След сканиране с Avira Antivir Personal-free version, получих следният доклад, който показва за наличие на 5 hidden objects: Avira AntiVir Personal Report file date: Thursday, December 08, 2011 09:11 Scanning for 3537942 virus strains and unwanted programs. The program is running as an unrestricted full version. Online services are available: Licensee : Avira AntiVir Personal - Free Antivirus Serial number : 0000149996-ADJIE-0000001 Platform : Windows 7 x64 Windows version : (Service Pack 1) [6.1.7601] Boot mode : Normally booted Username : SYSTEM Computer name : ACER-PC Version information: BUILD.DAT : 10.2.0.704 35934 Bytes 28.9.2011 г. 13:34:00 AVSCAN.EXE : 10.3.0.7 484008 Bytes 29.6.2011 г. 07:57:42 AVSCAN.DLL : 10.0.5.0 47464 Bytes 29.6.2011 г. 07:57:42 LUKE.DLL : 10.3.0.5 45416 Bytes 29.6.2011 г. 07:57:43 LUKERES.DLL : 10.0.0.1 12648 Bytes 10.2.2010 г. 21:40:49 AVSCPLR.DLL : 10.3.0.7 119656 Bytes 29.6.2011 г. 07:57:43 AVREG.DLL : 10.3.0.9 88833 Bytes 13.7.2011 г. 05:52:50 VBASE000.VDF : 7.10.0.0 19875328 Bytes 6.11.2009 г. 07:05:36 VBASE001.VDF : 7.11.0.0 13342208 Bytes 14.12.2010 г. 14:44:44 VBASE002.VDF : 7.11.3.0 1950720 Bytes 9.2.2011 г. 14:45:19 VBASE003.VDF : 7.11.5.225 1980416 Bytes 7.4.2011 г. 14:46:04 VBASE004.VDF : 7.11.8.178 2354176 Bytes 31.5.2011 г. 05:23:16 VBASE005.VDF : 7.11.10.251 1788416 Bytes 7.7.2011 г. 10:22:00 VBASE006.VDF : 7.11.13.60 6411776 Bytes 16.8.2011 г. 07:30:00 VBASE007.VDF : 7.11.15.106 2389504 Bytes 5.10.2011 г. 05:04:07 VBASE008.VDF : 7.11.18.32 2132992 Bytes 24.11.2011 г. 06:34:48 VBASE009.VDF : 7.11.18.33 2048 Bytes 24.11.2011 г. 06:34:48 VBASE010.VDF : 7.11.18.34 2048 Bytes 24.11.2011 г. 06:34:48 VBASE011.VDF : 7.11.18.35 2048 Bytes 24.11.2011 г. 06:34:48 VBASE012.VDF : 7.11.18.36 2048 Bytes 24.11.2011 г. 06:34:48 VBASE013.VDF : 7.11.18.89 204800 Bytes 28.11.2011 г. 06:37:17 VBASE014.VDF : 7.11.18.145 143872 Bytes 1.12.2011 г. 07:10:07 VBASE015.VDF : 7.11.18.180 173056 Bytes 2.12.2011 г. 07:10:07 VBASE016.VDF : 7.11.18.208 164864 Bytes 5.12.2011 г. 06:43:26 VBASE017.VDF : 7.11.18.239 177152 Bytes 6.12.2011 г. 06:43:26 VBASE018.VDF : 7.11.18.240 2048 Bytes 6.12.2011 г. 06:43:26 VBASE019.VDF : 7.11.18.241 2048 Bytes 6.12.2011 г. 06:43:26 VBASE020.VDF : 7.11.18.242 2048 Bytes 6.12.2011 г. 06:43:26 VBASE021.VDF : 7.11.18.243 2048 Bytes 6.12.2011 г. 06:43:26 VBASE022.VDF : 7.11.18.244 2048 Bytes 6.12.2011 г. 06:43:26 VBASE023.VDF : 7.11.18.245 2048 Bytes 6.12.2011 г. 06:43:26 VBASE024.VDF : 7.11.18.246 2048 Bytes 6.12.2011 г. 06:43:26 VBASE025.VDF : 7.11.18.247 2048 Bytes 6.12.2011 г. 06:43:27 VBASE026.VDF : 7.11.18.248 2048 Bytes 6.12.2011 г. 06:43:27 VBASE027.VDF : 7.11.18.249 2048 Bytes 6.12.2011 г. 06:43:27 VBASE028.VDF : 7.11.18.250 2048 Bytes 6.12.2011 г. 06:43:27 VBASE029.VDF : 7.11.18.251 2048 Bytes 6.12.2011 г. 06:43:27 VBASE030.VDF : 7.11.18.252 2048 Bytes 6.12.2011 г. 06:43:27 VBASE031.VDF : 7.11.19.5 18432 Bytes 7.12.2011 г. 06:43:27 Engineversion : 8.2.6.128 AEVDF.DLL : 8.1.2.2 106868 Bytes 28.10.2011 г. 08:39:30 AESCRIPT.DLL : 8.1.3.88 479611 Bytes 3.12.2011 г. 07:10:12 AESCN.DLL : 8.1.7.2 127349 Bytes 20.5.2011 г. 14:47:58 AESBX.DLL : 8.2.4.5 434549 Bytes 3.12.2011 г. 07:10:13 AERDL.DLL : 8.1.9.15 639348 Bytes 10.9.2011 г. 05:59:16 AEPACK.DLL : 8.2.14.4 741752 Bytes 3.12.2011 г. 07:10:12 AEOFFICE.DLL : 8.1.2.21 201084 Bytes 3.12.2011 г. 07:10:11 AEHEUR.DLL : 8.1.3.3 3871095 Bytes 3.12.2011 г. 07:10:11 AEHELP.DLL : 8.1.18.0 254327 Bytes 28.10.2011 г. 08:39:26 AEGEN.DLL : 8.1.5.15 405878 Bytes 3.12.2011 г. 07:10:08 AEEMU.DLL : 8.1.3.0 393589 Bytes 20.5.2011 г. 14:47:07 AECORE.DLL : 8.1.24.0 196983 Bytes 28.10.2011 г. 08:39:26 AEBB.DLL : 8.1.1.0 53618 Bytes 20.5.2011 г. 14:47:05 AVWINLL.DLL : 10.0.0.0 19304 Bytes 14.1.2010 г. 10:03:38 AVPREF.DLL : 10.0.3.2 44904 Bytes 29.6.2011 г. 07:57:42 AVREP.DLL : 10.0.0.10 174120 Bytes 20.5.2011 г. 14:48:19 AVARKT.DLL : 10.0.26.1 255336 Bytes 29.6.2011 г. 07:57:42 AVEVTLOG.DLL : 10.0.0.9 203112 Bytes 29.6.2011 г. 07:57:42 SQLITE3.DLL : 3.6.19.0 355688 Bytes 28.1.2010 г. 10:57:58 AVSMTP.DLL : 10.0.0.17 63848 Bytes 16.3.2010 г. 13:38:56 NETNT.DLL : 10.0.0.0 11624 Bytes 19.2.2010 г. 12:41:00 RCIMAGE.DLL : 10.0.0.35 2589544 Bytes 29.6.2011 г. 07:57:42 RCTEXT.DLL : 10.0.64.0 97640 Bytes 29.6.2011 г. 07:57:42 Configuration settings for the scan: Jobname.............................: Complete system scan Configuration file..................: C:\ProgramData\Avira\AntiVir Desktop\PROFILES\AVSCAN-20111207-235345-C19A2F70.avp Logging.............................: Default Primary action......................: interactive Secondary action....................: ignore Scan master boot sector.............: on Scan boot sector....................: on Boot sectors........................: C:, D:, E:, F:, Process scan........................: on Extended process scan...............: on Scan registry.......................: on Search for rootkits.................: on Integrity checking of system files..: off Scan all files......................: All files Scan archives.......................: on Recursion depth.....................: 20 Smart extensions....................: on Macro heuristic.....................: on File heuristic......................: Advanced Deviating risk categories...........: +PCK,+SPR, Start of the scan: Thursday, December 08, 2011 09:11 Starting search for hidden objects. HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows CE Services\symboliclinkvalue [NOTE] The registry entry is invisible. HKEY_LOCAL_MACHINE\System\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0009\Linkage\upperbind [NOTE] The registry entry is invisible. HKEY_LOCAL_MACHINE\System\ControlSet001\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage\bind [NOTE] The registry entry is invisible. HKEY_LOCAL_MACHINE\System\ControlSet001\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage\route [NOTE] The registry entry is invisible. HKEY_LOCAL_MACHINE\System\ControlSet001\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage\export [NOTE] The registry entry is invisible. The scan of running processes will be started Scan process 'opera.exe' - '87' Module(s) have been scanned Scan process 'daemonu.exe' - '56' Module(s) have been scanned Scan process 'avscan.exe' - '76' Module(s) have been scanned Scan process 'avscan.exe' - '30' Module(s) have been scanned Scan process 'ymsgr_tray.exe' - '37' Module(s) have been scanned Scan process 'jusched.exe' - '26' Module(s) have been scanned Scan process 'SweetIM.exe' - '61' Module(s) have been scanned Scan process 'YahooAUService.exe' - '63' Module(s) have been scanned Scan process 'nvSCPAPISvr.exe' - '31' Module(s) have been scanned Scan process 'trans.exe' - '101' Module(s) have been scanned Scan process 'sqlservr.exe' - '62' Module(s) have been scanned Scan process 'avgnt.exe' - '58' Module(s) have been scanned Scan process 'avguard.exe' - '67' Module(s) have been scanned Scan process 'armsvc.exe' - '25' Module(s) have been scanned Scan process 'tccargo.exe' - '56' Module(s) have been scanned Scan process 'uTorrent.exe' - '59' Module(s) have been scanned Scan process 'vVX3000.exe' - '28' Module(s) have been scanned Scan process 'sched.exe' - '48' Module(s) have been scanned Starting master boot sector scan: Master boot sector HD0 [iNFO] No virus was found! Master boot sector HD1 [iNFO] No virus was found! Master boot sector HD2 [iNFO] No virus was found! Master boot sector HD3 [iNFO] No virus was found! Master boot sector HD4 [iNFO] No virus was found! Master boot sector HD5 [iNFO] No virus was found! Start scanning boot sectors: Boot sector 'C:\' [iNFO] No virus was found! Boot sector 'D:\' [iNFO] No virus was found! Boot sector 'E:\' [iNFO] No virus was found! Boot sector 'F:\' [iNFO] No virus was found! Starting to scan executable files (registry). The registry was scanned ( '179' files ). Starting the file scan: Begin scan in 'C:\' Begin scan in 'D:\' <Volume> Begin scan in 'E:\' <WORK> Begin scan in 'F:\' <DATA> End of the scan: Thursday, December 08, 2011 11:32 Used time: 2:21:23 Hour(s) The scan has been done completely. 30309 Scanned directories 714193 Files were scanned 0 Viruses and/or unwanted programs were found 0 Files were classified as suspicious 0 files were deleted 0 Viruses and unwanted programs were repaired 0 Files were moved to quarantine 0 Files were renamed 0 Files cannot be scanned 714193 Files not concerned 18514 Archives were scanned 0 Warnings 5 Notes 497545 Objects were scanned with rootkit scan 5 Hidden objects were found Какво трябва да направя в този случай?Благодаря предварително

Не разбирам защо създавате втора тема....Аз ли не обясних правилно..!Подгответе дневници от сканирането с програмата DDS....Точка 5 от темата:Системата ми е инфектирана - Какво да правя сега?

Не, просто аз не съм разбрала правилно,за което съжалявам!Ще направя това което казвате!Благодаря

Супер...ще изтрия другата тема ....и ще продължим да пишем в тази..!

Надявам се този път да съм се справила.След като изпълних всичко ето какво се получи: . DDS (Ver_2011-08-26.01) - NTFSAMD64 Internet Explorer: 8.0.7601.17514 BrowserJavaVersion: 1.6.0_29 Run by admin at 12:56:10 on 2011-12-08 Microsoft Windows 7 Ultimate 6.1.7601.1.1251.359.1033.18.4095.2642 [GMT 2:00] . AV: AntiVir Desktop *Enabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} SP: AntiVir Desktop *Enabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A} . ============== Running Processes =============== . C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\nvvsvc.exe C:\Windows\system32\svchost.exe -k RPCSS C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k LocalService C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe C:\Windows\system32\nvvsvc.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\System32\spoolsv.exe C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe C:\Windows\system32\taskhost.exe C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe C:\Windows\vVX3000.exe C:\Windows\WindowsMobile\wmdc.exe C:\Program Files (x86)\uTorrent\uTorrent.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Program Files\Windows Sidebar\sidebar.exe C:\TCCARGO\tccargo.exe C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe C:\Program Files\Microsoft LifeCam\MSCamS64.exe c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe C:\Windows\system32\conhost.exe C:\Program Files (x86)\Trans\trans.exe c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe C:\Windows\system32\svchost.exe -k imgsvc C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Program Files\NVIDIA Corporation\Display\nvtray.exe C:\PROGRA~2\Yahoo!\MESSEN~1\ymsgr_tray.exe C:\Windows\system32\svchost.exe -k WindowsMobile C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\WUDFHost.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Windows\System32\svchost.exe -k LocalServicePeerNet C:\Program Files (x86)\Avira\AntiVir Desktop\avscan.exe C:\Program Files (x86)\Avira\AntiVir Desktop\avscan.exe C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe C:\Windows\System32\svchost.exe -k secsvcs C:\PROGRA~2\MICROS~1\OFFICE11\ois.exe C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\conhost.exe C:\Windows\system32\DllHost.exe C:\Windows\SysWOW64\cscript.exe C:\Windows\system32\wbem\wmiprvse.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://eu.ask.com/?l=dis&o=1716&gct=hp mDefault_Page_URL = hxxp://www.yahoo.com/?ilc=8 mStart Page = hxxp://www.yahoo.com/?ilc=8 uURLSearchHooks: UrlSearchHook Class: {00000000-6e41-4fd3-8538-502f5495e5fc} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll uURLSearchHooks: YTNavAssist.YTNavAssistPlugin Class: {81017ea9-9aa8-4a6a-9734-7af40e7d593f} - C:\PROGRA~2\Yahoo!\Companion\Installs\cpn0\YTNavAssist.dll uURLSearchHooks: SweetIM ToolbarURLSearchHook Class: {eee6c35d-6118-11dc-9c72-001320c79847} - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgHelper.dll mWinlogon: Userinit=userinit.exe BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - C:\PROGRA~2\Yahoo!\Companion\Installs\cpn0\yt.dll BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO: Skype Browser Helper: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll BHO: Softonic Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll BHO: SweetIM Toolbar Helper: {eee6c35c-6118-11dc-9c72-001320c79847} - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - C:\PROGRA~2\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - C:\PROGRA~2\Yahoo!\Companion\Installs\cpn0\yt.dll TB: SweetIM Toolbar for Internet Explorer: {eee6c35b-6118-11dc-9c72-001320c79847} - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll TB: Softonic Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll uRun: [uTorrent] "C:\Program Files (x86)\uTorrent\uTorrent.exe" uRun: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun uRun: [Google Update] "C:\Users\admin\AppData\Local\Google\Update\GoogleUpdate.exe" /c uRun: [Messenger (Yahoo!)] ~"C:\PROGRA~2\Yahoo!\MESSEN~1\YahooMessenger.exe" -quiet uRun: [TC Login] c:\tccargo\tccargo.exe --autostart mRun: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min mRun: [LifeCam] "C:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe" mRun: [Trans] C:\Program Files (x86)\Trans\trans.exe mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" mRun: [sweetIM] C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe mRun: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" mRun: [<NO NAME>] mRun: [ApnUpdater] "C:\Program Files (x86)\Ask.com\Updater\Updater.exe" mPolicies-explorer: NoActiveDesktop = 1 (0x1) mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1) mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0) mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3) mPolicies-system: EnableLUA = 0 (0x0) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) mPolicies-system: PromptOnSecureDesktop = 0 (0x0) IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\OFFICE11\EXCEL.EXE/3000 IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~1\OFFICE11\REFIEBAR.DLL DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab TCP: DhcpNameServer = 192.168.15.1 TCP: Interfaces\{70070C10-E0CF-45DB-8C32-2587B406A6EE} : DhcpNameServer = 192.168.15.1 Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll BHO-X64: &Yahoo! Toolbar Helper: {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~2\Yahoo!\Companion\Installs\cpn0\yt.dll BHO-X64: 0x1 - No File BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO-X64: AcroIEHelperStub - No File BHO-X64: Skype Browser Helper: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll BHO-X64: SkypeIEPluginBHO - No File BHO-X64: Softonic Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll BHO-X64: Ask Toolbar BHO - No File BHO-X64: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll BHO-X64: SweetIM Toolbar Helper: {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll BHO-X64: SWEETIE - No File BHO-X64: SingleInstance Class: {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\PROGRA~2\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll TB-X64: Yahoo! Toolbar: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~2\Yahoo!\Companion\Installs\cpn0\yt.dll TB-X64: SweetIM Toolbar for Internet Explorer: {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll TB-X64: Softonic Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll mRun-x64: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min mRun-x64: [LifeCam] "C:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe" mRun-x64: [Trans] C:\Program Files (x86)\Trans\trans.exe mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" mRun-x64: [sweetIM] C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe mRun-x64: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" mRun-x64: [(Default)] mRun-x64: [ApnUpdater] "C:\Program Files (x86)\Ask.com\Updater\Updater.exe" . ================= FIREFOX =================== . FF - ProfilePath - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8tcqd6hp.default\ FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?fr=mkg030&p= FF - prefs.js: browser.search.selectedEngine - Yahoo FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/?ilc=8 FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=mkg030&p= FF - plugin: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll FF - plugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll FF - plugin: C:\Users\admin\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll FF - plugin: C:\Users\admin\AppData\Local\Yahoo!\BrowserPlus\2.9.8\Plugins\npybrowserplus_2.9.8.dll FF - plugin: C:\Users\admin\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll . ---- FIREFOX POLICIES ---- FF - user.js: yahoo.ytff.general.dontshowhpoffer - true ============= SERVICES / DRIVERS =============== . R2 AdobeARMservice;Adobe Acrobat Update Service;C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-6-6 64952] R2 AntiVirSchedulerService;Avira AntiVir Scheduler;C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [2011-5-20 136360] R2 AntiVirService;Avira AntiVir Guard;C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [2011-5-20 269480] R2 avgntflt;avgntflt;C:\Windows\system32\DRIVERS\avgntflt.sys --> C:\Windows\system32\DRIVERS\avgntflt.sys [?] R2 nvUpdatusService;NVIDIA Update Service Daemon;C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-5-20 2218600] R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-4-7 378472] R3 NVHDA;Service for NVIDIA High Definition Audio Driver;C:\Windows\system32\drivers\nvhda64v.sys --> C:\Windows\system32\drivers\nvhda64v.sys [?] R3 RTL85n64;Realtek 8180/8185 Extensible 802.11 Wireless Device Driver;C:\Windows\system32\DRIVERS\RTL85n64.sys --> C:\Windows\system32\DRIVERS\RTL85n64.sys [?] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576] S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\system32\drivers\rdpvideominiport.sys --> C:\Windows\system32\drivers\rdpvideominiport.sys [?] S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?] S3 WatAdminSvc;Услуга на технологиите за активиране на Windows;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?] SUnknown tsusbhub;tsusbhub; [x] . =============== Created Last 30 ================ . 2011-12-08 07:12:47 69000 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{65FF0F56-F347-4BEC-9FB0-8B17906E1243}\offreg.dll 2011-12-08 06:15:03 8822856 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{65FF0F56-F347-4BEC-9FB0-8B17906E1243}\mpengine.dll 2011-11-25 16:20:59 2605920 ----a-w- C:\Windows\System32\D3DCompiler_40.dll 2011-11-25 16:16:46 -------- d-----w- C:\Program Files (x86)\Bounty Hounds Online 2011-11-25 16:03:12 -------- d-----w- C:\Users\admin\AppData\Local\PMB Files 2011-11-25 16:03:10 -------- d-----w- C:\ProgramData\PMB Files 2011-11-25 16:03:02 -------- d-----w- C:\Program Files (x86)\Pando Networks 2011-11-20 16:01:57 -------- d-----w- C:\Program Files (x86)\Activision 2011-11-20 11:04:08 -------- d-----w- C:\Users\admin\AppData\Local\PackageAware 2011-11-20 11:02:20 -------- d-----w- C:\Program Files (x86)\Ask.com 2011-11-19 15:22:18 -------- d-----w- C:\Program Files (x86)\Black_Box 2011-11-19 08:30:45 -------- d-----w- C:\Program Files (x86)\Activision Value 2011-11-19 07:01:10 -------- d-----w- C:\Users\admin\AppData\Roaming\Trio 2011-11-19 06:12:35 -------- d-----w- C:\Users\admin\AppData\Roaming\Cosmonaut Games 2011-11-19 06:11:04 -------- d-----w- C:\Program Files (x86)\Dive - The Medes Islands Secret 2011-11-18 20:02:17 -------- d-----w- C:\Program Files (x86)\The Three Musketeers 2011-11-18 17:53:24 -------- d-----w- C:\Users\admin\AppData\Roaming\dingogames 2011-11-18 17:53:24 -------- d-----w- C:\ProgramData\dingogames 2011-11-18 17:50:11 -------- d-----w- C:\ProgramData\Big Fish Games 2011-11-18 17:50:08 -------- d-----w- C:\Program Files (x86)\bfgclient 2011-11-18 17:46:00 -------- d-----w- C:\BigFishGamesCache 2011-11-18 17:21:01 -------- d-----w- C:\ProgramData\DivoGames 2011-11-18 16:34:03 -------- d-----w- C:\Program Files (x86)\MyRealGames.com 2011-11-18 16:11:58 -------- d-----w- C:\Users\admin\AppData\Roaming\URSE Games 2011-11-09 06:15:55 886784 ----a-w- C:\Program Files\Common Files\System\wab32.dll 2011-11-09 06:15:55 708608 ----a-w- C:\Program Files (x86)\Common Files\System\wab32.dll 2011-11-09 06:15:53 3144704 ----a-w- C:\Windows\System32\win32k.sys 2011-11-09 06:15:53 1923952 ----a-w- C:\Windows\System32\drivers\tcpip.sys . ==================== Find3M ==================== . 2011-11-23 18:47:12 414368 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl 2011-10-16 13:44:48 1700352 ----a-w- C:\Windows\SysWow64\gdiplus.dll 2011-10-03 02:06:03 472808 ----a-w- C:\Windows\SysWow64\deployJava1.dll 2011-10-01 03:25:37 1638912 ----a-w- C:\Windows\System32\mshtml.tlb 2011-10-01 02:42:56 1638912 ----a-w- C:\Windows\SysWow64\mshtml.tlb . ============= FINISH: 12:57:02,57 =============== а ето тук и другият : . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2011-08-26.01) . Microsoft Windows 7 Ultimate Boot Device: \Device\HarddiskVolume1 Install Date: 20.5.2011 г. 18:11:10 System Uptime: 8.12.2011 г. 09:09:01 (3 hours ago) . Motherboard: ACER | | MCP73PV Processor: Intel® Core2 Quad CPU Q8200 @ 2.33GHz | SOCKET775 M/B | 1985/333mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 154 GiB total, 66,98 GiB free. D: is FIXED (NTFS) - 298 GiB total, 110,832 GiB free. E: is FIXED (NTFS) - 596 GiB total, 19,062 GiB free. F: is FIXED (NTFS) - 144 GiB total, 76,223 GiB free. G: is CDROM () H: is Removable I: is Removable J: is Removable K: is Removable . ==== Disabled Device Manager Items ============= . Class GUID: Description: Coprocessor Device ID: PCI\VEN_10DE&DEV_07DA&SUBSYS_01371025&REV_A2\3&267A616A&0&1B Manufacturer: Name: Coprocessor PNP Device ID: PCI\VEN_10DE&DEV_07DA&SUBSYS_01371025&REV_A2\3&267A616A&0&1B Service: . ==== System Restore Points =================== . RP90: 7.12.2011 г. 16:07:39 - Scheduled Checkpoint . ==== Installed Programs ====================== . µTorrent Adobe Flash Player 10 ActiveX Adobe Flash Player 11 Plugin Adobe Reader X (10.1.1) ALADDIN NASIRAS REVENGE Ashampoo Burning Studio 10.0.1 Ask Toolbar Avira AntiVir Personal - Free Antivirus Battle for the Pacific Big Fish Games: Game Manager Bounty Hounds Online Call of Duty® 4 - Modern Warfare Demo Compatibility Pack for the 2007 Office system Crystal Reports 2008 Runtime SP2 Dive: The Medes Islands Secret Diver Jimmy Football Manager 2008 Fun And Bullets Google Chrome Harry Potter and the Deathly Hallows - Part 2 Helicopter Wars Java Auto Updater Java 6 Update 29 LEGO Universe LEGO® Indiana Jones™ Microsoft Corporation Microsoft Office Professional Edition 2003 Microsoft SQL Server 2005 Microsoft SQL Server 2005 Express Edition Microsoft SQL Server 2005 Tools Express Edition Microsoft SQL Server Setup Support Files (English) Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2005 Redistributable - KB2467175 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Mozilla Firefox 6.0.2 (x86 bg) NVIDIA 3D Vision Controller Driver NVIDIA PhysX NVIDIA Stereoscopic 3D Driver Opera 11.60 Pando Media Booster Police Supercars Racing Realtek High Definition Audio Driver Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708) Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663) Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636) Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078) Security Update for Microsoft .NET Framework 4 Extended (KB2416472) Security Update for Microsoft .NET Framework 4 Extended (KB2487367) Sky Fight - WW2 Skype Click to Call Skype™ 5.5 Sniper Ghost Warrior Super Motocross Africa Super Motocross Deluxe SweetIM for Messenger 3.6 SweetIM Toolbar for Internet Explorer 4.1 TC Login The Cursed Crusade version 1.0 The KMPlayer (remove only) The Three Musketeers TRANS 3.3.2.989 Trio - The Great Settlement Unity Web Player Update for Microsoft .NET Framework 4 Client Profile (KB2468871) Update for Microsoft .NET Framework 4 Client Profile (KB2473228) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) Update for Microsoft .NET Framework 4 Extended (KB2468871) Update for Microsoft .NET Framework 4 Extended (KB2533523) Winamp Winamp Detector Plug-in Windows 7 Codec Pack 2.6.1 Yahoo! BrowserPlus 2.9.8 Yahoo! Messenger Yahoo! Software Update Yahoo! Toolbar . ==== Event Viewer Messages From Past Week ======== . 8.12.2011 г. 08:14:36, Error: Service Control Manager [7011] - Изтекъл период на изчакване (30000 милисекунди) при изчакване на отговор за транзакция от услуга ShellHWDetection. 6.12.2011 г. 21:43:32, Error: volsnap [36] - The shadow copies of volume C: were aborted because the shadow copy storage could not grow due to a user imposed limit. 3.12.2011 г. 16:08:44, Error: volsnap [36] - The shadow copies of volume C: were aborted because the shadow copy storage could not grow due to a user imposed limit. 2.12.2011 г. 22:42:35, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk6\DR11. 2.12.2011 г. 22:42:34, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk6\DR11. . ==== End Of File ===========================

Перфектно се справяте..!Дневниците изглеждат наред...!Да направим така:

Изтеглете OTL.exe и го запазете на десктопа.

• Стартирайте OTL (ако е необходимо, потвърдете през UAC).
• Направете следните настройки:
• Сложете отметка пред Scan All Users
• Под менюто File Age => изберете 90 days
• Под менюто Standard Registry => променете на ALL
• Сложете отметки пред LOP и Purity Check

Под с Copy/ Paste въведете изцяло следната текстова информация (само това, което е поставено в карето):

netsvcs
msconfig
%SYSTEMDRIVE%\*.*
%USERPROFILE%\*.*
%USERPROFILE%\AppData\Local\*.*
%USERPROFILE%\AppData\Roaming\*.*
%ProgramData%\*.*
%CommonProgramFiles%\*.*
%PROGRAMFILES%\*.*
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\system32\drivers\*.sys /90
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\system32\Spool\prtprocs\w32x86\*.dll
/md5start
hlp.dat
winlogon.exe
wininit.exe
userinit.exe
explorer.exe
volsnap.sys
/md5stop

• Натиснете маркираният в синьо бутон: Run Scan.
• Като приключи проверката, ще се създадат два файла - OTL.Txt и Extras.Txt. Прикачете тези два файла в следващия си коментар (погледнете опцията "прикачени файлове", когато публикувате мнение).

Изпращам прикачените файлове!Extras.TxtOTL.Txt

Стартирайте отново OTL, копирайте (Copy) и поставете (Paste) скриптовия текст от текстовото поле по-долу под колонката Custom Scans/Fixes, като не забравяте да копирате скрипта 1 към 1, както и двете точки преди първия ред на скрипта.

:OTL
O4 - HKLM..\Run: []  File not found
O4 - HKU\S-1-5-21-1305609434-155683069-39690213-1000..\Run: [Messenger (Yahoo!)] ~"C:\PROGRA~2\Yahoo!\MESSEN~1\YahooMessenger.exe" -quiet File not found
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-21-1305609434-155683069-39690213-1001..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O18:[b]64bit:[/b] - Protocol\Handler\http\0x00000001 - No CLSID value found
O18:[b]64bit:[/b] - Protocol\Handler\http\oledb - No CLSID value found
O18:[b]64bit:[/b] - Protocol\Handler\https\0x00000001 - No CLSID value found
O18:[b]64bit:[/b] - Protocol\Handler\https\oledb - No CLSID value found
O18:[b]64bit:[/b] - Protocol\Handler\msdaipp - No CLSID value found
O18:[b]64bit:[/b] - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found
O18:[b]64bit:[/b] - Protocol\Handler\msdaipp\oledb - No CLSID value found
O18:[b]64bit:[/b] - Protocol\Handler\mso-offdap11 - No CLSID value found
O18:[b]64bit:[/b] - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18 - Protocol\Handler\msdaipp - No CLSID value found
O18:[b]64bit:[/b] - Protocol\Filter\text/xml - No CLSID value found
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21:[b]64bit:[/b] - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
@Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:F35F4269
@Alternate Data Stream - 139 bytes -> C:\ProgramData\TEMP:D3904CCE
@Alternate Data Stream - 135 bytes -> C:\ProgramData\TEMP:71B89F61
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:710F4DBF

:Reg

:files

autorun.inf /alldrives
autorun.exe /alldrives
recycler /alldrives
ipconfig /flushdns /c

:Commands
[purity]
[emptytemp]
[resethosts]
[clearallrestorepoints]
[emptyflash]
[Reboot]

След като въведете скрипта от цитата по-горе натиснете бутона, маркиран в червено: Run Fix

Windows ще се рестартира и ще се създаде лог файл. Публикувайте съдържанието му с Copy/Paste в следващия си коментар.

Ето и файла:

All processes killed

========== OTL ==========

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.

Registry value HKEY_USERS\S-1-5-21-1305609434-155683069-39690213-1000\Software\Microsoft\Windows\CurrentVersion\Run\\Messenger (Yahoo!) deleted successfully.

Registry value HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.

Registry value HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.

Registry value HKEY_USERS\S-1-5-21-1305609434-155683069-39690213-1001\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\msdaipp\ deleted successfully.

File Protocol\Handler\msdaipp - No CLSID value found not found.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet:/pagefile deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.

ADS C:\ProgramData\TEMP:F35F4269 deleted successfully.

ADS C:\ProgramData\TEMP:D3904CCE deleted successfully.

ADS C:\ProgramData\TEMP:71B89F61 deleted successfully.

ADS C:\ProgramData\TEMP:710F4DBF deleted successfully.

========== REGISTRY ==========

========== FILES ==========

autorun.inf not found in C:\

autorun.inf not found in D:\

autorun.inf not found in E:\

autorun.inf not found in F:\

autorun.exe not found in C:\

autorun.exe not found in D:\

autorun.exe not found in E:\

autorun.exe not found in F:\

recycler not found in C:\

recycler not found in D:\

recycler not found in E:\

recycler not found in F:\

< ipconfig /flushdns /c >

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

C:\Users\admin\Desktop\cmd.bat deleted successfully.

C:\Users\admin\Desktop\cmd.txt deleted successfully.

========== COMMANDS ==========

[EMPTYTEMP]

User: admin

->Temp folder emptied: 642582795 bytes

->Temporary Internet Files folder emptied: 40105020 bytes

->Java cache emptied: 4024708 bytes

->FireFox cache emptied: 60430446 bytes

->Google Chrome cache emptied: 16543562 bytes

->Opera cache emptied: 16668374 bytes

->Flash cache emptied: 3536102 bytes

User: All Users

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

User: Public

User: UpdatusUser

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32 (64bit) .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 69787872 bytes

%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50333 bytes

RecycleBin emptied: 0 bytes

Total Files Cleaned = 814,00 mb

C:\Windows\System32\drivers\etc\Hosts moved successfully.

HOSTS file reset successfully

Restore point Set: OTL Restore Point

[EMPTYFLASH]

User: admin

->Flash cache emptied: 0 bytes

User: All Users

User: Default

User: Default User

User: Public

User: UpdatusUser

Total Flash Files Cleaned = 0,00 mb

OTL by OldTimer - Version 3.2.31.0 log created on 12082011_142052

Files\Folders moved on Reboot...

C:\Users\admin\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

Registry entries deleted on Reboot...

Този последен текстови файл да го затворя или преди това да го съхраня на Десктопа?

Този последен текстови файл да го затворя или преди това да го съхраня на Десктопа?

Затворете го и пуснете сканиране с Авира за да видим до къде сме я докарали..!

ок. Какво сканиране да пусна? Бързо ще свърши ли работа? или...? и още един въпрос: необходимо ли е да изтрия ли всички програми, които стартирах /във връзка със целият този процес/, както и всички последвали ги файлове,които Ви изпращах преди да стартирам сканирането?

ок. Какво сканиране да пусна? Бързо ще свърши ли работа? или...?

Пълно е за предпочотане..!

и още един въпрос: необходимо ли е да изтрия ли всички програми, които стартирах /във връзка със целият този процес/, както и всички последвали ги файлове,които Ви изпращах преди да стартирам сканирането?

Това ще направим след като приключим с всичко....!

Пълното сканиране отне доста време, но ето готово е.От 5 скритите обекти намаляха на 1. Ето и файла: Avira AntiVir Personal Report file date: 08 декември 2011 г. 15:29 Scanning for 3545392 virus strains and unwanted programs. The program is running as an unrestricted full version. Online services are available: Licensee : Avira AntiVir Personal - Free Antivirus Serial number : 0000149996-ADJIE-0000001 Platform : Windows 7 x64 Windows version : (Service Pack 1) [6.1.7601] Boot mode : Normally booted Username : admin Computer name : ACER-PC Version information: BUILD.DAT : 10.2.0.704 35934 Bytes 28.9.2011 г. 13:34:00 AVSCAN.EXE : 10.3.0.7 484008 Bytes 29.6.2011 г. 07:57:42 AVSCAN.DLL : 10.0.5.0 47464 Bytes 29.6.2011 г. 07:57:42 LUKE.DLL : 10.3.0.5 45416 Bytes 29.6.2011 г. 07:57:43 LUKERES.DLL : 10.0.0.1 12648 Bytes 10.2.2010 г. 21:40:49 AVSCPLR.DLL : 10.3.0.7 119656 Bytes 29.6.2011 г. 07:57:43 AVREG.DLL : 10.3.0.9 88833 Bytes 13.7.2011 г. 05:52:50 VBASE000.VDF : 7.10.0.0 19875328 Bytes 6.11.2009 г. 07:05:36 VBASE001.VDF : 7.11.0.0 13342208 Bytes 14.12.2010 г. 14:44:44 VBASE002.VDF : 7.11.3.0 1950720 Bytes 9.2.2011 г. 14:45:19 VBASE003.VDF : 7.11.5.225 1980416 Bytes 7.4.2011 г. 14:46:04 VBASE004.VDF : 7.11.8.178 2354176 Bytes 31.5.2011 г. 05:23:16 VBASE005.VDF : 7.11.10.251 1788416 Bytes 7.7.2011 г. 10:22:00 VBASE006.VDF : 7.11.13.60 6411776 Bytes 16.8.2011 г. 07:30:00 VBASE007.VDF : 7.11.15.106 2389504 Bytes 5.10.2011 г. 05:04:07 VBASE008.VDF : 7.11.18.32 2132992 Bytes 24.11.2011 г. 06:34:48 VBASE009.VDF : 7.11.18.33 2048 Bytes 24.11.2011 г. 06:34:48 VBASE010.VDF : 7.11.18.34 2048 Bytes 24.11.2011 г. 06:34:48 VBASE011.VDF : 7.11.18.35 2048 Bytes 24.11.2011 г. 06:34:48 VBASE012.VDF : 7.11.18.36 2048 Bytes 24.11.2011 г. 06:34:48 VBASE013.VDF : 7.11.18.89 204800 Bytes 28.11.2011 г. 06:37:17 VBASE014.VDF : 7.11.18.145 143872 Bytes 1.12.2011 г. 07:10:07 VBASE015.VDF : 7.11.18.180 173056 Bytes 2.12.2011 г. 07:10:07 VBASE016.VDF : 7.11.18.208 164864 Bytes 5.12.2011 г. 06:43:26 VBASE017.VDF : 7.11.18.239 177152 Bytes 6.12.2011 г. 06:43:26 VBASE018.VDF : 7.11.18.240 2048 Bytes 6.12.2011 г. 06:43:26 VBASE019.VDF : 7.11.18.241 2048 Bytes 6.12.2011 г. 06:43:26 VBASE020.VDF : 7.11.18.242 2048 Bytes 6.12.2011 г. 06:43:26 VBASE021.VDF : 7.11.18.243 2048 Bytes 6.12.2011 г. 06:43:26 VBASE022.VDF : 7.11.18.244 2048 Bytes 6.12.2011 г. 06:43:26 VBASE023.VDF : 7.11.18.245 2048 Bytes 6.12.2011 г. 06:43:26 VBASE024.VDF : 7.11.18.246 2048 Bytes 6.12.2011 г. 06:43:26 VBASE025.VDF : 7.11.18.247 2048 Bytes 6.12.2011 г. 06:43:27 VBASE026.VDF : 7.11.18.248 2048 Bytes 6.12.2011 г. 06:43:27 VBASE027.VDF : 7.11.18.249 2048 Bytes 6.12.2011 г. 06:43:27 VBASE028.VDF : 7.11.18.250 2048 Bytes 6.12.2011 г. 06:43:27 VBASE029.VDF : 7.11.18.251 2048 Bytes 6.12.2011 г. 06:43:27 VBASE030.VDF : 7.11.18.252 2048 Bytes 6.12.2011 г. 06:43:27 VBASE031.VDF : 7.11.19.27 114688 Bytes 8.12.2011 г. 12:52:38 Engineversion : 8.2.6.128 AEVDF.DLL : 8.1.2.2 106868 Bytes 28.10.2011 г. 08:39:30 AESCRIPT.DLL : 8.1.3.88 479611 Bytes 3.12.2011 г. 07:10:12 AESCN.DLL : 8.1.7.2 127349 Bytes 20.5.2011 г. 14:47:58 AESBX.DLL : 8.2.4.5 434549 Bytes 3.12.2011 г. 07:10:13 AERDL.DLL : 8.1.9.15 639348 Bytes 10.9.2011 г. 05:59:16 AEPACK.DLL : 8.2.14.4 741752 Bytes 3.12.2011 г. 07:10:12 AEOFFICE.DLL : 8.1.2.21 201084 Bytes 3.12.2011 г. 07:10:11 AEHEUR.DLL : 8.1.3.3 3871095 Bytes 3.12.2011 г. 07:10:11 AEHELP.DLL : 8.1.18.0 254327 Bytes 28.10.2011 г. 08:39:26 AEGEN.DLL : 8.1.5.15 405878 Bytes 3.12.2011 г. 07:10:08 AEEMU.DLL : 8.1.3.0 393589 Bytes 20.5.2011 г. 14:47:07 AECORE.DLL : 8.1.24.0 196983 Bytes 28.10.2011 г. 08:39:26 AEBB.DLL : 8.1.1.0 53618 Bytes 20.5.2011 г. 14:47:05 AVWINLL.DLL : 10.0.0.0 19304 Bytes 14.1.2010 г. 10:03:38 AVPREF.DLL : 10.0.3.2 44904 Bytes 29.6.2011 г. 07:57:42 AVREP.DLL : 10.0.0.10 174120 Bytes 20.5.2011 г. 14:48:19 AVARKT.DLL : 10.0.26.1 255336 Bytes 29.6.2011 г. 07:57:42 AVEVTLOG.DLL : 10.0.0.9 203112 Bytes 29.6.2011 г. 07:57:42 SQLITE3.DLL : 3.6.19.0 355688 Bytes 28.1.2010 г. 10:57:58 AVSMTP.DLL : 10.0.0.17 63848 Bytes 16.3.2010 г. 13:38:56 NETNT.DLL : 10.0.0.0 11624 Bytes 19.2.2010 г. 12:41:00 RCIMAGE.DLL : 10.0.0.35 2589544 Bytes 29.6.2011 г. 07:57:42 RCTEXT.DLL : 10.0.64.0 97640 Bytes 29.6.2011 г. 07:57:42 Configuration settings for the scan: Jobname.............................: Complete system scan Configuration file..................: C:\program files (x86)\avira\antivir desktop\sysscan.avp Logging.............................: Default Primary action......................: interactive Secondary action....................: ignore Scan master boot sector.............: on Scan boot sector....................: on Boot sectors........................: C:, D:, E:, F:, Process scan........................: on Extended process scan...............: on Scan registry.......................: on Search for rootkits.................: on Integrity checking of system files..: off Scan all files......................: All files Scan archives.......................: on Recursion depth.....................: 20 Smart extensions....................: on Macro heuristic.....................: on File heuristic......................: Advanced Deviating risk categories...........: +PCK,+SPR, Start of the scan: 08 декември 2011 г. 15:29 Starting search for hidden objects. HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows CE Services\symboliclinkvalue [NOTE] The registry entry is invisible. The scan of running processes will be started Scan process 'avscan.exe' - '70' Module(s) have been scanned Scan process 'avcenter.exe' - '115' Module(s) have been scanned Scan process 'daemonu.exe' - '39' Module(s) have been scanned Scan process 'jusched.exe' - '26' Module(s) have been scanned Scan process 'SweetIM.exe' - '60' Module(s) have been scanned Scan process 'trans.exe' - '105' Module(s) have been scanned Scan process 'YahooAUService.exe' - '49' Module(s) have been scanned Scan process 'nvSCPAPISvr.exe' - '33' Module(s) have been scanned Scan process 'avgnt.exe' - '67' Module(s) have been scanned Scan process 'sqlservr.exe' - '62' Module(s) have been scanned Scan process 'tccargo.exe' - '73' Module(s) have been scanned Scan process 'avguard.exe' - '67' Module(s) have been scanned Scan process 'armsvc.exe' - '25' Module(s) have been scanned Scan process 'uTorrent.exe' - '73' Module(s) have been scanned Scan process 'vVX3000.exe' - '28' Module(s) have been scanned Scan process 'sched.exe' - '48' Module(s) have been scanned Starting master boot sector scan: Master boot sector HD0 [iNFO] No virus was found! Master boot sector HD1 [iNFO] No virus was found! Master boot sector HD2 [iNFO] No virus was found! Master boot sector HD3 [iNFO] No virus was found! Master boot sector HD4 [iNFO] No virus was found! Master boot sector HD5 [iNFO] No virus was found! Start scanning boot sectors: Boot sector 'C:\' [iNFO] No virus was found! Boot sector 'D:\' [iNFO] No virus was found! Boot sector 'E:\' [iNFO] No virus was found! Boot sector 'F:\' [iNFO] No virus was found! Starting to scan executable files (registry). The registry was scanned ( '178' files ). Starting the file scan: Begin scan in 'C:\' Begin scan in 'D:\' <Volume> Begin scan in 'E:\' <WORK> Begin scan in 'F:\' <DATA> End of the scan: 08 декември 2011 г. 17:48 Used time: 2:18:29 Hour(s) The scan has been done completely. 28729 Scanned directories 682455 Files were scanned 0 Viruses and/or unwanted programs were found 0 Files were classified as suspicious 0 files were deleted 0 Viruses and unwanted programs were repaired 0 Files were moved to quarantine 0 Files were renamed 0 Files cannot be scanned 682455 Files not concerned 18397 Archives were scanned 0 Warnings 1 Notes 497744 Objects were scanned with rootkit scan 1 Hidden objects were found

Скрити обекти не означава непременно че са заразени....!Опитвам се да ги премахна за да не ви притесняват..!

Стартирайте отново OTL и направете сканиране със същите настройки ...Този път обаче вместо Run Fix натиснете бутона ...Ще се създаде лог файл. Публикувайте съдържанието му с Copy/Paste в следващия си коментар.

Ето го и него:

OTL logfile created on: 8.12.2011 г. 20:23:51 - Run 2

OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\admin\Desktop

64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 8.0.7601.17514)

Locale: 00000402 | Country: Bulgaria | Language: BGR | Date Format: d.M.yyyy 'г.'

4,00 Gb Total Physical Memory | 2,76 Gb Available Physical Memory | 68,99% Memory free

8,00 Gb Paging File | 6,50 Gb Available in Paging File | 81,34% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 153,96 Gb Total Space | 65,95 Gb Free Space | 42,84% Space Free | Partition Type: NTFS

Drive D: | 298,08 Gb Total Space | 110,83 Gb Free Space | 37,18% Space Free | Partition Type: NTFS

Drive E: | 596,16 Gb Total Space | 19,06 Gb Free Space | 3,20% Space Free | Partition Type: NTFS

Drive F: | 144,04 Gb Total Space | 76,22 Gb Free Space | 52,92% Space Free | Partition Type: NTFS

Computer Name: ACER-PC | User Name: admin | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011.12.08 13:21:40 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\admin\Desktop\OTL.exe

PRC - [2011.08.04 18:37:36 | 001,215,488 | ---- | M] (TimoCom Soft- und Hardware GmbH) -- C:\TCCARGO\tccargo.exe

PRC - [2011.08.01 13:35:42 | 000,114,992 | R--- | M] (SweetIM Technologies Ltd.) -- C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe

PRC - [2011.06.29 09:57:42 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

PRC - [2011.06.06 11:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

PRC - [2011.05.23 17:09:15 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

PRC - [2011.05.23 17:09:15 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

PRC - [2011.05.20 16:40:52 | 000,399,736 | ---- | M] (BitTorrent, Inc.) -- C:\Program Files (x86)\uTorrent\uTorrent.exe

PRC - [2011.04.08 07:14:00 | 002,218,600 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe

PRC - [2011.04.07 20:54:52 | 000,378,472 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

PRC - [2011.01.10 14:32:06 | 002,895,240 | ---- | M] () -- C:\Program Files (x86)\Trans\trans.exe

PRC - [2010.05.20 14:26:30 | 000,762,736 | ---- | M] (Microsoft Corporation) -- C:\Windows\vVX3000.exe

PRC - [2008.11.09 22:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) -- C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe

========== Modules (No Company Name) ==========

MOD - [2011.01.10 14:32:06 | 002,895,240 | ---- | M] () -- C:\Program Files (x86)\Trans\trans.exe

MOD - [2011.01.10 14:12:42 | 001,978,880 | ---- | M] () -- C:\Program Files (x86)\Trans\res.dll

MOD - [2011.01.10 14:06:14 | 000,120,832 | ---- | M] () -- C:\Program Files (x86)\Trans\PDllHook.dll

========== Win32 Services (SafeList) ==========

SRV:64bit: - [2010.05.20 14:26:28 | 000,199,536 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft LifeCam\MSCamS64.exe -- (MSCamSvc)

SRV:64bit: - [2009.07.14 03:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)

SRV:64bit: - [2009.07.14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)

SRV - [2011.06.29 09:57:42 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2011.06.06 11:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)

SRV - [2011.05.23 17:09:15 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2011.04.08 07:14:00 | 002,218,600 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe -- (nvUpdatusService)

SRV - [2011.04.07 20:54:52 | 000,378,472 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)

SRV - [2010.03.18 12:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)

SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)

SRV - [2008.11.09 22:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) [Auto | Running] -- C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe -- (YahooAUService)

SRV - [2007.05.31 16:11:54 | 000,443,784 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm)

SRV - [2007.05.31 16:11:46 | 000,225,672 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr)

========== Driver Services (SafeList) ==========

DRV:64bit: - [2011.06.29 09:57:43 | 000,123,784 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)

DRV:64bit: - [2011.06.29 09:57:43 | 000,088,288 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)

DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)

DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)

DRV:64bit: - [2011.03.03 17:59:18 | 000,174,184 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA)

DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)

DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)

DRV:64bit: - [2010.11.20 13:03:42 | 000,020,992 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)

DRV:64bit: - [2010.05.20 14:26:30 | 002,060,144 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\VX3000.sys -- (VX3000)

DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)

DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)

DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)

DRV:64bit: - [2009.06.10 22:35:48 | 000,378,368 | ---- | M] (Realtek) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\RTL85n64.sys -- (RTL85n64)

DRV:64bit: - [2009.06.10 22:35:35 | 000,408,960 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvm62x64.sys -- (NVENETFD)

DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)

DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)

DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)

DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)

DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/?ilc=8

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/?ilc=8

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://eu.ask.com/?l=dis&o=1716&gct=hp

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = bg

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 80 75 E2 D8 FB 16 CC 01 [binary data]

IE - HKCU\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)

IE - HKCU\..\URLSearchHook: {81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - C:\PROGRA~2\Yahoo!\Companion\Installs\cpn0\YTNavAssist.dll (Yahoo! Inc.)

IE - HKCU\..\URLSearchHook: {EEE6C35D-6118-11DC-9C72-001320C79847} - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgHelper.dll (SweetIM Technologies Ltd.)

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Yahoo"

FF - prefs.js..browser.search.defaulturl: "http://search.yahoo.com/search?fr=mkg030&p="

FF - prefs.js..browser.search.selectedEngine: "Yahoo"

FF - prefs.js..browser.startup.homepage: "http://www.yahoo.com/?ilc=8"

FF - prefs.js..keyword.URL: "http://search.yahoo.com/search?fr=mkg030&p="

FF - prefs.js..sweetim.toolbar.previous.browser.search.defaultenginename: "SweetIM Search"

FF - prefs.js..sweetim.toolbar.previous.browser.search.defaulturl: ""

FF - prefs.js..sweetim.toolbar.previous.browser.search.selectedEngine: "SweetIM Search"

FF - prefs.js..browser.startup.homepage: "http://home.sweetim.com"

FF - prefs.js..sweetim.toolbar.previous.keyword.URL: ""

FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Program Files (x86)\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found

FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\admin\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)

FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\admin\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)

FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\admin\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

FF - HKCU\Software\MozillaPlugins\@yahoo.com/BrowserPlus,version=2.9.8: C:\Users\admin\AppData\Local\Yahoo!\BrowserPlus\2.9.8\Plugins\npybrowserplus_2.9.8.dll (Yahoo! Inc.)

FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011.09.23 19:58:36 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins

[2011.05.21 15:58:57 | 000,000,000 | ---D | M] (No name found) -- C:\Users\admin\AppData\Roaming\mozilla\Extensions

[2011.11.20 13:02:20 | 000,000,000 | ---D | M] (No name found) -- C:\Users\admin\AppData\Roaming\mozilla\Firefox\Profiles\8tcqd6hp.default\extensions

[2011.11.18 17:26:57 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Users\admin\AppData\Roaming\mozilla\Firefox\Profiles\8tcqd6hp.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}

[2011.08.30 19:45:08 | 000,000,000 | ---D | M] (SweetIM Toolbar for Firefox) -- C:\Users\admin\AppData\Roaming\mozilla\Firefox\Profiles\8tcqd6hp.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}

[2011.11.20 13:02:35 | 000,000,000 | ---D | M] (Softonic Toolbar) -- C:\Users\admin\AppData\Roaming\mozilla\Firefox\Profiles\8tcqd6hp.default\extensions\[email protected]

[2011.05.17 13:12:44 | 000,002,333 | ---- | M] () -- C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8tcqd6hp.default\searchplugins\askcom.xml

[2011.08.30 19:44:53 | 000,003,915 | ---- | M] () -- C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8tcqd6hp.default\searchplugins\SweetIM Search.xml

[2011.08.30 19:45:05 | 000,003,915 | ---- | M] () -- C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8tcqd6hp.default\searchplugins\sweetim.xml

[2011.10.23 12:44:13 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions

[2011.10.22 22:17:13 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}

[2011.09.09 16:04:58 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA}

[2011.10.23 12:44:13 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA}

[2011.09.23 19:58:36 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll

[2011.09.23 19:58:34 | 000,001,083 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\911bg.xml

[2011.09.23 19:58:34 | 000,002,442 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\diribg.xml

[2011.09.23 19:58:34 | 000,001,515 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\pe-bg.xml

[2011.09.23 19:58:34 | 000,001,857 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\portalbgdict.xml

[2011.09.23 19:58:34 | 000,001,220 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-bg.xml

========== Chrome ==========

CHR - default_search_provider: SweetIM Search (Enabled)

CHR - default_search_provider: search_url = http://search.sweetim.com/search.asp?src=6&q={searchTerms}&barid={C8B60AA0-D32F-11E0-9D73-002185720B57}

CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms}

CHR - Extension: Skype Click to Call = C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.6.0.8442_0\

O1 HOSTS File: ([2011.12.08 14:21:41 | 000,000,098 | ---- | M]) - C:\Windows\SysNative\drivers\etc\Hosts

O1 - Hosts: 127.0.0.1 localhost

O1 - Hosts: ::1 localhost

O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~2\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)

O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O2 - BHO: (Softonic Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)

O2 - BHO: (SweetIM Toolbar Helper) - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)

O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\PROGRA~2\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll (Yahoo! Inc)

O3 - HKLM\..\Toolbar: (Softonic Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)

O3 - HKLM\..\Toolbar: (SweetIM Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)

O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~2\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)

O3 - HKCU\..\Toolbar\WebBrowser: (Softonic Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)

O3 - HKCU\..\Toolbar\WebBrowser: (SweetIM Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)

O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)

O4:64bit: - HKLM..\Run: [skytel] C:\Program Files\Realtek\Audio\HDA\Skytel.exe (Realtek Semiconductor Corp.)

O4:64bit: - HKLM..\Run: [VX3000] C:\Windows\vVX3000.exe (Microsoft Corporation)

O4:64bit: - HKLM..\Run: [Windows Mobile Device Center] C:\Windows\WindowsMobile\wmdc.exe (Microsoft Corporation)

O4 - HKLM..\Run: [ApnUpdater] C:\Program Files (x86)\Ask.com\Updater\Updater.exe (Ask)

O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

O4 - HKLM..\Run: [LifeCam] C:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe (Microsoft Corporation)

O4 - HKLM..\Run: [sweetIM] C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe (SweetIM Technologies Ltd.)

O4 - HKLM..\Run: [Trans] C:\Program Files (x86)\Trans\trans.exe ()

O4 - HKCU..\Run: [TC Login] c:\tccargo\tccargo.exe (TimoCom Soft- und Hardware GmbH)

O4 - HKCU..\Run: [uTorrent] C:\Program Files (x86)\uTorrent\uTorrent.exe (BitTorrent, Inc.)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O8:64bit: - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\OFFICE11\EXCEL.EXE/3000 File not found

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\OFFICE11\EXCEL.EXE/3000 File not found

O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)

O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)

O1364bit: - gopher Prefix: missing

O13 - gopher Prefix: missing

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)

O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.15.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{70070C10-E0CF-45DB-8C32-2587B406A6EE}: DhcpNameServer = 192.168.15.1

O18:64bit: - Protocol\Handler\mso-offdap11 - No CLSID value found

O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found

O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\PROGRA~2\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL (Microsoft Corporation)

O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O18:64bit: - Protocol\Filter\text/xml - No CLSID value found

O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found

O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (userinit.exe) -C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)

O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O32 - HKLM CDRom: AutoRun - 1

O34 - HKLM BootExecute: (autocheck autochk *)

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

[CLEARALLRESTOREPOINTS]

Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2011.12.08 14:20:52 | 000,000,000 | ---D | C] -- C:\_OTL

[2011.12.08 13:21:40 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\admin\Desktop\OTL.exe

[2011.12.08 12:53:41 | 000,607,260 | R--- | C] (Swearware) -- C:\Users\admin\Desktop\dds.scr

[2011.12.07 23:44:03 | 000,000,000 | ---D | C] -- C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ALADDIN NASIRAS REVENGE

[2011.12.07 10:05:17 | 000,000,000 | ---D | C] -- C:\Users\admin\Desktop\MUSIKA

[2011.12.02 13:03:11 | 000,000,000 | ---D | C] -- C:\Users\admin\Desktop\100K7330

[2011.11.27 15:16:58 | 000,000,000 | ---D | C] -- C:\Users\admin\Desktop\FILMI

[2011.11.25 18:16:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Innogames

[2011.11.25 18:16:46 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Bounty Hounds Online

[2011.11.25 18:03:12 | 000,000,000 | ---D | C] -- C:\Users\admin\AppData\Local\PMB Files

[2011.11.25 18:03:10 | 000,000,000 | ---D | C] -- C:\ProgramData\PMB Files

[2011.11.25 18:03:02 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Pando Networks

[2011.11.20 18:02:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Activision

[2011.11.20 18:01:57 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Activision

[2011.11.20 13:04:08 | 000,000,000 | ---D | C] -- C:\Users\admin\AppData\Local\PackageAware

[2011.11.20 13:02:20 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Ask.com

[2011.11.19 17:22:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Black_Box

[2011.11.19 10:34:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Activision Value

[2011.11.19 10:30:45 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Activision Value

[2011.11.19 09:01:10 | 000,000,000 | ---D | C] -- C:\Users\admin\AppData\Roaming\Trio

[2011.11.19 08:12:35 | 000,000,000 | ---D | C] -- C:\Users\admin\AppData\Roaming\Cosmonaut Games

[2011.11.19 08:11:04 | 000,000,000 | ---D | C] -- C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dive - The Medes Islands Secret

[2011.11.19 08:11:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dive - The Medes Islands Secret

[2011.11.19 08:11:04 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Dive - The Medes Islands Secret

[2011.11.18 22:02:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\The Three Musketeers

[2011.11.18 22:02:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\The Three Musketeers

[2011.11.18 19:53:24 | 000,000,000 | ---D | C] -- C:\Users\admin\AppData\Roaming\dingogames

[2011.11.18 19:53:24 | 000,000,000 | ---D | C] -- C:\ProgramData\dingogames

[2011.11.18 19:52:50 | 000,000,000 | ---D | C] -- C:\ProgramData\TEMP

[2011.11.18 19:50:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Big Fish Games

[2011.11.18 19:50:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\bfgclient

[2011.11.18 19:46:00 | 000,000,000 | ---D | C] -- C:\BigFishGamesCache

[2011.11.18 19:21:01 | 000,000,000 | ---D | C] -- C:\ProgramData\DivoGames

[2011.11.18 18:34:03 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MyRealGames.com

[2011.11.18 18:11:58 | 000,000,000 | ---D | C] -- C:\Users\admin\AppData\Roaming\URSE Games

[2011.11.18 18:04:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MyRealGames.com

[2011.11.14 10:19:01 | 000,000,000 | R--D | C] -- C:\Users\admin\Documents\Scanned Documents

[2011.11.14 10:19:01 | 000,000,000 | ---D | C] -- C:\Users\admin\Documents\Fax

[2011.11.09 18:19:39 | 000,000,000 | ---D | C] -- C:\Users\admin\Desktop\miu papka

========== Files - Modified Within 30 Days ==========

[2011.12.08 20:21:00 | 000,001,008 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1305609434-155683069-39690213-1000UA.job

[2011.12.08 20:14:47 | 000,014,224 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2011.12.08 20:14:47 | 000,014,224 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2011.12.08 20:11:46 | 000,848,732 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI

[2011.12.08 20:11:46 | 000,701,800 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat

[2011.12.08 20:11:46 | 000,139,186 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat

[2011.12.08 20:07:21 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2011.12.08 20:07:19 | 3220,619,264 | -HS- | M] () -- C:\hiberfil.sys

[2011.12.08 16:21:01 | 000,000,956 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1305609434-155683069-39690213-1000Core.job

[2011.12.08 14:21:41 | 000,000,098 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\Hosts

[2011.12.08 13:21:40 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\admin\Desktop\OTL.exe

[2011.12.08 12:53:41 | 000,607,260 | R--- | M] (Swearware) -- C:\Users\admin\Desktop\dds.scr

[2011.12.08 12:23:29 | 000,638,782 | ---- | M] () -- C:\Users\admin\Desktop\SCAN0001.PDF

[2011.12.06 21:00:19 | 000,038,598 | ---- | M] () -- C:\Users\admin\Desktop\LEGO.Harry.Potter.Years.5-7-RELOADED.torrent

[2011.12.02 22:26:21 | 000,188,141 | ---- | M] () -- C:\Users\admin\Desktop\bus_2.JPG

[2011.12.02 17:56:03 | 000,095,241 | ---- | M] () -- C:\Users\admin\Desktop\100_2236.JPG

[2011.12.02 17:55:58 | 000,095,241 | ---- | M] () -- C:\Users\admin\Desktop\bus.JPG

[2011.11.21 07:14:52 | 000,002,392 | ---- | M] () -- C:\Users\admin\Desktop\Google Chrome.lnk

[2011.11.20 18:02:37 | 000,000,336 | ---- | M] () -- C:\Windows\game.ini

[2011.11.18 19:52:08 | 000,000,979 | ---- | M] () -- C:\Users\admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Game Manager.lnk

[2011.11.09 09:55:15 | 000,286,664 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT

========== Files Created - No Company Name ==========

[2011.12.08 12:23:29 | 000,638,782 | ---- | C] () -- C:\Users\admin\Desktop\SCAN0001.PDF

[2011.12.06 21:00:19 | 000,038,598 | ---- | C] () -- C:\Users\admin\Desktop\LEGO.Harry.Potter.Years.5-7-RELOADED.torrent

[2011.12.02 22:26:20 | 000,188,141 | ---- | C] () -- C:\Users\admin\Desktop\bus_2.JPG

[2011.12.02 17:55:57 | 000,095,241 | ---- | C] () -- C:\Users\admin\Desktop\bus.JPG

[2011.12.02 17:52:44 | 000,095,241 | ---- | C] () -- C:\Users\admin\Desktop\100_2236.JPG

[2011.11.20 18:02:37 | 000,000,336 | ---- | C] () -- C:\Windows\game.ini

[2011.11.18 19:52:08 | 000,000,979 | ---- | C] () -- C:\Users\admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Game Manager.lnk

[2011.08.30 13:46:15 | 000,004,096 | -H-- | C] () -- C:\Users\admin\AppData\Local\keyfile3.drm

[2011.06.12 22:14:13 | 000,834,200 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI

[2011.05.27 20:46:21 | 000,000,056 | -H-- | C] () -- C:\Windows\SysWow64\ezsidmv.dat

[2011.05.21 15:58:38 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat

[2011.05.20 16:32:03 | 000,000,376 | ---- | C] () -- C:\Windows\ODBC.INI

[2010.06.15 18:06:38 | 000,153,502 | ---- | C] () -- C:\Windows\SysWow64\libmplayer.dll

[2010.06.15 18:05:02 | 005,002,416 | ---- | C] () -- C:\Windows\SysWow64\libavcodec.dll

[2010.06.15 17:43:58 | 001,641,574 | ---- | C] () -- C:\Windows\SysWow64\ffmpegmt.dll

[2010.05.24 21:39:50 | 000,289,065 | ---- | C] () -- C:\Windows\SysWow64\ff_kernelDeint.dll

[2010.05.24 21:38:34 | 000,962,008 | ---- | C] () -- C:\Windows\SysWow64\ff_x264.dll

[2010.05.24 21:38:22 | 000,901,509 | ---- | C] () -- C:\Windows\SysWow64\xvidcore.dll

[2010.05.19 22:59:20 | 000,150,528 | ---- | C] () -- C:\Windows\SysWow64\mkx.dll

[2010.05.19 22:59:10 | 000,109,568 | ---- | C] () -- C:\Windows\SysWow64\avi.dll

[2010.05.19 22:59:02 | 000,141,824 | ---- | C] () -- C:\Windows\SysWow64\mp4.dll

[2010.05.19 22:58:52 | 000,123,392 | ---- | C] () -- C:\Windows\SysWow64\ogm.dll

[2010.05.19 22:58:24 | 000,113,152 | ---- | C] () -- C:\Windows\SysWow64\dsmux.exe

[2010.05.19 22:58:18 | 000,154,112 | ---- | C] () -- C:\Windows\SysWow64\ts.dll

[2010.05.19 22:58:08 | 000,249,856 | ---- | C] () -- C:\Windows\SysWow64\dxr.dll

[2010.05.19 22:57:42 | 000,097,792 | ---- | C] () -- C:\Windows\SysWow64\avs.dll

[2010.05.19 22:57:38 | 000,137,728 | ---- | C] () -- C:\Windows\SysWow64\mkv2vfr.exe

[2010.05.19 22:57:26 | 000,093,184 | ---- | C] () -- C:\Windows\SysWow64\avss.dll

[2010.05.19 22:57:20 | 000,358,400 | ---- | C] () -- C:\Windows\SysWow64\gdsmux.exe

[2010.05.19 22:55:40 | 000,080,384 | ---- | C] () -- C:\Windows\SysWow64\mkzlib.dll

[2010.05.19 22:55:36 | 000,024,576 | ---- | C] () -- C:\Windows\SysWow64\mkunicode.dll

[2010.05.12 17:09:06 | 000,108,032 | ---- | C] () -- C:\Windows\SysWow64\ff_vfw.dll

[2010.05.11 23:26:52 | 000,324,096 | ---- | C] () -- C:\Windows\SysWow64\TomsMoComp_ff.dll

[2010.05.11 23:22:22 | 000,100,864 | ---- | C] () -- C:\Windows\SysWow64\ff_wmv9.dll

[2010.05.11 00:10:04 | 000,178,688 | ---- | C] () -- C:\Windows\SysWow64\ff_libmad.dll

[2010.05.11 00:09:50 | 000,257,024 | ---- | C] () -- C:\Windows\SysWow64\ff_libdts.dll

[2010.05.11 00:09:42 | 000,142,848 | ---- | C] () -- C:\Windows\SysWow64\ff_liba52.dll

[2010.05.11 00:09:30 | 000,484,864 | ---- | C] () -- C:\Windows\SysWow64\ff_libfaad2.dll

[2010.05.11 00:07:24 | 001,556,992 | ---- | C] () -- C:\Windows\SysWow64\ff_samplerate.dll

[2010.05.11 00:05:28 | 000,146,944 | ---- | C] () -- C:\Windows\SysWow64\ff_tremor.dll

[2010.05.11 00:05:06 | 000,113,152 | ---- | C] () -- C:\Windows\SysWow64\ff_unrar.dll

[2010.05.11 00:03:56 | 000,163,328 | ---- | C] () -- C:\Windows\SysWow64\libmpeg2_ff.dll

[2009.08.11 23:21:26 | 000,087,552 | ---- | C] () -- C:\Windows\SysWow64\ac3config.exe

[2009.07.14 07:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat

[2009.07.14 04:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT

[2009.07.14 04:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat

[2009.07.14 02:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin

[2009.07.14 01:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll

[2009.07.13 23:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll

[2009.06.26 16:24:18 | 000,015,498 | ---- | C] () -- C:\Windows\VX3000.ini

[2009.06.10 23:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat

[2009.06.07 18:24:04 | 000,180,224 | ---- | C] () -- C:\Windows\SysWow64\xvidvfw.dll

[2009.01.11 00:15:44 | 000,159,744 | ---- | C] () -- C:\Windows\SysWow64\mmfinfo.dll

[2008.11.06 17:37:32 | 003,596,288 | ---- | C] () -- C:\Windows\SysWow64\qt-dx331.dll

[2007.10.13 11:30:20 | 000,000,137 | ---- | C] () -- C:\Windows\SysWow64\Registration.ini

[2003.01.07 17:05:08 | 000,002,695 | ---- | C] () -- C:\Windows\SysWow64\OUTLPERF.INI

========== LOP Check ==========

[2011.10.29 22:27:51 | 000,000,000 | ---D | M] -- C:\Users\admin\AppData\Roaming\Ashampoo

[2011.11.19 08:12:35 | 000,000,000 | ---D | M] -- C:\Users\admin\AppData\Roaming\Cosmonaut Games

[2011.11.18 19:53:24 | 000,000,000 | ---D | M] -- C:\Users\admin\AppData\Roaming\dingogames

[2011.05.21 15:57:10 | 000,000,000 | ---D | M] -- C:\Users\admin\AppData\Roaming\Opera

[2011.05.30 15:32:46 | 000,000,000 | ---D | M] -- C:\Users\admin\AppData\Roaming\RST

[2011.11.01 15:35:59 | 000,000,000 | ---D | M] -- C:\Users\admin\AppData\Roaming\Sports Interactive

[2011.11.19 09:25:41 | 000,000,000 | ---D | M] -- C:\Users\admin\AppData\Roaming\Trio

[2011.09.08 11:12:59 | 000,000,000 | ---D | M] -- C:\Users\admin\AppData\Roaming\Unity

[2011.11.18 18:11:58 | 000,000,000 | ---D | M] -- C:\Users\admin\AppData\Roaming\URSE Games

[2011.12.08 20:27:34 | 000,000,000 | ---D | M] -- C:\Users\admin\AppData\Roaming\uTorrent

[2011.11.23 12:09:53 | 000,032,558 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

========== Custom Scans ==========

< :OTL >

< O4 - HKLM..\Run: [] File not found >

< O4 - HKU\S-1-5-21-1305609434-155683069-39690213-1000..\Run: [Messenger (Yahoo!)] ~"C:\PROGRA~2\Yahoo!\MESSEN~1\YahooMessenger.exe" -quiet File not found >

< O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found >

< O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found >

< O4 - HKU\S-1-5-21-1305609434-155683069-39690213-1001..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found >

< O18:64bit: - Protocol\Handler\http\0x00000001 - No CLSID value found >

Invalid Switch: b] - Protocol\Handler\http\0x00000001 - No CLSID value found

< O18:64bit: - Protocol\Handler\http\oledb - No CLSID value found >

Invalid Switch: b] - Protocol\Handler\http\oledb - No CLSID value found

< O18:64bit: - Protocol\Handler\https\0x00000001 - No CLSID value found >

Invalid Switch: b] - Protocol\Handler\https\0x00000001 - No CLSID value found

< O18:64bit: - Protocol\Handler\https\oledb - No CLSID value found >

Invalid Switch: b] - Protocol\Handler\https\oledb - No CLSID value found

< O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found >

Invalid Switch: b] - Protocol\Handler\msdaipp - No CLSID value found

< O18:64bit: - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found >

Invalid Switch: b] - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found

< O18:64bit: - Protocol\Handler\msdaipp\oledb - No CLSID value found >

Invalid Switch: b] - Protocol\Handler\msdaipp\oledb - No CLSID value found

< O18:64bit: - Protocol\Handler\mso-offdap11 - No CLSID value found >

Invalid Switch: b] - Protocol\Handler\mso-offdap11 - No CLSID value found

< O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found >

Invalid Switch: b] - Protocol\Handler\skype-ie-addon-data - No CLSID value found

< O18 - Protocol\Handler\msdaipp - No CLSID value found >

< O18:64bit: - Protocol\Filter\text/xml - No CLSID value found >

Invalid Switch: xml - No CLSID value found

< O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found >

Invalid Switch: pagefile) - File not found

< O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. >

Invalid Switch: b] - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

< O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. >

< @Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:F35F4269 >

< @Alternate Data Stream - 139 bytes -> C:\ProgramData\TEMP:D3904CCE >

< @Alternate Data Stream - 135 bytes -> C:\ProgramData\TEMP:71B89F61 >

< @Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:710F4DBF >

< >

< :Reg >

< >

< :files >

< >

< autorun.inf /alldrives >

Invalid Switch: alldrives

< autorun.exe /alldrives >

Invalid Switch: alldrives

< recycler /alldrives >

Invalid Switch: alldrives

< ipconfig /flushdns /c >

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

< >

< :Commands >

< [purity] >

< [emptytemp] >

< [resethosts] >

< [emptyflash] >

< [Reboot] >

< End of report >

Лога е наред..!Не виждам активни зарази..!

Стартирайте OTL още веднъж и натиснете бутона CleanUp.

Ще последва рестарт на компютъра ви..!Сега е момента да изтриете всичко което използвахме в процедурата,както и всички генерирани логове...!След това следват контролни сканирания:

Изтеглете Malwarebytes' Anti-Malware или от тук

* Кликнете два пъти върху mbam-setup.exe, за да инсталирате програмата.

* Уверете се, че са поставени отметки на Update Malwarebytes' Anti-Malware и Launch Malwarebytes' Anti-Malware. След това кликнете на Finish.

* Ако има намерени обновявания, тя ще ги изтегли и инсталира.

* Стартирайте програмата и изберете "Perform Full Scan", след това кликнете на Scan.

* Сканирането ще отнеме малко време, затова моля да бъдете търпеливи.

* Когато сканирането завърши, кликнете на OK, след това Show Results, за да видите резултата.

* Уверете се, че на всички редове има отметки, и кликнете на Remove Selected.

* Когато всичко бъде премахнато, в Notepad ще бъде отворен лог. Копирайте този лог и го публикувайте в следващия си коментар по темата.

Забележка: Ако MalwareBytes' Anti-Malware се затрудни в премахването на откритите вируси/заплахи, той ще поиска да рестартира компютъра Ви и по време на рестартирането да премахне проблемните вируси/заплахи. Ако бъдете попитани, потвърдете че желаете вашия компютър да бъде рестартиран.

Изтеглете програмата: ESET Online Scanner

• Стартирайте esetsmartinstaller_enu.exe
• Сложете отметка на YES, I accept the Terms of Use и изберете Start:

  

• Скенерът ще започне да изтегля компонентите, които са му необходими:

  

• Уверете се, че има отметки на следните редове:

  

  Накрая изберете Start

• Скенерът ще започне да изтегля последните дефиниции.
• След, като сканирането завърши изберете Finish.
• Отидете в: C:\Program Files\ESET\ESET Online Scanner
• Отворете файла log.txt , копирайте съдържанието му и го поставете в следващия си коментар.

Ок. Но преди ди да стартирам OTL, под колонката Custom Scans/Fixes трябва ли да се постави някакъв текст като предните пъти, или този път там остава празно?

Не, нищо не поставяте там...Само натискате бутона CleanUp..Показал съм по горе..!

След сканирането с Malware следвайки Вашите инструкции излезе това: Malwarebytes' Anti-Malware 1.51.2.1300 www.malwarebytes.org Версия на базата от данни: 8336 Windows 6.1.7601 Service Pack 1 Internet Explorer 8.0.7601.17514 8.12.2011 г. 23:26:22 mbam-log-2011-12-08 (23-26-22).txt Тип сканиране: Пълно сканиране (C:\|D:\|E:\|F:\|G:\|H:\|I:\|J:\|K:\|) Сканирани обекти: 374598 Изминало време: 36 минута(и), 37 секунда(и) Заразени процеси в паметта: 0 Заразени модули в паметта: 0 Заразени ключове в регистратурата: 0 Заразени стойности в регистратурата: 0 Заразени информационни обекти в регистратурата: 0 Заразени папки: 0 Заразени файлове: 3 Заразени процеси в паметта: (Не бяха открити зловредни обекти) Заразени модули в паметта: (Не бяха открити зловредни обекти) Заразени ключове в регистратурата: (Не бяха открити зловредни обекти) Заразени стойности в регистратурата: (Не бяха открити зловредни обекти) Заразени информационни обекти в регистратурата: (Не бяха открити зловредни обекти) Заразени папки: (Не бяха открити зловредни обекти) Заразени файлове: c:\program files (x86)\stuntmania reloaded\uninstall.exe (Malware.Packer.Krunchy) -> Quarantined and deleted successfully. c:\Windows\Setup\SCRIPTS\data\bootinst.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully. f:\Joro\software install\nero 7 ultra edition\nero 7 ultra edition enhanced v7 5 9 0a eng keygen(2).exe (RiskWare.Tool.HCK) -> Quarantined and deleted successfully. Продължавам със следващата част от инструкциите

Здравейте отново! Сканирах два пъти с ЕСЕТ, но и двата пъти сканира с часове и спира на 99% никога не завършва на 100%.Не зная каква би могла да бъде причината .Но до 99% сканиране не излизат никакви проблеми.Мисля,че всичко е наред, но все пак последната дума е Вашата!Прилагам и документа който се получи след това сканиране: ESETSmartInstaller@High as downloader log: all ok ESETSmartInstaller@High as downloader log: all ok # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6583 # api_version=3.0.2 # EOSSerial=d62abad95b532f4c98f53e8570712c24 # end=stopped # remove_checked=true # archives_checked=true # unwanted_checked=true # unsafe_checked=true # antistealth_checked=true # utc_time=2011-12-10 09:33:52 # local_time=2011-12-10 11:33:52 ) # country="Bulgaria" # lang=1033 # osver=6.1.7601 NT Service Pack 1 # compatibility_mode=1797 16775165 100 94 489583 60004620 108461 0 # compatibility_mode=5893 16776573 100 94 43660 75094282 0 0 # compatibility_mode=8192 67108863 100 0 87731 87731 0 0 # scanned=196114 # found=0 # cleaned=0 # scan_time=45199

Да всичко е наред...!

Деинсталирайте ESET Online Scanner по стандартния начин..!Скенерът МБАМ препоръчвам да да си оставите и поне един път в седмицата сканирайте с него,като не забрявате да го обновявате..!

Това е от мен..!Пожелавам ви лека вечер и безопасен интернет..!

Много благодаря за съдействието!Приятна вечер и весело посрещане на предстоящите празници!!!