Здравейте!Проблема се появи за пръв път вчера.В какво се изразява-Появява се нещо като "снеговалеж" по екрана (като на телевизор който не може да хване добре ефирен сигнал).Проблема се наблюдава при браузване с Мозила (при забранени добавки на мозилата си работи нормално ) и при пускане на видео плеъра понякога.(Gom)С Интернет Експлорър-а няма проблем май.(отворих само за проба) Имам инсталирана Malwarebytes Anti-Malware с която сканирах,прилагам лога.След mbam изглеждаше,че съм се отървал,но днес пак се появи.

Malwarebytes Anti-Malware 1.70.0.1100www.malwarebytes.orgDatabase version: v2013.02.18.05Windows XP Service Pack 3 x86 NTFSInternet Explorer 8.0.6001.18702Ivan :: 1A [administrator]18.2.2013 г. 12:04:22mbam-log-2013-02-18 (12-04-22).txtScan type: Quick scanScan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUMScan options disabled: P2PObjects scanned: 256565Time elapsed: 2 minute(s), 59 second(s)Memory Processes Detected: 0(No malicious items detected)Memory Modules Detected: 0(No malicious items detected)Registry Keys Detected: 2HKCRCLSID{82184935-B894-4AB2-8590-603BA7D74B71} (Trojan.WebMoner) -> Quarantined and deleted successfully.HKCRbolnatakoja.eProtocol (Trojan.WebMoner) -> Quarantined and deleted successfully.Registry Values Detected: 0(No malicious items detected)Registry Data Items Detected: 0(No malicious items detected)Folders Detected: 0(No malicious items detected)Files Detected: 0(No malicious items detected)(end)

ддс

DDS (Ver_2011-09-30.01) - NTFS_x86 Internet Explorer: 8.0.6001.18702Run by Ivan at 15:54:01 on 2013-02-19Microsoft Windows XP Professional  5.1.2600.3.1251.359.1033.18.2047.1342 [GMT 2:00]..============== Running Processes ================.C:WINDOWSsystem32nvsvc32.exeC:WINDOWSsystem32spoolsv.exeC:Program FilesNVIDIA CorporationNVIDIA Update Coredaemonu.exeC:Documents and SettingsAll UsersApplication DataSkypeToolbarsSkype C2C Servicec2c_service.exeC:Program FilesNVIDIA CorporationNetworkAccessManagerbin32nSvcAppFlt.exeC:Program FilesNVIDIA CorporationNetworkAccessManagerbin32nSvcIp.exeC:WINDOWSSystem32alg.exeC:Program FilesAnalog DevicesCoresmax4pnp.exeC:Program FilesAnalog DevicesSoundMAXSmax4.exeC:Program FilesuTorrentuTorrent.exeC:WINDOWSsystem32taskmgr.exeC:WINDOWSexplorer.exeC:WINDOWSsystem32HPSIsvc.exeC:Program FilesMozilla Firefoxfirefox.exeC:Program FilesMozilla Firefoxplugin-container.exeC:WINDOWSsystem32wbemwmiprvse.exeC:WINDOWSSystem32svchost.exe -k netsvcsC:WINDOWSsystem32svchost.exe -k NetworkServiceC:WINDOWSsystem32svchost.exe -k LocalServiceC:WINDOWSSystem32svchost.exe -k HTTPFilter.============== Pseudo HJT Report ===============.uStart Page = hxxp://www.vesti.bg/BHO: Skype Browser Helper: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - c:program filesskypetoolbarsinternet explorerskypeieplugin.dlluRun: [uTorrent] "c:program filesutorrentuTorrent.exe"mRun: [SoundMAXPnP] c:program filesanalog devicescoresmax4pnp.exemRun: [SoundMAX] "c:program filesanalog devicessoundmaxSmax4.exe" /traymRun: [MSConfig] c:windowspchealthhelpctrbinariesMSConfig.exe /autodRun: [CTFMON.EXE] c:windowssystem32ctfmon.exeStartupFolder: c:docume~1alluse~1startm~1programsstartupmicros~1.lnk - c:program filesmicrosoft officeoffice10OSA.EXEuPolicies-Explorer: NoDriveTypeAutoRun = dword:145mPolicies-Explorer: NoDriveTypeAutoRun = dword:145IE: E&xport to Microsoft Excel - c:progra~1micros~2office10EXCEL.EXE/3000IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:program filesskypetoolbarsinternet explorerskypeieplugin.dllIE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%Network Diagnosticxpnetdiag.exeIE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:program filesmessengermsmsgs.exeDPF: {A996E48C-D3DC-4244-89F7-AFA33EC60679} - hxxps://ebb.ubb.bg/CAPICOM/capicom.cabTCP: NameServer = 192.168.1.1TCP: Interfaces{93BC2C17-BBE4-45DB-94E7-BF51ECCAE95C} : DHCPNameServer = 192.168.1.1Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:program filescommon filesmicrosoft sharedweb foldersPKMCDO.DLLHandler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:program filesskypetoolbarsinternet explorerskypeieplugin.dllHandler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:program filescommon filesskypeSkype4COM.dllSSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:windowssystem32WPDShServiceObj.dll.================= FIREFOX ===================.FF - ProfilePath - c:documents and settingsivanapplication datamozillafirefoxprofilesanuh6g35.defaultFF - plugin: c:program filesmicrosoft silverlight5.1.10411.0npctrlui.dllFF - plugin: c:program filesmozilla firefoxpluginsnpdjvu.dllFF - plugin: c:program filesmozilla firefoxpluginsnpFoxitReaderPlugin.dllFF - plugin: c:windowssystem32macromedflashNPSWF32_11_6_602_168.dll.============= SERVICES / DRIVERS ===============.R2 HPSIService;HP SI Service;c:windowssystem32HPSIsvc.exe [2012-11-12 99896]R2 NPF;NetGroup Packet Filter Driver;c:windowssystem32driversnpf.sys [2009-10-20 50704]R2 nvUpdatusService;NVIDIA Update Service Daemon;c:program filesnvidia corporationnvidia update coredaemonu.exe [2012-9-1 1262400]R2 Skype C2C Service;Skype C2C Service;c:documents and settingsall usersapplication dataskypetoolbarsskype c2c servicec2c_service.exe [2012-11-22 3290304]R3 MBAMProtector;MBAMProtector;c:windowssystem32driversmbam.sys [2012-10-22 21104]S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:windowsmicrosoft.netframeworkv4.0.30319mscorsvw.exe [2010-3-18 130384]S2 MBAMScheduler;MBAMScheduler;c:program filesmalwarebytes' anti-malwarembamscheduler.exe [2012-10-22 398184]S2 MBAMService;MBAMService;c:program filesmalwarebytes' anti-malwarembamservice.exe [2012-10-22 682344]S2 SkypeUpdate;Skype Updater;c:program filesskypeupdaterUpdater.exe [2013-1-8 161536]S3 MozillaMaintenance;Mozilla Maintenance Service;c:program filesmozilla maintenance servicemaintenanceservice.exe [2012-9-9 115608]S3 mvusbews;USB EWS Device;c:windowssystem32driversmvusbews.sys [2012-11-12 17408]S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:windowsmicrosoft.netframeworkv4.0.30319wpfWPFFontCache_v0400.exe [2010-3-18 753504]S3 XilinxFirmwareEmbeddedLpLoader;XilinxFirmwareEmbeddedLpLoader;c:windowssystem32driversxusb_emb.sys [2012-11-14 17408].=============== File Associations ===============.ShellExec: FOXITR~1.EXE: print="c:progra~1foxits~1foxitr~1FOXITR~1.EXE"/p "%1" ShellExec: FOXITR~1.EXE: printto="c:progra~1foxits~1foxitr~1FOXITR~1.EXE"/t "%1" "%2" "%3" "%4" .=============== Created Last 30 ================..==================== Find3M  ====================.2013-02-19 13:35:01	71024	----a-w-	c:windowssystem32FlashPlayerCPLApp.cpl2013-02-19 13:35:01	691568	----a-w-	c:windowssystem32FlashPlayerApp.exe2012-12-14 14:49:28	21104	----a-w-	c:windowssystem32driversmbam.sys.============= FINISH: 15:54:13,71 ===============

атач

.UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.IF REQUESTED, ZIP IT UP & ATTACH IT.DDS (Ver_2011-09-30.01).Microsoft Windows XP ProfessionalBoot Device: DeviceHarddiskVolume1Install Date: 9/1/2012 1:29:25 PMSystem Uptime: 2/19/2013 1:29:12 PM (2 hours ago).Motherboard: ASUSTeK Computer INC. |  | M2NProcessor: AMD Athlon(tm) 64 X2 Dual Core Processor 3600+ | CPU 1 | 1908/200mhz.==== Disk Partitions =========================.C: is FIXED (NTFS) - 156 GiB total, 125.974 GiB free.D: is FIXED (NTFS) - 775 GiB total, 65.318 GiB free.E: is CDROM ().==== Disabled Device Manager Items =============.==== System Restore Points ===================.No restore point in system..==== Installed Programs ======================.µTorrentAdobe Flash Player 11 PluginAIMP3ArcSoft MediaImpression 2AsusUpdateAtmel Software FrameworkAtmel Studio 6.0Atmel USBBoilsoft Video Joiner 6.57Boilsoft Video Splitter 6.34Bulgarian Keyboards XP by G. AtanasovDigilent SoftwareElectronic Parts CatalogueFoxit ReaderGOM PlayerHotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)Hotfix for Windows XP (KB942288-v3)Hotfix for Windows XP (KB954550-v5)HP LaserJet Professional P1100-P1560-P1600 SeriesIAR Embedded Workbench for Atmel AVR 5.50JLink OB CDC Driver PackageLizardtech DjVu ControlMalwarebytes Anti-Malware version 1.70.0.1100Microsoft .NET Framework 2.0 Service Pack 2Microsoft .NET Framework 3.0 Service Pack 2Microsoft .NET Framework 3.5 SP1Microsoft .NET Framework 4 Client ProfileMicrosoft .NET Framework 4 ExtendedMicrosoft .NET Framework 4 Multi-Targeting PackMicrosoft Application Error ReportingMicrosoft Help Viewer 1.0Microsoft Kernel-Mode Driver Framework Feature Pack 1.7Microsoft Office XP Professional with FrontPageMicrosoft SilverlightMicrosoft SQL Server 2008 R2 Management ObjectsMicrosoft SQL Server System CLR TypesMicrosoft User-Mode Driver Framework Feature Pack 1.0Microsoft Visual C++ 2005 RedistributableMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.4974Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161Microsoft Visual C++ 2010  x86 Runtime - 10.0.30319Microsoft Visual Studio 2010 Shell (Isolated) - ENUMozilla Firefox 18.0.2 (x86 en-US)Mozilla Maintenance ServiceMSVCRT RedistsNero 6 Ultra EditionNVIDIA Control Panel 301.42NVIDIA Display Control PanelNVIDIA DriversNVIDIA ForceWare Network Access ManagerNVIDIA Graphics Driver 301.42NVIDIA Install ApplicationNVIDIA nView 136.27NVIDIA nView Desktop ManagerNVIDIA PhysXNVIDIA PhysX System Software 9.12.0213nVidia Refresh Rate Fix MKII v2.21f ENVIDIA Update 1.8.15NVIDIA Update ComponentsPicture Package Music TransferPowerISOSkype Click to CallSkype™ 6.1Sony Picture UtilitySopCast 3.5.0SoundMAXUnit Conversion Tool 5.1Update for Microsoft Windows (KB971513)Vegas Movie Studio HD Platinum 11.0Vegas Pro 10.0Warcraft III: All ProductsWebFldrs XPWindows Driver Package - Advanced Micro Devices (AmdK8) Processor  (05/27/2006 1.3.2.0)Windows Driver Package - Segger (jlink) USB  (01/09/2007 2.6.5.0)Windows Driver Package - Segger (jlink) USB  (04/11/2012 2.6.8.2)Windows Driver Package - SEGGER (usbser) Ports  (01/25/2012 6.0.2600.4)Windows Feature Pack for Storage (32-bit) - IMAPI update for Blu-RayWindows Internet Explorer 8Windows Media Format 11 runtimeWinPcap 4.1.1WinRAR archiverXilinx Design Tools 14  ISE WebPACK + Vivado WebPACK 14.4 (C:XilinxISE1414.4ISE_DS)Xilinx Design Tools 14 Xilinx Documentation Navigator - Standalone Installation 14.4  (C:XilinxISE14DocNav)Xilinx Embedded Development Kit 7.1iXilinx ISE 7.1i.==== Event Viewer Messages From Past Week ========.2/19/2013 3:07:53 PM, error: Service Control Manager [7034]  - The MBAMScheduler service terminated unexpectedly.  It has done this 1 time(s).2/19/2013 3:07:47 PM, error: Service Control Manager [7034]  - The ArcSoft Connect Daemon service terminated unexpectedly.  It has done this 1 time(s).2/19/2013 3:07:43 PM, error: Service Control Manager [7031]  - The HP SI Service service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 1000 milliseconds: Restart the service.2/18/2013 12:32:01 PM, error: Service Control Manager [7026]  - The following boot-start or system-start driver(s) failed to load:  AFD AmdK8 Fips IPSec MRxSmb NetBIOS NetBT RasAcd Rdbss SCDEmu Tcpip2/18/2013 12:32:01 PM, error: Service Control Manager [7001]  - The TCP/IP NetBIOS Helper service depends on the AFD service which failed to start because of the following error:  A device attached to the system is not functioning.2/18/2013 12:32:01 PM, error: Service Control Manager [7001]  - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error:  A device attached to the system is not functioning.2/18/2013 12:32:01 PM, error: Service Control Manager [7001]  - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error:  A device attached to the system is not functioning.2/18/2013 12:32:01 PM, error: Service Control Manager [7001]  - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error:  A device attached to the system is not functioning.2/18/2013 12:30:36 PM, error: DCOM [10005]  - DCOM got error "84" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}2/18/2013 11:56:28 AM, error: Service Control Manager [7034]  - The NVIDIA Update Service Daemon service terminated unexpectedly.  It has done this 1 time(s).2/16/2013 9:04:42 AM, error: Service Control Manager [7024]  - The Background Intelligent Transfer Service service terminated with service-specific error 2147500037 (0x80004005).2/16/2013 10:10:30 AM, error: nvgts [9]  - The device, DeviceScsinvgts2, did not respond within the timeout period.2/16/2013 10:10:30 AM, error: nvgts [5]  - A parity error was detected on DeviceScsinvgts2..==== End Of File ===========================

Здравейте..!

 

Изтеглете ComboFix от тук и го запазете на десктопа си
Изключете вашата антивирусна и антишпионска програма, обикновено това става чрез натискане на десния бутон на мишката върху иконата на програма в системния трей.
Бележка: Ако не можете я спрете или не сте сигурни коя програма да изключите, моля прегледайте информацията от този линк: How to Disable your Security Programs

Стартирайте Combo-Fix.com и следвайте инструкциите.
Бележка: ComboFix ще се стартира без инсталирана Recovery Console.

Като част от неговата работа, ComboFix ще провери дали Microsoft Windows Recovery Console е инсталирана. Предвид бързо развиващия се зловреден софтуер е силно препоръчително да бъде инсталирана преди премахването на зловредния софтуер. Това ще Ви позволи да влезете в специален recovery/repai режим, който ще ни позволи по-лесно да решите проблем, който би могъл да възникне при премахване на зловредния софтуер.

• Следвайте инструкциите, за да позволите на ComboFix да изтегли и инсталира Microsoft Windows Recovery Console.В един момент ще бъдете попитани дали сте съгласни с лицензното споразумение. Необходимо е да потвърдите, че сте съгласни, за да инсталирате Microsoft Windows Recovery Console.

** Забележете: Ако Microsoft Windows Recovery Console е вече инсталирана, ComboFix ще продължи към процеса по премахване на зловредния софтуер.

След като Microsoft Windows Recovery Console е инсталирана, използвайки ComboFix, Вие ще видите следното съобщение:

Изберете Yes, за да продължи сканирането за зловреден софтуер.
Когато процесът приключи успешно, инструментът ще създаде лог файл. Моля, включете съдържанието на C:ComboFix.txt в следващия Ви коментар в тази тема.
Бележка:

• Моля, не движете мишката, докато ComboFix работи. Това може да наруши процеса на работа.
• ComboFix ще нулира всички настройки на Microsoft Internet Explorer, включително да направи IE браузър по подразбиране.
• ComboFix ще изключи autorun функцията на ВСИЧКИ CD, Floppy и USB устройства, за да помогне при премахването на зловредния софтуер и Ви защити от бъдещи вируси/заплахи, които поразява чрез autorun. Ако това е проблем за вас - моля, уведомете ме.
• ComboFix ще изключи вашата интернет връзка. Интернет връзката ще се възстанови автоматично, преди ComboFix да завърши процеса на работа. При проблем, той ще прекрати интернет връзката. За да възстановите интернет връзката си, рестартирайте компютъра си.
• В случай на проблем с ComboFix, той може да създаде лог файл. Моля, включете съдържанието на C:BUG.txt в следващия Ви коментар в тази тема.

Моля, не прикачвайте лог файла/овете от програмата, а го/ги копирайте и поставете в следващия Ви коментар в тази тема.

Благодаря Ви за отделеното внимание!

ComboFix 13-02-18.02 - Ivan 02.2013 г.  23:58:38.1.2 - x86Microsoft Windows XP Professional  5.1.2600.3.1251.359.1033.18.2047.1296 [GMT 2:00]Running from: c:documents and settingsIvanDesktopComboFix.exe..(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))..c:documents and settingsIvanWINDOWSc:windowssystem32NEW2D.tmpc:windowssystem32NEW39.tmp..(((((((((((((((((((((((((   Files Created from 2013-01-19 to 2013-02-19  )))))))))))))))))))))))))))))))..2013-02-18 10:30 . 2013-02-18 10:30	--------	d-----w-	c:documents and settingsAdministratorApplication DataMalwarebytes2013-02-18 10:30 . 2013-02-18 10:30	--------	d-sh--w-	c:documents and settingsAdministratorIETldCache2013-02-06 15:54 . 2013-02-19 18:01	--------	d-----w-	c:program filesMicrosoft Silverlight2013-01-22 17:42 . 2013-01-22 17:42	--------	d-----w-	c:program filesCommon FilesSkype...((((((((((((((((((((((((((((((((((((((((   Find3M Report   )))))))))))))))))))))))))))))))))))))))))))))))))))).2013-02-19 13:35 . 2012-09-01 13:43	71024	----a-w-	c:windowssystem32FlashPlayerCPLApp.cpl2013-02-19 13:35 . 2012-09-01 13:43	691568	----a-w-	c:windowssystem32FlashPlayerApp.exe2012-12-14 14:49 . 2012-10-22 14:46	21104	----a-w-	c:windowssystem32driversmbam.sys2013-02-07 11:22 . 2013-02-07 11:22	262552	----a-w-	c:program filesmozilla firefoxcomponentsbrowsercomps.dll..(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shown REGEDIT4.[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]"uTorrent"="c:program filesuTorrentuTorrent.exe" [2012-09-01 289584].[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]"SoundMAXPnP"="c:program filesAnalog DevicesCoresmax4pnp.exe" [2006-12-18 868352]"NvCplDaemon"="c:windowssystem32NvCpl.dll" [2010-03-16 13670504].[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]"CTFMON.EXE"="c:windowssystem32ctfmon.exe" [2008-04-14 15360].c:documents and settingsJivkoStart MenuProgramsStartupPicture Motion Browser Media Check Tool.lnk - c:program filesSonySony Picture UtilityVolumeWatcherSPUVolumeWatcher.exe [2012-9-16 368640].c:documents and settingsAll UsersStart MenuProgramsStartupMicrosoft Office.lnk - c:program filesMicrosoft OfficeOffice10OSA.EXE [2001-2-13 83360].[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootMinimalWdf01000.sys]@="Driver".[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregKernelFaultCheck]c:windowssystem32dumprep 0 -k [X].[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregArcSoft Connection Service]2010-10-27 16:17	207424	----a-w-	c:program filesCommon FilesArcSoftConnection ServiceBinACDaemon.exe.[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregNeroFilterCheck]2001-07-09 09:50	155648	----a-w-	c:windowssystem32NeroCheck.exe.[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregNvCplDaemon]2010-03-16 01:37	13670504	----a-w-	c:windowssystem32nvcpl.dll.[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregNvMediaCenter]2010-03-16 01:37	110696	----a-w-	c:windowssystem32nvmctray.dll.[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregSkype]2013-01-08 10:59	18705664	----a-r-	c:program filesSkypePhoneSkype.exe.[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]"c:Program FilesuTorrentuTorrent.exe"="c:WINDOWSsystem32dpvsetup.exe"="c:Program FilesAtmelAtmel Studio 6.0atmelstudio.exe"="c:Program FilesNVIDIA CorporationNVIDIA Update Coredaemonu.exe"="c:WINDOWSNetwork Diagnosticxpnetdiag.exe"="c:WINDOWSsystem32sessmgr.exe"="c:Program FilesSopCastSopCast.exe"="c:XilinxISE1414.4ISE_DSISEbinntunwrappedisimgui.exe"="c:XilinxISE1414.4ISE_DSISEbinnt_fpga_editor.exe"="c:Program FilesSkypePhoneSkype.exe"=.R2 HPSIService;HP SI Service;c:windowssystem32HPSIsvc.exe [11/12/2012 2:11 PM 99896]R2 NPF;NetGroup Packet Filter Driver;c:windowssystem32driversnpf.sys [10/20/2009 8:19 PM 50704]R3 MBAMProtector;MBAMProtector;c:windowssystem32driversmbam.sys [10/22/2012 4:46 PM 21104]S2 MBAMScheduler;MBAMScheduler;c:program filesMalwarebytes' Anti-Malwarembamscheduler.exe [10/22/2012 4:46 PM 398184]S2 MBAMService;MBAMService;c:program filesMalwarebytes' Anti-Malwarembamservice.exe [10/22/2012 4:46 PM 682344]S2 Skype C2C Service;Skype C2C Service;c:documents and settingsAll UsersApplication DataSkypeToolbarsSkype C2C Servicec2c_service.exe [11/22/2012 10:29 AM 3290304]S2 SkypeUpdate;Skype Updater;c:program filesSkypeUpdaterUpdater.exe [1/8/2013 12:55 PM 161536]S3 mvusbews;USB EWS Device;c:windowssystem32driversmvusbews.sys [11/12/2012 2:10 PM 17408]S3 XilinxFirmwareEmbeddedLpLoader;XilinxFirmwareEmbeddedLpLoader;c:windowssystem32driversxusb_emb.sys [11/14/2012 3:13 PM 17408]..------- Supplementary Scan -------.uStart Page = hxxp://www.vesti.bg/IE: E&xport to Microsoft Excel - c:progra~1MICROS~2Office10EXCEL.EXE/3000TCP: DhcpNameServer = 192.168.1.1FF - ProfilePath - c:documents and settingsIvanApplication DataMozillaFirefoxProfilesanuh6g35.defaultFF - ExtSQL: 2013-01-08 11:42; {73a6fe31-595d-460b-a920-fcc0f8843232}; c:documents and settingsIvanApplication DataMozillaFirefoxProfilesanuh6g35.defaultextensions{73a6fe31-595d-460b-a920-fcc0f8843232}.xpiFF - ExtSQL: 2013-01-08 12:03; [email protected]; c:documents and settingsIvanApplication DataMozillaFirefoxProfilesanuh6g35.defaultextensionsfiregestures@xuldev.org.xpiFF - ExtSQL: 2013-01-08 12:03; [email protected]; c:documents and settingsIvanApplication DataMozillaFirefoxProfilesanuh6g35.defaultextensionsadblockpopups@jessehakanen.net.xpiFF - ExtSQL: 2013-01-17 11:47; jid1-F9UJ2thwoAm5gQ@jetpack; c:documents and settingsIvanApplication DataMozillaFirefoxProfilesanuh6g35.defaultextensionsjid1-F9UJ2thwoAm5gQ@jetpack.xpi.- - - - ORPHANS REMOVED - - - -.MSConfigStartUp-nwiz - nwiz.exe...**************************************************************************.catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.netRootkit scan 2013-02-20 00:02Windows 5.1.2600 Service Pack 3 NTFS.scanning hidden processes ...  .scanning hidden autostart entries ... .scanning hidden files ...  .scan completed successfullyhidden files: 0.**************************************************************************.Completion time: 2013-02-20  00:03:49ComboFix-quarantined-files.txt  2013-02-19 22:03.Pre-Run: 135 165 423 616 bytes freePost-Run: 135 699 963 904 bytes free.WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe[boot loader]timeout=2default=multi(0)disk(0)rdisk(0)partition(1)WINDOWS[operating systems]c:cmdconsBOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdconsUnsupportedDebug="do not select this" /debugmulti(0)disk(0)rdisk(0)partition(1)WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect /usepmtimer.- - End Of File - - 572B63599332FF0FD8052FA746BC2CAD

Следвайте следната инструкция за проверка с GooredFix:

• Изтеглете GooredFix, миръри: тук и тук.
• Запазете го на десктопа.
• Затворете всички браузъри и стартирайте GooredFix.exe.
• Потвърдете с Yes, за да започне сканирането.
• GooredFix ще провери за инфекции и след това ще се появи лог (GooredFix.txt). Копирайте (Copy) и поставете (Paste) резултатите от сканирането в следващия си коментар.

При зареждане на ОС ми излезе това съобщение.Още не бях пуснал GooredFix .

The system has recovered from a serious error.error signature BCCode : 1000000a     BCP1 : 9CE00194     BCP2 : 00000002     BCP3 : 00000000BCP4 : 8050EF0C     OSVer : 5_1_2600     SP : 3_0     Product : 256_1     Error Report ContentsC:DOCUME~1IvanLOCALS~1TempWERf00f.dir00Mini090512-01.dmpC:DOCUME~1IvanLOCALS~1TempWERf00f.dir00sysdata.xml

GooredFix by jpshortstuff (03.07.10.1)Log created at 20:21 on 20/02/2013 (Ivan)Firefox version 18.0.2 (en-US)========== GooredScan ==================== GooredLog ==========C:Program FilesMozilla Firefoxextensions{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [11:22 07/02/2013]{972ce4c6-7e08-4474-a285-3208198ce6fd} [11:22 07/02/2013]C:Documents and SettingsIvanApplication DataMozillaFirefoxProfilesanuh6g35.defaultextensionsbg-BG@dictionaries.addons.mozilla.org [14:06 01/09/2012][email protected] [14:06 01/09/2012][email protected] [15:25 18/09/2012]{0538E3E3-7E9B-4d49-8831-A227C80A7AD3} [19:20 08/10/2012]{1018e4d6-728f-4b20-ad56-37578a4de76b} [09:42 08/01/2013][HKEY_LOCAL_MACHINESoftwareMozillaFirefoxExtensions]"{20a82645-c095-46ed-80e3-08825760534b}"="C:WINDOWSMicrosoft.NETFrameworkv3.5Windows Presentation FoundationDotNetAssistantExtension" [10:51 01/09/2012]-=E.O.F=-

Изтеглете Malwarebytes' Anti-Malware или от тук (не забравяйте да обновите програмата с нови дефиниции)

* Кликнете два пъти върху mbam-setup.exe, за да инсталирате програмата.

* Уверете се, че са поставени отметки на Update Malwarebytes' Anti-Malware и Launch Malwarebytes' Anti-Malware. След това кликнете на Finish.

* Ако има намерени обновявания, тя ще ги изтегли и инсталира.

* Стартирайте програмата и изберете "Perform Full Scan", след това кликнете на Scan.

* Сканирането ще отнеме малко време, затова моля да бъдете търпеливи.

* Когато сканирането завърши, кликнете на OK, след това Show Results, за да видите резултата

* Уверете се, че на всички редове има отметки, и кликнете на Remove Selected.

* Когато всичко бъде премахнато, в Notepad ще бъде отворен лог.

Копирайте този лог и го публикувайте в следващия си коментар по темата.

Забележка: Ако MalwareBytes' Anti-Malware се затрудни в премахването на откритите вируси/заплахи, той ще поиска да рестартира компютъра Ви и по време на рестартирането да премахне проблемните вируси/заплахи. Ако бъдете попитани, потвърдете че желаете вашия компютър да бъде рестартиран.

Изтеглете програмата: ESET Online Scanner

[*]Стартирайте esetsmartinstaller_enu.exe

[*]Сложете отметка на YES, I accept the Terms of Use и изберете Start:

[*]Скенерът ще започне да изтегля компонентите, които са му необходими:

Уверете се, че е премахната отметката от:

[*]Remove found threats

Уверете се че са маркирани следните позиции:

[*]Scan Archives

Кликнете върху Advanced Settings и маркирайте следните опции:

[*]Scan for potentially unwanted applications

[*]Scan for potentially unsafe applications

[*]Enable Anti-Stealth Technology

Накрая изберете Start

Скенерът ще започне да изтегля последните дефиниции.

[*]След, като сканирането завърши изберете Finish.

[*]Отидете в: C:Program FilesESETESET Online Scanner

[*]Отворете файла log.txt , копирайте съдържанието му и го поставете в следващия си коментар.

Malwarebytes Anti-Malware 1.70.0.1100www.malwarebytes.orgDatabase version: v2013.02.18.05Windows XP Service Pack 3 x86 NTFSInternet Explorer 8.0.6001.18702Ivan :: 1A [administrator]21.2.2013 г. 17:51:21mbam-log-2013-02-21 (17-51-21).txtScan type: Full scan (C:|D:|)Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUMScan options disabled: P2PObjects scanned: 652101Time elapsed: 2 hour(s), 24 minute(s), 12 second(s)Memory Processes Detected: 0(No malicious items detected)Memory Modules Detected: 0(No malicious items detected)Registry Keys Detected: 0(No malicious items detected)Registry Values Detected: 0(No malicious items detected)Registry Data Items Detected: 0(No malicious items detected)Folders Detected: 0(No malicious items detected)Files Detected: 2D:My DocumentsdocumentsprogramsGPSGarmin Mapsource City Navigator Europe NT 2009Garmin Mapsource City Navigator Europe NT 2009KeyGen v1.5garmin_keygen_v1.5.exe (RiskWare.Tool.CK) -> Quarantined and deleted successfully.D:My DocumentsdocumentsprogramsGPSGarmin Mobile XT v5.00.60Garmin Tools and KeygensGarmin Keygen 1.5.exe (RiskWare.Tool.CK) -> Quarantined and deleted successfully.(end)

ESETSmartInstaller@High as downloader log:all okESETSmartInstaller@High as downloader log:all ok# version=8# OnlineScannerApp.exe=1.0.0.1# OnlineScanner.ocx=1.0.0.6920# api_version=3.0.2# EOSSerial=5d44fe6623b7f24cadb20f52305399ab# engine=13211# end=finished# remove_checked=false# archives_checked=true# unwanted_checked=true# unsafe_checked=true# antistealth_checked=true# utc_time=2013-02-22 02:30:11# local_time=2013-02-22 04:30:11 (+0200, E. Europe Standard Time)# country="Bulgaria"# lang=1033# osver=5.1.2600 NT Service Pack 3# scanned=406908# found=14# cleaned=0# scan_time=26839sh=E1AB1B7DCF6C1F29AC4B8F2D4A89005BF8C6054C ft=0 fh=0000000000000000 vn="a variant of Win32/Multibar.AA application" ac=I fn="D:My Documentsdocumentsobshta deskWinToFlash 0.7.0037 beta.zip"sh=FE9B5CBF1FC3DC6C7CA951EED0137BC602DCEFD6 ft=0 fh=0000000000000000 vn="probably a variant of Win32/Keygen.BJ application" ac=I fn="D:My DocumentsdocumentsprogramsCamtasia Studio 6.0.0 Build 689 [ iron Doom ].rar"sh=8604905F5844817AD4B80AFC146A12A9526D0615 ft=1 fh=e07885c97cc84a65 vn="Win32/OpenCandy application" ac=I fn="D:My DocumentsdocumentsprogramsExtractNow.exe"sh=719385F644291B5E6413D267EF38D6B37F2FEFF2 ft=0 fh=0000000000000000 vn="Win32/OpenCandy application" ac=I fn="D:My Documentsdocumentsprogramsfls9.rar"sh=E85AD1D31F549F785895B2B5A1A5FF0C2F2B8E2A ft=0 fh=0000000000000000 vn="Win32/Tool.EvID4226 application" ac=I fn="D:My Documentsdocumentsprogramstcp limit EvID4226Patch223d-en.zip"sh=9DEF9E2A2B1C74C704A82B5413D7CEA69C57EF4F ft=0 fh=0000000000000000 vn="BAT/HostsChanger.A application" ac=I fn="D:My DocumentsdocumentsprogramsAdobe Illustrator CS4Keydisable_activation.cmd"sh=0000000000000000000000000000000000000000 ft=- fh=0000000000000000 vn="a variant of Win32/Packed.VMProtect.AAA trojan" ac=I fn="D:My DocumentsdocumentsprogramsGAMESStarcraft_II_Wings_Of_Liberty_Proper-Razor1911rzr-scii.iso"sh=AC22A18BABE139640CB02AED8BD44DB88DBC6B52 ft=1 fh=6af38116c7e9b888 vn="a variant of Win32/Packed.VMProtect.AAA trojan" ac=I fn="D:My DocumentsdocumentsprogramsGAMESStarcraft_II_Wings_Of_Liberty_Proper-Razor1911rzr-sciiRazor1911Keytro.exe"sh=D41FC034677F0E4B1190454A1E6ED006BD799745 ft=0 fh=0000000000000000 vn="probably a variant of Win32/Agent.KHSZKCD trojan" ac=I fn="D:My DocumentsdocumentsprogramsMy programsBorland 6.zip"sh=F8A733DE31D816E8C6D9F5F7E666A99DAB50600F ft=1 fh=68d34f8e2da3fc6c vn="a variant of Win32/Bundled.Toolbar.Ask application" ac=I fn="D:My DocumentsdocumentsprogramsPreinstall programsGOMGOMPLAYER.EXE"sh=DF292AAA8CD929B293F6943CE0DCC09666471B6D ft=1 fh=b85accf146c4baae vn="a variant of Win32/HackTool.Patcher.T application" ac=I fn="D:My DocumentsdocumentsprogramsSony Vegas Movie Studio HD Platinum 10.0 Build 179Crackvegas.movie.studio.hd.platinum.10.0-mpt.exe"sh=5A87843CD9F2C4BEC0498C3FFDF1948070382FC3 ft=1 fh=b85accf18528d101 vn="a variant of Win32/HackTool.Patcher.T application" ac=I fn="D:My DocumentsdocumentsprogramsUltimate defrag v3.0.100.19 + PortableUltimate defrag v3.0.100.19Patchultimate.defrag.3.0.100.10-MPT.exe"sh=B68400E00BFA981C7F822FFE859D0BF08FCF5C1F ft=0 fh=0000000000000000 vn="a variant of Win32/Packed.VMProtect.AAD trojan" ac=I fn="D:My DocumentsdocumentsprogramsVegas.Pro.10.0e.build.737-738 (x32-x64) v2 okKeygen.rar"sh=0A44DA206FCBCEB3B047D6D0F21DC7B18FB276EB ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="D:My DocumentsdocumentsprogramsWindows.LiveCD.6.2.FullISO.ISO"

 

Здравейте.!Какво е моментното състояние на компютъра ви..? Наблюдавате ли първоначалните проблеми..?

Всичко е нормално,проблемът не се е появявал!Да смятам ли,че съм излекуван?

Да..не виждам притеснителни неща от зловреден характер...За финал:

 

Деинсталирайте ComboFix така:

[*]Натиснете Start ==> Run ==> въведете командата Combofix /Uninstall ==> OK

[*]

[*]Моля, следвайте инструкциите, за да деинсталирате ComboFix. Ще получите съобщение, в което се казва ComboFix е деинсталиран успешно.

 

[*]Деинсталирайте ESET Online Scaner.

[*]Start => Run, въведете control appwiz.cpl в полето.След това натиснете ENTER.

[*]Изберете ESET Online Scanner от списъка с приложения, а след това маркирайте Remove. Aко бъдете подканени рестартирайте компютъра си.

[*]

 

Изтеглете OTCleanIt или от тук,стартирайте и натиснете

 

 

Изтеглете Delfix.exe и го стартирайте. Сложете отметка пред Remove disinfection tools => натиснете бутона Run Инструмента ще се самоизтрие след като приключи своята задача!

Изтрийте всичко друго което е останало след процедурите (използвано в лечението).Препоръчвам програмата Malwarebytes' Anti-Malware да остане на вашия компютър и периодично да сканирате системата си с нея (поне един -два пъти в седмицата),като не забравяйте да обновите дефинициите и преди всяко сканиране..!

Това е от мен...Пожелавам ви лек ден и безопасен интернет..!