Win32/agent.FLHOJIQ , Win32/Adware.toolbar.dealiu , Win32/agent.BAGSEMV Бавно стартира системата 10мин . DDS (Ver_2011-06-03.01) - NTFSx86 Internet Explorer: 8.0.6001.18702 Run by YouR-DeaTh at 20:12:42 on 2011-06-03 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1303 [GMT -7:00] . AV: ESET Smart Security 4.2 *Enabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0} . ============== Running Processes =============== . C:\WINXP\system32\Ati2evxx.exe C:\WINXP\system32\svchost -k DcomLaunch svchost.exe C:\WINXP\System32\svchost.exe -k netsvcs C:\WINXP\system32\svchost.exe -k WudfServiceGroup svchost.exe svchost.exe C:\WINXP\system32\spoolsv.exe C:\WINXP\system32\Ati2evxx.exe C:\WINXP\Explorer.EXE C:\WINXP\RTHDCPL.EXE C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\Program Files\PC Auto Shutdown\AutoShutdown.exe C:\Program Files\ESET\ESET Smart Security\egui.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe C:\Program Files\uTorrent\uTorrent.exe C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe svchost.exe C:\Program Files\ESET\ESET Smart Security\ekrn.exe C:\Program Files\LogMeIn Hamachi\hamachi-2.exe C:\Program Files\PC Auto Shutdown\ShutdownService.exe C:\WINXP\system32\svchost.exe -k imgsvc C:\Program Files\PC Connectivity Solution\ServiceLayer.exe C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe D:\GAMES\Counter-Strike Psycho\hl.exe . ============== Pseudo HJT Report =============== . uURLSearchHooks: YouTube Downloader Toolbar: {f3fee66e-e034-436a-86e4-9690573bee8a} - BHO: {f3fee66e-e034-436a-86e4-9690573bee8a} - YouTube Downloader Toolbar TB: YouTube Downloader Toolbar: {f3fee66e-e034-436a-86e4-9690573bee8a} - uRun: [uTorrent] "c:\program files\utorrent\uTorrent.exe" uRun: [PC Suite Tray] "c:\program files\nokia\nokia pc suite 7\PCSuite.exe" -onlytray mRun: [RTHDCPL] RTHDCPL.EXE mRun: [startCCC] "c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe" MSRun mRun: [LogMeIn Hamachi Ui] "c:\program files\logmein hamachi\hamachi-2-ui.exe" --auto-start mRun: [VirtualCloneDrive] "c:\program files\elaborate bytes\virtualclonedrive\VCDDaemon.exe" /s mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime mRun: [PC Auto Shutdown] "c:\program files\pc auto shutdown\AutoShutdown.exe" mRun: [<NO NAME>] mRun: [egui] "c:\program files\eset\eset smart security\egui.exe" /hide /waitservice IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe TCP: Interfaces\{40DA149B-9C43-42ED-9314-CF05F2AEAE85} : DhcpNameServer = 192.168.1.1 Notify: AtiExtEvent - Ati2evxx.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\winxp\system32\wpdshserviceobj.dll . ================= FIREFOX =================== . FF - ProfilePath - c:\documents and settings\your-death\application data\mozilla\firefox\profiles\c9bkjaiz.default\ FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: keyword.URL - hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=GOM2&o=101699&locale=en_US&apn_uid=59D99CD9-8281-4E3B-B0F8-45CCF72323C3&apn_ptnrs=F4&apn_sauid=7B8D532E-C2AD-4244-81A3-F9F7ED75FF03&apn_dtid=YYYYYYYYBG&q= . ============= SERVICES / DRIVERS =============== . R1 ehdrv;ehdrv;c:\winxp\system32\drivers\ehdrv.sys [2010-12-21 115008] R2 ekrn;ESET Service;c:\program files\eset\eset smart security\ekrn.exe [2011-1-12 810144] R2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;c:\program files\logmein hamachi\hamachi-2.exe [2011-5-25 1336712] R2 PCAutoShutdown_Service;PCAutoShutdown_Service;c:\program files\pc auto shutdown\ShutdownService.exe [2011-6-2 441624] S3 Ambfilt;Ambfilt;c:\winxp\system32\drivers\Ambfilt.sys [2011-6-1 1684736] S3 LLRING0;LLRING0;\??\d:\games\emerald mu -player\emerald mu\muguard\llck.sys --> d:\games\emerald mu -player\emerald mu\muguard\llck.sys [?] . =============== Created Last 30 ================ . 2011-06-04 02:58:43 -------- d-----w- c:\documents and settings\your-death\local settings\application data\ESET 2011-06-04 02:58:43 -------- d-----w- c:\documents and settings\your-death\application data\ESET 2011-06-04 02:57:46 -------- d-----w- c:\program files\ESET 2011-06-03 16:43:52 -------- d-----w- c:\documents and settings\your-death\application data\YouTube Downloader 2011-06-03 04:52:09 -------- d-----w- c:\documents and settings\your-death\application data\Search Settings 2011-06-03 04:52:05 -------- d-----w- c:\program files\YouTube Downloader Toolbar 2011-06-03 04:52:05 -------- d-----w- c:\program files\common files\Spigot 2011-06-03 04:52:05 -------- d-----w- c:\program files\Application Updater 2011-06-03 04:51:10 -------- d-----w- c:\program files\YouTube Downloader 2011-06-03 04:44:47 -------- d-----w- c:\program files\PC Auto Shutdown 2011-06-03 04:44:47 -------- d-----w- c:\documents and settings\all users\application data\PC Auto Shutdown 2011-06-03 04:21:03 -------- d-----w- c:\winxp\system32\LogFiles 2011-06-03 04:21:00 26112 -c--a-w- c:\winxp\system32\dllcache\usbser.sys 2011-06-03 04:21:00 26112 ----a-w- c:\winxp\system32\drivers\usbser.sys 2011-06-03 04:20:41 14640 ------w- c:\winxp\system32\spmsgXP_2k3.dll 2011-06-03 02:30:47 -------- d-----w- c:\documents and settings\all users\CyberLink 2011-06-03 02:26:40 -------- d-----w- c:\documents and settings\your-death\local settings\application data\Apple 2011-06-03 02:26:27 -------- d-----w- c:\documents and settings\your-death\local settings\application data\Apple Computer 2011-06-03 02:10:51 608448 ----a-w- c:\winxp\system32\comctl32.ocx 2011-06-03 02:10:42 -------- d-----w- c:\program files\Total Video Converter 2011-06-02 21:48:47 -------- d-----w- c:\winxp\system32\appmgmt 2011-06-02 19:37:11 -------- d-----w- c:\program files\directx 2011-06-02 19:36:34 -------- d-----w- c:\program files\KONAMI 2011-06-02 19:35:57 -------- d-----w- c:\program files\Elaborate Bytes 2011-06-02 19:17:02 -------- d-----w- c:\winxp\system32\Adobe 2011-06-02 19:10:13 -------- d-----w- c:\program files\Kaiba Corp VDS 2011-06-02 19:09:45 26176 ---ha-w- c:\winxp\system32\hamachi.sys 2011-06-02 19:09:34 -------- d-----w- c:\program files\LogMeIn Hamachi 2011-06-02 18:55:17 108336 ----a-w- c:\winxp\system32\MSWINSCK.OCX 2011-06-02 18:53:33 -------- d-----w- c:\documents and settings\your-death\local settings\application data\LogMeIn Hamachi 2011-06-02 18:50:28 26176 ---ha-w- c:\winxp\system32\drivers\hamachi.sys 2011-06-02 18:22:39 67939 ----a-w- c:\winxp\system32\x264vfw-uninstall.exe 2011-06-02 05:14:03 -------- d-----w- c:\program files\uTorrent 2011-06-02 05:13:57 -------- d-----w- c:\documents and settings\your-death\application data\uTorrent 2011-06-02 05:13:48 -------- d-----w- c:\program files\VS Revo Group 2011-06-02 05:10:56 -------- d-----w- c:\documents and settings\your-death\local settings\application data\VS Revo Group . ==================== Find3M ==================== . 2011-06-03 17:04:09 404640 ----a-w- c:\winxp\system32\FlashPlayerCPLApp.cpl 2011-06-02 04:46:36 0 ----a-w- c:\winxp\ativpsrm.bin 2011-04-26 05:58:12 499712 ----a-w- c:\winxp\system32\msvcp71.dll 2011-04-26 05:58:12 348160 ----a-w- c:\winxp\system32\msvcr71.dll . ============= FINISH: 20:13:12.56 =============== . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2011-06-03.01) . Microsoft Windows XP Professional Boot Device: \Device\HarddiskVolume1 Install Date: 6/1/2011 9:30:13 PM System Uptime: 6/3/2011 8:01:12 PM (0 hours ago) . Motherboard: Gigabyte Technology Co., Ltd. | | GA-MA69G-S3H Processor: AMD Athlon 64 X2 Dual Core Processor 3600+ | Socket M2 | 2004/200mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 29 GiB total, 22.435 GiB free. D: is FIXED (NTFS) - 119 GiB total, 11.597 GiB free. E: is CDROM () F: is CDROM () G: is CDROM () H: is CDROM () . ==== Disabled Device Manager Items ============= . Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318} Description: SM Bus Controller Device ID: PCI\VEN_1002&DEV_4385&SUBSYS_43851458&REV_14\3&61AAA01&0&A0 Manufacturer: Name: SM Bus Controller PNP Device ID: PCI\VEN_1002&DEV_4385&SUBSYS_43851458&REV_14\3&61AAA01&0&A0 Service: . Class GUID: {EEC5AD98-8080-425F-922A-DABF3DE3F69A} Description: Nokia 5310 XpressMusic Device ID: ROOT\WPD\0000 Manufacturer: Nokia Name: Nokia 5310 XpressMusic PNP Device ID: ROOT\WPD\0000 Service: WUDFRd . ==== System Restore Points =================== . RP1: 6/1/2011 9:32:36 PM - System Checkpoint RP2: 6/1/2011 9:38:34 PM - Installed AMD Processor Driver RP3: 6/1/2011 9:39:24 PM - Installed REALTEK GbE & FE Ethernet PCI NIC Driver RP4: 6/1/2011 9:40:05 PM - Installed Realtek High Definition Audio Driver RP5: 6/1/2011 9:41:16 PM - Installed Realtek High Definition Audio Driver RP6: 6/2/2011 12:36:33 PM - Installed Yu-Gi-Oh! ONLINE RP7: 6/2/2011 12:45:42 PM - Removed Yu-Gi-Oh! ONLINE RP8: 6/2/2011 2:02:49 PM - Installed Yu-Gi-Oh! ONLINE 3. RP9: 6/2/2011 2:48:42 PM - Removed Yu-Gi-Oh! ONLINE 3. RP10: 6/2/2011 7:22:03 PM - Installed PowerDirector RP11: 6/2/2011 7:42:03 PM - Configured WaveEditor RP12: 6/2/2011 7:44:20 PM - Configured PowerDirector RP13: 6/2/2011 9:20:41 PM - Installed Windows XP Wdf01007. RP14: 6/2/2011 9:21:00 PM - Installed Windows XP Wudf01007. . ==== Installed Programs ====================== . µTorrent Adobe Flash Player 10 ActiveX Adobe Flash Player 10 Plugin Adobe Shockwave Player 11.5 AMD Processor Driver Apple Application Support Apple Software Update ATI AVIVO Codecs ATI Catalyst Install Manager ATI Problem Report Wizard Catalyst Control Center - Branding Catalyst Control Center Graphics Previews Common Catalyst Control Center InstallProxy Catalyst Control Center Localization All ccc-core-static ccc-utility CCC Help Chinese Standard CCC Help Chinese Traditional CCC Help Czech CCC Help Danish CCC Help Dutch CCC Help English CCC Help Finnish CCC Help French CCC Help German CCC Help Greek CCC Help Hungarian CCC Help Italian CCC Help Japanese CCC Help Korean CCC Help Norwegian CCC Help Polish CCC Help Portuguese CCC Help Russian CCC Help Spanish CCC Help Swedish CCC Help Thai CCC Help Turkish ESET Smart Security K-Lite Mega Codec Pack 6.5.0 LogMeIn Hamachi Microsoft .NET Framework 2.0 Microsoft Kernel-Mode Driver Framework Feature Pack 1.7 Microsoft User-Mode Driver Framework Feature Pack 1.7 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 MozBackup 1.4.10 Mozilla Firefox 4.0.1 (x86 bg) MSVC80_x86_v2 Nokia Connectivity Cable Driver Nokia PC Suite PC Auto Shutdown 4.7 PC Connectivity Solution QuickTime REALTEK GbE & FE Ethernet PCI NIC Driver Realtek High Definition Audio Driver Revo Uninstaller 1.92 Security Update for Windows XP (KB923789) Security Update for Windows XP (KB950760) Security Update for Windows XP (KB980195) The KMPlayer (remove only) Total Video Converter 3.21 090220 Update for Microsoft Windows (KB971513) Update for Windows XP (KB2467659) Update for Windows XP (KB898461) VirtualCloneDrive WebFldrs XP Winamp (remove only) Windows Driver Package - Nokia Modem (06/01/2009 7.01.0.4) Windows Driver Package - Nokia Modem (10/05/2009 4.2) Windows Driver Package - Nokia pccsmcfd (08/22/2008 7.0.0.0) WinRAR 4.00 beta 5 (32-bit) x264vfw - H.264/MPEG-4 AVC codec (remove only) YouTube Downloader 2.7.4 YouTube Downloader Toolbar v4.4 . ==== Event Viewer Messages From Past Week ======== . 6/2/2011 9:14:42 PM, error: SideBySide [59] - Resolve Partial Assembly failed for Microsoft.VC80.MFCLOC. Reference error message: The referenced assembly is not installed on your system. . 6/2/2011 9:14:42 PM, error: SideBySide [59] - Generate Activation Context failed for C:\WINXP\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_b77cec8e\MFC80U.DLL. Reference error message: The operation completed successfully. . 6/2/2011 9:14:42 PM, error: SideBySide [32] - Dependent Assembly Microsoft.VC80.MFCLOC could not be found and Last Error was The referenced assembly is not installed on your system. 6/2/2011 12:09:51 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the LogMeIn Hamachi 2.0 Tunneling Engine service to connect. 6/2/2011 12:09:51 PM, error: Service Control Manager [7000] - The LogMeIn Hamachi 2.0 Tunneling Engine service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion. 6/2/2011 11:53:36 AM, error: Dhcp [1001] - Your computer was not assigned an address from the network (by the DHCP Server) for the Network Card with network address 7A790906B262. The following error occurred: The operation was canceled by the user. . Your computer will continue to try and obtain an address on its own from the network address (DHCP) server. 6/1/2011 9:30:23 PM, error: Setup [60055] - Windows Setup encountered non-fatal errors during installation. Please check the setuperr.log found in your Windows directory for more information. . ==== End Of File =========================== Malwarebytes' Anti-Malware 1.50.1.1100 www.malwarebytes.org Database version: 6763 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 6/3/2011 8:54:32 PM mbam-log-2011-06-03 (20-54-30).txt Scan type: Full scan (C:\|D:\|) Objects scanned: 214648 Time elapsed: 34 minute(s), 5 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 3 Folders Infected: 0 Files Infected: 44 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken. Folders Infected: (No malicious items detected) Files Infected: c:\system volume information\_restore{8cf44663-2fe3-4b98-98bc-60735762b360}\RP15\A0004664.dll (Adware.WidgiToolbar) -> No action taken. d:\system volume information\_restore{70559052-386f-4f4a-a2a3-9b96e2ef33a9}\RP68\A0044156.EXE (Dont.Steal.Our.Software) -> No action taken. d:\system volume information\_restore{70559052-386f-4f4a-a2a3-9b96e2ef33a9}\RP68\A0044157.exe (RiskWare.Tool.HCK) -> No action taken. d:\system volume information\_restore{80799a48-f3c5-4031-a81d-4d7ecd546d4c}\RP63\A0049732.exe (RiskWare.Tool.CK) -> No action taken. d:\system volume information\_restore{80799a48-f3c5-4031-a81d-4d7ecd546d4c}\RP69\A0066368.exe (Trojan.Downloader) -> No action taken. d:\system volume information\_restore{8cf44663-2fe3-4b98-98bc-60735762b360}\RP12\A0003309.exe (RiskWare.Tool.CK) -> No action taken. d:\system volume information\_restore{8cf44663-2fe3-4b98-98bc-60735762b360}\RP12\A0003581.EXE (Dont.Steal.Our.Software) -> No action taken. d:\system volume information\_restore{acf8c542-dab3-44a8-a71c-cdd6697422f3}\RP28\A0016406.exe (RiskWare.Tool.CK) -> No action taken. d:\system volume information\_restore{acf8c542-dab3-44a8-a71c-cdd6697422f3}\RP28\A0016411.exe (PUP.Hacktool.Patcher) -> No action taken. d:\system volume information\_restore{acf8c542-dab3-44a8-a71c-cdd6697422f3}\RP28\A0016412.exe (PUP.Hacktool.Patcher) -> No action taken. d:\system volume information\_restore{acf8c542-dab3-44a8-a71c-cdd6697422f3}\RP28\A0016413.exe (RiskWare.Tool.CK) -> No action taken. d:\system volume information\_restore{acf8c542-dab3-44a8-a71c-cdd6697422f3}\RP28\A0016414.exe (Riskware.Tool.CK) -> No action taken. d:\system volume information\_restore{acf8c542-dab3-44a8-a71c-cdd6697422f3}\RP28\A0016415.exe (Riskware.Tool.CK) -> No action taken. d:\system volume information\_restore{d5426944-33bd-4038-b197-8d74ca51e9e0}\RP1\A0003524.exe (RiskWare.Tool.CK) -> No action taken. d:\system volume information\_restore{d5426944-33bd-4038-b197-8d74ca51e9e0}\RP1\A0003544.exe (RiskWare.Tool.CK) -> No action taken. d:\system volume information\_restore{e4df3d11-7cd0-448d-9639-75c0055b0bec}\RP112\A0080156.exe (RiskWare.Tool.CK) -> No action taken. d:\system volume information\_restore{e4df3d11-7cd0-448d-9639-75c0055b0bec}\RP112\A0080292.exe (RiskWare.Tool.CK) -> No action taken. d:\system volume information\_restore{e4df3d11-7cd0-448d-9639-75c0055b0bec}\RP112\A0081574.exe (RiskWare.Tool.CK) -> No action taken. d:\system volume information\_restore{e4df3d11-7cd0-448d-9639-75c0055b0bec}\RP112\A0081816.exe (RiskWare.Tool.CK) -> No action taken. d:\system volume information\_restore{e4df3d11-7cd0-448d-9639-75c0055b0bec}\RP116\A0083999.exe (RiskWare.Tool.CK) -> No action taken. d:\system volume information\_restore{e4df3d11-7cd0-448d-9639-75c0055b0bec}\RP116\A0084110.exe (RiskWare.Tool.CK) -> No action taken. d:\GAMES\counter-strike 1.6 p48\counter-strike 1.6 p48\kzhack by nicking24\Kzhack\Hacks\kzH.exe (RiskWare.Tool.CK) -> No action taken. d:\GAMES\counter-strike 1.6 p48\counter-strike 1.6 p48\config\kzH.exe (RiskWare.Tool.CK) -> No action taken. d:\GAMES\counter-strike 1.6 p48\counter-strike 1.6 p48\cstrike\kzH.exe (RiskWare.Tool.CK) -> No action taken. d:\SOFT\MagicIso\magicisomakerkeygen.exe (Trojan.Downloader) -> No action taken. d:\SOFT\cyberlink.powerdvd.v11.0.ultra.multilingual.incl.keymaker.core\keygen\CORE10k.EXE (Dont.Steal.Our.Software) -> No action taken. d:\SOFT\cyberlink.powerdvd.v11.0.ultra.multilingual.incl.keymaker.core\keygen\keygen.exe (RiskWare.Tool.HCK) -> No action taken. d:\SOFT\vmware workstation full v7.1.3 (build 324285)\keymaker-embrace\keygen.exe (Trojan.Agent.CK) -> No action taken. d:\SOFT\multi password recovery 1.2.3 + portable\multi password recovery 1.2.3 + portable\Crack\MPR.exe (PUP.PasswordView) -> No action taken. d:\SOFT\multi password recovery 1.2.3 + portable\multi password recovery 1.2.3 + portable\multi password recovery 1.2.3 portable\HookLib.dll (PUP.Hooker) -> No action taken. d:\SOFT\multi password recovery 1.2.3 + portable\multi password recovery 1.2.3 + portable\multi password recovery 1.2.3 portable\MPR.exe (PUP.PasswordView) -> No action taken. d:\SOFT\nero burning rom 6.6.1.4+bg+keygen\nero burning rom 6.6.1.4+bg+keygen\nero burning rom 6.6.1.4 keygen.exe (Malware.Packer.Gen) -> No action taken. d:\SOFT\tuneup utilities 2010 9.0.4700.25 incl.keymaker-core\keygen.exe (RiskWare.Tool.HCK) -> No action taken. d:\SOFT\avs video converter 7.0.3.453\avs products patcher-dvt\Patch.exe (RiskWare.Tool.CK) -> No action taken. d:\SOFT\recover my files professional v4.6.6.969-fff\FFF\armaccess.dll (Malware.Packer) -> No action taken. d:\SOFT\xilisoft video converter ultimate 6.0.15.1110\patch-zoo\xilisoft.video.converter.ultimate.6.0.15.1110-patch.exe (PUP.Hacktool.Patcher) -> No action taken. d:\SOFT\xilisoft video converter ultimate v6.5.5.0426-laxity\lxt_xvcu6550426.exe (RiskWare.Tool.CK) -> No action taken. d:\SOFT\internet download manager 6.04 build 3 software + patch\internet download manager 6.04 build 3 software + patch\internet download manager 6.04 build 3 software\idm.6.xx.0.2-snd\SnDk&p.exe (RiskWare.Tool.CK) -> No action taken. d:\SOFT\kaspersky anti-virus + i nternet security 2011 1.0.2.556 cf2 bulgarian\activation\1 - blacklist patch\k11crackv13.exe (RiskWare.Tool.CK) -> No action taken. d:\SOFT\bitdefender antivirus + internet security + total security 2011 v14.0.24.337 incl.activator-box\box_bd2011.exe (RiskWare.Tool.CK) -> No action taken. d:\SOFT\techsmith camtasia studio v5.1.0 build 505\keygen\keygen.exe (Backdoor.RBot) -> No action taken. d:\SOFT\ultraiso.premium.edition.v9.3.6.2760.incl.keygen-zwt\keygen.exe (Riskware.Tool.CK) -> No action taken. d:\SOFT\malwarebytes' anti-malware v1.50.1.1100\w00t.exe (Dont.Steal.Our.Software) -> No action taken. d:\SOFT\malwarebytes.anti-malware.v1.50b.keygen-red\REDKg.exe (Dont.Steal.Our.Software) -> No action taken.

Редактирано 4 юни 201115 г. от nologo (преглед на промените)

Използвате пиратски софтуер, ключови генератори, пачове и пр. Затова:

• Стартирайте отново Malwarebytes' Anti-Malware, обновете я и изберете Quick Scan (бързо сканиране), след това кликнете на Scan.
• Сканирането ще отнеме малко време, затова моля бъдете търпеливи.
• Когато сканирането завърши, кликнете на OK, след това Show Results, за да видите резултата.
• Уверете се, че на всички редове има отметки, и кликнете Remove Selected.
• Когато всичко бъде премахнато, логът ще бъде отворен в Notepad. Копирайте лога и го публикувайте в следващия си коментар в темата.

Забележка: Ако MalwareBytes' Anti-Malware се затрудни в премахването на откритите вируси/заплахи, той ще поиска да рестартира компютъра и по време на рестартирането да премахне проблемните вируси/заплахи. Ако бъдете попитани, потвърдете че желаете вашия компютър да бъде рестартиран.

Malwarebytes' Anti-Malware 1.50.1.1100 www.malwarebytes.org Database version: 6763 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 6/4/2011 11:17:49 AM mbam-log-2011-06-04 (11-17-49).txt Scan type: Quick scan Objects scanned: 135132 Time elapsed: 1 minute(s), 54 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 3 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)

Така вече е по-добре. Следва:

• Изтеглете OTL.exe и го запазете на десктопа.
• Стартирайте файла с двукратен клик на мишката.
• Направете следните настройки:

• Под с Copy/ Paste въведете изцяло следната текстова информация (само това, което е поставено в карето):

netsvcs
drivers32 /all
%SYSTEMDRIVE%\*.*
%PROGRAMFILES%\*.*
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles

• Натиснете маркираният в синьо бутон: .
• Като приключи проверката, ще се създадат два файла - OTL.Txt и Extras.Txt. Прикачете тези два файла в следващия си коментар (погледнете опцията "прикачени файлове", когато публикувате мнение).

ето

OTL.Txt

Extras.Txt

Стартирайте отново OTL и с Copy/ Paste под колонката Custom Scans/Fixes въведете скриптовия текст от текстовото поле по-долу, като не забравяте да копирате скрипта 1 към 1, както и двете точки преди първия ред на скрипта!

:otl
SRV - (HidServ) -- File not found
IE - HKU\S-1-5-21-1060284298-1229272821-1417001333-1003\..\URLSearchHook: {F3FEE66E-E034-436a-86E4-9690573BEE8A} - Reg Error: Value error. File not found
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..extensions.enabledItems: [email protected]:3.11.3.15590
FF - prefs.js..keyword.URL: "http://websearch.ask.com/redirect?client=ff&src=kw&tb=GOM2&o=101699&locale=en_US&apn_uid=59D99CD9-8281-4E3B-B0F8-45CCF72323C3&apn_ptnrs=F4&apn_sauid=7B8D532E-C2AD-4244-81A3-F9F7ED75FF03&apn_dtid=YYYYYYYYBG&q="
[2011/06/02 14:55:47 | 000,002,570 | ---- | M] () -- C:\Documents and Settings\YouR-DeaTh\Application Data\Mozilla\Firefox\Profiles\c9bkjaiz.default\searchplugins\askcom.xml
O2 - BHO: (YouTube Downloader Toolbar) - {F3FEE66E-E034-436a-86E4-9690573BEE8A} - Reg Error: Value error. File not found
O3 - HKLM\..\Toolbar: (YouTube Downloader Toolbar) - {F3FEE66E-E034-436a-86E4-9690573BEE8A} - Reg Error: Value error. File not found
O4 - HKLM..\Run: [] File not found
[2011/06/01 14:07:30 | 000,000,000 | ---D | C] -- C:\WINXP\System32\3076
[2011/06/01 14:07:30 | 000,000,000 | ---D | C] -- C:\WINXP\System32\2052
[2011/06/01 14:07:30 | 000,000,000 | ---D | C] -- C:\WINXP\System32\1054
[2011/06/01 14:07:30 | 000,000,000 | ---D | C] -- C:\WINXP\System32\1042
[2011/06/01 14:07:30 | 000,000,000 | ---D | C] -- C:\WINXP\System32\1041
[2011/06/01 14:07:30 | 000,000,000 | ---D | C] -- C:\WINXP\System32\1037
[2011/06/01 14:07:30 | 000,000,000 | ---D | C] -- C:\WINXP\System32\1033
[2011/06/01 14:07:30 | 000,000,000 | ---D | C] -- C:\WINXP\System32\1031
[2011/06/01 14:07:30 | 000,000,000 | ---D | C] -- C:\WINXP\System32\1028
[2011/06/01 14:07:30 | 000,000,000 | ---D | C] -- C:\WINXP\System32\1025
:files
recycler /alldrives
ipconfig /flushdns /c
:commands
[purity]
[clearallrestorepoints]
[emptytemp]
[emptyflash]
[Reboot]

След като въведете скрипта от цитата по-горе натиснете бутона, маркиран в червено: Run Fix

Ще се създаде лог файл. Публикувайте съдържанието му с Copy/Paste в следващия си коментар.

All processes killed

========== OTL ==========

Service HidServ stopped successfully!

Service HidServ deleted successfully!

File File not found not found.

Registry value HKEY_USERS\S-1-5-21-1060284298-1229272821-1417001333-1003\Software\Microsoft\Internet Explorer\URLSearchHooks\\{F3FEE66E-E034-436a-86E4-9690573BEE8A} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F3FEE66E-E034-436a-86E4-9690573BEE8A}\ deleted successfully.

Prefs.js: "Ask.com" removed from browser.search.defaultengine

Prefs.js: "Ask.com" removed from browser.search.defaultenginename

Prefs.js: "Ask.com" removed from browser.search.order.1

Prefs.js: [email protected]:3.11.3.15590 removed from extensions.enabledItems

Prefs.js: "http://websearch.ask.com/redirect?client=ff&src=kw&tb=GOM2&o=101699&locale=en_US&apn_uid=59D99CD9-8281-4E3B-B0F8-45CCF72323C3&apn_ptnrs=F4&apn_sauid=7B8D532E-C2AD-4244-81A3-F9F7ED75FF03&apn_dtid=YYYYYYYYBG&q=" removed from keyword.URL

C:\Documents and Settings\YouR-DeaTh\Application Data\Mozilla\Firefox\Profiles\c9bkjaiz.default\searchplugins\askcom.xml moved successfully.

Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F3FEE66E-E034-436a-86E4-9690573BEE8A}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F3FEE66E-E034-436a-86E4-9690573BEE8A}\ not found.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{F3FEE66E-E034-436a-86E4-9690573BEE8A} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F3FEE66E-E034-436a-86E4-9690573BEE8A}\ not found.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.

C:\WINXP\System32\3076 folder moved successfully.

C:\WINXP\System32\2052 folder moved successfully.

C:\WINXP\System32\1054 folder moved successfully.

C:\WINXP\System32\1042 folder moved successfully.

C:\WINXP\System32\1041 folder moved successfully.

C:\WINXP\System32\1037 folder moved successfully.

Folder move failed. C:\WINXP\System32\1033 scheduled to be moved on reboot.

C:\WINXP\System32\1031 folder moved successfully.

C:\WINXP\System32\1028 folder moved successfully.

C:\WINXP\System32\1025 folder moved successfully.

========== FILES ==========

C:\RECYCLER\S-1-5-21-1060284298-1229272821-1417001333-1003 folder moved successfully.

C:\RECYCLER folder moved successfully.

D:\RECYCLER\S-1-5-21-789336058-1482476501-682003330-1003\Dd1 folder moved successfully.

D:\RECYCLER\S-1-5-21-789336058-1482476501-682003330-1003 folder moved successfully.

D:\RECYCLER\S-1-5-21-776561741-790525478-1801674531-1003 folder moved successfully.

D:\RECYCLER\S-1-5-21-583907252-1547161642-1417001333-1004 folder moved successfully.

D:\RECYCLER\S-1-5-21-57989841-706699826-1417001333-500 folder moved successfully.

D:\RECYCLER\S-1-5-21-507921405-1123561945-1801674531-1003 folder moved successfully.

D:\RECYCLER\S-1-5-21-448539723-1123561945-1417001333-500 folder moved successfully.

D:\RECYCLER\S-1-5-21-2025429265-1935655697-1957994488-1003 folder moved successfully.

D:\RECYCLER\S-1-5-21-1844237615-1364589140-1417001333-1004 folder moved successfully.

D:\RECYCLER\S-1-5-21-1645522239-492894223-1417001333-500 folder moved successfully.

D:\RECYCLER\S-1-5-21-1202660629-1788223648-682003330-1003 folder moved successfully.

D:\RECYCLER\S-1-5-21-1123561945-1592454029-1177238915-1003 folder moved successfully.

D:\RECYCLER\S-1-5-21-1078081533-220523388-1801674531-1004 folder moved successfully.

D:\RECYCLER\S-1-5-21-1060284298-1229272821-1417001333-1003 folder moved successfully.

D:\RECYCLER folder moved successfully.

< ipconfig /flushdns /c >

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

C:\Documents and Settings\YouR-DeaTh\Desktop\cmd.bat deleted successfully.

C:\Documents and Settings\YouR-DeaTh\Desktop\cmd.txt deleted successfully.

========== COMMANDS ==========

Restore points cleared and new OTL Restore Point set!

[EMPTYTEMP]

User: All Users

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

User: LocalService

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

User: YouR-DeaTh

->Temp folder emptied: 113017454 bytes

->Temporary Internet Files folder emptied: 36567594 bytes

->FireFox cache emptied: 86503677 bytes

->Flash cache emptied: 8323 bytes

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 2577 bytes

%systemroot%\System32\dllcache .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 1410250 bytes

%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes

%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes

RecycleBin emptied: 0 bytes

Total Files Cleaned = 227.00 mb

[EMPTYFLASH]

User: All Users

User: Default User

User: LocalService

User: NetworkService

User: YouR-DeaTh

->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb

OTL by OldTimer - Version 3.2.23.0 log created on 06042011_163734

Files\Folders moved on Reboot...

Folder move failed. C:\WINXP\System32\1033 scheduled to be moved on reboot.

Registry entries deleted on Reboot...

От лога на DDS си личи, че има някакви проблем с драйверите за дъното, по-точно с SM Bus controller. Имате дъно: GA-MA69G-S3H (Gigabyte Technology Co., Ltd.). Драйверите за дъното инсталирани ли са коректно? Има ли проблеми (въпросителни) в Device Manager?

няма драивери на SM Bus Controller http://imageshack.us/photo/my-images/834/26095976.png/

Редактирано 4 юни 201115 г. от YouR-DeaTh (преглед на промените)

Tова ли е дъното -> тук? Ако е това, драйверите за чипсета (Chipset/SATA RAID) се изтеглят от тази страница след избор на операционна система, в случая Windows XP. За лаптоп или за стационарен компютър става дума?

компютър

Добре, пробвайте този драйвер: ATi Chipset Driver (include chipset\sata raid driver) v8.38, ако не е инсталиран.

распозна го като го рестартирах готово

Редактирано 4 юни 201115 г. от YouR-DeaTh
главни букви! (преглед на промените)

Сега има ли забавяне при стартиране или някакви други проблеми с Windows?

не стартира се за 30сек

Сега стартирайте OTL още веднъж и натиснете бутона CleanUp.

При дeинсталацията на OTL ще бъдат почистени инструменти и файлове, които използвахме в темата. Ще последва рестарт на Windows. Ако има други инструменти или логове, изтрийте и тях.

След като няма повече оплаквания от Windows, маркирам проблема като решен. Приятен ден и успех!

Готово Благодаря