Не ми позволява да кача файла тук. Направих го в зип формат, но...

 

 

Ами качете го на някой външен сървър....!

 

https://www.zeta-uploader.com/bg

+

 

Изтеглете Malwarebytes' Anti-Malware или от тук (не забравяйте да обновите програмата с нови дефиниции)

* Кликнете два пъти върху mbam-setup.exe, за да инсталирате програмата.

* Уверете се, че са поставени отметки на Update Malwarebytes' Anti-Malware и Launch Malwarebytes' Anti-Malware. След това кликнете на Finish.

* Ако има намерени обновявания, тя ще ги изтегли и инсталира.

* Стартирайте програмата и изберете "Perform Full Scan", след това кликнете на Scan.

* Сканирането ще отнеме малко време, затова моля да бъдете търпеливи.

* Когато сканирането завърши, кликнете на OK, след това Show Results, за да видите резултата.

* Уверете се, че на всички редове има отметки, и кликнете на Remove Selected.

* Когато всичко бъде премахнато, в Notepad ще бъде отворен лог. Копирайте този лог и го публикувайте в следващия си коментар по темата.

Забележка: Ако MalwareBytes' Anti-Malware се затрудни в премахването на откритите вируси/заплахи, той ще поиска да рестартира компютъра Ви и по време на рестартирането да премахне проблемните вируси/заплахи. Ако бъдете попитани, потвърдете че желаете вашия компютър да бъде рестартиран.

Изтеглете програмата: ESET Online Scanner

• Стартирайте esetsmartinstaller_enu.exe
• Сложете отметка на YES, I accept the Terms of Use и изберете Start:

  

• Скенерът ще започне да изтегля компонентите, които са му необходими:

  

Уверете се, че е премахната отметката от:

• Remove found threats

Уверете се че са маркирани следните позиции:

• Scan Archives

Кликнете върху Advanced Settings и маркирайте следните опции:

• Scan for potentially unwanted applications
• Scan for potentially unsafe applications
• Enable Anti-Stealth Technology

Накрая изберете Start

• Скенерът ще започне да изтегля последните дефиниции.
• След, като сканирането завърши изберете Finish.
• Отидете в: C:Program FilesESETESET Online Scanner
• Отворете файла log.txt , копирайте съдържанието му и го поставете в следващия си коментар.

https://www.zeta-uploader.com/1053952714

 

Malwarebytes Anti-Malware 1.65.1

 

тази имам и си я ползвам

Malwarebytes Anti-Malware 1.65.1

 

тази имам и си я ползвам

 

 

Обновете програмата с последни дефиниции и направете сканирането..!Публикувайте дневника в следващия си пост..!

ESETSmartInstaller@High as downloader log: all ok # version=8 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6844 # api_version=3.0.2 # EOSSerial=f377ae4e339cda4aae8a8b359e7bac39 # end=finished # remove_checked=false # archives_checked=true # unwanted_checked=true # unsafe_checked=true # antistealth_checked=true # utc_time=2012-12-16 08:39:49 # local_time=2012-12-16 10:39:49 ) # country="Bulgaria" # lang=1033 # osver=6.1.7601 NT Service Pack 1 # compatibility_mode=774 16777213 100 94 2354319 132403861 0 0 # compatibility_mode=5893 16776573 100 94 32369 107320239 0 0 # scanned=199051 # found=19 # cleaned=0 # scan_time=17379 C:Program Files (x86)lz-edrawings11x32-on-64.exe  a variant of Win32/HackTool.Patcher.T application (unable to clean)  21C58E3F63C661B73C02B47579EFFEE082EF4F56  I C:Program Files (x86)SolidWorksx86lz-edrawings11x32-on-64.exe  a variant of Win32/HackTool.Patcher.T application (unable to clean)  21C58E3F63C661B73C02B47579EFFEE082EF4F56  I C:UsersNikiAppDataRoamingAuslogicsRescueBoost Speed120915200453875.rsc  a variant of Win32/OpenInstall application (unable to clean)  71C99B6C4DD60E0A2B1AF43E9A4FC76F2FA67D47  I C:UsersNikiAppDataRoamingAuslogicsRescueBoost Speed121204152638670.rsc  multiple threats (unable to clean)  891E4CCAC5E4819972146D01A1F908B5CCEE327E  I D:Game InstallBatman.Arkham.City.Game.of.the.Year.Edition-SKIDROWsr-bacgoty.iso  multiple threats (unable to clean)  0000000000000000000000000000000000000000  I D:Game InstallMax.Payne.3-RELOADEDDVD4rld-mp3d.iso  a variant of Win32/Packed.VMProtect.AAH trojan (unable to clean)  CEEFED45CCD70527CC26AE53C1D84438BE174E3C  I D:Game InstallMax.Payne.3.Update.v1.0.0.55-RELOADEDCrackgsrld.dll  a variant of Win32/Packed.VMProtect.AAH trojan (unable to clean)  C3F40FA6674806552A891192BBACBA164E630B43  I D:Game InstallMonopoly 3 - DEViANCEtrainer.exe  a variant of Win32/GameHack.G application (unable to clean)  274C1C8236284CB9D827C692858DCA4084CC89A8  I D:GamesBatmanBinariesWin32BatmanAC.exe  probably unknown NewHeur_PE virus (unable to clean)  C15F72BFF8A4165FD02C86E9828EA1EBD3E6C785  I D:GamesBatmanBinariesWin32buddha.dll  a variant of Win32/Packed.VMProtect.AAA trojan (unable to clean)  949382E751987B199BB9D17989848F8CBE8FA045  I D:GamesHitman Sniper Challengehmsc_skr.dll  a variant of Win32/Packed.VMProtect.AAA trojan (unable to clean)  AF37BAEBA80147C454FEA01A9EBBCA546A2ACAA1  I D:GamesMaxPayne3gsrld.dll  a variant of Win32/Packed.VMProtect.AAH trojan (unable to clean)  C3F40FA6674806552A891192BBACBA164E630B43  I D:Installcoretemp_1236.exe  a variant of Win32/InstallIQ application (unable to clean)  DCD42907E49F24CC83D5C15B083B6CD322BFA725  I D:InstallDTLite4454-0316.exe  Win32/OpenCandy application (unable to clean)  35F7C763AFB38E98D73272A7B6805FC6DE3AF2C1  I D:InstallHirens BootCD 15.2 (kaldata.com).zip  Win32/PSWTool.KonBoot.A application (unable to clean)  8B47F8F9C0CB46B01F19259C99F08D57223581C9  I D:InstallABBYY FineReader Professional 8.0.706abby finerederpatchtwk-fr8fixpatch.exe  a variant of Win32/HackTool.Patcher.A application (unable to clean)  9C3530B803CB0097254109DED9DB2DF295177D84  I D:InstallHirens BootCD 15.2 (kaldata.com)Hiren's.BootCD.15.2.iso  Win32/PSWTool.KonBoot.A application (unable to clean)  565B645851C49C4FB5CF1AF90540A4129033CE66  I D:InstallURSoft.Your.Uninstaller.Pro.v7.4.2012.5.Incl.Keygen.and.Patch-Lz0crackkeygen.exe  a variant of Win32/Keygen.BM application (unable to clean)  11351E80375A6031AEA29EB028C21DBB312FF885  I D:InstallWindows 7 Loaderwin7loader_safe_2002.exe  a variant of Win32/HiddenStart.A application (unable to clean)  B52FB8BB3D3BC6012732488D53EBBFB3D15537C7  I  

Копирайте текста в карето на notepad и го запазвате с име CFScript.txt на десктопа си:
 

KILLALL::ClearJavaCache::File::C:Program Files (x86)lz-edrawings11x32-on-64.exeC:Program Files (x86)SolidWorksx86lz-edrawings11x32-on-64.exeC:UsersNikiAppDataRoamingAuslogicsRescueBoost Speed120915200453875.rscC:UsersNikiAppDataRoamingAuslogicsRescueBoost Speed121204152638670.rsc

 
 След съхранението преместете  CFScript.txt на иконата на ComboFix.exe



Генерирания рапорт копирайте  и го поставете в следващия си коментар...!

ComboFix 12-12-14.01 - Niki 12.2012 г.  18:28:07.3.4 - x64 Microsoft Windows 7 Ultimate 6.1.7601.1.1251.359.1026.18.4010.2279 [GMT 2:00] Running from: c:usersNikiDesktopComboFix.exe Command switches used :: c:usersNikiDesktopCFScript.txt AV: avast! Antivirus *Enabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C} SP: avast! Antivirus *Enabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}  * Created a new restore point . FILE :: "c:program files (x86)lz-edrawings11x32-on-64.exe" "c:program files (x86)SolidWorksx86lz-edrawings11x32-on-64.exe" "c:usersNikiAppDataRoamingAuslogicsRescueBoost Speed120915200453875.rsc" "c:usersNikiAppDataRoamingAuslogicsRescueBoost Speed121204152638670.rsc" . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:program files (x86)lz-edrawings11x32-on-64.exe c:program files (x86)SolidWorksx86lz-edrawings11x32-on-64.exe c:usersNikiAppDataRoamingAuslogicsRescueBoost Speed120915200453875.rsc c:usersNikiAppDataRoamingAuslogicsRescueBoost Speed121204152638670.rsc . . ((((((((((((((((((((((((( Files Created from 2012-11-17 to 2012-12-17  ))))))))))))))))))))))))))))))) . . 2012-12-17 17:16 . 2012-12-17 17:16  76232  ----a-w-  c:programdataMicrosoftWindows DefenderDefinition Updates{1CE2137B-5698-4FBE-B331-D694FB4FD1BD}offreg.dll 2012-12-17 17:12 . 2012-12-17 17:12  --------  d-----w-  c:usersUpdatusUserAppDataLocaltemp 2012-12-17 17:12 . 2012-12-17 17:12  --------  d-----w-  c:usersDefaultAppDataLocaltemp 2012-12-16 15:46 . 2012-12-16 15:46  --------  d-----w-  c:program files (x86)ESET 2012-12-15 21:35 . 2012-11-08 17:24  9125352  ----a-w-  c:programdataMicrosoftWindows DefenderDefinition Updates{1CE2137B-5698-4FBE-B331-D694FB4FD1BD}mpengine.dll 2012-12-15 17:19 . 2012-12-17 17:16  --------  d-----w-  c:usersNikiAppDataRoaminguTorrent 2012-12-15 13:43 . 2012-12-15 13:43  --------  d-----w-  c:windowsERUNT 2012-12-15 13:43 . 2012-12-15 13:43  --------  d-----w-  C:JRT 2012-12-14 11:57 . 2012-12-14 11:57  --------  d-----w-  c:program files (x86)HD Tune 2012-12-14 11:50 . 2012-12-14 11:50  --------  d-----w-  c:usersNikiAppDataRoamingHD Tune Pro 2012-12-14 11:50 . 2012-12-14 11:55  --------  d-----w-  c:program files (x86)HD Tune Pro 2012-12-13 14:12 . 2012-12-13 20:03  --------  d-----w-  c:program files (x86)FileZilla Server 2012-12-13 14:07 . 2012-12-13 14:07  --------  d-----w-  c:programdataMySQL 2012-12-13 14:07 . 2012-12-13 14:07  --------  d-----w-  c:program filesMySQL 2012-12-13 12:57 . 2012-12-13 21:03  --------  d-----w-  C:xampp 2012-12-13 09:53 . 2012-12-13 14:44  --------  d-----w-  c:usersNikiInet magazin 2012-12-10 12:08 . 2007-04-04 16:55  403304  ----a-w-  c:windowssystem32xactengine2_7.dll 2012-12-09 13:13 . 2012-12-09 13:13  --------  d-----w-  c:program files (x86)MagicISO 2012-12-09 12:36 . 2012-12-09 12:36  98304  ----a-r-  c:usersNikiAppDataRoamingMicrosoftInstaller{3577E42B-3347-4EB8-BFDA-D36E8ED3C519}icons.exe 2012-12-09 12:36 . 2012-12-09 12:36  --------  d-----w-  c:usersNikiAppDataLocalApps 2012-12-01 14:58 . 2012-12-01 15:00  --------  d-----w-  c:windowsWindowsMobile 2012-11-30 08:16 . 2012-11-30 08:16  --------  d-----w-  c:usersDefaultAppDataLocalGoogle 2012-11-27 17:53 . 2012-11-27 17:53  --------  d-----w-  c:usersNikiAppDataLocalSamsung 2012-11-27 17:53 . 2012-12-14 11:41  --------  d-----w-  c:usersNikiAppDataRoamingSamsung 2012-11-27 16:34 . 2012-06-27 08:37  1917416  ----a-w-  c:windowssystem32WdfCoInstaller01005.dll 2012-11-27 16:34 . 2012-06-27 08:37  1917416  ----a-w-  c:windowssystem32driversWdfCoInstaller01005.dll 2012-11-27 16:34 . 2012-06-27 08:37  13800  ----a-w-  c:windowssystem32driversssadwh.sys 2012-11-27 16:34 . 2012-06-27 08:37  13288  ----a-w-  c:windowssystem32driversssadcm.sys 2012-11-27 16:33 . 2012-10-29 10:10  4659712  ----a-w-  c:windowsSysWow64Redemption.dll 2012-11-26 20:28 . 2012-01-17 08:40  76384  ----a-w-  c:windowssystem32libusb0.dll 2012-11-26 20:28 . 2012-11-26 20:31  --------  d-----w-  c:program filesMICRO-BOX 2012-11-26 20:03 . 2012-11-26 20:24  --------  d-----w-  c:program files (x86)GoforFiles 2012-11-26 20:03 . 2012-11-26 20:03  --------  d-----w-  c:usersNikiAppDataRoamingGoforFiles 2012-11-26 19:45 . 2012-11-26 19:45  --------  d-----w-  c:programdataSimilarSites 2012-11-26 19:45 . 2012-11-26 19:45  --------  d-----w-  c:program files (x86)Media Crawler 2012-11-26 19:45 . 2012-11-26 19:49  --------  d-----w-  c:program files (x86)SimilarSites 2012-11-26 19:45 . 2012-11-26 19:45  --------  d-----w-  c:usersNikiAppDataRoamingSimilarSites 2012-11-26 19:40 . 2012-11-26 19:40  --------  d-----w-  c:programdataeMule 2012-11-26 19:40 . 2012-11-26 19:40  --------  d-----w-  c:usersNikiAppDataLocaleMule 2012-11-26 19:40 . 2012-11-26 19:40  --------  d-----w-  c:program files (x86)eMule 2012-11-26 15:14 . 2012-11-26 15:14  --------  d-----w-  c:program files (x86)Common FilesSkype 2012-11-24 09:40 . 2012-12-10 12:43  --------  d-----w-  c:usersNikiAppDataLocalSKIDROW 2012-11-24 08:59 . 2012-11-24 08:59  --------  d-----w-  c:usersNikiAppDataLocalPrograms 2012-11-23 12:19 . 2012-11-23 12:19  --------  d-----w-  c:usersNikiAppDataLocalNero . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-12-15 21:36 . 2012-08-23 18:48  67413224  ----a-w-  c:windowssystem32MRT.exe 2012-12-12 08:04 . 2012-08-26 19:56  73656  ----a-w-  c:windowsSysWow64FlashPlayerCPLApp.cpl 2012-12-12 08:04 . 2012-08-26 19:56  697272  ----a-w-  c:windowsSysWow64FlashPlayerApp.exe 2012-10-30 22:51 . 2012-08-23 17:30  59728  ----a-w-  c:windowssystem32driversaswTdi.sys 2012-10-30 22:51 . 2012-08-23 17:30  370288  ----a-w-  c:windowssystem32driversaswSP.sys 2012-10-30 22:51 . 2012-08-23 17:30  984144  ----a-w-  c:windowssystem32driversaswSnx.sys 2012-10-30 22:51 . 2012-08-23 17:30  71600  ----a-w-  c:windowssystem32driversaswMonFlt.sys 2012-10-30 22:51 . 2012-08-23 17:30  25232  ----a-w-  c:windowssystem32driversaswFsBlk.sys 2012-10-30 22:51 . 2012-08-23 17:30  41224  ----a-w-  c:windowsavastSS.scr 2012-10-30 22:50 . 2012-08-23 17:30  227648  ----a-w-  c:windowsSysWow64aswBoot.exe 2012-10-30 22:50 . 2012-08-23 17:30  285328  ----a-w-  c:windowssystem32aswBoot.exe 2012-10-29 10:09 . 2012-10-29 10:09  974848  ----a-w-  c:windowsSysWow64cis-2.4.dll 2012-10-29 10:09 . 2012-10-29 10:09  81920  ----a-w-  c:windowsSysWow64issacapi_bs-2.3.dll 2012-10-29 10:09 . 2012-10-29 10:09  65536  ----a-w-  c:windowsSysWow64issacapi_pe-2.3.dll 2012-10-29 10:09 . 2012-10-29 10:09  57344  ----a-w-  c:windowsSysWow64issacapi_se-2.3.dll 2012-10-29 10:09 . 2012-10-29 10:09  49152  ----a-w-  c:windowsSysWow64MaJGUILib.dll 2012-10-29 10:09 . 2012-10-29 10:09  45056  ----a-w-  c:windowsSysWow64MaXMLProto.dll 2012-10-29 10:09 . 2012-10-29 10:09  40960  ----a-w-  c:windowsSysWow64MTTELECHIP.dll 2012-10-29 10:09 . 2012-10-29 10:09  200704  ----a-w-  c:windowsSysWow64muzwmts.dll 2012-10-29 10:09 . 2012-10-29 10:09  143360  ----a-w-  c:windowsSysWow643DAudio.ax 2012-10-29 10:09 . 2012-10-29 10:09  135168  ----a-w-  c:windowsSysWow64muzaf1.dll 2012-10-29 10:09 . 2012-10-29 10:09  131072  ----a-w-  c:windowsSysWow64muzmpgsp.ax 2012-10-29 10:09 . 2012-10-29 10:09  122880  ----a-w-  c:windowsSysWow64muzeffect.ax 2012-10-29 10:09 . 2012-10-29 10:09  118784  ----a-w-  c:windowsSysWow64MaDRM.dll 2012-10-29 10:09 . 2012-10-29 10:09  110592  ----a-w-  c:windowsSysWow64muzmp4sp.ax 2012-10-29 10:09 . 2012-10-29 10:09  57344  ----a-w-  c:windowsSysWow64MTXSYNCICON.dll 2012-10-29 10:09 . 2012-10-29 10:09  57344  ----a-w-  c:windowsSysWow64MK_Lyric.dll 2012-10-29 10:09 . 2012-10-29 10:09  569344  ----a-w-  c:windowsSysWow64muzdecode.ax 2012-10-29 10:09 . 2012-10-29 10:09  491520  ----a-w-  c:windowsSysWow64muzapp.dll 2012-10-29 10:09 . 2012-10-29 10:09  45320  ----a-w-  c:windowsSysWow64MAMACExtract.dll 2012-10-29 10:09 . 2012-10-29 10:09  45056  ----a-w-  c:windowsSysWow64MACXMLProto.dll 2012-10-29 10:09 . 2012-10-29 10:09  352256  ----a-w-  c:windowsSysWow64MSLUR71.dll 2012-10-29 10:09 . 2012-10-29 10:09  258048  ----a-w-  c:windowsSysWow64muzoggsp.ax 2012-10-29 10:09 . 2012-10-29 10:09  245760  ----a-w-  c:windowsSysWow64MSCLib.dll 2012-10-29 10:09 . 2012-10-29 10:09  24576  ----a-w-  c:windowsSysWow64MASetupCleaner.exe 2012-10-29 10:09 . 2012-10-29 10:09  155648  ----a-w-  c:windowsSysWow64MSFLib.dll 2012-10-15 16:59 . 2012-08-23 17:43  54072  ----a-w-  c:windowssystem32driversaswRdr2.sys 2012-10-04 16:40 . 2012-12-15 21:21  44032  ----a-w-  c:windowsapppatchacwow64.dll 2012-09-29 17:54 . 2012-08-23 17:36  25928  ----a-w-  c:windowssystem32driversmbam.sys 2012-09-25 22:47 . 2012-11-16 15:24  78336  ----a-w-  c:windowsSysWow64synceng.dll 2012-09-25 22:46 . 2012-11-16 15:24  95744  ----a-w-  c:windowssystem32synceng.dll 2012-09-24 07:10 . 2012-08-23 17:33  560184  ----a-w-  c:windowssystem32driverssptd.sys . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun] "uTorrent"="c:program files (x86)uTorrentuTorrent.exe" [2012-12-15 929688] . [HKEY_LOCAL_MACHINESOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionRun] "avast"="c:program filesAVAST SoftwareAvastavastUI.exe" [2012-10-30 4297136] . [HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionpoliciessystem] "ConsentPromptBehaviorAdmin"= 0 (0x0) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) . [HKEY_LOCAL_MACHINEsoftwarewow6432nodemicrosoftwindows ntcurrentversionwindows] "LoadAppInit_DLLs"=1 (0x1) "AppInit_DLLs"=c:windowsSysWOW64nvinit.dll . R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:windowsMicrosoft.NETFramework64v4.0.30319mscorsvw.exe [2010-03-18 138576] R2 mcamvusb;Virtual Usb Bus Enumerator;c:windowssystem32DRIVERSmcamvusb.sys [2006-08-07 40960] R2 SkypeUpdate;Skype Updater;c:program files (x86)SkypeUpdaterUpdater.exe [2012-11-09 160944] R3 AMPPALP;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Protocol;c:windowssystem32DRIVERSamppal.sys [2011-09-15 299008] R3 CoordinatorServiceHost;SW Distributed TS Coordinator Service;c:program filesSolidWorks CorpSolidWorksswSchedulerDTSCoordinatorService.exe [2012-06-08 89192] R3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;c:program filesCommon FilesMacrovision SharedFLEXnet PublisherFNPLicensingService64.exe [2012-09-28 1431888] R3 jrdusbser;Mobile Connector Device for Legacy Serial Communication;c:windowssystem32DRIVERSjrdusbser.sys [2011-08-05 119680] R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:windowssystem32driversrdpvideominiport.sys [2010-11-20 20992] R3 Remote Solver for Flow Simulation 2011;Remote Solver for Flow Simulation 2011;c:program filesSolidWorksCOSMOSbinCFWStandAloneSlv.exe [x] R3 Remote Solver for Flow Simulation 2012;Remote Solver for Flow Simulation 2012;c:program filesSolidWorks CorpSolidWorks Flow SimulationbinCFWStandAloneSlv.exe [2012-04-09 114824] R3 SBIOSIO;SBIOSIO;c:usersNikiAppDataLocalTemp__Samsung_UpdateSBIOSIO64.sys [x] R3 Synth3dVsc;Synth3dVsc;c:windowssystem32driverssynth3dvsc.sys [x] R3 TsUsbFlt;TsUsbFlt;c:windowssystem32driverstsusbflt.sys [2010-11-20 59392] R3 tsusbhub;tsusbhub;c:windowssystem32driverstsusbhub.sys [x] R3 VGPU;VGPU;c:windowssystem32driversrdvgkmd.sys [x] S0 BMLoad;Bytemobile Boot Time Load Driver;c:windowssystem32driversBMLoad.sys [2011-08-05 16512] S0 nvpciflt;nvpciflt;c:windowssystem32DRIVERSnvpciflt.sys [2012-08-30 30056] S0 sptd;sptd;c:windowsSystemRootSystem32Driverssptd.sys [x] S1 aswSnx;aswSnx; [x] S1 aswSP;aswSP; [x] S1 SABI;SAMSUNG Kernel Driver For Windows 7;c:windowssystem32DriversSABI.sys [2010-07-01 13824] S2 aksdf;aksdf;c:windowssystem32DRIVERSaksdf.sys [2006-12-13 65024] S2 AMPPALR3;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Service;c:program filesIntelBluetoothHSBTHSAmpPalService.exe [2011-09-15 1166848] S2 aswFsBlk;aswFsBlk; [x] S2 aswMonFlt;aswMonFlt;c:windowssystem32driversaswMonFlt.sys [2012-10-30 71600] S2 Bluetooth Device Monitor;Bluetooth Device Monitor;c:program files (x86)IntelBluetoothdevmonsrv.exe [2011-03-30 923984] S2 Bluetooth OBEX Service;Bluetooth OBEX Service;c:program files (x86)IntelBluetoothobexsrv.exe [2011-03-30 1001808] S2 BTHSSecurityMgr;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Security Service;c:program filesIntelBluetoothHSBTHSSecurityMgr.exe [2011-06-03 134928] S2 FileZillaServer;FileZillaServer;c:xamppfilezillaftpfilezillaserver.exe [2012-05-11 632320] S2 MBAMScheduler;MBAMScheduler;c:program files (x86)Malwarebytes' Anti-Malwarembamscheduler.exe [2012-09-29 399432] S2 MBAMService;MBAMService;c:program files (x86)Malwarebytes' Anti-Malwarembamservice.exe [2012-09-29 676936] S2 Modem Device Helper;Modem Device Helper;c:program files (x86)T-MobileConnection ManagerBackgroundServiceServiceManager.exe [2012-04-25 51576] S2 PanService;PandoraService;c:program files (x86)PANDORA.TVPanServicePandoraService.exe [2012-06-22 625816] S2 Skype C2C Service;Skype C2C Service;c:programdataSkypeToolbarsSkype C2C Servicec2c_service.exe [2012-11-22 3290304] S2 TeamViewer6;TeamViewer 6;c:program files (x86)TeamViewerVersion6TeamViewer_Service.exe [2010-12-07 2228008] S2 UNS;Intel® Management and Security Application User Notification Service;c:program files (x86)IntelIntel® Management Engine ComponentsUNSUNS.exe [2011-05-04 2656536] S3 ALSysIO;ALSysIO;c:usersNikiAppDataLocalTempALSysIO64.sys [x] S3 AMPPAL;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Virtual Adapter;c:windowssystem32DRIVERSAMPPAL.sys [2011-09-15 299008] S3 Bluetooth Media Service;Bluetooth Media Service;c:program files (x86)IntelBluetoothmediasrv.exe [2011-03-30 1321296] S3 btmaux;Intel Bluetooth Auxiliary Service;c:windowssystem32DRIVERSbtmaux.sys [2011-03-08 51712] S3 btmhsf;btmhsf;c:windowssystem32DRIVERSbtmhsf.sys [2011-03-08 274944] S3 ETD;ELAN PS/2 Port Input Device;c:windowssystem32DRIVERSETD.sys [2010-11-12 138024] S3 iBtFltCoex;iBtFltCoex;c:windowssystem32DRIVERSiBtFltCoex.sys [2011-03-22 59904] S3 IntcDAud;Intel® Display Audio;c:windowssystem32DRIVERSIntcDAud.sys [2011-08-23 317440] S3 MBAMProtector;MBAMProtector;c:windowssystem32driversmbam.sys [2012-09-29 25928] S3 RTL8167;Realtek 8167 NT Driver;c:windowssystem32DRIVERSRt64win7.sys [2011-04-21 471144] . . Contents of the 'Scheduled Tasks' folder . 2012-12-17 c:windowsTasksAdobe Flash Player Updater.job - c:windowsSysWOW64MacromedFlashFlashPlayerUpdateService.exe [2012-08-26 08:04] . 2012-12-16 c:windowsTasksGoogleUpdateTaskMachineCore.job - c:program files (x86)GoogleUpdateGoogleUpdate.exe [2012-10-29 19:59] . 2012-12-17 c:windowsTasksGoogleUpdateTaskMachineUA.job - c:program files (x86)GoogleUpdateGoogleUpdate.exe [2012-10-29 19:59] . . --------- X64 Entries ----------- . . [HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionexplorershelliconoverlayidentifiers00avast] @="{472083B0-C522-11CF-8763-00608CC02F24}" [HKEY_CLASSES_ROOTCLSID{472083B0-C522-11CF-8763-00608CC02F24}] 2012-10-30 22:50  133400  ----a-w-  c:program filesAVAST SoftwareAvastashShA64.dll . [HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionexplorershelliconoverlayidentifiersGDriveBlacklistedOverlay] @="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}" [HKEY_CLASSES_ROOTCLSID{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}] 2012-11-08 14:58  755224  ----a-w-  c:program files (x86)GoogleDrivegoogledrivesync64.dll . [HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionexplorershelliconoverlayidentifiersGDriveSharedOverlay] @="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}" [HKEY_CLASSES_ROOTCLSID{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}] 2012-11-08 14:58  755224  ----a-w-  c:program files (x86)GoogleDrivegoogledrivesync64.dll . [HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionexplorershelliconoverlayidentifiersGDriveSyncedOverlay] @="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}" [HKEY_CLASSES_ROOTCLSID{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}] 2012-11-08 14:58  755224  ----a-w-  c:program files (x86)GoogleDrivegoogledrivesync64.dll . [HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionexplorershelliconoverlayidentifiersGDriveSyncingOverlay] @="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}" [HKEY_CLASSES_ROOTCLSID{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}] 2012-11-08 14:58  755224  ----a-w-  c:program files (x86)GoogleDrivegoogledrivesync64.dll . [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun] "RtHDVCpl"="c:program filesRealtekAudioHDARAVCpl64.exe" [2011-05-18 11855976] "ETDCtrl"="c:program files (x86)ElantechETDCtrl.exe" [bU] "BTMTrayAgent"="c:program files (x86)IntelBluetoothbtmshell.dll" [2011-03-30 10372368] . [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWindows] "AppInit_DLLs"=c:windowsSystem32nvinitx.dll . ------- Supplementary Scan ------- . uLocal Page = c:windowssystem32blank.htm mLocal Page = c:windowsSysWOW64blank.htm IE: E&xport to Microsoft Excel - c:progra~2MICROS~1Office12EXCEL.EXE/3000 IE: {{807DF5E0-4EF7-48a8-A405-239F3E29FFA9} - {FE69C007-C452-4d3e-86D2-1730DF8BC871} - TCP: DhcpNameServer = 192.168.1.1 FF - ProfilePath - c:usersNikiAppDataRoamingMozillaFirefoxProfiles1gs8i5rv.default FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - about:home FF - ExtSQL: 2012-10-28 19:00; [email protected]; c:program files (x86)T-MobileConnection Manageraddon FF - ExtSQL: 2012-11-26 21:45; {E71B541F-5E72-5555-A47C-E47863195841}; c:usersNikiAppDataRoamingMozillaFirefoxProfiles1gs8i5rv.defaultextensions{E71B541F-5E72-5555-A47C-E47863195841} . . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:Windowssystem32MacromedFlashFlashUtil64_11_5_502_135_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{73C9DFA0-750D-11E1-B0C4-0800200C9A66}Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{73C9DFA0-750D-11E1-B0C4-0800200C9A66}LocalServer32] @="c:Windowssystem32MacromedFlashFlashUtil64_11_5_502_135_ActiveX.exe" . [HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{73C9DFA0-750D-11E1-B0C4-0800200C9A66}TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINESOFTWAREClassesInterface{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINESOFTWAREClassesInterface{6AE38AE0-750C-11E1-B0C4-0800200C9A66}ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINESOFTWAREClassesInterface{6AE38AE0-750C-11E1-B0C4-0800200C9A66}TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:WindowsSysWOW64MacromedFlashFlashUtil32_11_5_502_135_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{73C9DFA0-750D-11E1-B0C4-0800200C9A66}Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{73C9DFA0-750D-11E1-B0C4-0800200C9A66}LocalServer32] @="c:WindowsSysWOW64MacromedFlashFlashUtil32_11_5_502_135_ActiveX.exe" . [HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{73C9DFA0-750D-11E1-B0C4-0800200C9A66}TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{D27CDB6E-AE6D-11cf-96B8-444553540000}InprocServer32] @="c:WindowsSysWOW64MacromedFlashFlash32_11_5_502_135.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{D27CDB6E-AE6D-11cf-96B8-444553540000}MiscStatus] @="0" . [HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{D27CDB6E-AE6D-11cf-96B8-444553540000}ProgID] @="ShockwaveFlash.ShockwaveFlash.11" . [HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{D27CDB6E-AE6D-11cf-96B8-444553540000}ToolboxBitmap32] @="c:WindowsSysWOW64MacromedFlashFlash32_11_5_502_135.ocx, 1" . [HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{D27CDB6E-AE6D-11cf-96B8-444553540000}TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{D27CDB6E-AE6D-11cf-96B8-444553540000}Version] @="1.0" . [HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{D27CDB6E-AE6D-11cf-96B8-444553540000}VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{D27CDB70-AE6D-11cf-96B8-444553540000}InprocServer32] @="c:WindowsSysWOW64MacromedFlashFlash32_11_5_502_135.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{D27CDB70-AE6D-11cf-96B8-444553540000}ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{D27CDB70-AE6D-11cf-96B8-444553540000}ToolboxBitmap32] @="c:WindowsSysWOW64MacromedFlashFlash32_11_5_502_135.ocx, 1" . [HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{D27CDB70-AE6D-11cf-96B8-444553540000}TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{D27CDB70-AE6D-11cf-96B8-444553540000}Version] @="1.0" . [HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{D27CDB70-AE6D-11cf-96B8-444553540000}VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeInterface{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeInterface{6AE38AE0-750C-11E1-B0C4-0800200C9A66}ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeInterface{6AE38AE0-750C-11E1-B0C4-0800200C9A66}TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINESOFTWAREWow6432NodeMicrosoftWindows CE Services] "SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79, 00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00, . [HKEY_LOCAL_MACHINESYSTEMControlSet001ControlClass{4D36E96D-E325-11CE-BFC1-08002BE10318}0000AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINESYSTEMControlSet001ControlPCWSecurity] @Denied: (Full) (Everyone) . ------------------------ Other Running Processes ------------------------ . c:program filesAVAST SoftwareAvastAvastSvc.exe c:program files (x86)AuslogicsAuslogics BoostSpeedBoostSpeed.exe c:program files (x86)Malwarebytes' Anti-Malwarembamgui.exe c:xamppmysqlbinmysqld.exe c:program files (x86)SamsungSamsung Control CenterMovieColorEnhancer.exe c:program files (x86)SamsungSamsung Control CenterWifiManager.exe c:program files (x86)SamsungEco ModeSmartEco.exe c:program files (x86)SamsungSamsung Control CenterEasySpeedUpManager.exe c:program files (x86)IntelBluetoothBTPlayerCtrl.exe c:program files (x86)SamsungSamsung Support CenterSSCKbdHk.exe c:program files (x86)IntelIntel® Management Engine ComponentsLMSLMS.exe c:program files (x86)GoogleUpdate1.3.21.123GoogleCrashHandler.exe c:program files (x86)NVIDIA CorporationNVIDIA Update Coredaemonu.exe c:program files (x86)SamsungSamsung Update PlusSUPBackground.exe . ************************************************************************** . Completion time: 2012-12-17  19:35:50 - machine was rebooted ComboFix-quarantined-files.txt  2012-12-17 17:35 ComboFix2.txt  2012-12-16 10:10 ComboFix3.txt  2012-12-15 21:31 . Pre-Run: 53 444 513 792 bytes free Post-Run: 53 245 980 672 bytes free . - - End Of File - - DC0CD567346998EF77329ECE1A68936C  

 

Този рапорт съм го копирал от филе намиращ се в С:, не съм го копирал веднага след края на програмата, ако има някакво значение!

 

Когато се стартира и сега с този скрипт и предния път по време на работа 1,2 пъти даде някакво съобщение за грешка!

Дневникът е наред....В системата ви не виждам активни зарази...!Отана още нещо да направим:

 

Изтеглете този инструмент - Windows Repair All in one
Инсталирайте приложението и го стартирайте.

От стъпка 2 => стартирайте Check Disk


От стъпка 3 => стартирайте SFC



от Start Repairs натиснете Start и оттук вече сложете всички отметки показани на снимката:



Сложете отметка пред restart system when finished и натиснете Start.

 

 

Изтеглете OTL.exe и го запазете на десктопа.

• Стартирайте OTL.exe.
• Направете следните настройки:
• Сложете отметка пред Scan All Users
• Под менюто File Age изберете 90 days
• Под менюто Standard Registry променете на ALL
• Сложете отметки пред LOP и Purity Check

Под с Copy/ Paste въведете изцяло следната текстова информация (само това, което е поставено в карето):

 

netsvcs%SYSTEMDRIVE%*.exe/md5startexplorer.exewinlogon.exeUserinit.exesvchost.exeservices.exe/md5stop%systemroot%*. /rp /s%systemdrive%$Recycle.Bin|@;true;true;true /fpDRIVESCREATERESTOREPOINT

 

• Натиснете маркираният в синьо бутон: Run Scan.
• Като приключи проверката, ще се създадат два файла - OTL.Txt и Extras.Txt. Файлът OTL.Txt копирайте в следващия си пост. Extras.Txt прикачете в следващия си коментар (погледнете опцията Прикачени файлове, когато публикувате мнение).

Тия стъпки по отделно ли? В смисъл отиван на стъпка 2 (скан диск) и давам на Do it. Свършва процеса после другата и така?

Да ..точно така..!А може и първо да подготвите дневници със втората програма OTL.exe за да ги разгледам, а през това време вие да работите със Windows Repair All in one

https://www.zeta-uploader.com/bg/openfile?hash=400307425&rel=400307425.Txt

Стартирайте отново OTL, копирайте (Copy) и поставете (Paste) скриптовия текст от текстовото поле по-долу под колонката Custom Scans/Fixes, като не забравяте да копирате скрипта 1 към 1, както и двете точки преди първия ред на скрипта.

 

:OTLIE - HKLM..URLSearchHook:  - No CLSID value foundIE - HKLM..URLSearchHook: {FE69C007-C452-4d3e-86D2-1730DF8BC871} - No CLSID value foundIE - HKUS-1-5-21-213751356-1395971630-3989863745-1000..URLSearchHook:  - No CLSID value found@Alternate Data Stream - 210 bytes -> C:ProgramDataTEMP:1CE11B51@Alternate Data Stream - 165 bytes -> C:ProgramDataTEMP:07BF512B:filesrecycler /alldrivesipconfig /flushdns /c:Commands[purity][emptytemp][clearallrestorepoints][Reboot]

След като въведете скрипта от цитата по-горе натиснете бутона, маркиран в червено: Run Fix
Windows ще се рестартира и ще се създаде лог файл. Публикувайте съдържанието му с Copy/Paste в следващия си коментар.

Къде е този файл? След рестарта нещо като сканиране имаще и после нещо от сорта на memory dump 100 после стоп и некви числа.

 

Нищо не се е променило след тия операции даже пц стана по-зле!!!

Така..аз активни зарази в системата ви не виждам...проблема не е от вируси...!

 

Деинсталирайте ComboFix така:

• Натиснете Start ==> Run ==> въведете командата Combofix /Uninstall ==> OK

• Моля, следвайте инструкциите, за да деинсталирате ComboFix. Ще получите съобщение, в което се казва ComboFix е деинсталиран успешно.

Деинсталирайте adwcleaner.exe

• Моля, затворете всички отворени програми и интернет браузъри.
• Кликнете два пъти върху adwcleaner.exe за да стартирате инструмента.
• Кликнете върху Uninstall .
• Щракнете върху Yes за да деинсталирате Adwcleaner

Деинсталирайте ESET Online Scaner.

• Start => Run, въведете control appwiz.cpl в полето.След това натиснете ENTER.
• Изберете ESET Online Scanner от списъка с приложения, а след това маркирайте Remove. Aко бъдете подканени рестартирайте компютъра си.

Изтеглете OTCleanIt или от тук,стартирайте и натиснете

Изтрийте всичко друго което е останало след процедурите по деинсталация (дневници програми).Прпоръчвам програмата Malwarebytes' Anti-Malware да остане на вашия компютър и периодично да сканирате системата си с нея (поне един -два пъти в седмицата),като не забравяйте да обновите дефинициите и преди всяко сканиране..!