Хак по IP ?

25 август 201214 г.

Докато си писах с приятел по Skype, в чата бе добавен хакер, който ми засече IP адреса и ми спря за малко интернета. Веднага след това направих сканиране за вируси, keylogger-и и други вредни файлове в системата. Използвах Spybot - Search and Destroy, Malwarebytes и накрая сканирах с Avast. Откри много заразени файлове, но не мисля че са от въпросния хакер. На другия ден пак ми спря интернета и се оказа че е същия човек. След като пак се свързах с интернет по-късно, с помоща на приятел сменихме mac адреса и IP-то. За сега нямам проблем, но не е гаранция че няма да се повтори в бъдеще. Не разполагам с компакт диск на операционната ми система, но мога да набавя такъв. DDS (Ver_2011-09-30.01) - NTFS_AMD64 Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_32 Run by n at 22:35:35 on 2012-08-25 Microsoft Windows 7 Ultimate 6.1.7601.1.1251.359.1026.18.4094.1942 [GMT 3:00] . AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C} SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . ============== Running Processes =============== . C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k RPCSS C:\Windows\system32\atiesrxx.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k NetworkService C:\Program Files\AVAST Software\Avast\AvastSvc.exe C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Windows\system32\taskeng.exe C:\Program Files (x86)\PANDORA.TV\PanService\PandoraService.exe C:\Windows\system32\svchost.exe -k imgsvc C:\Program Files\Web Assistant\ExtensionUpdaterService.exe C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Windows\system32\SearchIndexer.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Windows\System32\svchost.exe -k LocalServicePeerNet C:\Windows\system32\wbem\wmiprvse.exe C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\AllShareDMS.exe C:\Windows\System32\svchost.exe -k secsvcs C:\Windows\system32\atieclxx.exe C:\Windows\system32\taskhost.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe C:\Program Files (x86)\uTorrent\uTorrent.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Program Files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exe C:\Program Files\AVAST Software\Avast\AvastUI.exe C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe C:\Program Files (x86)\Samsung\AllShare\AllShareAgent.exe C:\Program Files (x86)\Ask.com\Updater\Updater.exe C:\Windows\vm305_sti.exe C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Windows\system32\wuauclt.exe C:\Program Files (x86)\Skype\Phone\Skype.exe C:\Windows\system32\conhost.exe C:\Windows\system32\taskeng.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Windows\system32\conhost.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\System32\cscript.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://search.softonic.com/MON00006/tb_v1?SearchSource=10&cc= uProxyOverride = localhost; 127.0.0.1; <local> uURLSearchHooks: YTD Toolbar: {F3FEE66E-E034-436a-86E4-9690573BEE8A} - C:\Program Files (x86)\YTD Toolbar\IE\6.2\ytdToolbarIE.dll uURLSearchHooks: UrlSearchHook Class: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll mWinlogon: Userinit = userinit.exe, BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO: {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - <orphaned> BHO: Spybot-S&D IE Protection: {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll BHO: Incredibar.com Helper Object: {6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99} - BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll BHO: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll BHO: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll BHO: KMPlayer Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll BHO: Softonic Helper Object: {E87806B5-E908-45FD-AF5E-957D83E58E68} - C:\Program Files (x86)\Softonic\Softonic\1.6.7.4\bh\Softonic.dll BHO: YTD Toolbar: {F3FEE66E-E034-436a-86E4-9690573BEE8A} - C:\Program Files (x86)\YTD Toolbar\IE\6.2\ytdToolbarIE.dll TB: KMPlayer Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll TB: KMPlayer Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll TB: Incredibar Toolbar: {F9639E4A-801B-4843-AEE3-03D9DA199E77} - TB: Softonic Toolbar: {5018CFD2-804D-4C99-9F81-25EAEA2769DE} - C:\Program Files (x86)\Softonic\Softonic\1.6.7.4\SoftonicTlbr.dll TB: YTD Toolbar: {F3FEE66E-E034-436a-86E4-9690573BEE8A} - C:\Program Files (x86)\YTD Toolbar\IE\6.2\ytdToolbarIE.dll TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll TB: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll uRun: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun uRun: [uTorrent] "C:\Program Files (x86)\uTorrent\uTorrent.exe" /MINIMIZED uRun: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun uRun: [PicPick Start] C:\Program Files (x86)\PicPick\picpick.exe uRun: [spybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe uRun: [RGSC] D:\LACHEZAR\Games\Rockstar Games Social Club\RGSCLauncher.exe /silent mRun: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" mRun: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" mRun: [AllShareAgent] C:\Program Files (x86)\Samsung\AllShare\AllShareAgent.exe mRun: [ApnUpdater] "C:\Program Files (x86)\Ask.com\Updater\Updater.exe" mRun: [bigDog305] C:\Windows\VM305_STI.EXE A4 TECH PC Camera V mRun: [KeePass 2 PreLoad] "C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe" --preload mRun: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" mRun: [searchSettings] "C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe" StartupFolder: C:\Users\n\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CurseClientStartup.ccip StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\MCAFEE~1.LNK - C:\Program Files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exe mPolicies-Explorer: NoActiveDesktop = dword:1 mPolicies-Explorer: NoActiveDesktopChanges = dword:1 mPolicies-System: ConsentPromptBehaviorAdmin = dword:5 mPolicies-System: ConsentPromptBehaviorUser = dword:3 mPolicies-System: EnableUIADesktopToggle = dword:0 IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office12\ONBttnIE.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll . INFO: HKCU has more than 50 listed domains. If you wish to scan all of them, select the 'Force scan all domains' option. . . INFO: HKLM has more than 50 listed domains. If you wish to scan all of them, select the 'Force scan all domains' option. . DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_32-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0032-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_32-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_32-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab TCP: NameServer = 217.18.242.74 217.18.242.146 TCP: Interfaces\{EE92F72D-2D8C-4582-B835-DF3F99517AA9} : DHCPNameServer = 217.18.242.74 217.18.242.146 Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll SSODL: WebCheck - <orphaned> SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll x64-BHO: avast! WebRep: {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll x64-BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll x64-TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll x64-TB: avast! WebRep: {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll x64-Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s . INFO: x64-HKLM has more than 50 listed domains. If you wish to scan all of them, select the 'Force scan all domains' option. . x64-Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - <orphaned> x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned> x64-SSODL: WebCheck - <orphaned> Hosts: 127.0.0.1 www.spywareinfo.com . ================= FIREFOX =================== . FF - ProfilePath - C:\Users\n\AppData\Roaming\Mozilla\Firefox\Profiles\0k32gq6n.default\ FF - prefs.js: browser.search.selectedEngine - Yahoo FF - prefs.js: browser.startup.homepage - hxxps://www.google.bg/ FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=937811&p= FF - prefs.js: keyword.url - hxxp://search.babylon.com/?AF=110393&babsrc=adbartrp&mntrId=c44c3080000000000000001fd0888db9&q= FF - plugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll FF - plugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npwachk.dll FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll FF - plugin: C:\Windows\SysWOW64\npdeployJava1.dll FF - plugin: C:\Windows\SysWOW64\npmproxy.dll . ---- FIREFOX POLICIES ---- FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=110393 FF - user.js: extensions.BabylonToolbar_i.babExt - FF - user.js: extensions.BabylonToolbar_i.srcExt - ss FF - user.js: extensions.BabylonToolbar_i.id - c44c3080000000000000001fd0888db9 FF - user.js: extensions.BabylonToolbar_i.hardId - c44c3080000000000000001fd0888db9 FF - user.js: extensions.BabylonToolbar_i.instlDay - 15482 FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17 FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17 FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.1719:44:10 FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar FF - user.js: extensions.BabylonToolbar_i.aflt - babsst FF - user.js: extensions.BabylonToolbar_i.smplGrp - none FF - user.js: extensions.BabylonToolbar_i.tlbrId - base FF - user.js: extensions.BabylonToolbar_i.instlRef - sst FF - user.js: extensions.incredibar_i.ms_url_id - FF - user.js: extensions.incredibar_i.upn2 - 6R8uOvRBCT FF - user.js: extensions.incredibar_i.upn2n - 92824468074982023 FF - user.js: extensions.incredibar_i.productid - 26 FF - user.js: extensions.incredibar_i.installerproductid - 26 FF - user.js: extensions.incredibar_i.did - 10650 FF - user.js: extensions.incredibar_i.ppd - 20%5F5 FF - user.js: extensions.incredibar_i.newTab - false FF - user.js: extensions.incredibar_i.tlbrSrchUrl - hxxp://mystart.Incredibar.com/?a=6R8uOvRBCT&loc=IB_TB&i=26&search= FF - user.js: extensions.incredibar_i.id - c44c3080000000000000001fd0888db9 FF - user.js: extensions.incredibar_i.instlDay - 15493 FF - user.js: extensions.incredibar_i.vrsn - 1.5.11.14 FF - user.js: extensions.incredibar_i.vrsni - 1.5.11.14 FF - user.js: extensions.incredibar_i.vrsnTs - 1.5.11.140:26:16 FF - user.js: extensions.incredibar_i.prtnrId - Incredibar FF - user.js: extensions.incredibar_i.prdct - incredibar FF - user.js: extensions.incredibar_i.aflt - orgnl FF - user.js: extensions.incredibar_i.smplGrp - none FF - user.js: extensions.incredibar_i.tlbrId - base FF - user.js: extensions.incredibar_i.instlRef - FF - user.js: extensions.incredibar_i.dfltLng - FF - user.js: extensions.incredibar_i.excTlbr - false FF - user.js: extensions.Softonic.rvrtMsg - Click Yes to keep current home page and default search settings, Click No to restore original settings FF - user.js: extensions.Softonic.autoRvrt - false FF - user.js: extensions.Softonic_i.hmpg - true FF - user.js: extensions.Softonic.hmpgUrl - hxxp://search.softonic.com/MON00006/tb_v1?SearchSource=13&cc= FF - user.js: extensions.Softonic.hpOld - hxxp://mystart.incredibar.com/mb139?a=6r8uovrbct&i=26 FF - user.js: extensions.Softonic.hpNew - hxxp://search.softonic.com/MON00006/tb_v1?SearchSource=13&cc= FF - user.js: extensions.Softonic.dfltSrch - true FF - user.js: extensions.Softonic.srchPrvdr - Search the web (Softonic) FF - user.js: extensions.Softonic.keyWordUrl - hxxp://search.softonic.com/MON00006/tb_v1?SearchSource=2&cc=&q= FF - user.js: extensions.Softonic.dspOld - FF - user.js: extensions.Softonic.dspNew - Search the web (Softonic) FF - user.js: extensions.Softonic_i.dnsErr - true FF - user.js: extensions.Softonic_i.newTab - true FF - user.js: extensions.Softonic.newTabUrl - hxxp://search.softonic.com/MON00006/tb_v1?SearchSource=15&cc= FF - user.js: extensions.Softonic.tlbrSrchUrl - hxxp://search.softonic.com/MON00006/tb_v1?SearchSource=1&cc=&q= FF - user.js: extensions.Softonic.id - c44c3080000000000000001fd0888db9 FF - user.js: extensions.Softonic.instlDay - 15567 FF - user.js: extensions.Softonic.vrsn - 1.6.7.4 FF - user.js: extensions.Softonic.vrsni - 1.6.7.4 FF - user.js: extensions.Softonic_i.vrsnTs - 1.6.7.413:25:47 FF - user.js: extensions.Softonic.prtnrId - softonic FF - user.js: extensions.Softonic.prdct - Softonic FF - user.js: extensions.Softonic.aflt - SD FF - user.js: extensions.Softonic_i.smplGrp - none FF - user.js: extensions.Softonic.tlbrId - base FF - user.js: extensions.Softonic.instlRef - MON00006 FF - user.js: extensions.Softonic.dfltLng - FF - user.js: extensions.Softonic.excTlbr - false FF - user.js: extensions.Softonic.admin - false . ============= SERVICES / DRIVERS =============== . R1 aswSnx;aswSnx;C:\Windows\System32\drivers\aswSnx.sys [2012-1-17 969200] R1 aswSP;aswSP;C:\Windows\System32\drivers\aswSP.sys [2012-1-17 359464] R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\System32\atiesrxx.exe [2011-11-10 204288] R2 aswFsBlk;aswFsBlk;C:\Windows\System32\drivers\aswFsBlk.sys [2012-1-17 25232] R2 aswMonFlt;aswMonFlt;C:\Windows\System32\drivers\aswMonFlt.sys [2012-1-17 71600] R2 avast! Antivirus;avast! Antivirus;C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2012-8-25 44808] R2 PanService;PandoraService;C:\Program Files (x86)\PANDORA.TV\PanService\PandoraService.exe [2012-1-20 624856] R2 SamsungAllShareV2.0;Samsung AllShare PC;C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\AllShareDMS.exe [2012-3-2 25504] R2 SBSDWSCService;SBSD Security Center Service;C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2012-3-16 1153368] R2 Web Assistant Updater;Web Assistant Updater;C:\Program Files\Web Assistant\ExtensionUpdaterService.exe [2012-6-3 185856] R3 amdkmdag;amdkmdag;C:\Windows\System32\drivers\atikmdag.sys [2011-11-10 10567680] R3 amdkmdap;amdkmdap;C:\Windows\System32\drivers\atikmpag.sys [2011-11-10 325632] R3 AtiHDAudioService;AMD Function Driver for HD Audio Service;C:\Windows\System32\drivers\AtihdW76.sys [2011-10-17 93712] R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2009-3-2 187392] R3 vvftav;vvftav;C:\Windows\System32\drivers\vvftav.sys [2012-2-3 300800] R3 ZSMC0305;A4 TECH PC Camera V;C:\Windows\System32\drivers\usbVM305.sys [2012-2-3 1541120] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576] S2 gupdate;Услуга на Google Актуализация (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-1-27 136176] S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-7-13 160944] S3 dmvsc;dmvsc;C:\Windows\System32\drivers\dmvsc.sys [2010-11-21 71168] S3 gupdatem;Услуга на Google Актуализация (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-1-27 136176] S3 McComponentHostService;McAfee Security Scan Component Host Service;C:\Program Files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-1-15 227232] S3 MozillaMaintenance;Mozilla Maintenance Service;C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-8-25 113120] S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\System32\drivers\rdpvideominiport.sys [2010-11-21 20992] S3 SimpleSlideShowServer;SimpleSlideShowServer;C:\Program Files (x86)\Samsung\AllShare\AllShareSlideShowService.exe [2012-3-2 27584] S3 Synth3dVsc;Synth3dVsc;C:\Windows\System32\drivers\Synth3dVsc.sys [2010-11-21 88960] S3 terminpt;Microsoft Remote Desktop Input Driver;C:\Windows\System32\drivers\terminpt.sys [2010-11-21 34816] S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2010-11-21 59392] S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\System32\drivers\TsUsbGD.sys [2010-11-21 31232] S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2012-1-17 1255736] SUnknown tsusbhub;tsusbhub; [x] . =============== Created Last 30 ================ . 2012-08-25 16:09:46 -------- d-----w- C:\Program Files (x86)\Mozilla Maintenance Service 2012-08-25 16:09:45 136672 ----a-w- C:\Program Files (x86)\Mozilla Firefox\components\browsercomps.dll 2012-08-25 16:09:44 770384 ----a-w- C:\Program Files (x86)\Mozilla Firefox\msvcr100.dll 2012-08-25 16:09:44 68576 ----a-w- C:\Program Files (x86)\Mozilla Firefox\mozglue.dll 2012-08-25 16:09:44 573920 ----a-w- C:\Program Files (x86)\Mozilla Firefox\gkmedias.dll 2012-08-25 16:09:44 421200 ----a-w- C:\Program Files (x86)\Mozilla Firefox\msvcp100.dll 2012-08-25 16:09:44 157608 ----a-w- C:\Program Files (x86)\Mozilla Firefox\maintenanceservice_installer.exe 2012-08-25 16:09:44 113120 ----a-w- C:\Program Files (x86)\Mozilla Firefox\maintenanceservice.exe 2012-08-25 10:21:40 69000 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{8A89AE31-D8F4-4E3A-855E-63024E8192CD}\offreg.dll 2012-08-24 07:12:18 9309624 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{8A89AE31-D8F4-4E3A-855E-63024E8192CD}\mpengine.dll 2012-08-23 14:25:10 -------- d-----w- C:\Program Files (x86)\NVIDIA Corporation 2012-08-23 14:24:35 -------- d-----w- C:\Program Files (x86)\Common Files\Wise Installation Wizard 2012-08-23 14:21:42 -------- d-----w- C:\Users\n\AppData\Local\2K Games 2012-08-23 14:15:17 -------- d-----w- C:\Program Files (x86)\2K Games 2012-08-18 23:59:06 -------- d-sh--w- C:\Windows\System32\%APPDATA% 2012-08-15 18:52:07 -------- d-----w- C:\Program Files (x86)\YTD Toolbar 2012-08-15 18:51:50 -------- d-----w- C:\ProgramData\YTD Video Downloader 2012-08-15 18:51:46 -------- d-----w- C:\Program Files (x86)\GreenTree Applications 2012-08-15 14:45:47 -------- d-----w- C:\Users\n\AppData\Local\SugarSync 2012-08-15 14:45:25 -------- d-----w- C:\Program Files (x86)\SugarSync 2012-08-15 14:24:05 -------- d-----w- C:\Users\n\AppData\Local\Rockstar Games 2012-08-15 14:23:00 178800 ----a-w- C:\Windows\SysWow64\CmdLineExt_x64.dll 2012-08-15 14:21:12 -------- d-----w- C:\Windows\SysWow64\xlive 2012-08-15 14:21:11 -------- d-----w- C:\Program Files (x86)\Microsoft Games for Windows - LIVE 2012-08-15 13:56:44 -------- d-----w- C:\Users\n\AppData\Roaming\.minecraft 2012-08-15 10:48:41 -------- d-----w- C:\Program Files (x86)\Amnesia - The Dark Descent 2012-08-15 10:25:45 -------- d-----w- C:\Program Files (x86)\Softonic . ==================== Find3M ==================== . 2012-08-21 09:13:13 969200 ----a-w- C:\Windows\System32\drivers\aswSnx.sys 2012-08-21 09:13:12 71600 ----a-w- C:\Windows\System32\drivers\aswMonFlt.sys 2012-08-21 09:13:12 54072 ----a-w- C:\Windows\System32\drivers\aswRdr2.sys 2012-08-21 09:12:33 41224 ----a-w- C:\Windows\avastSS.scr 2012-07-18 18:15:06 3148800 ----a-w- C:\Windows\System32\win32k.sys 2012-07-04 22:13:27 59392 ----a-w- C:\Windows\System32\browcli.dll 2012-07-04 22:13:27 136704 ----a-w- C:\Windows\System32\browser.dll 2012-07-04 21:14:34 41984 ----a-w- C:\Windows\SysWow64\browcli.dll 2012-07-03 10:46:44 24904 ----a-w- C:\Windows\System32\drivers\mbam.sys 2012-06-29 03:56:34 2312704 ----a-w- C:\Windows\System32\jscript9.dll 2012-06-29 03:49:11 1392128 ----a-w- C:\Windows\System32\wininet.dll 2012-06-29 03:48:07 1494528 ----a-w- C:\Windows\System32\inetcpl.cpl 2012-06-29 03:43:49 173056 ----a-w- C:\Windows\System32\ieUnatt.exe 2012-06-29 03:39:48 2382848 ----a-w- C:\Windows\System32\mshtml.tlb 2012-06-29 00:16:58 1800704 ----a-w- C:\Windows\SysWow64\jscript9.dll 2012-06-29 00:09:01 1129472 ----a-w- C:\Windows\SysWow64\wininet.dll 2012-06-29 00:08:59 1427968 ----a-w- C:\Windows\SysWow64\inetcpl.cpl 2012-06-29 00:04:43 142848 ----a-w- C:\Windows\SysWow64\ieUnatt.exe 2012-06-29 00:00:45 2382848 ----a-w- C:\Windows\SysWow64\mshtml.tlb 2012-06-06 06:06:16 2004480 ----a-w- C:\Windows\System32\msxml6.dll 2012-06-06 06:06:16 1881600 ----a-w- C:\Windows\System32\msxml3.dll 2012-06-06 06:02:54 1133568 ----a-w- C:\Windows\System32\cdosys.dll 2012-06-06 05:05:52 1390080 ----a-w- C:\Windows\SysWow64\msxml6.dll 2012-06-06 05:05:52 1236992 ----a-w- C:\Windows\SysWow64\msxml3.dll 2012-06-06 05:03:06 805376 ----a-w- C:\Windows\SysWow64\cdosys.dll 2012-06-02 22:15:31 2622464 ----a-w- C:\Windows\System32\wucltux.dll 2012-06-02 22:15:08 99840 ----a-w- C:\Windows\System32\wudriver.dll 2012-06-02 12:19:42 186752 ----a-w- C:\Windows\System32\wuwebv.dll 2012-06-02 12:15:12 36864 ----a-w- C:\Windows\System32\wuapp.exe 2012-06-02 05:50:10 458704 ----a-w- C:\Windows\System32\drivers\cng.sys 2012-06-02 05:48:16 95600 ----a-w- C:\Windows\System32\drivers\ksecdd.sys 2012-06-02 05:48:16 151920 ----a-w- C:\Windows\System32\drivers\ksecpkg.sys 2012-06-02 05:45:31 340992 ----a-w- C:\Windows\System32\schannel.dll 2012-06-02 05:44:21 307200 ----a-w- C:\Windows\System32\ncrypt.dll 2012-06-02 04:40:42 22016 ----a-w- C:\Windows\SysWow64\secur32.dll 2012-06-02 04:40:39 225280 ----a-w- C:\Windows\SysWow64\schannel.dll 2012-06-02 04:39:10 219136 ----a-w- C:\Windows\SysWow64\ncrypt.dll 2012-06-02 04:34:09 96768 ----a-w- C:\Windows\SysWow64\sspicli.dll 2012-05-31 10:55:07 476960 ----a-w- C:\Windows\SysWow64\npdeployJava1.dll 2012-05-31 10:55:07 472864 ----a-w- C:\Windows\SysWow64\deployJava1.dll 2012-05-31 09:25:12 279656 ------w- C:\Windows\System32\MpSigStub.exe . ============= FINISH: 22:36:05,30 ===============

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

26 август 201214 г.

Здравейте...!Преди да продължим изтеглете този архив MCPR.zip разархивирайте и стартирайте инструмента MCPR.exe - целта е да премахнем McAfee Security Scan (възможен е конфликт с вашата антивирусна програма).

След това:

Изтеглете DDS (създаден от sUBs) от BleepingComputer.
След изтегляне на инструмента е необходимо да бъде запаметен (чрез менюто File => Save As...) на вашия работен плот.
След като изтеглите DDS на вашия работен плот, иконката на програмата би трябвало да изглежда по този начин:
Прекратете временно защитата в реално време на антивирусния ви софтуер. След това стартирайте DDS с двоен клик на иконката, като потвърдите намерението си с кликане върху бутона Run.
След приключване на работата на DDS, ще се появят два текстови файла в Notepad, наречени: DDS.txt и Attach.txt и ги запазете (чрез менюто File => Save As...) на вашия работен плот.Копирайте и поставете съдържанието на DDS.txt и Attach.txt директно във вашата тема. Моля, не ги прикачвайте!

26 август 201214 г.

Автор

Здравейте...!Преди да продължим изтеглете този архив MCPR.zip разархивирайте и стартирайте инструмента MCPR.exe - целта е да премахнем McAfee Security Scan (възможен е конфликт с вашата антивирусна програма).

След това:

Изтеглете DDS (създаден от sUBs) от BleepingComputer.

След изтегляне на инструмента е необходимо да бъде запаметен (чрез менюто File => Save As...) на вашия работен плот.

След като изтеглите DDS на вашия работен плот, иконката на програмата би трябвало да изглежда по този начин:

Прекратете временно защитата в реално време на антивирусния ви софтуер. След това стартирайте DDS с двоен клик на иконката, като потвърдите намерението си с кликане върху бутона Run.

След приключване на работата на DDS, ще се появят два текстови файла в Notepad, наречени: DDS.txt и Attach.txt и ги запазете (чрез менюто File => Save As...) на вашия работен плот.Копирайте и поставете съдържанието на DDS.txt и Attach.txt директно във вашата тема. Моля, не ги прикачвайте!

DDS

DDS (Ver_2011-09-30.01) - NTFS_AMD64

Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_32

Run by n at 14:55:19 on 2012-08-26

Microsoft Windows 7 Ultimate 6.1.7601.1.1251.359.1026.18.4094.2135 [GMT 3:00]

.

AV: avast! Antivirus *Enabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}

SP: avast! Antivirus *Enabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

============== Running Processes ===============

.

C:Windowssystem32wininit.exe

C:Windowssystem32lsm.exe

C:Windowssystem32svchost.exe -k DcomLaunch

C:Windowssystem32svchost.exe -k RPCSS

C:Windowssystem32atiesrxx.exe

C:WindowsSystem32svchost.exe -k LocalServiceNetworkRestricted

C:WindowsSystem32svchost.exe -k LocalSystemNetworkRestricted

C:Windowssystem32svchost.exe -k netsvcs

C:Windowssystem32svchost.exe -k LocalService

C:Windowssystem32atieclxx.exe

C:Windowssystem32svchost.exe -k NetworkService

C:Program FilesAVAST SoftwareAvastAvastSvc.exe

C:Windowssystem32Dwm.exe

C:WindowsSystem32spoolsv.exe

C:WindowsExplorer.EXE

C:Windowssystem32svchost.exe -k LocalServiceNoNetwork

C:Windowssystem32taskhost.exe

C:Windowssystem32taskeng.exe

C:Program Files (x86)PANDORA.TVPanServicePandoraService.exe

C:Windowssystem32svchost.exe -k imgsvc

C:Program FilesWeb AssistantExtensionUpdaterService.exe

C:Program Files (x86)Spybot - Search & DestroySDWinSec.exe

C:Program FilesRealtekAudioHDARAVCpl64.exe

C:Program Files (x86)DAEMON Tools LiteDTLite.exe

C:Program Files (x86)uTorrentuTorrent.exe

C:Program FilesWindows Sidebarsidebar.exe

C:Program Files (x86)PicPickpicpick.exe

C:Program Files (x86)Spybot - Search & DestroyTeaTimer.exe

C:Program Files (x86)McAfee Security Scan2.0.181SSScheduler.exe

C:WindowsMicrosoft.NETFramework64v4.0.30319dfsvc.exe

C:Program FilesAVAST SoftwareAvastAvastUI.exe

C:Program Files (x86)Common FilesAdobeARM1.0AdobeARM.exe

C:Program Files (x86)SamsungAllShareAllShareAgent.exe

C:Program Files (x86)Ask.comUpdaterUpdater.exe

C:Windowsvm305_sti.exe

C:Program Files (x86)Common FilesJavaJava Updatejusched.exe

C:Windowssystem32SearchIndexer.exe

C:Windowssystem32svchost.exe -k LocalServiceAndNoImpersonation

C:Program FilesWindows Media Playerwmpnetwk.exe

C:WindowsSystem32svchost.exe -k LocalServicePeerNet

C:Program Files (x86)SkypePhoneSkype.exe

C:Windowssystem32wbemwmiprvse.exe

C:Windowssystem32taskeng.exe

C:Program Files (x86)Internet ExplorerIELowutil.exe

C:Program Files (x86)GoogleChromeApplicationchrome.exe

C:Program Files (x86)SamsungAllShareAllShareDMSAllShareDMS.exe

C:Windowssystem32sppsvc.exe

C:WindowsSystem32svchost.exe -k secsvcs

C:Windowssystem32wbemwmiprvse.exe

C:WindowsservicingTrustedInstaller.exe

C:Windowssystem32SearchProtocolHost.exe

C:Windowssystem32SearchFilterHost.exe

C:Windowssystem32wuauclt.exe

C:Windowssystem32conhost.exe

C:WindowsSystem32cscript.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://search.softonic.com/MON00006/tb_v1?SearchSource=10&cc=

uProxyOverride = localhost; 127.0.0.1; <local>

uURLSearchHooks: YTD Toolbar: {F3FEE66E-E034-436a-86E4-9690573BEE8A} - C:Program Files (x86)YTD ToolbarIE6.2ytdToolbarIE.dll

uURLSearchHooks: UrlSearchHook Class: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:Program Files (x86)Ask.comGenericAskToolbar.dll

mWinlogon: Userinit = userinit.exe,

BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:Program Files (x86)Common FilesAdobeAcrobatActiveXAcroIEHelperShim.dll

BHO: {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - <orphaned>

BHO: Spybot-S&D IE Protection: {53707962-6F74-2D53-2644-206D7942484F} - C:Program Files (x86)Spybot - Search & DestroySDHelper.dll

BHO: Incredibar.com Helper Object: {6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99} -

BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:Program Files (x86)Microsoft OfficeOffice12GrooveShellExtensions.dll

BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:Program Files (x86)Javajre6binssv.dll

BHO: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:Program FilesAVAST SoftwareAvastaswWebRepIE.dll

BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:Program Files (x86)GoogleGoogle ToolbarGoogleToolbar_32.dll

BHO: KMPlayer Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - C:Program Files (x86)Ask.comGenericAskToolbar.dll

BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:Program Files (x86)Javajre6binjp2ssv.dll

BHO: Softonic Helper Object: {E87806B5-E908-45FD-AF5E-957D83E58E68} - C:Program Files (x86)SoftonicSoftonic1.6.7.4bhSoftonic.dll

BHO: YTD Toolbar: {F3FEE66E-E034-436a-86E4-9690573BEE8A} - C:Program Files (x86)YTD ToolbarIE6.2ytdToolbarIE.dll

TB: KMPlayer Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - C:Program Files (x86)Ask.comGenericAskToolbar.dll

TB: Incredibar Toolbar: {F9639E4A-801B-4843-AEE3-03D9DA199E77} -

TB: Softonic Toolbar: {5018CFD2-804D-4C99-9F81-25EAEA2769DE} - C:Program Files (x86)SoftonicSoftonic1.6.7.4SoftonicTlbr.dll

TB: YTD Toolbar: {F3FEE66E-E034-436a-86E4-9690573BEE8A} - C:Program Files (x86)YTD ToolbarIE6.2ytdToolbarIE.dll

TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:Program Files (x86)GoogleGoogle ToolbarGoogleToolbar_32.dll

TB: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:Program FilesAVAST SoftwareAvastaswWebRepIE.dll

uRun: [DAEMON Tools Lite] "C:Program Files (x86)DAEMON Tools LiteDTLite.exe" -autorun

uRun: [uTorrent] "C:Program Files (x86)uTorrentuTorrent.exe" /MINIMIZED

uRun: [sidebar] C:Program FilesWindows Sidebarsidebar.exe /autoRun

uRun: [PicPick Start] C:Program Files (x86)PicPickpicpick.exe

uRun: [spybotSD TeaTimer] C:Program Files (x86)Spybot - Search & DestroyTeaTimer.exe

uRun: [RGSC] D:LACHEZARGamesRockstar Games Social ClubRGSCLauncher.exe /silent

mRun: [GrooveMonitor] "C:Program Files (x86)Microsoft OfficeOffice12GrooveMonitor.exe"

mRun: [avast] "C:Program FilesAVAST SoftwareAvastavastUI.exe" /nogui

mRun: [Adobe Reader Speed Launcher] "C:Program Files (x86)AdobeReader 10.0ReaderReader_sl.exe"

mRun: [Adobe ARM] "C:Program Files (x86)Common FilesAdobeARM1.0AdobeARM.exe"

mRun: [AllShareAgent] C:Program Files (x86)SamsungAllShareAllShareAgent.exe

mRun: [ApnUpdater] "C:Program Files (x86)Ask.comUpdaterUpdater.exe"

mRun: [bigDog305] C:WindowsVM305_STI.EXE A4 TECH PC Camera V

mRun: [KeePass 2 PreLoad] "C:Program Files (x86)KeePass Password Safe 2KeePass.exe" --preload

mRun: [sunJavaUpdateSched] "C:Program Files (x86)Common FilesJavaJava Updatejusched.exe"

mRun: [searchSettings] "C:Program Files (x86)Common FilesSpigotSearch SettingsSearchSettings.exe"

StartupFolder: C:UsersnAppDataRoamingMicrosoftWindowsStart MenuProgramsStartupCurseClientStartup.ccip

StartupFolder: C:PROGRA~3MICROS~1WindowsSTARTM~1ProgramsStartupMCAFEE~1.LNK - C:Program Files (x86)McAfee Security Scan2.0.181SSScheduler.exe

mPolicies-Explorer: NoActiveDesktop = dword:1

mPolicies-Explorer: NoActiveDesktopChanges = dword:1

mPolicies-System: ConsentPromptBehaviorAdmin = dword:5

mPolicies-System: ConsentPromptBehaviorUser = dword:3

mPolicies-System: EnableUIADesktopToggle = dword:0

IE: E&xport to Microsoft Excel - C:PROGRA~2MICROS~1Office12EXCEL.EXE/3000

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:Program Files (x86)Microsoft OfficeOffice12ONBttnIE.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}

IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - C:Program Files (x86)Spybot - Search & DestroySDHelper.dll

.

INFO: HKCU has more than 50 listed domains.

If you wish to scan all of them, select the 'Force scan all domains' option.

.

INFO: HKLM has more than 50 listed domains.

If you wish to scan all of them, select the 'Force scan all domains' option.

.

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_32-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0032-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_32-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_32-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

TCP: NameServer = 217.18.242.74 217.18.242.146

TCP: Interfaces{EE92F72D-2D8C-4582-B835-DF3F99517AA9} : DHCPNameServer = 217.18.242.74 217.18.242.146

Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:Program Files (x86)Microsoft OfficeOffice12GrooveSystemServices.dll

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:Program Files (x86)Common FilesSkypeSkype4COM.dll

SSODL: WebCheck - <orphaned>

SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:Program Files (x86)Microsoft OfficeOffice12GrooveShellExtensions.dll

x64-BHO: avast! WebRep: {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:Program FilesAVAST SoftwareAvastaswWebRepIE64.dll

x64-BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:Program Files (x86)GoogleGoogle ToolbarGoogleToolbar_64.dll

x64-TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:Program Files (x86)GoogleGoogle ToolbarGoogleToolbar_64.dll

x64-TB: avast! WebRep: {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:Program FilesAVAST SoftwareAvastaswWebRepIE64.dll

x64-Run: [RtHDVCpl] C:Program FilesRealtekAudioHDARAVCpl64.exe -s

.

INFO: x64-HKLM has more than 50 listed domains.

If you wish to scan all of them, select the 'Force scan all domains' option.

.

x64-Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - <orphaned>

x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned>

x64-SSODL: WebCheck - <orphaned>

Hosts: 127.0.0.1 www.spywareinfo.com

.

================= FIREFOX ===================

.

FF - ProfilePath - C:UsersnAppDataRoamingMozillaFirefoxProfiles0k32gq6n.default

FF - prefs.js: browser.search.selectedEngine - Yahoo

FF - prefs.js: browser.startup.homepage - hxxps://www.google.bg/

FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=937811&p=

FF - prefs.js: keyword.url - hxxp://search.babylon.com/?AF=110393&babsrc=adbartrp&mntrId=c44c3080000000000000001fd0888db9&q=

FF - plugin: C:Program Files (x86)GoogleGoogle Earthpluginnpgeplugin.dll

FF - plugin: C:Program Files (x86)GoogleUpdate1.3.21.115npGoogleUpdate3.dll

FF - plugin: C:Program Files (x86)Javajre6binplugin2npjp2.dll

FF - plugin: C:Program Files (x86)Mozilla Firefoxpluginsnpwachk.dll

FF - plugin: C:WindowsSysWOW64MacromedFlashNPSWF32.dll

FF - plugin: C:WindowsSysWOW64npdeployJava1.dll

FF - plugin: C:WindowsSysWOW64npmproxy.dll

.

---- FIREFOX POLICIES ----

FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=110393

FF - user.js: extensions.BabylonToolbar_i.babExt -

FF - user.js: extensions.BabylonToolbar_i.srcExt - ss

FF - user.js: extensions.BabylonToolbar_i.id - c44c3080000000000000001fd0888db9

FF - user.js: extensions.BabylonToolbar_i.hardId - c44c3080000000000000001fd0888db9

FF - user.js: extensions.BabylonToolbar_i.instlDay - 15482

FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17

FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17

FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.1719:44:10

FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon

FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar

FF - user.js: extensions.BabylonToolbar_i.aflt - babsst

FF - user.js: extensions.BabylonToolbar_i.smplGrp - none

FF - user.js: extensions.BabylonToolbar_i.tlbrId - base

FF - user.js: extensions.BabylonToolbar_i.instlRef - sst

FF - user.js: extensions.incredibar_i.ms_url_id -

FF - user.js: extensions.incredibar_i.upn2 - 6R8uOvRBCT

FF - user.js: extensions.incredibar_i.upn2n - 92824468074982023

FF - user.js: extensions.incredibar_i.productid - 26

FF - user.js: extensions.incredibar_i.installerproductid - 26

FF - user.js: extensions.incredibar_i.did - 10650

FF - user.js: extensions.incredibar_i.ppd - 20%5F5

FF - user.js: extensions.incredibar_i.newTab - false

FF - user.js: extensions.incredibar_i.tlbrSrchUrl - hxxp://mystart.Incredibar.com/?a=6R8uOvRBCT&loc=IB_TB&i=26&search=

FF - user.js: extensions.incredibar_i.id - c44c3080000000000000001fd0888db9

FF - user.js: extensions.incredibar_i.instlDay - 15493

FF - user.js: extensions.incredibar_i.vrsn - 1.5.11.14

FF - user.js: extensions.incredibar_i.vrsni - 1.5.11.14

FF - user.js: extensions.incredibar_i.vrsnTs - 1.5.11.140:26:16

FF - user.js: extensions.incredibar_i.prtnrId - Incredibar

FF - user.js: extensions.incredibar_i.prdct - incredibar

FF - user.js: extensions.incredibar_i.aflt - orgnl

FF - user.js: extensions.incredibar_i.smplGrp - none

FF - user.js: extensions.incredibar_i.tlbrId - base

FF - user.js: extensions.incredibar_i.instlRef -

FF - user.js: extensions.incredibar_i.dfltLng -

FF - user.js: extensions.incredibar_i.excTlbr - false

FF - user.js: extensions.Softonic.rvrtMsg - Click Yes to keep current home page and default search settings, Click No to restore original settings

FF - user.js: extensions.Softonic.autoRvrt - false

FF - user.js: extensions.Softonic_i.hmpg - true

FF - user.js: extensions.Softonic.hmpgUrl - hxxp://search.softonic.com/MON00006/tb_v1?SearchSource=13&cc=

FF - user.js: extensions.Softonic.hpOld - hxxp://mystart.incredibar.com/mb139?a=6r8uovrbct&i=26

FF - user.js: extensions.Softonic.hpNew - hxxp://search.softonic.com/MON00006/tb_v1?SearchSource=13&cc=

FF - user.js: extensions.Softonic.dfltSrch - true

FF - user.js: extensions.Softonic.srchPrvdr - Search the web (Softonic)

FF - user.js: extensions.Softonic.keyWordUrl - hxxp://search.softonic.com/MON00006/tb_v1?SearchSource=2&cc=&q=

FF - user.js: extensions.Softonic.dspOld -

FF - user.js: extensions.Softonic.dspNew - Search the web (Softonic)

FF - user.js: extensions.Softonic_i.dnsErr - true

FF - user.js: extensions.Softonic_i.newTab - true

FF - user.js: extensions.Softonic.newTabUrl - hxxp://search.softonic.com/MON00006/tb_v1?SearchSource=15&cc=

FF - user.js: extensions.Softonic.tlbrSrchUrl - hxxp://search.softonic.com/MON00006/tb_v1?SearchSource=1&cc=&q=

FF - user.js: extensions.Softonic.id - c44c3080000000000000001fd0888db9

FF - user.js: extensions.Softonic.instlDay - 15567

FF - user.js: extensions.Softonic.vrsn - 1.6.7.4

FF - user.js: extensions.Softonic.vrsni - 1.6.7.4

FF - user.js: extensions.Softonic_i.vrsnTs - 1.6.7.413:25:47

FF - user.js: extensions.Softonic.prtnrId - softonic

FF - user.js: extensions.Softonic.prdct - Softonic

FF - user.js: extensions.Softonic.aflt - SD

FF - user.js: extensions.Softonic_i.smplGrp - none

FF - user.js: extensions.Softonic.tlbrId - base

FF - user.js: extensions.Softonic.instlRef - MON00006

FF - user.js: extensions.Softonic.dfltLng -

FF - user.js: extensions.Softonic.excTlbr - false

FF - user.js: extensions.Softonic.admin - false

.

============= SERVICES / DRIVERS ===============

.

R1 aswSnx;aswSnx;C:WindowsSystem32driversaswSnx.sys [2012-1-17 969200]

R1 aswSP;aswSP;C:WindowsSystem32driversaswSP.sys [2012-1-17 359464]

R2 AMD External Events Utility;AMD External Events Utility;C:WindowsSystem32atiesrxx.exe [2011-11-10 204288]

R2 aswFsBlk;aswFsBlk;C:WindowsSystem32driversaswFsBlk.sys [2012-1-17 25232]

R2 aswMonFlt;aswMonFlt;C:WindowsSystem32driversaswMonFlt.sys [2012-1-17 71600]

R2 avast! Antivirus;avast! Antivirus;C:Program FilesAVAST SoftwareAvastAvastSvc.exe [2012-8-25 44808]

R2 PanService;PandoraService;C:Program Files (x86)PANDORA.TVPanServicePandoraService.exe [2012-1-20 624856]

R2 SamsungAllShareV2.0;Samsung AllShare PC;C:Program Files (x86)SamsungAllShareAllShareDMSAllShareDMS.exe [2012-3-2 25504]

R2 SBSDWSCService;SBSD Security Center Service;C:Program Files (x86)Spybot - Search & DestroySDWinSec.exe [2012-3-16 1153368]

R2 Web Assistant Updater;Web Assistant Updater;C:Program FilesWeb AssistantExtensionUpdaterService.exe [2012-6-3 185856]

R3 amdkmdag;amdkmdag;C:WindowsSystem32driversatikmdag.sys [2011-11-10 10567680]

R3 amdkmdap;amdkmdap;C:WindowsSystem32driversatikmpag.sys [2011-11-10 325632]

R3 AtiHDAudioService;AMD Function Driver for HD Audio Service;C:WindowsSystem32driversAtihdW76.sys [2011-10-17 93712]

R3 RTL8167;Realtek 8167 NT Driver;C:WindowsSystem32driversRt64win7.sys [2009-3-2 187392]

R3 vvftav;vvftav;C:WindowsSystem32driversvvftav.sys [2012-2-3 300800]

R3 ZSMC0305;A4 TECH PC Camera V;C:WindowsSystem32driversusbVM305.sys [2012-2-3 1541120]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:WindowsMicrosoft.NETFrameworkv4.0.30319mscorsvw.exe [2010-3-18 130384]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:WindowsMicrosoft.NETFramework64v4.0.30319mscorsvw.exe [2010-3-18 138576]

S2 gupdate;Услуга на Google Актуализация (gupdate);C:Program Files (x86)GoogleUpdateGoogleUpdate.exe [2012-1-27 136176]

S2 SkypeUpdate;Skype Updater;C:Program Files (x86)SkypeUpdaterUpdater.exe [2012-7-13 160944]

S3 dmvsc;dmvsc;C:WindowsSystem32driversdmvsc.sys [2010-11-21 71168]

S3 gupdatem;Услуга на Google Актуализация (gupdatem);C:Program Files (x86)GoogleUpdateGoogleUpdate.exe [2012-1-27 136176]

S3 McComponentHostService;McAfee Security Scan Component Host Service;C:Program Files (x86)McAfee Security Scan2.0.181McCHSvc.exe [2010-1-15 227232]

S3 MozillaMaintenance;Mozilla Maintenance Service;C:Program Files (x86)Mozilla Maintenance Servicemaintenanceservice.exe [2012-8-25 113120]

S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:WindowsSystem32driversrdpvideominiport.sys [2010-11-21 20992]

S3 SimpleSlideShowServer;SimpleSlideShowServer;C:Program Files (x86)SamsungAllShareAllShareSlideShowService.exe [2012-3-2 27584]

S3 Synth3dVsc;Synth3dVsc;C:WindowsSystem32driversSynth3dVsc.sys [2010-11-21 88960]

S3 terminpt;Microsoft Remote Desktop Input Driver;C:WindowsSystem32driversterminpt.sys [2010-11-21 34816]

S3 TsUsbFlt;TsUsbFlt;C:WindowsSystem32driversTsUsbFlt.sys [2010-11-21 59392]

S3 TsUsbGD;Remote Desktop Generic USB Device;C:WindowsSystem32driversTsUsbGD.sys [2010-11-21 31232]

S3 WatAdminSvc;Windows Activation Technologies Service;C:WindowsSystem32WatWatAdminSvc.exe [2012-1-17 1255736]

SUnknown tsusbhub;tsusbhub; [x]

.

=============== Created Last 30 ================

.

2012-08-26 11:48:32 -------- d-s---w- C:WindowsSysWow64Microsoft

2012-08-25 16:09:46 -------- d-----w- C:Program Files (x86)Mozilla Maintenance Service

2012-08-25 16:09:45 136672 ----a-w- C:Program Files (x86)Mozilla Firefoxcomponentsbrowsercomps.dll

2012-08-25 16:09:44 770384 ----a-w- C:Program Files (x86)Mozilla Firefoxmsvcr100.dll

2012-08-25 16:09:44 68576 ----a-w- C:Program Files (x86)Mozilla Firefoxmozglue.dll

2012-08-25 16:09:44 573920 ----a-w- C:Program Files (x86)Mozilla Firefoxgkmedias.dll

2012-08-25 16:09:44 421200 ----a-w- C:Program Files (x86)Mozilla Firefoxmsvcp100.dll

2012-08-25 16:09:44 157608 ----a-w- C:Program Files (x86)Mozilla Firefoxmaintenanceservice_installer.exe

2012-08-25 16:09:44 113120 ----a-w- C:Program Files (x86)Mozilla Firefoxmaintenanceservice.exe

2012-08-25 10:21:40 69000 ----a-w- C:ProgramDataMicrosoftWindows DefenderDefinition Updates{8A89AE31-D8F4-4E3A-855E-63024E8192CD}offreg.dll

2012-08-24 07:12:18 9309624 ----a-w- C:ProgramDataMicrosoftWindows DefenderDefinition Updates{8A89AE31-D8F4-4E3A-855E-63024E8192CD}mpengine.dll

2012-08-23 14:25:10 -------- d-----w- C:Program Files (x86)NVIDIA Corporation

2012-08-23 14:24:35 -------- d-----w- C:Program Files (x86)Common FilesWise Installation Wizard

2012-08-23 14:21:42 -------- d-----w- C:UsersnAppDataLocal2K Games

2012-08-23 14:15:17 -------- d-----w- C:Program Files (x86)2K Games

2012-08-18 23:59:06 -------- d-sh--w- C:WindowsSystem32%APPDATA%

2012-08-15 18:52:07 -------- d-----w- C:Program Files (x86)YTD Toolbar

2012-08-15 18:51:50 -------- d-----w- C:ProgramDataYTD Video Downloader

2012-08-15 18:51:46 -------- d-----w- C:Program Files (x86)GreenTree Applications

2012-08-15 14:45:47 -------- d-----w- C:UsersnAppDataLocalSugarSync

2012-08-15 14:45:25 -------- d-----w- C:Program Files (x86)SugarSync

2012-08-15 14:24:05 -------- d-----w- C:UsersnAppDataLocalRockstar Games

2012-08-15 14:23:00 178800 ----a-w- C:WindowsSysWow64CmdLineExt_x64.dll

2012-08-15 14:21:12 -------- d-----w- C:WindowsSysWow64xlive

2012-08-15 14:21:11 -------- d-----w- C:Program Files (x86)Microsoft Games for Windows - LIVE

2012-08-15 13:56:44 -------- d-----w- C:UsersnAppDataRoaming.minecraft

2012-08-15 10:48:41 -------- d-----w- C:Program Files (x86)Amnesia - The Dark Descent

2012-08-15 10:25:45 -------- d-----w- C:Program Files (x86)Softonic

.

==================== Find3M ====================

.

2012-08-21 09:13:13 969200 ----a-w- C:WindowsSystem32driversaswSnx.sys

2012-08-21 09:13:12 71600 ----a-w- C:WindowsSystem32driversaswMonFlt.sys

2012-08-21 09:13:12 54072 ----a-w- C:WindowsSystem32driversaswRdr2.sys

2012-08-21 09:12:33 41224 ----a-w- C:WindowsavastSS.scr

2012-07-18 18:15:06 3148800 ----a-w- C:WindowsSystem32win32k.sys

2012-07-04 22:13:27 59392 ----a-w- C:WindowsSystem32browcli.dll

2012-07-04 22:13:27 136704 ----a-w- C:WindowsSystem32browser.dll

2012-07-04 21:14:34 41984 ----a-w- C:WindowsSysWow64browcli.dll

2012-07-03 10:46:44 24904 ----a-w- C:WindowsSystem32driversmbam.sys

2012-06-29 03:56:34 2312704 ----a-w- C:WindowsSystem32jscript9.dll

2012-06-29 03:49:11 1392128 ----a-w- C:WindowsSystem32wininet.dll

2012-06-29 03:48:07 1494528 ----a-w- C:WindowsSystem32inetcpl.cpl

2012-06-29 03:43:49 173056 ----a-w- C:WindowsSystem32ieUnatt.exe

2012-06-29 03:39:48 2382848 ----a-w- C:WindowsSystem32mshtml.tlb

2012-06-29 00:16:58 1800704 ----a-w- C:WindowsSysWow64jscript9.dll

2012-06-29 00:09:01 1129472 ----a-w- C:WindowsSysWow64wininet.dll

2012-06-29 00:08:59 1427968 ----a-w- C:WindowsSysWow64inetcpl.cpl

2012-06-29 00:04:43 142848 ----a-w- C:WindowsSysWow64ieUnatt.exe

2012-06-29 00:00:45 2382848 ----a-w- C:WindowsSysWow64mshtml.tlb

2012-06-06 06:06:16 2004480 ----a-w- C:WindowsSystem32msxml6.dll

2012-06-06 06:06:16 1881600 ----a-w- C:WindowsSystem32msxml3.dll

2012-06-06 06:02:54 1133568 ----a-w- C:WindowsSystem32cdosys.dll

2012-06-06 05:05:52 1390080 ----a-w- C:WindowsSysWow64msxml6.dll

2012-06-06 05:05:52 1236992 ----a-w- C:WindowsSysWow64msxml3.dll

2012-06-06 05:03:06 805376 ----a-w- C:WindowsSysWow64cdosys.dll

2012-06-02 22:15:31 2622464 ----a-w- C:WindowsSystem32wucltux.dll

2012-06-02 22:15:08 99840 ----a-w- C:WindowsSystem32wudriver.dll

2012-06-02 12:19:42 186752 ----a-w- C:WindowsSystem32wuwebv.dll

2012-06-02 12:15:12 36864 ----a-w- C:WindowsSystem32wuapp.exe

2012-06-02 05:50:10 458704 ----a-w- C:WindowsSystem32driverscng.sys

2012-06-02 05:48:16 95600 ----a-w- C:WindowsSystem32driversksecdd.sys

2012-06-02 05:48:16 151920 ----a-w- C:WindowsSystem32driversksecpkg.sys

2012-06-02 05:45:31 340992 ----a-w- C:WindowsSystem32schannel.dll

2012-06-02 05:44:21 307200 ----a-w- C:WindowsSystem32ncrypt.dll

2012-06-02 04:40:42 22016 ----a-w- C:WindowsSysWow64secur32.dll

2012-06-02 04:40:39 225280 ----a-w- C:WindowsSysWow64schannel.dll

2012-06-02 04:39:10 219136 ----a-w- C:WindowsSysWow64ncrypt.dll

2012-06-02 04:34:09 96768 ----a-w- C:WindowsSysWow64sspicli.dll

2012-05-31 10:55:07 476960 ----a-w- C:WindowsSysWow64npdeployJava1.dll

2012-05-31 10:55:07 472864 ----a-w- C:WindowsSysWow64deployJava1.dll

2012-05-31 09:25:12 279656 ------w- C:WindowsSystem32MpSigStub.exe

.

============= FINISH: 14:55:57,23 ===============

Attach

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2011-09-30.01)

.

Microsoft Windows 7 Ultimate

Boot Device: DeviceHarddiskVolume1

Install Date: 16.1.2012 г. 14:42:59

System Uptime: 26.8.2012 г. 14:50:40 (0 hours ago)

.

Motherboard: Gigabyte Technology Co., Ltd. | | EP43-DS3L

Processor: Intel® Core2 Duo CPU E7300 @ 2.66GHz | Socket 775 | 2667/266mhz

.

==== Disk Partitions =========================

.

A: is Removable

C: is FIXED (NTFS) - 488 GiB total, 428,209 GiB free.

D: is FIXED (NTFS) - 443 GiB total, 119,73 GiB free.

E: is CDROM ()

G: is CDROM ()

.

==== Disabled Device Manager Items =============

.

Class GUID:

Description: Internet Access Server

Device ID: UUID:9ABE16FB-19F7-056B-750B-705758106E30UMB3&F2283&0&UUID:9ABE16FB-19F7-056B-750B-705758106E30

Manufacturer:

Name: Internet Access Server

PNP Device ID: UUID:9ABE16FB-19F7-056B-750B-705758106E30UMB3&F2283&0&UUID:9ABE16FB-19F7-056B-750B-705758106E30

Service:

.

==== System Restore Points ===================

.

RP87: 23.8.2012 г. 03:00:11 - Windows Update

RP88: 23.8.2012 г. 17:24:40 - Installed NVIDIA PhysX

RP89: 24.8.2012 г. 02:05:39 - Windows Update

RP90: 24.8.2012 г. 09:56:28 - Windows Update

RP91: 25.8.2012 г. 02:06:32 - Windows Update

RP92: 25.8.2012 г. 10:12:41 - Windows Update

RP93: 25.8.2012 г. 18:43:05 - Removed LogMeIn Hamachi

RP94: 25.8.2012 г. 23:33:54 - Windows Update

RP95: 26.8.2012 г. 10:14:18 - Windows Update

.

==== Installed Programs ======================

.

µTorrent

2007 Microsoft Office Suite Service Pack 2 (SP2)

A4 TECH PC Camera V

Adobe Flash Player 11 ActiveX 64-bit

Adobe Flash Player 11 Plugin 64-bit

Adobe Reader X (10.0.1)

AMD Catalyst Install Manager

AMD Drag and Drop Transcoding

Amnesia - The Dark Descent

Ashampoo Burning Studio 9.21

Ask Toolbar

avast! Free Antivirus

Catalyst Control Center InstallProxy

Garena 2010

Garena Plus

Google Земя

Google Chrome

Google Toolbar for Internet Explorer

Google Update Helper

Hotfix for Microsoft .NET Framework 4 Client Profile (KB2461678)

Incredibar Toolbar on IE

Java Auto Updater

Java 6 Update 32

K-Lite Codec Pack 6.5.0 (Standard)

KeePass Password Safe 2.18

KMPlayer Toolbar Updater

Mafia II

Malwarebytes Anti-Malware, версия 1.62.0.1300

McAfee Security Scan Plus

Microsoft .NET Framework 4 Client Profile

Microsoft .NET Framework 4 Extended

Microsoft Games for Windows - LIVE Redistributable

Microsoft Office Access MUI (English) 2007

Microsoft Office Access Setup Metadata MUI (English) 2007

Microsoft Office Enterprise 2007

Microsoft Office Excel MUI (English) 2007

Microsoft Office Groove MUI (English) 2007

Microsoft Office Groove Setup Metadata MUI (English) 2007

Microsoft Office InfoPath MUI (English) 2007

Microsoft Office Office 64-bit Components 2007

Microsoft Office OneNote MUI (English) 2007

Microsoft Office Outlook MUI (English) 2007

Microsoft Office PowerPoint MUI (English) 2007

Microsoft Office Proof (English) 2007

Microsoft Office Proof (French) 2007

Microsoft Office Proof (Spanish) 2007

Microsoft Office Proofing (English) 2007

Microsoft Office Publisher MUI (English) 2007

Microsoft Office Shared 64-bit MUI (English) 2007

Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007

Microsoft Office Shared MUI (English) 2007

Microsoft Office Shared Setup Metadata MUI (English) 2007

Microsoft Office Word MUI (English) 2007

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319

Mozilla Firefox 14.0.1 (x86 bg)

Mozilla Maintenance Service

NVIDIA PhysX

Pandora Service

PicPick

Realtek High Definition Audio Driver

Samsung AllShare

Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)

Security Update for Microsoft .NET Framework 4 Extended (KB2487367)

Security Update for Microsoft .NET Framework 4 Extended (KB2656351)

Skype™ 5.10

Softonic toolbar on IE

Spybot - Search & Destroy

SugarSync Manager

TeamSpeak 3 Client

The KMPlayer (remove only)

Update for Microsoft .NET Framework 4 Client Profile (KB2468871)

Update for Microsoft .NET Framework 4 Client Profile (KB2533523)

Update for Microsoft .NET Framework 4 Client Profile (KB2600217)

Update for Microsoft .NET Framework 4 Extended (KB2468871)

Update for Microsoft .NET Framework 4 Extended (KB2533523)

Update for Microsoft .NET Framework 4 Extended (KB2600217)

Updater Service

USB PC Camera VC305

Web Assistant 2.0.0.439

Winamp

Winamp Detector Plug-in

WinRAR archiver

World of Warcraft

YTD Toolbar v6.2

YTD Video Downloader 3.9

.

==== Event Viewer Messages From Past Week ========

.

26.8.2012 г. 10:05:31, Error: Service Control Manager [7043] - The Windows Update service did not shut down properly after receiving a preshutdown control.

25.8.2012 г. 23:20:22, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the SBSD Security Center Service service to connect.

25.8.2012 г. 23:20:22, Error: Service Control Manager [7000] - The SBSD Security Center Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.

25.8.2012 г. 23:14:25, Error: Service Control Manager [7022] - The PandoraService service hung on starting.

23.8.2012 г. 01:12:00, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the LogMeIn Hamachi Tunneling Engine service to connect.

23.8.2012 г. 01:12:00, Error: Service Control Manager [7000] - The LogMeIn Hamachi Tunneling Engine service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.

23.8.2012 г. 01:11:59, Error: Service Control Manager [7030] - The LogMeIn Hamachi Tunneling Engine service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.

.

==== End Of File ===========================

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

26 август 201214 г.

Здравейте...!Преди да продължим изтеглете този архив MCPR.zip разархивирайте и стартирайте инструмента MCPR.exe - целта е да премахнем McAfee Security Scan (възможен е конфликт с вашата антивирусна програма).

McAfee Security Scan отново се вижда в системата ви...? Използвахте ли препоръчания от мен инструмент ..?

26 август 201214 г.

Автор

McAfee Security Scan отново се вижда в системата ви...? Използвахте ли препоръчания от мен инструмент ..?

Няколко пъти пробвах, но McAfee още си стои...

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

26 август 201214 г.

А с нормална деинсталация Start => Control Panel => Add or Remove Programs....?

26 август 201214 г.

Автор

А с нормална деинсталация Start => Control Panel => Add or Remove Programs....?

Готово !

DDS (Ver_2011-09-30.01) - NTFS_AMD64

Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_32

Run by n at 16:18:52 on 2012-08-26

Microsoft Windows 7 Ultimate 6.1.7601.1.1251.359.1026.18.4094.2042 [GMT 3:00]

.

AV: avast! Antivirus *Enabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}

SP: avast! Antivirus *Enabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

============== Running Processes ===============

.

C:Windowssystem32wininit.exe

C:Windowssystem32lsm.exe

C:Windowssystem32svchost.exe -k DcomLaunch

C:Windowssystem32svchost.exe -k RPCSS

C:Windowssystem32atiesrxx.exe

C:WindowsSystem32svchost.exe -k LocalServiceNetworkRestricted

C:WindowsSystem32svchost.exe -k LocalSystemNetworkRestricted

C:Windowssystem32svchost.exe -k netsvcs

C:Windowssystem32svchost.exe -k LocalService

C:Windowssystem32svchost.exe -k NetworkService

C:Program FilesAVAST SoftwareAvastAvastSvc.exe

C:Windowssystem32atieclxx.exe

C:WindowsSystem32spoolsv.exe

C:Windowssystem32svchost.exe -k LocalServiceNoNetwork

C:Windowssystem32taskhost.exe

C:Program Files (x86)PANDORA.TVPanServicePandoraService.exe

C:Windowssystem32Dwm.exe

C:WindowsExplorer.EXE

C:Windowssystem32taskeng.exe

C:Windowssystem32svchost.exe -k imgsvc

C:Program FilesWeb AssistantExtensionUpdaterService.exe

C:Program Files (x86)Spybot - Search & DestroySDWinSec.exe

C:Program FilesRealtekAudioHDARAVCpl64.exe

C:Program Files (x86)DAEMON Tools LiteDTLite.exe

C:Program Files (x86)uTorrentuTorrent.exe

C:Program FilesWindows Sidebarsidebar.exe

C:Program Files (x86)PicPickpicpick.exe

C:Program Files (x86)Spybot - Search & DestroyTeaTimer.exe

C:WindowsMicrosoft.NETFramework64v4.0.30319dfsvc.exe

C:Program FilesAVAST SoftwareAvastAvastUI.exe

C:Program Files (x86)Common FilesAdobeARM1.0AdobeARM.exe

C:Program Files (x86)SamsungAllShareAllShareAgent.exe

C:Program Files (x86)Ask.comUpdaterUpdater.exe

C:Windowsvm305_sti.exe

C:Program Files (x86)Common FilesJavaJava Updatejusched.exe

C:Windowssystem32svchost.exe -k LocalServiceAndNoImpersonation

C:Windowssystem32SearchIndexer.exe

C:Program FilesWindows Media Playerwmpnetwk.exe

C:WindowsSystem32svchost.exe -k LocalServicePeerNet

C:Windowssystem32wbemwmiprvse.exe

C:Program Files (x86)SamsungAllShareAllShareDMSAllShareDMS.exe

C:WindowsSystem32svchost.exe -k secsvcs

C:Program Files (x86)SkypePhoneSkype.exe

C:Program Files (x86)GoogleChromeApplicationchrome.exe

C:Windowssystem32wuauclt.exe

C:Program Files (x86)GoogleChromeApplicationchrome.exe

C:Program Files (x86)KeePass Password Safe 2KeePass.exe

C:Program Files (x86)GoogleChromeApplicationchrome.exe

C:Windowssystem32taskeng.exe

c:program fileswindows defenderMpCmdRun.exe

C:ProgramDataBattle.netAgentAgent.1225Agent.exe

C:Windowssystem32conhost.exe

C:ProgramDataBattle.netClientBlizzard Launcher.1815Blizzard Launcher.exe

C:Windowssystem32DllHost.exe