Вирус от Facebook

28 юли 201115 г.

Здравейте,заразих се от съобщение от чата,"инсталирах" Флаш плеъра който се "Изисква" за да видя някакво клишче.ВЕднага се усетих че е вирус и премахнах съмнителният файл и убих процеса с Диспечър на задачите ->Процеси имаше и още два процеса имената им бяха нещо от сорта на "1926434...." -НЕ разполагам с диск с Windows.-

От тогава нямам Facebook когато се опитам да вляза ме препраща към http://facebook.com/xampp

Прочетох в И-нет ,че проблемът ми идва от hosts файл затова го подмених с нов.Така имах достъп до ФейсБук няколко часа и след това пак същото..

Използвам: Malwarebytes' Anti-Malware 1.51.1.1800 но тогава не бях пуснал Защитният Модул.

Идвам от тук .

DDS.txt:

.

DDS (Ver_2011-06-23.01) - NTFSAMD64

Internet Explorer: 9.0.8112.16421

Run by Vivacom at 22:03:03 on 2011-07-28

Microsoft Windows 7 Home Premium 6.1.7601.1.1251.359.1026.18.1978.989 [GMT 3:00]

.

AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}

SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

============== Running Processes ===============

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\WLANExt.exe

C:\Windows\system32\conhost.exe

C:\Windows\system32\taskeng.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\rundll32.exe

C:\Windows\SysWOW64\rundll32.exe

c:\xampp\apache\bin\httpd.exe

C:\ProgramData\DatacardService\DCService.exe

C:\Program Files (x86)\Launch Manager\dsiwmis.exe

C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe

c:\xampp\filezillaftp\filezillaserver.exe

C:\Program Files (x86)\Acer\Registration\GREGsvc.exe

C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe

c:\xampp\mysql\bin\mysqld.exe

C:\Windows\System32\svchost.exe -k HPZ12

C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe

C:\Windows\System32\svchost.exe -k HPZ12

C:\Windows\system32\svchost.exe -k imgsvc

C:\Program Files\Acer\Acer Updater\UpdaterService.exe

C:\xampp\apache\bin\httpd.exe

C:\Windows\servicing\TrustedInstaller.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Windows\system32\taskhost.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\ProgramData\DatacardService\DCSHelper.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe

C:\Windows\System32\igfxtray.exe

C:\Windows\System32\hkcmd.exe

C:\Windows\System32\igfxpers.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Windows\PLFSetI.exe

C:\Windows\system32\igfxsrvc.exe

C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe

C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files (x86)\uTorrent\uTorrent.exe

C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

C:\Program Files (x86)\Launch Manager\LManager.exe

C:\Windows\system32\igfxext.exe

C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe

C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Program Files (x86)\Launch Manager\LMworker.exe

C:\Windows\system32\SearchIndexer.exe

C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe

C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Program Files (x86)\VIVACOM 3G USB Modem\VIVACOM 3G USB Modem.exe

C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Windows\system32\WUDFHost.exe

C:\Program Files (x86)\Internet Explorer\iexplore.exe

C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe

C:\Program Files (x86)\Internet Explorer\iexplore.exe

C:\Windows\system32\taskhost.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\conhost.exe

C:\Windows\SysWOW64\cscript.exe

C:\Windows\system32\wbem\wmiprvse.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://wpbg.hit.bg/

uDefault_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0402&m=aspire_5336&r=27360511m825l0444z145v47i21754

mDefault_Page_URL = hxxp://www.kaiowas.biz

mStart Page = hxxp://www.kaiowas.biz

uURLSearchHooks: H - No File

mWinlogon: Userinit=userinit.exe,

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO: Помощ за влизане на Windows Live: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll

BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll

TB: {BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} - No File

TB: {30F9B915-B755-4826-820B-08FBA6BD249D} - No File

{555d4d79-4bd2-4094-a395-cfc534424a05}

uRun: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

uRun: [uTorrent] "C:\Program Files (x86)\uTorrent\uTorrent.exe"

mRun: [iAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

mRun: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe

mRun: [suiteTray] "C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe"

mRun: [EgisUpdate] "C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe" -d

mRun: [EgisTecPMMUpdate] "C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe"

mRun: [backupManagerTray] "C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe" -h -k

mRun: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime

mRun: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray

mPolicies-explorer: NoActiveDesktop = 1 (0x1)

mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)

mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)

mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)

mPolicies-system: EnableLUA = 0 (0x0)

mPolicies-system: EnableSecureUIAPaths = 0 (0x0)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

mPolicies-system: PromptOnSecureDesktop = 0 (0x0)

IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000

IE: Google Sidewiki... - C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_43C348BC2E93EB2B.dll/cmsidewiki.html

IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5}

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab

DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} - hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework//microsoft/wrc32.ocx

DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab

TCP: Interfaces\{23179197-621F-4E23-9DCD-5AD9FFFD37B6} : DhcpNameServer = 192.168.1.1

TCP: Interfaces\{23179197-621F-4E23-9DCD-5AD9FFFD37B6}\6594651434F4D4F5E45647F575966496F5A5F6E656 : DhcpNameServer = 192.168.1.1

TCP: Interfaces\{6401E25B-7B96-4A34-942E-ED1567DCF999} : NameServer = 212.39.90.42 212.39.90.43

TCP: Interfaces\{9F2DF8A4-E36B-4A4B-B49A-6FA09740D04F} : NameServer = 212.39.90.42 212.39.90.43

TCP: Interfaces\{A8FB6DDF-942B-492B-AB7B-CF52A0DBF847} : NameServer = 212.39.90.42 212.39.90.43

BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO-X64: AcroIEHelperStub - No File

BHO-X64: Џ®¬®й § ў«Ё§ Ґ Windows Live: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO-X64: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll

BHO-X64: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

TB-X64: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll

TB-X64: {BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} - No File

TB-X64: {30F9B915-B755-4826-820B-08FBA6BD249D} - No File

EB-X64: {555D4D79-4BD2-4094-A395-CFC534424A05} - No File

mRun-x64: [iAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

mRun-x64: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe

mRun-x64: [suiteTray] "C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe"

mRun-x64: [EgisUpdate] "C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe" -d

mRun-x64: [EgisTecPMMUpdate] "C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe"

mRun-x64: [backupManagerTray] "C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe" -h -k

mRun-x64: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

mRun-x64: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime

mRun-x64: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray

.

============= SERVICES / DRIVERS ===============

.

R1 mwlPSDFilter;mwlPSDFilter;C:\Windows\system32\DRIVERS\mwlPSDFilter.sys --> C:\Windows\system32\DRIVERS\mwlPSDFilter.sys [?]

R1 mwlPSDNServ;mwlPSDNServ;C:\Windows\system32\DRIVERS\mwlPSDNServ.sys --> C:\Windows\system32\DRIVERS\mwlPSDNServ.sys [?]

R1 mwlPSDVDisk;mwlPSDVDisk;C:\Windows\system32\DRIVERS\mwlPSDVDisk.sys --> C:\Windows\system32\DRIVERS\mwlPSDVDisk.sys [?]

R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?]

R2 Apache2.2;Apache2.2;C:\xampp\apache\bin\httpd.exe [2010-10-18 20549]

R2 DCService.exe;DCService.exe;C:\ProgramData\DatacardService\DCService.exe [2010-5-8 229376]

R2 DsiWMIService;Dritek WMI Service;C:\Program Files (x86)\Launch Manager\dsiwmis.exe [2010-8-10 321104]

R2 ePowerSvc;Acer ePower Service;C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe [2010-8-18 868896]

R2 GREGService;GREGService;C:\Program Files (x86)\Acer\Registration\GREGsvc.exe [2010-1-8 23584]

R2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-8-10 13336]

R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-7-24 366640]

R2 MWLService;MyWinLocker Service;C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe [2010-5-27 305520]

R2 NTI IScheduleSvc;NTI IScheduleSvc;C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [2010-6-29 255744]

R2 Updater Service;Updater Service;C:\Program Files\Acer\Acer Updater\UpdaterService.exe [2010-8-10 243232]

R3 ewusbnet;HUAWEI USB-NDIS miniport;C:\Windows\system32\DRIVERS\ewusbnet.sys --> C:\Windows\system32\DRIVERS\ewusbnet.sys [?]

R3 huawei_enumerator;huawei_enumerator;C:\Windows\system32\DRIVERS\ew_jubusenum.sys --> C:\Windows\system32\DRIVERS\ew_jubusenum.sys [?]

R3 IntcHdmiAddService;Intel® High Definition Audio HDMI;C:\Windows\system32\drivers\IntcHdmi.sys --> C:\Windows\system32\drivers\IntcHdmi.sys [?]

R3 k57nd60a;Broadcom NetLink ™ Gigabit Ethernet - NDIS 6.0;C:\Windows\system32\DRIVERS\k57nd60a.sys --> C:\Windows\system32\DRIVERS\k57nd60a.sys [?]

R3 MBAMProtector;MBAMProtector;\??\C:\Windows\system32\drivers\mbam.sys --> C:\Windows\system32\drivers\mbam.sys [?]

R3 vwifimp;Microsoft Virtual WiFi Miniport Service;C:\Windows\system32\DRIVERS\vwifimp.sys --> C:\Windows\system32\DRIVERS\vwifimp.sys [?]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]

S2 gupdate;Услуга Google Update (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-5-12 135664]

S2 XAMPP;XAMPP Service;C:\xampp\service.exe [2007-12-21 60928]

S3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;C:\Windows\system32\DRIVERS\ew_hwusbdev.sys --> C:\Windows\system32\DRIVERS\ew_hwusbdev.sys [?]

S3 gupdatem;Услуга на Google Актуализация (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-5-12 135664]

S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\Windows\system32\Drivers\RtsUStor.sys --> C:\Windows\system32\Drivers\RtsUStor.sys [?]

S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]

S3 WatAdminSvc;Услуга на технологиите за активиране на Windows;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?]

.

=============== Created Last 30 ================

.

2011-07-27 00:00:55 -------- d-----w- C:\Program Files (x86)\MSXML 4.0

2011-07-25 10:47:04 -------- d-----w- C:\Users\Vivacom\AppData\Local\HP

2011-07-25 10:44:55 -------- d-----w- C:\ProgramData\WEBREG

2011-07-25 10:41:14 -------- d-----w- C:\Program Files (x86)\Common Files\Hewlett-Packard

2011-07-25 10:40:23 -------- d-----w- C:\Program Files (x86)\HP

2011-07-25 10:39:02 861184 ----a-w- C:\Windows\System32\hpowiax3.dll

2011-07-25 10:39:02 729600 ----a-w- C:\Windows\System32\hpotscl3.dll

2011-07-25 10:39:02 642360 ----a-w- C:\Windows\System32\hpzids40.dll

2011-07-25 10:39:02 540672 ----a-w- C:\Windows\System32\hppldcoi.dll

2011-07-25 10:39:02 497664 ----a-w- C:\Windows\System32\hpovst10.dll

2011-07-25 10:15:07 230400 ----a-w- C:\Windows\System32\Spool\prtprocs\x64\hpzppw71.dll

2011-07-24 20:42:42 41272 ----a-w- C:\Windows\SysWow64\drivers\mbamswissarmy.sys

2011-07-24 20:42:39 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware

2011-07-22 22:42:49 -------- d-----w- C:\Users\Vivacom\AppData\Local\Apps

2011-07-22 22:42:48 -------- d-----w- C:\Users\Vivacom\AppData\Local\Deployment

2011-07-22 21:52:28 169295 --sh--w- C:\Windows\SysWow64\tgr32thb.dll

2011-07-20 20:34:07 -------- d-----w- C:\Windows\ufa

2011-07-20 20:34:07 -------- d-----w- C:\Windows\phoenix

2011-07-20 20:12:04 246272 ----a-w- C:\Windows\unrar.exe

2011-07-20 20:11:51 -------- d--h--w- C:\Windows\update.2

2011-07-20 20:11:36 -------- d--h--w- C:\Windows\update.5.0

2011-07-20 20:07:46 -------- d--h--w- C:\Windows\update.1

2011-07-16 01:14:26 61440 ----a-w- C:\Windows\SysWow64\digitbox.ocx

2011-07-16 01:14:25 -------- d-----w- C:\Program Files (x86)\Alarm

2011-07-10 21:01:43 -------- d-----w- C:\Program Files (x86)\Xenocode

2011-07-08 00:25:24 -------- d-----w- C:\Program Files\DVD Maker

2011-07-08 00:15:30 -------- d-----w- C:\Users\Vivacom\AppData\Roaming\Malwarebytes

2011-07-08 00:15:16 -------- d-----w- C:\ProgramData\Malwarebytes

2011-07-08 00:15:13 25912 ----a-w- C:\Windows\System32\drivers\mbam.sys

2011-07-08 00:03:59 -------- d-----w- C:\Windows\System32\SPReview

2011-07-08 00:03:08 -------- d-----w- C:\Windows\System32\EventProviders

2011-07-05 13:44:06 145408 --sha-r- C:\Windows\SysWow64\mciseq6.dll

2011-07-01 18:43:55 -------- d-----w- C:\Users\Vivacom\AppData\Local\Blizzard Entertainment

2011-06-30 20:56:51 -------- d-----w- C:\ProgramData\Blizzard Entertainment

.

==================== Find3M ====================

.

2011-07-08 00:15:49 152576 ----a-w- C:\Windows\SysWow64\msclmd.dll

2011-07-08 00:15:47 175616 ----a-w- C:\Windows\System32\msclmd.dll

2011-06-11 03:07:25 3137536 ----a-w- C:\Windows\System32\win32k.sys

2011-06-03 06:57:45 362496 ----a-w- C:\Windows\System32\wow64win.dll

2011-06-03 06:57:45 243200 ----a-w- C:\Windows\System32\wow64.dll

2011-06-03 06:57:45 13312 ----a-w- C:\Windows\System32\wow64cpu.dll

2011-06-03 06:57:44 214528 ----a-w- C:\Windows\System32\winsrv.dll

2011-06-03 06:57:38 16384 ----a-w- C:\Windows\System32\ntvdm64.dll

2011-06-03 06:56:38 421888 ----a-w- C:\Windows\System32\KernelBase.dll

2011-06-03 06:53:33 338944 ----a-w- C:\Windows\System32\conhost.exe

2011-06-03 06:00:53 14336 ----a-w- C:\Windows\SysWow64\ntvdm64.dll

2011-06-03 05:57:52 44032 ----a-w- C:\Windows\apppatch\acwow64.dll

2011-06-03 05:57:33 25600 ----a-w- C:\Windows\SysWow64\setup16.exe

2011-06-03 05:56:12 5120 ----a-w- C:\Windows\SysWow64\wow32.dll

2011-06-03 05:56:11 272384 ----a-w- C:\Windows\SysWow64\KernelBase.dll

2011-06-03 03:53:31 7680 ----a-w- C:\Windows\SysWow64\instnm.exe

2011-06-03 03:53:31 2048 ----a-w- C:\Windows\SysWow64\user.exe

2011-06-03 03:48:32 3584 ---ha-w- C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll

2011-06-03 03:48:31 6144 ---ha-w- C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll

2011-06-03 03:48:31 4608 ---ha-w- C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll

2011-06-03 03:48:31 3072 ---ha-w- C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll

2011-05-25 20:15:47 472808 ----a-w- C:\Windows\SysWow64\deployJava1.dll

2011-05-24 11:42:55 404480 ----a-w- C:\Windows\System32\umpnpmgr.dll

2011-05-24 10:40:05 64512 ----a-w- C:\Windows\SysWow64\devobj.dll

2011-05-24 10:40:05 44544 ----a-w- C:\Windows\SysWow64\devrtl.dll

2011-05-24 10:39:38 145920 ----a-w- C:\Windows\SysWow64\cfgmgr32.dll

2011-05-24 10:37:54 252928 ----a-w- C:\Windows\SysWow64\drvinst.exe

2011-05-16 15:35:14 56752 ----a-w- C:\Windows\System32\drivers\VBoxUSBMon.sys

2011-05-16 15:35:14 156912 ----a-w- C:\Windows\System32\drivers\VBoxNetAdp.sys

2011-05-16 15:35:12 231600 ----a-w- C:\Windows\System32\drivers\VBoxDrv.sys

2011-05-14 19:37:00 404640 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

2011-05-12 17:57:34 206208 ----a-w- C:\Windows\PLFSetI.exe

2011-05-04 05:25:03 2315776 ----a-w- C:\Windows\System32\tquery.dll

2011-05-04 05:22:25 778752 ----a-w- C:\Windows\System32\mssvp.dll

2011-05-04 05:22:25 2223616 ----a-w- C:\Windows\System32\mssrch.dll

2011-05-04 05:22:24 75264 ----a-w- C:\Windows\System32\msscntrs.dll

2011-05-04 05:22:24 491520 ----a-w- C:\Windows\System32\mssph.dll

2011-05-04 05:22:24 288256 ----a-w- C:\Windows\System32\mssphtb.dll

2011-05-04 05:19:28 591872 ----a-w- C:\Windows\System32\SearchIndexer.exe

2011-05-04 05:19:28 249856 ----a-w- C:\Windows\System32\SearchProtocolHost.exe

2011-05-04 05:19:28 113664 ----a-w- C:\Windows\System32\SearchFilterHost.exe

2011-05-04 04:34:43 1549312 ----a-w- C:\Windows\SysWow64\tquery.dll

2011-05-04 04:32:02 666624 ----a-w- C:\Windows\SysWow64\mssvp.dll

2011-05-04 04:32:01 337408 ----a-w- C:\Windows\SysWow64\mssph.dll

2011-05-04 04:32:01 197120 ----a-w- C:\Windows\SysWow64\mssphtb.dll

2011-05-04 04:32:01 1401344 ----a-w- C:\Windows\SysWow64\mssrch.dll

2011-05-04 04:32:00 59392 ----a-w- C:\Windows\SysWow64\msscntrs.dll

2011-05-04 04:28:31 86528 ----a-w- C:\Windows\SysWow64\SearchFilterHost.exe

2011-05-04 04:28:31 427520 ----a-w- C:\Windows\SysWow64\SearchIndexer.exe

2011-05-04 04:28:31 164352 ----a-w- C:\Windows\SysWow64\SearchProtocolHost.exe

2011-05-03 05:29:29 976896 ----a-w- C:\Windows\System32\inetcomm.dll

2011-05-03 04:30:02 741376 ----a-w- C:\Windows\SysWow64\inetcomm.dll

.

============= FINISH: 22:03:33,16 ===============

Attach.txt

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2011-06-23.01)

.

Microsoft Windows 7 Home Premium

Boot Device: \Device\HarddiskVolume2

Install Date: 12.5.2011 г. 19:56:03

System Uptime: 28.7.2011 г. 21:53:38 (1 hours ago)

.

Motherboard: Acer | | Aspire 5336

Processor: Celeron® Dual-Core CPU T3500 @ 2.10GHz | uPGA-478 | 2094/200mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 285 GiB total, 247,379 GiB free.

D: is CDROM ()

E: is CDROM ()

F: is CDROM (CDFS)

G: is Removable

.

==== Disabled Device Manager Items =============

.

==== System Restore Points ===================

.

RP71: 21.7.2011 г. 13:41:12 - Планирана контролна точка

RP72: 22.7.2011 г. 23:31:53 - Installed Grand Theft Auto Sofia.

RP73: 23.7.2011 г. 01:36:06 - Removed Grand Theft Auto Sofia.

RP74: 25.7.2011 г. 23:30:37 - Removed HP Update

RP75: 25.7.2011 г. 23:32:04 - Removed Acrobat.com

RP76: 27.7.2011 г. 03:00:12 - Windows Update

RP77: 27.7.2011 г. 17:27:36 - Removed Google Earth Plug-in.

RP78: 28.7.2011 г. 03:00:11 - Windows Update

RP80: 28.7.2011 г. 15:06:50 - Removed service pack backup files

.

==== Installed Programs ======================

.

Архиватор WinRAR

Асистент за влизане на Windows Live

Инструмент за качване на Windows Live

Фотогалерия на Windows Live

µTorrent

2007 Microsoft Office Suite Service Pack 2 (SP2)

Acer Backup Manager

Acer Crystal Eye webcam Ver:1.1.188.706

Acer ePower Management

Acer eRecovery Management

Acer GameZone Console

Acer Registration

Acer ScreenSaver

Acer Updater

Adobe AIR

Adobe Flash Player 10 ActiveX

Adobe Flash Player 10 Plugin

Adobe Reader 9.1 MUI

Alarm

Backup Manager Basic

CyberLink PowerDVD 9

DAEMON Tools Lite

eSobi v2

GOM Player

Google Toolbar for Internet Explorer

Google Update Helper

Identity Card

Intel® Rapid Storage Technology

Java Auto Updater

Java™ 6 Update 25

Junk Mail filter update

Launch Manager

Malwarebytes' Anti-Malware, версия 1.51.1.1800

Microsoft Choice Guard

Microsoft Office 2007 Service Pack 2 (SP2)

Microsoft Office Access MUI (Bulgarian) 2007

Microsoft Office Excel 2007 Help Актуализация (KB963678)

Microsoft Office Excel MUI (Bulgarian) 2007

Microsoft Office Groove MUI (Bulgarian) 2007

Microsoft Office InfoPath MUI (Bulgarian) 2007

Microsoft Office Language Pack 2007 - Bulgarian/български

Microsoft Office O MUI (Bulgarian) 2007

Microsoft Office OneNote MUI (Bulgarian) 2007

Microsoft Office Outlook MUI (Bulgarian) 2007

Microsoft Office Powerpoint 2007 Help Актуализация (KB963669)

Microsoft Office PowerPoint MUI (Bulgarian) 2007

Microsoft Office Proof (Bulgarian) 2007

Microsoft Office Proof (English) 2007

Microsoft Office Proof (German) 2007

Microsoft Office Proof (Russian) 2007

Microsoft Office Proofing (Bulgarian) 2007

Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)

Microsoft Office Publisher MUI (Bulgarian) 2007

Microsoft Office Shared MUI (Bulgarian) 2007

Microsoft Office Suite Activation Assistant

Microsoft Office Word 2007 Help Актуализация (KB963665)

Microsoft Office Word MUI (Bulgarian) 2007

Microsoft Office X MUI (Bulgarian) 2007

Microsoft Silverlight

Microsoft SQL Server 2005 Compact Edition [ENU]

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319

Microsoft Works

MSVCRT

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

MyWinLocker

MyWinLocker Suite

NTI Media Maker 9

QuickTime

Realtek High Definition Audio Driver

Realtek USB 2.0 Card Reader

Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)

Shredder

Skype Toolbars

Skype™ 5.3

VIVACOM 3G USB Modem

Welcome Center

Windows Live Communications Platform

Windows Live Essentials

Windows Live Mail

Windows Live Messenger

Windows Live Movie Maker

Windows Live Sync

Windows Live Writer

XAMPP 1.7.4

.

==== Event Viewer Messages From Past Week ========

.

28.7.2011 г. 17:52:11, Error: Service Control Manager [7024] - Услуга Apache2.2 прекъсна със следната специфична за услугите грешка Невярна функция..

28.7.2011 г. 03:41:08, Error: Service Control Manager [7024] - Услуга Apache2.2 прекъсна със следната специфична за услугите грешка Невярна функция..

27.7.2011 г. 14:39:05, Error: Service Control Manager [7024] - Услуга Apache2.2 прекъсна със следната специфична за услугите грешка Невярна функция..

27.7.2011 г. 03:49:19, Error: Service Control Manager [7024] - Услуга Apache2.2 прекъсна със следната специфична за услугите грешка Невярна функция..

26.7.2011 г. 14:37:30, Error: Tcpip [4199] - The system detected an address conflict for IP address 192.168.1.2 with the system having network hardware address 00-18-46-01-A8-25. Network operations on this system may be disrupted as a result.

25.7.2011 г. 13:19:42, Error: VDS Basic Provider [1] - Unexpected failure. Error code: 490@01010004

24.7.2011 г. 23:47:44, Error: Service Control Manager [7034] - Услуга srviecheck беше прекъсната неочаквано. Това се е случвало с нея 1 път(и).

24.7.2011 г. 23:47:44, Error: Service Control Manager [7034] - Услуга srvbtcclient беше прекъсната неочаквано. Това се е случвало с нея 1 път(и).

24.7.2011 г. 23:47:43, Error: Service Control Manager [7034] - Услуга wxpdrivers беше прекъсната неочаквано. Това се е случвало с нея 1 път(и).

24.7.2011 г. 23:47:43, Error: Service Control Manager [7034] - Услуга srvsysdriver32 беше прекъсната неочаквано. Това се е случвало с нея 1 път(и).

23.7.2011 г. 21:09:22, Error: Service Control Manager [7034] - Услуга Apache2.2 беше прекъсната неочаквано. Това се е случвало с нея 1 път(и).

23.7.2011 г. 21:00:56, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - Компютърът е рестартиран от проверка за грешки. Проверката е: 0x0000007e (0xffffffffc0000005, 0x000000000001afae, 0xfffff880084b3908, 0xfffff880084b3160). Разтоварването е записано в: C:\Windows\MEMORY.DMP. ИД на доклада: 072311-42104-01.

23.7.2011 г. 18:48:51, Error: Service Control Manager [7024] - Услуга Apache2.2 прекъсна със следната специфична за услугите грешка Невярна функция..

23.7.2011 г. 18:45:15, Error: Service Control Manager [7024] - Услуга Apache2.2 прекъсна със следната специфична за услугите грешка Невярна функция..

23.7.2011 г. 18:44:34, Error: Service Control Manager [7024] - Услуга Apache2.2 прекъсна със следната специфична за услугите грешка Невярна функция..

23.7.2011 г. 18:44:31, Error: Service Control Manager [7024] - Услуга Apache2.2 прекъсна със следната специфична за услугите грешка Невярна функция..

23.7.2011 г. 18:44:23, Error: Service Control Manager [7024] - Услуга Apache2.2 прекъсна със следната специфична за услугите грешка Невярна функция..

23.7.2011 г. 01:04:20, Error: Schannel [36888] - The following fatal alert was generated: 10. The internal error state is 10.

23.7.2011 г. 01:04:19, Error: Schannel [36888] - The following fatal alert was generated: 10. The internal error state is 10.

22.7.2011 г. 16:37:30, Error: Service Control Manager [7034] - Услуга Apache2.2 беше прекъсната неочаквано. Това се е случвало с нея 1 път(и).

22.7.2011 г. 12:58:31, Error: Service Control Manager [7034] - Услуга Apache2.2 беше прекъсната неочаквано. Това се е случвало с нея 1 път(и).

21.7.2011 г. 23:08:56, Error: Service Control Manager [7034] - Услуга srvbtcclient беше прекъсната неочаквано. Това се е случвало с нея 2 път(и).

21.7.2011 г. 22:47:44, Error: Service Control Manager [7034] - Услуга srvbtcclient беше прекъсната неочаквано. Това се е случвало с нея 1 път(и).

21.7.2011 г. 22:47:35, Error: Service Control Manager [7034] - Услуга Apache2.2 беше прекъсната неочаквано. Това се е случвало с нея 1 път(и).

21.7.2011 г. 15:06:46, Error: Service Control Manager [7034] - Услуга srvbtcclient беше прекъсната неочаквано. Това се е случвало с нея 1 път(и).

21.7.2011 г. 11:45:16, Error: Service Control Manager [7009] - Изтекъл период на изчакване (30000 милисекунди) при изчакване на услуга Windows Error Reporting Service да се свърже.

.

==== End Of File ===========================

Надявам се съм следвал и спазвал всички инструкции от тук - надявам се да ми помогнте.

28 юли 201115 г.

Здравейте,

Следвайте следната инструкция за работа с OTL:

Изтеглете OTL.exe и го запазете на десктопа.
Стартирайте файла с двукратен клик на мишката.
Сложете отметка пред Scan All Users
Под менюто File Age => изберете 90 days
Под менюто Standard Registry => променете на ALL
Сложете отметки пред LOP и Purity Check

Под с Copy/ Paste въведете изцяло следната текстова информация (само това, което е поставено в карето):

netsvcs
msconfig
%SYSTEMDRIVE%\*.*
%USERPROFILE%\*.*
%USERPROFILE%\AppData\Local\*.*
%USERPROFILE%\AppData\Roaming\*.*
%ProgramData%\*.*
%CommonProgramFiles%\*.*
%PROGRAMFILES%\*.*
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\system32\drivers\*.sys /90
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\system32\Spool\prtprocs\w32x86\*.dll
/md5start
hlp.dat
winlogon.exe
wininit.exe
userinit.exe
explorer.exe
volsnap.sys
/md5stop

Натиснете маркираният в синьо бутон: .
Като приключи проверката, ще се създадат два файла - OTL.Txt и Extras.Txt. Прикачете тези два файла в следващия си коментар (погледнете опцията "прикачени файлове", когато публикувате мнение).

28 юли 201115 г.

Автор

Резултати:

28 юли 201115 г.

Нещо форума се бъгна при мен и не мога да сваля прикачените ви файлове.

Копирайте съдържанието им тук => http://pastebin.com/ и ми пратете линковете които водят към тях в следващия си пост.

Мерси и се извинявам за причиненото неудобство.

28 юли 201115 г.

Автор

http://pastebin.com/2HP5tBCj

http://pastebin.com/mdAqweHL

Редактирано 28 юли 201115 г. от Kastiel (преглед на промените)

28 юли 201115 г.

Здравейте отново !

Стартирайте отново OTL, копирайте (Copy) и поставете (Paste) скриптовия текст от текстовото поле по-долу под колонката Custom Scans/Fixes, като не забравяте да копирате скрипта 1 към 1, както и двете точки преди първия ред на скрипта.

:OTL
IE - HKU\S-1-5-21-9623944-1002734519-3881390022-1000\..\URLSearchHook: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - Reg Error: Key error. File not found
FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
O3:[b]64bit:[/b] - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - Reg Error: Key error. File not found
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - Reg Error: Key error. File not found
O31 - SafeBoot: AlternateShell - services32.exe
[2011/07/20 23:34:07 | 000,000,000 | ---D | C] -- C:\Windows\ufa
[2011/07/20 23:34:07 | 000,000,000 | ---D | C] -- C:\Windows\phoenix
[2011/07/20 23:11:51 | 000,000,000 | -H-D | C] -- C:\Windows\update.2
[2011/07/20 23:11:36 | 000,000,000 | -H-D | C] -- C:\Windows\update.5.0
[2011/07/20 23:07:46 | 000,000,000 | -H-D | C] -- C:\Windows\update.1
[2011/07/28 21:53:59 | 000,000,312 | -HS- | M] () -- C:\Windows\tasks\Oozpxe.job
[2011/07/24 00:15:47 | 000,000,179 | ---- | M] () -- C:\Windows\info1
[2011/07/20 23:34:06 | 005,589,370 | ---- | M] () -- C:\Windows\phoenix.rar
[2011/07/20 23:34:06 | 000,246,272 | ---- | M] () -- C:\Windows\unrar.exe
[2011/07/20 23:34:06 | 000,182,617 | ---- | M] () -- C:\Windows\ufa.rar
[2011/07/20 23:34:05 | 001,075,284 | ---- | M] () -- C:\Windows\rpcminer.rar
[2011/07/20 23:12:04 | 000,904,792 | ---- | M] () -- C:\Windows\geoiplist.rar
[2011/07/20 23:10:12 | 000,000,000 | ---- | M] () -- C:\Windows\loader2.exe_ok
[2011/07/17 03:24:20 | 004,636,907 | ---- | M] () -- C:\Windows\geoiplist
@Alternate Data Stream - 149 bytes -> C:\ProgramData\Temp:CDFF58FE
@Alternate Data Stream - 146 bytes -> C:\ProgramData\Temp:4D066AD2
@Alternate Data Stream - 146 bytes -> C:\ProgramData\Temp:466F9D5D
@Alternate Data Stream - 141 bytes -> C:\ProgramData\Temp:E36F5B57
:files
C:\Users\Vivacom\Downloads\WinRAR.3.2.keygen.by.ViKiNG
C:\Users\Vivacom\Downloads\Flash-Player.exe
C:\Windows\update.1\svchost.exe
C:\Windows\update.2\svchost.exe
:reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirewallOverride"=dword:00000000
"DisableThumbnailCache"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall"=dword:00000001
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall"=dword:00000001
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Users\Vivacom\Downloads\WinRAR.3.2.keygen.by.ViKiNG\WinRAR.3.2.keygen.by.ViKiNG.exe" =-
"C:\Users\Vivacom\Downloads\Flash-Player.exe" =-
"C:\Windows\update.1\svchost.exe" =-
"C:\Windows\update.2\svchost.exe" =-
"C:\Users\Vivacom\Downloads\WinRAR.3.2.keygen.by.ViKiNG\WinRAR.3.2.keygen.by.ViKiNG.exe" =-
"C:\Users\Vivacom\Downloads\Flash-Player.exe" =-
"C:\Windows\update.1\svchost.exe" =-
"C:\Windows\update.2\svchost.exe" =-
:commands
[resethosts]
[emptytemp]

След като въведете скрипта от цитата по-горе натиснете бутона, маркиран в червено: Run Fix

Windows ще се рестартира и ще се създаде лог файл. Публикувайте съдържанието му с Copy/Paste в следващия си коментар.

Ако не се появи лог файл, потърсете за него в папката C:\_OTL\MovedFiles

Ще продължим утре !

Приятна вечер !

29 юли 201115 г.

Автор

След като направих това което ми каза се съсздаде файла:07292011_022023

Съдържанието на файла :

All processes killed

Error: Unable to interpret <:OTLIE - HKU\S-1-5-21-9623944-1002734519-3881390022-1000\..\URLSearchHook: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - Reg Error: Key error. File not foundFF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not foundFF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not foundO3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - Reg Error: Key error. File not foundO9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - Reg Error: Key error. File not foundO31 - SafeBoot: AlternateShell - services32.exe[2011/07/20 23:34:07 | 000,000,000 | ---D | C] -- C:\Windows\ufa[2011/07/20 23:34:07 | 000,000,000 | ---D | C] -- C:\Windows\phoenix[2011/07/20 23:11:51 | 000,000,000 | -H-D | C] -- C:\Windows\update.2[2011/07/20 23:11:36 | 000,000,000 | -H-D | C] -- C:\Windows\update.5.0> in the current context!

Error: Unable to interpret <[2011/07/20 23:07:46 | 000,000,000 | -H-D | C] -- C:\Windows\update.1[2011/07/28 21:53:59 | 000,000,312 | -HS- | M] () -- C:\Windows\tasks\Oozpxe.job[2011/07/24 00:15:47 | 000,000,179 | ---- | M] () -- C:\Windows\info1[2011/07/20 23:34:06 | 005,589,370 | ---- | M] () -- C:\Windows\phoenix.rar[2011/07/20 23:34:06 | 000,246,272 | ---- | M] () -- C:\Windows\unrar.exe[2011/07/20 23:34:06 | 000,182,617 | ---- | M] () -- C:\Windows\ufa.rar[2011/07/20 23:34:05 | 001,075,284 | ---- | M] () -- C:\Windows\rpcminer.rar[2011/07/20 23:12:04 | 000,904,792 | ---- | M] () -- C:\Windows\geoiplist.rar[2011/07/20 23:10:12 | 000,000,000 | ---- | M] () -- C:\Windows\loader2.exe_ok[2011/07/17 03:24:20 | 004,636,907 | ---- | M] () -- C:\Windows\geoiplist@Alternate Data Stream - 149 bytes -> C:\ProgramData\Temp:CDFF58FE@Alternate Data Stream - 146 bytes -> C:\ProgramData\Temp:4D066AD2@Alternate Data Stream - 146 bytes -> C:\ProgramData\Temp:466F9D5D@Alternate Data Stream - 141 bytes -> C:\ProgramData\Temp:E36F5B57:filesC:\Users\Viva> in the current context!

Error: Unable to interpret <com\Downloads\WinRAR.3.2.keygen.by.ViKiNGC:\Users\Vivacom\Downloads\Flash-Player.exeC:\Windows\update.1\svchost.exeC:\Windows\update.2\svchost.exe:reg[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]"FirewallOverride"=dword:00000000"DisableThumbnailCache"=dword:00000000[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]"EnableFirewall"=dword:00000001[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]"EnableFirewall"=dword:00000001[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]"C:\Users\Vivacom\Downloads\WinRAR.3.2.keygen.by.ViKiNG\WinRAR.3.2.keygen.by.ViKiNG.exe" =-"C:\Users\Vivacom\Downloads\Flash-Player.exe" =-"C:\Windows\update.1\svchost.exe" =-"C:\Windows\update.2\svchost.exe" =-"C:\Users\Vivacom\Downloads\WinRAR.3.2.keygen.by.ViKiNG\WinRAR.3.2.keygen.by.ViKiNG.exe" =-"C:\Users\Vivacom\Downloads\Fla> in the current context!

Error: Unable to interpret <sh-Player.exe" =-"C:\Windows\update.1\svchost.exe" =-"C:\Windows\update.2\svchost.exe" =-[resethosts][emptytemp]> in the current context!

OTL by OldTimer - Version 3.2.26.1 log created on 07292011_022023

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

29 юли 201115 г.

Здравейте ! Не сте копирали скрипта правилно. Трябва да започва с двете точки преди OTL като всяка команда трябва да е на отделен ред (както е написан). Моля опитайте отново.

29 юли 201115 г.

Много благодаря на B-boy[styLe] !

Бях лепнал същата гадория и благодарение на него вече я няма!

Редактирано 29 юли 201115 г. от dalai.lamia (преглед на промените)

29 юли 201115 г.

Много благодаря на B-boy[styLe] !

Бях лепнал същата гадория и благодарение на него вече я няма!

Аз благодаря за файла...ще го публикувам в темата за подпомагането...резултатите са интересни...

29 юли 201115 г.

Автор

B-boy[styLe] Много благодаря.Подкарах Фейса без никакви проблеми!!

29 юли 201115 г.

B-boy[styLe] Много благодаря.Подкарах Фейса без никакви проблеми!!

Това е добре, но не сме свършили...моля публикувайте лог файла от правилното изпълнение на OTL за да преценя дали сме на финалната права.

Добре дошли!

Вирус от Facebook

Featured Replies

Архивирана тема

Разглеждащи това в момента 0

Дарение

Бюлетин

Профил

Навигация

Търсене

Конфигуриране на push известия в браузъра

Chrome (Android)

Chrome (Desktop)

Safari (iOS 16.4+)

Safari (macOS)

Edge (Android)

Edge (Desktop)

Firefox (Android)

Firefox (Desktop)