-w- c:\windows\BDTSupport.dll 2011-04-27 06:09:16 165840 ----a-w- c:\windows\PCTBDRes.dll 2011-04-27 06:09:16 1640400 ----a-w- c:\windows\PCTBDCore.dll 2011-04-27 06:09:16 149456 ----a-w- c:\windows\SGDetectionTool.dll 2011-04-27 06:07:47 98600 ----a-w- c:\windows\system32\drivers\pctwfpfilter.sys 2011-04-27 06:07:47 233136 ----a-w- c:\windows\system32\drivers\pctgntdi.sys 2011-04-27 06:07:44 207792 ----a-w- c:\windows\system32\drivers\PCTCore.sys 2011-04-27 06:07:43 87784 ----a-w- c:\windows\system32\drivers\PCTAppEvent.sys 2011-04-27 06:07:38 70408 ----a-w- c:\windows\system32\drivers\pctplsg.sys 2011-04-27 06:07:30 -------- d-----w- c:\users\c191~1\appdata\roaming\PC Tools 2011-04-27 06:07:30 -------- d-----w- c:\program files\Spyware Doctor 2011-04-27 06:07:30 -------- d-----w- c:\program files\common files\PC Tools 2011-04-27 06:07:30 -------- d-----w- c:\progra~2\PC Tools 2011-04-27 05:48:45 -------- d-----w- c:\windows\pss 2011-04-16 20:46:50 1446264 ----a-w- c:\program files\mozilla firefox\plugins\npLegitCheckPlugin.dll . ==================== Find3M ==================== . 2011-03-01 16:55:07 472808 ----a-w- c:\windows\system32\deployJava1.dll . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_11-03-05.01) . Microsoft Windows 7 Ultimate Boot Device: \Device\HarddiskVolume1 Install Date: 29.9.2010 г. 22:55:22 System Uptime: 12.5.2011 г. 10:08:00 (1 hours ago) . Motherboard: MSI | | MS-7267 Processor: Intel® Pentium® Dual CPU E2140 @ 1.60GHz | CPU 1 | 1596/200mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 204 GiB total, 76,453 GiB free. D: is CDROM () E: is CDROM () F: is CDROM () G: is CDROM () H: is CDROM () I: is CDROM () J: is CDROM () . ==== Disabled Device Manager Items ============= . ==== System Restore Points =================== . RP65: 27.4.2011 г. 15:53:47 - Планирана контролна точка RP66: 28.4.2011 г. 14:14:19 - Инсталиране на драйверен пакет за устройство: Google, Inc ADB Interface RP67: 6.5.2011 г. 11:49:49 - Планирана контролна точка . ==== Installed Programs ====================== . Архиватор WinRAR µTorrent A4 TECH PC Camera H Adobe Flash Player 10 ActiveX Adobe Flash Player 10 Plugin Adobe Shockwave Player 11.5 Any Video Converter 3.0.5 avast! Internet Security AVI ReComp 1.2.3 Avidemux 2.4 AviSynth 2.5 Browser Defender 2.0.6.11 Call of Duty® 4 - Modern Warfare CCleaner Core Temp version 0.99.7 Crash Time 4 - The Syndicate Disktrix UltimateDefrag FormatFactory 2.50 Google Chrome Java Auto Updater Java 6 Update 24 LG Bluetooth Drivers LG PC Suite IV LG United Mobile Drivers Microsoft Games for Windows - LIVE Microsoft Games for Windows - LIVE Redistributable Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Mozilla Firefox (3.6.17) MSVC80_x86 MSVC80_x86_v2 MSXML 4.0 SP2 Parser and SDK Need for Speed Hot Pursuit Nero 7 Premium neroxml Nokia Connectivity Cable Driver Nokia PC Suite Opera 10.62 PC Connectivity Solution Realtek High Definition Audio Driver SAMSUNG USB Driver for Mobile Phones SamsungConnectivityCableDriver Skype™ 4.2 Spyware Doctor 7.0 TeamSpeak 3 Client The KMPlayer (remove only) VirtualCloneDrive VobSub v2.23 (Remove Only) Windows Driver Package - Nokia Modem (03/05/2008 3.7) Windows Driver Package - Nokia Modem (03/13/2008 6.86.0.1) Windows Driver Package - Nokia Modem (06/09/2010 4.5) Windows Driver Package - Nokia Modem (06/09/2010 7.01.0.7) Windows Driver Package - Nokia pccsmcfd (08/22/2008 7.0.0.0) Xvid 1.1.2 final uninstall . ==== Event Viewer Messages From Past Week ======== . 9.5.2011 г. 19:38:17, Error: Microsoft-Windows-Kernel-Processor-Power [6] - Some processor performance power management features have been disabled due to a known firmware problem. Check with the computer manufacturer for updated firmware. 9.5.2011 г. 11:56:55, Error: Microsoft-Windows-Kernel-Processor-Power [6] - Some processor performance power management features have been disabled due to a known firmware problem. Check with the computer manufacturer for updated firmware. 8.5.2011 г. 12:53:40, Error: Microsoft-Windows-Kernel-Processor-Power [6] - Some processor performance power management features have been disabled due to a known firmware problem. Check with the computer manufacturer for updated firmware. 8.5.2011 г. 03:51:26, Error: NetBT [4300] - The driver could not be created. 8.5.2011 г. 03:51:26, Error: NetBT [4300] - The driver could not be created. 7.5.2011 г. 09:39:03, Error: Microsoft-Windows-Kernel-Processor-Power [6] - Some processor performance power management features have been disabled due to a known firmware problem. Check with the computer manufacturer for updated firmware. 6.5.2011 г. 10:10:20, Error: Microsoft-Windows-Kernel-Processor-Power [6] - Some processor performance power management features have been disabled due to a known firmware problem. Check with the computer manufacturer for updated firmware. 5.5.2011 г. 23:04:30, Error: Service Control Manager [7031] - Услуга avast! Antivirus беше прекъсната неочаквано. Това се е случвало с нея 1 път(и). След 5000 милисекунди ще бъде предприето следното коригиращо действие: Рестартиране на услугата. 5.5.2011 г. 23:03:14, Error: Microsoft-Windows-Kernel-Processor-Power [6] - Some processor performance power management features have been disabled due to a known firmware problem. Check with the computer manufacturer for updated firmware. 5.5.2011 г. 19:27:55, Error: VDS Basic Provider [1] - Unexpected failure. Error code: 490@01010004 5.5.2011 г. 19:27:55, Error: VDS Basic Provider [1] - Unexpected failure. Error code: 490@01010004 5.5.2011 г. 19:27:55, Error: VDS Basic Provider [1] - Unexpected failure. Error code: 490@01010004 5.5.2011 г. 19:27:55, Error: VDS Basic Provider [1] - Unexpected failure. Error code: 490@01010004 5.5.2011 г. 19:27:55, Error: VDS Basic Provider [1] - Unexpected failure. Error code: 490@01010004 5.5.2011 г. 19:27:55, Error: VDS Basic Provider [1] - Unexpected failure. Error code: 490@01010004 5.5.2011 г. 19:27:20, Error: VDS Basic Provider [1] - Unexpected failure. Error code: 490@01010004 5.5.2011 г. 19:27:20, Error: VDS Basic Provider [1] - Unexpected failure. Error code: 490@01010004 5.5.2011 г. 19:27:20, Error: VDS Basic Provider [1] - Unexpected failure. Error code: 490@01010004 5.5.2011 г. 19:27:20, Error: VDS Basic Provider [1] - Unexpected failure. Error code: 490@01010004 5.5.2011 г. 19:27:20, Error: VDS Basic Provider [1] - Unexpected failure. Error code: 490@01010004 5.5.2011 г. 19:27:20, Error: VDS Basic Provider [1] - Unexpected failure. Error code: 490@01010004 5.5.2011 г. 10:47:23, Error: Microsoft-Windows-Kernel-Processor-Power [6] - Some processor performance power management features have been disabled due to a known firmware problem. Check with the computer manufacturer for updated firmware. 12.5.2011 г. 10:08:08, Error: Microsoft-Windows-Kernel-Processor-Power [6] - Some processor performance power management features have been disabled due to a known firmware problem. Check with the computer manufacturer for updated firmware. 11.5.2011 г. 23:34:46, Error: NetBT [4300] - The driver could not be created. 11.5.2011 г. 23:34:46, Error: NetBT [4300] - The driver could not be created. 11.5.2011 г. 09:21:42, Error: Microsoft-Windows-Kernel-Processor-Power [6] - Some processor performance power management features have been disabled due to a known firmware problem. Check with the computer manufacturer for updated firmware. 10.5.2011 г. 18:15:28, Error: Microsoft-Windows-Kernel-Processor-Power [6] - Some processor performance power management features have been disabled due to a known firmware problem. Check with the computer manufacturer for updated firmware.

Здравейте..!Ще ми е необходима по задълбочена проверка на системата.!За целта:

Следвайте следната инструкция за работа с OTL:

• Изтеглете OTL.exe и го запазете на десктопа.
• Стартирайте файла с двукратен клик на мишката.
• Сложете отметка пред Scan All Users
• Под менюто File Age => изберете 90 days
• Под менюто Standard Registry => променете на ALL
• Сложете отметки пред LOP и Purity Check
• Под с Copy/ Paste въведете изцяло следната текстова информация (само това, което е поставено в карето):

netsvcs
msconfig
%SYSTEMDRIVE%\*.*
%USERPROFILE%\*.*
%USERPROFILE%\Application Data\*.*
%USERPROFILE%\Local Settings\Application Data\*.*
%AllUsersProfile%\*.*
%AllUsersProfile%\Application Data\*.*
%USERPROFILE%\AppData\*.*
%USERPROFILE%\My Documents\*.*
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\system32\drivers\*.sys /90
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\system32\Spool\prtprocs\w32x86\*.dll
/md5start
hlp.dat
winlogon.exe
wininit.exe
userinit.exe
explorer.exe
volsnap.sys
/md5stop

• Натиснете маркираният в синьо бутон: .
• Като приключи проверката, ще се създадат два файла - OTL.Txt и Extras.Txt. Прикачете тези два файла в следващия си коментар (погледнете опцията "прикачени файлове", когато публикувате мнение).

Резултатите от ОТL: OTL.Txt

Extras.Txt

Стартирайте пак OTL и с Copy/ Paste под колонката Custom Scans/Fixes въведете скриптовия текст от текстовото поле по-долу, като не забравяте да копирате скрипта 1 към 1, както и двете точки преди първия ред на скрипта!

:OTL
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4 - HKLM..\Run: [BigDog303]  File not found
O4 - HKLM..\Run: [NPSStartup]  File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O33 - MountPoints2\{9e9190ea-cc7f-11df-b418-0019dbbaec3a}\Shell - "" = AutoRun
O33 - MountPoints2\{9e9190ea-cc7f-11df-b418-0019dbbaec3a}\Shell\AutoRun\command - "" = F:\setup\rsrc\Autorun.exe
O33 - MountPoints2\{9e9190ea-cc7f-11df-b418-0019dbbaec3a}\Shell\dinstall\command - "" = F:\Directx\dxsetup.exe
O33 - MountPoints2\{ad94539e-1803-11e0-badf-ebbd8f8cc981}\Shell - "" = AutoRun
O33 - MountPoints2\{ad94539e-1803-11e0-badf-ebbd8f8cc981}\Shell\AutoRun\command - "" = K:\NPSAI.exe
MsConfig - StartUpReg: [b]BigDog303[/b] - hkey= - key= -  File not found
[2011.03.01 19:54:45 | 000,000,000 | ---D | C] -- C:\ProgramData\McAfee
@Alternate Data Stream - 194 bytes -> C:\ProgramData\TEMP:DFC5A2B2
@Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:A8ADE5D8

:Reg

:files


autorun.inf /alldrives
recycler /alldrives
ipconfig /flushdns /c

:Commands
[purity]
[emptytemp]
[resethosts]
[CreateRestorePoint]
[emptyflash]
[Reboot]

След като въведете скрипта от цитата по-горе натиснете бутона, маркиран в червено: Run Fix

Ще се създаде лог файл. Публикувайте съдържанието му с Copy/Paste в следващия си коментар.

===>>> Освен това:

• Изтеглете Malwarebytes' Anti-Malware или от тук
• Кликнете два пъти върху mbam-setup.exe, за да инсталирате програмата.
• Уверете се, че са поставени отметки на Update Malwarebytes' Anti-Malware и Launch Malwarebytes' Anti-Malware. След това кликнете на Finish.
• Ако има намерени обновявания, тя ще ги изтегли и инсталира.
• Стартирайте програмата и изберете "Perform Full Scan", след това кликнете на Scan.
• Сканирането ще отнеме малко време, затова моля да бъдете търпеливи.
• Когато сканирането завърши, кликнете на OK, след това Show Results, за да видите резултата.
• Уверете се, че на всички редове има отметки, и кликнете на Remove Selected.
• Когато всичко бъде премахнато, в Notepad ще бъде отворен лог. Копирайте този лог и го публикувайте в следващия си коментар по темата.

Забележка: Ако MalwareBytes' Anti-Malware се затрудни в премахването на откритите вируси/заплахи, той ще поиска да рестартира компютъра Ви и по време на рестартирането да премахне проблемните вируси/заплахи. Ако бъдете попитани, потвърдете че желаете вашия компютър да бъде рестартиран.

===>>> Освен това:

Следвайте следната инструкция за работа с Security Check:

• Изтеглете Security Check (автор: screen317) от тук или от тук и го запишете на десктопа.
• Кликнете два пъти върху SecurityCheck.exe и следвайте инструкциите.
• Когато програмата завърши работата си, ще се отвори един текстов документ: checkup.txt.
• Копирайте съдържанието с Копирай (Copy) на checkup.txt и с Постави (Paste) го поставете в следващия си коментар.

Лог от OTL:

All processes killed

========== OTL ==========

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\BigDog303 deleted successfully.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\NPSStartup deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9e9190ea-cc7f-11df-b418-0019dbbaec3a}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9e9190ea-cc7f-11df-b418-0019dbbaec3a}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9e9190ea-cc7f-11df-b418-0019dbbaec3a}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9e9190ea-cc7f-11df-b418-0019dbbaec3a}\ not found.

File F:\setup\rsrc\Autorun.exe not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9e9190ea-cc7f-11df-b418-0019dbbaec3a}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9e9190ea-cc7f-11df-b418-0019dbbaec3a}\ not found.

File F:\Directx\dxsetup.exe not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ad94539e-1803-11e0-badf-ebbd8f8cc981}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ad94539e-1803-11e0-badf-ebbd8f8cc981}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ad94539e-1803-11e0-badf-ebbd8f8cc981}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ad94539e-1803-11e0-badf-ebbd8f8cc981}\ not found.

File K:\NPSAI.exe not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\StartUpReg\BigDog303\ deleted successfully.

C:\ProgramData\McAfee\MCLOGS\Common\MsiExec folder moved successfully.

C:\ProgramData\McAfee\MCLOGS\Common folder moved successfully.

C:\ProgramData\McAfee\MCLOGS folder moved successfully.

C:\ProgramData\McAfee folder moved successfully.

ADS C:\ProgramData\TEMP:DFC5A2B2 deleted successfully.

ADS C:\ProgramData\TEMP:A8ADE5D8 deleted successfully.

========== REGISTRY ==========

========== FILES ==========

autorun.inf not found in C:\

recycler not found in C:\

< ipconfig /flushdns /c >

No captured output from command...

C:\Users\рахо\Desktop\cmd.bat deleted successfully.

========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

User: Public

User: ðàõî

User: рахо

->Temp folder emptied: 346932205 bytes

->Temporary Internet Files folder emptied: 736596 bytes

->Java cache emptied: 119877 bytes

->FireFox cache emptied: 87981139 bytes

->Google Chrome cache emptied: 0 bytes

->Opera cache emptied: 0 bytes

->Flash cache emptied: 50922 bytes

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 1216 bytes

RecycleBin emptied: 0 bytes

Total Files Cleaned = 416,00 mb

C:\Windows\System32\drivers\etc\Hosts moved successfully.

HOSTS file reset successfully

[EMPTYFLASH]

User: All Users

User: Default

User: Default User

User: Public

User: ðàõî

User: рахо

->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0,00 mb

OTL by OldTimer - Version 3.2.22.3 log created on 05152011_100719

Files\Folders moved on Reboot...

File move failed. C:\Windows\temp\_avast5_\Webshlock.txt scheduled to be moved on reboot.

Registry entries deleted on Reboot...

Лог от MBAM:

Malwarebytes' Anti-Malware 1.50.1.1100

www.malwarebytes.org

Версия на базата от данни: 6582

Windows 6.1.7600

Internet Explorer 8.0.7600.16385

15.5.2011 г. 11:30:13

mbam-log-2011-05-15 (11-30-13).txt

Тип сканиране: Пълно сканиране (C:\|)

Сканирани обекти: 309941

Изминало време: 1 час(а), 9 минута(и), 3 секунда(и)

Заразени процеси в паметта: 0

Заразени модули в паметта: 0

Заразени ключове в регистратурата: 0

Заразени стойности в регистратурата: 0

Заразени информационни обекти в регистратурата: 0

Заразени папки: 0

Заразени файлове: 12

Заразени процеси в паметта:

(Не бяха открити зловредни обекти)

Заразени модули в паметта:

(Не бяха открити зловредни обекти)

Заразени ключове в регистратурата:

(Не бяха открити зловредни обекти)

Заразени стойности в регистратурата:

(Не бяха открити зловредни обекти)

Заразени информационни обекти в регистратурата:

(Не бяха открити зловредни обекти)

Заразени папки:

(Не бяха открити зловредни обекти)

Заразени файлове:

c:\Users\рахо\AppData\Local\Xenocode\Sandbox\dream aquarium\1.0.0.0\2009.10.18t09.58\Virtual\STUBEXE\@programfiles@\dream aquarium\dream_aquarium.scr (Trojan.Agent) -> Quarantined and deleted successfully.

c:\Users\рахо\AppData\Local\Xenocode\Sandbox\dream aquarium\1.0.0.0\2009.10.18t09.58\Virtual\STUBEXE\@WINDIR@\dreamaquarium.scr (Trojan.Agent) -> Quarantined and deleted successfully.

c:\Users\рахо\Desktop\dreamaquarium.exe (Trojan.Agent) -> Quarantined and deleted successfully.

c:\Users\рахо\downloads\photodex proshow gold 4.1.2737\Keygen\CORE10k.EXE (Dont.Steal.Our.Software) -> Quarantined and deleted successfully.

c:\Users\рахо\downloads\photodex proshow gold 4.1.2737\Keygen\keygen.exe (Trojan.Agent.CK) -> Quarantined and deleted successfully.

c:\Users\рахо\downloads\photodex proshow producer v4.5.2949 + portable\photodex proshow producer v4.5.2949 + keygen\keygen.exe (Trojan.Agent.CK) -> Quarantined and deleted successfully.

c:\Users\рахо\downloads\ultimate defrag v3.0.100.19 + portable\ultimate defrag v3.0.100.19\Patch\ultimate.defrag.3.0.100.10-mpt.exe (PUP.Hacktool.Patcher) -> Quarantined and deleted successfully.

c:\Users\рахо\downloads\call_of_duty_4_crackfix_and_keygen-razor1911\Keygen\rzr-cod4.exe (Trojan.Agent.CK) -> Quarantined and deleted successfully.

c:\Users\рахо\favorites\google.earth.plus.5.2.x-mpt.exe (PUP.Hacktool.Patcher) -> Quarantined and deleted successfully.

c:\Windows.old\Users\raho\AppData\Local\thinstall\Cache\Stubs\458c363a5cd213ba857c3d0d6c83e5b7c51bde6\dream_aquarium.scr (Trojan.Backdoor) -> Quarantined and deleted successfully.

c:\Windows.old\Users\raho\AppData\Local\Xenocode\Sandbox\dream aquarium\1.0.0.0\2009.10.18t09.58\Virtual\STUBEXE\@programfiles@\dream aquarium\dream_aquarium.scr (Trojan.Agent) -> Quarantined and deleted successfully.

c:\Windows.old\Users\raho\AppData\Local\Xenocode\Sandbox\dream aquarium\1.0.0.0\2009.10.18t09.58\Virtual\STUBEXE\@WINDIR@\dreamaquarium.scr (Trojan.Agent) -> Quarantined and deleted successfully.

Лог от security chek :

Results of screen317's Security Check version 0.99.7

Windows 7 (UAC is disabled!)

Internet Explorer 8

``````````````````````````````

Antivirus/Firewall Check:

Windows Firewall Enabled!

avast! Internet Security

WMI entry may not exist for antivirus; attempting automatic update.

```````````````````````````````

Anti-malware/Other Utilities Check:

Malwarebytes' Anti-Malware

CCleaner

Java 6 Update 24

Out of date Java installed!

Adobe Flash Player 10.2.153.1

Mozilla Firefox (x86 bg..) Firefox Out of Date!

````````````````````````````````

Process Check:

objlist.exe by Laurent

Alwil Software Avast5 AvastSvc.exe

Alwil Software Avast5 afwServ.exe

Alwil Software Avast5 AvastUI.exe

``````````End of Log````````````

Благодаря ви....сега наблюдавате ли някъкви проблеми по системата ви....?

Определено се чувства промяна държи се за сега много добре. Благодаря ви много...повече хора като вас трябва да има

Радвам се..!Имаме още малко довършителна работа:

1.Стартирайте OTL още веднъж и натиснете бутона CleanUp.

При дeинсталацията на OTL ще бъдат почистени инструменти и файлове, които използвахме в темата (може да оставите Malwarebytes' Anti-Malware Free за периодично сканиране). Програмата не пречи на другите приложения за сигурност. Ще последва рестарт на Windows.

Направете обновяване на Java - новата версия е Version 6 Update 25,като почистите старите версии с JavaRA - - (разархивирате,стартирате и избирате '' Remove Older Versions")

Това е за сега от мен..!Пожелавам ви лек и спорен ден..!Поздрави..!

Много благодаря за помоща когато имате път към софия има бира от мен П.С. някой да заключи темата понеже незнам как стават работите

Редактирано 15 май 201115 г. от suffer34 (преглед на промените)