Премини към съдържанието
Форумът в приложение

По-лесно сърфиране. Научи повече.
Kaldata.com - Форуми

Приложение на форума на цял екран с push известия, значки и други.

За да инсталирате това приложение на iOS и iPadOS
  1. Докоснете Иконата за споделяне в Safari
  2. Превъртете менюто и докоснете Добавяне към началния екран.
  3. Докоснете Добавяне в горния десен ъгъл.
За да инсталирате това приложение на Android
  1. Докоснете менюто с 3 точки (⋮) в горния десен ъгъл на браузъра.
  2. Докоснете Добавяне към началния екран или Инсталиране на приложение.
  3. Потвърдете, като докоснете Инсталиране.
Добави Kaldata.com в предпочитани източници в Google

Добре дошли!

Добре дошли в нашите форуми, пълни с полезна информация. Имате проблем с компютъра или телефона си? Публикувайте нова тема и ще намерите решение на всичките си проблеми. Общувайте свободно и открийте безброй нови приятели.

Моля, регистрирайте се за да публикувате тема и да получите пълен достъп до всички функции.

 

имам вирус и съм убеден ,че е Sality

Carrie_
в Премахване на зловреден софтуер

Featured Replies

Здравейте,преди малко осъзнах,че имам вирус , който ми махна анти-вирусната програма , а дори не ми показва и task manager-a с надписа ( task manager has been disable by your administrator ).Опитах се да истегля HiJackThis , не се става ,ясно вируса прави тази бъркотия.Истеглих DDS както пишеше в инструкциите , но накрая се сайфна само DDS.txt. опитах няколко пъти , но все същото.В една статия срещнах същия проблем като моя , за това написах ,че е Satily ,тъй като проблема там беше именно същия. ето , информацията от DDS.txt DDS (Ver_2011-09-30.01) - NTFS_x86 Internet Explorer: 8.0.6001.18702 Run by CGI at 11:27:49 on 2012-05-04 Microsoft Windows XP Professional 5.1.2600.3.1251.359.1033.18.511.29 [GMT 3:00] . AV: AntiVir Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7} . ============== Running Processes ================ . C:\WINXP\system32\nvsvc32.exe C:\WINXP\Explorer.EXE C:\WINXP\system32\spoolsv.exe C:\Program Files\Avira\AntiVir Desktop\sched.exe C:\Program Files\Application Updater\ApplicationUpdater.exe C:\WINXP\RTHDCPL.EXE C:\WINXP\system32\RUNDLL32.EXE C:\WINXP\domino.exe C:\WINXP\VMSnap1.exe C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe C:\WINXP\system32\ctfmon.exe C:\Program Files\Pando Networks\Media Booster\PMB.exe C:\Program Files\Skype\Phone\Skype.exe C:\Documents and Settings\CGI\Local Settings\Application Data\Google\Update\1.3.21.111\GoogleCrashHandler.exe C:\DOCUME~1\CGI\LOCALS~1\Temp\sqigv.exe C:\WINXP\Datecs\Flex2K.exe C:\Documents and Settings\CGI\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Documents and Settings\CGI\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Documents and Settings\CGI\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Documents and Settings\CGI\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Documents and Settings\CGI\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\WINXP\system32\wbem\wmiprvse.exe C:\WINXP\System32\svchost.exe -k netsvcs C:\WINXP\system32\svchost.exe -k NetworkService C:\WINXP\system32\svchost.exe -k LocalService C:\WINXP\system32\svchost.exe -k LocalService C:\WINXP\system32\svchost.exe -k imgsvc . ============== Pseudo HJT Report =============== . uStart Page = hxxp://search.babylon.com/?babsrc=HP_Prot uURLSearchHooks: YouTube Downloader Toolbar: {F3FEE66E-E034-436a-86E4-9690573BEE8A} - c:\program files\youtube downloader toolbar\ie\5.6\youtubedownloaderToolbarIE.dll BHO: YouTube Downloader Toolbar: {F3FEE66E-E034-436a-86E4-9690573BEE8A} - c:\program files\youtube downloader toolbar\ie\5.6\youtubedownloaderToolbarIE.dll TB: Babylon Toolbar: {98889811-442D-49dd-99D7-DC866BE87DBC} - TB: Funmoods Toolbar: {A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3} - c:\program files\funmoods\funmoods\1.5.11.1\funmoodsTlbr.dll TB: YouTube Downloader Toolbar: {F3FEE66E-E034-436a-86E4-9690573BEE8A} - c:\program files\youtube downloader toolbar\ie\5.6\youtubedownloaderToolbarIE.dll uRun: [DAEMON Tools Lite] "c:\program files\daemon tools lite\DTLite.exe" -autorun uRun: [ctfmon.exe] c:\winxp\system32\ctfmon.exe uRun: [Google Update] "c:\documents and settings\cgi\local settings\application data\google\update\GoogleUpdate.exe" /c uRun: [Pando Media Booster] c:\program files\pando networks\media booster\PMB.exe uRun: [skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized uRun: [CursorXP] "c:\program files\cursorxp\CursorXP.exe" -s mRun: [RTHDCPL] RTHDCPL.EXE mRun: [Alcmtr] ALCMTR.EXE mRun: [NvMediaCenter] RUNDLL32.EXE c:\winxp\system32\NvMcTray.dll,NvTaskbarInit mRun: [NvCplDaemon] RUNDLL32.EXE c:\winxp\system32\NvCpl.dll,NvStartup mRun: [nwiz] c:\program files\nvidia corporation\nview\nwiz.exe /installquiet mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min mRun: [domino] c:\winxp\domino.exe mRun: [VMSnap1] c:\winxp\VMSnap1.exe mRun: [searchSettings] "c:\program files\common files\spigot\search settings\SearchSettings.exe" dRun: [CTFMON.EXE] c:\winxp\system32\CTFMON.EXE StartupFolder: c:\docume~1\cgi\startm~1\programs\startup\regist~2.lnk - e:\games\heroes5\registrationa1\RegistrationReminder.exe StartupFolder: c:\docume~1\cgi\startm~1\programs\startup\regist~1.lnk - e:\games\heroes5\registration\RegistrationReminder.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\flexty~1.lnk - c:\winxp\datecs\Flex2K.exe uPolicies-Explorer: NoDriveTypeAutoRun = dword:145 uPolicies-System: DisableTaskMgr = dword:1 uPolicies-System: DisableRegistryTools = dword:1 mPolicies-System: EnableLUA = dword:0 mPolicies-Explorer: NoDriveTypeAutoRun = dword:145 IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000 IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} - hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab TCP: Interfaces\{A625CEA9-55F8-4EC6-A310-D5B97AB62425} : NameServer = 87.120.16.1 87.120.16.2 SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\winxp\system32\wpdshserviceobj.dll Hosts: 173.212.255.178 embedded.garena.com Hosts: 173.212.255.178 embedded.garenanow.com . ================= FIREFOX =================== . FF - ProfilePath - c:\documents and settings\cgi\application data\mozilla\firefox\profiles\phlg1102.default\ FF - prefs.js: browser.startup.homepage - hxxp://start.funmoods.com/?f=1&a=ironto FF - prefs.js: browser.search.selectedEngine - Yahoo FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=937811&p= FF - plugin: c:\documents and settings\cgi\local settings\application data\google\update\1.3.21.99\npGoogleUpdate3.dll FF - plugin: c:\program files\pando networks\media booster\npPandoWebPlugin.dll . ---- FIREFOX POLICIES ---- FF - user.js: extensions.BabylonToolbar_i.id - cc4a2f5d000000000000005345000000 FF - user.js: extensions.BabylonToolbar_i.hardId - cc4a2f5d000000000000005345000000 FF - user.js: extensions.BabylonToolbar_i.instlDay - 15305 FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17 FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17 FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.1720:57:18 FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar FF - user.js: extensions.BabylonToolbar_i.aflt - babsst FF - user.js: extensions.BabylonToolbar_i.smplGrp - none FF - user.js: extensions.BabylonToolbar_i.tlbrId - base FF - user.js: extensions.BabylonToolbar_i.newTab - false FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=101240 FF - user.js: extensions.BabylonToolbar_i.babExt - FF - user.js: extensions.BabylonToolbar_i.srcExt - ss FF - user.js: extensions.BabylonToolbar_i.instlRef - sst FF - user.js: extensions.funmoods_i.hmpg - true FF - user.js: extensions.funmoods_i.hmpgUrl - hxxp://start.funmoods.com/?f=1&a=ironto FF - user.js: extensions.funmoods_i.dfltSrch - true FF - user.js: extensions.funmoods_i.srchPrvdr - Search FF - user.js: extensions.funmoods_i.dnsErr - true FF - user.js: extensions.funmoods_i.newTab - true FF - user.js: extensions.funmoods_i.newTabUrl - hxxp://start.funmoods.com/?f=2&a=ironto FF - user.js: extensions.funmoods_i.tlbrSrchUrl - hxxp://start.funmoods.com/results.php?f=3&a=ironto&q= FF - user.js: extensions.funmoods_i.id - cc4a2f5d000000000000005345000000 FF - user.js: extensions.funmoods_i.instlDay - 15362 FF - user.js: extensions.funmoods_i.vrsn - 1.5.11.1 FF - user.js: extensions.funmoods_i.vrsni - 1.5.11.1 FF - user.js: extensions.funmoods_i.vrsnTs - 1.5.11.123:45:04 FF - user.js: extensions.funmoods_i.prtnrId - funmoods FF - user.js: extensions.funmoods_i.prdct - funmoods FF - user.js: extensions.funmoods_i.aflt - ironto FF - user.js: extensions.funmoods_i.smplGrp - none FF - user.js: extensions.funmoods_i.tlbrId - base FF - user.js: extensions.funmoods_i.instlRef - FF - user.js: extensions.funmoods_i.dfltLng - FF - user.js: extensions.funmoods_i.excTlbr - false . ============= SERVICES / DRIVERS =============== . R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2011-4-2 11608] R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\winxp\system32\drivers\dtsoftbus01.sys [2011-4-3 218688] R2 avgntflt;avgntflt;c:\winxp\system32\drivers\avgntflt.sys [2011-4-2 66616] R3 abp470n5;abp470n5;\??\c:\winxp\system32\drivers\ejgnhq.sys --> c:\winxp\system32\drivers\ejgnhq.sys [?] S3 GGSAFERDriver;GGSAFER Driver;\??\c:\program files\garena plus\room\safedrv.sys --> c:\program files\garena plus\room\safedrv.sys [?] . =============== Created Last 30 ================ . 2012-05-03 15:11:38 -------- d-----w- c:\documents and settings\cgi\application data\Search Settings 2012-05-03 15:11:02 -------- d-----w- c:\program files\Application Updater 2012-05-03 15:10:59 -------- d-----w- c:\program files\YouTube Downloader Toolbar 2012-05-03 15:10:59 -------- d-----w- c:\program files\common files\Spigot 2012-05-02 19:41:21 -------- d-----w- c:\program files\Ventrilo 2012-05-02 19:41:10 -------- d-----w- c:\program files\common files\Wise Installation Wizard . ==================== Find3M ==================== . 2012-03-28 12:36:23 1 ----a-w- c:\winxp\system32\SI.bin 2012-03-27 21:44:28 120320 ----a-w- c:\winxp\system32\drivers\SSHDRV65.sys 2012-03-27 21:43:52 78848 ----a-w- c:\winxp\system32\drivers\SSHDRV85.sys 2012-03-13 09:55:17 139264 ----a-w- c:\winxp\War3Unin.exe 2012-02-20 17:55:44 43520 ----a-w- c:\winxp\system32\CmdLineExt03.dll 2012-02-16 18:53:39 7877 ----a-w- c:\winxp\BricoPackFoldersDelete.cmd 2012-02-16 18:53:38 218624 ----a-w- c:\winxp\system32\uxtheme.dll 2012-02-16 18:53:38 149328 ----a-w- c:\winxp\BricoPackUninst.cmd 2012-02-16 18:14:46 75017 ----a-w- c:\winxp\system32\e62a1057.exe . ============= FINISH: 11:30:31,46 ===============

Мда...

Sality е...

R3 abp470n5;abp470n5;??c:winxpsystem32driversejgnhq.sys --> c:winxpsystem32driversejgnhq.sys [?]

1. Спрете Autorun функцията.

Изтеглете и стартирайте следния файл Публикувано изображение

Стартирайте го и се съгласете с лицензионното споразумение.

Натиснете Next и изчакайте да си свърпи работата.

2. Спрете System Restore функцията.

Щракнете с десен бутон върху My Computer, после следвайте следните стъпки: Properties -> System restore и сложете отметката пред Turn System Restore on all drives. Натиснете Apply.

3. Изтеглете SalityKiller и го запазете на десктопа.

Изключете интернет достъпа и след това сканирайте с него по описания по-надолу начин:

  • Изтеглете SalityKiller и го разархивирайте на десктопа.
  • Отворете Start => Run => въведете командата "%userprofile%desktopsalitykiller" -l c:report.txt
  • Изчакайте проверката да завърши.
  • Публикувайте съдържанието на лог файла C:report.txt в следващия си пост.
  • Автор

за съжаление , когато въведа тази команда за SalityKiller , не иска да я подкара ;( просто ми се показва един черен прозорец за част от секундата и това е ;(

инсталирах , както казахте Microsoft-Fix it , след това ми се рестартира компютъра.Също така сложих отметка на Turn System Restore on all drives и натиснах Аpply

за съжаление , когато въведа тази команда за SalityKiller , не иска да я подкара ;( просто ми се показва един черен прозорец за част от секундата и това е ;(

инсталирах , както казахте Microsoft-Fix it , след това ми се рестартира компютъра.Също така сложих отметка на Turn System Restore on all drives и натиснах Аpply

Разархивирахте ли архива на десктопа преди да въведете командата ?

  • Автор

да , на Desktop-a , 2 файла са , но не разбирам защо не се получава , изключвам и интернет доставчика и все същото ;с когато напиша командата се появява един черен прозорец , който стои около 2-3 секунди и се маха и след това нищо не се случва , в него пише - Virus . Win32.Sality.aa.ae,ag,bh removing tool , Kaspersky Lab 2010 Version 1.3.6.0 Nov 12 2010 10:13:11 scanning threads . . . ето това пише , успех да го screenshotna...

За да преценим има ли смисъл да се борим, да видим какви са щетите нанесени от вируса.

Направете една проверка с Kaspersky Virus Removal Tool 2011

След като стартирате инструмента, отидете до Settings (Иконата, която прилича на звездичка) сложете отметка пред My Computer.

Публикувано изображение

От опциите за почистване изберете Disinfect => но не избирайте delete if disinfection fails.

Публикувано изображение

Върнете се до Automatic Scan и натиснете Start Scanning.

Публикувано изображение

Ако по време на сканирането ви попита за дадено действие изберете skip.

След като приключи проверката изберете Report (Иконата която прилича на листче) => Detected Threats изберете SAVE и запазете документа на десктопа.

Публикувано изображение

Kопирайте съдържанието му в следващия си пост.

Затворете инструмента - това ще до деинсталира автоматично.

  • Автор

Status: Detected (events: 211) 04.5.2012 г. 13:57:06 Detected Trojan program Backdoor.Win32.Mazben.hz c:documents and settingscgilocal settings empwingdihd.exe High 04.5.2012 г. 14:01:07 Detected virus Virus.Win32.Sality.aa c:WINXPAlcmtr.exe High 04.5.2012 г. 14:01:53 Detected virus Virus.Win32.Sality.aa c:Program FilesNVIDIA CorporationnViewnwiz.exe High 04.5.2012 г. 14:02:24 Detected virus Virus.Win32.Sality.aa c:Documents and SettingsCGILocal SettingsApplication DataGoogleUpdateGoogleUpdate.exe High 04.5.2012 г. 14:03:47 Detected virus Virus.Win32.Sality.aa c:Program FilesCursorXPCursorXP.exe High 04.5.2012 г. 14:05:07 Detected Trojan program Trojan.Win32.Genome.afbye c:Program FilesQuestBasicquestbasic.exe High 04.5.2012 г. 14:05:24 Detected adware not-a-virus:AdWare.Win32.OneStep.jko c:Program FilesQuestBasicquestbasic.dll Medium 04.5.2012 г. 14:07:02 Detected virus Virus.Win32.Sality.aa c:Program FilesMicrosoft OfficeOFFICE11EXCEL.EXE High 04.5.2012 г. 14:07:45 Detected virus Virus.Win32.Sality.aa c:Documents and SettingsCGIDesktopComboFix.exe High 04.5.2012 г. 14:08:17 Detected virus Virus.Win32.Sality.aa e:gamesHeroes 3 GoldHEROES3.EXE High 04.5.2012 г. 14:08:32 Detected virus Virus.Win32.Sality.aa c:Program FilesAheadImageDriveImageDrive.exe High 04.5.2012 г. 14:08:59 Detected virus Virus.Win32.Sality.aa c:Program FilesCommon FilesMicrosoft SharedOFFICE11MSOXMLED.EXE High 04.5.2012 г. 14:09:18 Detected virus Virus.Win32.Sality.aa c:Program FilesAheadNeronero.exe High 04.5.2012 г. 14:09:35 Detected virus Virus.Win32.Sality.aa c:Program FilesAheadNero StartSmartNeroStartSmart.exe High 04.5.2012 г. 14:10:43 Detected Trojan program Backdoor.Win32.Mazben.hz c:Documents and SettingsCGILocal SettingsTempwingdihd.exe High 04.5.2012 г. 14:11:30 Detected virus Virus.Win32.Sality.aa e:gamesWarcraft III Frozen Throne eSKFrozen Throne.exe High 04.5.2012 г. 14:11:48 Detected virus Virus.Win32.Sality.aa c:Program FilesTechSmithCamtasia Studio 7CamtasiaStudio.exe High 04.5.2012 г. 14:14:06 Detected virus Virus.Win32.Sality.aa c:program filesmicrosoft officeOFFICE11MSTORE.EXE High 04.5.2012 г. 14:14:14 Detected virus Virus.Win32.Sality.aa c:program filescommon filesmicrosoft sharedOFFICE11MSOXMLED.EXE High 04.5.2012 г. 14:14:18 Detected virus Virus.Win32.Sality.aa c:program filesnvidia corporationnViewnwiz.exe High 04.5.2012 г. 14:14:18 Detected virus Virus.Win32.Sality.aa c:documents and settingsCGIlocal settingsapplication dataGoogleUpdategoogleupdate.exe High 04.5.2012 г. 14:14:22 Detected virus Virus.Win32.Sality.aa c:program filesCursorXPCursorXP.exe High 04.5.2012 г. 14:15:20 Detected Trojan program Trojan.Win32.Genome.afbye c:program filesquestbasicquestbasic.exe High 04.5.2012 г. 14:15:20 Detected adware not-a-virus:AdWare.Win32.OneStep.jko c:program filesquestbasicquestbasic.dll Medium 04.5.2012 г. 14:16:15 Detected virus Virus.Win32.Sality.aa c:program filesAheadimagedriveimagedrive.exe High 04.5.2012 г. 14:16:16 Detected virus Virus.Win32.Sality.aa e:gamesheroes 3 goldHEROES3.EXE High 04.5.2012 г. 14:16:37 Detected virus Virus.Win32.Sality.aa c:program filesAheadNeronero.exe High 04.5.2012 г. 14:16:37 Detected virus Virus.Win32.Sality.aa c:program filesAheadnero startsmartnerostartsmart.exe High 04.5.2012 г. 14:19:01 Detected virus Virus.Win32.Sality.aa C:ComboFixCF21242.3XE High 04.5.2012 г. 14:19:10 Detected virus Virus.Win32.Sality.aa C:ComboFixiexplore.exe High 04.5.2012 г. 14:19:19 Detected virus Virus.Win32.Sality.aa C:ComboFixNirCmd.3XE High 04.5.2012 г. 14:19:19 Detected virus Virus.Win32.Sality.aa C:ComboFixNircmdB.exe High 04.5.2012 г. 14:19:38 Detected virus Virus.Win32.Sality.aa C:ComboFixSF.exe High 04.5.2012 г. 14:19:55 Detected virus Virus.Win32.Sality.aa C:ComboFixWindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe High 04.5.2012 г. 14:19:59 Detected virus Virus.Win32.Sality.aa C:Documents and SettingsAll UsersApplication DataAdobeSetup{AC76BA86-7AD7-1033-7B44-AA0000000001}setup.exe High 04.5.2012 г. 14:21:02 Detected virus Virus.Win32.Sality.aa C:Documents and SettingsAll UsersApplication DataQuestBasicquestbasic114.exe High 04.5.2012 г. 14:21:02 Detected virus Virus.Win32.Sality.aa C:Documents and SettingsAll UsersApplication DataQuestBasicquestbasic115.exe High 04.5.2012 г. 14:22:25 Detected virus Virus.Win32.Sality.aa C:Documents and SettingsCGIApplication Datamc-wowupdate.exe High 04.5.2012 г. 14:27:08 Detected virus Virus.Win32.Sality.aa C:Documents and SettingsCGIDesktopComboFix.exe High 04.5.2012 г. 14:27:17 Detected virus Virus.Win32.Sality.aa C:Documents and SettingsCGILocal SettingsApplication DataAKSoftwareTransBarTransBar.exe High 04.5.2012 г. 14:27:18 Detected virus Virus.Win32.Sality.aa C:Documents and SettingsCGILocal SettingsApplication DataAKSoftwareTransBarUninst.exe High 04.5.2012 г. 14:27:21 Detected virus Virus.Win32.Sality.aa C:Documents and SettingsCGILocal SettingsApplication DataBabylonSetupSetup.exe High 04.5.2012 г. 14:29:42 Detected virus Virus.Win32.Sality.aa C:Documents and SettingsCGILocal SettingsApplication DataGoogleUpdateGoogleUpdate.exe High 04.5.2012 г. 14:29:52 Detected virus Virus.Win32.Sality.aa C:Documents and SettingsCGILocal SettingsApplication DataGoogleUpdateDownload{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}18.0.1025.168chrome_updater.exe High 04.5.2012 г. 14:42:54 Detected virus EICAR-Test-File C:Documents and SettingsCGILocal SettingsTempAv-test.txt High 04.5.2012 г. 14:42:57 Detected Trojan program Backdoor.Win32.Mazben.hz C:Documents and SettingsCGILocal SettingsTempwingdihd.exe High 04.5.2012 г. 14:47:27 Detected virus Virus.Win32.Sality.aa C:Documents and SettingsCGILocal SettingsTempBabylonToolbarBabylonToolbar1.5.3.17BabylonToolbar4ffx.exe High 04.5.2012 г. 14:47:29 Detected virus Virus.Win32.Sality.aa C:Documents and SettingsCGILocal SettingsTempBabylonToolbarBabylonToolbar1.5.3.17BabylonToolbar4ie.exe High 04.5.2012 г. 14:47:42 Detected virus Virus.Win32.Sality.aa C:Documents and SettingsCGILocal SettingsTempD1163051-BAB0-7891-97AE-14D7F3702B8DMyBabylonTB.exe High 04.5.2012 г. 14:47:55 Detected virus Virus.Win32.Sality.aa C:Documents and SettingsCGILocal SettingsTempD1163051-BAB0-7891-97AE-14D7F3702B8DSetup.exe High 04.5.2012 г. 14:48:02 Detected virus Virus.Win32.Sality.aa C:Documents and SettingsCGILocal SettingsTempdicomviewerworkstation.exe High 04.5.2012 г. 14:48:14 Detected virus Virus.Win32.Sality.aa C:Documents and SettingsCGILocal SettingsTempis2063840535setup.exe High 04.5.2012 г. 14:48:16 Detected virus Virus.Win32.Sality.aa C:Documents and SettingsCGILocal SettingsTempnsj48.tmpextrafind9.exe High 04.5.2012 г. 14:48:25 Detected virus Virus.Win32.Sality.aa C:Documents and SettingsCGILocal SettingsTempTeamViewerVersion6 v_w32.exe High 04.5.2012 г. 14:48:31 Detected virus Virus.Win32.Sality.aa C:Documents and SettingsCGILocal SettingsTempTeamViewerVersion6TeamViewer_.exe High 04.5.2012 г. 14:49:17 Detected virus Virus.Win32.Sality.aa C:Documents and SettingsCGILocal SettingsTempTemporary Directory 1 for Intel_INF_V8301013_2kxpvista.zipINFUsb32UpdateUsb.exe High 04.5.2012 г. 14:49:22 Detected virus Virus.Win32.Sality.aa C:Documents and SettingsCGILocal SettingsTempTemporary Directory 1 for Intel_INF_V8301013_2kxpvista.zipINFUsb32USBCopy2.exe High 04.5.2012 г. 14:49:22 Detected virus Virus.Win32.Sality.aa C:Documents and SettingsCGILocal SettingsTempTemporary Directory 1 for Intel_INF_V8301013_2kxpvista.zipINFUsb32USBReg.exe High 04.5.2012 г. 14:49:31 Detected virus Virus.Win32.Sality.aa C:Documents and SettingsCGILocal SettingsTempTemporary Directory 1 for Realtek_2KXP_51005477.zipWDM_R176ChCfg.exe High 04.5.2012 г. 14:49:34 Detected virus Virus.Win32.Sality.aa C:Documents and SettingsCGILocal SettingsTempTemporary Directory 1 for Realtek_2KXP_51005477.zipWDM_R176SetCDfmt.exe High 04.5.2012 г. 14:49:41 Detected virus Virus.Win32.Sality.aa C:Documents and SettingsCGILocal SettingsTempTemporary Directory 1 for Realtek_2KXP_51005477.zipWDM_R176MSHDQFEWin2K3uskb888111srvrtm.exe High 04.5.2012 г. 14:49:42 Detected virus Virus.Win32.Sality.aa C:Documents and SettingsCGILocal SettingsTempTemporary Directory 1 for Realtek_2KXP_51005477.zipWDM_R176MSHDQFEWin2K_XPuskb888111w2ksp4.exe High 04.5.2012 г. 14:49:49 Detected virus Virus.Win32.Sality.aa C:Documents and SettingsCGILocal SettingsTempTemporary Directory 1 for Realtek_2KXP_51005477.zipWDM_R176MSHDQFEWin2K_XPuskb888111xpsp1.exe High 04.5.2012 г. 14:49:49 Detected virus Virus.Win32.Sality.aa C:Documents and SettingsCGILocal SettingsTempTemporary Directory 1 for Realtek_2KXP_51005477.zipWDM_R176MSHDQFEWin2K_XPuskb888111xpsp2.exe High 04.5.2012 г. 14:49:51 Detected virus Virus.Win32.Sality.aa C:Documents and SettingsCGILocal SettingsTempTemporary Directory 1 for Realtek_2KXP_51005477.zipWDM_R176WDMAlcmtr.exe High 04.5.2012 г. 14:50:16 Detected virus Virus.Win32.Sality.aa C:Documents and SettingsCGILocal SettingsTempTemporary Directory 1 for Realtek_2KXP_51005477.zipWDM_R176WDMRtlUpd.exe High 04.5.2012 г. 14:50:19 Detected virus Virus.Win32.Sality.aa C:Documents and SettingsCGILocal SettingsTempTemporary Directory 1 for Realtek_2KXP_51005477.zipWDM_R176WDMSkyTel.exe High 04.5.2012 г. 14:50:21 Detected virus Virus.Win32.Sality.aa C:Documents and SettingsCGILocal SettingsTempTemporary Directory 1 for Realtek_2KXP_51005477.zipWDM_R176WDMSoundMan.exe High 04.5.2012 г. 14:50:24 Detected virus Virus.Win32.Sality.aa C:Documents and SettingsCGILocal SettingsTemp{09EDB4D8-8EDF-419D-AEFE-28D6F0DFAF77}GoogleUpdate.exe High 04.5.2012 г. 14:50:41 Detected virus Virus.Win32.Sality.aa C:Documents and SettingsCGILocal SettingsTemp{7D216634-368F-435B-AED9-BEABDD2614AB}GoogleUpdate.exe High 04.5.2012 г. 14:51:05 Detected virus Virus.Win32.Sality.aa C:Documents and SettingsCGILocal SettingsTemporary Internet FilesContent.IE57WZ8KTJNextrafind9[1].exe High 04.5.2012 г. 14:51:21 Detected Trojan program Trojan-Downloader.SWF.Agent.ej C:Documents and SettingsCGILocal SettingsTemporary Internet FilesContent.IE57WZ8KTJNnb[1].swf//Swf2Swc High 04.5.2012 г. 14:51:22 Detected virus Virus.Win32.Sality.aa C:Documents and SettingsCGILocal SettingsTemporary Internet FilesContent.IE5G9202XPDYouTubeDownloaderSetup35[1].exe High 04.5.2012 г. 14:52:13 Detected Trojan program HEUR:Trojan-Downloader.Script.Generic C:Documents and SettingsCGILocal SettingsTemporary Internet FilesContent.IE5G9202XPDmd[1].htm High 04.5.2012 г. 14:53:10 Detected virus Virus.Win32.Sality.aa C:Documents and SettingsCGILocal SettingsTemporary Internet FilesContent.IE5KWL2LJ2Srkinstaller[1].exe High 04.5.2012 г. 14:53:16 Detected virus Virus.Win32.Sality.aa C:Documents and SettingsCGIMy DocumentsDownloadsdds.exe High 04.5.2012 г. 14:53:35 Detected Trojan program Trojan.JS.Zapchast.es C:Documents and SettingsCGILocal SettingsTemporary Internet FilesContent.IE5T28UM9VOceo1[1].js High 04.5.2012 г. 14:54:00 Detected virus Virus.Win32.Sality.aa C:Documents and SettingsCGILocal SettingsTemporary Internet FilesContent.IE5T28UM9VOrkverify[1].exe High 04.5.2012 г. 14:58:39 Detected virus Virus.Win32.Sality.aa C:Documents and SettingsCGIMy DocumentsDownloadsGarenaUniversalMHv13GarenaUniversalMHv13.exe High 04.5.2012 г. 15:00:11 Detected Trojan program HEUR:Trojan.Win32.Generic C:Documents and SettingsCGIMy DocumentsDownloadsWow_Emu_Hacker_3.3.5+4.0.1Emuhacker 3.3.5.rar//Emuhacker 3.3.5/WowemuHack 3.3.5.exe High 04.5.2012 г. 15:00:25 Detected virus Virus.Win32.Sality.aa C:Documents and SettingsCGIMy DocumentsDownloadsWow_Emu_Hacker_3.3.5+4.0.1GarenaPlus_Install.exe High 04.5.2012 г. 15:00:51 Detected adware not-a-virus:AdWare.Win32.OneStep.jkf C:Documents and SettingsLocalServiceLocal SettingsTemporary Internet FilesContent.IE555183XXCupgrade[1].cab//upgrade.exe//questbasic.dll Medium 04.5.2012 г. 15:01:42 Detected virus Virus.Win32.Sality.aa C:MSOCacheAll Users90000409-6000-11D3-8CFE-0150048383C9FILESPFILESCOMMONMSSHAREDDWDW20.EXE High 04.5.2012 г. 15:01:44 Detected virus Virus.Win32.Sality.aa C:MSOCacheAll Users90000409-6000-11D3-8CFE-0150048383C9FILESPFILESMSOFFICEOFFICE11OFFCLN.EXE High 04.5.2012 г. 15:01:46 Detected virus Virus.Win32.Sality.aa C:NVIDIADisplayDriver266.58WinXPEnglishDisplay.DriverdbInstaller.exe High 04.5.2012 г. 15:01:58 Detected virus Virus.Win32.Sality.aa C:NVIDIADisplayDriver266.58WinXPEnglishDisplay.DriverNvCPLSetupEng.exe High 04.5.2012 г. 15:02:08 Detected virus Virus.Win32.Sality.aa C:NVIDIADisplayDriver266.58WinXPEnglishDisplay.UpdateComUpdatus.exe High 04.5.2012 г. 15:02:12 Detected virus Virus.Win32.Sality.aa C:NVIDIADisplayDriver266.58WinXPEnglishDisplay.Updatedaemonu.exe High 04.5.2012 г. 15:02:13 Detected virus Virus.Win32.Sality.aa C:NVIDIADisplayDriver266.58WinXPEnglishDisplay.Updatenvlhr.exe High 04.5.2012 г. 15:02:29 Detected virus Virus.Win32.Sality.aa C:NVIDIADisplayDriver266.58WinXPEnglishNViewnviewsetup.exe High 04.5.2012 г. 15:02:30 Detected virus Virus.Win32.Sality.aa C:Program Files3DOgameup.exe High 04.5.2012 г. 15:02:35 Detected virus Virus.Win32.Sality.aa C:Program Files3DOSupportSysInfo.exe High 04.5.2012 г. 15:02:36 Detected virus Virus.Win32.Sality.aa C:Program Files3DOSupportsupport.exe High 04.5.2012 г. 15:02:40 Detected virus Virus.Win32.Sality.aa C:Program FilesActivisionCall of Duty 2cod2.exe High 04.5.2012 г. 15:03:30 Detected virus Virus.Win32.Sality.aa C:Program FilesAdobeReader 10.0Readerreader_sl.exe High 04.5.2012 г. 15:04:23 Detected virus Virus.Win32.Sality.aa C:Program FilesAheadImageDriveImageDrive.exe High 04.5.2012 г. 15:04:42 Detected virus Virus.Win32.Sality.aa C:Program FilesAheadNeroNeroCmd.exe High 04.5.2012 г. 15:04:44 Detected virus Virus.Win32.Sality.aa C:Program FilesAheadNeronero.exe High 04.5.2012 г. 15:04:57 Detected virus Virus.Win32.Sality.aa C:Program FilesAheadNeroUninstallUNNero.exe High 04.5.2012 г. 15:05:03 Detected virus Virus.Win32.Sality.aa C:Program FilesAheadNero SoundTraxSoundTrax.exe High 04.5.2012 г. 15:05:04 Detected virus Virus.Win32.Sality.aa C:Program FilesAheadNero ToolkitCDSpeed.exe High 04.5.2012 г. 15:05:05 Detected virus Virus.Win32.Sality.aa C:Program FilesAheadNero StartSmartNeroStartSmart.exe High 04.5.2012 г. 15:05:10 Detected virus Virus.Win32.Sality.aa C:Program FilesAheadNero ToolkitDriveSpeed.exe High 04.5.2012 г. 15:05:15 Detected virus Virus.Win32.Sality.aa C:Program FilesAheadNero Wave EditorDXEnum.exe High 04.5.2012 г. 15:05:18 Detected virus Virus.Win32.Sality.aa C:Program FilesAheadNero Wave EditorWaveEdit.exe High 04.5.2012 г. 15:05:23 Detected virus Virus.Win32.Sality.aa C:Program FilesAudacityaudacity.exe High 04.5.2012 г. 15:08:18 Detected virus Virus.Win32.Sality.aa C:Program FilesCommon FilesAheadLibspecialoffer.exe High 04.5.2012 г. 15:08:22 Detected virus Virus.Win32.Sality.aa C:Program FilesCommon FilesInstallShieldDriver7Intel 32IDriver.exe High 04.5.2012 г. 15:08:26 Detected virus Virus.Win32.Sality.aa C:Program FilesCommon FilesInstallShieldDriver9Intel 32IDriver.exe High 04.5.2012 г. 15:08:35 Detected virus Virus.Win32.Sality.aa C:Program FilesCommon FilesInstallShieldUpdateServiceagent.exe High 04.5.2012 г. 15:08:37 Detected virus Virus.Win32.Sality.aa C:Program FilesCommon FilesMicrosoft SharedDWDW20.EXE High 04.5.2012 г. 15:08:39 Detected virus Virus.Win32.Sality.aa C:Program FilesCommon FilesMicrosoft SharedDWDWTRIG20.EXE High 04.5.2012 г. 15:08:49 Detected virus Virus.Win32.Sality.aa C:Program FilesCommon FilesMicrosoft SharedMSInfoOINFOP11.EXE High 04.5.2012 г. 15:08:50 Detected virus Virus.Win32.Sality.aa C:Program FilesCommon FilesMicrosoft SharedOFFICE11MSOXMLED.EXE High 04.5.2012 г. 15:09:37 Detected virus Virus.Win32.Sality.aa C:Program FilesCommon FilesMicrosoft SharedWeb Components11DFUICOM.EXE High 04.5.2012 г. 15:10:15 Detected virus Virus.Win32.Sality.aa C:Program FilesCursorXPAniUtil.exe High 04.5.2012 г. 15:10:15 Detected virus Virus.Win32.Sality.aa C:Program FilesCursorXPCursorXP.exe High 04.5.2012 г. 15:10:16 Detected virus Virus.Win32.Sality.aa C:Program FilesCursorXPCurXPCpl.exe High 04.5.2012 г. 15:10:34 Detected virus Virus.Win32.Sality.aa C:Program FilesDAEMON Tools LiteDTHelper.exe High 04.5.2012 г. 15:10:36 Detected virus Virus.Win32.Sality.aa C:Program FilesDAEMON Tools LiteDTShellHlp.exe High 04.5.2012 г. 15:11:07 Detected virus Virus.Win32.Sality.aa C:Program FilesDAEMON Tools Liteuninst.exe High 04.5.2012 г. 15:11:26 Detected virus Virus.Win32.Sality.aa C:Program FilesEA GAMESNeed for Speed Underground 2pLan.exe High 04.5.2012 г. 15:11:46 Detected virus Virus.Win32.Sality.aa C:Program FilesFunmoodsfunmoods1.5.11.1uninstall.exe High 04.5.2012 г. 15:12:07 Detected virus Virus.Win32.Sality.aa C:Program FilesGarena Plusuninst.exe High 04.5.2012 г. 15:13:05 Detected virus Virus.Win32.Sality.aa C:Program FilesGarena PlusRoomventrilo-2.3.0-Windows-i386ventrilo-2.3.0-Windows-i386.exe High 04.5.2012 г. 15:13:15 Detected virus Virus.Win32.Sality.aa C:Program FilesiColorFolderiColorFolder.exe High 04.5.2012 г. 15:13:21 Detected virus Virus.Win32.Sality.aa C:Program FilesiColorFolderuninstall.exe High 04.5.2012 г. 15:13:31 Detected virus Virus.Win32.Sality.aa C:Program FilesInstallShield Installation Information{0A755762-EED8-47AB-A446-505766F93D43}setup.exe High 04.5.2012 г. 15:13:51 Detected virus Virus.Win32.Sality.aa C:Program FilesInstallShield Installation Information{41E496B5-47F4-11D6-9BBB-00E0987BB2CD}setup.exe High 04.5.2012 г. 15:13:55 Detected virus Virus.Win32.Sality.aa C:Program FilesInstallShield Installation Information{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}setup.exe High 04.5.2012 г. 15:15:07 Detected virus Virus.Win32.Sality.aa C:Program FilesK-Lite Codec PackToolsdsconfig.exe High 04.5.2012 г. 15:15:15 Detected virus Virus.Win32.Sality.aa C:Program FilesMicrosoft OfficeOFFICE11DSSM.EXE High 04.5.2012 г. 15:15:25 Detected virus Virus.Win32.Sality.aa C:Program FilesMicrosoft OfficeOFFICE11GRAPH.EXE High 04.5.2012 г. 15:15:26 Detected virus Virus.Win32.Sality.aa C:Program FilesMicrosoft OfficeOFFICE11EXCEL.EXE High 04.5.2012 г. 15:15:32 Detected virus Virus.Win32.Sality.aa C:Program FilesMicrosoft OfficeOFFICE11MSOHTMED.EXE High 04.5.2012 г. 15:15:36 Detected virus Virus.Win32.Sality.aa C:Program FilesMicrosoft OfficeOFFICE11MSTORDB.EXE High 04.5.2012 г. 15:15:37 Detected virus Virus.Win32.Sality.aa C:Program FilesMicrosoft OfficeOFFICE11MSTORE.EXE High 04.5.2012 г. 15:15:46 Detected virus Virus.Win32.Sality.aa C:Program FilesMicrosoft OfficeOFFICE11PROFLWIZ.EXE High 04.5.2012 г. 15:16:22 Detected virus Virus.Win32.Sality.aa C:Program FilesMicrosoft OfficeOFFICE111033MSOHELP.EXE High 04.5.2012 г. 15:17:58 Detected adware not-a-virus:AdWare.Win32.EZula.hgut C:Program FilesMozilla Firefoxextensions{3f137f8d-b367-555b-a8a2-101ef28242c4}components3413531b.dll Medium 04.5.2012 г. 15:18:21 Detected virus Virus.Win32.Sality.aa C:Program FilesNVIDIA CorporationnViewnwiz.exe High 04.5.2012 г. 15:18:30 Detected adware not-a-virus:AdWare.Win32.OneStep.jko C:Program FilesQuestBasicquestbasic.dll Medium 04.5.2012 г. 15:18:38 Detected Trojan program Trojan.Win32.Genome.afbye C:Program FilesQuestBasicquestbasic.exe High 04.5.2012 г. 15:19:34 Detected virus Virus.Win32.Sality.aa C:Program FilesTechSmithCamtasia Studio 7CamtasiaStudio.exe High 04.5.2012 г. 15:21:02 Detected virus Virus.Win32.Sality.aa C:Program FilesVideoLANVLCvlc.exe High 04.5.2012 г. 15:22:29 Detected virus Virus.Win32.Sality.aa C:WINXPAlcmtr.exe High 04.5.2012 г. 15:22:49 Detected virus Virus.Win32.Sality.aa C:WINXPDatecsRemove.exe High 04.5.2012 г. 15:33:32 Detected virus Virus.Win32.Sality.aa D:FlexType XP + kgFlexType XP new.EXE High 04.5.2012 г. 15:33:53 Detected virus Virus.Win32.Sality.aa D:DAEMON Tools Lite v4.30.4daemon4304-lite.exe High 04.5.2012 г. 15:35:02 Detected virus Virus.Win32.Sality.aa D:GamesGarenauninst.exe High 04.5.2012 г. 15:35:02 Detected virus Virus.Win32.Sality.aa D:GamesGarenaupdate.exe High 04.5.2012 г. 15:42:02 Detected Trojan program Backdoor.Win32.Zepfod.yy D:System Volume Information_restore{8A86D058-B40A-42EC-96EE-A7E7C505F241}RP2A0000999.exe High 04.5.2012 г. 15:42:05 Detected Trojan program Backdoor.Win32.Zepfod.yy D:System Volume Information_restore{8A86D058-B40A-42EC-96EE-A7E7C505F241}RP2A0001001.exe High 04.5.2012 г. 15:52:20 Detected Trojan program Backdoor.Win32.Agent.bnwu D:Picturesмоиfortress 3d.rar//fortress 3d/wAudio.dll High 04.5.2012 г. 15:57:00 Detected virus Virus.Win32.Sality.aa E:gamesTeamViewerQS_bg.exe High 04.5.2012 г. 15:57:02 Detected virus Virus.Win32.Sality.aa E:gamesHeroes 3 Goldh3ccmped.exe High 04.5.2012 г. 15:57:07 Detected virus Virus.Win32.Sality.aa E:gamesTeamViewer_Setup.exe High 04.5.2012 г. 15:57:17 Detected virus Virus.Win32.Sality.aa E:gamesHeroes 3 Goldh3maped.exe High 04.5.2012 г. 15:57:33 Detected virus Virus.Win32.Sality.aa E:gamesHeroes 3 GoldHEROES3.EXE High 04.5.2012 г. 15:58:47 Detected virus Virus.Win32.Sality.aa E:gamesHeroes 3 GoldONLINEAUTORUN.EXE High 04.5.2012 г. 15:59:10 Detected virus Virus.Win32.Sality.aa E:gamesMovies !!!Titanic.1997.iNTERNAL.DVDRip.XviD-CFHTeamViewer.exe High 04.5.2012 г. 16:01:22 Detected virus Virus.Win32.Sality.aa E:gamesWarcraft III Frozen Throne eSKBNUpdate.exe High 04.5.2012 г. 16:02:37 Detected virus Virus.Win32.Sality.aa E:gamesWarcraft III Frozen Throne eSKFrozen Throne.exe High 04.5.2012 г. 16:03:10 Detected virus Virus.Win32.Sality.aa E:gamesWarcraft III Frozen Throne eSKsleep.exe High 04.5.2012 г. 16:03:30 Detected virus Virus.Win32.Sality.aa E:gamesWarcraft III Frozen Throne eSKwar3.exe High 04.5.2012 г. 16:03:44 Detected virus Virus.Win32.Sality.aa E:gamesWarcraft III Frozen Throne eSKWarcraft III.exe High 04.5.2012 г. 16:03:45 Detected virus Virus.Win32.Sality.aa E:gamesWarcraft III Frozen Throne eSKWorld Editor.exe High 04.5.2012 г. 16:04:31 Detected virus Virus.Win32.Sality.aa E:gamesWarcraft III Frozen Throne eSKworldedit.exe High 04.5.2012 г. 16:06:39 Detected virus Virus.Win32.Sality.aa E:gamesWorld of WarcraftBackgroundDownloader.exe High 04.5.2012 г. 16:06:49 Detected virus Virus.Win32.Sality.aa E:gamesWorld of WarcraftLauncher.exe High 04.5.2012 г. 16:07:15 Detected virus Virus.Win32.Sality.aa E:gamesWorld of WarcraftRepair.exe High 04.5.2012 г. 16:07:39 Detected virus Virus.Win32.Sality.aa E:gamesWorld of WarcraftWowError.exe High 04.5.2012 г. 16:11:06 Detected virus Virus.Win32.Sality.aa E:MSOCacheAll Users90000409-6000-11D3-8CFE-0150048383C9FILESPFILESCOMMONMSSHAREDDWDWTRIG20.EXE High 04.5.2012 г. 16:11:09 Detected virus Virus.Win32.Sality.aa E:MSOCacheAll Users90000409-6000-11D3-8CFE-0150048383C9FILESPFILESMSOFFICEOFFICE11OFFCLN.EXE High 04.5.2012 г. 16:11:09 Detected virus Virus.Win32.Sality.aa E:MSOCacheAll Users90000409-6000-11D3-8CFE-0150048383C9FILESPFILESCOMMONMSSHAREDDWDW20.EXE High 04.5.2012 г. 16:11:12 Detected virus Virus.Win32.Sality.aa E:MSOCacheAll Users90000409-6000-11D3-8CFE-0150048383C9FILESSETUPOSE.EXE High 04.5.2012 г. 16:13:12 Detected virus Virus.Win32.Sality.aa E:Office11 - Disc 1 - ProfessionalSETUP.EXE High 04.5.2012 г. 16:13:24 Detected virus Virus.Win32.Sality.aa E:Office11 - Disc 1 - ProfessionalFILESOWC11SETUP.EXE High 04.5.2012 г. 16:13:24 Detected virus Virus.Win32.Sality.aa E:Office11 - Disc 1 - ProfessionalFILESOWC10SETUP.EXE High 04.5.2012 г. 16:13:29 Detected virus Virus.Win32.Sality.aa E:Office11 - Disc 1 - ProfessionalFILESPFILESCOMMONMSSHAREDDWDW20.EXE High 04.5.2012 г. 16:13:44 Detected virus Virus.Win32.Sality.aa E:Office11 - Disc 1 - ProfessionalFILESPFILESCOMMONMSSHAREDDWDWTRIG20.EXE High 04.5.2012 г. 16:13:51 Detected virus Virus.Win32.Sality.aa E:Office11 - Disc 1 - ProfessionalFILESPFILESMSOFFICEOFFICE11OFFCLN.EXE High 04.5.2012 г. 16:14:00 Detected virus Virus.Win32.Sality.aa E:Office11 - Disc 1 - ProfessionalFILESSETUPOSE.EXE High 04.5.2012 г. 16:14:03 Detected virus Virus.Win32.Sality.aa E:Office11 - Disc 1 - ProfessionalMSDE2000MSDE2KS3.EXE High 04.5.2012 г. 16:15:23 Detected virus Virus.Win32.Sality.aa E:Office11 - Disc 2 - FrontPageSETUP.EXE High 04.5.2012 г. 16:16:20 Detected virus Virus.Win32.Sality.aa E:Office11 - Disc 2 - FrontPageFILESOWC10SETUP.EXE High 04.5.2012 г. 16:16:31 Detected virus Virus.Win32.Sality.aa E:Office11 - Disc 2 - FrontPageFILESOWC11SETUP.EXE High 04.5.2012 г. 16:16:36 Detected virus Virus.Win32.Sality.aa E:Office11 - Disc 2 - FrontPageFILESPFILESCOMMONMSSHAREDDWDWTRIG20.EXE High 04.5.2012 г. 16:16:37 Detected virus Virus.Win32.Sality.aa E:Office11 - Disc 2 - FrontPageFILESPFILESCOMMONMSSHAREDDWDW20.EXE High 04.5.2012 г. 16:16:44 Detected virus Virus.Win32.Sality.aa E:Office11 - Disc 2 - FrontPageFILESPFILESMSOFFICEOFFICE11OFFCLN.EXE High 04.5.2012 г. 16:16:48 Detected virus Virus.Win32.Sality.aa E:Office11 - Disc 2 - FrontPageFILESSETUPOSE.EXE High 04.5.2012 г. 16:18:44 Detected virus Virus.Win32.Sality.aa E:Office11 - Disc 3 - VisioSETUP.EXE High 04.5.2012 г. 16:18:51 Detected virus Virus.Win32.Sality.aa E:Office11 - Disc 3 - VisioFILESPFILESCOMMONMSSHAREDDWDW20.EXE High 04.5.2012 г. 16:18:53 Detected virus Virus.Win32.Sality.aa E:Office11 - Disc 3 - VisioFILESPFILESCOMMONMSSHAREDDWDWTRIG20.EXE High 04.5.2012 г. 16:18:57 Detected virus Virus.Win32.Sality.aa E:Office11 - Disc 3 - VisioVisioDoc.exe High 04.5.2012 г. 16:19:01 Detected virus Virus.Win32.Sality.aa E:Office11 - Disc 3 - VisioFILESSETUPOSE.EXE High 04.5.2012 г. 16:19:20 Detected virus Virus.Win32.Sality.aa E:Office11 - Disc 4 - ProjectSETUP.EXE High 04.5.2012 г. 16:20:44 Detected virus Virus.Win32.Sality.aa E:Office11 - Disc 4 - ProjectFILESOWC10SETUP.EXE High 04.5.2012 г. 16:20:52 Detected virus Virus.Win32.Sality.aa E:Office11 - Disc 4 - ProjectFILESOWC11SETUP.EXE High 04.5.2012 г. 16:20:52 Detected virus Virus.Win32.Sality.aa E:Office11 - Disc 4 - ProjectFILESPFILESCOMMONMSSHAREDDWDW20.EXE High 04.5.2012 г. 16:20:54 Detected virus Virus.Win32.Sality.aa E:Office11 - Disc 4 - ProjectFILESPFILESCOMMONMSSHAREDDWDWTRIG20.EXE High 04.5.2012 г. 16:21:10 Detected virus Virus.Win32.Sality.aa E:Office11 - Disc 4 - ProjectFILESPFILESMSOFFICEOFFICE11OFFCLN.EXE High 04.5.2012 г. 16:21:10 Detected virus Virus.Win32.Sality.aa E:Office11 - Disc 4 - ProjectFILESSETUPOSE.EXE High 04.5.2012 г. 16:21:30 Detected virus Virus.Win32.Sality.aa E:Office11 - Disc 5 - OneNoteSETUP.EXE High 04.5.2012 г. 16:21:31 Detected virus Virus.Win32.Sality.aa E:Office11 - Disc 5 - OneNoteFILESPFILESCOMMONMSSHAREDDWDWTRIG20.EXE High 04.5.2012 г. 16:21:31 Detected virus Virus.Win32.Sality.aa E:Office11 - Disc 5 - OneNoteFILESPFILESCOMMONMSSHAREDDWDW20.EXE High 04.5.2012 г. 16:21:41 Detected virus Virus.Win32.Sality.aa E:Office11 - Disc 5 - OneNoteFILESSETUPOSE.EXE High 04.5.2012 г. 16:21:54 Detected virus Virus.Win32.Sality.aa E:Program FilesAdobeAdobe Bridge CS3Adobe DNG Converter.exe High 04.5.2012 г. 16:22:16 Detected virus Virus.Win32.Sality.aa E:Program FilesAdobeAdobe Bridge CS3bridgeproxy.exe High 04.5.2012 г. 16:22:17 Detected virus Virus.Win32.Sality.aa E:Program FilesAdobeAdobe Bridge CS3Bridge.exe High 04.5.2012 г. 16:25:12 Detected virus Worm.Win32.Qvod.pd E:System Volume Information_restore{2788A230-8FE5-4BF2-A943-92F8875000E2}RP299A0093785.exe High

Здравейте,

Положението е плачевно и по-принцип не се занимаваме с полиморфни вируси и директно препоръчваме формат на системния дял.

Все пак ще наруша принципите си и ще опитам да помогна за да ви спестя нелеката задача да инсталирате всичко наново.

Изтеглете прикачения файл и го разархивирайте.

Стартирайте файла fix.bat.

След като приключи, ще се изпише съобщението Deleted Successfully.

Натиснете OK за да се затвори документа.

Той автоматично ще се изтрие след това.

След това опитайте нова проверка със SalityKiller по-начина описан по-нагоре.

Ако отново не иска да стартира, изтеглете свежо копие на инструмента, след това спрете интернета и просто стартирайте програмата с двукратен клик на мишката върху нея.

След като проверката приключи, направете нова такава с Kaspersky Virus Removal Tool и публикувайте за да видя какво има за дооправяне.

Избягвайте използването на интернет по време на почистващия процес!

fix.zip

  • Автор

благодаря , но когато стартирам този фаил Fix.bat , ми се появява черен прозорец , в който пише " press any button to continue..." ,когато натисна , нищо не става след това ;с , също така ми отваря Notepad със съдържание : c:Documents and SettingsCGILocal SettingsTempwingdihd.exe

  • Изтеглете файла OTL,exe и го запазете на вашия десктоп.
  • Стартирайте файла OTL,exe с двукратен клик на мишката.
  • Под Публикувано изображение с Copy/ Paste въведете изцяло следната текстова информация (само това, което е поставено в карето):
:files
c:\Documents and Settings\CGI\Local Settings\Temp\wingdihd.exe
c:\Documents and Settings\CGI\Local Settings\Temp\sqigv.exe
c:\winxp\system32\e62a1057.exe
C:\Documents and Settings\CGI\Local Settings\Temp\Av-test.txt
C:\Documents and Settings\CGI\Local Settings\Temporary Internet Files\Content.IE5\7WZ8KTJN\nb[1].swf
C:\Documents and Settings\CGI\Local Settings\Temporary Internet Files\Content.IE5\G9202XPD\md[1].htm
C:\Documents and Settings\CGI\Local Settings\Temporary Internet Files\Content.IE5\T28UM9VO\ceo1[1].js
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\55183XXC\upgrade[1].cab
C:\Program Files\Mozilla Firefox\extensions\{3f137f8d-b367-555b-a8a2-101ef28242c4}\components\3413531b.dll
C:\Program Files\Mozilla Firefox\extensions\{3f137f8d-b367-555b-a8a2-101ef28242c4}
c:\Program Files\QuestBasic
c:\documents and settings\cgi\application data\Search Settings
c:\program files\Application Updater
c:\program files\common files\Spigot
C:\Documents and Settings\CGI\My Documents\Downloads\Wow_Emu_Hacker_3.3.5+4.0.1\Emuhacker 3.3.5.rar
D:\Pictures\мои\fortress 3d.rar
D:\System Volume Information\_restore{8A86D058-B40A-42EC-96EE-A7E7C505F241}\RP2\A0000999.exe
D:\System Volume Information\_restore{8A86D058-B40A-42EC-96EE-A7E7C505F241}\RP2\A0001001.exe
E:\System Volume Information\_restore{2788A230-8FE5-4BF2-A943-92F8875000E2}\RP299\A0093785.exe
:reg
[HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions]
"{3f137f8d-b367-555b-a8a2-101ef28242c4}"=-
:commands
[ClearAllRestorePoints]
[emptytemp]
След като въведете скрипта от цитата по-горе натиснете бутона, маркиран в червено: Run Fix

Windows ще се рестартира и ще се създаде лог файл - OTL fix log. Публикувайте съдържанието му с Copy/Paste в следващия си коментар.

  • Автор

All processes killed ========== FILES ========== c:Documents and SettingsCGILocal SettingsTempwingdihd.exe moved successfully. FileFolder c:Documents and SettingsCGILocal SettingsTempsqigv.exe not found. c:winxpsystem32e62a1057.exe moved successfully. FileFolder C:Documents and SettingsCGILocal SettingsTempAv-test.txt not found. FileFolder C:Documents and SettingsCGILocal SettingsTemporary Internet FilesContent.IE57WZ8KTJNnb[1].swf not found. FileFolder C:Documents and SettingsCGILocal SettingsTemporary Internet FilesContent.IE5G9202XPDmd[1].htm not found. FileFolder C:Documents and SettingsCGILocal SettingsTemporary Internet FilesContent.IE5T28UM9VOceo1[1].js not found. FileFolder C:Documents and SettingsLocalServiceLocal SettingsTemporary Internet FilesContent.IE555183XXCupgrade[1].cab not found. FileFolder C:Program FilesMozilla Firefoxextensions{3f137f8d-b367-555b-a8a2-101ef28242c4}components3413531b.dll not found. FileFolder C:Program FilesMozilla Firefoxextensions{3f137f8d-b367-555b-a8a2-101ef28242c4} not found. FileFolder c:Program FilesQuestBasic not found. c:documents and settingscgiapplication dataSearch Settings emp folder moved successfully. c:documents and settingscgiapplication dataSearch Settingsres folder moved successfully. c:documents and settingscgiapplication dataSearch Settings folder moved successfully. c:program filesApplication Updater folder moved successfully. c:program filescommon filesSpigotwtxpcomcomponents folder moved successfully. c:program filescommon filesSpigotwtxpcom folder moved successfully. c:program filescommon filesSpigotSearch SettingsRes folder moved successfully. c:program filescommon filesSpigotSearch SettingsLang folder moved successfully. c:program filescommon filesSpigotSearch Settings folder moved successfully. c:program filescommon filesSpigot folder moved successfully. FileFolder C:Documents and SettingsCGIMy DocumentsDownloadsWow_Emu_Hacker_3.3.5+4.0.1Emuhacker 3.3.5.rar not found. FileFolder D:Picturesмоиfortress 3d.rar not found. FileFolder D:System Volume Information_restore{8A86D058-B40A-42EC-96EE-A7E7C505F241}RP2A0000999.exe not found. FileFolder D:System Volume Information_restore{8A86D058-B40A-42EC-96EE-A7E7C505F241}RP2A0001001.exe not found. FileFolder E:System Volume Information_restore{2788A230-8FE5-4BF2-A943-92F8875000E2}RP299A0093785.exe not found. ========== REGISTRY ========== Registry value HKEY_LOCAL_MACHINESoftwareMozillaFirefoxExtensions{3f137f8d-b367-555b-a8a2-101ef28242c4} not found. Registry key HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{3f137f8d-b367-555b-a8a2-101ef28242c4} not found. ========== COMMANDS ========== Unable to stop System Restore Service. Error code 1717. Restore points not cleared. Error creating restore point. [EMPTYTEMP] User: All Users User: CGI ->Temp folder emptied: 851427623 bytes ->Temporary Internet Files folder emptied: 38661078 bytes ->Java cache emptied: 6267 bytes ->FireFox cache emptied: 678118177 bytes ->Google Chrome cache emptied: 310257485 bytes ->Flash cache emptied: 3169301 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: LocalService ->Temp folder emptied: 66016 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%System32 .tmp files removed: 2577 bytes %systemroot%System32dllcache .tmp files removed: 0 bytes %systemroot%System32drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 4946056 bytes %systemroot%system32configsystemprofileLocal SettingsTemp folder emptied: 0 bytes %systemroot%system32configsystemprofileLocal SettingsTemporary Internet Files folder emptied: 33170 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 1 799,00 mb OTL by OldTimer - Version 3.2.42.2 log created on 05042012_223523 FilesFolders moved on Reboot... Registry entries deleted on Reboot...

Изтеглете прикачения файл и го разархивирайте на десктопа.

Стартирайте файла sr.reg и потвърдете с YES.

След това направете проверката със SalityKiller както е описано по-нагоре и после с Kaspersky Virus Removal Tool.

Публикувайте резултатите.

sr.zip

  • Автор

ах, и тук ми показа " Registry editing has been disabled by ur administrator " .... ех , нямам късмет, дано не ви натоварвам ...

Стартирайте SalityKiller-a и изчакайте проверката. Ако не стане с параметъра, просто го стартирайте с двукратен клик върху иконата. После пуснете и kaspersky. После ще дочистим остатъците и пораженията.

  • Автор

Дано не е проблем , но ще мога да ви дам информацията в неделя , тогава ще имам възможност да направя инструкциите ви :) . И ако може да прикачите програмката SatilyKiller ,че не ми отваря саита вече ;с

  • Автор

здравей , направих всичко ,което ми каза и май достигнахме до успех.SalityKiller намери 992 virusa и всички те са излекувани , което е страхотно ,дори вече мога да виждам TaskManager-a. А от Kaspersky ето : Status: Detected (events: 7) 06.5.2012 г. 18:53:45 Detected Trojan program Backdoor.Win32.Mazben.hz C:System Volume Information_restore{6AEE6529-84AF-4E71-8394-C095543E6BE5}RP231A0085341.exe High 06.5.2012 г. 18:55:05 Detected Trojan program HEUR:Backdoor.Win32.Generic C:System Volume Information_restore{6AEE6529-84AF-4E71-8394-C095543E6BE5}RP231A0085673.exe//UPX High 06.5.2012 г. 18:57:38 Detected Trojan program HEUR:Backdoor.Win32.Generic C:System Volume Information_restore{6AEE6529-84AF-4E71-8394-C095543E6BE5}RP232A0086209.exe//UPX High 06.5.2012 г. 18:58:22 Detected virus Virus.Win32.Sality.aa C:System Volume Information_restore{6AEE6529-84AF-4E71-8394-C095543E6BE5}RP232A0086367.exe High 06.5.2012 г. 18:58:23 Detected virus Virus.Win32.Sality.aa C:System Volume Information_restore{6AEE6529-84AF-4E71-8394-C095543E6BE5}RP232A0086368.exe High 06.5.2012 г. 19:24:48 Detected virus Virus.Win32.Sality.aa C:System Volume Information_restore{6AEE6529-84AF-4E71-8394-C095543E6BE5}RP232A0086369.exe High 06.5.2012 г. 19:34:25 Detected Trojan program HEUR:Backdoor.Win32.Generic C:_OTLMovedFiles05042012_223523c_Documents and SettingsCGILocal SettingsTempwingdihd.exe//UPX High

Сега моля, архивирайте папката C:_OTL и я качете на този адрес => http://file.bg/

Публикувайте линк за download в следващия си коментар.

След това изтрийте архива и папката и изпразнете кошчето (Recycle Bin-a).

След това стартирайте файла по-нагоре (sr.reg) ако вече е възможно и рестартирайте.

Вече да проверим с тежката артилерия:

1. Изтеглете ComboFix от BleepingComputer (изтеглете я наново и изтрийте вашата версия, защото тя бе заразена).

и го запазете (бутон Save -> Save as) ComboFix на вашия десктоп:

Публикувано изображение

След приключване на изтеглянето на ComboFix, иконката на програмата би трябвало да изглежда така:

Публикувано изображение

2. Затворете всички работещи приложения, отворени прозорци и програми работещи във фонов режим. Спрете временно защитата в реално време на антивирусната програма и на другите програми за сигурност, ако има такива.

3. Стартирайте с двоен клик Combofix.exe. Изберете YES, за да се съгласите с условията за използване на програмата. Важно: По време на работата на ComboFix не бива да се движи мишката и да се натискат клавиши от клавиатурата. Просто търпеливо оставете ComboFix да си свърши работата, без да използвате компютъра за други цели.

4. ComboFix ще провери дали Windows Recovery Console e инсталиранa.

*Ако Windows Recovery Console не е инсталирана, ще е необходимо да използвате YES за инсталация на Windows Recovery Console

*Ако Windows Recovery Console е инсталирана, ComboFix ще продължи работата си.

Публикувано изображение

Забележка: Необходимо е да сте свързани към Интернет за да може Windows Recovery Console да се изтегли.

След инсталация на Windows Recovery Console потвърдете с YES, за да продължите напред. Снимка:

Публикувано изображение

5. ComboFix ще спре временно Интернет връзката, но след като приключи работата на програмата тази връзка ще бъде възстановена автоматично. ComboFix ще сканира за проблеми и за заразени файлове, като това може да отнеме известно време. Моля да бъдете търпеливи. Ако има проблем с Интернет връзката след приключване на работата на ComboFix, моля да прочетете това: Manually restoring the Internet connection section.

6. Когато работата на ComboFix приключи, ще се появи текстов документ (log) в Notepad:

Публикувано изображение

Копирайте с (Copy) и поставете с (Paste) съдържанието на лога в следващия си коментар.

  • Автор

това е за OTL :)

ComboFix 12-05-06.03 - CGI 05.2012 г. 21:27:11.2.1 - x86

Microsoft Windows XP Professional 5.1.2600.3.1251.359.1033.18.511.202 [GMT 3:00]

Running from: c:documents and settingsCGIDesktopComboFix.exe

.

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:documents and settingsAll UsersApplication DataQuestBasic

c:documents and settingsAll UsersApplication DataQuestBasicquestbasic114.exe

c:documents and settingsAll UsersApplication DataQuestBasicquestbasic115.exe

c:documents and settingsCGIMy Documents~ytCD.tmp

c:documents and settingsCGIMy Documents~ytCE.tmp

c:documents and settingsCGIMy Documents~ytD0.tmp

c:documents and settingsCGIWINDOWS

c:program filesRelevantKnowledge

D:install.exe

.

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

-------Legacy_ABP470N5

-------Legacy_QuestBasic_Service

-------Service_QuestBasic Service

.

.

((((((((((((((((((((((((( Files Created from 2012-04-06 to 2012-05-06 )))))))))))))))))))))))))))))))

.

.

2012-05-03 15:10 . 2012-05-03 15:11 -------- d-----w- c:program filesYouTube Downloader Toolbar

2012-05-02 19:41 . 2012-05-02 19:41 -------- d-----w- c:program filesVentrilo

2012-05-02 19:41 . 2012-05-02 19:41 -------- d-----w- c:program filesCommon FilesWise Installation Wizard

.

.

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-05-06 15:15 . 2011-04-02 19:55 69632 ----a-w- c:winxpAlcmtr.exe

2012-05-06 15:06 . 2011-04-03 18:12 49152 ----a-w- c:winxpVMSnap1.exe

2012-05-06 15:06 . 2011-04-03 18:12 49152 ----a-w- c:winxpdomino.exe

2012-03-27 21:44 . 2012-03-27 21:44 120320 ----a-w- c:winxpsystem32driversSSHDRV65.sys

2012-03-27 21:43 . 2012-03-27 21:43 78848 ----a-w- c:winxpsystem32driversSSHDRV85.sys

2012-03-13 09:55 . 2012-03-13 09:36 139264 ----a-w- c:winxpWar3Unin.exe

2012-02-20 17:55 . 2012-02-20 17:55 43520 ----a-w- c:winxpsystem32CmdLineExt03.dll

2012-02-16 18:53 . 2012-02-16 18:45 7877 ----a-w- c:winxpBricoPackFoldersDelete.cmd

2012-02-16 18:53 . 2012-02-16 18:53 149328 ----a-w- c:winxpBricoPackUninst.cmd

2012-02-16 18:53 . 2008-04-14 11:00 218624 ----a-w- c:winxpsystem32uxtheme.dll

2011-05-01 15:08 . 2011-04-02 20:10 142296 ----a-w- c:program filesmozilla firefoxcomponentsbrowsercomps.dll

.

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]

"Pando Media Booster"="c:program filesPando NetworksMedia BoosterPMB.exe" [2011-08-28 3077528]

"Skype"="c:program filesSkypePhoneSkype.exe" [2011-10-13 17453704]

"CursorXP"="c:program filesCursorXPCursorXP.exe" [2012-05-06 230400]

.

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]

"RTHDCPL"="RTHDCPL.EXE" [2007-09-03 16841216]

"NvMediaCenter"="c:winxpsystem32NvMcTray.dll" [2011-01-07 111208]

"NvCplDaemon"="c:winxpsystem32NvCpl.dll" [2011-01-07 13880424]

"nwiz"="c:program filesNVIDIA CorporationnViewnwiz.exe" [2012-05-06 1753192]

"domino"="c:winxpdomino.exe" [2012-05-06 49152]

"VMSnap1"="c:winxpVMSnap1.exe" [2012-05-06 49152]

.

[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]

"CTFMON.EXE"="c:winxpsystem32CTFMON.EXE" [2008-04-14 15360]

.

c:documents and settingsCGIStart MenuProgramsStartup

Registration Heroes of Might & Magic 5 - Hammers of Fate.LNK - e:gamesHeroes5registrationa1RegistrationReminder.exe [N/A]

Registration Heroes of Might & Magic 5.LNK - e:gamesHeroes5registrationRegistrationReminder.exe [N/A]

_uninst_37884409.lnk - c:documents and settingsCGILocal SettingsTemp_uninst_37884409.bat [N/A]

.

c:documents and settingsAll UsersStart MenuProgramsStartup

FlexType 2K.lnk - c:winxpDatecsFType2K.exe [2012-5-4 95232]

.

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregAdobe ARM]

2010-11-10 09:49 932288 ----a-w- c:program filesCommon FilesAdobeARM1.0AdobeARM.exe

.

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregAdobe Reader Speed Launcher]

2012-05-06 15:10 35736 ----a-w- c:program filesAdobeReader 10.0Readerreader_sl.exe

.

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregNeroFilterCheck]

2001-07-09 08:50 155648 ----a-w- c:winxpsystem32NeroCheck.exe

.

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofile]

"EnableFirewall"= 0 (0x0)

.

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]

"%windir%Network Diagnosticxpnetdiag.exe"=

"%windir%system32sessmgr.exe"=

"c:Program FilesuTorrentuTorrent.exe"=

"c:Program FilesPando NetworksMedia BoosterPMB.exe"=

"d:GamesGarenaGarena.exe"=

"c:Program FilesSkypePhoneSkype.exe"=

"c:Program FilesTeamViewerVersion7TeamViewer.exe"=

"c:Program FilesTeamViewerVersion7TeamViewer_Service.exe"=

"c:Program FilesGarena PlusRoomgarena_room.exe"=

"c:Program FilesNVIDIA CorporationnViewnwiz.exe"=

"c:WINXPdomino.exe"=

"c:Documents and SettingsCGILocal SettingsApplication DataGoogleUpdateGoogleUpdate.exe"=

"c:Program FilesCursorXPCursorXP.exe"=

"c:WINXPsystem32netsh.exe"=

"c:WINXPDatecsFType2K.exe"=

"c:Documents and SettingsCGIMy DocumentsDownloadsOTL.exe"=

"c:Program FilesGarena PlusGarenaMessenger.exe"=

"c:WINXPVMSnap1.exe"=

.

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileGloballyOpenPortsList]

"57080:TCP"= 57080:TCP:Pando Media Booster

"57080:UDP"= 57080:UDP:Pando Media Booster

.

R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:winxpsystem32driversdtsoftbus01.sys [03.4.2011 і. 19:16 218688]

R1 SSHDRV65;SSHDRV65;c:winxpsystem32driversSSHDRV65.sys [28.3.2012 і. 00:44 120320]

R1 SSHDRV85;SSHDRV85;c:winxpsystem32driversSSHDRV85.sys [28.3.2012 і. 00:43 78848]

S2 Application Updater;Application Updater;"c:program filesApplication UpdaterApplicationUpdater.exe" --> c:program filesApplication UpdaterApplicationUpdater.exe [?]

S3 GGSAFERDriver;GGSAFER Driver;??c:program filesGarena PlusRoomsafedrv.sys --> c:program filesGarena PlusRoomsafedrv.sys [?]

.

Contents of the 'Scheduled Tasks' folder

.

2012-05-05 c:winxpTasksGoogleUpdateTaskUserS-1-5-21-842925246-1606980848-1177238915-1003Core.job

- c:documents and settingsCGILocal SettingsApplication DataGoogleUpdateGoogleUpdate.exe [2011-06-17 15:09]

.

2012-05-06 c:winxpTasksGoogleUpdateTaskUserS-1-5-21-842925246-1606980848-1177238915-1003UA.job

- c:documents and settingsCGILocal SettingsApplication DataGoogleUpdateGoogleUpdate.exe [2011-06-17 15:09]

.

.

------- Supplementary Scan -------

.

uStart Page = hxxp://search.babylon.com/?babsrc=HP_Prot

IE: E&xport to Microsoft Excel - c:progra~1MICROS~2OFFICE11EXCEL.EXE/3000

TCP: Interfaces{A625CEA9-55F8-4EC6-A310-D5B97AB62425}: NameServer = 87.120.16.2 87.120.16.1

FF - ProfilePath - c:documents and settingsCGIApplication DataMozillaFirefoxProfilesphlg1102.default

FF - prefs.js: browser.startup.homepage - hxxp://start.funmoods.com/?f=1&a=ironto

FF - prefs.js: browser.search.selectedEngine - Yahoo

FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=937811&p=

FF - user.js: extensions.BabylonToolbar_i.id - cc4a2f5d000000000000005345000000

FF - user.js: extensions.BabylonToolbar_i.hardId - cc4a2f5d000000000000005345000000

FF - user.js: extensions.BabylonToolbar_i.instlDay - 15305

FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17

FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17

FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.1720:57

FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon

FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar

FF - user.js: extensions.BabylonToolbar_i.aflt - babsst

FF - user.js: extensions.BabylonToolbar_i.smplGrp - none

FF - user.js: extensions.BabylonToolbar_i.tlbrId - base

FF - user.js: extensions.BabylonToolbar_i.newTab - false

FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=101240

FF - user.js: extensions.BabylonToolbar_i.babExt -

FF - user.js: extensions.BabylonToolbar_i.srcExt - ss

FF - user.js: extensions.BabylonToolbar_i.instlRef - sst

FF - user.js: extensions.funmoods_i.hmpg - true

FF - user.js: extensions.funmoods_i.hmpgUrl - hxxp://start.funmoods.com/?f=1&a=ironto

FF - user.js: extensions.funmoods_i.dfltSrch - true

FF - user.js: extensions.funmoods_i.srchPrvdr - Search

FF - user.js: extensions.funmoods_i.dnsErr - true

FF - user.js: extensions.funmoods_i.newTab - true

FF - user.js: extensions.funmoods_i.newTabUrl - hxxp://start.funmoods.com/?f=2&a=ironto

FF - user.js: extensions.funmoods_i.tlbrSrchUrl - hxxp://start.funmoods.com/results.php?f=3&a=ironto&q=

FF - user.js: extensions.funmoods_i.id - cc4a2f5d000000000000005345000000

FF - user.js: extensions.funmoods_i.instlDay - 15362

FF - user.js: extensions.funmoods_i.vrsn - 1.5.11.1

FF - user.js: extensions.funmoods_i.vrsni - 1.5.11.1

FF - user.js: extensions.funmoods_i.vrsnTs - 1.5.11.123:45

FF - user.js: extensions.funmoods_i.prtnrId - funmoods

FF - user.js: extensions.funmoods_i.prdct - funmoods

FF - user.js: extensions.funmoods_i.aflt - ironto

FF - user.js: extensions.funmoods_i.smplGrp - none

FF - user.js: extensions.funmoods_i.tlbrId - base

FF - user.js: extensions.funmoods_i.instlRef -

FF - user.js: extensions.funmoods_i.dfltLng -

FF - user.js: extensions.funmoods_i.excTlbr - false

.

- - - - ORPHANS REMOVED - - - -

.

HKLM-Run-SearchSettings - c:program filesCommon FilesSpigotSearch SettingsSearchSettings.exe

AddRemove-e62a1057 - c:winxpsystem32e62a1057.exe

AddRemove-Hellfire - c:sierraHELLFIREUninst.isu

AddRemove-QuestBasic - c:program filesQuestBasicuninstall.exe

AddRemove-Yuri's Revenge - e:gamesCommand & Conquer - Red Alert 2Uninstll.EXE

AddRemove-{d08d9f98-1c78-4704-87e6-368b0023d831} - c:program filesRelevantKnowledgerlvknlg.exe

AddRemove-FoxTab AVI Converter - c:program filesFoxTabAVIConverterUninstallUninstall.exe

.

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2012-05-06 21:35

Windows 5.1.2600 Service Pack 3 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_USERSS-1-5-21-842925246-1606980848-1177238915-1003SoftwareMicrosoftWindowsCurrentVersionExplorerCLSID]

@Denied: (Full) (LocalSystem)

.

--------------------- DLLs Loaded Under Running Processes ---------------------

.

- - - - - - - > 'explorer.exe'(2892)

c:winxpsystem32WININET.dll

c:winxpsystem32newdll.dll

c:winxpsystem32ieframe.dll

c:winxpsystem32webcheck.dll

c:winxpsystem32wpdshserviceobj.dll

c:winxpsystem32portabledevicetypes.dll

c:winxpsystem32portabledeviceapi.dll

.

------------------------ Other Running Processes ------------------------

.

c:winxpsystem32nvsvc32.exe

c:winxpsystem32wscntfy.exe

c:winxpRTHDCPL.EXE

c:winxpsystem32RUNDLL32.EXE

.

**************************************************************************

.

Completion time: 2012-05-06 21:39:25 - machine was rebooted

ComboFix-quarantined-files.txt 2012-05-06 18:39

.

Pre-Run: 29 046 575 104 bytes free

Post-Run: 28 956 409 856 bytes free

.

- - End Of File - - D2C9146882C96A7A4BFB718A9CB7C98B

Редактирано от B-boy[StyLe]
премахнах линка от безопасност. :) (преглед на промените)

  • Отворете notepad и с copy/paste въведете следната информация:

    Driver::
Application Updater
Registry::
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"=dword:00000001
DDS::
uStart Page = hxxp://search.babylon.com/?babsrc=HP_Prot
Firefox::
FF - ProfilePath - c:\documents and settings\CGI\Application Data\Mozilla\Firefox\Profiles\phlg1102.default\
FF - prefs.js: browser.startup.homepage - hxxp://start.funmoods.com/?f=1&a=ironto
FF - user.js: extensions.BabylonToolbar_i.id - cc4a2f5d000000000000005345000000
FF - user.js: extensions.BabylonToolbar_i.hardId - cc4a2f5d000000000000005345000000
FF - user.js: extensions.BabylonToolbar_i.instlDay - 15305
FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.1720:57
FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar_i.aflt - babsst
FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
FF - user.js: extensions.BabylonToolbar_i.tlbrId - base
FF - user.js: extensions.BabylonToolbar_i.newTab - false
FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=101240
FF - user.js: extensions.BabylonToolbar_i.babExt -
FF - user.js: extensions.BabylonToolbar_i.srcExt - ss
FF - user.js: extensions.BabylonToolbar_i.instlRef - sst
FF - user.js: extensions.funmoods_i.hmpg - true
FF - user.js: extensions.funmoods_i.hmpgUrl - hxxp://start.funmoods.com/?f=1&a=ironto
FF - user.js: extensions.funmoods_i.dfltSrch - true
FF - user.js: extensions.funmoods_i.srchPrvdr - Search
FF - user.js: extensions.funmoods_i.dnsErr - true
FF - user.js: extensions.funmoods_i.newTab - true
FF - user.js: extensions.funmoods_i.newTabUrl - hxxp://start.funmoods.com/?f=2&a=ironto
FF - user.js: extensions.funmoods_i.tlbrSrchUrl - hxxp://start.funmoods.com/results.php?f=3&a=ironto&q=
FF - user.js: extensions.funmoods_i.id - cc4a2f5d000000000000005345000000
FF - user.js: extensions.funmoods_i.instlDay - 15362
FF - user.js: extensions.funmoods_i.vrsn - 1.5.11.1
FF - user.js: extensions.funmoods_i.vrsni - 1.5.11.1
FF - user.js: extensions.funmoods_i.vrsnTs - 1.5.11.123:45
FF - user.js: extensions.funmoods_i.prtnrId - funmoods
FF - user.js: extensions.funmoods_i.prdct - funmoods
FF - user.js: extensions.funmoods_i.aflt - ironto
FF - user.js: extensions.funmoods_i.smplGrp - none
FF - user.js: extensions.funmoods_i.tlbrId - base
FF - user.js: extensions.funmoods_i.instlRef -
FF - user.js: extensions.funmoods_i.dfltLng -
FF - user.js: extensions.funmoods_i.excTlbr - false
Reglock::
[HKEY_USERS\S-1-5-21-842925246-1606980848-1177238915-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID]
  • Запазете файла с име CFScript и го провлачете и пуснете в Combofix (както е показано на картинката отдолу).

    Публикувано изображение

  • По време на сканиране от страна на ComboFix не стартирайте никакви други приложения, не натискайте клавиши от клавиатурата и не местете мишката !
  • Публикувайте лог файла, който ще се създаде след рестарта на компютъра в следващия си пост.
  • Автор

ComboFix 12-05-06.03 - CGI 05.2012 г. 12:10:02.3.1 - x86 Microsoft Windows XP Professional 5.1.2600.3.1251.359.1033.18.511.222 [GMT 3:00] Running from: c:documents and settingsCGIDesktopComboFix.exe Command switches used :: c:documents and settingsCGIDesktopCFScript.txt.txt . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . . -------Legacy_APPLICATION_UPDATER -------Service_Application Updater . . ((((((((((((((((((((((((( Files Created from 2012-04-07 to 2012-05-07 ))))))))))))))))))))))))))))))) . . 2012-05-03 15:10 . 2012-05-03 15:11 -------- d-----w- c:program filesYouTube Downloader Toolbar 2012-05-02 19:41 . 2012-05-02 19:41 -------- d-----w- c:program filesVentrilo 2012-05-02 19:41 . 2012-05-02 19:41 -------- d-----w- c:program filesCommon FilesWise Installation Wizard . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-05-06 15:15 . 2011-04-02 19:55 69632 ----a-w- c:winxpAlcmtr.exe 2012-05-06 15:06 . 2011-04-03 18:12 49152 ----a-w- c:winxpVMSnap1.exe 2012-05-06 15:06 . 2011-04-03 18:12 49152 ----a-w- c:winxpdomino.exe 2012-03-27 21:44 . 2012-03-27 21:44 120320 ----a-w- c:winxpsystem32driversSSHDRV65.sys 2012-03-27 21:43 . 2012-03-27 21:43 78848 ----a-w- c:winxpsystem32driversSSHDRV85.sys 2012-03-13 09:55 . 2012-03-13 09:36 139264 ----a-w- c:winxpWar3Unin.exe 2012-02-20 17:55 . 2012-02-20 17:55 43520 ----a-w- c:winxpsystem32CmdLineExt03.dll 2012-02-16 18:53 . 2012-02-16 18:45 7877 ----a-w- c:winxpBricoPackFoldersDelete.cmd 2012-02-16 18:53 . 2012-02-16 18:53 149328 ----a-w- c:winxpBricoPackUninst.cmd 2012-02-16 18:53 . 2008-04-14 11:00 218624 ----a-w- c:winxpsystem32uxtheme.dll 2011-05-01 15:08 . 2011-04-02 20:10 142296 ----a-w- c:program filesmozilla firefoxcomponentsbrowsercomps.dll . . ((((((((((((((((((((((((((((( SnapShot@2012-05-06_18.35.06 ))))))))))))))))))))))))))))))))))))))))) . - 2008-04-14 11:00 . 2012-05-06 18:23 40128 c:winxpsystem32perfc009.dat + 2008-04-14 11:00 . 2012-05-07 09:03 40128 c:winxpsystem32perfc009.dat + 2008-04-14 11:00 . 2012-05-07 09:03 311740 c:winxpsystem32perfh009.dat - 2008-04-14 11:00 . 2012-05-06 18:23 311740 c:winxpsystem32perfh009.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun] "Pando Media Booster"="c:program filesPando NetworksMedia BoosterPMB.exe" [2011-08-28 3077528] "Skype"="c:program filesSkypePhoneSkype.exe" [2011-10-13 17453704] "CursorXP"="c:program filesCursorXPCursorXP.exe" [2012-05-06 230400] . [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun] "RTHDCPL"="RTHDCPL.EXE" [2007-09-03 16841216] "NvMediaCenter"="c:winxpsystem32NvMcTray.dll" [2011-01-07 111208] "NvCplDaemon"="c:winxpsystem32NvCpl.dll" [2011-01-07 13880424] "nwiz"="c:program filesNVIDIA CorporationnViewnwiz.exe" [2012-05-06 1753192] "domino"="c:winxpdomino.exe" [2012-05-06 49152] "VMSnap1"="c:winxpVMSnap1.exe" [2012-05-06 49152] . [HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun] "CTFMON.EXE"="c:winxpsystem32CTFMON.EXE" [2008-04-14 15360] . c:documents and settingsCGIStart MenuProgramsStartup Registration Heroes of Might & Magic 5 - Hammers of Fate.LNK - e:gamesHeroes5registrationa1RegistrationReminder.exe [N/A] Registration Heroes of Might & Magic 5.LNK - e:gamesHeroes5registrationRegistrationReminder.exe [N/A] _uninst_37884409.lnk - c:documents and settingsCGILocal SettingsTemp_uninst_37884409.bat [N/A] . c:documents and settingsAll UsersStart MenuProgramsStartup FlexType 2K.lnk - c:winxpDatecsFType2K.exe [2012-5-4 95232] . [HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregAdobe ARM] 2010-11-10 09:49 932288 ----a-w- c:program filesCommon FilesAdobeARM1.0AdobeARM.exe . [HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregAdobe Reader Speed Launcher] 2012-05-06 15:10 35736 ----a-w- c:program filesAdobeReader 10.0Readerreader_sl.exe . [HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregNeroFilterCheck] 2001-07-09 08:50 155648 ----a-w- c:winxpsystem32NeroCheck.exe . [HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList] "%windir%Network Diagnosticxpnetdiag.exe"= "%windir%system32sessmgr.exe"= "c:Program FilesuTorrentuTorrent.exe"= "c:Program FilesPando NetworksMedia BoosterPMB.exe"= "d:GamesGarenaGarena.exe"= "c:Program FilesSkypePhoneSkype.exe"= "c:Program FilesTeamViewerVersion7TeamViewer.exe"= "c:Program FilesTeamViewerVersion7TeamViewer_Service.exe"= "c:Program FilesGarena PlusRoomgarena_room.exe"= "c:Program FilesNVIDIA CorporationnViewnwiz.exe"= "c:WINXPdomino.exe"= "c:Documents and SettingsCGILocal SettingsApplication DataGoogleUpdateGoogleUpdate.exe"= "c:Program FilesCursorXPCursorXP.exe"= "c:WINXPsystem32netsh.exe"= "c:WINXPDatecsFType2K.exe"= "c:Documents and SettingsCGIMy DocumentsDownloadsOTL.exe"= "c:Program FilesGarena PlusGarenaMessenger.exe"= "c:WINXPVMSnap1.exe"= . [HKLM~servicessharedaccessparametersfirewallpolicystandardprofileGloballyOpenPortsList] "57080:TCP"= 57080:TCP:Pando Media Booster "57080:UDP"= 57080:UDP:Pando Media Booster . R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:winxpsystem32driversdtsoftbus01.sys [03.4.2011 і. 19:16 218688] R1 SSHDRV65;SSHDRV65;c:winxpsystem32driversSSHDRV65.sys [28.3.2012 і. 00:44 120320] R1 SSHDRV85;SSHDRV85;c:winxpsystem32driversSSHDRV85.sys [28.3.2012 і. 00:43 78848] S3 GGSAFERDriver;GGSAFER Driver;??c:program filesGarena PlusRoomsafedrv.sys --> c:program filesGarena PlusRoomsafedrv.sys [?] . Contents of the 'Scheduled Tasks' folder . 2012-05-05 c:winxpTasksGoogleUpdateTaskUserS-1-5-21-842925246-1606980848-1177238915-1003Core.job - c:documents and settingsCGILocal SettingsApplication DataGoogleUpdateGoogleUpdate.exe [2011-06-17 15:09] . 2012-05-06 c:winxpTasksGoogleUpdateTaskUserS-1-5-21-842925246-1606980848-1177238915-1003UA.job - c:documents and settingsCGILocal SettingsApplication DataGoogleUpdateGoogleUpdate.exe [2011-06-17 15:09] . . ------- Supplementary Scan ------- . IE: E&xport to Microsoft Excel - c:progra~1MICROS~2OFFICE11EXCEL.EXE/3000 FF - ProfilePath - c:documents and settingsCGIApplication DataMozillaFirefoxProfilesphlg1102.default FF - prefs.js: browser.search.selectedEngine - Yahoo FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=937811&p= . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2012-05-07 12:17 Windows 5.1.2600 Service Pack 3 NTFS . scanning hidden processes ... . scanning hidden autostart entries ... . scanning hidden files ... . scan completed successfully hidden files: 0 . ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- . - - - - - - - > 'explorer.exe'(4040) c:winxpsystem32WININET.dll c:winxpsystem32newdll.dll c:winxpsystem32ieframe.dll c:winxpsystem32webcheck.dll c:winxpsystem32wpdshserviceobj.dll c:winxpsystem32portabledevicetypes.dll c:winxpsystem32portabledeviceapi.dll . ------------------------ Other Running Processes ------------------------ . c:winxpsystem32nvsvc32.exe c:winxpsystem32wscntfy.exe c:winxpRTHDCPL.EXE c:winxpsystem32RUNDLL32.EXE . ************************************************************************** . Completion time: 2012-05-07 12:20:30 - machine was rebooted ComboFix-quarantined-files.txt 2012-05-07 09:20 ComboFix2.txt 2012-05-06 18:39 . Pre-Run: 28 941 832 192 bytes free Post-Run: 28 931 969 024 bytes free . - - End Of File - - 671B5D768D992A1ABA3E560366E21903

Деинсталирайте Combofix:

Натиснете Start => в полето за търсене въведете командата Combofix /Uninstall (има празно място между Combofix и /Uninstall) и натиснете Enter.

Публикувано изображение

Деинсталирайте OTL:

Стартирайте OTL още веднъж и натиснете бутона CleanUp.

Публикувано изображение

Ще последва рестарт на Windows.

Изтрийте ръчно всички инструменти и логове, които не са се изтрили при гореспоменатите процедури.

Изтрийте ръчно следните преки пътища:

c:documents and settingsCGIStart MenuProgramsStartupRegistration Heroes of Might & Magic 5 - Hammers of Fate.LNK
c:documents and settingsCGIStart MenuProgramsStartupRegistration Heroes of Might & Magic 5.LNK
c:documents and settingsCGIStart MenuProgramsStartup_uninst_37884409.lnk

Направете последна проверка с Kaspersky Virus Removal Tool и след това ще дам финалните съвети. :)

Архивирана тема

Темата е твърде стара и е архивирана. Не можете да добавяте нови отговори в нея, но винаги можете да публикувате нова тема, в която да продължи дискусията. Регистрирайте се или влезте във вашия профил за да публикувате нова тема.

Назад

Разглеждащи това в момента 0

  • Няма регистрирани потребители разглеждащи тази страница.

Дарение

  • Подкрепи съществуването на форума - направи дарение
    32%
    Дарени 315 € от нужните 1 000 €

Бюлетин

Получавайте известие, когато има важна промяна или новина свързана с форума.
Абонирайте се

Профил

Навигация

Търсене

Търсене

Конфигуриране на push известия в браузъра
Chrome (Android)
  1. Докоснете иконата на катинар до адресната лента.
  2. Докоснете Разрешения → Известия.
  3. Променете предпочитанията си.
Chrome (Desktop)
  1. Кликнете върху иконата на катинар в адресната лента.
  2. Изберете Настройки на сайта.
  3. Намерете Известия и коригирайте предпочитанията си.