• Изтеглете RogueKiller.exe и го запазете на десктопа.
• Стартирайте приложението и натиснете бутона SCAN.

• Ще се създаде лог файл на десктопа с името RKreport.txt на десктопа.
• Публикувайте лог файла в следващия си пост.

Изтеглете OTL.exe и го запазете на десктопа.

• Стартирайте OTL.exe.
• Направете следните настройки:
• Сложете отметка пред Scan All Users
• Под менюто File Age изберете 90 days
• Под менюто Standard Registry променете на ALL
• Сложете отметки пред LOP и Purity Check

Под с Copy/ Paste въведете изцяло следната текстова информация (само това, което е поставено в карето):

netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%SYSTEMDRIVE%*.*
%USERPROFILE%*.*
%USERPROFILE%temp*.exe
%USERPROFILE%AppDataLocal*.*
%USERPROFILE%AppDataLocal*.
%USERPROFILE%AppDataLocaltemp*.exe
%USERPROFILE%AppDataRoaming*.*
%USERPROFILE%AppDataRoaming*.
%Public%DocumentsSoftwrapYOYOGAMESGM70FINAL*.exe
%Public%DocumentsFonts*.exe
%Public%DocumentsConfig*.exe
%Public%Documents*.*
%ProgramData%*.*
%ProgramData%*.
%CommonProgramFiles%*.*
%CommonProgramFiles%ComObjects*.exe
%PROGRAMFILES%*.*
%PROGRAMFILES%*.
%ProgramFiles(x86)%*.*
%ProgramFiles(x86)%*.
%systemroot%system32configsystemprofileAppDataLocal*.*
%systemroot%system32configsystemprofileAppDataRoaming*.*
%windir%SysWOW64configsystemprofileAppDataLocal*.*
%windir%SysWOW64configsystemprofileAppDataRoaming*.*
%windir%ServiceProfilesLocalServiceAppDataLocalTemp*.tlb
%windir%ServiceProfilesNetworkServiceAppDataLocalTemp*.tlb
%windir%temp*.exe
%windir%*.
%windir%installer*.
%windir%system32*.
%windir%sysnative*.
%Temp%smtmp1*.*
%Temp%smtmp2*.*
%Temp%smtmp3*.*
%Temp%smtmp4*.*
%systemroot%system32*.dll /lockedfiles
%systemroot%syswow64*.dll /lockedfiles
%systemroot%Tasks*.job /lockedfiles
%systemroot%system32drivers*.sys /90
%systemroot%system32drivers*.sys /lockedfiles
%systemroot%syswow64drivers*.sys /90
%systemroot%syswow64drivers*.sys /lockedfiles
%systemroot%system32Spoolprtprocsw32x86*.dll
%systemroot%*. /rp /s
%systemroot%assemblytmp*.* /S /MD5
%systemroot%assemblytemp*.* /S /MD5
%systemroot%assemblyGAC*.ini
%systemroot%assemblyGAC_32*.ini
%systemroot%assemblyGAC_64*.ini
%SystemRoot%assemblyGAC_MSIL*.ini
HKEY_CLASSES_ROOTCLSID{7C857801-7381-11CF-884D-00AA004B2E24} /s
HKEY_CLASSES_ROOTCLSID{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1} /s
HKEY_CURRENT_USERSoftwareClassesCLSID{42aedc87-2188-41fd-b9a3-0c966feabec1} /s
HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1} /s
HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{42aedc87-2188-41fd-b9a3-0c966feabec1} /s
HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{a2a9545d-a0c2-42b4-9708-a0b2badd77c8} /s
HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{7C857801-7381-11CF-884D-00AA004B2E24} /s
HKEY_CURRENT_USERSoftwareMSOLoad /s
>C:commands.txt echo list vol /raw /hide /c
/wait
>C:DiskReport.txt diskpart /s C:commands.txt /raw /hide /c
/wait
type c:diskreport.txt /c
/wait
erase c:commands.txt /hide /c
/wait
erase c:diskreport.txt /hide /c
/md5start
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
sceclt.dll
ntelogon.dll
logevent.dll
consrv.dll
services.exe
explorer.exe
lsass.exe
svchost.exe
wininit.exe
winlogon.exe
userinit.exe
atapi.sys
iaStor.sys
serial.sys
volsnap.sys
disk.sys
redbook.sys
i8042prt.sys
afd.sys
netbt.sys
csc.sys
tcpip.sys
dfsc.sys
hlp.dat
str.sys
crexv.ocx
/md5stop

• Натиснете маркираният в синьо бутон: Run Scan.
• Като приключи проверката, ще се създадат два файла - OTL.Txt и Extras.Txt. Файлът OTL.Txt копирайте в следващия си пост. Extras.Txt прикачете в следващия си коментар (погледнете опцията Прикачени файлове, когато публикувате мнение).

RogueKiller V8.1.1 [10/03/2012] by Tigzy

mail: tigzyRK<at>gmail<dot>com

Feedback: http://www.geekstogo.com/forum/files/file/413-roguekiller/

Website: http://tigzy.geekstogo.com/roguekiller.php

Blog: http://tigzyrk.blogspot.com

Operating System: Windows 7 (6.1.7600 ) 32 bits version

Started in : Normal mode

User : stefan [Admin rights]

Mode : Scan -- Date : 10/07/2012 19:55:39

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 10 ¤¤¤

[RUN][sUSP PATH] HKCU[...]Run : Ivideon Server ("C:UsersstefanAppDataLocalIvideonIvideonServerIvideonServer.exe" --hide-main-window --force-start-broadcast --start-delay=15) -> FOUND

[RUN][sUSP PATH] HKUSS-1-5-21-2484765222-1754346837-1917303767-1000[...]Run : Ivideon Server ("C:UsersstefanAppDataLocalIvideonIvideonServerIvideonServer.exe" --hide-main-window --force-start-broadcast --start-delay=15) -> FOUND

[TASK][sUSP PATH] {FD7172DF-2711-4FEA-886D-BFB36F6FAB67} : C:WindowsSystem32pcalua.exe -a C:UsersstefanDesktopstreamripper-windows-installer-1.64.6.exe -d C:UsersstefanDesktop -> FOUND

[DNS] HKLM[...]ControlSet001ServicesInterfaces{07996BC0-7617-4F46-B9A0-124BFDA127A4} : NameServer (77.71.0.1,77.71.1.1) -> FOUND

[DNS] HKLM[...]ControlSet002ServicesInterfaces{07996BC0-7617-4F46-B9A0-124BFDA127A4} : NameServer (77.71.0.1,77.71.1.1) -> FOUND

[HJPOL] HKCU[...]System : disableregistrytools (0) -> FOUND

[HJ] HKLM[...]System : ConsentPromptBehaviorAdmin (0) -> FOUND

[HJ] HKLM[...]System : EnableLUA (0) -> FOUND

[HJ DESK] HKLM[...]NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND

[HJ DESK] HKLM[...]NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [LOADED] ¤¤¤

IRP[iRP_MJ_CREATE] : SystemRootsystem32DRIVERSatapi.sys -> HOOKED ([MAJOR] Unknown @ 0x85A6D1F8)

IRP[iRP_MJ_CLOSE] : SystemRootsystem32DRIVERSatapi.sys -> HOOKED ([MAJOR] Unknown @ 0x85A6D1F8)

IRP[iRP_MJ_DEVICE_CONTROL] : SystemRootsystem32DRIVERSatapi.sys -> HOOKED ([MAJOR] Unknown @ 0x85A6D1F8)

IRP[iRP_MJ_INTERNAL_DEVICE_CONTROL] : SystemRootsystem32DRIVERSatapi.sys -> HOOKED ([MAJOR] Unknown @ 0x85A6D1F8)

IRP[iRP_MJ_POWER] : SystemRootsystem32DRIVERSatapi.sys -> HOOKED ([MAJOR] Unknown @ 0x85A6D1F8)

IRP[iRP_MJ_SYSTEM_CONTROL] : SystemRootsystem32DRIVERSatapi.sys -> HOOKED ([MAJOR] Unknown @ 0x85A6D1F8)

IRP[iRP_MJ_PNP] : SystemRootsystem32DRIVERSatapi.sys -> HOOKED ([MAJOR] Unknown @ 0x85A6D1F8)

¤¤¤ HOSTS File: ¤¤¤

--> C:Windowssystem32driversetchosts

127.0.0.1 localhost

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: WDC WD6400AARS-00Y5B1 ATA Device +++++

--- User ---

[MBR] 8472f76b4d64529377be3339aa9be35d

[bSP] d81ef638f4080487b8338279076e6cc3 : Windows 7 MBR Code

Partition table:

0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 100 Mo

1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 39899 Mo

2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 81920000 | Size: 200000 Mo

3 - [XXXXXX] EXTEN-LBA (0x0f) [VISIBLE] Offset (sectors): 491520000 | Size: 370479 Mo

User = LL1 ... OK!

User = LL2 ... OK!

Finished : << RKreport[1].txt >>

RKreport[1].txt

OTL logfile created on: 7.10.2012 г. 20:03:42 - Run 1

OTL by OldTimer - Version 3.2.69.0 Folder = C:UsersstefanDownloads

Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000402 | Country: България | Language: BGR | Date Format: d.M.yyyy 'г.'

3,00 Gb Total Physical Memory | 1,51 Gb Available Physical Memory | 50,29% Memory free

5,99 Gb Paging File | 4,10 Gb Available in Paging File | 68,47% Paging File free

Paging file location(s): ?:pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:Windows | %ProgramFiles% = C:Program Files

Drive C: | 38,96 Gb Total Space | 9,94 Gb Free Space | 25,52% Space Free | Partition Type: NTFS

Drive D: | 361,79 Gb Total Space | 72,68 Gb Free Space | 20,09% Space Free | Partition Type: NTFS

Drive E: | 195,31 Gb Total Space | 82,84 Gb Free Space | 42,41% Space Free | Partition Type: NTFS

Computer Name: STEFAN-PC | User Name: stefan | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 90 Days

========== Processes (SafeList) ==========

PRC - [2012.10.07 19:58:00 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:UsersstefanDownloadsOTL.exe

PRC - [2012.10.07 19:54:50 | 001,422,336 | ---- | M] () -- C:UsersstefanDownloadsRogueKiller(1).exe

PRC - [2012.09.07 18:34:01 | 000,917,984 | ---- | M] (Mozilla Corporation) -- C:Program FilesMozilla Firefoxfirefox.exe

PRC - [2012.09.07 17:04:46 | 000,676,936 | ---- | M] (Malwarebytes Corporation) -- C:Program FilesMalwarebytes' Anti-Malwarembamservice.exe

PRC - [2012.09.07 17:04:46 | 000,399,432 | ---- | M] (Malwarebytes Corporation) -- C:Program FilesMalwarebytes' Anti-Malwarembamscheduler.exe

PRC - [2012.09.07 17:04:44 | 000,766,536 | ---- | M] (Malwarebytes Corporation) -- C:Program FilesMalwarebytes' Anti-Malwarembamgui.exe

PRC - [2012.08.30 22:13:00 | 001,258,856 | ---- | M] (NVIDIA Corporation) -- C:Program FilesNVIDIA CorporationNVIDIA Update Coredaemonu.exe

PRC - [2012.08.30 18:57:35 | 001,820,520 | ---- | M] (NVIDIA Corporation) -- C:Program FilesNVIDIA CorporationDisplaynvtray.exe

PRC - [2012.08.30 18:57:34 | 000,864,104 | ---- | M] (NVIDIA Corporation) -- C:Program FilesNVIDIA CorporationDisplaynvxdsync.exe

PRC - [2012.08.30 10:40:00 | 000,382,312 | ---- | M] (NVIDIA Corporation) -- C:Program FilesNVIDIA Corporation3D VisionnvSCPAPISvr.exe

PRC - [2012.08.22 19:35:23 | 001,807,560 | ---- | M] (Adobe Systems, Inc.) -- C:WindowsSystem32MacromedFlashFlashPlayerPlugin_11_4_402_265.exe

PRC - [2012.08.21 12:12:26 | 004,282,728 | ---- | M] (AVAST Software) -- C:Program FilesAVAST SoftwareAvastAvastUI.exe

PRC - [2012.08.21 12:12:25 | 000,044,808 | ---- | M] (AVAST Software) -- C:Program FilesAVAST SoftwareAvastAvastSvc.exe

PRC - [2012.07.27 23:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) -- C:Program FilesCommon FilesAdobeARM1.0armsvc.exe

PRC - [2012.06.28 18:40:52 | 000,074,752 | ---- | M] (Nullsoft, Inc.) -- C:Program FilesWinampwinampa.exe

PRC - [2012.06.28 15:23:00 | 001,022,352 | ---- | M] (BitTorrent, Inc.) -- C:Program FilesuTorrentuTorrent.exe

PRC - [2012.05.28 15:56:36 | 000,288,128 | ---- | M] (IObit) -- C:Program FilesIObitAdvanced SystemCare 5ASCTray.exe

PRC - [2012.05.26 12:04:52 | 000,913,792 | ---- | M] (IObit) -- C:Program FilesIObitAdvanced SystemCare 5ASCService.exe

PRC - [2012.05.24 19:11:34 | 003,487,128 | ---- | M] (Tonec Inc.) -- C:Program FilesInternet Download ManagerIDMan.exe

PRC - [2011.12.04 15:49:45 | 000,938,496 | ---- | M] (Zeyfman Genady) -- C:Program FilesDicterDicterService.exe

PRC - [2011.11.22 20:34:56 | 002,614,784 | ---- | M] (Microsoft Corporation) -- C:Windowsexplorer.exe

PRC - [2011.10.07 12:40:42 | 001,387,288 | ---- | M] (Logitech, Inc.) -- C:Program FilesLogitechSetPointPSetPoint.exe

PRC - [2011.09.27 22:05:24 | 000,149,784 | ---- | M] (Logitech, Inc.) -- C:Program FilesCommon FilesLogiShrdKHAL3KHALMNPR.EXE

PRC - [2010.12.20 16:46:58 | 000,519,744 | ---- | M] (ArcSoft Inc.) -- C:Program FilesArcSoftTotalMedia Theatre 5TotalMedia ServerTM Server.exe

PRC - [2010.05.25 17:58:58 | 000,263,600 | ---- | M] (Tonec Inc.) -- C:Program FilesInternet Download ManagerIEMonitor.exe

PRC - [2010.03.29 20:26:00 | 000,227,712 | ---- | M] (Microsoft Corporation) -- C:Program FilesMicrosoft OfficeOffice14ONENOTEM.EXE

PRC - [2010.03.16 02:58:36 | 000,718,208 | ---- | M] (Microsoft Corporation) -- C:Program FilesMicrosoft OfficeOffice14MSOSYNC.EXE

PRC - [2009.12.24 00:34:20 | 000,370,688 | ---- | M] (StarWind Software) -- C:Program FilesAlcohol SoftAlcohol 120StarWindStarWindServiceAE.exe

PRC - [2009.11.22 23:03:20 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:WindowsSystem32taskhost.exe

PRC - [2009.07.14 04:14:24 | 000,157,184 | ---- | M] (Microsoft Corporation) -- c:program fileswindows defenderMpCmdRun.exe

PRC - [2007.12.14 17:58:30 | 000,241,664 | ---- | M] () -- C:Program FilesPhilipsPhilips SPC230NC WebcamTrayMin230.exe

PRC - [2007.12.10 16:55:26 | 000,323,584 | ---- | M] (PixArt Imaging Incorporation) -- C:WindowsPhilipsSPC230NCMonitor.exe

PRC - [2007.11.01 04:10:55 | 000,270,336 | ---- | M] () -- E:ИГРИLuxor Mega PackLuxorLuxor.exe

PRC - [2007.04.14 01:21:02 | 000,196,608 | ---- | M] (MumboJumbo, LLC) -- E:ИГРИLuxor Mega PackLuxorLuxor.RWG

PRC - [2006.12.29 00:59:22 | 000,045,056 | ---- | M] () -- E:ИГРИLuxor Mega PackLuxorReflexiveArcadeRAW_003.wdt

========== Modules (No Company Name) ==========

MOD - [2012.09.07 18:34:00 | 002,244,064 | ---- | M] () -- C:Program FilesMozilla Firefoxmozjs.dll

MOD - [2012.08.30 10:39:42 | 000,374,120 | ---- | M] () -- C:Program FilesNVIDIA Corporation3D VisionNv3DVStreaming.dll

MOD - [2012.08.22 19:35:23 | 009,813,704 | ---- | M] () -- C:WindowsSystem32MacromedFlashNPSWF32_11_4_402_265.dll

MOD - [2012.05.24 10:45:42 | 000,138,112 | ---- | M] () -- C:Program FilesIObitAdvanced SystemCare 5ASCv5ExtMenu.dll

MOD - [2012.05.11 06:00:22 | 011,494,912 | ---- | M] () -- C:WindowsassemblyNativeImages_v2.0.50727_32mscorlibcabd1cad756dcaf706dfd1abde9a6604mscorlib.ni.dll

MOD - [2011.10.07 12:41:16 | 000,879,896 | ---- | M] () -- C:Program FilesLogitechSetPointPMacrosMacroCore.dll

MOD - [2011.05.28 22:04:56 | 000,140,288 | ---- | M] () -- C:Program FilesWinRARrarext.dll

MOD - [2010.01.30 02:41:12 | 004,254,560 | ---- | M] () -- C:PROGRA~1COMMON~1MICROS~1OFFICE14Culturesoffice.odf

MOD - [2007.12.14 17:58:30 | 000,241,664 | ---- | M] () -- C:Program FilesPhilipsPhilips SPC230NC WebcamTrayMin230.exe

MOD - [2007.11.01 04:10:55 | 000,270,336 | ---- | M] () -- E:ИГРИLuxor Mega PackLuxorLuxor.exe

MOD - [2007.04.12 22:14:02 | 000,962,630 | ---- | M] () -- E:ИГРИLuxor Mega PackLuxorReflexiveArcadeReflexiveArcade.dll

MOD - [2006.12.29 00:59:22 | 000,045,056 | ---- | M] () -- E:ИГРИLuxor Mega PackLuxorReflexiveArcadeRAW_003.wdt

MOD - [2006.12.29 00:48:44 | 000,184,320 | ---- | M] () -- E:ИГРИLuxor Mega PackLuxorui2.dll

MOD - [2006.12.29 00:48:44 | 000,090,112 | ---- | M] () -- E:ИГРИLuxor Mega PackLuxorcrash.dll

MOD - [2006.12.29 00:48:44 | 000,036,864 | ---- | M] () -- E:ИГРИLuxor Mega PackLuxorgfx2d_dx8.dll

MOD - [2006.12.29 00:48:44 | 000,028,672 | ---- | M] () -- E:ИГРИLuxor Mega PackLuxorimglib.dll

MOD - [2006.12.29 00:48:42 | 000,110,592 | ---- | M] () -- E:ИГРИLuxor Mega PackLuxorgfx2d.dll

MOD - [2006.12.29 00:48:42 | 000,098,304 | ---- | M] () -- E:ИГРИLuxor Mega PackLuxorjpeg.dll

MOD - [2006.12.29 00:48:42 | 000,057,406 | ---- | M] () -- E:ИГРИLuxor Mega PackLuxorcore.dll

MOD - [2006.12.29 00:48:42 | 000,049,152 | ---- | M] () -- E:ИГРИLuxor Mega PackLuxorsnd3d.dll

MOD - [2006.12.29 00:48:42 | 000,049,152 | ---- | M] () -- E:ИГРИLuxor Mega PackLuxorlogger.dll

MOD - [2006.12.29 00:48:42 | 000,032,768 | ---- | M] () -- E:ИГРИLuxor Mega PackLuxorsnd3d_fmod.dll

MOD - [2006.12.29 00:48:42 | 000,028,672 | ---- | M] () -- E:ИГРИLuxor Mega PackLuxorfile.dll

========== Services (SafeList) ==========

SRV - File not found [Auto | Stopped] -- -- (RichVideo)

SRV - File not found [On_Demand | Stopped] -- -- (gupdatem)

SRV - File not found [Auto | Stopped] -- -- (gupdate)

SRV - [2012.09.21 07:03:07 | 000,250,288 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:WindowsSystem32MacromedFlashFlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)

SRV - [2012.09.07 18:34:01 | 000,114,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:Program FilesMozilla Maintenance Servicemaintenanceservice.exe -- (MozillaMaintenance)

SRV - [2012.09.07 17:04:46 | 000,676,936 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:Program FilesMalwarebytes' Anti-Malwarembamservice.exe -- (MBAMService)

SRV - [2012.09.07 17:04:46 | 000,399,432 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:Program FilesMalwarebytes' Anti-Malwarembamscheduler.exe -- (MBAMScheduler)

SRV - [2012.08.30 22:13:00 | 001,258,856 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:Program FilesNVIDIA CorporationNVIDIA Update Coredaemonu.exe -- (nvUpdatusService)

SRV - [2012.08.30 10:40:00 | 000,382,312 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:Program FilesNVIDIA Corporation3D VisionnvSCPAPISvr.exe -- (Stereo Service)

SRV - [2012.08.21 12:12:25 | 000,044,808 | ---- | M] (AVAST Software) [Auto | Running] -- C:Program FilesAVAST SoftwareAvastAvastSvc.exe -- (avast! Antivirus)

SRV - [2012.07.27 23:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:Program FilesCommon FilesAdobeARM1.0armsvc.exe -- (AdobeARMservice)

SRV - [2012.06.07 19:12:14 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:Program FilesSkypeUpdaterUpdater.exe -- (SkypeUpdate)

SRV - [2012.05.26 12:04:52 | 000,913,792 | ---- | M] (IObit) [Auto | Running] -- C:Program FilesIObitAdvanced SystemCare 5ASCService.exe -- (AdvancedSystemCareService5)

SRV - [2011.12.20 22:33:46 | 000,176,128 | ---- | M] (Two Pilots) [Auto | Stopped] -- C:WindowsVPDAgent.exe -- (Agent)

SRV - [2011.12.04 15:49:45 | 000,938,496 | ---- | M] (Zeyfman Genady) [Auto | Running] -- C:Program FilesDicterDicterService.exe -- (DicterUpdateService)

SRV - [2011.11.22 20:28:48 | 001,343,400 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:WindowsSystem32WatWatAdminSvc.exe -- (WatAdminSvc)

SRV - [2011.11.02 17:07:06 | 000,655,624 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:Program FilesCommon FilesMacrovision SharedFLEXnet PublisherFNPLicensingService.exe -- (FLEXnet Licensing Service)

SRV - [2011.09.27 22:03:28 | 000,295,192 | ---- | M] (Logitech, Inc.) [On_Demand | Stopped] -- C:Program FilesCommon FilesLogiShrdBluetoothlbtserv.exe -- (LBTServ)

SRV - [2011.05.29 05:56:30 | 000,073,600 | ---- | M] () [Auto | Running] -- C:WindowsSystem32ezGOSvc.dll -- (ezGOSvc)

SRV - [2010.03.25 10:25:22 | 030,969,208 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:Program FilesMicrosoft OfficeOffice14GROOVE.EXE -- (Microsoft SharePoint Workspace Audit Service)

SRV - [2009.12.24 00:34:20 | 000,370,688 | ---- | M] (StarWind Software) [Auto | Running] -- C:Program FilesAlcohol SoftAlcohol 120StarWindStarWindServiceAE.exe -- (StarWindServiceAE)

SRV - [2009.07.14 04:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:WindowsSystem32sensrsvc.dll -- (SensrSvc)

SRV - [2009.07.14 04:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:WindowsSystem32PeerDistSvc.dll -- (PeerDistSvc)

SRV - [2009.07.14 04:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:Program FilesWindows Defendermpsvc.dll -- (WinDefend)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | Auto | Stopped] -- -- (X6XSEx)

DRV - File not found [Kernel | On_Demand | Unknown] -- -- (a2g7ro2s)

DRV - [2012.10.07 19:55:21 | 000,014,080 | ---- | M] () [Kernel | On_Demand | Unknown] -- C:WindowsSystem32driversTrueSight.sys -- (TrueSight)

DRV - [2012.09.07 17:04:46 | 000,022,856 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:WindowsSystem32driversmbam.sys -- (MBAMProtector)

DRV - [2012.08.30 22:13:00 | 010,790,760 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:WindowsSystem32driversnvlddmkm.sys -- (nvlddmkm)

DRV - [2012.08.21 12:13:15 | 000,729,752 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:WindowsSystem32driversaswSnx.sys -- (aswSnx)

DRV - [2012.08.21 12:13:15 | 000,355,632 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:WindowsSystem32driversaswSP.sys -- (aswSP)

DRV - [2012.08.21 12:13:15 | 000,054,232 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:WindowsSystem32driversaswTdi.sys -- (aswTdi)

DRV - [2012.08.21 12:13:14 | 000,058,680 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:WindowsSystem32driversaswMonFlt.sys -- (aswMonFlt)

DRV - [2012.08.21 12:13:14 | 000,044,784 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:WindowsSystem32driversaswRdr2.sys -- (aswRdr)

DRV - [2012.08.21 12:13:13 | 000,021,256 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:WindowsSystem32driversaswFsBlk.sys -- (aswFsBlk)

DRV - [2012.08.14 17:52:36 | 000,137,344 | ---- | M] () [Kernel | Auto | Running] -- C:WindowsSystem32drivershwpsgt.sys -- (hwpsgt)

DRV - [2012.08.14 17:52:15 | 000,009,472 | ---- | M] () [Kernel | Auto | Running] -- C:WindowsSystem32driverslemsgt.sys -- (lemsgt)

DRV - [2012.07.03 18:25:17 | 000,149,352 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:WindowsSystem32driversnvhda32v.sys -- (NVHDA)

DRV - [2012.05.11 07:34:08 | 000,181,432 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:WindowsSystem32driversssudmdm.sys -- (ssudmdm)

DRV - [2012.04.23 16:56:26 | 000,096,056 | ---- | M] (Tonec Inc.) [Kernel | Auto | Running] -- C:WindowsSystem32driversidmwfp.sys -- (IDMWFP)

DRV - [2012.02.16 00:24:36 | 000,080,824 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:WindowsSystem32driversssudbus.sys -- (dg_ssudbus)

DRV - [2011.09.02 09:31:28 | 000,039,192 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:WindowsSystem32driversLMouFilt.Sys -- (LMouFilt)

DRV - [2011.09.02 09:31:20 | 000,041,240 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:WindowsSystem32driversLHidFilt.Sys -- (LHidFilt)

DRV - [2011.07.20 00:43:10 | 000,436,792 | ---- | M] () [Kernel | Boot | Running] -- C:WindowsSystem32driverssptd.sys -- (sptd)

DRV - [2010.12.02 12:13:22 | 000,018,304 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:WindowsSystem32driversccdcmb.sys -- (nmwcd)

DRV - [2010.09.21 09:10:32 | 000,192,504 | ---- | M] () [Kernel | System | Running] -- C:WindowsSystem32driversArcSec.sys -- (ArcSec)

DRV - [2010.01.27 05:09:02 | 000,050,704 | ---- | M] (CACE Technologies, Inc.) [Kernel | Auto | Running] -- C:WindowsSystem32driversnpf.sys -- (npf)

DRV - [2009.12.18 11:58:52 | 000,011,336 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:Program FilesSystemRequirementsLabcpudrv.sys -- (cpudrv)

DRV - [2009.11.22 23:00:57 | 000,035,840 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:WindowsSystem32driverswinusb.sys -- (WinUsb)

DRV - [2009.11.22 22:37:42 | 000,293,904 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:WindowsSystem32driversvpcvmm.sys -- (vpcvmm)

DRV - [2009.11.22 22:37:42 | 000,165,376 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:WindowsSystem32driversvpchbus.sys -- (vpcbus)

DRV - [2009.11.22 22:37:42 | 000,078,336 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:WindowsSystem32driversvpcusb.sys -- (vpcusb)

DRV - [2009.11.22 22:37:42 | 000,055,040 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:WindowsSystem32driversvpcnfltr.sys -- (vpcnfltr)

DRV - [2009.07.14 04:19:10 | 000,175,824 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:WindowsSystem32driversvmbus.sys -- (vmbus)

DRV - [2009.07.14 04:19:10 | 000,040,896 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:WindowsSystem32driversvmstorfl.sys -- (storflt)

DRV - [2009.07.14 04:19:10 | 000,028,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:WindowsSystem32driversstorvsc.sys -- (storvsc)

DRV - [2009.07.14 02:28:47 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:WindowsSystem32driversvms3cap.sys -- (s3cap)

DRV - [2009.07.14 02:28:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:WindowsSystem32driversVMBusHID.sys -- (VMBusHID)

DRV - [2007.12.31 17:19:50 | 000,461,056 | ---- | M] (PixArt Imaging Inc.) [Kernel | On_Demand | Running] -- C:WindowsSystem32driversSPC230NC.SYS -- (SPC230NC)

DRV - [2007.09.26 15:28:46 | 000,008,576 | ---- | M] (PixArt Imaging Incorporation) [Kernel | On_Demand | Running] -- C:WindowsSystem32driversPAEAFLT.sys -- (PAEAFLT.sys)

========== Standard Registry (All) ==========

========== Internet Explorer ==========

IE - HKLMSOFTWAREMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

IE - HKLMSOFTWAREMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

IE - HKLMSOFTWAREMicrosoftInternet ExplorerMain,Default_Secondary_Page_URL = [binary data]

IE - HKLMSOFTWAREMicrosoftInternet ExplorerMain,Extensions Off Page = about:NoAdd-ons

IE - HKLMSOFTWAREMicrosoftInternet ExplorerMain,Local Page = C:WindowsSystem32blank.htm

IE - HKLMSOFTWAREMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

IE - HKLMSOFTWAREMicrosoftInternet ExplorerMain,Security Risk Page = about:SecurityRisk

IE - HKLMSOFTWAREMicrosoftInternet ExplorerMain,Start Page = http://www.google.com

IE - HKLMSOFTWAREMicrosoftInternet ExplorerSearch,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm

IE - HKLMSOFTWAREMicrosoftInternet ExplorerSearch,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm

IE - HKLM..SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKLM..SearchScopes{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKLMSoftwareMicrosoftWindowsCurrentVersionInternet Settings: "ProxyEnable" = 0

IE - HKU.DEFAULTSOFTWAREMicrosoftInternet ExplorerMain,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

IE - HKU.DEFAULTSOFTWAREMicrosoftInternet ExplorerMain,Start Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome

IE - HKU.DEFAULTSoftwareMicrosoftWindowsCurrentVersionInternet Settings: "ProxyEnable" = 0

Това не е целия дневник OTL.Txt ....!

Пробвах отново, но пише, че текста е твърде дълъг.

Прикачете двата дневника OTL.Txt и Extras.Txt в следващия си пост..!

Стартирайте отново OTL, копирайте (Copy) и поставете (Paste) скриптовия текст от текстовото поле по-долу под колонката Custom Scans/Fixes, като не забравяте да копирате скрипта 1 към 1, както и двете точки преди първия ред на скрипта.

:OTL
DRV - File not found [Kernel | On_Demand | Unknown] --  -- (a2g7ro2s)
@Alternate Data Stream - 149 bytes -> C:ProgramDataTEMP:8331D35A
@Alternate Data Stream - 145 bytes -> C:ProgramDataTEMP:1198CD34
@Alternate Data Stream - 112 bytes -> C:ProgramDataTEMP:D1B5B4F1
@Alternate Data Stream - 102 bytes -> C:ProgramDataTEMP:F8104EE7
@Alternate Data Stream - 100 bytes -> C:ProgramDataTEMP:EBC2DB92

:files
recycler /alldrives
ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
[clearallrestorepoints]
[Reboot]

След като въведете скрипта от цитата по-горе натиснете бутона, маркиран в червено: Run Fix

Windows ще се рестартира и ще се създаде лог файл. Публикувайте съдържанието му с Copy/Paste в следващия си коментар.

All processes killed

========== OTL ==========

Error: No service named a2g7ro2s was found to stop!

Registry key HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesa2g7ro2s deleted successfully.

ADS C:ProgramDataTEMP:8331D35A deleted successfully.

ADS C:ProgramDataTEMP:1198CD34 deleted successfully.

ADS C:ProgramDataTEMP:D1B5B4F1 deleted successfully.

ADS C:ProgramDataTEMP:F8104EE7 deleted successfully.

ADS C:ProgramDataTEMP:EBC2DB92 deleted successfully.

========== FILES ==========

recycler not found in C:

recycler not found in D:

recycler not found in E:

< ipconfig /flushdns /c >

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

C:UsersstefanDownloadscmd.bat deleted successfully.

C:UsersstefanDownloadscmd.txt deleted successfully.

========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator

->Temp folder emptied: 0 bytes

User: All Users

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

->Flash cache emptied: 56475 bytes

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

->Flash cache emptied: 0 bytes

User: Desktop

->Temp folder emptied: 0 bytes

User: Public

->Temp folder emptied: 0 bytes

User: stefan

->Temp folder emptied: 7075459 bytes

->Temporary Internet Files folder emptied: 2551912 bytes

->Java cache emptied: 0 bytes

->FireFox cache emptied: 96497868 bytes

->Google Chrome cache emptied: 0 bytes

->Flash cache emptied: 56363 bytes

User: UpdatusUser

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

->Flash cache emptied: 56475 bytes

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%System32 .tmp files removed: 0 bytes

%systemroot%System32drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 9696 bytes

RecycleBin emptied: 0 bytes

Total Files Cleaned = 101,00 mb

Restore point Set: OTL Restore Point

OTL by OldTimer - Version 3.2.69.0 log created on 10072012_214123

FilesFolders moved on Reboot...

File move failed. C:Windowstemp_avast_Webshlock.txt scheduled to be moved on reboot.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

Как е положението сега..?Някъкви проблеми..?

Абсолютно никакви, но ако излезе нещо ще ти пиша. Колкото и да ти благодаря, няма да е достатъчно, а тези, които пишат глупости за познанията ти, могат само да го..........

Стартирайте OTL още веднъж и натиснете бутона CleanUp.

Ще последва рестарт на компютъра ви..!Изтрийте и RogueKiller...!

Това е от мен...!Пожелавам лека вечер и безопасен интернет..!

Благодаря отново, просто нямам думи......!!!

Ице(ако мога така да се обърна)железен си в областта си!!! Всъщност, от твои публикации разбрах за Malwarebytes Anti-Malware и така видях троянеца. Ако не бях ровил тук, сигурно системата щеше да се скапе!!! Радвам се, че ти се зае, защото съм чел главно твои "постове" и някак си ти имах доверие. Не искам да обидя никой. Всички сте №1!!!!!!!!! БЛАГОДАРЯ!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

Редактирано 7 октомври 201213 г. от chochomen (преглед на промените)

Благодаря за доверието..!

Троянеца е под карантина в Malwarebytes Anti-Malware, да го трия или...?

Да, разбира се...!