Виждам много остатъци от антивирусен софтуер.Докато оглеждам дневниците почистете системата с помоща на тази програма:

Изтеглете AppRemover и го запазете на вашия десктоп.

Стартирате програмата:

Next >> Уверете се ще е маркиран "Remove Security Application"

Next >> AppRemover ще сканира всички приложения, свързани със сигурността на вашия компютър.

Маркирайте всички приложения които са излишни и си оставете само действащите...и кликате Next>> два пъти.

Следвайте допълнителните инструкциите на екрана. Ако поиска рестарт, моля направете го.

Току що направих всичко обяснено. За жалост ми прихвана само Avira free antivirus.

Направете бекъп на регистрите.Изтеглете програмата ERUNT,инсталирате и стартирате програмата,избирате папка за съхранение,в секцията Backup options,трябва да бъдат маркирани "System registry" , "Current user registry" и "Other open user registries",натискате "Ok" и потвърждавате създаването на папка.

Описание с картинки на ERUNT: тук

• Отворете notepad и с copy/paste въведете следната информация:

Windows Registry Editor Version 5.00

"netsvcs"=hex(7):41,00,65,00,4c,00,6f,00,6f,00,6b,00,75,00,70,00,53,00,76,00,\
  63,00,00,00,43,00,65,00,72,00,74,00,50,00,72,00,6f,00,70,00,53,00,76,00,63,\
  00,00,00,53,00,43,00,50,00,6f,00,6c,00,69,00,63,00,79,00,53,00,76,00,63,00,\
  00,00,6c,00,61,00,6e,00,6d,00,61,00,6e,00,73,00,65,00,72,00,76,00,65,00,72,\
  00,00,00,67,00,70,00,73,00,76,00,63,00,00,00,49,00,4b,00,45,00,45,00,58,00,\
  54,00,00,00,41,00,75,00,64,00,69,00,6f,00,53,00,72,00,76,00,00,00,46,00,61,\
  00,73,00,74,00,55,00,73,00,65,00,72,00,53,00,77,00,69,00,74,00,63,00,68,00,\
  69,00,6e,00,67,00,43,00,6f,00,6d,00,70,00,61,00,74,00,69,00,62,00,69,00,6c,\
  00,69,00,74,00,79,00,00,00,49,00,61,00,73,00,00,00,49,00,72,00,6d,00,6f,00,\
  6e,00,00,00,4e,00,6c,00,61,00,00,00,4e,00,74,00,6d,00,73,00,73,00,76,00,63,\
  00,00,00,4e,00,57,00,43,00,57,00,6f,00,72,00,6b,00,73,00,74,00,61,00,74,00,\
  69,00,6f,00,6e,00,00,00,4e,00,77,00,73,00,61,00,70,00,61,00,67,00,65,00,6e,\
  00,74,00,00,00,52,00,61,00,73,00,61,00,75,00,74,00,6f,00,00,00,52,00,61,00,\
  73,00,6d,00,61,00,6e,00,00,00,52,00,65,00,6d,00,6f,00,74,00,65,00,61,00,63,\
  00,63,00,65,00,73,00,73,00,00,00,53,00,45,00,4e,00,53,00,00,00,53,00,68,00,\
  61,00,72,00,65,00,64,00,61,00,63,00,63,00,65,00,73,00,73,00,00,00,53,00,52,\
  00,53,00,65,00,72,00,76,00,69,00,63,00,65,00,00,00,54,00,61,00,70,00,69,00,\
  73,00,72,00,76,00,00,00,57,00,6d,00,69,00,00,00,57,00,6d,00,64,00,6d,00,50,\
  00,6d,00,53,00,70,00,00,00,54,00,65,00,72,00,6d,00,53,00,65,00,72,00,76,00,\
  69,00,63,00,65,00,00,00,77,00,75,00,61,00,75,00,73,00,65,00,72,00,76,00,00,\
  00,42,00,49,00,54,00,53,00,00,00,53,00,68,00,65,00,6c,00,6c,00,48,00,57,00,\
  44,00,65,00,74,00,65,00,63,00,74,00,69,00,6f,00,6e,00,00,00,4c,00,6f,00,67,\
  00,6f,00,6e,00,48,00,6f,00,75,00,72,00,73,00,00,00,50,00,43,00,41,00,75,00,\
  64,00,69,00,74,00,00,00,68,00,65,00,6c,00,70,00,73,00,76,00,63,00,00,00,75,\
  00,70,00,6c,00,6f,00,61,00,64,00,6d,00,67,00,72,00,00,00,69,00,70,00,68,00,\
  6c,00,70,00,73,00,76,00,63,00,00,00,73,00,65,00,63,00,6c,00,6f,00,67,00,6f,\
  00,6e,00,00,00,41,00,70,00,70,00,49,00,6e,00,66,00,6f,00,00,00,6d,00,73,00,\
  69,00,73,00,63,00,73,00,69,00,00,00,4d,00,4d,00,43,00,53,00,53,00,00,00,77,\
  00,65,00,72,00,63,00,70,00,6c,00,73,00,75,00,70,00,70,00,6f,00,72,00,74,00,\
  00,00,45,00,61,00,70,00,48,00,6f,00,73,00,74,00,00,00,50,00,72,00,6f,00,66,\
  00,53,00,76,00,63,00,00,00,73,00,63,00,68,00,65,00,64,00,75,00,6c,00,65,00,\
  00,00,68,00,6b,00,6d,00,73,00,76,00,63,00,00,00,53,00,65,00,73,00,73,00,69,\
  00,6f,00,6e,00,45,00,6e,00,76,00,00,00,77,00,69,00,6e,00,6d,00,67,00,6d,00,\
  74,00,00,00,62,00,72,00,6f,00,77,00,73,00,65,00,72,00,00,00,54,00,68,00,65,\
  00,6d,00,65,00,73,00,00,00,42,00,44,00,45,00,53,00,56,00,43,00,00,00,41,00,\
  70,00,70,00,4d,00,67,00,6d,00,74,00,00,00,00,00

• Запазете файла с името fix.reg.
• Файла трябва да изглежда така -
• Стартирайте го и изберете YES на диалоговия прозорец.
• Рестартирайте компютъра си.

Стартирайте отново OTL, копирайте (Copy) и поставете (Paste) скриптовия текст от текстовото поле по-долу под колонката Custom Scans/Fixes, като не забравяте да копирате скрипта 1 към 1, както и двете точки преди първия ред на скрипта.

:OTL
O2 - BHO: (vShare Toolbar) - {043C5167-00BB-4324-AF7E-62013FAEDACF} - C:\Program Files (x86)\vShare\vshare_toolbar.dll ()
O3:[b]64bit:[/b] - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll File not found
O3:[b]64bit:[/b] - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (vShare Toolbar) - {043C5167-00BB-4324-AF7E-62013FAEDACF} - C:\Program Files (x86)\vShare\vshare_toolbar.dll ()
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKU\S-1-5-21-3004673125-4064137327-4027703221-1001\..\Toolbar\WebBrowser: (vShare Toolbar) - {043C5167-00BB-4324-AF7E-62013FAEDACF} - C:\Program Files (x86)\vShare\vshare_toolbar.dll ()
O3:[b]64bit:[/b] - HKU\S-1-5-21-3004673125-4064137327-4027703221-1001\..\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll File not found
O4:[b]64bit:[/b] - HKLM..\Run: [SpywareTerminatorShield] C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorShield.exe File not found
O4:[b]64bit:[/b] - HKLM..\Run: [SpywareTerminatorUpdater] C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe File not found
O4 - HKLM..\Run: [SNM] C:\Program Files (x86)\SpyNoMore\SNM.exe /startup File not found
O33 - MountPoints2\{0304913d-3cbd-11df-a666-001f16caae36}\Shell - "" = AutoRun
O33 - MountPoints2\{0304913d-3cbd-11df-a666-001f16caae36}\Shell\AutoRun\command - "" = H:\Installer.exe
O33 - MountPoints2\{e1c241c6-f1d2-11de-a3bf-001f16caae36}\Shell - "" = AutoRun
O33 - MountPoints2\{e1c241c6-f1d2-11de-a3bf-001f16caae36}\Shell\AutoRun\command - "" = F:\Autorun.exe
O33 - MountPoints2\{e4f568f2-0f73-11df-9652-001f16caae36}\Shell - "" = AutoRun
O33 - MountPoints2\{e4f568f2-0f73-11df-9652-001f16caae36}\Shell\AutoRun\command - "" = G:\autorun.exe
O33 - MountPoints2\{f6f42014-e96b-11de-8b1c-001f16caae36}\Shell - "" = AutoRun
O33 - MountPoints2\{f6f42014-e96b-11de-8b1c-001f16caae36}\Shell\AutoRun\command - "" = G:\autoplay.exe
[2012/03/09 15:12:10 | 000,000,000 | -HS- | M] () -- C:\Windows\SysNative\dds_log_trash.cmd
[2012/03/10 00:55:01 | 000,000,000 | -HS- | C] () -- C:\Windows\SysNative\dds_log_ad13.cmd
[2012/03/06 01:23:38 | 000,079,974 | ---- | M] () -- C:\TDSSKiller.2.7.19.0_06.03.2012_01.14.15_log.txt
[2012/03/14 19:13:25 | 000,079,298 | ---- | M] () -- C:\TDSSKiller.2.7.20.0_14.03.2012_19.11.32_log.txt
[2012/03/18 17:31:47 | 000,002,632 | -HS- | M] ()[b] Unable to obtain MD5[/b] -- C:\Windows\assembly\tmp\loader.tlb
[2012/03/03 08:46:37 | 000,002,048 | ---- | M] ()[b] Unable to obtain MD5[/b] -- C:\Windows\assembly\tmp\{1B372133-BFFA-4dba-9CCF-5474BED6A9F6}
[2012/03/18 17:31:41 | 000,002,048 | ---- | M] () MD5=B2AB84C354B5073ECA81824C635A8B50 -- C:\Windows\assembly\tmp\U\00000001.@
[2012/03/05 22:59:36 | 000,002,560 | ---- | M] () MD5=2D631E826FBD4CB4D133463D4324661D -- C:\Windows\assembly\tmp\U\000000c0.@
[2012/03/18 17:31:42 | 000,003,072 | ---- | M] () MD5=FE025E8778D66459F3519B8F0199E92C -- C:\Windows\assembly\tmp\U\000000cb.@
[2012/03/18 17:31:41 | 000,001,536 | ---- | M] () MD5=641D61902AE96341113C5C023984B719 -- C:\Windows\assembly\tmp\U\000000cf.@
[2012/03/10 00:55:01 | 000,061,952 | ---- | M] () MD5=A25F0B5125F5C2605AFE6DE4B879AE4C -- C:\Windows\assembly\tmp\U\80000000.@
[2012/03/18 17:31:43 | 000,093,696 | ---- | M] () MD5=459D7EA0728C20A264FAF252D678D8B7 -- C:\Windows\assembly\tmp\U\800000c0.@
[2012/03/18 17:31:42 | 000,023,040 | ---- | M] () MD5=F3FB23B537F584DCB9A5BB94B581A77C -- C:\Windows\assembly\tmp\U\800000cb.@
[2012/03/18 17:31:41 | 000,036,352 | ---- | M] () MD5=C933ADFC290398C091D0A77A66C69355 -- C:\Windows\assembly\tmp\U\800000cf.@
[2012/03/18 17:31:43 | 000,035,328 | -HS- | M] ()[b] Unable to obtain MD5[/b] -- C:\Windows\assembly\GAC_32\Desktop.ini
[2012/03/18 17:31:43 | 000,048,128 | -HS- | M] ()[b] Unable to obtain MD5[/b] -- C:\Windows\assembly\GAC_64\Desktop.ini
@Alternate Data Stream - 85 bytes -> C:\ProgramData:$SS_DESCRIPTOR_MVPUV9PFSVXJKX69UK1CWPP0DTVNYKM1UVXPJCEPP4DMJ3K1XYE7LRJEM53EPPJCFLPXB564BPLBB5N14D0B8F0LFUTVLJVMVFVV14TE
@Alternate Data Stream - 85 bytes -> C:\ProgramData:$SS_DESCRIPTOR_LVVWVBGV0VFBTLX4D06YH7LVUTPXGJMBKE1R0WT1VH7E24F7PHCTVF4VMVFVVX4VM
@Alternate Data Stream - 140 bytes -> C:\ProgramData\Temp:30FD0CBD
@Alternate Data Stream - 138 bytes -> C:\ProgramData\Temp:5D7E5A8F
@Alternate Data Stream - 133 bytes -> C:\ProgramData\Temp:93DE1838
@Alternate Data Stream - 132 bytes -> C:\ProgramData\Temp:4D066AD2
@Alternate Data Stream - 129 bytes -> C:\ProgramData\Temp:1D32EC29
@Alternate Data Stream - 127 bytes -> C:\ProgramData\Temp:430C6D84
@Alternate Data Stream - 122 bytes -> C:\ProgramData\Temp:ABE89FFE
@Alternate Data Stream - 118 bytes -> C:\ProgramData\Temp:4CF61E54
@Alternate Data Stream - 109 bytes -> C:\ProgramData\Temp:DFC5A2B2

:Reg

:files

autorun.inf /alldrives
autorun.exe /alldrives
recycler /alldrives
ipconfig /flushdns /c

:Commands
[purity]
[emptytemp]
[resethosts]
[clearallrestorepoints]
[emptyflash]
[Reboot]

След като въведете скрипта от цитата по-горе натиснете бутона, маркиран в червено: Run Fix

Windows ще се рестартира и ще се създаде лог файл. Публикувайте съдържанието му с Copy/Paste в следващия си коментар.

All processes killed

========== OTL ==========

Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{043C5167-00BB-4324-AF7E-62013FAEDACF}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{043C5167-00BB-4324-AF7E-62013FAEDACF}\ deleted successfully.

C:\Program Files (x86)\vShare\vshare_toolbar.dll moved successfully.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{043C5167-00BB-4324-AF7E-62013FAEDACF} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{043C5167-00BB-4324-AF7E-62013FAEDACF}\ not found.

File C:\Program Files (x86)\vShare\vshare_toolbar.dll not found.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.

Registry value HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{21FA44EF-376D-4D53-9B0F-8A89D3229068} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{21FA44EF-376D-4D53-9B0F-8A89D3229068}\ not found.

Registry value HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\ not found.

Registry value HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{21FA44EF-376D-4D53-9B0F-8A89D3229068} not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{21FA44EF-376D-4D53-9B0F-8A89D3229068}\ not found.

Registry value HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\ not found.

Registry value HKEY_USERS\S-1-5-21-3004673125-4064137327-4027703221-1001\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{043C5167-00BB-4324-AF7E-62013FAEDACF} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{043C5167-00BB-4324-AF7E-62013FAEDACF}\ not found.

File C:\Program Files (x86)\vShare\vshare_toolbar.dll not found.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\SNM deleted successfully.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0304913d-3cbd-11df-a666-001f16caae36}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0304913d-3cbd-11df-a666-001f16caae36}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0304913d-3cbd-11df-a666-001f16caae36}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0304913d-3cbd-11df-a666-001f16caae36}\ not found.

File H:\Installer.exe not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e1c241c6-f1d2-11de-a3bf-001f16caae36}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e1c241c6-f1d2-11de-a3bf-001f16caae36}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e1c241c6-f1d2-11de-a3bf-001f16caae36}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e1c241c6-f1d2-11de-a3bf-001f16caae36}\ not found.

File F:\Autorun.exe not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e4f568f2-0f73-11df-9652-001f16caae36}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e4f568f2-0f73-11df-9652-001f16caae36}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e4f568f2-0f73-11df-9652-001f16caae36}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e4f568f2-0f73-11df-9652-001f16caae36}\ not found.

File G:\autorun.exe not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f6f42014-e96b-11de-8b1c-001f16caae36}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f6f42014-e96b-11de-8b1c-001f16caae36}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f6f42014-e96b-11de-8b1c-001f16caae36}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f6f42014-e96b-11de-8b1c-001f16caae36}\ not found.

File G:\autoplay.exe not found.

C:\Windows\SysNative\dds_log_trash.cmd moved successfully.

C:\Windows\SysNative\dds_log_ad13.cmd moved successfully.

C:\TDSSKiller.2.7.19.0_06.03.2012_01.14.15_log.txt moved successfully.

C:\TDSSKiller.2.7.20.0_14.03.2012_19.11.32_log.txt moved successfully.

C:\Windows\assembly\tmp\loader.tlb moved successfully.

C:\Windows\assembly\tmp\{1B372133-BFFA-4dba-9CCF-5474BED6A9F6} moved successfully.

C:\Windows\assembly\tmp\U\00000001.@ moved successfully.

C:\Windows\assembly\tmp\U\000000c0.@ moved successfully.

C:\Windows\assembly\tmp\U\000000cb.@ moved successfully.

C:\Windows\assembly\tmp\U\000000cf.@ moved successfully.

C:\Windows\assembly\tmp\U\80000000.@ moved successfully.

C:\Windows\assembly\tmp\U\800000c0.@ moved successfully.

C:\Windows\assembly\tmp\U\800000cb.@ moved successfully.

C:\Windows\assembly\tmp\U\800000cf.@ moved successfully.

C:\Windows\assembly\GAC_32\Desktop.ini moved successfully.

C:\Windows\assembly\GAC_64\Desktop.ini moved successfully.

ADS C:\ProgramData:$SS_DESCRIPTOR_MVPUV9PFSVXJKX69UK1CWPP0DTVNYKM1UVXPJCEPP4DMJ3K1XYE7LRJEM53EPPJCFLPXB564BPLBB5N14D0B8F0LFUTVLJVMVFVV14TE deleted successfully.

ADS C:\ProgramData:$SS_DESCRIPTOR_LVVWVBGV0VFBTLX4D06YH7LVUTPXGJMBKE1R0WT1VH7E24F7PHCTVF4VMVFVVX4VM deleted successfully.

ADS C:\ProgramData\Temp:30FD0CBD deleted successfully.

ADS C:\ProgramData\Temp:5D7E5A8F deleted successfully.

ADS C:\ProgramData\Temp:93DE1838 deleted successfully.

ADS C:\ProgramData\Temp:4D066AD2 deleted successfully.

ADS C:\ProgramData\Temp:1D32EC29 deleted successfully.

ADS C:\ProgramData\Temp:430C6D84 deleted successfully.

ADS C:\ProgramData\Temp:ABE89FFE deleted successfully.

ADS C:\ProgramData\Temp:4CF61E54 deleted successfully.

ADS C:\ProgramData\Temp:DFC5A2B2 deleted successfully.

========== REGISTRY ==========

========== FILES ==========

autorun.inf not found in C:\

autorun.exe not found in C:\

recycler not found in C:\

< ipconfig /flushdns /c >

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

C:\Users\DULO BULGAR\Downloads\cmd.bat deleted successfully.

C:\Users\DULO BULGAR\Downloads\cmd.txt deleted successfully.

========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: ANTIVIRUS

->Temp folder emptied: 41589 bytes

->Temporary Internet Files folder emptied: 4198406 bytes

->Flash cache emptied: 57035 bytes

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

->Flash cache emptied: 56504 bytes

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

->Flash cache emptied: 0 bytes

User: DULO BULGAR

->Temp folder emptied: 266882751 bytes

->Temporary Internet Files folder emptied: 4634056 bytes

->Java cache emptied: 10947662 bytes

->FireFox cache emptied: 19103066 bytes

->Google Chrome cache emptied: 372015640 bytes

->Apple Safari cache emptied: 37457920 bytes

->Flash cache emptied: 68824 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 356352 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32 (64bit) .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 5369750 bytes

%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 81735156 bytes

RecycleBin emptied: 0 bytes

Total Files Cleaned = 766.00 mb

C:\Windows\System32\drivers\etc\Hosts moved successfully.

HOSTS file reset successfully

Restore point Set: OTL Restore Point

[EMPTYFLASH]

User: All Users

User: ANTIVIRUS

->Flash cache emptied: 0 bytes

User: Default

->Flash cache emptied: 0 bytes

User: Default User

->Flash cache emptied: 0 bytes

User: DULO BULGAR

->Flash cache emptied: 0 bytes

User: Public

Total Flash Files Cleaned = 0.00 mb

OTL by OldTimer - Version 3.2.39.1 log created on 03182012_223511

Files\Folders moved on Reboot...

C:\Users\DULO BULGAR\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

C:\Windows\temp\{E9C1E1AC-C9B2-4c85-94DE-9C1518918D02}.tlb moved successfully.

C:\Windows\temp\{E9C1E1AC-C9B2-4c85-94DE-9C1518918D12}.tlb moved successfully.

Registry entries deleted on Reboot...

Изтрийте вашето копие на Комбофикс (като изтриете иконата от вашия десктоп)...изтеглете ново свежо копие от тук или тук и го запазете на десктопа си.Направете нова проверка по инструкцията в пост 6.

Най-накрая успях да го подкарам този комбофикс

ComboFix.txt

Моля, не прикачвайте лог файла/овете от програмата, а го/ги копирайте и поставете в следващия Ви коментар в тази тема.

ComboFix 12-03-17.01 - DULO BULGAR 03.2012 г. 22:53:08.1.2 - x64

Microsoft Windows 7 Home Premium 6.1.7601.1.1251.359.1033.18.4025.2559 [GMT 2:00]

Running from: c:\users\DULO BULGAR\Desktop\ComboFix.exe

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\program files (x86)\Common Files\Acer GameZone online.ico

c:\users\DULO BULGAR\AppData\Roaming\.#

c:\users\DULO BULGAR\AppData\Roaming\.#\MBX@17C@1E62770.###

c:\users\DULO BULGAR\AppData\Roaming\.#\MBX@17C@1E627A0.###

c:\windows\assembly\tmp\U

c:\windows\iun6002.exe

c:\windows\system32\consrv.dll

c:\windows\system32\dlacdbhm.dll

c:\windows\system32\service.dll

c:\windows\system32\ShockMgr.dll

c:\windows\SysWow64\windrv.sys

.

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

-------\Service_RkHit

-------\Service_A88xEnc

-------\Service_a8djusb

-------\Service_SfCtlCom

.

.

((((((((((((((((((((((((( Files Created from 2012-02-18 to 2012-03-18 )))))))))))))))))))))))))))))))

.

.

2012-03-18 20:28 . 2012-03-18 20:28 -------- d-----w- c:\program files (x86)\ERUNT

2012-03-18 13:27 . 2012-03-18 13:27 -------- d-----w- c:\program files (x86)\Veetle

2012-03-17 12:44 . 2011-11-19 15:20 5559152 ----a-w- c:\windows\system32\ntoskrnl.exe

2012-03-17 12:44 . 2011-11-19 14:50 3968368 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe

2012-03-17 12:44 . 2011-11-19 14:50 3913584 ----a-w- c:\windows\SysWow64\ntoskrnl.exe

2012-03-16 21:40 . 2012-02-03 04:34 3145728 ----a-w- c:\windows\system32\win32k.sys

2012-03-16 21:40 . 2012-02-10 06:36 1544192 ----a-w- c:\windows\system32\DWrite.dll

2012-03-16 21:40 . 2012-02-10 05:38 1077248 ----a-w- c:\windows\SysWow64\DWrite.dll

2012-03-16 21:40 . 2012-01-25 06:38 77312 ----a-w- c:\windows\system32\rdpwsx.dll

2012-03-16 21:40 . 2012-01-25 06:38 149504 ----a-w- c:\windows\system32\rdpcorekmts.dll

2012-03-16 21:40 . 2012-01-25 06:33 9216 ----a-w- c:\windows\system32\rdrmemptylst.exe

2012-03-16 21:39 . 2012-02-17 06:38 1031680 ----a-w- c:\windows\system32\rdpcore.dll

2012-03-16 21:39 . 2012-02-17 05:34 826880 ----a-w- c:\windows\SysWow64\rdpcore.dll

2012-03-16 21:39 . 2012-02-17 04:58 210944 ----a-w- c:\windows\system32\drivers\rdpwd.sys

2012-03-16 21:39 . 2012-02-17 04:57 23552 ----a-w- c:\windows\system32\drivers\tdtcp.sys

2012-03-14 17:24 . 2012-03-14 17:24 -------- d-----w- c:\program files\AVAST Software

2012-03-14 14:20 . 2012-03-15 07:54 -------- d-----w- c:\program files (x86)\Common Files\Java

2012-03-14 12:15 . 2012-03-15 07:56 -------- d-----w- c:\program files (x86)\SopCast

2012-03-14 00:54 . 2012-03-15 07:56 -------- d-----w- c:\users\DULO BULGAR\AppData\Roaming\WindSolutions

2012-03-14 00:54 . 2012-03-14 01:02 -------- d-----w- c:\programdata\WindSolutions

2012-03-12 00:36 . 2012-03-17 02:15 -------- d-----w- c:\users\ANTIVIRUS

2012-03-06 18:11 . 2012-03-07 04:31 -------- d-----w- c:\program files\CCleaner

2012-03-06 18:10 . 2012-03-07 04:30 -------- d-----w- c:\users\DULO BULGAR\CCleaner Business Edition

2012-03-06 15:31 . 2012-03-15 07:56 -------- d-----w- c:\program files (x86)\Kaspersky Lab

2012-03-06 15:31 . 2012-03-06 18:12 -------- d-----w- c:\programdata\Kaspersky Lab

2012-03-06 15:04 . 2012-03-06 15:04 -------- d--h--w- c:\programdata\Common Files

2012-03-06 15:02 . 2012-03-07 04:31 -------- d-----w- c:\programdata\MFAData

2012-03-06 13:10 . 2012-03-06 15:27 -------- d-----w- c:\program files\SUPERAntiSpyware

2012-03-06 00:40 . 2012-03-15 07:55 -------- d-----w- c:\users\DULO BULGAR\AppData\Roaming\Malwarebytes

2012-03-06 00:39 . 2012-03-06 00:39 -------- d-----w- c:\programdata\Malwarebytes

2012-03-06 00:39 . 2012-03-07 04:31 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware

2012-03-06 00:39 . 2011-12-10 13:24 23152 ----a-w- c:\windows\system32\drivers\mbam.sys

2012-03-06 00:25 . 2012-03-06 00:25 51496 ----a-w- c:\windows\system32\drivers\stflt.sys

2012-03-05 23:16 . 2012-03-05 23:16 -------- d-----w- C:\TDSSKiller_Quarantine

2012-03-05 22:52 . 2011-12-15 13:00 27760 ----a-w- c:\windows\system32\drivers\avkmgr.sys

2012-03-05 22:52 . 2011-12-15 13:00 130760 ----a-w- c:\windows\system32\drivers\avipbb.sys

2012-03-05 22:52 . 2011-12-15 13:00 97312 ----a-w- c:\windows\system32\drivers\avgntflt.sys

2012-03-05 22:52 . 2012-03-17 02:14 -------- d-----w- c:\programdata\Avira

2012-03-05 22:52 . 2012-03-17 02:14 -------- d-----w- c:\program files (x86)\Avira

2012-03-05 22:40 . 2012-03-05 23:23 -------- d-----w- c:\users\DULO BULGAR\AppData\Roaming\DC++

2012-03-05 22:40 . 2012-03-05 22:40 -------- d-----w- c:\users\DULO BULGAR\AppData\Local\DC++

2012-03-05 18:28 . 2012-03-05 22:38 -------- d-----w- c:\program files (x86)\DC++

2012-03-05 05:48 . 2012-03-05 05:48 -------- d-----w- c:\programdata\AVAST Software

2012-03-05 05:20 . 2012-03-05 05:20 91313 ----a-w- c:\programdata\1330924809.bdinstall.bin

2012-03-05 05:04 . 2012-03-05 23:24 -------- d-----w- c:\program files (x86)\Common Files\PC Tools

2012-03-05 05:04 . 2012-01-11 14:19 230952 ----a-w- c:\windows\system32\drivers\PCTSD64.sys

2012-03-05 05:04 . 2012-03-05 05:21 -------- d-----w- c:\programdata\PC Tools

2012-03-05 05:04 . 2012-03-05 05:04 -------- d-----w- c:\users\DULO BULGAR\AppData\Roaming\TestApp

2012-03-03 07:01 . 2012-03-03 07:01 -------- d-sh--w- c:\windows\system32\%APPDATA%

2012-03-03 06:45 . 2012-03-05 19:02 -------- d-sh--w- c:\users\DULO BULGAR\AppData\Local\4bacaecd

2012-03-02 22:41 . 2012-03-02 22:41 11776 ----a-w- c:\program files (x86)\Mozilla Firefox\plugins\nprjplug.dll

2012-03-02 22:41 . 2012-03-02 22:41 -------- d-----w- c:\program files (x86)\Common Files\xing shared

2012-03-02 22:41 . 2012-03-02 22:41 150696 ----a-w- c:\program files (x86)\Mozilla Firefox\plugins\nppl3260.dll

2012-03-02 22:41 . 2012-03-02 22:41 108544 ----a-w- c:\program files (x86)\Mozilla Firefox\plugins\nprpjplug.dll

2012-03-01 17:11 . 2012-03-06 06:57 -------- d-----w- c:\programdata\CanonIJ

2012-03-01 17:09 . 2012-03-01 17:10 -------- d-----w- c:\users\DULO BULGAR\AppData\Roaming\Canon

.

.

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-03-14 14:19 . 2010-06-10 20:56 472808 ----a-w- c:\windows\SysWow64\deployJava1.dll

2012-03-03 23:53 . 2011-08-08 19:30 414368 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2012-02-03 13:09 . 2011-09-01 09:15 544552 ----a-w- c:\windows\system32\drivers\avckf.sys

2012-01-04 10:44 . 2012-02-16 00:02 509952 ----a-w- c:\windows\system32\ntshrui.dll

2012-01-04 08:58 . 2012-02-16 00:02 442880 ----a-w- c:\windows\SysWow64\ntshrui.dll

2011-12-30 06:26 . 2012-02-15 23:32 515584 ----a-w- c:\windows\system32\timedate.cpl

2011-12-30 05:27 . 2012-02-15 23:32 478720 ----a-w- c:\windows\SysWow64\timedate.cpl

2011-12-28 03:59 . 2012-02-15 23:31 498688 ----a-w- c:\windows\system32\drivers\afd.sys

.

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"uTorrent"="c:\program files (x86)\uTorrent\uTorrent.exe" [2012-02-23 740216]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"BackupManagerTray"="c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe" [2009-08-21 261888]

"LManager"="c:\program files (x86)\Launch Manager\LManager.exe" [2009-08-27 1194504]

"ArcadeDeluxeAgent"="c:\program files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe" [2009-08-01 128296]

"PlayMovie"="c:\program files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe" [2009-08-05 181480]

"SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]

"AdobeCS5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-02-22 406992]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]

"ArcSoft Connection Service"="c:\program files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-10-27 207424]

"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-09-27 59240]

"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2011-10-09 421736]

"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2011-10-24 421888]

"CanonSolutionMenuEx"="c:\program files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE" [2010-04-02 1185112]

"TkBellExe"="c:\program files (x86)\real\realplayer\Update\realsched.exe" [2012-03-02 296056]

"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-01-13 460872]

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"{91120000-002F-0000-0000-0000000FF1CE}"="c:\windows\system32\cmd.exe" [2010-11-20 302592]

.

c:\users\DULO BULGAR\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

ERUNT AutoBackup.lnk - c:\program files (x86)\ERUNT\AUTOBACK.EXE [2005-10-20 38912]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Adobe Gamma Loader.lnk - c:\program files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2010-7-16 113664]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]

"aux"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp

.

R2 AntiVirSchedulerService;Avira Scheduler;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2011-12-15 86224]

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\x86\ekrn.exe [x]

R2 gupdate1ca79c9886949e2;Услуга Google Update (gupdate1ca79c9886949e2);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2009-12-10 133104]

R2 UPDATESRV;BitDefender Desktop Update Service;c:\program files\Bitdefender\Bitdefender 2012\updatesrv.exe [x]

R3 gupdatem;Услуга на Google Актуализация (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2009-12-10 133104]

R3 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [2009-06-18 50432]

R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\System32\Drivers\RtsUStor.sys [x]

R3 RtsUIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys [x]

R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]

R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]

R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]

R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]

S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [x]

S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]

S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]

S2 ePowerSvc;Acer ePower Service;c:\program files\Acer\Acer ePower Management\ePowerSvc.exe [2009-08-06 844320]

S2 Greg_Service;GRegService;c:\program files (x86)\Acer\Registration\GregHSRW.exe [2009-06-04 1150496]

S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-01-13 652360]

S2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [2009-08-21 62720]

S2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [2009-06-18 144640]

S2 Printer Control;Printer Control;c:\windows\system32\PrintCtrl.exe [x]

S2 Updater Service;Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe [2009-07-04 240160]

S3 IntcHdmiAddService;Intel® High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [x]

S3 k57nd60a;Broadcom NetLink Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys [x]

S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]

S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]

.

.

Contents of the 'Scheduled Tasks' folder

.

2012-03-18 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2009-12-10 18:49]

.

2012-03-18 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2009-12-10 18:49]

.

2012-03-18 c:\windows\Tasks\ParetoLogic Registration.job

- c:\windows\system32\rundll32.exe [2009-07-13 01:14]

.

2012-03-17 c:\windows\Tasks\ParetoLogic Update Version2.job

- c:\program files (x86)\Common Files\ParetoLogic\UUS2\Pareto_Update.exe [2009-01-13 14:59]

.

.

--------- x86-64 -----------

.

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IAAnotif"="c:\program files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-06-05 186904]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-08-06 8060960]

"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2009-05-22 295936]

"PLFSetI"="c:\windows\PLFSetI.exe" [2008-07-30 200704]

"Acer ePower Management"="c:\program files\Acer\Acer ePower Management\ePowerTray.exe" [2009-08-06 828960]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-09-02 159232]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-09-02 380928]

"Persistence"="c:\windows\system32\igfxpers.exe" [2009-09-02 358912]

"LXCCCATS"="c:\windows\system32\spool\DRIVERS\x64\3\LXCCtime.dll" [2007-02-22 28672]

"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208]

"PrintDisp"="c:\windows\system32\PrintDisp.exe" [2011-01-03 976896]

"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2010-03-25 2726728]

"combofix"="c:\combofix\CF7492.3XE" [2010-11-20 345088]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"LoadAppInit_DLLs"=0x0

.

NETSVCS REQUIRES REPAIRS - current entries shown

AeLookupSvc

CertPropSvc

SCPolicySvc

lanmanserver

gpsvc

IKEEXT

AudioSrv

FastUserSwitchingCompatibility

Ias

Irmon

Nla

Ntmssvc

NWCWorkstation

Nwsapagent

Rasauto

Rasman

Remoteaccess

SENS

Sharedaccess

SRService

Tapisrv

Wmi

WmdmPmSp

BsHelpCS

ipcsvc

dcstor32

ZTEusbser6k

USB_RNDIS_XP

p2pgasvc

se2Cnd5

CAMFLT

avsinc

BoiHwsetup

RecAgent

aracpi

cpqalert

SfCtlCom

adsexpb

fa_scheduler

StkScan

jsdaemon

asp.net_1.1.4322

k750mgmt

usrbridg

iclarityqosservice

giveio

scsk4

aexnsclient

dmprimer

pensup

PEVSystemStart

BootScreen

mxserver

nisum

W55U01

ultra66

sisidex

p17xfilt

wpsscannersvc

sonywbms

transarcafsdaemon

z800bus

ngdbserv

awecho

XTrapD12

ups

cq_mem

PDExchange

adobeactivefilemonitor5.0

nvnforce

mcstrm

issuser

contentindex

crauto

viamraid

zpcollector

owstimer

p17

SiS300i

PSSdk21

awlegacy

USBCamera

a8djusb

mod7700

kerbkey

A88xEnc

steamdvr

lxcgcustomerconnect

NWSIPX32

epstnt01

SDdriver

gemserv

dpfusmgr

tdrpman

lsdiorw

SRTSP

tosrfec

ibmfilter

papyjoy

pgpserv

PNDIS5

SE2Cmdfl

smapint

epfw

Accelerometer

asusgsb

enodpl

dlbt_device

TermService

wuauserv

BITS

ShellHWDetection

LogonHours

PCAudit

helpsvc

uploadmgr

iphlpsvc

seclogon

AppInfo

msiscsi

MMCSS

winmgmt

SessionEnv

browser

EapHost

schedule

hkmsvc

wercplsupport

ProfSvc

Themes

BDESVC

.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs

.

.

------- Supplementary Scan -------

.

uStart Page = about:blank

uLocal Page = c:\windows\system32\blank.htm

mStart Page = about:blank

mLocal Page = c:\windows\SysWOW64\blank.htm

IE: &С&валяне &с BitComet - c:\users\DULO BULGAR\Downloads\BitComet_1.18\BitComet.exe/AddLink.htm

IE: &С&валяне на всички видео файлове с BitComet - c:\users\DULO BULGAR\Downloads\BitComet_1.18\BitComet.exe/AddVideo.htm

IE: &С&валяне на всички с BitComet - c:\users\DULO BULGAR\Downloads\BitComet_1.18\BitComet.exe/AddAllLink.htm

IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~2\Office12\EXCEL.EXE/3000

IE: Free YouTube Download - c:\users\DULO BULGAR\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm

IE: Free YouTube to MP3 Converter - c:\users\DULO BULGAR\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm

IE: Google Sidewiki... - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html

IE: Read EXIF - c:\program files (x86)\ArcSoft\RAW Thumbnail Viewer\ArcEXIFM.htm

TCP: DhcpNameServer = 192.168.1.1

FF - ProfilePath - c:\users\DULO BULGAR\AppData\Roaming\Mozilla\Firefox\Profiles\qedtn5js.default\

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - hxxp://plovdiv24.bg/

FF - prefs.js: keyword.URL - hxxp://search.sweetim.com/search.asp?src=2&q=

FF - user.js: general.useragent.extra.brc - BRI/1

.

- - - - ORPHANS REMOVED - - - -

.

URLSearchHooks-{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - (no file)

SafeBoot-68371326.sys

SafeBoot-mcmscsvc

SafeBoot-MCODS

Toolbar-Locked - (no file)

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)

WebBrowser-{BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} - (no file)

HKLM-Run-mwlDaemon - c:\program files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe

HKLM-Run-SpywareTerminatorShield - c:\program files (x86)\Spyware Terminator\SpywareTerminatorShield.exe

HKLM-Run-SpywareTerminatorUpdater - c:\program files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe

AddRemove-Age of Empires 2.0 - c:\users\DULO BULGAR\Saved Games\Age.of.Empires.II.The.Conquerors\\UNINSTAL.EXE

AddRemove-Free Studio_is1 - c:\program files (x86)\Common Files\DVDVideoSoft\Uninstall.exe

AddRemove-Free YouTube to MP3 Converter_is1 - c:\program files (x86)\Common Files\DVDVideoSoft\Uninstall.exe

AddRemove-Landprint Designer from Anvil 3D Mapping - c:\windows\system32\javaws.exe

.

.

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_USERS\.Default\Software\SetId\Internal]

@Denied: (A 2) (LocalSystem)

"DEVICE2"="vcvIsaaxyAA="

"DATA2"="<settings accountStatus=\"4\" oldDevice=\"\" timeDiff=\"1106312873\" expireTime=\"1309830893\" productStatus=\"1\" obSize=\"0\" InstallSTD=\"1289332796\" isSubsc=\"0\" authStat_av=\"0\" version=\"14.1\" keyType=\"194\" prodId=\"3\" moduleId1=\"9\" moduleId2=\"0\" relType=\"1\" />"

.

[HKEY_USERS\S-1-5-21-3004673125-4064137327-4027703221-1001\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]

"??"=hex:79,45,29,a3,05,26,37,a4,51,32,b3,9b,c6,6d,ac,bf,19,c2,fa,e1,68,40,ae,

4d,b5,ac,bb,3b,02,c2,9c,77,fb,e2,07,b4,05,c4,f6,04,e8,5a,2e,fc,7b,4e,d0,10,\

"??"=hex:64,35,ea,00,0f,1a,c0,2a,cb,7e,14,f0,74,d5,57,90

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11f_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11f_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11f.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.10"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11f.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11f.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11f.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

"MSCurrentCountry"=dword:000000b5

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Other Running Processes ------------------------

.

c:\program files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe

c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

c:\program files (x86)\Bonjour\mDNSResponder.exe

c:\program files (x86)\Canon\IJPLM\IJPLMSVC.EXE

c:\windows\SysWOW64\IoctlSvc.exe

c:\program files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe

.

**************************************************************************

.

Completion time: 2012-03-18 23:20:05 - machine was rebooted

ComboFix-quarantined-files.txt 2012-03-18 21:20

.

Pre-Run: 103 209 431 040 bytes free

Post-Run: 102 884 917 248 bytes free

.

- - End Of File - - 7542989237D56B9FF276EA0F215CE7D9

Супер...мисля за тази вечер да спираме..!Много се уморих .....утре към обяд ще продължим..!Лека вечер..!

Сърдечно благодаря! Приятна вечер!

Редактирано 18 март 201214 г. от marinious (преглед на промените)

• Отворете notepad и с copy/paste въведете следната информация:

Windows Registry Editor Version 5.00

"netsvcs"=hex(7):41,00,65,00,4c,00,6f,00,6f,00,6b,00,75,00,70,00,53,00,76,00,\
  63,00,00,00,43,00,65,00,72,00,74,00,50,00,72,00,6f,00,70,00,53,00,76,00,63,\
  00,00,00,53,00,43,00,50,00,6f,00,6c,00,69,00,63,00,79,00,53,00,76,00,63,00,\
  00,00,6c,00,61,00,6e,00,6d,00,61,00,6e,00,73,00,65,00,72,00,76,00,65,00,72,\
  00,00,00,67,00,70,00,73,00,76,00,63,00,00,00,49,00,4b,00,45,00,45,00,58,00,\
  54,00,00,00,41,00,75,00,64,00,69,00,6f,00,53,00,72,00,76,00,00,00,46,00,61,\
  00,73,00,74,00,55,00,73,00,65,00,72,00,53,00,77,00,69,00,74,00,63,00,68,00,\
  69,00,6e,00,67,00,43,00,6f,00,6d,00,70,00,61,00,74,00,69,00,62,00,69,00,6c,\
  00,69,00,74,00,79,00,00,00,49,00,61,00,73,00,00,00,49,00,72,00,6d,00,6f,00,\
  6e,00,00,00,4e,00,6c,00,61,00,00,00,4e,00,74,00,6d,00,73,00,73,00,76,00,63,\
  00,00,00,4e,00,57,00,43,00,57,00,6f,00,72,00,6b,00,73,00,74,00,61,00,74,00,\
  69,00,6f,00,6e,00,00,00,4e,00,77,00,73,00,61,00,70,00,61,00,67,00,65,00,6e,\
  00,74,00,00,00,52,00,61,00,73,00,61,00,75,00,74,00,6f,00,00,00,52,00,61,00,\
  73,00,6d,00,61,00,6e,00,00,00,52,00,65,00,6d,00,6f,00,74,00,65,00,61,00,63,\
  00,63,00,65,00,73,00,73,00,00,00,53,00,45,00,4e,00,53,00,00,00,53,00,68,00,\
  61,00,72,00,65,00,64,00,61,00,63,00,63,00,65,00,73,00,73,00,00,00,53,00,52,\
  00,53,00,65,00,72,00,76,00,69,00,63,00,65,00,00,00,54,00,61,00,70,00,69,00,\
  73,00,72,00,76,00,00,00,57,00,6d,00,69,00,00,00,57,00,6d,00,64,00,6d,00,50,\
  00,6d,00,53,00,70,00,00,00,54,00,65,00,72,00,6d,00,53,00,65,00,72,00,76,00,\
  69,00,63,00,65,00,00,00,77,00,75,00,61,00,75,00,73,00,65,00,72,00,76,00,00,\
  00,42,00,49,00,54,00,53,00,00,00,53,00,68,00,65,00,6c,00,6c,00,48,00,57,00,\
  44,00,65,00,74,00,65,00,63,00,74,00,69,00,6f,00,6e,00,00,00,4c,00,6f,00,67,\
  00,6f,00,6e,00,48,00,6f,00,75,00,72,00,73,00,00,00,50,00,43,00,41,00,75,00,\
  64,00,69,00,74,00,00,00,68,00,65,00,6c,00,70,00,73,00,76,00,63,00,00,00,75,\
  00,70,00,6c,00,6f,00,61,00,64,00,6d,00,67,00,72,00,00,00,69,00,70,00,68,00,\
  6c,00,70,00,73,00,76,00,63,00,00,00,73,00,65,00,63,00,6c,00,6f,00,67,00,6f,\
  00,6e,00,00,00,41,00,70,00,70,00,49,00,6e,00,66,00,6f,00,00,00,6d,00,73,00,\
  69,00,73,00,63,00,73,00,69,00,00,00,4d,00,4d,00,43,00,53,00,53,00,00,00,77,\
  00,65,00,72,00,63,00,70,00,6c,00,73,00,75,00,70,00,70,00,6f,00,72,00,74,00,\
  00,00,45,00,61,00,70,00,48,00,6f,00,73,00,74,00,00,00,50,00,72,00,6f,00,66,\
  00,53,00,76,00,63,00,00,00,73,00,63,00,68,00,65,00,64,00,75,00,6c,00,65,00,\
  00,00,68,00,6b,00,6d,00,73,00,76,00,63,00,00,00,53,00,65,00,73,00,73,00,69,\
  00,6f,00,6e,00,45,00,6e,00,76,00,00,00,77,00,69,00,6e,00,6d,00,67,00,6d,00,\
  74,00,00,00,62,00,72,00,6f,00,77,00,73,00,65,00,72,00,00,00,54,00,68,00,65,\
  00,6d,00,65,00,73,00,00,00,42,00,44,00,45,00,53,00,56,00,43,00,00,00,41,00,\
  70,00,70,00,4d,00,67,00,6d,00,74,00,00,00,00,00

• Запазете файла с името fix.reg.
• Файла трябва да изглежда така -
• Стартирайте го и изберете YES на диалоговия прозорец.
• Рестартирайте компютъра си.

За да почистите остатъците отAvira използвайте този инструмент: Avira RegistryCleaner

Копирайте текста в карето на notepad и го запазвате с име CFScript.txt на десктопа си:

KILLALL::

ClearJavaCache::

File::
c:\programdata\1330924809.bdinstall.bin
c:\program files\ESET\ESET Smart Security\x86\ekrn.exe
c:\program files\Bitdefender\Bitdefender 2012\updatesrv.exe


Folder::
c:\program files\AVAST Software
c:\program files (x86)\Kaspersky Lab
c:\programdata\Kaspersky Lab
C:\TDSSKiller_Quarantine
c:\programdata\AVAST Software

Driver::
ekrn
UPDATESRV

След съхранението преместете CFScript.txt на иконата на ComboFix.exe

Генерирания рапорт прикачете в следващия си пост..!

Заповядайте. Извинявам се, че го прикачам като файл, но беше прекалено дълго за да го сложа като текст.

ComboFix.txt

Всички препоръки от поста ли ми изпълнихте..?

Абсолютно от началото до края. Когато сканирах за премахването на Аваст обаче се махнаха доста регистри, но останаха около 10, които не искат да се махнат.

Абсолютно от началото до края. Когато сканирах за премахването на Аваст обаче се махнаха доста регистри, но останаха около 10, които не искат да се махнат.

Имате впредвид Avira....?

Питам защото виждам че два пъти се опитвам да поправя NETSVCS ..и двата пъти неуспешно..и се питам защо..!!!

Копирайте текста в карето на notepad и го запазвате с име CFScript.txt на десктопа си:

KILLALL::

File::
c:\windows\system32\drivers\avkmgr.sys
c:\windows\system32\drivers\avipbb.sys
c:\windows\system32\drivers\avgntflt.sys
c:\program files (x86)\Avira\AntiVir Desktop\sched.exe

Folder::
c:\programdata\Avira
c:\program files (x86)\Avira

Driver::
AntiVirSchedulerService

NetSvc::
AeLookupSvc
CertPropSvc
SCPolicySvc
lanmanserver
gpsvc
IKEEXT
AudioSrv
FastUserSwitchingCompatibility
Ias
Irmon
Nla
Ntmssvc
NWCWorkstation
Nwsapagent
Rasauto
Rasman
Remoteaccess
SENS
Sharedaccess
SRService
Tapisrv
Wmi
WmdmPmSp
BsHelpCS
ipcsvc
dcstor32
ZTEusbser6k
USB_RNDIS_XP
p2pgasvc
se2Cnd5
CAMFLT
avsinc
BoiHwsetup
RecAgent
aracpi
cpqalert
SfCtlCom
adsexpb
fa_scheduler
StkScan
jsdaemon
asp.net_1.1.4322
k750mgmt
usrbridg
iclarityqosservice
giveio
scsk4
aexnsclient
dmprimer
pensup
PEVSystemStart
BootScreen
mxserver
nisum
W55U01
ultra66
sisidex
p17xfilt
wpsscannersvc
sonywbms
transarcafsdaemon
z800bus
ngdbserv
awecho
XTrapD12
ups
cq_mem
PDExchange
adobeactivefilemonitor5.0
nvnforce
mcstrm
issuser
contentindex
crauto
viamraid
zpcollector
owstimer
p17
SiS300i
PSSdk21
awlegacy
USBCamera
a8djusb
mod7700
kerbkey
A88xEnc
steamdvr
lxcgcustomerconnect
NWSIPX32
epstnt01
SDdriver
gemserv
dpfusmgr
tdrpman
lsdiorw
SRTSP
tosrfec
ibmfilter
papyjoy
pgpserv
PNDIS5
SE2Cmdfl
smapint
epfw
Accelerometer
asusgsb
enodpl
dlbt_device
TermService
wuauserv
BITS
ShellHWDetection
LogonHours
PCAudit
helpsvc
uploadmgr
iphlpsvc
seclogon
AppInfo
msiscsi
MMCSS
winmgmt
SessionEnv
browser
EapHost
schedule
hkmsvc
wercplsupport
ProfSvc
Themes
BDESVC

След съхранението преместете CFScript.txt на иконата на ComboFix.exe

Генерирания рапорт прикачете в следващия си пост..!