Здравейте, редовно си сканирам компютъра с MBAM и нищо не намира, но сега като направих новия ъпдейт и ми откри 7 зарази, искам да ви попитам дали може нещо от това да е keylogger и да са ми разбрали паролите :S защото имам един такъв лош спомен. Malwarebytes' Anti-Malware 1.51.0.1200 www.malwarebytes.org Database version: 7139 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 7/14/2011 10:51:41 PM mbam-log-2011-07-14 (22-51-41).txt Scan type: Quick scan Objects scanned: 158133 Time elapsed: 4 minute(s), 58 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 4 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 3 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CLASSES_ROOT\CLSID\{9869EFB4-18E9-11D3-A837-00104B9E30B5} (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\TypeLib\{9869EFA6-18E9-11D3-A837-00104B9E30B5} (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CmdLineExt.CmdLineContextMenu.1 (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CmdLineExt.CmdLineContextMenu (Trojan.Agent) -> Quarantined and deleted successfully. Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: c:\WINDOWS\system32\cmdlineext03.dll (Trojan.Agent) -> Quarantined and deleted successfully. c:\documents and settings\insaneboy\local settings\temp\SIntf32.dll (Trojan.Agent) -> Quarantined and deleted successfully. c:\documents and settings\insaneboy\local settings\temp\SIntfNT.dll (Trojan.Agent) -> Quarantined and deleted successfully.

Редактирано 15 юли 201115 г. от rock n roll (преглед на промените)

СЛЕД това пуснах DDS DDS DDS (Ver_2011-07-14.01) - NTFS_x86 Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_21 Run by Insaneboy at 8:10:54 on 2011-07-15 Microsoft Windows XP Professional 5.1.2600.3.1251.1.1033.18.2047.1142 [GMT -7:00] . AV: ESET NOD32 Antivirus 4.0 *Enabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0} . ============== Running Processes ================ . C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\rundll32.exe C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe C:\Program Files\Skype\Phone\Skype.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe C:\Documents and Settings\Insaneboy\Local Settings\Application Data\Google\Update\1.3.21.57\GoogleCrashHandler.exe C:\Program Files\Datecs\FlexType 2K\FType2K.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe C:\Program Files\PC Connectivity Solution\ServiceLayer.exe C:\WINDOWS\System32\alg.exe C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe C:\Program Files\Skype\Plugin Manager\skypePM.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\plugin-container.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\WINDOWS\system32\svchost.exe -k DcomLaunch C:\WINDOWS\system32\svchost.exe -k rpcss C:\WINDOWS\System32\svchost.exe -k netsvcs C:\WINDOWS\system32\svchost.exe -k NetworkService C:\WINDOWS\system32\svchost.exe -k LocalService C:\WINDOWS\system32\svchost.exe -k LocalService C:\WINDOWS\system32\svchost.exe -k bthsvcs C:\WINDOWS\system32\svchost.exe -k imgsvc C:\WINDOWS\System32\svchost.exe -k HTTPFilter . ============== Pseudo HJT Report =============== . uStart Page = hxxp://www.bigseekpro.com/hypercam/{DD2814B1-439C-4007-9DCC-07A75417A01E} BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: BitComet Helper: {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - c:\program files\bitcomet\tools\BitCometBHO_1.2.6.26.dll BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll uRun: [bitComet] "c:\program files\bitcomet\BitComet.exe" /tray uRun: [Google Update] "c:\documents and settings\insaneboy\local settings\application data\google\update\GoogleUpdate.exe" /c uRun: [PC Suite Tray] "c:\program files\nokia\nokia pc suite 7\PCSuite.exe" -onlytray uRun: [skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background mRun: [bluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent mRun: [egui] "c:\program files\eset\eset nod32 antivirus\egui.exe" /hide /waitservice mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe" mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe" mRunOnce: [Malwarebytes' Anti-Malware] c:\program files\malwarebytes' anti-malware\mbamgui.exe /install /silent StartupFolder: c:\docume~1\insane~1\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe StartupFolder: c:\docume~1\insane~1\startm~1\programs\startup\esetno~1.lnk - c:\program files\eset\eset nod32 antivirus\egui.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\esetno~1.lnk - c:\program files\eset\eset nod32 antivirus\egui.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\flexty~1.lnk - c:\program files\datecs\flextype 2k\FType2K.exe uPolicies-Explorer: NoDriveTypeAutoRun = dword:323 uPolicies-Explorer: NoDriveAutoRun = dword:67108863 uPolicies-Explorer: NoDrives = dword:0 mPolicies-Explorer: NoDriveAutoRun = dword:67108863 mPolicies-Explorer: NoDriveTypeAutoRun = dword:323 mPolicies-Explorer: NoDrives = dword:0 mPolicies-Explorer: NoDriveTypeAutoRun = dword:323 mPolicies-Explorer: NoDriveAutoRun = dword:67108863 IE: &С&валяне &с BitComet - c:\program files\bitcomet\BitComet.exe/AddLink.htm IE: &С&валяне всички видео с BitComet - c:\program files\bitcomet\BitComet.exe/AddVideo.htm IE: &С&валяне всички с BitComet - c:\program files\bitcomet\BitComet.exe/AddAllLink.htm IE: E&xport to Microsoft Excel - c:\progra~1\mi1933~1\office11\EXCEL.EXE/3000 IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} IE: {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - c:\program files\bitcomet\tools\BitCometBHO_1.2.6.26.dll/206 IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab TCP: NameServer = 192.168.1.1 TCP: Interfaces\{7C033661-61B2-4251-85A2-2779380C19C8} : DHCPNameServer = 192.168.1.1 Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\program files\common files\skype\Skype4COM.dll Notify: AtiExtEvent - Ati2evxx.dll mASetup: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "c:\program files\outlook express\setup50.exe" /APP:OE /CALLER:WINNT /user /install mASetup: {7790769C-0471-11d2-AF11-00C04FA35D02} - "c:\program files\outlook express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install IFEO: Your Image File Name Here without a path - ntsd -d . ================= FIREFOX =================== . FF - ProfilePath - c:\documents and settings\insaneboy\application data\mozilla\firefox\profiles\upnk4r34.default\ FF - prefs.js: browser.search.selectedEngine - BigSeekPro FF - prefs.js: browser.startup.homepage - FF - prefs.js: network.proxy.type - 0 FF - plugin: c:\documents and settings\insaneboy\local settings\application data\google\update\1.3.21.57\npGoogleUpdate3.dll FF - plugin: c:\program files\adobe\reader 9.0\reader\air\nppdf32.dll FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} FF - Ext: Easy Youtube Video Downloader: {c0c9a2c7-2e5c-4447-bc53-97718bc91e1b} - %profile%\extensions\{c0c9a2c7-2e5c-4447-bc53-97718bc91e1b} FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b} FF - Ext: Java Quick Starter: [email protected] - c:\program files\java\jre6\lib\deploy\jqs\ff FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension . ============= SERVICES / DRIVERS =============== . R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [2009-5-12 107256] R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2009-5-12 94360] R2 ekrn;ESET Service;c:\program files\eset\eset nod32 antivirus\ekrn.exe [2009-5-12 731840] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S3 ATICDSDr;ATICDSDr;\??\e:\install pack\bin\atiicdxx.sys --> e:\install pack\bin\atiicdxx.sys [?] S3 F-Secure Standalone Minifilter;F-Secure Standalone Minifilter;\??\c:\docume~1\insane~1\locals~1\temp\onlinescanner\anti-virus\fsgk.sys --> c:\docume~1\insane~1\locals~1\temp\onlinescanner\anti-virus\fsgk.sys [?] S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504] S4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\microsoft sql server\100\shared\sqladhlp.exe [2008-7-10 47128] S4 RsFx0102;RsFx0102 Driver;c:\windows\system32\drivers\RsFx0102.sys [2008-7-10 242712] S4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files\microsoft sql server\mssql10.sqlexpress\mssql\binn\SQLAGENT.EXE [2008-7-10 369688] . =============== File Associations =============== . ShellExec: BitComet.exe: open="c:\program files\bitcomet\BitComet.exe" . =============== Created Last 30 ================ . 2011-07-13 02:37:42 -------- d-----w- c:\windows\system32\AGEIA 2011-07-13 02:37:08 -------- d-----w- c:\program files\common files\Wise Installation Wizard 2011-07-12 22:35:13 -------- d-----w- c:\documents and settings\all users\application data\Test Drive Unlimited 2011-07-11 03:40:48 -------- d-----w- c:\documents and settings\insaneboy\local settings\application data\Vagex 2011-07-03 05:08:04 -------- d-----w- c:\program files\common files\TechSmith Shared 2011-07-01 21:44:16 -------- d-----w- c:\windows\53FA9A9F3C194D43AD6BDEF365D469BA.TMP . ==================== Find3M ==================== . 2011-07-12 22:31:02 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2011-07-07 02:52:42 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2011-07-07 02:52:42 22712 ----a-w- c:\windows\system32\drivers\mbam.sys 2011-06-02 14:02:05 1858944 ----a-w- c:\windows\system32\win32k.sys 2011-05-02 15:31:52 692736 ----a-w- c:\windows\system32\inetcomm.dll 2011-04-29 17:25:27 151552 ----a-w- c:\windows\system32\schannel.dll 2011-04-29 16:19:43 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys 2011-04-26 11:07:50 33280 ----a-w- c:\windows\system32\csrsrv.dll 2011-04-26 11:07:50 293376 ----a-w- c:\windows\system32\winsrv.dll 2011-04-25 16:11:12 916480 ----a-w- c:\windows\system32\wininet.dll 2011-04-25 16:11:11 43520 ----a-w- c:\windows\system32\licmgr10.dll 2011-04-25 16:11:11 1469440 ----a-w- c:\windows\system32\inetcpl.cpl 2011-04-25 12:01:22 385024 ----a-w- c:\windows\system32\html.iec 2011-04-21 13:37:43 105472 ----a-w- c:\windows\system32\drivers\mup.sys . ============= FINISH: 8:11:01.01 =============== attach . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2011-07-14.01) . Microsoft Windows XP Professional Boot Device: \Device\HarddiskVolume1 Install Date: 9/3/2010 9:34:51 AM System Uptime: 7/14/2011 10:54:13 PM (10 hours ago) . Motherboard: MICRO-STAR INTERNATIONAL CO.,LTD | | MS-7388 Processor: AMD Athlon 64 X2 Dual Core Processor 5000+ | CPU 1 | 2600/200mhz . ==== Disk Partitions ========================= . A: is Removable C: is FIXED (NTFS) - 134 GiB total, 1.773 GiB free. D: is FIXED (NTFS) - 462 GiB total, 212.796 GiB free. E: is CDROM () F: is CDROM () . ==== Disabled Device Manager Items ============= . Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318} Description: Audio Device on High Definition Audio Bus Device ID: HDAUDIO\FUNC_01&VEN_1002&DEV_AA01&SUBSYS_00AA0100&REV_1000\5&AC286C1&0&0001 Manufacturer: Name: Audio Device on High Definition Audio Bus PNP Device ID: HDAUDIO\FUNC_01&VEN_1002&DEV_AA01&SUBSYS_00AA0100&REV_1000\5&AC286C1&0&0001 Service: . Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318} Description: SM Bus Controller Device ID: PCI\VEN_1002&DEV_4385&SUBSYS_73881462&REV_14\3&267A616A&0&A0 Manufacturer: Name: SM Bus Controller PNP Device ID: PCI\VEN_1002&DEV_4385&SUBSYS_73881462&REV_14\3&267A616A&0&A0 Service: . ==== System Restore Points =================== . RP103: 7/4/2011 12:36:49 AM - System Checkpoint RP104: 7/5/2011 12:44:02 AM - System Checkpoint RP105: 7/6/2011 2:40:23 AM - System Checkpoint RP106: 7/7/2011 3:09:47 AM - System Checkpoint RP107: 7/8/2011 4:09:47 AM - System Checkpoint RP108: 7/9/2011 5:09:47 AM - System Checkpoint RP109: 7/10/2011 5:34:37 AM - System Checkpoint RP110: 7/11/2011 6:09:49 AM - System Checkpoint RP111: 7/12/2011 7:09:47 AM - System Checkpoint RP112: 7/12/2011 3:18:25 PM - Installed Test Drive Unlimited RP113: 7/12/2011 7:37:40 PM - Installed NVIDIA PhysX RP114: 7/13/2011 9:32:32 PM - System Checkpoint RP115: 7/14/2011 3:00:14 AM - Software Distribution Service 3.0 RP116: 7/15/2011 3:26:53 AM - System Checkpoint . ==== Installed Programs ====================== . Adobe Bridge 1.0 Adobe Common File Installer Adobe Flash Player 10 Plugin Adobe Help Center 1.0 Adobe Photoshop CS2 Adobe Reader 9.4.5 - Bulgarian Adobe Stock Photos 1.0 BitComet 1.03 Camtasia Studio 7 CPA Blaster ESET NOD32 Antivirus Google Chrome K-Lite Codec Pack 7.1.0 (Full) Malwarebytes' Anti-Malware version 1.51.1.1800 Microsoft .NET Framework 2.0 Service Pack 2 Microsoft .NET Framework 4 Client Profile Microsoft .NET Framework 4 Extended Mozilla Firefox (3.6.18) NVIDIA PhysX Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708) Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663) Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870) Security Update for Microsoft .NET Framework 4 Extended (KB2416472) Security Update for Windows Internet Explorer 8 (KB2497640) Security Update for Windows Internet Explorer 8 (KB2510531) Security Update for Windows Internet Explorer 8 (KB2530548) Security Update for Windows Internet Explorer 8 (KB2544521) Security Update for Windows XP (KB2412687) Security Update for Windows XP (KB2476490) Security Update for Windows XP (KB2479943) Security Update for Windows XP (KB2481109) Security Update for Windows XP (KB2485663) Security Update for Windows XP (KB2503658) Security Update for Windows XP (KB2503665) Security Update for Windows XP (KB2506212) Security Update for Windows XP (KB2506223) Security Update for Windows XP (KB2507618) Security Update for Windows XP (KB2507938) Security Update for Windows XP (KB2508272) Security Update for Windows XP (KB2508429) Security Update for Windows XP (KB2509553) Security Update for Windows XP (KB2511455) Security Update for Windows XP (KB2524375) Security Update for Windows XP (KB2535512) Security Update for Windows XP (KB2536276) Security Update for Windows XP (KB2544893) Security Update for Windows XP (KB2555917) Skype™ 3.8 TeamViewer 6 Update for Microsoft .NET Framework 4 Client Profile (KB2473228) Update for Windows XP (KB2541763) Update for Windows XP (KB971029) Video Spin Blaster Yu-Gi-Oh! Power of Chaos JOEY THE PASSION Yu-Gi-Oh! Power of Chaos KAIBA THE REVENGE . ==== Event Viewer Messages From Past Week ======== . 7/14/2011 10:54:56 PM, error: sr [1] - The System Restore filter encountered the unexpected error '0xC0000001' while processing the file '' on the volume 'HarddiskVolume1'. It has stopped monitoring the volume. . ==== End Of File ===========================

Здравейте...!

• Изтеглете OTL.exe и го запазете на десктопа.
• Стартирайте файла с двукратен клик на мишката.
• Направете следните настройки:

• Под с Copy/ Paste въведете изцяло следната текстова информация (само това, което е поставено в карето):

netsvcs
msconfig
drivers32 /all
%SYSTEMDRIVE%\*.*
%PROGRAMFILES%\*.*
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%PROGRAMFILES%\Internet Explorer\*.tmp
%PROGRAMFILES%\Internet Explorer\*.dat
/md5start
rpcapd.exe
Packet.dll
WanPacket.dll
npf.sys
pthreadVC.dll
atapi.sys
iaStor.sys
explorer.exe
svchost.exe
userinit.exe
hlp.dat
winlogon.exe
wininit.exe
volsnap.sys
/md5stop

• Натиснете маркираният в синьо бутон: .
• Като приключи проверката, ще се създадат два файла - OTL.Txt и Extras.Txt. Прикачете тези два файла в следващия си коментар (погледнете опцията "прикачени файлове", когато публикувате мнение).

Ето:

OTL.Txt

Extras.Txt

Стартирайте отново OTL и с Copy/ Paste под колонката Custom Scans/Fixes въведете скриптовия текст от текстовото поле по-долу, като не забравяте да копирате скрипта 1 към 1, както и двете точки преди първия ред на скрипта!

:OTL
O3 - HKU\S-1-5-21-1078081533-926492609-682003330-1003\..\Toolbar\WebBrowser: (no name) - {32099AAC-C132-4136-9E9A-4E364A424E17} - No CLSID value found.

:Reg

:files

autorun.inf /alldrives
autorun.exe /alldrives 
recycler /alldrives
ipconfig /flushdns /c


:Commands
[purity]
[emptytemp]
[clearallrestorepoints]
[CreateRestorePoint]
[emptyflash]
[Reboot]

След като въведете скрипта от цитата по-горе натиснете бутона, маркиран в червено: Run Fix

Windows ще се рестартира и ще се създаде лог файл. Публикувайте съдържанието му с Copy/Paste в следващия си коментар.

===============================================================================================================

Моля, изтеглете aswMBR и го запазете на вашия десктоп.

• Кликнете с двоен клин на мишката върху файла aswMBR.exe за да го стартирате.
• Изберете Scan бутона, за да започне проверката.
• Когато проверката завърши, натиснете бутона save log, запазете съдържанието на лог файла на десктопа и публикувайте съдържанието му в следващия си коментар.

Ето лога от OTL:

All processes killed

========== OTL ==========

Registry value HKEY_USERS\S-1-5-21-1078081533-926492609-682003330-1003\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{32099AAC-C132-4136-9E9A-4E364A424E17} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{32099AAC-C132-4136-9E9A-4E364A424E17}\ not found.

========== REGISTRY ==========

========== FILES ==========

autorun.inf not found in C:\

autorun.inf not found in D:\

autorun.exe not found in C:\

autorun.exe not found in D:\

C:\RECYCLER\S-1-5-21-1078081533-926492609-682003330-1003 folder moved successfully.

C:\RECYCLER folder moved successfully.

D:\RECYCLER\S-1-5-21-1078081533-926492609-682003330-1003 folder moved successfully.

D:\RECYCLER folder moved successfully.

< ipconfig /flushdns /c >

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

C:\Documents and Settings\Insaneboy\Desktop\cmd.bat deleted successfully.

C:\Documents and Settings\Insaneboy\Desktop\cmd.txt deleted successfully.

========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

User: Insaneboy

->Temp folder emptied: 213073465 bytes

->Temporary Internet Files folder emptied: 291584757 bytes

->Java cache emptied: 1712917 bytes

->FireFox cache emptied: 99350613 bytes

->Google Chrome cache emptied: 9982600 bytes

->Flash cache emptied: 9816 bytes

User: LocalService

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 398909 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32\dllcache .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 1126020 bytes

%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes

%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes

RecycleBin emptied: 0 bytes

Total Files Cleaned = 589.00 mb

Restore points cleared and new OTL Restore Point set!

Error starting restore point: System Restore is disabled.

Error closing restore point: System Restore is disabled.

[EMPTYFLASH]

User: All Users

User: Default User

User: Insaneboy

->Flash cache emptied: 0 bytes

User: LocalService

User: NetworkService

Total Flash Files Cleaned = 0.00 mb

OTL by OldTimer - Version 3.2.26.1 log created on 07152011_150811

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

Ето и aswMBR лога:

aswMBR version 0.9.7.750 Copyright© 2011 AVAST Software

Run date: 2011-07-15 15:16:46

-----------------------------

15:16:46.250 OS Version: Windows 5.1.2600 Service Pack 3

15:16:46.250 Number of processors: 2 586 0x6B02

15:16:46.250 ComputerName: INSANEBO-191771 UserName: Insaneboy

15:16:46.781 Initialize success

15:17:03.984 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T1L0-5

15:17:03.984 Disk 0 Vendor: WDC_WD6400AAKS-22A7B0 01.03B01 Size: 610480MB BusType: 3

15:17:03.984 Disk 0 MBR read error 0

15:17:03.984 Disk 0 MBR scan

15:17:03.984 Disk 0 unknown MBR code

15:17:03.984 MBR BIOS signature not found 0

15:17:03.984 Disk 0 scanning sectors +1250258625

15:17:04.000 Disk 0 scanning C:\WINDOWS\system32\drivers

15:17:17.250 Service scanning

15:17:18.109 Disk 0 trace - called modules:

15:17:18.109 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys spgc.sys >>UNKNOWN [0x89e04938]<<

15:17:18.109 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x89da3ab8]

15:17:18.109 3 CLASSPNP.SYS[ba0e8fd7] -> nt!IofCallDriver -> \Device\00000068[0x89d9a510]

15:17:18.109 5 ACPI.sys[b9e74620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP1T1L0-5[0x89d8e940]

15:17:18.125 Scan finished successfully

15:21:28.187 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Insaneboy\Desktop\MBR.dat"

15:21:28.203 The log file has been saved successfully to "C:\Documents and Settings\Insaneboy\Desktop\aswMBR.txt"

Редактирано 15 юли 201115 г. от rock n roll (преглед на промените)

Деинсталирайте OTL така:

Стартирайте OTL още веднъж и натиснете бутона CleanUp.

Ще последва рестарт на Windows..!

След това контролни сканирания с:

* Изтеглете Malwarebytes' Anti-Malware или от тук

* Кликнете два пъти върху mbam-setup.exe, за да инсталирате програмата.

* Уверете се, че са поставени отметки на Update Malwarebytes' Anti-Malware и Launch Malwarebytes' Anti-Malware. След това кликнете на Finish.

* Ако има намерени обновявания, тя ще ги изтегли и инсталира.

* Стартирайте програмата и изберете "Perform Full Scan", след това кликнете на Scan.

* Сканирането ще отнеме малко време, затова моля да бъдете търпеливи.

* Когато сканирането завърши, кликнете на OK, след това Show Results, за да видите резултата.

* Уверете се, че на всички редове има отметки, и кликнете на Remove Selected.

* Когато всичко бъде премахнато, в Notepad ще бъде отворен лог. Копирайте този лог и го публикувайте в следващия си коментар по темата.

Забележка: Ако MalwareBytes' Anti-Malware се затрудни в премахването на откритите вируси/заплахи, той ще поиска да рестартира компютъра Ви и по време на рестартирането да премахне проблемните вируси/заплахи. Ако бъдете попитани, потвърдете че желаете вашия компютър да бъде рестартиран.

• Изтеглете програмата: ESET Online Scanner
• Стартирайте esetsmartinstaller_enu.exe
• Сложете отметка на YES, I accept the Terms of Use и изберете Start:

  

• Скенерът ще започне да изтегля компонентите, които са му необходими:

  

• Уверете се, че има отметки на следните редове:

  

  Накрая изберете Start

• Скенерът ще започне да изтегля последните дефиниции.
• След, като сканирането завърши изберете Finish.
• Отидете в: C:\Program Files\ESET\ESET Online Scanner
• Отворете файла log.txt , копирайте съдържанието му и го поставете в следващия си коментар.

Преди да продължа със скановете искам да ви попитам, че нещо стана с анвирусната ми NOD32 почна да дава грешка - няма връзка с ядрото или нещо от сорта и я деинсталирах, но сега като я инсталирам отново дава това

Използвам съм F-secure online scanner отдавна но е изтрит отвсякъде и въпреки всичко това още го дава... какво да направя?

Вие сте го използвали ама има остатъци....

S3 F-Secure Standalone Minifilter;F-Secure Standalone  Minifilter;\??\c:\docume~1\insane~1\locals~1\temp\onlinescanner\anti-virus\fsgk.sys  -->  c:\docume~1\insane~1\locals~1\temp\onlinescanner\anti-virus\fsgk.sys [?]

Опитай с този тоол:

UninstallationTool

Не стана, пак го открива...

Цццц ,че изтрихме OTL...!

* Изтеглете TFC (Temp File Cleaner) от тук и го запишете на десктопа

* Стартирайте TFC.exe

* Имайте търпение и изчакайте програмата да завърши работата си

* Ако е необходимо, потвърдете с OK за рестартиране на Windows

• Изтеглете OTL.exe и го запазете на десктопа.
• Стартирайте файла с двукратен клик на мишката.
• Направете следните настройки:

Натиснете бутона ...Ще се създаде лог файл. Публикувайте съдържанието му с Copy/Paste в следващия си коментар.

TFC свърши буквално за секунда OTL създаде OTL.txt и Extras.txt:

OTL.Txt

Extras.Txt

Стига е...няма го остатъка....!Я опитай да инсталираш ...!!!

Егати

Може би просто да му дам игнорирай...

Може би просто да му дам игнорирай...

Да опитай така...!

Malwarebytes' Anti-Malware 1.51.1.1800 www.malwarebytes.org Database version: 7152 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 7/16/2011 12:31:32 AM mbam-log-2011-07-16 (00-31-32).txt Scan type: Full scan (C:\|D:\|) Objects scanned: 282594 Time elapsed: 45 minute(s), 47 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)

И скана от ESET Online: ESETSmartInstaller@High as downloader log: all ok # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6528 # api_version=3.0.2 # EOSSerial=43f17dc52de3514cac4d6dad661a1a30 # end=finished # remove_checked=true # archives_checked=true # unwanted_checked=true # unsafe_checked=true # antistealth_checked=true # utc_time=2011-07-16 10:36:33 # local_time=2011-07-16 03:36:33 (-0800, Pacific Daylight Time) # country="Bulgaria" # lang=1033 # osver=5.1.2600 NT Service Pack 3 # compatibility_mode=8199 39157077 100 100 0 67745705 0 0 # scanned=140171 # found=0 # cleaned=0 # scan_time=10182 # nod_component=V3 Build:0x30000000

Перфектно...!

Деинсталирайте OTL така:

Стартирайте OTL още веднъж и натиснете бутона CleanUp.

Ще последва рестарт на Windows..!

Деинсталирайте и ESET Online Scanner....!

Друго нередно не виждам...Системата е чиста....!Пожелавам лек ден и безопасен Интернет...!

Много благодаря за помощта и отделеното време!