Помощ вирус- син екран-рестарт

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

26 декември 201114 г.

Аз ти предложих двата възможни варианти..които използваме с години...не виждам причина поне единия да сработи..!

26 декември 201114 г.

Автор

а само да те питам има ли начин тия папки да се махнат,и с проверката на харда има ли лоши сектори,каде да проверя

.

DDS (Ver_2011-08-26.01) - NTFSx86

Internet Explorer: 8.0.7601.17514 BrowserJavaVersion: 1.6.0_30

Run by Dondjovani at 19:59:42 on 2011-12-26

Microsoft Windows 7 Ultimate 6.1.7601.1.1251.359.1026.18.2047.1182 [GMT 2:00]

.

AV: avast! Antivirus *Enabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}

SP: avast! Antivirus *Enabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

============== Running Processes ===============

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\nvvsvc.exe

C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalService

C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

C:\Windows\system32\nvvsvc.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Program Files\Alwil Software\Avast5\AvastSvc.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\Common Files\PC Tools\sMonitor\SSDMonitor.exe

C:\Program Files\Skype\Phone\Skype.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\taskhost.exe

C:\Program Files\Common Files\PC Tools\sMonitor\StartManSvc.exe

C:\Program Files\TeamViewer\Version7\TeamViewer_Service.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\System32\svchost.exe -k secsvcs

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Mozilla Firefox\plugin-container.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Windows\system32\conhost.exe

C:\Windows\system32\wbem\wmiprvse.exe

.

============== Pseudo HJT Report ===============

.

BHO: Java Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll

BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - c:\progra~1\micros~2\office14\URLREDIR.DLL

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

uRun: [skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized

mRun: [RtHDVCpl] c:\program files\realtek\audio\hda\RtHDVCpl.exe -s

mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

mRun: [sSDMonitor] c:\program files\common files\pc tools\smonitor\SSDMonitor.exe

uPolicies-explorer: NoSecurityTab = 1 (0x1)

mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)

mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)

mPolicies-system: EnableLUA = 0 (0x0)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

mPolicies-system: PromptOnSecureDesktop = 0 (0x0)

IE: &Експортиране към Microsoft Excel - c:\progra~1\micros~2\office14\EXCEL.EXE/3000

IE: &Изпрати към OneNote - c:\progra~1\micros~2\office14\ONBttnIE.dll/105

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab

TCP: Interfaces\{AB538872-F32E-4F82-BDBF-6EAA0E98966D} : NameServer = 213.16.56.1 213.16.56.9

Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\common files\microsoft shared\office14\MSOXMLMF.DLL

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\users\dondjovani\appdata\roaming\mozilla\firefox\profiles\sbztxywt.default\

FF - prefs.js: browser.startup.homepage - www.google.com

FF - plugin: c:\progra~1\micros~2\office14\NPAUTHZ.DLL

FF - plugin: c:\progra~1\micros~2\office14\NPSPWRAP.DLL

FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll

FF - plugin: c:\program files\nvidia corporation\3d vision\npnv3dv.dll

FF - plugin: c:\program files\nvidia corporation\3d vision\npnv3dvstreaming.dll

.

============= SERVICES / DRIVERS ===============

.

R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2011-12-16 435032]

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2011-12-16 314456]

R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2011-12-16 20568]

R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2011-12-16 55128]

R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast5\AvastSvc.exe [2011-12-16 44768]

R2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;c:\program files\common files\pc tools\smonitor\StartManSvc.exe [2011-12-17 632792]

R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\nvidia corporation\3d vision\nvSCPAPISvr.exe [2011-8-3 379496]

R2 TeamViewer7;TeamViewer 7;c:\program files\teamviewer\version7\TeamViewer_Service.exe [2011-12-18 2984832]

R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\drivers\Rt86win7.sys [2011-12-16 277536]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-14 229888]

S3 c2wts;Claims to Windows Token Service;c:\program files\windows identity foundation\v3.5\c2wtshost.exe [2010-1-18 13080]

S3 osppsvc;Office Software Protection Platform;c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\OSPPSVC.EXE [2010-1-9 4640000]

S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2011-12-17 15872]

S3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\TsUsbFlt.sys [2011-12-17 52224]

S3 WatAdminSvc;Услуга на технологиите за активиране на Windows;c:\windows\system32\wat\WatAdminSvc.exe [2010-2-2 1343400]

.

=============== Created Last 30 ================

.

2011-12-26 17:42:30 56200 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{940a5b83-f616-454d-8a45-763cc1a47b83}\offreg.dll

2011-12-26 17:23:02 -------- d-sh--w- C:\found.000

2011-12-26 15:40:40 -------- d-sh--w- C:\$RECYCLE.BIN

2011-12-26 13:22:52 -------- d-----w- c:\windows\CheckSur

2011-12-26 11:28:21 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2011-12-26 11:28:15 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-12-26 11:28:15 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2011-12-25 15:32:38 -------- d-----w- c:\program files\FinalWire

2011-12-23 15:26:11 6823496 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{940a5b83-f616-454d-8a45-763cc1a47b83}\mpengine.dll

2011-12-20 05:40:19 805376 ----a-w- c:\windows\system32\FntCache.dll

2011-12-20 05:40:19 1076736 ----a-w- c:\windows\system32\DWrite.dll

2011-12-20 05:40:18 739840 ----a-w- c:\windows\system32\d2d1.dll

2011-12-19 19:44:57 -------- d-----r- c:\program files\Skype

2011-12-18 16:22:07 -------- d-----w- c:\users\dondjovani\appdata\roaming\TeamViewer

2011-12-18 16:20:27 -------- d-----w- c:\program files\TeamViewer

2011-12-18 15:44:15 2297552 ----a-w- c:\windows\system32\d3dx9_26.dll

2011-12-18 09:48:14 -------- d-----w- c:\program files\IVT Corporation

2011-12-18 09:05:26 -------- d-----w- c:\program files\Defraggler

2011-12-17 21:49:49 66664 ----a-w- c:\windows\system32\nvshext.dll

2011-12-17 21:49:49 3730024 ----a-w- c:\windows\system32\nvcpl.dll

2011-12-17 21:49:49 111208 ----a-w- c:\windows\system32\nvmctray.dll

2011-12-17 21:49:14 914024 ----a-w- c:\windows\system32\nvdispco32.dll

2011-12-17 21:49:14 6613096 ----a-w- c:\windows\system32\nvwgf2um.dll

2011-12-17 21:49:14 5404776 ----a-w- c:\windows\system32\nvcuda.dll

2011-12-17 21:49:14 2412136 ----a-w- c:\windows\system32\nvapi.dll

2011-12-17 21:49:14 16595560 ----a-w- c:\windows\system32\nvoglv32.dll

2011-12-17 21:49:14 12636776 ----a-w- c:\windows\system32\nvd3dum.dll

2011-12-17 21:49:14 10304104 ----a-w- c:\windows\system32\drivers\nvlddmkm.sys

2011-12-17 21:48:39 -------- d-----w- C:\NVIDIA

2011-12-17 21:45:12 -------- d-----w- c:\program files\Phyxion.net

2011-12-17 21:35:26 600680 ----a-w- c:\windows\system32\easyupdatusapiu.dll

2011-12-17 21:35:26 599144 ----a-w- c:\windows\system32\nvvsvc.exe

2011-12-17 21:35:26 2558568 ----a-w- c:\windows\system32\nvsvc.dll

2011-12-17 21:34:53 875112 ----a-w- c:\windows\system32\nvgenco32.dll

2011-12-17 21:34:53 57960 ----a-w- c:\windows\system32\OpenCL.dll

2011-12-17 21:34:53 2391656 ----a-w- c:\windows\system32\nvcuvid.dll

2011-12-17 21:34:53 2090088 ----a-w- c:\windows\system32\nvcuvenc.dll

2011-12-17 21:34:52 17193576 ----a-w- c:\windows\system32\nvcompiler.dll

2011-12-17 10:39:06 -------- d-----w- c:\program files\Nero

2011-12-17 10:27:29 -------- d-----w- c:\windows\PCHEALTH

2011-12-17 10:26:37 -------- d-----w- c:\program files\Microsoft Analysis Services

2011-12-17 10:22:12 -------- d-----w- c:\users\dondjovani\appdata\roaming\Registry Mechanic

2011-12-17 10:14:20 1892184 ----a-w- c:\windows\system32\D3DX9_42.dll

2011-12-17 10:13:10 4379984 ----a-w- c:\windows\system32\D3DX9_40.dll

2011-12-17 10:11:54 3727720 ----a-w- c:\windows\system32\d3dx9_35.dll

2011-12-17 10:10:30 3497832 ----a-w- c:\windows\system32\d3dx9_34.dll

2011-12-17 09:39:51 -------- d-----w- c:\users\dondjovani\appdata\local\Microsoft Help

2011-12-17 09:26:57 -------- d-----w- C:\HattrickOrganizer

2011-12-17 06:51:52 -------- d-----w- c:\windows\Panther

2011-12-17 06:51:40 -------- d-----w- C:\Boot

2011-12-17 02:07:26 -------- d-----w- c:\users\dondjovani\appdata\roaming\NVIDIA

2011-12-17 02:01:16 -------- d-----w- c:\program files\NVIDIA Corporation

2011-12-17 01:51:33 -------- d-----w- c:\windows\system32\appmgmt

2011-12-17 00:38:15 -------- d-----w- c:\windows\system32\SPReview

2011-12-17 00:37:10 -------- d-----w- c:\windows\system32\EventProviders

2011-12-17 00:30:58 954752 ----a-w- c:\windows\system32\mfc40.dll

2011-12-17 00:29:59 830464 ----a-w- c:\windows\system32\MSMPEG2ENC.DLL

2011-12-17 00:28:59 66048 ----a-w- c:\windows\system32\PrintBrmUi.exe

2011-12-17 00:27:35 363008 ----a-w- c:\windows\system32\wbemcomn.dll

2011-12-17 00:27:35 189952 ----a-w- c:\program files\windows portable devices\sqmapi.dll

2011-12-17 00:27:34 606208 ----a-w- c:\windows\system32\wbem\fastprox.dll

2011-12-17 00:27:21 189952 ----a-w- c:\windows\system32\sqmapi.dll

2011-12-17 00:14:10 -------- d-----w- c:\users\dondjovani\appdata\local\PackageAware

2011-12-16 23:43:59 -------- d-----w- c:\users\dondjovani\appdata\local\ElevatedDiagnostics

2011-12-16 23:36:19 -------- d-----w- c:\users\dondjovani\appdata\roaming\Malwarebytes

2011-12-16 23:33:01 880640 ----a-w- c:\windows\system32\UniBox10.ocx

2011-12-16 23:33:01 658432 ----a-w- c:\windows\system32\MSCOMCT2.OCX

2011-12-16 23:33:01 506368 ----a-w- c:\windows\system32\msxml.dll

2011-12-16 23:33:01 37336 ----a-w- c:\windows\system32\CleanMFT32.exe

2011-12-16 23:33:01 212992 ----a-w- c:\windows\system32\UniBoxVB12.ocx

2011-12-16 23:33:01 1101824 ----a-w- c:\windows\system32\UniBox210.ocx

2011-12-16 23:32:55 -------- d-----w- c:\program files\common files\PC Tools

2011-12-16 23:07:46 -------- d-----w- c:\users\dondjovani\appdata\roaming\COWON

2011-12-16 22:44:55 2106216 ----a-w- c:\program files\mozilla firefox\D3DCompiler_43.dll

2011-12-16 22:44:55 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll

2011-12-16 22:44:54 89048 ----a-w- c:\program files\mozilla firefox\libEGL.dll

2011-12-16 22:44:54 478168 ----a-w- c:\program files\mozilla firefox\libGLESv2.dll

2011-12-16 22:44:54 1998168 ----a-w- c:\program files\mozilla firefox\d3dx9_43.dll

2011-12-16 22:44:54 1989592 ----a-w- c:\program files\mozilla firefox\mozjs.dll

2011-12-16 22:44:54 15832 ----a-w- c:\program files\mozilla firefox\mozalloc.dll

2011-12-16 22:44:53 801752 ----a-w- c:\program files\mozilla firefox\mozsqlite3.dll

2011-12-16 22:35:47 476904 ----a-w- c:\program files\mozilla firefox\plugins\npdeployJava1.dll

2011-12-16 22:35:47 472808 ----a-w- c:\windows\system32\deployJava1.dll

2011-12-16 22:04:35 -------- d-----w- c:\users\dondjovani\appdata\roaming\IObit

2011-12-16 22:03:09 338944 ----a-w- c:\windows\system32\drivers\afd.sys

2011-12-16 22:01:54 28672 ----a-w- c:\windows\system32\dnscacheugc.exe

2011-12-16 22:00:46 1549312 ----a-w- c:\windows\system32\tquery.dll

2011-12-16 21:59:50 219136 ----a-w- c:\windows\system32\d3d10_1core.dll

2011-12-16 21:59:50 161792 ----a-w- c:\windows\system32\d3d10_1.dll

2011-12-16 21:59:49 3967856 ----a-w- c:\windows\system32\ntkrnlpa.exe

2011-12-16 21:59:48 3912560 ----a-w- c:\windows\system32\ntoskrnl.exe

2011-12-16 21:59:25 759296 ----a-w- c:\program files\common files\microsoft shared\vgx\VGX.dll

2011-12-16 21:59:24 1137664 ----a-w- c:\windows\system32\mfc42.dll

2011-12-16 21:59:23 1164288 ----a-w- c:\windows\system32\mfc42u.dll

2011-12-16 21:59:17 69632 ----a-w- c:\windows\system32\drivers\bowser.sys

2011-12-16 21:59:12 123904 ----a-w- c:\windows\system32\poqexec.exe

2011-12-16 21:59:11 27008 ----a-w- c:\windows\system32\drivers\Diskdump.sys

2011-12-16 21:52:51 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2011-12-16 21:51:43 691696 ----a-w- c:\windows\system32\drivers\sptd.sys

2011-12-16 21:51:11 -------- d-----w- c:\program files\DAEMON Tools Lite

2011-12-16 21:50:51 -------- d-----w- c:\users\dondjovani\appdata\roaming\DAEMON Tools Lite

2011-12-16 21:46:28 -------- d-----w- c:\program files\SpeedFan

2011-12-16 21:45:35 -------- d-----w- c:\program files\uTorrent

2011-12-16 21:45:19 728448 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys

2011-12-16 21:45:18 219008 ----a-w- c:\windows\system32\drivers\dxgmms1.sys

2011-12-16 21:45:18 107520 ----a-w- c:\windows\system32\cdd.dll

2011-12-16 21:45:13 -------- d-----w- c:\users\dondjovani\appdata\roaming\uTorrent

2011-12-16 21:45:05 -------- d-----w- c:\program files\common files\COWON

2011-12-16 21:45:04 -------- d-----w- c:\program files\JetAudio

2011-12-16 21:44:19 6823496 ----a-w- c:\programdata\microsoft\windows defender\definition updates\backup\mpengine.dll

2011-12-16 21:43:12 222080 ------w- c:\windows\system32\MpSigStub.exe

2011-12-16 21:42:25 -------- d-----w- c:\users\dondjovani\appdata\roaming\Mirillis

2011-12-16 21:42:25 -------- d-----w- c:\users\dondjovani\appdata\local\Mirillis

2011-12-16 21:42:01 -------- d-----w- c:\program files\Mirillis

2011-12-16 21:31:59 -------- d-----w- c:\users\dondjovani\appdata\local\Mozilla

2011-12-16 21:26:01 -------- d-----w- c:\users\dondjovani\appdata\local\Google

2011-12-16 21:25:55 55128 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys

2011-12-16 21:25:45 -------- d-----w- c:\program files\CCleaner

2011-12-16 21:25:21 41184 ----a-w- c:\windows\avastSS.scr

2011-12-16 21:25:18 -------- d-----w- c:\programdata\Alwil Software

2011-12-16 21:22:07 -------- d-----w- c:\windows\system32\RTCOM

2011-12-16 21:20:50 94208 ----a-w- c:\windows\system32\RTNUninst32.dll

2011-12-16 21:20:50 80416 ----a-w- c:\windows\system32\RtNicProp32.dll

2011-12-16 21:20:50 277536 ----a-w- c:\windows\system32\drivers\Rt86win7.sys

2011-12-16 21:20:47 -------- d-----w- c:\program files\Realtek

2011-12-16 21:19:57 53248 ----a-w- c:\windows\system32\CSVer.dll

2011-12-16 21:19:51 -------- d-----w- C:\Intel

2011-12-16 21:14:09 -------- d-sh--w- c:\windows\Installer

2011-12-16 21:04:06 -------- d-----w- c:\windows\system32\wbem\Performance

2011-12-16 21:01:06 -------- d-----r- c:\users\dondjovani\Virtual Machines

.

==================== Find3M ====================

.

2011-12-17 00:55:03 152576 ----a-w- c:\windows\system32\msclmd.dll

2011-11-28 17:53:53 435032 ----a-w- c:\windows\system32\drivers\aswSnx.sys

2011-11-24 04:25:27 2342912 ----a-w- c:\windows\system32\win32k.sys

2011-11-05 04:35:00 981504 ----a-w- c:\windows\system32\wininet.dll

2011-11-05 04:26:03 2048 ----a-w- c:\windows\system32\tzres.dll

2011-11-05 02:48:51 1638912 ----a-w- c:\windows\system32\mshtml.tlb

2011-10-26 04:28:12 38912 ----a-w- c:\windows\system32\csrsrv.dll

2011-10-18 04:25:00 2009088 ----a-w- c:\windows\system32\ntdsai.dll

2011-10-15 05:38:59 534528 ----a-w- c:\windows\system32\EncDec.dll

2011-09-29 16:03:04 1290608 ----a-w- c:\windows\system32\drivers\tcpip.sys

.

============= FINISH: 20:07:18,60 ===============