Оставих си компютъра докато правих windows uptade и ми пишеше да не го изкл - той сам се изкл...и отидох на гости, но като се пребрах и го вкл. зарежда ми биос и всичко, но като стигне до Welcome със синия фон и се бави там после излиза default wallpapera на windows*кат картинка без нищо*, но ми ги няма програмките на декстопа и синята линя *start menu* - чакам 2-3 мин и се оправя, но не мога да го търпя преди ставаше за 1 мин макс цялото стартиране...И днеска си вкл игра която ми отнемаше преди 1мин да се стартира, а сега 3-5 мин ..... 1.81 AMD 3400+ 2,5GB RAM NVidia GT 520 Даже и ми забива на 3D игри като cs, което е гадно и никога не ми го е правило досега... . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2011-09-30.01) . Microsoft Windows XP Professional Boot Device: \Device\HarddiskVolume1 Install Date: 28.12.2011 г. 14:28:34 System Uptime: 30.8.2012 г. 13:42:26 (1 hours ago) . Motherboard: MSI | | MS-7270 Processor: AMD Sempron™ Processor 3400+ | CPU 1 | 1809/200mhz . ==== Disk Partitions ========================= . A: is Removable C: is FIXED (NTFS) - 14 GiB total, 1,718 GiB free. D: is FIXED (NTFS) - 135 GiB total, 86,846 GiB free. E: is CDROM () F: is CDROM (UDF) . ==== Disabled Device Manager Items ============= . ==== System Restore Points =================== . RP7: 29.8.2012 г. 18:08:44 - Software Distribution Service 3.0 RP8: 30.8.2012 г. 07:54:55 - Removed Microsoft Games for Windows Marketplace RP9: 30.8.2012 г. 07:55:28 - Removed Microsoft Games for Windows - LIVE Redistributable RP10: 30.8.2012 г. 13:00:02 - Software Distribution Service 3.0 . ==== Installed Programs ====================== . 4Story UK 3.6.59 Acrobat.com Adobe AIR Adobe Flash Player 11 ActiveX Adobe Flash Player 11 Plugin Advanced SystemCare 5 avast! Free Antivirus BitLord 1.1 Call of Duty® 4 - Modern Warfare™ Call of Duty® 4 - Modern Warfare™ 1.6 Patch Call of Duty® 4 - Modern Warfare™ 1.7 Patch CCleaner Compatibility Pack for the 2007 Office system Counter-Strike CPUID HWMonitor 1.19 DAEMON Tools Pro Facebook Video Calling 1.2.0.159 FlashGet 1.9.6.1073 FlexType 2K Fraps (remove only) Game Booster 3 Garena Plus Google Chrome Google Update Helper HD Tune 2.55 Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595) Hotfix for Windows XP (KB954550-v5) Hotfix for Windows XP (KB976002-v5) International Volleyball 2010 ItaEst - Taka e! Java Auto Updater Java™ 6 Update 30 Java™ 7 Update 5 JavaFX 2.1.1 K-Lite Codec Pack 4.1.7 (Full) Kalydo Player 4.07.02 League of Legends LG Internet Kit LG PC Suite II LG USB Modem driver Microsoft .NET Framework 2.0 Service Pack 2 Microsoft .NET Framework 3.0 Service Pack 2 Microsoft .NET Framework 3.5 SP1 Microsoft .NET Framework 4 Client Profile Microsoft Kernel-Mode Driver Framework Feature Pack 1.9 Microsoft Office Professional Edition 2003 Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 mIRC Mozilla Firefox 15.0 (x86 bg) Mozilla Maintenance Service MSXML 4.0 SP3 Parser MSXML 4.0 SP3 Parser (KB2721691) MSXML 4.0 SP3 Parser (KB973685) MSXML 6.0 Parser MV2Player (remove only) Nero 8 Micro v8.3.2.1 Nokia Connectivity Cable Driver Nokia Software Updater NVIDIA Control Panel 285.58 NVIDIA Graphics Driver 285.58 NVIDIA HD Audio Driver 1.2.24.0 NVIDIA Install Application NVIDIA nView 135.95 NVIDIA PhysX NVIDIA PhysX System Software 9.11.0621 Opera 12.01 PC Connectivity Solution Play4S version 8654 RealNetworks - Microsoft Visual C++ 2008 Runtime RealPlayer Realtek High Definition Audio Driver RealUpgrade 1.1 SA Dictionary T4 ScanSoft PaperPort 10 Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111) Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424) Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405) Security Update for Windows Internet Explorer 8 (KB2510531) Security Update for Windows Internet Explorer 8 (KB2544521) Security Update for Windows Internet Explorer 8 (KB2699988) Security Update for Windows Internet Explorer 8 (KB2722913) Security Update for Windows XP (KB2698365) Security Update for Windows XP (KB2709162) Skype Click to Call Skype™ 5.10 Speed-Link SL-6535 USB Pad Steam System Requirements Lab CYRI TeamSpeak 3 Client TeamViewer 6 TeamViewer 7 The KMPlayer TuneXP 1.5 Update for Microsoft .NET Framework 3.5 SP1 (KB963707) Update for Windows Internet Explorer 8 (KB2598845) Update for Windows XP (KB2718704) V-Gear BEE V-Gear TalkCam Messenger Pro Ventrilo Client WebFldrs XP Winamp Windows Bulgarian Interface Pack Windows Driver Package - Nokia pccsmcfd (08/22/2008 7.0.0.0) Windows Genuine Advantage Notifications (KB905474) Windows Imaging Component Windows Internet Explorer 8 Windows Live ID Sign-in Assistant Windows Media Format Runtime Windows Presentation Foundation Windows XP Service Pack 3 WinRAR archiver Xerox WorkCentre 3119 Series Driver Uninstall XML Paper Specification Shared Components Pack 1.0 . ==== Event Viewer Messages From Past Week ======== . 30.8.2012 і. 07:41:57, error: Dhcp [1002] - The IP address lease 192.168.1.2 for the Network Card with network address 00161790D432 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message). 29.8.2012 і. 22:35:21, error: Dhcp [1002] - The IP address lease 192.168.1.2 for the Network Card with network address 00161790D432 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message). 29.8.2012 і. 17:48:59, error: Windows Update Agent [20] - Installation Failure: Windows failed to install the following update with error 0x800706be: Microsoft .NET Framework 3.5 SP1 Update for Windows Server 2003 and Windows XP x86 (KB982168). 29.8.2012 і. 17:48:59, error: Windows Update Agent [20] - Installation Failure: Windows failed to install the following update with error 0x800706ba: Security Update for Windows XP (KB2698365). 29.8.2012 і. 17:48:59, error: Windows Update Agent [20] - Installation Failure: Windows failed to install the following update with error 0x800706ba: Security Update for Microsoft XML Core Services 4.0 Service Pack 3 (KB2721691). 29.8.2012 і. 17:48:59, error: Windows Update Agent [20] - Installation Failure: Windows failed to install the following update with error 0x800706ba: Security Update for Microsoft Office 2007 suites (KB2597162). 29.8.2012 і. 17:48:59, error: Windows Update Agent [20] - Installation Failure: Windows failed to install the following update with error 0x800706ba: Security Update for Microsoft Office 2007 suites (KB2596785). 29.8.2012 і. 13:12:44, error: Dhcp [1002] - The IP address lease 192.168.1.2 for the Network Card with network address 00161790D432 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message). 29.8.2012 і. 11:02:32, error: Dhcp [1002] - The IP address lease 192.168.1.2 for the Network Card with network address 00161790D432 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message). 29.8.2012 і. 08:45:35, error: Service Control Manager [7034] - The Advanced SystemCare Service 5 service terminated unexpectedly. It has done this 1 time(s). 29.8.2012 і. 06:55:57, error: Dhcp [1002] - The IP address lease 192.168.1.2 for the Network Card with network address 00161790D432 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message). 28.8.2012 і. 09:59:44, error: Service Control Manager [7034] - The PnkBstrA service terminated unexpectedly. It has done this 1 time(s). 28.8.2012 і. 09:54:54, error: Dhcp [1002] - The IP address lease 192.168.1.2 for the Network Card with network address 00161790D432 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message). 28.8.2012 і. 08:41:14, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Windows Live ID Sign-in Assistant service to connect. 28.8.2012 і. 08:41:14, error: Service Control Manager [7000] - The Windows Live ID Sign-in Assistant service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion. 28.8.2012 і. 08:39:51, error: Dhcp [1002] - The IP address lease 192.168.1.2 for the Network Card with network address 00161790D432 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message). 27.8.2012 і. 14:01:16, error: Service Control Manager [7034] - The PnkBstrA service terminated unexpectedly. It has done this 1 time(s). 27.8.2012 і. 11:30:29, error: Dhcp [1002] - The IP address lease 192.168.1.2 for the Network Card with network address 00161790D432 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message). 27.8.2012 і. 09:03:44, error: Dhcp [1002] - The IP address lease 192.168.1.2 for the Network Card with network address 00161790D432 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message). 26.8.2012 і. 09:59:48, error: Dhcp [1002] - The IP address lease 192.168.1.2 for the Network Card with network address 00161790D432 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message). 26.8.2012 і. 07:28:18, error: Dhcp [1002] - The IP address lease 192.168.1.2 for the Network Card with network address 00161790D432 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message). 25.8.2012 і. 10:12:22, error: Dhcp [1002] - The IP address lease 192.168.1.2 for the Network Card with network address 00161790D432 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message). 24.8.2012 і. 20:59:50, error: Service Control Manager [7034] - The PnkBstrA service terminated unexpectedly. It has done this 1 time(s). 24.8.2012 і. 19:03:12, error: Dhcp [1002] - The IP address lease 192.168.1.2 for the Network Card with network address 00161790D432 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message). 24.8.2012 і. 07:54:26, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the NVSvc service. 24.8.2012 і. 07:53:16, error: Dhcp [1002] - The IP address lease 192.168.1.2 for the Network Card with network address 00161790D432 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message). . ==== End Of File =========================== DDS (Ver_2011-09-30.01) - NTFS_x86 Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 10.5.1 Run by Name at 14:05:36 on 2012-08-30 Microsoft Windows XP Professional 5.1.2600.3.1251.359.1033.18.2559.1814 [GMT 3:00] . AV: avast! Antivirus *Enabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D} . ============== Running Processes ================ . C:\Program Files\IObit\Advanced SystemCare 5\ASCService.exe C:\Program Files\Alwil Software\Avast5\AvastSvc.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\Documents and Settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe C:\WINDOWS\system32\wdfmgr.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Alwil Software\Avast5\avastUI.exe D:\Gameforge4D\4Story_UK\PrePatch.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\Program Files\Real\RealPlayer\update\realsched.exe C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\vsnpstd3.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\IObit\Advanced SystemCare 5\ASCTray.exe C:\Program Files\Datecs\FlexType 2K\FType2K.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\plugin-container.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\WINDOWS\System32\svchost.exe -k netsvcs C:\WINDOWS\System32\svchost.exe -k netsvcs C:\WINDOWS\system32\svchost.exe -k LocalService C:\WINDOWS\system32\svchost.exe -k imgsvc . ============== Pseudo HJT Report =============== . uStart Page = hxxp://www.google.bg/ uSearch Bar = hxxp://www.google.com/ie uSearch Page = hxxp://www.google.com uSearchAssistant = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s uURLSearchHooks: {00000000-6E41-4FD3-8538-502F5495E5FC} - <orphaned> BHO: FGCatchUrl: {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - c:\program files\flashget\jccatch.dll BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049C3E9-B461-4BC5-8870-4C09146192CA} - c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll BHO: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\oracle\javafx 2.1 runtime\bin\ssv.dll BHO: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - c:\program files\alwil software\avast5\aswWebRepIE.dll BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: Skype Browser Helper: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\oracle\javafx 2.1 runtime\bin\jp2ssv.dll BHO: FlashGet GetFlash Class: {F156768E-81EF-470C-9057-481BA8380DBA} - c:\program files\flashget\getflash.dll TB: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - c:\program files\alwil software\avast5\aswWebRepIE.dll uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uRun: [skype] "c:\program files\skype\phone\Skype.exe" /minimized /regrun uRun: [DAEMON Tools Pro Agent] "c:\program files\daemon tools pro\DTAgent.exe" -autorun uRun: [Facebook Update] "c:\documents and settings\name\local settings\application data\facebook\update\FacebookUpdate.exe" /c /nocrashserver uRun: [Advanced SystemCare 5] "c:\program files\iobit\advanced systemcare 5\ASCTray.exe" /AutoStart mRun: [sSBkgdUpdate] "c:\program files\common files\scansoft shared\ssbkgdupdate\SSBkgdupdate.exe" -Embedding -boot mRun: [nwiz] c:\program files\nvidia corporation\nview\nwiz.exe /installquiet mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup mRun: [avast5] "c:\program files\alwil software\avast5\avastUI.exe" /nogui mRun: [4StoryPrePatch] d:\gameforge4d\4story_uk\PrePatch.exe mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe" mRun: [TkBellExe] "c:\program files\real\realplayer\update\realsched.exe" -osboot mRun: [RTHDCPL] RTHDCPL.EXE mRun: [skyTel] SkyTel.EXE mRun: [Alcmtr] ALCMTR.EXE mRun: [snpstd3] c:\windows\vsnpstd3.exe mRun: [Flashget] c:\program files\flashget\flashget.exe /min dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\flexty~1.lnk - c:\program files\datecs\flextype 2k\FType2K.exe uPolicies-Explorer: NoDriveTypeAutoRun = dword:145 mPolicies-Windows\System: Allow-LogonScript-NetbiosDisabled = dword:1 mPolicies-Explorer: NoDriveTypeAutoRun = dword:145 IE: &Download All with FlashGet - c:\program files\flashget\jc_all.htm IE: &Download with FlashGet - c:\program files\flashget\jc_link.htm IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000 IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} IE: {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - c:\program files\flashget\FlashGet.exe IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe . INFO: HKCU has more than 50 listed domains. If you wish to scan all of them, select the 'Force scan all domains' option. . DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1346303584609 DPF: {A996E48C-D3DC-4244-89F7-AFA33EC60679} - hxxps://ebb.ubb.bg/CAPICOM/capicom.cab TCP: NameServer = 192.168.1.1 TCP: Interfaces\{7ABC7A0A-F857-462C-B7F4-4C2696B41BE4} : DHCPNameServer = 192.168.1.1 Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned> STS: IE Browseui preloader - {240E2B94-741E-4513-B66A-60EC26A9EF26} - c:\windows\system32\ieframe.dll STS: IE Component Categories cache daemon - {553858A7-4922-4e7e-B1C1-97140C1C16EF} - c:\windows\system32\ieframe.dll SecurityProviders: SecurityProviders = digest.dll . ================= FIREFOX =================== . FF - ProfilePath - c:\documents and settings\name\application data\mozilla\firefox\profiles\dmng5toc.default\ FF - prefs.js: keyword.URL - hxxp://search.babylon.com/?affID=111366&babsrc=KW_ss&mntrId=7c28911b00000000000000ff01000001&q= FF - plugin: c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\mozillaplugins\nprpchromebrowserrecordext.dll FF - plugin: c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\mozillaplugins\nprphtml5videoshim.dll FF - plugin: c:\documents and settings\name\application data\kalydo\kalydoplayer\bin1\npkalydo.dll FF - plugin: c:\documents and settings\name\local settings\application data\facebook\video\skype\npFacebookVideoCalling.dll FF - plugin: c:\program files\adobe\reader 9.0\reader\air\nppdf32.dll FF - plugin: c:\program files\google\update\1.3.21.115\npGoogleUpdate3.dll FF - plugin: c:\program files\mozilla firefox\plugins\nprpplugin.dll FF - plugin: c:\program files\oracle\javafx 2.1 runtime\bin\plugin2\npjp2.dll FF - plugin: c:\program files\real\realplayer\netscape6\nprpplugin.dll FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_4_402_265.dll FF - plugin: c:\windows\system32\npDeployJava1.dll FF - plugin: c:\windows\system32\npptools.dll . ---- FIREFOX POLICIES ---- FF - user.js: browser.cache.memory.capacity - 65536 FF - user.js: browser.chrome.favicons - false FF - user.js: browser.display.show_image_placeholders - true FF - user.js: browser.turbo.enabled - true FF - user.js: browser.urlbar.autocomplete.enabled - true FF - user.js: browser.urlbar.autofill - true FF - user.js: browser.xul.error_pages.enabled - true FF - user.js: content.interrupt.parsing - true FF - user.js: content.max.tokenizing.time - 3000000 FF - user.js: content.maxtextrun - 8191 FF - user.js: content.notify.backoffcount - 5 FF - user.js: content.notify.interval - 750000 FF - user.js: content.notify.ontimer - true FF - user.js: content.switch.threshold - 750000 FF - user.js: extensions.BabylonToolbar_i.aflt - babsst FF - user.js: extensions.BabylonToolbar_i.babExt - FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=111366 FF - user.js: extensions.BabylonToolbar_i.hardId - 7c28911b00000000000000ff01000001 FF - user.js: extensions.BabylonToolbar_i.id - 7c28911b00000000000000ff01000001 FF - user.js: extensions.BabylonToolbar_i.instlDay - 15457 FF - user.js: extensions.BabylonToolbar_i.instlRef - sst FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon FF - user.js: extensions.BabylonToolbar_i.smplGrp - none FF - user.js: extensions.BabylonToolbar_i.srcExt - ss FF - user.js: extensions.BabylonToolbar_i.tlbrId - base FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17 FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17 FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.179:53:12 FF - user.js: network.http.max-connections - 32 FF - user.js: network.http.max-connections-per-server - 8 FF - user.js: network.http.max-persistent-connections-per-proxy - 8 FF - user.js: network.http.max-persistent-connections-per-server - 4 FF - user.js: network.http.pipelining - true FF - user.js: network.http.pipelining.maxrequests - 8 FF - user.js: network.http.proxy.pipelining - true FF - user.js: network.http.request.max-start-delay - 0 FF - user.js: nglayout.initialpaint.delay - 0 FF - user.js: plugin.expose_full_path - true FF - user.js: ui.submenuDelay - 0 . ============= SERVICES / DRIVERS =============== . R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2012-4-23 729752] R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2011-12-28 355632] R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\drivers\dtsoftbus01.sys [2012-7-2 242240] R2 AdvancedSystemCareService5;Advanced SystemCare Service 5;c:\program files\iobit\advanced systemcare 5\ASCService.exe [2012-8-29 913792] R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2011-12-28 21256] R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast5\AvastSvc.exe [2011-12-28 44808] R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] R2 cpuz135;cpuz135;c:\windows\system32\drivers\cpuz135_x32.sys [2012-8-29 21992] R2 Skype C2C Service;Skype C2C Service;c:\documents and settings\all users\application data\skype\toolbars\skype c2c service\c2c_service.exe [2012-8-13 3064000] R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32.sys [2011-12-28 119656] R3 ULI5261XP;ULi M526X Ethernet NT Driver;c:\windows\system32\drivers\ULILAN51.SYS [2011-12-28 28672] S2 gupdate;Ус»уі° Google Update (gupdate);c:\program files\google\update\GoogleUpdate.exe [2011-12-28 136176] S2 SkypeUpdate;Skype Updater;c:\program files\skype\updater\Updater.exe [2012-7-13 160944] S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\ambfilt.sys --> c:\windows\system32\drivers\Ambfilt.sys [?] S3 EagleXNt;EagleXNt;\??\c:\windows\system32\drivers\eaglexnt.sys --> c:\windows\system32\drivers\EagleXNt.sys [?] S3 ESLvnic1;ESLvnic Virtual Network 32 Bit;c:\windows\system32\drivers\ESLvnic.sys [2012-2-11 24504] S3 GGSAFERDriver;GGSAFER Driver; [x] S3 gupdatem;Ус»уі° Ѕ° Google рєту°»ё·°цёя (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2011-12-28 136176] S3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\mozilla maintenance service\maintenanceservice.exe [2012-8-29 114144] S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [2012-2-19 137600] S3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [2012-2-19 8576] S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\gamemon.des -service --> c:\windows\system32\GameMon.des -service [?] S3 pwdrvio;pwdrvio;c:\windows\system32\pwdrvio.sys [2012-7-13 15576] S3 pwdspio;pwdspio;c:\windows\system32\pwdspio.sys [2012-7-13 10200] S3 ULI526X;ULi M526X 10/100 Ethernet Controller Driver;c:\windows\system32\drivers\ULIM526X.SYS [2011-12-28 30208] S3 vtany;vtany; [x] S3 WinRing0_1_2_0;WinRing0_1_2_0;c:\program files\iobit\game booster 3\driver\WinRing0.sys [2012-8-14 14416] S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504] S3 xhunter1;xhunter1; [x] S3 xsherlock;xsherlock;c:\windows\system32\xsherlock.xem [2012-7-3 670816] . =============== Created Last 30 ================ . 2012-08-30 06:26:23 -------- d-----w- c:\program files\HD Tune 2012-08-30 06:01:33 -------- d-----w- c:\documents and settings\name\application data\Kalydo 2012-08-29 08:49:52 -------- d--h--w- c:\windows\$hf_mig$ 2012-08-29 07:10:08 275696 ----a-w- c:\windows\system32\mucltui.dll 2012-08-29 07:10:08 222448 ----a-w- c:\windows\system32\muweb.dll 2012-08-29 07:10:08 17136 ----a-w- c:\windows\system32\mucltui.dll.mui 2012-08-29 06:10:25 22400 ----a-w- c:\windows\system32\RegistryDefragBootTime.exe 2012-08-29 05:37:14 21992 ----a-w- c:\windows\system32\drivers\cpuz135_x32.sys 2012-08-29 05:37:14 -------- d-----w- c:\program files\CPUID 2012-08-29 04:33:00 73696 ----a-w- c:\program files\mozilla firefox\breakpadinjector.dll 2012-08-28 14:42:08 -------- d-----w- c:\documents and settings\name\application data\Solveig Multimedia 2012-08-26 13:29:53 -------- d-----w- c:\documents and settings\name\application data\Realore_Whiterra Roads Of Rome 3 2012-08-26 13:15:42 -------- d-----w- c:\documents and settings\all users\application data\FarmFrenzy3 2012-08-26 09:44:10 -------- d-----w- c:\documents and settings\name\local settings\application data\Opera 2012-08-22 12:55:56 65536 ----a-w- c:\windows\system32\frapsvid.dll 2012-08-22 12:18:47 -------- d-----w- c:\documents and settings\name\local settings\application data\Facebook 2012-08-21 17:14:34 22328 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys 2012-08-21 17:14:34 22328 ----a-w- c:\documents and settings\name\application data\PnkBstrK.sys 2012-08-21 17:14:18 103736 ----a-w- c:\windows\system32\PnkBstrB.exe 2012-08-21 17:14:09 66872 ----a-w- c:\windows\system32\PnkBstrA.exe 2012-08-21 17:13:04 -------- d-----w- c:\documents and settings\name\application data\Tunngle 2012-08-21 17:12:49 27136 ----a-w- c:\windows\system32\drivers\tap0901t.sys 2012-08-21 16:53:38 -------- d-sh--w- c:\windows\ftpcache 2012-08-21 13:13:50 -------- d-----w- c:\documents and settings\name\local settings\application data\Overwolf 2012-08-20 18:36:40 -------- d-----w- c:\program files\Microsoft Games 2012-08-17 07:49:45 91136 ----a-w- c:\windows\system32\kswdmcap.ax 2012-08-17 07:49:44 61952 ----a-w- c:\windows\system32\kstvtune.ax 2012-08-17 07:49:44 53760 -c--a-w- c:\windows\system32\dllcache\vfwwdm32.dll 2012-08-17 07:49:44 53760 ----a-w- c:\windows\system32\vfwwdm32.dll 2012-08-17 07:49:37 43008 ----a-w- c:\windows\system32\ksxbar.ax 2012-08-17 07:44:42 -------- d-----w- c:\program files\V-Gear BEE 2012-08-17 07:44:34 796672 ----a-w- c:\windows\GPInstall.exe 2012-08-15 14:47:40 -------- d-----w- c:\program files\Steam 2012-08-15 14:10:07 -------- d-----r- c:\program files\Skype 2012-08-15 13:39:14 40960 ------r- c:\windows\system32\ChCfg.exe 2012-08-15 13:39:14 135168 ------r- c:\windows\system32\RtlCPAPI.dll 2012-08-15 13:39:03 -------- d-----w- c:\windows\system32\RTCOM 2012-08-15 13:36:12 5824 ----a-w- c:\windows\system32\drivers\ASUSHWIO.SYS 2012-08-15 08:17:47 -------- d-----w- c:\program files\smartdl 2012-08-14 16:11:12 696520 ----a-w- c:\windows\system32\FlashPlayerApp.exe 2012-08-14 14:58:39 -------- d-----w- c:\documents and settings\name\application data\Malwarebytes 2012-08-14 14:58:31 -------- d-----w- c:\documents and settings\all users\application data\Malwarebytes 2012-08-14 13:31:12 73416 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2012-08-14 13:22:17 65640 ----a-w- c:\windows\system32\RtkCoInstIIXP.dll 2012-08-14 13:22:17 11368 ----a-w- c:\windows\system32\RtkCoLDRXP.dll 2012-08-14 13:22:08 757760 ----a-w- c:\program files\common files\installshield\professional\runtime\11\50\intel32\iKernel.dll 2012-08-14 13:22:08 69715 ----a-w- c:\program files\common files\installshield\professional\runtime\11\50\intel32\ctor.dll 2012-08-14 13:22:08 5632 ----a-w- c:\program files\common files\installshield\professional\runtime\11\50\intel32\DotNetInstaller.exe 2012-08-14 13:22:08 274432 ----a-w- c:\program files\common files\installshield\professional\runtime\11\50\intel32\iscript.dll 2012-08-14 13:22:08 204800 ----a-w- c:\program files\common files\installshield\professional\runtime\11\50\intel32\iuser.dll 2012-08-14 13:22:06 331908 ----a-w- c:\program files\common files\installshield\professional\runtime\11\50\intel32\setup.dll 2012-08-14 13:22:06 200836 ----a-w- c:\program files\common files\installshield\professional\runtime\11\50\intel32\iGdi.dll 2012-08-14 13:16:23 11776 ----a-w- c:\program files\mozilla firefox\plugins\nprjplug.dll 2012-08-14 13:16:08 -------- d-----w- c:\program files\common files\xing shared 2012-08-14 13:15:58 150736 ----a-w- c:\program files\mozilla firefox\plugins\nppl3260.dll 2012-08-14 13:15:54 129176 ----a-w- c:\program files\mozilla firefox\plugins\nprpplugin.dll 2012-08-14 13:15:47 499712 ----a-w- c:\windows\system32\msvcp71.dll 2012-08-14 07:27:02 720896 ----a-w- c:\windows\iun6002.exe 2012-08-14 07:27:01 -------- d-----w- c:\program files\TuneXP 2012-08-14 06:48:46 -------- d-----w- c:\documents and settings\name\local settings\application data\WMTools Downloaded Files 2012-08-14 06:17:06 -------- d-----w- c:\documents and settings\name\local settings\application data\Sun 2012-08-13 13:31:26 -------- d-----w- c:\program files\Oracle 2012-08-13 13:31:12 772544 ----a-w- c:\windows\system32\npDeployJava1.dll 2012-08-06 20:09:18 -------- d-----w- c:\documents and settings\name\application data\DivoGames 2012-08-05 07:26:37 -------- d-----w- c:\program files\IObit 2012-08-03 17:35:23 -------- d-----w- c:\documents and settings\all users\application data\SulusGames 2012-08-02 07:14:30 -------- d-----w- c:\documents and settings\all users\application data\OrganicCoffee 2012-08-01 16:58:36 -------- d-----w- c:\documents and settings\name\application data\1morebee 2012-08-01 16:05:57 -------- d-----w- c:\documents and settings\name\application data\8floor 2012-08-01 09:47:02 -------- d-----w- c:\documents and settings\all users\application data\Trymedia 2012-07-31 17:59:21 -------- d-----w- c:\documents and settings\name\application data\blg 2012-07-31 17:59:21 -------- d-----w- c:\documents and settings\all users\application data\blg . ==================== Find3M ==================== . 2012-08-21 09:13:15 729752 ----a-w- c:\windows\system32\drivers\aswSnx.sys 2012-08-21 09:12:33 41224 ----a-w- c:\windows\avastSS.scr 2012-08-16 08:12:12 285360 -c--a-w- c:\windows\system32\nvdrsdb1.bin 2012-08-16 08:12:12 285360 ----a-w- c:\windows\system32\nvdrsdb0.bin 2012-08-16 08:12:12 1 ----a-w- c:\windows\system32\nvdrssel.bin 2012-08-14 13:15:47 348160 ----a-w- c:\windows\system32\msvcr71.dll 2012-07-10 17:47:28 4018624 ----a-w- c:\windows\system32\GameMon.des 2012-07-05 19:07:08 143872 ----a-w- c:\windows\system32\javacpl.cpl 2012-07-05 19:06:20 687544 -c--a-w- c:\windows\system32\deployJava1.dll 2012-07-03 13:40:26 836496 ----a-w- c:\windows\system32\drivers\ESLWireACD.sys 2012-07-02 21:31:48 670816 ----a-w- c:\windows\system32\xsherlock.xem 2012-07-02 17:49:33 916992 ----a-w- c:\windows\system32\wininet.dll 2012-07-02 17:49:32 43520 ----a-w- c:\windows\system32\licmgr10.dll 2012-07-02 17:49:32 1469440 ----a-w- c:\windows\system32\inetcpl.cpl 2012-07-02 12:05:43 385024 ----a-w- c:\windows\system32\html.iec 2012-07-02 10:52:00 242240 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys 2012-06-28 07:08:07 258352 ----a-w- c:\windows\system32\unicows.dll 2012-06-25 13:04:24 1394248 ----a-w- c:\windows\system32\msxml4.dll 2012-06-21 14:40:42 768848 ----a-w- c:\windows\system32\msvcr100.dll 2012-06-21 14:40:34 421200 ----a-w- c:\windows\system32\msvcp100.dll 2012-06-18 10:34:40 2872512 ----a-w- c:\windows\system32\pwNative.exe 2012-06-18 10:34:38 15576 ------w- c:\windows\system32\pwdrvio.sys 2012-06-18 10:34:38 10200 ------w- c:\windows\system32\pwdspio.sys 2012-06-02 12:19:44 22040 -c--a-w- c:\windows\system32\wucltui.dll.mui 2012-06-02 12:19:38 219160 ----a-w- c:\windows\system32\wuaucpl.cpl 2012-06-02 12:19:38 15384 ----a-w- c:\windows\system32\wuaucpl.cpl.mui 2012-06-02 12:19:34 15384 -c--a-w- c:\windows\system32\wuapi.dll.mui 2012-06-02 12:19:30 17944 ----a-w- c:\windows\system32\wuaueng.dll.mui . ============= FINISH: 14:06:06,03 ===============

Редактирано 5 септември 201214 г. от icotonev (преглед на промените)

Malwarebytes Anti-Malware 1.62.0.1300 www.malwarebytes.org Версия на базата от данни: v2012.08.30.02 Windows XP Service Pack 3 x86 NTFS Internet Explorer 8.0.6001.18702 Name :: HOME [ограничен] 30.8.2012 г. 16:17:03 mbam-log-2012-08-30 (16-17-03).txt Тип сканиране: Пълно сканиране (C:|D:|) Включени опции за сканиране: Памет | Автоматично зареждане | Системен регистър | Файлова система | Евристики/Допълнителни | Евристики/Shuriken | PUP | PUM Изключени опции за сканиране: P2P Сканирани обекти: 243623 Изминало време: 1 час(а), 15 минута(и), 41 секунда(и) Открити процеси в паметта: 0 (Не бяха открити зловредни обекти) Открити модули в паметта: 0 (Не бяха открити зловредни обекти) Открити ключове в системния регистър: 0 (Не бяха открити зловредни обекти) Открити стойности в системния регистър: 0 (Не бяха открити зловредни обекти) Открити информационни обекти в системния регистър: 0 (Не бяха открити зловредни обекти) Открити папки: 0 (Не бяха открити зловредни обекти) Открити файлове: 1 D:Call_Of_Duty_4_Crackfix_And_Keygen-Razor1911Keygenrzr-cod4.exe (Trojan.Agent.CK) -> Поставен под карантина и изтрит успешно. (край)

Здравейте..!

Моля,изтеглете AdwCleaner (by Xplode) и запазете на вашия десктоп.

• Кликнете два пъти върху AdwCleaner.exe за да стартирате инструмента.
• Маркирайте Search.
• След завършване на сканирането,автоматично ще се отвори лог-файл
• Моля, да публикувате съдържанието на този лог в следващия си отговор.
• Можете да намерите лога,който автоматично се запомня тук C:AdwCleaner[R1].txt.

Изтеглете Security Check (автор: screen317) от тук или от тук и го запишете на десктопа.

• Кликнете два пъти върху SecurityCheck.exe и следвайте инструкциите.
• Когато програмата завърши работата си, ще се отвори един текстов документ: checkup.txt.
• Копирайте съдържанието на checkup.txt с Копирай (Copy) и с Постави (Paste) го поставете в следващия си коментар.

# AdwCleaner v2.000 - Logfile created 08/31/2012 at 18:17:42

# Updated 30/08/2012 by Xplode

# Operating system : Microsoft Windows XP Service Pack 3 (32 bits)

# User : Name - HOME

# Boot Mode : Normal

# Running from : C:Documents and SettingsNameMy DocumentsDownloadsadwcleaner.exe

# Option [search]

***** [services] *****

***** [Files / Folders] *****

File Found : C:Documents and SettingsNameApplication DataMozillaFirefoxProfilesdmng5toc.defaultsearchpluginsAskcom.xml

File Found : C:Program FilesMozilla Firefoxsearchpluginsbabylon.xml

Folder Found : C:Documents and SettingsAll UsersApplication Databoost_interprocess

Folder Found : C:Documents and SettingsAll UsersApplication DataDownloadnSave

Folder Found : C:Documents and SettingsAll UsersApplication DataInstallMate

Folder Found : C:Documents and SettingsAll UsersApplication DataPremium

Folder Found : C:Documents and SettingsAll UsersApplication DataTrymedia

Folder Found : C:Documents and SettingsNameApplication DataBabylon

Folder Found : C:Documents and SettingsNameApplication DataBabylonToolbar

Folder Found : C:Documents and SettingsNameLocal SettingsApplication DataAPN

***** [Registry] *****

Key Found : HKCUSoftwareBabylonToolbar

Key Found : HKCUSoftwareMicrosoftInternet ExplorerSearchScopes{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E}

Key Found : HKCUSoftwareMicrosoftWindowsCurrentVersionExtSettings{98889811-442D-49DD-99D7-DC866BE87DBC}

Key Found : HKCUSoftwareMicrosoftWindowsCurrentVersionExtStats{00000000-6E41-4FD3-8538-502F5495E5FC}

Key Found : HKCUSoftwareMicrosoftWindowsCurrentVersionExtStats{2EECD738-5844-4A99-B4B6-146BF802613B}

Key Found : HKCUSoftwareMicrosoftWindowsCurrentVersionExtStats{98889811-442D-49DD-99D7-DC866BE87DBC}

Key Found : HKCUSoftwareMicrosoftWindowsCurrentVersionExtStats{D4027C7F-154A-4066-A1AD-4243D8127440}

Key Found : HKCUSoftwareMicrosoftWindowsCurrentVersionExtStats{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}

Key Found : HKCUSoftwareSoftonic

Key Found : HKLMSoftwareBabylon

Key Found : HKLMSoftwareBabylonToolbar

Key Found : HKLMSOFTWAREClassesAppID{09C554C3-109B-483C-A06B-F14172F1A947}

Key Found : HKLMSOFTWAREClassesAppID{35C1605E-438B-4D64-AAB1-8885F097A9B1}

Key Found : HKLMSOFTWAREClassesAppID{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}

Key Found : HKLMSOFTWAREClassesAppID{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}

Key Found : HKLMSOFTWAREClassesAppID{B12E99ED-69BD-437C-86BE-C862B9E5444D}

Key Found : HKLMSOFTWAREClassesAppID{BDB69379-802F-4EAF-B541-F8DE92DD98DB}

Key Found : HKLMSOFTWAREClassesAppID{D7EE8177-D51E-4F89-92B6-83EA2EC40800}

Key Found : HKLMSOFTWAREClassesAppIDescort.DLL

Key Found : HKLMSOFTWAREClassesAppIDescortApp.DLL

Key Found : HKLMSOFTWAREClassesAppIDescortEng.DLL

Key Found : HKLMSOFTWAREClassesAppIDescorTlbr.DLL

Key Found : HKLMSOFTWAREClassesAppIDesrv.EXE

Key Found : HKLMSOFTWAREClassesAppIDGenericAskToolbar.DLL

Key Found : HKLMSOFTWAREClassesInterface{813A22E0-3E2B-4188-9BDA-ECA9878B8D48}

Key Found : HKLMSOFTWAREMicrosoftInternet ExplorerLow RightsElevationPolicy{8375D9C8-634F-4ECB-8CF5-C7416BA5D542}

Key Found : HKLMSOFTWAREMicrosoftWindowsCurrentVersionApp ManagementARPCacheIM

Key Found : HKLMSOFTWAREMicrosoftWindowsCurrentVersionUninstallIM

Key Found : HKUS-1-5-21-796845957-1897051121-725345543-1003SoftwareMicrosoftInternet ExplorerSearchScopes{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E}

Value Found : HKCUSoftwareMicrosoftInternet ExplorerToolbarWebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]

Value Found : HKCUSoftwareMicrosoftInternet ExplorerURLSearchHooks [{00000000-6E41-4FD3-8538-502F5495E5FC}]

Value Found : HKLMSOFTWAREMicrosoftInternet ExplorerToolbar [{98889811-442D-49DD-99D7-DC866BE87DBC}]

Value Found : HKLMSOFTWAREMicrosoftInternet ExplorerToolbar [{D4027C7F-154A-4066-A1AD-4243D8127440}]

***** [internet Browsers] *****

- Internet Explorer v8.0.6001.18702

[OK] Registry is clean.

- Mozilla Firefox v15.0 (bg)

Profile name : default

File : C:Documents and SettingsNameApplication DataMozillaFirefoxProfilesdmng5toc.defaultprefs.js

Found : user_pref("browser.babylon.HPOnNewTab", "search.babylon.com");

Found : user_pref("browser.search.order.1", "Search the web (Babylon)");

Found : user_pref("extensions.4f97d088b0bf8.scode", "(function(){try{if('mystart.incredibar.com,premiumrepor[...]

Found : user_pref("extensions.BabylonToolbar_i.aflt", "babsst");

Found : user_pref("extensions.BabylonToolbar_i.babExt", "");

Found : user_pref("extensions.BabylonToolbar_i.babTrack", "affID=111366");

Found : user_pref("extensions.BabylonToolbar_i.hardId", "7c28911b00000000000000ff01000001");

Found : user_pref("extensions.BabylonToolbar_i.id", "7c28911b00000000000000ff01000001");

Found : user_pref("extensions.BabylonToolbar_i.instlDay", "15457");

Found : user_pref("extensions.BabylonToolbar_i.instlRef", "sst");

Found : user_pref("extensions.BabylonToolbar_i.newTab", true);

Found : user_pref("extensions.BabylonToolbar_i.newTabUrl", "hxxp://search.babylon.com/?affID=111366&babsrc=N[...]

Found : user_pref("extensions.BabylonToolbar_i.prdct", "BabylonToolbar");

Found : user_pref("extensions.BabylonToolbar_i.prtnrId", "babylon");

Found : user_pref("extensions.BabylonToolbar_i.smplGrp", "none");

Found : user_pref("extensions.BabylonToolbar_i.srcExt", "ss");

Found : user_pref("extensions.BabylonToolbar_i.tlbrId", "base");

Found : user_pref("extensions.BabylonToolbar_i.vrsn", "1.5.3.17");

Found : user_pref("extensions.BabylonToolbar_i.vrsnTs", "1.5.3.179:53:12");

Found : user_pref("extensions.BabylonToolbar_i.vrsni", "1.5.3.17");

Found : user_pref("keyword.URL", "hxxp://search.babylon.com/?affID=111366&babsrc=KW_ss&mntrId=7c28911b000000[...]

- Google Chrome v [unable to get version]

File : C:Documents and SettingsNameLocal SettingsApplication DataGoogleChromeUser DataDefaultPreferences

Found [l.9] : homepage = "hxxp://search.babylon.com/?affID=111366&babsrc=HP_ss&mntrId=7c28911b00000000000000ff01000001",

Found [l.1354] : homepage = "hxxp://search.babylon.com/?affID=111366&babsrc=HP_ss&mntrId=7c28911b00000000000000ff01000001",

*************************

AdwCleaner[R1].txt - [6367 octets] - [31/08/2012 18:17:42]

########## EOF - C:AdwCleaner[R1].txt - [6427 octets] ##########

Results of screen317's Security Check version 0.99.49

Windows XP Service Pack 3 x86

Internet Explorer 8

``````````````Antivirus/Firewall Check:``````````````

Windows Firewall Enabled!

avast! Antivirus

Antivirus up to date!

`````````Anti-malware/Other Utilities Check:`````````

CCleaner

JavaFX 2.1.1

Java 6 Update 30

Java 7 Update 5

Java version out of Date!

Adobe Flash Player 11.4.402.265

Mozilla Firefox (15.0)

Google Chrome 21.0.1180.79

Google Chrome 21.0.1180.83

````````Process Check: objlist.exe by Laurent````````

Alwil Software Avast5 AvastSvc.exe

Alwil Software Avast5 avastUI.exe

`````````````````System Health check`````````````````

Total Fragmentation on Drive C::

````````````````````End of Log``````````````````````

Забравих да кажа, че същия ден работих с Advanced System Care и почиствах регистри и т.н

Стартирайте отново програмата AdwCleaner (by Xplode).

• Затворете всички стартирани програми и браузъри
• Кликнете два пъти върху adwcleaner.exe за да стартирате инструмента.
• Този път маркирайте Delete
• Вашият компютър ще се рестартира автоматично. Текстовия файл ще се отвори след рестарта.
• Моля, да публикувате съдържанието на този лог в отговора си
• Можете да намерите лога,който автоматично се запомня тук C:AdwCleaner[s1].txt.

# AdwCleaner v2.000 - Logfile created 08/31/2012 at 18:26:53 # Updated 30/08/2012 by Xplode # Operating system : Microsoft Windows XP Service Pack 3 (32 bits) # User : Name - HOME # Boot Mode : Normal # Running from : C:Documents and SettingsNameMy DocumentsDownloadsadwcleaner.exe # Option [Delete] ***** [services] ***** ***** [Files / Folders] ***** File Deleted : C:Documents and SettingsNameApplication DataMozillaFirefoxProfilesdmng5toc.defaultsearchpluginsAskcom.xml File Deleted : C:Program FilesMozilla Firefoxsearchpluginsbabylon.xml Folder Deleted : C:Documents and SettingsAll UsersApplication Databoost_interprocess Folder Deleted : C:Documents and SettingsAll UsersApplication DataDownloadnSave Folder Deleted : C:Documents and SettingsAll UsersApplication DataInstallMate Folder Deleted : C:Documents and SettingsAll UsersApplication DataPremium Folder Deleted : C:Documents and SettingsAll UsersApplication DataTrymedia Folder Deleted : C:Documents and SettingsNameApplication DataBabylon Folder Deleted : C:Documents and SettingsNameApplication DataBabylonToolbar Folder Deleted : C:Documents and SettingsNameLocal SettingsApplication DataAPN ***** [Registry] ***** Key Deleted : HKCUSoftwareBabylonToolbar Key Deleted : HKCUSoftwareMicrosoftInternet ExplorerSearchScopes{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E} Key Deleted : HKCUSoftwareMicrosoftWindowsCurrentVersionExtSettings{98889811-442D-49DD-99D7-DC866BE87DBC} Key Deleted : HKCUSoftwareMicrosoftWindowsCurrentVersionExtStats{00000000-6E41-4FD3-8538-502F5495E5FC} Key Deleted : HKCUSoftwareMicrosoftWindowsCurrentVersionExtStats{2EECD738-5844-4A99-B4B6-146BF802613B} Key Deleted : HKCUSoftwareMicrosoftWindowsCurrentVersionExtStats{98889811-442D-49DD-99D7-DC866BE87DBC} Key Deleted : HKCUSoftwareMicrosoftWindowsCurrentVersionExtStats{D4027C7F-154A-4066-A1AD-4243D8127440} Key Deleted : HKCUSoftwareMicrosoftWindowsCurrentVersionExtStats{F9E4A054-E9B1-4BC3-83A3-76A1AE736170} Key Deleted : HKCUSoftwareSoftonic Key Deleted : HKLMSoftwareBabylon Key Deleted : HKLMSoftwareBabylonToolbar Key Deleted : HKLMSOFTWAREClassesAppID{09C554C3-109B-483C-A06B-F14172F1A947} Key Deleted : HKLMSOFTWAREClassesAppID{35C1605E-438B-4D64-AAB1-8885F097A9B1} Key Deleted : HKLMSOFTWAREClassesAppID{4E1E9D45-8BF9-4139-915C-9F83CC3D5921} Key Deleted : HKLMSOFTWAREClassesAppID{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874} Key Deleted : HKLMSOFTWAREClassesAppID{B12E99ED-69BD-437C-86BE-C862B9E5444D} Key Deleted : HKLMSOFTWAREClassesAppID{BDB69379-802F-4EAF-B541-F8DE92DD98DB} Key Deleted : HKLMSOFTWAREClassesAppID{D7EE8177-D51E-4F89-92B6-83EA2EC40800} Key Deleted : HKLMSOFTWAREClassesAppIDescort.DLL Key Deleted : HKLMSOFTWAREClassesAppIDescortApp.DLL Key Deleted : HKLMSOFTWAREClassesAppIDescortEng.DLL Key Deleted : HKLMSOFTWAREClassesAppIDescorTlbr.DLL Key Deleted : HKLMSOFTWAREClassesAppIDesrv.EXE Key Deleted : HKLMSOFTWAREClassesAppIDGenericAskToolbar.DLL Key Deleted : HKLMSOFTWAREClassesInterface{813A22E0-3E2B-4188-9BDA-ECA9878B8D48} Key Deleted : HKLMSOFTWAREMicrosoftInternet ExplorerLow RightsElevationPolicy{8375D9C8-634F-4ECB-8CF5-C7416BA5D542} Key Deleted : HKLMSOFTWAREMicrosoftWindowsCurrentVersionApp ManagementARPCacheIM Key Deleted : HKLMSOFTWAREMicrosoftWindowsCurrentVersionUninstallIM Value Deleted : HKCUSoftwareMicrosoftInternet ExplorerToolbarWebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}] Value Deleted : HKCUSoftwareMicrosoftInternet ExplorerURLSearchHooks [{00000000-6E41-4FD3-8538-502F5495E5FC}] Value Deleted : HKLMSOFTWAREMicrosoftInternet ExplorerToolbar [{98889811-442D-49DD-99D7-DC866BE87DBC}] Value Deleted : HKLMSOFTWAREMicrosoftInternet ExplorerToolbar [{D4027C7F-154A-4066-A1AD-4243D8127440}] ***** [internet Browsers] ***** - Internet Explorer v8.0.6001.18702 Restored : [HKCUSoftwareMicrosoftInternet ExplorerSearchScopes - DefaultScope] Restored : [HKUS-1-5-19SoftwareMicrosoftInternet ExplorerSearchScopes - DefaultScope] Restored : [HKUS-1-5-20SoftwareMicrosoftInternet ExplorerSearchScopes - DefaultScope] Restored : [HKUS-1-5-21-796845957-1897051121-725345543-1005SoftwareMicrosoftInternet ExplorerSearchScopes - DefaultScope] - Mozilla Firefox v15.0 (bg) Profile name : default File : C:Documents and SettingsNameApplication DataMozillaFirefoxProfilesdmng5toc.defaultprefs.js C:Documents and SettingsNameApplication DataMozillaFirefoxProfilesdmng5toc.defaultuser.js ... Deleted ! Deleted : user_pref("browser.babylon.HPOnNewTab", "search.babylon.com"); Deleted : user_pref("browser.search.order.1", "Search the web (Babylon)"); Deleted : user_pref("extensions.4f97d088b0bf8.scode", "(function(){try{if('mystart.incredibar.com,premiumrepor[...] Deleted : user_pref("extensions.BabylonToolbar_i.aflt", "babsst"); Deleted : user_pref("extensions.BabylonToolbar_i.babExt", ""); Deleted : user_pref("extensions.BabylonToolbar_i.babTrack", "affID=111366"); Deleted : user_pref("extensions.BabylonToolbar_i.hardId", "7c28911b00000000000000ff01000001"); Deleted : user_pref("extensions.BabylonToolbar_i.id", "7c28911b00000000000000ff01000001"); Deleted : user_pref("extensions.BabylonToolbar_i.instlDay", "15457"); Deleted : user_pref("extensions.BabylonToolbar_i.instlRef", "sst"); Deleted : user_pref("extensions.BabylonToolbar_i.newTab", true); Deleted : user_pref("extensions.BabylonToolbar_i.newTabUrl", "hxxp://search.babylon.com/?affID=111366&babsrc=N[...] Deleted : user_pref("extensions.BabylonToolbar_i.prdct", "BabylonToolbar"); Deleted : user_pref("extensions.BabylonToolbar_i.prtnrId", "babylon"); Deleted : user_pref("extensions.BabylonToolbar_i.smplGrp", "none"); Deleted : user_pref("extensions.BabylonToolbar_i.srcExt", "ss"); Deleted : user_pref("extensions.BabylonToolbar_i.tlbrId", "base"); Deleted : user_pref("extensions.BabylonToolbar_i.vrsn", "1.5.3.17"); Deleted : user_pref("extensions.BabylonToolbar_i.vrsnTs", "1.5.3.179:53:12"); Deleted : user_pref("extensions.BabylonToolbar_i.vrsni", "1.5.3.17"); Deleted : user_pref("keyword.URL", "hxxp://search.babylon.com/?affID=111366&babsrc=KW_ss&mntrId=7c28911b000000[...] - Google Chrome v [unable to get version] File : C:Documents and SettingsNameLocal SettingsApplication DataGoogleChromeUser DataDefaultPreferences Deleted [l.9] : homepage = "hxxp://search.babylon.com/?affID=111366&babsrc=HP_ss&mntrId=7c28911b00000000000000ff01000001", Deleted [l.1354] : homepage = "hxxp://search.babylon.com/?affID=111366&babsrc=HP_ss&mntrId=7c28911b00000000000000ff01000001", ************************* AdwCleaner[R1].txt - [6496 octets] - [31/08/2012 18:17:42] AdwCleaner[s1].txt - [6892 octets] - [31/08/2012 18:26:53] ########## EOF - C:AdwCleaner[s1].txt - [6952 octets] ########## Мога ли да получа информация какво става :?

Забравих да кажа, че същия ден работих с Advanced System Care и почиствах регистри и т.н

Ами хубаво..!Това каква връзка има с премахването на зловреден софтуер..?

Изтеглете Malwarebytes' Anti-Malware или от тук (не забравяйте да обновите програмата с нови дефиниции)

* Кликнете два пъти върху mbam-setup.exe, за да инсталирате програмата.

* Уверете се, че са поставени отметки на Update Malwarebytes' Anti-Malware и Launch Malwarebytes' Anti-Malware. След това кликнете на Finish.

* Ако има намерени обновявания, тя ще ги изтегли и инсталира.

* Стартирайте програмата и изберете "Perform Full Scan", след това кликнете на Scan.

* Сканирането ще отнеме малко време, затова моля да бъдете търпеливи.

* Когато сканирането завърши, кликнете на OK, след това Show Results, за да видите резултата.

* Уверете се, че на всички редове има отметки, и кликнете на Remove Selected.

* Когато всичко бъде премахнато, в Notepad ще бъде отворен лог. Копирайте този лог и го публикувайте в следващия си коментар по темата.

Забележка: Ако MalwareBytes' Anti-Malware се затрудни в премахването на откритите вируси/заплахи, той ще поиска да рестартира компютъра Ви и по време на рестартирането да премахне проблемните вируси/заплахи. Ако бъдете попитани, потвърдете че желаете вашия компютър да бъде рестартиран.

Изтеглете програмата: ESET Online Scanner

• Стартирайте esetsmartinstaller_enu.exe
• Сложете отметка на YES, I accept the Terms of Use и изберете Start:

  

• Скенерът ще започне да изтегля компонентите, които са му необходими:

  

Уверете се, че е премахната отметката от:

• Remove found threats

Уверете се че са маркирани следните позиции:

• Scan Archives

Кликнете върху Advanced Settings и маркирайте следните опции:

• Scan for potentially unwanted applications
• Scan for potentially unsafe applications
• Enable Anti-Stealth Technology

Накрая изберете Start

• Скенерът ще започне да изтегля последните дефиниции.
• След, като сканирането завърши изберете Finish.
• Отидете в: C:Program FilesESETESET Online Scanner
• Отворете файла log.txt , копирайте съдържанието му и го поставете в следващия си коментар.

Malwarebytes Anti-Malware 1.62.0.1300 www.malwarebytes.org Версия на базата от данни: v2012.09.01.02 Windows XP Service Pack 3 x86 NTFS Internet Explorer 8.0.6001.18702 Name :: HOME [администратор] 01.9.2012 г. 08:41:19 mbam-log-2012-09-01 (08-41-19).txt Тип сканиране: Пълно сканиране (C:|D:|) Включени опции за сканиране: Памет | Автоматично зареждане | Системен регистър | Файлова система | Евристики/Допълнителни | Евристики/Shuriken | PUP | PUM Изключени опции за сканиране: P2P Сканирани обекти: 262614 Изминало време: 1 час(а), 10 минута(и), 18 секунда(и) Открити процеси в паметта: 0 (Не бяха открити зловредни обекти) Открити модули в паметта: 0 (Не бяха открити зловредни обекти) Открити ключове в системния регистър: 0 (Не бяха открити зловредни обекти) Открити стойности в системния регистър: 0 (Не бяха открити зловредни обекти) Открити информационни обекти в системния регистър: 1 HKLMSOFTWAREMicrosoftSecurity Center|UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Лош: (1) Добър: (0) -> Поставен под карантина и поправен успешно. Открити папки: 0 (Не бяха открити зловредни обекти) Открити файлове: 0 (Не бяха открити зловредни обекти) (край) Сега пускам и ESET ONLINE SCANNER

1:15 min ми търси вируси тоя ЕСЕТ и е само на 27 %..... - Досега намери само 1 Win32/CrossRider application

ESETSmartInstaller@High as downloader log: all ok

Къде е дневника...?Може ли да го видя....?

Ако ми кажеш как мога да го намеря ще ти го дам... log.txt ESETSmartInstaller@High as downloader log: all ok

Редактирано 1 септември 201214 г. от someonehh (преглед на промените)

Добре..!Съдейки по последната информация мисля че в системата ви няма данни за зловреден софтуер...От първия дневник се виждаше BabylonToolbar ,който премахнахме с AdwCleaner. Имате ли още оплаквания по първоначалния проблем..?

Изтеглете OTL.exe и го запазете на десктопа.

• Стартирайте OTL (ако е необходимо, потвърдете през UAC).
• Направете следните настройки:
• Сложете отметка пред Scan All Users
• Под менюто File Age => изберете 90 days
• Под менюто Standard Registry => променете на ALL
• Сложете отметки пред LOP и Purity Check

Под с Copy/ Paste въведете изцяло следната текстова информация (само това, което е поставено в карето):

netsvcs
msconfig
safebootminimal
safebootnetwork
"%WinDir%$NtUninstallKB*$." /30
C:Program FilesCommon FilesComObjects*.* /s
%SYSTEMDRIVE%*.*
%USERPROFILE%*.*
%USERPROFILE%Application Data*.*
%USERPROFILE%Local SettingsApplication Data*.*
%AllUsersProfile%*.*
%AllUsersProfile%Application Data*.*
%USERPROFILE%My Documents*.*
%CommonProgramFiles%*.*
%PROGRAMFILES%*.*
%systemroot%system32configsystemprofile*.*
%windir%ServiceProfilesLocalServiceAppDataLocalTemp*.*
%windir%ServiceProfilesNetworkServiceAppDataLocalTemp*.*
%windir% emp*.*
%windir%system32*.
%Temp%smtmp1*.*
%Temp%smtmp2*.*
%Temp%smtmp3*.*
%Temp%smtmp4*.*
%systemroot%system32DBBK*.* /s
%systemroot%system32*.dll /lockedfiles
%systemroot%Tasks*.job /lockedfiles
%systemroot%system32drivers*.sys /90
%systemroot%system32drivers*.sys /lockedfiles
%systemroot%system32Spoolprtprocsw32x86*.dll
%systemroot%*. /rp /s
%systemroot%assembly mp*.* /S /MD5
%systemroot%assembly emp*.* /S /MD5
%systemroot%assemblyGAC_32*.* /S /MD5
%systemroot%assemblyGAC_MSIL*.* /S /MD5
>C:commands.txt echo list vol /raw /hide /c
/wait
>C:DiskReport.txt diskpart /s C:commands.txt /raw /hide /c
/wait
type c:diskreport.txt /c
/wait
erase c:commands.txt /hide /c
/wait
erase c:diskreport.txt /hide /c
/md5start
smss.exe
winlogon.exe
services.exe
lsass.exe
svchost.exe
explorer.exe
userinit.exe
atapi.sys
iaStor.sys
serial.sys
disk.sys
volsnap.sys
redbook.sys
i8042prt.sys
afd.sys
netbt.sys
tcpip.sys
ipsec.sys
hlp.dat
crexv.ocx
/md5stop

• Натиснете маркираният в синьо бутон: Run Scan.
• Като приключи проверката, ще се създадат два файла - OTL.Txt и Extras.Txt. Прикачете тези два файла в следващия си коментар (погледнете опцията "прикачени файлове", когато публикувате мнение).

Ето ги....

Extras.Txt

OTL.Txt

Стартирайте отново OTL, копирайте (Copy) и поставете (Paste) скриптовия текст от текстовото поле по-долу под колонката Custom Scans/Fixes, като не забравяте да копирате скрипта 1 към 1, както и двете точки преди първия ред на скрипта.

:OTL
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (xhunter1)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (vtany)
O33 - MountPoints2{60dfd664-3dff-11e1-aa48-00161790d432}Shell - "" = AutoRun
O33 - MountPoints2{60dfd664-3dff-11e1-aa48-00161790d432}ShellAutoRuncommand - "" = F:LGAutoRun.exe
O33 - MountPoints2{9de8bd4f-3ee7-11e1-aa4a-00161790d432}Shell - "" = AutoRun
O33 - MountPoints2{9de8bd4f-3ee7-11e1-aa4a-00161790d432}ShellAutoRuncommand - "" = F:setup.exe -- [2007.10.04 10:45:00 | 000,316,728 | R--- | M] (Activision											 )
O33 - MountPoints2{b8b95914-b306-11e1-abdb-00161790d432}ShellAutoRuncommand - "" = tomo/cafe.exe
O33 - MountPoints2{b8b95914-b306-11e1-abdb-00161790d432}ShellExplorecommand - "" = tomo/cafe.exe
O33 - MountPoints2{b8b95914-b306-11e1-abdb-00161790d432}ShellOpencommand - "" = tomo/cafe.exe
O33 - MountPoints2{d026db33-c40a-11e1-ac1a-00161790d432}Shell - "" = AutoRun
O33 - MountPoints2{d026db33-c40a-11e1-ac1a-00161790d432}ShellAutoRuncommand - "" = F:SetuprsrcAUTORUN.EXE -- [2007.03.23 02:57:09 | 000,051,336 | R--- | M] ()
O33 - MountPoints2{d026db33-c40a-11e1-ac1a-00161790d432}Shelldinstallcommand - "" = F:DirectXDXSETUP.exe -- [2007.06.01 06:23:56 | 000,503,144 | R--- | M] (Microsoft Corporation)
@Alternate Data Stream - 144 bytes -> C:Documents and SettingsAll UsersApplication DataTEMP:3A4C8FE7
@Alternate Data Stream - 137 bytes -> C:Documents and SettingsAll UsersApplication DataTEMP:A1023D41
@Alternate Data Stream - 134 bytes -> C:Documents and SettingsAll UsersApplication DataTEMP:F67947AF
@Alternate Data Stream - 132 bytes -> C:Documents and SettingsAll UsersApplication DataTEMP:C43C957E
@Alternate Data Stream - 130 bytes -> C:Documents and SettingsAll UsersApplication DataTEMP:F2327E82
@Alternate Data Stream - 125 bytes -> C:Documents and SettingsAll UsersApplication DataTEMP:122B409D
@Alternate Data Stream - 122 bytes -> C:Documents and SettingsAll UsersApplication DataTEMP:D01ACC06
@Alternate Data Stream - 118 bytes -> C:Documents and SettingsAll UsersApplication DataTEMP:A9ABA3FF
@Alternate Data Stream - 118 bytes -> C:Documents and SettingsAll UsersApplication DataTEMP:417B6FAC
@Alternate Data Stream - 114 bytes -> C:Documents and SettingsAll UsersApplication DataTEMP:CB0FEE2B
@Alternate Data Stream - 109 bytes -> C:Documents and SettingsAll UsersApplication DataTEMP:592D7272

:files


recycler /alldrives
ipconfig /flushdns /c

:Commands
[purity]
[emptytemp]
[emptyjava]
[resethosts]
[clearallrestorepoints]
[emptyflash]
[Reboot]

След като въведете скрипта от цитата по-горе натиснете бутона, маркиран в червено: Run Fix

Windows ще се рестартира и ще се създаде лог файл. Публикувайте съдържанието му с Copy/Paste в следващия си коментар.

2 пъти ми crashna програмата...нещо нестава.

Проблема не е от вирус, а от настройки явно... Някакви идей "? Идва синият екран с "добре дошли* и после dekstop backround се показва и чакам 2-3 мин. да се покажат старт менюто и иконите... Досега не е правил такива проблеми

Коригирах скрипта...опитайте отново...!Да, наистина в системата ви няма активни зарази.....чистим само разни "батаци"....!

Преди да го коригираш в сисиемата ми бе изтрит файл.... и трябваше да преинсталирам windows xp Всичко си е ОК сега...

Преди да го коригираш в сисиемата ми бе изтрит файл.... и трябваше да преинсталирам windows xp

Всичко си е ОК сега...

Искате да кажете че аз съм изтрил системен файл и съм ви убил системата..?Вие сигурен ли сте в това..?

Ами никога не обвинявам някой без да съм 100 процента сигурен...пуснах тази програма след което се рестартира уиндоус и ми изписа NLDR is missing Press Ctrl+Alt+Del to restart Вие решете

Добре както и да е ..Щом вече всичко е наред....няма проблеми.....но пак да кажа и приключвам: От системата ви по мои указания бяха премахнати досадния тоолбар Babylon + MountPoints2 и два остатъка от предполагам стари програми.....така че аз съм чист пред съвеста си.! Лек ден ви желая..!