Security.HiJack[ImageFileExecutionOptions] [ПРИКЛЮЧЕН]

28 януари 201214 г.

Здравейте! За първи път търся помощ тук във форума. От 2 дни лаптопа беше много бавен и пуснах антивирусната и програмите за зловреден софтуер. При останалите програми имаше само 1-2 вида бисквитки, но с SUPERAntiSpyware ми показа инфекция със Security.HiJack[imageFaleExecutionOptions]. Преди да го изчистя с програмата направих скрийншот, който мога да приложа. Тъй като исках да проверя за какво иде реч, попаднах на статия от този форум, че дори програмата да го е почистила, може да не е напълно изчистването. Затова въпроса ми е дали може да ми помогнете да проверите системата дали е изчистена напълно? Имам компютър от малко повече от година и не съм много в час с нещата, но се старая. Тъй като синът ми и мъжът ми само го ползват, се налага аз да го поддържам (разбира се с помощта на приятел, който разбира доста). Надявам се, ще ми помогнете и ще проявите търпение към новака! Благодаря предварително!

28 януари 201214 г.

http://www.kaldata.com/forums/index.php?showtopic=132819

Прочетете инструкциите и публикувайте логовете - два на брой от DDS.

28 януари 201214 г.

Автор

Ето това е резултата от DDS: . DDS (Ver_2011-08-26.01) - NTFSAMD64 Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_30 Run by Emil at 19:02:56 on 2012-01-28 Microsoft Windows 7 Ultimate 6.1.7601.1.1251.359.1033.18.4095.2201 [GMT 2:00] . AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160} SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD} SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} SP: IObit Security 360 *Disabled/Outdated* {FAE2835A-B90A-9E7A-85DA-82DBDA7C1E3A} . ============== Running Processes =============== . C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k RPCSS C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe C:\Windows\system32\atiesrxx.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\system32\atieclxx.exe C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Windows\system32\taskhost.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\system32\taskeng.exe C:\Program Files (x86)\IObit\Advanced SystemCare 4\PMonitor.exe C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE C:\Program Files\Microsoft Security Client\msseces.exe C:\Program Files (x86)\IObit\Advanced SystemCare 4\ASCService.exe C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE C:\Program Files (x86)\Stardock\ObjectDock\ObjectDock.exe C:\Program Files (x86)\IObit\IObit Security 360\IS360srv.exe C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\Program Files (x86)\System Control Manager\MGSysCtrl.exe C:\Program Files (x86)\Unlocker\UnlockerAssistant.exe C:\Program Files (x86)\IObit\IObit Security 360\is360tray.exe C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe C:\Program Files (x86)\System Control Manager\MSIService.exe C:\Program Files\Common Files\Nitro PDF\Reader\2.0\NitroPDFReaderDriverService2x64.exe C:\Windows\system32\svchost.exe -k imgsvc C:\Program Files (x86)\Stardock\ObjectDock\Dock64.exe C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe C:\Windows\system32\wbem\unsecapp.exe C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Windows\system32\SearchIndexer.exe C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesApp64.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe C:\Program Files (x86)\Mozilla Firefox\firefox.exe C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe C:\Windows\system32\SearchProtocolHost.exe C:\Windows\system32\SearchFilterHost.exe C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\conhost.exe C:\Windows\SysWOW64\cscript.exe C:\Windows\system32\wbem\wmiprvse.exe . ============== Pseudo HJT Report =============== . uSearch Page = hxxp://www.google.com uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2786678 uSearch Bar = hxxp://www.google.com/ie uDefault_Search_URL = hxxp://www.google.com/ie mDefault_Page_URL = hxxp://www.yahoo.com mStart Page = hxxp://www.yahoo.com uSearchAssistant = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s mSearchAssistant = about:blank uURLSearchHooks: YouTube Downloader Toolbar: {f3fee66e-e034-436a-86e4-9690573bee8a} - C:\Program Files (x86)\YouTube Downloader Toolbar\IE\4.9\youtubedownloaderToolbarIE.dll uURLSearchHooks: H - No File uURLSearchHooks: H - No File uURLSearchHooks: H - No File uURLSearchHooks: BS Player Toolbar: {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - C:\Program Files (x86)\BS_Player\prxtbBS_P.dll mURLSearchHooks: H - No File mURLSearchHooks: BS Player Toolbar: {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - C:\Program Files (x86)\BS_Player\prxtbBS_P.dll mWinlogon: Userinit=userinit.exe, BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll BHO: Java Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll BHO: Skype add-on for Internet Explorer: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll BHO: YouTube Downloader Toolbar: {f3fee66e-e034-436a-86e4-9690573bee8a} - C:\Program Files (x86)\YouTube Downloader Toolbar\IE\4.9\youtubedownloaderToolbarIE.dll BHO: BS Player Toolbar: {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - C:\Program Files (x86)\BS_Player\prxtbBS_P.dll TB: {10EDB994-47F8-43F7-AE96-F2EA63E9F90F} - No File TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File TB: {28387537-e3f9-4ed7-860c-11e69af4a8a0} - No File TB: {1c68c940-1b2f-46eb-bd8c-2e1612ff6a58} - No File TB: YouTube Downloader Toolbar: {f3fee66e-e034-436a-86e4-9690573bee8a} - C:\Program Files (x86)\YouTube Downloader Toolbar\IE\4.9\youtubedownloaderToolbarIE.dll TB: BS Player Toolbar: {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - C:\Program Files (x86)\BS_Player\prxtbBS_P.dll TB: {BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} - No File uRun: [spybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe uRun: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun uRun: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe mRun: [startCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun mRun: [MGSysCtrl] C:\Program Files (x86)\System Control Manager\MGSysCtrl.exe mRun: [unlockerAssistant] "C:\Program Files (x86)\Unlocker\UnlockerAssistant.exe" mRun: [iObit Security 360] "C:\Program Files (x86)\IObit\IObit Security 360\IS360tray.exe" /autostart mRun: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray StartupFolder: C:\Users\Emil\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\STARDO~1.LNK - C:\Program Files (x86)\Stardock\ObjectDock\ObjectDock.exe mPolicies-explorer: NoActiveDesktop = 1 (0x1) mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1) mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0) mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) mPolicies-system: PromptOnSecureDesktop = 0 (0x0) IE: Add to Google Photos Screensa&ver - C:\Windows\system32\GPhotos.scr/200 IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\OFFICE11\EXCEL.EXE/3000 IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~1\OFFICE11\REFIEBAR.DLL IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll Trusted Zone: clonewarsadventures.com Trusted Zone: freerealms.com Trusted Zone: soe.com Trusted Zone: sony.com DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - C:\Program Files (x86)\Yahoo!\Common\Yinsthelper.dll DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab TCP: Interfaces\{4DAB057F-1C06-42E0-BF4D-C140BDA14CF9} : DhcpNameServer = 89.25.0.253 94.155.155.4 TCP: Interfaces\{F0D86D91-DAA2-434E-94E4-3AEB33F8D1DB} : DhcpNameServer = 192.168.1.1 TCP: Interfaces\{F0D86D91-DAA2-434E-94E4-3AEB33F8D1DB}\257453433554029494 : DhcpNameServer = 217.18.242.74 217.18.242.146 TCP: Interfaces\{F0D86D91-DAA2-434E-94E4-3AEB33F8D1DB}\34F6D6075747562702D41627B65647 : DhcpNameServer = 192.168.1.1 Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll AppInit_DLLs: BHO-X64: Spybot-S&D IE Protection: {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll BHO-X64: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll BHO-X64: Windows Live Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll BHO-X64: Skype add-on for Internet Explorer: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll BHO-X64: SkypeIEPluginBHO - No File BHO-X64: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll BHO-X64: YouTube Downloader Toolbar: {F3FEE66E-E034-436a-86E4-9690573BEE8A} - C:\Program Files (x86)\YouTube Downloader Toolbar\IE\4.9\youtubedownloaderToolbarIE.dll BHO-X64: BS Player Toolbar: {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - C:\Program Files (x86)\BS_Player\prxtbBS_P.dll BHO-X64: BS Player - No File TB-X64: {10EDB994-47F8-43F7-AE96-F2EA63E9F90F} - No File TB-X64: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File TB-X64: {28387537-e3f9-4ed7-860c-11e69af4a8a0} - No File TB-X64: {1c68c940-1b2f-46eb-bd8c-2e1612ff6a58} - No File TB-X64: YouTube Downloader Toolbar: {F3FEE66E-E034-436a-86E4-9690573BEE8A} - C:\Program Files (x86)\YouTube Downloader Toolbar\IE\4.9\youtubedownloaderToolbarIE.dll TB-X64: BS Player Toolbar: {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - C:\Program Files (x86)\BS_Player\prxtbBS_P.dll TB-X64: {BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} - No File mRun-x64: [startCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun mRun-x64: [MGSysCtrl] C:\Program Files (x86)\System Control Manager\MGSysCtrl.exe mRun-x64: [unlockerAssistant] "C:\Program Files (x86)\Unlocker\UnlockerAssistant.exe" mRun-x64: [iObit Security 360] "C:\Program Files (x86)\IObit\IObit Security 360\IS360tray.exe" /autostart mRun-x64: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray AppInit_DLLs-X64: Hosts: 127.0.0.1 www.spywareinfo.com . ================= FIREFOX =================== . FF - ProfilePath - C:\Users\Emil\AppData\Roaming\Mozilla\Firefox\Profiles\kqc2i0fq.default\ FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1750559&SearchSource=3&q={searchTerms} FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - hxxp://www.google.bg/ FF - plugin: C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll FF - plugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll FF - plugin: C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll FF - plugin: C:\Program Files (x86)\Microsoft Silverlight\5.0.61118.0\npctrlui.dll FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll FF - plugin: C:\Users\Emil\AppData\Local\Google\Chrome\User Data\Default\Extensions\dkfjadjghjpjodfhffafagnkbgbpiphf\1.0.3.152_0\npsoe.dll FF - plugin: C:\Users\Emil\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll FF - plugin: C:\Users\Emil\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll . ---- FIREFOX POLICIES ---- FF - user.js: network.http.max-persistent-connections-per-server - 4 FF - user.js: nglayout.initialpaint.delay - 600 FF - user.js: content.notify.interval - 600000 FF - user.js: content.max.tokenizing.time - 1800000 FF - user.js: content.switch.threshold - 600000 . ============= SERVICES / DRIVERS =============== . R1 MpFilter;Microsoft Malware Protection Driver;C:\Windows\system32\DRIVERS\MpFilter.sys --> C:\Windows\system32\DRIVERS\MpFilter.sys [?] R1 SASDIFSV;SASDIFSV;C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys [2011-7-22 14928] R1 SASKUTIL;SASKUTIL;C:\Program Files\SUPERAntiSpyware\saskutil64.sys [2011-7-12 12368] R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?] R2 !SASCORE;SAS Core Service;C:\Program Files\SUPERAntiSpyware\SASCore64.exe [2011-8-12 140672] R2 AdvancedSystemCareService;Advanced SystemCare Service;C:\Program Files (x86)\IObit\Advanced SystemCare 4\ASCService.exe [2011-10-28 328536] R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\system32\atiesrxx.exe --> C:\Windows\system32\atiesrxx.exe [?] R2 IS360service;IS360service;C:\Program Files (x86)\IObit\IObit Security 360\is360srv.exe [2012-1-9 312152] R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-9-30 652872] R2 Micro Star SCM;Micro Star SCM;C:\Program Files (x86)\System Control Manager\MSIService.exe [2011-9-30 160768] R2 NitroReaderDriverReadSpool2;NitroPDFReaderDriverCreatorReadSpool2;C:\Program Files\Common Files\Nitro PDF\Reader\2.0\NitroPDFReaderDriverService2x64.exe [2011-6-21 341296] R2 PfFilter;PfFilter;C:\Program Files (x86)\IObit\Protected Folder\pffilter.sys [2011-10-28 36792] R2 SBSDWSCService;SBSD Security Center Service;C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2011-10-1 1153368] R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe [2011-11-18 2118976] R3 MBAMProtector;MBAMProtector;\??\C:\Windows\system32\drivers\mbam.sys --> C:\Windows\system32\drivers\mbam.sys [?] R3 MpNWMon;Microsoft Malware Protection Network Driver;C:\Windows\system32\DRIVERS\MpNWMon.sys --> C:\Windows\system32\DRIVERS\MpNWMon.sys [?] R3 netr28x;Ralink 802.11n Extensible Wireless Driver;C:\Windows\system32\DRIVERS\netr28x.sys --> C:\Windows\system32\DRIVERS\netr28x.sys [?] R3 NisDrv;Microsoft Network Inspection System;C:\Windows\system32\DRIVERS\NisDrvWFP.sys --> C:\Windows\system32\DRIVERS\NisDrvWFP.sys [?] R3 NisSrv;Microsoft Network Inspection;C:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-4-27 288272] R3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;C:\Windows\system32\DRIVERS\SiSG664.sys --> C:\Windows\system32\DRIVERS\SiSG664.sys [?] R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesDriver64.sys [2011-11-8 11856] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576] S3 dmvsc;dmvsc;C:\Windows\system32\drivers\dmvsc.sys --> C:\Windows\system32\drivers\dmvsc.sys [?] S3 DrvAgent64;DrvAgent64;C:\Windows\SysWOW64\drivers\DrvAgent64.SYS [2011-12-31 21712] S3 McComponentHostService;McAfee Security Scan Component Host Service;C:\Program Files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-1-15 227232] S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\system32\drivers\rdpvideominiport.sys --> C:\Windows\system32\drivers\rdpvideominiport.sys [?] S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\Windows\system32\Drivers\RtsUStor.sys --> C:\Windows\system32\Drivers\RtsUStor.sys [?] S3 Synth3dVsc;Synth3dVsc;C:\Windows\system32\drivers\synth3dvsc.sys --> C:\Windows\system32\drivers\synth3dvsc.sys [?] S3 terminpt;Microsoft Remote Desktop Input Driver;C:\Windows\system32\drivers\terminpt.sys --> C:\Windows\system32\drivers\terminpt.sys [?] S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?] S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\system32\drivers\TsUsbGD.sys --> C:\Windows\system32\drivers\TsUsbGD.sys [?] S3 tsusbhub;tsusbhub;C:\Windows\system32\drivers\tsusbhub.sys --> C:\Windows\system32\drivers\tsusbhub.sys [?] S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?] S4 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe [2011-8-15 2329480] . =============== Created Last 30 ================ . 2012-01-27 21:46:58 8602168 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{A95A156A-E96A-464C-9419-9EA771AC0792}\mpengine.dll 2012-01-26 15:11:15 -------- d-----w- C:\ProgramData\McAfee Security Scan 2012-01-26 15:11:12 -------- d-----w- C:\Program Files (x86)\McAfee Security Scan 2012-01-23 11:52:52 85936 ----a-w- C:\Windows\System32\drivers\scdemu.sys 2012-01-23 11:52:52 -------- d-----w- C:\Program Files (x86)\PowerISO 2012-01-22 22:56:06 -------- d-----w- C:\Users\Emil\AppData\Local\Sony 2012-01-22 22:56:06 -------- d-----w- C:\Program Files (x86)\Sony 2012-01-22 22:56:05 -------- d-----w- C:\Program Files\Sony 2012-01-16 22:02:11 -------- d-----w- C:\ProgramData\regid.1986-12.com.adobe 2012-01-16 21:32:15 -------- d-----w- C:\Users\Emil\New folder (2) 2012-01-16 21:19:21 -------- d-----w- C:\Users\Emil\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant 2012-01-15 00:46:00 340992 ----a-w- C:\Windows\System32\schannel.dll 2012-01-14 13:05:06 -------- d-----w- C:\Users\Emil\AppData\Roaming\FOG Downloader 2012-01-12 00:19:16 4448256 ----a-w- C:\Windows\SysWow64\GPhotos.scr 2012-01-11 19:54:54 1572864 ----a-w- C:\Windows\System32\quartz.dll 2012-01-11 19:54:54 1328128 ----a-w- C:\Windows\SysWow64\quartz.dll 2012-01-11 19:54:53 514560 ----a-w- C:\Windows\SysWow64\qdvd.dll 2012-01-11 19:54:53 366592 ----a-w- C:\Windows\System32\qdvd.dll 2012-01-11 19:54:51 1731920 ----a-w- C:\Windows\System32\ntdll.dll 2012-01-11 19:54:51 1292080 ----a-w- C:\Windows\SysWow64\ntdll.dll 2012-01-11 19:54:50 77312 ----a-w- C:\Windows\System32\packager.dll 2012-01-11 19:54:50 67072 ----a-w- C:\Windows\SysWow64\packager.dll 2011-12-31 01:19:47 422 ---ha-w- C:\aaw7boot.cmd 2011-12-31 01:01:06 -------- d-----w- C:\Program Files (x86)\BS_Player 2011-12-31 00:58:54 -------- d-----w- C:\Users\Emil\AppData\Roaming\BSplayer Pro 2011-12-31 00:58:54 -------- d-----w- C:\Users\Emil\AppData\Roaming\BSplayer 2011-12-31 00:02:47 -------- d-----w- C:\Users\Emil\AppData\Roaming\foobar2000 2011-12-30 23:37:02 21712 ----a-w- C:\Windows\SysWow64\drivers\DrvAgent64.SYS 2011-12-30 23:19:26 55384 ----a-w- C:\Windows\System32\drivers\SBREDrv.sys 2011-12-30 22:59:21 57288 ----a-w- C:\Windows\System32\drivers\PktIcpt.sys 2011-12-30 22:59:16 40392 ----a-w- C:\Windows\System32\drivers\GDBehave.sys 2011-12-30 22:58:34 15880 ----a-w- C:\Windows\SysWow64\lsdelete.exe 2011-12-30 22:58:04 85960 ----a-w- C:\Windows\System32\drivers\MiniIcpt.sys 2011-12-30 22:57:59 48584 ----a-w- C:\Windows\System32\drivers\gdwfpcd64.sys 2011-12-30 22:56:42 -------- d-----w- C:\ProgramData\G DATA 2011-12-30 22:56:42 -------- d-----w- C:\Program Files (x86)\Lavasoft 2011-12-30 22:56:42 -------- d-----w- C:\Program Files (x86)\Common Files\G Data 2011-12-30 22:26:56 -------- d-----w- C:\ProgramData\3825A 2011-12-30 22:11:04 -------- d-----w- C:\Users\Emil\AppData\Roaming\Canneverbe Limited 2011-12-30 22:11:04 -------- d-----w- C:\ProgramData\Canneverbe Limited . ==================== Find3M ==================== . 2012-01-26 15:13:15 414368 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl 2012-01-21 23:23:45 564792 ----a-w- C:\Windows\System32\drivers\sptd.sys 2012-01-04 09:26:37 279096 ------w- C:\Windows\System32\MpSigStub.exe 2011-12-24 02:10:12 2828 --sha-w- C:\ProgramData\KGyGaAvL.sys 2011-12-24 02:10:01 8 --sh--r- C:\ProgramData\E973425039.sys 2011-12-16 19:03:07 348160 ----a-w- C:\Windows\SysWow64\msvcr71.dll 2011-12-16 19:03:07 1700352 ----a-w- C:\Windows\SysWow64\gdiplus.dll 2011-12-16 19:03:07 1060864 ----a-w- C:\Windows\SysWow64\mfc71.dll 2011-12-10 13:24:08 23152 ----a-w- C:\Windows\System32\drivers\mbam.sys 2011-11-24 04:52:09 3145216 ----a-w- C:\Windows\System32\win32k.sys 2011-11-18 12:37:14 34624 ----a-w- C:\Windows\System32\TURegOpt.exe 2011-11-18 12:37:08 25920 ----a-w- C:\Windows\System32\authuitu.dll 2011-11-18 12:37:08 21312 ----a-w- C:\Windows\SysWow64\authuitu.dll 2011-11-17 07:52:42 83448 ----a-w- C:\Windows\SysWow64\CddbLangJA.dll 2011-11-17 07:52:42 808440 ----a-w- C:\Windows\SysWow64\CDDBUI.dll 2011-11-17 07:52:42 796152 ----a-w- C:\Windows\SysWow64\CDDBControl.dll 2011-11-17 07:52:42 499712 ----a-w- C:\Windows\SysWow64\msvcp71.dll 2011-11-17 07:52:42 169464 ----a-w- C:\Windows\SysWow64\CddbLangRU.dll 2011-11-17 07:52:42 103928 ----a-w- C:\Windows\SysWow64\CddbLangFR.dll 2011-11-17 07:52:42 103928 ----a-w- C:\Windows\SysWow64\CddbLangES.dll 2011-11-17 07:52:42 103928 ----a-w- C:\Windows\SysWow64\CddbLangDE.dll 2011-11-17 06:49:14 95600 ----a-w- C:\Windows\System32\drivers\ksecdd.sys 2011-11-17 06:49:14 152432 ----a-w- C:\Windows\System32\drivers\ksecpkg.sys 2011-11-17 06:44:43 459232 ----a-w- C:\Windows\System32\drivers\cng.sys 2011-11-17 06:35:28 395776 ----a-w- C:\Windows\System32\webio.dll 2011-11-17 06:35:26 29184 ----a-w- C:\Windows\System32\sspisrv.dll 2011-11-17 06:35:26 136192 ----a-w- C:\Windows\System32\sspicli.dll 2011-11-17 06:35:25 28160 ----a-w- C:\Windows\System32\secur32.dll 2011-11-17 06:35:19 1447936 ----a-w- C:\Windows\System32\lsasrv.dll 2011-11-17 06:33:55 31232 ----a-w- C:\Windows\System32\lsass.exe 2011-11-17 05:35:02 314880 ----a-w- C:\Windows\SysWow64\webio.dll 2011-11-17 05:34:52 224768 ----a-w- C:\Windows\SysWow64\schannel.dll 2011-11-17 05:34:52 22016 ----a-w- C:\Windows\SysWow64\secur32.dll 2011-11-17 05:28:48 96768 ----a-w- C:\Windows\SysWow64\sspicli.dll 2011-11-10 03:54:13 472808 ----a-w- C:\Windows\SysWow64\deployJava1.dll 2011-11-05 05:32:50 2048 ----a-w- C:\Windows\System32\tzres.dll 2011-11-05 04:26:03 2048 ----a-w- C:\Windows\SysWow64\tzres.dll 2011-11-04 01:53:39 2309120 ----a-w- C:\Windows\System32\jscript9.dll 2011-11-04 01:44:47 1390080 ----a-w- C:\Windows\System32\wininet.dll 2011-11-04 01:44:21 1493504 ----a-w- C:\Windows\System32\inetcpl.cpl 2011-11-04 01:34:43 2382848 ----a-w- C:\Windows\System32\mshtml.tlb 2011-11-03 22:47:42 1798144 ----a-w- C:\Windows\SysWow64\jscript9.dll 2011-11-03 22:40:21 1427456 ----a-w- C:\Windows\SysWow64\inetcpl.cpl 2011-11-03 22:39:47 1127424 ----a-w- C:\Windows\SysWow64\wininet.dll 2011-11-03 22:31:57 2382848 ----a-w- C:\Windows\SysWow64\mshtml.tlb . ============= FINISH: 19:04:31,99 =============== И другото: . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2011-08-26.01) . Microsoft Windows 7 Ultimate Boot Device: \Device\HarddiskVolume1 Install Date: 30.9.2011 г. 11:44:28 System Uptime: 28.1.2012 г. 18:08:22 (1 hours ago) . Motherboard: MICRO-STAR INT'L CO., LTD | | MS-1682 Processor: Pentium® Dual-Core CPU T4500 @ 2.30GHz | CPU 1 | 2300/200mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 40 GiB total, 8,99 GiB free. D: is FIXED (NTFS) - 426 GiB total, 339,76 GiB free. E: is CDROM () . ==== Disabled Device Manager Items ============= . Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318} Description: Microsoft ISATAP Adapter Device ID: ROOT\*ISATAP\0001 Manufacturer: Microsoft Name: Microsoft ISATAP Adapter #2 PNP Device ID: ROOT\*ISATAP\0001 Service: tunnel . Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318} Description: Microsoft Teredo Tunneling Adapter Device ID: ROOT\*TEREDO\0000 Manufacturer: Microsoft Name: Teredo Tunneling Pseudo-Interface PNP Device ID: ROOT\*TEREDO\0000 Service: tunnel . Class GUID: Description: Device ID: ROOT\LEGACY_A2ACC\0000 Manufacturer: Name: PNP Device ID: ROOT\LEGACY_A2ACC\0000 Service: . Class GUID: Description: Device ID: ROOT\LEGACY_A2INJECTIONDRIVER\0000 Manufacturer: Name: PNP Device ID: ROOT\LEGACY_A2INJECTIONDRIVER\0000 Service: . Class GUID: Description: Device ID: ROOT\LEGACY_REGFILTER\0000 Manufacturer: Name: PNP Device ID: ROOT\LEGACY_REGFILTER\0000 Service: . Class GUID: Description: Device ID: ROOT\XBOX360USBDEVICE\0000 Manufacturer: Name: PNP Device ID: ROOT\XBOX360USBDEVICE\0000 Service: . Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318} Description: Microsoft 6to4 Adapter Device ID: ROOT\*6TO4MP\0000 Manufacturer: Microsoft Name: Microsoft 6to4 Adapter PNP Device ID: ROOT\*6TO4MP\0000 Service: tunnel . Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318} Description: Microsoft ISATAP Adapter Device ID: ROOT\*ISATAP\0000 Manufacturer: Microsoft Name: Microsoft ISATAP Adapter PNP Device ID: ROOT\*ISATAP\0000 Service: tunnel . ==== System Restore Points =================== . No restore point in system. . ==== Installed Programs ====================== . µTorrent Adobe AIR Adobe Flash Player ActiveX Adobe Shockwave Player 11.6 Advanced SystemCare 4 AEnglish Dictionary XP 1.72 Apple Application Support BS Player Toolbar BS.Player FREE Camera Recorder Catalyst Control Center Core Implementation Catalyst Control Center Graphics Full Existing Catalyst Control Center Graphics Full New Catalyst Control Center Graphics Light Catalyst Control Center Graphics Previews Vista Catalyst Control Center InstallProxy Catalyst Control Center Localization All ccc-core-static CCC Help Chinese Standard CCC Help Chinese Traditional CCC Help Czech CCC Help Danish CCC Help Dutch CCC Help English CCC Help Finnish CCC Help French CCC Help German CCC Help Greek CCC Help Hungarian CCC Help Italian CCC Help Japanese CCC Help Korean CCC Help Norwegian CCC Help Polish CCC Help Portuguese CCC Help Russian CCC Help Spanish CCC Help Swedish CCC Help Thai CCC Help Turkish CDBurnerXP DHTML Editing Component Foxit Reader 5.0 FreeApps Ghostscript GPL 8.64 (Msi Setup) GIMP 2.6.11 GOM Player Google Земя Google Chrome Hotfix for Microsoft Visual Studio 2007 Tools for Applications - ENU (KB946040) Hotfix for Microsoft Visual Studio 2007 Tools for Applications - ENU (KB946308) Hotfix for Microsoft Visual Studio 2007 Tools for Applications - ENU (KB946344) Hotfix for Microsoft Visual Studio 2007 Tools for Applications - ENU (KB947540) Hotfix for Microsoft Visual Studio 2007 Tools for Applications - ENU (KB947789) IObit Security 360 Java Auto Updater Java 6 Update 30 K-Lite Codec Pack 6.2.0 (Full) LEGO Universe LogMeIn Hamachi Malwarebytes Anti-Malware, версия 1.60.0.1800 McAfee Security Scan Plus Microsoft Choice Guard Microsoft Office Professional Edition 2003 Microsoft SQL Server 2005 Compact Edition [ENU] Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft Visual Studio Tools for Applications 2.0 - ENU Microsoft Visual Studio Tools for Applications 2.0 Runtime Microsoft_VC80_ATL_x86 Microsoft_VC80_CRT_x86 Microsoft_VC80_MFC_x86 Microsoft_VC80_MFCLOC_x86 Microsoft_VC90_ATL_x86 Microsoft_VC90_CRT_x86 Microsoft_VC90_MFC_x86 Microsoft_VC90_MFCLOC_x86 Mozilla Firefox 8.0 (x86 bg) MSVCRT MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) MSXML 4.0 SP3 Parser MSXML 4.0 SP3 Parser (KB973685) Nero 7 Ultra Edition neroxml ObjectDock Plus Opera 11.60 PhotoScape Picasa 3 PowerISO Protected Folder QuickTime Realtek High Definition Audio Driver Realtek USB 2.0 Card Reader Revo Uninstaller 1.93 Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663) Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636) Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351) Skype™ 5.5 Spybot - Search & Destroy swMSM System Control Manager Talisman Online Ver.1461 The KMPlayer (remove only) TuneUp Utilities 2012 TuneUp Utilities Language Pack (en-US) Unity Web Player Unlocker 1.9.1 Update for Microsoft .NET Framework 4 Client Profile (KB2468871) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) VLC media player 1.1.11 Windows Live Communications Platform Windows Live Essentials Windows Live Photo Gallery Windows Live Sign-in Assistant Windows Live Sync Windows Live Upload Tool Windows Media Player Firefox Plugin Yahoo! Install Manager YouTube Downloader 3.4 YouTube Downloader Toolbar v4.9 . ==== Event Viewer Messages From Past Week ======== . 28.1.2012 г. 18:10:26, Error: Service Control Manager [7023] - The Superfetch service terminated with the following error: The system cannot find the file specified. 28.1.2012 г. 13:13:12, Error: Service Control Manager [7023] - The Superfetch service terminated with the following error: The system cannot find the file specified. 28.1.2012 г. 08:51:27, Error: volsnap [36] - The shadow copies of volume C: were aborted because the shadow copy storage could not grow due to a user imposed limit. 28.1.2012 г. 08:45:28, Error: Service Control Manager [7023] - The Superfetch service terminated with the following error: The system cannot find the file specified. 27.1.2012 г. 21:11:44, Error: Application Popup [56] - Driver USBSTOR returned invalid ID for a child device (274FCBD155A85B5DC58F3047B78A8B71A903359366B30DFB4EC5D5170B141B9). 27.1.2012 г. 16:04:28, Error: volsnap [36] - The shadow copies of volume C: were aborted because the shadow copy storage could not grow due to a user imposed limit. 27.1.2012 г. 13:53:23, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the lmhosts service. 27.1.2012 г. 07:55:26, Error: Service Control Manager [7023] - The Superfetch service terminated with the following error: The system cannot find the file specified. 26.1.2012 г. 15:47:42, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the lmhosts service. 26.1.2012 г. 12:31:58, Error: volsnap [36] - The shadow copies of volume C: were aborted because the shadow copy storage could not grow due to a user imposed limit. 26.1.2012 г. 08:25:25, Error: Service Control Manager [7023] - The Superfetch service terminated with the following error: The system cannot find the file specified. 25.1.2012 г. 08:28:14, Error: Service Control Manager [7023] - The Superfetch service terminated with the following error: The system cannot find the file specified. 24.1.2012 г. 07:27:08, Error: Service Control Manager [7023] - The Superfetch service terminated with the following error: The system cannot find the file specified. 23.1.2012 г. 13:57:34, Error: Service Control Manager [7023] - The Superfetch service terminated with the following error: The system cannot find the file specified. 23.1.2012 г. 12:45:06, Error: Application Popup [56] - Driver USBSTOR returned invalid ID for a child device (274FCBD155A85B5DC58F3047B78A8B71A903359366B30DFB4EC5D5170B141B9). 23.1.2012 г. 08:10:53, Error: Service Control Manager [7023] - The Superfetch service terminated with the following error: The system cannot find the file specified. 23.1.2012 г. 07:24:05, Error: Service Control Manager [7023] - The Superfetch service terminated with the following error: The system cannot find the file specified. 23.1.2012 г. 00:43:40, Error: volsnap [36] - The shadow copies of volume C: were aborted because the shadow copy storage could not grow due to a user imposed limit. 22.1.2012 г. 07:53:32, Error: Service Control Manager [7023] - The Superfetch service terminated with the following error: The system cannot find the file specified. 22.1.2012 г. 01:27:56, Error: Service Control Manager [7023] - The Superfetch service terminated with the following error: The system cannot find the file specified. 21.1.2012 г. 18:13:36, Error: Service Control Manager [7023] - The Superfetch service terminated with the following error: The system cannot find the file specified. 21.1.2012 г. 10:18:48, Error: Service Control Manager [7023] - The Superfetch service terminated with the following error: The system cannot find the file specified. 21.1.2012 г. 07:59:33, Error: Service Control Manager [7023] - The Superfetch service terminated with the following error: The system cannot find the file specified. . ==== End Of File ===========================

28 януари 201214 г.

Автор

Има ли нещо притеснително?

28 януари 201214 г.

Има ли нещо притеснително?

Здравейте,

Единственото притеснително и може би отговор на въпроса, защо компютъра ви се бави е инсталирането на няколкостотин програми за защита и оптимизация.

Съветвам ви да деинсталирате следните приложения от Start Menu => Control Panel => Uninstall a program:

IObit Security 360 => неефективна

Spybot - Search & Destroy => неефективна

McAfee Security Scan => само скенер...няма нужда при наличие на антивирусна програма

Advanced SystemCare 4 => при неправилна употреба повече вредят, отколкото да помагат

TuneUp Utilities 2012 => при неправилна употреба повече вредят, отколкото да помагат

Stardock ObjectDock => при наличие на удобния и голям "SUPER TASKBAR" в Windows 7 това приложение вече си е направо излишно и разхищение на системни ресурси.

След като го деинсталирате изтрийте следните папки и файлове:

C:\ProgramData\McAfee Security Scan <= тази папка

C:\Program Files (x86)\McAfee Security Scan <= тази папка

C:\Windows\System32\drivers\SBREDrv.sys <= този файл (остатък от Ad-aware)

C:\Windows\SysWow64\lsdelete.exe <= този файл (остатък от Ad-aware)

C:\Program Files (x86)\Lavasoft <= тази папка (остатък от Ad-aware)

C:\Windows\System32\drivers\MiniIcpt.sys <= този файл (остатък от G-DATA)

C:\Windows\System32\drivers\gdwfpcd64.sys <= този файл (остатък от G-DATA)

C:\ProgramData\G DATA <= тази папка

C:\Program Files (x86)\Common Files\G Data <= тази папка

Виждат се и услуги от a-squared (тях ще изтрием по-късно).

Device ID: ROOT\LEGACY_A2ACC\0000
Device ID: ROOT\LEGACY_A2INJECTIONDRIVER\0000

Искам да проверим съдържанието на една съмнителна папка.

Моля, изтеглете SystemLook и запазете програмата на десктопа.
Кликнете два пъти върху SystemLook.exe, за да стартирате програмата.
Копирайте съдържанието на следния код в текстовото поле на програмата
```
:dir
C:\ProgramData\3825A /sub
```
Кликнете на бутона Look, за да започне сканирането.
Когато сканирането завърши ще Ви се отвори Notepad с резултата от сканирането. Моля, публикувайте лог файла в следващия си коментар.

28 януари 201214 г.

Автор

C:\Program Files (x86)\McAfee Security Scan <= тази папка - това го търсих много, но не можах да го открия.

C:\Program Files (x86)\Lavasoft <= тази папка (остатък от Ad-aware) - това пък не ще да го трие - дава, че папката или файла е отворена в друга програма и ме подканя да опитам пак. Уж всичко бях изключила, пък не става.

Деинсталирах програмите. TuneUp Utilities 2012 - защо трябваше да я деинсталирам? Много хора ми я бяха препоръчвали и приятелят ми, който обслужва отвреме-навреме компютъра ми я беше инсталирал и твърдеше, че върши много хубава работа. Сега коя програма на компютъра ми извършва оптимизация вместо тази?

Ето и лог файла:

SystemLook 30.07.11 by jpshortstuff

Log created at 01:26 on 29/01/2012 by Emil

Administrator - Elevation successful

WARNING: SystemLook running under WOW64. Use SystemLook_x64 for accurate results.

========== dir ==========

C:\ProgramData\3825A - Parameters: "/sub"

---Files---

{5CB58EAA-6558-425E-8718-0C7B0ED430FD}.swf --a---- 3957 bytes [22:26 30/12/2011] [06:35 24/08/2011]

No folders found.

-= EOF =-

Редактирано 28 януари 201214 г. от Beni_mama (преглед на промените)

29 януари 201214 г.

Windows може да се поддържа достатъчно добре и без допълнително програми като TuneUp Utilities 2012.

Ако знаете английски ще разберете за какво говоря и защо не препоръчвам такива "чистачки" за всекидневна употреба. => http://miekiemoes.bl...weaking_13.html

От по-безопасните препоръчвам само CCleaner 3.15.1643 Standard (като разбира се се използва само като чистач на временните файлове и не се използва почистването на регистратурата, освен ако не знаете какво точно правите).

Деинсталирайте и следния туулбар:

BS Player Toolbar

Обновете следните програми до последните им версии:

Foxit Reader 5.0 => Foxit Reader 5.1.4 Build 0104

Mozilla Firefox 8.0 (x86 bg) => Mozilla Firefox 9.0.1 Final за Windows на български

K-Lite Codec Pack 6.2.0 (Full) => K-Lite Codec Pack 8.2.0 Final Full

Skype™ 5.5 => Skype 5.6.0.110 Final

Спрете някои ненужни услуги:

Отворете Start => в полето за търсене въведете командата => services.msc и натиснете Enter

От списъка намерете Windows Search и щракнете върху него с двукратен клик на мишката.

Натиснете Stop, а от падащото меню изберете Disabled.

Изтрийте папката C:\ProgramData\3825A <= тази папка

След това изтеглете прикачения файл, разархивирайте архива и стартирайте файла delete.bat (с десен бутон върху него => Run as administrator) delete.zip

За финал направете нова проверка с DDS и публикувайте резултатите.

Кажете и има ли някаква положителна промяна в бързината на лаптопа.

29 януари 201214 г.

Автор

Това с delete.zip - след като го разархивирах като кликна на delete.bat ми излиза меню на български и не виждам никаква опция свързана с администратор. Какво да правя?

Освен това ми изчезна от браузъра Youtube тул бара. Фигурира в Менажер на добавките и показва, че е активен, но го няма.

Редактирано 29 януари 201214 г. от Beni_mama (преглед на промените)

29 януари 201214 г.

На бъгларски опцията трябва да се казва Изпълни като администратор. (с десен бутон върху файла).

За туулбара сигурно само се е скрил бутона => Десен бутон върху туулбара на Mozilla (под адресната лента) и изберете Customize (ако е на български май се казваше персонализиция).

Намерете иконата на въпросния тулбар и го завлачете до желаната позиция с drag/drop (с провлачване - задържане и местене на иконата) и след това натиснете бутона Done. (готово).

PS: Възможно е след обновяване на Mozilla, вашата версия на туулбара вече да не се поддържа.

За целта просто може би трябва да се инсталира по-нова версия на самата програма => YouTube Downloader 3.5

29 януари 201214 г.

Автор

На бъгларски опцията трябва да се казва Изпълни като администратор. (с десен бутон върху файла).

За туулбара сигурно само се е скрил бутона => Десен бутон върху туулбара на Mozilla (под адресната лента) и изберете Customize (ако е на български май се казваше персонализиция).

Намерете иконата на въпросния тулбар и го завлачете до желаната позиция с drag/drop (с провлачване - задържане и местене на иконата) и след това натиснете бутона Done. (готово).

PS: Възможно е след обновяване на Mozilla, вашата версия на туулбара вече да не се поддържа.

За целта просто може би трябва да се инсталира по-нова версия на самата програма => YouTube Downloader 3.5

За най-горното аз не съм го правила както трябва - синчето ми показа къде е отишъл разархивирания файл и направих както ми казахте. Като натиснах бутона набързо се появи прозорец и изчезна и след това файла изчезна, остана само папката, да я изтрия ли?

Що се отнася до тулбара, инсталирах тази версия, която сте ми посочили, но нищо... Опитах и с горните съвети, но го няма. Вероятно е резултат от обновяването на Мозилата и друг път така се е получавало. Ще си търся друг тулбар.

Остава ми сега да пусна DDS.

29 януари 201214 г.

Ако сте сканирали с MBAM, тя попринцип го намира като (PUP.Dealio.TB) и е възможно да сте го премахнали с нея ?

Но вие казвате, че присъства в мениджъра на добавките...какво пише за неговото състояние там ? (трябва да има активирай, деактивирай, премахни), а при проблемни добавки направо го изключва автоматично и пише, че не се поддръжа от браузъра.

За теглене, много по-удачна е добавката download helper, но тя е само за Mozilla Firefox.

Тегли обаче от почти всички флаш базирани сайтове при това без да е необходимо инсталирането на други програми...само се кликва въхру розовите планетки.

Може да бъде изтеглен оттук

29 януари 201214 г.

Автор

Ето резултата от DDS:

.

DDS (Ver_2011-08-26.01) - NTFSAMD64

Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_30

Run by Emil at 20:15:23 on 2012-01-29

Microsoft Windows 7 Ultimate 6.1.7601.1.1251.359.1033.18.4095.2851 [GMT 2:00]

.

AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}

SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}

SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

============== Running Processes ===============

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe

C:\Windows\system32\atiesrxx.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\system32\atieclxx.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\taskhost.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE

C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe

C:\Program Files (x86)\System Control Manager\MSIService.exe

C:\Program Files\Common Files\Nitro PDF\Reader\2.0\NitroPDFReaderDriverService2x64.exe

C:\Windows\system32\svchost.exe -k imgsvc

C:\Program Files\Microsoft Security Client\msseces.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE

C:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe

C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

C:\Program Files (x86)\System Control Manager\MGSysCtrl.exe

C:\Program Files (x86)\Unlocker\UnlockerAssistant.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

D:\Downloads\K-Lite Codec Pack 8.2.0 Full (kaldata.com).exe

C:\Users\Emil\AppData\Local\Temp\is-N9DTO.tmp\K-Lite Codec Pack 8.2.0 Full (kaldata.com).tmp

D:\Downloads\K-Lite Codec Pack 8.2.0 Full (kaldata.com).exe

C:\Users\Emil\AppData\Local\Temp\is-P2J7G.tmp\K-Lite Codec Pack 8.2.0 Full (kaldata.com).tmp

C:\Windows\system32\taskeng.exe

C:\Program Files (x86)\Skype\Phone\Skype.exe

C:\Program Files (x86)\Application Updater\ApplicationUpdater.exe

C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe

C:\Windows\system32\UI0Detect.exe

C:\Windows\system32\prevhost.exe

C:\Windows\system32\DllHost.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\conhost.exe

C:\Windows\SysWOW64\cscript.exe

C:\Windows\system32\wbem\wmiprvse.exe

.

============== Pseudo HJT Report ===============

.

uSearch Page = hxxp://www.google.com

uStart Page = hxxp://eu.ask.com/?l=dis&o=101702

uSearch Bar = hxxp://www.google.com/ie

uDefault_Search_URL = hxxp://www.google.com/ie

mDefault_Page_URL = hxxp://www.yahoo.com

mStart Page = hxxp://www.yahoo.com

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

mSearchAssistant = about:blank

uURLSearchHooks: YouTube Downloader Toolbar: {f3fee66e-e034-436a-86e4-9690573bee8a} - C:\Program Files (x86)\YouTube Downloader Toolbar\IE\4.9\youtubedownloaderToolbarIE.dll

uURLSearchHooks: H - No File

mURLSearchHooks: H - No File

mWinlogon: Userinit=userinit.exe,

BHO: Java Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll

BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO: Skype add-on for Internet Explorer: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

BHO: YouTube Downloader Toolbar: {f3fee66e-e034-436a-86e4-9690573bee8a} - C:\Program Files (x86)\YouTube Downloader Toolbar\IE\4.9\youtubedownloaderToolbarIE.dll

TB: {10EDB994-47F8-43F7-AE96-F2EA63E9F90F} - No File

TB: {28387537-e3f9-4ed7-860c-11e69af4a8a0} - No File

TB: {1c68c940-1b2f-46eb-bd8c-2e1612ff6a58} - No File

TB: YouTube Downloader Toolbar: {f3fee66e-e034-436a-86e4-9690573bee8a} - C:\Program Files (x86)\YouTube Downloader Toolbar\IE\4.9\youtubedownloaderToolbarIE.dll

TB: {BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} - No File

TB: {FED66DC5-1B74-4A04-8F5C-15C5ACE2B9A5} - No File

uRun: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

uRun: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

mRun: [startCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

mRun: [MGSysCtrl] C:\Program Files (x86)\System Control Manager\MGSysCtrl.exe

mRun: [unlockerAssistant] "C:\Program Files (x86)\Unlocker\UnlockerAssistant.exe"

mRun: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray

mRun: [searchSettings] "C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe"

StartupFolder: C:\Users\Emil\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\STARDO~1.LNK - C:\Program Files (x86)\Stardock\ObjectDock\ObjectDock.exe

mPolicies-explorer: NoActiveDesktop = 1 (0x1)

mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)

mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)

mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

mPolicies-system: PromptOnSecureDesktop = 0 (0x0)

IE: Add to Google Photos Screensa&ver - C:\Windows\system32\GPhotos.scr/200

IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\OFFICE11\EXCEL.EXE/3000

IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~1\OFFICE11\REFIEBAR.DLL

Trusted Zone: clonewarsadventures.com

Trusted Zone: freerealms.com

Trusted Zone: soe.com

Trusted Zone: sony.com

DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - C:\Program Files (x86)\Yahoo!\Common\Yinsthelper.dll

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab

TCP: DhcpNameServer = 89.25.0.253 94.155.155.4

TCP: Interfaces\{4DAB057F-1C06-42E0-BF4D-C140BDA14CF9} : DhcpNameServer = 89.25.0.253 94.155.155.4

TCP: Interfaces\{F0D86D91-DAA2-434E-94E4-3AEB33F8D1DB} : DhcpNameServer = 192.168.1.1

TCP: Interfaces\{F0D86D91-DAA2-434E-94E4-3AEB33F8D1DB}\257453433554029494 : DhcpNameServer = 217.18.242.74 217.18.242.146

TCP: Interfaces\{F0D86D91-DAA2-434E-94E4-3AEB33F8D1DB}\34F6D6075747562702D41627B65647 : DhcpNameServer = 192.168.1.1

Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL

AppInit_DLLs:

BHO-X64: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll

BHO-X64: Windows Live Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO-X64: Skype add-on for Internet Explorer: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

BHO-X64: SkypeIEPluginBHO - No File

BHO-X64: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

BHO-X64: YouTube Downloader Toolbar: {F3FEE66E-E034-436a-86E4-9690573BEE8A} - C:\Program Files (x86)\YouTube Downloader Toolbar\IE\4.9\youtubedownloaderToolbarIE.dll

TB-X64: {10EDB994-47F8-43F7-AE96-F2EA63E9F90F} - No File

TB-X64: {28387537-e3f9-4ed7-860c-11e69af4a8a0} - No File

TB-X64: {1c68c940-1b2f-46eb-bd8c-2e1612ff6a58} - No File

TB-X64: YouTube Downloader Toolbar: {F3FEE66E-E034-436a-86E4-9690573BEE8A} - C:\Program Files (x86)\YouTube Downloader Toolbar\IE\4.9\youtubedownloaderToolbarIE.dll

TB-X64: {BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} - No File

TB-X64: {FED66DC5-1B74-4A04-8F5C-15C5ACE2B9A5} - No File

mRun-x64: [startCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

mRun-x64: [MGSysCtrl] C:\Program Files (x86)\System Control Manager\MGSysCtrl.exe

mRun-x64: [unlockerAssistant] "C:\Program Files (x86)\Unlocker\UnlockerAssistant.exe"

mRun-x64: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray

mRun-x64: [searchSettings] "C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe"

AppInit_DLLs-X64:

Hosts: 127.0.0.1 www.spywareinfo.com

.

================= FIREFOX ===================

.

FF - ProfilePath - C:\Users\Emil\AppData\Roaming\Mozilla\Firefox\Profiles\kqc2i0fq.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1750559&SearchSource=3&q={searchTerms}

FF - prefs.js: browser.search.selectedEngine - Yahoo

FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/

FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=937811&p=

FF - plugin: C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll

FF - plugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll

FF - plugin: C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll

FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll

FF - plugin: C:\Program Files (x86)\Microsoft Silverlight\5.0.61118.0\npctrlui.dll

FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

FF - plugin: C:\Users\Emil\AppData\Local\Google\Chrome\User Data\Default\Extensions\dkfjadjghjpjodfhffafagnkbgbpiphf\1.0.3.152_0\npsoe.dll

FF - plugin: C:\Users\Emil\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll

FF - plugin: C:\Users\Emil\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll

FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll

.

---- FIREFOX POLICIES ----

FF - user.js: network.http.max-persistent-connections-per-server - 4

FF - user.js: nglayout.initialpaint.delay - 600

FF - user.js: content.notify.interval - 600000

FF - user.js: content.max.tokenizing.time - 1800000

FF - user.js: content.switch.threshold - 600000

.

============= SERVICES / DRIVERS ===============

.

R1 MpFilter;Microsoft Malware Protection Driver;C:\Windows\system32\DRIVERS\MpFilter.sys --> C:\Windows\system32\DRIVERS\MpFilter.sys [?]

R1 SASDIFSV;SASDIFSV;C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys [2011-7-22 14928]

R1 SASKUTIL;SASKUTIL;C:\Program Files\SUPERAntiSpyware\saskutil64.sys [2011-7-12 12368]

R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?]

R2 !SASCORE;SAS Core Service;C:\Program Files\SUPERAntiSpyware\SASCore64.exe [2011-8-12 140672]

R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\system32\atiesrxx.exe --> C:\Windows\system32\atiesrxx.exe [?]

R2 Application Updater;Application Updater;C:\Program Files (x86)\Application Updater\ApplicationUpdater.exe [2011-12-14 748440]

R2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe [2011-8-15 2329480]

R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-9-30 652872]

R2 Micro Star SCM;Micro Star SCM;C:\Program Files (x86)\System Control Manager\MSIService.exe [2011-9-30 160768]

R2 NitroReaderDriverReadSpool2;NitroPDFReaderDriverCreatorReadSpool2;C:\Program Files\Common Files\Nitro PDF\Reader\2.0\NitroPDFReaderDriverService2x64.exe [2011-6-21 341296]

R2 PfFilter;PfFilter;C:\Program Files (x86)\IObit\Protected Folder\pffilter.sys [2011-10-28 36792]

R3 MBAMProtector;MBAMProtector;\??\C:\Windows\system32\drivers\mbam.sys --> C:\Windows\system32\drivers\mbam.sys [?]

R3 MpNWMon;Microsoft Malware Protection Network Driver;C:\Windows\system32\DRIVERS\MpNWMon.sys --> C:\Windows\system32\DRIVERS\MpNWMon.sys [?]

R3 netr28x;Ralink 802.11n Extensible Wireless Driver;C:\Windows\system32\DRIVERS\netr28x.sys --> C:\Windows\system32\DRIVERS\netr28x.sys [?]

R3 NisDrv;Microsoft Network Inspection System;C:\Windows\system32\DRIVERS\NisDrvWFP.sys --> C:\Windows\system32\DRIVERS\NisDrvWFP.sys [?]

R3 NisSrv;Microsoft Network Inspection;C:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-4-27 288272]

R3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;C:\Windows\system32\DRIVERS\SiSG664.sys --> C:\Windows\system32\DRIVERS\SiSG664.sys [?]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]

S3 dmvsc;dmvsc;C:\Windows\system32\drivers\dmvsc.sys --> C:\Windows\system32\drivers\dmvsc.sys [?]

S3 DrvAgent64;DrvAgent64;C:\Windows\SysWOW64\drivers\DrvAgent64.SYS [2011-12-31 21712]

S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\system32\drivers\rdpvideominiport.sys --> C:\Windows\system32\drivers\rdpvideominiport.sys [?]

S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\Windows\system32\Drivers\RtsUStor.sys --> C:\Windows\system32\Drivers\RtsUStor.sys [?]

S3 Synth3dVsc;Synth3dVsc;C:\Windows\system32\drivers\synth3dvsc.sys --> C:\Windows\system32\drivers\synth3dvsc.sys [?]

S3 terminpt;Microsoft Remote Desktop Input Driver;C:\Windows\system32\drivers\terminpt.sys --> C:\Windows\system32\drivers\terminpt.sys [?]

S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]

S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\system32\drivers\TsUsbGD.sys --> C:\Windows\system32\drivers\TsUsbGD.sys [?]

S3 tsusbhub;tsusbhub;C:\Windows\system32\drivers\tsusbhub.sys --> C:\Windows\system32\drivers\tsusbhub.sys [?]

S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?]

.

=============== Created Last 30 ================

.

2012-01-29 15:33:26 -------- d-----w- C:\Program Files (x86)\Application Updater

2012-01-29 15:33:25 -------- d-----w- C:\Program Files (x86)\YouTube Downloader Toolbar

2012-01-29 15:33:25 -------- d-----w- C:\Program Files (x86)\Common Files\Spigot

2012-01-29 15:32:56 -------- d-----w- C:\ProgramData\YouTube Downloader

2012-01-29 15:32:50 -------- d-----w- C:\Program Files (x86)\YouTube Downloader

2012-01-29 14:18:04 -------- d-----w- C:\Program Files (x86)\Foxit Software

2012-01-29 14:09:49 626688 ----a-w- C:\Program Files (x86)\Mozilla Firefox\msvcr80.dll

2012-01-29 14:09:49 548864 ----a-w- C:\Program Files (x86)\Mozilla Firefox\msvcp80.dll

2012-01-29 14:09:49 479232 ----a-w- C:\Program Files (x86)\Mozilla Firefox\msvcm80.dll

2012-01-29 14:09:49 43992 ----a-w- C:\Program Files (x86)\Mozilla Firefox\mozutils.dll

2012-01-28 23:30:03 8602168 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{46F8F690-E978-49C2-9FF8-DDAEC6DE2633}\mpengine.dll

2012-01-23 11:52:52 85936 ----a-w- C:\Windows\System32\drivers\scdemu.sys

2012-01-23 11:52:52 -------- d-----w- C:\Program Files (x86)\PowerISO

2012-01-22 22:56:06 -------- d-----w- C:\Users\Emil\AppData\Local\Sony

2012-01-22 22:56:06 -------- d-----w- C:\Program Files (x86)\Sony

2012-01-22 22:56:05 -------- d-----w- C:\Program Files\Sony

2012-01-16 22:02:11 -------- d-----w- C:\ProgramData\regid.1986-12.com.adobe

2012-01-16 21:32:15 -------- d-----w- C:\Users\Emil\New folder (2)

2012-01-16 21:19:21 -------- d-----w- C:\Users\Emil\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant

2012-01-15 00:46:00 340992 ----a-w- C:\Windows\System32\schannel.dll

2012-01-14 13:05:06 -------- d-----w- C:\Users\Emil\AppData\Roaming\FOG Downloader

2012-01-12 00:19:16 4448256 ----a-w- C:\Windows\SysWow64\GPhotos.scr

2012-01-11 19:54:54 1572864 ----a-w- C:\Windows\System32\quartz.dll

2012-01-11 19:54:54 1328128 ----a-w- C:\Windows\SysWow64\quartz.dll

2012-01-11 19:54:53 514560 ----a-w- C:\Windows\SysWow64\qdvd.dll

2012-01-11 19:54:53 366592 ----a-w- C:\Windows\System32\qdvd.dll

2012-01-11 19:54:51 1731920 ----a-w- C:\Windows\System32\ntdll.dll

2012-01-11 19:54:51 1292080 ----a-w- C:\Windows\SysWow64\ntdll.dll

2012-01-11 19:54:50 77312 ----a-w- C:\Windows\System32\packager.dll

2012-01-11 19:54:50 67072 ----a-w- C:\Windows\SysWow64\packager.dll

2011-12-31 01:19:47 422 ---ha-w- C:\aaw7boot.cmd

2011-12-31 00:58:54 -------- d-----w- C:\Users\Emil\AppData\Roaming\BSplayer Pro

2011-12-31 00:58:54 -------- d-----w- C:\Users\Emil\AppData\Roaming\BSplayer

2011-12-31 00:02:47 -------- d-----w- C:\Users\Emil\AppData\Roaming\foobar2000

2011-12-30 23:37:02 21712 ----a-w- C:\Windows\SysWow64\drivers\DrvAgent64.SYS

2011-12-30 22:59:21 57288 ----a-w- C:\Windows\System32\drivers\PktIcpt.sys

2011-12-30 22:59:16 40392 ----a-w- C:\Windows\System32\drivers\GDBehave.sys

2011-12-30 22:58:04 85960 ----a-w- C:\Windows\System32\drivers\MiniIcpt.sys

2011-12-30 22:57:59 48584 ----a-w- C:\Windows\System32\drivers\gdwfpcd64.sys

2011-12-30 22:56:42 -------- d-----w- C:\Program Files (x86)\Lavasoft

2011-12-30 22:11:04 -------- d-----w- C:\Users\Emil\AppData\Roaming\Canneverbe Limited

2011-12-30 22:11:04 -------- d-----w- C:\ProgramData\Canneverbe Limited

.

==================== Find3M ====================

.

2012-01-26 15:13:15 414368 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

2012-01-21 23:23:45 564792 ----a-w- C:\Windows\System32\drivers\sptd.sys

2012-01-04 09:26:37 279096 ------w- C:\Windows\System32\MpSigStub.exe

2011-12-24 02:10:12 2828 --sha-w- C:\ProgramData\KGyGaAvL.sys

2011-12-24 02:10:01 8 --sh--r- C:\ProgramData\E973425039.sys

2011-12-16 19:03:07 348160 ----a-w- C:\Windows\SysWow64\msvcr71.dll

2011-12-16 19:03:07 1700352 ----a-w- C:\Windows\SysWow64\gdiplus.dll

2011-12-16 19:03:07 1060864 ----a-w- C:\Windows\SysWow64\mfc71.dll

2011-12-10 13:24:08 23152 ----a-w- C:\Windows\System32\drivers\mbam.sys

2011-11-24 04:52:09 3145216 ----a-w- C:\Windows\System32\win32k.sys

2011-11-17 07:52:42 83448 ----a-w- C:\Windows\SysWow64\CddbLangJA.dll

2011-11-17 07:52:42 808440 ----a-w- C:\Windows\SysWow64\CDDBUI.dll

2011-11-17 07:52:42 796152 ----a-w- C:\Windows\SysWow64\CDDBControl.dll

2011-11-17 07:52:42 499712 ----a-w- C:\Windows\SysWow64\msvcp71.dll

2011-11-17 07:52:42 169464 ----a-w- C:\Windows\SysWow64\CddbLangRU.dll

2011-11-17 07:52:42 103928 ----a-w- C:\Windows\SysWow64\CddbLangFR.dll

2011-11-17 07:52:42 103928 ----a-w- C:\Windows\SysWow64\CddbLangES.dll

2011-11-17 07:52:42 103928 ----a-w- C:\Windows\SysWow64\CddbLangDE.dll

2011-11-17 06:49:14 95600 ----a-w- C:\Windows\System32\drivers\ksecdd.sys

2011-11-17 06:49:14 152432 ----a-w- C:\Windows\System32\drivers\ksecpkg.sys

2011-11-17 06:44:43 459232 ----a-w- C:\Windows\System32\drivers\cng.sys

2011-11-17 06:35:28 395776 ----a-w- C:\Windows\System32\webio.dll

2011-11-17 06:35:26 29184 ----a-w- C:\Windows\System32\sspisrv.dll

2011-11-17 06:35:26 136192 ----a-w- C:\Windows\System32\sspicli.dll

2011-11-17 06:35:25 28160 ----a-w- C:\Windows\System32\secur32.dll

2011-11-17 06:35:19 1447936 ----a-w- C:\Windows\System32\lsasrv.dll

2011-11-17 06:33:55 31232 ----a-w- C:\Windows\System32\lsass.exe

2011-11-17 05:35:02 314880 ----a-w- C:\Windows\SysWow64\webio.dll

2011-11-17 05:34:52 224768 ----a-w- C:\Windows\SysWow64\schannel.dll

2011-11-17 05:34:52 22016 ----a-w- C:\Windows\SysWow64\secur32.dll

2011-11-17 05:28:48 96768 ----a-w- C:\Windows\SysWow64\sspicli.dll

2011-11-10 03:54:13 472808 ----a-w- C:\Windows\SysWow64\deployJava1.dll

2011-11-05 05:32:50 2048 ----a-w- C:\Windows\System32\tzres.dll

2011-11-05 04:26:03 2048 ----a-w- C:\Windows\SysWow64\tzres.dll

2011-11-04 01:53:39 2309120 ----a-w- C:\Windows\System32\jscript9.dll

2011-11-04 01:44:47 1390080 ----a-w- C:\Windows\System32\wininet.dll

2011-11-04 01:44:21 1493504 ----a-w- C:\Windows\System32\inetcpl.cpl

2011-11-04 01:34:43 2382848 ----a-w- C:\Windows\System32\mshtml.tlb

2011-11-03 22:47:42 1798144 ----a-w- C:\Windows\SysWow64\jscript9.dll

2011-11-03 22:40:21 1427456 ----a-w- C:\Windows\SysWow64\inetcpl.cpl

2011-11-03 22:39:47 1127424 ----a-w- C:\Windows\SysWow64\wininet.dll

2011-11-03 22:31:57 2382848 ----a-w- C:\Windows\SysWow64\mshtml.tlb

.

============= FINISH: 20:16:24,76 ===============

Ето и другото:

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2011-08-26.01)

.

Microsoft Windows 7 Ultimate

Boot Device: \Device\HarddiskVolume1

Install Date: 30.9.2011 г. 11:44:28

System Uptime: 29.1.2012 г. 10:13:19 (10 hours ago)

.

Motherboard: MICRO-STAR INT'L CO., LTD | | MS-1682

Processor: Pentium® Dual-Core CPU T4500 @ 2.30GHz | CPU 1 | 2300/200mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 40 GiB total, 8,936 GiB free.

D: is FIXED (NTFS) - 426 GiB total, 339,688 GiB free.

E: is CDROM ()

.

==== Disabled Device Manager Items =============

.

Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}

Description: Microsoft ISATAP Adapter

Device ID: ROOT\*ISATAP\0001

Manufacturer: Microsoft

Name: Microsoft ISATAP Adapter #2

PNP Device ID: ROOT\*ISATAP\0001

Service: tunnel

.

Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}

Description: Microsoft Teredo Tunneling Adapter

Device ID: ROOT\*TEREDO\0000

Manufacturer: Microsoft

Name: Teredo Tunneling Pseudo-Interface

PNP Device ID: ROOT\*TEREDO\0000

Service: tunnel

.

Class GUID:

Description:

Device ID: ROOT\LEGACY_A2ACC\0000

Manufacturer:

Name:

PNP Device ID: ROOT\LEGACY_A2ACC\0000

Service:

.

Class GUID:

Description:

Device ID: ROOT\LEGACY_A2INJECTIONDRIVER\0000

Manufacturer:

Name:

PNP Device ID: ROOT\LEGACY_A2INJECTIONDRIVER\0000

Service:

.

Class GUID:

Description:

Device ID: ROOT\LEGACY_REGFILTER\0000

Manufacturer:

Name:

PNP Device ID: ROOT\LEGACY_REGFILTER\0000

Service:

.

Class GUID:

Description:

Device ID: ROOT\XBOX360USBDEVICE\0000

Manufacturer:

Name:

PNP Device ID: ROOT\XBOX360USBDEVICE\0000

Service:

.

Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}

Description: Microsoft 6to4 Adapter

Device ID: ROOT\*6TO4MP\0000

Manufacturer: Microsoft

Name: Microsoft 6to4 Adapter

PNP Device ID: ROOT\*6TO4MP\0000

Service: tunnel

.

Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}

Description: Microsoft ISATAP Adapter

Device ID: ROOT\*ISATAP\0000

Manufacturer: Microsoft

Name: Microsoft ISATAP Adapter

PNP Device ID: ROOT\*ISATAP\0000

Service: tunnel

.

==== System Restore Points ===================

.

RP358: 29.1.2012 г. 19:29:34 - Revo Uninstaller's restore point - Ask Toolbar

.

==== Installed Programs ======================

.

µTorrent

Adobe AIR

Adobe Flash Player ActiveX

Adobe Shockwave Player 11.6

AEnglish Dictionary XP 1.72

Apple Application Support

BS.Player FREE

Camera Recorder

Catalyst Control Center Core Implementation

Catalyst Control Center Graphics Full Existing

Catalyst Control Center Graphics Full New

Catalyst Control Center Graphics Light

Catalyst Control Center Graphics Previews Vista

Catalyst Control Center InstallProxy

Catalyst Control Center Localization All

ccc-core-static

CCC Help Chinese Standard

CCC Help Chinese Traditional

CCC Help Czech

CCC Help Danish

CCC Help Dutch

CCC Help English

CCC Help Finnish

CCC Help French

CCC Help German

CCC Help Greek

CCC Help Hungarian

CCC Help Italian

CCC Help Japanese

CCC Help Korean

CCC Help Norwegian

CCC Help Polish

CCC Help Portuguese

CCC Help Russian

CCC Help Spanish

CCC Help Swedish

CCC Help Thai

CCC Help Turkish

CDBurnerXP

DHTML Editing Component

Foxit Reader 5.1

FreeApps

Ghostscript GPL 8.64 (Msi Setup)

GIMP 2.6.11

GOM Player

Google Земя

Google Chrome

Hotfix for Microsoft Visual Studio 2007 Tools for Applications - ENU (KB946040)

Hotfix for Microsoft Visual Studio 2007 Tools for Applications - ENU (KB946308)

Hotfix for Microsoft Visual Studio 2007 Tools for Applications - ENU (KB946344)

Hotfix for Microsoft Visual Studio 2007 Tools for Applications - ENU (KB947540)

Hotfix for Microsoft Visual Studio 2007 Tools for Applications - ENU (KB947789)

Java Auto Updater

Java 6 Update 30

LEGO Universe

LogMeIn Hamachi

Malwarebytes Anti-Malware, версия 1.60.0.1800

Microsoft Choice Guard

Microsoft Office Professional Edition 2003

Microsoft SQL Server 2005 Compact Edition [ENU]

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

Microsoft Visual Studio Tools for Applications 2.0 - ENU

Microsoft Visual Studio Tools for Applications 2.0 Runtime

Microsoft_VC80_ATL_x86

Microsoft_VC80_CRT_x86

Microsoft_VC80_MFC_x86

Microsoft_VC80_MFCLOC_x86

Microsoft_VC90_ATL_x86

Microsoft_VC90_CRT_x86

Microsoft_VC90_MFC_x86

Microsoft_VC90_MFCLOC_x86

Mozilla Firefox 8.0 (x86 bg)

MSVCRT

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

MSXML 4.0 SP3 Parser

MSXML 4.0 SP3 Parser (KB973685)

Nero 7 Ultra Edition

neroxml

Opera 11.60

PhotoScape

Picasa 3

PowerISO

Protected Folder

QuickTime

Realtek High Definition Audio Driver

Realtek USB 2.0 Card Reader

Revo Uninstaller 1.93

Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)

Skype™ 5.6

swMSM

System Control Manager

Talisman Online Ver.1461

The KMPlayer (remove only)

TuneUp Utilities Language Pack (en-US)

Unity Web Player

Unlocker 1.9.1

Update for Microsoft .NET Framework 4 Client Profile (KB2468871)

Update for Microsoft .NET Framework 4 Client Profile (KB2533523)

VLC media player 1.1.11

Windows Live Communications Platform

Windows Live Essentials

Windows Live Photo Gallery

Windows Live Sign-in Assistant

Windows Live Sync

Windows Live Upload Tool

Windows Media Player Firefox Plugin

Yahoo! Install Manager

YouTube Downloader 3.5

YouTube Downloader Toolbar v4.9

.

==== Event Viewer Messages From Past Week ========

.

29.1.2012 г. 15:17:04, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the ShellHWDetection service.

29.1.2012 г. 08:41:52, Error: Service Control Manager [7023] - The Superfetch service terminated with the following error: The system cannot find the file specified.

29.1.2012 г. 01:19:56, Error: Service Control Manager [7023] - The Superfetch service terminated with the following error: The system cannot find the file specified.

29.1.2012 г. 00:20:47, Error: Service Control Manager [7034] - The Advanced SystemCare Service service terminated unexpectedly. It has done this 1 time(s).

28.1.2012 г. 23:55:30, Error: Service Control Manager [7034] - The IS360service service terminated unexpectedly. It has done this 1 time(s).

28.1.2012 г. 18:10:26, Error: Service Control Manager [7023] - The Superfetch service terminated with the following error: The system cannot find the file specified.

28.1.2012 г. 13:13:12, Error: Service Control Manager [7023] - The Superfetch service terminated with the following error: The system cannot find the file specified.

28.1.2012 г. 08:51:27, Error: volsnap [36] - The shadow copies of volume C: were aborted because the shadow copy storage could not grow due to a user imposed limit.

28.1.2012 г. 08:45:28, Error: Service Control Manager [7023] - The Superfetch service terminated with the following error: The system cannot find the file specified.

27.1.2012 г. 21:11:44, Error: Application Popup [56] - Driver USBSTOR returned invalid ID for a child device (274FCBD155A85B5DC58F3047B78A8B71A903359366B30DFB4EC5D5170B141B9).

27.1.2012 г. 16:04:28, Error: volsnap [36] - The shadow copies of volume C: were aborted because the shadow copy storage could not grow due to a user imposed limit.

27.1.2012 г. 13:53:23, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the lmhosts service.

27.1.2012 г. 07:55:26, Error: Service Control Manager [7023] - The Superfetch service terminated with the following error: The system cannot find the file specified.

26.1.2012 г. 15:47:42, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the lmhosts service.

26.1.2012 г. 12:31:58, Error: volsnap [36] - The shadow copies of volume C: were aborted because the shadow copy storage could not grow due to a user imposed limit.

26.1.2012 г. 08:25:25, Error: Service Control Manager [7023] - The Superfetch service terminated with the following error: The system cannot find the file specified.

25.1.2012 г. 08:28:14, Error: Service Control Manager [7023] - The Superfetch service terminated with the following error: The system cannot find the file specified.

24.1.2012 г. 07:27:08, Error: Service Control Manager [7023] - The Superfetch service terminated with the following error: The system cannot find the file specified.

23.1.2012 г. 13:57:34, Error: Service Control Manager [7023] - The Superfetch service terminated with the following error: The system cannot find the file specified.

23.1.2012 г. 12:45:06, Error: Application Popup [56] - Driver USBSTOR returned invalid ID for a child device (274FCBD155A85B5DC58F3047B78A8B71A903359366B30DFB4EC5D5170B141B9).

23.1.2012 г. 08:10:53, Error: Service Control Manager [7023] - The Superfetch service terminated with the following error: The system cannot find the file specified.

23.1.2012 г. 07:24:05, Error: Service Control Manager [7023] - The Superfetch service terminated with the following error: The system cannot find the file specified.

23.1.2012 г. 00:43:40, Error: volsnap [36] - The shadow copies of volume C: were aborted because the shadow copy storage could not grow due to a user imposed limit.

22.1.2012 г. 07:53:32, Error: Service Control Manager [7023] - The Superfetch service terminated with the following error: The system cannot find the file specified.

22.1.2012 г. 01:27:56, Error: Service Control Manager [7023] - The Superfetch service terminated with the following error: The system cannot find the file specified.

.

==== End Of File ===========================

Ако сте сканирали с MBAM, тя попринцип го намира като (PUP.Dealio.TB) и е възможно да сте го премахнали с нея ?
Но вие казвате, че присъства в мениджъра на добавките...какво пише за неговото състояние там ? (трябва да има активирай, деактивирай, премахни), а при проблемни добавки направо го изключва автоматично и пише, че не се поддръжа от браузъра.

За теглене, много по-удачна е добавката download helper, но тя е само за Mozilla Firefox.
Тегли обаче от почти всички флаш базирани сайтове при това без да е необходимо инсталирането на други програми...само се кликва въхру розовите планетки.
Може да бъде изтеглен оттук

Има бутони деактивирай и премахни, което показва, че в момента е активна тази добавка, но я няма. MBAM не знам какво е.

Аз ползвам основно Мозилата, сложих си го този Даунлауд Хелпър, много ми харесва, но преди това бях инсталирала горното, а с него дойде тулбар, който ми допадна много.

А какво означава това WARNING: SystemLook running under WOW64. Use SystemLook_x64 for accurate results. от пост 6.

А за това дето бях писала по-горе:

C:\Program Files (x86)\McAfee Security Scan <= тази папка - това го търсих много, но не можах да го открия.

C:\Program Files (x86)\Lavasoft <= тази папка (остатък от Ad-aware) - това пък не ще да го трие - дава, че папката или файла е отворена в друга програма и ме подканя да опитам пак. Уж всичко бях изключила, пък не става.

Как да я изтрия тази папка?

29 януари 201214 г.

Има едни остатъци които ме дразнят, затова да ги оберем с Combofix:

1. Изтеглете ComboFix от BleepingComputer

и го запазете (бутон Save -> Save as) ComboFix на вашия десктоп:

След приключване на изтеглянето на ComboFix, иконката на програмата би трябвало да изглежда така:

2. Затворете всички работещи приложения, отворени прозорци и програми работещи във фонов режим. Спрете временно защитата в реално време на антивирусната програма и на другите програми за сигурност, ако има такива.

3. Стартирайте с двоен клик Combofix.exe. Изберете YES, за да се съгласите с условията за използване на програмата. Важно: По време на работата на ComboFix не бива да се движи мишката и да се натискат клавиши от клавиатурата. Просто търпеливо оставете ComboFix да си свърши работата, без да използвате компютъра за други цели.

4. Ако получите предупреждение от UAC, съгласете се.

5 ComboFix ще спре временно Интернет връзката, но след като приключи работата на програмата тази връзка ще бъде възстановена автоматично. ComboFix ще сканира за проблеми и за заразени файлове, като това може да отнеме известно време. Моля да бъдете търпеливи. Ако има проблем с Интернет връзката след приключване на работата на Combofix, моля да прочетете това: Manually restoring the Internet connection section.

6 Когато работата на ComboFix приключи, ще се появи текстов документ (log) в Notepad:

Копирайте с (Copy) и поставете с (Paste) съдържанието на лога в следващия си коментар.

Забележка: Ако се появи следното съобщение при отварянето на различни програми след завършване на сканирането с Combofix - "illegal operation on a registry key that has been marked for deletion." просто рестартирайте компютъра още веднъж и то ще изчезне.

По време на сканирането не използвайте компютъра си !

Останалите неща ще премахнем със скрипт за Combofix при нужда.

29 януари 201214 г.

Автор

Ето резултата: ComboFix 12-01-29.02 - Emil 01.2012 г. 21:03:32.1.2 - x64 Microsoft Windows 7 Ultimate 6.1.7601.1.1251.359.1033.18.4095.2770 [GMT 2:00] Running from: d:\desktop\ComboFix.exe AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160} SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD} SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\program files (x86)\StartNow Toolbar c:\program files (x86)\StartNow Toolbar\ReactivateFF.exe c:\program files (x86)\StartNow Toolbar\ReactivateIE.exe c:\program files (x86)\StartNow Toolbar\Resources\images\engine_images.png c:\program files (x86)\StartNow Toolbar\Resources\images\engine_maps.png c:\program files (x86)\StartNow Toolbar\Resources\images\engine_news.png c:\program files (x86)\StartNow Toolbar\Resources\images\engine_videos.png c:\program files (x86)\StartNow Toolbar\Resources\images\engine_web.png c:\program files (x86)\StartNow Toolbar\Resources\images\icon_amazon.png c:\program files (x86)\StartNow Toolbar\Resources\images\icon_ebay.png c:\program files (x86)\StartNow Toolbar\Resources\images\icon_facebook.png c:\program files (x86)\StartNow Toolbar\Resources\images\icon_games.png c:\program files (x86)\StartNow Toolbar\Resources\images\icon_msn.png c:\program files (x86)\StartNow Toolbar\Resources\images\icon_shopping.png c:\program files (x86)\StartNow Toolbar\Resources\images\icon_travel.png c:\program files (x86)\StartNow Toolbar\Resources\images\icon_twitter.png c:\program files (x86)\StartNow Toolbar\Resources\images\startnow_logo.png c:\program files (x86)\StartNow Toolbar\Resources\installer.xml c:\program files (x86)\StartNow Toolbar\Resources\skin\chevron_button.png c:\program files (x86)\StartNow Toolbar\Resources\skin\searchbox_button_hover.png c:\program files (x86)\StartNow Toolbar\Resources\skin\searchbox_button_normal.png c:\program files (x86)\StartNow Toolbar\Resources\skin\searchbox_dropdown_button_normal.png c:\program files (x86)\StartNow Toolbar\Resources\skin\searchbox_input_background.png c:\program files (x86)\StartNow Toolbar\Resources\skin\searchbox_input_left.png c:\program files (x86)\StartNow Toolbar\Resources\skin\searchbox_input_middle.png c:\program files (x86)\StartNow Toolbar\Resources\skin\separator.png c:\program files (x86)\StartNow Toolbar\Resources\skin\splitter.png c:\program files (x86)\StartNow Toolbar\Resources\skin\toolbarbutton_ff_hover_c.png c:\program files (x86)\StartNow Toolbar\Resources\skin\toolbarbutton_ie_hover_c.png c:\program files (x86)\StartNow Toolbar\Resources\skin\toolbarbutton_ie_hover_l.png c:\program files (x86)\StartNow Toolbar\Resources\skin\toolbarbutton_ie_hover_r.png c:\program files (x86)\StartNow Toolbar\Resources\skin\toolbarbutton_ie_normal_c.png c:\program files (x86)\StartNow Toolbar\Resources\skin\toolbarbutton_ie_normal_l.png c:\program files (x86)\StartNow Toolbar\Resources\skin\toolbarbutton_ie_normal_r.png c:\program files (x86)\StartNow Toolbar\Resources\toolbar.xml c:\program files (x86)\StartNow Toolbar\Resources\update.xml c:\program files (x86)\StartNow Toolbar\StartNowToolbarUninstall.exe c:\program files (x86)\StartNow Toolbar\Toolbar32.dll c:\program files (x86)\StartNow Toolbar\ToolbarBroker.exe c:\program files (x86)\StartNow Toolbar\ToolbarUpdaterService.exe c:\program files (x86)\StartNow Toolbar\uninstall.dat c:\windows\SysWow64\SETA64C.tmp . . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . . -------\Service_Updater Service for StartNow Toolbar -------\Service_Updater Service for StartNow Toolbar . . ((((((((((((((((((((((((( Files Created from 2011-12-28 to 2012-01-29 ))))))))))))))))))))))))))))))) . . 2012-01-29 18:45 . 2011-06-24 15:44 243200 ----a-w- c:\windows\SysWow64\xvidvfw.dll 2012-01-29 18:45 . 2011-06-24 15:28 650752 ----a-w- c:\windows\SysWow64\xvidcore.dll 2012-01-29 18:45 . 2008-09-24 19:41 839680 ----a-w- c:\windows\SysWow64\lameACM.acm 2012-01-29 18:45 . 2011-12-21 18:14 151552 ----a-w- c:\windows\SysWow64\ac3acm.acm 2012-01-29 18:45 . 2012-01-25 18:00 79360 ----a-w- c:\windows\SysWow64\ff_vfw.dll 2012-01-29 15:33 . 2012-01-29 15:33 -------- d-----w- c:\program files (x86)\Application Updater 2012-01-29 15:33 . 2012-01-29 15:35 -------- d-----w- c:\program files (x86)\YouTube Downloader Toolbar 2012-01-29 15:33 . 2012-01-29 15:33 -------- d-----w- c:\program files (x86)\Common Files\Spigot 2012-01-29 15:32 . 2012-01-29 18:04 -------- d-----w- c:\programdata\YouTube Downloader 2012-01-29 15:32 . 2012-01-29 15:32 -------- d-----w- c:\program files (x86)\YouTube Downloader 2012-01-29 15:03 . 2012-01-29 15:03 -------- d-----w- c:\program files (x86)\Common Files\Skype 2012-01-29 14:18 . 2012-01-29 14:18 -------- d-----w- c:\program files (x86)\Foxit Software 2012-01-29 14:09 . 2012-01-29 14:09 626688 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcr80.dll 2012-01-29 14:09 . 2012-01-29 14:09 548864 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcp80.dll 2012-01-29 14:09 . 2012-01-29 14:09 479232 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcm80.dll 2012-01-29 14:09 . 2012-01-29 14:09 43992 ----a-w- c:\program files (x86)\Mozilla Firefox\mozutils.dll 2012-01-28 23:30 . 2012-01-06 05:15 8602168 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{46F8F690-E978-49C2-9FF8-DDAEC6DE2633}\mpengine.dll 2012-01-26 15:16 . 2012-01-26 15:16 -------- d-----w- c:\program files\Microsoft Silverlight 2012-01-26 15:16 . 2012-01-26 15:16 -------- d-----w- c:\program files (x86)\Microsoft Silverlight 2012-01-23 11:52 . 2012-01-23 11:52 -------- d-----w- c:\program files (x86)\PowerISO 2012-01-23 11:52 . 2008-10-31 07:00 85936 ----a-w- c:\windows\system32\drivers\scdemu.sys 2012-01-22 23:07 . 2012-01-22 23:07 -------- d-----w- c:\users\Emil\AppData\Roaming\Publish Providers 2012-01-22 22:56 . 2012-01-22 22:58 -------- d-----w- c:\users\Emil\AppData\Local\Sony 2012-01-22 22:56 . 2012-01-22 22:56 -------- d-----w- c:\programdata\Sony 2012-01-22 22:56 . 2012-01-22 22:56 -------- d-----w- c:\program files (x86)\Sony 2012-01-22 22:56 . 2012-01-22 22:56 -------- d-----w- c:\program files\Sony 2012-01-22 22:55 . 2012-01-22 23:07 -------- d-----w- c:\users\Emil\AppData\Roaming\Sony 2012-01-17 03:39 . 2012-01-29 01:26 -------- d-----w- c:\users\Emil\AppData\Roaming\Media Player Classic 2012-01-16 22:02 . 2012-01-16 22:02 -------- d-----w- c:\programdata\regid.1986-12.com.adobe 2012-01-16 21:45 . 2012-01-16 22:38 -------- d-----w- c:\program files (x86)\Common Files\Adobe 2012-01-16 21:32 . 2012-01-16 21:32 -------- d-----w- c:\users\Emil\New folder (2) 2012-01-16 21:19 . 2012-01-17 01:35 -------- d-----w- c:\users\Emil\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant 2012-01-15 00:46 . 2011-11-17 06:35 340992 ----a-w- c:\windows\system32\schannel.dll 2012-01-14 16:12 . 2012-01-14 16:13 -------- d-----w- c:\program files (x86)\QuickTime 2012-01-14 16:12 . 2012-01-14 16:12 -------- d-----w- c:\programdata\Apple Computer 2012-01-14 13:05 . 2012-01-14 13:29 -------- d-----w- c:\users\Emil\AppData\Roaming\FOG Downloader 2012-01-12 00:19 . 2012-01-12 00:19 4448256 ----a-w- c:\windows\SysWow64\GPhotos.scr 2012-01-11 19:54 . 2011-10-26 05:25 1572864 ----a-w- c:\windows\system32\quartz.dll 2012-01-11 19:54 . 2011-10-26 04:32 1328128 ----a-w- c:\windows\SysWow64\quartz.dll 2012-01-11 19:54 . 2011-10-26 05:25 366592 ----a-w- c:\windows\system32\qdvd.dll 2012-01-11 19:54 . 2011-10-26 04:32 514560 ----a-w- c:\windows\SysWow64\qdvd.dll 2012-01-11 19:54 . 2011-11-17 06:41 1731920 ----a-w- c:\windows\system32\ntdll.dll 2012-01-11 19:54 . 2011-11-17 05:38 1292080 ----a-w- c:\windows\SysWow64\ntdll.dll 2012-01-11 19:54 . 2011-11-19 14:58 77312 ----a-w- c:\windows\system32\packager.dll 2012-01-11 19:54 . 2011-11-19 14:01 67072 ----a-w- c:\windows\SysWow64\packager.dll 2011-12-31 01:19 . 2011-12-31 01:19 422 ---ha-w- C:\aaw7boot.cmd 2011-12-31 00:58 . 2011-12-31 01:33 -------- d-----w- c:\users\Emil\AppData\Roaming\BSplayer 2011-12-31 00:58 . 2011-12-31 00:58 -------- d-----w- c:\users\Emil\AppData\Roaming\BSplayer Pro 2011-12-31 00:02 . 2012-01-17 04:12 -------- d-----w- c:\users\Emil\AppData\Roaming\foobar2000 2011-12-30 23:37 . 2011-12-30 23:37 21712 ----a-w- c:\windows\SysWow64\drivers\DrvAgent64.SYS 2011-12-30 23:16 . 2011-12-31 14:23 -------- dc----w- c:\windows\system32\DRVSTORE 2011-12-30 22:59 . 2011-12-30 22:59 57288 ----a-w- c:\windows\system32\drivers\PktIcpt.sys 2011-12-30 22:59 . 2011-12-30 22:59 40392 ----a-w- c:\windows\system32\drivers\GDBehave.sys 2011-12-30 22:58 . 2011-12-30 22:58 85960 ----a-w- c:\windows\system32\drivers\MiniIcpt.sys 2011-12-30 22:57 . 2011-12-30 22:57 48584 ----a-w- c:\windows\system32\drivers\gdwfpcd64.sys 2011-12-30 22:56 . 2011-12-30 23:15 -------- d-----w- c:\program files (x86)\Lavasoft 2011-12-30 22:11 . 2011-12-30 22:11 -------- d-----w- c:\users\Emil\AppData\Roaming\Canneverbe Limited 2011-12-30 22:11 . 2011-12-30 22:11 -------- d-----w- c:\programdata\Canneverbe Limited . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-01-26 15:13 . 2011-09-30 18:08 414368 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2012-01-21 23:23 . 2011-09-30 09:46 564792 ----a-w- c:\windows\system32\drivers\sptd.sys 2012-01-06 05:15 . 2011-10-01 11:45 8602168 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll 2012-01-04 09:26 . 2010-11-21 03:27 279096 ------w- c:\windows\system32\MpSigStub.exe 2011-12-24 02:10 . 2011-12-24 02:10 2828 --sha-w- c:\programdata\KGyGaAvL.sys 2011-12-24 02:10 . 2011-12-24 02:10 8 --sh--r- c:\programdata\E973425039.sys 2011-12-16 19:03 . 2011-12-16 19:03 348160 ----a-w- c:\windows\SysWow64\msvcr71.dll 2011-12-16 19:03 . 2011-12-16 19:03 1700352 ----a-w- c:\windows\SysWow64\gdiplus.dll 2011-12-16 19:03 . 2011-12-16 19:03 1060864 ----a-w- c:\windows\SysWow64\mfc71.dll 2011-12-10 13:24 . 2011-09-30 09:53 23152 ----a-w- c:\windows\system32\drivers\mbam.sys 2011-11-24 04:52 . 2011-12-14 12:44 3145216 ----a-w- c:\windows\system32\win32k.sys 2011-11-17 07:52 . 2011-11-17 07:52 83448 ----a-w- c:\windows\SysWow64\CddbLangJA.dll 2011-11-17 07:52 . 2011-11-17 07:52 808440 ----a-w- c:\windows\SysWow64\CDDBUI.dll 2011-11-17 07:52 . 2011-11-17 07:52 796152 ----a-w- c:\windows\SysWow64\CDDBControl.dll 2011-11-17 07:52 . 2011-11-17 07:52 499712 ----a-w- c:\windows\SysWow64\msvcp71.dll 2011-11-17 07:52 . 2011-11-17 07:52 169464 ----a-w- c:\windows\SysWow64\CddbLangRU.dll 2011-11-17 07:52 . 2011-11-17 07:52 103928 ----a-w- c:\windows\SysWow64\CddbLangFR.dll 2011-11-17 07:52 . 2011-11-17 07:52 103928 ----a-w- c:\windows\SysWow64\CddbLangES.dll 2011-11-17 07:52 . 2011-11-17 07:52 103928 ----a-w- c:\windows\SysWow64\CddbLangDE.dll 2011-11-10 03:54 . 2011-10-30 10:35 472808 ----a-w- c:\windows\SysWow64\deployJava1.dll 2011-11-05 05:32 . 2011-12-14 12:44 2048 ----a-w- c:\windows\system32\tzres.dll 2011-11-05 04:26 . 2011-12-14 12:44 2048 ----a-w- c:\windows\SysWow64\tzres.dll 2011-11-04 01:53 . 2011-12-15 00:18 2309120 ----a-w- c:\windows\system32\jscript9.dll 2011-11-04 01:44 . 2011-12-15 00:18 1390080 ----a-w- c:\windows\system32\wininet.dll 2011-11-04 01:44 . 2011-12-15 00:18 1493504 ----a-w- c:\windows\system32\inetcpl.cpl 2011-11-04 01:34 . 2011-12-15 00:18 2382848 ----a-w- c:\windows\system32\mshtml.tlb 2011-11-03 22:47 . 2011-12-15 00:18 1798144 ----a-w- c:\windows\SysWow64\jscript9.dll 2011-11-03 22:40 . 2011-12-15 00:18 1427456 ----a-w- c:\windows\SysWow64\inetcpl.cpl 2011-11-03 22:39 . 2011-12-15 00:18 1127424 ----a-w- c:\windows\SysWow64\wininet.dll 2011-11-03 22:31 . 2011-12-15 00:18 2382848 ----a-w- c:\windows\SysWow64\mshtml.tlb . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584] "SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2011-12-18 5486464] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-06-25 98304] "MGSysCtrl"="c:\program files (x86)\System Control Manager\MGSysCtrl.exe" [2009-08-05 2072576] "UnlockerAssistant"="c:\program files (x86)\Unlocker\UnlockerAssistant.exe" [2010-07-04 17408] "Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-12-24 460872] "SearchSettings"="c:\program files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe" [2011-12-13 922976] . c:\users\Emil\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Stardock ObjectDock.lnk - c:\program files (x86)\Stardock\ObjectDock\ObjectDock.exe [N/A] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 0 (0x0) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "aux"=wdmaud.drv . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ \0 . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE] @="" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc] @="Service" . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" "PWRISOVM.EXE"=c:\program files (x86)\PowerISO\PWRISOVM.EXE . R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [x] R3 DrvAgent64;DrvAgent64;c:\windows\SysWOW64\Drivers\DrvAgent64.SYS [2011-12-30 21712] R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [x] R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [x] R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-04-27 288272] R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [x] R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x] R3 RtsUIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys [x] R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x] R3 terminpt;Microsoft Remote Desktop Input Driver;c:\windows\system32\drivers\terminpt.sys [x] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x] R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [x] R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x] R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x] S0 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x] S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [2011-07-22 14928] S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [2011-07-12 12368] S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x] S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [2011-08-11 140672] S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x] S2 Application Updater;Application Updater;c:\program files (x86)\Application Updater\ApplicationUpdater.exe [2011-12-14 748440] S2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;c:\program files (x86)\LogMeIn Hamachi\hamachi-2.exe [2011-08-15 2329480] S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-12-24 652872] S2 Micro Star SCM;Micro Star SCM;c:\program files (x86)\System Control Manager\MSIService.exe [2009-07-09 160768] S2 NitroReaderDriverReadSpool2;NitroPDFReaderDriverCreatorReadSpool2;c:\program files\Common Files\Nitro PDF\Reader\2.0\NitroPDFReaderDriverService2x64.exe [2011-06-21 341296] S2 PfFilter;PfFilter;c:\program files (x86)\IObit\Protected Folder\pffilter.sys [2011-03-16 36792] S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x] S3 netr28x;Ralink 802.11n Extensible Wireless Driver;c:\windows\system32\DRIVERS\netr28x.sys [x] S3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;c:\windows\system32\DRIVERS\SiSG664.sys [x] . . --- Other Services/Drivers In Memory --- . *NewlyCreated* - WS2IFSL . Contents of the 'Scheduled Tasks' folder . 2012-01-29 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1104016754-2124649026-2186395686-1000Core.job - c:\users\Emil\AppData\Local\Google\Update\GoogleUpdate.exe [2011-09-30 10:03] . 2012-01-29 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1104016754-2124649026-2186395686-1000UA.job - c:\users\Emil\AppData\Local\Google\Update\GoogleUpdate.exe [2011-09-30 10:03] . . --------- x86-64 ----------- . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 1436736] "combofix"="c:\combofix\CF21882.3XE" [2010-11-21 345088] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "LoadAppInit_DLLs"=0x1 . ------- Supplementary Scan ------- . uLocal Page = c:\windows\system32\blank.htm uStart Page = hxxp://klit.startnow.com/?src=startpage&provider=&provider_name=yahoo&provider_code=&partner_id=693&product_id=741&affiliate_id=&channel=&toolbar_id=200&toolbar_version=2.4.0&install_country=BG&install_date=20120129&user_guid=5801BB2401424D1EA6A2DA24953C61D7&machine_id=89d89ea44c515b1b4a825b3bfe0295ce&browser=IE&os=win&os_version=6.1-x64-SP1 uDefault_Search_URL = hxxp://www.google.com/ie mStart Page = hxxp://www.yahoo.com mLocal Page = c:\windows\SysWOW64\blank.htm uSearchAssistant = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\OFFICE11\EXCEL.EXE/3000 Trusted Zone: clonewarsadventures.com Trusted Zone: freerealms.com Trusted Zone: soe.com Trusted Zone: sony.com FF - ProfilePath - c:\users\Emil\AppData\Roaming\Mozilla\Firefox\Profiles\kqc2i0fq.default\ FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1750559&SearchSource=3&q={searchTerms} FF - prefs.js: browser.search.selectedEngine - Yahoo FF - prefs.js: browser.startup.homepage - hxxp://klit.startnow.com/?src=startpage&provider=&provider_name=yahoo&provider_code=&partner_id=693&product_id=741&affiliate_id=&channel=&toolbar_id=200&toolbar_version=2.4.0&install_country=BG&install_date=20120129&user_guid=5801BB2401424D1EA6A2DA24953C61D7&machine_id=89d89ea44c515b1b4a825b3bfe0295ce&browser=FF&os=win&os_version=6.1-x64-SP1 FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=937811&p= FF - user.js: network.http.max-persistent-connections-per-server - 4 FF - user.js: nglayout.initialpaint.delay - 600 FF - user.js: content.notify.interval - 600000 FF - user.js: content.max.tokenizing.time - 1800000 FF - user.js: content.switch.threshold - 600000 . - - - - ORPHANS REMOVED - - - - . Toolbar-{28387537-e3f9-4ed7-860c-11e69af4a8a0} - (no file) Toolbar-10 - (no file) Toolbar-{1c68c940-1b2f-46eb-bd8c-2e1612ff6a58} - (no file) Toolbar-10 - (no file) WebBrowser-{1C68C940-1B2F-46EB-BD8C-2E1612FF6A58} - (no file) WebBrowser-{BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} - (no file) WebBrowser-{FED66DC5-1B74-4A04-8F5C-15C5ACE2B9A5} - (no file) AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe AddRemove-StartNow Toolbar - c:\program files (x86)\StartNow Toolbar\StartNowToolbarUninstall.exe AddRemove-YInstHelper - c:\windows\system32\regsvr32 . . . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions] @Denied: (2) (LocalSystem) "{53707962-6F74-2D53-2644-206D7942484F}"=hex:51,66,7a,6c,4c,1d,38,12,0c,7a,63, 57,46,21,3d,68,59,52,63,2d,7c,1c,0c,5b "{9030D464-4C02-4ABF-8ECC-5164760863C6}"=hex:51,66,7a,6c,4c,1d,38,12,0a,d7,23, 94,30,02,d1,0f,f1,da,12,24,73,56,27,d2 "{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}"=hex:51,66,7a,6c,4c,1d,38,12,07,5b,93, aa,6e,60,ba,0b,f0,6d,b2,b7,80,44,00,83 "{FF059E31-CC5A-4E2E-BF3B-96E929D65503}"=hex:51,66,7a,6c,4c,1d,38,12,5f,9d,16, fb,68,82,40,0b,c0,2d,d5,a9,2c,88,11,17 "{BDEADE7F-C265-11D0-BCED-00A0C90AB50F}"=hex:51,66,7a,6c,4c,1d,38,12,11,dd,f9, b9,57,8c,be,54,c3,fb,43,e0,cc,54,f1,1b . [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration] @Denied: (2) (LocalSystem) "Timestamp"=hex:23,38,3f,7f,5d,95,cc,01 . [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences] @Denied: (2) (LocalSystem) "88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,6d,ff,80,df,88,a0,a4,44,81,04,ab,\ "2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,6d,ff,80,df,88,a0,a4,44,81,04,ab,\ . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shell\B20@O=5 *=0 *C*C*l*e*a*n*e*r*& \command] @="c:\\Program Files\\CCleaner\\ccleaner.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash9f.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.9" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash9f.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash9f.ocx" "ThreadingModel"="Apartment" . Само да питам нещо, защо Windows Defender не ми се отваря и никога не е могла да се отваря?

29 януари 201214 г.

Деинсталирайте следните две приложения:

DriverAgent => безмислена (а и често по-важните актуализации за драйвърите си идват през Windows Update)

PowerIso (тъй като имате Daemon Tools)

След това:

Отворете notepad.exe и с copy/paste въведете следната информация:

Driver::
DrvAgent64
Application Updater
A2ACC
A2INJECTIONDRIVER
RegFilter
sptd
File::
c:windowsSysWow64driversDrvAgent64.SYS
c:windowssystem32driversPktIcpt.sys
c:windowssystem32driversGDBehave.sys
c:windowssystem32driversMiniIcpt.sys
c:windowssystem32driversgdwfpcd64.sys
C:WindowsSysWOW64driversDrvAgent64.SYS
c:usersEmilAppDataRoamingMicrosoftWindowsStart MenuProgramsStartupStardock ObjectDock.lnk
Folder::
c:program files (x86)Application Updater
c:program files (x86)Common FilesSpigot
c:program files (x86)Lavasoft
Registry::
[HKEY_LOCAL_MACHINESOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionRun]
"SearchSettings"=-
DDS::
uStart Page = hxxp://klit.startnow.com/?src=startpage&provider=&provider_name=yahoo&provider_code=&partner_id=693&product_id=741&affiliate_id=&channel=&toolbar_id=200&toolbar_version=2.4.0&install_country=BG&install_date=20120129&user_guid=5801BB2401424D1EA6A2DA24953C61D7&machine_id=89d89ea44c515b1b4a825b3bfe0295ce&browser=IE&os=win&os_version=6.1-x64-SP1
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
Trusted Zone: clonewarsadventures.com
Trusted Zone: freerealms.com
Trusted Zone: soe.com
Trusted Zone: sony.com
Firefox::
FF - ProfilePath - c:usersEmilAppDataRoamingMozillaFirefoxProfileskqc2i0fq.default
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1750559&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.startup.homepage - hxxp://klit.startnow.com/?src=startpage&provider=&provider_name=yahoo&provider_code=&partner_id=693&product_id=741&affiliate_id=&channel=&toolbar_id=200&toolbar_version=2.4.0&install_country=BG&install_date=20120129&user_guid=5801BB2401424D1EA6A2DA24953C61D7&machine_id=89d89ea44c515b1b4a825b3bfe0295ce&browser=FF&os=win&os_version=6.1-x64-SP1
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=937811&p=

Запазете файла с име CFScript и го провлачете и пуснете в Combofix (както е показано на картинката отдолу).
По време на сканиране от страна на ComboFix не стартирайте никакви други приложения, не натискайте клавиши от клавиатурата и не местете мишката !
Публикувайте лог файла, който ще се създаде след рестарта на компютъра в следващия си пост.

Windows Defender не ви се отваря, защото имате Microsoft Security Essentials (която включва функционалността на Windows Defender и я допълва с антивирусен модул, защото Windows Defender е само анти-шпионска програма).

29 януари 201214 г.

Автор

Нямам Daemon Tools. Деинсталирах я преди няколко дни. Изчезваше функцията за инсталиране (сина ми искаше да инсталира игра). Деинсталирах я и наново я инсталирах, всичко беше наред, но след 2 дни същия проблем и аз я деинсталирах. Посъветваха ми да инсталирам другата програма. Не знам защо така се получи. И в момента проверих в страт менюто я няма и в програмата за деинсталиране на програми също я няма. Къде излиза, че я има? Driver Agent също нямам на компютъра - пак я няма нито в Старт менюто, нито в деинсталационната програма?!... Не разбирам.... А това другото ще го направя утре, че направо се уморих днес.

29 януари 201214 г.

В лога има остатъци от тях и затова попитах.

Нищо ще премахнем и тях...ще ги включа в скрипта си (като редакция на предишния си коментар).

S3 DrvAgent64;DrvAgent64;C:\Windows\SysWOW64\drivers\DrvAgent64.SYS

S0 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]

29 януари 201214 г.

Автор

Ще коригирате информацията от пост 16, която трябва да въведа, така ли да го разбирам? Ей, тва компютрите много сложна работа и голяма краста... Благодаря ви много, ама много, за търпението, с което ме ръководите!

Редактирано 29 януари 201214 г. от Beni_mama (преглед на промените)

29 януари 201214 г.

Няма защо. Да, поста вече е редактиран. (пост 15 е готов за изпъленение с новите команди в скрипта). Когато можете го изпълнете и публикувайте резултатите. В момента основно разчистваме боклукчиви програми, причини за забавянето и други остатъци или зловредни приложения, но като цяло положението не е толкова зле. Приятна почивка.

30 януари 201214 г.

Автор

Благодаря, за пожеланията, починах си вече и мога да продължа! Ето резултата: ComboFix 12-01-29.02 - Emil 01.2012 г. 13:10:20.2.2 - x64 Microsoft Windows 7 Ultimate 6.1.7601.1.1251.359.1033.18.4095.2750 [GMT 2:00] Running from: d:\desktop\ComboFix.exe Command switches used :: d:\desktop\CFScript.txt AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160} SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD} SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . FILE :: "c:\users\Emil\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stardock ObjectDock.lnk" "c:\windows\system32\drivers\GDBehave.sys" "c:\windows\system32\drivers\gdwfpcd64.sys" "c:\windows\system32\drivers\MiniIcpt.sys" "c:\windows\system32\drivers\PktIcpt.sys" "c:\windows\SysWOW64\drivers\DrvAgent64.SYS" . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\program files (x86)\Lavasoft c:\program files (x86)\Lavasoft\Ad-Aware\ShellExt_64.dll c:\users\Emil\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stardock ObjectDock.lnk c:\windows\system32\drivers\GDBehave.sys c:\windows\system32\drivers\gdwfpcd64.sys c:\windows\system32\drivers\MiniIcpt.sys c:\windows\system32\drivers\PktIcpt.sys c:\windows\SysWOW64\drivers\DrvAgent64.SYS . . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . . -------\Legacy_A2ACC -------\Legacy_A2INJECTIONDRIVER -------\Legacy_DRVAGENT64 -------\Legacy_REGFILTER -------\Legacy_SPTD -------\Service_DrvAgent64 -------\Service_sptd . . ((((((((((((((((((((((((( Files Created from 2011-12-28 to 2012-01-30 ))))))))))))))))))))))))))))))) . . 2012-01-30 11:19 . 2012-01-30 11:19 -------- d-----w- c:\users\Default\AppData\Local\temp 2012-01-30 04:33 . 2012-01-06 05:15 8602168 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{137AC39A-20A5-45DB-93CE-D00A97DBFC89}\mpengine.dll 2012-01-29 18:45 . 2011-06-24 15:44 243200 ----a-w- c:\windows\SysWow64\xvidvfw.dll 2012-01-29 18:45 . 2011-06-24 15:28 650752 ----a-w- c:\windows\SysWow64\xvidcore.dll 2012-01-29 18:45 . 2008-09-24 19:41 839680 ----a-w- c:\windows\SysWow64\lameACM.acm 2012-01-29 18:45 . 2011-12-21 18:14 151552 ----a-w- c:\windows\SysWow64\ac3acm.acm 2012-01-29 18:45 . 2012-01-25 18:00 79360 ----a-w- c:\windows\SysWow64\ff_vfw.dll 2012-01-29 15:03 . 2012-01-29 15:03 -------- d-----w- c:\program files (x86)\Common Files\Skype 2012-01-29 14:18 . 2012-01-29 14:18 -------- d-----w- c:\program files (x86)\Foxit Software 2012-01-29 14:09 . 2012-01-29 14:09 626688 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcr80.dll 2012-01-29 14:09 . 2012-01-29 14:09 548864 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcp80.dll 2012-01-29 14:09 . 2012-01-29 14:09 479232 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcm80.dll 2012-01-29 14:09 . 2012-01-29 14:09 43992 ----a-w- c:\program files (x86)\Mozilla Firefox\mozutils.dll 2012-01-26 15:16 . 2012-01-26 15:16 -------- d-----w- c:\program files\Microsoft Silverlight 2012-01-26 15:16 . 2012-01-26 15:16 -------- d-----w- c:\program files (x86)\Microsoft Silverlight 2012-01-23 11:52 . 2012-01-23 11:52 -------- d-----w- c:\program files (x86)\PowerISO 2012-01-23 11:52 . 2008-10-31 07:00 85936 ----a-w- c:\windows\system32\drivers\scdemu.sys 2012-01-22 23:07 . 2012-01-22 23:07 -------- d-----w- c:\users\Emil\AppData\Roaming\Publish Providers 2012-01-22 22:56 . 2012-01-22 22:58 -------- d-----w- c:\users\Emil\AppData\Local\Sony 2012-01-22 22:56 . 2012-01-22 22:56 -------- d-----w- c:\programdata\Sony 2012-01-22 22:56 . 2012-01-22 22:56 -------- d-----w- c:\program files (x86)\Sony 2012-01-22 22:56 . 2012-01-22 22:56 -------- d-----w- c:\program files\Sony 2012-01-22 22:55 . 2012-01-22 23:07 -------- d-----w- c:\users\Emil\AppData\Roaming\Sony 2012-01-17 03:39 . 2012-01-29 01:26 -------- d-----w- c:\users\Emil\AppData\Roaming\Media Player Classic 2012-01-16 22:02 . 2012-01-16 22:02 -------- d-----w- c:\programdata\regid.1986-12.com.adobe 2012-01-16 21:45 . 2012-01-16 22:38 -------- d-----w- c:\program files (x86)\Common Files\Adobe 2012-01-16 21:32 . 2012-01-16 21:32 -------- d-----w- c:\users\Emil\New folder (2) 2012-01-16 21:19 . 2012-01-17 01:35 -------- d-----w- c:\users\Emil\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant 2012-01-15 00:46 . 2011-11-17 06:35 340992 ----a-w- c:\windows\system32\schannel.dll 2012-01-14 16:12 . 2012-01-14 16:13 -------- d-----w- c:\program files (x86)\QuickTime 2012-01-14 16:12 . 2012-01-14 16:12 -------- d-----w- c:\programdata\Apple Computer 2012-01-14 13:05 . 2012-01-14 13:29 -------- d-----w- c:\users\Emil\AppData\Roaming\FOG Downloader 2012-01-12 00:19 . 2012-01-12 00:19 4448256 ----a-w- c:\windows\SysWow64\GPhotos.scr 2012-01-11 19:54 . 2011-10-26 05:25 1572864 ----a-w- c:\windows\system32\quartz.dll 2012-01-11 19:54 . 2011-10-26 04:32 1328128 ----a-w- c:\windows\SysWow64\quartz.dll 2012-01-11 19:54 . 2011-10-26 05:25 366592 ----a-w- c:\windows\system32\qdvd.dll 2012-01-11 19:54 . 2011-10-26 04:32 514560 ----a-w- c:\windows\SysWow64\qdvd.dll 2012-01-11 19:54 . 2011-11-17 06:41 1731920 ----a-w- c:\windows\system32\ntdll.dll 2012-01-11 19:54 . 2011-11-17 05:38 1292080 ----a-w- c:\windows\SysWow64\ntdll.dll 2012-01-11 19:54 . 2011-11-19 14:58 77312 ----a-w- c:\windows\system32\packager.dll 2012-01-11 19:54 . 2011-11-19 14:01 67072 ----a-w- c:\windows\SysWow64\packager.dll . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-01-30 11:27 . 2012-01-30 11:27 69000 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{137AC39A-20A5-45DB-93CE-D00A97DBFC89}\offreg.dll 2012-01-26 15:13 . 2011-09-30 18:08 414368 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2012-01-21 23:23 . 2011-09-30 09:46 564792 ----a-w- c:\windows\system32\drivers\sptd.sys 2012-01-06 05:15 . 2011-10-01 11:45 8602168 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll 2012-01-04 09:26 . 2010-11-21 03:27 279096 ------w- c:\windows\system32\MpSigStub.exe 2011-12-31 01:19 . 2011-12-31 01:19 422 ---ha-w- C:\aaw7boot.cmd 2011-12-24 02:10 . 2011-12-24 02:10 2828 --sha-w- c:\programdata\KGyGaAvL.sys 2011-12-24 02:10 . 2011-12-24 02:10 8 --sh--r- c:\programdata\E973425039.sys 2011-12-16 19:03 . 2011-12-16 19:03 348160 ----a-w- c:\windows\SysWow64\msvcr71.dll 2011-12-16 19:03 . 2011-12-16 19:03 1700352 ----a-w- c:\windows\SysWow64\gdiplus.dll 2011-12-16 19:03 . 2011-12-16 19:03 1060864 ----a-w- c:\windows\SysWow64\mfc71.dll 2011-12-10 13:24 . 2011-09-30 09:53 23152 ----a-w- c:\windows\system32\drivers\mbam.sys 2011-11-24 04:52 . 2011-12-14 12:44 3145216 ----a-w- c:\windows\system32\win32k.sys 2011-11-17 07:52 . 2011-11-17 07:52 83448 ----a-w- c:\windows\SysWow64\CddbLangJA.dll 2011-11-17 07:52 . 2011-11-17 07:52 808440 ----a-w- c:\windows\SysWow64\CDDBUI.dll 2011-11-17 07:52 . 2011-11-17 07:52 796152 ----a-w- c:\windows\SysWow64\CDDBControl.dll 2011-11-17 07:52 . 2011-11-17 07:52 499712 ----a-w- c:\windows\SysWow64\msvcp71.dll 2011-11-17 07:52 . 2011-11-17 07:52 169464 ----a-w- c:\windows\SysWow64\CddbLangRU.dll 2011-11-17 07:52 . 2011-11-17 07:52 103928 ----a-w- c:\windows\SysWow64\CddbLangFR.dll 2011-11-17 07:52 . 2011-11-17 07:52 103928 ----a-w- c:\windows\SysWow64\CddbLangES.dll 2011-11-17 07:52 . 2011-11-17 07:52 103928 ----a-w- c:\windows\SysWow64\CddbLangDE.dll 2011-11-10 03:54 . 2011-10-30 10:35 472808 ----a-w- c:\windows\SysWow64\deployJava1.dll 2011-11-05 05:32 . 2011-12-14 12:44 2048 ----a-w- c:\windows\system32\tzres.dll 2011-11-05 04:26 . 2011-12-14 12:44 2048 ----a-w- c:\windows\SysWow64\tzres.dll 2011-11-04 01:53 . 2011-12-15 00:18 2309120 ----a-w- c:\windows\system32\jscript9.dll 2011-11-04 01:44 . 2011-12-15 00:18 1390080 ----a-w- c:\windows\system32\wininet.dll 2011-11-04 01:44 . 2011-12-15 00:18 1493504 ----a-w- c:\windows\system32\inetcpl.cpl 2011-11-04 01:34 . 2011-12-15 00:18 2382848 ----a-w- c:\windows\system32\mshtml.tlb 2011-11-03 22:47 . 2011-12-15 00:18 1798144 ----a-w- c:\windows\SysWow64\jscript9.dll 2011-11-03 22:40 . 2011-12-15 00:18 1427456 ----a-w- c:\windows\SysWow64\inetcpl.cpl 2011-11-03 22:39 . 2011-12-15 00:18 1127424 ----a-w- c:\windows\SysWow64\wininet.dll 2011-11-03 22:31 . 2011-12-15 00:18 2382848 ----a-w- c:\windows\SysWow64\mshtml.tlb . . ((((((((((((((((((((((((((((( SnapShot@2012-01-29_19.12.29 ))))))))))))))))))))))))))))))))))))))))) . + 2010-11-21 03:09 . 2012-01-30 10:31 45482 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin + 2009-07-14 05:10 . 2012-01-30 10:31 43350 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin + 2011-09-30 09:44 . 2012-01-30 10:31 10232 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1104016754-2124649026-2186395686-1000_UserData.bin + 2012-01-30 11:22 . 2012-01-30 11:22 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat - 2012-01-29 19:11 . 2012-01-29 19:11 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat - 2012-01-29 19:11 . 2012-01-29 19:11 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2012-01-30 11:22 . 2012-01-30 11:22 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat - 2009-07-14 05:01 . 2012-01-29 19:10 497052 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat + 2009-07-14 05:01 . 2012-01-30 11:20 497052 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat + 2011-09-30 10:06 . 2012-01-30 11:20 6516171 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-1104016754-2124649026-2186395686-1000-12288.dat - 2011-09-30 10:06 . 2012-01-29 19:10 6516171 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-1104016754-2124649026-2186395686-1000-12288.dat + 2011-10-01 01:56 . 2012-01-30 11:20 13216322 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-1104016754-2124649026-2186395686-1000-8192.dat - 2011-10-01 01:56 . 2012-01-29 19:10 13216322 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-1104016754-2124649026-2186395686-1000-8192.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584] "SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2011-12-18 5486464] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-06-25 98304] "MGSysCtrl"="c:\program files (x86)\System Control Manager\MGSysCtrl.exe" [2009-08-05 2072576] "UnlockerAssistant"="c:\program files (x86)\Unlocker\UnlockerAssistant.exe" [2010-07-04 17408] "Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-12-24 460872] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 0 (0x0) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "aux"=wdmaud.drv . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ \0 . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE] @="" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc] @="Service" . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" "PWRISOVM.EXE"=c:\program files (x86)\PowerISO\PWRISOVM.EXE . R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [x] R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [x] R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x] R3 RtsUIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys [x] R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x] R3 terminpt;Microsoft Remote Desktop Input Driver;c:\windows\system32\drivers\terminpt.sys [x] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x] R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [x] R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x] R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x] S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [2011-07-22 14928] S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [2011-07-12 12368] S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x] S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [2011-08-11 140672] S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x] S2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;c:\program files (x86)\LogMeIn Hamachi\hamachi-2.exe [2011-08-15 2329480] S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-12-24 652872] S2 Micro Star SCM;Micro Star SCM;c:\program files (x86)\System Control Manager\MSIService.exe [2009-07-09 160768] S2 NitroReaderDriverReadSpool2;NitroPDFReaderDriverCreatorReadSpool2;c:\program files\Common Files\Nitro PDF\Reader\2.0\NitroPDFReaderDriverService2x64.exe [2011-06-21 341296] S2 PfFilter;PfFilter;c:\program files (x86)\IObit\Protected Folder\pffilter.sys [2011-03-16 36792] S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x] S3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [x] S3 netr28x;Ralink 802.11n Extensible Wireless Driver;c:\windows\system32\DRIVERS\netr28x.sys [x] S3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [x] S3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-04-27 288272] S3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;c:\windows\system32\DRIVERS\SiSG664.sys [x] . . Contents of the 'Scheduled Tasks' folder . 2012-01-29 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1104016754-2124649026-2186395686-1000Core.job - c:\users\Emil\AppData\Local\Google\Update\GoogleUpdate.exe [2011-09-30 10:03] . 2012-01-30 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1104016754-2124649026-2186395686-1000UA.job - c:\users\Emil\AppData\Local\Google\Update\GoogleUpdate.exe [2011-09-30 10:03] . . --------- x86-64 ----------- . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 1436736] "combofix"="c:\combofix\CF14710.3XE" [2010-11-21 345088] . ------- Supplementary Scan ------- . uLocal Page = c:\windows\system32\blank.htm uDefault_Search_URL = hxxp://www.google.com/ie mStart Page = hxxp://www.yahoo.com mLocal Page = c:\windows\SysWOW64\blank.htm uSearchAssistant = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\OFFICE11\EXCEL.EXE/3000 FF - ProfilePath - c:\users\Emil\AppData\Roaming\Mozilla\Firefox\Profiles\kqc2i0fq.default\ FF - prefs.js: browser.search.selectedEngine - Google FF - user.js: network.http.max-persistent-connections-per-server - 4 FF - user.js: nglayout.initialpaint.delay - 600 FF - user.js: content.notify.interval - 600000 FF - user.js: content.max.tokenizing.time - 1800000 FF - user.js: content.switch.threshold - 600000 . - - - - ORPHANS REMOVED - - - - . Toolbar-{28387537-e3f9-4ed7-860c-11e69af4a8a0} - (no file) Toolbar-10 - (no file) Toolbar-{1c68c940-1b2f-46eb-bd8c-2e1612ff6a58} - (no file) WebBrowser-{BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} - (no file) WebBrowser-{FED66DC5-1B74-4A04-8F5C-15C5ACE2B9A5} - (no file) . . . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions] @Denied: (2) (LocalSystem) "{53707962-6F74-2D53-2644-206D7942484F}"=hex:51,66,7a,6c,4c,1d,38,12,0c,7a,63, 57,46,21,3d,68,59,52,63,2d,7c,1c,0c,5b "{9030D464-4C02-4ABF-8ECC-5164760863C6}"=hex:51,66,7a,6c,4c,1d,38,12,0a,d7,23, 94,30,02,d1,0f,f1,da,12,24,73,56,27,d2 "{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}"=hex:51,66,7a,6c,4c,1d,38,12,07,5b,93, aa,6e,60,ba,0b,f0,6d,b2,b7,80,44,00,83 "{FF059E31-CC5A-4E2E-BF3B-96E929D65503}"=hex:51,66,7a,6c,4c,1d,38,12,5f,9d,16, fb,68,82,40,0b,c0,2d,d5,a9,2c,88,11,17 "{BDEADE7F-C265-11D0-BCED-00A0C90AB50F}"=hex:51,66,7a,6c,4c,1d,38,12,11,dd,f9, b9,57,8c,be,54,c3,fb,43,e0,cc,54,f1,1b . [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration] @Denied: (2) (LocalSystem) "Timestamp"=hex:23,38,3f,7f,5d,95,cc,01 . [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences] @Denied: (2) (LocalSystem) "88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,6d,ff,80,df,88,a0,a4,44,81,04,ab,\ "2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,6d,ff,80,df,88,a0,a4,44,81,04,ab,\ . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shell\B20@O=5 *=0 *C*C*l*e*a*n*e*r*& \command] @="c:\\Program Files\\CCleaner\\ccleaner.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash9f.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.9" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash9f.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash9f.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash9f.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil9f.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}\LocalServer32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil9f.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}] @Denied: (A 2) (Everyone) @="IFlashBroker" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Completion time: 2012-01-30 13:34:24 - machine was rebooted ComboFix-quarantined-files.txt 2012-01-30 11:34 ComboFix2.txt 2012-01-29 19:17 . Pre-Run: 9 186 824 192 bytes free Post-Run: 9 107 972 096 bytes free . - - End Of File - - 6402F459F7B6C8CCF7604F1F0F7A3498 Забравих да изключа реалната защита на антивирусната затова пак ще повторя всичко. Така е като ти висят две деца на главата....

Редактирано 30 януари 201214 г. от Beni_mama (преглед на промените)

30 януари 201214 г.

Няма нужда от повторения. Скрипта се е изпълнил успешно. Някакви подобрения по системата ?

30 януари 201214 г.

Автор

Сега вече го направих с изключена реална защита. Побъркаха ме тези деца, постоянно галопират около мен и викат.

Ето резултата:

ComboFix 12-01-29.02 - Emil 01.2012 г. 13:54:27.3.2 - x64

Microsoft Windows 7 Ultimate 6.1.7601.1.1251.359.1033.18.4095.2950 [GMT 2:00]

Running from: d:\desktop\ComboFix.exe

Command switches used :: d:\desktop\CFScript.txt

AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}

SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}

SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

FILE ::

"c:\users\Emil\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stardock ObjectDock.lnk"

"c:\windows\system32\drivers\GDBehave.sys"

"c:\windows\system32\drivers\gdwfpcd64.sys"

"c:\windows\system32\drivers\MiniIcpt.sys"

"c:\windows\system32\drivers\PktIcpt.sys"

"c:\windows\SysWOW64\drivers\DrvAgent64.SYS"

.

((((((((((((((((((((((((( Files Created from 2011-12-28 to 2012-01-30 )))))))))))))))))))))))))))))))

.

2012-01-30 12:00 . 2012-01-30 12:00 -------- d-----w- c:\users\Default\AppData\Local\temp

2012-01-30 04:33 . 2012-01-06 05:15 8602168 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{137AC39A-20A5-45DB-93CE-D00A97DBFC89}\mpengine.dll

2012-01-29 18:45 . 2011-06-24 15:44 243200 ----a-w- c:\windows\SysWow64\xvidvfw.dll

2012-01-29 18:45 . 2011-06-24 15:28 650752 ----a-w- c:\windows\SysWow64\xvidcore.dll

2012-01-29 18:45 . 2008-09-24 19:41 839680 ----a-w- c:\windows\SysWow64\lameACM.acm

2012-01-29 18:45 . 2011-12-21 18:14 151552 ----a-w- c:\windows\SysWow64\ac3acm.acm

2012-01-29 18:45 . 2012-01-25 18:00 79360 ----a-w- c:\windows\SysWow64\ff_vfw.dll

2012-01-29 15:03 . 2012-01-29 15:03 -------- d-----w- c:\program files (x86)\Common Files\Skype

2012-01-29 14:18 . 2012-01-29 14:18 -------- d-----w- c:\program files (x86)\Foxit Software

2012-01-29 14:09 . 2012-01-29 14:09 626688 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcr80.dll

2012-01-29 14:09 . 2012-01-29 14:09 548864 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcp80.dll

2012-01-29 14:09 . 2012-01-29 14:09 479232 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcm80.dll

2012-01-29 14:09 . 2012-01-29 14:09 43992 ----a-w- c:\program files (x86)\Mozilla Firefox\mozutils.dll

2012-01-26 15:16 . 2012-01-26 15:16 -------- d-----w- c:\program files\Microsoft Silverlight

2012-01-26 15:16 . 2012-01-26 15:16 -------- d-----w- c:\program files (x86)\Microsoft Silverlight

2012-01-23 11:52 . 2012-01-23 11:52 -------- d-----w- c:\program files (x86)\PowerISO

2012-01-23 11:52 . 2008-10-31 07:00 85936 ----a-w- c:\windows\system32\drivers\scdemu.sys

2012-01-22 23:07 . 2012-01-22 23:07 -------- d-----w- c:\users\Emil\AppData\Roaming\Publish Providers

2012-01-22 22:56 . 2012-01-22 22:58 -------- d-----w- c:\users\Emil\AppData\Local\Sony

2012-01-22 22:56 . 2012-01-22 22:56 -------- d-----w- c:\programdata\Sony

2012-01-22 22:56 . 2012-01-22 22:56 -------- d-----w- c:\program files (x86)\Sony

2012-01-22 22:56 . 2012-01-22 22:56 -------- d-----w- c:\program files\Sony

2012-01-22 22:55 . 2012-01-22 23:07 -------- d-----w- c:\users\Emil\AppData\Roaming\Sony

2012-01-17 03:39 . 2012-01-29 01:26 -------- d-----w- c:\users\Emil\AppData\Roaming\Media Player Classic

2012-01-16 22:02 . 2012-01-16 22:02 -------- d-----w- c:\programdata\regid.1986-12.com.adobe

2012-01-16 21:45 . 2012-01-16 22:38 -------- d-----w- c:\program files (x86)\Common Files\Adobe

2012-01-16 21:32 . 2012-01-16 21:32 -------- d-----w- c:\users\Emil\New folder (2)

2012-01-16 21:19 . 2012-01-17 01:35 -------- d-----w- c:\users\Emil\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant

2012-01-15 00:46 . 2011-11-17 06:35 340992 ----a-w- c:\windows\system32\schannel.dll

2012-01-14 16:12 . 2012-01-14 16:13 -------- d-----w- c:\program files (x86)\QuickTime

2012-01-14 16:12 . 2012-01-14 16:12 -------- d-----w- c:\programdata\Apple Computer

2012-01-14 13:05 . 2012-01-14 13:29 -------- d-----w- c:\users\Emil\AppData\Roaming\FOG Downloader

2012-01-12 00:19 . 2012-01-12 00:19 4448256 ----a-w- c:\windows\SysWow64\GPhotos.scr

2012-01-11 19:54 . 2011-10-26 05:25 1572864 ----a-w- c:\windows\system32\quartz.dll

2012-01-11 19:54 . 2011-10-26 04:32 1328128 ----a-w- c:\windows\SysWow64\quartz.dll

2012-01-11 19:54 . 2011-10-26 05:25 366592 ----a-w- c:\windows\system32\qdvd.dll

2012-01-11 19:54 . 2011-10-26 04:32 514560 ----a-w- c:\windows\SysWow64\qdvd.dll

2012-01-11 19:54 . 2011-11-17 06:41 1731920 ----a-w- c:\windows\system32\ntdll.dll

2012-01-11 19:54 . 2011-11-17 05:38 1292080 ----a-w- c:\windows\SysWow64\ntdll.dll

2012-01-11 19:54 . 2011-11-19 14:58 77312 ----a-w- c:\windows\system32\packager.dll

2012-01-11 19:54 . 2011-11-19 14:01 67072 ----a-w- c:\windows\SysWow64\packager.dll

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-01-26 15:13 . 2011-09-30 18:08 414368 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2012-01-21 23:23 . 2011-09-30 09:46 564792 ----a-w- c:\windows\system32\drivers\sptd.sys

2012-01-06 05:15 . 2011-10-01 11:45 8602168 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

2012-01-04 09:26 . 2010-11-21 03:27 279096 ------w- c:\windows\system32\MpSigStub.exe

2011-12-31 01:19 . 2011-12-31 01:19 422 ---ha-w- C:\aaw7boot.cmd

2011-12-24 02:10 . 2011-12-24 02:10 2828 --sha-w- c:\programdata\KGyGaAvL.sys

2011-12-24 02:10 . 2011-12-24 02:10 8 --sh--r- c:\programdata\E973425039.sys

2011-12-16 19:03 . 2011-12-16 19:03 348160 ----a-w- c:\windows\SysWow64\msvcr71.dll

2011-12-16 19:03 . 2011-12-16 19:03 1700352 ----a-w- c:\windows\SysWow64\gdiplus.dll

2011-12-16 19:03 . 2011-12-16 19:03 1060864 ----a-w- c:\windows\SysWow64\mfc71.dll

2011-12-10 13:24 . 2011-09-30 09:53 23152 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-11-24 04:52 . 2011-12-14 12:44 3145216 ----a-w- c:\windows\system32\win32k.sys

2011-11-17 07:52 . 2011-11-17 07:52 83448 ----a-w- c:\windows\SysWow64\CddbLangJA.dll

2011-11-17 07:52 . 2011-11-17 07:52 808440 ----a-w- c:\windows\SysWow64\CDDBUI.dll

2011-11-17 07:52 . 2011-11-17 07:52 796152 ----a-w- c:\windows\SysWow64\CDDBControl.dll

2011-11-17 07:52 . 2011-11-17 07:52 499712 ----a-w- c:\windows\SysWow64\msvcp71.dll

2011-11-17 07:52 . 2011-11-17 07:52 169464 ----a-w- c:\windows\SysWow64\CddbLangRU.dll

2011-11-17 07:52 . 2011-11-17 07:52 103928 ----a-w- c:\windows\SysWow64\CddbLangFR.dll

2011-11-17 07:52 . 2011-11-17 07:52 103928 ----a-w- c:\windows\SysWow64\CddbLangES.dll

2011-11-17 07:52 . 2011-11-17 07:52 103928 ----a-w- c:\windows\SysWow64\CddbLangDE.dll

2011-11-10 03:54 . 2011-10-30 10:35 472808 ----a-w- c:\windows\SysWow64\deployJava1.dll

2011-11-05 05:32 . 2011-12-14 12:44 2048 ----a-w- c:\windows\system32\tzres.dll

2011-11-05 04:26 . 2011-12-14 12:44 2048 ----a-w- c:\windows\SysWow64\tzres.dll

2011-11-04 01:53 . 2011-12-15 00:18 2309120 ----a-w- c:\windows\system32\jscript9.dll

2011-11-04 01:44 . 2011-12-15 00:18 1390080 ----a-w- c:\windows\system32\wininet.dll

2011-11-04 01:44 . 2011-12-15 00:18 1493504 ----a-w- c:\windows\system32\inetcpl.cpl

2011-11-04 01:34 . 2011-12-15 00:18 2382848 ----a-w- c:\windows\system32\mshtml.tlb

2011-11-03 22:47 . 2011-12-15 00:18 1798144 ----a-w- c:\windows\SysWow64\jscript9.dll

2011-11-03 22:40 . 2011-12-15 00:18 1427456 ----a-w- c:\windows\SysWow64\inetcpl.cpl

2011-11-03 22:39 . 2011-12-15 00:18 1127424 ----a-w- c:\windows\SysWow64\wininet.dll

2011-11-03 22:31 . 2011-12-15 00:18 2382848 ----a-w- c:\windows\SysWow64\mshtml.tlb

.

((((((((((((((((((((((((((((( SnapShot@2012-01-29_19.12.29 )))))))))))))))))))))))))))))))))))))))))

.

+ 2010-11-21 03:09 . 2012-01-30 11:40 45530 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin

+ 2009-07-14 05:10 . 2012-01-30 11:40 43374 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin

+ 2011-09-30 09:44 . 2012-01-30 11:40 10264 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1104016754-2124649026-2186395686-1000_UserData.bin

+ 2012-01-30 12:01 . 2012-01-30 12:01 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat

- 2012-01-29 19:11 . 2012-01-29 19:11 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat

- 2012-01-29 19:11 . 2012-01-29 19:11 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat

+ 2012-01-30 12:01 . 2012-01-30 12:01 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat

- 2009-07-14 05:01 . 2012-01-29 19:10 497052 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat

+ 2009-07-14 05:01 . 2012-01-30 12:00 497052 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat

+ 2011-09-30 10:06 . 2012-01-30 11:20 6516171 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-1104016754-2124649026-2186395686-1000-12288.dat

- 2011-09-30 10:06 . 2012-01-29 19:10 6516171 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-1104016754-2124649026-2186395686-1000-12288.dat

+ 2011-10-01 01:56 . 2012-01-30 12:00 13216322 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-1104016754-2124649026-2186395686-1000-8192.dat

- 2011-10-01 01:56 . 2012-01-29 19:10 13216322 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-1104016754-2124649026-2186395686-1000-8192.dat

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]

"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2011-12-18 5486464]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-06-25 98304]

"MGSysCtrl"="c:\program files (x86)\System Control Manager\MGSysCtrl.exe" [2009-08-05 2072576]

"UnlockerAssistant"="c:\program files (x86)\Unlocker\UnlockerAssistant.exe" [2010-07-04 17408]

"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-12-24 460872]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 0 (0x0)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

"PromptOnSecureDesktop"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]

"aux"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute REG_MULTI_SZ \0

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]

@=""

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

@="Service"

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe"

"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"

"PWRISOVM.EXE"=c:\program files (x86)\PowerISO\PWRISOVM.EXE

.

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [x]

R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [x]

R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [x]

R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-04-27 288272]

R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [x]

R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x]

R3 RtsUIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys [x]

R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]

R3 terminpt;Microsoft Remote Desktop Input Driver;c:\windows\system32\drivers\terminpt.sys [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]

R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [x]

R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]

R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]

R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]

S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [2011-07-22 14928]

S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [2011-07-12 12368]

S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]

S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [2011-08-11 140672]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]

S2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;c:\program files (x86)\LogMeIn Hamachi\hamachi-2.exe [2011-08-15 2329480]

S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-12-24 652872]

S2 Micro Star SCM;Micro Star SCM;c:\program files (x86)\System Control Manager\MSIService.exe [2009-07-09 160768]

S2 NitroReaderDriverReadSpool2;NitroPDFReaderDriverCreatorReadSpool2;c:\program files\Common Files\Nitro PDF\Reader\2.0\NitroPDFReaderDriverService2x64.exe [2011-06-21 341296]

S2 PfFilter;PfFilter;c:\program files (x86)\IObit\Protected Folder\pffilter.sys [2011-03-16 36792]

S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]

S3 netr28x;Ralink 802.11n Extensible Wireless Driver;c:\windows\system32\DRIVERS\netr28x.sys [x]

S3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;c:\windows\system32\DRIVERS\SiSG664.sys [x]

.

Contents of the 'Scheduled Tasks' folder

.

2012-01-29 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1104016754-2124649026-2186395686-1000Core.job

- c:\users\Emil\AppData\Local\Google\Update\GoogleUpdate.exe [2011-09-30 10:03]

.

2012-01-30 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1104016754-2124649026-2186395686-1000UA.job

- c:\users\Emil\AppData\Local\Google\Update\GoogleUpdate.exe [2011-09-30 10:03]

.

--------- x86-64 -----------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 1436736]

.

------- Supplementary Scan -------

.

uLocal Page = c:\windows\system32\blank.htm

uDefault_Search_URL = hxxp://www.google.com/ie

mStart Page = hxxp://www.yahoo.com

mLocal Page = c:\windows\SysWOW64\blank.htm

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\OFFICE11\EXCEL.EXE/3000

FF - ProfilePath - c:\users\Emil\AppData\Roaming\Mozilla\Firefox\Profiles\kqc2i0fq.default\

FF - prefs.js: browser.search.selectedEngine - Google

FF - user.js: network.http.max-persistent-connections-per-server - 4

FF - user.js: nglayout.initialpaint.delay - 600

FF - user.js: content.notify.interval - 600000

FF - user.js: content.max.tokenizing.time - 1800000

FF - user.js: content.switch.threshold - 600000

.

- - - - ORPHANS REMOVED - - - -

.

Toolbar-{28387537-e3f9-4ed7-860c-11e69af4a8a0} - (no file)

Toolbar-10 - (no file)

Toolbar-{1c68c940-1b2f-46eb-bd8c-2e1612ff6a58} - (no file)

WebBrowser-{BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} - (no file)

WebBrowser-{FED66DC5-1B74-4A04-8F5C-15C5ACE2B9A5} - (no file)

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]

@Denied: (2) (LocalSystem)

"{53707962-6F74-2D53-2644-206D7942484F}"=hex:51,66,7a,6c,4c,1d,38,12,0c,7a,63,

57,46,21,3d,68,59,52,63,2d,7c,1c,0c,5b

"{9030D464-4C02-4ABF-8ECC-5164760863C6}"=hex:51,66,7a,6c,4c,1d,38,12,0a,d7,23,

94,30,02,d1,0f,f1,da,12,24,73,56,27,d2

"{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}"=hex:51,66,7a,6c,4c,1d,38,12,07,5b,93,

aa,6e,60,ba,0b,f0,6d,b2,b7,80,44,00,83

"{FF059E31-CC5A-4E2E-BF3B-96E929D65503}"=hex:51,66,7a,6c,4c,1d,38,12,5f,9d,16,

fb,68,82,40,0b,c0,2d,d5,a9,2c,88,11,17

"{BDEADE7F-C265-11D0-BCED-00A0C90AB50F}"=hex:51,66,7a,6c,4c,1d,38,12,11,dd,f9,

b9,57,8c,be,54,c3,fb,43,e0,cc,54,f1,1b

.

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]

@Denied: (2) (LocalSystem)

"Timestamp"=hex:23,38,3f,7f,5d,95,cc,01

.

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]

@Denied: (2) (LocalSystem)

"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,

d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,6d,ff,80,df,88,a0,a4,44,81,04,ab,\

"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,

d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,6d,ff,80,df,88,a0,a4,44,81,04,ab,\

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shell\B20@O=5 *=0 *C*C*l*e*a*n*e*r*& \command]

@="c:\\Program Files\\CCleaner\\ccleaner.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash9f.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.9"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash9f.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash9f.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash9f.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil9f.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}\LocalServer32]

@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil9f.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}]

@Denied: (A 2) (Everyone)

@="IFlashBroker"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Completion time: 2012-01-30 14:06:28 - machine was rebooted

ComboFix-quarantined-files.txt 2012-01-30 12:06

ComboFix2.txt 2012-01-30 11:34

ComboFix3.txt 2012-01-29 19:17

.

Pre-Run: 9 193 377 792 bytes free

Post-Run: 9 090 740 224 bytes free

.

- - End Of File - - 5D3FC8333B9AFA428DD2FD634FF61371

Няма нужда от повторения. Скрипта се е изпълнил успешно.
Някакви подобрения по системата ?

Късно братче, вече го направих!

Да, компа е по-бърз. Преди докато ми се отвори браузъра или някоя програма направо ми идеше да си изгриза ноктите (нещо което много мразя). Сега е лекинко... Благодаря!

Сега какво следва?

30 януари 201214 г.

~~Няма проблеми.~~

Та какво писах в предишния си коментар, наблюдавате ли някакво подобрение след разчистването ?

Бих препоръчал следното...забелязах, че съм забравил да изтрия драйвъра на Daemon Tools.

Изтрийте този файл ръчно:

c:\windows\system32\drivers\sptd.sys <= този файл.

Също така видях, че и двете програми SUPERAntispyware и Malwarebytes' Anti-Malware ви се стартират автоматично.

Ако използвате безплатната версия на SUPERAntispyware => това не е необходимо...затова от настройките направете следното:

Кликнете на Preferences => оттам от General and Startup махнете отметкaтa пред:

Start SUPERAntispyware when Windows starts

За Malwarebytes' Anti-Malware ви съветвам да я деинсталирате и след това да я инсталирате наново като не активирате защитата в реално време.

Изберете Decline.

След това мисля, че сме готови да почистим използваните от нас инструменти.

30 януари 201214 г.

Автор

Определено има големи промени... Сега какво правим?

Редактирано 30 януари 201214 г. от Beni_mama (преглед на промените)

30 януари 201214 г.

Много сте бърза. Писали сме по-едно и също време...вижте горния ми коментар.

Добре дошли!

Security.HiJack[ImageFileExecutionOptions] [ПРИКЛЮЧЕН]

Featured Replies

Архивирана тема

Разглеждащи това в момента 0

Дарение

Бюлетин

Профил

Навигация

Търсене

Конфигуриране на push известия в браузъра

Chrome (Android)

Chrome (Desktop)

Safari (iOS 16.4+)

Safari (macOS)

Edge (Android)

Edge (Desktop)

Firefox (Android)

Firefox (Desktop)