Ами, получих линка от приятел, усъмних се и затова сканирах файла.. Тъй като антивирусната даде зелена светлина, реших да видя какво толкова е в тоя архив... И от там се почна със спама който скайпа ми започна да праща автоматично до абонатите ми lol is this your new... Опитах доста неща, следвах доста съвети но така и не успях да се отърва от тази гадинка. Форума ми беше препоръчан от приятел, и ето ме на.. Та сега и големия списък: DDS (Ver_2011-09-30.01) - NTFS_x86 Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 10.4.1 Run by Admin at 16:42:24 on 2012-11-05 Microsoft Windows 7 Home Premium 6.1.7600.0.1251.359.1033.18.2804.851 [GMT 2:00] . SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . ============== Running Processes ================ . C:windowssystem32wininit.exe C:windowssystem32lsm.exe C:Windowssystem32nvvsvc.exe C:windowssystem32nvvsvc.exe C:windowssystem32WLANExt.exe C:windowssystem32conhost.exe C:windowsSystem32spoolsv.exe C:Program FilesAnvisoftAnvi Smart DefenderASDSrv.exe C:Program FilesLenovoBluetooth Softwarebtwdins.exe C:Program FilesLenovoReadyCommcommonIGRS.exe C:Program FilesCommon FilesLightScribeLSSrvc.exe C:Program FilesIntelIntel® Management Engine ComponentsLMSLMS.exe C:Program FilesNVIDIA CorporationNVIDIA Updatusdaemonu.exe C:windowssystem32PnkBstrA.exe C:Program FilesQUALCOMMQDLService2kQDLService2kLenovo.exe C:windowsSystem32IgrsSvcs.exe C:ProgramDataSkypeToolbarsSkype C2C Servicec2c_service.exe C:Program FilesCommon FilesMicrosoft SharedWindows LiveWLIDSVC.EXE C:Program FilesMobile Broadband DriversWMCoremini_WMCore.exe C:Program FilesIntelIntel® Rapid Storage TechnologyIAStorDataMgrSvc.exe C:Program FilesCommon FilesMicrosoft SharedWindows LiveWLIDSvcM.exe C:windowssystem32wbemwmiprvse.exe C:windowssystem32taskeng.exe C:Program FilesExpressFilesEFUpdater.exe C:windowssystem32Dwm.exe C:windowsExplorer.EXE C:windowssystem32taskhost.exe C:Program FilesIntelIntel® Rapid Storage TechnologyIAStorIcon.exe C:Program FilesElantechETDCtrl.exe C:Program FilesLenovoEnergy Managementutility.exe C:Program FilesLenovoEnergy ManagementEnergy Management.exe C:Program FilesLenovoYouCamYouCamTray.exe C:Program FilesLenovoVeriFacePManage.exe C:WindowsSystem32igfxtray.exe C:WindowsSystem32hkcmd.exe C:WindowsSystem32igfxpers.exe C:Windowssystem32igfxsrvc.exe C:Program FilesElaborate BytesVirtualCloneDriveVCDDaemon.exe C:Program FilesExpressFilesExpressFiles.exe C:Program FilesCommon FilesJavaJava Updatejusched.exe C:Program FilesAeria GamesIgniteaeriaignite.exe D:Games4StoryPrePatch.exe C:windowssystem32SearchIndexer.exe C:Program FilesAnvisoftAnvi Smart DefenderASDTray.exe C:Program FilesCommon FilesAheadLibNMBgMonitor.exe C:UsersAdminAppDataLocalAkamainetsession_win.exe C:UsersAdminAppDataLocalAkamainetsession_win.exe C:Program FilesLenovoBluetooth SoftwareBTTray.exe C:Program FilesCommon FilesAheadLibNMIndexStoreSvr.exe C:Program FilesMcAfee Security Scan3.0.207SSScheduler.exe C:Program FilesCommon FilesAheadLibNMIndexingService.exe C:Program FilesMozilla Firefoxfirefox.exe C:Program FilesIntelIntel® Management Engine ComponentsUNSUNS.exe C:windowssystem32wuauclt.exe C:Program FilesCommon FilesJavaJava Updatejucheck.exe C:Program FilesSkypePhoneSkype.exe C:Program FilesMozilla Firefoxplugin-container.exe C:windowssystem32MacromedFlashFlashPlayerPlugin_11_4_402_287.exe C:windowssystem32MacromedFlashFlashPlayerPlugin_11_4_402_287.exe C:Program FilesTeamViewerVersion7TeamViewer_Service.exe C:UsersAdminAppDataRoamingF9CF.exe C:windowssystem32conhost.exe C:windowssystem32wbemwmiprvse.exe C:windowssystem32svchost.exe -k DcomLaunch C:windowssystem32svchost.exe -k RPCSS C:windowsSystem32svchost.exe -k LocalServiceNetworkRestricted C:windowsSystem32svchost.exe -k LocalSystemNetworkRestricted C:windowssystem32svchost.exe -k netsvcs C:windowssystem32svchost.exe -k LocalService C:windowssystem32svchost.exe -k NetworkService C:windowssystem32svchost.exe -k LocalServiceNoNetwork C:windowsSystem32svchost.exe -k secsvcs C:windowssystem32svchost.exe -k NetworkServiceNetworkRestricted C:windowssystem32svchost.exe -k LocalServiceAndNoImpersonation C:windowssystem32svchost.exe -k SDRSVC . ============== Pseudo HJT Report =============== . uStart Page = hxxp://isearch.claro-search.com/?affID=114170&tt=3412_1&babsrc=HP_iclro&mntrId=e2ea9912000000000000f0def117a655 uDefault_Page_URL = hxxp://www.lenovo.com uProxyOverride = <local> uURLSearchHooks: {90b49673-5506-483e-b92b-ca0265bd9ca8} - <orphaned> BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:program filescommon filesadobeacrobatactivexAcroIEHelperShim.dll BHO: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:program filesoraclejavafx 2.1 runtimebinssv.dll BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:program filescommon filesmicrosoft sharedwindows liveWindowsLiveLogin.dll BHO: Skype Browser Helper: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - c:program filesskypetoolbarsinternet explorerskypeieplugin.dll BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:program filesoraclejavafx 2.1 runtimebinjp2ssv.dll BHO: Yontoo: {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - c:program filesyontooYontooIEClient.dll uRun: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "c:program filescommon filesaheadlibNMBgMonitor.exe" uRun: [speech Recognition] "c:windowsspeechcommonsapisvr.exe" -SpeechUX -Startup uRun: [Akamai NetSession Interface] "c:usersadminappdatalocalakamainetsession_win.exe" mRun: [iAStorIcon] c:program filesintelintel® rapid storage technologyIAStorIcon.exe mRun: [ETDWare] c:program fileselantechETDCtrl.exe mRun: [EnergyUtility] c:program fileslenovoenergy managementutility.exe mRun: [Energy Management] c:program fileslenovoenergy managementEnergy Management.exe mRun: [Adobe Reader Speed Launcher] "c:program filesadobereader 9.0readerReader_sl.exe" mRun: [uCam_Menu] "c:program fileslenovoyoucammuitransfermuistartmenu.exe" "c:program fileslenovoyoucam" updatewithcreateonce "softwarecyberlinkyoucam3.0" mRun: [YouCam Mirror Tray icon] "c:program fileslenovoyoucamYouCamTray.exe" /s mRun: [updateP2GShortCut] "c:program fileslenovopower2gomuitransfermuistartmenu.exe" "c:program fileslenovopower2go" updatewithcreateonce "softwarecyberlinkpower2go5.0" mRun: [VeriFaceManager] c:program fileslenovoverifacePManage.exe mRun: [igfxTray] c:windowssystem32igfxtray.exe mRun: [HotKeysCmds] c:windowssystem32hkcmd.exe mRun: [Persistence] c:windowssystem32igfxpers.exe mRun: [NvCplDaemon] RUNDLL32.EXE c:windowssystem32NvCpl.dll,NvStartup mRun: [NeroFilterCheck] c:program filescommon filesaheadlibNeroCheck.exe mRun: [VirtualCloneDrive] "c:program fileselaborate bytesvirtualclonedriveVCDDaemon.exe" /s mRun: [ExpressFiles] "c:program filesexpressfilesExpressFiles.exe" -tray mRun: [sunJavaUpdateSched] "c:program filescommon filesjavajava updatejusched.exe" mRun: [AdobeAAMUpdater-1.0] "c:program filescommon filesadobeoobepdappuwaUpdaterStartupUtility.exe" mRun: [switchBoard] c:program filescommon filesadobeswitchboardSwitchBoard.exe mRun: [AdobeCS5ServiceManager] "c:program filescommon filesadobecs5servicemanagerCS5ServiceManager.exe" -launchedbylogin mRun: [Aeria Ignite] "c:program filesaeria gamesigniteaeriaignite.exe" silent mRun: [4StoryPrePatch] d:games4storyPrePatch.exe mRun: [Anvi Smart Defender] c:program filesanvisoftanvi smart defenderASDTray.exe StartupFolder: c:progra~2micros~1windowsstartm~1programsstartupblueto~1.lnk - c:program fileslenovobluetooth softwareBTTray.exe StartupFolder: c:progra~2micros~1windowsstartm~1programsstartupmcafee~1.lnk - c:program filesmcafee security scan3.0.207SSScheduler.exe uPolicies-Explorer: NoDriveTypeAutoRun = dword:145 mPolicies-System: ConsentPromptBehaviorAdmin = dword:0 mPolicies-System: ConsentPromptBehaviorUser = dword:3 mPolicies-System: EnableLUA = dword:0 mPolicies-System: EnableUIADesktopToggle = dword:0 mPolicies-System: PromptOnSecureDesktop = dword:0 IE: E&xport to Microsoft Excel - c:progra~1micros~2office11EXCEL.EXE/3000 IE: Send image to &Bluetooth Device... - c:program fileslenovobluetooth softwarebtsendto_ie_ctx.htm IE: Send page to &Bluetooth Device... - c:program fileslenovobluetooth softwarebtsendto_ie.htm IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:program filesskypetoolbarsinternet explorerskypeieplugin.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:program fileslenovobluetooth softwarebtsendto_ie.htm IE: {d9288080-1baa-4bc4-9cf8-a92d743db949} - c:usersadminappdataroamingmicrosoftwindowsstart menuprogramsimvuRun IMVU.lnk DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab TCP: NameServer = 212.50.10.50 212.50.10.51 192.168.1.1 TCP: Interfaces{05B64030-BB40-4086-8005-BB7516C8343C} : DHCPNameServer = 212.50.10.50 212.50.10.51 192.168.1.1 TCP: Interfaces{1749888E-199B-423D-9B4B-90DC915176DA} : DHCPNameServer = 192.168.1.1 Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:program filesskypetoolbarsinternet explorerskypeieplugin.dll Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:program filescommon filesskypeSkype4COM.dll Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - c:program fileswindows livephoto galleryAlbumDownloadProtocolHandler.dll Notify: igfxcui - igfxdev.dll SSODL: WebCheck - <orphaned> LSA: Security Packages = kerberos msv1_0 schannel wdigest tspkg pku2u livessp . ================= FIREFOX =================== . FF - ProfilePath - c:usersadminappdataroamingmozillafirefoxprofilesiarkkmju.default FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - hxxp://tabs.ultimate-guitar.com/b/bullet_for_my_valentine/say_goodnight_acoustic_ver3_tab.htm|http://www.youtube.com/watch?v=h7sdYQi8DDk|http://www.songsterr.com/a/wsa/theme-songs-pirates-of-the-caribbean-guitar-tab-s83486t0|http://www.songsterr.com/a/wsa/guns-n-roses-don-t-cry-acoustic-guitar-tab-s23298t0|https://www.google.bg/ FF - prefs.js: keyword.URL - hxxp://search.babylon.com/?affID=109980&babsrc=KW_ss&mntrId=e2ea9912000000000000f0def117a655&q=&babsrc=SP_FFUP FF - component: c:program filesmozilla firefoxextensions{82af8dca-6de9-405d-bd5e-43525bdad38a}componentsSkypeFfComponent.dll FF - plugin: c:program filesmozilla firefoxpluginsnpFoxitReaderPlugin.dll FF - plugin: c:program filesoraclejavafx 2.1 runtimebinplugin2npjp2.dll FF - plugin: c:program filespando networksmedia boosternpPandoWebPlugin.dll FF - plugin: c:program fileswindows livephoto galleryNPWLPG.dll FF - plugin: c:windowssystem32macromedflashNPSWF32_11_4_402_287.dll FF - plugin: c:windowssystem32npDeployJava1.dll FF - plugin: c:windowssystem32npmproxy.dll . ---- FIREFOX POLICIES ---- FF - user.js: extensions.BabylonToolbar_i.id - e2ea9912000000000000f0def117a655 FF - user.js: extensions.BabylonToolbar_i.hardId - e2ea9912000000000000f0def117a655 FF - user.js: extensions.BabylonToolbar_i.instlDay - 15441 FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17 FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17 FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.1715:23:07 FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar FF - user.js: extensions.BabylonToolbar_i.aflt - babsst FF - user.js: extensions.BabylonToolbar_i.smplGrp - none FF - user.js: extensions.BabylonToolbar_i.tlbrId - base FF - user.js: extensions.BabylonToolbar_i.newTab - false FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=109980 FF - user.js: extensions.BabylonToolbar_i.babExt - FF - user.js: extensions.BabylonToolbar_i.srcExt - ss FF - user.js: extensions.BabylonToolbar_i.instlRef - sst FF - user.js: extensions.claro.autoRvrt - false FF - user.js: extensions.claro_i.newTab - false FF - user.js: extensions.claro.id - e2ea9912000000000000f0def117a655 FF - user.js: extensions.claro.instlDay - 15574 FF - user.js: extensions.claro.vrsn - 1.6.4.1 FF - user.js: extensions.claro.vrsni - 1.6.4.1 FF - user.js: extensions.claro_i.vrsnTs - 1.6.4.111:02:36 FF - user.js: extensions.claro.prtnrId - claro FF - user.js: extensions.claro.prdct - claro FF - user.js: extensions.claro.aflt - babsst FF - user.js: extensions.claro_i.smplGrp - none FF - user.js: extensions.claro.tlbrId - iclaro FF - user.js: extensions.claro.instlRef - sst FF - user.js: extensions.claro.dfltLng - en FF - user.js: extensions.claro.excTlbr - false FF - user.js: extensions.claro.admin - false FF - user.js: extentions.y2layers.installId - 5bd5c82f-da1d-49d1-abb4-c1584b91b9bc FF - user.js: extentions.y2layers.defaultEnableAppsList - DropDownDeals,buzzdock,YontooNewOffers . FF - user.js: extensions.autoDisableScopes - 14 . ============= SERVICES / DRIVERS =============== . R1 asdrm;asdrm;c:windowssystem32driversasdrm.sys [2012-11-4 16208] R1 vwififlt;Virtual WiFi Filter Driver;c:windowssystem32driversvwififlt.sys [2009-7-14 48128] R2 asdrs;AntiMalware Host-based Intrusion Prevention System;c:windowssystem32driversasdrs.sys [2012-11-4 22864] R2 asdsrv;Anvi Smart Defender Realtime Guard Service;c:program filesanvisoftanvi smart defenderASDSrv.exe [2012-8-23 686896] R2 asdws;AnviSmartDefender Web Guard;c:windowssystem32driversasdws.sys [2012-11-4 14160] R2 FPSensor;EgisTec-Corp Fingerprint Reader Driver (FPSensor.sys);c:windowssystem32driversFPSensor.sys [2011-7-13 29232] R2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:program filesintelintel® rapid storage technologyIAStorDataMgrSvc.exe [2010-3-24 13336] R2 IGRS;IGRS;c:program fileslenovoreadycommcommonIGRS.exe [2009-7-14 38152] R2 nvUpdatusService;NVIDIA Update Service Daemon;c:program filesnvidia corporationnvidia updatusdaemonu.exe [2011-7-13 1800808] R2 QDLService2kLenovo;Qualcomm Gobi 2000 Download Service (Lenovo);c:program filesqualcommqdlservice2kQDLService2kLenovo.exe [2009-11-24 331512] R2 ReadyComm.DirectRouter;ReadyComm.DirectRouter;c:windowssystem32igrssvcs.exe -k igrssvcs --> c:windowssystem32IgrsSvcs.exe -k IgrsSvcs [?] R2 Skype C2C Service;Skype C2C Service;c:programdataskypetoolbarsskype c2c servicec2c_service.exe [2012-8-13 3064000] R2 TeamViewer7;TeamViewer 7;c:program filesteamviewerversion7TeamViewer_Service.exe [2012-11-5 2848168] R2 UNS;Intel® Management & Security Application User Notification Service;c:program filesintelintel® management engine componentsunsUNS.exe [2010-3-24 2320920] R2 WMCoreService;Mobile Broadband Core Service;c:program filesmobile broadband driverswmcoremini_WMCore.exe [2009-9-24 430080] R3 ACPIVPC;Lenovo Virtual Power Controller Driver;c:windowssystem32driversAcpiVpc.sys [2010-3-24 21256] R3 ETD;ELAN PS/2 Port Input Device;c:windowssystem32driversETD.sys [2010-3-24 119296] R3 Impcd;Impcd;c:windowssystem32driversImpcd.sys [2010-3-24 125696] R3 IntcDAud;Intel® Display Audio;c:windowssystem32driversIntcDAud.sys [2010-3-24 209920] R3 L1C;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller (NDIS 6.20);c:windowssystem32driversL1C62x86.sys [2009-6-10 50688] R3 wdmirror;wdmirror;c:windowssystem32driversWDMirror.sys [2010-3-24 11792] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:windowsmicrosoft.netframeworkv4.0.30319mscorsvw.exe [2010-3-18 130384] S2 SkypeUpdate;Skype Updater;c:program filesskypeupdaterUpdater.exe [2012-6-7 160944] S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:windowssystem32driversb57nd60x.sys [2009-7-14 229888] S3 Bridge0;Bridge0;c:windowssystem32driverswdbridge.sys [2010-3-24 63240] S3 btusbflt;Bluetooth USB Filter;c:windowssystem32driversbtusbflt.sys [2010-3-24 43944] S3 btwl2cap;Bluetooth L2CAP Service;c:windowssystem32driversbtwl2cap.sys [2010-3-24 29472] S3 e36gbus;F3607gw Mobile Broadband Device driver (Win7);c:windowssystem32driverse36gbus.sys [2010-3-24 285056] S3 e36gmgmt;F3607gw Mobile Broadband Device Management Drivers (Win7);c:windowssystem32driverse36gmgmt.sys [2010-3-24 357376] S3 e36wgps;Mobile Broadband GPS Port;c:windowssystem32driverse36wgps.sys [2010-3-24 82984] S3 ecnssndis;Service for enabling selective suspend to NDIS device;c:windowssystem32driverswwanuss.sys [2010-3-24 10240] S3 ecnssndisfltr;SSNDIS filter service;c:windowssystem32driverswwanussf.sys [2010-3-24 14848] S3 hwusbdev;Huawei DataCard USB PNP Device;c:windowssystem32driversewusbdev.sys [2010-3-24 101120] S3 Lc57XX_AutoEjecDiskDrv;Lc57XX Auto-Eject Disk Monitor Filter Driver;c:windowssystem32driversLc57XX_AutoEjectCD.sys [2010-3-24 8192] S3 LC57XXPORTS_DS;LC57XX Port Interface driver DS;c:windowssystem32driverslc57xx_port_ds.sys [2010-3-24 67072] S3 LC57XXPORTS_SS;LC57XX Port Interface driver SS;c:windowssystem32driverslc57xx_port_ss.sys [2010-3-24 67072] S3 Lenovo ReadyComm AppSvc;Lenovo ReadyComm AppSvc;c:program fileslenovoreadycommAppSvc.exe [2010-3-24 509192] S3 Lenovo ReadyComm ConnSvc;Lenovo ReadyComm ConnSvc;c:program fileslenovoreadycommConnSvc.exe [2010-3-24 579400] S3 Lenovo_AutoEjecDiskDrv;Lenovo Auto-Eject Disk Monitor Filter Driver;c:windowssystem32driversLenovo_AutoEjectCD.sys [2010-3-24 7680] S3 LENOVO_TD2XX_USBVCOM_SERVICE;Lenovo TD2XX Usb Virtual Serial Service;c:windowssystem32driversLenovoVcom.sys [2010-3-24 67072] S3 McComponentHostService;McAfee Security Scan Component Host Service;c:program filesmcafee security scan3.0.207McCHSvc.exe [2011-6-17 237008] S3 MozillaMaintenance;Mozilla Maintenance Service;c:program filesmozilla maintenance servicemaintenanceservice.exe [2012-10-15 115168] S3 npggsvc;nProtect GameGuard Service;c:windowssystem32gamemon.des -service --> c:windowssystem32GameMon.des -service [?] S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:windowssystem32driversnvhda32v.sys [2010-3-24 66664] S3 PS_MDP;ReadyComm Presentation Space Helper Service;c:windowssystem32igrssvcs.exe -k igrssvcs --> c:windowssystem32IgrsSvcs.exe -k IgrsSvcs [?] S3 qcfilterlno2k;Gobi 2000 USB Composite Device Filter Driver(05C6-9205);c:windowssystem32driversqcfilterlno2k.sys [2009-11-24 5248] S3 qcusbserlno2k;Gobi 2000 USB Device for Legacy Serial Communication(05C6-9205);c:windowssystem32driversqcusbserlno2k.sys [2009-11-24 106368] S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:windowssystem32driversRtsUStor.sys [2010-3-24 182304] S3 RTL8167;Realtek 8167 NT Driver;c:windowssystem32driversRt86win7.sys [2010-3-24 189440] S3 SwitchBoard;SwitchBoard;c:program filescommon filesadobeswitchboardSwitchBoard.exe [2010-2-19 517096] S3 WatAdminSvc;Windows Activation Technologies Service;c:windowssystem32watWatAdminSvc.exe [2011-7-29 1343400] S3 wsvd;wsvd;c:windowssystem32driverswsvd.sys [2009-7-22 81704] S3 zte_bus;ZTE Composite Device driver (WDM);c:windowssystem32driverszte_bus.sys [2010-3-24 95488] S3 zte_mdm;ZTE CMCC AT Interface Drivers;c:windowssystem32driverszte_mdm.sys [2010-3-24 121728] S3 zte_tat;ZTE TAT Interface Drivers (WDM);c:windowssystem32driverszte_tat.sys [2010-3-24 109696] S3 zte_trce;ZTE Trace Interface Driver (WDM);c:windowssystem32driverszte_trce.sys [2010-3-24 117760] S3 ztemtusbsernotebook;ZTEMT Legacy Serial Communication NoteBook;c:windowssystem32driversCT_ZTEMT_U_USBSER_NOTEBOOK.sys [2010-3-24 106752] . =============== Created Last 30 ================ . 2012-11-05 14:36:29 93696 ----a-w- c:usersadminappdataroamingF9CF.exe 2012-11-05 14:16:59 -------- d-----w- c:program filesTeamViewer 2012-11-05 14:07:15 93696 ----a-w- c:usersadminappdataroaming37B7.exe 2012-11-05 13:40:25 93696 ----a-w- c:usersadminappdataroamingA72B.exe 2012-11-05 13:13:36 93696 ----a-w- c:usersadminappdataroaming19D8.exe 2012-11-05 12:42:15 93696 ----a-w- c:usersadminappdataroaming64BB.exe 2012-11-04 19:14:08 -------- d-----w- c:usersadminappdataroamingAnvisoft 2012-11-04 19:14:00 22864 ----a-w- c:windowssystem32driversasdrs.sys 2012-11-04 19:14:00 16208 ----a-w- c:windowssystem32driversasdrm.sys 2012-11-04 19:14:00 14160 ----a-w- c:windowssystem32driversasdws.sys 2012-11-04 19:14:00 -------- d-----w- c:programdataAnvisoft 2012-11-04 19:13:58 -------- d-----w- c:program filesAnvisoft 2012-11-04 18:39:52 91136 ----a-w- c:usersadminappdataroaming20FD.exe 2012-11-04 18:13:00 91136 ----a-w- c:usersadminappdataroaming8B51.exe 2012-11-04 17:27:57 369 ----a-w- c:usersadminappdataroaming4CAA.exe 2012-11-04 16:29:06 369 ----a-w- c:usersadminappdataroaming694C.exe 2012-11-04 15:19:12 0 ----a-w- c:usersadminappdataroaming6A92.exe 2012-11-04 14:40:39 91136 ----a-w- c:usersadminappdataroaming1F10.exe 2012-11-04 14:26:41 91136 ----a-w- c:usersadminappdataroaming5598.exe 2012-11-04 05:13:03 56200 ----a-w- c:programdatamicrosoftwindows defenderdefinition updates{e1800c12-7c7f-442b-867f-68967a3b25dd}offreg.dll 2012-11-04 05:06:14 -------- d-----w- c:program filesYontoo 2012-11-04 05:06:13 -------- d-----w- c:programdataTarma Installer 2012-11-02 19:07:33 6918632 ----a-w- c:programdatamicrosoftwindows defenderdefinition updates{e1800c12-7c7f-442b-867f-68967a3b25dd}mpengine.dll 2012-10-15 11:26:41 -------- d-----w- c:program filesMozilla Maintenance Service 2012-10-14 15:48:53 -------- d-----w- c:programdataMcAfee Security Scan 2012-10-14 15:48:51 -------- d-----w- c:program filesMcAfee Security Scan . ==================== Find3M ==================== . 2012-10-15 11:14:41 73656 ----a-w- c:windowssystem32FlashPlayerCPLApp.cpl 2012-10-15 11:14:41 696760 ----a-w- c:windowssystem32FlashPlayerApp.exe 2012-09-14 18:30:38 2048 ----a-w- c:windowssystem32tzres.dll 2012-08-31 17:21:56 1210736 ----a-w- c:windowssystem32driversntfs.sys 2012-08-30 17:18:33 3958128 ----a-w- c:windowssystem32ntkrnlpa.exe 2012-08-30 17:18:33 3902832 ----a-w- c:windowssystem32ntoskrnl.exe 2012-08-24 17:10:47 172544 ----a-w- c:windowssystem32wintrust.dll 2012-08-24 06:59:17 1800704 ----a-w- c:windowssystem32jscript9.dll 2012-08-24 06:51:27 1129472 ----a-w- c:windowssystem32wininet.dll 2012-08-24 06:51:02 1427968 ----a-w- c:windowssystem32inetcpl.cpl 2012-08-24 06:47:26 142848 ----a-w- c:windowssystem32ieUnatt.exe 2012-08-24 06:47:12 420864 ----a-w- c:windowssystem32vbscript.dll 2012-08-24 06:43:58 2382848 ----a-w- c:windowssystem32mshtml.tlb 2012-08-18 11:23:05 169984 ----a-w- c:windowssystem32winsrv.dll 2012-08-18 11:21:20 293376 ----a-w- c:windowssystem32KernelBase.dll 2012-08-18 11:18:47 271360 ----a-w- c:windowssystem32conhost.exe 2012-08-18 09:07:02 6144 ---ha-w- c:windowssystem32api-ms-win-security-base-l1-1-0.dll 2012-08-18 09:07:02 4608 ---ha-w- c:windowssystem32api-ms-win-core-threadpool-l1-1-0.dll 2012-08-18 09:07:02 3584 ---ha-w- c:windowssystem32api-ms-win-core-xstate-l1-1-0.dll 2012-08-18 09:07:02 3072 ---ha-w- c:windowssystem32api-ms-win-core-util-l1-1-0.dll 2012-08-10 23:54:04 541184 ----a-w- c:windowssystem32kerberos.dll . ============= FINISH: 16:43:40,91 =============== П.П. Малко странно предполагам, обаче въпросната програмка ми остави само dds.txt на десктопа, без attach.txt. Ако липсва някоя важна информация, мога да допълня надявам се. Благодаря предварително за отделеното време и помощта. М мерси на luckyboy, намерих фантом-отметката, не мога да я копна понеже се получавало твърде дълъг пост.. Е предпологам че ако ми я поискат мога да добавя като отговор...

Редактирано 5 ноември 201213 г. от Джим (преглед на промените)

П.П. Малко странно предполагам, обаче въпросната програмка ми остави само dds.txt на десктопа, без attach.txt. Ако липсва някоя важна информация, мога да допълня надявам се.

Сложи отметката!

Здравейте..!

Изтеглете и стартирайте програмата AdwCleaner (by Xplode).

• Затворете всички стартирани програми и браузъри
• Кликнете два пъти върху adwcleaner.exe за да стартирате инструмента.
• Този път маркирайте Delete
• Вашият компютър ще се рестартира автоматично. Текстовия файл ще се отвори след рестарта.
• Моля, да публикувате съдържанието на този лог в отговора си
• Можете да намерите лога,който автоматично се запомня тук C:AdwCleaner[s1].txt.

Заповядайте # AdwCleaner v2.007 - Logfile created 11/07/2012 at 14:00:27 # Updated 06/11/2012 by Xplode # Operating system : Windows 7 Home Premium (32 bits) # User : Admin - ADMIN-PC # Boot Mode : Normal # Running from : C:UsersAdminDownloadsadwcleaner.exe # Option [Delete] ***** [services] ***** ***** [Files / Folders] ***** File Deleted : C:Program FilesMozilla FireFoxComponentsAskSearch.js File Deleted : C:Program FilesMozilla Firefoxsearchpluginsbabylon.xml File Deleted : C:user.js File Deleted : C:UsersAdminAppDataRoamingMozillaFirefoxProfilesiarkkmju.defaultsearchpluginsdaemon-search.xml Folder Deleted : C:Program FilesConduit Folder Deleted : C:Program FilesDAEMON Tools Toolbar Folder Deleted : C:Program FilesYontoo Folder Deleted : C:ProgramDataBabylon Folder Deleted : C:ProgramDataInstallMate Folder Deleted : C:ProgramDataPremium Folder Deleted : C:ProgramDataTarma Installer Folder Deleted : C:ProgramDataTheBflix Folder Deleted : C:UsersAdminAppDataLocalConduit Folder Deleted : C:UsersAdminAppDataLocalTempBabylonToolbar Folder Deleted : C:UsersAdminAppDataLocalLowClaro LTD Folder Deleted : C:UsersAdminAppDataLocalLowConduit Folder Deleted : C:UsersAdminAppDataRoamingBabylon Folder Deleted : C:UsersAdminAppDataRoamingBabylonToolbar Folder Deleted : C:UsersAdminAppDataRoamingMozillaFirefoxProfilesiarkkmju.defaultextensionsplugin@yontoo.com ***** [Registry] ***** Key Deleted : HKCUSoftwareAppDataLowSoftwareSmartBar Key Deleted : HKCUSoftwareConduit Key Deleted : HKCUSoftwareHeadlight Key Deleted : HKCUSoftwareMicrosoftBabylon Key Deleted : HKCUSoftwareMicrosoftInternet ExplorerSearchScopes{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9} Key Deleted : HKCUSoftwareMicrosoftInternet ExplorerSearchScopes{AD22EBAF-0D18-4FC7-90CC-5EA0ABBE9EB8} Key Deleted : HKCUSoftwareMicrosoftInternet ExplorerSearchScopes{CF739809-1C6C-47C0-85B9-569DBB141420} Key Deleted : HKCUSoftwareMicrosoftWindowsCurrentVersionExtSettings{000F18F2-09EB-4A59-82B2-5AE4184C39C3} Key Deleted : HKCUSoftwareMicrosoftWindowsCurrentVersionExtSettings{201F27D4-3704-41D6-89C1-AA35E39143ED} Key Deleted : HKCUSoftwareMicrosoftWindowsCurrentVersionExtSettings{3041D03E-FD4B-44E0-B742-2D9B88305F98} Key Deleted : HKCUSoftwareMicrosoftWindowsCurrentVersionExtSettings{9E131A93-EED7-4BEB-B015-A0ADB30B5646} Key Deleted : HKCUSoftwareMicrosoftWindowsCurrentVersionExtSettings{B0DE3308-5D5A-470D-81B9-634FC078393B} Key Deleted : HKCUSoftwareMicrosoftWindowsCurrentVersionExtSettings{F3FEE66E-E034-436A-86E4-9690573BEE8A} Key Deleted : HKCUSoftwareMicrosoftWindowsCurrentVersionExtStats{000F18F2-09EB-4A59-82B2-5AE4184C39C3} Key Deleted : HKCUSoftwareMicrosoftWindowsCurrentVersionExtStats{201F27D4-3704-41D6-89C1-AA35E39143ED} Key Deleted : HKCUSoftwareMicrosoftWindowsCurrentVersionExtStats{3041D03E-FD4B-44E0-B742-2D9B88305F98} Key Deleted : HKCUSoftwareMicrosoftWindowsCurrentVersionExtStats{9E131A93-EED7-4BEB-B015-A0ADB30B5646} Key Deleted : HKCUSoftwareMicrosoftWindowsCurrentVersionExtStats{F3FEE66E-E034-436A-86E4-9690573BEE8A} Key Deleted : HKCUSoftwareSoftonic Key Deleted : HKCUSoftwareZugo Key Deleted : HKLMSoftwareBabylon Key Deleted : HKLMSoftwareBabylonToolbar Key Deleted : HKLMSOFTWAREClassesAppID{5B1881D1-D9C7-46DF-B041-1E593282C7D0} Key Deleted : HKLMSOFTWAREClassesAppID{608D3067-77E8-463D-9084-908966806826} Key Deleted : HKLMSOFTWAREClassesAppID{BDB69379-802F-4EAF-B541-F8DE92DD98DB} Key Deleted : HKLMSOFTWAREClassesAppID{CFDAFE39-20CE-451D-BD45-A37452F39CF0} Key Deleted : HKLMSOFTWAREClassesAppID{EA28B360-05E0-4F93-8150-02891F1D8D3C} Key Deleted : HKLMSOFTWAREClassesAppIDYontooIEClient.DLL Key Deleted : HKLMSOFTWAREClassesCLSID{10DE7085-6A1E-4D41-A7BF-9AF93E351401} Key Deleted : HKLMSOFTWAREClassesCLSID{2EECD738-5844-4A99-B4B6-146BF802613B} Key Deleted : HKLMSOFTWAREClassesCLSID{3C471948-F874-49F5-B338-4F214A2EE0B1} Key Deleted : HKLMSOFTWAREClassesCLSID{7E84186E-B5DE-4226-8A66-6E49C6B511B4} Key Deleted : HKLMSOFTWAREClassesCLSID{80922EE0-8A76-46AE-95D5-BD3C3FE0708D} Key Deleted : HKLMSOFTWAREClassesCLSID{DF7770F7-832F-4BDF-B144-100EDDD0C3AE} Key Deleted : HKLMSOFTWAREClassesCLSID{E46C8196-B634-44A1-AF6E-957C64278AB1} Key Deleted : HKLMSOFTWAREClassesCLSID{FD72061E-9FDE-484D-A58A-0BAB4151CAD8} Key Deleted : HKLMSOFTWAREClassesCLSID{FE9271F2-6EFD-44B0-A826-84C829536E93} Key Deleted : HKLMSOFTWAREClassesInstallerProducts3192AA38321C641458DBDAF83979D193 Key Deleted : HKLMSOFTWAREClassesInterface{10DE7085-6A1E-4D41-A7BF-9AF93E351401} Key Deleted : HKLMSOFTWAREClassesInterface{1AD27395-1659-4DFF-A319-2CFA243861A5} Key Deleted : HKLMSOFTWAREClassesProd.cap Key Deleted : HKLMSOFTWAREClassesToolbar.CT2612669 Key Deleted : HKLMSOFTWAREClassesTypeLib{D372567D-67C1-4B29-B3F0-159B52B3E967} Key Deleted : HKLMSOFTWAREClassesYontooIEClient.Api Key Deleted : HKLMSOFTWAREClassesYontooIEClient.Api.1 Key Deleted : HKLMSOFTWAREClassesYontooIEClient.Layers Key Deleted : HKLMSOFTWAREClassesYontooIEClient.Layers.1 Key Deleted : HKLMSoftwareConduit Key Deleted : HKLMSOFTWAREGoogleChromeExtensionsdhkplhfnhceodhffomolpfigojocbpcb Key Deleted : HKLMSOFTWAREGoogleChromeExtensionsniapdbllcanepiiimjjndipklodoedlc Key Deleted : HKLMSoftwareIminent Key Deleted : HKLMSOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{FD72061E-9FDE-484D-A58A-0BAB4151CAD8} Key Deleted : HKLMSOFTWAREMicrosoftWindowsCurrentVersionExtPreApproved{DF7770F7-832F-4BDF-B144-100EDDD0C3AE} Key Deleted : HKLMSOFTWAREMicrosoftWindowsCurrentVersionInstallerUserDataS-1-5-18Products3192AA38321C641458DBDAF83979D193 Key Deleted : HKLMSOFTWAREMicrosoftWindowsCurrentVersionUninstall{83AA2913-C123-4146-85BD-AD8F93971D39} Key Deleted : HKLMSOFTWAREMicrosoftWindowsCurrentVersionUninstall{889DF117-14D1-44EE-9F31-C5FB5D47F68B} Key Deleted : HKLMSoftwareTarma Installer ***** [internet Browsers] ***** - Internet Explorer v9.0.8112.16421 Replaced : [HKCUSoftwareMicrosoftInternet ExplorerMain - Start Page] = hxxp://isearch.claro-search.com/?affID=114170&tt=3412_1&babsrc=HP_iclro&mntrId=e2ea9912000000000000f0def117a655 --> hxxp://www.google.com Replaced : [HKCUSoftwareMicrosoftInternet ExplorerMain - Secondary Start Pages] = hxxp://search.babylon.com/?affid=109980&babsrc=hp_ss&mntrid=e2ea9912000000000000f0def117a655 --> hxxp://www.google.com - Mozilla Firefox v16.0.2 (en-US) Profile name : default File : C:UsersAdminAppDataRoamingMozillaFirefoxProfilesiarkkmju.defaultprefs.js C:UsersAdminAppDataRoamingMozillaFirefoxProfilesiarkkmju.defaultuser.js ... Deleted ! Deleted : user_pref("browser.babylon.HPOnNewTab", "search.babylon.com"); Deleted : user_pref("browser.newtab.url", "hxxp://isearch.claro-search.com/?affID=114170&tt=3412_1&babsrc=NT_i[...] Deleted : user_pref("browser.search.order.1", "Claro Search"); Deleted : user_pref("extensions.4f807b1f7fecf.scode", "(function(){try{if('aol.com,mail.google.com,mystart.inc[...] Deleted : user_pref("extensions.BabylonToolbar.admin", false); Deleted : user_pref("extensions.BabylonToolbar.aflt", "babsst"); Deleted : user_pref("extensions.BabylonToolbar.babExt", ""); Deleted : user_pref("extensions.BabylonToolbar.babTrack", "affID=109980"); Deleted : user_pref("extensions.BabylonToolbar.bbDpng", 15); Deleted : user_pref("extensions.BabylonToolbar.dfltLng", "en"); Deleted : user_pref("extensions.BabylonToolbar.dfltSrch", true); Deleted : user_pref("extensions.BabylonToolbar.hmpg", true); Deleted : user_pref("extensions.BabylonToolbar.id", "e2ea9912000000000000f0def117a655"); Deleted : user_pref("extensions.BabylonToolbar.instlDay", "15441"); Deleted : user_pref("extensions.BabylonToolbar.instlRef", "sst"); Deleted : user_pref("extensions.BabylonToolbar.keyWordUrl", "hxxp://search.babylon.com/?affID=109980&babsrc=KW[...] Deleted : user_pref("extensions.BabylonToolbar.lastDP", 15); Deleted : user_pref("extensions.BabylonToolbar.lastVrsnTs", "1.5.3.1715:23:07"); Deleted : user_pref("extensions.BabylonToolbar.mntrFFxVrsn", "3.6"); Deleted : user_pref("extensions.BabylonToolbar.newTab", true); Deleted : user_pref("extensions.BabylonToolbar.newTabUrl", "hxxp://search.babylon.com/?babsrc=NT_FFUP"); Deleted : user_pref("extensions.BabylonToolbar.noFFXTlbr", false); Deleted : user_pref("extensions.BabylonToolbar.prdct", "BabylonToolbar"); Deleted : user_pref("extensions.BabylonToolbar.propectorlck", 88860294); Deleted : user_pref("extensions.BabylonToolbar.prtkDS", 0); Deleted : user_pref("extensions.BabylonToolbar.prtkHmpg", 0); Deleted : user_pref("extensions.BabylonToolbar.prtnrId", "babylon"); Deleted : user_pref("extensions.BabylonToolbar.ptch_0717", true); Deleted : user_pref("extensions.BabylonToolbar.smplGrp", "azb"); Deleted : user_pref("extensions.BabylonToolbar.srcExt", "ss"); Deleted : user_pref("extensions.BabylonToolbar.srchPrvdr", "Search the web (Babylon)"); Deleted : user_pref("extensions.BabylonToolbar.tlbrId", "base"); Deleted : user_pref("extensions.BabylonToolbar.vrsn", "1.5.3.17"); Deleted : user_pref("extensions.BabylonToolbar.vrsnTs", "1.5.3.1715:23:07"); Deleted : user_pref("extensions.BabylonToolbar.vrsni", "1.5.3.17"); Deleted : user_pref("extensions.BabylonToolbar_i.aflt", "babsst"); Deleted : user_pref("extensions.BabylonToolbar_i.babExt", ""); Deleted : user_pref("extensions.BabylonToolbar_i.babTrack", "affID=109980"); Deleted : user_pref("extensions.BabylonToolbar_i.hardId", "e2ea9912000000000000f0def117a655"); Deleted : user_pref("extensions.BabylonToolbar_i.id", "e2ea9912000000000000f0def117a655"); Deleted : user_pref("extensions.BabylonToolbar_i.instlDay", "15441"); Deleted : user_pref("extensions.BabylonToolbar_i.instlRef", "sst"); Deleted : user_pref("extensions.BabylonToolbar_i.newTab", false); Deleted : user_pref("extensions.BabylonToolbar_i.prdct", "BabylonToolbar"); Deleted : user_pref("extensions.BabylonToolbar_i.prtnrId", "babylon"); Deleted : user_pref("extensions.BabylonToolbar_i.smplGrp", "none"); Deleted : user_pref("extensions.BabylonToolbar_i.srcExt", "ss"); Deleted : user_pref("extensions.BabylonToolbar_i.tlbrId", "base"); Deleted : user_pref("extensions.BabylonToolbar_i.vrsn", "1.5.3.17"); Deleted : user_pref("extensions.BabylonToolbar_i.vrsnTs", "1.5.3.1715:23:07"); Deleted : user_pref("extensions.BabylonToolbar_i.vrsni", "1.5.3.17"); Deleted : user_pref("extensions.claro.admin", false); Deleted : user_pref("extensions.claro.aflt", "babsst"); Deleted : user_pref("extensions.claro.autoRvrt", "false"); Deleted : user_pref("extensions.claro.cntry", "BG"); Deleted : user_pref("extensions.claro.dfltLng", "en"); Deleted : user_pref("extensions.claro.envrmnt", "production"); Deleted : user_pref("extensions.claro.excTlbr", false); Deleted : user_pref("extensions.claro.hdrMd5", "5FDB6B6049B7C67AEEBA79320D330057"); Deleted : user_pref("extensions.claro.hmpg", false); Deleted : user_pref("extensions.claro.id", "e2ea9912000000000000f0def117a655"); Deleted : user_pref("extensions.claro.instlDay", "15574"); Deleted : user_pref("extensions.claro.instlRef", "sst"); Deleted : user_pref("extensions.claro.lastVrsnTs", "1.6.4.111:02:36"); Deleted : user_pref("extensions.claro.mntrvrsn", "1.3.1"); Deleted : user_pref("extensions.claro.newTab", false); Deleted : user_pref("extensions.claro.prdct", "claro"); Deleted : user_pref("extensions.claro.prtnrId", "claro"); Deleted : user_pref("extensions.claro.sg", "none"); Deleted : user_pref("extensions.claro.smplGrp", "none"); Deleted : user_pref("extensions.claro.tlbrId", "iclaro"); Deleted : user_pref("extensions.claro.vrsn", "1.6.4.1"); Deleted : user_pref("extensions.claro.vrsnTs", "1.6.4.111:02:36"); Deleted : user_pref("extensions.claro.vrsni", "1.6.4.1"); Deleted : user_pref("extensions.claro_i.newTab", false); Deleted : user_pref("extensions.claro_i.smplGrp", "none"); Deleted : user_pref("extensions.claro_i.vrsnTs", "1.6.4.111:02:36"); Deleted : user_pref("keyword.URL", "hxxp://search.babylon.com/?affID=109980&babsrc=KW_ss&mntrId=e2ea9912000000[...] - Google Chrome v [unable to get version] File : C:UsersAdminAppDataLocalGoogleChromeUser DataDefaultPreferences Deleted [l.21] : icon_url = "hxxp://www.daemon-search.com/favicon.ico", Deleted [l.24] : keyword = "my.daemon-search.com", Deleted [l.27] : search_url = "hxxp://www.daemon-search.com/search?q={searchTerms}", ************************* AdwCleaner[s1].txt - [12803 octets] - [07/11/2012 14:00:27] ########## EOF - C:AdwCleaner[s1].txt - [12864 octets] ##########

Прекрасно..!

Изтеглете ComboFix от тук и го запазете на десктопа си.

• Изключете вашата антивирусна и антишпионска програма, обикновено това става чрез натискане на десния бутон на мишката върху иконата на програма в системния трей.

Бележка: Ако не можете я спрете или не сте сигурни коя програма да изключите, моля прегледайте информацията от този линк: How to Disable your Security Programs

• Стартирайте Combo-Fix.com и следвайте инструкциите.

Бележка: ComboFix ще се стартира без инсталирана Recovery Console.

• Като част от неговата работа, ComboFix ще провери дали Microsoft Windows Recovery Console е инсталирана. Предвид бързо развиващия се зловреден софтуер е силно препоръчително да бъде инсталирана преди премахването на зловредния софтуер. Това ще Ви позволи да влезете в специален recovery/repair режим, който ще ни позволи по-лесно да решите проблем, който би могъл да възникне при премахване на зловредния софтуер.

• Следвайте инструкциите, за да позволите на ComboFix да изтегли и инсталира Microsoft Windows Recovery Console. В един момент ще бъдете попитани дали сте съгласни с лицензното споразумение. Необходимо е да потвърдите, че сте съгласни, за да инсталирате Microsoft Windows Recovery Console.

** Забележете: Ако Microsoft Windows Recovery Console е вече инсталирана, ComboFix ще продължи към процеса по премахване на зловредния софтуер.

След като Microsoft Windows Recovery Console е инсталирана, използвайки ComboFix, Вие ще видите следното съобщение:

Изберете Yes, за да продължи сканирането за зловреден софтуер.

Когато процесът приключи успешно, инструментът ще създаде лог файл. Моля, включете съдържанието на C:ComboFix.txt в следващия Ви коментар в тази тема.

Бележка:

• Моля, не движете мишката, докато ComboFix работи. Това може да наруши процеса на работа.
• ComboFix ще нулира всички настройки на Microsoft Internet Explorer, включително да направи IE браузър по подразбиране.
• ComboFix ще изключи autorun функцията на ВСИЧКИ CD, Floppy и USB устройства, за да помогне при премахването на зловредния софтуер и Ви защити от бъдещи вируси/заплахи, които поразяват чрез autorun. Ако това е проблем за вас - моля, уведомете ме.
• ComboFix ще изключи вашата интернет връзка. Интернет връзката ще се възстанови автоматично, преди ComboFix да завърши процеса на работа. При проблем, той ще прекрати интернет връзката. За да възстановите интернет връзката си, рестартирайте компютъра си.
• В случай на проблем с ComboFix, той може да създаде лог файл. Моля, включете съдържанието на C:BUG.txt в следващия Ви коментар в тази тема.

Моля, не прикачвайте лог файла/овете от програмата, а го/ги копирайте и поставете в следващия Ви коментар в тази тема.Архивирайте папката C:Qoobox и я качете тук . Изпратете линка на лична за да го прегледам.

Както си мислех първия път нещо се прецака с лог файловете вероятно аз съм го сгъбясал... Пуснах го втори път, и остви два различни лог файла, единия на дестопа catchme.txt със следното съдържание File "C:ComboFixMT_ntfs.sys.tmp" added successfully driver loading error driver loading error File "C:ComboFixMT_ntfs.sys.tmp" added successfully driver loading error File "C:ComboFixMT_asyncmac.sys.tmp" added successfully driver loading error File "C:ComboFixMT_cdrom.sys.tmp" added successfully driver loading error driver loading error Всъщност не съм много сигурен че е лог на тази програма, но приличи ми на нейн така че реших да го постна... И другия който ми бяхте поискали ComboFix 12-11-09.02 - Admin 11.2012 г. 18:05:42.1.2 - x86 Microsoft Windows 7 Home Premium 6.1.7600.0.1251.359.1033.18.2804.1593 [GMT 2:00] Running from: c:usersAdminDownloadsComboFix.exe SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:usersAdminAppDataRoaming19D8.exe c:usersAdminAppDataRoaming1F10.exe c:usersAdminAppDataRoaming20FD.exe c:usersAdminAppDataRoaming3274.exe c:usersAdminAppDataRoaming37B7.exe c:usersAdminAppDataRoaming45A6.exe c:usersAdminAppDataRoaming4787.exe c:usersAdminAppDataRoaming4CAA.exe c:usersAdminAppDataRoaming5598.exe c:usersAdminAppDataRoaming64BB.exe c:usersAdminAppDataRoaming6769.exe c:usersAdminAppDataRoaming694C.exe c:usersAdminAppDataRoaming6A92.exe c:usersAdminAppDataRoaming7AFF.exe c:usersAdminAppDataRoaming8B51.exe c:usersAdminAppDataRoaming9D67.exe c:usersAdminAppDataRoamingA72B.exe c:usersAdminAppDataRoamingCA1.exe c:usersAdminAppDataRoamingD4D6.exe c:usersAdminAppDataRoamingF9CF.exe c:usersAdminAppDataRoamingYzasaq.exe c:windowssystem32drivers7b03070dd563dd8f.sys . ---- Previous Run ------- . c:usersAdminAppDataLocalassemblytmp c:usersAdminAppDataRoaming19D8.exe c:usersAdminAppDataRoaming1F10.exe c:usersAdminAppDataRoaming20FD.exe c:usersAdminAppDataRoaming3161.exe c:usersAdminAppDataRoaming3274.exe c:usersAdminAppDataRoaming37B7.exe c:usersAdminAppDataRoaming422B.exe c:usersAdminAppDataRoaming45A6.exe c:usersAdminAppDataRoaming4787.exe c:usersAdminAppDataRoaming4BD9.exe c:usersAdminAppDataRoaming4CAA.exe c:usersAdminAppDataRoaming5097.exe c:usersAdminAppDataRoaming5598.exe c:usersAdminAppDataRoaming579B.exe c:usersAdminAppDataRoaming64BB.exe c:usersAdminAppDataRoaming694C.exe c:usersAdminAppDataRoaming6A92.exe c:usersAdminAppDataRoaming6E50.exe c:usersAdminAppDataRoaming7517.exe c:usersAdminAppDataRoaming866F.exe c:usersAdminAppDataRoaming8B51.exe c:usersAdminAppDataRoaming9CD1.exe c:usersAdminAppDataRoaming9D67.exe c:usersAdminAppDataRoaming9F28.exe c:usersAdminAppDataRoamingA05F.exe c:usersAdminAppDataRoamingA72B.exe c:usersAdminAppDataRoamingB8C2.exe c:usersAdminAppDataRoamingBF49.exe c:usersAdminAppDataRoamingD25E.exe c:usersAdminAppDataRoamingD4D6.exe c:usersAdminAppDataRoamingD625.exe c:usersAdminAppDataRoamingF9CF.exe c:usersAdminAppDataRoamingYzasaq.exe . Infected copy of c:windowssystem32driversntfs.sys was found and disinfected Restored copy from - c:windowswinsxsx86_microsoft-windows-ntfs_31bf3856ad364e35_6.1.7600.17119_none_a69715e87e02f01cntfs.sys Infected copy of c:windowssystem32driversasyncmac.sys was found and disinfected Restored copy from - c:windowswinsxsx86_microsoft-windows-rasbase-asyncmac_31bf3856ad364e35_6.1.7600.16385_none_242e2506962cd3e0asyncmac.sys . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . . -------Legacy_7b03070dd563dd8f -------Service_7b03070dd563dd8f -------Legacy_7b03070dd563dd8f -------Service_7b03070dd563dd8f . . ((((((((((((((((((((((((( Files Created from 2012-10-10 to 2012-11-10 ))))))))))))))))))))))))))))))) . . 2012-11-10 15:58 . 2012-10-12 05:56 6918632 ----a-w- c:programdataMicrosoftWindows DefenderDefinition Updates{AB578C0C-6DF6-4818-9A20-1E6964B20E22}mpengine.dll 2012-11-10 00:59 . 2012-11-10 00:59 43600 ----a-w- c:windowssystem32driversrhtpcvmn.sys 2012-11-05 14:16 . 2012-11-05 14:16 -------- d-----w- c:program filesTeamViewer 2012-11-04 19:14 . 2012-11-04 19:14 -------- d-----w- c:usersAdminAppDataRoamingAnvisoft 2012-11-04 19:14 . 2012-11-04 19:14 -------- d-----w- c:programdataAnvisoft 2012-11-04 19:14 . 2012-08-20 09:23 22864 ----a-w- c:windowssystem32driversasdrs.sys 2012-11-04 19:14 . 2012-08-20 09:23 16208 ----a-w- c:windowssystem32driversasdrm.sys 2012-11-04 19:14 . 2012-08-20 09:23 14160 ----a-w- c:windowssystem32driversasdws.sys 2012-11-04 19:13 . 2012-11-04 19:13 -------- d-----w- c:program filesAnvisoft 2012-10-15 11:26 . 2012-10-28 17:16 -------- d-----w- c:program filesMozilla Maintenance Service 2012-10-14 15:48 . 2012-11-11 01:56 -------- d-----w- c:programdataMcAfee Security Scan 2012-10-14 15:48 . 2012-10-20 16:39 -------- d-----w- c:program filesMcAfee Security Scan . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-10-15 11:14 . 2012-04-07 15:30 696760 ----a-w- c:windowssystem32FlashPlayerApp.exe 2012-10-15 11:14 . 2011-08-10 03:05 73656 ----a-w- c:windowssystem32FlashPlayerCPLApp.cpl 2012-09-14 18:30 . 2012-10-10 17:54 2048 ----a-w- c:windowssystem32tzres.dll 2012-08-31 17:21 . 2012-10-10 17:54 1210736 ----a-w- c:windowssystem32driversntfs.sys 2012-08-30 17:18 . 2012-10-10 17:54 3958128 ----a-w- c:windowssystem32ntkrnlpa.exe 2012-08-30 17:18 . 2012-10-10 17:54 3902832 ----a-w- c:windowssystem32ntoskrnl.exe 2012-08-24 17:10 . 2012-10-10 17:54 172544 ----a-w- c:windowssystem32wintrust.dll 2012-08-24 06:59 . 2012-09-21 19:59 1800704 ----a-w- c:windowssystem32jscript9.dll 2012-08-24 06:51 . 2012-09-21 19:59 1129472 ----a-w- c:windowssystem32wininet.dll 2012-08-24 06:51 . 2012-09-21 19:59 1427968 ----a-w- c:windowssystem32inetcpl.cpl 2012-08-24 06:47 . 2012-09-21 19:59 142848 ----a-w- c:windowssystem32ieUnatt.exe 2012-08-24 06:47 . 2012-09-21 19:59 420864 ----a-w- c:windowssystem32vbscript.dll 2012-08-24 06:43 . 2012-09-21 19:59 2382848 ----a-w- c:windowssystem32mshtml.tlb 2012-08-18 11:23 . 2012-10-10 17:54 169984 ----a-w- c:windowssystem32winsrv.dll 2012-08-18 11:21 . 2012-10-10 17:54 293376 ----a-w- c:windowssystem32KernelBase.dll 2012-08-18 11:18 . 2012-10-10 17:54 271360 ----a-w- c:windowssystem32conhost.exe 2012-08-18 11:09 . 2012-10-10 17:54 4608 ---ha-w- c:windowssystem32api-ms-win-core-processthreads-l1-1-0.dll 2012-08-18 11:09 . 2012-10-10 17:54 4096 ---ha-w- c:windowssystem32api-ms-win-core-sysinfo-l1-1-0.dll 2012-08-18 11:09 . 2012-10-10 17:54 4096 ---ha-w- c:windowssystem32api-ms-win-core-synch-l1-1-0.dll 2012-08-18 11:09 . 2012-10-10 17:54 4096 ---ha-w- c:windowssystem32api-ms-win-core-misc-l1-1-0.dll 2012-08-18 11:09 . 2012-10-10 17:54 4096 ---ha-w- c:windowssystem32api-ms-win-core-localregistry-l1-1-0.dll 2012-08-18 11:09 . 2012-10-10 17:54 4096 ---ha-w- c:windowssystem32api-ms-win-core-localization-l1-1-0.dll 2012-08-18 11:09 . 2012-10-10 17:54 3584 ---ha-w- c:windowssystem32api-ms-win-core-processenvironment-l1-1-0.dll 2012-08-18 11:09 . 2012-10-10 17:54 3584 ---ha-w- c:windowssystem32api-ms-win-core-namedpipe-l1-1-0.dll 2012-08-18 11:09 . 2012-10-10 17:54 3584 ---ha-w- c:windowssystem32api-ms-win-core-memory-l1-1-0.dll 2012-08-18 11:09 . 2012-10-10 17:54 3584 ---ha-w- c:windowssystem32api-ms-win-core-libraryloader-l1-1-0.dll 2012-08-18 11:09 . 2012-10-10 17:54 3072 ---ha-w- c:windowssystem32api-ms-win-core-string-l1-1-0.dll 2012-08-18 11:09 . 2012-10-10 17:54 3072 ---ha-w- c:windowssystem32api-ms-win-core-rtlsupport-l1-1-0.dll 2012-08-18 11:09 . 2012-10-10 17:54 3072 ---ha-w- c:windowssystem32api-ms-win-core-profile-l1-1-0.dll 2012-08-18 11:09 . 2012-10-10 17:54 5120 ---ha-w- c:windowssystem32api-ms-win-core-file-l1-1-0.dll 2012-08-18 11:09 . 2012-10-10 17:54 3584 ---ha-w- c:windowssystem32api-ms-win-core-interlocked-l1-1-0.dll 2012-08-18 11:09 . 2012-10-10 17:54 3584 ---ha-w- c:windowssystem32api-ms-win-core-heap-l1-1-0.dll 2012-08-18 11:09 . 2012-10-10 17:54 3072 ---ha-w- c:windowssystem32api-ms-win-core-io-l1-1-0.dll 2012-08-18 11:09 . 2012-10-10 17:54 3072 ---ha-w- c:windowssystem32api-ms-win-core-handle-l1-1-0.dll 2012-08-18 11:09 . 2012-10-10 17:54 3072 ---ha-w- c:windowssystem32api-ms-win-core-fibers-l1-1-0.dll 2012-08-18 11:09 . 2012-10-10 17:54 3072 ---ha-w- c:windowssystem32api-ms-win-core-errorhandling-l1-1-0.dll 2012-08-18 11:09 . 2012-10-10 17:54 3072 ---ha-w- c:windowssystem32api-ms-win-core-delayload-l1-1-0.dll 2012-08-18 11:09 . 2012-10-10 17:54 3072 ---ha-w- c:windowssystem32api-ms-win-core-debug-l1-1-0.dll 2012-08-18 11:09 . 2012-10-10 17:54 3072 ---ha-w- c:windowssystem32api-ms-win-core-datetime-l1-1-0.dll 2012-08-18 11:09 . 2012-10-10 17:54 3072 ---ha-w- c:windowssystem32api-ms-win-core-console-l1-1-0.dll 2012-08-18 09:07 . 2012-10-10 17:54 6144 ---ha-w- c:windowssystem32api-ms-win-security-base-l1-1-0.dll 2012-08-18 09:07 . 2012-10-10 17:54 4608 ---ha-w- c:windowssystem32api-ms-win-core-threadpool-l1-1-0.dll 2012-08-18 09:07 . 2012-10-10 17:54 3584 ---ha-w- c:windowssystem32api-ms-win-core-xstate-l1-1-0.dll 2012-08-18 09:07 . 2012-10-10 17:54 3072 ---ha-w- c:windowssystem32api-ms-win-core-util-l1-1-0.dll 2012-10-28 03:19 . 2012-10-28 03:19 261600 ----a-w- c:program filesmozilla firefoxcomponentsbrowsercomps.dll . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionexplorershelliconoverlayidentifiersVeriFace Enc] @="{771C7324-DA80-49D3-8017-753B0AF60951}" [HKEY_CLASSES_ROOTCLSID{771C7324-DA80-49D3-8017-753B0AF60951}] 2010-03-24 01:15 1410400 ----a-w- c:windowsSystem32IcnOvrly.dll . [HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:program filesCommon FilesAheadLibNMBgMonitor.exe" [2006-12-23 143360] "Speech Recognition"="c:windowsSpeechCommonsapisvr.exe" [2009-07-14 51712] "Akamai NetSession Interface"="c:usersAdminAppDataLocalAkamainetsession_win.exe" [2012-10-09 4441920] . [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun] "IAStorIcon"="c:program filesIntelIntel® Rapid Storage TechnologyIAStorIcon.exe" [2009-11-20 284696] "ETDWare"="c:program filesElantechETDCtrl.exe" [2009-11-24 501640] "EnergyUtility"="c:program filesLenovoEnergy Managementutility.exe" [2009-12-17 4114368] "Energy Management"="c:program filesLenovoEnergy ManagementEnergy Management.exe" [2009-12-17 6223808] "Adobe Reader Speed Launcher"="c:program filesAdobeReader 9.0ReaderReader_sl.exe" [2008-12-03 35184] "UCam_Menu"="c:program filesLenovoYouCamMUITransferMUIStartMenu.exe" [2009-05-20 222504] "YouCam Mirror Tray icon"="c:program filesLenovoYouCamYouCamTray.exe" [2009-11-11 167008] "UpdateP2GShortCut"="c:program filesLenovoPower2GoMUITransferMUIStartMenu.exe" [2008-12-04 218408] "VeriFaceManager"="c:program filesLenovoVeriFacePManage.exe" [2010-03-24 3122528] "IgfxTray"="c:windowssystem32igfxtray.exe" [2009-11-24 141848] "HotKeysCmds"="c:windowssystem32hkcmd.exe" [2009-11-24 175640] "Persistence"="c:windowssystem32igfxpers.exe" [2009-11-24 166936] "NvCplDaemon"="c:windowssystem32NvCpl.dll" [2010-04-07 14830184] "NeroFilterCheck"="c:program filesCommon FilesAheadLibNeroCheck.exe" [2006-01-12 155648] "VirtualCloneDrive"="c:program filesElaborate BytesVirtualCloneDriveVCDDaemon.exe" [2011-03-07 89456] "ExpressFiles"="c:program filesExpressFilesExpressFiles.exe" [2012-11-04 488088] "SunJavaUpdateSched"="c:program filesCommon FilesJavaJava Updatejusched.exe" [2012-01-17 252296] "AdobeAAMUpdater-1.0"="c:program filesCommon FilesAdobeOOBEPDAppUWAUpdaterStartupUtility.exe" [2010-03-06 500208] "SwitchBoard"="c:program filesCommon FilesAdobeSwitchBoardSwitchBoard.exe" [2010-02-19 517096] "AdobeCS5ServiceManager"="c:program filesCommon FilesAdobeCS5ServiceManagerCS5ServiceManager.exe" [2010-02-22 406992] "Aeria Ignite"="c:program filesAeria GamesIgniteaeriaignite.exe" [2012-09-10 1411224] "4StoryPrePatch"="d:games4StoryPrePatch.exe" [2011-11-18 327680] "Anvi Smart Defender"="c:program filesAnvisoftAnvi Smart DefenderASDTray.exe" [2012-08-23 1229104] . c:programdataMicrosoftWindowsStart MenuProgramsStartup Bluetooth.lnk - c:program filesLenovoBluetooth SoftwareBTTray.exe [2009-8-12 795936] McAfee Security Scan Plus.lnk - c:program filesMcAfee Security Scan3.0.207SSScheduler.exe [2011-6-17 272528] . [HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionpoliciessystem] "ConsentPromptBehaviorAdmin"= 0 (0x0) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) . [HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversionwindows] "AppInit_DLLs"=c:windowsSystem32nvinit.dll . [HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversiondrivers32] "mixer2"=wdmaud.drv . --- Other Services/Drivers In Memory --- . *NewlyCreated* - WS2IFSL . [HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversionsvchost] IgrsSvcs REG_MULTI_SZ ReadyComm.DirectRouter PS_MDP . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.google.com uInternet Settings,ProxyOverride = <local> IE: E&xport to Microsoft Excel - c:progra~1MICROS~2OFFICE11EXCEL.EXE/3000 IE: Send image to &Bluetooth Device... - c:program filesLenovoBluetooth Softwarebtsendto_ie_ctx.htm IE: Send page to &Bluetooth Device... - c:program filesLenovoBluetooth Softwarebtsendto_ie.htm IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949} - c:usersAdminAppDataRoamingMicrosoftWindowsStart MenuProgramsIMVURun IMVU.lnk TCP: DhcpNameServer = 212.50.10.50 212.50.10.51 192.168.1.1 FF - ProfilePath - c:usersAdminAppDataRoamingMozillaFirefoxProfilesiarkkmju.default FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - hxxp://tabs.ultimate-guitar.com/b/bullet_for_my_valentine/say_goodnight_acoustic_ver3_tab.htm|http://www.youtube.com/watch?v=h7sdYQi8DDk|http://www.songsterr.com/a/wsa/theme-songs-pirates-of-the-caribbean-guitar-tab-s83486t0|http://www.songsterr.com/a/wsa/guns-n-roses-don-t-cry-acoustic-guitar-tab-s23298t0|https://www.google.bg/ FF - ExtSQL: !HIDDEN! 2012-04-08 07:06; [email protected]; c:usersAdminAppDataRoamingMozillaFirefoxProfilesiarkkmju.defaultextensions4f807b1f7fec8@4f807b1f7fec9.info . - - - - ORPHANS REMOVED - - - - . URLSearchHooks-{90b49673-5506-483e-b92b-ca0265bd9ca8} - (no file) Toolbar-Locked - (no file) HKCU-Run-Yzasaq - c:usersAdminAppDataRoamingYzasaq.exe SafeBoot-mcmscsvc SafeBoot-MCODS AddRemove-NCsoft-Lineage2 - d:programsncsoftNCLauncher.exe . . . [HKEY_LOCAL_MACHINEsystemControlSet001servicesnpggsvc] "ImagePath"="c:windowssystem32GameMon.des -service" . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_LOCAL_MACHINEsystemControlSet001ControlClass{4D36E96D-E325-11CE-BFC1-08002BE10318}0000AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINEsystemControlSet001ControlClass{4D36E96D-E325-11CE-BFC1-08002BE10318}0001AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINEsystemControlSet001ControlClass{4D36E96D-E325-11CE-BFC1-08002BE10318}0002AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINEsystemControlSet001ControlPCWSecurity] @Denied: (Full) (Everyone) . --------------------- DLLs Loaded Under Running Processes --------------------- . - - - - - - - > 'Explorer.exe'(5660) c:windowssystem32IcnOvrly.dll c:program filesLenovoBluetooth Softwarebtmmhook.dll c:program filesLenovoBluetooth Softwarebtncopy.dll . ------------------------ Other Running Processes ------------------------ . c:windowssystem32nvvsvc.exe c:windowssystem32WLANExt.exe c:windowssystem32conhost.exe c:windowssystem32nvvsvc.exe c:program filesAnvisoftAnvi Smart DefenderASDSrv.exe c:program filesLenovoBluetooth Softwarebtwdins.exe c:program filesLenovoReadyCommcommonIGRS.exe c:program filesCommon FilesLightScribeLSSrvc.exe c:program filesIntelIntel® Management Engine ComponentsLMSLMS.exe c:program filesNVIDIA CorporationNVIDIA Updatusdaemonu.exe c:windowssystem32PnkBstrA.exe c:program filesQUALCOMMQDLService2kQDLService2kLenovo.exe c:windowsSystem32IgrsSvcs.exe c:programdataSkypeToolbarsSkype C2C Servicec2c_service.exe c:program filesTeamViewerVersion7TeamViewer_Service.exe c:program filesCommon FilesMicrosoft SharedWindows LiveWLIDSVC.EXE c:program filesMobile Broadband DriversWMCoremini_WMCore.exe c:program filesIntelIntel® Rapid Storage TechnologyIAStorDataMgrSvc.exe c:program filesCommon FilesMicrosoft SharedWindows LiveWLIDSvcM.exe c:windowssystem32taskhost.exe c:program filesExpressFilesEFupdater.exe c:windowssystem32conhost.exe c:windowssystem32igfxsrvc.exe c:program filesCommon FilesAheadLibNMIndexStoreSvr.exe c:program filesCommon FilesAheadLibNMIndexingService.exe c:windowssystem32sppsvc.exe c:program filesIntelIntel® Management Engine ComponentsUNSUNS.exe c:windowsservicingTrustedInstaller.exe c:?c:windowssystem32wbemWMIADAP.EXE . ************************************************************************** . Completion time: 2012-11-10 18:18:18 - machine was rebooted ComboFix-quarantined-files.txt 2012-11-10 16:18 . Pre-Run: 96 053 309 440 bytes free Post-Run: 95 885 025 280 bytes free . - - End Of File - - 66736B9322800AA20D89C0E67A053B6D И така

Изтеглете Malwarebytes' Anti-Malware или от тук (не забравяйте да обновите програмата с нови дефиниции)

* Кликнете два пъти върху mbam-setup.exe, за да инсталирате програмата.

* Уверете се, че са поставени отметки на Update Malwarebytes' Anti-Malware и Launch Malwarebytes' Anti-Malware. След това кликнете на Finish.

* Ако има намерени обновявания, тя ще ги изтегли и инсталира.

* Стартирайте програмата и изберете "Perform Full Scan", след това кликнете на Scan.

* Сканирането ще отнеме малко време, затова моля да бъдете търпеливи.

* Когато сканирането завърши, кликнете на OK, след това Show Results, за да видите резултата.

* Уверете се, че на всички редове има отметки, и кликнете на Remove Selected.

* Когато всичко бъде премахнато, в Notepad ще бъде отворен лог. Копирайте този лог и го публикувайте в следващия си коментар по темата.

Забележка: Ако MalwareBytes' Anti-Malware се затрудни в премахването на откритите вируси/заплахи, той ще поиска да рестартира компютъра Ви и по време на рестартирането да премахне проблемните вируси/заплахи. Ако бъдете попитани, потвърдете че желаете вашия компютър да бъде рестартиран.

Изтеглете програмата: ESET Online Scanner

• Стартирайте esetsmartinstaller_enu.exe
• Сложете отметка на YES, I accept the Terms of Use и изберете Start:

  

• Скенерът ще започне да изтегля компонентите, които са му необходими:

  

Уверете се, че е премахната отметката от:

• Remove found threats

Уверете се че са маркирани следните позиции:

• Scan Archives

Кликнете върху Advanced Settings и маркирайте следните опции:

• Scan for potentially unwanted applications
• Scan for potentially unsafe applications
• Enable Anti-Stealth Technology

Накрая изберете Start

• Скенерът ще започне да изтегля последните дефиниции.
• След, като сканирането завърши изберете Finish.
• Отидете в: C:Program FilesESETESET Online Scanner
• Отворете файла log.txt , копирайте съдържанието му и го поставете в следващия си коментар.