SHA256: 44cc10b587e1e363497ea3434056dcc38371f38f452a6716c088e04c257b1f76 File name: CNMVS7B.DLL Detection ratio: 0 / 46 Analysis date: 2012-12-29 17:57:54 UTC ( 4 минути ago )

Cтартирайте пак OTL и с Copy/ Paste под колонката Custom Scans/Fixes въведете скриптовия текст от текстовото поле по-долу, като не забравяте да копирате скрипта 1 към 1, както и двете точки преди първия ред на скрипта!

:OTL

SRV - (WPFFontCache_v0400) -- C:WINDOWSMicrosoft.NETFrameworkv4.0.30319WPFWPFFontCache_v0400.exe File not found

SRV - (Suite Service) -- C:Program FilesFightersFighterSuiteService.exe File not found

SRV - (NMIndexingService) -- C:Program FilesCommon FilesAheadLibNMIndexingService.exe File not found

SRV - (NIS) -- C:Program FilesNorton Internet SecurityEngine17.5.0.127ccSvcHst.exe /s NIS /m C:Program FilesNorton Internet SecurityEngine17.5.0.127diMaster.dll /prefetch:1 File not found

SRV - (gusvc) -- C:Program FilesGoogleCommonGoogle UpdaterGoogleUpdaterService.exe File not found

SRV - (gupdatem) -- C:Program FilesGoogleUpdateGoogleUpdate.exe /medsvc File not found

SRV - (gupdate) -- C:Program FilesGoogleUpdateGoogleUpdate.exe /svc File not found

SRV - (Common Toolkit Tools) -- D:Common Toolkit Tools.exe File not found

SRV - (AVGIDSAgent) -- C:Program FilesAVGAVG2012AVGIDSAgent.exe File not found

 

IE - HKUS-1-5-21-436374069-1580818891-1606980848-1003..URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - No CLSID value found

FF - [email protected]/installer,version=1.0.3: C:Program FilesSony Online Entertainmentnpsoe.dll File not found

FF - [email protected]/Google Update;version=3: C:Program FilesGoogleUpdate1.3.21.123npGoogleUpdate3.dll File not found

FF - [email protected]/Google Update;version=9: C:Program FilesGoogleUpdate1.3.21.123npGoogleUpdate3.dll File not found

 

O2 - BHO: (no name) - {31332EEF-CB9F-458F-AFEB-D30E9A66B6BA} - No CLSID value found.

O2 - BHO: (no name) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No CLSID value found.

O2 - BHO: (ADDICT-THING Class) - {5ABE8288-D628-AA2F-37E1-7A779F6AD325} - C:Documents and SettingsAll UsersApplication DataADDICT-THINGbhoclass.dll ()

O2 - BHO: (no name) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - No CLSID value found.

O2 - BHO: (no name) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - No CLSID value found.

O2 - BHO: (no name) - {95B7759C-8C7F-4BF1-B163-73684A933233} - No CLSID value found.

O2 - BHO: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.

O3 - HKLM..Toolbar: (no name) - !{32099AAC-C132-4136-9E9A-4E364A424E17} - No CLSID value found.

O3 - HKLM..Toolbar: (no name) - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - No CLSID value found.

O3 - HKLM..Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found.

O3 - HKLM..Toolbar: (no name) - {95B7759C-8C7F-4BF1-B163-73684A933233} - No CLSID value found.

O3 - HKLM..Toolbar: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.

O3 - HKLM..Toolbar: (no name) - 10 - No CLSID value found.

O3 - HKUS-1-5-21-436374069-1580818891-1606980848-1003..ToolbarWebBrowser: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found.

O3 - HKUS-1-5-21-436374069-1580818891-1606980848-1003..ToolbarWebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.

O3 - HKUS-1-5-21-436374069-1580818891-1606980848-1003..ToolbarWebBrowser: (no name) - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No CLSID value found.

O8 - Extra context menu item: Add to AMV Converter... - D:AMVConvertergrab.html File not found

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:PROGRA~1MICROS~2Office12EXCEL.EXE/3000 File not found

O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:Program FilesCanonEasy-WebPrintResource.dll/RC_AddToList.html File not found

O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:Program FilesCanonEasy-WebPrintResource.dll/RC_HSPrint.html File not found

O8 - Extra context menu item: Easy-WebPrint Preview - res://C:Program FilesCanonEasy-WebPrintResource.dll/RC_Preview.html File not found

O8 - Extra context menu item: Easy-WebPrint Print - res://C:Program FilesCanonEasy-WebPrintResource.dll/RC_Print.html File not found

O8 - Extra context menu item: MediaManager tool grab multimedia file - D:MediaManagergrab.html File not found

O9 - Extra Button: AVG Do Not Track - {68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} - Reg Error: Key error. File not found

O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengermsmsgs.exe File not found

O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengermsmsgs.exe File not found

O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} http://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab (Reg Error: Key error.)

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)

O18 - ProtocolHandlerbelarc - No CLSID value found

O18 - ProtocolHandlerlinkscanner - No CLSID value found

 

@Alternate Data Stream - 108 bytes -> C:Documents and SettingsAll UsersApplication DataTEMP:12D2EB9C

 

:Files

C:Documents and SettingsAll UsersApplication Datapcdfdata

C:Documents and SettingsAll UsersApplication DataADDICT-THING

C:Program FilesCanonEasy-WebPrint

recycler /alldrives

ipconfig /flushdns /c

 

:Commands

[purity]

[resethosts]

[emptytemp]

[emptyflash]

[Reboot]

 

След като въведете скрипта от цитата по-горе натиснете бутона, маркиран в червено:

Ще се създаде лог файл. Публикувайте съдържанието му с Copy/Paste в следващия си коментар.

All processes killed
========== OTL ==========
Service WPFFontCache_v0400 stopped successfully!
Service WPFFontCache_v0400 deleted successfully!
File C:WINDOWSMicrosoft.NETFrameworkv4.0.30319WPFWPFFontCache_v0400.exe File not found not found.
Service Suite Service stopped successfully!
Service Suite Service deleted successfully!
File C:Program FilesFightersFighterSuiteService.exe File not found not found.
Service NMIndexingService stopped successfully!
Service NMIndexingService deleted successfully!
File C:Program FilesCommon FilesAheadLibNMIndexingService.exe File not found not found.
Error: No service named NIS was found to stop!
Registry key HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesNIS deleted successfully.
File C:Program FilesNorton Internet SecurityEngine17.5.0.127ccSvcHst.exe /s NIS /m C:Program FilesNorton Internet SecurityEngine17.5.0.127diMaster.dll /prefetch:1 File not found not found.
Service gusvc stopped successfully!
Service gusvc deleted successfully!
File C:Program FilesGoogleCommonGoogle UpdaterGoogleUpdaterService.exe File not found not found.
Service gupdatem stopped successfully!
Service gupdatem deleted successfully!
File C:Program FilesGoogleUpdateGoogleUpdate.exe /medsvc File not found not found.
Service gupdate stopped successfully!
Service gupdate deleted successfully!
File C:Program FilesGoogleUpdateGoogleUpdate.exe /svc File not found not found.
Service Common Toolkit Tools stopped successfully!
Service Common Toolkit Tools deleted successfully!
File D:Common Toolkit Tools.exe File not found not found.
Service AVGIDSAgent stopped successfully!
Service AVGIDSAgent deleted successfully!
File C:Program FilesAVGAVG2012AVGIDSAgent.exe File not found not found.
Registry value HKEY_USERSS-1-5-21-436374069-1580818891-1606980848-1003SoftwareMicrosoftInternet ExplorerURLSearchHooks{00000000-6E41-4FD3-8538-502F5495E5FC} deleted successfully.
Registry key HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{00000000-6E41-4FD3-8538-502F5495E5FC} not found.
Registry key [email protected]/installer,version=1.0.3 deleted successfully.
Registry key [email protected]/Google Update;version=3 deleted successfully.
Registry key [email protected]/Google Update;version=9 deleted successfully.
Registry key HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{31332EEF-CB9F-458F-AFEB-D30E9A66B6BA} deleted successfully.
Registry key HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{31332EEF-CB9F-458F-AFEB-D30E9A66B6BA} not found.
Registry key HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} deleted successfully.
Registry key HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} not found.
Registry key HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{5ABE8288-D628-AA2F-37E1-7A779F6AD325} deleted successfully.
Registry key HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{5ABE8288-D628-AA2F-37E1-7A779F6AD325} deleted successfully.
C:Documents and SettingsAll UsersApplication DataADDICT-THINGbhoclass.dll moved successfully.
Registry key HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} deleted successfully.
Registry key HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} not found.
Registry key HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{6D53EC84-6AAE-4787-AEEE-F4628F01010C} deleted successfully.
Registry key HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{6D53EC84-6AAE-4787-AEEE-F4628F01010C} not found.
Registry key HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{95B7759C-8C7F-4BF1-B163-73684A933233} deleted successfully.
Registry key HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{95B7759C-8C7F-4BF1-B163-73684A933233} not found.
Registry key HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully.
Registry key HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully.
Registry value HKEY_LOCAL_MACHINESoftwareMicrosoftInternet ExplorerToolbar!{32099AAC-C132-4136-9E9A-4E364A424E17} deleted successfully.
Registry value HKEY_LOCAL_MACHINESoftwareMicrosoftInternet ExplorerToolbar{327C2873-E90D-4c37-AA9D-10AC9BABA46C} deleted successfully.
Registry key HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{327C2873-E90D-4c37-AA9D-10AC9BABA46C} not found.
Registry value HKEY_LOCAL_MACHINESoftwareMicrosoftInternet ExplorerToolbar{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} deleted successfully.
Registry key HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} not found.
Registry value HKEY_LOCAL_MACHINESoftwareMicrosoftInternet ExplorerToolbar{95B7759C-8C7F-4BF1-B163-73684A933233} deleted successfully.
Registry key HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{95B7759C-8C7F-4BF1-B163-73684A933233} not found.
Registry value HKEY_LOCAL_MACHINESoftwareMicrosoftInternet ExplorerToolbar{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully.
Registry key HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{D4027C7F-154A-4066-A1AD-4243D8127440} not found.
Registry value HKEY_LOCAL_MACHINESoftwareMicrosoftInternet ExplorerToolbar10 deleted successfully.
Registry value HKEY_USERSS-1-5-21-436374069-1580818891-1606980848-1003SoftwareMicrosoftInternet ExplorerToolbarWebBrowser{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} deleted successfully.
Registry key HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} not found.
Registry value HKEY_USERSS-1-5-21-436374069-1580818891-1606980848-1003SoftwareMicrosoftInternet ExplorerToolbarWebBrowser{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully.
Registry key HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{D4027C7F-154A-4066-A1AD-4243D8127440} not found.
Registry value HKEY_USERSS-1-5-21-436374069-1580818891-1606980848-1003SoftwareMicrosoftInternet ExplorerToolbarWebBrowser{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} deleted successfully.
Registry key HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} deleted successfully.
Registry key HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerMenuExtAdd to AMV Converter... deleted successfully.
Registry key HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerMenuExtE&xport to Microsoft Excel deleted successfully.
Registry key HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerMenuExtEasy-WebPrint Add To Print List deleted successfully.
Registry key HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerMenuExtEasy-WebPrint High Speed Print deleted successfully.
Registry key HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerMenuExtEasy-WebPrint Preview deleted successfully.
Registry key HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerMenuExtEasy-WebPrint Print deleted successfully.
Registry key HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerMenuExtMediaManager tool grab multimedia file deleted successfully.
Registry key HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerExtensions{68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} deleted successfully.
Registry key HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} not found.
Registry key HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerExtensions{FB5F1910-F110-11d2-BB9E-00C04F795683} deleted successfully.
Registry key HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{FB5F1910-F110-11d2-BB9E-00C04F795683} not found.
Registry key HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerExtensions{FB5F1910-F110-11d2-BB9E-00C04F795683} not found.
Registry key HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{FB5F1910-F110-11d2-BB9E-00C04F795683} not found.
Starting removal of ActiveX control {31435657-9980-0010-8000-00AA00389B71}
C:WINDOWSDownloaded Program Fileswvc1dmo.inf not found.
Registry key HKEY_LOCAL_MACHINESOFTWAREMicrosoftCode Store DatabaseDistribution Units{31435657-9980-0010-8000-00AA00389B71} deleted successfully.
Registry key HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{31435657-9980-0010-8000-00AA00389B71} not found.
Registry key HKEY_LOCAL_MACHINESOFTWAREMicrosoftActive SetupInstalled Components{31435657-9980-0010-8000-00AA00389B71} not found.
Registry key HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{31435657-9980-0010-8000-00AA00389B71} not found.
Starting removal of ActiveX control {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
C:WINDOWSDownloaded Program Filesgp.inf not found.
Registry key HKEY_LOCAL_MACHINESOFTWAREMicrosoftCode Store DatabaseDistribution Units{E2883E8F-472F-4FB0-9522-AC9BF37916A7} deleted successfully.
Registry key HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{E2883E8F-472F-4FB0-9522-AC9BF37916A7} not found.
Registry key HKEY_LOCAL_MACHINESOFTWAREMicrosoftActive SetupInstalled Components{E2883E8F-472F-4FB0-9522-AC9BF37916A7} not found.
Registry key HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{E2883E8F-472F-4FB0-9522-AC9BF37916A7} not found.
Registry key HKEY_LOCAL_MACHINESOFTWAREClassesPROTOCOLSHandlerbelarc deleted successfully.
File ProtocolHandlerbelarc - No CLSID value found not found.
Registry key HKEY_LOCAL_MACHINESOFTWAREClassesPROTOCOLSHandlerlinkscanner deleted successfully.
File ProtocolHandlerlinkscanner - No CLSID value found not found.
ADS C:Documents and SettingsAll UsersApplication DataTEMP:12D2EB9C deleted successfully.
========== FILES ==========
FileFolder C:Documents and SettingsAll UsersApplication Datapcdfdata not found.
C:Documents and SettingsAll UsersApplication DataADDICT-THINGdata folder moved successfully.
C:Documents and SettingsAll UsersApplication DataADDICT-THING folder moved successfully.
FileFolder C:Program FilesCanonEasy-WebPrint not found.
C:RECYCLERS-1-5-21-436374069-1580818891-1606980848-1003 folder moved successfully.
C:RECYCLER folder moved successfully.
recycler not found in D:
recycler not found in E:
recycler not found in I:
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
I:cmd.bat deleted successfully.
I:cmd.txt deleted successfully.
========== COMMANDS ==========
C:WINDOWSSystem32driversetcHosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: All Users

User: Default User
->Temporary Internet Files folder emptied: 33170 bytes

User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 49554 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 39367236 bytes

User: Svetlan
->Temp folder emptied: 9510440 bytes
->Temporary Internet Files folder emptied: 93694030 bytes
->Java cache emptied: 116489 bytes
->FireFox cache emptied: 5870037 bytes
->Google Chrome cache emptied: 0 bytes
->Apple Safari cache emptied: 29504512 bytes
->Opera cache emptied: 34982854 bytes
->Flash cache emptied: 54081 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%System32 .tmp files removed: 0 bytes
%systemroot%System32dllcache .tmp files removed: 0 bytes
%systemroot%System32drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 499396 bytes
%systemroot%system32configsystemprofileLocal SettingsTemp folder emptied: 119052321 bytes
%systemroot%system32configsystemprofileLocal SettingsTemporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 317.00 mb


[EMPTYFLASH]

User: Administrator

User: All Users

User: Default User

User: LocalService

User: NetworkService

User: Svetlan
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb


OTL by OldTimer - Version 3.2.69.0 log created on 12292012_202305

FilesFolders moved on Reboot...

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

Как е системата сега ? Има ли някакви проблеми?

Не всичко изглежда наред благодаря още един път наистина супер помощ ми оказахте не вярвах, че ще се оправи без сервиз Хоу Хоу Хоу по коледа стават чудеса

Добре, остана още малко, не отговорихте на въпроса:

Имате 2 антивирусни:

Моля да оставите само едната. Или това са само остатъци от антивирусните ? Вижте в Add/Remove Programs дали могат да се деинсталират.

 

Искам да знам дали можете да ги деинсталирате, ако не ще ги махнем с OTL.

Да щях да забравя нямам нито една антивирусна махнал съм ги и 2-те от "add and removes" няма какво да се деинсталира принципно си стоя без антивирусна и през месец си пускам профилактично "Malwarebytes Anti-Malware" и "SUPERAntiSpyware Free Edition" пречи ли това, че нямам никаква антивирусна ?

Добре, нека ги махнем тогава. Ще ми трябват свежи логове от OTL.

Този път отворете OTL и натиснете "Quick Scan", след това публикувайте 2-та лога.

Само един лог ми изкара 

Само един лог ми изкара 

OTL.Txt

Cтартирайте пак OTL и с Copy/ Paste под колонката Custom Scans/Fixes въведете скриптовия текст от текстовото поле по-долу, като не забравяте да копирате скрипта 1 към 1, както и двете точки преди първия ред на скрипта!

 

:OTL

SRV - (vToolbarUpdater) -- C:Program FilesCommon FilesAVG Secure SearchvToolbarUpdater10.0.6ToolbarUpdater.exe ()

SRV - (avgwd) -- C:Program FilesAVGAVG2012avgwdsvc.exe (AVG Technologies CZ, s.r.o.)

 

DRV - (AVGIDSHX) -- C:WINDOWSsystem32driversavgidshx.sys (AVG Technologies CZ, s.r.o. )

DRV - (Avgtdix) -- C:WINDOWSsystem32driversavgtdix.sys (AVG Technologies CZ, s.r.o.)

DRV - (Avgldx86) -- C:WINDOWSsystem32driversavgldx86.sys (AVG Technologies CZ, s.r.o.)

DRV - (Avgrkx86) -- C:WINDOWSsystem32driversavgrkx86.sys (AVG Technologies CZ, s.r.o.)

DRV - (Avgmfx86) -- C:WINDOWSsystem32driversavgmfx86.sys (AVG Technologies CZ, s.r.o.)

DRV - (AVGIDSShim) -- C:WINDOWSsystem32driversavgidsshimx.sys (AVG Technologies CZ, s.r.o. )

DRV - (AVGIDSFilter) -- C:WINDOWSsystem32driversavgidsfilterx.sys (AVG Technologies CZ, s.r.o. )

DRV - (AVGIDSDriver) -- C:WINDOWSsystem32driversavgidsdriverx.sys (AVG Technologies CZ, s.r.o. )

 

DRV - (eeCtrl) -- C:Program FilesCommon FilesSymantec SharedEENGINEeeCtrl.sys (Symantec Corporation)

DRV - (SymEvent) -- C:WINDOWSsystem32driversSYMEVENT.SYS (Symantec Corporation)

DRV - (ccHP) -- C:WINDOWSsystem32driversNIS1105000.07Fcchpx86.sys (Symantec Corporation)

DRV - (SRTSP) -- C:WINDOWSsystem32driversNIS1105000.07Fsrtsp.sys (Symantec Corporation)

DRV - (SRTSPX) -- C:WINDOWSsystem32driversNIS1105000.07Fsrtspx.sys (Symantec Corporation)

DRV - (SymEFA) -- C:WINDOWSsystem32driversNIS1105000.07FSymEFA.sys (Symantec Corporation)

DRV - (SymIRON) -- C:WINDOWSsystem32driversNIS1105000.07FIronx86.sys (Symantec Corporation)

DRV - (BHDrvx86) -- C:Documents and SettingsAll UsersApplication DataNorton{0C55C096-0F1D-4F28-AAA2-85EF591126E7}NIS_17.5.0.127DefinitionsBASHDefs20091205.001BHDrvx86.sys (Symantec Corporation)

DRV - (SYMTDI) -- C:WINDOWSsystem32driversNIS1105000.07Fsymtdi.sys (Symantec Corporation)

DRV - (IDSxpx86) -- C:Documents and SettingsAll UsersApplication DataNorton{0C55C096-0F1D-4F28-AAA2-85EF591126E7}NIS_17.5.0.127DefinitionsIPSDefs20091105.001IDSxpx86.sys (Symantec Corporation)

DRV - (SymDS) -- C:WINDOWSsystem32driversNIS1105000.07FSymDS.sys (Symantec Corporation)

 

FF - HKEY_LOCAL_MACHINEsoftwaremozillaFirefoxExtensions{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:Program FilesAVGAVG2012Firefox4

FF - HKEY_LOCAL_MACHINEsoftwaremozillaFirefoxExtensions{F53C93F1-07D5-430c-86D4-C9531B27DFAF}: C:Program FilesAVGAVG2012FirefoxDoNotTrack

 

O18 - ProtocolHandlerviprotocol {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:Program FilesCommon FilesAVG Secure SearchViProtocolInstaller10.0.6ViProtocol.dll ()

 

[2012.04.30 08:41:09 | 000,000,000 | ---D | M] -- C:Documents and SettingsAll UsersApplication DataAVG Secure Search

[2012.05.16 08:14:50 | 000,000,000 | ---D | M] -- C:Documents and SettingsAll UsersApplication DataAVG2012

[2011.11.07 16:51:35 | 000,000,000 | ---D | M] -- C:Documents and SettingsSvetlanApplication DataAVG2012

[2012.12.28 19:49:41 | 000,001,945 | ---- | M] () -- C:Documents and SettingsAll UsersDesktopXP Defender.lnk

 

:Services

avgwdsvc

ToolbarUpdater

avgidshx

avgtdix

avgldx86

avgrkx86

avgmfx86

avgidsshimx

avgidsfilterx

avgidsdriverx

 

:Files

C:Program FilesCommon FilesAVG Secure SearchvToolbarUpdater10.0.6ToolbarUpdater.exe

C:Program FilesAVGAVG2012avgwdsvc.exe

C:WINDOWSsystem32driversavgidshx.sys

C:WINDOWSsystem32driversavgtdix.sys

C:WINDOWSsystem32driversavgldx86.sys

C:WINDOWSsystem32driversavgrkx86.sys

C:WINDOWSsystem32driversavgmfx86.sys

C:WINDOWSsystem32driversavgidsshimx.sys

C:WINDOWSsystem32driversavgidsfilterx.sys

C:WINDOWSsystem32driversavgidsdriverx.sys

C:Program FilesCommon FilesSymantec SharedEENGINEeeCtrl.sys

 

C:Program FilesCommon FilesAVG Secure Search

C:WINDOWSsystem32driversNIS

C:Documents and SettingsAll UsersApplication DataNorton

 

:Reg

[-HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringAhnlabAntiVirus]

[-HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringComputerAssociatesAntiVirus]

[-HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringKasperskyAntiVirus]

[-HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringMcAfeeAntiVirus]

[-HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringMcAfeeFirewall]

[-HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringPandaAntiVirus]

[-HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringPandaFirewall]

[-HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringSophosAntiVirus]

[-HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringSymantecAntiVirus]

[-HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringSymantecFirewall]

[-HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringTinyFirewall]

[-HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringTrendAntiVirus]

[-HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringTrendFirewall]

[-HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringZoneLabsFirewall]

 

:Commands

[purity]

[Reboot]

 

След като въведете скрипта от цитата по-горе натиснете бутона, маркиран в червено:
Ще се създаде лог файл. Публикувайте съдържанието му с Copy/Paste в следващия си коментар.

Помъчих се 4 пъти, но винаги ОТЛ-то като го пусна и става "not responding" като последният път реших да изчакам малко, но уви не продължава .. смисъл като цъкна рън и тогава зацепва

Нека пробваме така, ако от първия път не стане пишете тук.

 

Cтартирайте пак OTL и с Copy/ Paste под колонката Custom Scans/Fixes въведете скриптовия текст от текстовото поле по-долу, като не забравяте да копирате скрипта 1 към 1, както и двете точки преди първия ред на скрипта!

:OTL

SRV - (vToolbarUpdater) -- C:Program FilesCommon FilesAVG Secure SearchvToolbarUpdater10.0.6ToolbarUpdater.exe ()

SRV - (avgwd) -- C:Program FilesAVGAVG2012avgwdsvc.exe (AVG Technologies CZ, s.r.o.)

 

DRV - (AVGIDSHX) -- C:WINDOWSsystem32driversavgidshx.sys (AVG Technologies CZ, s.r.o. )

DRV - (Avgtdix) -- C:WINDOWSsystem32driversavgtdix.sys (AVG Technologies CZ, s.r.o.)

DRV - (AVGIDSShim) -- C:WINDOWSsystem32driversavgidsshimx.sys (AVG Technologies CZ, s.r.o. )

DRV - (AVGIDSFilter) -- C:WINDOWSsystem32driversavgidsfilterx.sys (AVG Technologies CZ, s.r.o. )

DRV - (AVGIDSDriver) -- C:WINDOWSsystem32driversavgidsdriverx.sys (AVG Technologies CZ, s.r.o. )

 

DRV - (eeCtrl) -- C:Program FilesCommon FilesSymantec SharedEENGINEeeCtrl.sys (Symantec Corporation)

DRV - (SymEvent) -- C:WINDOWSsystem32driversSYMEVENT.SYS (Symantec Corporation)

DRV - (ccHP) -- C:WINDOWSsystem32driversNIS1105000.07Fcchpx86.sys (Symantec Corporation)

DRV - (SRTSP) -- C:WINDOWSsystem32driversNIS1105000.07Fsrtsp.sys (Symantec Corporation)

DRV - (SRTSPX) -- C:WINDOWSsystem32driversNIS1105000.07Fsrtspx.sys (Symantec Corporation)

DRV - (SymEFA) -- C:WINDOWSsystem32driversNIS1105000.07FSymEFA.sys (Symantec Corporation)

DRV - (SymIRON) -- C:WINDOWSsystem32driversNIS1105000.07FIronx86.sys (Symantec Corporation)

DRV - (BHDrvx86) -- C:Documents and SettingsAll UsersApplication DataNorton{0C55C096-0F1D-4F28-AAA2-85EF591126E7}NIS_17.5.0.127DefinitionsBASHDefs20091205.001BHDrvx86.sys (Symantec Corporation)

DRV - (SYMTDI) -- C:WINDOWSsystem32driversNIS1105000.07Fsymtdi.sys (Symantec Corporation)

DRV - (IDSxpx86) -- C:Documents and SettingsAll UsersApplication DataNorton{0C55C096-0F1D-4F28-AAA2-85EF591126E7}NIS_17.5.0.127DefinitionsIPSDefs20091105.001IDSxpx86.sys (Symantec Corporation)

DRV - (SymDS) -- C:WINDOWSsystem32driversNIS1105000.07FSymDS.sys (Symantec Corporation)

 

FF - HKEY_LOCAL_MACHINEsoftwaremozillaFirefoxExtensions{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:Program FilesAVGAVG2012Firefox4

FF - HKEY_LOCAL_MACHINEsoftwaremozillaFirefoxExtensions{F53C93F1-07D5-430c-86D4-C9531B27DFAF}: C:Program FilesAVGAVG2012FirefoxDoNotTrack 

O18 - ProtocolHandlerviprotocol {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:Program FilesCommon FilesAVG Secure SearchViProtocolInstaller10.0.6ViProtocol.dll ()

 

[2012.04.30 08:41:09 | 000,000,000 ---D M] -- C:Documents and SettingsAll UsersApplication DataAVG Secure Search

[2012.05.16 08:14:50 | 000,000,000 ---D M] -- C:Documents and SettingsAll UsersApplication DataAVG2012

[2011.11.07 16:51:35 | 000,000,000 ---D M] -- C:Documents and SettingsSvetlanApplication DataAVG2012

[2012.12.28 19:49:41 | 000,001,945 ---- M] () -- C:Documents and SettingsAll UsersDesktopXP Defender.lnk

 

:Reg

[-HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringAhnlabAntiVirus]

[-HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringComputerAssociatesAntiVirus]

[-HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringKasperskyAntiVirus]

[-HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringMcAfeeAntiVirus]

[-HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringMcAfeeFirewall]

[-HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringPandaAntiVirus]

[-HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringPandaFirewall]

[-HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringSophosAntiVirus]

[-HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringSymantecAntiVirus]

[-HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringSymantecFirewall]

[-HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringTinyFirewall]

[-HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringTrendAntiVirus]

[-HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringTrendFirewall]

[-HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringZoneLabsFirewall]

 

:Files

C:Program FilesCommon FilesAVG Secure Search

C:WINDOWSsystem32driversNIS

C:Documents and SettingsAll UsersApplication DataNorton

C:Documents and SettingsAll UsersApplication DataAVG2012

C:Documents and SettingsSvetlanApplication DataAVG2012

 

:Commands

[purity]

[Reboot]

 

След като въведете скрипта от цитата по-горе натиснете бутона, маркиран в червено: 
Ще се създаде лог файл. Публикувайте съдържанието му с Copy/Paste в следващия си коментар.

Отново "not responding" като стигне до този файл "DRV - (Avgldx86) -- C:WINDOWSsystem32driversavgldx86.sys (AVG Technologies CZ, s.r.o.)" и забива 

Добре, за да не пълним страниците ще редактирвам стария скрипт. Пробвайте отново.

Сега тръгна за по-дълго време, но спря когато стигна до този файл "DRV - (SymEvent) -- C:WINDOWSsystem32driversSYMEVENT.SYS (Symantec Corporation)" сещам се, че като триех авг-то с клизма я махнах нещо се опъваше доста..

Заразите ги махнахме, остана само AVG и Norton да премахнем.

 

Нека пробваме с:

 

AVG Removal Tool

• Стартирайте програмата и следвайте инструкциите.

След това изтеглете:

Norton Removal Tool

• Стартирайте програмата и следвайте инструкциите.

 

Моля да ме уведомите ако възникнат грешки.

Значи нортона се махна, но авг-то ме съмнява появи се един лог файл

2012-12-29 22:03:56,843 INFO AvgRemover 2012.0.5
-------------------------------------------------------
2012-12-29 22:03:56,843 DEBUG Avg9UninstallDirectories key failed to open (error: e0010013)
2012-12-29 22:03:56,843 DEBUG Avg8UninstallDirectories key failed to open (error: e0010013)
2012-12-29 22:03:56,859 DEBUG Reading AVG IDSIDSInstallDir value failed (error: e001003d)
2012-12-29 22:03:56,859 DEBUG Reading HKLMSOFTWAREMicrosoftWindowsCurrentVersion:ProgramFilesDir (x86) value failed (error: e001003d)
2012-12-29 22:03:56,859 INFO Command line: "C:Documents and SettingsSvetlanDesktopavg_remover_stf_x86_2012_1796.exe"
2012-12-29 22:03:56,890 WARN AvgDir param empty, but Remover found AvgDir at 'C:Program FilesAVGAVG2012', use this path as default.
2012-12-29 22:03:56,890 WARN AvgDataDir param empty, but Remover found AvgDataDir at 'C:Documents and SettingsAll UsersApplication DataAVG2012', use this path as default.
2012-12-29 22:04:02,531 INFO AvgRemover runs in attempt number 1
2012-12-29 22:04:02,546 INFO Attempting to unregister AVG from the Windows Security Center.
2012-12-29 22:04:02,546 INFO Attempting to uninstall AVG Identity Protection.
2012-12-29 22:04:02,609 DEBUG Uninstalling IDP failed with error 0xe001003d
2012-12-29 22:04:02,609 INFO Attempting to uninstall toolbar
2012-12-29 22:09:15,406 INFO AvgRemover 2012.0.5
-------------------------------------------------------
2012-12-29 22:09:15,453 DEBUG Avg9UninstallDirectories key failed to open (error: e0010013)
2012-12-29 22:09:15,453 DEBUG Avg8UninstallDirectories key failed to open (error: e0010013)
2012-12-29 22:09:15,453 DEBUG Reading AVG IDSIDSInstallDir value failed (error: e001003d)
2012-12-29 22:09:15,453 DEBUG Reading HKLMSOFTWAREMicrosoftWindowsCurrentVersion:ProgramFilesDir (x86) value failed (error: e001003d)
2012-12-29 22:09:15,453 INFO Command line: "C:Documents and SettingsSvetlanDesktopavg_remover_stf_x86_2012_1796.exe" /run_number=2 /avgdir="C:Program FilesAVGAVG2012" /avgdatadir="C:Documents and SettingsAll UsersApplication DataAVG2012" /ndis_nextstep=1
2012-12-29 22:09:15,453 DEBUG AvgDir param set to C:Program FilesAVGAVG2012.
2012-12-29 22:09:15,453 DEBUG AvgDataDir param set to C:Documents and SettingsAll UsersApplication DataAVG2012.
2012-12-29 22:09:15,453 INFO AvgRemover runs in attempt number 2
2012-12-29 22:09:15,453 INFO Attempting to uninstall AVG Identity Protection.
2012-12-29 22:09:15,453 DEBUG Uninstalling IDP failed with error 0xe001003d
2012-12-29 22:09:15,453 INFO Attempting to uninstall toolbar
2012-12-29 22:12:25,125 INFO AvgRemover 2012.0.5
-------------------------------------------------------
2012-12-29 22:12:25,125 DEBUG Avg9UninstallDirectories key failed to open (error: e0010013)
2012-12-29 22:12:25,125 DEBUG Avg8UninstallDirectories key failed to open (error: e0010013)
2012-12-29 22:12:25,125 DEBUG Reading AVG IDSIDSInstallDir value failed (error: e001003d)
2012-12-29 22:12:25,125 DEBUG Reading HKLMSOFTWAREMicrosoftWindowsCurrentVersion:ProgramFilesDir (x86) value failed (error: e001003d)
2012-12-29 22:12:25,125 INFO Command line: "C:Documents and SettingsSvetlanDesktopavg_remover_stf_x86_2012_1796.exe"
2012-12-29 22:12:25,125 WARN AvgDir param empty, but Remover found AvgDir at 'C:Program FilesAVGAVG2012', use this path as default.
2012-12-29 22:12:25,125 WARN AvgDataDir param empty, but Remover found AvgDataDir at 'C:Documents and SettingsAll UsersApplication DataAVG2012', use this path as default.
2012-12-29 22:12:40,203 INFO AvgRemover runs in attempt number 1
2012-12-29 22:12:40,203 INFO Attempting to unregister AVG from the Windows Security Center.
2012-12-29 22:12:40,203 INFO Attempting to uninstall AVG Identity Protection.
2012-12-29 22:12:40,203 DEBUG Uninstalling IDP failed with error 0xe001003d
2012-12-29 22:12:40,203 INFO Attempting to uninstall toolbar

 

Ааа, значи AVG се опъва нещо, ама не знае, че тия при мен не минават. Щом не иска с хубаво минавам към тежката артилерия.

1. Изтеглете ComboFix от BleepingComputer
и го запазете (бутон Save -> Save as) ComboFix на вашия десктоп:

След приключване на изтеглянето на ComboFix, иконката на програмата би трябвало да изглежда така:


2. Затворете всички работещи приложения, отворени прозорци и програми работещи във фонов режим. Спрете временно защитата в реално време на антивирусната програма и на другите програми за сигурност, ако има такива.


3. Стартирайте с двоен клик Combofix.exe. Изберете YES, за да се съгласите с условията за използване на програмата. Важно: По време на работата на ComboFix не бива да се движи мишката и да се натискат клавиши от клавиатурата. Просто търпеливо оставете ComboFix да си свърши работата, без да използвате компютъра за други цели.


4. ComboFix ще провери дали Windows Recovery Console e инсталиранa.


*Ако Windows Recovery Console не е инсталирана, ще е необходимо да използвате YES за инсталация на Windows Recovery Console
*Ако Windows Recovery Console е инсталирана, ComboFix ще продължи работата си.



Забележка: Необходимо е да сте свързани към Интернет за да може Windows Recovery Console да се изтегли.


След инсталация на Windows Recovery Console потвърдете с YES, за да продължите напред. Снимка:



5. ComboFix ще спре временно Интернет връзката, но след като приключи работата на програмата тази връзка ще бъде възстановена автоматично. ComboFix ще сканира за проблеми и за заразени файлове, като това може да отнеме известно време. Моля да бъдете търпеливи. Ако има проблем с Интернет връзката след приключване на работата на ComboFix, моля да прочетете това: Manually restoring the Internet connection section.


6. Когато работата на ComboFix приключи, ще се появи текстов документ (log) в Notepad:


Копирайте с (Copy) и поставете с (Paste) съдържанието на лога в следващия си коментар.

ComboFix 12-12-30.01 - Svetlan 30.12.2012 11:54:31.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1251.359.1033.18.511.319 [GMT 2:00]
Running from: c:documents and settingsSvetlanDesktopComboFix.exe
AV: AVG Anti-Virus Free Edition 2012 *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:documents and settingsAll UsersApplication DataTEMP
c:documents and settingsAll UsersStart MenuProgramsXP Defender
c:documents and settingsAll UsersStart MenuProgramsXP DefenderRemove XP Defender.lnk
c:documents and settingsAll UsersStart MenuProgramsXP DefenderXP Defender Help and Support.lnk
c:documents and settingsAll UsersStart MenuProgramsXP DefenderXP Defender.lnk
c:windowsN06041CD7-Mortal Kombat 4-Setup.exe
c:windowssystem32URTTemp
c:windowssystem32URTTempregtlib.exe
.
.
((((((((((((((((((((((((( Files Created from 2012-11-28 to 2012-12-30 )))))))))))))))))))))))))))))))
.
.
2012-12-29 18:31 . 2012-12-29 18:31 -------- d-----w- c:documents and settingsSvetlanLocal SettingsApplication DataSun
2012-12-29 17:57 . 2012-12-29 17:57 -------- d-----w- c:program filesCommon FilesJava
2012-12-29 17:57 . 2012-12-29 17:55 143872 ----a-w- c:windowssystem32javacpl.cpl
2012-12-29 17:57 . 2012-12-29 17:55 859072 ----a-w- c:windowssystem32npDeployJava1.dll
2012-12-29 17:56 . 2012-12-29 17:56 93640 ----a-w- c:windowssystem32WindowsAccessBridge.dll
2012-12-02 14:22 . 2012-12-02 14:22 -------- d-----w- c:documents and settingsSvetlanApplication Dataxim
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-12-29 17:55 . 2011-10-27 19:14 779704 ----a-w- c:windowssystem32deployJava1.dll
2012-12-14 14:49 . 2011-11-08 00:21 21104 ----a-w- c:windowssystem32driversmbam.sys
2012-12-13 16:41 . 2012-05-26 18:30 697272 ----a-w- c:windowssystem32FlashPlayerApp.exe
2012-12-13 16:41 . 2011-10-21 06:52 73656 ----a-w- c:windowssystem32FlashPlayerCPLApp.cpl
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
"GarenaPlus"="e:downloadsGarena PlusGarenaMessenger.exe" [2012-12-17 9152968]
"uTorrent"="c:documents and settingsSvetlanDesktopNew FolderuTorrent.exe" [2011-04-21 549752]
"Skype"="c:program filesskypephoneskype.exe" [2008-04-23 22058792]
"Advanced SystemCare 6"="d:installAdvanced SystemCare 6ASCTray.exe" [2012-09-24 490880]
.
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
"Adobe Photo Downloader"="c:program filesAdobePhotoshop Album Starter Edition3.0Appsapdproxy.exe" [2005-06-07 57344]
"SNPSTD2"="c:windowsvsnpstd2.exe" [2004-01-06 40960]
"LogMeIn Hamachi Ui"="c:program fileslogmein hamachihamachi-2-ui.exe" [2012-02-28 1987976]
"SunJavaUpdateSched"="c:program filesCommon FilesJavaJava Updatejusched.exe" [2012-07-03 252848]
.
[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
"CTFMON.EXE"="c:windowssystem32CTFMON.EXE" [2008-04-14 15360]
.
[hkey_local_machinesoftwaremicrosoftwindowscurrentversionexplorerShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:program filesSUPERAntiSpywareSASSEH.DLL" [2011-07-19 113024]
.
[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetcontrollsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau
.
[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootMinimal!SASCORE]
@=""
.
[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregKernelFaultCheck]
c:windowssystem32dumprep 0 -k [X]
HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregWeatherClock
.
[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregAVG_TRAY]
2012-04-05 02:12 2587008 ----a-w- c:program filesAVGAVG2012avgtray.exe
.
[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregDAEMON Tools Lite]
2011-08-02 07:33 4910912 ----a-w- c:program filesDAEMON Tools LiteDTLite.exe
.
[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregDTLite]
2011-08-02 07:33 4910912 ----a-w- c:program filesDAEMON Tools LiteDTLite.exe
.
[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregGarenaPlus]
2012-12-17 03:02 9152968 ----a-w- e:downloadsGarena PlusGarenaMessenger.exe
.
[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregSUPERAntiSpyware]
2012-11-23 10:23 4763008 ----a-w- c:program filesSUPERAntiSpywareSUPERANTISPYWARE.EXE
.
[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupreguTorrent]
2011-04-21 16:38 549752 ----a-w- c:documents and settingsSvetlanDesktopNew FolderuTorrent.exe
.
[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigservices]
"PCToolsSSDMonitorSvc"=2 (0x2)
"ose"=3 (0x3)
"odserv"=3 (0x3)
"NIS"=2 (0x2)
"IDriverT"=3 (0x3)
.
[HKLM~servicessharedaccessparametersfirewallpolicystandardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
"%windir%system32sessmgr.exe"=
"c:Documents and SettingsSvetlanDesktopNew FolderuTorrent.exe"=
"c:Program FilesOperaopera.exe"=
"c:program filesskypephoneskype.exe"=
.
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:windowssystem32driversavgrkx86.sys [31.01.2012 03:46 31952]
R0 SmartDefragDriver;SmartDefragDriver;c:windowssystem32driversSmartDefragDriver.sys [03.12.2011 14:52 14776]
R0 sptd;sptd;SystemRootSystemRootSystem32Driverssptd.sys --> SystemRootSystemRootSystem32Driverssptd.sys [?]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:windowssystem32driversdtsoftbus01.sys [06.12.2011 04:29 232512]
R1 SASDIFSV;SASDIFSV;c:program filesSUPERAntiSpywaresasdifsv.sys [22.07.2011 18:27 12880]
R1 SASKUTIL;SASKUTIL;c:program filesSUPERAntiSpywareSASKUTIL.SYS [12.07.2011 23:55 67664]
R2 !SASCORE;SAS Core Service;c:program filesSUPERAntiSpywareSASCORE.EXE [12.08.2011 01:38 116608]
S2 AdvancedSystemCareService6;Advanced SystemCare Service 6;d:installAdvanced SystemCare 6ASCService.exe [09.12.2012 11:54 464256]
S2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;c:program filesLogMeIn Hamachihamachi-2.exe [28.02.2012 17:38 1373576]
S3 Asushwio;Asushwio;c:windowssystem32driversASUSHWIO.SYS [26.11.2010 20:45 5824]
S3 GGSAFERDriver;GGSAFER Driver;??e:downloadsGarena PlusRoomsafedrv.sys --> e:downloadsGarena PlusRoomsafedrv.sys [?]
S4 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;c:program filesCommon FilesPC ToolssMonitorStartManSvc.exe [30.10.2010 05:06 583640]
.
Contents of the 'Scheduled Tasks' folder
.
2012-12-30 c:windowsTasksAdobe Flash Player Updater.job
- c:windowssystem32MacromedFlashFlashPlayerUpdateService.exe [2012-05-26 16:41]
.
2012-12-08 c:windowsTasksAppleSoftwareUpdate.job
- c:program filesApple Software UpdateSoftwareUpdate.exe [2011-06-01 14:57]
.
2012-12-29 c:windowsTasksASC6_PerformanceMonitor.job
- d:installAdvanced SystemCare 6Monitor.exe [2012-12-09 18:33]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.searchnu.com/406
IE: Add to Google Photos Screensa&ver - c:windowssystem32GPhotos.scr/200
Trusted Zone: clonewarsadventures.com
Trusted Zone: freerealms.com
Trusted Zone: soe.com
Trusted Zone: sony.com
TCP: Interfaces{63FE8A85-350E-4F84-A204-112294701F34}: NameServer = 212.25.58.229 212.25.58.2
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:program filesCommon FilesAVG Secure SearchViProtocolInstaller10.0.6ViProtocol.dll
.
- - - - ORPHANS REMOVED - - - -
.
HKLM-RunOnce-AvgRemover - c:documents and settingsSvetlanDesktopavg_remover_stf_x86_2012_1796.exe
MSConfigStartUp-Adobe ARM - c:program filesCommon FilesAdobeARM1.0AdobeARM.exe
MSConfigStartUp-Adobe Reader Speed Launcher - c:program filesAdobeReader 9.0ReaderReader_sl.exe
MSConfigStartUp-AdobeARM - c:program filesCommon FilesAdobeARM1.0AdobeARM.exe
MSConfigStartUp-Advanced SystemCare 4 - c:program filesIObitAdvanced SystemCare 4ASCTray.exe
MSConfigStartUp-Advanced SystemCare 5 - c:program filesIObitAdvanced SystemCare 5ASCTray.exe
MSConfigStartUp-Cmaudio - cmicnfg.cpl
MSConfigStartUp-Google Update - c:documents and settingsSvetlanLocal SettingsApplication DataGoogleUpdateGoogleUpdate.exe
MSConfigStartUp-MSMSGS - c:program filesMessengermsmsgs.exe
MSConfigStartUp-NeroCheck - c:program filesCommon FilesAheadLibNeroCheck.exe
MSConfigStartUp-NeroFilterCheck - c:program filesCommon FilesAheadLibNeroCheck.exe
MSConfigStartUp-Reader_sl - c:program filesAdobeReader 9.0ReaderReader_sl.exe
MSConfigStartUp-winampa - c:program filesWinampwinampa.exe
MSConfigStartUp-WinampAgent - c:program filesWinampwinampa.exe
AddRemove-Easy-WebPrint - c:program filesCanonEasy-WebPrintUninst.isu
AddRemove-Google Chrome - c:program filesGoogleChromeApplication23.0.1271.97Installersetup.exe
AddRemove-{71277DC4-4217-462A-9FF4-62D7815B2C69} - c:documents and settingsAll UsersApplication DataADDICT-THINGuninstall.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-12-30 12:02
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERSS-1-5-21-436374069-1580818891-1606980848-1003SoftwareMicrosoftSystemCertificatesAddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
[HKEY_LOCAL_MACHINEsoftwareClassesCLSID{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:WINDOWSsystem32MacromedFlashFlashUtil32_11_5_502_135_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINEsoftwareClassesCLSID{73C9DFA0-750D-11E1-B0C4-0800200C9A66}Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINEsoftwareClassesCLSID{73C9DFA0-750D-11E1-B0C4-0800200C9A66}LocalServer32]
@="c:WINDOWSsystem32MacromedFlashFlashUtil32_11_5_502_135_ActiveX.exe"
.
[HKEY_LOCAL_MACHINEsoftwareClassesCLSID{73C9DFA0-750D-11E1-B0C4-0800200C9A66}TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINEsoftwareClassesInterface{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINEsoftwareClassesInterface{6AE38AE0-750C-11E1-B0C4-0800200C9A66}ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINEsoftwareClassesInterface{6AE38AE0-750C-11E1-B0C4-0800200C9A66}TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINEsoftwareClassesVideoLAN.VLCPlugin.*1*]
@="?????????????????? v1"
.
[HKEY_LOCAL_MACHINEsoftwareClassesVideoLAN.VLCPlugin.*1*CLSID]
@="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}"
.
[HKEY_LOCAL_MACHINEsoftwareClassesVideoLAN.VLCPlugin.*2*]
@="?????????????????? v2"
.
[HKEY_LOCAL_MACHINEsoftwareClassesVideoLAN.VLCPlugin.*2*CLSID]
@="{9BE31822-FDAD-461B-AD51-BE1D1C159921}"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(804)
c:windowssystem32Ati2evxx.dll
.
Completion time: 2012-12-30 12:05:12
ComboFix-quarantined-files.txt 2012-12-30 10:05
.
Pre-Run: 1 129 885 696 bytes free
Post-Run: 1 101 348 864 bytes free
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot Loader]
Timeout=2
Default=c:$win_nt$.~btBOOTSECT.DAT
[Operating Systems]
c:cmdconsBOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
c:$win_nt$.~btBOOTSECT.DAT="Microsoft Windows XP Professional Setup"
.
- - End Of File - - FD16A23E5DBE0B1BE352EA52D2606BB3

Копирайте текста в карето на Notepad и го запазвате с име CFScript.txt на десктопа си:

KillAll::

 

Driver::

avgrkx86

 

File::

c:windowssystem32driversavgrkx86.sys

 

Folder::

c:program filesCommon FilesAVG Secure Search

c:program filesAVG

 

Registry::

[-HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregAVG_TRAY]

След съхранението преместете CFScript.txt на иконата на ComboFix.exe

Генерирания рапорт копирайте  и го поставете в следващия си коментар!

 

 

След това:

Моля, изтеглете SystemLook и запазете програмата на десктопа.

• Кликнете два пъти върху SystemLook.exe, за да стартирате програмата.
• Копирайте съдържанието на следния код в текстовото поле на програмата

 

:filefind

AVG

avg

Symantec

Norton

:folderfind

AVG

avg

Symantec

Norton

:regfind

AVG

avg

Symantec

Norton

 

• Кликнете на бутона Look, за да започне сканирането.
• Когато сканирането завърши ще Ви се отвори Notepad с резултата от сканирането.
• Моля, публикувайте лог файла в следващия си коментар.