Много добре. Сега успяхме да махнем част от гадината. Остава да отключим малко файлове, няма много работа. Ето как:

• Моля изтеглете Junction.zip и го запазете на вашия десктоп. Разархивирайте файла и го копирайте файла junction.exe в C:\Windows.
• Изтеглете следния файл:
• Разархивирайте fix.zip и стартирайте стартирайте файла fix.bat с десен бутон → Run as administrator
• Изчакайте да завърши проверката и да се появи лог файла (този лог файл ще се намира на С:\ с име log.txt).
• Копирайте съдържанието му в следващия си коментар.

Junction v1.06 - Windows junction creator and reparse point viewer Copyright © 2000-2010 Mark Russinovich Sysinternals - www.sysinternals.com Failed to open \\?\c:\\pagefile.sys: The process cannot access the file because it is being used by another process. Failed to open \\?\c:\\System Volume Information: Access is denied. . Failed to open \\?\c:\\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Scans\History\CacheManager\MpScanCache-0.bin: Access is denied. .. ... ... ... ... ... ... ... ... ... ... ... ... .. Failed to open \\?\c:\\Program Files\Malwarebytes' Anti-Malware\mbam.exe: Access is denied. . ... Failed to open \\?\c:\\Program Files\Microsoft Security Client\Antimalware\ : Access is denied. ... .. Failed to open \\?\c:\\Qoobox\BackEnv: Access is denied. . ... ... ... ... ... ... ... ... ... No reparse points found.

Сега изтеглете GrantPerms.zip и го разархивирайте в папка по избор. Стартирайте GrantPerms.exe и въведете следната информация:

c:\\Program Files\Microsoft Security Client\Antimalware\
c:\\Program Files\Malwarebytes' Anti-Malware\mbam.exe
c:\\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Scans\History\CacheManager\MpScanCache-0.bin

Натиснете Unlock и след това List Permissions. Публикувайте лог файла в следващия си пост.

След това пробвайте дали работи MBAM (Malwarebytes Anti-Malware). Aко работи, пуснете бързо (Quick) сканиране и дайте резултат (лог) от сканирането.

GrantPerms by Farbar Ran by Jivko at 2011-10-27 14:04:11 =============================================== WARNING: The parameter <c:\\Program Files\Microsoft Security Client\Antimalware" -ot file -actn list -lst F:tab;W:O,d;I:y > contains a double quotation mark ("). Did you unintentionally escape a double quote? Hint: use <"C:\\"> instead of <"C:\">. ERROR: The object path was not specified. \\?\c:\\Program Files\Malwarebytes' Anti-Malware\mbam.exe Owner: BUILTIN\Administrators DACL(P)(AI): BUILTIN\Administrators FULL ALLOW (NI) NT AUTHORITY\SYSTEM FULL ALLOW (NI) BUILTIN\Users READ/EXECUTE ALLOW (NI) \\?\c:\\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Scans\History\CacheManager\MpScanCache-0.bin Owner: BUILTIN\Administrators DACL(NP)(AI): BUILTIN\Users READ/EXECUTE ALLOW (NI) NT AUTHORITY\SYSTEM FULL ALLOW (I) BUILTIN\Administrators FULL ALLOW (I) Malwarebytes' Anti-Malware 1.51.2.1300 www.malwarebytes.org Database version: 8029 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 27.10.2011 г. 14:07:22 mbam-log-2011-10-27 (14-07-15).txt Scan type: Quick scan Objects scanned: 154692 Time elapsed: 1 minute(s), 48 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 1 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: c:\documents and settings\Jivko\Desktop\fdd.exe (Joke.Stressreducer) -> No action taken.

Хм, май нещо съм пропуснал. Стартирайте отново GrantPerms.exe и въведете следната информация:

c:\\System Volume Information
c:\\Program Files\Microsoft Security Client\Antimalware

Натиснете Unlock и след това List Permissions. Публикувайте лог файла в следващия си пост.

GrantPerms by Farbar Ran by Jivko at 2011-10-27 14:24:11 =============================================== \\?\c:\\System Volume Information Owner: BUILTIN\Administrators DACL(P)(AI): BUILTIN\Administrators FULL ALLOW (CI)(OI) NT AUTHORITY\SYSTEM FULL ALLOW (CI)(OI) BUILTIN\Users READ/EXECUTE ALLOW (CI)(OI) \\?\c:\\Program Files\Microsoft Security Client\Antimalware Owner: BUILTIN\Administrators DACL(NP)(AI): BUILTIN\Administrators FULL ALLOW (CI)(OI) NT AUTHORITY\SYSTEM FULL ALLOW (CI)(OI) BUILTIN\Users READ/EXECUTE ALLOW (CI)(OI) BUILTIN\Users READ/EXECUTE ALLOW (I) BUILTIN\Users READ/EXECUTE ALLOW (CI)(OI)(IO)(I) BUILTIN\Power Users change ALLOW (I) BUILTIN\Power Users change ALLOW (CI)(OI)(IO)(I) BUILTIN\Administrators FULL ALLOW (I) BUILTIN\Administrators FULL ALLOW (CI)(OI)(IO)(I) NT AUTHORITY\SYSTEM FULL ALLOW (I) NT AUTHORITY\SYSTEM FULL ALLOW (CI)(OI)(IO)(I) CREATOR OWNER FULL ALLOW (CI)(OI)(IO)(I)

Ще трябва да проверим все пак дали има някакви остатъци. Затова следва:

1) Изтеглете: ESET Online Scanner

2) Стартирайте esetsmartinstaller_enu.exe

3) Сложете отметка на YES, I accept the Terms of Use и изберете Start

4) Скенерът ще започне да изтегля компонентите, които са му необходими.

5) Уверете се, че има отметки на следните редове, включително и тези от менюто Advanced Settings:

• Scan archives
• Scan for potentially unwanted applications
• Scan for potentially unsafe applications
• Enable Anti-Stealth technology

И накрая изберете Start

6) Скенерът ще започне да изтегля последните дефиниции.

7) След, като сканирането завърши изберете Finish.

8) Отидете в:

C:\Program Files\ESET\ESET Online Scanner

Отворете файла log.txt , копирайте съдържанието му и го поставете в следващия си коментар.

P.S. Проверката продължава доста време, над час, Имайте търпение. Пишете дали антивирусната програма работи нормално.

Понеже малко прибързах и редактирах мнението си. Трябва да има отметка на Remove Fond Threats. Ако сте започнали сканирането, спрете и започнете наново.

Редактирано 27 октомври 201114 г. от nologo (преглед на промените)

ами наистина е много до тук около 3,5 часа като в момента е на половината на втория твърд диск, за мое съжаление до момента са открити 23 вируса, но ще изчакам да разбера точната им бройка, още на първите вируси изпищя и антивирусната на майкрософ, като засече почти същия брой вируси - около осем. Не знам дали ще е проблем, но около 5 мин след като ги засече ми изписа че ги е изтрила сама. След като приключи НОД ще публикувам лог файла охх чак сега видх съобщението Ви, и за сега няма отметка за изтриване на вирусите, но когато приключи и публикувам лог файла ще пусна ново сканиране с отметка за изтриване на намерените вируси

ESETSmartInstaller@High as downloader log: all ok # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6583 # api_version=3.0.2 # EOSSerial=232ba179bb40a84eba8b806309d579e6 # end=finished # remove_checked=false # archives_checked=true # unwanted_checked=true # unsafe_checked=true # antistealth_checked=true # utc_time=2011-10-27 03:44:08 # local_time=2011-10-27 06:44:08 (+0200, FLE Daylight Time) # country="Bulgaria" # lang=1033 # osver=5.1.2600 NT Service Pack 3 # compatibility_mode=5891 16776533 42 87 13760 16593429 0 0 # compatibility_mode=8192 67108863 100 0 176 176 0 0 # scanned=210212 # found=26 # cleaned=0 # scan_time=14889 C:\Documents and Settings\Jivko\Application Data\Sun\Java\Deployment\cache\6.0\15\88743cf-22fbd4d7 a variant of Java/TrojanDownloader.Agent.ME trojan (unable to clean) 00000000000000000000000000000000 I C:\Documents and Settings\Jivko\Desktop\felix.exe Win32/Joke.ScreenMate application (unable to clean) 00000000000000000000000000000000 I C:\Documents and Settings\Jivko\Desktop\cs\Fighter FX 7.2.rar a variant of Win32/GameHack.Q application (unable to clean) 00000000000000000000000000000000 I C:\Documents and Settings\Jivko\Desktop\cs\Fighter FX 7.2\FighterFX.dll a variant of Win32/GameHack.Q application (unable to clean) 00000000000000000000000000000000 I C:\Documents and Settings\Jivko\My Documents\felix.exe Win32/Joke.ScreenMate application (unable to clean) 00000000000000000000000000000000 I C:\Documents and Settings\Jivko\My Documents\Downloads\9_Fighter_FX_7.2.zip a variant of Win32/GameHack.Q application (unable to clean) 00000000000000000000000000000000 I C:\Documents and Settings\Jivko\My Documents\Downloads\felix.rar Win32/Joke.ScreenMate application (unable to clean) 00000000000000000000000000000000 I C:\Documents and Settings\Jivko\My Documents\Downloads\funny_hack_2.0.zip a variant of Win32/HackTool.CheatEngine.AB application (unable to clean) 00000000000000000000000000000000 I C:\Documents and Settings\Jivko\My Documents\Downloads\LFS_S2Z_KeyFileGen.exe a variant of Win32/Keygen.BQ application (unable to clean) 00000000000000000000000000000000 I C:\System Volume Information\_restore{5213DA6D-CD99-41C8-A7CF-A1063443E1F2}\RP371\A0178932.exe Win32/Joke.ScreenMate application (unable to clean) 00000000000000000000000000000000 I E:\Downloads\Live For Speed Z.rar a variant of Win32/Keygen.BQ application (unable to clean) 00000000000000000000000000000000 I E:\Downloads\sa-mp-0.2.1-install.exe probably a variant of Win32/Agent.CGVCIBL trojan (unable to clean) 00000000000000000000000000000000 I E:\Downloads\LDOCE5-2009\Alcohol 120 v1.9.6.4719\keymaker.exe probably a variant of Win32/Agent.CWORLZS trojan (unable to clean) 00000000000000000000000000000000 I E:\Downloads\LfS_S2_Alpha_Y\LFS_S2Z_KeyFileGen.exe a variant of Win32/Keygen.BQ application (unable to clean) 00000000000000000000000000000000 I E:\Downloads\LingvoSoft - Dictionary - Phrasebook - Talking Dictionary\LingvoSoft - Talking Dictionary 2007 v4.0.22 (En to 30 lang)\crk\lingvosoft.dictionary.2007-patch.exe a variant of Win32/HackTool.Patcher.A application (unable to clean) 00000000000000000000000000000000 I E:\Downloads\LingvoSoft.Talking.Dictionary.2007.English.Bulgarian.v4.0.22.WinALL-CHiCNCREAM\lingvosoft.dictionary.2007-patch.exe a variant of Win32/HackTool.Patcher.A application (unable to clean) 00000000000000000000000000000000 I E:\Downloads\Live For Speed Z\LFSZ\LFS_S2X_KeyGen.exe a variant of Win32/Keygen.BQ application (unable to clean) 00000000000000000000000000000000 I E:\Downloads\Live For Speed Z\LFSZ\LFS_S2Z_KeyFileGen.exe a variant of Win32/Keygen.BQ application (unable to clean) 00000000000000000000000000000000 I E:\Downloads\Monopoly 3 - DEViANCE\trainer.exe a variant of Win32/GameHack.G application (unable to clean) 00000000000000000000000000000000 I E:\Downloads\Need for Speed Carbon Collectors Edition - Razor1911\rzr-nfsc.iso probably a variant of Win32/Agent.KUNSSGB trojan (unable to clean) 00000000000000000000000000000000 I E:\Downloads\Need For Speed Most Wanted PC DVD\NFSMWBE PC DVD.ISO a variant of Win32/HackTool.Patcher.A application (unable to clean) 00000000000000000000000000000000 I E:\Downloads\OFFICE_2003_ALL_IN_ONE\OFFICE_2003_ALL_IN_ONE.iso probably a variant of Win32/Agent.CNVAOQK trojan (unable to clean) 00000000000000000000000000000000 I E:\Downloads\Pro.Evolution.Soccer.2012-RELOADED\rld-ps12.iso a variant of Win32/Packed.VMProtect.AAH trojan (unable to clean) 00000000000000000000000000000000 I E:\Downloads\Watery Desktop 3D\Patch.exe a variant of Win32/HackTool.Patcher.T application (unable to clean) 00000000000000000000000000000000 I E:\Games\гта\GTA San Andreas\samp.dll probably a variant of Win32/Agent.CGVCIBL trojan (unable to clean) 00000000000000000000000000000000 I E:\Нова папка\skypelauncher-setup.exe Win32/Toolbar.Zugo application (unable to clean) 00000000000000000000000000000000 I

нещата май започват да се нареждат благодарение на вас. Това е резултата от НОД след чистенето на вирусите: ESETSmartInstaller@High as downloader log: all ok # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6583 # api_version=3.0.2 # EOSSerial=232ba179bb40a84eba8b806309d579e6 # end=finished # remove_checked=false # archives_checked=true # unwanted_checked=true # unsafe_checked=true # antistealth_checked=true # utc_time=2011-10-27 03:44:08 # local_time=2011-10-27 06:44:08 (+0200, FLE Daylight Time) # country="Bulgaria" # lang=1033 # osver=5.1.2600 NT Service Pack 3 # compatibility_mode=5891 16776533 42 87 13760 16593429 0 0 # compatibility_mode=8192 67108863 100 0 176 176 0 0 # scanned=210212 # found=26 # cleaned=0 # scan_time=14889 C:\Documents and Settings\Jivko\Application Data\Sun\Java\Deployment\cache\6.0\15\88743cf-22fbd4d7 a variant of Java/TrojanDownloader.Agent.ME trojan (unable to clean) 00000000000000000000000000000000 I C:\Documents and Settings\Jivko\Desktop\felix.exe Win32/Joke.ScreenMate application (unable to clean) 00000000000000000000000000000000 I C:\Documents and Settings\Jivko\Desktop\cs\Fighter FX 7.2.rar a variant of Win32/GameHack.Q application (unable to clean) 00000000000000000000000000000000 I C:\Documents and Settings\Jivko\Desktop\cs\Fighter FX 7.2\FighterFX.dll a variant of Win32/GameHack.Q application (unable to clean) 00000000000000000000000000000000 I C:\Documents and Settings\Jivko\My Documents\felix.exe Win32/Joke.ScreenMate application (unable to clean) 00000000000000000000000000000000 I C:\Documents and Settings\Jivko\My Documents\Downloads\9_Fighter_FX_7.2.zip a variant of Win32/GameHack.Q application (unable to clean) 00000000000000000000000000000000 I C:\Documents and Settings\Jivko\My Documents\Downloads\felix.rar Win32/Joke.ScreenMate application (unable to clean) 00000000000000000000000000000000 I C:\Documents and Settings\Jivko\My Documents\Downloads\funny_hack_2.0.zip a variant of Win32/HackTool.CheatEngine.AB application (unable to clean) 00000000000000000000000000000000 I C:\Documents and Settings\Jivko\My Documents\Downloads\LFS_S2Z_KeyFileGen.exe a variant of Win32/Keygen.BQ application (unable to clean) 00000000000000000000000000000000 I C:\System Volume Information\_restore{5213DA6D-CD99-41C8-A7CF-A1063443E1F2}\RP371\A0178932.exe Win32/Joke.ScreenMate application (unable to clean) 00000000000000000000000000000000 I E:\Downloads\Live For Speed Z.rar a variant of Win32/Keygen.BQ application (unable to clean) 00000000000000000000000000000000 I E:\Downloads\sa-mp-0.2.1-install.exe probably a variant of Win32/Agent.CGVCIBL trojan (unable to clean) 00000000000000000000000000000000 I E:\Downloads\LDOCE5-2009\Alcohol 120 v1.9.6.4719\keymaker.exe probably a variant of Win32/Agent.CWORLZS trojan (unable to clean) 00000000000000000000000000000000 I E:\Downloads\LfS_S2_Alpha_Y\LFS_S2Z_KeyFileGen.exe a variant of Win32/Keygen.BQ application (unable to clean) 00000000000000000000000000000000 I E:\Downloads\LingvoSoft - Dictionary - Phrasebook - Talking Dictionary\LingvoSoft - Talking Dictionary 2007 v4.0.22 (En to 30 lang)\crk\lingvosoft.dictionary.2007-patch.exe a variant of Win32/HackTool.Patcher.A application (unable to clean) 00000000000000000000000000000000 I E:\Downloads\LingvoSoft.Talking.Dictionary.2007.English.Bulgarian.v4.0.22.WinALL-CHiCNCREAM\lingvosoft.dictionary.2007-patch.exe a variant of Win32/HackTool.Patcher.A application (unable to clean) 00000000000000000000000000000000 I E:\Downloads\Live For Speed Z\LFSZ\LFS_S2X_KeyGen.exe a variant of Win32/Keygen.BQ application (unable to clean) 00000000000000000000000000000000 I E:\Downloads\Live For Speed Z\LFSZ\LFS_S2Z_KeyFileGen.exe a variant of Win32/Keygen.BQ application (unable to clean) 00000000000000000000000000000000 I E:\Downloads\Monopoly 3 - DEViANCE\trainer.exe a variant of Win32/GameHack.G application (unable to clean) 00000000000000000000000000000000 I E:\Downloads\Need for Speed Carbon Collectors Edition - Razor1911\rzr-nfsc.iso probably a variant of Win32/Agent.KUNSSGB trojan (unable to clean) 00000000000000000000000000000000 I E:\Downloads\Need For Speed Most Wanted PC DVD\NFSMWBE PC DVD.ISO a variant of Win32/HackTool.Patcher.A application (unable to clean) 00000000000000000000000000000000 I E:\Downloads\OFFICE_2003_ALL_IN_ONE\OFFICE_2003_ALL_IN_ONE.iso probably a variant of Win32/Agent.CNVAOQK trojan (unable to clean) 00000000000000000000000000000000 I E:\Downloads\Pro.Evolution.Soccer.2012-RELOADED\rld-ps12.iso a variant of Win32/Packed.VMProtect.AAH trojan (unable to clean) 00000000000000000000000000000000 I E:\Downloads\Watery Desktop 3D\Patch.exe a variant of Win32/HackTool.Patcher.T application (unable to clean) 00000000000000000000000000000000 I E:\Games\гта\GTA San Andreas\samp.dll probably a variant of Win32/Agent.CGVCIBL trojan (unable to clean) 00000000000000000000000000000000 I E:\Нова папка\skypelauncher-setup.exe Win32/Toolbar.Zugo application (unable to clean) 00000000000000000000000000000000 I ESETSmartInstaller@High as downloader log: all ok # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6583 # api_version=3.0.2 # EOSSerial=232ba179bb40a84eba8b806309d579e6 # end=finished # remove_checked=true # archives_checked=true # unwanted_checked=true # unsafe_checked=true # antistealth_checked=true # utc_time=2011-10-27 10:39:55 # local_time=2011-10-28 01:39:55 (+0200, FLE Daylight Time) # country="Bulgaria" # lang=1033 # osver=5.1.2600 NT Service Pack 3 # compatibility_mode=5891 16776533 42 87 29093 16608762 0 0 # compatibility_mode=8192 67108863 100 0 15509 15509 0 0 # scanned=210349 # found=28 # cleaned=28 # scan_time=24502 C:\Documents and Settings\Jivko\Application Data\Sun\Java\Deployment\cache\6.0\15\88743cf-22fbd4d7 a variant of Java/TrojanDownloader.Agent.ME trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\Documents and Settings\Jivko\Desktop\felix.exe Win32/Joke.ScreenMate application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\Documents and Settings\Jivko\Desktop\cs\Fighter FX 7.2.rar a variant of Win32/GameHack.Q application (deleted - quarantined) 00000000000000000000000000000000 C C:\Documents and Settings\Jivko\Desktop\cs\Fighter FX 7.2\FighterFX.dll a variant of Win32/GameHack.Q application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\Documents and Settings\Jivko\My Documents\felix.exe Win32/Joke.ScreenMate application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\Documents and Settings\Jivko\My Documents\Downloads\9_Fighter_FX_7.2.zip a variant of Win32/GameHack.Q application (deleted - quarantined) 00000000000000000000000000000000 C C:\Documents and Settings\Jivko\My Documents\Downloads\felix.rar Win32/Joke.ScreenMate application (deleted - quarantined) 00000000000000000000000000000000 C C:\Documents and Settings\Jivko\My Documents\Downloads\funny_hack_2.0.zip a variant of Win32/HackTool.CheatEngine.AB application (deleted - quarantined) 00000000000000000000000000000000 C C:\Documents and Settings\Jivko\My Documents\Downloads\LFS_S2Z_KeyFileGen.exe a variant of Win32/Keygen.BQ application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\System Volume Information\_restore{5213DA6D-CD99-41C8-A7CF-A1063443E1F2}\RP371\A0178932.exe Win32/Joke.ScreenMate application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\System Volume Information\_restore{5213DA6D-CD99-41C8-A7CF-A1063443E1F2}\RP395\A0189590.exe Win32/Joke.ScreenMate application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\System Volume Information\_restore{5213DA6D-CD99-41C8-A7CF-A1063443E1F2}\RP395\A0189591.dll a variant of Win32/GameHack.Q application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C E:\Downloads\Live For Speed Z.rar a variant of Win32/Keygen.BQ application (deleted - quarantined) 00000000000000000000000000000000 C E:\Downloads\sa-mp-0.2.1-install.exe probably a variant of Win32/Agent.CGVCIBL trojan (deleted - quarantined) 00000000000000000000000000000000 C E:\Downloads\LDOCE5-2009\Alcohol 120 v1.9.6.4719\keymaker.exe probably a variant of Win32/Agent.CWORLZS trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C E:\Downloads\LfS_S2_Alpha_Y\LFS_S2Z_KeyFileGen.exe a variant of Win32/Keygen.BQ application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C E:\Downloads\LingvoSoft - Dictionary - Phrasebook - Talking Dictionary\LingvoSoft - Talking Dictionary 2007 v4.0.22 (En to 30 lang)\crk\lingvosoft.dictionary.2007-patch.exe a variant of Win32/HackTool.Patcher.A application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C E:\Downloads\LingvoSoft.Talking.Dictionary.2007.English.Bulgarian.v4.0.22.WinALL-CHiCNCREAM\lingvosoft.dictionary.2007-patch.exe a variant of Win32/HackTool.Patcher.A application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C E:\Downloads\Live For Speed Z\LFSZ\LFS_S2X_KeyGen.exe a variant of Win32/Keygen.BQ application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C E:\Downloads\Live For Speed Z\LFSZ\LFS_S2Z_KeyFileGen.exe a variant of Win32/Keygen.BQ application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C E:\Downloads\Monopoly 3 - DEViANCE\trainer.exe a variant of Win32/GameHack.G application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C E:\Downloads\Need for Speed Carbon Collectors Edition - Razor1911\rzr-nfsc.iso probably a variant of Win32/Agent.KUNSSGB trojan (deleted - quarantined) 00000000000000000000000000000000 C E:\Downloads\Need For Speed Most Wanted PC DVD\NFSMWBE PC DVD.ISO a variant of Win32/HackTool.Patcher.A application (deleted - quarantined) 00000000000000000000000000000000 C E:\Downloads\OFFICE_2003_ALL_IN_ONE\OFFICE_2003_ALL_IN_ONE.iso probably a variant of Win32/Agent.CNVAOQK trojan (deleted - quarantined) 00000000000000000000000000000000 C E:\Downloads\Pro.Evolution.Soccer.2012-RELOADED\rld-ps12.iso a variant of Win32/Packed.VMProtect.AAH trojan (deleted) 00000000000000000000000000000000 C E:\Downloads\Watery Desktop 3D\Patch.exe a variant of Win32/HackTool.Patcher.T application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C E:\Games\гта\GTA San Andreas\samp.dll probably a variant of Win32/Agent.CGVCIBL trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C E:\Нова папка\skypelauncher-setup.exe Win32/Toolbar.Zugo application (deleted - quarantined) 00000000000000000000000000000000 C Сега съм пуснала ново сканиране но за сега резултата е 0 вируси дано се задържи така до края че нещо бавно става ето това е резултата от последното сканиране: ESETSmartInstaller@High as downloader log: all ok # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6583 # api_version=3.0.2 # EOSSerial=232ba179bb40a84eba8b806309d579e6 # end=finished # remove_checked=false # archives_checked=true # unwanted_checked=true # unsafe_checked=true # antistealth_checked=true # utc_time=2011-10-27 03:44:08 # local_time=2011-10-27 06:44:08 (+0200, FLE Daylight Time) # country="Bulgaria" # lang=1033 # osver=5.1.2600 NT Service Pack 3 # compatibility_mode=5891 16776533 42 87 13760 16593429 0 0 # compatibility_mode=8192 67108863 100 0 176 176 0 0 # scanned=210212 # found=26 # cleaned=0 # scan_time=14889 C:\Documents and Settings\Jivko\Application Data\Sun\Java\Deployment\cache\6.0\15\88743cf-22fbd4d7 a variant of Java/TrojanDownloader.Agent.ME trojan (unable to clean) 00000000000000000000000000000000 I C:\Documents and Settings\Jivko\Desktop\felix.exe Win32/Joke.ScreenMate application (unable to clean) 00000000000000000000000000000000 I C:\Documents and Settings\Jivko\Desktop\cs\Fighter FX 7.2.rar a variant of Win32/GameHack.Q application (unable to clean) 00000000000000000000000000000000 I C:\Documents and Settings\Jivko\Desktop\cs\Fighter FX 7.2\FighterFX.dll a variant of Win32/GameHack.Q application (unable to clean) 00000000000000000000000000000000 I C:\Documents and Settings\Jivko\My Documents\felix.exe Win32/Joke.ScreenMate application (unable to clean) 00000000000000000000000000000000 I C:\Documents and Settings\Jivko\My Documents\Downloads\9_Fighter_FX_7.2.zip a variant of Win32/GameHack.Q application (unable to clean) 00000000000000000000000000000000 I C:\Documents and Settings\Jivko\My Documents\Downloads\felix.rar Win32/Joke.ScreenMate application (unable to clean) 00000000000000000000000000000000 I C:\Documents and Settings\Jivko\My Documents\Downloads\funny_hack_2.0.zip a variant of Win32/HackTool.CheatEngine.AB application (unable to clean) 00000000000000000000000000000000 I C:\Documents and Settings\Jivko\My Documents\Downloads\LFS_S2Z_KeyFileGen.exe a variant of Win32/Keygen.BQ application (unable to clean) 00000000000000000000000000000000 I C:\System Volume Information\_restore{5213DA6D-CD99-41C8-A7CF-A1063443E1F2}\RP371\A0178932.exe Win32/Joke.ScreenMate application (unable to clean) 00000000000000000000000000000000 I E:\Downloads\Live For Speed Z.rar a variant of Win32/Keygen.BQ application (unable to clean) 00000000000000000000000000000000 I E:\Downloads\sa-mp-0.2.1-install.exe probably a variant of Win32/Agent.CGVCIBL trojan (unable to clean) 00000000000000000000000000000000 I E:\Downloads\LDOCE5-2009\Alcohol 120 v1.9.6.4719\keymaker.exe probably a variant of Win32/Agent.CWORLZS trojan (unable to clean) 00000000000000000000000000000000 I E:\Downloads\LfS_S2_Alpha_Y\LFS_S2Z_KeyFileGen.exe a variant of Win32/Keygen.BQ application (unable to clean) 00000000000000000000000000000000 I E:\Downloads\LingvoSoft - Dictionary - Phrasebook - Talking Dictionary\LingvoSoft - Talking Dictionary 2007 v4.0.22 (En to 30 lang)\crk\lingvosoft.dictionary.2007-patch.exe a variant of Win32/HackTool.Patcher.A application (unable to clean) 00000000000000000000000000000000 I E:\Downloads\LingvoSoft.Talking.Dictionary.2007.English.Bulgarian.v4.0.22.WinALL-CHiCNCREAM\lingvosoft.dictionary.2007-patch.exe a variant of Win32/HackTool.Patcher.A application (unable to clean) 00000000000000000000000000000000 I E:\Downloads\Live For Speed Z\LFSZ\LFS_S2X_KeyGen.exe a variant of Win32/Keygen.BQ application (unable to clean) 00000000000000000000000000000000 I E:\Downloads\Live For Speed Z\LFSZ\LFS_S2Z_KeyFileGen.exe a variant of Win32/Keygen.BQ application (unable to clean) 00000000000000000000000000000000 I E:\Downloads\Monopoly 3 - DEViANCE\trainer.exe a variant of Win32/GameHack.G application (unable to clean) 00000000000000000000000000000000 I E:\Downloads\Need for Speed Carbon Collectors Edition - Razor1911\rzr-nfsc.iso probably a variant of Win32/Agent.KUNSSGB trojan (unable to clean) 00000000000000000000000000000000 I E:\Downloads\Need For Speed Most Wanted PC DVD\NFSMWBE PC DVD.ISO a variant of Win32/HackTool.Patcher.A application (unable to clean) 00000000000000000000000000000000 I E:\Downloads\OFFICE_2003_ALL_IN_ONE\OFFICE_2003_ALL_IN_ONE.iso probably a variant of Win32/Agent.CNVAOQK trojan (unable to clean) 00000000000000000000000000000000 I E:\Downloads\Pro.Evolution.Soccer.2012-RELOADED\rld-ps12.iso a variant of Win32/Packed.VMProtect.AAH trojan (unable to clean) 00000000000000000000000000000000 I E:\Downloads\Watery Desktop 3D\Patch.exe a variant of Win32/HackTool.Patcher.T application (unable to clean) 00000000000000000000000000000000 I E:\Games\гта\GTA San Andreas\samp.dll probably a variant of Win32/Agent.CGVCIBL trojan (unable to clean) 00000000000000000000000000000000 I E:\Нова папка\skypelauncher-setup.exe Win32/Toolbar.Zugo application (unable to clean) 00000000000000000000000000000000 I ESETSmartInstaller@High as downloader log: all ok # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6583 # api_version=3.0.2 # EOSSerial=232ba179bb40a84eba8b806309d579e6 # end=finished # remove_checked=true # archives_checked=true # unwanted_checked=true # unsafe_checked=true # antistealth_checked=true # utc_time=2011-10-27 10:39:55 # local_time=2011-10-28 01:39:55 (+0200, FLE Daylight Time) # country="Bulgaria" # lang=1033 # osver=5.1.2600 NT Service Pack 3 # compatibility_mode=5891 16776533 42 87 29093 16608762 0 0 # compatibility_mode=8192 67108863 100 0 15509 15509 0 0 # scanned=210349 # found=28 # cleaned=28 # scan_time=24502 C:\Documents and Settings\Jivko\Application Data\Sun\Java\Deployment\cache\6.0\15\88743cf-22fbd4d7 a variant of Java/TrojanDownloader.Agent.ME trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\Documents and Settings\Jivko\Desktop\felix.exe Win32/Joke.ScreenMate application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\Documents and Settings\Jivko\Desktop\cs\Fighter FX 7.2.rar a variant of Win32/GameHack.Q application (deleted - quarantined) 00000000000000000000000000000000 C C:\Documents and Settings\Jivko\Desktop\cs\Fighter FX 7.2\FighterFX.dll a variant of Win32/GameHack.Q application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\Documents and Settings\Jivko\My Documents\felix.exe Win32/Joke.ScreenMate application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\Documents and Settings\Jivko\My Documents\Downloads\9_Fighter_FX_7.2.zip a variant of Win32/GameHack.Q application (deleted - quarantined) 00000000000000000000000000000000 C C:\Documents and Settings\Jivko\My Documents\Downloads\felix.rar Win32/Joke.ScreenMate application (deleted - quarantined) 00000000000000000000000000000000 C C:\Documents and Settings\Jivko\My Documents\Downloads\funny_hack_2.0.zip a variant of Win32/HackTool.CheatEngine.AB application (deleted - quarantined) 00000000000000000000000000000000 C C:\Documents and Settings\Jivko\My Documents\Downloads\LFS_S2Z_KeyFileGen.exe a variant of Win32/Keygen.BQ application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\System Volume Information\_restore{5213DA6D-CD99-41C8-A7CF-A1063443E1F2}\RP371\A0178932.exe Win32/Joke.ScreenMate application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\System Volume Information\_restore{5213DA6D-CD99-41C8-A7CF-A1063443E1F2}\RP395\A0189590.exe Win32/Joke.ScreenMate application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\System Volume Information\_restore{5213DA6D-CD99-41C8-A7CF-A1063443E1F2}\RP395\A0189591.dll a variant of Win32/GameHack.Q application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C E:\Downloads\Live For Speed Z.rar a variant of Win32/Keygen.BQ application (deleted - quarantined) 00000000000000000000000000000000 C E:\Downloads\sa-mp-0.2.1-install.exe probably a variant of Win32/Agent.CGVCIBL trojan (deleted - quarantined) 00000000000000000000000000000000 C E:\Downloads\LDOCE5-2009\Alcohol 120 v1.9.6.4719\keymaker.exe probably a variant of Win32/Agent.CWORLZS trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C E:\Downloads\LfS_S2_Alpha_Y\LFS_S2Z_KeyFileGen.exe a variant of Win32/Keygen.BQ application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C E:\Downloads\LingvoSoft - Dictionary - Phrasebook - Talking Dictionary\LingvoSoft - Talking Dictionary 2007 v4.0.22 (En to 30 lang)\crk\lingvosoft.dictionary.2007-patch.exe a variant of Win32/HackTool.Patcher.A application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C E:\Downloads\LingvoSoft.Talking.Dictionary.2007.English.Bulgarian.v4.0.22.WinALL-CHiCNCREAM\lingvosoft.dictionary.2007-patch.exe a variant of Win32/HackTool.Patcher.A application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C E:\Downloads\Live For Speed Z\LFSZ\LFS_S2X_KeyGen.exe a variant of Win32/Keygen.BQ application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C E:\Downloads\Live For Speed Z\LFSZ\LFS_S2Z_KeyFileGen.exe a variant of Win32/Keygen.BQ application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C E:\Downloads\Monopoly 3 - DEViANCE\trainer.exe a variant of Win32/GameHack.G application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C E:\Downloads\Need for Speed Carbon Collectors Edition - Razor1911\rzr-nfsc.iso probably a variant of Win32/Agent.KUNSSGB trojan (deleted - quarantined) 00000000000000000000000000000000 C E:\Downloads\Need For Speed Most Wanted PC DVD\NFSMWBE PC DVD.ISO a variant of Win32/HackTool.Patcher.A application (deleted - quarantined) 00000000000000000000000000000000 C E:\Downloads\OFFICE_2003_ALL_IN_ONE\OFFICE_2003_ALL_IN_ONE.iso probably a variant of Win32/Agent.CNVAOQK trojan (deleted - quarantined) 00000000000000000000000000000000 C E:\Downloads\Pro.Evolution.Soccer.2012-RELOADED\rld-ps12.iso a variant of Win32/Packed.VMProtect.AAH trojan (deleted) 00000000000000000000000000000000 C E:\Downloads\Watery Desktop 3D\Patch.exe a variant of Win32/HackTool.Patcher.T application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C E:\Games\гта\GTA San Andreas\samp.dll probably a variant of Win32/Agent.CGVCIBL trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C E:\Нова папка\skypelauncher-setup.exe Win32/Toolbar.Zugo application (deleted - quarantined) 00000000000000000000000000000000 C ESETSmartInstaller@High as downloader log: all ok # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6583 # api_version=3.0.2 # EOSSerial=232ba179bb40a84eba8b806309d579e6 # end=finished # remove_checked=true # archives_checked=true # unwanted_checked=true # unsafe_checked=true # antistealth_checked=true # utc_time=2011-10-28 06:16:04 # local_time=2011-10-28 09:16:04 (+0200, FLE Daylight Time) # country="Bulgaria" # lang=1033 # osver=5.1.2600 NT Service Pack 3 # compatibility_mode=5891 16776533 42 87 60479 16640148 0 0 # compatibility_mode=8192 67108863 100 0 46895 46895 0 0 # scanned=202724 # found=0 # cleaned=0 # scan_time=20486 чакам по-нататъшни инструкции

Следва:

1. Направете скан с DDS и прикачете файла Extras.txt в следващия си коментар.

2. Деинсталирайте ComboFix:

Start → Run → Копирайте (copy) и поставете (Paste) следния текст, маркиран в синьо:

Combofix /Uninstall

после OK

3.Изтеглете OTCleanIt , стартирайте го и натиснете CleanUp

Деинсталирайте ESET Online Scanner и ако има останали програми и логове, които използвахме в темата, може да ги изтриете. Препоръчвам да оставите Malwarebytes' Anti-Malware за периодично сканиране.

Проверете дали антивирусната и останалите програми работят нормално, също така вижте за проблеми с драйверите в Device Manager.

направих всичко което сте написал, прикачвам двата файла от ДДС, антивирусната на майкрософ работи нормално, не намира никакви вируси, оставям другата програма за сканиране (тя също не намира нищо) И искам да ви кажа едно огромно БЛАГОДАРЯ на теб и на целия Ви екип, които се грижите за нашите компютри. Нещо мога ли да направя в замяна за помощта ВИ?

Благодаря за пожеланията. След като няма повече оплаквания от Windows, маркирам проблема като решен. Приятна вечер и успех!