Премини към съдържанието
Форумът в приложение

По-лесно сърфиране. Научи повече.
Kaldata.com - Форуми

Приложение на форума на цял екран с push известия, значки и други.

За да инсталирате това приложение на iOS и iPadOS
  1. Докоснете Иконата за споделяне в Safari
  2. Превъртете менюто и докоснете Добавяне към началния екран.
  3. Докоснете Добавяне в горния десен ъгъл.
За да инсталирате това приложение на Android
  1. Докоснете менюто с 3 точки (⋮) в горния десен ъгъл на браузъра.
  2. Докоснете Добавяне към началния екран или Инсталиране на приложение.
  3. Потвърдете, като докоснете Инсталиране.
Добави Kaldata.com в предпочитани източници в Google

Добре дошли!

Добре дошли в нашите форуми, пълни с полезна информация. Имате проблем с компютъра или телефона си? Публикувайте нова тема и ще намерите решение на всичките си проблеми. Общувайте свободно и открийте безброй нови приятели.

Моля, регистрирайте се за да публикувате тема и да получите пълен достъп до всички функции.

 

Няколко вируса в компютъра ми [РЕШЕН]

pwnflakes
в Премахване на зловреден софтуер

Featured Replies

Добър вечер! От 3 дена имам проблеми с компютъра, или по-точно с интернета ми. Проблема е следния: Когато включа или рестартирам компютъра си, интернета ми върви нормално (успявам да влизам в сайтове) около 2 минути след като е включен компютъра ми, едва успявам да вляза в даден сайт, дори изобщо не ми позволява. Skype ми работи между другото. Нямам идея от къде бих могъл да съм се заразил. Антивирусна програма имах (AVG), но поради някаква причина спря да работи. Пробвах с Avira, намира ми вирусите, но не ми дава да ги премахна. А ето и резултата от DDS. - DDS . DDS (Ver_2011-08-26.01) - NTFSx86 Internet Explorer: 6.0.2900.5512 Run by iP at 18:08:58 on 2011-11-05 Microsoft Windows XP Professional 5.1.2600.3.1251.359.1033.18.2046.1456 [GMT 2:00] . AV: AVG Anti-Virus Free Edition 2011 *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF} . ============== Running Processes =============== . C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\UnsignedThemesSvc.exe svchost.exe C:\WINDOWS\explorer.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\1596432654:4049524896.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbarsrv.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Pando Networks\Media Booster\PMB.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\DAEMON Tools Lite\DTLite.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe C:\Documents and Settings\iP\Application Data\Dropbox\bin\Dropbox.exe C:\Program Files\GIGABYTE\Gamer HUD Lite\HUD.exe C:\WINDOWS\System32\svchost.exe -k Akamai C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Skype\Plugin Manager\skypePM.exe "C:\WINDOWS\system32\svchost.exe" . ============== Pseudo HJT Report =============== . uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2776682 mDefault_Page_URL = hxxp://www.yahoo.com mStart Page = hxxp://home.sweetim.com uInternet Connection Wizard,ShellNext = iexplore uInternet Settings,ProxyServer = http=;ftp=;https=; mSearchAssistant = hxxp://search.babylon.com/?babsrc=SP_ss&q={searchTerms}&mntrId=6cc4eef600000000000000241d149bc8&tlver=1.4.19.19&ss=1&affID=17981 uURLSearchHooks: DeviceVM Url Search Hook: {0063bf63-bfff-4b8f-9d26-4267df7f17dd} - c:\windows\system32\dvmurl.dll uURLSearchHooks: BrotherSoft Extreme Toolbar: {51a86bb3-6602-4c85-92a5-130ee4864f13} - c:\program files\brothersoft_extreme\prxtbBrot.dll uURLSearchHooks: SweetIM ToolbarURLSearchHook Class: {eee6c35d-6118-11dc-9c72-001320c79847} - c:\program files\sweetim\toolbars\internet explorer\mgHelper.dll mURLSearchHooks: SweetIM ToolbarURLSearchHook Class: {eee6c35d-6118-11dc-9c72-001320c79847} - c:\program files\sweetim\toolbars\internet explorer\mgHelper.dll uWinlogon: Shell=c:\documents and settings\ip\local settings\application data\0ea1275f\X BHO: Yahoo! Companion BHO: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\ycomp5_6_2_0.dll BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: CescrtHlpr Object: {2eecd738-5844-4a99-b4b6-146bf802613b} - c:\program files\babylontoolbar\babylontoolbar\1.4.19.19\bh\BabylonToolbar.dll BHO: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\prxConduitEngine.dll BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg10\avgssie.dll BHO: BrotherSoft Extreme Toolbar: {51a86bb3-6602-4c85-92a5-130ee4864f13} - c:\program files\brothersoft_extreme\prxtbBrot.dll BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll BHO: SweetIM Toolbar Helper: {eee6c35c-6118-11dc-9c72-001320c79847} - c:\program files\sweetim\toolbars\internet explorer\mgToolbarIE.dll BHO: TBSB08577 Class: {fcbccb87-9224-4b8d-b117-f56d924beb18} - c:\program files\william hill toolbar\tbcore3.dll TB: &Yahoo! Companion: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\ycomp5_6_2_0.dll TB: BrotherSoft Extreme Toolbar: {51a86bb3-6602-4c85-92a5-130ee4864f13} - c:\program files\brothersoft_extreme\prxtbBrot.dll TB: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\prxConduitEngine.dll TB: WilliamHill Toolbar: {3c4a28a6-35d6-482d-8a9e-ffc843e00bb6} - c:\program files\william hill toolbar\tbcore3.dll TB: Babylon Toolbar: {98889811-442d-49dd-99d7-dc866be87dbc} - c:\program files\babylontoolbar\babylontoolbar\1.4.19.19\BabylonToolbarTlbr.dll TB: SweetIM Toolbar for Internet Explorer: {eee6c35b-6118-11dc-9c72-001320c79847} - c:\program files\sweetim\toolbars\internet explorer\mgToolbarIE.dll uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe uRun: [Google Update] "c:\documents and settings\ip\local settings\application data\google\update\GoogleUpdate.exe" /c uRun: [spyware Doctor with AntiVirus] c:\documents and settings\ip\desktop\sdasetup_aff.exe -min uRun: [Pando Media Booster] c:\program files\pando networks\media booster\PMB.exe uRun: [Easy-Hide-IP] c:\program files\easy-hide-ip\easy-hide-ip.exe uRun: [skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized uRun: [msnmsgr] ~"c:\program files\windows live\messenger\msnmsgr.exe" /background uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background uRun: [Overwolf] c:\program files\overwolf\Overwolf.exe -silent uRun: [DAEMON Tools Lite] "c:\program files\daemon tools lite\DTLite.exe" -autorun mRun: [startCCC] "c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe" MSRun mRun: [RTHDCPL] RTHDCPL.EXE mRun: [Alcmtr] ALCMTR.EXE mRun: [GEST] ] mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe" mRun: [AVG_TRAY] c:\program files\avg\avg10\avgtray.exe mRun: [babylonToolbar] "c:\program files\babylontoolbar\babylontoolbar\1.4.19.19\BabylonToolbarsrv.exe" /md I mRun: [sweetIM] c:\program files\sweetim\messenger\SweetIM.exe mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\AppleSyncNotifier.exe mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe" mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe" mRun: [AdobeAAMUpdater-1.0] "c:\program files\common files\adobe\oobe\pdapp\uwa\UpdaterStartupUtility.exe" mRun: [switchBoard] c:\program files\common files\adobe\switchboard\SwitchBoard.exe mRun: [AdobeCS5.5ServiceManager] "c:\program files\common files\adobe\cs5.5servicemanager\CS5.5ServiceManager.exe" -launchedbylogin mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE StartupFolder: c:\docume~1\ip\startm~1\programs\startup\dropbox.lnk - c:\documents and settings\ip\application data\dropbox\bin\Dropbox.exe StartupFolder: c:\docume~1\ip\startm~1\programs\startup\gigaby~1.lnk - c:\program files\gigabyte\gamer hud lite\HUD.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000 IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - c:\program files\pokerstars.net\PokerStarsUpdate.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {3C4A28A6-35D6-482D-8A9E-FFC843E00BB6} - {3C4A28A6-35D6-482D-8A9E-FFC843E00BB6} - c:\program files\william hill toolbar\tbcore3.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL LSP: mswsock.dll DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab TCP: DhcpNameServer = 212.116.128.2 212.116.136.2 TCP: Interfaces\{C6B00F76-804D-4855-A3BB-18434ED8A815} : DhcpNameServer = 212.116.128.2 212.116.136.2 Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - Notify: AtiExtEvent - Ati2evxx.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll Hosts: 86.127.71.45 L2authd.lineage2.com ============= SERVICES / DRIVERS =============== . R1 archlp;archlp;c:\windows\system32\drivers\ArcHlp.sys [2009-2-19 127744] R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\drivers\dtsoftbus01.sys [2011-9-27 232512] R2 Akamai;Akamai NetSession Interface;c:\windows\system32\svchost.exe -k Akamai [2008-4-14 14336] R2 GEST Service;GEST Service for program management.;c:\program files\gigabyte\energysaver\GSvr.exe [2011-4-25 70284] R2 UnsignedThemes;Unsigned Themes;c:\windows\UnsignedThemesSvc.exe [2009-7-13 9244] R2 uxpatch;uxpatch;c:\windows\system32\drivers\uxpatch.sys [2009-7-13 25448] S0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\avgidseh.sys --> c:\windows\system32\drivers\AVGIDSEH.Sys [?] S0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys --> c:\windows\system32\drivers\avgrkx86.sys [?] S0 nielprt;Nielsen Patch Service;c:\windows\system32\drivers\nielprt.sys --> c:\windows\system32\drivers\nielprt.sys [?] S1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys --> c:\windows\system32\drivers\avgldx86.sys [?] S1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\drivers\avgmfx86.sys --> c:\windows\system32\drivers\avgmfx86.sys [?] S1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys --> c:\windows\system32\drivers\avgtdix.sys [?] S2 AVGIDSAgent;AVGIDSAgent;"c:\program files\avg\avg10\identity protection\agent\bin\avgidsagent.exe" --> c:\program files\avg\avg10\identity protection\agent\bin\AVGIDSAgent.exe [?] S2 avgwd;AVG WatchDog;"c:\program files\avg\avg10\avgwdsvc.exe" --> c:\program files\avg\avg10\avgwdsvc.exe [?] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\avgidsdriver.sys --> c:\windows\system32\drivers\AVGIDSDriver.Sys [?] S3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\avgidsfilter.sys --> c:\windows\system32\drivers\AVGIDSFilter.Sys [?] S3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\avgidsshim.sys --> c:\windows\system32\drivers\AVGIDSShim.Sys [?] S3 dump_wmimmc;dump_wmimmc;\??\d:\games\кабал онлайн\gameguard\dump_wmimmc.sys --> d:\games\кабал онлайн\gameguard\dump_wmimmc.sys [?] S3 NielGfx;Nielsen USB GFX;c:\windows\system32\drivers\nielgfx.sys --> c:\windows\system32\drivers\nielgfx.sys [?] S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\gamemon.des -service --> c:\windows\system32\GameMon.des -service [?] S3 SwitchBoard;SwitchBoard;c:\program files\common files\adobe\switchboard\SwitchBoard.exe [2010-2-19 517096] S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504] S3 XDva385;XDva385;\??\c:\windows\system32\xdva385.sys --> c:\windows\system32\XDva385.sys [?] . =============== Created Last 30 ================ . 2011-11-05 08:43:39 48016 --sha-w- c:\windows\system32\c_66485.nl_ 2011-11-05 08:40:14 -------- d-----w- c:\windows\system32\NtmsData 2011-11-05 08:36:41 -------- d-----w- c:\documents and settings\all users\application data\Avira 2011-11-04 18:44:49 -------- d-----w- c:\program files\Games-Masters.com 2011-11-03 13:27:18 -------- d-sh--w- c:\documents and settings\ip\local settings\application data\0ea1275f 2011-11-02 16:18:05 -------- d-----w- c:\program files\NatureTreks Healing With Color 2011-11-01 06:38:08 -------- d-----w- c:\documents and settings\all users\application data\regid.1986-12.com.adobe 2011-10-31 12:47:32 -------- d-----w- c:\documents and settings\ip\application data\com.adobe.downloadassistant.AdobeDownloadAssistant 2011-10-31 12:47:26 -------- d-----w- c:\program files\Adobe Download Assistant 2011-10-13 12:51:05 -------- d-----w- c:\documents and settings\ip\application data\LogoMaker 2011-10-13 12:48:21 -------- d-----w- c:\program files\Studio V5 2011-10-12 09:32:53 -------- d-----w- c:\documents and settings\ip\local settings\application data\Rockstar Games 2011-10-12 09:26:35 -------- d-sh--w- c:\documents and settings\all users\application data\SecuROM 2011-10-12 09:22:29 276992 ------w- c:\windows\system32\audiodev.dll 2011-10-12 09:21:44 -------- d-----w- c:\windows\system32\xlive 2011-10-12 09:21:43 -------- d-----w- c:\program files\Microsoft Games for Windows - LIVE 2011-10-11 09:53:07 -------- d-----w- c:\program files\MSXML 4.0 . ==================== Find3M ==================== . 2011-11-05 16:04:59 16608 ----a-w- c:\windows\gdrv.sys 2011-11-04 15:49:19 9244 ----a-w- c:\windows\UnsignedThemesSvc.exe 2011-11-04 15:49:19 76744 ----a-w- c:\windows\system32\PnkBstrA.exe 2011-11-04 15:48:52 579128 ----a-w- c:\windows\system32\ati2evxx.exe 2011-09-27 13:47:12 232512 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys 2011-09-26 08:41:20 611328 ----a-w- c:\windows\system32\uiautomationcore.dll 2011-09-26 08:41:20 220160 ----a-w- c:\windows\system32\oleacc.dll 2011-09-26 08:41:14 20480 ----a-w- c:\windows\system32\oleaccrc.dll 2011-09-09 09:12:13 599040 ----a-w- c:\windows\system32\crypt32.dll 2011-09-07 19:39:40 281760 ----a-w- c:\windows\system32\drivers\atksgt.sys 2011-09-07 19:39:40 25888 ----a-w- c:\windows\system32\drivers\lirsgt.sys 2011-09-06 13:25:11 1867904 ----a-w- c:\windows\system32\win32k.sys 2011-09-05 13:54:47 668672 ----a-w- c:\windows\system32\wininet.dll 2011-09-05 13:54:47 61952 ----a-w- c:\windows\system32\tdc.ocx 2011-09-05 13:54:46 81920 ----a-w- c:\windows\system32\ieencode.dll 2011-09-05 12:48:25 369664 ----a-w- c:\windows\system32\html.iec 2011-08-27 18:44:27 73728 ----a-w- c:\windows\system32\javacpl.cpl 2011-08-27 18:44:26 472808 ----a-w- c:\windows\system32\deployJava1.dll 2011-08-17 13:41:46 138496 ----a-w- c:\windows\system32\drivers\afd.sys 2011-08-12 10:51:26 26488 ----a-w- c:\windows\system32\spupdsvc.exe 2011-08-10 20:05:24 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl . ============= FINISH: 18:09:25,79 =============== Благодаря ви предварително!

Attach.zip

Здравейте..!Вашата система е сериозно заразена...мога да ви помогна ако бъдете търпелив..ще имаме доста работа..!:)

Започваме..:

Публикувано изображение Изтеглете ComboFix Публикувано изображение от тук или тук и го запазете на десктопа си.

  • Изключете вашата антивирусна и антишпионска програма, обикновено това става чрез натискане на десния бутон на мишката върху иконата на програма в системния трей.
Бележка: Ако не можете я спрете или не сте сигурни коя програма да изключите, моля прегледайте информацията от този линк: How to Disable your Security Programs
  • Стартирайте Combo-Fix.com Публикувано изображение и следвайте инструкциите.
Бележка: ComboFix ще се стартира без инсталирана Recovery Console.
  • Като част от неговата работа, ComboFix ще провери дали Microsoft Windows Recovery Console е инсталирана. Предвид бързо развиващия се зловреден софтуер е силно препоръчително да бъде инсталирана преди премахването на зловредния софтуер. Това ще Ви позволи да влезете в специален recovery/repair режим, който ще ни позволи по-лесно да решите проблем, който би могъл да възникне при премахване на зловредния софтуер.
  • Следвайте инструкциите, за да позволите на ComboFix да изтегли и инсталира Microsoft Windows Recovery Console. В един момент ще бъдете попитани дали сте съгласни с лицензното споразумение. Необходимо е да потвърдите, че сте съгласни, за да инсталирате Microsoft Windows Recovery Console.
** Забележете: Ако Microsoft Windows Recovery Console е вече инсталирана, ComboFix ще продължи към процеса по премахване на зловредния софтуер.

Публикувано изображение

След като Microsoft Windows Recovery Console е инсталирана, използвайки ComboFix, Вие ще видите следното съобщение:

Публикувано изображение

Изберете Yes, за да продължи сканирането за зловреден софтуер.

Когато процесът приключи успешно, инструментът ще създаде лог файл. Моля, включете съдържанието на C:\ComboFix.txt в следващия Ви коментар в тази тема.

Бележка:

  • Моля, не движете мишката, докато ComboFix работи. Това може да наруши процеса на работа.
  • ComboFix ще нулира всички настройки на Microsoft Internet Explorer, включително да направи IE браузър по подразбиране.
  • ComboFix ще изключи autorun функцията на ВСИЧКИ CD, Floppy и USB устройства, за да помогне при премахването на зловредния софтуер и Ви защити от бъдещи вируси/заплахи, които поразяват чрез autorun. Ако това е проблем за вас - моля, уведомете ме.
  • ComboFix ще изключи вашата интернет връзка. Интернет връзката ще се възстанови автоматично, преди ComboFix да завърши процеса на работа. При проблем, той ще прекрати интернет връзката. За да възстановите интернет връзката си, рестартирайте компютъра си.
  • В случай на проблем с ComboFix, той може да създаде лог файл. Моля, включете съдържанието на C:\BUG.txt в следващия Ви коментар в тази тема.
Публикувано изображение Моля, не прикачвайте лог файла/овете от програмата, а го/ги копирайте и поставете в следващия Ви коментар в тази тема.
  • Автор

Има проблем с програмата - Изписва ми че антивирусна AVG e активна в момента, но от "Task Manager" не ми излиза изобщо че е активна, в "Add or remove programs" също я няма, за да мога да я деинсталирам. Какво да правя?

Просто игнорирайте съобщението и продължете ....а няма я в "Add or remove programs" зщото вируса е повредил/изтрил антивирусната ви програма..ще се наложи след като завършим след лечението да се преинсталира или инсталира друга такава....!

Може да използвате AVG Remover - http://www.avg.com/us-en/utilities за да деинсталирате правилно AVG..!

  • Автор

Добре. Ето го LOG файла ComboFix 11-11-05.02 - iP 11.2011 г. 19:23:18.1.2 - x86 Microsoft Windows XP Professional 5.1.2600.3.1251.359.1033.18.2046.1675 [GMT 2:00] Running from: c:\documents and settings\iP\Desktop\ComboFix.exe AV: AVG Anti-Virus Free Edition 2011 *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\documents and settings\iP\Application Data\Toolbar4 c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\arrow_refresh.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\basis.xml c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\bg.gif c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\bingo1.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\cache\f7fb51bfcdf8e4ab1eef5118eb359198 c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\casino1.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\close.gif c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\cog.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\computer_delete.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\favicon.ico c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\favicon.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\icons.bmp c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\info.txt c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\jquery.js c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\jquery.jsonSuggest.js c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\jsonSuggest.css c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\lb.gif c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\lt.gif c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\minimize.gif c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\next.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\onclose.gif c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\onminimize.gif c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\onontop.gif c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\onsettings.gif c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ontop.gif c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\PitchsideLive.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\pixel.gif c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\play.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\poker1.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\pouse.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\radio.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\rb.gif c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\rb_res.gif c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\rss.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\RSSClient.exe c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\rt.gif c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\search.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\SearchIco.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\settings.gif c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\setup_widget_serv.exe c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\sitechecker.js c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\sport.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\tbcore3.inf c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\TbHelper2.exe c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\tbs_include_script_weather.js c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\template.htm c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\Thumbs.db c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ticker.html c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\twit_icn.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\uninstall.exe c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\UninstallToolbar.exe c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\update.exe c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\vegas1.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\version.txt c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_0.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_1.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_10.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_11.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_12.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_13.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_14.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_15.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_16.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_17.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_18.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_19.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_2.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_20.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_21.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_22.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_23.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_24.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_25.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_26.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_27.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_28.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_29.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_3.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_30.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_31.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_32.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_33.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_34.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_35.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_36.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_37.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_38.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_39.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_4.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_40.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_41.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_42.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_43.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_44.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_45.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_46.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_47.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_5.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_6.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_7.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_8.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_9.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\weather.plugin.html c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\weather_bg.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\WH widget.html c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wh_logo.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\widget.js c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\WilliamHill.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_0.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_1.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_10.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_11.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_12.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_13.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_14.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_15.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_16.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_17.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_18.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_19.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_2.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_20.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_21.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_22.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_23.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_24.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_25.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_26.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_27.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_28.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_29.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_3.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_30.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_31.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_32.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_33.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_34.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_35.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_36.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_37.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_38.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_39.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_4.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_40.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_41.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_42.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_43.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_44.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_45.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_46.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_47.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_5.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_6.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_7.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_8.png c:\documents and settings\iP\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_9.png c:\documents and settings\iP\Application Data\williamhill_toolbar_installer.exe c:\documents and settings\iP\Local Settings\Application Data\0ea1275f c:\documents and settings\iP\Local Settings\Application Data\0ea1275f\@ c:\documents and settings\iP\Local Settings\Application Data\0ea1275f\U\80000000.@ c:\documents and settings\iP\Local Settings\Application Data\0ea1275f\U\800000cb.@ c:\documents and settings\iP\Local Settings\Application Data\0ea1275f\X c:\program files\William Hill Toolbar\tbHElper.dll c:\windows\ c:\windows\$NtUninstallKB54785$ c:\windows\$NtUninstallKB54785$\2151025654 c:\windows\$NtUninstallKB54785$\245442399\@ c:\windows\$NtUninstallKB54785$\245442399\L\thdwarve c:\windows\$NtUninstallKB54785$\245442399\loader.tlb c:\windows\$NtUninstallKB54785$\245442399\U\@00000001 c:\windows\$NtUninstallKB54785$\245442399\U\@000000c0 c:\windows\$NtUninstallKB54785$\245442399\U\@000000cb c:\windows\$NtUninstallKB54785$\245442399\U\@000000cf c:\windows\$NtUninstallKB54785$\245442399\U\@80000000 c:\windows\$NtUninstallKB54785$\245442399\U\@800000c0 c:\windows\$NtUninstallKB54785$\245442399\U\@800000cb c:\windows\$NtUninstallKB54785$\245442399\U\@800000cf c:\windows\msxml4-KB954430-enu.LOG c:\windows\msxml4-KB973688-enu.LOG c:\windows\system32\ c:\windows\system32\_000006_.tmp.dll c:\windows\system32\c_66485.nls c:\windows\system32\config\systemprofile\Application Data\Toolbar4 c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\arrow_refresh.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\basis.xml c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\bg.gif c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\bingo1.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\cache\f7fb51bfcdf8e4ab1eef5118eb359198 c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\casino1.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\close.gif c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\cog.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\computer_delete.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\favicon.ico c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\favicon.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\icons.bmp c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\info.txt c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\jquery.js c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\jquery.jsonSuggest.js c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\jsonSuggest.css c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\lb.gif c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\lt.gif c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\minimize.gif c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\next.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\onclose.gif c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\onminimize.gif c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\onontop.gif c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\onsettings.gif c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ontop.gif c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\PitchsideLive.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\pixel.gif c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\play.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\poker1.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\pouse.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\radio.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\rb.gif c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\rb_res.gif c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\rss.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\RSSClient.exe c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\rt.gif c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\search.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\SearchIco.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\settings.gif c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\setup_widget_serv.exe c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\sitechecker.js c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\sport.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\tbcore3.inf c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\TbHelper2.exe c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\tbs_include_script_weather.js c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\template.htm c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\Thumbs.db c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ticker.html c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\twit_icn.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\uninstall.exe c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\UninstallToolbar.exe c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\update.exe c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\vegas1.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\version.txt c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_0.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_1.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_10.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_11.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_12.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_13.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_14.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_15.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_16.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_17.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_18.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_19.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_2.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_20.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_21.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_22.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_23.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_24.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_25.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_26.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_27.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_28.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_29.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_3.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_30.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_31.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_32.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_33.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_34.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_35.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_36.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_37.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_38.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_39.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_4.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_40.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_41.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_42.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_43.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_44.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_45.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_46.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_47.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_5.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_6.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_7.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_8.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wb_9.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\weather.plugin.html c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\weather_bg.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\WH widget.html c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\wh_logo.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\widget.js c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\WilliamHill.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_0.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_1.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_10.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_11.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_12.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_13.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_14.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_15.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_16.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_17.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_18.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_19.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_2.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_20.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_21.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_22.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_23.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_24.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_25.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_26.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_27.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_28.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_29.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_3.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_30.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_31.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_32.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_33.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_34.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_35.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_36.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_37.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_38.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_39.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_4.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_40.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_41.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_42.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_43.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_44.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_45.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_46.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_47.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_5.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_6.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_7.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_8.png c:\windows\system32\config\systemprofile\Application Data\Toolbar4\{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}\ws_9.png . Infected copy of c:\windows\system32\drivers\ipsec.sys was found and disinfected Restored copy from - The cat found it :) . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . . -------\Service_ea1275f . . ((((((((((((((((((((((((( Files Created from 2011-10-05 to 2011-11-05 ))))))))))))))))))))))))))))))) . . 2011-11-05 17:21 . 2008-04-14 09:00 75264 -c--a-w- c:\windows\system32\dllcache\ipsec.sys 2011-11-05 17:21 . 2008-04-14 09:00 75264 ----a-w- c:\windows\system32\drivers\ipsec.sys 2011-11-05 08:43 . 2011-11-05 08:43 48016 --sha-w- c:\windows\system32\c_66485.nl_ 2011-11-05 08:40 . 2011-11-05 11:03 -------- d-----w- c:\windows\system32\NtmsData 2011-11-05 08:36 . 2011-11-05 11:10 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira 2011-11-04 18:44 . 2011-11-04 18:44 -------- d-----w- c:\program files\Games-Masters.com 2011-11-04 17:06 . 2011-11-04 17:06 -------- d-----w- c:\windows\system32\config\systemprofile\Local Settings\Application Data\Conduit 2011-11-04 17:05 . 2011-11-05 09:16 -------- d-----w- c:\windows\system32\config\systemprofile\Local Settings\Application Data\BrotherSoft_Extreme 2011-11-04 17:05 . 2011-11-04 17:05 -------- d-----w- c:\windows\system32\config\systemprofile\Application Data\BabylonToolbar 2011-11-02 16:18 . 2011-11-02 16:18 -------- d-----w- c:\program files\NatureTreks Healing With Color 2011-11-01 06:38 . 2011-11-01 17:18 -------- d-----w- c:\documents and settings\All Users\Application Data\regid.1986-12.com.adobe 2011-10-31 12:47 . 2011-10-31 12:47 -------- d-----w- c:\documents and settings\iP\Application Data\com.adobe.downloadassistant.AdobeDownloadAssistant 2011-10-31 12:47 . 2011-10-31 12:47 -------- d-----w- c:\program files\Adobe Download Assistant 2011-10-31 12:47 . 2011-10-31 12:47 -------- d-----w- c:\program files\Common Files\Adobe AIR 2011-10-13 12:51 . 2011-10-13 12:51 -------- d-----w- c:\documents and settings\iP\Application Data\LogoMaker 2011-10-13 12:48 . 2011-10-13 12:48 -------- d-----w- c:\program files\Studio V5 2011-10-12 09:32 . 2011-10-12 09:32 -------- d-----w- c:\documents and settings\iP\Local Settings\Application Data\Rockstar Games 2011-10-12 09:26 . 2011-10-12 09:26 -------- d-sh--w- c:\documents and settings\All Users\Application Data\SecuROM 2011-10-12 09:22 . 2011-10-12 09:23 -------- d-----w- c:\windows\system32\drivers\umdf 2011-10-12 09:22 . 2006-10-18 18:47 276992 ------w- c:\windows\system32\audiodev.dll 2011-10-12 09:21 . 2011-10-12 09:21 -------- d-----w- c:\windows\system32\xlive 2011-10-12 09:21 . 2011-10-12 09:21 -------- d-----w- c:\program files\Microsoft Games for Windows - LIVE 2011-10-11 09:53 . 2011-10-11 09:53 -------- d-----w- c:\program files\MSXML 4.0 2011-10-10 18:03 . 2011-10-12 14:59 -------- d-----w- c:\program files\Microsoft Silverlight 2011-10-07 15:34 . 2011-10-07 15:34 -------- d-----w- c:\windows\Sun . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-11-05 17:31 . 2011-04-25 19:02 16608 ----a-w- c:\windows\gdrv.sys 2011-11-04 15:49 . 2011-07-15 18:23 76744 ----a-w- c:\windows\system32\PnkBstrA.exe 2011-11-04 15:49 . 2009-07-12 22:07 9244 ----a-w- c:\windows\UnsignedThemesSvc.exe 2011-11-04 15:48 . 2008-09-11 02:07 579128 ----a-w- c:\windows\system32\ati2evxx.exe 2011-09-27 13:47 . 2011-09-27 13:47 232512 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys 2011-09-26 08:41 . 2008-07-29 16:59 611328 ----a-w- c:\windows\system32\uiautomationcore.dll 2011-09-26 08:41 . 2008-04-14 09:00 220160 ----a-w- c:\windows\system32\oleacc.dll 2011-09-26 08:41 . 2008-04-14 09:00 20480 ----a-w- c:\windows\system32\oleaccrc.dll 2011-09-09 09:12 . 2008-04-14 09:00 599040 ----a-w- c:\windows\system32\crypt32.dll 2011-09-07 19:39 . 2011-09-07 19:39 281760 ----a-w- c:\windows\system32\drivers\atksgt.sys 2011-09-07 19:39 . 2011-09-07 19:39 25888 ----a-w- c:\windows\system32\drivers\lirsgt.sys 2011-09-06 13:25 . 2009-11-08 09:36 1867904 ----a-w- c:\windows\system32\win32k.sys 2011-09-05 13:54 . 2009-11-08 09:37 668672 ----a-w- c:\windows\system32\wininet.dll 2011-09-05 13:54 . 2008-04-14 09:00 61952 ----a-w- c:\windows\system32\tdc.ocx 2011-09-05 13:54 . 2009-11-08 09:37 81920 ----a-w- c:\windows\system32\ieencode.dll 2011-09-05 12:48 . 2009-11-08 09:37 369664 ----a-w- c:\windows\system32\html.iec 2011-08-27 18:44 . 2011-08-27 18:44 73728 ----a-w- c:\windows\system32\javacpl.cpl 2011-08-27 18:44 . 2011-08-27 18:44 472808 ----a-w- c:\windows\system32\deployJava1.dll 2011-08-17 13:41 . 2009-11-08 09:35 138496 ----a-w- c:\windows\system32\drivers\afd.sys 2011-08-12 10:51 . 2011-04-23 07:30 26488 ----a-w- c:\windows\system32\spupdsvc.exe 2011-08-10 20:05 . 2011-06-11 18:54 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{51a86bb3-6602-4c85-92a5-130ee4864f13}"= "c:\program files\BrotherSoft_Extreme\prxtbBrot.dll" [2011-01-17 175912] "{EEE6C35D-6118-11DC-9C72-001320C79847}"= "c:\program files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll" [2011-02-01 141616] . [HKEY_CLASSES_ROOT\clsid\{51a86bb3-6602-4c85-92a5-130ee4864f13}] . [HKEY_CLASSES_ROOT\clsid\{eee6c35d-6118-11dc-9c72-001320c79847}] [HKEY_CLASSES_ROOT\SweetIM_URLSearchHook.ToolbarURLSearchHook.1] [HKEY_CLASSES_ROOT\TypeLib\{EEE6C35F-6118-11DC-9C72-001320C79847}] [HKEY_CLASSES_ROOT\SweetIM_URLSearchHook.ToolbarURLSearchHook] . [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}] 2011-01-17 14:54 175912 ----a-w- c:\program files\ConduitEngine\prxConduitEngine.dll . [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{51a86bb3-6602-4c85-92a5-130ee4864f13}] 2011-01-17 14:54 175912 ----a-w- c:\program files\BrotherSoft_Extreme\prxtbBrot.dll . [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}] 2011-02-01 12:58 1499440 ----a-r- c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{51a86bb3-6602-4c85-92a5-130ee4864f13}"= "c:\program files\BrotherSoft_Extreme\prxtbBrot.dll" [2011-01-17 175912] "{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files\ConduitEngine\prxConduitEngine.dll" [2011-01-17 175912] "{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}"= "c:\program files\William Hill Toolbar\tbcore3.dll" [2010-09-27 2639360] "{EEE6C35B-6118-11DC-9C72-001320C79847}"= "c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll" [2011-02-01 1499440] . [HKEY_CLASSES_ROOT\clsid\{51a86bb3-6602-4c85-92a5-130ee4864f13}] . [HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}] . [HKEY_CLASSES_ROOT\clsid\{3c4a28a6-35d6-482d-8a9e-ffc843e00bb6}] [HKEY_CLASSES_ROOT\TBSB08577.TBSB08577.3] [HKEY_CLASSES_ROOT\TypeLib\{EC4085F2-8DB3-45a6-AD0B-CA289F3C5D7E}] [HKEY_CLASSES_ROOT\TBSB08577.TBSB08577] . [HKEY_CLASSES_ROOT\clsid\{eee6c35b-6118-11dc-9c72-001320c79847}] [HKEY_CLASSES_ROOT\SWEETIE.IEToolbar.1] [HKEY_CLASSES_ROOT\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}] [HKEY_CLASSES_ROOT\SWEETIE.IEToolbar] . [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] "{51A86BB3-6602-4C85-92A5-130EE4864F13}"= "c:\program files\BrotherSoft_Extreme\prxtbBrot.dll" [2011-01-17 175912] "{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6}"= "c:\program files\William Hill Toolbar\tbcore3.dll" [2010-09-27 2639360] "{EEE6C35B-6118-11DC-9C72-001320C79847}"= "c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll" [2011-02-01 1499440] . [HKEY_CLASSES_ROOT\clsid\{51a86bb3-6602-4c85-92a5-130ee4864f13}] . [HKEY_CLASSES_ROOT\clsid\{3c4a28a6-35d6-482d-8a9e-ffc843e00bb6}] [HKEY_CLASSES_ROOT\TBSB08577.TBSB08577.3] [HKEY_CLASSES_ROOT\TypeLib\{EC4085F2-8DB3-45a6-AD0B-CA289F3C5D7E}] [HKEY_CLASSES_ROOT\TBSB08577.TBSB08577] . [HKEY_CLASSES_ROOT\clsid\{eee6c35b-6118-11dc-9c72-001320c79847}] [HKEY_CLASSES_ROOT\SWEETIE.IEToolbar.1] [HKEY_CLASSES_ROOT\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}] [HKEY_CLASSES_ROOT\SWEETIE.IEToolbar] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 94208 ----a-w- c:\documents and settings\iP\Application Data\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 94208 ----a-w- c:\documents and settings\iP\Application Data\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 94208 ----a-w- c:\documents and settings\iP\Application Data\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4] @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 94208 ----a-w- c:\documents and settings\iP\Application Data\Dropbox\bin\DropboxExt.14.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Pando Media Booster"="c:\program files\Pando Networks\Media Booster\PMB.exe" [2011-05-19 3077528] "Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-11-07 21633320] "DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2011-08-02 4910912] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "GEST"="]" [X] "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-01 61440] "RTHDCPL"="RTHDCPL.EXE" [2008-02-13 16857600] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-04-14 421160] "AVG_TRAY"="c:\program files\AVG\AVG10\avgtray.exe" [2011-09-10 2338656] "BabylonToolbar"="c:\program files\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbarsrv.exe" [2010-11-07 286720] "SweetIM"="c:\program files\SweetIM\Messenger\SweetIM.exe" [2011-03-13 114992] "AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-04-20 58656] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920] "AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2011-03-15 499608] "SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096] "AdobeCS5.5ServiceManager"="c:\program files\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" [2011-01-12 1523360] . [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] . c:\documents and settings\iP\Start Menu\Programs\Startup\ Dropbox.lnk - c:\documents and settings\iP\Application Data\Dropbox\bin\Dropbox.exe [2011-5-25 24176560] GIGABYTE Gamer HUD Lite.lnk - c:\program files\GIGABYTE\Gamer HUD Lite\HUD.exe [2008-10-14 1952256] . c:\documents and settings\All Users\Start Menu\Programs\Startup\ Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2011-5-11 113664] . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG10\avgchsvx.exe /sync\0c:\progra~1\AVG\AVG10\avgrsx.exe /sync /restart . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] @="Driver" . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Documents and Settings\\iP\\Application Data\\Dropbox\\bin\\Dropbox.exe"= "c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"= "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\WINDOWS\\system32\\PnkBstrA.exe"= "c:\\WINDOWS\\system32\\PnkBstrB.exe"= "c:\\Program Files\\TeamViewer\\Version6\\TeamViewer.exe"= "c:\\Program Files\\TeamViewer\\Version6\\TeamViewer_Service.exe"= "c:\\Program Files\\Electronic Arts\\Battlefield Bad Company 2\\BFBC2Updater.exe"= "c:\\Documents and Settings\\All Users\\Application Data\\SweetIM\\Messenger\\update\\sweetimsetup.exe"= "c:\\Program Files\\Ventrilo\\Ventrilo.exe"= "c:\\Documents and Settings\\All Users\\Start Menu\\Programs\\KONAMI\\Pro Evolution Soccer 2011\\PES2011.exe"= "c:\\Program Files\\Veetle\\Player\\VeetleNet.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "2706:TCP"= 2706:TCP:Inhatch P2P Streaming "2707:TCP"= 2707:TCP:Inhatch P2P Streaming "2708:TCP"= 2708:TCP:Inhatch P2P Streaming "2709:TCP"= 2709:TCP:Inhatch P2P Streaming "56652:TCP"= 56652:TCP:Pando Media Booster "56652:UDP"= 56652:UDP:Pando Media Booster "10950:TCP"= 10950:TCP:Inhatch P2P Streaming "10951:TCP"= 10951:TCP:Inhatch P2P Streaming "10952:TCP"= 10952:TCP:Inhatch P2P Streaming "10953:TCP"= 10953:TCP:Inhatch P2P Streaming "49780:UDP"= 49780:UDP:Inhatch P2P Streaming "1035:TCP"= 1035:TCP:Akamai NetSession Interface "5000:UDP"= 5000:UDP:Akamai NetSession Interface . R1 archlp;archlp;c:\windows\system32\drivers\ArcHlp.sys [19.2.2009 г. 13:22 127744] R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\drivers\dtsoftbus01.sys [27.9.2011 г. 15:47 232512] R2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe -k Akamai [14.4.2008 г. 11:00 14336] R2 GEST Service;GEST Service for program management.;c:\program files\GIGABYTE\EnergySaver\GSvr.exe [25.4.2011 г. 21:03 70284] R2 UnsignedThemes;Unsigned Themes;c:\windows\UnsignedThemesSvc.exe [13.7.2009 г. 00:07 9244] R2 uxpatch;uxpatch;c:\windows\system32\drivers\uxpatch.sys [13.7.2009 г. 00:07 25448] S0 AVGIDSEH;AVGIDSEH;c:\windows\system32\DRIVERS\AVGIDSEH.Sys --> c:\windows\system32\DRIVERS\AVGIDSEH.Sys [?] S0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx86.sys --> c:\windows\system32\DRIVERS\avgrkx86.sys [?] S0 nielprt;Nielsen Patch Service;c:\windows\system32\DRIVERS\nielprt.sys --> c:\windows\system32\DRIVERS\nielprt.sys [?] S1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx86.sys --> c:\windows\system32\DRIVERS\avgldx86.sys [?] S1 Avgtdix;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdix.sys --> c:\windows\system32\DRIVERS\avgtdix.sys [?] S2 AVGIDSAgent;AVGIDSAgent;"c:\program files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe" --> c:\program files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe [?] S2 avgwd;AVG WatchDog;"c:\program files\AVG\AVG10\avgwdsvc.exe" --> c:\program files\AVG\AVG10\avgwdsvc.exe [?] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18.3.2010 г. 12:16 130384] S3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\AVGIDSDriver.Sys --> c:\windows\system32\DRIVERS\AVGIDSDriver.Sys [?] S3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\DRIVERS\AVGIDSFilter.Sys --> c:\windows\system32\DRIVERS\AVGIDSFilter.Sys [?] S3 AVGIDSShim;AVGIDSShim;c:\windows\system32\DRIVERS\AVGIDSShim.Sys --> c:\windows\system32\DRIVERS\AVGIDSShim.Sys [?] S3 dump_wmimmc;dump_wmimmc;\??\d:\games\КАБАЛ ОНЛАЙН\GameGuard\dump_wmimmc.sys --> d:\games\КАБАЛ ОНЛАЙН\GameGuard\dump_wmimmc.sys [?] S3 NielGfx;Nielsen USB GFX;c:\windows\system32\drivers\nielgfx.sys --> c:\windows\system32\drivers\nielgfx.sys [?] S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?] S3 SwitchBoard;SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [19.2.2010 г. 13:37 517096] S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18.3.2010 г. 12:16 753504] S3 XDva385;XDva385;\??\c:\windows\system32\XDva385.sys --> c:\windows\system32\XDva385.sys [?] . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] Akamai REG_MULTI_SZ Akamai . Contents of the 'Scheduled Tasks' folder . 2011-11-01 c:\windows\Tasks\AdobeAAMUpdater-1.0-IP-82A2D95E3E12-iP.job - c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe [2011-10-31 15:42] . 2011-10-29 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 14:57] . 2011-11-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1606980848-651377827-1177238915-1003Core.job - c:\documents and settings\iP\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-04-25 20:10] . 2011-11-05 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1606980848-651377827-1177238915-1003UA.job - c:\documents and settings\iP\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-04-25 20:10] . . ------- Supplementary Scan ------- . uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2776682 mStart Page = hxxp://home.sweetim.com uInternet Connection Wizard,ShellNext = iexplore uInternet Settings,ProxyServer = http=;ftp=;https=; IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 IE: {{3C4A28A6-35D6-482D-8A9E-FFC843E00BB6} - {3C4A28A6-35D6-482D-8A9E-FFC843E00BB6} - c:\program files\William Hill Toolbar\tbcore3.dll TCP: DhcpNameServer = 212.116.128.2 212.116.136.2 . - - - - ORPHANS REMOVED - - - - . HKCU-Run-Spyware Doctor with AntiVirus - c:\documents and settings\iP\Desktop\sdasetup_aff.exe HKCU-Run-Easy-Hide-IP - c:\program files\Easy-Hide-IP\easy-hide-ip.exe HKCU-Run-msnmsgr - ~c:\program files\Windows Live\Messenger\msnmsgr.exe HKCU-Run-Overwolf - c:\program files\Overwolf\Overwolf.exe AddRemove-Counter-Strike LH 2011 2.00 - c:\program files\LongHorn\Counter-Strike LH 2011\Uninstall.exe AddRemove-Easy-Hide-IP_is1 - c:\program files\Easy-Hide-IP\unins000.exe AddRemove-Guild Wars - c:\program files\Guild Wars\Gw.exe . . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2011-11-05 19:31 Windows 5.1.2600 Service Pack 3 NTFS . scanning hidden processes ... . scanning hidden autostart entries ... . HKCU\Software\Microsoft\Windows\CurrentVersion\Run msnmsgr = ~"c:\program files\Windows Live\Messenger\msnmsgr.exe" /background? . scanning hidden files ... . scan completed successfully hidden files: 0 . ************************************************************************** . [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc] "ImagePath"="c:\windows\system32\GameMon.des -service" . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_USERS\S-1-5-21-1606980848-651377827-1177238915-1003\Software\SecuROM\License information*] "datasecu"=hex:2c,70,2f,21,11,16,cb,e7,c1,f0,93,d2,50,72,15,df,31,fc,bf,a3,c0, 3d,ca,7e,62,41,b6,a0,ed,0a,6c,e7,ca,e3,0c,99,c7,5a,34,80,f5,2f,36,6a,d2,26,\ "rkeysecu"=hex:21,66,38,12,05,5b,bb,a1,50,cd,a9,4b,34,b9,5b,18 . --------------------- DLLs Loaded Under Running Processes --------------------- . - - - - - - - > 'winlogon.exe'(704) c:\windows\system32\Ati2evxx.dll . - - - - - - - > 'explorer.exe'(2592) c:\documents and settings\iP\Application Data\Dropbox\bin\DropboxExt.14.dll c:\windows\system32\msi.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . ------------------------ Other Running Processes ------------------------ . c:\windows\system32\Ati2evxx.exe c:\windows\system32\Ati2evxx.exe c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe c:\program files\Java\jre6\bin\jqs.exe c:\windows\system32\PnkBstrA.exe c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe c:\windows\RTHDCPL.EXE c:\program files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe c:\program files\iPod\bin\iPodService.exe c:\program files\Skype\Plugin Manager\skypePM.exe c:\windows\system32\wscntfy.exe . ************************************************************************** . Completion time: 2011-11-05 19:34:04 - machine was rebooted ComboFix-quarantined-files.txt 2011-11-05 17:34 . Pre-Run: 4 806 615 040 bytes free Post-Run: 6 348 988 416 bytes free . WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons UnsupportedDebug="do not select this" /debug multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect . - - End Of File - - 264B6F72B2FD379228F8EEBEBD2211A5

Моля изтрийте текущата версия на TDSSKiller и изтеглете последната версия оттук и я запазете на вашия декстоп.

  • Стартирайте TDSSKiller.exe за да стартирате приложението. След това кликнете върху бутона Change parameters.

    Публикувано изображение

  • Сложете отметки пред Verify Driver Digital Signature и Detect TDLFS file system и натиснете ОК.

    Публикувано изображение

  • Натиснете бутона Start Scan.

    Публикувано изображение

  • Ако подозрителен обект бъде засечен, действието по подразбиране ще бъде Skip, кликнете върху Continue.

    Публикувано изображение

  • Ако зловредни обекти бъдат намерени, тогава от падащото меню ще имате три възможности.

    Бъдете сигурни, че избраното действие е Cure и натиснете върху Continue > Рестартирайте за да бъде завършена поправката.

    Публикувано изображение

    Забележка: Ако Cure бутона не е наличен от възможностите, тогава моля изберете Skip бутона, не избирайте Delete освен ако не сте инструктирани затова.

  • Лог файл ще бъде създаден в свободната директория на дял C:\ . Потърсете за лог с името "TDSSKiller.[Version]_[Date]_[Time]_log.txt" и копирайте съдържанието му в следващия си пост.
  • Автор

От падащото меню накрая ми излизат следните опции: - Skip - Copy to quarantine - Delete Не виждам "Cure" - какво трябва да направя? Ако дам "Skip" се връщам обратно на стъпката в която трябва да кликна "Start Scan"

Забележка: Ако Cure бутона не е наличен от възможностите, тогава моля изберете Skip бутона, не избирайте Delete освен ако не сте инструктирани затова.:)

Сега изтеглете The Avenger и го разархивирайте на десктопа. Стартирайте avenger.exe, копирайте (Copy) следния текст и го поставете (Paste) в текстовото поле на програмата:

Files to delete:
c:\windows\system32\c_66485.nl_

Уверете се, че Scan for rootkits и Automatically disable any rootkits found имат отметки.

След това изберете Execute и при въпрос от страна на програмата, кликнете върху Yes, при което компютъра ще се рестартира. След рестартта копирайте и поставете съдържанието на лог файла от програмата, намиращ се в C:\avenger.txt в следващия си коментар в тази тема.

  • Автор

Logfile of The Avenger Version 2.0, © by Swandog46 http://swandog46.geekstogo.com Platform: Windows XP ******************* Script file opened successfully. Script file read successfully. Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: Rootkit scan active. No rootkits found! File "c:\windows\system32\c_66485.nl_" deleted successfully. Completed script processing. ******************* Finished! Terminate.

До тук перфектно..!Спавяте се отлично...!Сега:

  • Моля изтеглете Junction.zip и го запазете на вашия десктоп.
  • Разархивирайте архива и копирайте файла junction.exe в C:\Windows.
  • Отидете до Start => Run... => въведете командата отдолу с Copy/Paste и натиснете OK
cmd /c junction -s c:\ >log.txt&log.txt& del log.txt
  • Изчакайте проверката да завърши и да се появи лог файла.
  • Копирайте съдържанието му в следващия си пост.
  • Автор

Junction v1.06 - Windows junction creator and reparse point viewer Copyright © 2000-2010 Mark Russinovich Sysinternals - www.sysinternals.com Failed to open \\?\c:\\pagefile.sys: The process cannot access the file because it is being used by another process. Failed to open \\?\c:\\System Volume Information: Access is denied. ... ... ... ... ... ... ... ... ... ... ... Failed to open \\?\c:\\Program Files\AVG\AVG10\avgcsrvx.exe: Access is denied. Failed to open \\?\c:\\Program Files\AVG\AVG10\avgtray.exe: Access is denied. Failed to open \\?\c:\\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\ : Access is denied. ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... Failed to open \\?\c:\\Program Files\Games-Masters.com\CABAL Online (Europe)\GameGuard.des: Access is denied. ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... Failed to open \\?\c:\\Program Files\SweetIM\Messenger\SweetIM.exe: Access is denied. ... ... ... ... ... Failed to open \\?\c:\\Qoobox\BackEnv: Access is denied. ... ... ... ... ... ... ... ... ... ... .No reparse points found.

Моля изтеглете GrantPerms.zip и го разархивирайте в папка по избор.

Стартирайте GrantPerms.exe и въведете следната информация:

c:\System Volume Information
c:\Program Files\AVG\AVG10\avgcsrvx.exe
c:\Program Files\AVG\AVG10\avgtray.exe
c:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\

Натиснете Unlock и след това List Permissions. Публикувайте лог файла в следващия си пост.

  • Автор

Заповядай! Всичко добре ли върви, защото забелязах някои грешки в последните два лога? GrantPerms by Farbar Ran by iP at 2011-11-05 21:16:16 =============================================== \\?\c:\\System Volume Information Owner: BUILTIN\Administrators DACL(P)(AI): BUILTIN\Administrators FULL ALLOW (CI)(OI) NT AUTHORITY\SYSTEM FULL ALLOW (CI)(OI) BUILTIN\Users READ/EXECUTE ALLOW (CI)(OI) \\?\c:\\Program Files\AVG\AVG10\avgcsrvx.exe Owner: BUILTIN\Administrators DACL(P)(AI): BUILTIN\Administrators FULL ALLOW (NI) NT AUTHORITY\SYSTEM FULL ALLOW (NI) BUILTIN\Users READ/EXECUTE ALLOW (NI) \\?\c:\\Program Files\AVG\AVG10\avgtray.exe Owner: BUILTIN\Administrators DACL(P)(AI): BUILTIN\Administrators FULL ALLOW (NI) NT AUTHORITY\SYSTEM FULL ALLOW (NI) BUILTIN\Users READ/EXECUTE ALLOW (NI) WARNING: The parameter <c:\\Program Files\AVG\AVG10\Identity Protection\Agent\Bin" -ot file -actn list -lst F:tab;W:O,d;I:y > contains a double quotation mark ("). Did you unintentionally escape a double quote? Hint: use <"C:\\"> instead of <"C:\">. ERROR: The object path was not specified. Благодаря ти много че отделяш от времето си за да ми помогнеш :)

Опсссс малка грешка сме допуснали...:

Моля, изтеглете GrantPerms.zip и го разархивирайте в папка по избор.

Стартирайте GrantPerms.exe и въведете следната информация:

c:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin

Натиснете Unlock и след това List Permissions. Публикувайте лог файла в следващия си пост.

  • Автор

GrantPerms by Farbar Ran by iP at 2011-11-05 21:27:43 =============================================== \\?\c:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin Owner: BUILTIN\Administrators DACL(NP)(AI): NT AUTHORITY\SYSTEM FULL ALLOW (CI)(OI)(I) BUILTIN\Administrators FULL ALLOW (CI)(OI)(I) BUILTIN\Users READ/EXECUTE ALLOW (CI)(OI)(I)

А сега е добре...!Така...може ли един свеж лог от:

  • Изтеглете DDS: от BleepingComputer.
  • След изтегляне на файла го запишете (бутон Save => Save as) DDS на вашия десктоп, снимка:

    Публикувано изображение

  • След като изтеглите DDS на десктопа, иконката на програмата би трябвало да изглежда така: Публикувано изображение
  • Прекратете временно работата на всички скрипт блокиращи приложения, ако има такива или разрешете изпълнението на dds.scr. След това стартирайте DDS с двоен клик на иконката, като потвърдите с Run.
  • След приключване на работата на DDS копирайте с Copy текста от двата файлови лога, които ще се появят в Notepad: DDS.txt и Attach.txt и ги запазете (бутон Save => Save as) на десктопа.
  • Автор

Заповядай! . DDS (Ver_2011-08-26.01) - NTFSx86 Internet Explorer: 6.0.2900.5512 Run by iP at 21:33:36 on 2011-11-05 Microsoft Windows XP Professional 5.1.2600.3.1251.359.1033.18.2046.1270 [GMT 2:00] . AV: AVG Anti-Virus Free Edition 2011 *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF} . ============== Running Processes =============== . C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\UnsignedThemesSvc.exe svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbarsrv.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\DAEMON Tools Lite\DTLite.exe C:\Documents and Settings\iP\Application Data\Dropbox\bin\Dropbox.exe C:\Program Files\GIGABYTE\Gamer HUD Lite\HUD.exe C:\WINDOWS\System32\svchost.exe -k Akamai C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\system32\PnkBstrA.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Skype\Plugin Manager\skypePM.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\wuauclt.exe C:\Documents and Settings\iP\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Documents and Settings\iP\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Documents and Settings\iP\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Documents and Settings\iP\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Documents and Settings\iP\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Documents and Settings\iP\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Documents and Settings\iP\Local Settings\Application Data\Google\Chrome\Application\chrome.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2776682 mStart Page = hxxp://home.sweetim.com uInternet Connection Wizard,ShellNext = iexplore uInternet Settings,ProxyServer = http=;ftp=;https=; uURLSearchHooks: DeviceVM Url Search Hook: {0063bf63-bfff-4b8f-9d26-4267df7f17dd} - c:\windows\system32\dvmurl.dll uURLSearchHooks: BrotherSoft Extreme Toolbar: {51a86bb3-6602-4c85-92a5-130ee4864f13} - c:\program files\brothersoft_extreme\prxtbBrot.dll uURLSearchHooks: SweetIM ToolbarURLSearchHook Class: {eee6c35d-6118-11dc-9c72-001320c79847} - c:\program files\sweetim\toolbars\internet explorer\mgHelper.dll mURLSearchHooks: SweetIM ToolbarURLSearchHook Class: {eee6c35d-6118-11dc-9c72-001320c79847} - c:\program files\sweetim\toolbars\internet explorer\mgHelper.dll BHO: Yahoo! Companion BHO: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\ycomp5_6_2_0.dll BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: CescrtHlpr Object: {2eecd738-5844-4a99-b4b6-146bf802613b} - c:\program files\babylontoolbar\babylontoolbar\1.4.19.19\bh\BabylonToolbar.dll BHO: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\prxConduitEngine.dll BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg10\avgssie.dll BHO: BrotherSoft Extreme Toolbar: {51a86bb3-6602-4c85-92a5-130ee4864f13} - c:\program files\brothersoft_extreme\prxtbBrot.dll BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll BHO: SweetIM Toolbar Helper: {eee6c35c-6118-11dc-9c72-001320c79847} - c:\program files\sweetim\toolbars\internet explorer\mgToolbarIE.dll BHO: TBSB08577 Class: {fcbccb87-9224-4b8d-b117-f56d924beb18} - c:\program files\william hill toolbar\tbcore3.dll TB: &Yahoo! Companion: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\ycomp5_6_2_0.dll TB: BrotherSoft Extreme Toolbar: {51a86bb3-6602-4c85-92a5-130ee4864f13} - c:\program files\brothersoft_extreme\prxtbBrot.dll TB: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\prxConduitEngine.dll TB: WilliamHill Toolbar: {3c4a28a6-35d6-482d-8a9e-ffc843e00bb6} - c:\program files\william hill toolbar\tbcore3.dll TB: Babylon Toolbar: {98889811-442d-49dd-99d7-dc866be87dbc} - c:\program files\babylontoolbar\babylontoolbar\1.4.19.19\BabylonToolbarTlbr.dll TB: SweetIM Toolbar for Internet Explorer: {eee6c35b-6118-11dc-9c72-001320c79847} - c:\program files\sweetim\toolbars\internet explorer\mgToolbarIE.dll uRun: [Pando Media Booster] c:\program files\pando networks\media booster\PMB.exe uRun: [skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized uRun: [DAEMON Tools Lite] "c:\program files\daemon tools lite\DTLite.exe" -autorun mRun: [startCCC] "c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe" MSRun mRun: [RTHDCPL] RTHDCPL.EXE mRun: [GEST] ] mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe" mRun: [AVG_TRAY] c:\program files\avg\avg10\avgtray.exe mRun: [babylonToolbar] "c:\program files\babylontoolbar\babylontoolbar\1.4.19.19\BabylonToolbarsrv.exe" /md I mRun: [sweetIM] c:\program files\sweetim\messenger\SweetIM.exe mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\AppleSyncNotifier.exe mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe" mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe" mRun: [AdobeAAMUpdater-1.0] "c:\program files\common files\adobe\oobe\pdapp\uwa\UpdaterStartupUtility.exe" mRun: [switchBoard] c:\program files\common files\adobe\switchboard\SwitchBoard.exe mRun: [AdobeCS5.5ServiceManager] "c:\program files\common files\adobe\cs5.5servicemanager\CS5.5ServiceManager.exe" -launchedbylogin dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE StartupFolder: c:\docume~1\ip\startm~1\programs\startup\dropbox.lnk - c:\documents and settings\ip\application data\dropbox\bin\Dropbox.exe StartupFolder: c:\docume~1\ip\startm~1\programs\startup\gigaby~1.lnk - c:\program files\gigabyte\gamer hud lite\HUD.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000 IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - c:\program files\pokerstars.net\PokerStarsUpdate.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {3C4A28A6-35D6-482D-8A9E-FFC843E00BB6} - {3C4A28A6-35D6-482D-8A9E-FFC843E00BB6} - c:\program files\william hill toolbar\tbcore3.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab TCP: DhcpNameServer = 212.116.128.2 212.116.136.2 TCP: Interfaces\{C6B00F76-804D-4855-A3BB-18434ED8A815} : DhcpNameServer = 212.116.128.2 212.116.136.2 Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - Notify: AtiExtEvent - Ati2evxx.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll . ============= SERVICES / DRIVERS =============== . R1 archlp;archlp;c:\windows\system32\drivers\ArcHlp.sys [2009-2-19 127744] R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\drivers\dtsoftbus01.sys [2011-9-27 232512] R2 Akamai;Akamai NetSession Interface;c:\windows\system32\svchost.exe -k Akamai [2008-4-14 14336] R2 GEST Service;GEST Service for program management.;c:\program files\gigabyte\energysaver\GSvr.exe [2011-4-25 70284] R2 UnsignedThemes;Unsigned Themes;c:\windows\UnsignedThemesSvc.exe [2009-7-13 9244] R2 uxpatch;uxpatch;c:\windows\system32\drivers\uxpatch.sys [2009-7-13 25448] S0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\avgidseh.sys --> c:\windows\system32\drivers\AVGIDSEH.Sys [?] S0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys --> c:\windows\system32\drivers\avgrkx86.sys [?] S0 nielprt;Nielsen Patch Service;c:\windows\system32\drivers\nielprt.sys --> c:\windows\system32\drivers\nielprt.sys [?] S1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys --> c:\windows\system32\drivers\avgldx86.sys [?] S1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\drivers\avgmfx86.sys --> c:\windows\system32\drivers\avgmfx86.sys [?] S1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys --> c:\windows\system32\drivers\avgtdix.sys [?] S2 AVGIDSAgent;AVGIDSAgent;"c:\program files\avg\avg10\identity protection\agent\bin\avgidsagent.exe" --> c:\program files\avg\avg10\identity protection\agent\bin\AVGIDSAgent.exe [?] S2 avgwd;AVG WatchDog;"c:\program files\avg\avg10\avgwdsvc.exe" --> c:\program files\avg\avg10\avgwdsvc.exe [?] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\avgidsdriver.sys --> c:\windows\system32\drivers\AVGIDSDriver.Sys [?] S3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\avgidsfilter.sys --> c:\windows\system32\drivers\AVGIDSFilter.Sys [?] S3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\avgidsshim.sys --> c:\windows\system32\drivers\AVGIDSShim.Sys [?] S3 dump_wmimmc;dump_wmimmc;\??\d:\games\кабал онлайн\gameguard\dump_wmimmc.sys --> d:\games\кабал онлайн\gameguard\dump_wmimmc.sys [?] S3 NielGfx;Nielsen USB GFX;c:\windows\system32\drivers\nielgfx.sys --> c:\windows\system32\drivers\nielgfx.sys [?] S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\gamemon.des -service --> c:\windows\system32\GameMon.des -service [?] S3 SwitchBoard;SwitchBoard;c:\program files\common files\adobe\switchboard\SwitchBoard.exe [2010-2-19 517096] S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504] S3 XDva385;XDva385;\??\c:\windows\system32\xdva385.sys --> c:\windows\system32\XDva385.sys [?] . =============== Created Last 30 ================ . 2011-11-05 18:56:30 150392 ----a-w- c:\windows\junction.exe 2011-11-05 17:37:40 -------- d-----w- c:\documents and settings\ip\application data\Toolbar4 2011-11-05 17:21:23 75264 -c--a-w- c:\windows\system32\dllcache\ipsec.sys 2011-11-05 17:21:23 75264 ----a-w- c:\windows\system32\drivers\ipsec.sys 2011-11-05 17:19:03 -------- d-sha-r- C:\cmdcons 2011-11-05 17:17:24 98816 ----a-w- c:\windows\sed.exe 2011-11-05 17:17:24 518144 ----a-w- c:\windows\SWREG.exe 2011-11-05 17:17:24 256000 ----a-w- c:\windows\PEV.exe 2011-11-05 17:17:24 208896 ----a-w- c:\windows\MBR.exe 2011-11-05 08:40:14 -------- d-----w- c:\windows\system32\NtmsData 2011-11-05 08:36:41 -------- d-----w- c:\documents and settings\all users\application data\Avira 2011-11-04 18:44:49 -------- d-----w- c:\program files\Games-Masters.com 2011-11-02 16:18:05 -------- d-----w- c:\program files\NatureTreks Healing With Color 2011-11-01 06:38:08 -------- d-----w- c:\documents and settings\all users\application data\regid.1986-12.com.adobe 2011-10-31 12:47:32 -------- d-----w- c:\documents and settings\ip\application data\com.adobe.downloadassistant.AdobeDownloadAssistant 2011-10-31 12:47:26 -------- d-----w- c:\program files\Adobe Download Assistant 2011-10-13 12:51:05 -------- d-----w- c:\documents and settings\ip\application data\LogoMaker 2011-10-13 12:48:21 -------- d-----w- c:\program files\Studio V5 2011-10-12 09:32:53 -------- d-----w- c:\documents and settings\ip\local settings\application data\Rockstar Games 2011-10-12 09:26:35 -------- d-sh--w- c:\documents and settings\all users\application data\SecuROM 2011-10-12 09:22:29 276992 ------w- c:\windows\system32\audiodev.dll 2011-10-12 09:21:44 -------- d-----w- c:\windows\system32\xlive 2011-10-12 09:21:43 -------- d-----w- c:\program files\Microsoft Games for Windows - LIVE 2011-10-11 09:53:07 -------- d-----w- c:\program files\MSXML 4.0 . ==================== Find3M ==================== . 2011-11-05 18:46:41 16608 ----a-w- c:\windows\gdrv.sys 2011-11-04 15:49:19 9244 ----a-w- c:\windows\UnsignedThemesSvc.exe 2011-11-04 15:49:19 76744 ----a-w- c:\windows\system32\PnkBstrA.exe 2011-11-04 15:48:52 579128 ----a-w- c:\windows\system32\ati2evxx.exe 2011-09-27 13:47:12 232512 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys 2011-09-26 08:41:20 611328 ----a-w- c:\windows\system32\uiautomationcore.dll 2011-09-26 08:41:20 220160 ----a-w- c:\windows\system32\oleacc.dll 2011-09-26 08:41:14 20480 ----a-w- c:\windows\system32\oleaccrc.dll 2011-09-09 09:12:13 599040 ----a-w- c:\windows\system32\crypt32.dll 2011-09-07 19:39:40 281760 ----a-w- c:\windows\system32\drivers\atksgt.sys 2011-09-07 19:39:40 25888 ----a-w- c:\windows\system32\drivers\lirsgt.sys 2011-09-06 13:25:11 1867904 ----a-w- c:\windows\system32\win32k.sys 2011-09-05 13:54:47 668672 ----a-w- c:\windows\system32\wininet.dll 2011-09-05 13:54:47 61952 ----a-w- c:\windows\system32\tdc.ocx 2011-09-05 13:54:46 81920 ----a-w- c:\windows\system32\ieencode.dll 2011-09-05 12:48:25 369664 ----a-w- c:\windows\system32\html.iec 2011-08-27 18:44:27 73728 ----a-w- c:\windows\system32\javacpl.cpl 2011-08-27 18:44:26 472808 ----a-w- c:\windows\system32\deployJava1.dll 2011-08-17 13:41:46 138496 ----a-w- c:\windows\system32\drivers\afd.sys 2011-08-12 10:51:26 26488 ----a-w- c:\windows\system32\spupdsvc.exe 2011-08-10 20:05:24 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl . ============= FINISH: 21:34:07,09 ===============

Attach.txt

Перфектно..! :) Вашата система беше заразена с рууткит Zero Access...!Следват контролни сканирания,но преди да пусна инструкциите бих искал да ви кажа че сканиранията стават малко по- бавно...Дори да не успеете тази вечер може и утре да продължита...Хубавото е че вече не се вижда рууткита.....лошото е че утре аз съм на работа и ще мога да пиша чак в понеделник...!

Публикувано изображение Изтеглете Malwarebytes' Anti-Malware или от тук

* Кликнете два пъти върху mbam-setup.exe, за да инсталирате програмата.

* Уверете се, че са поставени отметки на Update Malwarebytes' Anti-Malware и Launch Malwarebytes' Anti-Malware. След това кликнете на Finish.

* Ако има намерени обновявания, тя ще ги изтегли и инсталира.

* Стартирайте програмата и изберете "Perform Full Scan", след това кликнете на Scan.

* Сканирането ще отнеме малко време, затова моля да бъдете търпеливи.

* Когато сканирането завърши, кликнете на OK, след това Show Results, за да видите резултата.

* Уверете се, че на всички редове има отметки, и кликнете на Remove Selected.

* Когато всичко бъде премахнато, в Notepad ще бъде отворен лог. Копирайте този лог и го публикувайте в следващия си коментар по темата.

Забележка: Ако MalwareBytes' Anti-Malware се затрудни в премахването на откритите вируси/заплахи, той ще поиска да рестартира компютъра Ви и по време на рестартирането да премахне проблемните вируси/заплахи. Ако бъдете попитани, потвърдете че желаете вашия компютър да бъде рестартиран.

Публикувано изображение Изтеглете програмата: ESET Online Scanner

  • Стартирайте esetsmartinstaller_enu.exe Публикувано изображение
  • Сложете отметка на YES, I accept the Terms of Use и изберете Start:

    Публикувано изображение

  • Скенерът ще започне да изтегля компонентите, които са му необходими:

    Публикувано изображение

  • Уверете се, че има отметки на следните редове:

    Публикувано изображение

    Накрая изберете Start

  • Скенерът ще започне да изтегля последните дефиниции.
  • След, като сканирането завърши изберете Finish.
  • Отидете в: C:\Program Files\ESET\ESET Online Scanner
  • Отворете файла log.txt , копирайте съдържанието му и го поставете в следващия си коментар.
  • Автор

Окей, ще се заема с това утре. Благодаря ти отново за отделеното време, и до понеделник!

Супер..!Не забравяйте след сканиранията да си преинсталирате и антивирусната програма AVG...!

За тази вечер остана следното..:

Деинсталирайте Комбофикс така:

1.Натиснете Start ==> Run ==> въведете командата Combofix /Uninstall ==> OK

Публикувано изображение

2.Изтеглете Публикувано изображениеOTCleanIt или от тук,стартирайте и натиснете Публикувано изображение

Освен това изтрийте и всички други останали програми и логове които използвахме в процеса на лечение..!

Архивирана тема

Темата е твърде стара и е архивирана. Не можете да добавяте нови отговори в нея, но винаги можете да публикувате нова тема, в която да продължи дискусията. Регистрирайте се или влезте във вашия профил за да публикувате нова тема.

Назад

Разглеждащи това в момента 0

  • Няма регистрирани потребители разглеждащи тази страница.

Дарение

  • Подкрепи съществуването на форума - направи дарение
    32%
    Дарени 315 € от нужните 1 000 €

Бюлетин

Получавайте известие, когато има важна промяна или новина свързана с форума.
Абонирайте се

Профил

Навигация

Търсене

Търсене

Конфигуриране на push известия в браузъра
Chrome (Android)
  1. Докоснете иконата на катинар до адресната лента.
  2. Докоснете Разрешения → Известия.
  3. Променете предпочитанията си.
Chrome (Desktop)
  1. Кликнете върху иконата на катинар в адресната лента.
  2. Изберете Настройки на сайта.
  3. Намерете Известия и коригирайте предпочитанията си.