Здравейте,

При проверка на системата с Malwarebytes бяха открити 4 файла....

G:\Program\nero8.3.2.1\Nero_8_Lite_8.3.2.1_[English]\Keygen\keygen.exe (Trojan.Agent) -> Не беше предприето действие.

C:\Documents and Settings\Velislav\Local Settings\Temporary Internet Files\Content.IE5\HCT8FGJ8\men_of_war_assault_squad_nocd_nodvd___crack_[20011_en_ru]_{reloaded}[2].exe (PUP.BundleInstaller.MG) -> Поставен под карантина и изтрит успешно.

C:\System Volume Information\_restore{074CC734-B513-4E0C-B482-45F27EFF8485}\RP105\A0097394.exe (PUP.BundleInstaller.MG) -> Поставен под карантина и изтрит успешно.

C:\WINDOWS\Temp\unp202119663.tmp (PUP.BundleInstaller.MG) -> Поставен под карантина и изтрит успешно.

Поставени под карантина и изтрити успешно, без първия Trojan.Agent.... Все пак искам да получа и малко експертно мнение. Поставям ви резултатите от DDS.txt и Attach.txt .....

.

DDS (Ver_2011-08-26.01) - NTFSx86

Internet Explorer: 8.0.6001.18702

Run by Velislav at 8:36:55 on 2012-02-07

Microsoft Windows XP Professional 5.1.2600.3.1251.359.1033.18.2047.1223 [GMT 2:00]

.

AV: avast! Antivirus *Enabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}

.

============== Running Processes ===============

.

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\Program Files\Alwil Software\Avast5\AvastSvc.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Alwil Software\Avast5\avastUI.exe

C:\WINDOWS\System32\svchost.exe -k HTTPFilter

C:\WINDOWS\RTHDCPL.EXE

C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\system32\wscntfy.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\WINDOWS\system32\NOTEPAD.EXE

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.abv.bg/

BHO: Помощник за връзки на Adobe PDF Reader: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll

BHO: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program files\alwil software\avast5\aswWebRepIE.dll

TB: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program files\alwil software\avast5\aswWebRepIE.dll

uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe

uRun: [cdloader] "c:\documents and settings\velislav\application data\mjusbsp\cdloader2.exe" MAGICJACK

uRun: [MediaGet2] c:\documents and settings\velislav\local settings\application data\mediaget2\mediaget.exe --minimized

mRun: [avast5] "c:\program files\alwil software\avast5\avastUI.exe" /nogui

mRun: [RTHDCPL] RTHDCPL.EXE

mRun: [Alcmtr] ALCMTR.EXE

dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE

IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL

Trusted Zone: e-fibank.bg

DPF: {0D41B8C5-2599-4893-8183-00195EC8D5F9} - hxxp://support.asus.com/select/asusTek_sys_ctrl3.cab

DPF: {46A70B4B-61D5-4D95-820D-895C3F9D6109} - hxxps://repository.infonotary.com/updates/inpki-x86.cab

DPF: {A996E48C-D3DC-4244-89F7-AFA33EC60679} - hxxps://e-fibank.bg/EBank/CAPICOM/capicom.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

TCP: DhcpNameServer = 192.168.0.1

TCP: Interfaces\{D142CFF8-917F-4A72-B69F-60E5CC7C7DA5} : DhcpNameServer = 192.168.0.1

Notify: AtiExtEvent - Ati2evxx.dll

.

============= SERVICES / DRIVERS ===============

.

R0 d347bus;d347bus;c:\windows\system32\drivers\d347bus.sys [2011-11-18 155136]

R0 d347prt;d347prt;c:\windows\system32\drivers\d347prt.sys [2011-11-18 5248]

R0 mv61xx;mv61xx;c:\windows\system32\drivers\mv61xx.sys [2007-5-25 137728]

R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2011-11-16 435032]

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2011-11-15 314456]

R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2011-11-15 20568]

R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast5\AvastSvc.exe [2011-11-15 44768]

R3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Controller;c:\windows\system32\drivers\atl01_xp.sys [2011-11-15 38656]

R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2012-2-7 40776]

S2 gupdate;Услуга на Google Актуализация (gupdate);c:\program files\google\update\GoogleUpdate.exe [2012-3-2 136176]

S3 gupdatem;Услуга на Google Актуализация (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2012-3-2 136176]

S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-11-18 20464]

S3 teamviewervpn;TeamViewer VPN Adapter;c:\windows\system32\drivers\teamviewervpn.sys [2008-1-25 25088]

S4 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2011-11-18 652360]

.

=============== Created Last 30 ================

.

2012-03-02 18:20:46 -------- d-----w- c:\documents and settings\velislav\local settings\application data\MediaGet2

2012-03-02 15:18:57 -------- d-----w- c:\documents and settings\velislav\local settings\application data\Google

2012-02-07 05:44:27 40776 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2012-01-31 06:18:00 -------- d-----w- c:\program files\VideoLAN

2012-01-20 20:05:53 -------- d-----w- c:\program files\SAM Simulator

2012-01-16 19:00:06 -------- d--h--w- c:\windows\system32\GroupPolicy

.

==================== Find3M ====================

.

2012-01-25 17:49:46 286720 ------w- c:\windows\Setup1.exe

2012-01-25 17:49:45 73216 ----a-w- c:\windows\ST6UNST.EXE

2011-12-10 13:24:06 20464 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-11-28 18:01:25 41184 ----a-w- c:\windows\avastSS.scr

2011-11-28 17:53:53 435032 ----a-w- c:\windows\system32\drivers\aswSnx.sys

2011-11-17 21:27:20 604488 ----a-w- c:\windows\system32\TUProgSt.exe

2011-11-17 21:27:17 361288 ----a-w- c:\windows\system32\TuneUpDefragService.exe

2011-11-17 10:17:12 0 ----a-w- c:\windows\ativpsrm.bin

2011-11-16 17:25:37 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2011-11-15 17:59:22 315392 ----a-w- c:\windows\HideWin.exe

2011-11-10 03:42:12 7493120 ----a-w- c:\windows\system32\drivers\ati2mtag.sys

2011-11-10 03:34:58 311296 ----a-w- c:\windows\system32\atiiiexx.dll

2011-11-10 03:26:40 57344 ----a-w- c:\windows\system32\aticalrt.dll

2011-11-10 03:26:32 53248 ----a-w- c:\windows\system32\aticalcl.dll

2011-11-10 03:20:22 7196672 ----a-w- c:\windows\system32\aticaldd.dll

2011-11-10 03:06:36 19210240 ----a-w- c:\windows\system32\atioglxx.dll

2011-11-10 02:54:28 466944 ----a-w- c:\windows\system32\ATIDEMGX.dll

2011-11-10 02:53:20 304640 ----a-w- c:\windows\system32\ati2dvag.dll

2011-11-10 02:50:00 5266624 ----a-w- c:\windows\system32\ati3duag.dll

2011-11-10 02:41:00 956160 ----a-w- c:\windows\system32\ativvamv.dll

2011-11-10 02:32:38 212992 ----a-w- c:\windows\system32\atipdlxx.dll

2011-11-10 02:32:24 155648 ----a-w- c:\windows\system32\Oemdspif.dll

2011-11-10 02:32:16 26112 ----a-w- c:\windows\system32\Ati2mdxx.exe

2011-11-10 02:32:08 43520 ----a-w- c:\windows\system32\ati2edxx.dll

2011-11-10 02:31:56 192512 ----a-w- c:\windows\system32\ati2evxx.dll

2011-11-10 02:30:42 643072 ----a-w- c:\windows\system32\ati2evxx.exe

2011-11-10 02:30:14 3303040 ----a-w- c:\windows\system32\ativvaxx.dll

2011-11-10 02:29:24 53248 ----a-w- c:\windows\system32\ATIDDC.DLL

2011-11-10 02:27:54 159744 ----a-w- c:\windows\system32\atiapfxx.exe

2011-11-10 02:23:30 806912 ----a-w- c:\windows\system32\atikvmag.dll

2011-11-10 02:20:58 602112 ----a-w- c:\windows\system32\atiok3x2.dll

2011-11-10 02:18:32 233472 ----a-w- c:\windows\system32\atiadlxx.dll

2011-11-10 02:18:08 17408 ----a-w- c:\windows\system32\atitvo32.dll

2011-11-10 02:12:22 884736 ----a-w- c:\windows\system32\ati2cqag.dll

2011-11-10 02:12:02 65024 ----a-w- c:\windows\system32\atimpc32.dll

2011-11-10 02:12:02 65024 ----a-w- c:\windows\system32\amdpcom32.dll

2011-11-10 02:12:00 53248 ----a-w- c:\windows\system32\drivers\ati2erec.dll

2011-11-09 20:39:44 59904 ----a-w- c:\windows\system32\OpenVideo.dll

2011-11-09 20:39:32 54784 ----a-w- c:\windows\system32\OVDecode.dll

2011-11-09 20:38:40 14375936 ----a-w- c:\windows\system32\amdocl.dll

2011-11-09 20:37:46 44032 ----a-w- c:\windows\system32\OpenCL.dll

.

============= FINISH: 8:37:44,35 ===============

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2011-08-26.01)

.

Microsoft Windows XP Professional

Boot Device: \Device\HarddiskVolume1

Install Date: 11/15/2011 7:41:27 PM

System Uptime: 2/7/2012 7:41:39 AM (1 hours ago)

.

Motherboard: ASUSTeK Computer INC. | | P5K SE

Processor: Intel® Pentium® Dual CPU E2160 @ 1.80GHz | LGA775 | 1805/200mhz

.

==== Disk Partitions =========================

.

A: is Removable

C: is FIXED (NTFS) - 40 GiB total, 24.431 GiB free.

D: is FIXED (NTFS) - 193 GiB total, 64.445 GiB free.

E: is CDROM (CDFS)

F: is CDROM ()

G: is FIXED (NTFS) - 466 GiB total, 172.594 GiB free.

I: is CDROM ()

.

==== Disabled Device Manager Items =============

.

==== System Restore Points ===================

.

RP89: 1/4/2012 8:12:28 PM - System Checkpoint

RP90: 1/9/2012 8:59:38 AM - System Checkpoint

RP91: 1/7/2012 3:37:24 AM - System Checkpoint

RP92: 1/8/2012 11:10:00 AM - System Checkpoint

RP93: 1/10/2012 10:28:46 AM - System Checkpoint

RP94: 1/14/2012 11:19:57 AM - System Checkpoint

RP95: 1/15/2012 5:34:08 PM - System Checkpoint

RP96: 1/16/2012 11:35:29 PM - System Checkpoint

RP97: 1/19/2012 8:34:54 AM - System Checkpoint

RP98: 1/20/2012 7:29:01 PM - System Checkpoint

RP99: 1/21/2012 7:57:15 PM - System Checkpoint

RP100: 1/23/2012 12:02:51 AM - System Checkpoint

RP101: 1/24/2012 12:09:44 AM - System Checkpoint

RP102: 1/25/2012 12:39:28 AM - System Checkpoint

RP103: 1/26/2012 1:32:37 AM - System Checkpoint

RP104: 1/27/2012 2:32:38 AM - System Checkpoint

RP105: 3/2/2012 4:12:03 PM - System Checkpoint

RP106: 2/5/2012 4:42:23 PM - System Checkpoint

RP107: 2/6/2012 5:20:22 PM - System Checkpoint

.

==== Installed Programs ======================

.

µTorrent

7-Zip 9.20

Adobe Flash Player 11 ActiveX

Adobe Reader 8 - Bulgarian

AMD APP SDK Runtime

AMD Catalyst Install Manager

ASUS VGA Driver

Attansic Ethernet Utility

Attansic L1 Gigabit Ethernet Driver

avast! Free Antivirus

BS.Player FREE

Bulgarian (Phonetic) - Custom

Catalyst Control Center Core Implementation

Catalyst Control Center Graphics Full Existing

Catalyst Control Center Graphics Full New

Catalyst Control Center Graphics Light

Catalyst Control Center InstallProxy

Catalyst Control Center Localization Chinese Standard

Catalyst Control Center Localization Chinese Traditional

Catalyst Control Center Localization Czech

Catalyst Control Center Localization Danish

Catalyst Control Center Localization Dutch

Catalyst Control Center Localization Finnish

Catalyst Control Center Localization French

Catalyst Control Center Localization German

Catalyst Control Center Localization Greek

Catalyst Control Center Localization Hungarian

Catalyst Control Center Localization Italian

Catalyst Control Center Localization Japanese

Catalyst Control Center Localization Korean

Catalyst Control Center Localization Norwegian

Catalyst Control Center Localization Polish

Catalyst Control Center Localization Portuguese

Catalyst Control Center Localization Russian

Catalyst Control Center Localization Spanish

Catalyst Control Center Localization Swedish

Catalyst Control Center Localization Thai

Catalyst Control Center Localization Turkish

ccc-utility

CCC Help Chinese Standard

CCC Help Chinese Traditional

CCC Help Czech

CCC Help Danish

CCC Help Dutch

CCC Help English

CCC Help Finnish

CCC Help French

CCC Help German

CCC Help Greek

CCC Help Hungarian

CCC Help Italian

CCC Help Japanese

CCC Help Korean

CCC Help Norwegian

CCC Help Polish

CCC Help Portuguese

CCC Help Russian

CCC Help Spanish

CCC Help Swedish

CCC Help Thai

CCC Help Turkish

DAEMON Tools

EVEREST Corporate Edition v5.50

Google Земя

Google Update Helper

High Definition Audio Driver Package - KB888111

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)

Hotfix for Windows XP (KB954550-v5)

Inhatch web plugins

K-Lite Codec Pack 5.5.1 (Full)

Logitech Webcam Software

Logitech Webcam Software Driver Package

magicJack

Malwarebytes Anti-Malware, версия 1.60.1.1000

marvell 61xx

Men of War: Assault Squad (Remove Only)

Microsoft .NET Framework 2.0 Service Pack 2

Microsoft .NET Framework 3.0 Service Pack 2

Microsoft .NET Framework 3.5 SP1

Microsoft Office Professional Edition 2003

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

Nero 8 Lite 8.3.2.1

NirSoft BlueScreenView

Realtek High Definition Audio Driver

SAM Simulator

Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)

Security Update for Windows Internet Explorer 8 (KB2544521)

Security Update for Windows Internet Explorer 8 (KB2586448)

Security Update for Windows Internet Explorer 8 (KB982381)

Security Update for Windows Media Player (KB952069)

Security Update for Windows Media Player (KB954155)

Security Update for Windows Media Player (KB973540)

Security Update for Windows XP (KB2508272)

Security Update for Windows XP (KB2562937)

Skins

Skype™ 5.5

TeamViewer 7

TuneUp Utilities 2009

Update 1.98.8.0 for "Men of War: Assault Squad"

Update for Windows Internet Explorer 8 (KB2598845)

Update for Windows XP (KB898461)

VLC media player 1.1.11

WebFldrs XP

WinDjView 1.0.3

Windows Internet Explorer 8

Windows XP Service Pack 3

WinRAR archiver

XviD MPEG-4 Video Codec

.

==== End Of File ===========================

Здравейте,

Лог файла изглежда наред. Намерените неща са просто потенциално нежелани приложения или кейгенератори.

Просто избягвайте да използвате кракове, пачове, кейгенератори и да влизате в съмнителни сайтове - warez, torrent и т.н.

Има си достатъчно наброй безплатни и качествени алтернативи.

Само две препоръки:

Деинсталирайте - MediaGet...това е adware приложение - Win32/Adware.GoodMedia.C

Не дръжте сайтове в доверената зона на браузъра (особено за банкиране)

Trusted Zone: e-fibank.bg

Доверената зона сериозно намалява сигурността на посетения сайт и го третира с минимални ограничения.

Ето как да изчистите списъка на сайтовете в браузъра:

Зони за защита: добавяне или премахване на уеб сайтове

След това изтрийте DDS и лог файловет създадени от него.

Безопасно сърфиране и приятен ден !

Много Ви благодаря за отговора. Ще взема предвид препоръките. Хубава вечер!