Avira AntiVir Personal Report file date: 15 август 2011 г. 13:10 Scanning for 3375694 virus strains and unwanted programs. The program is running as an unrestricted full version. Online services are available: Licensee : Avira AntiVir Personal - Free Antivirus Serial number : 0000149996-ADJIE-0000001 Platform : Windows 7 Windows version : (Service Pack 1) [6.1.7601] Boot mode : Normally booted Username : SYSTEM Computer name : TOSHIBA-PC Version information: BUILD.DAT : 10.2.0.700 35934 Bytes 21.7.2011 г. 17:12:00 AVSCAN.EXE : 10.3.0.7 484008 Bytes 30.6.2011 г. 14:24:13 AVSCAN.DLL : 10.0.5.0 47464 Bytes 30.6.2011 г. 14:24:13 LUKE.DLL : 10.3.0.5 45416 Bytes 30.6.2011 г. 14:24:13 LUKERES.DLL : 10.0.0.1 12648 Bytes 10.2.2010 г. 21:40:49 AVSCPLR.DLL : 10.3.0.7 119656 Bytes 30.6.2011 г. 14:24:13 AVREG.DLL : 10.3.0.9 88833 Bytes 13.7.2011 г. 14:03:23 VBASE000.VDF : 7.10.0.0 19875328 Bytes 6.11.2009 г. 07:05:36 VBASE001.VDF : 7.11.0.0 13342208 Bytes 14.12.2010 г. 13:15:47 VBASE002.VDF : 7.11.3.0 1950720 Bytes 9.2.2011 г. 13:15:47 VBASE003.VDF : 7.11.5.225 1980416 Bytes 7.4.2011 г. 05:29:07 VBASE004.VDF : 7.11.8.178 2354176 Bytes 31.5.2011 г. 05:29:09 VBASE005.VDF : 7.11.10.251 1788416 Bytes 7.7.2011 г. 07:11:02 VBASE006.VDF : 7.11.10.252 2048 Bytes 7.7.2011 г. 07:11:02 VBASE007.VDF : 7.11.10.253 2048 Bytes 7.7.2011 г. 07:11:02 VBASE008.VDF : 7.11.10.254 2048 Bytes 7.7.2011 г. 07:11:02 VBASE009.VDF : 7.11.10.255 2048 Bytes 7.7.2011 г. 07:11:02 VBASE010.VDF : 7.11.11.0 2048 Bytes 7.7.2011 г. 07:11:02 VBASE011.VDF : 7.11.11.1 2048 Bytes 7.7.2011 г. 07:11:02 VBASE012.VDF : 7.11.11.2 2048 Bytes 7.7.2011 г. 07:11:02 VBASE013.VDF : 7.11.11.75 688128 Bytes 12.7.2011 г. 14:03:20 VBASE014.VDF : 7.11.11.104 978944 Bytes 13.7.2011 г. 09:40:05 VBASE015.VDF : 7.11.11.137 655360 Bytes 14.7.2011 г. 09:40:11 VBASE016.VDF : 7.11.11.184 699392 Bytes 18.7.2011 г. 14:21:39 VBASE017.VDF : 7.11.11.214 414208 Bytes 19.7.2011 г. 14:21:54 VBASE018.VDF : 7.11.11.242 772096 Bytes 20.7.2011 г. 14:22:20 VBASE019.VDF : 7.11.12.3 1291776 Bytes 20.7.2011 г. 14:23:28 VBASE020.VDF : 7.11.12.30 844288 Bytes 21.7.2011 г. 13:15:27 VBASE021.VDF : 7.11.12.67 149504 Bytes 24.7.2011 г. 08:59:37 VBASE022.VDF : 7.11.12.93 195072 Bytes 25.7.2011 г. 11:39:55 VBASE023.VDF : 7.11.12.113 150528 Bytes 26.7.2011 г. 11:39:55 VBASE024.VDF : 7.11.12.152 182784 Bytes 28.7.2011 г. 18:25:07 VBASE025.VDF : 7.11.12.181 117760 Bytes 1.8.2011 г. 17:27:17 VBASE026.VDF : 7.11.12.205 148480 Bytes 3.8.2011 г. 06:43:58 VBASE027.VDF : 7.11.12.229 252928 Bytes 5.8.2011 г. 04:06:16 VBASE028.VDF : 7.11.12.243 134656 Bytes 8.8.2011 г. 05:52:36 VBASE029.VDF : 7.11.13.14 164864 Bytes 11.8.2011 г. 10:09:39 VBASE030.VDF : 7.11.13.40 250368 Bytes 15.8.2011 г. 10:09:39 VBASE031.VDF : 7.11.13.41 2048 Bytes 15.8.2011 г. 10:09:39 Engineversion : 8.2.6.30 AEVDF.DLL : 8.1.2.1 106868 Bytes 28.3.2011 г. 13:15:27 AESCRIPT.DLL : 8.1.3.74 1622393 Bytes 6.8.2011 г. 04:06:19 AESCN.DLL : 8.1.7.2 127349 Bytes 28.3.2011 г. 13:15:27 AESBX.DLL : 8.2.1.34 323957 Bytes 5.6.2011 г. 05:29:14 AERDL.DLL : 8.1.9.13 639349 Bytes 16.7.2011 г. 09:40:35 AEPACK.DLL : 8.2.9.5 676214 Bytes 16.7.2011 г. 09:40:31 AEOFFICE.DLL : 8.1.2.13 201083 Bytes 28.7.2011 г. 18:26:12 AEHEUR.DLL : 8.1.2.153 3678584 Bytes 15.8.2011 г. 10:09:42 AEHELP.DLL : 8.1.17.7 254327 Bytes 28.7.2011 г. 18:25:14 AEGEN.DLL : 8.1.5.7 401778 Bytes 6.8.2011 г. 04:06:16 AEEMU.DLL : 8.1.3.0 393589 Bytes 28.3.2011 г. 13:15:19 AECORE.DLL : 8.1.22.4 196983 Bytes 16.7.2011 г. 09:40:15 AEBB.DLL : 8.1.1.0 53618 Bytes 28.3.2011 г. 13:15:19 AVWINLL.DLL : 10.0.0.0 19304 Bytes 28.3.2011 г. 13:15:31 AVPREF.DLL : 10.0.3.2 44904 Bytes 30.6.2011 г. 14:24:13 AVREP.DLL : 10.0.0.10 174120 Bytes 5.6.2011 г. 05:29:14 AVARKT.DLL : 10.0.26.1 255336 Bytes 30.6.2011 г. 14:24:12 AVEVTLOG.DLL : 10.0.0.9 203112 Bytes 30.6.2011 г. 14:24:13 SQLITE3.DLL : 3.6.19.0 355688 Bytes 17.6.2010 г. 12:27:22 AVSMTP.DLL : 10.0.0.17 63848 Bytes 28.3.2011 г. 13:15:30 NETNT.DLL : 10.0.0.0 11624 Bytes 28.3.2011 г. 13:15:39 RCIMAGE.DLL : 10.0.0.35 2589544 Bytes 30.6.2011 г. 14:24:12 RCTEXT.DLL : 10.0.64.0 97640 Bytes 30.6.2011 г. 14:24:12 Configuration settings for the scan: Jobname.............................: Complete system scan Configuration file..................: C:\Program Files\Avira\AntiVir Desktop\sysscan.avp Logging.............................: Default Primary action......................: interactive Secondary action....................: ignore Scan master boot sector.............: on Scan boot sector....................: on Boot sectors........................: C:, D:, E:, Process scan........................: on Extended process scan...............: on Scan registry.......................: on Search for rootkits.................: on Integrity checking of system files..: off Scan all files......................: All files Scan archives.......................: on Recursion depth.....................: 20 Smart extensions....................: on Macro heuristic.....................: on File heuristic......................: Advanced Deviating risk categories...........: +APPL,+GAME,+JOKE,+PCK,+PFS,+SPR, Start of the scan: 15 август 2011 г. 13:10 Starting search for hidden objects. HKEY_LOCAL_MACHINE\System\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0015\Linkage\upperbind [NOTE] The registry entry is invisible. HKEY_LOCAL_MACHINE\System\ControlSet001\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{6B683E0E-1505-488C-8053-3C1301924246}\Linkage\bind [NOTE] The registry entry is invisible. HKEY_LOCAL_MACHINE\System\ControlSet001\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{6B683E0E-1505-488C-8053-3C1301924246}\Linkage\route [NOTE] The registry entry is invisible. HKEY_LOCAL_MACHINE\System\ControlSet001\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{6B683E0E-1505-488C-8053-3C1301924246}\Linkage\export [NOTE] The registry entry is invisible. The scan of running processes will be started Scan process 'SearchProtocolHost.exe' - '29' Module(s) have been scanned Scan process 'SearchFilterHost.exe' - '27' Module(s) have been scanned Scan process 'SearchProtocolHost.exe' - '33' Module(s) have been scanned Scan process 'svchost.exe' - '55' Module(s) have been scanned Scan process 'sppsvc.exe' - '27' Module(s) have been scanned Scan process 'TPCHWMsg.exe' - '25' Module(s) have been scanned Scan process 'TPCHSrv.exe' - '45' Module(s) have been scanned Scan process 'nero.exe' - '128' Module(s) have been scanned Scan process 'svchost.exe' - '34' Module(s) have been scanned Scan process 'vssvc.exe' - '47' Module(s) have been scanned Scan process 'avscan.exe' - '75' Module(s) have been scanned Scan process 'avscan.exe' - '27' Module(s) have been scanned Scan process 'conhost.exe' - '14' Module(s) have been scanned Scan process 'avshadow.exe' - '31' Module(s) have been scanned Scan process 'avguard.exe' - '65' Module(s) have been scanned Scan process 'svchost.exe' - '37' Module(s) have been scanned Scan process 'TrustedInstaller.exe' - '47' Module(s) have been scanned Scan process 'SearchIndexer.exe' - '60' Module(s) have been scanned Scan process 'svchost.exe' - '39' Module(s) have been scanned Scan process 'skypePM.exe' - '77' Module(s) have been scanned Scan process 'wmiprvse.exe' - '62' Module(s) have been scanned Scan process 'conhost.exe' - '22' Module(s) have been scanned Scan process 'HidFind.exe' - '27' Module(s) have been scanned Scan process 'Apntex.exe' - '22' Module(s) have been scanned Scan process 'PCCompanionInfo.exe' - '39' Module(s) have been scanned Scan process 'Skype.exe' - '125' Module(s) have been scanned Scan process 'PCCompanion.exe' - '120' Module(s) have been scanned Scan process 'sidebar.exe' - '85' Module(s) have been scanned Scan process 'avgnt.exe' - '56' Module(s) have been scanned Scan process 'igfxpers.exe' - '34' Module(s) have been scanned Scan process 'hkcmd.exe' - '49' Module(s) have been scanned Scan process 'ApMsgFwd.exe' - '28' Module(s) have been scanned Scan process 'reader_sl.exe' - '21' Module(s) have been scanned Scan process 'Apoint.exe' - '49' Module(s) have been scanned Scan process 'UnlockerAssistant.exe' - '20' Module(s) have been scanned Scan process 'RtHDVCpl.exe' - '47' Module(s) have been scanned Scan process 'svchost.exe' - '32' Module(s) have been scanned Scan process 'Explorer.EXE' - '181' Module(s) have been scanned Scan process 'Dwm.exe' - '31' Module(s) have been scanned Scan process 'svchost.exe' - '62' Module(s) have been scanned Scan process 'sched.exe' - '50' Module(s) have been scanned Scan process 'taskhost.exe' - '40' Module(s) have been scanned Scan process 'taskeng.exe' - '26' Module(s) have been scanned Scan process 'spoolsv.exe' - '83' Module(s) have been scanned Scan process 'svchost.exe' - '71' Module(s) have been scanned Scan process 'svchost.exe' - '59' Module(s) have been scanned Scan process 'svchost.exe' - '148' Module(s) have been scanned Scan process 'svchost.exe' - '109' Module(s) have been scanned Scan process 'svchost.exe' - '78' Module(s) have been scanned Scan process 'svchost.exe' - '34' Module(s) have been scanned Scan process 'svchost.exe' - '52' Module(s) have been scanned Scan process 'winlogon.exe' - '31' Module(s) have been scanned Scan process 'lsm.exe' - '16' Module(s) have been scanned Scan process 'lsass.exe' - '63' Module(s) have been scanned Scan process 'services.exe' - '33' Module(s) have been scanned Scan process 'csrss.exe' - '18' Module(s) have been scanned Scan process 'wininit.exe' - '26' Module(s) have been scanned Scan process 'csrss.exe' - '18' Module(s) have been scanned Scan process 'smss.exe' - '2' Module(s) have been scanned Starting master boot sector scan: Master boot sector HD0 [iNFO] No virus was found! Start scanning boot sectors: Boot sector 'C:\' [iNFO] No virus was found! Boot sector 'D:\' [iNFO] No virus was found! Boot sector 'E:\' [iNFO] No virus was found! Starting to scan executable files (registry). The registry was scanned ( '579' files ). Starting the file scan: Begin scan in 'C:\' C:\Users\TOSHIBA\Documents\[email protected] [0] Archive type: RAR SFX (self extracting) --> 1.exe [DETECTION] Contains recognition pattern of the DR/Delphi.Gen dropper Begin scan in 'D:\' Begin scan in 'E:\' Beginning disinfection: C:\Users\TOSHIBA\Documents\[email protected] [DETECTION] Is the TR/Dropper.Gen Trojan [NOTE] The file was moved to the quarantine directory under the name '4851a5ee.qua'. End of the scan: 15 август 2011 г. 14:35 Used time: 1:25:05 Hour(s) The scan has been done completely. 21620 Scanned directories 433573 Files were scanned 2 Viruses and/or unwanted programs were found 0 Files were classified as suspicious 0 files were deleted 0 Viruses and unwanted programs were repaired 1 Files were moved to quarantine 0 Files were renamed 0 Files cannot be scanned 433571 Files not concerned 2122 Archives were scanned 0 Warnings 5 Notes 408425 Objects were scanned with rootkit scan 4 Hidden objects were found Това ми показа Авира след сакниране. Вируси ли са това и да пускам ли ДДС? Два дена на лаптопа бяха племенниците ми и това се получи.

Редактирано 15 август 201115 г. от nologo (преглед на промените)

Няма да е лошо да видим логове от DDS. Следвайте инструкцията в тази тема.

Благодаря за бързия отговор! Ето логовете . Копирах ги но неможах да ги поставя. Незнам защо.

Attach.txt

DDS.txt

Стъпка 1

• Обновете и стартирайте Malwarebytes' Anti-Malware. Изберете Perform Quick Scan, след това кликнете на Scan.
• Сканирането ще отнеме малко време, затова моля бъдете търпеливи.
• Когато сканирането завърши, кликнете на OK, след това Show Results, за да видите резултата.
• Уверете се, че на всички редове има отметки, и кликнете Remove Selected.
• Когато всичко бъде премахнато, логът ще бъде отворен в Notepad. Копирайте лога и го публикувайте в следващия си коментар в темата.

Стъпка 2

Изтеглете aswMBR и го запазете на вашия десктоп.

• Щракнете върху файла aswMBR.exe, за да го стартирате.
• Изчакайте програмата да изтегли дефинициите на avast.
• От падащото меню посочете дял C:\ както е на снимката:

• Изберете бутона Scan, за да започне проверката.
• Когато проверката завърши, натиснете бутона save log, запазете съдържанието на лог файла на десктопа и публикувайте съдържанието му в следващия си коментар.

Откакто промениха вида на форума не мога да копирам и поставям логовете. Понякога става но трудно.

aswMBR.txt

мбам лог.txt

Редактирано 15 август 201115 г. от dancho730616 (преглед на промените)

Сега Avira засича ли нещо? В предишния лог има следи от дропер:

C:\Users\TOSHIBA\Documents\[email protected]

[DETECTION] Is the TR/Dropper.Gen Trojan

Ще може ли отново да пуснете сканиране и след това лог от Avira?

Сега Avira засича ли нещо? В предишния лог има следи от дропер:

Ще може ли отново да пуснете сканиране и след това лог от Avira?

Добре, ще обновя Авира и ще сканирам. Това вирус ли е дропера? Пускам Авира . Аз ли немога да копирам и поставям или има проблем с форума незнам?! Пробвах няколко пъти е не можах да го поставя. Прикачам го.

Авира лог.txt

Редактирано 15 август 201115 г. от dancho730616 (преглед на промените)

Не е вирус, Това е зловреден файл, ето информация на английски тук.

Авира се е справила добре. Сега имате ли някакви оплаквания от Windows?

Не, нямам други оплаквания. Благодаря ви! Само може ли да ми кажете как да копирам и поставям цитати в форума, защото аз почти винаги не успявам.

Радвам се, че няма оплаквания. Затова ще маркирам проблема като решен. Може да изтриете аswMBR и DDS, както и логовете им. Приятна вечер и успех!

P.S. А за цитатите може да пишете в подходяща тема от този раздел: Предложения, Въпроси и Проблеми свързани със сайта

Радвам се, че няма оплаквания. Затова ще маркирам проблема като решен. Може да изтриете аswMBR и DDS, както и логовете им. Приятна вечер и успех!

P.S. А за цитатите може да пишете в подходяща тема от този раздел: Предложения, Въпроси и Проблеми свързани със сайта

Благодаря! Лека вечер!