Премини към съдържанието
Форумът в приложение

По-лесно сърфиране. Научи повече.
Kaldata.com - Форуми

Приложение на форума на цял екран с push известия, значки и други.

За да инсталирате това приложение на iOS и iPadOS
  1. Докоснете Иконата за споделяне в Safari
  2. Превъртете менюто и докоснете Добавяне към началния екран.
  3. Докоснете Добавяне в горния десен ъгъл.
За да инсталирате това приложение на Android
  1. Докоснете менюто с 3 точки (⋮) в горния десен ъгъл на браузъра.
  2. Докоснете Добавяне към началния екран или Инсталиране на приложение.
  3. Потвърдете, като докоснете Инсталиране.
Добави Kaldata.com в предпочитани източници в Google

Добре дошли!

Добре дошли в нашите форуми, пълни с полезна информация. Имате проблем с компютъра или телефона си? Публикувайте нова тема и ще намерите решение на всичките си проблеми. Общувайте свободно и открийте безброй нови приятели.

Моля, регистрирайте се за да публикувате тема и да получите пълен достъп до всички функции.

 

Проблем с вируси

Гости Прокси регулатор
Гости Прокси регулатор
в Премахване на зловреден софтуер

Featured Replies

Здравейте днес забелязах някъкво съобщение от Windows, което гласи, че системата е инфектирана или нещо от сорта, погледнах гледам два вируса:

Публикувано изображение

опитах се да ги премахна от тук, но неуспешно точно след като цъкна на "Изчистване на системата, почва да зарежда и хоп изчезва след тва пак се появявя, явно вируса не допуска да мога да го махна. Пробвах с Malware Anti Virus... не намери нищо. Реших да погледна Task Manager-а и гледам:

Публикувано изображение

някъкви файлове с измислени имена и се досетих, че сигурно са то вирусите. И така търся решение как да махна тази гадна напаст! Благодаря предварително!

Здравейте..!Бих ви препоръчал да прочетете Системата ми е инфектирана - Какво да правя сега? и да подготвите дневвник от сканирането с DDS ( точка 5)...!:D

ето информация от DDS.txt: . DDS (Ver_2011-08-26.01) - NTFSAMD64 Internet Explorer: 8.0.7601.17514 BrowserJavaVersion: 1.6.0_26 Run by Siso at 13:19:30 on 2011-10-22 Microsoft Windows 7 Ultimate 6.1.7601.1.1251.359.1033.18.4095.2264 [GMT 3:00] . AV: avast! antivirus *Enabled/Updated* {C37D8F93-0602-E43C-40AA-47DAD597F308} SP: avast! antivirus *Enabled/Updated* {781C6E77-2038-EBB2-7A1A-7CA8AE10B9B5} SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . ============== Running Processes =============== . C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k RPCSS C:\Windows\system32\atiesrxx.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\atieclxx.exe C:\Windows\system32\svchost.exe -k NetworkService C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Windows\system32\taskhost.exe C:\Windows\Pixart\Pac7302\Monitor.exe C:\Program Files (x86)\uTorrent\uTorrent.exe C:\AppServ\Apache2.2\bin\httpd.exe C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe C:\Program Files (x86)\IVT Corporation\BlueSoleil\BlueSoleilCS.exe C:\Program Files (x86)\Skype\Phone\Skype.exe C:\Program Files (x86)\Internet Download Manager\IDMan.exe C:\Program Files (x86)\Bonjour\mDNSResponder.exe C:\Program Files (x86)\IVT Corporation\BlueSoleil\BsMobileCS.exe C:\Program Files (x86)\Firebird\Firebird_2_5\bin\fbguard.exe C:\Program Files (x86)\Hand-Crafted Software\FreeProxy\FreeProxy.exe C:\Program Files (x86)\Gadwin Systems\PrintScreenPro\PrintScreenPro.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Program Files (x86)\Icecast2 Win32\icecastService.exe C:\Users\Siso\AppData\Local\Programs\Google\MusicManager\MusicManager.exe C:\Program Files (x86)\BlazeVideo\BlazeDTV 6.0\MediaDetector.exe C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe C:\Users\Siso\AppData\Local\Google\Update\1.3.21.79\GoogleCrashHandler.exe C:\ALTDVB StarEdition III\ALTDVB Manager.exe C:\AppServ\Apache2.2\bin\httpd.exe C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe C:\Program Files (x86)\Winamp\winampa.exe C:\Program Files (x86)\IVT Corporation\BlueSoleil\BtTray.exe C:\Program Files\Alwil Software\Avast4\ashDisp.exe C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Program Files (x86)\iTunes\iTunesHelper.exe C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe C:\Program Files (x86)\Skype\Plugin Manager\skypePM.exe C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Windows\splwow64.exe C:\Program Files (x86)\Mail Enable\Bin64\MELSC.EXE C:\Program Files (x86)\Mail Enable\Bin64\MEMTA.EXE C:\Program Files (x86)\Mail Enable\Bin64\MEPOC.EXE C:\Program Files (x86)\Mail Enable\Bin64\MEPOPS.EXE C:\Program Files (x86)\Mail Enable\Bin64\MESMTPC.EXE C:\AppServ\MySQL\bin\mysqld-nt.exe C:\Windows\SysWOW64\PnkBstrA.exe C:\Windows\system32\svchost.exe -k imgsvc C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Windows\system32\SearchIndexer.exe C:\Program Files (x86)\Firebird\Firebird_2_5\bin\fbserver.exe C:\Program Files (x86)\IVT Corporation\BlueSoleil\BsHelpCS.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Windows\system32\taskhost.exe C:\Program Files (x86)\Internet Download Manager\IEMonitor.exe C:\Users\Siso\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\Siso\AppData\Local\Google\Chrome\Application\chrome.exe C:\Windows\SysWOW64\rundll32.exe C:\Users\Siso\AppData\Local\Google\Chrome\Application\chrome.exe C:\Windows\System32\svchost.exe -k secsvcs C:\Users\Siso\Desktop\4k8t247w.exe C:\Users\Siso\AppData\Local\Temp\RarSFX3\yl2d54.exe C:\Users\Siso\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\Siso\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\Siso\AppData\Local\Google\Chrome\Application\chrome.exe C:\Windows\system32\AUDIODG.EXE C:\Windows\system32\SearchProtocolHost.exe C:\Windows\system32\SearchFilterHost.exe C:\Windows\system32\DllHost.exe C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\conhost.exe C:\Windows\SysWOW64\cscript.exe C:\Windows\system32\wbem\wmiprvse.exe . ============== Pseudo HJT Report =============== . uStart Page = about:blank uInternet Settings,ProxyServer = 206.207.248.35:3128 mSearchAssistant = hxxp://start.facemoods.com/?a=w7th&s={searchTerms}&f=4 uURLSearchHooks: Softonic English FF Toolbar: {ffa0793e-3980-4be4-8234-048fa665f700} - C:\Program Files (x86)\Softonic_English_FF\prxtbSof0.dll mURLSearchHooks: Softonic English FF Toolbar: {ffa0793e-3980-4be4-8234-048fa665f700} - C:\Program Files (x86)\Softonic_English_FF\prxtbSof0.dll mWinlogon: Userinit=userinit.exe, BHO: IDM integration (IDMIEHlprObj Class): {0055c089-8582-441b-a0bf-17b458c2a3a8} - C:\Program Files (x86)\Internet Download Manager\IDMIECC.dll BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO: RewardsArcade: {597a9974-8cb0-4f41-b61f-ed065738a397} - C:\Program Files (x86)\RewardsArcade\RewardsArcade.dll BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll BHO: Softonic English FF Toolbar: {ffa0793e-3980-4be4-8234-048fa665f700} - C:\Program Files (x86)\Softonic_English_FF\prxtbSof0.dll TB: Softonic English FF Toolbar: {ffa0793e-3980-4be4-8234-048fa665f700} - C:\Program Files (x86)\Softonic_English_FF\prxtbSof0.dll TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File TB: {30F9B915-B755-4826-820B-08FBA6BD249D} - No File uRun: [uTorrent] "C:\Program Files (x86)\uTorrent\uTorrent.exe" uRun: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun uRun: [skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /nosplash /minimized uRun: [iDMan] C:\Program Files (x86)\Internet Download Manager\IDMan.exe /onboot uRun: [RGSC] D:\Siso\Games\GTA IV\Rockstar Games Social Club\RGSCLauncher.exe /silent uRun: [Gadwin PrintScreen Pro] C:\Program Files (x86)\Gadwin Systems\PrintScreenPro\PrintScreenPro.exe /nosplash uRun: [Google Update] "C:\Users\Siso\AppData\Local\Google\Update\GoogleUpdate.exe" /c uRun: [steam] "C:\Program Files (x86)\Steam\Steam.exe" -silent uRun: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun uRun: [MusicManager] "C:\Users\Siso\AppData\Local\Programs\Google\MusicManager\MusicManager.exe" uRun: [blazeServoTool] "C:\Program Files (x86)\BlazeVideo\BlazeDTV 6.0\MediaDetector.exe" uRun: [Pando Media Booster] C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe mRun: [HDAudDeck] C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe -r mRun: [WinampAgent] "C:\Program Files (x86)\Winamp\winampa.exe" mRun: [btTray] "C:\Program Files (x86)\IVT Corporation\BlueSoleil\BtTray.exe" mRun: [avast!] "C:\Program Files\Alwil Software\Avast4\ashDisp.exe" mRun: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" mRun: [amd_dc_opt] C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" mRun: [switchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe mRun: [AdobeCS5.5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" -launchedbylogin mRun: [ALTDVB_Manager] C:\ALTDVB StarEdition III\\ALTDVB Manager.exe mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" mRun: [startCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun mRun: [ATICustomerCare] "C:\Program Files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe" StartupFolder: C:\Users\Siso\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\ALTDVB~1.LNK - C:\ALTDVB StarEdition III\ALTDVB Manager.exe StartupFolder: C:\Users\Siso\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\REGIST~1.LNK - D:\Siso\Games\Driver Parallel Lines\Register\RegistrationReminder.exe mPolicies-explorer: NoActiveDesktop = 1 (0x1) mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1) mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0) mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3) mPolicies-system: EnableLUA = 0 (0x0) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) mPolicies-system: PromptOnSecureDesktop = 0 (0x0) IE: ????3?? IE: ????3?????? IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\OFFICE11\EXCEL.EXE/3000 IE: Send by Bluetooth - C:\Program Files (x86)\IVT Corporation\BlueSoleil\TransSend\IE\tsinfo.htm IE: Send via &Message... - C:\Program Files (x86)\IVT Corporation\BlueSoleil\TransSend\IE\tssms.htm IE: Свали всички линкове с IDM - C:\Program Files (x86)\Internet Download Manager\IEGetAll.htm IE: Свали с IDM - C:\Program Files (x86)\Internet Download Manager\IEExt.htm IE: ????3?? - C:\Users\Siso\AppData\Roaming\FlashGetBHO\GetUrl.htm IE: ????3?????? - C:\Users\Siso\AppData\Roaming\FlashGetBHO\GetAllUrl.htm IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~1\OFFICE11\REFIEBAR.DLL DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab TCP: Interfaces\{D4DD6AF9-0B7F-42F6-964B-821F4A1D9E22} : NameServer = 212.25.58.229 212.25.58.2 Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Windows\SysWOW64\skype4com.dll BHO-X64: IDM integration (IDMIEHlprObj Class): {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files (x86)\Internet Download Manager\IDMIECC.dll BHO-X64: IDM Helper - No File BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO-X64: AcroIEHelperStub - No File BHO-X64: RewardsArcade: {597A9974-8CB0-4f41-B61F-ED065738A397} - C:\Program Files (x86)\RewardsArcade\RewardsArcade.dll BHO-X64: RewardsArcade - No File BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll BHO-X64: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll BHO-X64: Softonic English FF Toolbar: {ffa0793e-3980-4be4-8234-048fa665f700} - C:\Program Files (x86)\Softonic_English_FF\prxtbSof0.dll BHO-X64: Softonic English FF - No File TB-X64: Softonic English FF Toolbar: {ffa0793e-3980-4be4-8234-048fa665f700} - C:\Program Files (x86)\Softonic_English_FF\prxtbSof0.dll TB-X64: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File TB-X64: {30F9B915-B755-4826-820B-08FBA6BD249D} - No File mRun-x64: [HDAudDeck] C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe -r mRun-x64: [WinampAgent] "C:\Program Files (x86)\Winamp\winampa.exe" mRun-x64: [btTray] "C:\Program Files (x86)\IVT Corporation\BlueSoleil\BtTray.exe" mRun-x64: [avast!] "C:\Program Files\Alwil Software\Avast4\ashDisp.exe" mRun-x64: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" mRun-x64: [amd_dc_opt] C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe mRun-x64: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime mRun-x64: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" mRun-x64: [switchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe mRun-x64: [AdobeCS5.5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" -launchedbylogin mRun-x64: [ALTDVB_Manager] C:\ALTDVB StarEdition III\\ALTDVB Manager.exe mRun-x64: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" mRun-x64: [startCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun mRun-x64: [ATICustomerCare] "C:\Program Files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe" . ================= FIREFOX =================== . FF - ProfilePath - C:\Users\Siso\AppData\Roaming\Mozilla\Firefox\Profiles\80w5p5ie.default\ FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2359656&SearchSource=3&q={searchTerms} FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - about:home FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2359656&SearchSource=2&q= FF - prefs.js: network.proxy.type - 0 FF - component: C:\Users\Siso\AppData\Roaming\IDM\idmmzcc3\components\idmmzcc.dll FF - component: C:\Users\Siso\AppData\Roaming\Mozilla\Firefox\Profiles\80w5p5ie.default\extensions\{12e4c684-c03e-4e4d-85bc-0c065e7a9489}\components\WinampPlayer.dll FF - component: C:\Users\Siso\AppData\Roaming\Mozilla\Firefox\Profiles\80w5p5ie.default\extensions\{41cef275-f2d3-4e13-a99d-9ff86220682e}\components\RadioWMPCore.dll FF - component: C:\Users\Siso\AppData\Roaming\Mozilla\Firefox\Profiles\80w5p5ie.default\extensions\{41cef275-f2d3-4e13-a99d-9ff86220682e}\components\RadioWMPCoreGecko19.dll FF - component: C:\Users\Siso\AppData\Roaming\Mozilla\Firefox\Profiles\80w5p5ie.default\extensions\{ffa0793e-3980-4be4-8234-048fa665f700}\components\RadioWMPCore.dll FF - component: C:\Users\Siso\AppData\Roaming\Mozilla\Firefox\Profiles\80w5p5ie.default\extensions\{ffa0793e-3980-4be4-8234-048fa665f700}\components\RadioWMPCoreGecko19.dll FF - component: C:\Users\Siso\AppData\Roaming\Mozilla\Firefox\Profiles\80w5p5ie.default\extensions\[email protected]\components\RadioWMPCoreGecko19.dll FF - plugin: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll FF - plugin: C:\Program Files (x86)\InhatchTeam\Inhatch\npinhatch.dll FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll FF - plugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll FF - plugin: C:\Program Files (x86)\Veetle\Player\npvlc.dll FF - plugin: C:\Program Files (x86)\Veetle\plugins\npVeetle.dll FF - plugin: C:\Program Files\ma-config.com\nphardwaredetection.dll FF - plugin: C:\Users\Siso\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll FF - plugin: C:\Users\Siso\AppData\Roaming\Mozilla\Plugins\npoff.dll FF - plugin: C:\Users\Siso\AppData\Roaming\Mozilla\Plugins\npwbe.dll FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll . ============= SERVICES / DRIVERS =============== . R0 BtHidBus;Bluetooth HID Bus Service;C:\Windows\system32\Drivers\BtHidBus.sys --> C:\Windows\system32\Drivers\BtHidBus.sys [?] R1 aswSP;avast! Self Protection;C:\Windows\system32\drivers\aswSP.sys --> C:\Windows\system32\drivers\aswSP.sys [?] R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;C:\Windows\system32\DRIVERS\dtsoftbus01.sys --> C:\Windows\system32\DRIVERS\dtsoftbus01.sys [?] R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\system32\atiesrxx.exe --> C:\Windows\system32\atiesrxx.exe [?] R2 Apache2.2;Apache2.2;C:\AppServ\Apache2.2\bin\httpd.exe [2008-1-17 24635] R2 aswFsBlk;aswFsBlk;C:\Windows\system32\DRIVERS\aswFsBlk.sys --> C:\Windows\system32\DRIVERS\aswFsBlk.sys [?] R2 aswMonFlt;aswMonFlt;C:\Windows\system32\DRIVERS\aswMonFlt.sys --> C:\Windows\system32\DRIVERS\aswMonFlt.sys [?] R2 avast! Antivirus;avast! Antivirus;C:\Program Files\Alwil Software\Avast4\ashServ.exe [2011-6-6 155160] R2 BsMobileCS;BsMobileCS;C:\Program Files (x86)\IVT Corporation\BlueSoleil\BsMobileCS.exe [2009-2-27 143467] R2 IDMWFP;IDMWFP;C:\Windows\system32\DRIVERS\idmwfp.sys --> C:\Windows\system32\DRIVERS\idmwfp.sys [?] R3 amdkmdag;amdkmdag;C:\Windows\system32\DRIVERS\atikmdag.sys --> C:\Windows\system32\DRIVERS\atikmdag.sys [?] R3 amdkmdap;amdkmdap;C:\Windows\system32\DRIVERS\atikmpag.sys --> C:\Windows\system32\DRIVERS\atikmpag.sys [?] R3 AtiHDAudioService;AMD Function Driver for HD Audio Service;C:\Windows\system32\drivers\AtihdW76.sys --> C:\Windows\system32\drivers\AtihdW76.sys [?] R3 avast! Mail Scanner;avast! Mail Scanner;C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe [2011-6-6 254040] R3 avast! Web Scanner;avast! Web Scanner;C:\Program Files\Alwil Software\Avast4\ashWebSv.exe [2011-6-6 352920] R3 btnetBUs;Bluetooth PAN Bus Service;C:\Windows\system32\Drivers\btnetBus.sys --> C:\Windows\system32\Drivers\btnetBus.sys [?] R3 IvtBtBUs;IVT Bluetooth Bus Service;C:\Windows\system32\Drivers\IvtBtBus.sys --> C:\Windows\system32\Drivers\IvtBtBus.sys [?] R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys --> C:\Windows\system32\DRIVERS\Rt64win7.sys [?] R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;C:\Windows\system32\drivers\viahduaa.sys --> C:\Windows\system32\drivers\viahduaa.sys [?] S2 AODService;AODService;C:\Program Files (x86)\AMD\OverDrive\AODAssist.exe [2009-5-5 124256] S3 amdiox64;AMD IO Driver;C:\Windows\system32\DRIVERS\amdiox64.sys --> C:\Windows\system32\DRIVERS\amdiox64.sys [?] S3 dmvsc;dmvsc;C:\Windows\system32\drivers\dmvsc.sys --> C:\Windows\system32\drivers\dmvsc.sys [?] S3 driverhardwarev2x64;driverhardwarev2x64;C:\Program Files\ma-config.com\Drivers\driverhardwarev2x64.sys [2011-7-21 16640] S3 epmntdrv;epmntdrv;C:\Windows\System32\epmntdrv.sys [2011-9-25 14216] S3 EuGdiDrv;EuGdiDrv;C:\Windows\System32\EuGdiDrv.sys [2011-9-25 8456] S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\system32\drivers\rdpvideominiport.sys --> C:\Windows\system32\drivers\rdpvideominiport.sys [?] S3 Synth3dVsc;Synth3dVsc;C:\Windows\system32\drivers\synth3dvsc.sys --> C:\Windows\system32\drivers\synth3dvsc.sys [?] S3 terminpt;Microsoft Remote Desktop Input Driver;C:\Windows\system32\drivers\terminpt.sys --> C:\Windows\system32\drivers\terminpt.sys [?] S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?] S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\system32\drivers\TsUsbGD.sys --> C:\Windows\system32\drivers\TsUsbGD.sys [?] SUnknown tsusbhub;tsusbhub; [x] . =============== Created Last 30 ================ . 2011-10-22 09:42:51 -------- d-----w- C:\Users\Siso\DoctorWeb 2011-10-22 08:44:41 184320 --sh--w- C:\Windows\SysWow64\igfxvtk2.exe 2011-10-19 20:26:31 -------- d-----w- C:\Users\Siso\AppData\Roaming\Ashampoo 2011-10-19 20:26:09 -------- d-----w- C:\Users\Siso\AppData\Local\ashampoo 2011-10-19 20:26:09 -------- d-----w- C:\ProgramData\ashampoo 2011-10-19 20:26:05 -------- d-----w- C:\ProgramData\page 2011-10-19 20:26:04 -------- d-----w- C:\Program Files (x86)\Ashampoo 2011-10-19 19:58:13 -------- d-----w- C:\Program Files (x86)\VS Revo Group 2011-10-19 19:54:47 -------- d-----w- C:\Users\Siso\AppData\Local\Ahead 2011-10-19 19:51:39 -------- d-----w- C:\Program Files (x86)\Nero 2011-10-19 15:32:26 -------- d-----w- C:\Users\Siso\AppData\Local\RewardsArcade 2011-10-19 15:32:25 -------- d-----w- C:\Program Files (x86)\RewardsArcade 2011-10-19 15:27:50 -------- d-----w- C:\Users\Siso\AppData\Roaming\Trillian 2011-10-18 17:23:22 -------- d-----w- C:\Program Files (x86)\BulGames™ 2011-10-18 12:06:29 -------- d-----w- C:\Program Files (x86)\NVIDIA Corporation 2011-10-16 09:51:20 -------- d-----w- C:\Users\Siso\AppData\Roaming\Need for Speed World 2011-10-16 09:35:36 -------- d-----w- C:\Users\Siso\AppData\Local\Electronic_Arts_Inc 2011-10-16 09:35:11 -------- d-----w- C:\Users\Siso\AppData\Local\PMB Files 2011-10-16 09:35:07 -------- d-----w- C:\ProgramData\PMB Files 2011-10-16 09:35:02 -------- d-----w- C:\Program Files (x86)\Pando Networks 2011-10-16 09:34:57 -------- d-----w- C:\Users\Siso\AppData\Local\Pando_Temp 2011-10-13 21:49:48 -------- d-----w- C:\Program Files (x86)\ATI 2011-10-13 21:49:23 -------- d-----w- C:\Program Files\ATI Technologies 2011-10-13 21:06:11 -------- d-----w- C:\ATI 2011-10-13 15:20:36 -------- d-----w- C:\Program Files (x86)\AMD APP 2011-10-13 15:20:25 -------- d-----w- C:\Program Files (x86)\Common Files\ATI Technologies 2011-10-13 15:18:08 -------- d-----w- C:\Program Files\Common Files\ATI Technologies 2011-10-13 15:15:38 -------- d-----w- C:\Program Files (x86)\ATI Technologies 2011-10-13 15:15:15 -------- d-----w- C:\Program Files\ATI 2011-10-13 15:14:18 -------- d-----w- C:\AMD 2011-10-11 18:30:46 -------- d-----w- C:\Program Files (x86)\Nokia 2011-10-11 18:28:24 -------- d-----w- C:\Program Files (x86)\Wave 2 Mp3 2011-10-03 17:23:46 -------- d-----w- C:\Program Files (x86)\FlashGet 2011-10-03 17:20:48 -------- d-----w- C:\Users\Siso\AppData\Roaming\FlashGet 2011-10-03 17:20:47 -------- d-----w- C:\Users\Siso\AppData\Roaming\BITS 2011-10-03 17:20:43 -------- d-----w- C:\Users\Siso\AppData\Roaming\FlashGetBHO 2011-10-03 17:20:40 -------- d-----w- C:\Program Files (x86)\FlashGet Network 2011-10-03 16:56:42 10203648 ----a-w- C:\Windows\System32\drivers\atikmdag.sys 2011-10-03 16:24:38 24996864 ----a-w- C:\Windows\System32\atio6axx.dll 2011-10-03 16:03:46 151552 ----a-w- C:\Windows\System32\atiapfxx.exe 2011-10-03 16:03:04 18836480 ----a-w- C:\Windows\SysWow64\atioglxx.dll 2011-10-03 16:00:04 466944 ----a-w- C:\Windows\System32\ATIDEMGX.dll 2011-10-03 15:59:54 486912 ----a-w- C:\Windows\System32\atieclxx.exe 2011-10-03 15:59:22 204288 ----a-w- C:\Windows\System32\atiesrxx.exe 2011-10-03 15:58:22 120320 ----a-w- C:\Windows\System32\atitmm64.dll 2011-10-03 15:58:04 423424 ----a-w- C:\Windows\System32\atipdl64.dll 2011-10-03 15:57:58 356352 ----a-w- C:\Windows\SysWow64\atipdlxx.dll 2011-10-03 15:57:48 278528 ----a-w- C:\Windows\SysWow64\Oemdspif.dll 2011-10-03 15:57:44 21504 ----a-w- C:\Windows\System32\atimuixx.dll 2011-10-03 15:57:42 59392 ----a-w- C:\Windows\System32\atiedu64.dll 2011-10-03 15:57:36 43520 ----a-w- C:\Windows\SysWow64\ati2edxx.dll 2011-10-03 15:54:56 4204032 ----a-w- C:\Windows\SysWow64\atidxx32.dll 2011-10-03 15:49:44 1113088 ----a-w- C:\Windows\System32\atiumd6v.dll 2011-10-03 15:49:10 1828864 ----a-w- C:\Windows\SysWow64\atiumdmv.dll 2011-10-03 15:39:54 51200 ----a-w- C:\Windows\System32\aticalrt64.dll 2011-10-03 15:39:50 46080 ----a-w- C:\Windows\SysWow64\aticalrt.dll 2011-10-03 15:39:42 44544 ----a-w- C:\Windows\System32\aticalcl64.dll 2011-10-03 15:39:40 44032 ----a-w- C:\Windows\SysWow64\aticalcl.dll 2011-10-03 15:39:28 8723456 ----a-w- C:\Windows\System32\aticaldd64.dll 2011-10-03 15:36:02 7331840 ----a-w- C:\Windows\SysWow64\aticaldd.dll 2011-10-03 15:23:10 270336 ----a-w- C:\Windows\SysWow64\atiadlxy.dll 2011-10-03 15:22:58 15360 ----a-w- C:\Windows\System32\atig6pxx.dll 2011-10-03 15:22:54 13312 ----a-w- C:\Windows\SysWow64\atiglpxx.dll 2011-10-03 15:22:54 13312 ----a-w- C:\Windows\System32\atiglpxx.dll 2011-10-03 15:22:52 39936 ----a-w- C:\Windows\System32\atig6txx.dll 2011-10-03 15:22:46 32768 ----a-w- C:\Windows\SysWow64\atigktxx.dll 2011-10-03 15:22:40 310784 ----a-w- C:\Windows\System32\drivers\atikmpag.sys 2011-10-03 15:21:54 31744 ----a-w- C:\Windows\SysWow64\atiuxpag.dll 2011-10-03 15:21:28 54784 ----a-w- C:\Windows\System32\atimpc64.dll 2011-10-03 15:21:28 54784 ----a-w- C:\Windows\System32\amdpcom64.dll 2011-10-03 15:21:22 53760 ----a-w- C:\Windows\SysWow64\atimpc32.dll 2011-10-03 15:21:22 53760 ----a-w- C:\Windows\SysWow64\amdpcom32.dll 2011-10-03 15:21:10 53248 ----a-w- C:\Windows\System32\drivers\ati2erec.dll 2011-10-03 09:53:20 60416 ----a-w- C:\Windows\System32\OVDecode64.dll 2011-10-03 09:53:16 53760 ----a-w- C:\Windows\SysWow64\OVDecode.dll 2011-10-03 09:52:46 16652288 ----a-w- C:\Windows\System32\amdocl64.dll 2011-10-03 09:43:00 44032 ----a-w- C:\Windows\System32\amdoclcl64.dll 2011-10-03 09:42:58 37376 ----a-w- C:\Windows\SysWow64\amdoclcl.dll 2011-09-29 15:56:45 134104 ----a-w- C:\Program Files (x86)\Mozilla Firefox\components\browsercomps.dll 2011-09-29 15:56:44 89048 ----a-w- C:\Program Files (x86)\Mozilla Firefox\libEGL.dll 2011-09-29 15:56:44 773080 ----a-w- C:\Program Files (x86)\Mozilla Firefox\mozsqlite3.dll 2011-09-29 15:56:44 478168 ----a-w- C:\Program Files (x86)\Mozilla Firefox\libGLESv2.dll 2011-09-29 15:56:44 2106216 ----a-w- C:\Program Files (x86)\Mozilla Firefox\D3DCompiler_43.dll 2011-09-29 15:56:44 1998168 ----a-w- C:\Program Files (x86)\Mozilla Firefox\d3dx9_43.dll 2011-09-29 15:56:44 1833944 ----a-w- C:\Program Files (x86)\Mozilla Firefox\mozjs.dll 2011-09-29 15:56:44 15832 ----a-w- C:\Program Files (x86)\Mozilla Firefox\mozalloc.dll 2011-09-28 18:50:01 -------- d-----w- C:\ubuntu 2011-09-26 16:59:35 -------- d-----w- C:\Program Files (x86)\CDex 2011-09-25 12:03:43 9096 ----a-w- C:\Windows\System32\EuGdiDrv.sys 2011-09-25 12:03:43 86408 ----a-w- C:\Windows\SysWow64\setupempdrv03.exe 2011-09-25 12:03:43 8456 ----a-w- C:\Windows\SysWow64\EuGdiDrv.sys 2011-09-25 12:03:43 2913920 ----a-w- C:\Windows\System32\BootMan.exe 2011-09-25 12:03:43 2336384 ----a-w- C:\Windows\SysWow64\BootMan.exe 2011-09-25 12:03:43 16776 ----a-w- C:\Windows\System32\epmntdrv.sys 2011-09-25 12:03:43 14848 ----a-w- C:\Windows\SysWow64\EuEpmGdi.dll 2011-09-25 12:03:43 14216 ----a-w- C:\Windows\SysWow64\epmntdrv.sys 2011-09-25 12:03:43 11264 ----a-w- C:\Windows\System32\EuEpmGdi.dll 2011-09-25 12:03:43 100232 ----a-w- C:\Windows\System32\setupempdrvx64.exe 2011-09-25 12:03:38 -------- d-----w- C:\Program Files (x86)\EASEUS 2011-09-24 11:04:08 -------- d-----w- C:\Program Files (x86)\Audacity 2011-09-22 14:13:21 -------- d-----w- C:\Casino . ==================== Find3M ==================== . 2011-10-09 14:49:00 414368 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl 2011-10-03 16:03:36 732672 ----a-w- C:\Windows\SysWow64\aticfx32.dll 2011-10-03 16:02:24 862720 ----a-w- C:\Windows\System32\aticfx64.dll 2011-10-03 15:48:58 3888640 ----a-w- C:\Windows\System32\atiumd6a.dll 2011-10-03 15:46:12 4944896 ----a-w- C:\Windows\System32\atidxx64.dll 2011-10-03 15:39:12 4064768 ----a-w- C:\Windows\SysWow64\atiumdva.dll 2011-10-03 15:35:48 4289024 ----a-w- C:\Windows\SysWow64\atiumdag.dll 2011-10-03 15:30:02 5428736 ----a-w- C:\Windows\System32\atiumd64.dll 2011-10-03 15:29:30 58880 ----a-w- C:\Windows\System32\coinst.dll 2011-10-03 15:23:18 381952 ----a-w- C:\Windows\System32\atiadlxx.dll 2011-10-03 15:22:00 40960 ----a-w- C:\Windows\System32\atiuxp64.dll 2011-10-03 15:21:48 38912 ----a-w- C:\Windows\System32\atiu9p64.dll 2011-10-03 15:21:42 29184 ----a-w- C:\Windows\SysWow64\atiu9pag.dll 2011-09-13 14:18:15 14 ----a-w- C:\Windows\SysWow64\systeminfo.dll 2011-09-13 13:46:48 507392 ----a-w- C:\Windows\System32\drivers\AF15BDA.sys 2011-09-13 13:46:48 28672 ----a-w- C:\Windows\System32\AF15BDAEX.dll 2011-09-13 13:46:48 140 ----a-w- C:\Windows\System32\AF15IRTBL.bin 2011-09-04 16:12:05 0 ----a-w- C:\Windows\ativpsrm.bin 2011-09-02 16:05:12 5632 ----a-w- C:\Windows\SysWow64\BReWErS.dll 2011-09-01 14:22:11 332288 ----a-w- C:\Windows\System32\uxtheme.dll 2011-09-01 14:22:09 2851840 ----a-w- C:\Windows\System32\themeui.dll 2011-09-01 14:22:06 44544 ----a-w- C:\Windows\System32\themeservice.dll 2011-08-31 22:54:30 271200 ----a-w- C:\Windows\SysWow64\PnkBstrB.xtr 2011-08-31 22:54:30 271200 ----a-w- C:\Windows\SysWow64\PnkBstrB.exe 2011-08-31 22:53:53 103736 ----a-w- C:\Windows\SysWow64\PnkBstrB.ex0 2011-08-31 14:00:50 25416 ----a-w- C:\Windows\System32\drivers\mbam.sys 2011-08-26 15:03:02 102 ----a-w- C:\Windows\dxyiptfm2.dll 2011-08-26 14:39:19 512512 ----a-w- C:\Windows\SysWow64\sendmail.exe 2011-08-26 14:39:19 1437184 ----a-w- C:\Windows\tellmail.exe 2011-08-26 14:39:19 1437184 ----a-w- C:\Windows\SysWow64\tellmail.exe 2011-08-24 17:19:10 56320 ----a-w- C:\Windows\SysWow64\OpenVideo.dll 2011-08-24 17:18:30 13601280 ----a-w- C:\Windows\SysWow64\amdocl.dll 2011-08-24 17:17:52 43520 ----a-w- C:\Windows\SysWow64\OpenCL.dll 2011-07-28 14:48:58 51200 ----a-w- C:\Windows\System32\OpenCL.dll . ============= FINISH: 13:20:42,84 =============== Ето и от Attach.txt: . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2011-08-26.01) . Microsoft Windows 7 Ultimate Boot Device: \Device\HarddiskVolume1 Install Date: 3.6.2011 г. 19:16:43 System Uptime: 22.10.2011 г. 12:44:11 (1 hours ago) . Motherboard: ASRock | | M3A770DE Processor: AMD Athlon II X2 265 Processor | CPUSocket | 3300/200mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 108 GiB total, 16,361 GiB free. D: is FIXED (NTFS) - 823 GiB total, 254,693 GiB free. E: is CDROM () F: is CDROM () . ==== Disabled Device Manager Items ============= . Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1} Description: AODDriver4.01 Device ID: ROOT\LEGACY_AODDRIVER4.01\0000 Manufacturer: Name: AODDriver4.01 PNP Device ID: ROOT\LEGACY_AODDRIVER4.01\0000 Service: AODDriver4.01 . Class GUID: Description: IVT_Virtual_0000 Device ID: {F12D3CF8-B11D-457E-8641-BE2AF2D6D204}\IVTBTPAN\1&21CCD16&0&0000 Manufacturer: Name: IVT_Virtual_0000 PNP Device ID: {F12D3CF8-B11D-457E-8641-BE2AF2D6D204}\IVTBTPAN\1&21CCD16&0&0000 Service: . ==== System Restore Points =================== . RP140: 19.10.2011 г. 22:42:19 - Installed Nero 7 Premium RP141: 19.10.2011 г. 22:45:35 - Installed Nero 7 Premium RP142: 19.10.2011 г. 22:51:12 - Installed Nero 7. Available with Windows Installer version 1.2 and later. RP143: 19.10.2011 г. 22:59:45 - Revo Uninstaller's restore point - Nero 7 Premium RP144: 19.10.2011 г. 23:00:08 - Installed Nero 7. Available with Windows Installer version 1.2 and later. RP145: 19.10.2011 г. 23:12:25 - Installed Nero 7 Premium RP146: 21.10.2011 г. 15:43:26 - Installed Nero 7 Premium RP147: 22.10.2011 г. 00:47:31 - Installed Grand Theft Auto IV RP148: 22.10.2011 г. 00:56:47 - Removed Grand Theft Auto IV . ==== Installed Programs ====================== . µTorrent Acoustica Effects Pack Acoustica Mixcraft 5 Adobe AIR Adobe Community Help Adobe Flash Player 11 Plugin Adobe Help Center 1.0 Adobe Photoshop CS5.1 Adobe Reader 9.4.6 Advanced Port Scanner v1.3 ALTDVB StarEdition III AMD OverDrive Apple Application Support Apple Software Update AppServ 2.5.10 (remove only) Ashampoo Burning Studio 2009 ASIO4ALL ATI Catalyst Registration Audacity 1.2.6 Auto Gordian Knot 2.55 avast! Antivirus AviSynth 2.5 Batman: Arkham Asylum BlazeDTV 6.0 Burnout Paradise The Ultimate Box Call of Duty® 4 - Modern Warfare Call of Duty® 4 - Modern Warfare 1.6 Patch Call of Duty® 4 - Modern Warfare 1.7 Patch Camtasia Studio 5 Camtasia Studio 7 Casino at bet365 Catalyst Control Center - Branding Catalyst Control Center Graphics Previews Common Catalyst Control Center Graphics Previews Vista Catalyst Control Center InstallProxy ccc-core-static CCC Help English CDex - Open Source Digital Audio CD Extractor Crysis® CuteFTP 8 Professional DAEMON Tools Lite Dark Sector DiRT 3 Dragon Age II Driver Sweeper version 3.1.0 Dual-Core Optimizer DVB Dream version 1.5c DVBViewer Pro DVD Decrypter (Remove Only) EASEUS Partition Master 7.1.1 Home Edition Easy CD-DA Extractor 2011 eTeSoft Video Converter 2.00.907.28 EVEREST Ultimate Edition v5.50 Exact Audio Copy 1.0beta2 FairUse Wizard 2 FileZilla Client 3.5.0 Firebird 2.5.0.26074 (Win32) FLV to AVI MPEG WMV 3GP MP4 iPod Converter 4.2.0622 FormatFactory 2.70 Fraps (remove only) FreeProxy version 4.10 Gadwin PrintScreen Professional Game Booster Game Booster 3 Google Chrome Grand Theft Auto IV Grand Theft Auto Sofia GTA San Andreas B-13 NFS 2011 HydraVision Icecast 2.3.2 IL Download Manager Inhatch web plugins Internet Download Manager James Bond 007 - Blood Stone Java Auto Updater Java 6 Update 26 Just Cause 2 K-Lite Mega Codec Pack 7.5.0 Mafia II Magic DVD Ripper V5.5.1 MailEnable Messaging Services for Microsoft Windows Malwarebytes' Anti-Malware, версия 1.51.2.1300 Medal of Honor Microsoft Games for Windows - LIVE Redistributable Microsoft Games for Windows Marketplace Microsoft Office 2003 Bulgarian User Interface Pack Microsoft Office Professional Edition 2003 Microsoft Software Update for Web Folders (English) 12 Microsoft SQL Server Compact 3.5 ENU Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 Microsoft_VC80_ATL_x86 Microsoft_VC80_CRT_x86 Microsoft_VC80_MFC_x86 Microsoft_VC80_MFCLOC_x86 Microsoft_VC90_ATL_x86 Microsoft_VC90_CRT_x86 Microsoft_VC90_MFC_x86 Microsoft_VC90_MFCLOC_x86 Mozilla Firefox 7.0.1 (x86 bg) MP3 Player Utilities MPEG2 Decoders MSI to redistribute MS VS2005 CRT libraries Multiupload Batch Uploader 1.0 Music Manager Need for Speed Hot Pursuit Need For Speed™ World Nero 6 Ultra Edition Nokia Multimedia Converter Pro v2.0 Notepad++ NVIDIA PhysX OpenAL Operation Flashpoint ®: Red River Pando Media Booster PCSX2 - Playstation 2 Emulator PDF Settings CS5 PhotoScape Platform Prog Finder Prototype PunkBuster Services Quantum of Solace QuickTime Rapture3D 2.4.8 Game Readon TV Movie Radio Player 7.4.0.0 Realtek Ethernet Controller Driver Red Faction Armageddon 1.0 Revo Uninstaller 1.93 RewardsArcade Rogue Warrior SAM Broadcaster v4 SHOUTcast DNAS (remove only) Skype™ 3.6 Sniper Ghost Warrior Softonic English FF Toolbar Sound Forge Pro 10.0 Steam Sysax Multi Server 5 System Requirements Lab CYRI TeamViewer 6 The Chronicles of Riddick - Assault on Dark Athena The KMPlayer (remove only) The Lord of the Rings FREE Trial Trillian Ubuntu Ultra Video Converter 4.4.0827 Veetle TV Vegas Movie Studio HD Platinum 10.0 VIA Platform Device Manager Virtua Tennis 4™ VLC media player 1.1.11 VobSub v2.23 (Remove Only) Winamp Windows Media Player Firefox Plugin Wolfenstein XviD MPEG4 Video Codec (remove only) . ==== Event Viewer Messages From Past Week ======== . 22.10.2011 г. 12:45:31, Error: Service Control Manager [7026] - Неуспешно зареждане на следния драйвер, който се активира с включване на компютъра или стартиране на системата: Cinemsup 22.10.2011 г. 12:44:39, Error: Service Control Manager [7000] - Услуга FileZilla Server FTP server не може да бъде стартирана поради следната грешка: Системата не може да намери указания файл. 22.10.2011 г. 12:44:34, Error: Service Control Manager [7000] - Услуга atksgt не може да бъде стартирана поради следната грешка: Зареждането на този драйвер е блокирано 22.10.2011 г. 12:44:34, Error: Application Popup [875] - Driver atksgt.sys has been blocked from loading. 22.10.2011 г. 12:44:32, Error: Service Control Manager [7000] - Услуга Apache не може да бъде стартирана поради следната грешка: Системата не може да намери указания файл. 22.10.2011 г. 12:44:31, Error: Service Control Manager [7000] - Услуга AODDriver4.01 не може да бъде стартирана поради следната грешка: Системата не може да намери указания път. 22.10.2011 г. 12:42:33, Error: Service Control Manager [7001] - Услуга Network List Service зависи от услуга Network Location Awareness, която не може да бъде стартирана поради следната грешка: Подчинената услуга или група не успя да стартира. 22.10.2011 г. 12:41:48, Error: Service Control Manager [7001] - Услуга Network List Service зависи от услуга Network Location Awareness, която не може да бъде стартирана поради следната грешка: Подчинената услуга или група не успя да стартира. 22.10.2011 г. 12:41:48, Error: Service Control Manager [7001] - Услуга Network List Service зависи от услуга Network Location Awareness, която не може да бъде стартирана поради следната грешка: Подчинената услуга или група не успя да стартира. 22.10.2011 г. 12:41:48, Error: Service Control Manager [7001] - Услуга Network List Service зависи от услуга Network Location Awareness, която не може да бъде стартирана поради следната грешка: Подчинената услуга или група не успя да стартира. 22.10.2011 г. 12:41:48, Error: Service Control Manager [7001] - Услуга Network List Service зависи от услуга Network Location Awareness, която не може да бъде стартирана поради следната грешка: Подчинената услуга или група не успя да стартира. 22.10.2011 г. 12:41:48, Error: Service Control Manager [7001] - Услуга Network List Service зависи от услуга Network Location Awareness, която не може да бъде стартирана поради следната грешка: Подчинената услуга или група не успя да стартира. 22.10.2011 г. 12:41:48, Error: Service Control Manager [7001] - Услуга Network List Service зависи от услуга Network Location Awareness, която не може да бъде стартирана поради следната грешка: Подчинената услуга или група не успя да стартира. 22.10.2011 г. 12:41:48, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030} 22.10.2011 г. 12:41:48, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39} 22.10.2011 г. 12:41:45, Error: Service Control Manager [7001] - Услуга Network List Service зависи от услуга Network Location Awareness, която не може да бъде стартирана поради следната грешка: Подчинената услуга или група не успя да стартира. 22.10.2011 г. 12:41:45, Error: Service Control Manager [7001] - Услуга Network List Service зависи от услуга Network Location Awareness, която не може да бъде стартирана поради следната грешка: Подчинената услуга или група не успя да стартира. 22.10.2011 г. 12:41:45, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netprofm with arguments "" in order to run the server: {A47979D2-C419-11D9-A5B4-001185AD2B89} 22.10.2011 г. 12:41:45, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netman with arguments "" in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E} 22.10.2011 г. 12:41:44, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF} 22.10.2011 г. 12:41:36, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC} 22.10.2011 г. 12:41:28, Error: Service Control Manager [7026] - Неуспешно зареждане на следния драйвер, който се активира с включване на компютъра или стартиране на системата: AFD aswRdr aswSP aswTdi Cinemsup CSC DfsC discache NetBIOS NetBT nsiproxy Psched rdbss spldr tdx Wanarpv6 WfpLwf 22.10.2011 г. 12:41:28, Error: Service Control Manager [7001] - Услуга Workstation зависи от услуга Network Store Interface Service, която не може да бъде стартирана поради следната грешка: Подчинената услуга или група не успя да стартира. 22.10.2011 г. 12:41:28, Error: Service Control Manager [7001] - Услуга WebDav Client Redirector Driver зависи от услуга Redirected Buffering Sub Sysytem, която не може да бъде стартирана поради следната грешка: Свързано към системата устройство не функционира. 22.10.2011 г. 12:41:28, Error: Service Control Manager [7001] - Услуга WebClient зависи от услуга WebDav Client Redirector Driver, която не може да бъде стартирана поради следната грешка: Подчинената услуга или група не успя да стартира. 22.10.2011 г. 12:41:28, Error: Service Control Manager [7001] - Услуга TCP/IP NetBIOS Helper зависи от услуга Ancillary Function Driver for Winsock, която не може да бъде стартирана поради следната грешка: Свързано към системата устройство не функционира. 22.10.2011 г. 12:41:28, Error: Service Control Manager [7001] - Услуга SMB MiniRedirector Wrapper and Engine зависи от услуга Redirected Buffering Sub Sysytem, която не може да бъде стартирана поради следната грешка: Свързано към системата устройство не функционира. 22.10.2011 г. 12:41:28, Error: Service Control Manager [7001] - Услуга SMB 2.0 MiniRedirector зависи от услуга SMB MiniRedirector Wrapper and Engine, която не може да бъде стартирана поради следната грешка: Подчинената услуга или група не успя да стартира. 22.10.2011 г. 12:41:28, Error: Service Control Manager [7001] - Услуга SMB 1.x MiniRedirector зависи от услуга SMB MiniRedirector Wrapper and Engine, която не може да бъде стартирана поради следната грешка: Подчинената услуга или група не успя да стартира. 22.10.2011 г. 12:41:28, Error: Service Control Manager [7001] - Услуга Network Store Interface Service зависи от услуга NSI proxy service driver., която не може да бъде стартирана поради следната грешка: Свързано към системата устройство не функционира. 22.10.2011 г. 12:41:28, Error: Service Control Manager [7001] - Услуга Network Location Awareness зависи от услуга Network Store Interface Service, която не може да бъде стартирана поради следната грешка: Подчинената услуга или група не успя да стартира. 22.10.2011 г. 12:41:28, Error: Service Control Manager [7001] - Услуга IP Helper зависи от услуга Network Store Interface Service, която не може да бъде стартирана поради следната грешка: Подчинената услуга или група не успя да стартира. 22.10.2011 г. 12:41:28, Error: Service Control Manager [7001] - Услуга DNS Client зависи от услуга NetIO Legacy TDI Support Driver, която не може да бъде стартирана поради следната грешка: Свързано към системата устройство не функционира. 22.10.2011 г. 12:41:28, Error: Service Control Manager [7001] - Услуга DHCP Client зависи от услуга Ancillary Function Driver for Winsock, която не може да бъде стартирана поради следната грешка: Свързано към системата устройство не функционира. 22.10.2011 г. 12:41:28, Error: Service Control Manager [7001] - Услуга Apache2.2 зависи от услуга Ancillary Function Driver for Winsock, която не може да бъде стартирана поради следната грешка: Свързано към системата устройство не функционира. 22.10.2011 г. 12:41:28, Error: Service Control Manager [7001] - Услуга Apache зависи от услуга Ancillary Function Driver for Winsock, която не може да бъде стартирана поради следната грешка: Свързано към системата устройство не функционира. 19.10.2011 г. 22:53:36, Error: Service Control Manager [7030] - Услуга NBService е маркирана като интерактивна услуга. Обаче системата е конфигурирана да не допуска интерактивни услуги. Тази услуга може да не функционира правилно. 19.10.2011 г. 20:10:26, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk1\DR3. 18.10.2011 г. 23:43:23, Error: Service Control Manager [7026] - Неуспешно зареждане на следния драйвер, който се активира с включване на компютъра или стартиране на системата: Cinemsup 18.10.2011 г. 23:43:09, Error: Service Control Manager [7000] - Услуга FileZilla Server FTP server не може да бъде стартирана поради следната грешка: Системата не може да намери указания файл. 18.10.2011 г. 23:43:08, Error: Service Control Manager [7000] - Услуга atksgt не може да бъде стартирана поради следната грешка: Зареждането на този драйвер е блокирано 18.10.2011 г. 23:43:08, Error: Service Control Manager [7000] - Услуга Apache не може да бъде стартирана поради следната грешка: Системата не може да намери указания файл. 18.10.2011 г. 23:43:08, Error: Service Control Manager [7000] - Услуга AODDriver4.01 не може да бъде стартирана поради следната грешка: Системата не може да намери указания път. 18.10.2011 г. 23:43:08, Error: Application Popup [875] - Driver atksgt.sys has been blocked from loading. 18.10.2011 г. 23:39:28, Error: Service Control Manager [7026] - Неуспешно зареждане на следния драйвер, който се активира с включване на компютъра или стартиране на системата: Cinemsup 18.10.2011 г. 23:39:11, Error: Service Control Manager [7000] - Услуга FileZilla Server FTP server не може да бъде стартирана поради следната грешка: Системата не може да намери указания файл. 18.10.2011 г. 23:39:10, Error: Service Control Manager [7000] - Услуга atksgt не може да бъде стартирана поради следната грешка: Зареждането на този драйвер е блокирано 18.10.2011 г. 23:39:10, Error: Application Popup [875] - Driver atksgt.sys has been blocked from loading. 18.10.2011 г. 23:39:09, Error: Service Control Manager [7000] - Услуга Apache не може да бъде стартирана поради следната грешка: Системата не може да намери указания файл. 18.10.2011 г. 23:39:09, Error: Service Control Manager [7000] - Услуга AODDriver4.01 не може да бъде стартирана поради следната грешка: Системата не може да намери указания път. 17.10.2011 г. 16:47:15, Error: Service Control Manager [7026] - Неуспешно зареждане на следния драйвер, който се активира с включване на компютъра или стартиране на системата: Cinemsup 17.10.2011 г. 16:46:57, Error: Service Control Manager [7000] - Услуга FileZilla Server FTP server не може да бъде стартирана поради следната грешка: Системата не може да намери указания файл. 17.10.2011 г. 16:46:57, Error: Service Control Manager [7000] - Услуга atksgt не може да бъде стартирана поради следната грешка: Зареждането на този драйвер е блокирано 17.10.2011 г. 16:46:57, Error: Service Control Manager [7000] - Услуга Apache не може да бъде стартирана поради следната грешка: Системата не може да намери указания файл. 17.10.2011 г. 16:46:57, Error: Service Control Manager [7000] - Услуга AODDriver4.01 не може да бъде стартирана поради следната грешка: Системата не може да намери указания път. 17.10.2011 г. 16:46:57, Error: Application Popup [875] - Driver atksgt.sys has been blocked from loading. . ==== End Of File ===========================

Преди да продължим деинсталирайте/премахнете остатъците от DoctorWeb като използвате този инструмент: Drweb Removal Tool:

for x86

for x64

И двата цитирани от вас файлове са на dr.web cureit....!:D

Преди да продължим деинсталирайте/премахнете остатъците от DoctorWeb като използвате този инструмент: Drweb Removal Tool:

for x86

for x64

И двата цитирани от вас файлове са на dr.web cureit....! :D

опитвам се да изтегля x64, но ми изписва "404 Not Found"

Опитай така : Download

Освен това - познато ли ви е това прокси - ProxyServer = 206.207.248.35:3128

Готово изтрих го, а за проксито не :D

Публикувано изображение Изтеглете Security Check (автор: screen317) от тук или от тук и го запишете на десктопа.

  • Кликнете два пъти върху SecurityCheck.exe и следвайте инструкциите.
  • Когато програмата завърши работата си, ще се отвори един текстов документ: checkup.txt.
  • Копирайте съдържанието на checkup.txt с Копирай (Copy) и с Постави (Paste) го поставете в следващия си коментар.
Публикувано изображение Моля, изтеглете aswMBR и го запазете на вашия десктоп.
  • Кликнете с двоен клин на мишката върху файла aswMBR.exe за да го стартирате.
  • Изчакайте да изтегли дефинициите на avast!
  • От падащото меню посочете дял C:\ както е на снимката:
Публикувано изображение
  • Изберете Scan бутона, за да започне проверката.
  • Когато проверката завърши, натиснете бутона save log, запазете съдържанието на лог файла на десктопа и публикувайте съдържанието му в следващия си коментар.
Публикувано изображение Изтеглете ComboFix Публикувано изображение от тук или тук и го запазете на десктопа си.
  • Изключете вашата антивирусна и антишпионска програма, обикновено това става чрез натискане на десния бутон на мишката върху иконата на програма в системния трей.
Бележка: Ако не можете я спрете или не сте сигурни коя програма да изключите, моля прегледайте информацията от този линк: How to Disable your Security Programs
  • Стартирайте Combo-Fix.com Публикувано изображение и следвайте инструкциите.
Бележка: ComboFix ще се стартира без инсталирана Recovery Console.
  • Като част от неговата работа, ComboFix ще провери дали Microsoft Windows Recovery Console е инсталирана. Предвид бързо развиващия се зловреден софтуер е силно препоръчително да бъде инсталирана преди премахването на зловредния софтуер. Това ще Ви позволи да влезете в специален recovery/repair режим, който ще ни позволи по-лесно да решите проблем, който би могъл да възникне при премахване на зловредния софтуер.
  • Следвайте инструкциите, за да позволите на ComboFix да изтегли и инсталира Microsoft Windows Recovery Console. В един момент ще бъдете попитани дали сте съгласни с лицензното споразумение. Необходимо е да потвърдите, че сте съгласни, за да инсталирате Microsoft Windows Recovery Console.
** Забележете: Ако Microsoft Windows Recovery Console е вече инсталирана, ComboFix ще продължи към процеса по премахване на зловредния софтуер.

Публикувано изображение

След като Microsoft Windows Recovery Console е инсталирана, използвайки ComboFix, Вие ще видите следното съобщение:

Публикувано изображение

Изберете Yes, за да продължи сканирането за зловреден софтуер.

Когато процесът приключи успешно, инструментът ще създаде лог файл. Моля, включете съдържанието на C:\ComboFix.txt в следващия Ви коментар в тази тема.

Бележка:

  • Моля, не движете мишката, докато ComboFix работи. Това може да наруши процеса на работа.
  • ComboFix ще нулира всички настройки на Microsoft Internet Explorer, включително да направи IE браузър по подразбиране.
  • ComboFix ще изключи autorun функцията на ВСИЧКИ CD, Floppy и USB устройства, за да помогне при премахването на зловредния софтуер и Ви защити от бъдещи вируси/заплахи, които поразяват чрез autorun. Ако това е проблем за вас - моля, уведомете ме.
  • ComboFix ще изключи вашата интернет връзка. Интернет връзката ще се възстанови автоматично, преди ComboFix да завърши процеса на работа. При проблем, той ще прекрати интернет връзката. За да възстановите интернет връзката си, рестартирайте компютъра си.
  • В случай на проблем с ComboFix, той може да създаде лог файл. Моля, включете съдържанието на C:\BUG.txt в следващия Ви коментар в тази тема.
Публикувано изображение Моля, не прикачвайте лог файла/овете от програмата, а го/ги копирайте и поставете в следващия Ви коментар в тази тема.

Security Check ЛОГ:

Results of screen317's Security Check version 0.99.24

Windows 7 x64 (UAC is disabled!)

Internet Explorer 8 Out of date!

``````````````````````````````

Antivirus/Firewall Check:

Windows Firewall Enabled!

avast! Antivirus

WMI entry may not exist for antivirus; attempting automatic update.

```````````````````````````````

Anti-malware/Other Utilities Check:

Malwarebytes' Anti-Malware

Java 6 Update 26

Out of date Java installed!

Adobe Flash Player 11.0.1.152

````````````````````````````````

Process Check:

objlist.exe by Laurent

Alwil Software Avast4 aswUpdSv.exe

Alwil Software Avast4 ashServ.exe

Alwil Software Avast4 ashDisp.exe

Alwil Software Avast4 ashMaiSv.exe

Alwil Software Avast4 ashWebSv.exe

``````````End of Log````````````

aswMBR ЛОГ: aswMBR version 0.9.8.986 Copyright© 2011 AVAST Software Run date: 2011-10-22 16:29:37 ----------------------------- 16:29:37.402 OS Version: Windows x64 6.1.7601 Service Pack 1 16:29:37.402 Number of processors: 2 586 0x603 16:29:37.402 ComputerName: SISO-PC UserName: Siso 16:29:40.389 Initialize success 16:30:39.219 AVAST engine defs: 11102200 16:31:24.676 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 16:31:24.679 Disk 0 Vendor: ST31000524AS JC45 Size: 953869MB BusType: 3 16:31:26.700 Disk 0 MBR read successfully 16:31:26.702 Disk 0 MBR scan 16:31:26.705 Disk 0 Windows 7 default MBR code 16:31:26.708 Service scanning 16:31:33.588 Modules scanning 16:31:33.593 Disk 0 trace - called modules: 16:31:33.609 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys ataport.SYS pciide.sys PCIIDEX.SYS hal.dll atapi.sys 16:31:33.613 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8004a26060] 16:31:33.618 3 CLASSPNP.SYS[fffff8800199843f] -> nt!IofCallDriver -> [0xfffffa80048b1520] 16:31:33.623 5 ACPI.sys[fffff88000e0b7a1] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0xfffffa80048ad680] 16:31:34.886 AVAST engine scan C:\ 18:26:21.719 File: C:\Windows\SysWOW64\igfxvtk2.exe **INFECTED** Win32:Kolab-NL [Trj] 19:00:01.178 Disk 0 MBR has been saved successfully to "C:\Users\Siso\Desktop\MBR.dat" 19:00:01.180 The log file has been saved successfully to "C:\Users\Siso\Desktop\aswMBR.txt" 19:09:21.828 Scan finished successfully 19:31:59.492 Disk 0 MBR has been saved successfully to "C:\Users\Siso\Desktop\MBR.dat" 19:31:59.497 The log file has been saved successfully to "C:\Users\Siso\Desktop\aswMBR.txt" ComboFix ЛОГ: ComboFix 11-10-21.06 - Siso 10.2011 г. 19:36:38.1.2 - x64 Microsoft Windows 7 Ultimate 6.1.7601.1.1251.359.1033.18.4095.1832 [GMT 3:00] Running from: c:\users\Siso\Desktop\ComboFix.exe AV: avast! antivirus *Disabled/Updated* {C37D8F93-0602-E43C-40AA-47DAD597F308} SP: avast! antivirus *Disabled/Updated* {781C6E77-2038-EBB2-7A1A-7CA8AE10B9B5} SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\programdata\page c:\programdata\page\page.ico c:\programdata\page\page.URL c:\users\Siso\AppData\Roaming\BITS c:\users\Siso\AppData\Roaming\BITS\BITS.ini c:\users\Siso\AppData\Roaming\BITS\P2PCfg.ini c:\users\Siso\AppData\Roaming\IDM\idmmzcc3 c:\users\Siso\AppData\Roaming\IDM\idmmzcc3\chrome.manifest c:\users\Siso\AppData\Roaming\IDM\idmmzcc3\chrome\idmmzcc.jar c:\users\Siso\AppData\Roaming\IDM\idmmzcc3\components\idmmzcc.dll c:\users\Siso\AppData\Roaming\IDM\idmmzcc3\components\iIDMMzCC.xpt c:\users\Siso\AppData\Roaming\IDM\idmmzcc3\components2\idmhelper.js c:\users\Siso\AppData\Roaming\IDM\idmmzcc3\components2\idmhelper2.js c:\users\Siso\AppData\Roaming\IDM\idmmzcc3\components2\idmmzcc.dll c:\users\Siso\AppData\Roaming\IDM\idmmzcc3\components2\idmmzcc64.dll c:\users\Siso\AppData\Roaming\IDM\idmmzcc3\components2\iIDMHelper.xpt c:\users\Siso\AppData\Roaming\IDM\idmmzcc3\components2\iIDMHelper2.xpt c:\users\Siso\AppData\Roaming\IDM\idmmzcc3\components2\iIDMMzCC.xpt c:\users\Siso\AppData\Roaming\IDM\idmmzcc3\install.js c:\users\Siso\AppData\Roaming\IDM\idmmzcc3\install.rdf c:\users\Siso\AppData\Roaming\IDM\idmmzcc3\META-INF\manifest.mf c:\users\Siso\AppData\Roaming\IDM\idmmzcc3\META-INF\zigbert.rsa c:\users\Siso\AppData\Roaming\IDM\idmmzcc3\META-INF\zigbert.sf c:\windows\dxyiptfm2.dll c:\windows\SysWow64\BReWErS.dll c:\windows\SysWow64\systeminfo.dll . . ((((((((((((((((((((((((( Files Created from 2011-09-22 to 2011-10-22 ))))))))))))))))))))))))))))))) . . 2011-10-22 16:41 . 2011-10-22 16:41 -------- d-----w- c:\users\Default\AppData\Local\temp 2011-10-22 16:41 . 2011-10-22 16:41 -------- d-----w- c:\users\apache2triad.Siso-PC\AppData\Local\temp 2011-10-22 16:41 . 2011-10-22 16:41 -------- d-----w- c:\users\apache2triad.Siso-PC.000\AppData\Local\temp 2011-10-22 09:42 . 2011-10-22 09:42 -------- d-----w- c:\users\Siso\DoctorWeb 2011-10-22 08:44 . 2011-10-21 11:58 184320 --sh--w- c:\windows\SysWow64\igfxvtk2.exe 2011-10-21 21:56 . 2011-10-21 21:56 -------- d--h--r- c:\users\Siso\AppData\Roaming\SecuROM 2011-10-19 20:26 . 2011-10-19 20:26 -------- d-----w- c:\users\Siso\AppData\Roaming\Ashampoo 2011-10-19 20:26 . 2011-10-19 20:26 -------- d-----w- c:\users\Siso\AppData\Local\ashampoo 2011-10-19 20:26 . 2011-10-19 20:26 -------- d-----w- c:\programdata\ashampoo 2011-10-19 20:26 . 2011-10-19 20:26 -------- d-----w- c:\program files (x86)\Ashampoo 2011-10-19 19:58 . 2011-10-19 20:20 -------- d-----w- c:\program files (x86)\VS Revo Group 2011-10-19 19:54 . 2011-10-19 19:54 -------- d-----w- c:\users\Siso\AppData\Local\Ahead 2011-10-19 19:53 . 2011-10-19 19:55 -------- d-----w- c:\users\Siso\AppData\Roaming\Ahead 2011-10-19 19:51 . 2011-10-19 19:51 -------- d-----w- c:\program files (x86)\Nero 2011-10-19 15:32 . 2011-10-19 15:32 -------- d-----w- c:\users\Siso\AppData\Local\RewardsArcade 2011-10-19 15:32 . 2011-10-19 15:32 -------- d-----w- c:\program files (x86)\RewardsArcade 2011-10-19 15:27 . 2011-10-19 15:34 -------- d-----w- c:\users\Siso\AppData\Roaming\Trillian 2011-10-19 15:27 . 2011-10-22 09:35 -------- d-----w- c:\program files (x86)\Trillian 2011-10-18 17:23 . 2011-10-18 17:23 -------- d-----w- c:\program files (x86)\BulGames™ 2011-10-18 12:06 . 2011-10-18 12:06 -------- d-----w- c:\program files (x86)\NVIDIA Corporation 2011-10-16 09:51 . 2011-10-16 09:51 -------- d-----w- c:\users\Siso\AppData\Roaming\Need for Speed World 2011-10-16 09:35 . 2011-10-16 09:35 -------- d-----w- c:\users\Siso\AppData\Local\Electronic_Arts_Inc 2011-10-16 09:35 . 2011-10-22 16:41 -------- d-----w- c:\users\Siso\AppData\Local\PMB Files 2011-10-16 09:35 . 2011-10-16 09:46 -------- d-----w- c:\programdata\PMB Files 2011-10-16 09:35 . 2011-10-16 09:35 -------- d-----w- c:\program files (x86)\Pando Networks 2011-10-16 09:34 . 2011-10-16 09:34 -------- d-----w- c:\users\Siso\AppData\Local\Pando_Temp 2011-10-13 21:52 . 2011-10-13 21:52 -------- d-----w- c:\programdata\ATI 2011-10-13 21:49 . 2011-10-13 21:49 -------- d-----w- c:\program files (x86)\ATI 2011-10-13 21:49 . 2011-10-13 21:49 -------- d-----w- c:\program files\ATI Technologies 2011-10-13 21:06 . 2011-10-13 21:06 -------- d-----w- C:\ATI 2011-10-13 15:20 . 2011-10-13 15:20 -------- d-----w- c:\program files (x86)\AMD APP 2011-10-13 15:20 . 2011-10-13 15:20 -------- d-----w- c:\program files (x86)\Common Files\ATI Technologies 2011-10-13 15:18 . 2011-10-13 15:18 -------- d-----w- c:\program files\Common Files\ATI Technologies 2011-10-13 15:15 . 2011-10-13 21:49 -------- d-----w- c:\program files (x86)\ATI Technologies 2011-10-13 15:15 . 2011-10-13 15:15 -------- d-----w- c:\program files\ATI 2011-10-13 15:14 . 2011-10-13 15:14 -------- d-----w- C:\AMD 2011-10-11 18:30 . 2011-10-11 18:30 -------- d-----w- c:\program files (x86)\Nokia 2011-10-11 18:28 . 2011-10-11 18:29 -------- d-----w- c:\program files (x86)\Wave 2 Mp3 2011-10-06 21:44 . 2011-10-06 21:44 -------- d-----w- c:\windows\system32\Macromed 2011-10-03 17:23 . 2011-10-03 17:24 -------- d-----w- c:\program files (x86)\FlashGet 2011-10-03 17:20 . 2011-10-03 17:23 -------- d-----w- c:\users\Siso\AppData\Roaming\FlashGet 2011-10-03 17:20 . 2011-10-03 17:20 -------- d-----w- c:\program files (x86)\FlashGet Network 2011-10-03 16:56 . 2011-10-03 16:56 10203648 ----a-w- c:\windows\system32\drivers\atikmdag.sys 2011-10-03 16:24 . 2011-10-03 16:24 24996864 ----a-w- c:\windows\system32\atio6axx.dll 2011-10-03 16:03 . 2011-10-03 16:03 151552 ----a-w- c:\windows\system32\atiapfxx.exe 2011-10-03 16:03 . 2011-10-03 16:03 18836480 ----a-w- c:\windows\SysWow64\atioglxx.dll 2011-10-03 16:00 . 2011-10-03 16:00 466944 ----a-w- c:\windows\system32\ATIDEMGX.dll 2011-10-03 15:59 . 2011-10-03 15:59 486912 ----a-w- c:\windows\system32\atieclxx.exe 2011-10-03 15:59 . 2011-10-03 15:59 204288 ----a-w- c:\windows\system32\atiesrxx.exe 2011-10-03 15:58 . 2011-10-03 15:58 120320 ----a-w- c:\windows\system32\atitmm64.dll 2011-10-03 15:58 . 2011-10-03 15:58 423424 ----a-w- c:\windows\system32\atipdl64.dll 2011-10-03 15:57 . 2011-10-03 15:57 356352 ----a-w- c:\windows\SysWow64\atipdlxx.dll 2011-10-03 15:57 . 2011-10-03 15:57 278528 ----a-w- c:\windows\SysWow64\Oemdspif.dll 2011-10-03 15:57 . 2011-10-03 15:57 21504 ----a-w- c:\windows\system32\atimuixx.dll 2011-10-03 15:57 . 2011-10-03 15:57 59392 ----a-w- c:\windows\system32\atiedu64.dll 2011-10-03 15:57 . 2011-10-03 15:57 43520 ----a-w- c:\windows\SysWow64\ati2edxx.dll 2011-10-03 15:54 . 2011-10-03 15:54 4204032 ----a-w- c:\windows\SysWow64\atidxx32.dll 2011-10-03 15:49 . 2011-10-03 15:49 1113088 ----a-w- c:\windows\system32\atiumd6v.dll 2011-10-03 15:49 . 2011-10-03 15:49 1828864 ----a-w- c:\windows\SysWow64\atiumdmv.dll 2011-10-03 15:39 . 2011-10-03 15:39 51200 ----a-w- c:\windows\system32\aticalrt64.dll 2011-10-03 15:39 . 2011-10-03 15:39 46080 ----a-w- c:\windows\SysWow64\aticalrt.dll 2011-10-03 15:39 . 2011-10-03 15:39 44544 ----a-w- c:\windows\system32\aticalcl64.dll 2011-10-03 15:39 . 2011-10-03 15:39 44032 ----a-w- c:\windows\SysWow64\aticalcl.dll 2011-10-03 15:39 . 2011-10-03 15:39 8723456 ----a-w- c:\windows\system32\aticaldd64.dll 2011-10-03 15:36 . 2011-10-03 15:36 7331840 ----a-w- c:\windows\SysWow64\aticaldd.dll 2011-10-03 15:23 . 2011-10-03 15:23 270336 ----a-w- c:\windows\SysWow64\atiadlxy.dll 2011-10-03 15:22 . 2011-10-03 15:22 15360 ----a-w- c:\windows\system32\atig6pxx.dll 2011-10-03 15:22 . 2011-10-03 15:22 13312 ----a-w- c:\windows\SysWow64\atiglpxx.dll 2011-10-03 15:22 . 2011-10-03 15:22 13312 ----a-w- c:\windows\system32\atiglpxx.dll 2011-10-03 15:22 . 2011-10-03 15:22 39936 ----a-w- c:\windows\system32\atig6txx.dll 2011-10-03 15:22 . 2011-10-03 15:22 32768 ----a-w- c:\windows\SysWow64\atigktxx.dll 2011-10-03 15:22 . 2011-10-03 15:22 310784 ----a-w- c:\windows\system32\drivers\atikmpag.sys 2011-10-03 15:21 . 2011-10-03 15:21 31744 ----a-w- c:\windows\SysWow64\atiuxpag.dll 2011-10-03 15:21 . 2011-10-03 15:21 54784 ----a-w- c:\windows\system32\atimpc64.dll 2011-10-03 15:21 . 2011-10-03 15:21 54784 ----a-w- c:\windows\system32\amdpcom64.dll 2011-10-03 15:21 . 2011-10-03 15:21 53760 ----a-w- c:\windows\SysWow64\atimpc32.dll 2011-10-03 15:21 . 2011-10-03 15:21 53760 ----a-w- c:\windows\SysWow64\amdpcom32.dll 2011-10-03 15:21 . 2011-10-03 15:21 53248 ----a-w- c:\windows\system32\drivers\ati2erec.dll 2011-10-03 09:53 . 2011-10-03 09:53 60416 ----a-w- c:\windows\system32\OVDecode64.dll 2011-10-03 09:53 . 2011-10-03 09:53 53760 ----a-w- c:\windows\SysWow64\OVDecode.dll 2011-10-03 09:52 . 2011-10-03 09:52 16652288 ----a-w- c:\windows\system32\amdocl64.dll 2011-10-03 09:43 . 2011-10-03 09:43 44032 ----a-w- c:\windows\system32\amdoclcl64.dll 2011-10-03 09:42 . 2011-10-03 09:42 37376 ----a-w- c:\windows\SysWow64\amdoclcl.dll 2011-09-29 15:56 . 2011-10-12 15:59 134104 ----a-w- c:\program files (x86)\Mozilla Firefox\components\browsercomps.dll 2011-09-29 15:56 . 2011-10-12 15:59 89048 ----a-w- c:\program files (x86)\Mozilla Firefox\libEGL.dll 2011-09-29 15:56 . 2011-10-12 15:59 773080 ----a-w- c:\program files (x86)\Mozilla Firefox\mozsqlite3.dll 2011-09-29 15:56 . 2011-10-12 15:59 478168 ----a-w- c:\program files (x86)\Mozilla Firefox\libGLESv2.dll 2011-09-29 15:56 . 2011-10-12 15:59 1833944 ----a-w- c:\program files (x86)\Mozilla Firefox\mozjs.dll 2011-09-29 15:56 . 2011-10-12 15:59 15832 ----a-w- c:\program files (x86)\Mozilla Firefox\mozalloc.dll 2011-09-29 15:56 . 2011-09-23 01:15 2106216 ----a-w- c:\program files (x86)\Mozilla Firefox\D3DCompiler_43.dll 2011-09-29 15:56 . 2011-09-23 01:15 1998168 ----a-w- c:\program files (x86)\Mozilla Firefox\d3dx9_43.dll 2011-09-28 18:50 . 2011-09-28 18:50 -------- d-----w- C:\ubuntu 2011-09-26 16:59 . 2011-09-26 17:00 -------- d-----w- c:\program files (x86)\CDex 2011-09-25 12:03 . 2011-03-03 19:09 2913920 ----a-w- c:\windows\system32\BootMan.exe 2011-09-25 12:03 . 2011-03-03 19:09 2336384 ----a-w- c:\windows\SysWow64\BootMan.exe 2011-09-25 12:03 . 2010-07-15 05:44 9096 ----a-w- c:\windows\system32\EuGdiDrv.sys 2011-09-25 12:03 . 2010-07-15 05:44 86408 ----a-w- c:\windows\SysWow64\setupempdrv03.exe 2011-09-25 12:03 . 2010-07-15 05:44 8456 ----a-w- c:\windows\SysWow64\EuGdiDrv.sys 2011-09-25 12:03 . 2010-07-15 05:44 16776 ----a-w- c:\windows\system32\epmntdrv.sys 2011-09-25 12:03 . 2010-07-15 05:44 14216 ----a-w- c:\windows\SysWow64\epmntdrv.sys 2011-09-25 12:03 . 2010-07-15 05:44 11264 ----a-w- c:\windows\system32\EuEpmGdi.dll 2011-09-25 12:03 . 2010-07-15 05:44 100232 ----a-w- c:\windows\system32\setupempdrvx64.exe 2011-09-25 12:03 . 2010-07-15 05:44 14848 ----a-w- c:\windows\SysWow64\EuEpmGdi.dll 2011-09-25 12:03 . 2011-09-25 12:03 -------- d-----w- c:\program files (x86)\EASEUS 2011-09-24 11:04 . 2011-09-24 11:04 -------- d-----w- c:\program files (x86)\Audacity . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-10-09 14:49 . 2011-07-29 08:37 414368 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2011-10-03 16:03 . 2011-04-19 23:09 732672 ----a-w- c:\windows\SysWow64\aticfx32.dll 2011-10-03 16:02 . 2011-04-19 23:07 862720 ----a-w- c:\windows\system32\aticfx64.dll 2011-10-03 15:48 . 2011-09-04 16:53 3888640 ----a-w- c:\windows\system32\atiumd6a.dll 2011-10-03 15:46 . 2011-04-19 22:49 4944896 ----a-w- c:\windows\system32\atidxx64.dll 2011-10-03 15:39 . 2011-04-19 22:30 4064768 ----a-w- c:\windows\SysWow64\atiumdva.dll 2011-10-03 15:35 . 2011-04-19 22:38 4289024 ----a-w- c:\windows\SysWow64\atiumdag.dll 2011-10-03 15:30 . 2011-09-04 16:53 5428736 ----a-w- c:\windows\system32\atiumd64.dll 2011-10-03 15:29 . 2011-04-19 22:27 58880 ----a-w- c:\windows\system32\coinst.dll 2011-10-03 15:23 . 2010-05-27 16:26 381952 ----a-w- c:\windows\system32\atiadlxx.dll 2011-10-03 15:22 . 2011-04-19 22:21 40960 ----a-w- c:\windows\system32\atiuxp64.dll 2011-10-03 15:21 . 2010-05-27 16:24 38912 ----a-w- c:\windows\system32\atiu9p64.dll 2011-10-03 15:21 . 2011-04-19 22:21 29184 ----a-w- c:\windows\SysWow64\atiu9pag.dll 2011-09-13 13:46 . 2011-09-13 13:46 28672 ----a-w- c:\windows\system32\AF15BDAEX.dll 2011-09-13 13:46 . 2011-09-13 13:46 140 ----a-w- c:\windows\system32\AF15IRTBL.bin 2011-09-13 13:46 . 2010-06-22 00:12 507392 ----a-w- c:\windows\system32\drivers\AF15BDA.sys 2011-09-01 14:22 . 2009-07-13 23:55 332288 ----a-w- c:\windows\system32\uxtheme.dll 2011-09-01 14:22 . 2010-11-21 03:23 2851840 ----a-w- c:\windows\system32\themeui.dll 2011-09-01 14:22 . 2009-07-13 23:54 44544 ----a-w- c:\windows\system32\themeservice.dll 2011-08-31 22:54 . 2011-06-28 15:23 271200 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr 2011-08-31 22:54 . 2011-06-03 19:44 271200 ----a-w- c:\windows\SysWow64\PnkBstrB.exe 2011-08-31 22:53 . 2011-06-03 19:44 103736 ----a-w- c:\windows\SysWow64\PnkBstrB.ex0 2011-08-31 14:00 . 2011-09-04 13:31 25416 ----a-w- c:\windows\system32\drivers\mbam.sys 2011-08-27 16:01 . 2011-08-27 16:01 57056 ----a-r- c:\users\Siso\AppData\Roaming\Microsoft\Installer\{748FBFC5-9D60-4058-9136-A862AF552CC2}\pdfico.exe 2011-08-27 16:01 . 2011-08-27 16:01 52960 ----a-r- c:\users\Siso\AppData\Roaming\Microsoft\Installer\{748FBFC5-9D60-4058-9136-A862AF552CC2}\sysaxico.exe 2011-08-27 16:01 . 2011-08-27 16:01 52960 ----a-r- c:\users\Siso\AppData\Roaming\Microsoft\Installer\{748FBFC5-9D60-4058-9136-A862AF552CC2}\htmico.exe 2011-08-27 16:01 . 2011-08-27 16:01 48864 ----a-r- c:\users\Siso\AppData\Roaming\Microsoft\Installer\{748FBFC5-9D60-4058-9136-A862AF552CC2}\chmico.exe 2011-08-26 14:39 . 2011-08-26 14:39 512512 ----a-w- c:\windows\SysWow64\sendmail.exe 2011-08-26 14:39 . 2011-08-26 14:39 1437184 ----a-w- c:\windows\tellmail.exe 2011-08-26 14:39 . 2011-08-26 14:39 1437184 ----a-w- c:\windows\SysWow64\tellmail.exe 2011-08-24 17:19 . 2011-08-24 17:19 56320 ----a-w- c:\windows\SysWow64\OpenVideo.dll 2011-08-24 17:18 . 2011-08-24 17:18 13601280 ----a-w- c:\windows\SysWow64\amdocl.dll 2011-08-24 17:17 . 2011-08-24 17:17 43520 ----a-w- c:\windows\SysWow64\OpenCL.dll 2011-08-09 17:01 . 2011-06-10 22:31 737072 ----a-w- c:\programdata\Microsoft\eHome\Packages\SportsV2\SportsTemplateCore\Microsoft.MediaCenter.Sports.UI.dll 2011-08-09 17:01 . 2011-06-10 22:30 4283672 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\markup.dll 2011-08-09 17:01 . 2011-06-10 22:30 42776 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM\StartResources.dll 2011-07-28 14:48 . 2011-07-28 14:48 51200 ----a-w- c:\windows\system32\OpenCL.dll 2011-07-25 16:41 . 2011-07-25 16:41 737072 ----a-w- c:\programdata\Microsoft\eHome\Packages\SportsV2\SportsTemplateCore-2\Microsoft.MediaCenter.Sports.UI.dll 2011-07-25 16:41 . 2011-07-25 16:41 4283672 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\markup.dll 2011-07-25 16:41 . 2011-07-25 16:41 42776 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM-2\StartResources.dll 2011-07-25 16:41 . 2011-07-25 16:41 539968 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{ffa0793e-3980-4be4-8234-048fa665f700}"= "c:\program files (x86)\Softonic_English_FF\prxtbSof0.dll" [2011-05-09 176936] . [HKEY_CLASSES_ROOT\clsid\{ffa0793e-3980-4be4-8234-048fa665f700}] . [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{597A9974-8CB0-4f41-B61F-ED065738A397}] 2011-10-02 19:26 522752 ----a-w- c:\program files (x86)\RewardsArcade\RewardsArcade.dll . [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{ffa0793e-3980-4be4-8234-048fa665f700}] 2011-05-09 09:49 176936 ----a-w- c:\program files (x86)\Softonic_English_FF\prxtbSof0.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar] "{ffa0793e-3980-4be4-8234-048fa665f700}"= "c:\program files (x86)\Softonic_English_FF\prxtbSof0.dll" [2011-05-09 176936] . [HKEY_CLASSES_ROOT\clsid\{ffa0793e-3980-4be4-8234-048fa665f700}] . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "uTorrent"="c:\program files (x86)\uTorrent\uTorrent.exe" [2011-06-03 399736] "DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2011-01-20 1305408] "Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2007-12-07 21686568] "IDMan"="c:\program files (x86)\Internet Download Manager\IDMan.exe" [2011-04-05 3278232] "Gadwin PrintScreen Pro"="c:\program files (x86)\Gadwin Systems\PrintScreenPro\PrintScreenPro.exe" [2011-05-12 1858048] "Steam"="c:\program files (x86)\Steam\Steam.exe" [2011-08-07 1242448] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584] "MusicManager"="c:\users\Siso\AppData\Local\Programs\Google\MusicManager\MusicManager.exe" [2011-09-14 13128704] "BlazeServoTool"="c:\program files (x86)\BlazeVideo\BlazeDTV 6.0\MediaDetector.exe" [2009-07-07 282624] "Pando Media Booster"="c:\program files (x86)\Pando Networks\Media Booster\PMB.exe" [2011-10-16 3077528] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "HDAudDeck"="c:\program files (x86)\VIA\VIAudioi\VDeck\VDeck.exe" [2009-09-21 2583040] "WinampAgent"="c:\program files (x86)\Winamp\winampa.exe" [2008-01-15 37376] "BtTray"="c:\program files (x86)\IVT Corporation\BlueSoleil\BtTray.exe" [2009-02-27 278016] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696] "amd_dc_opt"="c:\program files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2008-07-22 77824] "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2010-11-29 421888] "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2011-06-07 421160] "SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096] "AdobeCS5.5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" [2011-01-12 1523360] "ALTDVB_Manager"="c:\altdvb staredition iii\\ALTDVB Manager.exe" [2009-12-22 420352] "Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-09-07 37296] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920] "StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-10-26 98304] "ATICustomerCare"="c:\program files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe" [2010-05-04 311296] . c:\users\Siso\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ ALTDVB Manager.lnk - c:\altdvb staredition iii\ALTDVB Manager.exe [2009-12-22 420352] Registration Driver Parallel Lines.LNK - d:\siso\Games\Driver Parallel Lines\Register\RegistrationReminder.exe [N/A] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 0 (0x0) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp . R2 AODDriver4.01;AODDriver4.01;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [x] R2 AODService;AODService;c:\program files (x86)\AMD\OverDrive\AODAssist.exe [2009-05-05 124256] R2 Apache2.2;Apache2.2;c:\appserv\Apache2.2\bin\httpd.exe [2008-01-17 24635] R3 ALSysIO;ALSysIO;c:\users\Siso\AppData\Local\Temp\ALSysIO64.sys [x] R3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys [x] R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [x] R3 driverhardwarev2x64;driverhardwarev2x64;c:\program files\ma-config.com\Drivers\driverhardwarev2x64.sys [2011-07-21 16640] R3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys [2010-07-15 16776] R3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys [2010-07-15 9096] R3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\x64\maconfservice.exe [2011-08-08 421376] R3 Mercury32;Mercury32;c:\mail\mercury.exe [2011-08-26 761344] R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [x] R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096] R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x] R3 SysaxMultiServer;Sysax Multi Server Service;c:\program files (x86)\SysaxServer\sysaxservd.exe [2010-11-30 1867520] R3 terminpt;Microsoft Remote Desktop Input Driver;c:\windows\system32\drivers\terminpt.sys [x] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x] R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [x] R3 tsusbhub;tsusbhub; [x] S0 BtHidBus;Bluetooth HID Bus Service;c:\windows\System32\Drivers\BtHidBus.sys [x] S1 aswSP;avast! Self Protection; [x] S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [x] S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x] S2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [x] S2 aswMonFlt;aswMonFlt;c:\windows\system32\DRIVERS\aswMonFlt.sys [x] S2 BsMobileCS;BsMobileCS;c:\program files (x86)\IVT Corporation\BlueSoleil\BsMobileCS.exe [2009-02-27 143467] S2 FirebirdGuardianDefaultInstance;Firebird Guardian - DefaultInstance;c:\program files (x86)\Firebird\Firebird_2_5\bin\fbguard.exe [2010-09-17 98304] S2 FreeProxy;Free Proxy Service;c:\program files (x86)\Hand-Crafted Software\FreeProxy\FreeProxy.exe [2010-03-27 565248] S2 Icecast-trunk;Icecast-trunk Streaming Media Server;c:\program files (x86)\Icecast2 Win32\icecastService.exe [2008-05-24 417792] S2 IDMWFP;IDMWFP;c:\windows\system32\DRIVERS\idmwfp.sys [x] S2 MELCS;MailEnable List Connector;c:\program files (x86)\Mail Enable\Bin64\MELSC.EXE [2011-08-03 133632] S2 MEMTAS;MailEnable Mail Transfer Agent;c:\program files (x86)\Mail Enable\Bin64\MEMTA.EXE [2011-08-03 143872] S2 MEPOCS;MailEnable Postoffice Connector;c:\program files (x86)\Mail Enable\Bin64\MEPOC.EXE [2011-08-03 720896] S2 MEPOPS;MailEnable POP Service;c:\program files (x86)\Mail Enable\Bin64\MEPOPS.EXE [2011-08-03 453120] S2 MESMTPCS;MailEnable SMTP Connector;c:\program files (x86)\Mail Enable\Bin64\MESMTPC.EXE [2011-08-03 712192] S2 TeamViewer6;TeamViewer 6;c:\program files (x86)\TeamViewer\Version6\TeamViewer_Service.exe [2011-08-30 2358656] S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x] S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x] S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [x] S3 btnetBUs;Bluetooth PAN Bus Service;c:\windows\system32\Drivers\btnetBus.sys [x] S3 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance;c:\program files (x86)\Firebird\Firebird_2_5\bin\fbserver.exe [2010-09-17 3735552] S3 IvtBtBUs;IVT Bluetooth Bus Service;c:\windows\system32\Drivers\IvtBtBus.sys [x] S3 pcouffin;VSO Software pcouffin;c:\windows\system32\Drivers\pcouffin.sys [x] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x] . . Contents of the 'Scheduled Tasks' folder . 2011-10-22 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3051125622-3749105565-2852968184-1000Core.job - c:\users\Siso\AppData\Local\Google\Update\GoogleUpdate.exe [2011-06-23 14:25] . 2011-10-22 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3051125622-3749105565-2852968184-1000UA.job - c:\users\Siso\AppData\Local\Google\Update\GoogleUpdate.exe [2011-06-23 14:25] . . --------- x86-64 ----------- . . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\IDM Shell Extension] @="{CDC95B92-E27C-4745-A8C5-64A52A78855D}" [HKEY_CLASSES_ROOT\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}] 2011-03-02 15:23 85232 ----a-w- c:\program files (x86)\Internet Download Manager\IDMShellExt64.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "PAC7302_Monitor"="c:\windows\PixArt\PAC7302\Monitor.exe" [2006-11-03 319488] "AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2011-03-15 499608] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "LoadAppInit_DLLs"=0x0 . ------- Supplementary Scan ------- . uLocal Page = c:\windows\system32\blank.htm uStart Page = about:blank mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyServer = 206.207.248.35:3128 IE: ????3?? IE: ????3?????? IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\OFFICE11\EXCEL.EXE/3000 IE: Send by Bluetooth - c:\program files (x86)\IVT Corporation\BlueSoleil\TransSend\IE\tsinfo.htm IE: Send via &Message... - c:\program files (x86)\IVT Corporation\BlueSoleil\TransSend\IE\tssms.htm IE: Свали всички линкове с IDM - c:\program files (x86)\Internet Download Manager\IEGetAll.htm IE: Свали с IDM - c:\program files (x86)\Internet Download Manager\IEExt.htm IE: ????3?? - c:\users\Siso\AppData\Roaming\FlashGetBHO\GetUrl.htm IE: ????3?????? - c:\users\Siso\AppData\Roaming\FlashGetBHO\GetAllUrl.htm FF - ProfilePath - c:\users\Siso\AppData\Roaming\Mozilla\Firefox\Profiles\80w5p5ie.default\ FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2359656&SearchSource=3&q={searchTerms} FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - about:home FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2359656&SearchSource=2&q= FF - prefs.js: network.proxy.type - 0 . - - - - ORPHANS REMOVED - - - - . Wow6432Node-HKCU-Run-RGSC - d:\siso\Games\GTA IV\Rockstar Games Social Club\RGSCLauncher.exe WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file) WebBrowser-{FFA0793E-3980-4BE4-8234-048FA665F700} - (no file) WebBrowser-{30F9B915-B755-4826-820B-08FBA6BD249D} - (no file) AddRemove-PunkBusterSvc - c:\windows\system32\pbsvc.exe AddRemove-ALTDVB StarEdition III - c:\altdvb staredition iii\Uninstal.exe . . . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\MySql] "ImagePath"="c:\appserv\MySQL\bin\mysqld-nt --defaults-file=c:\appserv\MySQL\my.ini mysql" . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_USERS\S-1-5-21-3051125622-3749105565-2852968184-1000_Classes\Wow6432Node\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}] @Denied: (Full) (Everyone) "scansk"=hex(0):c0,7a,c9,28,61,cd,0f,38,b8,dd,7d,a1,98,7e,26,82,23,cb,e5,45,a4, 26,0f,9c,5f,6d,46,d1,8c,77,c6,d0,76,5f,0a,9b,29,50,60,88,00,00,00,00,00,00,\ . [HKEY_USERS\S-1-5-21-3051125622-3749105565-2852968184-1000_Classes\Wow6432Node\CLSID\{abec27f5-70ef-421f-8fbb-cc70f84e67a5}] @Denied: (Full) (Everyone) @Allowed: (Read) (RestrictedCode) "Model"=dword:0000011d "Therad"=dword:0000001f "MData"=hex(0):73,d5,cf,b8,a4,07,89,80,31,e4,35,6b,2a,ca,fe,43,b6,1f,81,1f,5a, 1b,4d,36,46,8f,3c,f2,5c,68,ee,21,46,8f,3c,f2,5c,68,ee,21,46,8f,3c,f2,5c,68,\ . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11c_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11c_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11c.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.10" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11c.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11c.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11c.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\PCW\Security] @Denied: (Full) (Everyone) . ------------------------ Other Running Processes ------------------------ . c:\program files\Alwil Software\Avast4\aswUpdSv.exe c:\program files\Alwil Software\Avast4\ashServ.exe c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe c:\program files (x86)\IVT Corporation\BlueSoleil\BlueSoleilCS.exe c:\program files (x86)\Bonjour\mDNSResponder.exe c:\program files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE c:\appserv\MySQL\bin\mysqld-nt.exe c:\windows\SysWOW64\PnkBstrA.exe c:\program files (x86)\Internet Download Manager\IEMonitor.exe c:\program files\Alwil Software\Avast4\ashWebSv.exe c:\program files\Alwil Software\Avast4\ashMaiSv.exe c:\program files (x86)\Skype\Plugin Manager\skypePM.exe . ************************************************************************** . Completion time: 2011-10-22 19:46:57 - machine was rebooted ComboFix-quarantined-files.txt 2011-10-22 16:46 . Pre-Run: 16 800 514 048 bytes free Post-Run: 20 790 857 728 bytes free . - - End Of File - - 8DBF628444FDC8103F9B18427A23C2D9

Редактирано от Прокси регулатор (преглед на промените)

Архивирайте папката C:\Qoobox\Quarantine и я качете на място по-избор - http://www.zippyshare.com/

Публикувайте линка за да мога да я изтегля.

Файлът:

c:\windows\SysWow64\igfxvtk2.exe

.изпратете на http://www.virustotal.com/index.html за анализ.Резултата съобщете в следващия си пост..!

Публикувано изображение

http://www32.zippyshare.com/v/8872388/file.html а относно този файл който представлява вирусът сега го няма явно програмата го е изтрила няма как да го кача в този сайт..

Копирайте текста в карето на notepad и го запазвате с име CFScript.txt на десктопа си:

KILLALL::

Collect::
c:\windows\SysWow64\igfxvtk2.exe

Folder::
c:\users\Siso\DoctorWeb

DDS::
uURLSearchHooks: Softonic English FF Toolbar: {ffa0793e-3980-4be4-8234-048fa665f700} - C:\Program Files (x86)\Softonic_English_FF\prxtbSof0.dll
TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
TB: {30F9B915-B755-4826-820B-08FBA6BD249D} - No File
BHO-X64: AcroIEHelperStub - No File
BHO-X64: RewardsArcade - No File
TB-X64: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
TB-X64: {30F9B915-B755-4826-820B-08FBA6BD249D} - No File

След съхранението преместете CFScript.txt на иконата на ComboFix.exe

Публикувано изображение

Генерирания рапорт прикачете в следващия си пост..!

ComboFix 11-10-21.06 - Siso 10.2011 г. 22:25:56.2.2 - x64 Microsoft Windows 7 Ultimate 6.1.7601.1.1251.359.1033.18.4095.2488 [GMT 3:00] Running from: c:\users\Siso\Desktop\ComboFix.exe Command switches used :: c:\users\Siso\Desktop\CFScript.txt AV: avast! antivirus *Enabled/Updated* {C37D8F93-0602-E43C-40AA-47DAD597F308} SP: avast! antivirus *Enabled/Updated* {781C6E77-2038-EBB2-7A1A-7CA8AE10B9B5} SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\users\Siso\AppData\Roaming\IDM\idmmzcc3 c:\users\Siso\AppData\Roaming\IDM\idmmzcc3\chrome.manifest c:\users\Siso\AppData\Roaming\IDM\idmmzcc3\chrome\idmmzcc.jar c:\users\Siso\AppData\Roaming\IDM\idmmzcc3\components\idmmzcc.dll c:\users\Siso\AppData\Roaming\IDM\idmmzcc3\components\iIDMMzCC.xpt c:\users\Siso\AppData\Roaming\IDM\idmmzcc3\components2\idmhelper.js c:\users\Siso\AppData\Roaming\IDM\idmmzcc3\components2\idmhelper2.js c:\users\Siso\AppData\Roaming\IDM\idmmzcc3\components2\idmmzcc.dll c:\users\Siso\AppData\Roaming\IDM\idmmzcc3\components2\idmmzcc64.dll c:\users\Siso\AppData\Roaming\IDM\idmmzcc3\components2\iIDMHelper.xpt c:\users\Siso\AppData\Roaming\IDM\idmmzcc3\components2\iIDMHelper2.xpt c:\users\Siso\AppData\Roaming\IDM\idmmzcc3\components2\iIDMMzCC.xpt c:\users\Siso\AppData\Roaming\IDM\idmmzcc3\install.js c:\users\Siso\AppData\Roaming\IDM\idmmzcc3\install.rdf c:\users\Siso\AppData\Roaming\IDM\idmmzcc3\META-INF\manifest.mf c:\users\Siso\AppData\Roaming\IDM\idmmzcc3\META-INF\zigbert.rsa c:\users\Siso\AppData\Roaming\IDM\idmmzcc3\META-INF\zigbert.sf c:\users\Siso\DoctorWeb c:\users\Siso\DoctorWeb\CureIt.log c:\windows\SysWow64\igfxvtk2.exe . . ((((((((((((((((((((((((( Files Created from 2011-09-22 to 2011-10-22 ))))))))))))))))))))))))))))))) . . 2011-10-22 19:30 . 2011-10-22 19:30 -------- d-----w- c:\users\Default\AppData\Local\temp 2011-10-22 19:30 . 2011-10-22 19:30 -------- d-----w- c:\users\apache2triad\AppData\Local\temp 2011-10-22 19:30 . 2011-10-22 19:30 -------- d-----w- c:\users\apache2triad.Siso-PC\AppData\Local\temp 2011-10-22 19:30 . 2011-10-22 19:30 -------- d-----w- c:\users\apache2triad.Siso-PC.000\AppData\Local\temp 2011-10-21 21:56 . 2011-10-21 21:56 -------- d--h--r- c:\users\Siso\AppData\Roaming\SecuROM 2011-10-19 20:26 . 2011-10-19 20:26 -------- d-----w- c:\users\Siso\AppData\Roaming\Ashampoo 2011-10-19 20:26 . 2011-10-19 20:26 -------- d-----w- c:\users\Siso\AppData\Local\ashampoo 2011-10-19 20:26 . 2011-10-19 20:26 -------- d-----w- c:\programdata\ashampoo 2011-10-19 20:26 . 2011-10-19 20:26 -------- d-----w- c:\program files (x86)\Ashampoo 2011-10-19 19:58 . 2011-10-19 20:20 -------- d-----w- c:\program files (x86)\VS Revo Group 2011-10-19 19:54 . 2011-10-19 19:54 -------- d-----w- c:\users\Siso\AppData\Local\Ahead 2011-10-19 19:53 . 2011-10-19 19:55 -------- d-----w- c:\users\Siso\AppData\Roaming\Ahead 2011-10-19 19:51 . 2011-10-19 19:51 -------- d-----w- c:\program files (x86)\Nero 2011-10-19 15:32 . 2011-10-19 15:32 -------- d-----w- c:\users\Siso\AppData\Local\RewardsArcade 2011-10-19 15:32 . 2011-10-19 15:32 -------- d-----w- c:\program files (x86)\RewardsArcade 2011-10-19 15:27 . 2011-10-19 15:34 -------- d-----w- c:\users\Siso\AppData\Roaming\Trillian 2011-10-19 15:27 . 2011-10-22 09:35 -------- d-----w- c:\program files (x86)\Trillian 2011-10-18 17:23 . 2011-10-18 17:23 -------- d-----w- c:\program files (x86)\BulGames™ 2011-10-18 12:06 . 2011-10-18 12:06 -------- d-----w- c:\program files (x86)\NVIDIA Corporation 2011-10-16 09:51 . 2011-10-16 09:51 -------- d-----w- c:\users\Siso\AppData\Roaming\Need for Speed World 2011-10-16 09:35 . 2011-10-16 09:35 -------- d-----w- c:\users\Siso\AppData\Local\Electronic_Arts_Inc 2011-10-16 09:35 . 2011-10-22 17:19 -------- d-----w- c:\users\Siso\AppData\Local\PMB Files 2011-10-16 09:35 . 2011-10-16 09:46 -------- d-----w- c:\programdata\PMB Files 2011-10-16 09:35 . 2011-10-16 09:35 -------- d-----w- c:\program files (x86)\Pando Networks 2011-10-16 09:34 . 2011-10-16 09:34 -------- d-----w- c:\users\Siso\AppData\Local\Pando_Temp 2011-10-13 21:52 . 2011-10-13 21:52 -------- d-----w- c:\programdata\ATI 2011-10-13 21:49 . 2011-10-13 21:49 -------- d-----w- c:\program files (x86)\ATI 2011-10-13 21:49 . 2011-10-13 21:49 -------- d-----w- c:\program files\ATI Technologies 2011-10-13 21:06 . 2011-10-13 21:06 -------- d-----w- C:\ATI 2011-10-13 15:20 . 2011-10-13 15:20 -------- d-----w- c:\program files (x86)\AMD APP 2011-10-13 15:20 . 2011-10-13 15:20 -------- d-----w- c:\program files (x86)\Common Files\ATI Technologies 2011-10-13 15:18 . 2011-10-13 15:18 -------- d-----w- c:\program files\Common Files\ATI Technologies 2011-10-13 15:15 . 2011-10-13 21:49 -------- d-----w- c:\program files (x86)\ATI Technologies 2011-10-13 15:15 . 2011-10-13 15:15 -------- d-----w- c:\program files\ATI 2011-10-13 15:14 . 2011-10-13 15:14 -------- d-----w- C:\AMD 2011-10-11 18:30 . 2011-10-11 18:30 -------- d-----w- c:\program files (x86)\Nokia 2011-10-11 18:28 . 2011-10-11 18:29 -------- d-----w- c:\program files (x86)\Wave 2 Mp3 2011-10-06 21:44 . 2011-10-06 21:44 -------- d-----w- c:\windows\system32\Macromed 2011-10-03 17:23 . 2011-10-03 17:24 -------- d-----w- c:\program files (x86)\FlashGet 2011-10-03 17:20 . 2011-10-03 17:23 -------- d-----w- c:\users\Siso\AppData\Roaming\FlashGet 2011-10-03 17:20 . 2011-10-03 17:20 -------- d-----w- c:\program files (x86)\FlashGet Network 2011-10-03 16:56 . 2011-10-03 16:56 10203648 ----a-w- c:\windows\system32\drivers\atikmdag.sys 2011-10-03 16:24 . 2011-10-03 16:24 24996864 ----a-w- c:\windows\system32\atio6axx.dll 2011-10-03 16:03 . 2011-10-03 16:03 151552 ----a-w- c:\windows\system32\atiapfxx.exe 2011-10-03 16:03 . 2011-10-03 16:03 18836480 ----a-w- c:\windows\SysWow64\atioglxx.dll 2011-10-03 16:00 . 2011-10-03 16:00 466944 ----a-w- c:\windows\system32\ATIDEMGX.dll 2011-10-03 15:59 . 2011-10-03 15:59 486912 ----a-w- c:\windows\system32\atieclxx.exe 2011-10-03 15:59 . 2011-10-03 15:59 204288 ----a-w- c:\windows\system32\atiesrxx.exe 2011-10-03 15:58 . 2011-10-03 15:58 120320 ----a-w- c:\windows\system32\atitmm64.dll 2011-10-03 15:58 . 2011-10-03 15:58 423424 ----a-w- c:\windows\system32\atipdl64.dll 2011-10-03 15:57 . 2011-10-03 15:57 356352 ----a-w- c:\windows\SysWow64\atipdlxx.dll 2011-10-03 15:57 . 2011-10-03 15:57 278528 ----a-w- c:\windows\SysWow64\Oemdspif.dll 2011-10-03 15:57 . 2011-10-03 15:57 21504 ----a-w- c:\windows\system32\atimuixx.dll 2011-10-03 15:57 . 2011-10-03 15:57 59392 ----a-w- c:\windows\system32\atiedu64.dll 2011-10-03 15:57 . 2011-10-03 15:57 43520 ----a-w- c:\windows\SysWow64\ati2edxx.dll 2011-10-03 15:54 . 2011-10-03 15:54 4204032 ----a-w- c:\windows\SysWow64\atidxx32.dll 2011-10-03 15:49 . 2011-10-03 15:49 1113088 ----a-w- c:\windows\system32\atiumd6v.dll 2011-10-03 15:49 . 2011-10-03 15:49 1828864 ----a-w- c:\windows\SysWow64\atiumdmv.dll 2011-10-03 15:39 . 2011-10-03 15:39 51200 ----a-w- c:\windows\system32\aticalrt64.dll 2011-10-03 15:39 . 2011-10-03 15:39 46080 ----a-w- c:\windows\SysWow64\aticalrt.dll 2011-10-03 15:39 . 2011-10-03 15:39 44544 ----a-w- c:\windows\system32\aticalcl64.dll 2011-10-03 15:39 . 2011-10-03 15:39 44032 ----a-w- c:\windows\SysWow64\aticalcl.dll 2011-10-03 15:39 . 2011-10-03 15:39 8723456 ----a-w- c:\windows\system32\aticaldd64.dll 2011-10-03 15:36 . 2011-10-03 15:36 7331840 ----a-w- c:\windows\SysWow64\aticaldd.dll 2011-10-03 15:23 . 2011-10-03 15:23 270336 ----a-w- c:\windows\SysWow64\atiadlxy.dll 2011-10-03 15:22 . 2011-10-03 15:22 15360 ----a-w- c:\windows\system32\atig6pxx.dll 2011-10-03 15:22 . 2011-10-03 15:22 13312 ----a-w- c:\windows\SysWow64\atiglpxx.dll 2011-10-03 15:22 . 2011-10-03 15:22 13312 ----a-w- c:\windows\system32\atiglpxx.dll 2011-10-03 15:22 . 2011-10-03 15:22 39936 ----a-w- c:\windows\system32\atig6txx.dll 2011-10-03 15:22 . 2011-10-03 15:22 32768 ----a-w- c:\windows\SysWow64\atigktxx.dll 2011-10-03 15:22 . 2011-10-03 15:22 310784 ----a-w- c:\windows\system32\drivers\atikmpag.sys 2011-10-03 15:21 . 2011-10-03 15:21 31744 ----a-w- c:\windows\SysWow64\atiuxpag.dll 2011-10-03 15:21 . 2011-10-03 15:21 54784 ----a-w- c:\windows\system32\atimpc64.dll 2011-10-03 15:21 . 2011-10-03 15:21 54784 ----a-w- c:\windows\system32\amdpcom64.dll 2011-10-03 15:21 . 2011-10-03 15:21 53760 ----a-w- c:\windows\SysWow64\atimpc32.dll 2011-10-03 15:21 . 2011-10-03 15:21 53760 ----a-w- c:\windows\SysWow64\amdpcom32.dll 2011-10-03 15:21 . 2011-10-03 15:21 53248 ----a-w- c:\windows\system32\drivers\ati2erec.dll 2011-10-03 09:53 . 2011-10-03 09:53 60416 ----a-w- c:\windows\system32\OVDecode64.dll 2011-10-03 09:53 . 2011-10-03 09:53 53760 ----a-w- c:\windows\SysWow64\OVDecode.dll 2011-10-03 09:52 . 2011-10-03 09:52 16652288 ----a-w- c:\windows\system32\amdocl64.dll 2011-10-03 09:43 . 2011-10-03 09:43 44032 ----a-w- c:\windows\system32\amdoclcl64.dll 2011-10-03 09:42 . 2011-10-03 09:42 37376 ----a-w- c:\windows\SysWow64\amdoclcl.dll 2011-09-29 15:56 . 2011-10-12 15:59 134104 ----a-w- c:\program files (x86)\Mozilla Firefox\components\browsercomps.dll 2011-09-29 15:56 . 2011-10-12 15:59 89048 ----a-w- c:\program files (x86)\Mozilla Firefox\libEGL.dll 2011-09-29 15:56 . 2011-10-12 15:59 773080 ----a-w- c:\program files (x86)\Mozilla Firefox\mozsqlite3.dll 2011-09-29 15:56 . 2011-10-12 15:59 478168 ----a-w- c:\program files (x86)\Mozilla Firefox\libGLESv2.dll 2011-09-29 15:56 . 2011-10-12 15:59 1833944 ----a-w- c:\program files (x86)\Mozilla Firefox\mozjs.dll 2011-09-29 15:56 . 2011-10-12 15:59 15832 ----a-w- c:\program files (x86)\Mozilla Firefox\mozalloc.dll 2011-09-29 15:56 . 2011-09-23 01:15 2106216 ----a-w- c:\program files (x86)\Mozilla Firefox\D3DCompiler_43.dll 2011-09-29 15:56 . 2011-09-23 01:15 1998168 ----a-w- c:\program files (x86)\Mozilla Firefox\d3dx9_43.dll 2011-09-28 18:50 . 2011-09-28 18:50 -------- d-----w- C:\ubuntu 2011-09-26 16:59 . 2011-09-26 17:00 -------- d-----w- c:\program files (x86)\CDex 2011-09-25 12:03 . 2011-03-03 19:09 2913920 ----a-w- c:\windows\system32\BootMan.exe 2011-09-25 12:03 . 2011-03-03 19:09 2336384 ----a-w- c:\windows\SysWow64\BootMan.exe 2011-09-25 12:03 . 2010-07-15 05:44 9096 ----a-w- c:\windows\system32\EuGdiDrv.sys 2011-09-25 12:03 . 2010-07-15 05:44 86408 ----a-w- c:\windows\SysWow64\setupempdrv03.exe 2011-09-25 12:03 . 2010-07-15 05:44 8456 ----a-w- c:\windows\SysWow64\EuGdiDrv.sys 2011-09-25 12:03 . 2010-07-15 05:44 16776 ----a-w- c:\windows\system32\epmntdrv.sys 2011-09-25 12:03 . 2010-07-15 05:44 14216 ----a-w- c:\windows\SysWow64\epmntdrv.sys 2011-09-25 12:03 . 2010-07-15 05:44 11264 ----a-w- c:\windows\system32\EuEpmGdi.dll 2011-09-25 12:03 . 2010-07-15 05:44 100232 ----a-w- c:\windows\system32\setupempdrvx64.exe 2011-09-25 12:03 . 2010-07-15 05:44 14848 ----a-w- c:\windows\SysWow64\EuEpmGdi.dll 2011-09-25 12:03 . 2011-09-25 12:03 -------- d-----w- c:\program files (x86)\EASEUS 2011-09-24 11:04 . 2011-09-24 11:04 -------- d-----w- c:\program files (x86)\Audacity . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-10-09 14:49 . 2011-07-29 08:37 414368 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2011-10-03 16:03 . 2011-04-19 23:09 732672 ----a-w- c:\windows\SysWow64\aticfx32.dll 2011-10-03 16:02 . 2011-04-19 23:07 862720 ----a-w- c:\windows\system32\aticfx64.dll 2011-10-03 15:48 . 2011-09-04 16:53 3888640 ----a-w- c:\windows\system32\atiumd6a.dll 2011-10-03 15:46 . 2011-04-19 22:49 4944896 ----a-w- c:\windows\system32\atidxx64.dll 2011-10-03 15:39 . 2011-04-19 22:30 4064768 ----a-w- c:\windows\SysWow64\atiumdva.dll 2011-10-03 15:35 . 2011-04-19 22:38 4289024 ----a-w- c:\windows\SysWow64\atiumdag.dll 2011-10-03 15:30 . 2011-09-04 16:53 5428736 ----a-w- c:\windows\system32\atiumd64.dll 2011-10-03 15:29 . 2011-04-19 22:27 58880 ----a-w- c:\windows\system32\coinst.dll 2011-10-03 15:23 . 2010-05-27 16:26 381952 ----a-w- c:\windows\system32\atiadlxx.dll 2011-10-03 15:22 . 2011-04-19 22:21 40960 ----a-w- c:\windows\system32\atiuxp64.dll 2011-10-03 15:21 . 2010-05-27 16:24 38912 ----a-w- c:\windows\system32\atiu9p64.dll 2011-10-03 15:21 . 2011-04-19 22:21 29184 ----a-w- c:\windows\SysWow64\atiu9pag.dll 2011-09-13 13:46 . 2011-09-13 13:46 28672 ----a-w- c:\windows\system32\AF15BDAEX.dll 2011-09-13 13:46 . 2011-09-13 13:46 140 ----a-w- c:\windows\system32\AF15IRTBL.bin 2011-09-13 13:46 . 2010-06-22 00:12 507392 ----a-w- c:\windows\system32\drivers\AF15BDA.sys 2011-09-01 14:22 . 2009-07-13 23:55 332288 ----a-w- c:\windows\system32\uxtheme.dll 2011-09-01 14:22 . 2010-11-21 03:23 2851840 ----a-w- c:\windows\system32\themeui.dll 2011-09-01 14:22 . 2009-07-13 23:54 44544 ----a-w- c:\windows\system32\themeservice.dll 2011-08-31 22:54 . 2011-06-28 15:23 271200 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr 2011-08-31 22:54 . 2011-06-03 19:44 271200 ----a-w- c:\windows\SysWow64\PnkBstrB.exe 2011-08-31 22:53 . 2011-06-03 19:44 103736 ----a-w- c:\windows\SysWow64\PnkBstrB.ex0 2011-08-31 14:00 . 2011-09-04 13:31 25416 ----a-w- c:\windows\system32\drivers\mbam.sys 2011-08-27 16:01 . 2011-08-27 16:01 57056 ----a-r- c:\users\Siso\AppData\Roaming\Microsoft\Installer\{748FBFC5-9D60-4058-9136-A862AF552CC2}\pdfico.exe 2011-08-27 16:01 . 2011-08-27 16:01 52960 ----a-r- c:\users\Siso\AppData\Roaming\Microsoft\Installer\{748FBFC5-9D60-4058-9136-A862AF552CC2}\sysaxico.exe 2011-08-27 16:01 . 2011-08-27 16:01 52960 ----a-r- c:\users\Siso\AppData\Roaming\Microsoft\Installer\{748FBFC5-9D60-4058-9136-A862AF552CC2}\htmico.exe 2011-08-27 16:01 . 2011-08-27 16:01 48864 ----a-r- c:\users\Siso\AppData\Roaming\Microsoft\Installer\{748FBFC5-9D60-4058-9136-A862AF552CC2}\chmico.exe 2011-08-26 14:39 . 2011-08-26 14:39 512512 ----a-w- c:\windows\SysWow64\sendmail.exe 2011-08-26 14:39 . 2011-08-26 14:39 1437184 ----a-w- c:\windows\tellmail.exe 2011-08-26 14:39 . 2011-08-26 14:39 1437184 ----a-w- c:\windows\SysWow64\tellmail.exe 2011-08-24 17:19 . 2011-08-24 17:19 56320 ----a-w- c:\windows\SysWow64\OpenVideo.dll 2011-08-24 17:18 . 2011-08-24 17:18 13601280 ----a-w- c:\windows\SysWow64\amdocl.dll 2011-08-24 17:17 . 2011-08-24 17:17 43520 ----a-w- c:\windows\SysWow64\OpenCL.dll 2011-08-09 17:01 . 2011-06-10 22:31 737072 ----a-w- c:\programdata\Microsoft\eHome\Packages\SportsV2\SportsTemplateCore\Microsoft.MediaCenter.Sports.UI.dll 2011-08-09 17:01 . 2011-06-10 22:30 4283672 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\markup.dll 2011-08-09 17:01 . 2011-06-10 22:30 42776 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM\StartResources.dll 2011-07-28 14:48 . 2011-07-28 14:48 51200 ----a-w- c:\windows\system32\OpenCL.dll 2011-07-25 16:41 . 2011-07-25 16:41 737072 ----a-w- c:\programdata\Microsoft\eHome\Packages\SportsV2\SportsTemplateCore-2\Microsoft.MediaCenter.Sports.UI.dll 2011-07-25 16:41 . 2011-07-25 16:41 4283672 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\markup.dll 2011-07-25 16:41 . 2011-07-25 16:41 42776 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM-2\StartResources.dll 2011-07-25 16:41 . 2011-07-25 16:41 539968 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll . . ((((((((((((((((((((((((((((( SnapShot@2011-10-22_16.43.07 ))))))))))))))))))))))))))))))))))))))))) . - 2009-07-14 04:54 . 2011-10-22 15:28 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2009-07-14 04:54 . 2011-10-22 16:58 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2009-07-14 04:54 . 2011-10-22 16:58 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2009-07-14 04:54 . 2011-10-22 15:28 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2009-07-14 04:54 . 2011-10-22 15:28 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2009-07-14 04:54 . 2011-10-22 16:58 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2010-11-21 03:09 . 2011-10-22 16:50 51752 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin - 2009-07-14 05:10 . 2011-10-22 11:27 42882 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin + 2009-07-14 05:10 . 2011-10-22 16:50 42882 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin + 2011-06-03 16:23 . 2011-10-22 16:50 12544 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3051125622-3749105565-2852968184-1000_UserData.bin - 2011-06-03 16:53 . 2011-10-22 16:42 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2011-06-03 16:53 . 2011-10-22 19:31 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2011-06-03 16:53 . 2011-10-22 16:06 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2011-06-03 16:53 . 2011-10-22 19:05 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2011-10-22 19:31 . 2011-10-22 19:31 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat - 2011-10-22 16:42 . 2011-10-22 16:42 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat + 2011-10-22 19:31 . 2011-10-22 19:31 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat - 2011-10-22 16:42 . 2011-10-22 16:42 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat - 2009-07-14 05:01 . 2011-10-22 16:42 665428 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat + 2009-07-14 05:01 . 2011-10-22 19:30 665428 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat + 2011-06-05 08:34 . 2011-10-22 19:30 24826748 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-3051125622-3749105565-2852968184-1000-12288.dat - 2011-06-05 08:34 . 2011-10-22 16:42 24826748 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-3051125622-3749105565-2852968184-1000-12288.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{ffa0793e-3980-4be4-8234-048fa665f700}"= "c:\program files (x86)\Softonic_English_FF\prxtbSof0.dll" [2011-05-09 176936] . [HKEY_CLASSES_ROOT\clsid\{ffa0793e-3980-4be4-8234-048fa665f700}] . [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{597A9974-8CB0-4f41-B61F-ED065738A397}] 2011-10-02 19:26 522752 ----a-w- c:\program files (x86)\RewardsArcade\RewardsArcade.dll . [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{ffa0793e-3980-4be4-8234-048fa665f700}] 2011-05-09 09:49 176936 ----a-w- c:\program files (x86)\Softonic_English_FF\prxtbSof0.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar] "{ffa0793e-3980-4be4-8234-048fa665f700}"= "c:\program files (x86)\Softonic_English_FF\prxtbSof0.dll" [2011-05-09 176936] . [HKEY_CLASSES_ROOT\clsid\{ffa0793e-3980-4be4-8234-048fa665f700}] . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "uTorrent"="c:\program files (x86)\uTorrent\uTorrent.exe" [2011-06-03 399736] "DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2011-01-20 1305408] "Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2007-12-07 21686568] "IDMan"="c:\program files (x86)\Internet Download Manager\IDMan.exe" [2011-04-05 3278232] "Gadwin PrintScreen Pro"="c:\program files (x86)\Gadwin Systems\PrintScreenPro\PrintScreenPro.exe" [2011-05-12 1858048] "Steam"="c:\program files (x86)\Steam\Steam.exe" [2011-08-07 1242448] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584] "MusicManager"="c:\users\Siso\AppData\Local\Programs\Google\MusicManager\MusicManager.exe" [2011-09-14 13128704] "BlazeServoTool"="c:\program files (x86)\BlazeVideo\BlazeDTV 6.0\MediaDetector.exe" [2009-07-07 282624] "Pando Media Booster"="c:\program files (x86)\Pando Networks\Media Booster\PMB.exe" [2011-10-16 3077528] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "HDAudDeck"="c:\program files (x86)\VIA\VIAudioi\VDeck\VDeck.exe" [2009-09-21 2583040] "WinampAgent"="c:\program files (x86)\Winamp\winampa.exe" [2008-01-15 37376] "BtTray"="c:\program files (x86)\IVT Corporation\BlueSoleil\BtTray.exe" [2009-02-27 278016] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696] "amd_dc_opt"="c:\program files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2008-07-22 77824] "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2010-11-29 421888] "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2011-06-07 421160] "SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096] "AdobeCS5.5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" [2011-01-12 1523360] "ALTDVB_Manager"="c:\altdvb staredition iii\\ALTDVB Manager.exe" [2009-12-22 420352] "Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-09-07 37296] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920] "StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-10-26 98304] "ATICustomerCare"="c:\program files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe" [2010-05-04 311296] . c:\users\Siso\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ ALTDVB Manager.lnk - c:\altdvb staredition iii\ALTDVB Manager.exe [2009-12-22 420352] Registration Driver Parallel Lines.LNK - d:\siso\Games\Driver Parallel Lines\Register\RegistrationReminder.exe [N/A] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 0 (0x0) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp . R2 AODDriver4.01;AODDriver4.01;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [x] R2 AODService;AODService;c:\program files (x86)\AMD\OverDrive\AODAssist.exe [2009-05-05 124256] R3 ALSysIO;ALSysIO;c:\users\Siso\AppData\Local\Temp\ALSysIO64.sys [x] R3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys [x] R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [x] R3 driverhardwarev2x64;driverhardwarev2x64;c:\program files\ma-config.com\Drivers\driverhardwarev2x64.sys [2011-07-21 16640] R3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys [2010-07-15 16776] R3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys [2010-07-15 9096] R3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\x64\maconfservice.exe [2011-08-08 421376] R3 Mercury32;Mercury32;c:\mail\mercury.exe [2011-08-26 761344] R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [x] R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096] R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x] R3 SysaxMultiServer;Sysax Multi Server Service;c:\program files (x86)\SysaxServer\sysaxservd.exe [2010-11-30 1867520] R3 terminpt;Microsoft Remote Desktop Input Driver;c:\windows\system32\drivers\terminpt.sys [x] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x] R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [x] R3 tsusbhub;tsusbhub; [x] S0 BtHidBus;Bluetooth HID Bus Service;c:\windows\System32\Drivers\BtHidBus.sys [x] S1 aswSP;avast! Self Protection; [x] S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [x] S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x] S2 Apache2.2;Apache2.2;c:\appserv\Apache2.2\bin\httpd.exe [2008-01-17 24635] S2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [x] S2 aswMonFlt;aswMonFlt;c:\windows\system32\DRIVERS\aswMonFlt.sys [x] S2 BsMobileCS;BsMobileCS;c:\program files (x86)\IVT Corporation\BlueSoleil\BsMobileCS.exe [2009-02-27 143467] S2 FirebirdGuardianDefaultInstance;Firebird Guardian - DefaultInstance;c:\program files (x86)\Firebird\Firebird_2_5\bin\fbguard.exe [2010-09-17 98304] S2 FreeProxy;Free Proxy Service;c:\program files (x86)\Hand-Crafted Software\FreeProxy\FreeProxy.exe [2010-03-27 565248] S2 Icecast-trunk;Icecast-trunk Streaming Media Server;c:\program files (x86)\Icecast2 Win32\icecastService.exe [2008-05-24 417792] S2 IDMWFP;IDMWFP;c:\windows\system32\DRIVERS\idmwfp.sys [x] S2 MELCS;MailEnable List Connector;c:\program files (x86)\Mail Enable\Bin64\MELSC.EXE [2011-08-03 133632] S2 MEMTAS;MailEnable Mail Transfer Agent;c:\program files (x86)\Mail Enable\Bin64\MEMTA.EXE [2011-08-03 143872] S2 MEPOCS;MailEnable Postoffice Connector;c:\program files (x86)\Mail Enable\Bin64\MEPOC.EXE [2011-08-03 720896] S2 MEPOPS;MailEnable POP Service;c:\program files (x86)\Mail Enable\Bin64\MEPOPS.EXE [2011-08-03 453120] S2 MESMTPCS;MailEnable SMTP Connector;c:\program files (x86)\Mail Enable\Bin64\MESMTPC.EXE [2011-08-03 712192] S2 TeamViewer6;TeamViewer 6;c:\program files (x86)\TeamViewer\Version6\TeamViewer_Service.exe [2011-08-30 2358656] S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x] S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x] S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [x] S3 btnetBUs;Bluetooth PAN Bus Service;c:\windows\system32\Drivers\btnetBus.sys [x] S3 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance;c:\program files (x86)\Firebird\Firebird_2_5\bin\fbserver.exe [2010-09-17 3735552] S3 IvtBtBUs;IVT Bluetooth Bus Service;c:\windows\system32\Drivers\IvtBtBus.sys [x] S3 pcouffin;VSO Software pcouffin;c:\windows\system32\Drivers\pcouffin.sys [x] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x] . . Contents of the 'Scheduled Tasks' folder . 2011-10-22 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3051125622-3749105565-2852968184-1000Core.job - c:\users\Siso\AppData\Local\Google\Update\GoogleUpdate.exe [2011-06-23 14:25] . 2011-10-22 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3051125622-3749105565-2852968184-1000UA.job - c:\users\Siso\AppData\Local\Google\Update\GoogleUpdate.exe [2011-06-23 14:25] . . --------- x86-64 ----------- . . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\IDM Shell Extension] @="{CDC95B92-E27C-4745-A8C5-64A52A78855D}" [HKEY_CLASSES_ROOT\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}] 2011-03-02 15:23 85232 ----a-w- c:\program files (x86)\Internet Download Manager\IDMShellExt64.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "PAC7302_Monitor"="c:\windows\PixArt\PAC7302\Monitor.exe" [2006-11-03 319488] "AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2011-03-15 499608] . ------- Supplementary Scan ------- . uLocal Page = c:\windows\system32\blank.htm uStart Page = about:blank mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyServer = 206.207.248.35:3128 IE: ????3?? IE: ????3?????? IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\OFFICE11\EXCEL.EXE/3000 IE: Send by Bluetooth - c:\program files (x86)\IVT Corporation\BlueSoleil\TransSend\IE\tsinfo.htm IE: Send via &Message... - c:\program files (x86)\IVT Corporation\BlueSoleil\TransSend\IE\tssms.htm IE: Свали всички линкове с IDM - c:\program files (x86)\Internet Download Manager\IEGetAll.htm IE: Свали с IDM - c:\program files (x86)\Internet Download Manager\IEExt.htm IE: ????3?? - c:\users\Siso\AppData\Roaming\FlashGetBHO\GetUrl.htm IE: ????3?????? - c:\users\Siso\AppData\Roaming\FlashGetBHO\GetAllUrl.htm TCP: Interfaces\{D4DD6AF9-0B7F-42F6-964B-821F4A1D9E22}: NameServer = 212.25.58.229 212.25.58.2 FF - ProfilePath - c:\users\Siso\AppData\Roaming\Mozilla\Firefox\Profiles\80w5p5ie.default\ FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2359656&SearchSource=3&q={searchTerms} FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - about:home FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2359656&SearchSource=2&q= FF - prefs.js: network.proxy.type - 0 . - - - - ORPHANS REMOVED - - - - . WebBrowser-{FFA0793E-3980-4BE4-8234-048FA665F700} - (no file) . . . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\MySql] "ImagePath"="c:\appserv\MySQL\bin\mysqld-nt --defaults-file=c:\appserv\MySQL\my.ini mysql" . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_USERS\S-1-5-21-3051125622-3749105565-2852968184-1000_Classes\Wow6432Node\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}] @Denied: (Full) (Everyone) "scansk"=hex(0):c0,7a,c9,28,61,cd,0f,38,b8,dd,7d,a1,98,7e,26,82,23,cb,e5,45,a4, 26,0f,9c,5f,6d,46,d1,8c,77,c6,d0,76,5f,0a,9b,29,50,60,88,00,00,00,00,00,00,\ . [HKEY_USERS\S-1-5-21-3051125622-3749105565-2852968184-1000_Classes\Wow6432Node\CLSID\{abec27f5-70ef-421f-8fbb-cc70f84e67a5}] @Denied: (Full) (Everyone) @Allowed: (Read) (RestrictedCode) "Model"=dword:0000011d "Therad"=dword:0000001f "MData"=hex(0):73,d5,cf,b8,a4,07,89,80,31,e4,35,6b,2a,ca,fe,43,b6,1f,81,1f,5a, 1b,4d,36,46,8f,3c,f2,5c,68,ee,21,46,8f,3c,f2,5c,68,ee,21,46,8f,3c,f2,5c,68,\ . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11c_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11c_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11c.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.10" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11c.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11c.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11c.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\PCW\Security] @Denied: (Full) (Everyone) . ------------------------ Other Running Processes ------------------------ . c:\program files\Alwil Software\Avast4\aswUpdSv.exe c:\program files\Alwil Software\Avast4\ashServ.exe c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe c:\program files (x86)\IVT Corporation\BlueSoleil\BlueSoleilCS.exe c:\program files (x86)\Bonjour\mDNSResponder.exe c:\program files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE c:\appserv\MySQL\bin\mysqld-nt.exe c:\windows\SysWOW64\PnkBstrA.exe c:\program files\Alwil Software\Avast4\ashWebSv.exe c:\program files\Alwil Software\Avast4\ashMaiSv.exe c:\program files (x86)\Internet Download Manager\IEMonitor.exe c:\program files (x86)\Skype\Plugin Manager\skypePM.exe . ************************************************************************** . Completion time: 2011-10-22 22:36:48 - machine was rebooted ComboFix-quarantined-files.txt 2011-10-22 19:36 ComboFix2.txt 2011-10-22 16:46 . Pre-Run: 20 642 050 048 bytes free Post-Run: 20 542 193 664 bytes free . - - End Of File - - 4F29071E45B9A4216009FC86D2F52C22

Здравейте..!Първо да се извиня но имах ангажименти и нямах възможност да пиша..!Справили сте се отлично ...ще огледам дневника и ще ви пиша...!Между другото може да направите едно контролно сканиране по тази инструкция:

Публикувано изображение Изтеглете Malwarebytes' Anti-Malware или от тук

* Кликнете два пъти върху mbam-setup.exe, за да инсталирате програмата.

* Уверете се, че са поставени отметки на Update Malwarebytes' Anti-Malware и Launch Malwarebytes' Anti-Malware. След това кликнете на Finish.

* Ако има намерени обновявания, тя ще ги изтегли и инсталира.

* Стартирайте програмата и изберете "Perform Full Scan", след това кликнете на Scan.

* Сканирането ще отнеме малко време, затова моля да бъдете търпеливи.

* Когато сканирането завърши, кликнете на OK, след това Show Results, за да видите резултата.

* Уверете се, че на всички редове има отметки, и кликнете на Remove Selected.

* Когато всичко бъде премахнато, в Notepad ще бъде отворен лог. Копирайте този лог и го публикувайте в следващия си коментар по темата.

Забележка: Ако MalwareBytes' Anti-Malware се затрудни в премахването на откритите вируси/заплахи, той ще поиска да рестартира компютъра Ви и по време на рестартирането да премахне проблемните вируси/заплахи. Ако бъдете попитани, потвърдете че желаете вашия компютър да бъде рестартиран.

И още един въпрос - какво е моментното състояние на системата ви..?Наблюдавате ли някъкви проблеми..?:mad:

Здравейте..!Първо да се извиня но имах ангажименти и нямах възможност да пиша..!Справили сте се отлично ...ще огледам дневника и ще ви пиша...!Между другото може да направите едно контролно сканиране по тази инструкция: Публикувано изображение Изтеглете Malwarebytes' Anti-Malware или от тук * Кликнете два пъти върху mbam-setup.exe, за да инсталирате програмата. * Уверете се, че са поставени отметки на Update Malwarebytes' Anti-Malware и Launch Malwarebytes' Anti-Malware. След това кликнете на Finish. * Ако има намерени обновявания, тя ще ги изтегли и инсталира. * Стартирайте програмата и изберете "Perform Full Scan", след това кликнете на Scan. * Сканирането ще отнеме малко време, затова моля да бъдете търпеливи. * Когато сканирането завърши, кликнете на OK, след това Show Results, за да видите резултата. * Уверете се, че на всички редове има отметки, и кликнете на Remove Selected. * Когато всичко бъде премахнато, в Notepad ще бъде отворен лог. Копирайте този лог и го публикувайте в следващия си коментар по темата. Забележка: Ако MalwareBytes' Anti-Malware се затрудни в премахването на откритите вируси/заплахи, той ще поиска да рестартира компютъра Ви и по време на рестартирането да премахне проблемните вируси/заплахи. Ако бъдете попитани, потвърдете че желаете вашия компютър да бъде рестартиран. И още един въпрос - какво е моментното състояние на системата ви..?Наблюдавате ли някъкви проблеми..? :(

В момента програмата сканира...

Здравейте отново ами състоянието на системата е добро с изключение на антивирусната Avast която я няма в Трейа(долу в дясно) изобщо не е включена това стана след сканирането на ComboFix иначе всичко друго е наред.

Редактирано от Прокси регулатор (преглед на промените)

Malwarebytes' Anti-Malware 1.51.2.1300 www.malwarebytes.org Версия на базата от данни: 7998 Windows 6.1.7601 Service Pack 1 Internet Explorer 8.0.7601.17514 24.10.2011 г. 16:30:17 mbam-log-2011-10-24 (16-30-17).txt Тип сканиране: Пълно сканиране (C:\|D:\|) Сканирани обекти: 480419 Изминало време: 1 час(а), 26 минута(и), 38 секунда(и) Заразени процеси в паметта: 0 Заразени модули в паметта: 0 Заразени ключове в регистратурата: 1 Заразени стойности в регистратурата: 0 Заразени информационни обекти в регистратурата: 0 Заразени папки: 0 Заразени файлове: 19 Заразени процеси в паметта: (Не бяха открити зловредни обекти) Заразени модули в паметта: (Не бяха открити зловредни обекти) Заразени ключове в регистратурата: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\bet365casino (PUP.Casino) -> Quarantined and deleted successfully. Заразени стойности в регистратурата: (Не бяха открити зловредни обекти) Заразени информационни обекти в регистратурата: (Не бяха открити зловредни обекти) Заразени папки: (Не бяха открити зловредни обекти) Заразени файлове: c:\altdvb staredition iii\newcamd server info converter.exe (Trojan.Agent) -> Quarantined and deleted successfully. c:\Casino\casino at bet365\_setupcasino_a616b8.exe (PUP.Casino) -> Quarantined and deleted successfully. c:\program files (x86)\Xilisoft\video converter ultimate 6\lxt_xvcu6550426.exe (RiskWare.Tool.CK) -> Quarantined and deleted successfully. d:\Siso\Games\Crysis\Bin32\rzr-crys.exe (Trojan.Downloader) -> Quarantined and deleted successfully. d:\Siso\Games\DiRT 3\SKIDROW.dll (Trojan.Downloader.H) -> Quarantined and deleted successfully. d:\Siso\Games\need for speed hot pursuit\nfshp_activator.exe (RiskWare.Tool.CK) -> Quarantined and deleted successfully. d:\Siso\Install\_Others\call_of_duty_4_crackfix_and_keygen-razor1911\Keygen\rzr-cod4.exe (Trojan.Agent.CK) -> Quarantined and deleted successfully. d:\Siso\Install\_Soft\anti-virus\avast! professional edition 4.8.1282\Keygen.exe (Backdoor.IRCBot) -> Quarantined and deleted successfully. d:\Siso\Install\_Soft\imtoo mp3 to wav\CORE10k.EXE (Dont.Steal.Our.Software) -> Quarantined and deleted successfully. d:\Siso\Install\_Soft\Internet\dl managers\internet download manager 6.05 b11\patch-snd\SnDk&p.exe (RiskWare.Tool.CK) -> Quarantined and deleted successfully. d:\Siso\Install\_Soft\Internet\dl managers\tonec.inc.internet.download.manager.v6.05.14.winall.incl.keygen.and.patch-brd\Keygen\Keygen.exe (Riskware.Tool.CK) -> Quarantined and deleted successfully. d:\Siso\Install\_Soft\Internet\dl managers\tonec.inc.internet.download.manager.v6.05.14.winall.incl.keygen.and.patch-brd\Keygen\Patch.exe (Riskware.Tool.CK) -> Quarantined and deleted successfully. d:\Siso\Install\_Soft\ivt.bluesoleil.v6.4.249.0.x64 & x86 .incl.keymaker-embrace\ivt.bluesoleil.v6.4.249.0.x64.incl.keymaker-embrace\ivt.bluesoleil.v6.4.249.0.x64.incl.keymaker-embrace\Crack\keygen.exe (Trojan.Agent) -> Quarantined and deleted successfully. d:\Siso\Install\_Soft\Media\convertors & audio tools\aone.ultra.video.converter.v4.4.0827.incl.patch-proxy\Patch\patch-proxy.exe (PUP.Hacktool.Patcher) -> Not selected for removal. d:\Siso\Install\_Soft\Media\convertors & audio tools\xilisoft video converter ultimate v6.5.5.0426-laxity\lxt_xvcu6550426.exe (RiskWare.Tool.CK) -> Quarantined and deleted successfully. d:\Siso\Install\_Soft\Media\players & codecs\winamp 5 52 kgn [h33t] [dinguskull]\Keygen.exe (Trojan.Downloader) -> Quarantined and deleted successfully. d:\Siso\Install\_Soft\Others\vmware workstation full v7.1.4 build 385536\Keygen\keygen.exe (Trojan.Agent.CK) -> Quarantined and deleted successfully. d:\Siso\Install\_Soft\techsmith camtasia studio 7.1.1 (keygen-zwt + serials)\keygen-zwt\keygen.exe (Backdoor.RBot) -> Quarantined and deleted successfully. d:\Torrents\adobe photoshop cs2 iso + keygen\keygen\keygen.exe (Trojan.Agent.CK) -> Quarantined and deleted successfully. След рестарта се появи някъкъв син екран от Windows не успях да го прочета след следващия рестарт нямаше такъв

Деинсталирайте Комбофикс така:

1.Натиснете Start ==> Run ==> въведете командата Combofix /Uninstall ==> OK

Публикувано изображение

2.Изтеглете Публикувано изображениеOTCleanIt или от тук,стартирайте и натиснете Публикувано изображение

Публикувано изображение Изтеглете програмата: ESET Online Scanner

  • Стартирайте esetsmartinstaller_enu.exe Публикувано изображение
  • Сложете отметка на YES, I accept the Terms of Use и изберете Start:

    Публикувано изображение

  • Скенерът ще започне да изтегля компонентите, които са му необходими:

    Публикувано изображение

  • Уверете се, че има отметки на следните редове:

    Публикувано изображение

    Накрая изберете Start

  • Скенерът ще започне да изтегля последните дефиниции.
  • След, като сканирането завърши изберете Finish.
  • Отидете в: C:\Program Files\ESET\ESET Online Scanner
  • Отворете файла log.txt , копирайте съдържанието му и го поставете в следващия си коментар.

ESETSmartInstaller@High as downloader log: all ok # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6583 # api_version=3.0.2 # EOSSerial=bbf2e7ea0b19f94cb82486190811fe0d # end=finished # remove_checked=true # archives_checked=true # unwanted_checked=true # unsafe_checked=true # antistealth_checked=true # utc_time=2011-10-24 11:53:10 # local_time=2011-10-25 02:53:10 ) # country="Bulgaria" # lang=1033 # osver=6.1.7601 NT Service Pack 1 # compatibility_mode=769 16775165 100 98 45 255775438 9349 0 # compatibility_mode=5893 16776573 100 94 12362632 71113334 0 0 # compatibility_mode=8192 67108863 100 0 198 198 0 0 # scanned=270123 # found=22 # cleaned=22 # scan_time=16905 C:\3545345345345.rar a variant of Win32/GameHack.D application (deleted - quarantined) 00000000000000000000000000000000 C C:\Users\Siso\AppData\Local\Google\Chrome\User Data\Default\Cache\f_0000d0 HTML/ScrInject.B.Gen virus (deleted - quarantined) 00000000000000000000000000000000 C C:\Users\Siso\AppData\Local\Google\Chrome\User Data\Default\Cache\f_01bb77 HTML/ScrInject.B.Gen virus (deleted - quarantined) 00000000000000000000000000000000 C C:\Users\Siso\AppData\Local\Temp\ICReinstall\cnet_NokiaSoftwareUpdaterSetup_EN_US_exe.exe a variant of Win32/InstallCore.D application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\Users\Siso\Desktop\Stuff\systems-php\vij.me(1).rar PHP/JackShell.A trojan (deleted - quarantined) 00000000000000000000000000000000 C C:\Users\Siso\Desktop\Stuff\systems-php\ZPanel-v25-BETA11.rar JS/Kryptik.BP trojan (deleted - quarantined) 00000000000000000000000000000000 C C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HOMGT5OA\upgrade[1].cab a variant of Win32/Adware.OneStep.AG application (deleted - quarantined) 00000000000000000000000000000000 C D:\Siso\Games\Crysis\Bin32\Crysis v1.2.1 + 9 Trainer.exe a variant of Win32/HackTool.CheatEngine.AB application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C D:\Siso\Games\DiRT 3\paul.dll a variant of Win32/Packed.VMProtect.AAA trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C D:\Siso\Games\The Chronicles of Riddick - Assault on Dark Athena\System\Win32_x86\dvm.dll probably a variant of Win32/Obfuscated.DPDCUM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C D:\Siso\Install\_Others\MEGA SOFTWARE PACK.iso multiple threats (deleted - quarantined) 00000000000000000000000000000000 C D:\Siso\Install\_Soft\DriverSweeper_3.1.0.exe Win32/OpenCandy application (deleted - quarantined) 00000000000000000000000000000000 C D:\Siso\Install\_Soft\ImToo MP3 To WAV.zip a variant of Win32/Keygen.BH application (deleted - quarantined) 00000000000000000000000000000000 C D:\Siso\Install\_Soft\Acoustica Mixcraft v5.2 build 151+Patch\Acoustica Mixcraft v5.2 build 151+patch.exe a variant of Win32/HackTool.Patcher.T application (deleted - quarantined) 00000000000000000000000000000000 C D:\Siso\Install\_Soft\DVB_t\DVBDream.v1.5c.Valid.Keygen.BY.Prince.rar probably a variant of Win32/TrojanDropper.Agent.GFODUQZ trojan (deleted - quarantined) 00000000000000000000000000000000 C D:\Siso\Install\_Soft\Gadwin_Print_Screen_Pro_v4.4.1211\PATCH\gadwin.print.screen.pro.v4.4.1211-patch.exe a variant of Win32/HackTool.Patcher.A application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C D:\Siso\Install\_Soft\ImToo MP3 To WAV\keygen.exe a variant of Win32/Keygen.BH application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C D:\Siso\Install\_Soft\Internet\DL Managers\Internet Download Manager 6.05 b11\fix.zip multiple threats (deleted - quarantined) 00000000000000000000000000000000 C D:\Siso\Install\_Soft\Internet\Remote\Radmin 3.2 Ru Server + Client.zip Win32/HideIcon.A application (deleted - quarantined) 00000000000000000000000000000000 C D:\Siso\Install\_Soft\Media\Convertors & Audio Tools\Aone.Ultra.Video.Converter.v4.4.0827.Incl.Patch-PROXY\Patch\Patch-proxy.exe a variant of Win32/HackTool.Patcher.T application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C D:\Torrents\Picture24.JPG.zip Win32/Injector.KCW trojan (deleted - quarantined) 00000000000000000000000000000000 C D:\Torrents\Adobe.Photoshop.CS5.1.Extended.v12.1.Incl.Keymaker-CORE\Keygen\keygen.exe a variant of Win32/Keygen.BH application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

Прекрсно..!Ако нямате други проблеми мисля да се ориантираме към приключване...!Деинсталирайте ESET Online Scanner.Пожелавам ви лек ден и безопзсен Интернет...!:biggrin:

Прекрсно..!Ако нямате други проблеми мисля да се ориантираме към приключване...!Деинсталирайте ESET Online Scanner.Пожелавам ви лек ден и безопзсен Интернет...! :rolleyes:

А един въпрос как да си възвърна AVAST-а защото го няма в трейя ? :wors:

А един въпрос как да си възвърна AVAST-а защото го няма в трейя ? :)

Хм....има вероятност вируса да е повредил/изтрил антивирусната ...и при положение че програмата е компрометирана аз бих я преинсталирал....! :)

Архивирана тема

Темата е твърде стара и е архивирана. Не можете да добавяте нови отговори в нея, но винаги можете да публикувате нова тема, в която да продължи дискусията. Регистрирайте се или влезте във вашия профил за да публикувате нова тема.

Назад

Разглеждащи това в момента 0

  • Няма регистрирани потребители разглеждащи тази страница.

Дарение

  • Подкрепи съществуването на форума - направи дарение
    32%
    Дарени 315 € от нужните 1 000 €

Бюлетин

Получавайте известие, когато има важна промяна или новина свързана с форума.
Абонирайте се

Профил

Навигация

Търсене

Търсене

Конфигуриране на push известия в браузъра
Chrome (Android)
  1. Докоснете иконата на катинар до адресната лента.
  2. Докоснете Разрешения → Известия.
  3. Променете предпочитанията си.
Chrome (Desktop)
  1. Кликнете върху иконата на катинар в адресната лента.
  2. Изберете Настройки на сайта.
  3. Намерете Известия и коригирайте предпочитанията си.