Заразен - Live security protection - Страница 2 - Премахване на зловреден софтуер - Kaldata.com

12 юни 201214 г.

Всичко изгледа наред вече.

Довечера ще имам отговор най-вероятно защо OTL/OTS не искат да старатират при вас.

Направете нова проверка с HitmanPro под нормален режим и с включен интернет.

Само че изтеглете тази бета. Спрете всички ненужни програми и процеси преди да я стартирате.

Ако се проточи над 1-2 часа я спрете. Не я чакайте отново 10 часа.

Как работи в момента машинката?

12 юни 201214 г.

Автор

В момента работи много добре. Сега ще пробвам с тоя Hitman и ще кача лога след това.

Благодаря за помощта.

Този път процедурата трая само 5 минути

Ето го и лога:

http://dox.bg/files/dw?a=bed14cf968

Показва ми, че е намерило някакви Tracking cookies + няколко троянеца.

Редактирано 12 юни 201214 г. от Chavdar Mutafov (преглед на промените)

12 юни 201214 г.

Троянците са по-скоро фалшиви тревоги, бисквитките не са проблем.

Изтеглете FixExec и го стартирайте.

Рестартирайте компютъра.

След това пробвайте да стартирате OTL/OTS отново.

Довечера ще пиша пак.

12 юни 201214 г.

Автор

Отново ми дава същата грешка свързана с тоя файл kernel32.dll и при OTL и при OTS.

12 юни 201214 г.

Ок...Да проверим за финални поражения по услугите на Windows:

1) Изтеглете: ESET Online Scanner

2) Стартирайте esetsmartinstaller_enu.exe

3) Сложете отметка на YES, I accept the Terms of Use и изберете Start

4) Скенерът ще започне да изтегля компонентите, които са му необходими.

5) Уверете се, че има отметки на следните редове, включително и тези от менюто Advanced Settings:

Remove found threats
Scan archives
Scan for potentially unwanted applications
Scan for potentially unsafe applications
Enable Anti-Stealth technology

И накрая изберете Start

6) Скенерът ще започне да изтегля последните дефиниции.

7) След, като сканирането завърши изберете Finish.

8) Отидете в:

C:Program FilesESETESET Online Scanner

Отворете файла log.txt , копирайте съдържанието му и го поставете в следващия си пост.

И да проверим за повредени услуги:

Моля изтеглете Farbar Service Scanner и я стартирайте.

Сложете всички отметки
Натиснете бутона "Scan".
Ще се създаде лог файл с името (FSS.txt) в папката откъдето стартирате инструмента.
Копирайте съдържанието на лог файла в следващия си пост.

12 юни 201214 г.

Автор

Ето ги логовете:

ESET

ESETSmartInstaller@High as downloader log:

all ok

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6583

# api_version=3.0.2

# EOSSerial=806584b0deb39043b86b9a6238f5721f

# end=finished

# remove_checked=true

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=true

# antistealth_checked=true

# utc_time=2012-06-12 06:47:20

# local_time=2012-06-12 09:47:20 (+0200, FLE Daylight Time)

# country="United Kingdom"

# lang=1033

# osver=6.0.6002 NT Service Pack 2

# compatibility_mode=5892 16776573 100 100 7188 177050867 0 0

# compatibility_mode=8192 67108863 100 0 159 159 0 0

# scanned=194268

# found=11

# cleaned=11

# scan_time=8700

C:Program FilesWindows Savevid ToolbarDatamngrBrowserConnection.dll Win32/Toolbar.SearchSuite application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:Program FilesWindows Savevid ToolbarDatamngrdatamngr.dll Win32/Toolbar.SearchSuite application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:Program FilesWindows Savevid ToolbarDatamngrdatamngrUI.exe Win32/Toolbar.SearchSuite application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:Program FilesWindows Savevid ToolbarDatamngrDnsBHO.dll Win32/Toolbar.SearchSuite application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:Program FilesWindows Savevid ToolbarDatamngrIEBHO.dll Win32/Toolbar.SearchSuite application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:ProgramData{C4A867AE-B15C-4B7F-AD27-7F8C13A57518}SavevidSetupV2.res Win32/Toolbar.SearchSuite application (deleted - quarantined) 00000000000000000000000000000000 C

C:QooboxQuarantineCProgramDataF4D55F3E000DF644006F4B3C570F1C8BF4D55F3E000DF644006F4B3C570F1C8B.exe.vir a variant of Win32/Kryptik.AGSN trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:UsersToshibaDesktopzoek.exe Win32/Delf.NXC trojan (deleted - quarantined) 00000000000000000000000000000000 C

C:UsersToshibaDownloadsBS Player Pro + KeyGen.zip a variant of Win32/Keygen.AG application (deleted - quarantined) 00000000000000000000000000000000 C

C:UsersToshibaDownloadsSavevidSetupV2.exe Win32/Toolbar.SearchSuite application (deleted - quarantined) 00000000000000000000000000000000 C

E:GamesMedal of Honor Allied Assault BreakthroughCD2Breakthrough-CodeTrainerpztrain.exe a variant of Win32/GameHack.S application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

FSS

Farbar Service Scanner Version: 09-06-2012

Ran by Toshiba (administrator) on 12-06-2012 at 21:49:03

Running from "C:UsersToshibaDesktop"

Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86)

Boot Mode: Normal

****************************************************************

Internet Services:

============

Connection Status:

==============

Localhost is accessible.

LAN connected.

Google IP is accessible.

Google.com is accessible.

Yahoo IP is accessible.

Yahoo.com is accessible.

Windows Firewall:

=============

Firewall Disabled Policy:

==================

System Restore:

============

System Restore Disabled Policy:

========================

Security Center:

============

Windows Update:

============

Windows Autoupdate Disabled Policy:

============================

Windows Defender:

==============

File Check:

========

C:Windowssystem32nsisvc.dll => MD5 is legit

C:Windowssystem32Driversnsiproxy.sys => MD5 is legit

C:Windowssystem32dhcpcsvc.dll => MD5 is legit

C:Windowssystem32Driversafd.sys => MD5 is legit

C:Windowssystem32Drivers dx.sys => MD5 is legit

C:Windowssystem32Drivers cpip.sys

[2012-05-11 09:11] - [2012-03-30 15:39] - 0905600 ____A (Microsoft Corporation) 27D470DABC77BC60D0A3B0E4DEB6CB91

C:Windowssystem32dnsrslvr.dll => MD5 is legit

C:Windowssystem32mpssvc.dll

[2009-09-15 14:09] - [2009-04-11 09:28] - 0407552 ____A (Microsoft Corporation)

C:Windowssystem32bfe.dll => MD5 is legit

C:Windowssystem32Driversmpsdrv.sys => MD5 is legit

C:Windowssystem32SDRSVC.dll => MD5 is legit

C:Windowssystem32vssvc.exe => MD5 is legit

C:Windowssystem32wscsvc.dll => MD5 is legit

C:Windowssystem32wbemWMIsvc.dll => MD5 is legit

C:Windowssystem32wuaueng.dll => MD5 is legit

C:Windowssystem32qmgr.dll => MD5 is legit

C:Windowssystem32es.dll => MD5 is legit

C:Windowssystem32cryptsvc.dll => MD5 is legit

C:Program FilesWindows DefenderMpSvc.dll => MD5 is legit

C:Windowssystem32svchost.exe => MD5 is legit

C:Windowssystem32rpcss.dll => MD5 is legit

**** End of log ****

12 юни 201214 г.

И тези логове са ок.

Намерените неща от Есет са в карантинната папка на Combofix - Qoobox, някакви туулбари, една фалшива тревога (визирам zoek.exe) и някой друг кейген.

Има начини да подкараме OTL - като използваме LiveCD, с OTLPE или флашка с FRST но не мисля, че това е необходимо. Тежката артилерия ще я пазим за случаите, когато е нужна.

За финал...две проверки за да сме сигурни, че всичко е наред:

Моля, изтеглете SystemLook и запазете програмата на десктопа.
Кликнете два пъти върху SystemLook.exe, за да стартирате програмата.

Копирайте съдържанието на следния код в текстовото поле на програмата

:filefind
c25edaa9-4085-1174-f85f-1a915fadf364
{c25edaa9-4085-1174-f85f-1a915fadf364}
:folderfind
c25edaa9-4085-1174-f85f-1a915fadf364
{c25edaa9-4085-1174-f85f-1a915fadf364}
:regfind
c25edaa9-4085-1174-f85f-1a915fadf364
{c25edaa9-4085-1174-f85f-1a915fadf364}

Кликнете на бутона Look, за да започне сканирането.
Когато сканирането завърши ще Ви се отвори Notepad с резултата от сканирането. Моля, публикувайте лог файла в следващия си коментар.

Изтеглете Security Check от screen317 от тук или и го запаметете на вашия десктоп.

Кликнете два пъти върху SecurityCheck.exe и следвайте инструкциите.
Накрая, автоматично ще се отвори текстов документ, наречен checkup.txt, моля поставете съдържанието му в следващия Ви коментар в тази тема.
Направете и нова проверка с DDS и прикачете двата файла които ще се създадат.

12 юни 201214 г.

Автор

Ето и тези логове:

Systemlook

SystemLook 30.07.11 by jpshortstuff

Log created at 23:33 on 12/06/2012 by Toshiba

Administrator - Elevation successful

========== filefind ==========

Searching for "c25edaa9-4085-1174-f85f-1a915fadf364"

No files found.

Searching for "{c25edaa9-4085-1174-f85f-1a915fadf364}"

No files found.

========== folderfind ==========

Searching for "c25edaa9-4085-1174-f85f-1a915fadf364"

No folders found.

Searching for "{c25edaa9-4085-1174-f85f-1a915fadf364}"

No folders found.

========== regfind ==========

Searching for "c25edaa9-4085-1174-f85f-1a915fadf364"

No data found.

Searching for "{c25edaa9-4085-1174-f85f-1a915fadf364}"

No data found.

-= EOF =-

Securitycheck

Results of screen317's Security Check version 0.99.41

Windows Vista Service Pack 2 x86 (UAC is disabled!)

Internet Explorer 9

``````````````Antivirus/Firewall Check:``````````````

Windows Firewall Enabled!

WMI entry may not exist for antivirus; attempting automatic update.

`````````Anti-malware/Other Utilities Check:`````````

Malwarebytes Anti-Malware version 1.61.0.1400

Java™ 6 Update 19

Java™ 6 Update 3

Java version out of date!

Adobe Flash Player 10 Flash Player out of date!

Adobe Flash Player 10.3.183.10 Flash Player out of Date!

Adobe Reader 8 Adobe Reader out of date!

Adobe Reader X KB403742.. Adobe Reader out of Date!

Mozilla Firefox (13.0)

Google Chrome 19.0.1084.52

Google Chrome 19.0.1084.56

````````Process Check: objlist.exe by Laurent````````

Malwarebytes Anti-Malware mbamservice.exe

Malwarebytes Anti-Malware mbamgui.exe

Toshiba Toshiba Online Product Information TOPI.exe

M-Tel NETAGENT OnlineUpdate ouc.exe

`````````````````System Health check`````````````````

Total Fragmentation on Drive C: 1 %

````````````````````End of Log``````````````````````

А тези от DDS ги прикачвам.attach.txt dds.txt

12 юни 201214 г.

Здравейте,

Току що получих отговор от автора на OTL/OTS.

Той изтъква няколко възможни причини..

kernel32.dll е повреден от гадината.

kernel32.dll - достъпа до файла е отказан заради гадинка или някоя програма за защита...

kernel32.dll - манипулация на файла ако Операционната Система е кракната.

kernel32.dll - е с прецакани права.

Преди да пристъпим към обновяването на старите програми използвани от вас и да приключим случая нека да видим все пак някои от нещата споменати от автора на инструмента.

Кликнете два пъти върху SystemLook.exe, за да стартирате програмата.
Копирайте съдържанието на следния код в текстовото поле на програмата
```
:filefind
kernel32.dll
```
Кликнете на бутона Look, за да започне сканирането.
Когато сканирането завърши ще Ви се отвори Notepad с резултата от сканирането. Моля, публикувайте лог файла в следващия си коментар.

Сега изтеглете GrantPerms.zip и го разархивирайте на десктопа. Стартирайте GrantPerms.exe и въведете следната информация:
```
C:\Windows\system32\kernel32.dll
```
Натиснете Unlock и след това List Permissions. Публикувайте лог файла в следващия си пост.

Изтеглете LockSearch© от jpshortstuff и го запазете на вашия десктоп.
Стартирайте LockSearch.exe.
Натиснете 2 и натиснете Enter.
След като проверката завърши ще се появи лог файл с името - LockSearch.txt.
Пунликувайте лог файла в следващия си пост.

И тъй като Windows не е 64 битов можем да направим и една проверка за рууткити.

Изтеглете Gmer

Временно спрете Интернета си,всички работещи програми,както и антивирусната си програма.
Стартирате програмата.
След завършването на автоматичната проверка,махнете отметките от следните позиции:

- IAT/EAT

- Show all

- махнете отметките от всички локални дискове. Маркирайте само системния дял (обикновенно това е C:\ )
Натиснете бутона Scan
Изчакайте програмата да завърши сканирането,след което натиснете бутона Save и запишете (save as) резултатите на десктопа с име Gmer.log.
Включете Интернета си и прикачете Gmer.log в следващия си коментар.

Забележка:
Не предприемайте никакви действия върху редовете маркирани с "<--- ROOТKIT" ,защото това може да доведе до проблеми с Windows.

12 юни 201214 г.

Автор

Това е лога от SystemLook. Линка към GrandPerms не работи. Да търся ли да го тегля от другаде или да продължавам по другите стъпки като пропусна GrandPerms? Log: SystemLook 30.07.11 by jpshortstuff Log created at 00:21 on 13/06/2012 by Toshiba Administrator - Elevation successful ========== filefind ========== Searching for "kernel32.dll" C:WindowsERDNTcachekernel32.dll --a---- 891392 bytes [14:55 11/06/2012] [06:28 11/04/2009] BB8509089E7DF514310814E1B2593FFC C:WindowsSystem32kernel32.dll --a---- 891392 bytes [11:09 15/09/2009] [06:28 11/04/2009] BB8509089E7DF514310814E1B2593FFC C:Windowswinsxsx86_microsoft-windows-kernel32_31bf3856ad364e35_6.0.6000.16820_none_91c20a8f593529edkernel32.dll --a---- 875520 bytes [15:19 22/04/2009] [07:26 13/02/2009] B82C7AC1D559F0FD088792171D64C7F3 C:Windowswinsxsx86_microsoft-windows-kernel32_31bf3856ad364e35_6.0.6000.21010_none_92564f68724ae108kernel32.dll --a---- 875520 bytes [15:19 22/04/2009] [07:13 13/02/2009] BB792054BD990EC05D9E260D50FEAD39 C:Windowswinsxsx86_microsoft-windows-kernel32_31bf3856ad364e35_6.0.6001.18000_none_93bde541564b88aekernel32.dll --a---- 888320 bytes [02:24 21/01/2008] [02:24 21/01/2008] DC2338093F91BA4E0512208E60206DDD C:Windowswinsxsx86_microsoft-windows-kernel32_31bf3856ad364e35_6.0.6001.18215_none_93b81a93564f1da0kernel32.dll --a---- 888832 bytes [15:19 22/04/2009] [08:49 13/02/2009] DB6E3731E6F5C8AE2843F80B5787F7C6 C:Windowswinsxsx86_microsoft-windows-kernel32_31bf3856ad364e35_6.0.6001.22376_none_9401d8206f9c7e67kernel32.dll --a---- 890880 bytes [15:19 22/04/2009] [08:21 13/02/2009] 1987D817D08F5EAF0B7F334026FDDB79 C:Windowswinsxsx86_microsoft-windows-kernel32_31bf3856ad364e35_6.0.6002.18005_none_95a95e4d536d53fakernel32.dll --a---- 891392 bytes [11:09 15/09/2009] [06:28 11/04/2009] BB8509089E7DF514310814E1B2593FFC -= EOF =-

12 юни 201214 г.

Ето опитайте с този линк.

13 юни 201214 г.

Автор

Ето и тези логове:

GrantPerms

GrantPerms by Farbar

Ran by Toshiba (administrator) at 2012-06-13 08:08:03

===============================================

?C:Windowssystem32kernel32.dll

Owner: BUILTINAdministrators

DACL(P)(AI):

BUILTINAdministrators FULL ALLOW (NI)

NT AUTHORITYSYSTEM FULL ALLOW (NI)

BUILTINUsers READ/EXECUTE ALLOW (NI)

LockSearch

LockSearch by jpshortstuff (05.11.09.1)

Log created at 08:10 on 13/06/2012 (Toshiba)

Scanning C:

C:hiberfil.sys

-------------------------

C:pagefile.sys

-------------------------

C:WindowsSystem32driverssptd.sys

-------------------------

C:WindowsSystem32driverssptd.sys [unable to get md5 : 685816 bytes]

-=E.O.F=-

Gmer

GMER 1.0.15.15641 - http://www.gmer.net

Rootkit scan 2012-06-13 11:59:37

Windows 6.0.6002 Service Pack 2 Harddisk0DR0 -> DeviceIdeIAAStorageDevice-0 Hitachi_ rev.BBFO

Running: gmer.exe; Driver: C:UsersToshibaAppDataLocalTempawlirfow.sys

---- Kernel code sections - GMER 1.0.15 ----

? C:WindowsSystem32Driverssptd.sys The process cannot access the file because it is being used by another process.

.text C:Windowssystem32DRIVERS os_sps32.sys section is writeable [0x8895C000, 0x4036D, 0xE8000020]

.dsrt C:Windowssystem32DRIVERS os_sps32.sys unknown last section [0x889A5000, 0x510, 0x40000040]

.text USBPORT.SYS!DllUnload 8C92541B 5 Bytes JMP 86E0F1C8

? System32Driversakh9f2rn.SYS The system cannot find the path specified. !

? C:UsersToshibaAppDataLocalTempmbr.sys The system cannot find the file specified. !

---- User code sections - GMER 1.0.15 ----

.text C:Program FilesCamera Assistant Software for ToshibaCEC_MAIN.exe[2792] ntdll.dll!DbgBreakPoint 76F8878E 1 Byte [90]

.text C:Program FilesMozilla Firefoxplugin-container.exe[5380] USER32.dll!SetWindowLongA 7697E7CD 5 Bytes JMP 60A3FB5F C:Program FilesMozilla Firefoxxul.dll (Mozilla Foundation)

.text C:Program FilesMozilla Firefoxplugin-container.exe[5380] USER32.dll!SetWindowLongW 769813B4 5 Bytes JMP 60A3FAEE C:Program FilesMozilla Firefoxxul.dll (Mozilla Foundation)

.text C:Program FilesMozilla Firefoxplugin-container.exe[5380] USER32.dll!GetWindowInfo 7698428E 5 Bytes JMP 6081A76C C:Program FilesMozilla Firefoxxul.dll (Mozilla Foundation)

.text C:Program FilesMozilla Firefoxplugin-container.exe[5380] USER32.dll!TrackPopupMenu 769914F3 5 Bytes JMP 6081AD79 C:Program FilesMozilla Firefoxxul.dll (Mozilla Foundation)

.text C:Program FilesMozilla Firefoxfirefox.exe[6108] ntdll.dll!LdrLoadDll 76F69378 5 Bytes JMP 6069696F C:Program FilesMozilla Firefoxxul.dll (Mozilla Foundation)

.text C:Program FilesMozilla Firefoxfirefox.exe[6108] kernel32.dll!MapViewOfFile 76BA68F0 5 Bytes JMP 60940219 C:Program FilesMozilla Firefoxxul.dll (Mozilla Foundation)

.text C:Program FilesMozilla Firefoxfirefox.exe[6108] kernel32.dll!VirtualAlloc 76BAAD55 5 Bytes JMP 60940240 C:Program FilesMozilla Firefoxxul.dll (Mozilla Foundation)

.text C:Program FilesMozilla Firefoxfirefox.exe[6108] GDI32.dll!CreateDIBSection 77137461 5 Bytes JMP 609401A3 C:Program FilesMozilla Firefoxxul.dll (Mozilla Foundation)

---- Devices - GMER 1.0.15 ----

Device FileSystemNtfs Ntfs 84C651E8

AttachedDevice Driverkbdclass DeviceKeyboardClass0 Wdf01000.sys (WDF Dynamic/Microsoft Corporation)

AttachedDevice Driverkbdclass DeviceKeyboardClass1 Wdf01000.sys (WDF Dynamic/Microsoft Corporation)

Device Drivervolmgr DeviceVolMgrControl 84C601E8

Device Drivernetbt DeviceNetBT_Tcpip_{30E634D1-28B4-4480-AFAF-028373E16047} 8D41E590

Device Driverusbuhci DeviceUSBPDO-0 86E391E8

Device Driverusbuhci DeviceUSBPDO-1 86E391E8

Device Driverusbehci DeviceUSBPDO-2 86E16790

Device Driverusbuhci DeviceUSBPDO-3 86E391E8

Device Driverusbuhci DeviceUSBPDO-4 86E391E8

Device Driverusbuhci DeviceUSBPDO-5 86E391E8

Device Driverusbehci DeviceUSBPDO-6 86E16790

Device Drivervolmgr DeviceHarddiskVolume1 84C601E8

Device Drivervolmgr DeviceHarddiskVolume2 84C601E8

Device Drivercdrom DeviceCdRom0 86F631E8

Device Driveratapi DeviceIdeIdeDeviceP0T0L0-0 84C631E8

Device DriveriaStor DeviceIdeiaStor0 84C621E8

Device Driveratapi DeviceIdeIdePort0 84C631E8

Device DriveriaStor DeviceIdeIAAStorageDevice-0 84C621E8

Device Drivervolmgr DeviceHarddiskVolume3 84C601E8

Device Drivercdrom DeviceCdRom1 86F631E8

Device Drivernetbt DeviceNetBT_Tcpip_{6475AB7E-77B5-40BE-BE81-3F5BF5F7320F} 8D41E590

Device Drivernetbt DeviceNetBt_Wins_Export 8D41E590

Device DriveriScsiPrt DeviceRaidPort0 86FA51E8

Device DriverPCI_NTPNP5587 Device0000005e sptd.sys

Device Driverusbuhci DeviceUSBFDO-0 86E391E8

Device Drivernetbt DeviceNetBT_Tcpip_{2498BB33-CA49-4981-B480-DC48BFAFE622} 8D41E590

Device Driverusbuhci DeviceUSBFDO-1 86E391E8

Device Driverusbehci DeviceUSBFDO-2 86E16790

Device Driverusbuhci DeviceUSBFDO-3 86E391E8

Device Driverusbuhci DeviceUSBFDO-4 86E391E8

Device Driverusbuhci DeviceUSBFDO-5 86E391E8

Device Driverusbehci DeviceUSBFDO-6 86E16790

Device Driverakh9f2rn DeviceScsiakh9f2rn1Port4Path0Target0Lun0 86F641E8

Device Driverakh9f2rn DeviceScsiakh9f2rn1 86F641E8

---- Registry - GMER 1.0.15 ----

Reg HKLMSYSTEMCurrentControlSetServicessptdCfg@s1 771343423

Reg HKLMSYSTEMCurrentControlSetServicessptdCfg@s2 285507792

Reg HKLMSYSTEMCurrentControlSetServicessptdCfg@h0 1

Reg HKLMSYSTEMCurrentControlSetServicessptdCfg14919EA49A8F3B4AA3CF1058D9A64CEC

Reg HKLMSYSTEMCurrentControlSetServicessptdCfg19659239224E364682FA4BAF72C53EA4

Reg HKLMSYSTEMCurrentControlSetServicessptdCfg19659239224E364682FA4BAF72C53EA4@h0 0

Reg HKLMSYSTEMCurrentControlSetServicessptdCfg19659239224E364682FA4BAF72C53EA4@khjeh 0xA7 0x13 0x74 0xB1 ...

Reg HKLMSYSTEMCurrentControlSetServicessptdCfg19659239224E364682FA4BAF72C53EA4@p0 C:Program FilesDAEMON Tools

Reg HKLMSYSTEMCurrentControlSetServicessptdCfg19659239224E364682FA4BAF72C53EA400000001

Reg HKLMSYSTEMCurrentControlSetServicessptdCfg19659239224E364682FA4BAF72C53EA400000001@a0 0x20 0x01 0x00 0x00 ...

Reg HKLMSYSTEMCurrentControlSetServicessptdCfg19659239224E364682FA4BAF72C53EA400000001@khjeh 0x5A 0xCE 0xC9 0x46 ...

Reg HKLMSYSTEMCurrentControlSetServicessptdCfg19659239224E364682FA4BAF72C53EA4000000010Jf40

Reg HKLMSYSTEMCurrentControlSetServicessptdCfg19659239224E364682FA4BAF72C53EA4000000010Jf40@khjeh 0x4A 0x38 0xB1 0x0D ...

Reg HKLMSYSTEMControlSet003ServicessptdCfg14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)

Reg HKLMSYSTEMControlSet003ServicessptdCfg19659239224E364682FA4BAF72C53EA4 (not active ControlSet)

Reg HKLMSYSTEMControlSet003ServicessptdCfg19659239224E364682FA4BAF72C53EA4@h0 0

Reg HKLMSYSTEMControlSet003ServicessptdCfg19659239224E364682FA4BAF72C53EA4@khjeh 0xA7 0x13 0x74 0xB1 ...

Reg HKLMSYSTEMControlSet003ServicessptdCfg19659239224E364682FA4BAF72C53EA4@p0 C:Program FilesDAEMON Tools

Reg HKLMSYSTEMControlSet003ServicessptdCfg19659239224E364682FA4BAF72C53EA400000001 (not active ControlSet)

Reg HKLMSYSTEMControlSet003ServicessptdCfg19659239224E364682FA4BAF72C53EA400000001@a0 0x20 0x01 0x00 0x00 ...

Reg HKLMSYSTEMControlSet003ServicessptdCfg19659239224E364682FA4BAF72C53EA400000001@khjeh 0x5A 0xCE 0xC9 0x46 ...

Reg HKLMSYSTEMControlSet003ServicessptdCfg19659239224E364682FA4BAF72C53EA4000000010Jf40 (not active ControlSet)

Reg HKLMSYSTEMControlSet003ServicessptdCfg19659239224E364682FA4BAF72C53EA4000000010Jf40@khjeh 0x4A 0x38 0xB1 0x0D ...

---- EOF - GMER 1.0.15 ----

13 юни 201214 г.

Всичко изглежда наред.

По-късно вечерта ще обновим старите програми, ще почистим едни последни папки на тулбарите и ще деинсталираме използваните от нас инструменти.

Преди това искам да видя дали това ще помогне да подкараме OTL/OTS. Ако ли не, здраве да е.

Изтеглете този инструмент - Windows Repair All in one

Инсталирайте приложението и го стартирайте.

От стъпка 2 => стартирайте Check Disk

От стъпка 3 => стартирайте SFC

от Start Repairs натиснете Start и оттук вече сложете всички отметки показани на снимката:

Сложете отметка пред restart system when finished и натиснете Start.

После вижте дали OTL/OTS стартират успешно.

13 юни 201214 г.

Автор

Преборихме го тоя трън в задника OTL Ето и логовете от него.Extras.Txt OTL.Txt

13 юни 201214 г.

Добра работа.... И надявам се последния скрипт за вашата система преди да преминем към почистване на използваните от нас инструменти.

Стартирайте файла OTL.exe с двукратен клик на мишката.
Под с Copy/ Paste въведете изцяло следната текстова информация (само това, което е поставено в карето):

:OTL
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\ComboFix\catchme.sys -- (catchme)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\blzblk.sys -- (blzblk)
DRV - File not found [Kernel | On_Demand | Unknown] --  -- (adhbdal2)
IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2405}: "URL" = http://dts.search-results.com/sr?src=ieb&appid=0&systemid=405&sr=0&q={searchTerms}
IE - HKU\S-1-5-21-1015945211-613370749-1973384520-1000\..\SearchScopes\{0303B671-0512-4AD6-AEE0-B626E11A107B}: "URL" = http://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=937811&p={searchTerms}
IE - HKU\S-1-5-21-1015945211-613370749-1973384520-1000\..\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}: "URL" = http://websearch.ask.com/redirect?client=ie&tb=SPC2&o=15000&src=crm&q={searchTerms}&locale=en_EU&apn_ptnrs=PV&apn_dtid=YYYYYYYYBG&apn_uid=4F4248D1-AE2A-45D1-871A-A8F9E6995F0D&apn_sauid=C0928DB3-A1F6-4C2F-9B81-4593E52B3081
IE - HKU\S-1-5-21-1015945211-613370749-1973384520-1000\..\SearchScopes\{33D59858-89D9-4AC2-A956-93875EB02323}: "URL" = http://search.localstrike.com.ar/?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}
IE - HKU\S-1-5-21-1015945211-613370749-1973384520-1000\..\SearchScopes\{70D46D94-BF1E-45ED-B567-48701376298E}: "URL" = http://127.0.0.1:4664/search&s=g0zceuo8w7IuqRlaz3ctJiIMmJk?q={searchTerms}
IE - HKU\S-1-5-21-1015945211-613370749-1973384520-1000\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2405}: "URL" = http://dts.search-results.com/sr?src=ieb&appid=0&systemid=405&sr=0&q={searchTerms}
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.defaultthis.engineName: "LocalStrike"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=937811&ilc=12"
FF - prefs.js..browser.search.selectedEngine: "Ask.com"
FF - prefs.js..extensions.enabledItems: [email protected]:3.11.3.15590
FF - prefs.js..keyword.URL: "http://websearch.ask.com/redirect?client=ff&src=kw&tb=SPC2&o=15000&locale=en_EU&apn_uid=4F4248D1-AE2A-45D1-871A-A8F9E6995F0D&apn_ptnrs=PV&apn_sauid=C0928DB3-A1F6-4C2F-9B81-4593E52B3081&apn_dtid=YYYYYYYYBG&q="
[2012.04.04 20:42:10 | 000,000,000 | ---D | M] (Savevid Toolbar) -- C:\Users\Toshiba\AppData\Roaming\Mozilla\Firefox\Profiles\49485toh.default\extensions\{23cd218f-af09-443f-bbb1-adb89fd5986d}
[2012.04.04 20:41:33 | 000,000,000 | ---D | M] ("Savevid.com Easy Video Downloader") -- C:\Users\Toshiba\AppData\Roaming\Mozilla\Firefox\Profiles\49485toh.default\extensions\[email protected]
[2012.05.29 17:26:28 | 000,000,000 | ---D | M] ("Sopcast Ask Toolbar") -- C:\Users\Toshiba\AppData\Roaming\Mozilla\Firefox\Profiles\49485toh.default\extensions\[email protected]
[2012.06.13 20:28:19 | 000,002,396 | ---- | M] () -- C:\Users\Toshiba\AppData\Roaming\Mozilla\Firefox\Profiles\49485toh.default\searchplugins\askcom.xml
[2012.04.04 20:41:58 | 000,002,515 | ---- | M] () -- C:\Users\Toshiba\AppData\Roaming\Mozilla\Firefox\Profiles\49485toh.default\searchplugins\Search_Results.xml
[2012.04.04 20:41:58 | 000,002,515 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\Search_Results.xml
O4 - HKLM..\Run: [DATAMNGR] C:\PROGRA~1\WI0498~1\Datamngr\DATAMN~1.EXE File not found
O9 - Extra Button: eBay.co.uk - Buy It Sell It Love It - {76577871-04EC-495E-A12B-91F7C3600AFA} - http://rover.ebay.com/rover/1/710-44557-9400-3/4 File not found
O9 - Extra Button: Amazon.co.uk - {8A918C1D-E123-4E36-B562-5C1519E434CE} - http://www.amazon.co.uk/exec/obidos/redirect-home?tag=Toshibaukbholink-21&site=home File not found
O9 - Extra Button: Bodog Poker - {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - C:\Program Files\Bodog Poker\BPGame.exe File not found
O20 - AppInit_DLLs: (C:\PROGRA~1\WI0498~1\Datamngr\datamngr.dll) -  File not found
O20 - AppInit_DLLs: (C:\PROGRA~1\WI0498~1\Datamngr\IEBHO.dll) -  File not found
[2012.04.04 20:41:56 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Savevid Toolbar
[2012.04.04 20:41:35 | 000,000,000 | ---D | C] -- C:\ProgramData\{C4A867AE-B15C-4B7F-AD27-7F8C13A57518}
[2012.04.04 20:41:32 | 000,000,000 | ---D | C] -- C:\Program Files\SavevidPlug-in
[2012.04.04 20:40:46 | 000,000,000 | ---D | C] -- C:\Users\Toshiba\AppData\Local\PackageAware
:files
C:\Users\Toshiba\AppData\Local\Xenocode\ApplianceCaches\HoldemManager.exe_v08404D5B\Native\STUBEXE\@WINDIR@\Microsoft.NET\Framework\v2.0.50727\csc.exe
C:\Users\Toshiba\AppData\Local\Xenocode\ApplianceCaches\HoldemManager.exe_v08404D5B\TheApp\STUBEXE\@PROGRAMFILES@\RVG Software\Holdem Manager\HoldemManager.exe
C:\Users\Toshiba\AppData\Local\Xenocode\ApplianceCaches\HoldemManager.exe_v7BC20518\Native\STUBEXE\@PROGRAMFILES@\RVG Software\Holdem Manager\DBControlPanel.exe
:commands
[emptytemp]

След като въведете скрипта от цитата по-горе натиснете бутона, маркиран в червено: Run Fix

Windows ще се рестартира и ще се създаде лог файл - OTL fix log. Публикувайте съдържанието му с Copy/Paste в следващия си коментар.

13 юни 201214 г.

Автор

Ето и този лог: All processes killed ========== OTL ========== Service catchme stopped successfully! Service catchme deleted successfully! File C:ComboFixcatchme.sys not found. Service blzblk stopped successfully! Service blzblk deleted successfully! File C:Windowssystem32driversblzblk.sys not found. Error: No service named adhbdal2 was found to stop! Registry key HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesadhbdal2 deleted successfully. Registry key HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerSearchScopes{9BB47C17-9C68-4BB3-B188-DD9AF0FD2405} deleted successfully. Registry key HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{9BB47C17-9C68-4BB3-B188-DD9AF0FD2405} not found. Registry key HKEY_USERSS-1-5-21-1015945211-613370749-1973384520-1000SoftwareMicrosoftInternet ExplorerSearchScopes{0303B671-0512-4AD6-AEE0-B626E11A107B} deleted successfully. Registry key HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{0303B671-0512-4AD6-AEE0-B626E11A107B} not found. Registry key HKEY_USERSS-1-5-21-1015945211-613370749-1973384520-1000SoftwareMicrosoftInternet ExplorerSearchScopes{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} deleted successfully. Registry key HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} not found. Registry key HKEY_USERSS-1-5-21-1015945211-613370749-1973384520-1000SoftwareMicrosoftInternet ExplorerSearchScopes{33D59858-89D9-4AC2-A956-93875EB02323} deleted successfully. Registry key HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{33D59858-89D9-4AC2-A956-93875EB02323} not found. Registry key HKEY_USERSS-1-5-21-1015945211-613370749-1973384520-1000SoftwareMicrosoftInternet ExplorerSearchScopes{70D46D94-BF1E-45ED-B567-48701376298E} deleted successfully. Registry key HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{70D46D94-BF1E-45ED-B567-48701376298E} not found. Registry key HKEY_USERSS-1-5-21-1015945211-613370749-1973384520-1000SoftwareMicrosoftInternet ExplorerSearchScopes{9BB47C17-9C68-4BB3-B188-DD9AF0FD2405} deleted successfully. Registry key HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{9BB47C17-9C68-4BB3-B188-DD9AF0FD2405} not found. Prefs.js: "Ask.com" removed from browser.search.defaultengine Prefs.js: "Ask.com" removed from browser.search.defaultenginename Prefs.js: "LocalStrike" removed from browser.search.defaultthis.engineName Prefs.js: "Ask.com" removed from browser.search.order.1 Prefs.js: "chr-greentree_ff&type=937811&ilc=12" removed from browser.search.param.yahoo-fr Prefs.js: "Ask.com" removed from browser.search.selectedEngine Prefs.js: [email protected]:3.11.3.15590 removed from extensions.enabledItems Prefs.js: "http://websearch.ask.com/redirect?client=ff&src=kw&tb=SPC2&o=15000&locale=en_EU&apn_uid=4F4248D1-AE2A-45D1-871A-A8F9E6995F0D&apn_ptnrs=PV&apn_sauid=C0928DB3-A1F6-4C2F-9B81-4593E52B3081&apn_dtid=YYYYYYYYBG&q=" removed from keyword.URL C:UsersToshibaAppDataRoamingMozillaFirefoxProfiles49485toh.defaultextensions{23cd218f-af09-443f-bbb1-adb89fd5986d}components folder moved successfully. C:UsersToshibaAppDataRoamingMozillaFirefoxProfiles49485toh.defaultextensions{23cd218f-af09-443f-bbb1-adb89fd5986d}chromeskinsearchbar folder moved successfully. C:UsersToshibaAppDataRoamingMozillaFirefoxProfiles49485toh.defaultextensions{23cd218f-af09-443f-bbb1-adb89fd5986d}chromeskinoptions folder moved successfully. C:UsersToshibaAppDataRoamingMozillaFirefoxProfiles49485toh.defaultextensions{23cd218f-af09-443f-bbb1-adb89fd5986d}chromeskinlibweatherbuttonpanelsimages folder moved successfully. C:UsersToshibaAppDataRoamingMozillaFirefoxProfiles49485toh.defaultextensions{23cd218f-af09-443f-bbb1-adb89fd5986d}chromeskinlibweatherbuttonpanels folder moved successfully. C:UsersToshibaAppDataRoamingMozillaFirefoxProfiles49485toh.defaultextensions{23cd218f-af09-443f-bbb1-adb89fd5986d}chromeskinlibweatherbuttonicons folder moved successfully. C:UsersToshibaAppDataRoamingMozillaFirefoxProfiles49485toh.defaultextensions{23cd218f-af09-443f-bbb1-adb89fd5986d}chromeskinlibweatherbutton folder moved successfully. C:UsersToshibaAppDataRoamingMozillaFirefoxProfiles49485toh.defaultextensions{23cd218f-af09-443f-bbb1-adb89fd5986d}chromeskinlibuwa folder moved successfully. C:UsersToshibaAppDataRoamingMozillaFirefoxProfiles49485toh.defaultextensions{23cd218f-af09-443f-bbb1-adb89fd5986d}chromeskinlibradioimages folder moved successfully. C:UsersToshibaAppDataRoamingMozillaFirefoxProfiles49485toh.defaultextensions{23cd218f-af09-443f-bbb1-adb89fd5986d}chromeskinlibradiocss folder moved successfully. C:UsersToshibaAppDataRoamingMozillaFirefoxProfiles49485toh.defaultextensions{23cd218f-af09-443f-bbb1-adb89fd5986d}chromeskinlibradio folder moved successfully. C:UsersToshibaAppDataRoamingMozillaFirefoxProfiles49485toh.defaultextensions{23cd218f-af09-443f-bbb1-adb89fd5986d}chromeskinlibpanelsimages folder moved successfully. C:UsersToshibaAppDataRoamingMozillaFirefoxProfiles49485toh.defaultextensions{23cd218f-af09-443f-bbb1-adb89fd5986d}chromeskinlibpanelsdefaultscripts folder moved successfully. C:UsersToshibaAppDataRoamingMozillaFirefoxProfiles49485toh.defaultextensions{23cd218f-af09-443f-bbb1-adb89fd5986d}chromeskinlibpanelsdefaultimages folder moved successfully. C:UsersToshibaAppDataRoamingMozillaFirefoxProfiles49485toh.defaultextensions{23cd218f-af09-443f-bbb1-adb89fd5986d}chromeskinlibpanelsdefaultcss folder moved successfully. C:UsersToshibaAppDataRoamingMozillaFirefoxProfiles49485toh.defaultextensions{23cd218f-af09-443f-bbb1-adb89fd5986d}chromeskinlibpanelsdefault folder moved successfully. C:UsersToshibaAppDataRoamingMozillaFirefoxProfiles49485toh.defaultextensions{23cd218f-af09-443f-bbb1-adb89fd5986d}chromeskinlibpanelscss folder moved successfully. C:UsersToshibaAppDataRoamingMozillaFirefoxProfiles49485toh.defaultextensions{23cd218f-af09-443f-bbb1-adb89fd5986d}chromeskinlibpanels folder moved successfully. C:UsersToshibaAppDataRoamingMozillaFirefoxProfiles49485toh.defaultextensions{23cd218f-af09-443f-bbb1-adb89fd5986d}chromeskinlib folder moved successfully. C:UsersToshibaAppDataRoamingMozillaFirefoxProfiles49485toh.defaultextensions{23cd218f-af09-443f-bbb1-adb89fd5986d}chromeskin folder moved successfully. C:UsersToshibaAppDataRoamingMozillaFirefoxProfiles49485toh.defaultextensions{23cd218f-af09-443f-bbb1-adb89fd5986d}chromecontentwidgetsnet.vmn.www.WebTVskinscripts folder moved successfully. C:UsersToshibaAppDataRoamingMozillaFirefoxProfiles49485toh.defaultextensions{23cd218f-af09-443f-bbb1-adb89fd5986d}chromecontentwidgetsnet.vmn.www.WebTVskinimages folder moved successfully. C:UsersToshibaAppDataRoamingMozillaFirefoxProfiles49485toh.defaultextensions{23cd218f-af09-443f-bbb1-adb89fd5986d}chromecontentwidgetsnet.vmn.www.WebTVskincss folder moved successfully. C:UsersToshibaAppDataRoamingMozillaFirefoxProfiles49485toh.defaultextensions{23cd218f-af09-443f-bbb1-adb89fd5986d}chromecontentwidgetsnet.vmn.www.WebTVskin folder moved successfully. C:UsersToshibaAppDataRoamingMozillaFirefoxProfiles49485toh.defaultextensions{23cd218f-af09-443f-bbb1-adb89fd5986d}chromecontentwidgetsnet.vmn.www.WebTVjs folder moved successfully. C:UsersToshibaAppDataRoamingMozillaFirefoxProfiles49485toh.defaultextensions{23cd218f-af09-443f-bbb1-adb89fd5986d}chromecontentwidgetsnet.vmn.www.WebTVimages folder moved successfully. C:UsersToshibaAppDataRoamingMozillaFirefoxProfiles49485toh.defaultextensions{23cd218f-af09-443f-bbb1-adb89fd5986d}chromecontentwidgetsnet.vmn.www.WebTVcss folder moved successfully. C:UsersToshibaAppDataRoamingMozillaFirefoxProfiles49485toh.defaultextensions{23cd218f-af09-443f-bbb1-adb89fd5986d}chromecontentwidgetsnet.vmn.www.WebTV folder moved successfully. C:UsersToshibaAppDataRoamingMozillaFirefoxProfiles49485toh.defaultextensions{23cd218f-af09-443f-bbb1-adb89fd5986d}chromecontentwidgetscom.savevid.www.Savevid folder moved successfully. C:UsersToshibaAppDataRoamingMozillaFirefoxProfiles49485toh.defaultextensions{23cd218f-af09-443f-bbb1-adb89fd5986d}chromecontentwidgetscom.djboxservice.dj.DJBox humbs folder moved successfully. C:UsersToshibaAppDataRoamingMozillaFirefoxProfiles49485toh.defaultextensions{23cd218f-af09-443f-bbb1-adb89fd5986d}chromecontentwidgetscom.djboxservice.dj.DJBox folder moved successfully. C:UsersToshibaAppDataRoamingMozillaFirefoxProfiles49485toh.defaultextensions{23cd218f-af09-443f-bbb1-adb89fd5986d}chromecontentwidgets folder moved successfully. C:UsersToshibaAppDataRoamingMozillaFirefoxProfiles49485toh.defaultextensions{23cd218f-af09-443f-bbb1-adb89fd5986d}chromecontentmodules folder moved successfully. C:UsersToshibaAppDataRoamingMozillaFirefoxProfiles49485toh.defaultextensions{23cd218f-af09-443f-bbb1-adb89fd5986d}chromecontentlib folder moved successfully. C:UsersToshibaAppDataRoamingMozillaFirefoxProfiles49485toh.defaultextensions{23cd218f-af09-443f-bbb1-adb89fd5986d}chromecontentdatasearch folder moved successfully. C:UsersToshibaAppDataRoamingMozillaFirefoxProfiles49485toh.defaultextensions{23cd218f-af09-443f-bbb1-adb89fd5986d}chromecontentdata folder moved successfully. C:UsersToshibaAppDataRoamingMozillaFirefoxProfiles49485toh.defaultextensions{23cd218f-af09-443f-bbb1-adb89fd5986d}chromecontent folder moved successfully. C:UsersToshibaAppDataRoamingMozillaFirefoxProfiles49485toh.defaultextensions{23cd218f-af09-443f-bbb1-adb89fd5986d}chrome folder moved successfully. C:UsersToshibaAppDataRoamingMozillaFirefoxProfiles49485toh.defaultextensions{23cd218f-af09-443f-bbb1-adb89fd5986d} folder moved successfully. C:UsersToshibaAppDataRoamingMozillaFirefoxProfiles49485toh.defaultextensionsffmenu@savevid.comchromecontent folder moved successfully. C:UsersToshibaAppDataRoamingMozillaFirefoxProfiles49485toh.defaultextensionsffmenu@savevid.comchrome folder moved successfully. C:UsersToshibaAppDataRoamingMozillaFirefoxProfiles49485toh.defaultextensionsffmenu@savevid.com folder moved successfully. C:UsersToshibaAppDataRoamingMozillaFirefoxProfiles49485toh.defaultextensions [email protected] folder moved successfully. C:UsersToshibaAppDataRoamingMozillaFirefoxProfiles49485toh.defaultextensions [email protected] folder moved successfully. C:UsersToshibaAppDataRoamingMozillaFirefoxProfiles49485toh.defaultextensions [email protected] folder moved successfully. C:UsersToshibaAppDataRoamingMozillaFirefoxProfiles49485toh.defaultextensions [email protected] folder moved successfully. C:UsersToshibaAppDataRoamingMozillaFirefoxProfiles49485toh.defaultextensions [email protected] folder moved successfully. C:UsersToshibaAppDataRoamingMozillaFirefoxProfiles49485toh.defaultextensions [email protected] empff-config.Wed-04-May-2011-07-50-20-GMT folder moved successfully. C:UsersToshibaAppDataRoamingMozillaFirefoxProfiles49485toh.defaultextensions [email protected] empff-config.Tue-12-Jun-2012-09-57-44-GMT folder moved successfully. C:UsersToshibaAppDataRoamingMozillaFirefoxProfiles49485toh.defaultextensions [email protected] empff-config.Tue-08-Nov-2011-07-29-26-GMT folder moved successfully. C:UsersToshibaAppDataRoamingMozillaFirefoxProfiles49485toh.defaultextensions [email protected] empff-config.Thu-29-Sep-2011-07-47-41-GMT folder moved successfully. C:UsersToshibaAppDataRoamingMozillaFirefoxProfiles49485toh.defaultextensions [email protected] empff-config.Thu-26-May-2011-15-26-32-GMT folder moved successfully. C:UsersToshibaAppDataRoamingMozillaFirefoxProfiles49485toh.defaultextensions [email protected] empff-config.Sun-25-Sep-2011-20-56-31-GMT folder moved successfully. C:UsersToshibaAppDataRoamingMozillaFirefoxProfiles49485toh.defaultextensions [email protected] empff-config.Sun-01-May-2011-13-32-24-GMT folder moved successfully. C:UsersToshibaAppDataRoamingMozillaFirefoxProfiles49485toh.defaultextensions [email protected] emp folder moved successfully. C:UsersToshibaAppDataRoamingMozillaFirefoxProfiles49485toh.defaultextensions [email protected] folder moved successfully. C:UsersToshibaAppDataRoamingMozillaFirefoxProfiles49485toh.defaultextensions [email protected] folder moved successfully. C:UsersToshibaAppDataRoamingMozillaFirefoxProfiles49485toh.defaultextensions [email protected] folder moved successfully. C:UsersToshibaAppDataRoamingMozillaFirefoxProfiles49485toh.defaultextensions [email protected] folder moved successfully. C:UsersToshibaAppDataRoamingMozillaFirefoxProfiles49485toh.defaultsearchpluginsaskcom.xml moved successfully. C:UsersToshibaAppDataRoamingMozillaFirefoxProfiles49485toh.defaultsearchpluginsSearch_Results.xml moved successfully. C:Program FilesMozilla FirefoxsearchpluginsSearch_Results.xml moved successfully. Registry value HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunDATAMNGR deleted successfully. Registry key HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerExtensions{76577871-04EC-495E-A12B-91F7C3600AFA} deleted successfully. Registry key HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{76577871-04EC-495E-A12B-91F7C3600AFA} not found. Registry key HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerExtensions{8A918C1D-E123-4E36-B562-5C1519E434CE} deleted successfully. Registry key HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{8A918C1D-E123-4E36-B562-5C1519E434CE} not found. Registry key HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerExtensions{F47C1DB5-ED21-4dc1-853E-D1495792D4C5} deleted successfully. Registry key HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{F47C1DB5-ED21-4dc1-853E-D1495792D4C5} not found. Registry value HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWindowsAppInit_Dlls:C:PROGRA~1WI0498~1Datamngrdatamngr.dll deleted successfully. Registry value HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWindowsAppInit_Dlls:C:PROGRA~1WI0498~1DatamngrIEBHO.dll deleted successfully. C:Program FilesWindows Savevid ToolbarDatamngrToolBarcomponents folder moved successfully. C:Program FilesWindows Savevid ToolbarDatamngrToolBarchromeskinsearchbar folder moved successfully. C:Program FilesWindows Savevid ToolbarDatamngrToolBarchromeskinoptions folder moved successfully. C:Program FilesWindows Savevid ToolbarDatamngrToolBarchromeskinlibweatherbuttonpanelsimages folder moved successfully. C:Program FilesWindows Savevid ToolbarDatamngrToolBarchromeskinlibweatherbuttonpanels folder moved successfully. C:Program FilesWindows Savevid ToolbarDatamngrToolBarchromeskinlibweatherbuttonicons folder moved successfully. C:Program FilesWindows Savevid ToolbarDatamngrToolBarchromeskinlibweatherbutton folder moved successfully. C:Program FilesWindows Savevid ToolbarDatamngrToolBarchromeskinlibuwa folder moved successfully. C:Program FilesWindows Savevid ToolbarDatamngrToolBarchromeskinlibradioimages folder moved successfully. C:Program FilesWindows Savevid ToolbarDatamngrToolBarchromeskinlibradiocss folder moved successfully. C:Program FilesWindows Savevid ToolbarDatamngrToolBarchromeskinlibradio folder moved successfully. C:Program FilesWindows Savevid ToolbarDatamngrToolBarchromeskinlibpanelsimages folder moved successfully. C:Program FilesWindows Savevid ToolbarDatamngrToolBarchromeskinlibpanelsdefaultscripts folder moved successfully. C:Program FilesWindows Savevid ToolbarDatamngrToolBarchromeskinlibpanelsdefaultimages folder moved successfully. C:Program FilesWindows Savevid ToolbarDatamngrToolBarchromeskinlibpanelsdefaultcss folder moved successfully. C:Program FilesWindows Savevid ToolbarDatamngrToolBarchromeskinlibpanelsdefault folder moved successfully. C:Program FilesWindows Savevid ToolbarDatamngrToolBarchromeskinlibpanelscss folder moved successfully. C:Program FilesWindows Savevid ToolbarDatamngrToolBarchromeskinlibpanels folder moved successfully. C:Program FilesWindows Savevid ToolbarDatamngrToolBarchromeskinlib folder moved successfully. C:Program FilesWindows Savevid ToolbarDatamngrToolBarchromeskin folder moved successfully. C:Program FilesWindows Savevid ToolbarDatamngrToolBarchromecontentwidgetsnet.vmn.www.WebTVskinscripts folder moved successfully. C:Program FilesWindows Savevid ToolbarDatamngrToolBarchromecontentwidgetsnet.vmn.www.WebTVskinimages folder moved successfully. C:Program FilesWindows Savevid ToolbarDatamngrToolBarchromecontentwidgetsnet.vmn.www.WebTVskincss folder moved successfully. C:Program FilesWindows Savevid ToolbarDatamngrToolBarchromecontentwidgetsnet.vmn.www.WebTVskin folder moved successfully. C:Program FilesWindows Savevid ToolbarDatamngrToolBarchromecontentwidgetsnet.vmn.www.WebTVjs folder moved successfully. C:Program FilesWindows Savevid ToolbarDatamngrToolBarchromecontentwidgetsnet.vmn.www.WebTVimages folder moved successfully. C:Program FilesWindows Savevid ToolbarDatamngrToolBarchromecontentwidgetsnet.vmn.www.WebTVcss folder moved successfully. C:Program FilesWindows Savevid ToolbarDatamngrToolBarchromecontentwidgetsnet.vmn.www.WebTV folder moved successfully. C:Program FilesWindows Savevid ToolbarDatamngrToolBarchromecontentwidgetscom.savevid.www.Savevid folder moved successfully. C:Program FilesWindows Savevid ToolbarDatamngrToolBarchromecontentwidgetscom.djboxservice.dj.DJBox humbs folder moved successfully. C:Program FilesWindows Savevid ToolbarDatamngrToolBarchromecontentwidgetscom.djboxservice.dj.DJBox folder moved successfully. C:Program FilesWindows Savevid ToolbarDatamngrToolBarchromecontentwidgets folder moved successfully. C:Program FilesWindows Savevid ToolbarDatamngrToolBarchromecontentmodules folder moved successfully. C:Program FilesWindows Savevid ToolbarDatamngrToolBarchromecontentlib folder moved successfully. C:Program FilesWindows Savevid ToolbarDatamngrToolBarchromecontentdatasearch folder moved successfully. C:Program FilesWindows Savevid ToolbarDatamngrToolBarchromecontentdata folder moved successfully. C:Program FilesWindows Savevid ToolbarDatamngrToolBarchromecontent folder moved successfully. C:Program FilesWindows Savevid ToolbarDatamngrToolBarchrome folder moved successfully. C:Program FilesWindows Savevid ToolbarDatamngrToolBar folder moved successfully. C:Program FilesWindows Savevid ToolbarDatamngrFirefoxExtensioncontent folder moved successfully. C:Program FilesWindows Savevid ToolbarDatamngrFirefoxExtensioncomponents folder moved successfully. C:Program FilesWindows Savevid ToolbarDatamngrFirefoxExtension folder moved successfully. C:Program FilesWindows Savevid ToolbarDatamngr folder moved successfully. C:Program FilesWindows Savevid Toolbar folder moved successfully. C:ProgramData{C4A867AE-B15C-4B7F-AD27-7F8C13A57518} folder moved successfully. C:Program FilesSavevidPlug-in folder moved successfully. C:UsersToshibaAppDataLocalPackageAware folder moved successfully. ========== FILES ========== C:UsersToshibaAppDataLocalXenocodeApplianceCachesHoldemManager.exe_v08404D5BNativeSTUBEXE@[email protected] moved successfully. C:UsersToshibaAppDataLocalXenocodeApplianceCachesHoldemManager.exe_v08404D5BTheAppSTUBEXE@PROGRAMFILES@RVG SoftwareHoldem ManagerHoldemManager.exe moved successfully. C:UsersToshibaAppDataLocalXenocodeApplianceCachesHoldemManager.exe_v7BC20518NativeSTUBEXE@PROGRAMFILES@RVG SoftwareHoldem ManagerDBControlPanel.exe moved successfully. ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes ->Flash cache emptied: 56504 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: postgres ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes User: postgres.Toshiba-PC ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes ->Flash cache emptied: 56504 bytes User: Public ->Temp folder emptied: 0 bytes User: Toshiba ->Temp folder emptied: 32204545 bytes ->Temporary Internet Files folder emptied: 191380165 bytes ->Java cache emptied: 63514823 bytes ->FireFox cache emptied: 52380838 bytes ->Google Chrome cache emptied: 316359633 bytes ->Flash cache emptied: 201260 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%System32 .tmp files removed: 0 bytes %systemroot%System32drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 0 bytes %systemroot%system32configsystemprofileLocal SettingsTemporary Internet Files folder emptied: 0 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 626,00 mb OTL by OldTimer - Version 3.2.48.0 log created on 06142012_012433 FilesFolders moved on Reboot... C:Windows empWebExLog613atashost.log moved successfully. Registry entries deleted on Reboot...

14 юни 201214 г.

Изтеглете и обновете следните програми:

Adobe Flash Player 11.3.300.257 Final за (Internet Explorer) | BG Mirror (1.87 MB)

Adobe Flash Player 11.3.300.257 Final за (Firefox, Safari, Opera) | BG Mirror (1.84 MB)

Adobe Reader 10.1.3 | BG Mirror (50.9 MB)

http://www.oracle.co...ds-1637595.html (тук изберете): - Windows x86 Offline 16.2 MB

Деинсталирайте следните програми, ако още присъстват:

Ask Toolbar

SaveVid Plug-in

Windows Savevid Toolbar

YouTube Downloader Toolbar v5.8

В другия пост ще изчистим използваните от нас инструменти.

14 юни 201214 г.

Автор

Готов съм с тези задачи

14 юни 201214 г.

Да почистим:

Деинсталирайте Combofix:

Натиснете Start => в полето за търсене въведете Combofix /Uninstall (има празно място между Combofix и /Uninstall) и натиснете Enter.

Стартирайте OTL още веднъж и натиснете бутона CleanUp.

Ако бъдете подканени да рестартирате, се съгласете.

Изтеглете ToolsCleaner2 и го стартирайте.

Натиснете бутона Recherche и изчакайте да се извърши проверката.

Може временно да ви изпише "Not responding", но програмата не е забила.

След края на проверката натиснете бутона Suppression и за финал Quitter.

Публикувайте доклада от лог файла C:TCleaner.txt в следващия си пост.

Изтрийте всички инструменти и логове на инструментите които сме използвали (и не са се изтрили след изпълнените досега процедури).

14 юни 201214 г.

Автор

Toolscleaner-a не свърши работа. [ Rapport ToolsCleaner version 2.3.11 (par A.Rothstein & dj QUIOU) ] --> Recherche: --------------------------------- --> Suppression:

Редактирано 14 юни 201214 г. от Chavdar Mutafov (преглед на промените)

14 юни 201214 г.

Явно OTL е почистил предостатъчно.

Ако все пак е пропуснала нещо го изтрийте ръчно, но като цяло това не е болка.

За финал вижте тази статия и направете една лека оптимизация на Windows Vista:

http://windows.micro...ter-performance

Препоръчвам създаването на image файл с Macrium Reflect Free

http://www.macrium.c...eflectfree.aspx

Ето и кратко ръководство (отдолу има и видеоклип):

http://kb.macrium.co...ticle50074.aspx

Ако няма повече проблеми маркирам случая като решен!

Безопсно сърфиране и писане на дипломната работа.

14 юни 201214 г.

Автор

Ще изпълня и последните наставления. Благодаря още веднъж за изключително професионалната помощ.

Добре дошли!

Заразен - Live security protection

Featured Replies

Архивирана тема

Разглеждащи това в момента 0

Дарение

Бюлетин

Профил

Навигация

Търсене

Конфигуриране на push известия в браузъра

Chrome (Android)

Chrome (Desktop)

Safari (iOS 16.4+)

Safari (macOS)

Edge (Android)

Edge (Desktop)

Firefox (Android)

Firefox (Desktop)