След инсталация на bs player,не мога да премахна bs player toolbar [РЕШЕН]

23 февруари 201214 г.

Здравейте.

По време на инсталацията на bsplayer и туулбара му, COMODO Firewall ме информира,че CT1750559_ie.exe се опитва да промени ключ от регистъра.Не знам какво точно означава това,но ми се струва,че опитите да го блокирам са ми били напразни.От add/remove programs премахнах bs player,но се оказва невъзможно да премахна BS Player Toolbar.След което забелязах че защитата на COMODO Firewall,блокирва ататаки,в чийто инфо виждам CT1750559_ie.exe.

След стартиране на DDS,прекратиха блокираните атаки които бяха през няколко минути.

Снощи сканирах системата с нод32 и откри HTML/Iframe.B.virus който може би елиминирах?!

Като цял не виждам промяна в работата на машината,която използвам предимно за интернет и филми.

Неразполагам с компакт диск за операционната ми система.

DDS

DDS (Ver_2011-09-30.01) - NTFS_AMD64

Internet Explorer: 8.0.7600.16385

Run by Цеци at 22:35:39 on 2012-02-23

Microsoft Windows 7 Ultimate 6.1.7600.0.1251.359.1026.18.4061.2398 [GMT 1:00]

.

AV: ESET NOD32 Antivirus 4.2 *Disabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}

AV: Microsoft Security Essentials *Disabled/Outdated* {BF5CEBDC-F2D3-7540-343C-F0CE11FD6E66}

SP: Microsoft Security Essentials *Disabled/Outdated* {043D0A38-D4E9-7ACE-0E8C-CBBC6A7A24DB}

SP: ESET NOD32 Antivirus 4.2 *Disabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: COMODO Defense+ *Enabled/Updated* {CE351521-78FA-2048-BB22-B68A4A5CA7EC}

FW: COMODO Firewall *Enabled* {4D6F75E0-14AF-2E9E-AACD-24CDCF08AA2A}

.

============== Running Processes ===============

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files (x86)\Common Files\DeviceHelper\DeviceManager.exe

C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe

C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe

C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBService.exe

C:\Windows\SysWOW64\IoctlSvc.exe

C:\Program Files (x86)\Spyware Doctor\sdhelp.exe

C:\Windows\system32\svchost.exe -k imgsvc

C:\Windows\system32\taskhost.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Program Files (x86)\HSPA USB MODEM\ModemListener.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Windows\system32\SearchIndexer.exe

C:\Program Files (x86)\HSPA USB MODEM\Hspa USB Modem.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Windows\system32\sppsvc.exe

C:\Windows\System32\svchost.exe -k secsvcs

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\System32\svchost.exe -k LocalServicePeerNet

C:\Program Files (x86)\Mozilla Firefox\firefox.exe

C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe

C:\Program Files (x86)\Skype\Phone\Skype.exe

C:\Windows\system32\WUDFHost.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Windows\SysWOW64\NOTEPAD.EXE

C:\Windows\system32\conhost.exe

C:\Windows\System32\cscript.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.google.bg/

uProxyServer = 93.152.135.96:808

mWinlogon: Userinit = userinit.exe,

BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO: PCTools Site Guard: {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\Program Files (x86)\Spyware Doctor\tools\iesdsg.dll

BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll

BHO: Помощ за влизане на Windows Live: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO: PCTools Browser Monitor: {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\Program Files (x86)\Spyware Doctor\tools\iesdpb.dll

BHO: FDMIECookiesBHO Class: {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files (x86)\Free Download Manager\iefdm2.dll

BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

uRun: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

uRun: [spyware Doctor] "C:\Program Files (x86)\Spyware Doctor\swdoctor.exe" /Q

mRun: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"

mRun: [ModemListener] C:\Program Files (x86)\HSPA USB MODEM\ModemListener.exe start

mRun: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray

dRun: [spyware Doctor] "C:\Program Files (x86)\Spyware Doctor\swdoctor.exe" /Q

uPolicies-Explorer: NoDriveTypeAutoRun = dword:145

mPolicies-Explorer: NoActiveDesktop = dword:1

mPolicies-Explorer: NoActiveDesktopChanges = dword:1

mPolicies-System: ConsentPromptBehaviorAdmin = dword:0

mPolicies-System: ConsentPromptBehaviorUser = dword:3

mPolicies-System: EnableLUA = dword:0

mPolicies-System: EnableUIADesktopToggle = dword:0

mPolicies-System: PromptOnSecureDesktop = dword:0

IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000

IE: Свали видеото с Free Download Manager - C:\Program Files (x86)\Free Download Manager\dlfvideo.htm

IE: Свали всички с Free Download Manager - C:\Program Files (x86)\Free Download Manager\dlall.htm

IE: Свали избраните с Free Download Manager - C:\Program Files (x86)\Free Download Manager\dlselected.htm

IE: Свали с Free Download Manager - C:\Program Files (x86)\Free Download Manager\dllink.htm

IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office12\ONBttnIE.dll

IE: {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - {A1EDC4A1-940F-48E0-8DFD-E38F1D501021} - C:\Program Files (x86)\Spyware Doctor\tools\iesdpb.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}

DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

TCP: Interfaces\{163943E6-2B91-47BC-B4D8-5F47A5A29BC4} : NameServer = 8.26.56.26,156.154.70.22

TCP: Interfaces\{83AE2040-2A7A-48C9-999A-5C9F484A9243} : NameServer = 8.26.56.26,156.154.70.22

TCP: Interfaces\{83AE2040-2A7A-48C9-999A-5C9F484A9243} : DHCPNameServer = 192.168.1.254

TCP: Interfaces\{83AE2040-2A7A-48C9-999A-5C9F484A9243}\25F6D61607F62747F6 : NameServer = 8.26.56.26,156.154.70.22

TCP: Interfaces\{83AE2040-2A7A-48C9-999A-5C9F484A9243}\25F6D61607F62747F6 : DHCPNameServer = 192.168.1.1

TCP: Interfaces\{83AE2040-2A7A-48C9-999A-5C9F484A9243}\56875636 : DHCPNameServer = 10.0.0.1

Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll

SSODL: WebCheck - <orphaned>

SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll

x64-BHO: Windows Live Family Safety Browser Helper Class: {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll

x64-BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

x64-Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice

x64-Run: [COMODO Internet Security] "C:\Program Files\COMODO\COMODO Internet Security\cfp.exe" -h

x64-DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab

x64-DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab

x64-DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab

x64-Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - <orphaned>

x64-SSODL: WebCheck - <orphaned>

.

================= FIREFOX ===================

.

FF - ProfilePath - C:\Users\Цеци\AppData\Roaming\Mozilla\Firefox\Profiles\649yaraw.default\

.

============= SERVICES / DRIVERS ===============

.

R1 cmdGuard;COMODO Internet Security Sandbox Driver;C:\Windows\System32\drivers\cmdGuard.sys [2012-1-17 577824]

R1 cmdHlp;COMODO Internet Security Helper Driver;C:\Windows\System32\drivers\cmdhlp.sys [2011-12-19 43248]

R1 MpFilter;Microsoft Malware Protection Driver;C:\Windows\System32\drivers\MpFilter.sys [2010-3-25 173984]

R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\System32\drivers\vwififlt.sys [2009-7-14 59904]

R2 DeviceManager;DeviceManager;C:\Program Files (x86)\Common Files\DeviceHelper\DeviceManager.exe -start --> C:\Program Files (x86)\Common Files\DeviceHelper\DeviceManager.exe -start [?]

R2 eamonm;eamonm;C:\Windows\System32\drivers\eamonm.sys [2010-9-3 170104]

R2 ekrn;ESET Service;C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe [2010-11-4 810144]

R2 epfwwfpr;epfwwfpr;C:\Windows\System32\drivers\epfwwfpr.sys [2010-7-29 126320]

R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-2-12 652360]

R3 jrdusbser;Mobile Connector Device for Legacy Serial Communication;C:\Windows\System32\drivers\jrdusbser.sys [2012-1-13 119680]

R3 MBAMProtector;MBAMProtector;C:\Windows\System32\drivers\mbam.sys [2012-1-25 23152]

R3 vwifimp;Microsoft Virtual WiFi Miniport Service;C:\Windows\System32\drivers\vwifimp.sys [2009-7-14 17920]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]

S3 fssfltr;fssfltr;C:\Windows\System32\drivers\fssfltr.sys [2010-10-4 61288]

S3 fsssvc;Услуга за семейна безопасност на Windows Live;C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe [2010-4-28 704872]

S3 MpNWMon;Microsoft Malware Protection Network Driver;C:\Windows\System32\drivers\MpNWMon.sys [2010-3-25 40832]

S3 nmwcdnsucx64;Nokia USB Flashing Generic;C:\Windows\System32\drivers\nmwcdnsucx64.sys [2011-8-17 12800]

S3 nmwcdnsux64;Nokia USB Flashing Phone Parent;C:\Windows\System32\drivers\nmwcdnsux64.sys [2011-8-17 171008]

S3 WatAdminSvc;Услуга на технологиите за активиране на Windows;C:\Windows\System32\Wat\WatAdminSvc.exe [2010-10-4 1255736]

.

=============== Created Last 30 ================

.

2012-02-23 21:33:51 -------- d-----w- C:\Users\?хЎш\AppData\Local\Microsoft

2012-02-21 21:51:14 -------- d-----w- C:\Program Files (x86)\Conduit

2012-02-21 21:35:53 -------- d-----w- C:\Program Files (x86)\BS_Player

2012-02-21 21:34:52 -------- d-----w- C:\Users\Цеци\AppData\Roaming\BSplayer Pro

2012-02-21 21:34:52 -------- d-----w- C:\Users\Цеци\AppData\Roaming\BSplayer

2012-02-20 22:34:49 8643640 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{126C8BF0-A4F7-4F2C-B4FE-4B14CF8456DB}\mpengine.dll

2012-02-17 20:55:30 134104 ----a-w- C:\Program Files (x86)\Mozilla Firefox\components\browsercomps.dll

2012-02-17 20:55:29 626688 ----a-w- C:\Program Files (x86)\Mozilla Firefox\msvcr80.dll

2012-02-17 20:55:29 548864 ----a-w- C:\Program Files (x86)\Mozilla Firefox\msvcp80.dll

2012-02-17 20:55:29 479232 ----a-w- C:\Program Files (x86)\Mozilla Firefox\msvcm80.dll

2012-02-17 20:55:29 45016 ----a-w- C:\Program Files (x86)\Mozilla Firefox\mozutils.dll

2012-02-17 20:55:29 2106216 ----a-w- C:\Program Files (x86)\Mozilla Firefox\D3DCompiler_43.dll

2012-02-17 20:55:29 1998168 ----a-w- C:\Program Files (x86)\Mozilla Firefox\d3dx9_43.dll

2012-02-01 16:52:03 -------- d-----w- C:\ProgramData\CPA_VA

2012-02-01 03:04:21 -------- d-----w- C:\ProgramData\Comodo

2012-02-01 03:04:17 -------- d-----w- C:\Program Files\COMODO

2012-02-01 03:04:10 -------- d-----w- C:\Program Files (x86)\Comodo

2012-02-01 03:04:09 1060864 ----a-w- C:\Windows\SysWow64\mfc71.dll

2012-01-25 22:50:14 -------- d-----w- C:\Users\Цеци\AppData\Roaming\Malwarebytes

2012-01-25 22:50:07 -------- d-----w- C:\ProgramData\Malwarebytes

2012-01-25 22:50:06 23152 ----a-w- C:\Windows\System32\drivers\mbam.sys

2012-01-25 22:50:06 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware

2012-01-25 22:37:47 -------- d-----w- C:\Program Files (x86)\TeaTimer (Spybot - Search & Destroy)

2012-01-25 22:37:47 -------- d-----w- C:\Program Files (x86)\SDHelper (Spybot - Search & Destroy)

2012-01-25 22:37:47 -------- d-----w- C:\Program Files (x86)\Misc. Support Library (Spybot - Search & Destroy)

2012-01-25 22:37:47 -------- d-----w- C:\Program Files (x86)\File Scanner Library (Spybot - Search & Destroy)

2012-01-25 22:31:42 -------- d-----w- C:\ProgramData\Spybot - Search & Destroy

2012-01-25 22:31:39 -------- d-----w- C:\Program Files (x86)\Spybot - Search & Destroy

2012-01-25 22:11:31 478 ----a-w- C:\Windows\win.tmp

2012-01-25 22:11:31 219 ----a-w- C:\Windows\system.tmp

2012-01-25 22:07:55 50048 ----a-w- C:\Windows\SysWow64\drivers\ikhlayer.sys

2012-01-25 22:07:48 -------- d-----w- C:\Users\Цеци\AppData\Roaming\PC Tools

2012-01-25 22:07:48 -------- d-----w- C:\Program Files (x86)\Spyware Doctor

.

==================== Find3M ====================

.

2012-01-29 04:10:42 279656 ------w- C:\Windows\System32\MpSigStub.exe

2012-01-17 20:00:46 577824 ----a-w- C:\Windows\System32\drivers\cmdGuard.sys

2011-12-19 17:59:18 43248 ----a-w- C:\Windows\System32\drivers\cmdhlp.sys

2011-12-19 17:59:16 22696 ----a-w- C:\Windows\System32\drivers\cmderd.sys

2011-12-19 17:58:58 41200 ----a-w- C:\Windows\System32\cmdcsr.dll

2011-12-19 17:58:56 389840 ----a-w- C:\Windows\System32\guard64.dll

2011-12-19 17:58:56 301224 ----a-w- C:\Windows\SysWow64\guard32.dll

.

============= FINISH: 22:35:58,98 ===============

attach

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2011-09-30.01)

.

Microsoft Windows 7 Ultimate

Boot Device: \Device\HarddiskVolume1

Install Date: 4.10.2010 г. 12:24:29

System Uptime: 23.2.2012 г. 21:52:59 (1 hours ago)

.

Motherboard: ASUSTeK Computer Inc. | | K50IJ

Processor: Pentium® Dual-Core CPU T4400 @ 2.20GHz | Socket 478 | 2200/200mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 80 GiB total, 46,716 GiB free.

D: is FIXED (NTFS) - 218 GiB total, 116,857 GiB free.

E: is CDROM ()

H: is Removable

.

==== Disabled Device Manager Items =============

.

==== System Restore Points ===================

.

No restore point in system.

.

==== Installed Programs ======================

.

Update for Microsoft Office 2007 (KB2508958)

Архиватор WinRAR

Асистент за влизане на Windows Live

Инструмент за качване на Windows Live

Фотогалерия на Windows Live

Семейна безопасност на Windows Live

Adobe Flash Player 10 ActiveX

Adobe Flash Player 10 Plugin

Adobe Reader 9.4.4

Adobe Shockwave Player 11.5

Any Audio Converter 3.2.3

Ashampoo Burning Studio 10.0.4

BS Player Toolbar

CANON iMAGE GATEWAY Task for ZoomBrowser EX

Canon Internet Library for ZoomBrowser EX

Canon MOV Decoder

Canon MOV Encoder

Canon MovieEdit Task for ZoomBrowser EX

Canon Utilities CameraWindow

Canon Utilities CameraWindow DC 8

Canon Utilities Movie Uploader for YouTube

Canon Utilities MyCamera

Canon Utilities PhotoStitch

Canon Utilities ZoomBrowser EX

Canon ZoomBrowser EX Memory Card Utility

Comodo Dragon

COMODO Internet Security

Counter-Strike

Counter-Strike 1.6 Version 29, Exe build: 3647

DC++ 0.782

Easy Driver Pro

ESET NOD32 Antivirus

Free Download Manager 3.0

HSPA USB MODEM

Java Auto Updater

Java 6 Update 21 (64-bit)

Java 6 Update 22

K-Lite Codec Pack (64-bit) v3.9.0

K-Lite Mega Codec Pack 6.4.0

Malwarebytes Anti-Malware, версия 1.60.1.1000

Microsoft .NET Framework 4 Client Profile

Microsoft Antimalware

Microsoft Antimalware Service BG-BG Language Pack

Microsoft Application Error Reporting

Microsoft Choice Guard

Microsoft Office 2007 Service Pack 3 (SP3)

Microsoft Office Access MUI (Bulgarian) 2007

Microsoft Office Access MUI (English) 2007

Microsoft Office Access Setup Metadata MUI (English) 2007

Microsoft Office Enterprise 2007

Microsoft Office Excel 2007 Help Актуализация (KB963678)

Microsoft Office Excel MUI (Bulgarian) 2007

Microsoft Office Excel MUI (English) 2007

Microsoft Office Groove MUI (Bulgarian) 2007

Microsoft Office Groove MUI (English) 2007

Microsoft Office Groove Setup Metadata MUI (English) 2007

Microsoft Office InfoPath MUI (Bulgarian) 2007

Microsoft Office InfoPath MUI (English) 2007

Microsoft Office Office 64-bit Components 2007

Microsoft Office OneNote MUI (Bulgarian) 2007

Microsoft Office OneNote MUI (English) 2007

Microsoft Office Outlook MUI (Bulgarian) 2007

Microsoft Office Outlook MUI (English) 2007

Microsoft Office Powerpoint 2007 Help Актуализация (KB963669)

Microsoft Office PowerPoint MUI (Bulgarian) 2007

Microsoft Office PowerPoint MUI (English) 2007

Microsoft Office Proof (Bulgarian) 2007

Microsoft Office Proof (English) 2007

Microsoft Office Proof (French) 2007

Microsoft Office Proof (German) 2007

Microsoft Office Proof (Russian) 2007

Microsoft Office Proof (Spanish) 2007

Microsoft Office Proofing (Bulgarian) 2007

Microsoft Office Proofing (English) 2007

Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)

Microsoft Office Publisher MUI (Bulgarian) 2007

Microsoft Office Publisher MUI (English) 2007

Microsoft Office Shared 64-bit MUI (Bulgarian) 2007

Microsoft Office Shared 64-bit MUI (English) 2007

Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007

Microsoft Office Shared MUI (Bulgarian) 2007

Microsoft Office Shared MUI (English) 2007

Microsoft Office Shared Setup Metadata MUI (English) 2007

Microsoft Office Word 2007 Help Актуализация (KB963665)

Microsoft Office Word MUI (Bulgarian) 2007

Microsoft Office Word MUI (English) 2007

Microsoft Security Essentials

Microsoft Silverlight

Microsoft SQL Server 2005 Compact Edition [ENU]

Mozilla Firefox 10.0.2 (x86 bg)

MSVC80_x64_v2

MSVC80_x86_v2

MSVC90_x64

MSVC90_x86

MSVCRT

MSXML 4.0 SP2 (KB973688)

Nero 8 Ultra Edition HD

neroxml

Nokia Connectivity Cable Driver

Nokia Ovi Suite

Nokia Ovi Suite Software Updater

Ovi Desktop Sync Engine

OviMPlatform

PC Connectivity Solution

SA Dictionary 2008 Beta 4

Security Update for Microsoft .NET Framework 4 Client Profile (KB2160841)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)

Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition

Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition

Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition

Security Update for Microsoft Office Publisher 2007 (KB2596705) 32-Bit Edition

Skype™ 5.5

Spybot - Search & Destroy 1.3

Spyware Doctor 3.5

Steam

The KMPlayer (remove only)

Update for 2007 Microsoft Office System (KB967642)

Update for Microsoft Office 2007 Help for Common Features (KB963673)

Update for Microsoft Office 2007 suites (KB2596651) 32-Bit Edition

Update for Microsoft Office 2007 suites (KB2596686) 32-Bit Edition

Update for Microsoft Office 2007 suites (KB2596789) 32-Bit Edition

Update for Microsoft Office Access 2007 Help (KB963663)

Update for Microsoft Office Excel 2007 (KB2596596) 32-Bit Edition

Update for Microsoft Office Excel 2007 Help (KB963678)

Update for Microsoft Office Infopath 2007 Help (KB963662)

Update for Microsoft Office OneNote 2007 Help (KB963670)

Update for Microsoft Office Outlook 2007 Help (KB963677)

Update for Microsoft Office Powerpoint 2007 Help (KB963669)

Update for Microsoft Office Publisher 2007 Help (KB963667)

Update for Microsoft Office Script Editor Help (KB963671)

Update for Microsoft Office Word 2007 Help (KB963665)

USB 2.0 1.3M UVC WebCam

VCRedistSetup

VLC media player 1.1.4

Windows Driver Package - Nokia pccsmcfd (08/22/2008 7.0.0.0)

Windows Live Communications Platform

Windows Live Essentials

Windows Live Messenger

Windows Live Movie Maker

Windows Live Sync

Windows Live Writer

.

==== Event Viewer Messages From Past Week ========

.

23.2.2012 г. 21:39:16, Error: Application Popup [1060] - \??\C:\Windows\SysWow64\drivers\ikhlayer.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.

23.2.2012 г. 14:51:30, Error: Application Popup [1060] - \??\C:\Windows\SysWow64\drivers\ikhlayer.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.

23.2.2012 г. 13:49:25, Error: Application Popup [1060] - \??\C:\Windows\SysWow64\drivers\ikhlayer.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.

22.2.2012 г. 21:03:05, Error: Application Popup [1060] - \??\C:\Windows\SysWow64\drivers\ikhlayer.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.

22.2.2012 г. 07:01:45, Error: Application Popup [1060] - \??\C:\Windows\SysWow64\drivers\ikhlayer.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.

21.2.2012 г. 23:27:50, Error: Application Popup [1060] - \??\C:\Windows\TEMP\mc2DC59.tmp has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.

21.2.2012 г. 23:26:44, Error: Application Popup [1060] - \??\C:\Windows\SysWow64\drivers\ikhlayer.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.

21.2.2012 г. 21:37:15, Error: Application Popup [1060] - \??\C:\Windows\SysWow64\drivers\ikhlayer.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.

21.2.2012 г. 14:17:05, Error: Application Popup [1060] - \??\C:\Windows\SysWow64\drivers\ikhlayer.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.

20.2.2012 г. 19:44:25, Error: Application Popup [1060] - \??\C:\Windows\SysWow64\drivers\ikhlayer.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.

20.2.2012 г. 12:38:07, Error: Application Popup [1060] - \??\C:\Windows\SysWow64\drivers\ikhlayer.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.

19.2.2012 г. 21:57:21, Error: Application Popup [1060] - \??\C:\Windows\SysWow64\drivers\ikhlayer.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.

19.2.2012 г. 12:47:56, Error: Application Popup [1060] - \??\C:\Windows\SysWow64\drivers\ikhlayer.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.

18.2.2012 г. 20:29:21, Error: Application Popup [1060] - \??\C:\Windows\SysWow64\drivers\ikhlayer.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.

17.2.2012 г. 21:49:54, Error: Application Popup [1060] - \??\C:\Windows\SysWow64\drivers\ikhlayer.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.

16.2.2012 г. 15:31:42, Error: Application Popup [1060] - \??\C:\Windows\SysWow64\drivers\ikhlayer.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.

.

==== End Of File ===========================

Емил Костов

Hardware Team

Пол:Мъж
Град:Плевен
Интереси:Интернет,Компютърни игри и програми. WEB design

24 февруари 201214 г.

Колегите ще проверят дали имаш вируси, но може BS Toolbar да го забраниш като приложение в браузъра.

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

24 февруари 201214 г.

Здравйте..!Съветвам ви да деинсталирате всички защитни програми и да си оставите само една...Незнам изобщо как работи компютъра с толкова защитен софтуер.Използвайте тази програма:

Изтеглете AppRemover и го запазете на вашия десктоп.

Стартирате програмата:

Next >> Уверете се ще е маркиран "Remove Security Application"

Next >> AppRemover ще сканира всички приложения, свързани със сигурността на вашия компютър.

Маркирайте всички приложения които са излишни и си оставете само действащите...и кликате Next>> два пъти.

Следвайте допълнителните инструкциите на екрана. Ако поиска рестарт, моля направете го.

24 февруари 201214 г.

Автор

Благодаря за вниманието

Emokostov,опитах се да прекратя инсталирването и може би за това не го виждам като приложение в браузара,но не мога да го премахна от add/remove programs.

icotonev,благодаря за съвета,не знаех,че си пречат,макар и да не са стартирани доста от тях.По принцип използвам нод32+Malwarebytes Anti-Malware+комодо защитна стена.Съветвате ме да оставя само една.Да оставя нод+защитната стена на комодо или само едно от 3-те?Искам компютъра да ми е защитен,но явно се иска повече четене,от колкото "охранители"

Според вас имам ли право да мисля,че съществува вирус в машината ми ?

24 февруари 201214 г.

Здравейте,

Колегата има лични ангажименти и затова аз ще ви отговоря...

Ако не сте си платили за продукта на ESET, по-добре я деинсталирайте и си оставете Microsoft Security Essentials + Comodo Firewall (без антивирусния модул на пакета).

Тъй като имате инсталирани Malwarebytes' Anti-Malware (един от най-добрите скенери за зловредни приложения) и Spybot Search & Destroy (който е доста слабичък в наши дни, но поне има имунизация на системата), можете да деинсталирате платеното приложение не PC Tools Spyware Doctor.

Колкото до тулбара, просто изтрийте следната папка:

C:\Program Files (x86)\Conduit <= тази папка.

За да претърсим дали има още остатъци от него, направете следното:

Изтеглете OTL.exe и го запазете на десктопа.

Стартирайте OTL (ако е необходимо, потвърдете през UAC).
Направете следните настройки:
Сложете отметка пред Scan All Users
Под менюто File Age изберете 90 days
Под менюто Standard Registryпроменете на ALL
Сложете отметки пред LOP и Purity Check

Под

с Copy/ Paste въведете изцяло следната текстова информация (само това, което е поставено в карето):

netsvcs
msconfig
safebootminimal
safebootnetwork
%SYSTEMDRIVE%\*.*
%USERPROFILE%\*.*
%USERPROFILE%\AppData\Local\*.*
%USERPROFILE%\AppData\Roaming\*.*
%ProgramData%\*.*
%CommonProgramFiles%\*.*
%PROGRAMFILES%\*.*
%systemroot%\system32\config\systemprofile\AppData\Local\*.*
%windir%\SysWOW64\config\systemprofile\AppData\Local\*.*
%windir%\ServiceProfiles\LocalService\AppData\Local\Temp\*.*
%windir%\ServiceProfiles\NetworkService\AppData\Local\Temp\*.*
%windir%\temp\*.*
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\syswow64\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\system32\drivers\*.sys /90
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\syswow64\drivers\*.sys /90
%systemroot%\syswow64\drivers\*.sys /lockedfiles
%systemroot%\system32\Spool\prtprocs\w32x86\*.dll
%systemroot%\*. /mp /s
%systemroot%\assembly\temp\*.* /S /MD5
%systemroot%\assembly\tmp\*.* /S /MD5
%systemroot%\assembly\GAC_32\*.* /S /MD5
%systemroot%\assembly\GAC_64\*.* /S /MD5
%SystemRoot%\assembly\GAC_MSIL\*.* /S /MD5
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems /s
/md5start
explorer.exe
lsass.exe
svchost.exe
wininit.exe
winlogon.exe
userinit.exe
atapi.sys
iaStor.sys
serial.sys
volsnap.sys
disk.sys
redbook.sys
i8042prt.sys
afd.sys
netbt.sys
tcpip.sys
hlp.dat
/md5stop

Натиснете маркираният в синьо бутон: Run Scan.
Като приключи проверката, ще се създадат два файла - OTL.Txt и Extras.Txt. Прикачете тези два файла в следващия си коментар (погледнете опцията Прикачени файлове, когато публикувате мнение).

25 февруари 201214 г.

Автор

Оставих Comodo Firewall (без антивирусния модул на пакета),Malwarebytes Anti-Malware и ESET (които ще заменя с платен нортън-ще ми е подарък,може би ще е по-добър варянт) В процес на сканирването на OTL а и след това,COMODO firewall ме предупреди,че чрез програма system се опитвам да се свържа с друг компютър...бе блокирано.Има ли нещо общо с OTL? Ето и двата текстови документа:

OTL.Txt

Extras.Txt

25 февруари 201214 г.

За да се използва COMODO се изискват определени познания по Операционната Система. Няма как за всяко едно действие да ви кажа кое е правилно да се натиска и кое не.

Коя версия на Norton ще използвате? Ако е пълния пакет, тогава махнете и COMODO за да не се припокриват.

И не мисля, че има нужда да използвате защитата в реално време на MBAM. Оставете си я като скенер само.

И не, OTL си е напълно легална програма !

Стартирайте отново OTL, копирайте (Copy) и поставете (Paste) скриптовия текст от текстовото поле по-долу под колонката Custom Scans/Fixes, като не забравяте да копирате скрипта 1 към 1, както и двете точки преди първия ред на скрипта.

:OTL
[2012.02.22 21:11:29 | 000,000,000 | ---D | M] (BS Player Community Toolbar) -- C:\Users\Цеци\AppData\Roaming\mozilla\Firefox\Profiles\649yaraw.default\extensions\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}
O3 - HKU\S-1-5-21-213642539-3441712944-2455257314-1000\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
[2012.02.21 22:44:42 | 000,000,000 | ---D | C] -- C:\Users\Цеци\AppData\Local\Conduit
[2011.08.01 22:11:40 | 000,000,000 | ---D | M] -- C:\Users\Цеци\AppData\Roaming\OpenCandy
:Commands
[emptytemp]

След като въведете скрипта от цитата по-горе натиснете бутона, маркиран в червено: Run Fix

Windows ще се рестартира и ще се създаде лог файл. Публикувайте съдържанието му с Copy/Paste в следващия си коментар.

25 февруари 201214 г.

Автор

Брат ми вчера си закупил лаптоп заедно с Norton (3 Users).Ако не възръзявате,като получа инфомрация,какво точно е закупено,да се посъветвам с вас чрез лично съобщение,как ще най-добре да процедирам?!

Лог файл:

[.ShellClassInfo]

LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21799

[LocalizedFileNames]

Internet Explorer.lnk=@%windir%\System32\ie4uinit.exe,-734

Media Center.lnk=@%systemroot%\ehome\ehres.dll,-100

Windows Media Player.lnk=@%SystemRoot%\system32\unregmp2.exe,-4

25 февруари 201214 г.

Здравейте, Това не е лог файла от OTL. Отворете папката C:\_OTL\MovedFiles => и публикувайте лог файла в следващия си пост.

25 февруари 201214 г.

Автор

All processes killed ========== OTL ========== C:\Users\Цеци\AppData\Roaming\mozilla\Firefox\Profiles\649yaraw.default\extensions\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}\searchplugin folder moved successfully. C:\Users\Цеци\AppData\Roaming\mozilla\Firefox\Profiles\649yaraw.default\extensions\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}\modules folder moved successfully. C:\Users\Цеци\AppData\Roaming\mozilla\Firefox\Profiles\649yaraw.default\extensions\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}\META-INF folder moved successfully. C:\Users\Цеци\AppData\Roaming\mozilla\Firefox\Profiles\649yaraw.default\extensions\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}\defaults folder moved successfully. C:\Users\Цеци\AppData\Roaming\mozilla\Firefox\Profiles\649yaraw.default\extensions\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}\components folder moved successfully. C:\Users\Цеци\AppData\Roaming\mozilla\Firefox\Profiles\649yaraw.default\extensions\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}\chrome folder moved successfully. C:\Users\Цеци\AppData\Roaming\mozilla\Firefox\Profiles\649yaraw.default\extensions\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} folder moved successfully. Registry value HKEY_USERS\S-1-5-21-213642539-3441712944-2455257314-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found. C:\Users\Цеци\AppData\Local\Conduit\CT1750559 folder moved successfully. C:\Users\Цеци\AppData\Local\Conduit folder moved successfully. C:\Users\Цеци\AppData\Roaming\OpenCandy\OpenCandy_F775CD70EC2D448DA7C21E6039DB3131 folder moved successfully. C:\Users\Цеци\AppData\Roaming\OpenCandy folder moved successfully. ========== COMMANDS ========== [EMPTYTEMP] User: &5F8 User: All Users User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Public User: Цеци ->Temp folder emptied: 1289160795 bytes ->Temporary Internet Files folder emptied: 115021510 bytes ->Java cache emptied: 0 bytes ->FireFox cache emptied: 917617206 bytes ->Opera cache emptied: 17083058 bytes ->Flash cache emptied: 9906 bytes User: ╓хЎш %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 697 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32 (64bit) .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 1160493795 bytes %systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 387860 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 3 338,00 mb OTL by OldTimer - Version 3.2.33.2 log created on 02252012_165147

26 февруари 201214 г.

Изглежда наред. Мисля, че успяхме да премахнем туулбара и освободихме близо 4 GB ненужни файлове. Наблюдавате ли някакви проблеми от горе-споменатите при създаването на темата ?

27 февруари 201214 г.

Автор

Като,че ли всичко е наред.Благодаря Ви.

27 февруари 201214 г.

Деинсталирайте OTL:

Стартирайте OTL още веднъж и натиснете бутона CleanUp.

Ще последва рестарт на Windows.

Съгласете се. След рестарта изтрийте ръчно всички инструменти и логове, които не са се изтрили при гореспоменатите процедури.

Обновете и всички програми със Secunia Personal Inspector

Поздрави и приятен ден!

Добре дошли!

След инсталация на bs player,не мога да премахна bs player toolbar [РЕШЕН]

Featured Replies

Архивирана тема

Разглеждащи това в момента 0

Дарение

Бюлетин

Профил

Навигация

Търсене

Конфигуриране на push известия в браузъра

Chrome (Android)

Chrome (Desktop)

Safari (iOS 16.4+)

Safari (macOS)

Edge (Android)

Edge (Desktop)

Firefox (Android)

Firefox (Desktop)