Проблем с бавен компютър

7 юни 201115 г.

Здравейте! От скоро компютъра ми е малко бавен и се чудя можете ли да ми помогнете. Разполагам с диск за windowsa. DDS файла _______________________________________________ . DDS (Ver_2011-06-03.01) - NTFSx86 Internet Explorer: 6.0.2900.5512 BrowserJavaVersion: 1.6.0_25 Run by ROSTISLAVTINCHEV at 22:16:10 on 2011-06-07 Microsoft Windows XP Professional 5.1.2600.3.1251.1.1033.18.1919.1062 [GMT 3:00] . AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D} . ============== Running Processes =============== . C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe C:\WINDOWS\system32\Ati2evxx.exe svchost.exe C:\Program Files\AVAST Software\Avast\AvastSvc.exe C:\WINDOWS\Explorer.EXE svchost.exe C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe C:\Program Files\AVAST Software\Avast\avastUI.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\Datecs\Flex2K.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe C:\WINDOWS\System32\svchost.exe -k HTTPFilter C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\plugin-container.exe C:\Program Files\Mozilla Firefox\plugin-container.exe C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE C:\Program Files\Skype\Plugin Manager\skypePM.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://eu.ask.com?o=15854&l=dis mWinlogon: Taskman=c:\documents and settings\rostislavtinchev\cbzvl.exe BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: PandoraTV Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: PandoraTV Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll TB: {32099AAC-C132-4136-9E9A-4E364A424E17} - No File uRun: [uTorrent] "c:\program files\utorrent\uTorrent.exe" uRun: [DAEMON Tools Lite] "c:\program files\daemon tools lite\DTLite.exe" -autorun uRun: [skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe mRun: [QlbCtrl.exe] c:\program files\hewlett-packard\hp quick launch buttons\QlbCtrl.exe /Start mRun: [synTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe mRun: [soundMAXPnP] c:\program files\analog devices\core\smax4pnp.exe mRun: [soundMAX] c:\program files\analog devices\soundmax\Smax4.exe /tray mRun: [startCCC] "c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe" MSRun mRun: [hpWirelessAssistant] c:\program files\hewlett-packard\hp wireless assistant\HPWAMain.exe mRun: [avast] "c:\program files\avast software\avast\avastUI.exe" /nogui mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe" mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 10.0\reader\Reader_sl.exe" mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe" mRun: [<NO NAME>] mRun: [ApnUpdater] "c:\program files\ask.com\updater\Updater.exe" StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\blueso~1.lnk - c:\program files\ivt corporation\bluesoleil\BlueSoleil.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\flexty~1.lnk - c:\windows\datecs\Flex2K.exe IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000 IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab TCP: DhcpNameServer = 212.25.58.229 212.25.58.2 TCP: Interfaces\{33BC2DEC-5939-4AF5-A8A9-9CC2B87AE464} : DhcpNameServer = 212.25.58.229 212.25.58.2 Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL Notify: AtiExtEvent - Ati2evxx.dll . ================= FIREFOX =================== . FF - ProfilePath - c:\documents and settings\rostislavtinchev\application data\mozilla\firefox\profiles\nw1buq4n.default\ FF - prefs.js: browser.search.defaulturl - hxxp://search.aol.com/search/search?query={searchTerms}&invocationType=tb50-ff-aolradio-chromesbox-en-us&tb_uuid=20110504191052343&tb_oid=04-05-2011&tb_mrud=04-05-2011 FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - about:home FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/redirector/sredir?sredir=843&invocationType=tb50-ff-aolradio-ab-en-us&tb_uuid=20110504191052343&tb_oid=04-05-2011&tb_mrud=04-05-2011&query= FF - plugin: c:\docume~1\rostis~1\applic~1\powerc~1\nppowerloader.dll FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll FF - plugin: c:\program files\pando networks\media booster\npPandoWebPlugin.dll . ---- FIREFOX POLICIES ---- FF - user.js: network.protocol-handler.warn-external.dnupdate - false ============= SERVICES / DRIVERS =============== . R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2011-5-2 441176] R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2011-5-2 307928] R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2011-5-2 19544] R2 avast! Antivirus;avast! Antivirus;c:\program files\avast software\avast\AvastSvc.exe [2011-5-2 42184] R3 Com4QLBEx;Com4QLBEx;c:\program files\hewlett-packard\hp quick launch buttons\Com4QLBEx.exe [2011-5-1 193840] R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [2008-7-23 44800] S3 XDva356;XDva356;\??\c:\windows\system32\xdva356.sys --> c:\windows\system32\XDva356.sys [?] . =============== Created Last 30 ================ . 2011-06-07 09:36:54 -------- d-----w- c:\program files\CCleaner 2011-06-06 19:43:21 -------- d-----w- c:\windows\system32\LogFiles 2011-05-31 05:43:00 199168 --sh--r- c:\documents and settings\rostislavtinchev\cbzvl.exe 2011-05-18 20:02:44 -------- d-----w- c:\documents and settings\rostislavtinchev\local settings\application data\Identities 2011-05-12 18:57:36 5888 ------w- c:\windows\system32\drivers\imagedrv.sys 2011-05-12 18:57:36 127488 ------w- c:\windows\system32\drivers\imagesrv.sys 2011-05-12 18:57:24 364544 ------w- c:\windows\system32\TwnLib4.dll 2011-05-12 18:57:24 106496 ----a-w- c:\windows\system32\TwnLib20.dll 2011-05-12 18:57:23 476320 ------w- c:\windows\system32\ImagXpr7.dll 2011-05-12 18:57:23 471040 ------w- c:\windows\system32\ImagXRA7.dll 2011-05-12 18:57:23 262144 ------w- c:\windows\system32\ImagXR7.dll 2011-05-12 18:57:23 1568768 ------w- c:\windows\system32\ImagX7.dll 2011-05-12 18:57:23 155648 ----a-w- c:\windows\system32\NeroCheck.exe . ==================== Find3M ==================== . 2011-05-10 12:10:59 40112 ----a-w- c:\windows\avastSS.scr 2011-05-10 12:03:54 441176 ----a-w- c:\windows\system32\drivers\aswSnx.sys 2011-05-05 19:27:47 73728 ----a-w- c:\windows\system32\javacpl.cpl 2011-05-05 19:27:47 472808 ----a-w- c:\windows\system32\deployJava1.dll 2011-05-02 17:31:26 691696 ----a-w- c:\windows\system32\drivers\sptd.sys 2011-05-02 08:32:22 87280 ----a-w- c:\windows\system32\bcmwlcoi.dll 2011-05-02 08:32:22 1391104 ----a-w- c:\windows\system32\drivers\BCMWL5.SYS 2011-05-01 21:30:57 0 ----a-w- c:\windows\ativpsrm.bin . ============= FINISH: 22:16:41.98 =============== Atach файла ______________________________________________________ . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2011-06-03.01) . Microsoft Windows XP Professional Boot Device: \Device\HarddiskVolume1 Install Date: 5/1/2011 11:26:41 PM System Uptime: 6/7/2011 10:26:45 AM (12 hours ago) . Motherboard: Hewlett-Packard | | 30C2 Processor: AMD Turion 64 X2 Mobile Technology TL-56 | U10 | 1795/200mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 29 GiB total, 20.45 GiB free. D: is FIXED (NTFS) - 120 GiB total, 82.713 GiB free. E: is CDROM () F: is CDROM () . ==== Disabled Device Manager Items ============= . Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318} Description: SM Bus Controller Device ID: PCI\VEN_1002&DEV_4385&SUBSYS_30C2103C&REV_14\3&61AAA01&0&A0 Manufacturer: Name: SM Bus Controller PNP Device ID: PCI\VEN_1002&DEV_4385&SUBSYS_30C2103C&REV_14\3&61AAA01&0&A0 Service: . Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318} Description: Device ID: ACPI\HPQ0004\3&61AAA01&0 Manufacturer: Name: PNP Device ID: ACPI\HPQ0004\3&61AAA01&0 Service: . ==== System Restore Points =================== . RP17: 5/3/2011 8:22:32 PM - Removed League of Legends RP18: 5/3/2011 10:59:00 PM - Installed BlueSoleil RP19: 5/4/2011 11:12:30 AM - Installed Windows KB954550-v5. RP20: 5/4/2011 11:12:38 AM - Printer Driver Microsoft XPS Document Writer Installed RP21: 5/4/2011 11:12:46 AM - Printer Driver Microsoft XPS Document Writer Installed RP22: 5/5/2011 10:27:41 PM - Installed Java 6 Update 25 RP23: 5/7/2011 6:42:26 PM - System Checkpoint RP24: 5/8/2011 1:03:54 PM - Removed Skype Toolbars RP25: 5/12/2011 8:50:27 PM - System Checkpoint RP26: 5/15/2011 2:19:01 PM - System Checkpoint RP27: 5/17/2011 11:41:22 AM - System Checkpoint RP28: 5/19/2011 7:29:49 PM - System Checkpoint RP29: 5/20/2011 11:18:21 PM - System Checkpoint RP30: 5/22/2011 7:15:44 PM - System Checkpoint RP31: 5/25/2011 1:59:57 AM - Installed Adobe Reader X (10.0.1). RP32: 5/27/2011 3:00:16 PM - System Checkpoint RP33: 5/28/2011 5:43:43 PM - System Checkpoint RP34: 5/30/2011 3:53:20 PM - System Checkpoint RP35: 6/2/2011 8:55:59 PM - System Checkpoint RP36: 6/3/2011 10:59:01 PM - System Checkpoint RP37: 6/5/2011 3:16:10 PM - System Checkpoint RP38: 6/7/2011 1:20:40 PM - System Checkpoint . ==== Installed Programs ====================== . Adobe AIR Adobe Flash Player 10 Plugin Adobe Reader X (10.0.1) Agere Systems HDA Modem AOL Radio Toolbar Ask Toolbar ATI - Software Uninstall Utility ATI Catalyst Control Center ATI Display Driver AuthenTec Fingerprint Sensor Minimum Install avast! Free Antivirus BlueSoleil Broadcom 802.11 Wireless LAN Adapter Broadcom NetXtreme Ethernet Controller Catalyst Control Center - Branding Catalyst Control Center Core Implementation Catalyst Control Center Graphics Full Existing Catalyst Control Center Graphics Full New Catalyst Control Center Graphics Light Catalyst Control Center Graphics Previews Common Catalyst Control Center HydraVision Full Catalyst Control Center Localization All ccc-core-preinstall ccc-core-static ccc-utility CCC Help Chinese Standard CCC Help Chinese Traditional CCC Help Czech CCC Help Danish CCC Help Dutch CCC Help English CCC Help Finnish CCC Help French CCC Help German CCC Help Greek CCC Help Hungarian CCC Help Italian CCC Help Japanese CCC Help Korean CCC Help Norwegian CCC Help Polish CCC Help Portuguese CCC Help Russian CCC Help Spanish CCC Help Swedish CCC Help Thai CCC Help Turkish CCleaner Embedded Security for HP ProtectTools Driver FlexType 2K Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595) Hotfix for Windows XP (KB954550-v5) HP Broadband Wireless Modules HP Quick Launch Buttons 6.40 C2 HP Wireless Assistant Java Auto Updater Java 6 Update 25 Microsoft .NET Framework 2.0 Service Pack 2 Microsoft .NET Framework 3.0 Service Pack 2 Microsoft .NET Framework 3.5 SP1 Microsoft Kernel-Mode Driver Framework Feature Pack 1.5 Microsoft Office Professional Edition 2003 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Mozilla Firefox 4.0.1 (x86 bg) Nero 6 Ultra Edition Pando Media Booster Power Challenge Game Plugin Skins Skype™ 5.3 SoundMAX Synaptics Pointing Device Driver The KMPlayer (remove only) WebFldrs XP WinRAR 4.00 (32-bit) µTorrent . ==== Event Viewer Messages From Past Week ======== . 6/7/2011 10:27:19 AM, error: Dhcp [1002] - The IP address lease 192.168.0.101 for the Network Card with network address 0021000288FB has been denied by the DHCP server 192.168.0.1 (The DHCP Server sent a DHCPNACK message). 6/6/2011 10:43:20 PM, error: NetBT [4321] - The name "FROZEN :20" could not be registered on the Interface with IP address 192.168.0.101. The machine with the IP address 192.168.0.100 did not allow the name to be claimed by this machine. 6/6/2011 10:43:20 PM, error: NetBT [4321] - The name "FROZEN :0" could not be registered on the Interface with IP address 192.168.0.101. The machine with the IP address 192.168.0.100 did not allow the name to be claimed by this machine. 6/2/2011 8:48:54 AM, error: Service Control Manager [7000] - The Bluetooth Network Filter service failed to start due to the following error: %1 is not a valid Win32 application. 6/2/2011 12:31:11 AM, error: Server [2505] - The server could not bind to the transport \Device\NetBT_Tcpip_{9891BA07-DC0F-4DA9-BD5D-09F894B8AEF4} because another computer on the network has the same name. The server could not start. 6/2/2011 12:31:11 AM, error: NetBT [4321] - The name "FROZEN :20" could not be registered on the Interface with IP address 192.168.50.1. The machine with the IP address 192.168.50.1 did not allow the name to be claimed by this machine. 6/2/2011 12:31:11 AM, error: NetBT [4321] - The name "FROZEN :0" could not be registered on the Interface with IP address 192.168.50.1. The machine with the IP address 192.168.50.1 did not allow the name to be claimed by this machine. 6/2/2011 12:31:07 AM, error: Dhcp [1002] - The IP address lease 0.0.0.0 for the Network Card with network address 0011670C6B12 has been denied by the DHCP server 192.168.50.254 (The DHCP Server sent a DHCPNACK message). 6/1/2011 9:27:13 AM, error: Dhcp [1008] - Your computer was unable to initialize a Network Interface attached to the system. The error code is: A device attached to the system is not functioning. . 6/1/2011 11:49:51 AM, error: Server [2505] - The server could not bind to the transport \Device\NetBT_Tcpip_{33BC2DEC-5939-4AF5-A8A9-9CC2B87AE464} because another computer on the network has the same name. The server could not start. 6/1/2011 11:49:51 AM, error: NetBT [4321] - The name "FROZEN :20" could not be registered on the Interface with IP address 172.16.1.225. The machine with the IP address 172.16.1.220 did not allow the name to be claimed by this machine. 6/1/2011 11:49:51 AM, error: NetBT [4321] - The name "FROZEN :0" could not be registered on the Interface with IP address 172.16.1.225. The machine with the IP address 172.16.1.220 did not allow the name to be claimed by this machine. . ==== End Of File =========================== Благодаря ви предварително! :eek: :) :) :)

7 юни 201115 г.

Привет, frozenheart. Имате малко проблеми с Windows и донякъде с драйверите за хардуера. Сега ще се опитаме да ги оправим. Затова:

Изтеглете OTL.exe и го запазете на десктопа.
Стартирайте файла с двукратен клик на мишката.
Направете следните настройки:

Под с Copy/ Paste въведете изцяло следната текстова информация (само това, което е поставено в карето):

netsvcs
drivers32 /all
%SYSTEMDRIVE%\*.*
%PROGRAMFILES%\*.*
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles

Натиснете маркираният в синьо бутон: .
Като приключи проверката, ще се създадат два файла - OTL.Txt и Extras.Txt. Прикачете тези два файла в следващия си коментар (погледнете опцията "прикачени файлове", когато публикувате мнение).

7 юни 201115 г.

Автор

Заповядайте и БЛАГОДАРЯ! :ph34r:

OTL.Txt

Extras.Txt

7 юни 201115 г.

Докато огледам логовете на OTL, напишете модела на лаптопа в следващия си коментар.

7 юни 201115 г.

Автор

HP Compaq 6715b ми е лаптопа.

7 юни 201115 г.

О.К. Сега ще премахнем малко Adware и лоши файлове. Затова стартирайте отново OTL и с Copy/ Paste под колонката Custom Scans/Fixes въведете скриптовия текст от текстовото поле по-долу, като не забравяте да копирате скрипта 1 към 1, както и двете точки преди първия ред на скрипта!

:otl
IE - HKU\S-1-5-21-1659004503-2052111302-1801674531-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://eu.ask.com?o=15854&l=dis
[2011/05/02 19:41:50 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Documents and Settings\ROSTISLAVTINCHEV\Application Data\Mozilla\Firefox\Profiles\nw1buq4n.default\extensions\[email protected]
[2011/05/29 21:01:20 | 000,000,000 | ---D | M] (PandoraTV Toolbar) -- C:\Documents and Settings\ROSTISLAVTINCHEV\Application Data\Mozilla\Firefox\Profiles\nw1buq4n.default\extensions\[email protected]
[2011/05/02 19:41:50 | 000,000,863 | ---- | M] () -- C:\Documents and Settings\ROSTISLAVTINCHEV\Application Data\Mozilla\Firefox\Profiles\nw1buq4n.default\searchplugins\conduit.xml
O2 - BHO: (PandoraTV Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (PandoraTV Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKU\S-1-5-21-1659004503-2052111302-1801674531-1003\..\Toolbar\WebBrowser: (no name) - {32099AAC-C132-4136-9E9A-4E364A424E17} - No CLSID value found.
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files\Ask.com\Updater\Updater.exe (Ask)
O4 - HKLM..\Run: [KernelFaultCheck] File not found
O20 - HKLM Winlogon: TaskMan - (C:\Documents and Settings\ROSTISLAVTINCHEV\cbzvl.exe) - C:\Documents and Settings\ROSTISLAVTINCHEV\cbzvl.exe ()
O33 - MountPoints2\{42f833d6-7496-11e0-839f-0021000288fb}\Shell\AutoRun\command - "" = G:\hejmoj/prince.exe
O33 - MountPoints2\{42f833d6-7496-11e0-839f-0021000288fb}\Shell\Explore\command - "" = G:\hejmoj/prince.exe
O33 - MountPoints2\{42f833d6-7496-11e0-839f-0021000288fb}\Shell\Open\command - "" = G:\hejmoj/prince.exe
O33 - MountPoints2\{a5a4d10c-7432-11e0-8398-93dffe94d897}\Shell\AutoRun\command - "" = meden/alirazveden.exe
O33 - MountPoints2\{a5a4d10c-7432-11e0-8398-93dffe94d897}\Shell\Explore\command - "" = meden/alirazveden.exe
O33 - MountPoints2\{a5a4d10c-7432-11e0-8398-93dffe94d897}\Shell\Open\command - "" = meden/alirazveden.exe
[2011/06/07 23:01:00 | 000,000,256 | ---- | M] () -- C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
:files
C:\Documents and Settings\ROSTISLAVTINCHEV\cbzvl.exe
recycler /alldrives
ipconfig /flushdns /c
:commands
[purity]
[emptytemp]
[emptyflash]
[Reboot]

След като въведете скрипта от цитата по-горе натиснете бутона, маркиран в червено: Run Fix

Ще се създаде лог файл. Публикувайте съдържанието му с Copy/Paste в следващия си коментар.

7 юни 201115 г.

Автор

Свърши ми сканирането, но не ми се рестартира компютъра. Също така нямах никакъв .txt файл на дескстопа

Редактирано 7 юни 201115 г. от frozenheart (преглед на промените)

7 юни 201115 г.

Добре, ще проверя по-късно за лога. Сега следва:

Изтеглете Malwarebytes' Anti-Malware от тук, като изберете Malwarebytes Anti-Malware Free.
Кликнете два пъти върху mbam-setup.exe, за да инсталирате програмата. При инсталацията изберете английски език (English). В края на инсталацията на Malwarebytes' Anti-Malware не инсталирайте пробната версия, а само безплатната (Free).
Уверете се, че има отметки на Update Malwarebytes' Anti-Malware и Launch Malwarebytes' Anti-Malware, след това кликнете на Finish. Ако има намерени по-нови обновления, тя ще ги изтегли и инсталира.
Стартирайте програмата и изберете Perform Quick Scan, след това кликнете на Scan.
Сканирането ще отнеме малко време, затова моля бъдете търпеливи.
Когато сканирането завърши, кликнете на OK, след това Show Results, за да видите резултата.
Уверете се, че на всички редове има отметки, и кликнете Remove Selected.
Когато всичко бъде премахнато, логът ще бъде отворен в Notepad. Копирайте лога и го публикувайте в следващия си коментар в темата.

Забележка: Ако MalwareBytes' Anti-Malware се затрудни в премахването на откритите вируси/заплахи, той ще поиска да рестартира компютъра и по време на рестартирането да премахне проблемните вируси/заплахи. Ако бъдете попитани, потвърдете че желаете вашия компютър да бъде рестартиран.

7 юни 201115 г.

Автор

Ето го .txt файла _______________________________________ Malwarebytes' Anti-Malware 1.51.0.1200 www.malwarebytes.org Database version: 6803 Windows 5.1.2600 Service Pack 3 Internet Explorer 6.0.2900.5512 6/8/2011 12:37:51 AM mbam-log-2011-06-08 (00-37-51).txt Scan type: Quick scan Objects scanned: 137724 Time elapsed: 2 minute(s), 19 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 1 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 1 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman (Worm.Palevo) -> Value: Taskman -> Quarantined and deleted successfully. Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: c:\documents and settings\rostislavtinchev\cbzvl.exe (Worm.Palevo) -> Delete on reboot.

7 юни 201115 г.

Сега ми трябва отново сканиране с DDS, както го направихте в първия коментар по темата. Става лесно и бързо.

7 юни 201115 г.

Автор

DSS файла __________________ . DDS (Ver_2011-06-03.01) - NTFSx86 Internet Explorer: 6.0.2900.5512 BrowserJavaVersion: 1.6.0_25 Run by ROSTISLAVTINCHEV at 0:50:07 on 2011-06-08 Microsoft Windows XP Professional 5.1.2600.3.1251.1.1033.18.1919.1260 [GMT 3:00] . AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D} . ============== Running Processes =============== . C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\Program Files\AVAST Software\Avast\AvastSvc.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe C:\Program Files\AVAST Software\Avast\avastUI.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\Datecs\Flex2K.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe C:\WINDOWS\System32\svchost.exe -k HTTPFilter C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\plugin-container.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://eu.ask.com?o=15854&l=dis uWinlogon: Shell=explorer.exe,c:\documents and settings\rostislavtinchev\cbzvl.exe BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: PandoraTV Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: PandoraTV Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll TB: {32099AAC-C132-4136-9E9A-4E364A424E17} - No File uRun: [uTorrent] "c:\program files\utorrent\uTorrent.exe" uRun: [DAEMON Tools Lite] "c:\program files\daemon tools lite\DTLite.exe" -autorun uRun: [skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe mRun: [QlbCtrl.exe] c:\program files\hewlett-packard\hp quick launch buttons\QlbCtrl.exe /Start mRun: [synTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe mRun: [soundMAXPnP] c:\program files\analog devices\core\smax4pnp.exe mRun: [soundMAX] c:\program files\analog devices\soundmax\Smax4.exe /tray mRun: [startCCC] "c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe" MSRun mRun: [hpWirelessAssistant] c:\program files\hewlett-packard\hp wireless assistant\HPWAMain.exe mRun: [avast] "c:\program files\avast software\avast\avastUI.exe" /nogui mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe" mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 10.0\reader\Reader_sl.exe" mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe" mRun: [<NO NAME>] mRun: [ApnUpdater] "c:\program files\ask.com\updater\Updater.exe" StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\blueso~1.lnk - c:\program files\ivt corporation\bluesoleil\BlueSoleil.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\flexty~1.lnk - c:\windows\datecs\Flex2K.exe IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000 IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab TCP: DhcpNameServer = 212.25.58.229 212.25.58.2 TCP: Interfaces\{33BC2DEC-5939-4AF5-A8A9-9CC2B87AE464} : DhcpNameServer = 212.25.58.229 212.25.58.2 Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL Notify: AtiExtEvent - Ati2evxx.dll . ================= FIREFOX =================== . FF - ProfilePath - c:\documents and settings\rostislavtinchev\application data\mozilla\firefox\profiles\nw1buq4n.default\ FF - prefs.js: browser.search.defaulturl - hxxp://search.aol.com/search/search?query={searchTerms}&invocationType=tb50-ff-aolradio-chromesbox-en-us&tb_uuid=20110504191052343&tb_oid=04-05-2011&tb_mrud=04-05-2011 FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - about:home FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/redirector/sredir?sredir=843&invocationType=tb50-ff-aolradio-ab-en-us&tb_uuid=20110504191052343&tb_oid=04-05-2011&tb_mrud=04-05-2011&query= FF - plugin: c:\docume~1\rostis~1\applic~1\powerc~1\nppowerloader.dll FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll FF - plugin: c:\program files\pando networks\media booster\npPandoWebPlugin.dll . ---- FIREFOX POLICIES ---- FF - user.js: network.protocol-handler.warn-external.dnupdate - false ============= SERVICES / DRIVERS =============== . R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2011-5-2 441176] R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2011-5-2 307928] R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2011-5-2 19544] R2 avast! Antivirus;avast! Antivirus;c:\program files\avast software\avast\AvastSvc.exe [2011-5-2 42184] R3 Com4QLBEx;Com4QLBEx;c:\program files\hewlett-packard\hp quick launch buttons\Com4QLBEx.exe [2011-5-1 193840] R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [2008-7-23 44800] S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2011-6-8 39984] S3 XDva356;XDva356;\??\c:\windows\system32\xdva356.sys --> c:\windows\system32\XDva356.sys [?] . =============== Created Last 30 ================ . 2011-06-07 21:33:50 -------- d-----w- c:\documents and settings\rostislavtinchev\application data\Malwarebytes 2011-06-07 21:33:21 39984 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2011-06-07 21:33:20 -------- d-----w- c:\documents and settings\all users\application data\Malwarebytes 2011-06-07 21:33:16 22712 ----a-w- c:\windows\system32\drivers\mbam.sys 2011-06-07 21:33:16 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2011-06-07 09:36:54 -------- d-----w- c:\program files\CCleaner 2011-06-06 19:43:21 -------- d-----w- c:\windows\system32\LogFiles 2011-05-18 20:02:44 -------- d-----w- c:\documents and settings\rostislavtinchev\local settings\application data\Identities 2011-05-12 18:57:36 5888 ------w- c:\windows\system32\drivers\imagedrv.sys 2011-05-12 18:57:36 127488 ------w- c:\windows\system32\drivers\imagesrv.sys 2011-05-12 18:57:24 364544 ------w- c:\windows\system32\TwnLib4.dll 2011-05-12 18:57:24 106496 ----a-w- c:\windows\system32\TwnLib20.dll 2011-05-12 18:57:23 476320 ------w- c:\windows\system32\ImagXpr7.dll 2011-05-12 18:57:23 471040 ------w- c:\windows\system32\ImagXRA7.dll 2011-05-12 18:57:23 262144 ------w- c:\windows\system32\ImagXR7.dll 2011-05-12 18:57:23 1568768 ------w- c:\windows\system32\ImagX7.dll 2011-05-12 18:57:23 155648 ----a-w- c:\windows\system32\NeroCheck.exe . ==================== Find3M ==================== . 2011-05-10 12:10:59 40112 ----a-w- c:\windows\avastSS.scr 2011-05-10 12:03:54 441176 ----a-w- c:\windows\system32\drivers\aswSnx.sys 2011-05-05 19:27:47 73728 ----a-w- c:\windows\system32\javacpl.cpl 2011-05-05 19:27:47 472808 ----a-w- c:\windows\system32\deployJava1.dll 2011-05-02 17:31:26 691696 ----a-w- c:\windows\system32\drivers\sptd.sys 2011-05-02 08:32:22 87280 ----a-w- c:\windows\system32\bcmwlcoi.dll 2011-05-02 08:32:22 1391104 ----a-w- c:\windows\system32\drivers\BCMWL5.SYS 2011-05-01 21:30:57 0 ----a-w- c:\windows\ativpsrm.bin . ============= FINISH: 0:50:46.20 =============== Attach файла __________________________ . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2011-06-03.01) . Microsoft Windows XP Professional Boot Device: \Device\HarddiskVolume1 Install Date: 5/1/2011 11:26:41 PM System Uptime: 6/8/2011 12:38:48 AM (0 hours ago) . Motherboard: Hewlett-Packard | | 30C2 Processor: AMD Turion 64 X2 Mobile Technology TL-56 | U10 | 1795/200mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 29 GiB total, 20.379 GiB free. D: is FIXED (NTFS) - 120 GiB total, 82.715 GiB free. E: is CDROM () F: is CDROM () . ==== Disabled Device Manager Items ============= . Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318} Description: SM Bus Controller Device ID: PCI\VEN_1002&DEV_4385&SUBSYS_30C2103C&REV_14\3&61AAA01&0&A0 Manufacturer: Name: SM Bus Controller PNP Device ID: PCI\VEN_1002&DEV_4385&SUBSYS_30C2103C&REV_14\3&61AAA01&0&A0 Service: . Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318} Description: Device ID: ACPI\HPQ0004\3&61AAA01&0 Manufacturer: Name: PNP Device ID: ACPI\HPQ0004\3&61AAA01&0 Service: . ==== System Restore Points =================== . RP17: 5/3/2011 8:22:32 PM - Removed League of Legends RP18: 5/3/2011 10:59:00 PM - Installed BlueSoleil RP19: 5/4/2011 11:12:30 AM - Installed Windows KB954550-v5. RP20: 5/4/2011 11:12:38 AM - Printer Driver Microsoft XPS Document Writer Installed RP21: 5/4/2011 11:12:46 AM - Printer Driver Microsoft XPS Document Writer Installed RP22: 5/5/2011 10:27:41 PM - Installed Java 6 Update 25 RP23: 5/7/2011 6:42:26 PM - System Checkpoint RP24: 5/8/2011 1:03:54 PM - Removed Skype Toolbars RP25: 5/12/2011 8:50:27 PM - System Checkpoint RP26: 5/15/2011 2:19:01 PM - System Checkpoint RP27: 5/17/2011 11:41:22 AM - System Checkpoint RP28: 5/19/2011 7:29:49 PM - System Checkpoint RP29: 5/20/2011 11:18:21 PM - System Checkpoint RP30: 5/22/2011 7:15:44 PM - System Checkpoint RP31: 5/25/2011 1:59:57 AM - Installed Adobe Reader X (10.0.1). RP32: 5/27/2011 3:00:16 PM - System Checkpoint RP33: 5/28/2011 5:43:43 PM - System Checkpoint RP34: 5/30/2011 3:53:20 PM - System Checkpoint RP35: 6/2/2011 8:55:59 PM - System Checkpoint RP36: 6/3/2011 10:59:01 PM - System Checkpoint RP37: 6/5/2011 3:16:10 PM - System Checkpoint RP38: 6/7/2011 1:20:40 PM - System Checkpoint . ==== Installed Programs ====================== . Adobe AIR Adobe Flash Player 10 Plugin Adobe Reader X (10.0.1) Agere Systems HDA Modem AOL Radio Toolbar Ask Toolbar ATI - Software Uninstall Utility ATI Catalyst Control Center ATI Display Driver AuthenTec Fingerprint Sensor Minimum Install avast! Free Antivirus BlueSoleil Broadcom 802.11 Wireless LAN Adapter Broadcom NetXtreme Ethernet Controller Catalyst Control Center - Branding Catalyst Control Center Core Implementation Catalyst Control Center Graphics Full Existing Catalyst Control Center Graphics Full New Catalyst Control Center Graphics Light Catalyst Control Center Graphics Previews Common Catalyst Control Center HydraVision Full Catalyst Control Center Localization All ccc-core-preinstall ccc-core-static ccc-utility CCC Help Chinese Standard CCC Help Chinese Traditional CCC Help Czech CCC Help Danish CCC Help Dutch CCC Help English CCC Help Finnish CCC Help French CCC Help German CCC Help Greek CCC Help Hungarian CCC Help Italian CCC Help Japanese CCC Help Korean CCC Help Norwegian CCC Help Polish CCC Help Portuguese CCC Help Russian CCC Help Spanish CCC Help Swedish CCC Help Thai CCC Help Turkish CCleaner Embedded Security for HP ProtectTools Driver FlexType 2K Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595) Hotfix for Windows XP (KB954550-v5) HP Broadband Wireless Modules HP Quick Launch Buttons 6.40 C2 HP Wireless Assistant Java Auto Updater Java 6 Update 25 Malwarebytes' Anti-Malware version 1.51.0.1200 Microsoft .NET Framework 2.0 Service Pack 2 Microsoft .NET Framework 3.0 Service Pack 2 Microsoft .NET Framework 3.5 SP1 Microsoft Kernel-Mode Driver Framework Feature Pack 1.5 Microsoft Office Professional Edition 2003 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Mozilla Firefox 4.0.1 (x86 bg) Nero 6 Ultra Edition Pando Media Booster Power Challenge Game Plugin Skins Skype™ 5.3 SoundMAX Synaptics Pointing Device Driver The KMPlayer (remove only) WebFldrs XP WinRAR 4.00 (32-bit) µTorrent . ==== Event Viewer Messages From Past Week ======== . 6/8/2011 12:39:26 AM, error: sr [1] - The System Restore filter encountered the unexpected error '0xC0000001' while processing the file '' on the volume 'HarddiskVolume1'. It has stopped monitoring the volume. 6/7/2011 10:27:19 AM, error: Dhcp [1002] - The IP address lease 192.168.0.101 for the Network Card with network address 0021000288FB has been denied by the DHCP server 192.168.0.1 (The DHCP Server sent a DHCPNACK message). 6/6/2011 10:43:20 PM, error: NetBT [4321] - The name "FROZEN :20" could not be registered on the Interface with IP address 192.168.0.101. The machine with the IP address 192.168.0.100 did not allow the name to be claimed by this machine. 6/6/2011 10:43:20 PM, error: NetBT [4321] - The name "FROZEN :0" could not be registered on the Interface with IP address 192.168.0.101. The machine with the IP address 192.168.0.100 did not allow the name to be claimed by this machine. 6/3/2011 11:33:38 AM, error: Server [2505] - The server could not bind to the transport \Device\NetBT_Tcpip_{33BC2DEC-5939-4AF5-A8A9-9CC2B87AE464} because another computer on the network has the same name. The server could not start. 6/3/2011 11:33:38 AM, error: NetBT [4321] - The name "FROZEN :20" could not be registered on the Interface with IP address 172.16.1.225. The machine with the IP address 172.16.1.220 did not allow the name to be claimed by this machine. 6/3/2011 11:33:38 AM, error: NetBT [4321] - The name "FROZEN :0" could not be registered on the Interface with IP address 172.16.1.225. The machine with the IP address 172.16.1.220 did not allow the name to be claimed by this machine. 6/2/2011 8:48:55 AM, error: Service Control Manager [7000] - The Bluetooth Network Filter service failed to start due to the following error: %1 is not a valid Win32 application. 6/2/2011 12:31:11 AM, error: Server [2505] - The server could not bind to the transport \Device\NetBT_Tcpip_{9891BA07-DC0F-4DA9-BD5D-09F894B8AEF4} because another computer on the network has the same name. The server could not start. 6/2/2011 12:31:11 AM, error: NetBT [4321] - The name "FROZEN :20" could not be registered on the Interface with IP address 192.168.50.1. The machine with the IP address 192.168.50.1 did not allow the name to be claimed by this machine. 6/2/2011 12:31:11 AM, error: NetBT [4321] - The name "FROZEN :0" could not be registered on the Interface with IP address 192.168.50.1. The machine with the IP address 192.168.50.1 did not allow the name to be claimed by this machine. 6/2/2011 12:31:07 AM, error: Dhcp [1002] - The IP address lease 0.0.0.0 for the Network Card with network address 0011670C6B12 has been denied by the DHCP server 192.168.50.254 (The DHCP Server sent a DHCPNACK message). 6/1/2011 9:27:13 AM, error: Dhcp [1008] - Your computer was unable to initialize a Network Interface attached to the system. The error code is: A device attached to the system is not functioning. . . ==== End Of File ===========================

7 юни 201115 г.

Пробвайте отново инструкцията от коментар 6. За всеки случай прикачам един TXT файл:

Отворете го с Notepad, маркирайте с Ctrl+A всичко, после копирайте с Ctrl+С и поставете текста с Ctrl+V под колонката Custom Scans/Fixes. След това натиснете бутона, маркиран в червено: Run Fix и вижте дали ще се получи лог.

7 юни 201115 г.

Автор

All processes killed

========== OTL ==========

HKU\S-1-5-21-1659004503-2052111302-1801674531-1003\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!

C:\Documents and Settings\ROSTISLAVTINCHEV\Application Data\Mozilla\Firefox\Profiles\nw1buq4n.default\extensions\[email protected]\searchplugin folder moved successfully.

C:\Documents and Settings\ROSTISLAVTINCHEV\Application Data\Mozilla\Firefox\Profiles\nw1buq4n.default\extensions\[email protected]\META-INF folder moved successfully.

C:\Documents and Settings\ROSTISLAVTINCHEV\Application Data\Mozilla\Firefox\Profiles\nw1buq4n.default\extensions\[email protected]\lib folder moved successfully.

C:\Documents and Settings\ROSTISLAVTINCHEV\Application Data\Mozilla\Firefox\Profiles\nw1buq4n.default\extensions\[email protected]\DualPackage folder moved successfully.

C:\Documents and Settings\ROSTISLAVTINCHEV\Application Data\Mozilla\Firefox\Profiles\nw1buq4n.default\extensions\[email protected]\defaults folder moved successfully.

C:\Documents and Settings\ROSTISLAVTINCHEV\Application Data\Mozilla\Firefox\Profiles\nw1buq4n.default\extensions\[email protected]\components folder moved successfully.

C:\Documents and Settings\ROSTISLAVTINCHEV\Application Data\Mozilla\Firefox\Profiles\nw1buq4n.default\extensions\[email protected]\chrome folder moved successfully.

C:\Documents and Settings\ROSTISLAVTINCHEV\Application Data\Mozilla\Firefox\Profiles\nw1buq4n.default\extensions\[email protected] folder moved successfully.

C:\Documents and Settings\ROSTISLAVTINCHEV\Application Data\Mozilla\Firefox\Profiles\nw1buq4n.default\extensions\[email protected]\searchplugins folder moved successfully.

C:\Documents and Settings\ROSTISLAVTINCHEV\Application Data\Mozilla\Firefox\Profiles\nw1buq4n.default\extensions\[email protected]\logs folder moved successfully.

C:\Documents and Settings\ROSTISLAVTINCHEV\Application Data\Mozilla\Firefox\Profiles\nw1buq4n.default\extensions\[email protected]\defaults\preferences folder moved successfully.

C:\Documents and Settings\ROSTISLAVTINCHEV\Application Data\Mozilla\Firefox\Profiles\nw1buq4n.default\extensions\[email protected]\defaults folder moved successfully.

C:\Documents and Settings\ROSTISLAVTINCHEV\Application Data\Mozilla\Firefox\Profiles\nw1buq4n.default\extensions\[email protected]\datastore folder moved successfully.

C:\Documents and Settings\ROSTISLAVTINCHEV\Application Data\Mozilla\Firefox\Profiles\nw1buq4n.default\extensions\[email protected]\chrome\temp\ff-config.Tue-03-May-2011-20-13-23-GMT folder moved successfully.

C:\Documents and Settings\ROSTISLAVTINCHEV\Application Data\Mozilla\Firefox\Profiles\nw1buq4n.default\extensions\[email protected]\chrome\temp\ff-config.Thu-05-May-2011-20-45-28-GMT folder moved successfully.

C:\Documents and Settings\ROSTISLAVTINCHEV\Application Data\Mozilla\Firefox\Profiles\nw1buq4n.default\extensions\[email protected]\chrome\temp\ff-config.Sun-29-May-2011-18-40-35-GMT folder moved successfully.

C:\Documents and Settings\ROSTISLAVTINCHEV\Application Data\Mozilla\Firefox\Profiles\nw1buq4n.default\extensions\[email protected]\chrome\temp folder moved successfully.

C:\Documents and Settings\ROSTISLAVTINCHEV\Application Data\Mozilla\Firefox\Profiles\nw1buq4n.default\extensions\[email protected]\chrome\skin folder moved successfully.

C:\Documents and Settings\ROSTISLAVTINCHEV\Application Data\Mozilla\Firefox\Profiles\nw1buq4n.default\extensions\[email protected]\chrome\content folder moved successfully.

C:\Documents and Settings\ROSTISLAVTINCHEV\Application Data\Mozilla\Firefox\Profiles\nw1buq4n.default\extensions\[email protected]\chrome folder moved successfully.

C:\Documents and Settings\ROSTISLAVTINCHEV\Application Data\Mozilla\Firefox\Profiles\nw1buq4n.default\extensions\[email protected] folder moved successfully.

C:\Documents and Settings\ROSTISLAVTINCHEV\Application Data\Mozilla\Firefox\Profiles\nw1buq4n.default\searchplugins\conduit.xml moved successfully.

Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ deleted successfully.

C:\Program Files\Ask.com\GenericAskToolbar.dll moved successfully.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.

File C:\Program Files\Ask.com\GenericAskToolbar.dll not found.

Registry value HKEY_USERS\S-1-5-21-1659004503-2052111302-1801674531-1003\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{32099AAC-C132-4136-9E9A-4E364A424E17} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{32099AAC-C132-4136-9E9A-4E364A424E17}\ not found.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ApnUpdater deleted successfully.

C:\Program Files\Ask.com\Updater\Updater.exe moved successfully.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\KernelFaultCheck deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\TaskMan:C:\Documents and Settings\ROSTISLAVTINCHEV\cbzvl.exe deleted successfully.

File C:\Documents and Settings\ROSTISLAVTINCHEV\cbzvl.exe not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{42f833d6-7496-11e0-839f-0021000288fb}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42f833d6-7496-11e0-839f-0021000288fb}\ not found.

File G:\hejmoj/prince.exe not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{42f833d6-7496-11e0-839f-0021000288fb}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42f833d6-7496-11e0-839f-0021000288fb}\ not found.

File G:\hejmoj/prince.exe not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{42f833d6-7496-11e0-839f-0021000288fb}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42f833d6-7496-11e0-839f-0021000288fb}\ not found.

File G:\hejmoj/prince.exe not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a5a4d10c-7432-11e0-8398-93dffe94d897}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a5a4d10c-7432-11e0-8398-93dffe94d897}\ not found.

File meden/alirazveden.exe not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a5a4d10c-7432-11e0-8398-93dffe94d897}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a5a4d10c-7432-11e0-8398-93dffe94d897}\ not found.

File meden/alirazveden.exe not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a5a4d10c-7432-11e0-8398-93dffe94d897}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a5a4d10c-7432-11e0-8398-93dffe94d897}\ not found.

File meden/alirazveden.exe not found.

C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job moved successfully.

========== FILES ==========

File\Folder C:\Documents and Settings\ROSTISLAVTINCHEV\cbzvl.exe not found.

C:\RECYCLER\S-1-5-21-1659004503-2052111302-1801674531-1003 folder moved successfully.

C:\RECYCLER folder moved successfully.

D:\RECYCLER\S-1-5-21-484763869-1682526488-1417001333-1003 folder moved successfully.

D:\RECYCLER\S-1-5-21-1844237615-573735546-839522115-1003 folder moved successfully.

D:\RECYCLER\S-1-5-21-1659004503-2052111302-1801674531-1003 folder moved successfully.

D:\RECYCLER\S-1-5-21-1644491937-2052111302-725345543-1003 folder moved successfully.

D:\RECYCLER folder moved successfully.

< ipconfig /flushdns /c >

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

C:\Documents and Settings\ROSTISLAVTINCHEV\Desktop\cmd.bat deleted successfully.

C:\Documents and Settings\ROSTISLAVTINCHEV\Desktop\cmd.txt deleted successfully.

========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

->Flash cache emptied: 56466 bytes

User: LocalService

->Temp folder emptied: 65984 bytes

->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

User: ROSTISLAVTINCHEV

->Temp folder emptied: 53937741 bytes

->Temporary Internet Files folder emptied: 164755 bytes

->Java cache emptied: 0 bytes

->FireFox cache emptied: 68357486 bytes

->Flash cache emptied: 58000 bytes

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 2402044 bytes

%systemroot%\System32 .tmp files removed: 2577 bytes

%systemroot%\System32\dllcache .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 0 bytes

%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes

%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes

RecycleBin emptied: 0 bytes

Total Files Cleaned = 119.00 mb

[EMPTYFLASH]

User: All Users

User: Default User

->Flash cache emptied: 0 bytes

User: LocalService

User: NetworkService

User: ROSTISLAVTINCHEV

->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb

OTL by OldTimer - Version 3.2.23.0 log created on 06082011_010341

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

7 юни 201115 г.

Сега ще може ли лог от едно бързо сканиране (Quick Scan) с Malwarebytes' Anti-Malware, за да видя дали гадината Kazy/ Palevo е изчезнала? Ето инструкция:

Обновете (Update) и стартирайте Malwarebytes' Anti-Malware. Изберете Quick Scan, след това кликнете на Scan. Сканирането ще отнеме малко време, затова моля бъдете търпеливи.
Когато сканирането завърши, кликнете на OK, след това -> Show Results, за да видите резултата.
Уверете се (само ако има открити зловредни файлове), че на всички редове има отметки, и кликнете Remove Selected.
Когато всичко бъде премахнато, логът ще бъде отворен в Notepad. Копирайте лога и го публикувайте в следващия си коментар в темата.

Забележка: Ако MalwareBytes' Anti-Malware се затрудни в премахването на откритите вируси/заплахи, той ще поиска да рестартира компютъра и по време на рестартирането да премахне проблемните вируси/заплахи. Ако бъдете попитани, потвърдете че желаете вашия компютър да бъде рестартиран.

8 юни 201115 г.

Автор

Вече го няма :huh: ___________________________________________ Malwarebytes' Anti-Malware 1.51.0.1200 www.malwarebytes.org Database version: 6803 Windows 5.1.2600 Service Pack 3 Internet Explorer 6.0.2900.5512 6/8/2011 10:56:42 AM mbam-log-2011-06-08 (10-56-42).txt Scan type: Quick scan Objects scanned: 137136 Time elapsed: 2 minute(s), 29 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 1 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell (Worm.Palevo) -> Value: Shell -> Quarantined and deleted successfully. Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)

8 юни 201115 г.

Дотук добре. Ето какво предлагам:

Стъпка 1

Следвайте инструкцията за работа с RootRepeal:

Изтеглете ZIP архив на RootRepeal, ето два миръра:geekstogo или psikotick
Разархивирайте RootRepeal.zip на вашия десктоп, стартирайте RootRepeal.exe и направете следните настройки:
Кликнете на таба Report в долната част на прозореца.
Кликнете на бутона Scan
Сложете отметки пред следното:

Drivers

FilesProcessesSSDTStealth ObjectsHidden ServicesShadow SSDT

Кликнете на бутона OK
На следващия диалогов прозорец, сложете отметки преди всички дялове (C:\ , D:\ ....)
Кликнете на OK, за да започне процеса на сканиране

Забележка: Процеса на сканиране може да отнеме време. Моля, не стартирайте никакви програми, докато програмата сканира.

Когато сканирането завърши успешно ще се появи бутона Save Report
Кликнете върху Save Report и запишете лог файла на вашия десктоп, с име RootRepeal.txt
Отворете File, след което Exit, за да затворите програмата.
Копирайте и поставете съдържанието на RootRepeal.txt в следващия си коментар.

Стъпка 2

Според мен драйверите за лаптопа са на тази страница. Пробвайте да изтеглите драйвера за чипсета: Infineon Trusted Platform Module (TPM) Driver -> линк за изтегляне. Файлът за чипсета е sp40431.exe. Стартирайте го, инсталирайте драйверите, рестартирайте и вижте дали има резултат, като отидете в контролния панел -> Device Manager. Там вече не би трябвало да има проблем с SM Bus Controller. Също така забавянето на Windows би трябвало да изчезне.

8 юни 201115 г.

Автор

ROOTREPEAL © AD, 2007-2009 ================================================== Scan Start Time: 2011/06/08 21:15 Program Version: Version 1.3.5.0 Windows Version: Windows XP SP3 ================================================== Drivers ------------------- Name: dump_atapi.sys Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys Address: 0xB0A26000 Size: 98304 File Visible: No Signed: - Status: - Name: dump_WMILIB.SYS Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS Address: 0xBA664000 Size: 8192 File Visible: No Signed: - Status: - Name: PCI_PNP5430 Image Path: \Driver\PCI_PNP5430 Address: 0x00000000 Size: 0 File Visible: No Signed: - Status: - Name: rootrepeal.sys Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys Address: 0xAD454000 Size: 49152 File Visible: No Signed: - Status: - Name: sptd Image Path: \Driver\sptd Address: 0x00000000 Size: 0 File Visible: No Signed: - Status: - Name: spxy.sys Image Path: spxy.sys Address: 0xB9EB4000 Size: 995328 File Visible: No Signed: - Status: - Hidden/Locked Files ------------------- Path: C:\Documents and Settings\All Users\Application Data\AVAST Software\Avast\aswAr.run Status: Invisible to the Windows API! SSDT ------------------- #: 009 Function Name: NtAddBootEntry Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSnx.SYS" at address 0xb0aec202 #: 017 Function Name: NtAllocateVirtualMemory Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xb0b52cb2 #: 025 Function Name: NtClose Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSnx.SYS" at address 0xb0b106c1 #: 035 Function Name: NtCreateEvent Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSnx.SYS" at address 0xb0aee81c #: 036 Function Name: NtCreateEventPair Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSnx.SYS" at address 0xb0aee874 #: 038 Function Name: NtCreateIoCompletion Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSnx.SYS" at address 0xb0aee98a #: 041 Function Name: NtCreateKey Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSnx.SYS" at address 0xb0b10075 #: 043 Function Name: NtCreateMutant Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSnx.SYS" at address 0xb0aee772 #: 050 Function Name: NtCreateSection Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSnx.SYS" at address 0xb0aee8c4 #: 051 Function Name: NtCreateSemaphore Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSnx.SYS" at address 0xb0aee7c6 #: 054 Function Name: NtCreateTimer Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSnx.SYS" at address 0xb0aee938 #: 061 Function Name: NtDeleteBootEntry Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSnx.SYS" at address 0xb0aec226 #: 063 Function Name: NtDeleteKey Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSnx.SYS" at address 0xb0b10d87 #: 065 Function Name: NtDeleteValueKey Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSnx.SYS" at address 0xb0b1103d #: 068 Function Name: NtDuplicateObject Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSnx.SYS" at address 0xb0aeec0e #: 071 Function Name: NtEnumerateKey Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSnx.SYS" at address 0xb0b10bf2 #: 073 Function Name: NtEnumerateValueKey Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSnx.SYS" at address 0xb0b10a5d #: 083 Function Name: NtFreeVirtualMemory Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xb0b52d62 #: 097 Function Name: NtLoadDriver Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSnx.SYS" at address 0xb0aebff0 #: 109 Function Name: NtModifyBootEntry Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSnx.SYS" at address 0xb0aec24a #: 111 Function Name: NtNotifyChangeKey Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSnx.SYS" at address 0xb0aeed82 #: 112 Function Name: NtNotifyChangeMultipleKeys Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSnx.SYS" at address 0xb0aeccda #: 114 Function Name: NtOpenEvent Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSnx.SYS" at address 0xb0aee84c #: 115 Function Name: NtOpenEventPair Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSnx.SYS" at address 0xb0aee89c #: 117 Function Name: NtOpenIoCompletion Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSnx.SYS" at address 0xb0aee9b4 #: 119 Function Name: NtOpenKey Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSnx.SYS" at address 0xb0b103d1 #: 120 Function Name: NtOpenMutant Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSnx.SYS" at address 0xb0aee79e #: 122 Function Name: NtOpenProcess Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSnx.SYS" at address 0xb0aeea46 #: 125 Function Name: NtOpenSection Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSnx.SYS" at address 0xb0aee904 #: 126 Function Name: NtOpenSemaphore Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSnx.SYS" at address 0xb0aee7f4 #: 128 Function Name: NtOpenThread Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSnx.SYS" at address 0xb0aeeb2a #: 131 Function Name: NtOpenTimer Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSnx.SYS" at address 0xb0aee962 #: 137 Function Name: NtProtectVirtualMemory Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xb0b52dfa #: 160 Function Name: NtQueryKey Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSnx.SYS" at address 0xb0b108d8 #: 163 Function Name: NtQueryObject Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSnx.SYS" at address 0xb0aecba0 #: 177 Function Name: NtQueryValueKey Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSnx.SYS" at address 0xb0b1072a #: 192 Function Name: NtRenameKey Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xb0b5be48 #: 204 Function Name: NtRestoreKey Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSnx.SYS" at address 0xb0b0f6e8 #: 211 Function Name: NtSetBootEntryOrder Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSnx.SYS" at address 0xb0aec26e #: 212 Function Name: NtSetBootOptions Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSnx.SYS" at address 0xb0aec292 #: 240 Function Name: NtSetSystemInformation Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSnx.SYS" at address 0xb0aec04a #: 241 Function Name: NtSetSystemPowerState Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSnx.SYS" at address 0xb0aec186 #: 247 Function Name: NtSetValueKey Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSnx.SYS" at address 0xb0b10e8e #: 249 Function Name: NtShutdownSystem Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSnx.SYS" at address 0xb0aec162 #: 255 Function Name: NtSystemDebugControl Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSnx.SYS" at address 0xb0aec1aa #: 268 Function Name: NtVdmControl Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSnx.SYS" at address 0xb0aec2b6 Stealth Objects ------------------- Object: Hidden Code [Driver: Ntfs, IRP_MJ_CREATE] Process: System Address: 0x89d011f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_CLOSE] Process: System Address: 0x89d011f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_READ] Process: System Address: 0x89d011f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_WRITE] Process: System Address: 0x89d011f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_INFORMATION] Process: System Address: 0x89d011f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_INFORMATION] Process: System Address: 0x89d011f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_EA] Process: System Address: 0x89d011f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_EA] Process: System Address: 0x89d011f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_FLUSH_BUFFERS] Process: System Address: 0x89d011f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_VOLUME_INFORMATION] Process: System Address: 0x89d011f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_VOLUME_INFORMATION] Process: System Address: 0x89d011f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_DIRECTORY_CONTROL] Process: System Address: 0x89d011f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_FILE_SYSTEM_CONTROL] Process: System Address: 0x89d011f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x89d011f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_SHUTDOWN] Process: System Address: 0x89d011f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_LOCK_CONTROL] Process: System Address: 0x89d011f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_CLEANUP] Process: System Address: 0x89d011f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_SECURITY] Process: System Address: 0x89d011f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_SECURITY] Process: System Address: 0x89d011f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_QUOTA] Process: System Address: 0x89d011f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_QUOTA] Process: System Address: 0x89d011f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_PNP] Process: System Address: 0x89d011f8 Size: 121 Object: Hidden Code [Driver: Cdrom, IRP_MJ_CREATE] Process: System Address: 0x898af500 Size: 121 Object: Hidden Code [Driver: Cdrom, IRP_MJ_CLOSE] Process: System Address: 0x898af500 Size: 121 Object: Hidden Code [Driver: Cdrom, IRP_MJ_READ] Process: System Address: 0x898af500 Size: 121 Object: Hidden Code [Driver: Cdrom, IRP_MJ_WRITE] Process: System Address: 0x898af500 Size: 121 Object: Hidden Code [Driver: Cdrom, IRP_MJ_FLUSH_BUFFERS] Process: System Address: 0x898af500 Size: 121 Object: Hidden Code [Driver: Cdrom, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x898af500 Size: 121 Object: Hidden Code [Driver: Cdrom, IRP_MJ_INTERNAL_DEVICE_CONTROL] Process: System Address: 0x898af500 Size: 121 Object: Hidden Code [Driver: Cdrom, IRP_MJ_SHUTDOWN] Process: System Address: 0x898af500 Size: 121 Object: Hidden Code [Driver: Cdrom, IRP_MJ_POWER] Process: System Address: 0x898af500 Size: 121 Object: Hidden Code [Driver: Cdrom, IRP_MJ_SYSTEM_CONTROL] Process: System Address: 0x898af500 Size: 121 Object: Hidden Code [Driver: Cdrom, IRP_MJ_PNP] Process: System Address: 0x898af500 Size: 121 Object: Hidden Code [Driver: dmio, IRP_MJ_CREATE] Process: System Address: 0x89d741f8 Size: 121 Object: Hidden Code [Driver: dmio, IRP_MJ_CLOSE] Process: System Address: 0x89d741f8 Size: 121 Object: Hidden Code [Driver: dmio, IRP_MJ_READ] Process: System Address: 0x89d741f8 Size: 121 Object: Hidden Code [Driver: dmio, IRP_MJ_WRITE] Process: System Address: 0x89d741f8 Size: 121 Object: Hidden Code [Driver: dmio, IRP_MJ_FLUSH_BUFFERS] Process: System Address: 0x89d741f8 Size: 121 Object: Hidden Code [Driver: dmio, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x89d741f8 Size: 121 Object: Hidden Code [Driver: dmio, IRP_MJ_INTERNAL_DEVICE_CONTROL] Process: System Address: 0x89d741f8 Size: 121 Object: Hidden Code [Driver: dmio, IRP_MJ_SHUTDOWN] Process: System Address: 0x89d741f8 Size: 121 Object: Hidden Code [Driver: dmio, IRP_MJ_POWER] Process: System Address: 0x89d741f8 Size: 121 Object: Hidden Code [Driver: dmio, IRP_MJ_SYSTEM_CONTROL] Process: System Address: 0x89d741f8 Size: 121 Object: Hidden Code [Driver: dmio, IRP_MJ_PNP] Process: System Address: 0x89d741f8 Size: 121 Object: Hidden Code [Driver: usbohci, IRP_MJ_CREATE] Process: System Address: 0x8995b500 Size: 121 Object: Hidden Code [Driver: usbohci, IRP_MJ_CLOSE] Process: System Address: 0x8995b500 Size: 121 Object: Hidden Code [Driver: usbohci, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x8995b500 Size: 121 Object: Hidden Code [Driver: usbohci, IRP_MJ_INTERNAL_DEVICE_CONTROL] Process: System Address: 0x8995b500 Size: 121 Object: Hidden Code [Driver: usbohci, IRP_MJ_POWER] Process: System Address: 0x8995b500 Size: 121 Object: Hidden Code [Driver: usbohci, IRP_MJ_SYSTEM_CONTROL] Process: System Address: 0x8995b500 Size: 121 Object: Hidden Code [Driver: usbohci, IRP_MJ_PNP] Process: System Address: 0x8995b500 Size: 121 Object: Hidden Code [Driver: Ftdisk, IRP_MJ_CREATE] Process: System Address: 0x89d031f8 Size: 121 Object: Hidden Code [Driver: Ftdisk, IRP_MJ_READ] Process: System Address: 0x89d031f8 Size: 121 Object: Hidden Code [Driver: Ftdisk, IRP_MJ_WRITE] Process: System Address: 0x89d031f8 Size: 121 Object: Hidden Code [Driver: Ftdisk, IRP_MJ_FLUSH_BUFFERS] Process: System Address: 0x89d031f8 Size: 121 Object: Hidden Code [Driver: Ftdisk, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x89d031f8 Size: 121 Object: Hidden Code [Driver: Ftdisk, IRP_MJ_INTERNAL_DEVICE_CONTROL] Process: System Address: 0x89d031f8 Size: 121 Object: Hidden Code [Driver: Ftdisk, IRP_MJ_SHUTDOWN] Process: System Address: 0x89d031f8 Size: 121 Object: Hidden Code [Driver: Ftdisk, IRP_MJ_CLEANUP] Process: System Address: 0x89d031f8 Size: 121 Object: Hidden Code [Driver: Ftdisk, IRP_MJ_POWER] Process: System Address: 0x89d031f8 Size: 121 Object: Hidden Code [Driver: Ftdisk, IRP_MJ_SYSTEM_CONTROL] Process: System Address: 0x89d031f8 Size: 121 Object: Hidden Code [Driver: Ftdisk, IRP_MJ_PNP] Process: System Address: 0x89d031f8 Size: 121 Object: Hidden Code [Driver: a5411gtcȅఅ瑎獆풸푈Ԡ, IRP_MJ_CREATE] Process: System Address: 0x898ab500 Size: 121 Object: Hidden Code [Driver: a5411gtcȅఅ瑎獆풸푈Ԡ, IRP_MJ_CLOSE] Process: System Address: 0x898ab500 Size: 121 Object: Hidden Code [Driver: a5411gtcȅఅ瑎獆풸푈Ԡ, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x898ab500 Size: 121 Object: Hidden Code [Driver: a5411gtcȅఅ瑎獆풸푈Ԡ, IRP_MJ_INTERNAL_DEVICE_CONTROL] Process: System Address: 0x898ab500 Size: 121 Object: Hidden Code [Driver: a5411gtcȅఅ瑎獆풸푈Ԡ, IRP_MJ_POWER] Process: System Address: 0x898ab500 Size: 121 Object: Hidden Code [Driver: a5411gtcȅఅ瑎獆풸푈Ԡ, IRP_MJ_SYSTEM_CONTROL] Process: System Address: 0x898ab500 Size: 121 Object: Hidden Code [Driver: a5411gtcȅఅ瑎獆풸푈Ԡ, IRP_MJ_PNP] Process: System Address: 0x898ab500 Size: 121 Object: Hidden Code [Driver: NetBT, IRP_MJ_CREATE] Process: System Address: 0x898d9500 Size: 121 Object: Hidden Code [Driver: NetBT, IRP_MJ_CLOSE] Process: System Address: 0x898d9500 Size: 121 Object: Hidden Code [Driver: NetBT, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x898d9500 Size: 121 Object: Hidden Code [Driver: NetBT, IRP_MJ_INTERNAL_DEVICE_CONTROL] Process: System Address: 0x898d9500 Size: 121 Object: Hidden Code [Driver: NetBT, IRP_MJ_CLEANUP] Process: System Address: 0x898d9500 Size: 121 Object: Hidden Code [Driver: NetBT, IRP_MJ_PNP] Process: System Address: 0x898d9500 Size: 121 Object: Hidden Code [Driver: usbehci, IRP_MJ_CREATE] Process: System Address: 0x898fd500 Size: 121 Object: Hidden Code [Driver: usbehci, IRP_MJ_CLOSE] Process: System Address: 0x898fd500 Size: 121 Object: Hidden Code [Driver: usbehci, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x898fd500 Size: 121 Object: Hidden Code [Driver: usbehci, IRP_MJ_INTERNAL_DEVICE_CONTROL] Process: System Address: 0x898fd500 Size: 121 Object: Hidden Code [Driver: usbehci, IRP_MJ_POWER] Process: System Address: 0x898fd500 Size: 121 Object: Hidden Code [Driver: usbehci, IRP_MJ_SYSTEM_CONTROL] Process: System Address: 0x898fd500 Size: 121 Object: Hidden Code [Driver: usbehci, IRP_MJ_PNP] Process: System Address: 0x898fd500 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_CREATE] Process: System Address: 0x89ad01f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_CREATE_NAMED_PIPE] Process: System Address: 0x89ad01f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_CLOSE] Process: System Address: 0x89ad01f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_READ] Process: System Address: 0x89ad01f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_WRITE] Process: System Address: 0x89ad01f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_QUERY_INFORMATION] Process: System Address: 0x89ad01f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SET_INFORMATION] Process: System Address: 0x89ad01f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_QUERY_EA] Process: System Address: 0x89ad01f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SET_EA] Process: System Address: 0x89ad01f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_FLUSH_BUFFERS] Process: System Address: 0x89ad01f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_QUERY_VOLUME_INFORMATION] Process: System Address: 0x89ad01f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SET_VOLUME_INFORMATION] Process: System Address: 0x89ad01f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_DIRECTORY_CONTROL] Process: System Address: 0x89ad01f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_FILE_SYSTEM_CONTROL] Process: System Address: 0x89ad01f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x89ad01f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_INTERNAL_DEVICE_CONTROL] Process: System Address: 0x89ad01f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SHUTDOWN] Process: System Address: 0x89ad01f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_LOCK_CONTROL] Process: System Address: 0x89ad01f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_CLEANUP] Process: System Address: 0x89ad01f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_CREATE_MAILSLOT] Process: System Address: 0x89ad01f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_QUERY_SECURITY] Process: System Address: 0x89ad01f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SET_SECURITY] Process: System Address: 0x89ad01f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_POWER] Process: System Address: 0x89ad01f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SYSTEM_CONTROL] Process: System Address: 0x89ad01f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_DEVICE_CHANGE] Process: System Address: 0x89ad01f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_QUERY_QUOTA] Process: System Address: 0x89ad01f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SET_QUOTA] Process: System Address: 0x89ad01f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_PNP] Process: System Address: 0x89ad01f8 Size: 121 Object: Hidden Code [Driver: MA, IRP_MJ_CREATE] Process: System Address: 0x8996d500 Size: 121 Object: Hidden Code [Driver: MA, IRP_MJ_CLOSE] Process: System Address: 0x8996d500 Size: 121 Object: Hidden Code [Driver: MA, IRP_MJ_READ] Process: System Address: 0x8996d500 Size: 121 Object: Hidden Code [Driver: MA, IRP_MJ_QUERY_INFORMATION] Process: System Address: 0x8996d500 Size: 121 Object: Hidden Code [Driver: MA, IRP_MJ_SET_INFORMATION] Process: System Address: 0x8996d500 Size: 121 Object: Hidden Code [Driver: MA, IRP_MJ_QUERY_VOLUME_INFORMATION] Process: System Address: 0x8996d500 Size: 121 Object: Hidden Code [Driver: MA, IRP_MJ_DIRECTORY_CONTROL] Process: System Address: 0x8996d500 Size: 121 Object: Hidden Code [Driver: MA, IRP_MJ_FILE_SYSTEM_CONTROL] Process: System Address: 0x8996d500 Size: 121 Object: Hidden Code [Driver: MA, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x8996d500 Size: 121 Object: Hidden Code [Driver: MA, IRP_MJ_SHUTDOWN] Process: System Address: 0x8996d500 Size: 121 Object: Hidden Code [Driver: MA, IRP_MJ_LOCK_CONTROL] Process: System Address: 0x8996d500 Size: 121 Object: Hidden Code [Driver: MA, IRP_MJ_CLEANUP] Process: System Address: 0x8996d500 Size: 121 Object: Hidden Code [Driver: MA, IRP_MJ_PNP] Process: System Address: 0x8996d500 Size: 121 ==EOF==

8 юни 201115 г.

Драйверът за чипсета инсталиран ли е? Пак ли е бавен Windows? Има ли някакви неразпознати устройства в Device Manager?

8 юни 201115 г.

Автор

SM Bus controller още ми е с въпрос.

8 юни 201115 г.

Хм, значи драйверът за SM Bus controller изисква коректно инсталиран видео драйвер, странно. Затова опитайте да инсталирате видео драйвера ATI Video Driver and Control Panel от тази страница. Директен линк: тук. След това инсталирайте отново драйвера за чипсета и пишете дали има проблем.

8 юни 201115 г.

Автор

Добре. Вече нямам въпросителен на SM Bus controller, но имам на unknown device. Можете ли да ми кажете как мога да го премахна?

8 юни 201115 г.

Проблемът с SM Bus controller беше най-важен. Добре, че го отстранихме. Сега рестартирайте и вижте дали Windows зарежда и работи по-бързо. Вероятно има пропуснати драйвери от страницата, която посочих по-горе. Прегледайте внимателно страницата с драйверите и инсталирайте тези, които липсват. Ако не можете да се справите, пишете. Ще проверим хардуера, става доста лесно.

Редактирано 8 юни 201115 г. от nologo (преглед на промените)

8 юни 201115 г.

Автор

Добре! Благодаря ви много. :biggrin: Лека вечер!

8 юни 201115 г.

Сега стартирайте OTL още веднъж и натиснете бутона CleanUp.

Публикувано изображение

При дeинсталацията на OTL ще бъдат почистени инструменти и файлове, които използвахме в темата. Ще последва рестарт на Windows. Може да оставите Malwarebytes' Anti-Malware Free за периодично сканиране. Програмата не пречи на другите приложения за сигурност.

Имаше доста драйвери, които не бяха инсталирани коректно. Ще изчакам да прегледате страницата и да инсталирате драйверите. Ако след това имате проблем с неразпознати устройства, пишете в тази тема.

8 юни 201115 г.

Автор

Ами можете ли да ми препоръчате някоя добра антивирусна за като по - слаби компютри, и да не товари много компютъра.

Добре дошли!

Проблем с бавен компютър

Featured Replies

Архивирана тема

Разглеждащи това в момента 0

Дарение

Бюлетин

Профил

Навигация

Търсене

Конфигуриране на push известия в браузъра

Chrome (Android)

Chrome (Desktop)

Safari (iOS 16.4+)

Safari (macOS)

Edge (Android)

Edge (Desktop)

Firefox (Android)

Firefox (Desktop)