Неизтриваеми регистри, забранен Task Manager, Firewall, не се пуска CCleaner

4 декември 201213 г.

Автор

Status: Detected (events: 6) 12/4/2012 11:07:25 AM Detected virus Virus.Win32.Sality.gen C:AMDSupport12-6-legacy_xp32_dd_ccc_whqlBinATISetup.exe High 12/4/2012 11:15:26 AM Detected Trojan program HEUR:Trojan.Win32.Generic C:Program FilesCommon FilesMicrosoft SharedDWDWTRIG20.EXE High 12/4/2012 11:16:06 AM Detected Trojan program HEUR:Trojan.Win32.Generic C:Program FilesMicrosoft OfficeOFFICE11GRAPH.EXE High 12/4/2012 11:16:27 AM Detected Trojan program HEUR:Trojan.Win32.Generic C:Program FilesMozilla Firefoxupdater.exe High 12/4/2012 11:17:02 AM Detected Trojan program HEUR:Trojan.Win32.Generic C:Program FilesTeamViewerVersion7tv_w32.exe High 12/4/2012 11:43:29 AM Detected Trojan program HEUR:Trojan.Win32.Generic D:DownloadsXS++XS++.exe//PE_Patch.PECompact//PecBundle//PECompact High След като сканирах със SalityKiller отново нямаше лог файл, и този път искаше рестарт на системата и заразените файлове не бяха 11, а в порядъка на 120.

4 декември 201213 г.

Да, това е очаквано...искам да изтрием едни файлове...после ще преинсталирате въпросните програми:

Разархивирайте прикачения файл cmd.zip и стартирайте файла cmd.bat.

Кажете ми какво изписва след като приключи.

4 декември 201213 г.

Автор

Deleted succesfully! Press any key to continue

4 декември 201213 г.

Чудесно...

Сега изтрийте вашето копие на Combofix и изтеглете ново оттук.

Стартирайте проверката и публикувайте резултатите.

4 декември 201213 г.

Автор

ComboFix 12-12-02.01 - Kosta 12/04/2012 14:45:07.4.2 - x86 Microsoft Windows XP Professional 5.1.2600.3.1251.359.1033.18.1022.712 [GMT 2:00] Running from: c:documents and settingsKostaDesktopComboFix.exe . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . . -------Legacy_DAC970NT . . ((((((((((((((((((((((((( Files Created from 2012-11-04 to 2012-12-04 ))))))))))))))))))))))))))))))) . . . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-12-04 08:37 . 2008-10-18 14:58 69632 ----a-w- c:windowsSOUNDMAN.EXE 2012-10-24 17:50 . 2012-11-12 19:49 261600 ----a-w- c:program filesmozilla firefoxcomponentsbrowsercomps.dll . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun] "Skype"="c:program filesSkypePhoneSkype.exe" [2012-11-09 17877168] . [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun] "SoundMan"="SOUNDMAN.EXE" [2012-12-04 69632] "StartCCC"="c:program filesATI TechnologiesATI.ACECore-StaticCLIStart.exe" [2012-12-04 98304] . [HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun] "CTFMON.EXE"="c:windowssystem32CTFMON.EXE" [2008-04-14 15360] . c:documents and settingsKostaStart MenuProgramsStartup _uninst_75325547.lnk - c:documents and settingsKostaLocal Settingstemp_uninst_75325547.bat [N/A] . c:documents and settingsAll UsersStart MenuProgramsStartup VIA RAID TOOL.lnk - c:program filesVIARAIDraid_tool.exe [2012-11-12 565248] . [HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity center] "AntiVirusOverride"=dword:00000001 "FirewallOverride"=dword:00000001 . [HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity centerSvc] "AntiVirusOverride"=dword:00000001 "AntiVirusDisableNotify"=dword:00000001 "FirewallDisableNotify"=dword:00000001 "FirewallOverride"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 "UacDisableNotify"=dword:00000001 . [HKLM~servicessharedaccessparametersfirewallpolicystandardprofile] "EnableFirewall"= 0 (0x0) . [HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList] "%windir%system32sessmgr.exe"= "c:Program FilesuTorrentuTorrent.exe"= "c:Program FilesSkypePhoneSkype.exe"= "c:Program FilesTeamViewerVersion7TeamViewer.exe"= "c:Program FilesTeamViewerVersion7TeamViewer_Service.exe"= "c:Program FilesATI TechnologiesATI.ACECore-StaticCLIStart.exe"= "c:Program FilesVIARAIDraid_tool.exe"= "d:Program FilesMalwarebytes' Anti-Malwarembam.exe"= "c:Documents and SettingsKostaDesktopavg_remover_stf_x86_2013_2706.exe"= "c:Program FilesMalwarebytes' Anti-Malwarembamgui.exe"= "%windir%Network Diagnosticxpnetdiag.exe"= "c:WINDOWSSOUNDMAN.EXE"= "c:Documents and SettingsKostaDesktopsalitykillerSalityKiller.exe"= . R0 viasraid;viasraid;c:windowssystem32driversviasraid.sys [11/12/2012 9:01 PM 77312] R1 avgtp;avgtp;c:windowssystem32driversavgtpx86.sys [12/2/2012 3:33 PM 26984] R2 MBAMScheduler;MBAMScheduler;c:program filesMalwarebytes' Anti-Malwarembamscheduler.exe [12/3/2012 10:49 AM 399432] R2 MBAMService;MBAMService;c:program filesMalwarebytes' Anti-Malwarembamservice.exe [12/3/2012 10:49 AM 676936] R3 MBAMProtector;MBAMProtector;c:windowssystem32driversmbam.sys [12/3/2012 10:49 AM 22856] S2 SkypeUpdate;Skype Updater;"c:program filesSkypeUpdaterUpdater.exe" --> c:program filesSkypeUpdaterUpdater.exe [?] . Contents of the 'Scheduled Tasks' folder . 2012-12-04 c:windowsTasksAdobe Flash Player Updater.job - c:windowssystem32MacromedFlashFlashPlayerUpdateService.exe [2012-11-12 20:12] . . ------- Supplementary Scan ------- . IE: E&xport to Microsoft Excel - c:progra~1MICROS~2OFFICE11EXCEL.EXE/3000 TCP: DhcpNameServer = 192.168.1.1 FF - ProfilePath - c:documents and settingsKostaApplication DataMozillaFirefoxProfiles9okxqodz.default FF - prefs.js: browser.search.selectedEngine - AVG Secure Search FF - prefs.js: browser.startup.homepage - hxxp://zamunda.net/ FF - prefs.js: keyword.URL - hxxp://isearch.avg.com/search?cid={39677E91-F827-4BF2-97B5-BD0E8970D5D6}&mid=81ddcc84729f47d08285d1a90beb2aab-864a9bdc40b4b43d421c36172313d8cc12028430&lang=en&ds=AVG&pr=pr&d=2012-12-02 15:33&v=13.2.0.4&sap=ku&q= FF - ExtSQL: 2012-11-12 21:57; [email protected]; c:documents and settingsKostaApplication DataMozillaFirefoxProfiles9okxqodz.defaultextensionsffxtlbr@incredibar.com FF - ExtSQL: 2012-11-12 22:22; {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}; c:documents and settingsKostaApplication DataMozillaFirefoxProfiles9okxqodz.defaultextensions{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi FF - ExtSQL: 2012-11-12 22:23; [email protected]; c:documents and settingsKostaApplication DataMozillaFirefoxProfiles9okxqodz.defaultextensionspersonas@christopher.beard.xpi FF - user.js: extensions.incredibar_i.newTab - false FF - user.js: extensions.incredibar_i.tlbrSrchUrl - hxxp://mystart.Incredibar.com/?a=6OyU0fnaYp&loc=IB_TB&i=26&search= FF - user.js: extensions.incredibar_i.id - 1059c73700000000000000e04d0fc358 FF - user.js: extensions.incredibar_i.instlDay - 15656 FF - user.js: extensions.incredibar_i.vrsn - 1.5.11.14 FF - user.js: extensions.incredibar_i.vrsni - 1.5.11.14 FF - user.js: extensions.incredibar_i.vrsnTs - 1.5.11.1421:57 FF - user.js: extensions.incredibar_i.prtnrId - Incredibar FF - user.js: extensions.incredibar_i.prdct - incredibar FF - user.js: extensions.incredibar_i.aflt - orgnl FF - user.js: extensions.incredibar_i.smplGrp - none FF - user.js: extensions.incredibar_i.tlbrId - base FF - user.js: extensions.incredibar_i.instlRef - FF - user.js: extensions.incredibar_i.dfltLng - FF - user.js: extensions.incredibar_i.excTlbr - false FF - user.js: extensions.incredibar_i.ms_url_id - FF - user.js: extensions.incredibar_i.upn2 - 6OyU0fnaYp FF - user.js: extensions.incredibar_i.upn2n - 92262440493798657 FF - user.js: extensions.incredibar_i.productid - 26 FF - user.js: extensions.incredibar_i.installerproductid - 26 FF - user.js: extensions.incredibar_i.did - 10643 FF - user.js: extensions.incredibar_i.ppd - 1 . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2012-12-04 14:51 Windows 5.1.2600 Service Pack 3 NTFS . scanning hidden processes ... . scanning hidden autostart entries ... . scanning hidden files ... . scan completed successfully hidden files: 0 . ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_LOCAL_MACHINEsoftwareClassesCLSID{645FF040-5081-101B-9F08-00AA002F954E}ShellО*т*в*а*р*я*н*е* *н*а* *C*C*l*e*a*n*e*r*& command] @="c:Program FilesCCleanerccleaner.exe" . --------------------- DLLs Loaded Under Running Processes --------------------- . - - - - - - - > 'winlogon.exe'(948) c:windowssystem32Ati2evxx.dll c:windowssystem32atiadlxx.dll . ------------------------ Other Running Processes ------------------------ . c:windowssystem32Ati2evxx.exe c:windowssystem32Ati2evxx.exe c:windowsSOUNDMAN.EXE c:program filesATI TechnologiesATI.ACECore-StaticMOM.exe c:program filesMalwarebytes' Anti-Malwarembamgui.exe c:program filesATI TechnologiesATI.ACECore-Staticccc.exe . ************************************************************************** . Completion time: 2012-12-04 14:53:10 - machine was rebooted ComboFix-quarantined-files.txt 2012-12-04 12:53 ComboFix2.txt 2012-12-03 22:26 ComboFix3.txt 2012-12-03 21:22 ComboFix4.txt 2012-12-03 19:15 . Pre-Run: 7,539,560,448 bytes free Post-Run: 7,754,731,520 bytes free . - - End Of File - - E12F83780CA928192CBD0319ACB89293

4 декември 201213 г.

Изтеглете, разархивирайте и стартирайте прикачения файл. disable_dangerous_services_xp.zip

Изберете YES на диалоговия прозорец.

Отворете Notepad.exe и се уверете, че пред Format => няма отметка пред Word Wrap (ако има я махнете).

с copy/paste поставете следната информация:

File::
c:\documents and settings\Kosta\Start Menu\Programs\Startup\_uninst_75325547.lnk
Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000000
"FirewallOverride"=dword:00000000
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000000
"AntiVirusDisableNotify"=dword:00000000
"FirewallDisableNotify"=dword:00000000
"FirewallOverride"=dword:00000000
"UpdatesDisableNotify"=dword:00000000
"UacDisableNotify"=dword:00000000
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"=dword:00000001
Firefox::
FF - ProfilePath - c:\documents and settings\Kosta\Application Data\Mozilla\Firefox\Profiles\9okxqodz.default\
FF - prefs.js: browser.search.selectedEngine - AVG Secure Search
FF - prefs.js: keyword.URL - hxxp://isearch.avg.com/search?cid={39677E91-F827-4BF2-97B5-BD0E8970D5D6}&mid=81ddcc84729f47d08285d1a90beb2aab-864a9bdc40b4b43d421c36172313d8cc12028430&lang=en&ds=AVG&pr=pr&d=2012-12-02 15:33&v=13.2.0.4&sap=ku&q=
FF - ExtSQL: 2012-11-12 21:57; [email protected]; c:\documents and settings\Kosta\Application Data\Mozilla\Firefox\Profiles\9okxqodz.default\extensions\[email protected]
FF - user.js: extensions.incredibar_i.newTab - false
FF - user.js: extensions.incredibar_i.tlbrSrchUrl - hxxp://mystart.Incredibar.com/?a=6OyU0fnaYp&loc=IB_TB&i=26&search=
FF - user.js: extensions.incredibar_i.id - 1059c73700000000000000e04d0fc358
FF - user.js: extensions.incredibar_i.instlDay - 15656
FF - user.js: extensions.incredibar_i.vrsn - 1.5.11.14
FF - user.js: extensions.incredibar_i.vrsni - 1.5.11.14
FF - user.js: extensions.incredibar_i.vrsnTs - 1.5.11.1421:57
FF - user.js: extensions.incredibar_i.prtnrId - Incredibar
FF - user.js: extensions.incredibar_i.prdct - incredibar
FF - user.js: extensions.incredibar_i.aflt - orgnl
FF - user.js: extensions.incredibar_i.smplGrp - none
FF - user.js: extensions.incredibar_i.tlbrId - base
FF - user.js: extensions.incredibar_i.instlRef -
FF - user.js: extensions.incredibar_i.dfltLng -
FF - user.js: extensions.incredibar_i.excTlbr - false
FF - user.js: extensions.incredibar_i.ms_url_id -
FF - user.js: extensions.incredibar_i.upn2 - 6OyU0fnaYp
FF - user.js: extensions.incredibar_i.upn2n - 92262440493798657
FF - user.js: extensions.incredibar_i.productid - 26
FF - user.js: extensions.incredibar_i.installerproductid - 26
FF - user.js: extensions.incredibar_i.did - 10643
FF - user.js: extensions.incredibar_i.ppd - 1
Reboot::

Запазете файла с име CFScript и го провлачете и пуснете в Combofix (както на картинката отдолу):

Публикувайте новия лог файл в следващия си пост.

4 декември 201213 г.

Автор

ComboFix 12-12-02.01 - Kosta 12/04/2012 15:04:14.5.2 - x86 Microsoft Windows XP Professional 5.1.2600.3.1251.359.1033.18.1022.686 [GMT 2:00] Running from: c:documents and settingsKostaDesktopComboFix.exe Command switches used :: c:documents and settingsKostaDesktopCFScript.txt . FILE :: "c:documents and settingsKostaStart MenuProgramsStartup_uninst_75325547.lnk" . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:documents and settingsKostaStart MenuProgramsStartup_uninst_75325547.lnk . . ((((((((((((((((((((((((( Files Created from 2012-11-04 to 2012-12-04 ))))))))))))))))))))))))))))))) . . . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-12-04 08:37 . 2008-10-18 14:58 69632 ----a-w- c:windowsSOUNDMAN.EXE 2012-10-24 17:50 . 2012-11-12 19:49 261600 ----a-w- c:program filesmozilla firefoxcomponentsbrowsercomps.dll . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun] "Skype"="c:program filesSkypePhoneSkype.exe" [2012-11-09 17877168] . [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun] "SoundMan"="SOUNDMAN.EXE" [2012-12-04 69632] "StartCCC"="c:program filesATI TechnologiesATI.ACECore-StaticCLIStart.exe" [2012-12-04 98304] . [HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun] "CTFMON.EXE"="c:windowssystem32CTFMON.EXE" [2008-04-14 15360] . c:documents and settingsAll UsersStart MenuProgramsStartup VIA RAID TOOL.lnk - c:program filesVIARAIDraid_tool.exe [2012-11-12 565248] . [HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList] "%windir%system32sessmgr.exe"= "c:Program FilesuTorrentuTorrent.exe"= "c:Program FilesSkypePhoneSkype.exe"= "c:Program FilesTeamViewerVersion7TeamViewer.exe"= "c:Program FilesTeamViewerVersion7TeamViewer_Service.exe"= "c:Program FilesATI TechnologiesATI.ACECore-StaticCLIStart.exe"= "c:Program FilesVIARAIDraid_tool.exe"= "d:Program FilesMalwarebytes' Anti-Malwarembam.exe"= "c:Documents and SettingsKostaDesktopavg_remover_stf_x86_2013_2706.exe"= "c:Program FilesMalwarebytes' Anti-Malwarembamgui.exe"= "%windir%Network Diagnosticxpnetdiag.exe"= "c:WINDOWSSOUNDMAN.EXE"= "c:Documents and SettingsKostaDesktopsalitykillerSalityKiller.exe"= . R0 viasraid;viasraid;c:windowssystem32driversviasraid.sys [11/12/2012 9:01 PM 77312] R1 avgtp;avgtp;c:windowssystem32driversavgtpx86.sys [12/2/2012 3:33 PM 26984] R2 MBAMScheduler;MBAMScheduler;c:program filesMalwarebytes' Anti-Malwarembamscheduler.exe [12/3/2012 10:49 AM 399432] R2 MBAMService;MBAMService;c:program filesMalwarebytes' Anti-Malwarembamservice.exe [12/3/2012 10:49 AM 676936] R3 MBAMProtector;MBAMProtector;c:windowssystem32driversmbam.sys [12/3/2012 10:49 AM 22856] S2 SkypeUpdate;Skype Updater;"c:program filesSkypeUpdaterUpdater.exe" --> c:program filesSkypeUpdaterUpdater.exe [?] . Contents of the 'Scheduled Tasks' folder . 2012-12-04 c:windowsTasksAdobe Flash Player Updater.job - c:windowssystem32MacromedFlashFlashPlayerUpdateService.exe [2012-11-12 20:12] . . ------- Supplementary Scan ------- . IE: E&xport to Microsoft Excel - c:progra~1MICROS~2OFFICE11EXCEL.EXE/3000 TCP: DhcpNameServer = 192.168.1.1 FF - ProfilePath - c:documents and settingsKostaApplication DataMozillaFirefoxProfiles9okxqodz.default FF - prefs.js: browser.startup.homepage - hxxp://zamunda.net/ FF - ExtSQL: 2012-11-12 21:57; [email protected]; c:documents and settingsKostaApplication DataMozillaFirefoxProfiles9okxqodz.defaultextensionsffxtlbr@incredibar.com FF - ExtSQL: 2012-11-12 22:22; {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}; c:documents and settingsKostaApplication DataMozillaFirefoxProfiles9okxqodz.defaultextensions{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi FF - ExtSQL: 2012-11-12 22:23; [email protected]; c:documents and settingsKostaApplication DataMozillaFirefoxProfiles9okxqodz.defaultextensionspersonas@christopher.beard.xpi FF - user.js: extensions.incredibar_i.newTab - false FF - user.js: extensions.incredibar_i.tlbrSrchUrl - hxxp://mystart.Incredibar.com/?a=6OyU0fnaYp&loc=IB_TB&i=26&search= FF - user.js: extensions.incredibar_i.id - 1059c73700000000000000e04d0fc358 FF - user.js: extensions.incredibar_i.instlDay - 15656 FF - user.js: extensions.incredibar_i.vrsn - 1.5.11.14 FF - user.js: extensions.incredibar_i.vrsni - 1.5.11.14 FF - user.js: extensions.incredibar_i.vrsnTs - 1.5.11.1421:57 FF - user.js: extensions.incredibar_i.prtnrId - Incredibar FF - user.js: extensions.incredibar_i.prdct - incredibar FF - user.js: extensions.incredibar_i.aflt - orgnl FF - user.js: extensions.incredibar_i.smplGrp - none FF - user.js: extensions.incredibar_i.tlbrId - base FF - user.js: extensions.incredibar_i.instlRef - FF - user.js: extensions.incredibar_i.dfltLng - FF - user.js: extensions.incredibar_i.excTlbr - false FF - user.js: extensions.incredibar_i.ms_url_id - FF - user.js: extensions.incredibar_i.upn2 - 6OyU0fnaYp FF - user.js: extensions.incredibar_i.upn2n - 92262440493798657 FF - user.js: extensions.incredibar_i.productid - 26 FF - user.js: extensions.incredibar_i.installerproductid - 26 FF - user.js: extensions.incredibar_i.did - 10643 FF - user.js: extensions.incredibar_i.ppd - 1 . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2012-12-04 15:08 Windows 5.1.2600 Service Pack 3 NTFS . scanning hidden processes ... . scanning hidden autostart entries ... . scanning hidden files ... . scan completed successfully hidden files: 0 . ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_LOCAL_MACHINEsoftwareClassesCLSID{645FF040-5081-101B-9F08-00AA002F954E}ShellО*т*в*а*р*я*н*е* *н*а* *C*C*l*e*a*n*e*r*& command] @="c:Program FilesCCleanerccleaner.exe" . --------------------- DLLs Loaded Under Running Processes --------------------- . - - - - - - - > 'winlogon.exe'(948) c:windowssystem32Ati2evxx.dll c:windowssystem32atiadlxx.dll . ------------------------ Other Running Processes ------------------------ . c:windowssystem32Ati2evxx.exe c:windowssystem32Ati2evxx.exe c:program filesMalwarebytes' Anti-Malwarembamgui.exe c:windowsSOUNDMAN.EXE c:program filesATI TechnologiesATI.ACECore-StaticMOM.exe c:program filesATI TechnologiesATI.ACECore-Staticccc.exe . ************************************************************************** . Completion time: 2012-12-04 15:10:13 - machine was rebooted ComboFix-quarantined-files.txt 2012-12-04 13:10 ComboFix2.txt 2012-12-04 12:53 ComboFix3.txt 2012-12-03 22:26 ComboFix4.txt 2012-12-03 21:22 ComboFix5.txt 2012-12-04 13:03 . Pre-Run: 7,733,383,168 bytes free Post-Run: 7,733,977,088 bytes free . - - End Of File - - 616EF0A57130DC8CBC8A9DB8E8CB0107

4 декември 201213 г.

Отворете Start => run => въведете CMD => натиснете Enter

Въведете командата sc delete avgtp => натиснете Enter

След това по-най бързия начин изтеглете и инсталирайте антивирусна програма (като например) безпларната Avira AntiVir Free 13.0.0.2832 (94.4 MB).

След това направете следните настройки:

Отворете програмата с двоен клик върху иконката в трея и след това кликнете на configuration горе вдясно. Сложете отметка пред expert mode.

След това направете следните настройки:

След това обновете дефинициите и стартирайте пълна проверка:

Публикувайте резултатите след като приключи!

За финал:

СТЪПКА 1

Стартирайте отново програмата AdwCleaner (by Xplode).

Затворете всички стартирани програми и браузъри
Кликнете два пъти върху adwcleaner.exe за да стартирате инструмента.
Този път маркирайте Delete
Вашият компютър ще се рестартира автоматично. Текстовия файл ще се отвори след рестарта.
Моля, да публикувате съдържанието на този лог в отговора си
Можете да намерите лога,който автоматично се запомня тук C:\AdwCleaner[R1].txt.

СТЪПКА 2

Моля изтеглете Junkware Removal Tool на вашия десктоп.

Спрете временно работата на защитните програми.
Стартирайте инструмента JRT.exe
Ще се отвори ДОС прозорец. Натиснете което и да е копче от клавиатурата.
Затворете излишните приложения и всички браузъри и изчакайте проверката да завърши.
Ще се появи лог файл (който можете да намерите и ръчно на десктопа с името JRT.txt).
Моля копирайте съдържанието на лог файла в следващия си пост.

СТЪПКА 3

Изтеглете OTL.exe и го запазете на десктопа.

Стартирайте OTL (ако е необходимо, потвърдете през UAC).
Направете следните настройки:
Сложете отметка пред Scan All Users
Под менюто File Age изберете 90 days
Под менюто Standard Registry променете на ALL
Сложете отметки пред LOP и Purity Check

Под

с Copy/ Paste въведете изцяло следната текстова информация (само това, което е поставено в карето):

netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%SYSTEMDRIVE%\*.*
%USERPROFILE%\*.*
%USERPROFILE%\Application Data\*.*
%USERPROFILE%\Application Data\*.
%USERPROFILE%\Local Settings\*.*
%USERPROFILE%\Local Settings\temp\*.exe
%USERPROFILE%\Local Settings\Temporary Internet Files\*.exe
%USERPROFILE%\Local Settings\Application Data\*.*
%AllUsersProfile%\*.*
%AllUsersProfile%\Application Data\*.*
%AllUsersProfile%\Application Data\*.
%AllUsersProfile%\Application Data\Local Settings\*.*
%AllUsersProfile%\Application Data\Local Settings\Temp\*.exe
%ALLUSERSPROFILE%\Documents\My Music\*.exe
%ALLUSERSPROFILE%\Documents\My Pictures\*.exe
%ALLUSERSPROFILE%\Documents\My Videos\*.exe
%ALLUSERSPROFILE%\Documents\*.exe
%USERPROFILE%\My Documents\*.*
%CommonProgramFiles%\*.*
%CommonProgramFiles%\ComObjects*.*
%PROGRAMFILES%\*.*
%PROGRAMFILES%\*.
%systemroot%\system32\config\systemprofile\*.*
%systemroot%\system32\config\systemprofile\Application Data\*.*
%systemroot%\system32\config\systemprofile\\Local Settings\*.*
%systemroot%\system32\config\systemprofile\\Local Settings\Application Data\*.*
%systemroot%\system32\config\systemprofile\\Local Settings\Temp\*.exe
%systemroot%\system32\config\systemprofile\\Local Settings\Temporary Internet Files\*.exe
C:\Documents and Settings\LocalService\Application Data\*.*
C:\Documents and Settings\LocalService\Local Settings\Application Data\*.*
C:\Documents and Settings\LocalService\Local Settings\temp\*.exe
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\*.exe
C:\Documents and Settings\LocalService\Local Settings\*.*
C:\Documents and Settings\LocalService\*.*
C:\Documents and Settings\NetworkService\Application Data\*.*
C:\Documents and Settings\NetworkService\Local Settings\Application Data\*.*
C:\Documents and Settings\NetworkService\Local Settings\temp\*.exe
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\*.exe
C:\Documents and Settings\NetworkService\Local Settings\*.*
C:\Documents and Settings\NetworkService\*.*
%windir%\temp\*.exe
%windir%\*.
%windir%\installer\*.
%windir%\system32\*.
%Temp%\smtmp\1\*.*
%Temp%\smtmp\2\*.*
%Temp%\smtmp\3\*.*
%Temp%\smtmp\4\*.*
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\system32\drivers\*.sys /90
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\system32\Spool\prtprocs\w32x86\*.dll
%systemroot%\*. /rp /s
%systemroot%\assembly\tmp\*.* /S /MD5
%systemroot%\assembly\temp\*.* /S /MD5
%systemroot%\assembly\GAC\*.ini
%systemroot%\assembly\GAC_32\*.ini
%SystemRoot%\assembly\GAC_MSIL\*.ini
wsSystemRoot|l,n,u,@;True;False;True;$,{ /fn
%systemdrive%\$Recycle.Bin|@;true;true;true /fp
c:|incredibar;true;true;true; /FP
HKEY_CLASSES_ROOT\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24} /s
HKEY_CLASSES_ROOT\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1} /s
HKEY_CURRENT_USER\Software\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1} /s
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1} /s
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1} /s
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a2a9545d-a0c2-42b4-9708-a0b2badd77c8} /s
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24} /s
HKEY_CLASSES_ROOT\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F} /s
HKEY_CLASSES_ROOT\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9} /s
HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9} /s
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F} /s
HKEY_CURRENT_USER\Software\Classes\clsid\{12d0253a-7c96-815c-11e0-3034bbd97cc0}] /s
HKEY_CURRENT_USER\Software\MSOLoad /s
type C:\WINDOWS\system.ini >> test.txt /c
>C:\commands.txt echo list vol /raw /hide /c
/wait
>C:\DiskReport.txt diskpart /s C:\commands.txt /raw /hide /c
/wait
type c:\diskreport.txt /c
/wait
erase c:\commands.txt /hide /c
/wait
erase c:\diskreport.txt /hide /c
/md5start
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
sceclt.dll
ntelogon.dll
logevent.dll
consrv.dll
services.exe
svchost.exe
explorer.exe
userinit.exe
winlogon.exe
smss.exe
lsass.exe
atapi.sys
iaStor.sys
serial.sys
disk.sys
volsnap.sys
redbook.sys
i8042prt.sys
afd.sys
netbt.sys
tcpip.sys
ipsec.sys
hlp.dat
str.sys
crexv.ocx
/md5stop

Натиснете маркираният в синьо бутон: Run Scan.
Като приключи проверката, ще се създадат два файла - OTL.Txt и Extras.Txt. Прикачете тези два файла в следващия си коментар (погледнете опцията Прикачени файлове, когато публикувате мнение).

По време на сканирането с инструментите, не използвайте компютъра си и изключете интернет достъпа !

4 декември 201213 г.

Автор

Avira Free Antivirus Report file date: Tuesday, December 04, 2012 15:40 The program is running as an unrestricted full version. Online services are available. Licensee : Avira Free Antivirus Serial number : 0000149996-ADJIE-0000001 Platform : Microsoft Windows XP Windows version : (Service Pack 3) [5.1.2600] Boot mode : Normally booted Username : Kosta Computer name : KOSTA-702552266 Version information: BUILD.DAT : 13.0.0.2832 48424 Bytes 20.11.2012 г. 13:53:00 AVSCAN.EXE : 13.4.0.294 639264 Bytes 16.11.2012 г. 14:03:35 AVSCANRC.DLL : 13.4.0.219 54560 Bytes 09.10.2012 г. 14:19:07 LUKE.DLL : 13.4.0.267 67360 Bytes 13.11.2012 г. 14:45:05 AVSCPLR.DLL : 13.4.0.271 93984 Bytes 14.11.2012 г. 16:44:59 AVREG.DLL : 13.4.0.267 245536 Bytes 13.11.2012 г. 14:36:46 avlode.dll : 13.4.0.294 426784 Bytes 16.11.2012 г. 14:03:00 avlode.rdf : 13.0.0.24 7196 Bytes 27.9.2012 г. 08:30:38 VBASE000.VDF : 7.10.0.0 19875328 Bytes 06.11.2009 г. 12:50:29 VBASE001.VDF : 7.11.0.0 13342208 Bytes 14.12.2010 г. 12:50:31 VBASE002.VDF : 7.11.19.170 14374912 Bytes 20.12.2011 г. 12:50:34 VBASE003.VDF : 7.11.21.238 4472832 Bytes 01.2.2012 г. 12:50:36 VBASE004.VDF : 7.11.26.44 4329472 Bytes 28.3.2012 г. 12:50:37 VBASE005.VDF : 7.11.34.116 4034048 Bytes 29.6.2012 г. 12:42:40 VBASE006.VDF : 7.11.41.250 4902400 Bytes 06.9.2012 г. 12:42:40 VBASE007.VDF : 7.11.50.230 3904512 Bytes 22.11.2012 г. 13:31:55 VBASE008.VDF : 7.11.50.231 2048 Bytes 22.11.2012 г. 13:31:55 VBASE009.VDF : 7.11.50.232 2048 Bytes 22.11.2012 г. 13:31:55 VBASE010.VDF : 7.11.50.233 2048 Bytes 22.11.2012 г. 13:31:55 VBASE011.VDF : 7.11.50.234 2048 Bytes 22.11.2012 г. 13:31:55 VBASE012.VDF : 7.11.50.235 2048 Bytes 22.11.2012 г. 13:31:55 VBASE013.VDF : 7.11.50.236 2048 Bytes 22.11.2012 г. 13:31:55 VBASE014.VDF : 7.11.51.27 133632 Bytes 23.11.2012 г. 13:31:55 VBASE015.VDF : 7.11.51.95 140288 Bytes 26.11.2012 г. 13:31:56 VBASE016.VDF : 7.11.51.221 164352 Bytes 29.11.2012 г. 13:31:56 VBASE017.VDF : 7.11.52.29 158208 Bytes 01.12.2012 г. 13:31:56 VBASE018.VDF : 7.11.52.91 116736 Bytes 03.12.2012 г. 13:31:56 VBASE019.VDF : 7.11.52.92 2048 Bytes 03.12.2012 г. 13:31:56 VBASE020.VDF : 7.11.52.93 2048 Bytes 03.12.2012 г. 13:31:56 VBASE021.VDF : 7.11.52.94 2048 Bytes 03.12.2012 г. 13:31:56 VBASE022.VDF : 7.11.52.95 2048 Bytes 03.12.2012 г. 13:31:56 VBASE023.VDF : 7.11.52.96 2048 Bytes 03.12.2012 г. 13:31:57 VBASE024.VDF : 7.11.52.97 2048 Bytes 03.12.2012 г. 13:31:57 VBASE025.VDF : 7.11.52.98 2048 Bytes 03.12.2012 г. 13:31:57 VBASE026.VDF : 7.11.52.99 2048 Bytes 03.12.2012 г. 13:31:57 VBASE027.VDF : 7.11.52.100 2048 Bytes 03.12.2012 г. 13:31:57 VBASE028.VDF : 7.11.52.101 2048 Bytes 03.12.2012 г. 13:31:57 VBASE029.VDF : 7.11.52.102 2048 Bytes 03.12.2012 г. 13:31:57 VBASE030.VDF : 7.11.52.103 2048 Bytes 03.12.2012 г. 13:31:57 VBASE031.VDF : 7.11.52.122 66048 Bytes 04.12.2012 г. 13:31:57 Engine version : 8.2.10.214 AEVDF.DLL : 8.1.2.10 102772 Bytes 19.9.2012 г. 12:42:55 AESCRIPT.DLL : 8.1.4.70 467323 Bytes 04.12.2012 г. 13:32:00 AESCN.DLL : 8.1.9.4 131445 Bytes 15.11.2012 г. 14:08:00 AESBX.DLL : 8.2.5.12 606578 Bytes 28.8.2012 г. 14:58:06 AERDL.DLL : 8.2.0.74 643445 Bytes 07.11.2012 г. 09:09:14 AEPACK.DLL : 8.3.0.40 815479 Bytes 12.11.2012 г. 11:19:00 AEOFFICE.DLL : 8.1.2.50 201084 Bytes 05.11.2012 г. 13:00:38 AEHEUR.DLL : 8.1.4.156 5579128 Bytes 04.12.2012 г. 13:31:59 AEHELP.DLL : 8.1.25.2 258423 Bytes 12.10.2012 г. 13:52:32 AEGEN.DLL : 8.1.6.10 438646 Bytes 15.11.2012 г. 14:08:00 AEEXP.DLL : 8.2.0.16 119157 Bytes 04.12.2012 г. 13:32:00 AEEMU.DLL : 8.1.3.2 393587 Bytes 19.9.2012 г. 12:42:55 AECORE.DLL : 8.1.29.2 201079 Bytes 07.11.2012 г. 09:09:14 AEBB.DLL : 8.1.1.4 53619 Bytes 05.11.2012 г. 13:00:38 AVWINLL.DLL : 13.4.0.163 25888 Bytes 19.9.2012 г. 16:09:30 AVPREF.DLL : 13.4.0.163 50464 Bytes 19.9.2012 г. 16:07:51 AVREP.DLL : 13.4.0.244 177952 Bytes 30.10.2012 г. 12:06:41 AVARKT.DLL : 13.4.0.292 260384 Bytes 16.11.2012 г. 11:58:39 AVEVTLOG.DLL : 13.4.0.267 167200 Bytes 13.11.2012 г. 14:35:34 SQLITE3.DLL : 3.7.0.1 397088 Bytes 19.9.2012 г. 16:17:40 AVSMTP.DLL : 13.4.0.163 62240 Bytes 19.9.2012 г. 16:08:55 NETNT.DLL : 13.4.0.163 15648 Bytes 19.9.2012 г. 16:16:26 RCIMAGE.DLL : 13.4.0.163 4782880 Bytes 19.9.2012 г. 17:40:13 RCTEXT.DLL : 13.4.0.163 66336 Bytes 19.10.2012 г. 09:56:26 Configuration settings for the scan: Jobname.............................: Complete system scan Configuration file..................: C:Program FilesAviraAntiVir Desktopsysscan.avp Reporting...........................: default Primary action......................: Repair Secondary action....................: Delete Scan master boot sector.............: on Scan boot sector....................: on Boot sectors........................: C:, D:, E:, Process scan........................: on Extended process scan...............: on Scan registry.......................: on Search for rootkits.................: on Integrity checking of system files..: off Optimised scan......................: on Scan all files......................: All files Scan archives.......................: on Limit recursion depth...............: 20 Smart extensions....................: on Macrovirus heuristic................: on File heuristic......................: extended Deviating risk categories...........: +APPL,+GAME,+JOKE,+PCK,+SPR, Start of the scan: Tuesday, December 04, 2012 15:40 Starting master boot sector scan: Master boot sector HD0 [iNFO] No virus was found! Start scanning boot sectors: Boot sector 'C:' [iNFO] No virus was found! Boot sector 'D:' [iNFO] No virus was found! Boot sector 'E:' [iNFO] No virus was found! Starting search for hidden objects. HKEY_LOCAL_MACHINESystemControlSet001ServicesDhcpParameters{AF2482AC-44F8-4D4F-AF87-E79F62C8EF28} [NOTE] The registry entry is invisible. HKEY_LOCAL_MACHINESystemControlSet001ServicesTcpipParametersInterfaces{AF2482AC-44F8-4D4F-AF87-E79F62C8EF28}NTEContextList [NOTE] The registry entry is invisible. HKEY_LOCAL_MACHINESystemControlSet001ServicesTcpipParametersInterfaces{AF2482AC-44F8-4D4F-AF87-E79F62C8EF28}DhcpServer [NOTE] The registry entry is invisible. HKEY_LOCAL_MACHINESystemControlSet001ServicesTcpipParametersInterfaces{AF2482AC-44F8-4D4F-AF87-E79F62C8EF28}DhcpServer HKEY_LOCAL_MACHINESystemControlSet001Services{AF2482AC-44F8-4D4F-AF87-E79F62C8EF28}ParametersTcpipDhcpIPAddress [NOTE] The registry entry is invisible. HKEY_LOCAL_MACHINESystemControlSet001Services{AF2482AC-44F8-4D4F-AF87-E79F62C8EF28}ParametersTcpipDhcpSubnetMask [NOTE] The registry entry is invisible. HKEY_USERSS-1-5-21-1659004503-1604221776-682003330-1003SoftwareAPNUpdaterhomepageurl_lmd [NOTE] The registry entry is invisible. HKEY_USERSS-1-5-21-1659004503-1604221776-682003330-1003SoftwareAPNUpdaterhomepageurl_lmd HKEY_USERSS-1-5-21-1659004503-1604221776-682003330-1003SoftwareAPNUpdaterhomepageurl_lmd The scan of running processes will be started: Scan process 'rsmsink.exe' - '27' Module(s) have been scanned Scan process 'msdtc.exe' - '39' Module(s) have been scanned Scan process 'dllhost.exe' - '58' Module(s) have been scanned Scan process 'dllhost.exe' - '44' Module(s) have been scanned Scan process 'vssvc.exe' - '47' Module(s) have been scanned Scan process 'avscan.exe' - '85' Module(s) have been scanned Scan process 'avcenter.exe' - '83' Module(s) have been scanned Scan process 'CIDGlobalLight.exe' - '40' Module(s) have been scanned Scan process 'DNTPService.exe' - '68' Module(s) have been scanned Scan process 'avgnt.exe' - '67' Module(s) have been scanned Scan process 'AVWEBGRD.EXE' - '49' Module(s) have been scanned Scan process 'sched.exe' - '39' Module(s) have been scanned Scan process 'avshadow.exe' - '25' Module(s) have been scanned Scan process 'avguard.exe' - '87' Module(s) have been scanned Scan process 'Updater.exe' - '46' Module(s) have been scanned Scan process 'plugin-container.exe' - '63' Module(s) have been scanned Scan process 'firefox.exe' - '117' Module(s) have been scanned Scan process 'explorer.exe' - '92' Module(s) have been scanned Scan process 'wuauclt.exe' - '32' Module(s) have been scanned Scan process 'svchost.exe' - '78' Module(s) have been scanned Scan process 'raid_tool.exe' - '21' Module(s) have been scanned Scan process 'SOUNDMAN.EXE' - '21' Module(s) have been scanned Scan process 'mbamscheduler.exe' - '26' Module(s) have been scanned Scan process 'Ati2evxx.exe' - '35' Module(s) have been scanned Scan process 'spoolsv.exe' - '52' Module(s) have been scanned Scan process 'svchost.exe' - '31' Module(s) have been scanned Scan process 'svchost.exe' - '156' Module(s) have been scanned Scan process 'svchost.exe' - '38' Module(s) have been scanned Scan process 'svchost.exe' - '38' Module(s) have been scanned Scan process 'Ati2evxx.exe' - '26' Module(s) have been scanned Scan process 'lsass.exe' - '57' Module(s) have been scanned Scan process 'services.exe' - '35' Module(s) have been scanned Scan process 'winlogon.exe' - '66' Module(s) have been scanned Scan process 'csrss.exe' - '12' Module(s) have been scanned Scan process 'smss.exe' - '2' Module(s) have been scanned Starting to scan executable files (registry): The registry was scanned ( '366' files ). Starting the file scan: Begin scan in 'C:' C:Program FilesCommon FilesMicrosoft SharedOFFICE11MSOXMLED.EXE [DETECTION] Contains suspicious code HEUR/Crypted [NOTE] The detection was classified as suspicious. [NOTE] A backup was created as '54575d9d.qua' ( QUARANTINE ) [WARNING] The file was ignored. C:System Volume Information_restore{350EC62C-C1D6-4D87-8F3C-D1CE9796A78A}RP1A0000215.exe [DETECTION] Contains code of the W32/Sality.Patched Windows virus [NOTE] A backup was created as '537a64dd.qua' ( QUARANTINE ) [NOTE] The file was deleted. Begin scan in 'D:' D:DownloadsAdobe Photoshop CS5 v12.03 Extended + PortablePortableZamunda.netPhotoshop CS5 v12.03NativeSTUBEXE8.0.1135@[email protected] [DETECTION] Is the TR/Crypt.XPACK.Gen Trojan [NOTE] A backup was created as '4ce08c62.qua' ( QUARANTINE ) [NOTE] The file was deleted. D:GamesFavorite-GamesFGUpdate.exe [DETECTION] Contains suspicious code HEUR/Malware [NOTE] The detection was classified as suspicious. [NOTE] A backup was created as '1e80d3c7.qua' ( QUARANTINE ) [WARNING] The file was ignored. Begin scan in 'E:' End of the scan: Tuesday, December 04, 2012 16:27 Used time: 46:36 Minute(s) The scan has been done completely. 5130 Scanned directories 255072 Files were scanned 2 Viruses and/or unwanted programs were found 2 Files were classified as suspicious 2 Files were deleted 0 Viruses and unwanted programs were repaired 4 Files were moved to quarantine 0 Files were renamed 0 Files cannot be scanned 255068 Files not concerned 5457 Archives were scanned 2 Warnings 10 Notes 202765 Objects were scanned with rootkit scan 9 Hidden objects were found # AdwCleaner v2.011 - Logfile created 12/04/2012 at 16:32:05 # Updated 02/12/2012 by Xplode # Operating system : Microsoft Windows XP Service Pack 3 (32 bits) # User : Kosta - KOSTA-702552266 # Boot Mode : Normal # Running from : C:Documents and SettingsKostaDesktopadwcleaner.exe # Option [Delete] ***** [services] ***** ***** [Files / Folders] ***** File Deleted : C:Documents and SettingsKostaApplication DataMozillaFirefoxProfiles9okxqodz.defaultsearchpluginsAskcom.xml File Deleted : C:Documents and SettingsKostaApplication DataMozillaFirefoxProfiles9okxqodz.defaultsearchpluginsMyStart Search.xml File Deleted : C:Program FilesMozilla Firefoxsearchpluginsavg-secure-search.xml File Deleted : C:user.js File Deleted : C:WINDOWSTasksScheduled Update for Ask Toolbar.job Folder Deleted : C:DOCUME~1KostaLOCALS~1TempAskSearch Folder Deleted : C:Documents and SettingsKostaApplication DataAskToolbar Folder Deleted : C:Documents and SettingsKostaApplication Dataincredibar.com Folder Deleted : C:Documents and SettingsKostaApplication DataMozillaFirefoxProfiles9okxqodz.defaultextensionsffxtlbr@incredibar.com Folder Deleted : C:Documents and SettingsKostaApplication DataMozillaFirefoxProfiles9okxqodz.defaultextensionstoolbar@ask.com Folder Deleted : C:Documents and SettingsKostaLocal SettingsApplication DataAskToolbar Folder Deleted : C:Program FilesAsk.com Folder Deleted : C:WINDOWSInstaller{86D4B82A-ABED-442A-BE86-96357B70F4FE} ***** [Registry] ***** Key Deleted : HKCUSoftwareAPN Key Deleted : HKCUSoftwareAsk.com Key Deleted : HKCUSoftwareAskToolbar Key Deleted : HKCUSoftwareIB Updater Key Deleted : HKCUSoftwareIM Key Deleted : HKCUSoftwareImInstaller Key Deleted : HKCUSoftwareincredibar.com Key Deleted : HKCUSoftwareMicrosoftInternet ExplorerLow RightsElevationPolicy{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A} Key Deleted : HKCUSoftwareMicrosoftInternet ExplorerSearchScopes{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E} Key Deleted : HKCUSoftwareMicrosoftInternet ExplorerSearchScopes{95B7759C-8C7F-4BF1-B163-73684A933233} Key Deleted : HKCUSoftwareMicrosoftWindowsCurrentVersionExtStats{D4027C7F-154A-4066-A1AD-4243D8127440} Key Deleted : HKCUSoftwareMicrosoftWindowsCurrentVersionUninstall{79A765E1-C399-405B-85AF-466F52E918B0} Key Deleted : HKLMSoftwareAPN Key Deleted : HKLMSoftwareAskToolbar Key Deleted : HKLMSOFTWAREClassesAppID{09C554C3-109B-483C-A06B-F14172F1A947} Key Deleted : HKLMSOFTWAREClassesAppID{4E1E9D45-8BF9-4139-915C-9F83CC3D5921} Key Deleted : HKLMSOFTWAREClassesAppID{608D3067-77E8-463D-9084-908966806826} Key Deleted : HKLMSOFTWAREClassesAppID{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874} Key Deleted : HKLMSOFTWAREClassesAppID{B12E99ED-69BD-437C-86BE-C862B9E5444D} Key Deleted : HKLMSOFTWAREClassesAppID{B302A1BD-0157-49FA-90F1-4E94F22C7B4B} Key Deleted : HKLMSOFTWAREClassesAppID{CFE8AAFD-A0F3-4329-84E9-6B679EC93EC2} Key Deleted : HKLMSOFTWAREClassesAppID{D7EE8177-D51E-4F89-92B6-83EA2EC40800} Key Deleted : HKLMSOFTWAREClassesAppIDescort.DLL Key Deleted : HKLMSOFTWAREClassesAppIDescortApp.DLL Key Deleted : HKLMSOFTWAREClassesAppIDescortEng.DLL Key Deleted : HKLMSOFTWAREClassesAppIDescorTlbr.DLL Key Deleted : HKLMSOFTWAREClassesAppIDesrv.EXE Key Deleted : HKLMSOFTWAREClassesAppIDExtension.DLL Key Deleted : HKLMSOFTWAREClassesAppIDGenericAskToolbar.DLL Key Deleted : HKLMSOFTWAREClassesCLSID{00000000-6E41-4FD3-8538-502F5495E5FC} Key Deleted : HKLMSOFTWAREClassesCLSID{C01315C7-B4E2-4864-B43D-5FAFC414D179} Key Deleted : HKLMSOFTWAREClassesCLSID{C1545464-C77C-4130-A572-1C619E2895FE} Key Deleted : HKLMSOFTWAREClassesCLSID{D4027C7F-154A-4066-A1AD-4243D8127440} Key Deleted : HKLMSOFTWAREClassesCLSID{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} Key Deleted : HKLMSOFTWAREClassesCLSID{ED0E67AD-926C-4008-87E5-03CF72AA2A7E} Key Deleted : HKLMSOFTWAREClassesCLSID{EF7FEC6D-451B-4452-9D26-7E10C6B5DB6E} Key Deleted : HKLMSOFTWAREClassesescort.escortIEPane Key Deleted : HKLMSOFTWAREClassesescort.escortIEPane.1 Key Deleted : HKLMSOFTWAREClassesesrv.IncredibarESrvc Key Deleted : HKLMSOFTWAREClassesesrv.IncredibarESrvc.1 Key Deleted : HKLMSOFTWAREClassesGenericAskToolbar.ToolbarWnd Key Deleted : HKLMSOFTWAREClassesGenericAskToolbar.ToolbarWnd.1 Key Deleted : HKLMSOFTWAREClassesI Key Deleted : HKLMSOFTWAREClassesIncredibarApp.appCore Key Deleted : HKLMSOFTWAREClassesIncredibarApp.appCore.1 Key Deleted : HKLMSOFTWAREClassesInstallerFeaturesA28B4D68DEBAA244EB686953B7074FEF Key Deleted : HKLMSOFTWAREClassesInstallerProductsA28B4D68DEBAA244EB686953B7074FEF Key Deleted : HKLMSOFTWAREClassesInstallerUpgradeCodesF928123A039649549966D4C29D35B1C9 Key Deleted : HKLMSOFTWAREClassesInterface{03E2A1F3-4402-4121-8B35-733216D61217} Key Deleted : HKLMSOFTWAREClassesInterface{22B0769F-794B-4422-AC84-47B123C8986D} Key Deleted : HKLMSOFTWAREClassesInterface{255E0B2A-D747-4EEF-B7CE-159D73A3656D} Key Deleted : HKLMSOFTWAREClassesInterface{28ED590D-F5ED-4E05-A87F-1D759F1C6169} Key Deleted : HKLMSOFTWAREClassesInterface{45D5B93F-E2ED-4AF2-915E-DCDDBDA8C33C} Key Deleted : HKLMSOFTWAREClassesInterface{6C434537-053E-486D-B62A-160059D9D456} Key Deleted : HKLMSOFTWAREClassesInterface{771B99AB-636F-4A11-9039-8DFEB927B061} Key Deleted : HKLMSOFTWAREClassesInterface{91CF619A-4686-4CA4-9232-3B2E6B63AA92} Key Deleted : HKLMSOFTWAREClassesInterface{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC} Key Deleted : HKLMSOFTWAREClassesInterface{A36867C6-302D-49FC-9D8E-1EB037B5F1AB} Key Deleted : HKLMSOFTWAREClassesInterface{A8321AA2-2227-40C7-8525-6C2F4E1B0EBE} Key Deleted : HKLMSOFTWAREClassesInterface{AA41A731-6814-4A70-A6F1-C0A20FBBFBD5} Key Deleted : HKLMSOFTWAREClassesInterface{ABBB8A9E-D8AF-40D1-94BE-5175077465FC} Key Deleted : HKLMSOFTWAREClassesInterface{AC71B60E-94C9-4EDE-BA46-E146747BB67E} Key Deleted : HKLMSOFTWAREClassesInterface{BF737694-56F6-46FA-9FDC-FA99A5B25FAD} Key Deleted : HKLMSOFTWAREClassesInterface{CFCD164E-8AC9-478E-9ECC-B616A932016C} Key Deleted : HKLMSOFTWAREClassesInterface{D5961CC0-B442-4567-8030-67E241EF4CC2} Key Deleted : HKLMSOFTWAREClassesInterface{E450067F-1C93-41A7-928E-07E5C2EEC680} Key Deleted : HKLMSOFTWAREClassesInterface{F977D9F2-4BDC-44A6-B508-7C0284C61EED} Key Deleted : HKLMSOFTWAREClassesTypeLib{2996F0E7-292B-4CAE-893F-47B8B1C05B56} Key Deleted : HKLMSOFTWAREClassesTypeLib{48C9C8B0-A546-46C1-A81F-47A31E623E9D} Key Deleted : HKLMSOFTWAREClassesTypeLib{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8} Key Deleted : HKLMSOFTWAREClassesTypeLib{CFE8AAFD-A0F3-4329-84E9-6B679EC93EC2} Key Deleted : HKLMSOFTWAREClassesTypeLib{D7EE8177-D51E-4F89-92B6-83EA2EC40800} Key Deleted : HKLMSOFTWAREGoogleChromeExtensionsdlnembnfbcpjnepmfjmngjenhhajpdfd Key Deleted : HKLMSoftwareIB Updater Key Deleted : HKLMSoftwareincredibar.com Key Deleted : HKLMSOFTWAREMicrosoftInternet ExplorerLow RightsElevationPolicy{74C36554-31F0-49DD-8857-ED6A64DF45BE} Key Deleted : HKLMSOFTWAREMicrosoftInternet ExplorerLow RightsElevationPolicy{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A} Key Deleted : HKLMSOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{D4027C7F-154A-4066-A1AD-4243D8127440} Key Deleted : HKLMSOFTWAREMicrosoftWindowsCurrentVersionInstallerUserDataS-1-5-18Components0E12F736682067FDE4D1158D5940A82E Key Deleted : HKLMSOFTWAREMicrosoftWindowsCurrentVersionInstallerUserDataS-1-5-18Components1A24B5BB8521B03E0C8D908F5ABC0AE6 Key Deleted : HKLMSOFTWAREMicrosoftWindowsCurrentVersionInstallerUserDataS-1-5-18Components261F213D1F55267499B1F87D0CC3BCF7 Key Deleted : HKLMSOFTWAREMicrosoftWindowsCurrentVersionInstallerUserDataS-1-5-18Components2B0D56C4F4C46D844A57FFED6F0D2852 Key Deleted : HKLMSOFTWAREMicrosoftWindowsCurrentVersionInstallerUserDataS-1-5-18Components49D4375FE41653242AEA4C969E4E65E0 Key Deleted : HKLMSOFTWAREMicrosoftWindowsCurrentVersionInstallerUserDataS-1-5-18Components6AA0923513360135B272E8289C5F13FA Key Deleted : HKLMSOFTWAREMicrosoftWindowsCurrentVersionInstallerUserDataS-1-5-18Components6F7467AF8F29C134CBBAB394ECCFDE96 Key Deleted : HKLMSOFTWAREMicrosoftWindowsCurrentVersionInstallerUserDataS-1-5-18Components741B4ADF27276464790022C965AB6DA8 Key Deleted : HKLMSOFTWAREMicrosoftWindowsCurrentVersionInstallerUserDataS-1-5-18Components7DE196B10195F5647A2B21B761F3DE01 Key Deleted : HKLMSOFTWAREMicrosoftWindowsCurrentVersionInstallerUserDataS-1-5-18Components922525DCC5199162F8935747CA3D8E59 Key Deleted : HKLMSOFTWAREMicrosoftWindowsCurrentVersionInstallerUserDataS-1-5-18Components9D4F5849367142E4685ED8C25E44C5ED Key Deleted : HKLMSOFTWAREMicrosoftWindowsCurrentVersionInstallerUserDataS-1-5-18ComponentsA5875B04372C19545BEB90D4D606C472 Key Deleted : HKLMSOFTWAREMicrosoftWindowsCurrentVersionInstallerUserDataS-1-5-18ComponentsA876D9E80B896EC44A8620248CC79296 Key Deleted : HKLMSOFTWAREMicrosoftWindowsCurrentVersionInstallerUserDataS-1-5-18ComponentsB66FFAB725B92594C986DE826A867888 Key Deleted : HKLMSOFTWAREMicrosoftWindowsCurrentVersionInstallerUserDataS-1-5-18ComponentsBCDA179D619B91648538E3394CAC94CC Key Deleted : HKLMSOFTWAREMicrosoftWindowsCurrentVersionInstallerUserDataS-1-5-18ComponentsD677B1A9671D4D4004F6F2A4469E86EA Key Deleted : HKLMSOFTWAREMicrosoftWindowsCurrentVersionInstallerUserDataS-1-5-18ComponentsDD1402A9DD4215A43ABDE169A41AFA0E Key Deleted : HKLMSOFTWAREMicrosoftWindowsCurrentVersionInstallerUserDataS-1-5-18ComponentsE36E114A0EAD2AD46B381D23AD69CDDF Key Deleted : HKLMSOFTWAREMicrosoftWindowsCurrentVersionInstallerUserDataS-1-5-18ComponentsEF8E618DB3AEDFBB384561B5C548F65E Key Deleted : HKLMSOFTWAREMicrosoftWindowsCurrentVersionInstallerUserDataS-1-5-18ProductsA28B4D68DEBAA244EB686953B7074FEF Key Deleted : HKLMSOFTWAREMicrosoftWindowsCurrentVersionUninstall{86D4B82A-ABED-442A-BE86-96357B70F4FE} Value Deleted : HKCUSoftwareMicrosoftInternet ExplorerToolbarWebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}] Value Deleted : HKCUSoftwareMicrosoftInternet ExplorerURLSearchHooks [{00000000-6E41-4FD3-8538-502F5495E5FC}] Value Deleted : HKLMSOFTWAREMicrosoftInternet ExplorerToolbar [{D4027C7F-154A-4066-A1AD-4243D8127440}] Value Deleted : HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun [ApnUpdater] Value Deleted : HKLMSOFTWAREMozillaFirefoxextensions [{336D0C35-8A85-403a-B9D2-65C292C39087}] ***** [internet Browsers] ***** - Internet Explorer v6.0.2900.5512 [OK] Registry is clean. - Mozilla Firefox v16.0.2 (bg) Profile name : default File : C:Documents and SettingsKostaApplication DataMozillaFirefoxProfiles9okxqodz.defaultprefs.js C:Documents and SettingsKostaApplication DataMozillaFirefoxProfiles9okxqodz.defaultuser.js ... Deleted ! Deleted : user_pref("browser.newtab.url", "hxxp://mystart.incredibar.com/mb201?a=6OyU0fnaYp&i=26"); Deleted : user_pref("browser.search.defaultenginename", "AVG Secure Search"); Deleted : user_pref("extensions.enabledAddons", "[email protected]:1.5.0,[email protected]:1.6.2[...] Deleted : user_pref("extensions.incredibar.actvtyRptTime", "1353235746558"); Deleted : user_pref("extensions.incredibar.admin", false); Deleted : user_pref("extensions.incredibar.aflt", "orgnl"); Deleted : user_pref("extensions.incredibar.afterInstallRpt", "sent"); Deleted : user_pref("extensions.incredibar.cntry", "BG"); Deleted : user_pref("extensions.incredibar.dfltLng", "EN"); Deleted : user_pref("extensions.incredibar.dfltSrch", false); Deleted : user_pref("extensions.incredibar.dfltlng", "EN"); Deleted : user_pref("extensions.incredibar.dfltsrch", "false"); Deleted : user_pref("extensions.incredibar.did", "10643"); Deleted : user_pref("extensions.incredibar.envrmnt", "production"); Deleted : user_pref("extensions.incredibar.excTlbr", false); Deleted : user_pref("extensions.incredibar.hdrMd5", "DCF64A9DB27CEA9671D211DF349B6A1D"); Deleted : user_pref("extensions.incredibar.hmpg", false); Deleted : user_pref("extensions.incredibar.hrdid", "1059c73700000000000000e04d0fc358"); Deleted : user_pref("extensions.incredibar.id", "1059c73700000000000000e04d0fc358"); Deleted : user_pref("extensions.incredibar.installerproductid", "26"); Deleted : user_pref("extensions.incredibar.instlDay", "15656"); Deleted : user_pref("extensions.incredibar.instlRef", ""); Deleted : user_pref("extensions.incredibar.instlday", "15656"); Deleted : user_pref("extensions.incredibar.instlref", ""); Deleted : user_pref("extensions.incredibar.isDcmntCmplt", false); Deleted : user_pref("extensions.incredibar.isdcmntcmplt", true); Deleted : user_pref("extensions.incredibar.keywordurl", ""); Deleted : user_pref("extensions.incredibar.lastVrsnTs", "1.5.11.1421:57:22"); Deleted : user_pref("extensions.incredibar.mntrvrsn", "1.2.0"); Deleted : user_pref("extensions.incredibar.newTab", false); Deleted : user_pref("extensions.incredibar.newtab", "false"); Deleted : user_pref("extensions.incredibar.newtaburl", ""); Deleted : user_pref("extensions.incredibar.noFFXTlbr", false); Deleted : user_pref("extensions.incredibar.ppd", "1"); Deleted : user_pref("extensions.incredibar.prdct", "incredibar"); Deleted : user_pref("extensions.incredibar.productid", "26"); Deleted : user_pref("extensions.incredibar.prtnrId", "Incredibar"); Deleted : user_pref("extensions.incredibar.prtnrid", "Incredibar"); Deleted : user_pref("extensions.incredibar.sg", "none"); Deleted : user_pref("extensions.incredibar.smplGrp", "none"); Deleted : user_pref("extensions.incredibar.smplgrp", "none"); Deleted : user_pref("extensions.incredibar.srch", ""); Deleted : user_pref("extensions.incredibar.srchprvdr", ""); Deleted : user_pref("extensions.incredibar.tlbrId", "base"); Deleted : user_pref("extensions.incredibar.tlbrSrchUrl", "hxxp://mystart.Incredibar.com/?a=6OyU0fnaYp&loc=IB_T[...] Deleted : user_pref("extensions.incredibar.tlbrid", "base"); Deleted : user_pref("extensions.incredibar.tlbrsrchurl", "hxxp://mystart.Incredibar.com/?a=6OyU0fnaYp&loc=IB_T[...] Deleted : user_pref("extensions.incredibar.upn2", "6OyU0fnaYp"); Deleted : user_pref("extensions.incredibar.upn2n", "92262440493798657"); Deleted : user_pref("extensions.incredibar.vrsn", "1.5.11.14"); Deleted : user_pref("extensions.incredibar.vrsnTs", "1.5.11.1421:57:22"); Deleted : user_pref("extensions.incredibar.vrsni", "1.5.11.14"); Deleted : user_pref("extensions.incredibar.vrsnts", "1.5.11.1421:57:22"); Deleted : user_pref("extensions.incredibar_i.aflt", "orgnl"); Deleted : user_pref("extensions.incredibar_i.dfltLng", ""); Deleted : user_pref("extensions.incredibar_i.did", "10643"); Deleted : user_pref("extensions.incredibar_i.excTlbr", false); Deleted : user_pref("extensions.incredibar_i.id", "1059c73700000000000000e04d0fc358"); Deleted : user_pref("extensions.incredibar_i.installerproductid", "26"); Deleted : user_pref("extensions.incredibar_i.instlDay", "15656"); Deleted : user_pref("extensions.incredibar_i.instlRef", ""); Deleted : user_pref("extensions.incredibar_i.ms_url_id", ""); Deleted : user_pref("extensions.incredibar_i.newTab", false); Deleted : user_pref("extensions.incredibar_i.ppd", "1"); Deleted : user_pref("extensions.incredibar_i.prdct", "incredibar"); Deleted : user_pref("extensions.incredibar_i.productid", "26"); Deleted : user_pref("extensions.incredibar_i.prtnrId", "Incredibar"); Deleted : user_pref("extensions.incredibar_i.smplGrp", "none"); Deleted : user_pref("extensions.incredibar_i.tlbrId", "base"); Deleted : user_pref("extensions.incredibar_i.tlbrSrchUrl", "hxxp://mystart.Incredibar.com/?a=6OyU0fnaYp&loc=IB[...] Deleted : user_pref("extensions.incredibar_i.upn2", "6OyU0fnaYp"); Deleted : user_pref("extensions.incredibar_i.upn2n", "92262440493798657"); Deleted : user_pref("extensions.incredibar_i.vrsn", "1.5.11.14"); Deleted : user_pref("extensions.incredibar_i.vrsnTs", "1.5.11.1421:57:22"); Deleted : user_pref("extensions.incredibar_i.vrsni", "1.5.11.14"); Deleted : user_pref("{336D0C35-8A85-403a-B9D2-65C292C39087}.ScriptData_WSG_blackList", "form=CONTLB|babsrc=too[...] Deleted : user_pref("{336D0C35-8A85-403a-B9D2-65C292C39087}.ScriptData_WSG_whiteList", "{"search.babylon.com[...] ************************* AdwCleaner[s1].txt - [16708 octets] - [04/12/2012 16:32:05] ########## EOF - C:AdwCleaner[s1].txt - [16769 octets] ########## ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Junkware Removal Tool (JRT) by Thisisu Version: 3.8.0 (12.04.2012:1) OS: Microsoft Windows XP x86 Ran by Kosta on Tue 12/04/2012 at 16:36:41.35 Blog: http://thisisudax.blogspot.com ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services ~~~ Registry Values ~~~ Registry Keys ~~~ Files ~~~ Folders ~~~ FireFox Successfully deleted the following from C:Documents and SettingsKostaApplication Datamozillafirefoxprofiles9okxqodz.defaultprefs.js user_pref("{336D0C35-8A85-403a-B9D2-65C292C39087}.ScriptData_WSG_referrer", "http://us.yhs4.search.yahoo.com/yhs/search?fr=altavista&itag=ody&q=http://www.crispersound.org/|||8641354055423478"); user_pref("{336D0C35-8A85-403a-B9D2-65C292C39087}.ScriptData_WSG_temp_referer", "http://us.yhs4.search.yahoo.com/yhs/search?fr=altavista&itag=ody&q=http://www.crispersound.org/|#|old_value|||864135405 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Scan was completed on Tue 12/04/2012 at 16:42:51.82 End of JRT log ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Ето.

OTL.Txt

Extras.Txt

4 декември 201213 г.

Стартирайте файла с двукратен клик на мишката.
Под с Copy/ Paste въведете изцяло следната текстова информация (само това, което е поставено в карето):

:OTL
SRV - File not found [Auto | Stopped] -- C:\Program Files\Skype\Updater\Updater.exe -- (SkypeUpdate)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\ComboFix\catchme.sys -- (catchme)
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-21-1659004503-1604221776-682003330-1003\..\SearchScopes,DefaultScope =
FF - user.js - File not found
O4 - HKLM..\Run: []  File not found
[2012/11/12 21:49:03 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini
[2012/12/02 22:13:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVG
[2012/12/02 22:11:24 | 000,000,000 | -HSD | M] -- C:\Documents and Settings\All Users\Application Data\{D1D4879F-2279-49C9-AEBF-3B95C84EAA8F}
[2012/12/02 22:12:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kosta\Application Data\AVG
[2012/12/02 15:34:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kosta\Application Data\AVG2012
[2012/12/02 15:33:07 | 000,026,984 | ---- | M] (AVG Technologies) -- C:\WINDOWS\system32\drivers\avgtpx86.sys
:files
C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLED.EXE
D:\Games\Favorite-Games\FGUpdate.exe
:reg
[-HKEY_USERS\S-1-5-21-1659004503-1604221776-682003330-1003\Software\APN]
:commands
[emptytemp]

След като въведете скрипта от цитата по-горе натиснете бутона, маркиран в червено: Run Fix

Windows ще се рестартира и ще се създаде лог файл - OTL fix log. Публикувайте съдържанието му с Copy/Paste в следващия си коментар.

След това отворете файла C:\Windows\system.ini с notepad и премахнете само следните два реда от него:

[MCIDRV_VER]

DEVICEMB=23587546834

Затворете файла и запазете промените.

Пишете как е положението после.

4 декември 201213 г.

Автор

All processes killed ========== OTL ========== Service SkypeUpdate stopped successfully! Service SkypeUpdate deleted successfully! File C:Program FilesSkypeUpdaterUpdater.exe not found. Service catchme stopped successfully! Service catchme deleted successfully! File C:ComboFixcatchme.sys not found. HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerSearchScopesDefaultScope| /E : value set successfully! HKEY_USERS.DEFAULTSoftwareMicrosoftInternet ExplorerSearchScopesDefaultScope| /E : value set successfully! HKEY_USERSS-1-5-18SoftwareMicrosoftInternet ExplorerSearchScopesDefaultScope| /E : value set successfully! HKEY_USERSS-1-5-20SoftwareMicrosoftInternet ExplorerSearchScopesDefaultScope| /E : value set successfully! HKEY_USERSS-1-5-21-1659004503-1604221776-682003330-1003SoftwareMicrosoftInternet ExplorerSearchScopesDefaultScope| /E : value set successfully! Registry value HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun deleted successfully. C:WINDOWSassemblyDesktop.ini moved successfully. C:Documents and SettingsAll UsersApplication DataAVGAWL2012 folder moved successfully. C:Documents and SettingsAll UsersApplication DataAVGAWLProgram Statistics folder moved successfully. C:Documents and SettingsAll UsersApplication DataAVGAWL folder moved successfully. C:Documents and SettingsAll UsersApplication DataAVG folder moved successfully. C:Documents and SettingsAll UsersApplication Data{D1D4879F-2279-49C9-AEBF-3B95C84EAA8F} folder moved successfully. C:Documents and SettingsKostaApplication DataAVGAWL2012TuningIndex folder moved successfully. C:Documents and SettingsKostaApplication DataAVGAWL2012StartUp Manager folder moved successfully. C:Documents and SettingsKostaApplication DataAVGAWL2012Dashboard folder moved successfully. C:Documents and SettingsKostaApplication DataAVGAWL2012Backups folder moved successfully. C:Documents and SettingsKostaApplication DataAVGAWL2012 folder moved successfully. C:Documents and SettingsKostaApplication DataAVG folder moved successfully. C:Documents and SettingsKostaApplication DataAVG2012cfgall folder moved successfully. C:Documents and SettingsKostaApplication DataAVG2012 folder moved successfully. C:WINDOWSsystem32driversavgtpx86.sys moved successfully. ========== FILES ========== C:Program FilesCommon FilesMicrosoft SharedOFFICE11MSOXMLED.EXE moved successfully. File move failed. D:GamesFavorite-GamesFGUpdate.exe scheduled to be moved on reboot. ========== REGISTRY ========== Registry key HKEY_USERSS-1-5-21-1659004503-1604221776-682003330-1003SoftwareAPN not found. ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: Kosta ->Temp folder emptied: 1817624 bytes ->Temporary Internet Files folder emptied: 3477482 bytes ->FireFox cache emptied: 234250129 bytes ->Flash cache emptied: 19080 bytes User: LocalService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 2162283 bytes %systemroot%System32 .tmp files removed: 2577 bytes %systemroot%System32dllcache .tmp files removed: 0 bytes %systemroot%System32drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 0 bytes %systemroot%system32configsystemprofileLocal SettingsTemp folder emptied: 0 bytes %systemroot%system32configsystemprofileLocal SettingsTemporary Internet Files folder emptied: 33170 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 231.00 mb OTL by OldTimer - Version 3.2.69.0 log created on 12042012_200857 FilesFolders moved on Reboot... File move failed. D:GamesFavorite-GamesFGUpdate.exe scheduled to be moved on reboot. PendingFileRenameOperations files... Registry entries deleted on Reboot...

4 декември 201213 г.

Финални стъпки.

Изтеглете прикачения архив sr.zip и го разархивирайте.

Стартирайте файла sr.reg и го стартирайте.

Изберете YES на диалоговия прозорец.

След това:

Изтеглете The Avenger и го разархивирайте на вашия десктоп.

Стартирайте The Avenger и копирайте следния скрипт и го поставете в текстовото поле на програмата:

Files to delete:
D:GamesFavorite-GamesFGUpdate.exe

Накрая изберете Execute и при въпрос от страна на програмата, посочете Yes. Така компютъра ще се рестартира. След рестартирането, копирайте и поставете тук, съдържанието на лог файла от програмата, намиращ се в C:avenger.txt

И за финал можете да направите нова проверка с Avira (ФИНАЛНА).

4 декември 201213 г.

Автор

Logfile of The Avenger Version 2.0, © by Swandog46 http://swandog46.geekstogo.com Platform: Windows XP ******************* Script file opened successfully. Script file read successfully. Backups directory opened successfully at C:Avenger ******************* Beginning to process script file: Rootkit scan active. No rootkits found! Error: could not open file "D:GamesFavorite-GamesFGUpdate.exe" Deletion of file "D:GamesFavorite-GamesFGUpdate.exe" failed! Status: 0xc000003a (STATUS_OBJECT_PATH_NOT_FOUND) --> bad path / the parent directory does not exist Completed script processing. ******************* Finished! Terminate. Одеве преди да направя проверката не се замислих и направо преинсталирах Favorite Games, където беше този файл дано да не е голяма грешка това. А сега ще пусна да сканира Avira. Най-добре е да спра интернета нали?

4 декември 201213 г.

Logfile of The Avenger Version 2.0, © by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

Error: could not open file "D:GamesFavorite-GamesFGUpdate.exe"
Deletion of file "D:GamesFavorite-GamesFGUpdate.exe" failed!
Status: 0xc000003a (STATUS_OBJECT_PATH_NOT_FOUND)
--> bad path / the parent directory does not exist

Completed script processing.

*******************

Finished! Terminate.

Одеве преди да направя проверката не се замислих и направо преинсталирах Favorite Games, където беше този файл дано да не е голяма грешка това. А сега ще пусна да сканира Avira. Най-добре е да спра интернета нали?

Ми има две възможности...

1.Файла беше инфектиран и най-вероятно да се наложи да почнем отначало...

2.Изтеглили сте чисто копие на играта и сте презаписали инфектирания файл с чисто копие (и пътя не е бил намерен от The Avenger) и всичко е ток и жица...

Дано да е втория вариант, че не ми се почва отначало...

Да, изключете интернета (но преди това обновете дефиниициите на Авира).

4 декември 201213 г.

Автор

Не съм свалял играта на ново просто я изтрих, не ми трябва. Дано не съм прецакал всичко... Иначе всичко си работи нормално с изключение на това че не мога да направя Firefox браузър по подразбиране и ми дават някаква грешка видео драйвърите, но си натискам ок и няма промяна в работата на машината, а относно дефинициите, да ги направя по default ли?

4 декември 201213 г.

Не съм свалял играта на ново просто я изтрих, не ми трябва. Дано не съм прецакал всичко... Иначе всичко си работи нормално с изключение на това че не мога да направя Firefox браузър по подразбиране и ми дават някаква грешка видео драйвърите, но си натискам ок и няма промяна в работата на машината, а относно дефинициите, да ги направя по default ли?

Дават грешки, защото ще се наложи да преинсталирате почти всички програми и драйвъри...дори да са били излекувани от SalityKiller, те си остават леко прецакани. Целта на гимнастиката беше да спасим изтриването на останалите дялове (и ако може да спасим форматиране и на системния дял). И мисля, че си струваше.

Забележка: Ако ще преинсталирате софтуера и игрите, ги изтеглете от интернет наново (без да използвате инсталаторите, които са били вече на хардиска).

Даже ако имате инсталационен диск на Windows XP ще ви дам една команда за да проверим и критичните системни файлове за дефекти.

Но това са поправими щети...мисля че го излекувахме.

А как така да направите дефинициите по default? Просто натиснете Start update. И после изключете антивирусната и напрвете пак пълна проверка.

PS: Виждате ли колко часа ни отне...занапред не стойте пак без антивирусна, защото този вирус е достатъчен за да омаже пейзажа...а има и доста по-сериозни такива.

4 декември 201213 г.

Автор

Да разбрах опасностите и наистина, наистина съм ви много благодарен, защото имах същия вирус миналата година февруари месец, тогава някой ваш колега тук във форума ми каза да форматирам всичко, така и направих и нямаше как да не се излекува, но сега ми спестихте страшно много ценни данни като снимки, документи и т.н, едно голямо БЛАГОДАРЯ, че има хора като вас, които отделят от личното си време, за да помагат на хора като мен от добра воля и съпричастност!!! П.П : Програмите ще ги преинсталирам, свалям ги наново, драйвърите също и игрите до една. Обнових антивирусната, а относно пълната проверка с кои програми да я направя, че ги събрах много на десктопа от тези, които ми дадохте?

Редактирано 4 декември 201213 г. от Kostadin Loparski (преглед на промените)

4 декември 201213 г.

Всъщност по-принцип Световната практика е да се форматира при този вирус и затова колегита са ви казали така. Така че, не е грешка от тяхна страна. Пак добре, че имахте Sality...Virut е ного по-бъгав и нелечим.

Ми главно с Авира направете пълна проверка...Ако искате да се подсигурите включете и една проверка със следните 3 инструмента за всеки случай:

AVG rmslt.exe

PCMAV for Sality

Dr.Web CureIt

За финал не казахте дали имате инсталационен диск с Windows XP...Ако да...следвайте това

Добре е да се провери състоянието на системните файлове:

Използвайте „System File Checker” за да проверите състоянието и версиите на системните файлове. За да направите това, следвайте тези стъпки:

Щракнете върху Старт, а след това щракнете върху Изпълнeние.
Копирайте и поставете (или въведете) следната команда (cmd) в полето Отвори и след това натиснете ENTER:
В командния ред въведете sfc /scannow и натиснете клавиша ENTER.

Забележка Ако се появи подкана за Windows XP CD диск, поставете компактдиска в CD устройството.

Пишете като приключите с проверките и наблюдавайте какво е положението 1-2 дни...дали има проблеми и ако няма такива приключваме.

Добре е да се сканират и всички флашки за вируса, за да не стане пак нова инфекция.

4 декември 201213 г.

Автор

Имам диск с оригинално копие, което не е пипано. Относно флашката, по-добре ли ще е да я сканирам на Windows 7, защото доколкото четох той много по-трудно се заразява със Sality? Утре ще направя пълна проверка на системата и ще ви известя при евентуални промени в работата. Благодаря отново за огромното съдействие!!!

4 декември 201213 г.

Оригинално копие или не...важното е да е със същия Service Pack, защото вие вече инсталирахте Service Pack 3 ъпдейта по мой съвет.

Ако инсталационния ви диск е с Windows XP SP2 няма да ви е от полза. Тогава ще се наложи да спестите проверката sfc /scannow.

За въпроса за флашките, ние спряхме Autorun-a с инструмента на Microsoft, но все пак да се подсигурим и така:

1.Изтеглете Panda USB Vaccine и стартирайте инструмента. Изберете Vaccinate Computer. След това поставете флашката и изберете Select an USB drive => Посочете флашката и изберете Vaccinate USB

2.Изтеглете и стартирайте Flash_Disinfector (дръжте флашката включена). Програмата ще я провери за някои от по-основните бацили и ще имунизира системата (ще създаде скрити папки с името Autorun.inf на всеки един от дяловете на компютъра, които ще служат за имунизация на компютъра и затова не ги трийте).

3.След това вече с десен бутон върху буквата на флашката можете да сканирате флашката с Avira като изберете опцията от контекстното меню.

От програмите за преинсталация са още - Microsoft Office, TeamViewer, Mozilla Firefox (вижте дали след преинсталацията можете да го направите браузър по-подразбиране) и останалите програми (едва ли са много).

Ами това е от мен засега...

5 декември 201213 г.

Да хвърли и едно око тук и тук ,а тук за Autorun и Autoplay

Редактирано 5 декември 201213 г. от Lost in (преглед на промените)

5 декември 201213 г.

Да хвърли и едно око тук и тук ,а тук за Autorun и Autoplay

Мерси друже, но вече е направено тук - Microsoft Fixit и тук (disable_dangerous_services_xp.reg). Дадох му Panda USB Vaccine за всеки случай и Flash_Disinfector за допълнителна имунизация за да може да сканира флашките.

Лека вечер!

6 декември 201213 г.

Автор

Здравейте, компютърът работи нормално и няма промяна за сега. Свалих Panda USB Vaccine и когато избера USB-то ми пише "Vaccination was not posible", а относно другия линк Avira го блокира и не ми отваря страницата, за да сваля файла.

Редактирано 6 декември 201213 г. от Kostadin Loparski (преглед на промените)

6 декември 201213 г.

...... а относно другия линк Avira го блокира и не ми отваря страницата, за да сваля файла.

http://dox.bg/files/dw?a=2f21fb3444

6 декември 201213 г.

Здравейте, компютърът работи нормално и няма промяна за сега. Свалих Panda USB Vaccine и когато избера USB-то ми пише "Vaccination was not posible", а относно другия линк Avira го блокира и не ми отваря страницата, за да сваля файла.

Каква файлова система е флашката? Ако е NTFS, то тогава аз съм ви дал малко по-стара версия на Panda USB Vaccine, която не имунизира NTFS, но пък и не иска инсталиране. Не е толкова важно. От нея натиснете само Vaccinate Computer.

Kолкото до Flash_Disinfector-a, ако не се получи с линка от колегата по-нагоре използвайте тази алтернатива

Стартирайте инструмента и натиснете: Vaccinate и затворете и изтрийте програмата.

Щом няма повече проблеми ще добавя РЕШЕН в заглавието.

Добре дошли!

Неизтриваеми регистри, забранен Task Manager, Firewall, не се пуска CCleaner

Featured Replies

Архивирана тема

Разглеждащи това в момента 0

Дарение

Бюлетин

Профил

Навигация

Търсене

Конфигуриране на push известия в браузъра

Chrome (Android)

Chrome (Desktop)

Safari (iOS 16.4+)

Safari (macOS)

Edge (Android)

Edge (Desktop)

Firefox (Android)

Firefox (Desktop)