Здравейте, от около седмица имам проблем с РС в къщи. Миналата неделя спрях защитите на антивирусната НОД32(триал версия), не си спомням точно за какво, в последствие след включването им изписа, че е намерил гадинка и е необходимо да се рестартира компютъра за почистването и. За съжаление не обърнах внимание какво е намерило, тъй като не си спомням да съм свалял, или инсталирал нищо. Мисля, че пишеше win32 Sandy или Samba. След рестартиране, НОДа изписа, че е повреден и че трябва да се преинсталира. Опитах се да направя това нещо, но след деинсталацията ми изписва, че има друга версия и не може да се инсталира. Имам инсталиран Malware bytes, но постоянно ми дава грешка и не сканира. В момента ползвам чужд хард с ОС на него. Пуснах другата ОС, сканирах с триал НОД32 и не намира зловреди обекти, освен предполагаеми такива, които са ми познати. Операционната система ми е WIN 7 32 бит, разполагам с диск за преинсталация. Бих преинсталирал и да си реша проблема, но както споменах ползвам чужд хард (моя е в сервиз и чакам да ми се подмени), Записал съм си информацията на друг чужд хад и като нямам спомен да съм инсталирал или свалял нещо, съм притеснен дали не съм заразил дисковете и на двама познати. Това са логовете от компютъра: DDS (Ver_2011-09-30.01) - NTFS_x86 Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 10.0.0 Run by KOLIO at 17:18:05 on 2012-05-26 Microsoft Windows 7 Ultimate 6.1.7601.1.1251.359.1033.18.2047.888 [GMT 3:00] . SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . ============== Running Processes ================ . C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\nvvsvc.exe C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe C:\Program Files\Creative\Shared Files\CTAudSvc.exe C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe C:\Windows\system32\nvvsvc.exe C:\Windows\System32\spoolsv.exe C:\Program Files\EATON\PersonalSolutionPac\RunSC.exe C:\Program Files\EATON\PersonalSolutionPac\PCtl.exe C:\Program Files\Common Files\Microsoft Shared\IME14\SHARED\IMEDICTUPDATE.EXE C:\Program Files\iZ3D Driver\Win32\S3DCService.exe C:\Program Files\EATON\PersonalSolutionPac\BIL.exe C:\Program Files\EATON\PersonalSolutionPac\CilUSB.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\system32\taskhost.exe C:\Program Files\ASUS\AI Suite\AiNap\AiNap.exe C:\Program Files\Creative\Volume Panel\VolPanlu.exe C:\Program Files\Logitech\SetPointP\SetPoint.exe C:\Program Files\EATON\PersonalSolutionPac\mgenetsystray.exe C:\Windows\System32\Ctxfihlp.exe C:\Program Files\3RVX\3RVX.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Program Files\DAEMON Tools Lite\DTLite.exe C:\Program Files\Stardock\CursorFX\CursorFX.exe C:\Program Files\uTorrent\uTorrent.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\MagicTune Premium\GammaTray.exe C:\New folder\PROGRAMI\Rainlendar 0.22.1\Rainlendar\Rainlendar.exe C:\Program Files\Stardock\ObjectDockFree\ObjectDock.exe C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE C:\Windows\SYSTEM32\CTXFISPI.EXE C:\Windows\system32\SearchIndexer.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\plugin-container.exe C:\Program Files\Nero\Update\NASvc.exe C:\Windows\system32\conhost.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k RPCSS C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Windows\system32\svchost.exe -k imgsvc C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalServicePeerNet C:\Windows\System32\svchost.exe -k secsvcs . ============== Pseudo HJT Report =============== . uURLSearchHooks: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - c:\program files\utorrentbar\prxtbuTo0.dll mURLSearchHooks: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - c:\program files\utorrentbar\prxtbuTo0.dll BHO: ExplorerBHO Class: {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - c:\program files\classic shell\ClassicExplorer32.dll BHO: Skype Browser Helper: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - c:\program files\microsoft office\office14\URLREDIR.DLL BHO: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - c:\program files\utorrentbar\prxtbuTo0.dll BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre7\bin\jp2ssv.dll BHO: Logitech Scroll App: {E11DB59D-5008-42ff-9069-535843BC0BE1} - c:\program files\logitech\scrollapp\LogiSmooth.dll TB: uTorrentBar Toolbar: {BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} - c:\program files\utorrentbar\prxtbuTo0.dll TB: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - c:\program files\utorrentbar\prxtbuTo0.dll TB: Classic Explorer Bar: {553891B7-A0D5-4526-BE18-D3CE461D6310} - c:\program files\classic shell\ClassicExplorer32.dll uRun: [skinClock] c:\program files\clock tray skins\ClockTraySkins.exe uRun: [3RVX] c:\program files\3rvx\3RVX.exe uRun: [sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun uRun: [DAEMON Tools Lite] "c:\program files\daemon tools lite\DTLite.exe" -autorun uRun: [CursorFX] "c:\program files\stardock\cursorfx\CursorFX.exe" uRun: [uTorrent] "c:\program files\utorrent\uTorrent.exe" /MINIMIZED uRun: [skype] "c:\program files\skype\phone\Skype.exe" /minimized /regrun uRun: [Windows Update Server] c:\users\kolio\9babae71-3127.exe mRun: [Ai Nap] "c:\program files\asus\ai suite\ainap\AiNap.exe" mRun: [QFan Help] "c:\program files\asus\ai suite\qfan3\QFanHelp.exe" mRun: [Cpu Level Up help] "c:\program files\asus\ai suite\CpuLevelUpHelp.exe" mRun: [VolPanel] "c:\program files\creative\volume panel\VolPanlu.exe" /r mRun: [EvtMgr6] c:\program files\logitech\setpointp\SetPoint.exe /launchGaming mRun: [pspNetSystray] c:\program files\eaton\personalsolutionpac\mgenetsystray.exe mRun: [MagicTuneLauncher] c:\program files\magictune premium\MagicTuneLauncher.exe mRun: [CTxfiHlp] CTXFIHLP.EXE mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray StartupFolder: c:\users\kolio\appdata\roaming\micros~1\windows\startm~1\programs\startup\rainle~2.lnk - c:\new folder\programi\rainlendar 0.22.1\rainlendar\Rainlendar.exe StartupFolder: c:\users\kolio\appdata\roaming\micros~1\windows\startm~1\programs\startup\stardo~1.lnk - c:\program files\stardock\objectdockfree\ObjectDock.exe StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\gammat~1.lnk - c:\program files\magictune premium\GammaTray.exe uPolicies-Explorer: NoDriveTypeAutoRun = dword:145 mPolicies-System: ConsentPromptBehaviorAdmin = dword:0 mPolicies-System: ConsentPromptBehaviorUser = dword:3 mPolicies-System: EnableLUA = dword:0 mPolicies-System: EnableUIADesktopToggle = dword:0 mPolicies-System: PromptOnSecureDesktop = dword:0 IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office14\EXCEL.EXE/3000 IE: {64964764-1101-4bbd-8891-B56B1A53B9B3} - {553891B7-A0D5-4526-BE18-D3CE461D6310} IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0-windows-i586.cab DPF: {CAFEEFAC-0017-0000-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0-windows-i586.cab TCP: NameServer = 217.10.240.2 217.10.240.242 192.168.1.1 TCP: Interfaces\{010CC14B-556A-4880-BC88-F7E8EFABF2F7} : DHCPNameServer = 217.10.240.2 217.10.240.242 192.168.1.1 TCP: Interfaces\{0EEEBE4F-59BC-4301-9CBC-8846BFA12AF0} : DHCPNameServer = 217.10.240.2 217.10.240.242 192.168.1.1 TCP: Interfaces\{82DFF0AE-E49A-4661-857F-1C700ED3481E} : DHCPNameServer = 192.168.1.1 Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\common files\microsoft shared\office14\MSOXMLMF.DLL Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\program files\common files\skype\Skype4COM.dll Notify: LBTWlgn - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll SSODL: WebCheck - <orphaned> STS: ObjectDockShlExt Class - {1984D045-52CF-49cd-DB77-08F378FEA4DB} - c:\program files\stardock\objectdockfree\ODMenu.dll . ================= FIREFOX =================== . FF - ProfilePath - c:\users\kolio\appdata\roaming\mozilla\firefox\profiles\febeprof.kolio\ FF - prefs.js: browser.search.defaulturl - hxxp://search.winamp.com/search/search?query={searchTerms}&invocationType=tb50-ff-winamp-chromesbox-en-us&tb_uuid=20111115165448450&tb_oid=15-11-2011&tb_mrud=15-11-2011&query= FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q= FF - component: c:\program files\nokia\nokia pc suite 7\bkmrksync\components\BkMrkExt.dll FF - plugin: c:\progra~1\micros~2\office14\NPAUTHZ.DLL FF - plugin: c:\progra~1\micros~2\office14\NPSPWRAP.DLL FF - plugin: c:\program files\foxit software\foxit phantompdf\plugins\npFoxitPhantomPDFPlugin.dll FF - plugin: c:\program files\google\update\1.3.21.111\npGoogleUpdate3.dll FF - plugin: c:\program files\inhatchteam\inhatch\npinhatch.dll FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll FF - plugin: c:\program files\java\jre7\bin\new_plugin\npdeployJava1.dll FF - plugin: c:\program files\java\jre7\bin\new_plugin\npjp2.dll FF - plugin: c:\program files\microsoft silverlight\4.1.10111.0\npctrlui.dll FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll FF - plugin: c:\program files\mozilla firefox\plugins\npwachk.dll FF - plugin: c:\program files\nvidia corporation\3d vision\npnv3dv.dll FF - plugin: c:\program files\nvidia corporation\3d vision\npnv3dvstreaming.dll FF - plugin: c:\users\kolio\appdata\roaming\mozilla\firefox\profiles\febeprof.kolio\extensions\{1bc9ba34-1eed-42ca-a505-6d2f1a935bbb}\plugins\npietab2.dll FF - plugin: c:\users\kolio\appdata\roaming\mozilla\firefox\profiles\febeprof.kolio\extensions\[email protected]\plugins\npLogitechDeviceDetection.dll FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_2_202_235.dll FF - plugin: c:\windows\system32\tvuax\npTVUAx.dll . ============= SERVICES / DRIVERS =============== . R1 ArcSec;ArcSec;c:\windows\system32\drivers\ArcSec.sys [2010-9-21 192504] R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\drivers\dtsoftbus01.sys [2011-11-16 239168] R1 iZ3DInjectionDriver;Driver inject our D3D and OGL wrappers;c:\program files\iz3d driver\win32\S3DInjectionDriver.sys [2011-12-31 34968] R1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\drivers\vwififlt.sys [2009-7-14 48128] R2 EATON Service module;EATON Service module;c:\program files\eaton\personalsolutionpac\RunSC.exe [2011-11-15 126976] R2 ImeDictUpdateService;Microsoft IME Dictionary Update;c:\program files\common files\microsoft shared\ime14\shared\IMEDICTUPDATE.EXE [2010-10-20 59760] R2 NAUpdate;Nero Update;c:\program files\nero\update\NASvc.exe [2011-9-23 641832] R2 S3DSvc32;S3D Service (Win32);c:\program files\iz3d driver\win32\S3DCService.exe [2011-12-31 360960] R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\nvidia corporation\3d vision\nvSCPAPISvr.exe [2012-2-29 382272] R3 CT20XUT.SYS;CT20XUT.SYS;c:\windows\system32\drivers\CT20XUT.sys [2010-5-5 171096] R3 CTEXFIFX.SYS;CTEXFIFX.SYS;c:\windows\system32\drivers\CTEXFIFX.sys [2010-5-5 1324120] R3 CTHWIUT.SYS;CTHWIUT.SYS;c:\windows\system32\drivers\CTHWIUT.sys [2010-5-5 72792] R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\drivers\Rt86win7.sys [2011-6-10 394856] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 gupdate;Услуга на Google Актуализация (gupdate);c:\program files\google\update\GoogleUpdate.exe [2012-5-21 136176] S2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2012-3-3 654408] S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\nvidia corporation\nvidia update core\daemonu.exe [2012-2-26 2348352] S2 SkypeUpdate;Skype Updater;c:\program files\skype\updater\Updater.exe [2012-2-29 158856] S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\macromed\flash\FlashPlayerUpdateService.exe [2012-4-17 257696] S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-14 229888] S3 Creative ALchemy AL6 Licensing Service;Creative ALchemy AL6 Licensing Service;c:\program files\common files\creative labs shared\service\AL6Licensing.exe [2011-11-14 79360] S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files\common files\creative labs shared\service\CTAELicensing.exe [2011-11-15 79360] S3 Creative Dolby Digital Live Pack Licensing Service;Creative Dolby Digital Live Pack Licensing Service;c:\program files\common files\creative labs shared\service\DDLLicensing.exe [2011-11-14 79360] S3 CT20XUT;CT20XUT;c:\windows\system32\drivers\CT20XUT.sys [2010-5-5 171096] S3 CTEXFIFX;CTEXFIFX;c:\windows\system32\drivers\CTEXFIFX.sys [2010-5-5 1324120] S3 CTHWIUT;CTHWIUT;c:\windows\system32\drivers\CTHWIUT.sys [2010-5-5 72792] S3 gupdatem;Услуга на Google Актуализация (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2012-5-21 136176] S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-12-20 22344] S3 osppsvc;Office Software Protection Platform;c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\OSPPSVC.EXE [2010-1-9 4640000] S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2011-11-15 15872] S3 RTL8187;Realtek RTL8187 Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\drivers\RTL8187.sys [2010-1-7 375808] S3 Sony Ericsson PCCompanion;Sony Ericsson PCCompanion;c:\program files\sony ericsson\sony ericsson pc companion\PCCService.exe [2012-1-26 155344] S3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\TsUsbFlt.sys [2011-11-15 52224] S3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\wat\WatAdminSvc.exe [2011-11-15 1343400] S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\drivers\yk62x86.sys [2009-9-28 315392] . =============== Created Last 30 ================ . 2012-05-26 13:45:30 56200 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{4ff555da-272a-4cd2-b23e-bdf9cb3ab6a6}\offreg.dll 2012-05-21 19:19:03 -------- d-----w- c:\programdata\AVAST Software 2012-05-21 19:19:03 -------- d-----w- c:\program files\AVAST Software 2012-05-20 19:46:42 -------- d-----w- c:\program files\ESET 2012-05-20 18:29:26 -------- d-----w- c:\users\kolio\appdata\roaming\MPC-BE 2012-05-20 12:49:49 -------- d-----w- c:\users\kolio\appdata\local\ESET 2012-05-20 08:34:43 41472 ----a-w- c:\users\kolio\9babae71-3127.exe 2012-05-02 14:47:57 -------- d-----w- C:\filmi 2012-05-01 15:22:49 -------- d-----w- C:\New folder . ==================== Find3M ==================== . 2012-05-06 20:44:05 70304 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2012-05-06 20:44:05 419488 ----a-w- c:\windows\system32\FlashPlayerApp.exe 2012-04-04 12:56:40 22344 ----a-w- c:\windows\system32\drivers\mbam.sys 2012-02-29 23:59:00 881984 ----a-w- c:\windows\system32\nvgenco32.dll 2012-02-29 23:59:00 7713088 ----a-w- c:\windows\system32\nvwgf2um.dll 2012-02-29 23:59:00 61248 ----a-w- c:\windows\system32\OpenCL.dll 2012-02-29 23:59:00 5892928 ----a-w- c:\windows\system32\nvcuda.dll 2012-02-29 23:59:00 2517312 ----a-w- c:\windows\system32\nvcuvid.dll 2012-02-29 23:59:00 2437440 ----a-w- c:\windows\system32\nvcuvenc.dll 2012-02-29 23:59:00 2301248 ----a-w- c:\windows\system32\nvapi.dll 2012-02-29 23:59:00 19444544 ----a-w- c:\windows\system32\nvoglv32.dll 2012-02-29 23:59:00 17543488 ----a-w- c:\windows\system32\nvcompiler.dll 2012-02-29 23:59:00 15009600 ----a-w- c:\windows\system32\nvd3dum.dll 2012-02-29 23:59:00 10819392 ----a-w- c:\windows\system32\drivers\nvlddmkm.sys 2012-02-29 23:59:00 1000256 ----a-w- c:\windows\system32\nvdispco32.dll 2012-02-29 20:56:41 3881792 ----a-w- c:\windows\system32\nvcpl.dll 2012-02-29 20:55:16 2719040 ----a-w- c:\windows\system32\nvsvc.dll 2012-02-29 20:53:47 108352 ----a-w- c:\windows\system32\nvmctray.dll 2012-02-29 20:53:46 645440 ----a-w- c:\windows\system32\nvvsvc.exe 2012-02-29 20:53:46 62272 ----a-w- c:\windows\system32\nvshext.dll 2012-02-29 20:53:45 2561344 ----a-w- c:\windows\system32\nvsvcr.dll 2012-02-29 11:26:56 416064 ----a-w- c:\windows\system32\nvStreaming.exe . ============= FINISH: 17:18:21,69 =============== attach.txt . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2011-09-30.01) . Microsoft Windows 7 Ultimate Boot Device: \Device\HarddiskVolume1 Install Date: 15.11.2011 г. 06:42:54 System Uptime: 26.5.2012 г. 16:42:15 (1 hours ago) . Motherboard: ASUSTeK Computer INC. | | P5B-Deluxe Processor: Intel® Core™2 Duo CPU E6750 @ 2.66GHz | LGA 775 | 2664/333mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 56 GiB total, 1,608 GiB free. D: is FIXED (NTFS) - 0 GiB total, 0,031 GiB free. E: is CDROM () F: is CDROM () G: is CDROM () H: is FIXED (NTFS) - 48 GiB total, 2,538 GiB free. I: is FIXED (NTFS) - 250 GiB total, 5,954 GiB free. . ==== Disabled Device Manager Items ============= . Class GUID: {4d36e96f-e325-11ce-bfc1-08002be10318} Description: Microsoft PS/2 Mouse Device ID: ACPI\PNP0F03\4&38495A6&0 Manufacturer: Microsoft Name: Microsoft PS/2 Mouse PNP Device ID: ACPI\PNP0F03\4&38495A6&0 Service: i8042prt . Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318} Description: Marvell Yukon 88E8001/8003/8010 PCI Gigabit Ethernet Controller Device ID: PCI\VEN_11AB&DEV_4320&SUBSYS_811A1043&REV_14\4&E6D76C4&0&20F0 Manufacturer: Marvell Name: Marvell Yukon 88E8001/8003/8010 PCI Gigabit Ethernet Controller PNP Device ID: PCI\VEN_11AB&DEV_4320&SUBSYS_811A1043&REV_14\4&E6D76C4&0&20F0 Service: yukonw7 . Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318} Description: Marvell Yukon 88E8056 PCI-E Gigabit Ethernet Controller Device ID: PCI\VEN_11AB&DEV_4364&SUBSYS_81F81043&REV_12\4&360CE69C&0&00E5 Manufacturer: Marvell Name: Marvell Yukon 88E8056 PCI-E Gigabit Ethernet Controller PNP Device ID: PCI\VEN_11AB&DEV_4364&SUBSYS_81F81043&REV_12\4&360CE69C&0&00E5 Service: yukonw7 . Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318} Description: Realtek RTL8187 Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter Device ID: USB\VID_0BDA&PID_8187\0015AF0B3DC6 Manufacturer: Realtek Semiconductor Corp. Name: Realtek RTL8187 Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter PNP Device ID: USB\VID_0BDA&PID_8187\0015AF0B3DC6 Service: RTL8187 . ==== System Restore Points =================== . RP90: 29.4.2012 г. 22:45:56 - Scheduled Checkpoint RP92: 5.5.2012 г. 09:29:17 - Configured Platform RP100: 20.5.2012 г. 23:02:42 - Installed ESET Smart Security RP101: 21.5.2012 г. 07:51:02 - ESET Smart Security е инсталиран RP102: 21.5.2012 г. 18:52:01 - ESET Smart Security е инсталиран RP103: 21.5.2012 г. 22:18:57 - avast! Free Antivirus Инсталация RP104: 22.5.2012 г. 07:48:53 - avast! Free Antivirus Инсталация . ==== Installed Programs ====================== . µTorrent Надявам се да получа съдействие и благодаря предварително.

Здравейте..!

Изтеглете ComboFix от тук или тук и го запазете на десктопа си.

• Изключете вашата антивирусна и антишпионска програма, обикновено това става чрез натискане на десния бутон на мишката върху иконата на програма в системния трей.

Бележка: Ако не можете я спрете или не сте сигурни коя програма да изключите, моля прегледайте информацията от този линк: How to Disable your Security Programs

• Стартирайте Combo-Fix.com и следвайте инструкциите.

Бележка: ComboFix ще се стартира без инсталирана Recovery Console.

• Като част от неговата работа, ComboFix ще провери дали Microsoft Windows Recovery Console е инсталирана. Предвид бързо развиващия се зловреден софтуер е силно препоръчително да бъде инсталирана преди премахването на зловредния софтуер. Това ще Ви позволи да влезете в специален recovery/repair режим, който ще ни позволи по-лесно да решите проблем, който би могъл да възникне при премахване на зловредния софтуер.

• Следвайте инструкциите, за да позволите на ComboFix да изтегли и инсталира Microsoft Windows Recovery Console. В един момент ще бъдете попитани дали сте съгласни с лицензното споразумение. Необходимо е да потвърдите, че сте съгласни, за да инсталирате Microsoft Windows Recovery Console.

** Забележете: Ако Microsoft Windows Recovery Console е вече инсталирана, ComboFix ще продължи към процеса по премахване на зловредния софтуер.

След като Microsoft Windows Recovery Console е инсталирана, използвайки ComboFix, Вие ще видите следното съобщение:

Изберете Yes, за да продължи сканирането за зловреден софтуер.

Когато процесът приключи успешно, инструментът ще създаде лог файл. Моля, включете съдържанието на C:ComboFix.txt в следващия Ви коментар в тази тема.

Бележка:

• Моля, не движете мишката, докато ComboFix работи. Това може да наруши процеса на работа.
• ComboFix ще нулира всички настройки на Microsoft Internet Explorer, включително да направи IE браузър по подразбиране.
• ComboFix ще изключи autorun функцията на ВСИЧКИ CD, Floppy и USB устройства, за да помогне при премахването на зловредния софтуер и Ви защити от бъдещи вируси/заплахи, които поразяват чрез autorun. Ако това е проблем за вас - моля, уведомете ме.
• ComboFix ще изключи вашата интернет връзка. Интернет връзката ще се възстанови автоматично, преди ComboFix да завърши процеса на работа. При проблем, той ще прекрати интернет връзката. За да възстановите интернет връзката си, рестартирайте компютъра си.
• В случай на проблем с ComboFix, той може да създаде лог файл. Моля, включете съдържанието на C:BUG.txt в следващия Ви коментар в тази тема.

Моля, не прикачвайте лог файла/овете от програмата, а го/ги копирайте и поставете в следващия Ви коментар в тази тема.

Като поствах темата, вече бях пуснал да се сканира с майкрософт сейфти скенер. Намери ми OpenCandy, мисля че това ми изписа и нода преди проблемите. Поствам новите логове и не пипам нищо повече без инструкция:

DDS (Ver_2011-09-30.01) - NTFS_x86

Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 10.0.0

Run by KOLIO at 10:44:25 on 2012-05-27

Microsoft Windows 7 Ultimate 6.1.7601.1.1251.359.1033.18.2047.593 [GMT 3:00]

.

SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

============== Running Processes ================

.

C:Windowssystem32wininit.exe

C:Windowssystem32lsm.exe

C:Windowssystem32nvvsvc.exe

C:Program FilesNVIDIA Corporation3D VisionnvSCPAPISvr.exe

C:Program FilesCreativeShared FilesCTAudSvc.exe

C:WindowsSystem32spoolsv.exe

C:Program FilesNVIDIA CorporationDisplaynvxdsync.exe

C:Windowssystem32nvvsvc.exe

C:Program FilesEATONPersonalSolutionPacRunSC.exe

C:Program FilesEATONPersonalSolutionPacPCtl.exe

C:Program FilesCommon FilesMicrosoft SharedIME14SHAREDIMEDICTUPDATE.EXE

C:Program FilesiZ3D DriverWin32S3DCService.exe

C:Program FilesEATONPersonalSolutionPacBIL.exe

C:Program FilesEATONPersonalSolutionPacCilUSB.exe

C:Program FilesMalwarebytes' Anti-Malwarembamservice.exe

C:Program FilesNeroUpdateNASvc.exe

C:Program FilesWindows Media Playerwmpnetwk.exe

C:Windowssystem32SearchIndexer.exe

C:Windowssystem32Dwm.exe

C:Windowssystem32 askhost.exe

C:Program FilesASUSAI SuiteAiNapAiNap.exe

C:Program FilesCreativeVolume PanelVolPanlu.exe

C:Program FilesLogitechSetPointPSetPoint.exe

C:Program FilesEATONPersonalSolutionPacmgenetsystray.exe

C:Program FilesMalwarebytes' Anti-Malwarembamgui.exe

C:Program Files3RVX3RVX.exe

C:Program FilesWindows Sidebarsidebar.exe

C:Program FilesDAEMON Tools LiteDTLite.exe

C:Program FilesStardockCursorFXCursorFX.exe

C:Program FilesuTorrentuTorrent.exe

C:Program FilesSkypePhoneSkype.exe

C:Program FilesMagicTune PremiumGammaTray.exe

C:New folderPROGRAMIRainlendar 0.22.1RainlendarRainlendar.exe

C:Program FilesStardockObjectDockFreeObjectDock.exe

C:WindowsSYSTEM32CTXFISPI.EXE

C:WindowsExplorer.exe

C:Program FilesMozilla Firefoxfirefox.exe

C:Program FilesMozilla Firefoxplugin-container.exe

C:Windowssystem32SearchProtocolHost.exe

C:Windowssystem32SearchFilterHost.exe

C:Windowssystem32wbemwmiprvse.exe

C:Windowssystem32vssvc.exe

C:Windowssystem32 askeng.exe

C:Windowssystem32conhost.exe

C:Windowssystem32svchost.exe -k DcomLaunch

C:Windowssystem32svchost.exe -k RPCSS

C:WindowsSystem32svchost.exe -k LocalServiceNetworkRestricted

C:WindowsSystem32svchost.exe -k LocalSystemNetworkRestricted

C:Windowssystem32svchost.exe -k netsvcs

C:Windowssystem32svchost.exe -k LocalService

C:Windowssystem32svchost.exe -k NetworkService

C:Windowssystem32svchost.exe -k LocalServiceNoNetwork

C:Windowssystem32svchost.exe -k LocalServiceAndNoImpersonation

C:Windowssystem32svchost.exe -k imgsvc

C:WindowsSystem32svchost.exe -k secsvcs

C:Windowssystem32svchost.exe -k NetworkServiceNetworkRestricted

C:WindowsSystem32svchost.exe -k LocalServicePeerNet

C:WindowsSystem32svchost.exe -k swprv

.

============== Pseudo HJT Report ===============

.

uURLSearchHooks: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - c:program filesutorrentbarprxtbuTo0.dll

mURLSearchHooks: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - c:program filesutorrentbarprxtbuTo0.dll

BHO: ExplorerBHO Class: {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - c:program filesclassic shellClassicExplorer32.dll

BHO: Skype Browser Helper: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - c:program filesskype oolbarsinternet explorerskypeieplugin.dll

BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - c:program filesmicrosoft officeoffice14URLREDIR.DLL

BHO: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - c:program filesutorrentbarprxtbuTo0.dll

BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:program filesjavajre7binjp2ssv.dll

BHO: Logitech Scroll App: {E11DB59D-5008-42ff-9069-535843BC0BE1} - c:program fileslogitechscrollappLogiSmooth.dll

TB: uTorrentBar Toolbar: {BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} - c:program filesutorrentbarprxtbuTo0.dll

TB: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - c:program filesutorrentbarprxtbuTo0.dll

TB: Classic Explorer Bar: {553891B7-A0D5-4526-BE18-D3CE461D6310} - c:program filesclassic shellClassicExplorer32.dll

uRun: [3RVX] c:program files3rvx3RVX.exe

uRun: [sidebar] c:program fileswindows sidebarsidebar.exe /autoRun

uRun: [DAEMON Tools Lite] "c:program filesdaemon tools liteDTLite.exe" -autorun

uRun: [CursorFX] "c:program filesstardockcursorfxCursorFX.exe"

uRun: [uTorrent] "c:program filesutorrentuTorrent.exe" /MINIMIZED

uRun: [skype] "c:program filesskypephoneSkype.exe" /minimized /regrun

mRun: [Ai Nap] "c:program filesasusai suiteainapAiNap.exe"

mRun: [QFan Help] "c:program filesasusai suiteqfan3QFanHelp.exe"

mRun: [Cpu Level Up help] "c:program filesasusai suiteCpuLevelUpHelp.exe"

mRun: [VolPanel] "c:program filescreativevolume panelVolPanlu.exe" /r

mRun: [EvtMgr6] c:program fileslogitechsetpointpSetPoint.exe /launchGaming

mRun: [pspNetSystray] c:program fileseatonpersonalsolutionpacmgenetsystray.exe

mRun: [MagicTuneLauncher] c:program filesmagictune premiumMagicTuneLauncher.exe

mRun: [CTxfiHlp] CTXFIHLP.EXE

mRun: [Malwarebytes' Anti-Malware] "c:program filesmalwarebytes' anti-malwarembamgui.exe" /starttray

StartupFolder: c:userskolioappdataroamingmicros~1windowsstartm~1programsstartuprainle~2.lnk - c:new folderprogramirainlendar 0.22.1rainlendarRainlendar.exe

StartupFolder: c:userskolioappdataroamingmicros~1windowsstartm~1programsstartupstardo~1.lnk - c:program filesstardockobjectdockfreeObjectDock.exe

StartupFolder: c:progra~2micros~1windowsstartm~1programsstartupgammat~1.lnk - c:program filesmagictune premiumGammaTray.exe

uPolicies-Explorer: NoDriveTypeAutoRun = dword:145

uPolicies-Explorer: NoDrives = dword:0

mPolicies-Explorer: NoDrives = dword:0

mPolicies-System: ConsentPromptBehaviorAdmin = dword:0

mPolicies-System: ConsentPromptBehaviorUser = dword:3

mPolicies-System: EnableLUA = dword:0

mPolicies-System: EnableUIADesktopToggle = dword:0

mPolicies-System: PromptOnSecureDesktop = dword:0

IE: E&xport to Microsoft Excel - c:progra~1micros~2office14EXCEL.EXE/3000

IE: {64964764-1101-4bbd-8891-B56B1A53B9B3} - {553891B7-A0D5-4526-BE18-D3CE461D6310}

IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:program filesskype oolbarsinternet explorerskypeieplugin.dll

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0-windows-i586.cab

DPF: {CAFEEFAC-0017-0000-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0-windows-i586.cab

TCP: NameServer = 217.10.240.2 217.10.240.242 192.168.1.1

TCP: Interfaces{010CC14B-556A-4880-BC88-F7E8EFABF2F7} : DHCPNameServer = 217.10.240.2 217.10.240.242 192.168.1.1

TCP: Interfaces{0EEEBE4F-59BC-4301-9CBC-8846BFA12AF0} : DHCPNameServer = 217.10.240.2 217.10.240.242 192.168.1.1

TCP: Interfaces{82DFF0AE-E49A-4661-857F-1C700ED3481E} : DHCPNameServer = 192.168.1.1

Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:program filescommon filesmicrosoft sharedoffice14MSOXMLMF.DLL

Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:program filesskype oolbarsinternet explorerskypeieplugin.dll

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:program filescommon filesskypeSkype4COM.dll

Notify: LBTWlgn - c:program filescommon fileslogishrdbluetoothLBTWlgn.dll

STS: ObjectDockShlExt Class - {1984D045-52CF-49cd-DB77-08F378FEA4DB} - c:program filesstardockobjectdockfreeODMenu.dll

.

================= FIREFOX ===================

.

FF - ProfilePath - c:userskolioappdataroamingmozillafirefoxprofilesfebeprof.kolio

FF - prefs.js: browser.search.defaulturl - hxxp://search.winamp.com/search/search?query={searchTerms}&invocationType=tb50-ff-winamp-chromesbox-en-us&tb_uuid=20111115165448450&tb_oid=15-11-2011&tb_mrud=15-11-2011&query=

FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=

FF - plugin: c:progra~1micros~2office14NPAUTHZ.DLL

FF - plugin: c:progra~1micros~2office14NPSPWRAP.DLL

FF - plugin: c:program filesfoxit softwarefoxit phantompdfpluginsnpFoxitPhantomPDFPlugin.dll

FF - plugin: c:program filesgoogleupdate1.3.21.111npGoogleUpdate3.dll

FF - plugin: c:program filesinhatchteaminhatchnpinhatch.dll

FF - plugin: c:program filesjavajre7binnew_pluginnpdeployJava1.dll

FF - plugin: c:program filesjavajre7binnew_pluginnpjp2.dll

FF - plugin: c:program filesmicrosoft silverlight4.1.10111.0npctrlui.dll

FF - plugin: c:program filesmozilla firefoxpluginsnpdeployJava1.dll

FF - plugin: c:program filesmozilla firefoxpluginsnpwachk.dll

FF - plugin: c:program filesnvidia corporation3d visionnpnv3dv.dll

FF - plugin: c:program filesnvidia corporation3d visionnpnv3dvstreaming.dll

FF - plugin: c:userskolioappdataroamingmozillafirefoxprofilesfebeprof.kolioextensions{1bc9ba34-1eed-42ca-a505-6d2f1a935bbb}pluginsnpietab2.dll

FF - plugin: c:userskolioappdataroamingmozillafirefoxprofilesfebeprof.kolioextensionsdevicedetection@logitech.compluginsnpLogitechDeviceDetection.dll

FF - plugin: c:windowssystem32macromedflashNPSWF32_11_2_202_235.dll

FF - plugin: c:windowssystem32 vuaxnpTVUAx.dll

.

============= SERVICES / DRIVERS ===============

.

R1 ArcSec;ArcSec;c:windowssystem32driversArcSec.sys [2010-9-21 192504]

R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:windowssystem32driversdtsoftbus01.sys [2011-11-16 239168]

R1 iZ3DInjectionDriver;Driver inject our D3D and OGL wrappers;c:program filesiz3d driverwin32S3DInjectionDriver.sys [2011-12-31 34968]

R1 vwififlt;Virtual WiFi Filter Driver;c:windowssystem32driversvwififlt.sys [2009-7-14 48128]

R2 EATON Service module;EATON Service module;c:program fileseatonpersonalsolutionpacRunSC.exe [2011-11-15 126976]

R2 ImeDictUpdateService;Microsoft IME Dictionary Update;c:program filescommon filesmicrosoft sharedime14sharedIMEDICTUPDATE.EXE [2010-10-20 59760]

R2 MBAMService;MBAMService;c:program filesmalwarebytes' anti-malwarembamservice.exe [2012-3-3 654408]

R2 NAUpdate;Nero Update;c:program filesneroupdateNASvc.exe [2011-9-23 641832]

R2 S3DSvc32;S3D Service (Win32);c:program filesiz3d driverwin32S3DCService.exe [2011-12-31 360960]

R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:program filesnvidia corporation3d visionnvSCPAPISvr.exe [2012-2-29 382272]

R3 CT20XUT.SYS;CT20XUT.SYS;c:windowssystem32driversCT20XUT.sys [2010-5-5 171096]

R3 CTEXFIFX.SYS;CTEXFIFX.SYS;c:windowssystem32driversCTEXFIFX.sys [2010-5-5 1324120]

R3 CTHWIUT.SYS;CTHWIUT.SYS;c:windowssystem32driversCTHWIUT.sys [2010-5-5 72792]

R3 MBAMProtector;MBAMProtector;c:windowssystem32driversmbam.sys [2011-12-20 22344]

R3 RTL8167;Realtek 8167 NT Driver;c:windowssystem32driversRt86win7.sys [2011-6-10 394856]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:windowsmicrosoft.netframeworkv4.0.30319mscorsvw.exe [2010-3-18 130384]

S2 gupdate;Услуга на Google Актуализация (gupdate);c:program filesgoogleupdateGoogleUpdate.exe [2012-5-21 136176]

S2 nvUpdatusService;NVIDIA Update Service Daemon;c:program filesnvidia corporationnvidia update coredaemonu.exe [2012-2-26 2348352]

S2 SkypeUpdate;Skype Updater;c:program filesskypeupdaterUpdater.exe [2012-2-29 158856]

S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:windowssystem32macromedflashFlashPlayerUpdateService.exe [2012-4-17 257696]

S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:windowssystem32driversb57nd60x.sys [2009-7-14 229888]

S3 Creative ALchemy AL6 Licensing Service;Creative ALchemy AL6 Licensing Service;c:program filescommon filescreative labs sharedserviceAL6Licensing.exe [2011-11-14 79360]

S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:program filescommon filescreative labs sharedserviceCTAELicensing.exe [2011-11-15 79360]

S3 Creative Dolby Digital Live Pack Licensing Service;Creative Dolby Digital Live Pack Licensing Service;c:program filescommon filescreative labs sharedserviceDDLLicensing.exe [2011-11-14 79360]

S3 CT20XUT;CT20XUT;c:windowssystem32driversCT20XUT.sys [2010-5-5 171096]

S3 CTEXFIFX;CTEXFIFX;c:windowssystem32driversCTEXFIFX.sys [2010-5-5 1324120]

S3 CTHWIUT;CTHWIUT;c:windowssystem32driversCTHWIUT.sys [2010-5-5 72792]

S3 gupdatem;Услуга на Google Актуализация (gupdatem);c:program filesgoogleupdateGoogleUpdate.exe [2012-5-21 136176]

S3 osppsvc;Office Software Protection Platform;c:program filescommon filesmicrosoft sharedofficesoftwareprotectionplatformOSPPSVC.EXE [2010-1-9 4640000]

S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:windowssystem32driversrdpvideominiport.sys [2011-11-15 15872]

S3 RTL8187;Realtek RTL8187 Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;c:windowssystem32driversRTL8187.sys [2010-1-7 375808]

S3 Sony Ericsson PCCompanion;Sony Ericsson PCCompanion;c:program filessony ericssonsony ericsson pc companionPCCService.exe [2012-1-26 155344]

S3 TsUsbFlt;TsUsbFlt;c:windowssystem32driversTsUsbFlt.sys [2011-11-15 52224]

S3 WatAdminSvc;Windows Activation Technologies Service;c:windowssystem32watWatAdminSvc.exe [2011-11-15 1343400]

S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:windowssystem32driversyk62x86.sys [2009-9-28 315392]

SUnknown 37341d879194f409;37341d879194f409; [x]

.

=============== Created Last 30 ================

.

2012-05-27 07:31:12 -------- d-----w- C:$RECYCLE.BIN

2012-05-27 07:30:06 56200 ----a-w- c:programdatamicrosoftwindows defenderdefinition updates{4ff555da-272a-4cd2-b23e-bdf9cb3ab6a6}offreg.dll

2012-05-27 07:27:52 -------- d-----w- c:userskolioappdatalocal emp

2012-05-27 07:23:30 98816 ----a-w- c:windowssed.exe

2012-05-27 07:23:30 256000 ----a-w- c:windowsPEV.exe

2012-05-27 07:23:30 208896 ----a-w- c:windowsMBR.exe

2012-05-27 07:23:25 -------- d-----w- C:ComboFix

2012-05-27 06:29:59 -------- d-----w- c:program filesESET

2012-05-26 15:06:30 -------- d-----w- c:windowssystem32MpEngineStore

2012-05-21 19:19:03 -------- d-----w- c:programdataAVAST Software

2012-05-21 19:19:03 -------- d-----w- c:program filesAVAST Software

2012-05-20 18:29:26 -------- d-----w- c:userskolioappdataroamingMPC-BE

2012-05-20 12:49:49 -------- d-----w- c:userskolioappdatalocalESET

2012-05-02 14:47:57 -------- d-----w- C:filmi

2012-05-01 15:22:49 -------- d-----w- C:New folder

.

==================== Find3M ====================

.

2012-05-06 20:44:05 70304 ----a-w- c:windowssystem32FlashPlayerCPLApp.cpl

2012-05-06 20:44:05 419488 ----a-w- c:windowssystem32FlashPlayerApp.exe

2012-04-04 12:56:40 22344 ----a-w- c:windowssystem32driversmbam.sys

2012-02-29 23:59:00 881984 ----a-w- c:windowssystem32nvgenco32.dll

2012-02-29 23:59:00 7713088 ----a-w- c:windowssystem32nvwgf2um.dll

2012-02-29 23:59:00 61248 ----a-w- c:windowssystem32OpenCL.dll

2012-02-29 23:59:00 5892928 ----a-w- c:windowssystem32nvcuda.dll

2012-02-29 23:59:00 2517312 ----a-w- c:windowssystem32nvcuvid.dll

2012-02-29 23:59:00 2437440 ----a-w- c:windowssystem32nvcuvenc.dll

2012-02-29 23:59:00 2301248 ----a-w- c:windowssystem32nvapi.dll

2012-02-29 23:59:00 19444544 ----a-w- c:windowssystem32nvoglv32.dll

2012-02-29 23:59:00 17543488 ----a-w- c:windowssystem32nvcompiler.dll

2012-02-29 23:59:00 15009600 ----a-w- c:windowssystem32nvd3dum.dll

2012-02-29 23:59:00 10819392 ----a-w- c:windowssystem32driversnvlddmkm.sys

2012-02-29 23:59:00 1000256 ----a-w- c:windowssystem32nvdispco32.dll

2012-02-29 20:56:41 3881792 ----a-w- c:windowssystem32nvcpl.dll

2012-02-29 20:55:16 2719040 ----a-w- c:windowssystem32nvsvc.dll

2012-02-29 20:53:47 108352 ----a-w- c:windowssystem32nvmctray.dll

2012-02-29 20:53:46 645440 ----a-w- c:windowssystem32nvvsvc.exe

2012-02-29 20:53:46 62272 ----a-w- c:windowssystem32nvshext.dll

2012-02-29 20:53:45 2561344 ----a-w- c:windowssystem32nvsvcr.dll

2012-02-29 11:26:56 416064 ----a-w- c:windowssystem32nvStreaming.exe

.

============= FINISH: 10:44:35,38 ===============

ComboFix 12-05-27.01 - KOLIO 05.2012 г. 10:24:12.1.2 - x86

Microsoft Windows 7 Ultimate 6.1.7601.1.1251.359.1033.18.2047.773 [GMT 3:00]

Running from: c:new folderDESCTOPComboFix.exe

SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

C:Install.exe

c:usersKOLIO9babae71-3127.exe

c:usersKOLIOAppDataLocalTempe730ebe5-3127.tmp

c:usersKOLIOAppDataRoamingMicrosoftWindowsStart MenuPrograms3RVX.lnk

c:windowssystem32drivers37341d879194f409.sys

.

Infected copy of c:windowssystem32driversAGP440.sys was found and disinfected

Restored copy from - c:windowsSystem32DriverStoreFileRepositorymachine.inf_x86_neutral_a97a2a0d0fbc6696AGP440.sys

Infected copy of c:windowssystem32driversasyncmac.sys was found and disinfected

Restored copy from - c:windowswinsxsx86_microsoft-windows-rasbase-asyncmac_31bf3856ad364e35_6.1.7600.16385_none_242e2506962cd3e0asyncmac.sys

Infected copy of c:windowssystem32driverscdrom.sys was found and disinfected

Restored copy from - c:windowsSystem32DriverStoreFileRepositorycdrom.inf_x86_neutral_6381e09675524225cdrom.sys

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

-------Legacy_37341d879194f409

-------Service_37341d879194f409

.

.

((((((((((((((((((((((((( Files Created from 2012-04-27 to 2012-05-27 )))))))))))))))))))))))))))))))

.

.

2012-05-27 07:30 . 2012-05-27 07:30 56200 ----a-w- c:programdataMicrosoftWindows DefenderDefinition Updates{4FF555DA-272A-4CD2-B23E-BDF9CB3AB6A6}offreg.dll

2012-05-27 06:29 . 2012-05-27 06:29 -------- d-----w- c:program filesESET

2012-05-26 15:06 . 2012-05-27 06:17 -------- d-----w- c:windowssystem32MpEngineStore

2012-05-21 19:19 . 2012-05-21 19:19 -------- d-----w- c:program filesGoogle

2012-05-21 19:19 . 2012-05-27 07:16 -------- d-----w- c:programdataAVAST Software

2012-05-21 19:19 . 2012-05-27 07:08 -------- d-----w- c:program filesAVAST Software

2012-05-20 18:29 . 2012-05-20 18:29 -------- d-----w- c:usersKOLIOAppDataRoamingMPC-BE

2012-05-20 12:49 . 2012-05-20 12:49 -------- d-----w- c:usersKOLIOAppDataLocalESET

2012-05-20 08:29 . 2012-05-20 19:21 -------- d-----w- c:program filesCommon FilesSkype

2012-05-02 14:47 . 2012-05-19 16:59 -------- d-----w- C:filmi

2012-05-01 15:22 . 2012-05-20 09:50 -------- d-----w- C:New folder

.

.

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-05-06 20:44 . 2012-04-17 20:31 419488 ----a-w- c:windowssystem32FlashPlayerApp.exe

2012-05-06 20:44 . 2011-11-14 21:45 70304 ----a-w- c:windowssystem32FlashPlayerCPLApp.cpl

2012-04-04 12:56 . 2011-12-20 19:56 22344 ----a-w- c:windowssystem32driversmbam.sys

2012-02-29 23:59 . 2012-03-15 08:59 61248 ----a-w- c:windowssystem32OpenCL.dll

2012-02-29 23:59 . 2012-03-15 08:59 5892928 ----a-w- c:windowssystem32nvcuda.dll

2012-02-29 23:59 . 2012-03-15 08:59 2517312 ----a-w- c:windowssystem32nvcuvid.dll

2012-02-29 23:59 . 2012-03-15 08:59 2437440 ----a-w- c:windowssystem32nvcuvenc.dll

2012-02-29 23:59 . 2012-03-15 08:59 19444544 ----a-w- c:windowssystem32nvoglv32.dll

2012-02-29 23:59 . 2012-03-15 08:59 17543488 ----a-w- c:windowssystem32nvcompiler.dll

2012-02-29 23:59 . 2012-03-15 08:59 10819392 ----a-w- c:windowssystem32driversnvlddmkm.sys

2012-02-29 23:59 . 2011-11-14 21:19 881984 ----a-w- c:windowssystem32nvgenco32.dll

2012-02-29 23:59 . 2011-11-14 21:19 2301248 ----a-w- c:windowssystem32nvapi.dll

2012-02-29 23:59 . 2011-11-14 21:19 1000256 ----a-w- c:windowssystem32nvdispco32.dll

2012-02-29 23:59 . 2009-07-13 22:09 7713088 ----a-w- c:windowssystem32nvwgf2um.dll

2012-02-29 23:59 . 2009-06-10 21:19 15009600 ----a-w- c:windowssystem32nvd3dum.dll

2012-02-29 20:56 . 2011-11-14 21:20 3881792 ----a-w- c:windowssystem32nvcpl.dll

2012-02-29 20:55 . 2011-11-14 21:20 2719040 ----a-w- c:windowssystem32nvsvc.dll

2012-02-29 20:53 . 2011-11-14 21:20 108352 ----a-w- c:windowssystem32nvmctray.dll

2012-02-29 20:53 . 2011-11-14 21:20 645440 ----a-w- c:windowssystem32nvvsvc.exe

2012-02-29 20:53 . 2011-11-14 21:20 62272 ----a-w- c:windowssystem32nvshext.dll

2012-02-29 20:53 . 2011-11-14 21:20 2561344 ----a-w- c:windowssystem32nvsvcr.dll

2012-02-29 11:26 . 2012-02-29 11:26 416064 ----a-w- c:windowssystem32nvStreaming.exe

2012-03-04 12:10 . 2011-11-14 20:08 134104 ----a-w- c:program filesmozilla firefoxcomponentsbrowsercomps.dll

.

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerURLSearchHooks]

"{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}"= "c:program filesuTorrentBarprxtbuTo0.dll" [2011-05-09 176936]

.

[HKEY_CLASSES_ROOTclsid{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]

.

[HKEY_LOCAL_MACHINE~Browser Helper Objects{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]

2011-05-09 09:49 176936 ----a-w- c:program filesuTorrentBarprxtbuTo0.dll

.

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]

"{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}"= "c:program filesuTorrentBarprxtbuTo0.dll" [2011-05-09 176936]

.

[HKEY_CLASSES_ROOTclsid{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]

.

[HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerToolbarWebbrowser]

"{BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC}"= "c:program filesuTorrentBarprxtbuTo0.dll" [2011-05-09 176936]

.

[HKEY_CLASSES_ROOTclsid{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]

.

[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionexplorershelliconoverlayidentifiersShareOverlay]

@="{594D4122-1F87-41E2-96C7-825FB4796516}"

[HKEY_CLASSES_ROOTCLSID{594D4122-1F87-41E2-96C7-825FB4796516}]

2011-08-19 20:13 505344 ----a-w- c:program filesClassic ShellClassicExplorer32.dll

.

[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]

"3RVX"="c:program files3RVX3RVX.exe" [2008-10-13 159232]

"Sidebar"="c:program filesWindows Sidebarsidebar.exe" [2010-11-20 1174016]

"DAEMON Tools Lite"="c:program filesDAEMON Tools LiteDTLite.exe" [2011-11-10 3514176]

"CursorFX"="c:program filesStardockCursorFXCursorFX.exe" [2011-10-24 432784]

"uTorrent"="c:program filesuTorrentuTorrent.exe" [2012-05-12 880496]

"Skype"="c:program filesSkypePhoneSkype.exe" [2012-02-29 17151624]

.

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]

"Ai Nap"="c:program filesASUSAI SuiteAiNapAiNap.exe" [2009-08-21 1427968]

"QFan Help"="c:program filesASUSAI SuiteQFan3QFanHelp.exe" [2009-08-19 603136]

"Cpu Level Up help"="c:program filesASUSAI SuiteCpuLevelUpHelp.exe" [2009-08-21 887936]

"VolPanel"="c:program filesCreativeVolume PanelVolPanlu.exe" [2009-02-03 237693]

"EvtMgr6"="c:program filesLogitechSetPointPSetPoint.exe" [2011-10-07 1387288]

"pspNetSystray"="c:program filesEATONPersonalSolutionPacmgenetsystray.exe" [2008-09-24 1253376]

"MagicTuneLauncher"="c:program filesMagicTune PremiumMagicTuneLauncher.exe" [2010-12-21 51712]

"CTxfiHlp"="CTXFIHLP.EXE" [2010-05-05 25600]

"Malwarebytes' Anti-Malware"="c:program filesMalwarebytes' Anti-Malwarembamgui.exe" [2012-04-04 462408]

.

c:usersKOLIOAppDataRoamingMicrosoftWindowsStart MenuProgramsStartup

Rainlendar.exe - Shortcut.lnk - c:new folderPROGRAMIRainlendar 0.22.1RainlendarRainlendar.exe [2006-1-21 118784]

Stardock ObjectDock.lnk - c:program filesStardockObjectDockFreeObjectDock.exe [2010-10-6 3768176]

.

c:programdataMicrosoftWindowsStart MenuProgramsStartup

GammaTray.lnk - c:program filesMagicTune PremiumGammaTray.exe [2011-11-15 36864]

.

[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionpoliciessystem]

"ConsentPromptBehaviorAdmin"= 0 (0x0)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableLUA"= 0 (0x0)

"EnableUIADesktopToggle"= 0 (0x0)

"PromptOnSecureDesktop"= 0 (0x0)

.

[hkey_local_machinesoftwaremicrosoftwindowscurrentversionexplorerSharedTaskScheduler]

"{1984D045-52CF-49cd-DB77-08F378FEA4DB}"= "c:program filesStardockObjectDockFreeODMenu.dll" [2010-10-04 511344]

.

[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversionwinlogonnotifyLBTWlgn]

2011-09-27 19:03 66328 ----a-w- c:program filesCommon FilesLogiShrdBluetoothLBTWLgn.dll

.

[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversiondrivers32]

"mixer"=wdmaud.drv

.

[HKLM~startupfolderC:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^TotalMedia Server.lnk]

path=c:programdataMicrosoftWindowsStart MenuProgramsStartupTotalMedia Server.lnk

backup=c:windowspssTotalMedia Server.lnk.CommonStartup

backupExtension=.CommonStartup

.

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregIME14 CHS Setup]

2010-01-20 23:45 80240 ----a-w- c:progra~1COMMON~1MICROS~1IME14SHAREDIMEKLMG.EXE

.

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregIME14 CHT Setup]

2010-01-20 23:45 80240 ----a-w- c:progra~1COMMON~1MICROS~1IME14SHAREDIMEKLMG.EXE

.

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregIME14 JPN Setup]

2010-01-20 23:45 80240 ----a-w- c:progra~1COMMON~1MICROS~1IME14SHAREDIMEKLMG.EXE

.

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregIME14 KOR Setup]

2010-01-20 23:45 80240 ----a-w- c:progra~1COMMON~1MICROS~1IME14SHAREDIMEKLMG.EXE

.

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregLogiScrollApp]

2011-09-16 02:46 45848 ----a-w- c:program filesLogitechScrollAppKhalScroll.exe

.

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregNSU_agent]

2011-12-13 21:37 190768 ----a-w- c:program filesNokiaNokia Software Updaternsu3ui_agent.exe

.

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregPC Suite Tray]

2011-06-16 13:21 1500160 ----a-w- c:program filesNokiaNokia PC Suite 7PCSuite.exe

.

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregSunJavaUpdateSched]

2011-05-04 11:59 252136 ----a-w- c:program filesCommon FilesJavaJava Updatejusched.exe

.

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregWinampAgent]

2010-12-06 22:02 74752 ----a-w- c:program filesWinampwinampa.exe

.

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregXvid]

2011-01-17 19:41 8192 ----a-w- c:program filesXvidCheckUpdate.exe

.

R2 3127;3127;c:usersKOLIOAppDataLocalTemp3127.sys [x]

.

.

--- Other Services/Drivers In Memory ---

.

*NewlyCreated* - WS2IFSL

.

[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversionsvchost]

LocalServiceAndNoImpersonation REG_MULTI_SZ SSDPSRV upnphost SCardSvr TBS FontCache fdrespub AppIDSvc QWAVE wcncsvc SensrSvc

.

Contents of the 'Scheduled Tasks' folder

.

2012-05-27 c:windowsTasksAdobe Flash Player Updater.job

- c:windowssystem32MacromedFlashFlashPlayerUpdateService.exe [2012-04-17 20:44]

.

2012-05-27 c:windowsTasksGoogleUpdateTaskMachineCore.job

- c:program filesGoogleUpdateGoogleUpdate.exe [2012-05-21 19:19]

.

2012-05-27 c:windowsTasksGoogleUpdateTaskMachineUA.job

- c:program filesGoogleUpdateGoogleUpdate.exe [2012-05-21 19:19]

.

.

------- Supplementary Scan -------

.

IE: E&xport to Microsoft Excel - c:progra~1MICROS~2Office14EXCEL.EXE/3000

TCP: DhcpNameServer = 217.10.240.2 217.10.240.242 192.168.1.1

FF - ProfilePath - c:usersKOLIOAppDataRoamingMozillaFirefoxProfilesfebeprof.kolio

FF - prefs.js: browser.search.defaulturl - hxxp://search.winamp.com/search/search?query={searchTerms}&invocationType=tb50-ff-winamp-chromesbox-en-us&tb_uuid=20111115165448450&tb_oid=15-11-2011&tb_mrud=15-11-2011&query=

FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=

.

- - - - ORPHANS REMOVED - - - -

.

HKCU-Run-Windows Update Server - c:usersKOLIO9babae71-3127.exe

MSConfigStartUp-TNOD UP - c:program filesTNod User & Password FinderTNODUP.exe

.

.

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINEsoftwareClassesCLSID{645FF040-5081-101B-9F08-00AA002F954E}shellB20@O=5 *=0 *C*C*l*e*a*n*e*r*& command]

@="c:Program FilesCCleanerccleaner.exe"

.

[HKEY_LOCAL_MACHINEsystemControlSet001ControlClass{4D36E96D-E325-11CE-BFC1-08002BE10318}0000AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINEsystemControlSet001ControlPCWSecurity]

@Denied: (Full) (Everyone)

.

--------------------- DLLs Loaded Under Running Processes ---------------------

.

- - - - - - - > 'Explorer.exe'(2796)

c:program filesStardockObjectDockFreeDockShellHook.dll

c:program filesStardockObjectDockFreeODMenu.dll

c:program filesNokiaNokia PC Suite 7PhoneBrowser.dll

c:program filesNokiaNokia PC Suite 7NGSCM.DLL

c:program filesNokiaNokia PC Suite 7LangPhoneBrowser_eng.nlr

c:program filesNokiaNokia PC Suite 7ResourcePhoneBrowser_Nokia.ngr

.

------------------------ Other Running Processes ------------------------

.

c:windowssystem32nvvsvc.exe

c:program filesNVIDIA Corporation3D VisionnvSCPAPISvr.exe

c:program filesCreativeShared FilesCTAudSvc.exe

c:program filesNVIDIA CorporationDisplaynvxdsync.exe

c:windowssystem32nvvsvc.exe

c:program filesEATONPersonalSolutionPacRunSC.exe

c:program filesEATONPersonalSolutionPacPCtl.exe

c:program filesCommon FilesMicrosoft SharedIME14SHAREDIMEDICTUPDATE.EXE

c:program filesiZ3D DriverWin32S3DCService.exe

c:program filesEATONPersonalSolutionPacBIL.exe

c:program filesEATONPersonalSolutionPacCilUSB.exe

c:windowsservicingTrustedInstaller.exe

c:program filesMalwarebytes' Anti-Malwarembamservice.exe

c:program filesNeroUpdateNASvc.exe

c:windowssystem32sppsvc.exe

c:program filesWindows Media Playerwmpnetwk.exe

c:windowssystem32 askhost.exe

c:windowssystem32conhost.exe

c:windowsSYSTEM32CTXFISPI.EXE

c:?c:windowssystem32wbemWMIADAP.EXE

.

**************************************************************************

.

Completion time: 2012-05-27 10:33:52 - machine was rebooted

ComboFix-quarantined-files.txt 2012-05-27 07:33

.

Pre-Run: 1 719 570 432 bytes free

Post-Run: 2 067 357 696 bytes free

.

- - End Of File - - 16FBAC70179BD1D301BB7049832E7929

Не успявам да кача атач лога, пише ми че е много дълъг

Редактирано 27 май 201214 г. от koliomalinov (преглед на промените)

Архивирайте папката C:QooboxQuarantine с парола virus.Изпратете архива на адрес quarantine <at> safezone.cc (заместете <at> на @).Задължително укажете линк към вашата тема.

Виждам че сега сте без антивирус и има много остатъци от различни антивирусни програми,затова:

Копирайте текста в карето на notepad и го запазвате с име CFScript.txt на десктопа си:

KILLALL::
ClearJavaCache::

Folder::
c:program filesESET
c:programdataAVAST Software
c:program filesAVAST Software
c:usersKOLIOAppDataLocalESET

След съхранението преместете CFScript.txt на иконата на ComboFix.exe

Генерирания рапорт прикачете в следващия си пост..!

ComboFix 12-05-27.01 - KOLIO 05.2012 г. 14:29:45.2.2 - x86 Microsoft Windows 7 Ultimate 6.1.7601.1.1251.359.1033.18.2047.1073 [GMT 3:00] Running from: c:new folderDESCTOPComboFix.exe Command switches used :: c:new folderDESCTOPCFScript.txt SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:program filesAVAST Software c:program filesAVAST SoftwareAvastSetuphistory.ini c:program filesAVAST SoftwareAvastSetupsetup.ini c:program filesESET c:program filesESETESET NOD32 Antivirusem000_32.dat c:program filesESETESET NOD32 Antivirusem001_32.dat c:program filesESETESET NOD32 Antivirusem002_32.dat c:program filesESETESET NOD32 Antivirusem003_32.dat c:program filesESETESET NOD32 Antivirusem004_32.dat c:program filesESETESET NOD32 Antivirusem005_32.dat c:program filesESETESET NOD32 Antivirusem006_32.dat c:program filesESETESET NOD32 Antivirusem009_32.dat c:program filesESETESET NOD32 Antivirusem015_32.dat c:program filesESETESET NOD32 Antivirusem017_32.dat c:program filesESETESET NOD32 Antivirusem018_32.dat c:program filesESETESET NOD32 Antivirusem019_32.dat c:program filesESETESET NOD32 Antivirusem022_32.dat c:programdataAVAST Software c:usersKOLIOAppDataLocalESET . . ((((((((((((((((((((((((( Files Created from 2012-04-27 to 2012-05-27 ))))))))))))))))))))))))))))))) . . 2012-05-27 11:33 . 2012-05-27 11:34 -------- d-----w- c:usersKOLIOAppDataLocal emp 2012-05-27 11:33 . 2012-05-27 11:33 -------- d-----w- c:usersUpdatusUserAppDataLocal emp 2012-05-27 11:33 . 2012-05-27 11:33 -------- d-----w- c:usersDefaultAppDataLocal emp 2012-05-26 15:06 . 2012-05-27 06:17 -------- d-----w- c:windowssystem32MpEngineStore 2012-05-21 19:19 . 2012-05-21 19:19 -------- d-----w- c:program filesGoogle 2012-05-20 18:29 . 2012-05-20 18:29 -------- d-----w- c:usersKOLIOAppDataRoamingMPC-BE 2012-05-20 08:29 . 2012-05-20 19:21 -------- d-----w- c:program filesCommon FilesSkype 2012-05-02 14:47 . 2012-05-19 16:59 -------- d-----w- C:filmi 2012-05-01 15:22 . 2012-05-20 09:50 -------- d-----w- C:New folder . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-05-06 20:44 . 2012-04-17 20:31 419488 ----a-w- c:windowssystem32FlashPlayerApp.exe 2012-05-06 20:44 . 2011-11-14 21:45 70304 ----a-w- c:windowssystem32FlashPlayerCPLApp.cpl 2012-04-04 12:56 . 2011-12-20 19:56 22344 ----a-w- c:windowssystem32driversmbam.sys 2012-02-29 23:59 . 2012-03-15 08:59 61248 ----a-w- c:windowssystem32OpenCL.dll 2012-02-29 23:59 . 2012-03-15 08:59 5892928 ----a-w- c:windowssystem32nvcuda.dll 2012-02-29 23:59 . 2012-03-15 08:59 2517312 ----a-w- c:windowssystem32nvcuvid.dll 2012-02-29 23:59 . 2012-03-15 08:59 2437440 ----a-w- c:windowssystem32nvcuvenc.dll 2012-02-29 23:59 . 2012-03-15 08:59 19444544 ----a-w- c:windowssystem32nvoglv32.dll 2012-02-29 23:59 . 2012-03-15 08:59 17543488 ----a-w- c:windowssystem32nvcompiler.dll 2012-02-29 23:59 . 2012-03-15 08:59 10819392 ----a-w- c:windowssystem32driversnvlddmkm.sys 2012-02-29 23:59 . 2011-11-14 21:19 881984 ----a-w- c:windowssystem32nvgenco32.dll 2012-02-29 23:59 . 2011-11-14 21:19 2301248 ----a-w- c:windowssystem32nvapi.dll 2012-02-29 23:59 . 2011-11-14 21:19 1000256 ----a-w- c:windowssystem32nvdispco32.dll 2012-02-29 23:59 . 2009-07-13 22:09 7713088 ----a-w- c:windowssystem32nvwgf2um.dll 2012-02-29 23:59 . 2009-06-10 21:19 15009600 ----a-w- c:windowssystem32nvd3dum.dll 2012-02-29 20:56 . 2011-11-14 21:20 3881792 ----a-w- c:windowssystem32nvcpl.dll 2012-02-29 20:55 . 2011-11-14 21:20 2719040 ----a-w- c:windowssystem32nvsvc.dll 2012-02-29 20:53 . 2011-11-14 21:20 108352 ----a-w- c:windowssystem32nvmctray.dll 2012-02-29 20:53 . 2011-11-14 21:20 645440 ----a-w- c:windowssystem32nvvsvc.exe 2012-02-29 20:53 . 2011-11-14 21:20 62272 ----a-w- c:windowssystem32nvshext.dll 2012-02-29 20:53 . 2011-11-14 21:20 2561344 ----a-w- c:windowssystem32nvsvcr.dll 2012-02-29 11:26 . 2012-02-29 11:26 416064 ----a-w- c:windowssystem32nvStreaming.exe 2012-03-04 12:10 . 2011-11-14 20:08 134104 ----a-w- c:program filesmozilla firefoxcomponentsbrowsercomps.dll . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerURLSearchHooks] "{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}"= "c:program filesuTorrentBarprxtbuTo0.dll" [2011-05-09 176936] . [HKEY_CLASSES_ROOTclsid{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}] . [HKEY_LOCAL_MACHINE~Browser Helper Objects{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}] 2011-05-09 09:49 176936 ----a-w- c:program filesuTorrentBarprxtbuTo0.dll . [HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar] "{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}"= "c:program filesuTorrentBarprxtbuTo0.dll" [2011-05-09 176936] . [HKEY_CLASSES_ROOTclsid{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}] . [HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerToolbarWebbrowser] "{BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC}"= "c:program filesuTorrentBarprxtbuTo0.dll" [2011-05-09 176936] . [HKEY_CLASSES_ROOTclsid{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}] . [HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionexplorershelliconoverlayidentifiersShareOverlay] @="{594D4122-1F87-41E2-96C7-825FB4796516}" [HKEY_CLASSES_ROOTCLSID{594D4122-1F87-41E2-96C7-825FB4796516}] 2011-08-19 20:13 505344 ----a-w- c:program filesClassic ShellClassicExplorer32.dll . [HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun] "3RVX"="c:program files3RVX3RVX.exe" [2008-10-13 159232] "Sidebar"="c:program filesWindows Sidebarsidebar.exe" [2010-11-20 1174016] "DAEMON Tools Lite"="c:program filesDAEMON Tools LiteDTLite.exe" [2011-11-10 3514176] "CursorFX"="c:program filesStardockCursorFXCursorFX.exe" [2011-10-24 432784] "uTorrent"="c:program filesuTorrentuTorrent.exe" [2012-05-12 880496] "Skype"="c:program filesSkypePhoneSkype.exe" [2012-02-29 17151624] . [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun] "Ai Nap"="c:program filesASUSAI SuiteAiNapAiNap.exe" [2009-08-21 1427968] "QFan Help"="c:program filesASUSAI SuiteQFan3QFanHelp.exe" [2009-08-19 603136] "Cpu Level Up help"="c:program filesASUSAI SuiteCpuLevelUpHelp.exe" [2009-08-21 887936] "VolPanel"="c:program filesCreativeVolume PanelVolPanlu.exe" [2009-02-03 237693] "EvtMgr6"="c:program filesLogitechSetPointPSetPoint.exe" [2011-10-07 1387288] "pspNetSystray"="c:program filesEATONPersonalSolutionPacmgenetsystray.exe" [2008-09-24 1253376] "MagicTuneLauncher"="c:program filesMagicTune PremiumMagicTuneLauncher.exe" [2010-12-21 51712] "CTxfiHlp"="CTXFIHLP.EXE" [2010-05-05 25600] "Malwarebytes' Anti-Malware"="c:program filesMalwarebytes' Anti-Malwarembamgui.exe" [2012-04-04 462408] . c:usersKOLIOAppDataRoamingMicrosoftWindowsStart MenuProgramsStartup Rainlendar.exe - Shortcut.lnk - c:new folderPROGRAMIRainlendar 0.22.1RainlendarRainlendar.exe [2006-1-21 118784] Stardock ObjectDock.lnk - c:program filesStardockObjectDockFreeObjectDock.exe [2010-10-6 3768176] . c:programdataMicrosoftWindowsStart MenuProgramsStartup GammaTray.lnk - c:program filesMagicTune PremiumGammaTray.exe [2011-11-15 36864] . [HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionpoliciessystem] "ConsentPromptBehaviorAdmin"= 0 (0x0) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) . [hkey_local_machinesoftwaremicrosoftwindowscurrentversionexplorerSharedTaskScheduler] "{1984D045-52CF-49cd-DB77-08F378FEA4DB}"= "c:program filesStardockObjectDockFreeODMenu.dll" [2010-10-04 511344] . [HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversionwinlogonnotifyLBTWlgn] 2011-09-27 19:03 66328 ----a-w- c:program filesCommon FilesLogiShrdBluetoothLBTWLgn.dll . [HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversiondrivers32] "mixer"=wdmaud.drv . [HKLM~startupfolderC:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^TotalMedia Server.lnk] path=c:programdataMicrosoftWindowsStart MenuProgramsStartupTotalMedia Server.lnk backup=c:windowspssTotalMedia Server.lnk.CommonStartup backupExtension=.CommonStartup . [HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregIME14 CHS Setup] 2010-01-20 23:45 80240 ----a-w- c:progra~1COMMON~1MICROS~1IME14SHAREDIMEKLMG.EXE . [HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregIME14 CHT Setup] 2010-01-20 23:45 80240 ----a-w- c:progra~1COMMON~1MICROS~1IME14SHAREDIMEKLMG.EXE . [HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregIME14 JPN Setup] 2010-01-20 23:45 80240 ----a-w- c:progra~1COMMON~1MICROS~1IME14SHAREDIMEKLMG.EXE . [HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregIME14 KOR Setup] 2010-01-20 23:45 80240 ----a-w- c:progra~1COMMON~1MICROS~1IME14SHAREDIMEKLMG.EXE . [HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregLogiScrollApp] 2011-09-16 02:46 45848 ----a-w- c:program filesLogitechScrollAppKhalScroll.exe . [HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregNSU_agent] 2011-12-13 21:37 190768 ----a-w- c:program filesNokiaNokia Software Updaternsu3ui_agent.exe . [HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregPC Suite Tray] 2011-06-16 13:21 1500160 ----a-w- c:program filesNokiaNokia PC Suite 7PCSuite.exe . [HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregSunJavaUpdateSched] 2011-05-04 11:59 252136 ----a-w- c:program filesCommon FilesJavaJava Updatejusched.exe . [HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregWinampAgent] 2010-12-06 22:02 74752 ----a-w- c:program filesWinampwinampa.exe . [HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregXvid] 2011-01-17 19:41 8192 ----a-w- c:program filesXvidCheckUpdate.exe . R2 3127;3127;c:usersKOLIOAppDataLocalTemp3127.sys [x] R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:windowsMicrosoft.NETFrameworkv4.0.30319mscorsvw.exe [2010-03-18 130384] R2 gupdate;Услуга на Google Актуализация (gupdate);c:program filesGoogleUpdateGoogleUpdate.exe [2012-05-21 136176] R2 MBAMService;MBAMService;c:program filesMalwarebytes' Anti-Malwarembamservice.exe [2012-04-04 654408] R2 NAUpdate;Nero Update;c:program filesNeroUpdateNASvc.exe [2011-09-23 641832] R2 nvUpdatusService;NVIDIA Update Service Daemon;c:program filesNVIDIA CorporationNVIDIA Update Coredaemonu.exe [2012-02-29 2348352] R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:windowssystem32MacromedFlashFlashPlayerUpdateService.exe [2012-05-06 257696] R3 Creative ALchemy AL6 Licensing Service;Creative ALchemy AL6 Licensing Service;c:program filesCommon FilesCreative Labs SharedServiceAL6Licensing.exe [2011-11-14 79360] R3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:program filesCommon FilesCreative Labs SharedServiceCTAELicensing.exe [2011-11-15 79360] R3 Creative Dolby Digital Live Pack Licensing Service;Creative Dolby Digital Live Pack Licensing Service;c:program filesCommon FilesCreative Labs SharedServiceDDLLicensing.exe [2011-11-14 79360] R3 CT20XUT;CT20XUT;c:windowssystem32driversCT20XUT.SYS [2010-05-05 171096] R3 CTEXFIFX;CTEXFIFX;c:windowssystem32driversCTEXFIFX.SYS [2010-05-05 1324120] R3 CTHWIUT;CTHWIUT;c:windowssystem32driversCTHWIUT.SYS [2010-05-05 72792] R3 gupdatem;Услуга на Google Актуализация (gupdatem);c:program filesGoogleUpdateGoogleUpdate.exe [2012-05-21 136176] R3 MBAMProtector;MBAMProtector;c:windowssystem32driversmbam.sys [2012-04-04 22344] R3 osppsvc;Office Software Protection Platform;c:program filesCommon FilesMicrosoft SharedOfficeSoftwareProtectionPlatformOSPPSVC.EXE [2010-01-09 4640000] R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:windowssystem32driversrdpvideominiport.sys [2010-11-20 15872] R3 RTL8187;Realtek RTL8187 Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;c:windowssystem32DRIVERSrtl8187.sys [2010-01-07 375808] R3 Sony Ericsson PCCompanion;Sony Ericsson PCCompanion;c:program filesSony EricssonSony Ericsson PC CompanionPCCService.exe [2011-06-29 155344] R3 Synth3dVsc;Synth3dVsc;c:windowssystem32driverssynth3dvsc.sys [x] R3 TsUsbFlt;TsUsbFlt;c:windowssystem32drivers susbflt.sys [2010-11-20 52224] R3 tsusbhub;tsusbhub;c:windowssystem32drivers susbhub.sys [x] R3 VGPU;VGPU;c:windowssystem32driversrdvgkmd.sys [x] R3 WatAdminSvc;Windows Activation Technologies Service;c:windowssystem32WatWatAdminSvc.exe [2011-11-15 1343400] R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:windowssystem32DRIVERSyk62x86.sys [2009-09-28 315392] S1 ArcSec;ArcSec;c:windowssystem32driversArcSec.sys [2010-09-21 192504] S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:windowssystem32DRIVERSdtsoftbus01.sys [2011-11-16 239168] S1 iZ3DInjectionDriver;Driver inject our D3D and OGL wrappers;c:program filesiZ3D DriverWin32S3DInjectionDriver.sys [2010-10-06 34968] S1 vwififlt;Virtual WiFi Filter Driver;c:windowssystem32DRIVERSvwififlt.sys [2009-07-13 48128] S2 EATON Service module;EATON Service module;c:program filesEATONPersonalSolutionPacRunSC.exe [2010-11-29 126976] S2 ImeDictUpdateService;Microsoft IME Dictionary Update;c:program filesCommon FilesMicrosoft SharedIME14SHAREDIMEDICTUPDATE.EXE [2010-10-20 59760] S2 S3DSvc32;S3D Service (Win32);c:program filesiZ3D DriverWin32S3DCService.exe [2010-10-24 360960] S2 SkypeUpdate;Skype Updater;c:program filesSkypeUpdaterUpdater.exe [2012-02-29 158856] S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:program filesNVIDIA Corporation3D VisionnvSCPAPISvr.exe [2012-02-29 382272] S3 CT20XUT.SYS;CT20XUT.SYS;c:windowsSystem32driversCT20XUT.SYS [2010-05-05 171096] S3 CTEXFIFX.SYS;CTEXFIFX.SYS;c:windowsSystem32driversCTEXFIFX.SYS [2010-05-05 1324120] S3 CTHWIUT.SYS;CTHWIUT.SYS;c:windowsSystem32driversCTHWIUT.SYS [2010-05-05 72792] S3 RTL8167;Realtek 8167 NT Driver;c:windowssystem32DRIVERSRt86win7.sys [2011-06-10 394856] . . [HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversionsvchost] LocalServiceAndNoImpersonation REG_MULTI_SZ SSDPSRV upnphost SCardSvr TBS FontCache fdrespub AppIDSvc QWAVE wcncsvc SensrSvc . Contents of the 'Scheduled Tasks' folder . 2012-05-27 c:windowsTasksAdobe Flash Player Updater.job - c:windowssystem32MacromedFlashFlashPlayerUpdateService.exe [2012-04-17 20:44] . 2012-05-27 c:windowsTasksGoogleUpdateTaskMachineCore.job - c:program filesGoogleUpdateGoogleUpdate.exe [2012-05-21 19:19] . 2012-05-27 c:windowsTasksGoogleUpdateTaskMachineUA.job - c:program filesGoogleUpdateGoogleUpdate.exe [2012-05-21 19:19] . . ------- Supplementary Scan ------- . IE: E&xport to Microsoft Excel - c:progra~1MICROS~2Office14EXCEL.EXE/3000 TCP: DhcpNameServer = 217.10.240.2 217.10.240.242 192.168.1.1 FF - ProfilePath - c:usersKOLIOAppDataRoamingMozillaFirefoxProfilesfebeprof.kolio FF - prefs.js: browser.search.defaulturl - hxxp://search.winamp.com/search/search?query={searchTerms}&invocationType=tb50-ff-winamp-chromesbox-en-us&tb_uuid=20111115165448450&tb_oid=15-11-2011&tb_mrud=15-11-2011&query= FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q= . . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_LOCAL_MACHINEsoftwareClassesCLSID{645FF040-5081-101B-9F08-00AA002F954E}shellB20@O=5 *=0 *C*C*l*e*a*n*e*r*& command] @="c:Program FilesCCleanerccleaner.exe" . [HKEY_LOCAL_MACHINEsystemControlSet001ControlClass{4D36E96D-E325-11CE-BFC1-08002BE10318}0000AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINEsystemControlSet001ControlPCWSecurity] @Denied: (Full) (Everyone) . --------------------- DLLs Loaded Under Running Processes --------------------- . - - - - - - - > 'Explorer.exe'(4128) c:program filesStardockObjectDockFreeDockShellHook.dll c:program filesStardockObjectDockFreeODMenu.dll c:program filesNokiaNokia PC Suite 7PhoneBrowser.dll c:program filesNokiaNokia PC Suite 7NGSCM.DLL c:program filesNokiaNokia PC Suite 7LangPhoneBrowser_eng.nlr c:program filesNokiaNokia PC Suite 7ResourcePhoneBrowser_Nokia.ngr . ------------------------ Other Running Processes ------------------------ . c:windowssystem32nvvsvc.exe c:program filesCreativeShared FilesCTAudSvc.exe c:program filesNVIDIA CorporationDisplaynvxdsync.exe c:windowssystem32nvvsvc.exe c:program filesEATONPersonalSolutionPacPCtl.exe c:program filesEATONPersonalSolutionPacBIL.exe c:program filesEATONPersonalSolutionPacCilUSB.exe c:windowsservicingTrustedInstaller.exe c:windowssystem32 askhost.exe c:windowssystem32conhost.exe c:windowsSYSTEM32CTXFISPI.EXE c:program filesCommon FilesLogiShrdKHAL3KHALMNPR.EXE c:program filesWindows Media Playerwmpnetwk.exe . ************************************************************************** . Completion time: 2012-05-27 14:35:50 - machine was rebooted ComboFix-quarantined-files.txt 2012-05-27 11:35 ComboFix2.txt 2012-05-27 07:33 . Pre-Run: 2 038 304 768 bytes free Post-Run: 1 797 402 624 bytes free . - - End Of File - - CDA69E74E89901B4AF3CA871EEF491A7

Вашата ситема е заразена с: Trojan.Inject , Trojan-Dropper.Win32.Demp.ffi,Trojan-Dropper.Win32.Demp.fgv

Копирайте текста в карето на notepad и го запазвате с име CFScript.txt на десктопа си:

KILLALL::

File::
c:usersKOLIOAppDataLocalTemp3127.sys

Driver::
3127

След съхранението преместете CFScript.txt на иконата на ComboFix.exe

Генерирания рапорт прикачете в следващия си пост..!

ComboFix 12-05-27.01 - KOLIO 05.2012 г. 14:54:58.3.2 - x86 Microsoft Windows 7 Ultimate 6.1.7601.1.1251.359.1033.18.2047.903 [GMT 3:00] Running from: c:new folderDESCTOPComboFix.exe Command switches used :: c:new folderDESCTOPCFScript.txt SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . FILE :: "c:usersKOLIOAppDataLocalTemp3127.sys" . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . . -------Service_3127 . . ((((((((((((((((((((((((( Files Created from 2012-04-27 to 2012-05-27 ))))))))))))))))))))))))))))))) . . 2012-05-27 11:58 . 2012-05-27 11:58 -------- d-----w- c:usersUpdatusUserAppDataLocal emp 2012-05-27 11:58 . 2012-05-27 11:58 -------- d-----w- c:usersDefaultAppDataLocal emp 2012-05-27 11:33 . 2012-05-27 11:59 -------- d-----w- c:usersKOLIOAppDataLocal emp 2012-05-27 07:30 . 2012-05-27 11:36 56200 ----a-w- c:programdataMicrosoftWindows DefenderDefinition Updates{4FF555DA-272A-4CD2-B23E-BDF9CB3AB6A6}offreg.dll 2012-05-26 15:06 . 2012-05-27 06:17 -------- d-----w- c:windowssystem32MpEngineStore 2012-05-21 19:19 . 2012-05-21 19:19 -------- d-----w- c:program filesGoogle 2012-05-20 18:29 . 2012-05-20 18:29 -------- d-----w- c:usersKOLIOAppDataRoamingMPC-BE 2012-05-20 08:29 . 2012-05-20 19:21 -------- d-----w- c:program filesCommon FilesSkype 2012-05-02 14:47 . 2012-05-19 16:59 -------- d-----w- C:filmi 2012-05-01 15:22 . 2012-05-20 09:50 -------- d-----w- C:New folder . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-05-06 20:44 . 2012-04-17 20:31 419488 ----a-w- c:windowssystem32FlashPlayerApp.exe 2012-05-06 20:44 . 2011-11-14 21:45 70304 ----a-w- c:windowssystem32FlashPlayerCPLApp.cpl 2012-04-04 12:56 . 2011-12-20 19:56 22344 ----a-w- c:windowssystem32driversmbam.sys 2012-02-29 23:59 . 2012-03-15 08:59 61248 ----a-w- c:windowssystem32OpenCL.dll 2012-02-29 23:59 . 2012-03-15 08:59 5892928 ----a-w- c:windowssystem32nvcuda.dll 2012-02-29 23:59 . 2012-03-15 08:59 2517312 ----a-w- c:windowssystem32nvcuvid.dll 2012-02-29 23:59 . 2012-03-15 08:59 2437440 ----a-w- c:windowssystem32nvcuvenc.dll 2012-02-29 23:59 . 2012-03-15 08:59 19444544 ----a-w- c:windowssystem32nvoglv32.dll 2012-02-29 23:59 . 2012-03-15 08:59 17543488 ----a-w- c:windowssystem32nvcompiler.dll 2012-02-29 23:59 . 2012-03-15 08:59 10819392 ----a-w- c:windowssystem32driversnvlddmkm.sys 2012-02-29 23:59 . 2011-11-14 21:19 881984 ----a-w- c:windowssystem32nvgenco32.dll 2012-02-29 23:59 . 2011-11-14 21:19 2301248 ----a-w- c:windowssystem32nvapi.dll 2012-02-29 23:59 . 2011-11-14 21:19 1000256 ----a-w- c:windowssystem32nvdispco32.dll 2012-02-29 23:59 . 2009-07-13 22:09 7713088 ----a-w- c:windowssystem32nvwgf2um.dll 2012-02-29 23:59 . 2009-06-10 21:19 15009600 ----a-w- c:windowssystem32nvd3dum.dll 2012-02-29 20:56 . 2011-11-14 21:20 3881792 ----a-w- c:windowssystem32nvcpl.dll 2012-02-29 20:55 . 2011-11-14 21:20 2719040 ----a-w- c:windowssystem32nvsvc.dll 2012-02-29 20:53 . 2011-11-14 21:20 108352 ----a-w- c:windowssystem32nvmctray.dll 2012-02-29 20:53 . 2011-11-14 21:20 645440 ----a-w- c:windowssystem32nvvsvc.exe 2012-02-29 20:53 . 2011-11-14 21:20 62272 ----a-w- c:windowssystem32nvshext.dll 2012-02-29 20:53 . 2011-11-14 21:20 2561344 ----a-w- c:windowssystem32nvsvcr.dll 2012-02-29 11:26 . 2012-02-29 11:26 416064 ----a-w- c:windowssystem32nvStreaming.exe 2012-03-04 12:10 . 2011-11-14 20:08 134104 ----a-w- c:program filesmozilla firefoxcomponentsbrowsercomps.dll . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerURLSearchHooks] "{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}"= "c:program filesuTorrentBarprxtbuTo0.dll" [2011-05-09 176936] . [HKEY_CLASSES_ROOTclsid{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}] . [HKEY_LOCAL_MACHINE~Browser Helper Objects{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}] 2011-05-09 09:49 176936 ----a-w- c:program filesuTorrentBarprxtbuTo0.dll . [HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar] "{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}"= "c:program filesuTorrentBarprxtbuTo0.dll" [2011-05-09 176936] . [HKEY_CLASSES_ROOTclsid{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}] . [HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerToolbarWebbrowser] "{BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC}"= "c:program filesuTorrentBarprxtbuTo0.dll" [2011-05-09 176936] . [HKEY_CLASSES_ROOTclsid{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}] . [HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionexplorershelliconoverlayidentifiersShareOverlay] @="{594D4122-1F87-41E2-96C7-825FB4796516}" [HKEY_CLASSES_ROOTCLSID{594D4122-1F87-41E2-96C7-825FB4796516}] 2011-08-19 20:13 505344 ----a-w- c:program filesClassic ShellClassicExplorer32.dll . [HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun] "3RVX"="c:program files3RVX3RVX.exe" [2008-10-13 159232] "Sidebar"="c:program filesWindows Sidebarsidebar.exe" [2010-11-20 1174016] "DAEMON Tools Lite"="c:program filesDAEMON Tools LiteDTLite.exe" [2011-11-10 3514176] "CursorFX"="c:program filesStardockCursorFXCursorFX.exe" [2011-10-24 432784] "uTorrent"="c:program filesuTorrentuTorrent.exe" [2012-05-12 880496] "Skype"="c:program filesSkypePhoneSkype.exe" [2012-02-29 17151624] . [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun] "Ai Nap"="c:program filesASUSAI SuiteAiNapAiNap.exe" [2009-08-21 1427968] "QFan Help"="c:program filesASUSAI SuiteQFan3QFanHelp.exe" [2009-08-19 603136] "Cpu Level Up help"="c:program filesASUSAI SuiteCpuLevelUpHelp.exe" [2009-08-21 887936] "VolPanel"="c:program filesCreativeVolume PanelVolPanlu.exe" [2009-02-03 237693] "EvtMgr6"="c:program filesLogitechSetPointPSetPoint.exe" [2011-10-07 1387288] "pspNetSystray"="c:program filesEATONPersonalSolutionPacmgenetsystray.exe" [2008-09-24 1253376] "MagicTuneLauncher"="c:program filesMagicTune PremiumMagicTuneLauncher.exe" [2010-12-21 51712] "CTxfiHlp"="CTXFIHLP.EXE" [2010-05-05 25600] "Malwarebytes' Anti-Malware"="c:program filesMalwarebytes' Anti-Malwarembamgui.exe" [2012-04-04 462408] . c:usersKOLIOAppDataRoamingMicrosoftWindowsStart MenuProgramsStartup Rainlendar.exe - Shortcut.lnk - c:new folderPROGRAMIRainlendar 0.22.1RainlendarRainlendar.exe [2006-1-21 118784] Stardock ObjectDock.lnk - c:program filesStardockObjectDockFreeObjectDock.exe [2010-10-6 3768176] . c:programdataMicrosoftWindowsStart MenuProgramsStartup GammaTray.lnk - c:program filesMagicTune PremiumGammaTray.exe [2011-11-15 36864] . [HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionpoliciessystem] "ConsentPromptBehaviorAdmin"= 0 (0x0) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) . [hkey_local_machinesoftwaremicrosoftwindowscurrentversionexplorerSharedTaskScheduler] "{1984D045-52CF-49cd-DB77-08F378FEA4DB}"= "c:program filesStardockObjectDockFreeODMenu.dll" [2010-10-04 511344] . [HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversionwinlogonnotifyLBTWlgn] 2011-09-27 19:03 66328 ----a-w- c:program filesCommon FilesLogiShrdBluetoothLBTWLgn.dll . [HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversiondrivers32] "mixer"=wdmaud.drv . [HKLM~startupfolderC:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^TotalMedia Server.lnk] path=c:programdataMicrosoftWindowsStart MenuProgramsStartupTotalMedia Server.lnk backup=c:windowspssTotalMedia Server.lnk.CommonStartup backupExtension=.CommonStartup . [HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregIME14 CHS Setup] 2010-01-20 23:45 80240 ----a-w- c:progra~1COMMON~1MICROS~1IME14SHAREDIMEKLMG.EXE . [HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregIME14 CHT Setup] 2010-01-20 23:45 80240 ----a-w- c:progra~1COMMON~1MICROS~1IME14SHAREDIMEKLMG.EXE . [HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregIME14 JPN Setup] 2010-01-20 23:45 80240 ----a-w- c:progra~1COMMON~1MICROS~1IME14SHAREDIMEKLMG.EXE . [HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregIME14 KOR Setup] 2010-01-20 23:45 80240 ----a-w- c:progra~1COMMON~1MICROS~1IME14SHAREDIMEKLMG.EXE . [HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregLogiScrollApp] 2011-09-16 02:46 45848 ----a-w- c:program filesLogitechScrollAppKhalScroll.exe . [HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregNSU_agent] 2011-12-13 21:37 190768 ----a-w- c:program filesNokiaNokia Software Updaternsu3ui_agent.exe . [HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregPC Suite Tray] 2011-06-16 13:21 1500160 ----a-w- c:program filesNokiaNokia PC Suite 7PCSuite.exe . [HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregSunJavaUpdateSched] 2011-05-04 11:59 252136 ----a-w- c:program filesCommon FilesJavaJava Updatejusched.exe . [HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregWinampAgent] 2010-12-06 22:02 74752 ----a-w- c:program filesWinampwinampa.exe . [HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregXvid] 2011-01-17 19:41 8192 ----a-w- c:program filesXvidCheckUpdate.exe . R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:windowsMicrosoft.NETFrameworkv4.0.30319mscorsvw.exe [2010-03-18 130384] R2 gupdate;Услуга на Google Актуализация (gupdate);c:program filesGoogleUpdateGoogleUpdate.exe [2012-05-21 136176] R2 MBAMService;MBAMService;c:program filesMalwarebytes' Anti-Malwarembamservice.exe [2012-04-04 654408] R2 NAUpdate;Nero Update;c:program filesNeroUpdateNASvc.exe [2011-09-23 641832] R2 nvUpdatusService;NVIDIA Update Service Daemon;c:program filesNVIDIA CorporationNVIDIA Update Coredaemonu.exe [2012-02-29 2348352] R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:windowssystem32MacromedFlashFlashPlayerUpdateService.exe [2012-05-06 257696] R3 Creative ALchemy AL6 Licensing Service;Creative ALchemy AL6 Licensing Service;c:program filesCommon FilesCreative Labs SharedServiceAL6Licensing.exe [2011-11-14 79360] R3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:program filesCommon FilesCreative Labs SharedServiceCTAELicensing.exe [2011-11-15 79360] R3 Creative Dolby Digital Live Pack Licensing Service;Creative Dolby Digital Live Pack Licensing Service;c:program filesCommon FilesCreative Labs SharedServiceDDLLicensing.exe [2011-11-14 79360] R3 CT20XUT;CT20XUT;c:windowssystem32driversCT20XUT.SYS [2010-05-05 171096] R3 CTEXFIFX;CTEXFIFX;c:windowssystem32driversCTEXFIFX.SYS [2010-05-05 1324120] R3 CTHWIUT;CTHWIUT;c:windowssystem32driversCTHWIUT.SYS [2010-05-05 72792] R3 gupdatem;Услуга на Google Актуализация (gupdatem);c:program filesGoogleUpdateGoogleUpdate.exe [2012-05-21 136176] R3 MBAMProtector;MBAMProtector;c:windowssystem32driversmbam.sys [2012-04-04 22344] R3 osppsvc;Office Software Protection Platform;c:program filesCommon FilesMicrosoft SharedOfficeSoftwareProtectionPlatformOSPPSVC.EXE [2010-01-09 4640000] R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:windowssystem32driversrdpvideominiport.sys [2010-11-20 15872] R3 RTL8187;Realtek RTL8187 Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;c:windowssystem32DRIVERSrtl8187.sys [2010-01-07 375808] R3 Sony Ericsson PCCompanion;Sony Ericsson PCCompanion;c:program filesSony EricssonSony Ericsson PC CompanionPCCService.exe [2011-06-29 155344] R3 Synth3dVsc;Synth3dVsc;c:windowssystem32driverssynth3dvsc.sys [x] R3 TsUsbFlt;TsUsbFlt;c:windowssystem32drivers susbflt.sys [2010-11-20 52224] R3 tsusbhub;tsusbhub;c:windowssystem32drivers susbhub.sys [x] R3 VGPU;VGPU;c:windowssystem32driversrdvgkmd.sys [x] R3 WatAdminSvc;Windows Activation Technologies Service;c:windowssystem32WatWatAdminSvc.exe [2011-11-15 1343400] R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:windowssystem32DRIVERSyk62x86.sys [2009-09-28 315392] S1 ArcSec;ArcSec;c:windowssystem32driversArcSec.sys [2010-09-21 192504] S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:windowssystem32DRIVERSdtsoftbus01.sys [2011-11-16 239168] S1 iZ3DInjectionDriver;Driver inject our D3D and OGL wrappers;c:program filesiZ3D DriverWin32S3DInjectionDriver.sys [2010-10-06 34968] S1 vwififlt;Virtual WiFi Filter Driver;c:windowssystem32DRIVERSvwififlt.sys [2009-07-13 48128] S2 EATON Service module;EATON Service module;c:program filesEATONPersonalSolutionPacRunSC.exe [2010-11-29 126976] S2 ImeDictUpdateService;Microsoft IME Dictionary Update;c:program filesCommon FilesMicrosoft SharedIME14SHAREDIMEDICTUPDATE.EXE [2010-10-20 59760] S2 S3DSvc32;S3D Service (Win32);c:program filesiZ3D DriverWin32S3DCService.exe [2010-10-24 360960] S2 SkypeUpdate;Skype Updater;c:program filesSkypeUpdaterUpdater.exe [2012-02-29 158856] S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:program filesNVIDIA Corporation3D VisionnvSCPAPISvr.exe [2012-02-29 382272] S3 CT20XUT.SYS;CT20XUT.SYS;c:windowsSystem32driversCT20XUT.SYS [2010-05-05 171096] S3 CTEXFIFX.SYS;CTEXFIFX.SYS;c:windowsSystem32driversCTEXFIFX.SYS [2010-05-05 1324120] S3 CTHWIUT.SYS;CTHWIUT.SYS;c:windowsSystem32driversCTHWIUT.SYS [2010-05-05 72792] S3 RTL8167;Realtek 8167 NT Driver;c:windowssystem32DRIVERSRt86win7.sys [2011-06-10 394856] . . [HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversionsvchost] LocalServiceAndNoImpersonation REG_MULTI_SZ SSDPSRV upnphost SCardSvr TBS FontCache fdrespub AppIDSvc QWAVE wcncsvc SensrSvc . Contents of the 'Scheduled Tasks' folder . 2012-05-27 c:windowsTasksAdobe Flash Player Updater.job - c:windowssystem32MacromedFlashFlashPlayerUpdateService.exe [2012-04-17 20:44] . 2012-05-27 c:windowsTasksGoogleUpdateTaskMachineCore.job - c:program filesGoogleUpdateGoogleUpdate.exe [2012-05-21 19:19] . 2012-05-27 c:windowsTasksGoogleUpdateTaskMachineUA.job - c:program filesGoogleUpdateGoogleUpdate.exe [2012-05-21 19:19] . . ------- Supplementary Scan ------- . IE: E&xport to Microsoft Excel - c:progra~1MICROS~2Office14EXCEL.EXE/3000 TCP: DhcpNameServer = 217.10.240.2 217.10.240.242 192.168.1.1 FF - ProfilePath - c:usersKOLIOAppDataRoamingMozillaFirefoxProfilesfebeprof.kolio FF - prefs.js: browser.search.defaulturl - hxxp://search.winamp.com/search/search?query={searchTerms}&invocationType=tb50-ff-winamp-chromesbox-en-us&tb_uuid=20111115165448450&tb_oid=15-11-2011&tb_mrud=15-11-2011&query= FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q= . . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_LOCAL_MACHINEsoftwareClassesCLSID{645FF040-5081-101B-9F08-00AA002F954E}shellB20@O=5 *=0 *C*C*l*e*a*n*e*r*& command] @="c:Program FilesCCleanerccleaner.exe" . [HKEY_LOCAL_MACHINEsystemControlSet001ControlClass{4D36E96D-E325-11CE-BFC1-08002BE10318}0000AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINEsystemControlSet001ControlPCWSecurity] @Denied: (Full) (Everyone) . --------------------- DLLs Loaded Under Running Processes --------------------- . - - - - - - - > 'Explorer.exe'(4184) c:program filesStardockObjectDockFreeDockShellHook.dll c:program filesStardockObjectDockFreeODMenu.dll c:program filesNokiaNokia PC Suite 7PhoneBrowser.dll c:program filesNokiaNokia PC Suite 7NGSCM.DLL c:program filesNokiaNokia PC Suite 7LangPhoneBrowser_eng.nlr c:program filesNokiaNokia PC Suite 7ResourcePhoneBrowser_Nokia.ngr . ------------------------ Other Running Processes ------------------------ . c:windowssystem32nvvsvc.exe c:program filesCreativeShared FilesCTAudSvc.exe c:program filesNVIDIA CorporationDisplaynvxdsync.exe c:windowssystem32nvvsvc.exe c:program filesEATONPersonalSolutionPacPCtl.exe c:program filesEATONPersonalSolutionPacBIL.exe c:windowsservicingTrustedInstaller.exe c:program filesEATONPersonalSolutionPacCilUSB.exe c:windowssystem32 askhost.exe c:windowssystem32conhost.exe c:windowsSYSTEM32CTXFISPI.EXE c:program filesCommon FilesLogiShrdKHAL3KHALMNPR.EXE c:program filesWindows Media Playerwmpnetwk.exe . ************************************************************************** . Completion time: 2012-05-27 15:01:04 - machine was rebooted ComboFix-quarantined-files.txt 2012-05-27 12:01 ComboFix2.txt 2012-05-27 11:35 ComboFix3.txt 2012-05-27 07:33 . Pre-Run: 1 863 331 840 bytes free Post-Run: 1 579 696 128 bytes free . - - End Of File - - 0F26A88AF159FA4D3510E98608041943

Добре изглеждат нещата вече...още една контролна проверка и ще се ориантираме към приключване..!

Изтеглете Malwarebytes' Anti-Malware или от тук

* Кликнете два пъти върху mbam-setup.exe, за да инсталирате програмата.

* Уверете се, че са поставени отметки на Update Malwarebytes' Anti-Malware и Launch Malwarebytes' Anti-Malware. След това кликнете на Finish.

* Ако има намерени обновявания, тя ще ги изтегли и инсталира.

* Стартирайте програмата и изберете "Perform Full Scan", след това кликнете на Scan.

* Сканирането ще отнеме малко време, затова моля да бъдете търпеливи.

* Когато сканирането завърши, кликнете на OK, след това Show Results, за да видите резултата.

* Уверете се, че на всички редове има отметки, и кликнете на Remove Selected.

* Когато всичко бъде премахнато, в Notepad ще бъде отворен лог. Копирайте този лог и го публикувайте в следващия си коментар по темата.

Забележка: Ако MalwareBytes' Anti-Malware се затрудни в премахването на откритите вируси/заплахи, той ще поиска да рестартира компютъра Ви и по време на рестартирането да премахне проблемните вируси/заплахи. Ако бъдете попитани, потвърдете че желаете вашия компютър да бъде рестартиран.

Изтеглете програмата: ESET Online Scanner

• Стартирайте esetsmartinstaller_enu.exe
• Сложете отметка на YES, I accept the Terms of Use и изберете Start:

  

• Скенерът ще започне да изтегля компонентите, които са му необходими:

  

• Уверете се, че има отметки на следните редове:

  

  Накрая изберете Start

• Скенерът ще започне да изтегля последните дефиниции.
• След, като сканирането завърши изберете Finish.
• Отидете в: C:Program FilesESETESET Online Scanner
• Отворете файла log.txt , копирайте съдържанието му и го поставете в следващия си коментар.

Надявам се не е глупав въпроса ми, но имам инсталиран Malwarebytes' Anti-Malware, ползвам я от доста време, та въпроса ми е дали да я преинсталирам???

Редактирано 27 май 201214 г. от koliomalinov (преглед на промените)

Не не..само преди да започнеш сканирането просто я ъпдейтваш и това е...!Преинсталиране само ако е много стара версия..!

Malwarebytes Anti-Malware 1.61.0.1400 www.malwarebytes.org Версия на базата от данни: v2012.05.27.02 Windows 7 Service Pack 1 x86 NTFS Internet Explorer 9.0.8112.16421 KOLIO :: KOLIO-PC [администратор] Защита: включена 27.5.2012 г. 22:44:37 ч. mbam-log-2012-05-27 (22-44-37).txt Тип сканиране: Пълно сканиране Включени опции за сканиране: Памет | Автоматично зареждане | Системен регистър | Файлова система | Евристики/Допълнителни | Евристики/Shuriken | PUP | PUM Изключени опции за сканиране: P2P Сканирани обекти: 39917 Изминало време: 2 минута(и), 13 секунда(и) Открити процеси в паметта: 0 (Не бяха открити зловредни обекти) Открити модули в паметта: 0 (Не бяха открити зловредни обекти) Открити ключове в системния регистър: 0 (Не бяха открити зловредни обекти) Открити стойности в системния регистър: 0 (Не бяха открити зловредни обекти) Открити информационни обекти в системния регистър: 0 (Не бяха открити зловредни обекти) Открити папки: 0 (Не бяха открити зловредни обекти) Открити файлове: 0 (Не бяха открити зловредни обекти) (край) Не мисла, че програмата сканира всичко-гледах докато сканираше файловете, забави се върху файл от С: и приключи без да проверява другите дялове.

ESETSmartInstaller@High as downloader log: all ok # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6583 # api_version=3.0.2 # EOSSerial=09359dec17e058498e4d299d3227fa86 # end=finished # remove_checked=true # archives_checked=true # unwanted_checked=true # unsafe_checked=true # antistealth_checked=true # utc_time=2012-05-27 10:54:58 # local_time=2012-05-28 01:54:58 (+0200, FLE Daylight Time) # country="Bulgaria" # lang=1033 # osver=6.1.7601 NT Service Pack 1 # compatibility_mode=5893 16776573 100 94 10684 89779517 0 0 # compatibility_mode=8192 67108863 100 0 111 111 0 0 # scanned=392297 # found=64 # cleaned=64 # scan_time=10971 C:New folderPROGRAMIHirens BootCDHirens BootCD 14.1 (kaldata.com).zip Win32/PSWTool.KonBoot.A application (deleted - quarantined) 00000000000000000000000000000000 C C:New folderPROGRAMIwinampwinamp,3 i 5Winamp 5.601 Build 3091winamp561_full_emusic-7plus_all.exe Win32/OpenCandy application (deleted - quarantined) 00000000000000000000000000000000 C C:New folderPROGRAMIwinampwinamp,3 i 5Winamp 5.601 Build 3091Bundlewinamp5601_full_bundle_emusic-7plus_all.exe Win32/OpenCandy application (deleted - quarantined) 00000000000000000000000000000000 C C:New folderPROGRAMIwinampwinamp,3 i 5Winamp 5.601 Build 3091Bundlewinamp5601_full_bundle_emusic-7plus_en-us.exe Win32/OpenCandy application (deleted - quarantined) 00000000000000000000000000000000 C C:New folderPROGRAMIwinampwinamp,3 i 5Winamp 5.601 Build 3091Fullwinamp5601_full_emusic-7plus_all.exe Win32/OpenCandy application (deleted - quarantined) 00000000000000000000000000000000 C C:New folderPROGRAMIwinampwinamp,3 i 5Winamp 5.601 Build 3091Fullwinamp5601_full_emusic-7plus_en-us.exe Win32/OpenCandy application (deleted - quarantined) 00000000000000000000000000000000 C C:New folderResursCheatEngine561.exe multiple threats (deleted - quarantined) 00000000000000000000000000000000 C C:New folderResursclockClock Tray Skins 4.0 fullclock.tray.skins.v3.x-patch.exe a variant of Win32/HackTool.Patcher.A application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:New folderResursCorelDRAW Graphics Suite X5 15.1.0.588 SP1keygen.rar a variant of Win32/Keygen.AU application (deleted - quarantined) 00000000000000000000000000000000 C C:New folderResursGoldWave.v5.55.Incl.Keygen-BLiZZARDkeygen.exe a variant of Win32/Keygen.AD application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:New folderResursStardock ObjectDock Plus 2.0keygen.exe a variant of Win32/HackTool.Patcher.J application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:New folderResursza VCDTMPGEnc Plus Crack.zip a variant of Win32/Tool.TPE.A application (deleted - quarantined) 00000000000000000000000000000000 C C:Program FilesClock Tray Skinsclock.tray.skins.v3.x-patch.exe a variant of Win32/HackTool.Patcher.A application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:QooboxQuarantineCUsersKOLIO9babae71-3127.exe.vir Win32/Simda.E trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:QooboxQuarantineCUsersKOLIOAppDataLocalTempe730ebe5-3127.tmp.vir Win32/Simda.E trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C H:KOLIOdesktopOrbitDownloaderSetup.exe Win32/OpenCandy application (deleted - quarantined) 00000000000000000000000000000000 C H:KOLIOdesktopTEL[000023].zip a variant of Win32/Keygen.BV application (deleted - quarantined) 00000000000000000000000000000000 C H:KOLIOdesktopTEL[000033].zip a variant of Win32/Keygen.BV application (deleted - quarantined) 00000000000000000000000000000000 C H:KOLIOdesktopTEL[000049].zip a variant of Win32/Keygen.BV application (deleted - quarantined) 00000000000000000000000000000000 C H:KOLIOdesktopTEL[000260].zip a variant of Win32/Keygen.BV application (deleted - quarantined) 00000000000000000000000000000000 C H:KOLIOdesktopTEL[000261].zip a variant of Win32/Keygen.BV application (deleted - quarantined) 00000000000000000000000000000000 C H:KOLIOdesktopTEL[000263].zip a variant of Win32/Keygen.BV application (deleted - quarantined) 00000000000000000000000000000000 C H:KOLIOdesktopTEL[000264].zip a variant of Win32/Keygen.BV application (deleted - quarantined) 00000000000000000000000000000000 C H:KOLIOdesktopTEL[000265].zip a variant of Win32/Keygen.BV application (deleted - quarantined) 00000000000000000000000000000000 C H:KOLIOdesktopTEL[000267].zip a variant of Win32/Keygen.BV application (deleted - quarantined) 00000000000000000000000000000000 C H:KOLIOdesktopTEL[000368].zip a variant of Win32/Keygen.BV application (deleted - quarantined) 00000000000000000000000000000000 C H:KOLIOdesktopTEL[000431].zip a variant of Win32/Keygen.BV application (deleted - quarantined) 00000000000000000000000000000000 C H:KOLIOdesktopTEL[000432].zip a variant of Win32/Keygen.BV application (deleted - quarantined) 00000000000000000000000000000000 C H:KOLIOdesktopTEL[000435].zip a variant of Win32/Keygen.BV application (deleted - quarantined) 00000000000000000000000000000000 C I:KOLIO elefoni6210 NavigatorBest.Call.Notes.v1.0.zip a variant of Win32/Keygen.BV application (deleted - quarantined) 00000000000000000000000000000000 C I:KOLIO elefoni6210 NavigatorBest.Full.Screen.Caller.v3.02.zip a variant of Win32/Keygen.BV application (deleted - quarantined) 00000000000000000000000000000000 C I:KOLIO elefoni6210 NavigatorBest.Full.Screen.Message.zip a variant of Win32/Keygen.BV application (deleted - quarantined) 00000000000000000000000000000000 C I:KOLIO elefoni6210 NavigatorBest.Tracker.v1.03.zip a variant of Win32/Keygen.BV application (deleted - quarantined) 00000000000000000000000000000000 C I:KOLIO elefoni6210 NavigatorBestCallCheaterv1.03.zip a variant of Win32/Keygen.BV application (deleted - quarantined) 00000000000000000000000000000000 C I:KOLIO elefoni6210 NavigatorBestCryptoV3.0.zip a variant of Win32/Keygen.BV application (deleted - quarantined) 00000000000000000000000000000000 C I:KOLIO elefoni6210 NavigatorBest_Profiles_v1.01.zip a variant of Win32/Keygen.BV application (deleted - quarantined) 00000000000000000000000000000000 C I:KOLIO elefoni6210 NavigatorEpocware.Handy.Calendarv2.00.beta4.S60v3.Keygen-HSpda[09-07-08].zip a variant of Win32/Keygen.BV application (deleted - quarantined) 00000000000000000000000000000000 C I:KOLIO elefoni6210 NavigatorEpocware_Handy_Calendar_v2.0_beta3_S60v3_incl.Keygen-HSpda.zip a variant of Win32/Keygen.BV application (deleted - quarantined) 00000000000000000000000000000000 C I:KOLIO elefoni6210 NavigatorEpocware_Handy_Calendar_v2.0_S60v3_incl.Keygen-HSpda.zip a variant of Win32/Keygen.BV application (deleted - quarantined) 00000000000000000000000000000000 C I:KOLIO elefoni6210 NavigatorFull.Screen.Messagev3.0.zip a variant of Win32/Keygen.BV application (deleted - quarantined) 00000000000000000000000000000000 C I:KOLIO elefoni6210 NavigatorHandy.Blacklist.v3.03.zip a variant of Win32/Keygen.BV application (deleted - quarantined) 00000000000000000000000000000000 C I:KOLIO elefoni6210 NavigatorHandy.Profiles.v1.06.zip a variant of Win32/Keygen.BV application (deleted - quarantined) 00000000000000000000000000000000 C I:KOLIO elefoni6210 NavigatorHandyProfiles_1_05.zip a variant of Win32/Keygen.BV application (deleted - quarantined) 00000000000000000000000000000000 C I:KOLIO elefoni6210 NavigatorSmartphoneware.Best.Private.Conversation.v1.0.S60v3.SymbianOS9.incl.Keygen_HSpda.zip a variant of Win32/Keygen.BV application (deleted - quarantined) 00000000000000000000000000000000 C I:KOLIO elefoni6210 NavigatorSmartphoneware.Best.Reminder.v2.0.S60v3.SymbianOS9.incl.Keygen-HSpda[update].zip a variant of Win32/Keygen.BV application (deleted - quarantined) 00000000000000000000000000000000 C I:KOLIO elefoni6210 NavigatornovoNew folderINSTALL.zip a variant of Win32/Keygen.BV application (deleted - quarantined) 00000000000000000000000000000000 C I:KOLIO elefoni6210 NavigatornovoNew folderKylom.Projekt.v1.23.zip a variant of Win32/Keygen.BV application (deleted - quarantined) 00000000000000000000000000000000 C I:KOLIO elefoni6210 NavigatornovoNew folderINSTALLBest.Dictaphone.v1.01.S60v3.SymbianOS9.incl.Keygen-HSpda.rar a variant of Win32/Keygen.BV application (deleted - quarantined) 00000000000000000000000000000000 C I:KOLIO elefoni6210 NavigatornovoNew folderINSTALLfscaller_s60_5x_and_3x_v_4_00_sw.zip a variant of Win32/Keygen.BV application (deleted - quarantined) 00000000000000000000000000000000 C I:KOLIO elefoni6210 NavigatornovoNew folderINSTALLHandy.Taskman.v2.02.zip a variant of Win32/Keygen.BV application (deleted - quarantined) 00000000000000000000000000000000 C I:KOLIO elefoni6210 NavigatornovoNew folderINSTALLSmartphoneware Best Timer v3.00.rar a variant of Win32/Keygen.BV application (deleted - quarantined) 00000000000000000000000000000000 C I:KOLIO elefoni6210 NavigatorPROGRAMI VAJNIdictaphone_S60_3_0_v_1_01_0.rar a variant of Win32/Keygen.BV application (deleted - quarantined) 00000000000000000000000000000000 C I:KOLIO elefoni6210 NavigatorPROGRAMI VAJNIfscaller_s60_5x_and_3x_v_4_00_sw.zip a variant of Win32/Keygen.BV application (deleted - quarantined) 00000000000000000000000000000000 C I:KOLIO elefoni6210 NavigatorPROGRAMI VAJNIHandy.Taskman.v2.02.zip a variant of Win32/Keygen.BV application (deleted - quarantined) 00000000000000000000000000000000 C I:KOLIO elefoni6210 NavigatorPROGRAMI VAJNISmartphoneware Best Timer v3.00.rar a variant of Win32/Keygen.BV application (deleted - quarantined) 00000000000000000000000000000000 C I:KOLIO elefoni6630Epocware.Handy.Blacklist.v2.0.N70.N72.N90.SymbianOS8.incl.Keygen-HSpda.zip a variant of Win32/Keygen.BV application (deleted - quarantined) 00000000000000000000000000000000 C I:KOLIO elefoni6630Epocware.Handy.Taskman.v1.06.S60v2.SymbianOS.incl.Keygen-HSpda.zip a variant of Win32/Keygen.BV application (deleted - quarantined) 00000000000000000000000000000000 C I:KOLIO elefoni6630Epocware.Handy.Tools.Pro.Datecode.11.07.07.S60v2.SymbianOS.incl.Keygen-HSpda.zip a variant of Win32/Keygen.BV application (deleted - quarantined) 00000000000000000000000000000000 C I:KOLIO elefoni6630New FolderNew FolderNew FolderEpocware.Handy.Taskman.v1.06.S60v2.SymbianOS.incl.Keygen-HSpda.zip a variant of Win32/Keygen.BV application (deleted - quarantined) 00000000000000000000000000000000 C I:KOLIO elefoni6630New FolderNew FolderNew FolderEpocware.Handy.Tools.Pro.Datecode.11.07.07.S60v2.SymbianOS.incl.Keygen-HSpda.zip a variant of Win32/Keygen.BV application (deleted - quarantined) 00000000000000000000000000000000 C I:KOLIO elefoni6630resursEpocware.Handy.Blacklist.v2.0.N70.N72.N90.SymbianOS8.incl.Keygen-HSpda.zip a variant of Win32/Keygen.BV application (deleted - quarantined) 00000000000000000000000000000000 C I:KOLIO elefoni6630resursEpocware.Handy.Clock.v4.08.S60v3.Keygen-HSpda.zip a variant of Win32/Keygen.BV application (deleted - quarantined) 00000000000000000000000000000000 C I:KOLIO elefoniAndroidSpy_Phone_v1.2.5_.apk Android/SpyPhone.A application (deleted - quarantined) 00000000000000000000000000000000 C I:KOLIO elefoniAndroidnovoMyPhoneExplorer_Setup_1.8.2.exe Win32/OpenCandy application (deleted - quarantined) 00000000000000000000000000000000 C

Как е системата ви сега..?Наблюдавате ли някои от първоначалните проблеми..?

Много благодаря за съдействието. НОД-а се инсталира нормално, ще сканирам и с него след като обновя дефинициите. Malwarebytes отново не сканира-сканира за около минута две само диск "С", след което се забавя на някой файл и приключа със сканирането. Дал съм пълно сканиране, на всички дялове. Пробвах да сканирам всичко без "С" и сканира нормално. Преинсталирах го, като почистих и регистрите, без различен ефект. За притеснение ли е това? Ако е удобно да попитам няколко допълнителни въпроса? Както споменах още в началото преди около три седмици си копирах съдържанието на моя хард върху хард на колега. С какво е удачно да сканирам въпросния хард дали е заразен. Втория ми въпрос е подобен-преди да предприема почистване си записах един блурей диск с най-важната информация, безопасно ли е да се сканира този диск да проверя дали е заразен и дали мога да си го оставя като резерв??? Благодаря още веднъж.

Деинсталирайте Комбофикс така:

1.Натиснете Start ==> Run ==> въведете командата Combofix /Uninstall ==> OK

2.Изтеглете OTCleanIt или от тук,стартирайте и натиснете

Деинсталирайте/изтрийте всички програмки и логове които използвахме в темата (които са останали след горните процедури).Деинсталирайте ESET Online Scanner...!

Ако е удобно да попитам няколко допълнителни въпроса? Както споменах още в началото преди около три седмици си копирах съдържанието на моя хард върху хард на колега. С какво е удачно да сканирам въпросния хард дали е заразен. Втория ми въпрос е подобен-преди да предприема почистване си записах един блурей диск с най-важната информация, безопасно ли е да се сканира този диск да проверя дали е заразен и дали мога да си го оставя като резерв??? Благодаря още веднъж.

И двата външни носителя можете да сканирате с вашата антивирусна или Malwarebytes Anti-Malware..!Ако има проблем пишете..!

Пожелавам лека вечер и безопасен интернет..!