Премини към съдържанието
Форумът в приложение

По-лесно сърфиране. Научи повече.
Kaldata.com - Форуми

Приложение на форума на цял екран с push известия, значки и други.

За да инсталирате това приложение на iOS и iPadOS
  1. Докоснете Иконата за споделяне в Safari
  2. Превъртете менюто и докоснете Добавяне към началния екран.
  3. Докоснете Добавяне в горния десен ъгъл.
За да инсталирате това приложение на Android
  1. Докоснете менюто с 3 точки (⋮) в горния десен ъгъл на браузъра.
  2. Докоснете Добавяне към началния екран или Инсталиране на приложение.
  3. Потвърдете, като докоснете Инсталиране.
Добави Kaldata.com в предпочитани източници в Google

Добре дошли!

Добре дошли в нашите форуми, пълни с полезна информация. Имате проблем с компютъра или телефона си? Публикувайте нова тема и ще намерите решение на всичките си проблеми. Общувайте свободно и открийте безброй нови приятели.

Моля, регистрирайте се за да публикувате тема и да получите пълен достъп до всички функции.

 

Борба с YouToo

plamba95
в Премахване на зловреден софтуер

Featured Replies

Здравейте ровех се из интернет, затворих браузъра си без да исках и когато го пуснах Chrome ми каза, че е инсталирано ново приложение с име yontoo... Тъй като не ми беше познато направо го изтрих, но реших да погледна в нета... Оказва се, че е злонамерен софтуер, за премахването на който явно ще ми е нужна вашата помощ... Намерих го из папките, но няма го трия, тъй като четох, че нещо барало регистрите.

Ето и dds.txt

DDS (Ver_2011-09-30.01) - NTFS_AMD64

Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 10.7.2

Run by New at 12:16:58 on 2012-11-12

Microsoft Windows 7 Ultimate 6.1.7601.1.1251.359.1033.18.4094.2005 [GMT 2:00]

.

AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}

SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}

SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

============== Running Processes ===============

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\nvvsvc.exe

C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

C:\Windows\system32\svchost.exe -k RPCSS

C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalService

C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

C:\Windows\system32\nvvsvc.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\taskhost.exe

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

F:\xampp\apache\bin\httpd.exe

F:\xampp\filezillaftp\filezillaserver.exe

C:\Windows\system32\Dwm.exe

C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE

C:\Windows\Explorer.EXE

C:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe

F:\xampp\apache\bin\httpd.exe

F:\xampp\mysql\bin\mysqld.exe

C:\Windows\SysWOW64\PnkBstrA.exe

C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe

C:\Program Files\Microsoft Security Client\msseces.exe

C:\Windows\system32\svchost.exe -k imgsvc

C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Windows\SysWOW64\vmnat.exe

C:\Program Files\Web Assistant\ExtensionUpdaterService.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Program Files (x86)\Skype\Phone\Skype.exe

C:\Windows\SysWOW64\vmnetdhcp.exe

C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Users\New\AppData\Local\RockMelt\Update\1.2.189.1\RockMeltCrashHandler.exe

C:\Program Files (x86)\VMware\VMware Workstation\vmware-hostd.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Program Files (x86)\PowerISO\PWRISOVM.EXE

C:\Program Files (x86)\Ask.com\Updater\Updater.exe

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

C:\Program Files (x86)\VMware\VMware Workstation\vmware-tray.exe

C:\Windows\System32\svchost.exe -k LocalServicePeerNet

C:\Program Files (x86)\Nero\Update\NASvc.exe

C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Windows\system32\wuauclt.exe

C:\Program Files (x86)\Firebird\Firebird_2_5\bin\fbserver.exe

C:\Windows\system32\taskhost.exe

C:\Windows\system32\svchost.exe -k SDRSVC

C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe

C:\Users\New\android-sdks\platform-tools\adb.exe

C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe

C:\Windows\system32\taskeng.exe

C:\Program Files (x86)\TeamViewer\Version7\TeamViewer.exe

C:\Program Files (x86)\TeamViewer\Version7\tv_w32.exe

C:\Program Files (x86)\TeamViewer\Version7\tv_x64.exe

C:\Programs\Notepad++\notepad++.exe

C:\Users\New\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\New\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\New\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\New\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\New\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\New\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\New\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\New\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\New\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\New\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Windows\system32\taskeng.exe

C:\Windows\system32\conhost.exe

C:\Windows\System32\cscript.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT3106777

mStart Page = hxxp://home.sweetim.com

uProxyServer = hxxp=;ftp=;https=;

uURLSearchHooks: UrlSearchHook Class: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll

uURLSearchHooks: WinZipBar Toolbar: {50fafaf0-70a9-419d-a109-fa4b4ffd4e37} - C:\Program Files (x86)\WinZipBar\prxtbWinZ.dll

mURLSearchHooks: WinZipBar Toolbar: {50fafaf0-70a9-419d-a109-fa4b4ffd4e37} - C:\Program Files (x86)\WinZipBar\prxtbWinZ.dll

mWinlogon: Userinit = userinit.exe

BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO: ShoppingReport2: {258C9770-1713-4021-8D7E-1F184A2BD754} - C:\Program Files (x86)\ShoppingReport2\Bin\2.7.37\ShoppingReport.dll

BHO: Web Assistant: {336D0C35-8A85-403a-B9D2-65C292C39087} - C:\Program Files\Web Assistant\Extension32.dll

BHO: WinZipBar Toolbar: {50fafaf0-70a9-419d-a109-fa4b4ffd4e37} - C:\Program Files (x86)\WinZipBar\prxtbWinZ.dll

BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll

BHO: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll

BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll

BHO: Ask Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll

BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll

BHO: SweetIM Toolbar Helper: {EEE6C35C-6118-11DC-9C72-001320C79847} -

BHO: Yontoo: {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - C:\Program Files (x86)\Yontoo\YontooIEClient.dll

TB: Google Toolbar: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll

TB: WinZipBar Toolbar: {50FAFAF0-70A9-419D-A109-FA4B4FFD4E37} - C:\Program Files (x86)\WinZipBar\prxtbWinZ.dll

TB: Ask Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll

TB: SweetIM Toolbar for Internet Explorer: {EEE6C35B-6118-11DC-9C72-001320C79847} -

TB: WinZipBar Toolbar: {50fafaf0-70a9-419d-a109-fa4b4ffd4e37} - C:\Program Files (x86)\WinZipBar\prxtbWinZ.dll

TB: Ask Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll

TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll

EB: ShopperReports: {BDEA95CF-F0E6-41E0-BD3D-B00F39A4E939} - C:\Program Files (x86)\ShoppingReport2\Bin\2.7.37\ShoppingReport.dll

uRun: [Google Update] "C:\Users\New\AppData\Local\Google\Update\GoogleUpdate.exe" /c

uRun: [Facebook Update] "C:\Users\New\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver

uRun: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

uRun: [espaces] C:\premiumsoft\PhotoFun\photofun.exe

uRun: [skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun

uRun: [AdobeBridge] <no file>

mRun: [switchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe

mRun: [AdobeCS5.5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" -launchedbylogin

mRun: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"

mRun: [sweetIM] C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe

mRun: [PWRISOVM.EXE] C:\Program Files (x86)\PowerISO\PWRISOVM.EXE -startup

mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

mRun: [Java Update] C:\Program Files\Java\divx.exe

mRun: [ApnUpdater] "C:\Program Files (x86)\Ask.com\Updater\Updater.exe"

mRun: [vmware-tray.exe] "C:\Program Files (x86)\VMware\VMware Workstation\vmware-tray.exe"

StartupFolder: C:\Users\New\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\ONENOT~1.LNK - C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE

mPolicies-Explorer: NoActiveDesktop = dword:1

mPolicies-Explorer: NoActiveDesktopChanges = dword:1

mPolicies-System: ConsentPromptBehaviorAdmin = dword:5

mPolicies-System: ConsentPromptBehaviorUser = dword:3

mPolicies-System: EnableUIADesktopToggle = dword:0

IE: E&xport to Microsoft Excel - C:\PROGRA~2\MIF5BA~1\Office12\EXCEL.EXE/3000

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office12\ONBttnIE.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}

IE: {DB38E21A-0133-419d-92AD-ECDFD5244D6D} - {3E2DFD6A-4E20-4d4c-AA8B-E1F9DBEF3C80} - C:\Program Files (x86)\ShoppingReport2\Bin\2.7.37\ShoppingReport.dll

IE: {EB620C54-E229-4942-87CE-E717109FC8C6} - {714E0876-FCEE-49ce-A429-B9AD8AEFCB56} - C:\Program Files (x86)\ShoppingReport2\Bin\2.7.37\ShoppingReport.dll

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

TCP: NameServer = 192.168.1.1

TCP: Interfaces\{7DBA065F-D5B5-4ACC-9995-719FDFFD200D} : DHCPNameServer = 7.254.254.254

TCP: Interfaces\{BD9237A0-890A-4FC9-AD65-9F6116C73E92} : DHCPNameServer = 192.168.1.1

Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll

Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

SSODL: WebCheck - <orphaned>

SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll

LSA: Security Packages = kerberos msv1_0 schannel wdigest tspkg pku2u livessp

x64-BHO: Web Assistant: {336D0C35-8A85-403a-B9D2-65C292C39087} - C:\Program Files\Web Assistant\Extension64.dll

x64-BHO: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll

x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

x64-BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll

x64-BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll

x64-TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll

x64-Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s

x64-Run: [AdobeAAMUpdater-1.0] "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"

x64-Run: [MSC] "C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey

x64-Run: [CanonSolutionMenu] C:\Program Files (x86)\Canon\SolutionMenu\CNSLMAIN.exe /logon

x64-Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - <orphaned>

x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned>

x64-Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - <orphaned>

x64-SSODL: WebCheck - <orphaned>

.

================= FIREFOX ===================

.

FF - ProfilePath - C:\Users\New\AppData\Roaming\Mozilla\Firefox\Profiles\ctiao2m7.default\

FF - prefs.js: browser.search.selectedEngine - Ask.com

FF - prefs.js: browser.startup.homepage - hxxp://eu.ask.com/?l=dis&o=102876&gct=hp

FF - prefs.js: keyword.URL - hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=HIP&o=102876&locale=en_EU&apn_uid=b2c8c015-1ec1-4df9-8540-52d12fdf115f&apn_ptnrs=6G&apn_sauid=80FD47BC-6E69-4FD3-8CA5-8ED445F1B614&apn_dtid=YYYYYYYYBG&&q=

FF - prefs.js: network.proxy.gopher -

FF - prefs.js: network.proxy.gopher_port - 0

FF - prefs.js: network.proxy.type - 0

FF - plugin: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll

FF - plugin: C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll

FF - plugin: C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll

FF - plugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll

FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll

FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll

FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll

FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll

FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dll

FF - plugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npdeployJava1.dll

FF - plugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll

FF - plugin: C:\Program Files (x86)\Microsoft Silverlight\3.0.40818.0\npctrlui.dll

FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll

FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll

FF - plugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll

FF - plugin: C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll

FF - plugin: C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypchub.dll

FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

FF - plugin: C:\Users\New\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll

FF - plugin: C:\Users\New\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll

FF - plugin: C:\Users\New\AppData\Local\RockMelt\Update\1.2.189.1\npRockMeltOneClick8.dll

FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_287.dll

FF - plugin: C:\Windows\SysWOW64\npDeployJava1.dll

FF - plugin: C:\Windows\SysWOW64\npmproxy.dll

.

---- FIREFOX POLICIES ----

FF - user.js: extensions.incredibar_i.newTab - false

FF - user.js: extensions.incredibar_i.tlbrSrchUrl - hxxp://mystart.Incredibar.com/?a=6R8CVN11it&loc=IB_TB&i=26&search=

FF - user.js: extensions.incredibar_i.id - 3009b69a00000000000000ff7dba065f

FF - user.js: extensions.incredibar_i.instlDay - 15575

FF - user.js: extensions.incredibar_i.vrsn - 1.5.11.14

FF - user.js: extensions.incredibar_i.vrsni - 1.5.11.14

FF - user.js: extensions.incredibar_i.vrsnTs - 1.5.11.1410:42:39

FF - user.js: extensions.incredibar_i.prtnrId - Incredibar

FF - user.js: extensions.incredibar_i.prdct - incredibar

FF - user.js: extensions.incredibar_i.aflt - orgnl

FF - user.js: extensions.incredibar_i.smplGrp - none

FF - user.js: extensions.incredibar_i.tlbrId - base

FF - user.js: extensions.incredibar_i.instlRef -

FF - user.js: extensions.incredibar_i.dfltLng -

FF - user.js: extensions.incredibar_i.excTlbr - false

FF - user.js: extensions.incredibar_i.ms_url_id -

FF - user.js: extensions.incredibar_i.upn2 - 6R8CVN11it

FF - user.js: extensions.incredibar_i.upn2n - 92824929143237861

FF - user.js: extensions.incredibar_i.productid - 26

FF - user.js: extensions.incredibar_i.installerproductid - 26

FF - user.js: extensions.incredibar_i.did - 10671

FF - user.js: extensions.incredibar_i.ppd - 77777212

FF - user.js: network.proxy.type - 0

FF - user.js: network.proxy.http -

user_pref(network.proxy.http_port,);

FF - user.js: network.proxy.no_proxies_on -

FF - user.js: extentions.y2layers.installId - 10a0be8c-ae9a-4221-834e-929f6955eaa8

FF - user.js: extentions.y2layers.defaultEnableAppsList - DropDownDeals,buzzdock,YontooNewOffers

.

FF - user.js: extensions.autoDisableScopes - 14

.

============= SERVICES / DRIVERS ===============

.

R0 BtHidBus;Bluetooth HID Bus Service;C:\Windows\System32\drivers\BtHidBus.sys [2011-7-27 24456]

R0 vsock;vSockets Driver;C:\Windows\System32\drivers\vsock.sys [2012-9-29 70256]

R1 MpFilter;Microsoft Malware Protection Driver;C:\Windows\System32\drivers\MpFilter.sys [2011-4-18 189440]

R2 AdobeARMservice;Adobe Acrobat Update Service;C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-7-27 63960]

R2 Apache2.2;Apache2.2;F:\xampp\apache\bin\httpd.exe [2011-9-10 18432]

R2 NAUpdate;Nero Update;C:\Program Files (x86)\Nero\Update\NASvc.exe [2011-9-23 641832]

R2 nvUpdatusService;NVIDIA Update Service Daemon;C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [2012-2-22 2348352]

R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2012-2-9 382272]

R2 TeamViewer7;TeamViewer 7;C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe [2012-8-31 2848168]

R2 VMUSBArbService;VMware USB Arbitration Service;C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe [2012-8-1 917656]

R2 VMwareHostd;VMware Workstation Server;C:\Program Files (x86)\VMware\VMware Workstation\vmware-hostd.exe [2012-8-15 15680000]

R2 Web Assistant Updater;Web Assistant Updater;C:\Program Files\Web Assistant\ExtensionUpdaterService.exe [2012-8-23 188760]

R3 btnetBUs;Bluetooth PAN Bus Service;C:\Windows\System32\drivers\btnetBus.sys [2010-4-6 30088]

R3 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance;C:\Program Files (x86)\Firebird\Firebird_2_5\bin\fbserver.exe [2012-10-9 3735552]

R3 IvtBtBUs;IVT Bluetooth Bus Service;C:\Windows\System32\drivers\IvtBtBus.sys [2010-4-6 27016]

R3 MpNWMon;Microsoft Malware Protection Network Driver;C:\Windows\System32\drivers\MpNWMon.sys [2011-4-18 40832]

R3 NisDrv;Microsoft Network Inspection System;C:\Windows\System32\drivers\NisDrvWFP.sys [2011-4-27 84864]

R3 NisSrv;Microsoft Network Inspection;C:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-4-27 288272]

R3 NVHDA;Service for NVIDIA High Definition Audio Driver;C:\Windows\System32\drivers\nvhda64v.sys [2012-2-22 188224]

R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2011-11-14 452200]

R3 tap0901t;TAP-Win32 Adapter V9 (Tunngle);C:\Windows\System32\drivers\tap0901t.sys [2012-5-28 31232]

S2 BsMobileCS;BsMobileCS;C:\Program Files (x86)\IVT Corporation\BlueSoleil\BsMobileCS.exe --> C:\Program Files (x86)\IVT Corporation\BlueSoleil\BsMobileCS.exe [?]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]

S2 FirebirdGuardianDefaultInstance;Firebird Guardian - DefaultInstance;C:\Program Files (x86)\Firebird\Firebird_2_5\bin\fbguard.exe [2012-10-9 98304]

S2 gupdate;Услуга Google Update (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-11-18 136176]

S2 Icecast;Icecast Media Server;C:\Program Files (x86)\Icecast2 Win32\icecastService.exe [2012-10-11 393216]

S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-7-3 160944]

S2 XAMPP;XAMPP Service;F:\xampp\service.exe [2007-12-21 60928]

S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-3-31 250808]

S3 dmvsc;dmvsc;C:\Windows\System32\drivers\dmvsc.sys [2010-11-21 71168]

S3 epmntdrv;epmntdrv;C:\Windows\System32\epmntdrv.sys [2011-12-20 16776]

S3 EuGdiDrv;EuGdiDrv;C:\Windows\System32\EuGdiDrv.sys [2011-12-20 9096]

S3 gupdatem;Услуга на Google Актуализация (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-11-18 136176]

S3 MozillaMaintenance;Mozilla Maintenance Service;C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-6-29 115168]

S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\System32\drivers\rdpvideominiport.sys [2010-11-21 20992]

S3 Sony PC Companion;Sony PC Companion;C:\Program Files (x86)\Sony\Sony PC Companion\PCCService.exe [2012-7-20 155320]

S3 SwitchBoard;Adobe SwitchBoard;C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-2-19 517096]

S3 Synth3dVsc;Synth3dVsc;C:\Windows\System32\drivers\Synth3dVsc.sys [2010-11-21 88960]

S3 terminpt;Microsoft Remote Desktop Input Driver;C:\Windows\System32\drivers\terminpt.sys [2010-11-21 34816]

S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2010-11-21 59392]

S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\System32\drivers\TsUsbGD.sys [2010-11-21 31232]

S3 tsusbhub;tsusbhub;C:\Windows\System32\drivers\tsusbhub.sys [2010-11-21 117248]

S3 TunngleService;TunngleService;C:\Program Files (x86)\Tunngle\TnglCtrl.exe [2012-7-13 736104]

S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2011-11-26 1255736]

S4 MSSQLServerADHelper100;SQL Active Directory Helper Service;C:\Program Files (x86)\Microsoft SQL Server\100\Shared\sqladhlp.exe [2008-7-10 47128]

S4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);C:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [2008-7-10 369688]

.

=============== File Associations ===============

.

FileExt: .reg: regfile="regedit.exe" "%1"

.

=============== Created Last 30 ================

.

2012-11-12 08:16:07 9291768 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{6AC33633-D320-4E62-BD17-EF191968D904}\mpengine.dll

2012-11-06 14:36:21 -------- d-----w- C:\Program Files (x86)\Yontoo

2012-11-06 14:36:18 -------- d-----w- C:\ProgramData\Tarma Installer

2012-11-06 14:36:14 -------- d-----w- C:\Program Files (x86)\TornTV.com

2012-10-29 23:02:12 -------- d-----w- C:\Users\New\AppData\Roaming\Sierra

2012-10-29 22:23:13 -------- d-----w- C:\Program Files (x86)\GameSpy Arcade

2012-10-29 22:16:56 172032 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\10\00\Intel32\iuser.dll

2012-10-29 22:16:55 733184 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\10\00\Intel32\iKernel.dll

2012-10-29 22:16:55 69715 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\10\00\Intel32\ctor.dll

2012-10-29 22:16:55 5632 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\10\00\Intel32\DotNetInstaller.exe

2012-10-29 22:16:55 266240 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\10\00\Intel32\iscript.dll

2012-10-29 22:16:55 180356 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\10\00\Intel32\iGdi.dll

2012-10-29 22:16:54 303236 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\10\00\Intel32\setup.dll

2012-10-24 21:00:41 -------- d-----w- C:\Program Files (x86)\Total Video Converter

2012-10-24 20:55:01 -------- d-----w- C:\Users\New\AppData\Roaming\AnvSoft

2012-10-24 20:54:39 -------- d-----w- C:\Program Files (x86)\AnvSoft

2012-10-16 19:05:44 -------- d-----w- C:\Program Files\IconSort

2012-10-16 14:53:05 -------- d-----w- C:\Users\New\AppData\Local\Android

2012-10-16 13:28:03 -------- d-----w- C:\Users\New\android-sdks

2012-10-16 13:15:52 -------- d-----w- C:\Users\New\.android

2012-10-16 13:00:51 -------- d-----w- C:\Users\New\AppData\Local\Eclipse

2012-10-16 12:36:38 -------- d-----w- C:\Program Files\eclipse

2012-10-16 12:29:04 1034216 ----a-w- C:\Windows\System32\npDeployJava1.dll

2012-10-16 12:28:55 108008 ----a-w- C:\Windows\System32\WindowsAccessBridge-64.dll

.

==================== Find3M ====================

.

2012-11-06 12:35:26 298016 ----a-w- C:\Windows\SysWow64\PnkBstrB.xtr

2012-11-06 12:35:26 298016 ----a-w- C:\Windows\SysWow64\PnkBstrB.exe

2012-10-16 12:28:48 916456 ----a-w- C:\Windows\System32\deployJava1.dll

2012-10-08 21:45:12 696760 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe

2012-10-08 21:45:11 73656 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

2012-09-08 11:59:52 95208 ----a-w- C:\Windows\SysWow64\WindowsAccessBridge-32.dll

2012-09-08 11:59:49 821736 ----a-w- C:\Windows\SysWow64\npDeployJava1.dll

2012-09-08 11:59:49 746984 ----a-w- C:\Windows\SysWow64\deployJava1.dll

2012-08-15 12:18:42 933528 ----a-w- C:\Windows\System32\vnetlib64.dll

2012-08-15 12:18:40 357016 ----a-w- C:\Windows\SysWow64\vmnetdhcp.exe

2012-08-15 12:18:16 67224 ----a-w- C:\Windows\System32\drivers\vmx86.sys

2012-08-15 12:18:08 30360 ----a-w- C:\Windows\System32\drivers\vmnetuserif.sys

2012-08-15 12:18:00 31384 ----a-w- C:\Windows\System32\drivers\VMparport.sys

2012-08-15 12:17:26 435864 ----a-w- C:\Windows\SysWow64\vmnat.exe

2012-08-15 12:16:52 62104 ----a-w- C:\Windows\System32\vmnetbridge.dll

2012-08-15 12:16:52 48792 ----a-w- C:\Windows\System32\vnetinst.dll

2012-08-15 12:16:52 45720 ----a-w- C:\Windows\System32\drivers\vmnetbridge.sys

2012-08-15 12:16:50 24216 ----a-w- C:\Windows\System32\drivers\vmnet.sys

2012-08-15 12:16:50 20120 ----a-w- C:\Windows\System32\drivers\vmnetadapter.sys

2012-08-15 10:33:44 353280 ----a-w- C:\Windows\SysWow64\vmnc.dll

2010-08-03 08:11:16 819200 --sha-w- C:\Windows\SysWOW64\xvidcore.dll

2010-08-03 08:11:16 180224 --sha-w- C:\Windows\SysWOW64\xvidvfw.dll

.

============= FINISH: 12:17:47,85 ===============

и attach.txt

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2011-09-30.01)

.

Microsoft Windows 7 Ultimate

Boot Device: \Device\HarddiskVolume1

Install Date: 14.11.2011 г. 18:27:45

System Uptime: 9.10.2012 г. 10:09:49 (818 hours ago)

.

Motherboard: ASUSTeK Computer INC. | | M5A78L-M LX

Processor: AMD Athlon™ II X3 455 Processor | AM3R2 | 3300/200mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 180 GiB total, 42,127 GiB free.

D: is FIXED (NTFS) - 601 GiB total, 210,769 GiB free.

E: is CDROM ()

F: is FIXED (NTFS) - 100 GiB total, 96,411 GiB free.

G: is CDROM ()

H: is CDROM ()

L: is FIXED (NTFS) - 50 GiB total, 49,891 GiB free.

.

==== Disabled Device Manager Items =============

.

Class GUID: {d2de069d-7286-420b-baf8-225d700ce748}

Description: Bluetooth Serial Port Bus

Device ID: ROOT\BLUETOOTH_DEVICE\0002

Manufacturer: IVT Corporation

Name: Bluetooth Serial Port Bus

PNP Device ID: ROOT\BLUETOOTH_DEVICE\0002

Service: BTCOMBUS

.

Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}

Description: Hamachi Network Interface

Device ID: ROOT\NET\0001

Manufacturer: LogMeIn, Inc.

Name: Hamachi Network Interface

PNP Device ID: ROOT\NET\0001

Service: hamachi

.

==== System Restore Points ===================

.

RP156: 3.11.2012 г. 10:16:07 - Windows Update

RP157: 7.11.2012 г. 10:17:02 - Windows Update

RP158: 10.11.2012 г. 10:18:05 - Windows Update

.

==== Installed Programs ======================

.

.

==== End Of File ===========================

Здравейте,

СТЪПКА 1

Публикувано изображение Стартирайте отново програмата AdwCleaner (by Xplode).

  • Затворете всички стартирани програми и браузъри
  • Кликнете два пъти върху adwcleaner.exe за да стартирате инструмента.
  • Този път маркирайте Delete
  • Вашият компютър ще се рестартира автоматично. Текстовия файл ще се отвори след рестарта.
  • Моля, да публикувате съдържанието на този лог в отговора си
  • Можете да намерите лога,който автоматично се запомня тук C:AdwCleaner[R1].txt.

СТЪПКА 2

Публикувано изображение Моля изтеглете Junkware Removal Tool на вашия десктоп.

  • Спрете временно работата на защитните програми.
  • Стартирайте инструмента JRT.exe
  • Ще се отвори ДОС прозорец. Натиснете което и да е копче от клавиатурата.
  • Затворете излишните приложения и всички браузъри и изчакайте проверката да завърши.
  • Ще се появи лог файл (който можете да намерите и ръчно на десктопа с името JRT.txt).
  • Моля копирайте съдържанието на лог файла в следващия си пост.

По време на сканирането с инструментите, не използвайте компютъра си !

СТЪПКА 3

Направете свежа проверка с DDS след това.

  • Автор

Стъпка 1 я изпълних успешно, но при Стъпка 2, при стартиране на приложението(дори и като администратор) ДОС прозореца се отваря и веднага се затваря и не мога да прочета какво пише... засякох думата not само... Какво да правя?

Редактирано от plamba95 (преглед на промените)

Здравейте и извинете за закъснението.

Може ли да публикувате лог файла от adwcleaner.

Колкото до JRT - положението е странно. Говорех с автора и той няма идея от какво може да е (освен ако акаунта ви не е с администраторски права, но пък вие твърдите, че е с такива).

Както и да е...двата инструмента леко се припокриват, така че втория може и да го пропуснем.

Как е сега положението?

Искам да направим е една друга проверка:

Изтеглете OTL.exe и го запазете на десктопа.

  • Стартирайте OTL (ако е необходимо, потвърдете през UAC).
  • Направете следните настройки:
  • Сложете отметка пред Scan All Users
  • Под менюто File Age изберете 90 days
  • Под менюто Standard Registry променете на ALL
  • Сложете отметки пред LOP и Purity Check
Под Публикувано изображение с Copy/ Paste въведете изцяло следната текстова информация (само това, което е поставено в карето):


netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%SYSTEMDRIVE%*.*
%USERPROFILE%*.*
%USERPROFILE%temp*.exe
%USERPROFILE%AppDataLocal*.*
%USERPROFILE%AppDataLocal*.
%USERPROFILE%AppDataLocaltemp*.exe
%USERPROFILE%AppDataRoaming*.*
%USERPROFILE%AppDataRoaming*.
%Public%DocumentsSoftwrapYOYOGAMESGM70FINAL*.exe
%Public%DocumentsFonts*.exe
%Public%DocumentsConfig*.exe
%Public%Documents*.*
%ProgramData%*.*
%ProgramData%*.
%CommonProgramFiles%*.*
%CommonProgramFiles%ComObjects*.exe
%commonprogramfiles(x86)%*.*
%programfiles%*.*
%programfiles%*.
%ProgramFiles(x86)%*.*
%ProgramFiles(x86)%*.
%systemroot%system32configsystemprofileAppDataLocal*.*
%systemroot%system32configsystemprofileAppDataRoaming*.*
%windir%SysWOW64configsystemprofileAppDataLocal*.*
%windir%SysWOW64configsystemprofileAppDataRoaming*.*
%windir%ServiceProfilesLocalServiceAppDataLocalTemp*.tlb
%windir%ServiceProfilesNetworkServiceAppDataLocalTemp*.tlb
%windir%temp*.exe
%windir%*.
%windir%installer*.
%windir%system32*.
%windir%sysnative*.
%Temp%smtmp1*.*
%Temp%smtmp2*.*
%Temp%smtmp3*.*
%Temp%smtmp4*.*
%systemroot%system32*.dll /lockedfiles
%systemroot%syswow64*.dll /lockedfiles
%systemroot%Tasks*.job /lockedfiles
%systemroot%system32drivers*.sys /90
%systemroot%system32drivers*.sys /lockedfiles
%systemroot%syswow64drivers*.sys /90
%systemroot%syswow64drivers*.sys /lockedfiles
%systemroot%system32Spoolprtprocsw32x86*.dll
%systemroot%*. /rp /s
%systemroot%assemblytmp*.* /S /MD5
%systemroot%assemblytemp*.* /S /MD5
%systemroot%assemblyGAC*.ini
%systemroot%assemblyGAC_32*.ini
%systemroot%assemblyGAC_64*.ini
%SystemRoot%assemblyGAC_MSIL*.ini
wsSystemRoot|l,n,u,@;True;False;True;$,{ /fn
%systemdrive%$Recycle.Bin|@;true;true;true /fp
c:|Babylon;true;true;true; /FP
c:|Fun4IM;true;true;true; /FP
c:|Bandoo;true;true;true; /FP
c:|Searchn;true;true;true; /FP
c:|Searchq;true;true;true; /FP
c:|searchqu;true;true;true; /FP
c:|datamngr;true;true;true; /FP
c:|iLivid;true;true;true; /FP
c:|whitesmoke;true;true;true; /FP
c:|MyWebSearch;true;true;true; /FP
c:|yontoo;true;true;true; /FP
c:|SweetIM;true;true;true; /FP
c:|conduit;true;true;true; /FP
c:|Ask;true;true;true; /FP
c:|Tarma;true;true;true; /FP
HKEY_CLASSES_ROOTCLSID{7C857801-7381-11CF-884D-00AA004B2E24} /s
HKEY_CLASSES_ROOTCLSID{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1} /s
HKEY_CURRENT_USERSoftwareClassesCLSID{42aedc87-2188-41fd-b9a3-0c966feabec1} /s
HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1} /s
HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{42aedc87-2188-41fd-b9a3-0c966feabec1} /s
HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{a2a9545d-a0c2-42b4-9708-a0b2badd77c8} /s
HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{7C857801-7381-11CF-884D-00AA004B2E24} /s
HKEY_CLASSES_ROOTclsid{5839FCA9-774D-42A1-ACDA-D6A79037F57F} /s
HKEY_CLASSES_ROOTclsid{fbeb8a05-beee-4442-804e-409d6c4515e9} /s
HKEY_CURRENT_USERSoftwareClassesclsid{fbeb8a05-beee-4442-804e-409d6c4515e9} /s
HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{5839FCA9-774D-42A1-ACDA-D6A79037F57F} /s
HKEY_CURRENT_USERSoftwareClassesclsid{12d0253a-7c96-815c-11e0-3034bbd97cc0}] /s
HKEY_CURRENT_USERSoftwareMSOLoad /s
bcdedit /enum all /v >C:boot.txt /c
>C:commands.txt echo list vol /raw /hide /c
/wait
>C:DiskReport.txt diskpart /s C:commands.txt /raw /hide /c
/wait
type c:diskreport.txt /c
/wait
erase c:commands.txt /hide /c
/wait
erase c:diskreport.txt /hide /c
/md5start
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
sceclt.dll
ntelogon.dll
logevent.dll
consrv.dll
services.exe
explorer.exe
lsass.exe
svchost.exe
wininit.exe
winlogon.exe
userinit.exe
atapi.sys
iaStor.sys
serial.sys
volsnap.sys
disk.sys
redbook.sys
i8042prt.sys
afd.sys
netbt.sys
csc.sys
tcpip.sys
dfsc.sys
hlp.dat
str.sys
crexv.ocx
/md5stop
  • Натиснете маркираният в синьо бутон: Run Scan.
  • Като приключи проверката, ще се създадат два файла - OTL.Txt и Extras.Txt. Прикачете тези два файла в следващия си коментар (погледнете опцията Прикачени файлове, когато публикувате мнение).
  • Автор

Файловете бяха твърде големи затова ги качих в dox

Файл : otl.rar

Линк за сваляне : http://dox.bg/files/dw?a=2863ee477a

Файл : AdwCleaner[s1].txt

Линк за сваляне : http://dox.bg/files/dw?a=1041b313e3

  • Стартирайте файла Публикувано изображение с двукратен клик на мишката.
  • Под Публикувано изображение с Copy/ Paste въведете изцяло следната текстова информация (само това, което е поставено в карето):
:OTL
IE - HKU\S-1-5-21-1418445458-2635008593-318623010-1000\..\SearchScopes\{8C44B271-0F09-4E81-A04D-FEE7D9C21B70}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3106777
IE - HKU\S-1-5-21-1418445458-2635008593-318623010-1000\..\SearchScopes\{EDCD965F-904D-46D6-A5FD-6B035F0E356E}: "URL" = http://websearch.ask.com/redirect?client=ie&tb=HIP&o=102876&src=kw&q={searchTerms}&locale=&apn_ptnrs=6G&apn_dtid=YYYYYYYYBG&apn_uid=b2c8c015-1ec1-4df9-8540-52d12fdf115f&apn_sauid=80FD47BC-6E69-4FD3-8CA5-8ED445F1B614
64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{336D0C35-8A85-403a-B9D2-65C292C39087}: C:\PROGRAM FILES\WEB ASSISTANT\FIREFOX
File not found (No name found) -- C:\PROGRAM FILES\WEB ASSISTANT\FIREFOX
File not found (No name found) -- C:\USERS\NEW\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\CTIAO2M7.DEFAULT\EXTENSIONS\[email protected]
File not found (No name found) -- C:\USERS\NEW\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\CTIAO2M7.DEFAULT\EXTENSIONS\[email protected]
File not found (No name found) -- C:\USERS\NEW\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\CTIAO2M7.DEFAULT\EXTENSIONS\[email protected]
O4 - HKLM..\Run: []  File not found
[2012.10.12 23:50:29 | 001,056,688 | ---- | M] (Yontoo LLC) -- C:\Users\New\AppData\Local\temp\YontooSetup-S.exe
[2011.11.16 22:32:27 | 000,000,000 | ---- | C] () -- C:\ProgramData\62d84d65df5fe8eb57eff37ccb4df5f6_c
:files
dir /s /a "C:\Users\New\AppData\Local\28050" /c
C:\PROGRAM FILES\WEB ASSISTANT
C:\USERS\NEW\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\CTIAO2M7.DEFAULT\EXTENSIONS\[email protected]
C:\USERS\NEW\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\CTIAO2M7.DEFAULT\EXTENSIONS\[email protected]
C:\USERS\NEW\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\CTIAO2M7.DEFAULT\EXTENSIONS\[email protected]
:reg
[HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions]
"{336D0C35-8A85-403a-B9D2-65C292C39087}"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Mozilla\Firefox\Extensions]
"{336D0C35-8A85-403a-B9D2-65C292C39087}"=-
:commands
[emptytemp]

След като въведете скрипта от цитата по-горе натиснете бутона, маркиран в червено: Run Fix

Windows ще се рестартира и ще се създаде лог файл - OTL fix log. Публикувайте съдържанието му с Copy/Paste в следващия си коментар.

  • Автор

All processes killed

========== OTL ==========

Registry key HKEY_USERSS-1-5-21-1418445458-2635008593-318623010-1000SoftwareMicrosoftInternet ExplorerSearchScopes{8C44B271-0F09-4E81-A04D-FEE7D9C21B70} deleted successfully.

Registry key HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{8C44B271-0F09-4E81-A04D-FEE7D9C21B70} not found.

Registry key HKEY_USERSS-1-5-21-1418445458-2635008593-318623010-1000SoftwareMicrosoftInternet ExplorerSearchScopes{EDCD965F-904D-46D6-A5FD-6B035F0E356E} deleted successfully.

Registry key HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{EDCD965F-904D-46D6-A5FD-6B035F0E356E} not found.

Registry value HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun deleted successfully.

C:UsersNewAppDataLocaltempYontooSetup-S.exe moved successfully.

C:ProgramData62d84d65df5fe8eb57eff37ccb4df5f6_c moved successfully.

========== FILES ==========

< dir /s /a "C:UsersNewAppDataLocal28050" /c >

Volume in drive C has no label.

Volume Serial Number is 3009-B69A

Directory of C:UsersNewAppDataLocal28050

19.06.2012 Ј. 22:13 <DIR> .

19.06.2012 Ј. 22:13 <DIR> ..

19.06.2012 Ј. 22:13 <DIR> eidos

0 File(s) 0 bytes

Directory of C:UsersNewAppDataLocal28050eidos

19.06.2012 Ј. 22:13 <DIR> .

19.06.2012 Ј. 22:13 <DIR> ..

19.06.2012 Ј. 22:13 <DIR> 3009b69a

0 File(s) 0 bytes

Directory of C:UsersNewAppDataLocal28050eidos3009b69a

19.06.2012 Ј. 22:13 <DIR> .

19.06.2012 Ј. 22:13 <DIR> ..

19.06.2012 Ј. 22:13 <DIR> cache

0 File(s) 0 bytes

Directory of C:UsersNewAppDataLocal28050eidos3009b69acache

19.06.2012 Ј. 22:13 <DIR> .

19.06.2012 Ј. 22:13 <DIR> ..

22.06.2012 Ј. 18:49 <DIR> persistent

22.06.2012 Ј. 18:49 <DIR> temp

0 File(s) 0 bytes

Directory of C:UsersNewAppDataLocal28050eidos3009b69acachepersistent

22.06.2012 Ј. 18:49 <DIR> .

22.06.2012 Ј. 18:49 <DIR> ..

22.06.2012 Ј. 18:49 846 BA8C6DA4D591E3B712775DC910D39928FFAFE49D

1 File(s) 846 bytes

Directory of C:UsersNewAppDataLocal28050eidos3009b69acachetemp

22.06.2012 Ј. 18:49 <DIR> .

22.06.2012 Ј. 18:49 <DIR> ..

0 File(s) 0 bytes

Total Files Listed:

1 File(s) 846 bytes

17 Dir(s) 49я601я896я448 bytes free

C:UsersNewDownloadscmd.bat deleted successfully.

C:UsersNewDownloadscmd.txt deleted successfully.

FileFolder C:PROGRAM FILESWEB ASSISTANT not found.

FileFolder C:USERSNEWAPPDATAROAMINGMOZILLAFIREFOXPROFILESCTIAO2M7.DEFAULTEXTENSIONSFFXTLBR@INCREDIBAR.COM not found.

FileFolder C:USERSNEWAPPDATAROAMINGMOZILLAFIREFOXPROFILESCTIAO2M7.DEFAULTEXTENSIONSPLUGIN@YONTOO.COM not found.

FileFolder C:USERSNEWAPPDATAROAMINGMOZILLAFIREFOXPROFILESCTIAO2M7.DEFAULTEXTENSIONSTOOLBAR@ASK.COM not found.

========== REGISTRY ==========

Registry value HKEY_LOCAL_MACHINESoftwareMozillaFirefoxExtensions{336D0C35-8A85-403a-B9D2-65C292C39087} not found.

Registry key HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{336D0C35-8A85-403a-B9D2-65C292C39087} not found.

Registry value HKEY_LOCAL_MACHINESOFTWAREWow6432NodeMozillaFirefoxExtensions{336D0C35-8A85-403a-B9D2-65C292C39087} not found.

Registry key HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{336D0C35-8A85-403a-B9D2-65C292C39087} not found.

========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

->Flash cache emptied: 56466 bytes

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

->Flash cache emptied: 0 bytes

User: New

->Temp folder emptied: 111789811 bytes

->Temporary Internet Files folder emptied: 13596927 bytes

->Java cache emptied: 1329872 bytes

->FireFox cache emptied: 89755754 bytes

->Google Chrome cache emptied: 424639767 bytes

->Opera cache emptied: 635786 bytes

->Flash cache emptied: 57292 bytes

User: Public

User: UpdatusUser

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

->Flash cache emptied: 56466 bytes

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 200704 bytes

%systemroot%System32 .tmp files removed: 0 bytes

%systemroot%System32 (64bit) .tmp files removed: 0 bytes

%systemroot%System32drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 183085 bytes

%systemroot%sysnativeconfigsystemprofileAppDataLocalMicrosoftWindowsTemporary Internet Files folder emptied: 67697 bytes

%systemroot%sysnativeconfigsystemprofileAppDataLocalLowSunJavaDeployment folder emptied: 626 bytes

RecycleBin emptied: 0 bytes

Total Files Cleaned = 613,00 mb

OTL by OldTimer - Version 3.2.69.0 log created on 11152012_095859

FilesFolders moved on Reboot...

C:UsersNewAppDataLocalTempFXSAPIDebugLogFile.txt moved successfully.

File move failed. C:Windowstempvmware-SYSTEMvmauthd.log scheduled to be moved on reboot.

C:Windowstempvmware-SYSTEMvmware-usbarb-3720.log moved successfully.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

За финал:

Изтеглете прикачения файл, разархивирайте го и го стартирайте: delete.zip

Обновете всички старти приложения, ако има засечени такива с помощта на PatchMyPC

А за да почистим използваните от нас инструменти

Изтеглете OTC.exe и го стартирайте. Натиснете бутона CleanUp!.

Рестартирайте компютъра, ако ви попита!

За финал прочетете тази тема: http://forums.softvisia.com/index.php/topic/13912-%D1%80%D1%8A%D0%BA%D0%BE%D0%B2%D0%BE%D0%B4%D1%81%D1%82%D0%B2%D0%BE-%D0%B7%D0%B0-%D0%BF%D0%BE%D0%B4%D0%B4%D1%80%D1%8A%D0%B6%D0%BA%D0%B0-%D0%BD%D0%B0-windows-xp-vista-%D0%B8-7-revision-20/ (все важни неща като актуализация на драйвърите, премахването на излишните програми, дегфрагментацията на системния дял, премахване на някои визуални ефекти с цел бързодействие на системата и т.н.).

Ако нямате повече проблеми и въпроси ще маркирам случая като РЕШЕН.

Поздрави! :)

  • Автор

Това е! Благодаря ви! Сега ще почистя след себе си :D А за подръжката, по-принцип от време на време си я правя :P Лек ден! :)

Архивирана тема

Темата е твърде стара и е архивирана. Не можете да добавяте нови отговори в нея, но винаги можете да публикувате нова тема, в която да продължи дискусията. Регистрирайте се или влезте във вашия профил за да публикувате нова тема.

Назад

Разглеждащи това в момента 0

  • Няма регистрирани потребители разглеждащи тази страница.

Дарение

  • Подкрепи съществуването на форума - направи дарение
    32%
    Дарени 315 € от нужните 1 000 €

Бюлетин

Получавайте известие, когато има важна промяна или новина свързана с форума.
Абонирайте се

Профил

Навигация

Търсене

Търсене

Конфигуриране на push известия в браузъра
Chrome (Android)
  1. Докоснете иконата на катинар до адресната лента.
  2. Докоснете Разрешения → Известия.
  3. Променете предпочитанията си.
Chrome (Desktop)
  1. Кликнете върху иконата на катинар в адресната лента.
  2. Изберете Настройки на сайта.
  3. Намерете Известия и коригирайте предпочитанията си.