Така..!Положението е ок..!

Архивирай папката C:\Qoobox\Quarantine => и я качи на този адрес => http://file.bg/

Копирай линка за download в следващия си пост за да я изтеглим.

След това..:

Деинсталирайте Комбофикс така:

1.Натиснете Start ==> Run ==> въведете командата Combofix /Uninstall ==> OK

2.Изтеглете OTCleanIt или от тук,стартирайте и натиснете

Деинсталирай/изтрий всички програмки, фиксове,папки и логове които използвахме в темата (които са останали след горните процедури).Препоръчвам да си оставиш Malwarebytes' Anti-Malware и перодически да сканираш с нея.Все пак не забравяй че това не е антивирусна програма.

И за финал искам контролен лог от:

• Изтеглете DDS (създаден от sUBs) от BleepingComputer.
• След изтегляне на инструмента е необходимо да бъде запаметен (чрез менюто File => Save As...) на вашия работен плот.

  

• След като изтеглите DDS на вашия работен плот, иконката на програмата би трябвало да изглежда по този начин:
• Прекратете временно защитата в реално време на антивирусния ви софтуер. След това стартирайте DDS с двоен клик на иконката, като потвърдите намерението си с кликане върху бутона Run.
• След приключване на работата на DDS, ще се появят два текстови файла в Notepad, наречени: DDS.txt и Attach.txt и ги запазете (чрез менюто File => Save As...) на вашия работен плот.Копирайте и поставете съдържанието на DDS.txt и Attach.txt директно във вашата тема. Моля, не ги прикачвайте!

Мерси много за усилията!!!!!без вашата помощ нямаше да се справя!1 огромно БЛАГОДАРЯ!!!желая ви успешна борба с вирусите.живи и здрави! опс...имало още работа.... а аз бързам да бягам.....

Последното става бързо,искам да хвърля един бърз поглед,да не сме пропуснали нещо..!

DDS (Ver_2011-09-30.01) - NTFS_x86 Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_29 Run by kalin2 at 20:29:39 on 2012-04-05 Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.39.1040.18.3325.2073 [GMT 2:00] . AV: avast! Antivirus *Disabled/Outdated* {C37D8F93-0602-E43C-40AA-47DAD597F308} SP: avast! Antivirus *Disabled/Outdated* {781C6E77-2038-EBB2-7A1A-7CA8AE10B9B5} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . ============== Running Processes ================ . C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\nvvsvc.exe C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe C:\Windows\system32\SLsvc.exe C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe C:\Windows\system32\nvvsvc.exe C:\Program Files\Alwil Software\Avast5\AvastSvc.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\RtHDVCpl.exe C:\Program Files\Packard Bell\GOOGLE_EULA\EULALauncher.exe C:\Program Files\Packard Bell\FIJI\ABoard.exe C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe C:\Program Files\Logitech\QuickCam\Quickcam.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\NVIDIA Corporation\Display\nvtray.exe C:\Program Files\BearShare Applications\MediaBar\Datamngr\datamngrUI.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\Program Files\HP\HP Software Update\hpwuschd2.exe C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe C:\Program Files\Alwil Software\Avast5\AvastUI.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\FirefoxPreloader\FirefoxPreloader.exe C:\Windows\System32\spoolsv.exe C:\Windows\system32\taskeng.exe C:\Windows\system32\taskeng.exe C:\Program Files\Packard Bell\FIJI\AOSD.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe C:\Program Files\Common Files\Motive\McciCMService.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\WUDFHost.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Windows\servicing\TrustedInstaller.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\system32\conime.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k rpcss C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k GPSvcGroup C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Windows\System32\svchost.exe -k HPZ12 C:\Windows\System32\svchost.exe -k HPZ12 C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Windows\system32\svchost.exe -k imgsvc C:\Windows\System32\svchost.exe -k WerSvcGroup C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation . ============== Pseudo HJT Report =============== . uStart Page = hxxp://www.yandex.ru/?clid=133922 uSearchURL,(Default) = hxxp://www.google.com/search/?q=%s BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - <orphaned> BHO: Supporto di collegamento per Adobe PDF Reader: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll BHO: Babylon toolbar helper: {2EECD738-5844-4a99-B4B6-146BF802613B} - c:\program files\babylontoolbar\babylontoolbar\1.4.31.2\bh\BabylonToolbar.dll BHO: UrlHelper Class: {74322BF9-DF26-493f-B0DA-6D2FC5E6429E} - c:\program files\bearshare applications\mediabar\datamngr\IEBHO.dll BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: Skype Browser Helper: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll BHO: MediaBar: {c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c} - c:\program files\bearshare applications\mediabar\datamngr\toolbar\bsdtxmltbpi.dll BHO: CBrowserHelperObject Object: {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\program files\google\google_bae\BAE.dll BHO: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files\microsoft\bingbar\7.1.361.0\BingExt.dll BHO: Nero Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre6\bin\jp2ssv.dll TB: Nero Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - TB: MediaBar: {c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c} - c:\program files\bearshare applications\mediabar\datamngr\toolbar\bsdtxmltbpi.dll TB: Babylon Toolbar: {98889811-442D-49dd-99D7-DC866BE87DBC} - c:\program files\babylontoolbar\babylontoolbar\1.4.31.2\BabylonToolbarTlbr.dll TB: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} - uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe uRun: [skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized mRun: [RtHDVCpl] RtHDVCpl.exe mRun: [toolbar_eula_launcher] c:\program files\packard bell\google_eula\EULALauncher.exe mRun: [ACTIVBOARD] c:\program files\packard bell\fiji\aboard.exe mRun: [LogitechCommunicationsManager] "c:\program files\common files\logishrd\lcommgr\Communications_Helper.exe" mRun: [LogitechQuickCamRibbon] "c:\program files\logitech\quickcam\Quickcam.exe" /hide mRun: [WinampAgent] "c:\program files\winamp\winampa.exe" mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe" mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe" mRun: [DATAMNGR] c:\progra~1\bearsh~1\mediabar\datamngr\DATAMN~1.EXE mRun: [Google Desktop Search] "c:\program files\google\google desktop search\GoogleDesktop.exe" /startup mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe" mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe mRun: [Microsoft Default Manager] "c:\program files\microsoft\search enhancement pack\default manager\DefMgr.exe" -resume mRun: [Malwarebytes' Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray mRun: [avast5] c:\progra~1\alwils~1\avast5\avastUI.exe /nogui StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\firefo~1.lnk - c:\program files\firefoxpreloader\FirefoxPreloader.exe uPolicies-Explorer: NoDriveTypeAutoRun = dword:145 uPolicies-Explorer: NoDrives = dword:0 mPolicies-Explorer: BindDirectlyToPropertySetStorage = dword:0 mPolicies-Explorer: NoDrives = dword:0 mPolicies-System: EnableUIADesktopToggle = dword:0 IE: Add to AMV/AVI Video Converter... - c:\program files\media player utilities 4.29\amvconverter\grab.html IE: Free YouTube Download - c:\users\kalin2\appdata\roaming\dvdvideosoftiehelpers\freeyoutubedownload.htm IE: Free YouTube to MP3 Converter - c:\users\kalin2\appdata\roaming\dvdvideosoftiehelpers\freeyoutubetomp3converter.htm IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab TCP: NameServer = 192.168.178.1 TCP: Interfaces\{036B74BB-4E8C-47E9-BEE9-87F58B783959} : DHCPNameServer = 192.168.178.1 Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll LSA: Security Packages = kerberos msv1_0 schannel wdigest tspkg . ================= FIREFOX =================== . FF - ProfilePath - c:\users\kalin2\appdata\roaming\mozilla\firefox\profiles\i6nqjf42.default\ FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2851640&SearchSource=3&q={searchTerms} FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ FF - prefs.js: keyword.URL - hxxp://dts.search-results.com/sr?src=ffb&appid=330&systemid=2&q= FF - component: c:\program files\bearshare applications\mediabar\datamngr\firefoxextension\components\DataMngrHlpFF3.dll FF - component: c:\program files\mozilla firefox\extensions\{82af8dca-6de9-405d-bd5e-43525bdad38a}\components\SkypeFfComponent.dll FF - component: c:\users\kalin2\appdata\roaming\mozilla\firefox\profiles\i6nqjf42.default\extensions\[email protected]\components\RadioWMPCoreGecko19.dll FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll FF - plugin: c:\program files\google\update\1.3.21.111\npGoogleUpdate3.dll FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll FF - plugin: c:\program files\microsoft silverlight\4.1.10111.0\npctrlui.dll FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll FF - plugin: c:\program files\mozilla firefox\plugins\npwachk.dll FF - plugin: c:\program files\nvidia corporation\3d vision\npnv3dv.dll FF - plugin: c:\program files\nvidia corporation\3d vision\npnv3dvstreaming.dll FF - plugin: c:\users\kalin2\appdata\locallow\unity\webplayer\loader\npUnity3D32.dll . ---- FIREFOX POLICIES ---- FF - user.js: yahoo.ytff.general.dontshowhpoffer - true . ============= SERVICES / DRIVERS =============== . R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2012-4-5 164048] R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2012-4-5 19024] R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2012-4-5 51792] R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast5\AvastSvc.exe [2012-4-5 40384] R2 ezSharedSvc;Easybits Shared Services for Windows;c:\windows\system32\svchost.exe -k netsvcs [2008-1-21 21504] R2 FontCache;Servizio cache tipi di carattere Windows;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-21 21504] R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2012-4-4 652360] R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\nvidia corporation\nvidia updatus\daemonu.exe [2011-9-24 2255464] R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\nvidia corporation\3d vision\nvSCPAPISvr.exe [2011-8-3 379496] R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-4-4 20464] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 gupdate;Servizio di Google Update (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-2-6 135664] S3 avast! Mail Scanner;avast! Mail Scanner;c:\program files\alwil software\avast5\AvastSvc.exe [2012-4-5 40384] S3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast5\AvastSvc.exe [2012-4-5 40384] S3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys [2010-5-26 14216] S3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys [2010-5-26 8456] S3 gupdatem;Servizio Google Update (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-2-6 135664] S3 TrojanKillerDriver;GridinSoft Trojan Killer Driver;c:\windows\system32\drivers\gtkdrv.sys [2012-1-4 16128] S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504] . =============== Created Last 30 ================ . 2012-04-05 16:02:39 51792 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys 2012-04-05 15:31:22 -------- d-----w- C:\TDSSKiller_Quarantine 2012-04-04 19:37:26 -------- d-----w- c:\program files\AVAST Software 2012-04-04 17:39:47 20464 ----a-w- c:\windows\system32\drivers\mbam.sys 2012-04-04 17:39:47 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2012-04-04 17:20:20 6582328 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{c9529a31-529b-463f-a87d-d2731727336a}\mpengine.dll 2012-04-04 16:42:16 -------- d-----w- c:\users\kalin2\appdata\local\temp 2012-04-04 16:36:15 -------- d-sh--w- C:\$RECYCLE.BIN 2012-04-02 17:40:24 -------- d-----w- c:\program files\GridinSoft Trojan Killer 2012-04-02 15:25:04 -------- d-----w- c:\program files\Lavalys 2012-03-30 17:25:25 592824 ----a-w- c:\program files\mozilla firefox\gkmedias.dll 2012-03-30 17:25:24 44472 ----a-w- c:\program files\mozilla firefox\mozglue.dll 2012-03-13 19:34:36 2044416 ----a-w- c:\windows\system32\win32k.sys 2012-03-13 19:34:26 1068544 ----a-w- c:\windows\system32\DWrite.dll 2012-03-13 19:34:25 219648 ----a-w- c:\windows\system32\d3d10_1core.dll 2012-03-13 19:34:25 1172480 ----a-w- c:\windows\system32\d3d10warp.dll 2012-03-13 19:34:24 683008 ----a-w- c:\windows\system32\d2d1.dll 2012-03-13 19:34:23 160768 ----a-w- c:\windows\system32\d3d10_1.dll 2012-03-13 19:33:51 2409784 ----a-w- c:\program files\windows mail\OESpamFilter.dat 2012-03-13 19:27:22 613376 ----a-w- c:\windows\system32\rdpencom.dll 2012-03-13 19:27:21 180736 ----a-w- c:\windows\system32\drivers\rdpwd.sys . ==================== Find3M ==================== . 2012-02-23 08:18:36 237072 ------w- c:\windows\system32\MpSigStub.exe . ============= FINISH: 20.29.59,92 =============== видя ли линка за карантината,защото го бях постнал а сега не го виждам в коментара си...?

Като изключим някои друг toolbar за премахване нещата изглеждт супер...!

видя ли линка за карантината,защото го бях постнал а сега не го виждам в коментара си...?

Да аз го махнах умишлено с цел безопастност.....за да не се зарази някй друг ако го изтегли..!

значи да считаме че всичко е наред!благодаря ти много за усилията,старанието и изгубеното време!желая на теб и колегите ти приятна и успешна работа!ще следя форума ви и да се надяваме да не ме нападне подобен ДЗВЕР ......

Благодаря..!Пожелавам ви безопасен интернет и всичко най-добро...!Лека вечер...!

Здравейте

Аз имам същия проблем , като колегата knelly и искам да попитам дали да следвам стъпките , които си посочил на него или за мен проблема ще се реши по друг начин. аз съм с windows 7 home premium.

Следвайте тези тема => Системата ми е инфектирана - Какво да правя сега? и си отворете нова такава. Не пишете в чужди теми.

Тази се затваря!