Здравейте в компютъра на чичо има някакъв вирус в svchost.exe - червей ( поне така казва ESET ) по-долу са логовете от DDS и Attach . Благодаря предварително за помощта

DDS : DDS (Ver_2011-09-30.01) - NTFS_x86 Internet Explorer: 8.0.7601.17514  BrowserJavaVersion: 1.6.0_26 Run by румпи at 15:56:34 on 2013-04-15 Microsoft Windows 7 Ultimate 6.1.7601.1.1251.359.1026.18.1919.907 [GMT 3:00] . AV: ESET Smart Security 5.0 *Disabled/Outdated* {77DEAFED-8149-104B-25A1-21771CA47CD1} SP: ESET Smart Security 5.0 *Disabled/Outdated* {CCBF4E09-A773-1FC5-1F11-1A056723366C} SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} FW: Лична защитна стена на ESET *Disabled* {4FE52EC8-CB26-1113-0EFE-8842E2773BAA} . ============== Running Processes ================ . C:Windowssystem32wininit.exe C:Windowssystem32lsm.exe C:Windowssystem32Ati2evxx.exe C:Windowssystem32Ati2evxx.exe C:WindowsSystem32spoolsv.exe C:Windowssystem32taskhost.exe C:Program FilesESETESET Smart Securityekrn.exe C:Windowssystem32Dwm.exe C:Windowssystem32taskeng.exe C:Program FilesCommon FilesLightScribeLSSrvc.exe C:WindowsExplorer.EXE C:Program FilesCommon FilesMicrosoft SharedVS7DEBUGMDM.EXE C:Program FilesGoogleUpdateGoogleUpdate.exe C:Windowssystem32PnkBstrA.exe C:Program FilesRealNetworksRealDownloaderrndlresolversvc.exe C:Program FilesCyberLinkShared FilesRichVideo.exe C:WindowsSOUNDMAN.EXE C:Program FilesATI TechnologiesATI.ACECore-StaticMOM.EXE C:Program FilesCommon FilesJavaJava Updatejusched.exe C:Program FilesHPHP Software UpdatehpwuSchd2.exe C:Program FilesCyberLinkPowerDVDPDVDServ.exe C:Program FilesESETESET Smart Securityegui.exe C:Program FilesAsk.comUpdaterUpdater.exe C:Program FilesCommon FilesAdobeARM1.0AdobeARM.exe C:Program FilesUnlockerUnlockerAssistant.exe C:Program FilesuTorrentuTorrent.exe C:Program FilesWindows Sidebarsidebar.exe C:Windowssystem32wbemwmiprvse.exe C:Program FilesCyberLinkPower2GoPower2GoExpress.exe C:Program FilesCommon FilesLightScribeLightScribeControlPanel.exe C:UsersрумпиAppDataLocalGoogleUpdateGoogleUpdate.exe C:Program FilesHPDigital Imagingbinhpqtra08.exe C:Windowssystem32SearchIndexer.exe C:Program FilesMcAfee Security Scan3.0.207SSScheduler.exe C:Windowssystem32WUDFHost.exe C:Windowssystem32mspaint.exe C:Program FilesHPDigital ImagingbinhpqSTE08.exe C:Program FilesHPDigital Imagingbinhpqbam08.exe C:Program FilesHPDigital Imagingbinhpqgpc01.exe C:Program FilesRealNetworksRealDownloaderrecordingmanager.exe C:Program FilesATI TechnologiesATI.ACECore-StaticCCC.exe C:Program FilesMozilla Firefoxfirefox.exe C:WindowsservicingTrustedInstaller.exe C:Program FilesMozilla Firefoxplugin-container.exe C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_3_300_270.exe C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_3_300_270.exe C:Program FilesRealRealPlayerupdaterealsched.exe C:Windowssystem32conhost.exe C:Windowssystem32SearchProtocolHost.exe C:Windowssystem32SearchFilterHost.exe C:Windowssystem32svchost.exe -k DcomLaunch C:Windowssystem32svchost.exe -k RPCSS C:WindowsSystem32svchost.exe -k LocalServiceNetworkRestricted C:WindowsSystem32svchost.exe -k LocalSystemNetworkRestricted C:Windowssystem32svchost.exe -k netsvcs C:Windowssystem32svchost.exe -k LocalService C:Windowssystem32svchost.exe -k NetworkService C:Windowssystem32svchost.exe -k LocalServiceAndNoImpersonation C:Windowssystem32svchost.exe -k LocalServiceNoNetwork C:Windowssystem32svchost.exe -k hpdevmgmt C:WindowsSystem32svchost.exe -k HPZ12 C:WindowsSystem32svchost.exe -k HPZ12 C:Windowssystem32svchost.exe -k imgsvc C:Windowssystem32svchost.exe -k HPService C:Windowssystem32svchost.exe -k NetworkServiceNetworkRestricted C:WindowsSystem32svchost.exe -k secsvcs . ============== Pseudo HJT Report =============== . uStart Page = hxxp://search.chatzum.com/ mStart Page = hxxp://search.chatzum.com/ uURLSearchHooks: UrlSearchHook Class: {00000000-6E41-4FD3-8538-502F5495E5FC} - c:program filesask.comGenericAskToolbar.dll uURLSearchHooks: ToolbarURLSearchHook Class: {CA3EB689-8F09-4026-AA10-B9534C691CE0} - c:program fileschatzum toolbartbunsvf96d.tmptbhelper.dll BHO: HP Print Enhancer: {0347C33E-8762-4905-BF09-768834316C61} - c:program fileshpdigital imagingsmart web printinghpswp_printenhancer.dll BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:program filescommon filesadobeacrobatactivexAcroIEHelperShim.dll BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049C3E9-B461-4BC5-8870-4C09146192CA} - c:program filesrealnetworksrealdownloaderbrowserpluginsierndlbrowserrecordplugin.dll BHO: Ask Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - c:program filesask.comGenericAskToolbar.dll BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:program filesjavajre6binjp2ssv.dll BHO: TBSB09850 Class: {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - c:program fileschatzum toolbartbunsvf96d.tmptbcore3.dll BHO: HP Smart BHO Class: {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - c:program fileshpdigital imagingsmart web printinghpswp_BHO.dll TB: Ask Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - c:program filesask.comGenericAskToolbar.dll TB: ChatZum Toolbar: {37D48D9C-3F7E-412F-B5BF-611BE7CCFCA1} - c:program fileschatzum toolbartbunsvf96d.tmptbcore3.dll TB: Ask Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - c:program filesask.comGenericAskToolbar.dll TB: ChatZum Toolbar: {37D48D9C-3F7E-412F-B5BF-611BE7CCFCA1} - c:program fileschatzum toolbartbunsvf96d.tmptbcore3.dll EB: HP Smart Web Printing: {555D4D79-4BD2-4094-A395-CFC534424A05} - c:program fileshpdigital imagingsmart web printinghpswp_bho.dll EB: HP Smart Web Printing: {555D4D79-4BD2-4094-A395-CFC534424A05} - c:program fileshpdigital imagingsmart web printinghpswp_bho.dll uRun: [uTorrent] "c:program filesutorrentuTorrent.exe"  /MINIMIZED uRun: [DAEMON Tools Lite] "c:program filesdaemon tools litedaemon.exe" -autorun uRun: [sidebar] c:program fileswindows sidebarsidebar.exe /autoRun uRun: [Power2GoExpress] "c:program filescyberlinkpower2goPower2GoExpress.exe" /Startup uRun: [LightScribe Control Panel] c:program filescommon fileslightscribeLightScribeControlPanel.exe -hidden uRun: [Google Update] "c:usersрумпиappdatalocalgoogleupdateGoogleUpdate.exe" /c uRun: [Kpwswc] c:usersрумпиappdataroamingmicrosoftKpwswc.exe mRun: [startCCC] c:program filesati technologiesati.acecore-staticCLIStart.exe mRun: [soundMan] SOUNDMAN.EXE mRun: [sunJavaUpdateSched] "c:program filescommon filesjavajava updatejusched.exe" mRun: [HP Software Update] c:program fileshphp software updateHPWuSchd2.exe mRun: [hpqSRMon] c:program fileshpdigital imagingbinhpqSRMon.exe mRun: [RemoteControl] "c:program filescyberlinkpowerdvdPDVDServ.exe" mRun: [LanguageShortcut] "c:program filescyberlinkpowerdvdlanguageLanguage.exe" mRun: [updatePPShortCut] "c:program filescyberlinkpowerproducermuitransfermuistartmenu.exe" "c:program filescyberlinkpowerproducer" update "softwarecyberlinkpowerproducer4.0" mRun: [TkBellExe] "c:program filesrealrealplayerupdaterealsched.exe" -osboot mRun: [egui] "c:program fileseseteset smart securityegui.exe" /hide /waitservice mRun: [ApnUpdater] "c:program filesask.comupdaterUpdater.exe" mRun: [Adobe Reader Speed Launcher] "c:program filesadobereader 9.0readerReader_sl.exe" mRun: [Adobe ARM] "c:program filescommon filesadobearm1.0AdobeARM.exe" mRun: [unlockerAssistant] "c:program filesunlockerUnlockerAssistant.exe" dRun: [20090604] e:regappencore_reg.exe /r "e:regappencore_reg.rpd" StartupFolder: c:progra~2micros~1windowsstartm~1programsstartuphpdigi~1.lnk - c:program fileshpdigital imagingbinhpqtra08.exe StartupFolder: c:progra~2micros~1windowsstartm~1programsstartupmcafee~1.lnk - c:program filesmcafee security scan3.0.207SSScheduler.exe mPolicies-System: ConsentPromptBehaviorAdmin = dword:5 mPolicies-System: ConsentPromptBehaviorUser = dword:3 mPolicies-System: EnableUIADesktopToggle = dword:0 IE: E&xport to Microsoft Excel - c:progra~1micros~3office11EXCEL.EXE/3000 IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:program fileshpdigital imagingsmart web printinghpswp_BHO.dll DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab TCP: NameServer = 212.233.128.2 212.233.128.1 TCP: Interfaces{2CB7050D-EE12-407D-AAD8-0977A5E45738} : DHCPNameServer = 212.233.128.2 212.233.128.1 TCP: Interfaces{A61E5AC1-497A-4698-8939-C99E6514268C} : DHCPNameServer = 192.168.1.1 SSODL: WebCheck - <orphaned> mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "c:program filescommon fileslightscribeLSRunOnce.exe" . ================= FIREFOX =================== . FF - ProfilePath - c:usersрумпиappdataroamingmozillafirefoxprofilesv71qqp7o.default . ============= SERVICES / DRIVERS =============== . R0 epfwwfp;epfwwfp;c:windowssystem32driversepfwwfp.sys [2011-8-4 50624] R1 EpfwLWF;Epfw NDIS LightWeight Filter;c:windowssystem32driversEpfwLWF.sys [2011-8-4 33656] R1 vwififlt;Virtual WiFi Filter Driver;c:windowssystem32driversvwififlt.sys [2009-7-14 48128] R2 eamonm;eamonm;c:windowssystem32driverseamonm.sys [2011-8-9 163424] R2 ekrn;ESET Service;c:program fileseseteset smart securityekrn.exe [2011-9-22 974944] R2 RealNetworks Downloader Resolver Service;RealNetworks Downloader Resolver Service;c:program filesrealnetworksrealdownloaderrndlresolversvc.exe [2011-8-15 31408] R3 RTL8167;Realtek 8167 NT Driver;c:windowssystem32driversRt86win7.sys [2009-6-11 139776] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:windowsmicrosoft.netframeworkv4.0.30319mscorsvw.exe [2010-3-18 130384] S2 gupdate;Услуга на Google Актуализация (gupdate);c:program filesgoogleupdateGoogleUpdate.exe [2011-7-3 136176] S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:windowssystem32macromedflashFlashPlayerUpdateService.exe [2012-7-28 250056] S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:windowssystem32driversb57nd60x.sys [2009-7-14 229888] S3 gupdatem;Услуга на Google Актуализация (gupdatem);c:program filesgoogleupdateGoogleUpdate.exe [2011-7-3 136176] S3 McComponentHostService;McAfee Security Scan Component Host Service;c:program filesmcafee security scan3.0.207McCHSvc.exe [2011-6-17 237008] S3 netr28u;RT2870 USB Wireless LAN Card Driver for Vista;c:windowssystem32driversnetr28u.sys [2009-6-11 657408] S3 phaudlwr;Philips Audio Filter;c:windowssystem32driversphaudlwr.sys [2009-10-20 89648] S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:windowssystem32driversrdpvideominiport.sys [2011-7-2 15872] S3 SPC530;Philips SPC530NC PC Camera;c:windowssystem32driversSPC530.sys [2012-3-25 486912] S3 SPC530m;Philips SPC530NC PC Cameram;c:windowssystem32driversSPC530m.sys [2012-3-25 7680] S3 TsUsbFlt;TsUsbFlt;c:windowssystem32driversTsUsbFlt.sys [2011-7-2 52224] S3 WatAdminSvc;Услуга на технологиите за активиране на Windows;c:windowssystem32watWatAdminSvc.exe [2011-7-2 1343400] . =============== Created Last 30 ================ . 2013-04-15 12:56:35  --------  d-----w-  c:usersёєьяшappdatalocalMicrosoft 2013-04-15 12:51:51  4515  ----a-w-  c:usersрумпиappdataroaming2922.exe 2013-04-15 12:51:48  147303  --sha-w-  c:usersрумпиappdataroamingmicrosoftKpwswc.exe 2013-04-13 11:35:34  147303  --sha-w-  c:usersрумпиappdataroamingtemp.bin . ==================== Find3M  ==================== . . ============= FINISH: 15:57:09,62 ===============  

Attach : . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2011-09-30.01) . Microsoft Windows 7 Ultimate Boot Device: DeviceHarddiskVolume1 Install Date: 31.12.2006 г. 23:32:58 System Uptime: 15.4.2013 г. 15:51:06 (0 hours ago) . Motherboard: |  | RS690-SB600 Processor: AMD Athlon 64 X2 Dual Core Processor 5200+ | Socket AM2  | 2700/200mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 36 GiB total, 0,341 GiB free. D: is FIXED (NTFS) - 59 GiB total, 15,538 GiB free. E: is FIXED (NTFS) - 59 GiB total, 17,4 GiB free. F: is CDROM () H: is CDROM () I: is Removable . ==== Disabled Device Manager Items ============= . ==== System Restore Points =================== . RP393: 14.4.2013 г. 22:23:27 - Планирана контролна точка . ==== Installed Programs ====================== . µTorrent Веселая ферма 3. Мадагаскар 1400 1400_Help 1400Trb 32 Bit HP CIO Components Installer Adobe Flash Player 10 ActiveX Adobe Flash Player 11 Plugin Adobe Reader 9.5.0 - Bulgarian AIO_CDB_ProductContext AIO_CDB_Software AIO_Scan Ashampoo Burning Studio 9.10 Ask Toolbar Ask Toolbar Updater ATI Catalyst Install Manager BFL lag fix BFL Switcher BFL_FIFA_10 BufferChm Catalyst Control Center Core Implementation Catalyst Control Center Graphics Full Existing Catalyst Control Center Graphics Full New Catalyst Control Center Graphics Light Catalyst Control Center Graphics Previews Vista ccc-core-static ccc-utility CCC Help English ChatZum Toolbar Copy CyberLink DVD Suite DAEMON Tools Toolbar Destinations DeviceDiscovery DocProc ESET Smart Security EVEREST Ultimate Edition v5.00 Farm Frenzy 3 American Pie (Final) v.7.0 Farm Frenzy 3 Russian Roulette 1.00 Favorite-Games Sounds Fax FIFA 10 Google Chrome Google Earth Plug-in Google Update Helper GPBaseService2 Hama Black Force Pad Hoyle Casino Games 2012 Hoyle Swashbucklin' Slots HP Customer Participation Program 13.0 HP Imaging Device Functions 13.0 HP Photosmart Essential 3.5 HP Photosmart Officejet and Deskjet All-In-One Driver Software 13.0 Rel. B HP Smart Web Printing 4.51 HP Solution Center 13.0 HP Update HPPhotoGadget HPPhotoSmartDiscLabelContent1 HPPhotosmartEssential HPProductAssistant HPSSupply Ice Age 3 Java Auto Updater Java 6 Update 26 K-Lite Codec Pack 5.2.8 (Full) BETA LabelPrint LightScribe System Software  1.12.37.1 MarketResearch McAfee Security Scan Plus MediaShow Microsoft .NET Framework 4 Client Profile Microsoft DirectX SDK (June 2010) Microsoft Office 2003 Bulgarian User Interface Pack Microsoft Office 2003 Proofing Tools Microsoft Office Professional Edition 2003 Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319 Microsoft WSE 3.0 Runtime Mozilla Firefox 5.0 (x86 bg) MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) Need For Speed Undercover Need for Speed™ Undercover Network OCR Software by I.R.I.S. 13.0 PhotoNow! Power2Go PowerDirector PowerDVD PowerProducer RealDownloader RealNetworks - Microsoft Visual C++ 2008 Runtime RealPlayer Realtek AC'97 Audio RealUpgrade 1.1 REAPER Scan Scooby-Doo First Frights Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708) Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663) Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636) Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078) Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121) Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405) Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827) Shop for HP Supplies Skins Skype™ 5.5 SmartWebPrinting SolutionCenter Status System Requirements Lab CYRI The KMPlayer 2.9.4.1435 (CUDA+DXVA) The Sims 2 The Sims 2 Nightlife The Sims™ 2 Celebration! Stuff The Sims™ 2 Mansion and Garden Stuff The Sims™ 2 Seasons Toolbox Total Video Converter 3.71 100812 TrayApp UnloadSupport Unlocker 1.9.1 Update for Microsoft .NET Framework 4 Client Profile (KB2468871) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) Warbirds 2012 WebReg Windows Media Player Firefox Plugin WinRAR 4.01 (32-битова версия) . ==== Event Viewer Messages From Past Week ======== . 9.4.2013 г. 20:29:39, Error: Service Control Manager [7000]  - Услуга Услуга на Google Актуализация (gupdate) не може да бъде стартирана поради следната грешка:  Каналът е затворен. 9.4.2013 г. 20:29:39, Error: Microsoft-Windows-DistributedCOM [10005]  - DCOM got error "109" attempting to start the service gupdate with arguments "/comsvc" in order to run the server: {4EB61BAC-A3B6-4760-9581-655041EF4D69} 8.4.2013 г. 20:21:16, Error: Disk [11]  - The driver detected a controller error on DeviceHarddisk1DR2. 8.4.2013 г. 20:21:16, Error: Disk [11]  - The driver detected a controller error on DeviceHarddisk1DR2. 8.4.2013 г. 20:21:15, Error: Disk [11]  - The driver detected a controller error on DeviceHarddisk1DR2. 8.4.2013 г. 20:21:14, Error: Disk [11]  - The driver detected a controller error on DeviceHarddisk1DR2. 8.4.2013 г. 19:57:08, Error: Disk [11]  - The driver detected a controller error on DeviceHarddisk1DR1. 8.4.2013 г. 19:57:08, Error: Disk [11]  - The driver detected a controller error on DeviceHarddisk1DR1. 8.4.2013 г. 19:57:07, Error: Disk [11]  - The driver detected a controller error on DeviceHarddisk1DR1. 8.4.2013 г. 19:57:07, Error: Disk [11]  - The driver detected a controller error on DeviceHarddisk1DR1. 8.4.2013 г. 19:48:22, Error: Disk [11]  - The driver detected a controller error on DeviceHarddisk1DR3. 8.4.2013 г. 19:48:21, Error: Disk [11]  - The driver detected a controller error on DeviceHarddisk1DR3. 8.4.2013 г. 19:48:20, Error: Disk [11]  - The driver detected a controller error on DeviceHarddisk1DR3. 8.4.2013 г. 18:57:35, Error: Disk [11]  - The driver detected a controller error on DeviceHarddisk1DR4. 8.4.2013 г. 18:57:35, Error: Disk [11]  - The driver detected a controller error on DeviceHarddisk1DR4. 8.4.2013 г. 18:57:34, Error: Disk [11]  - The driver detected a controller error on DeviceHarddisk1DR4. 8.4.2013 г. 18:57:34, Error: Disk [11]  - The driver detected a controller error on DeviceHarddisk1DR4. 8.4.2013 г. 18:57:33, Error: Disk [11]  - The driver detected a controller error on DeviceHarddisk1DR4. 8.4.2013 г. 12:40:02, Error: volsnap [36]  - The shadow copies of volume C: were aborted because the shadow copy storage could not grow due to a user imposed limit. 15.4.2013 г. 15:52:22, Error: Disk [11]  - The driver detected a controller error on DeviceHarddisk1DR1. 15.4.2013 г. 15:52:21, Error: Disk [11]  - The driver detected a controller error on DeviceHarddisk1DR1. 15.4.2013 г. 15:52:20, Error: Disk [11]  - The driver detected a controller error on DeviceHarddisk1DR1. 15.4.2013 г. 15:52:19, Error: Disk [11]  - The driver detected a controller error on DeviceHarddisk1DR1. 15.4.2013 г. 15:52:18, Error: Disk [11]  - The driver detected a controller error on DeviceHarddisk1DR1. 15.4.2013 г. 15:52:18, Error: Disk [11]  - The driver detected a controller error on DeviceHarddisk1DR1. 15.4.2013 г. 15:52:16, Error: Disk [11]  - The driver detected a controller error on DeviceHarddisk1DR1. 15.4.2013 г. 15:52:16, Error: Disk [11]  - The driver detected a controller error on DeviceHarddisk1DR1. 15.4.2013 г. 15:52:15, Error: Disk [11]  - The driver detected a controller error on DeviceHarddisk1DR1. 15.4.2013 г. 15:52:14, Error: Disk [11]  - The driver detected a controller error on DeviceHarddisk1DR1. 15.4.2013 г. 15:52:12, Error: Disk [11]  - The driver detected a controller error on DeviceHarddisk1DR1. 15.4.2013 г. 15:52:11, Error: Disk [11]  - The driver detected a controller error on DeviceHarddisk1DR1. 15.4.2013 г. 15:52:11, Error: Disk [11]  - The driver detected a controller error on DeviceHarddisk1DR1. 15.4.2013 г. 15:52:10, Error: Disk [11]  - The driver detected a controller error on DeviceHarddisk1DR1. 14.4.2013 г. 20:28:25, Error: volsnap [36]  - The shadow copies of volume C: were aborted because the shadow copy storage could not grow due to a user imposed limit. 13.4.2013 г. 13:05:04, Error: Disk [11]  - The driver detected a controller error on DeviceHarddisk1DR1. 13.4.2013 г. 13:05:03, Error: Disk [11]  - The driver detected a controller error on DeviceHarddisk1DR1. 13.4.2013 г. 13:05:03, Error: Disk [11]  - The driver detected a controller error on DeviceHarddisk1DR1. 13.4.2013 г. 13:05:02, Error: Disk [11]  - The driver detected a controller error on DeviceHarddisk1DR1. 12.4.2013 г. 13:29:26, Error: Service Control Manager [7034]  - Услуга Услуга на Google Актуализация (gupdate) беше прекъсната неочаквано. Това се е случвало с нея 1 път(и). 12.4.2013 г. 10:15:18, Error: volsnap [36]  - The shadow copies of volume C: were aborted because the shadow copy storage could not grow due to a user imposed limit. 11.4.2013 г. 06:33:53, Error: Service Control Manager [7034]  - Услуга Услуга на Google Актуализация (gupdate) беше прекъсната неочаквано. Това се е случвало с нея 1 път(и). 10.4.2013 г. 21:24:29, Error: volsnap [36]  - The shadow copies of volume C: were aborted because the shadow copy storage could not grow due to a user imposed limit. 10.4.2013 г. 17:35:59, Error: atikmdag [43033]  - Edid checksum error 10.4.2013 г. 07:53:46, Error: volsnap [36]  - The shadow copies of volume C: were aborted because the shadow copy storage could not grow due to a user imposed limit. . ==== End Of File ===========================  

 

 

 

Здравейте...Дамммм...да видим с какво си имаме работа..!
 
Изтеглете ComboFix от тук и го запазете на десктопа си
Изключете вашата антивирусна и антишпионска програма, обикновено това става чрез натискане на десния бутон на мишката върху иконата на програма в системния трей.
Бележка: Ако не можете я спрете или не сте сигурни коя програма да изключите, моля прегледайте информацията от този линк: How to Disable your Security Programs
Стартирайте Combo-Fix.com и следвайте инструкциите.
Бележка: ComboFix ще се стартира без инсталирана Recovery Console.
Като част от неговата работа, ComboFix ще провери дали Microsoft Windows Recovery Console е инсталирана. Предвид бързо развиващия се зловреден софтуер е силно препоръчително да бъде инсталирана преди премахването на зловредния софтуер. Това ще Ви позволи да влезете в специален recovery/repai режим, който ще ни позволи по-лесно да решите проблем, който би могъл да възникне при премахване на зловредния софтуер.

• [*]Следвайте инструкциите, за да позволите на

ComboFix да изтегли и инсталира Microsoft Windows Recovery Console.В един момент ще бъдете попитани дали сте съгласни с лицензното споразумение. Необходимо е да потвърдите, че сте съгласни, за да инсталирате Microsoft Windows Recovery Console.

** Забележете: Ако Microsoft Windows Recovery Console е вече инсталирана, ComboFix ще продължи към процеса по премахване на зловредния софтуер.

След като Microsoft Windows Recovery Console е инсталирана, използвайки ComboFix, Вие ще видите следното съобщение:

Изберете Yes, за да продължи сканирането за зловреден софтуер.
Когато процесът приключи успешно, инструментът ще създаде лог файл. Моля, включете съдържанието на C:ComboFix.txt в следващия Ви коментар в тази тема.
Бележка:

• [*]Моля, не движете мишката, докато ComboFix работи. Това може да наруши процеса на работа. [*]ComboFix ще нулира всички настройки на

Microsoft Internet Explorer, включително да направи IE браузър по подразбиране. [*]ComboFix ще изключи autorun функцията на ВСИЧКИ CD, Floppy и USB устройства, за да помогне при премахването на зловредния софтуер и Ви защити от бъдещи вируси/заплахи, които поразява чрез autorun. Ако това е проблем за вас - моля, уведомете ме. [*]ComboFix ще изключи вашата интернет връзка. Интернет връзката ще се възстанови автоматично, преди ComboFix да завърши процеса на работа. При проблем, той ще прекрати интернет връзката. За да възстановите интернет връзката си, рестартирайте компютъра си. [*]В случай на проблем с ComboFix, той може да създаде лог файл. Моля, включете съдържанието на C:BUG.txt в следващия Ви коментар в тази тема.

Моля, не прикачвайте лог файла/овете от програмата, а го/ги копирайте и поставете в следващия Ви коментар в тази тема.

Копирайте текста в карето на notepad и го запазвате с име CFScript.txt на десктопа си:

 

KILLALL::ClearJavaCache:: File::c:recyclerS-1-5-21-0243556031-888888379-781863308-15559prxzy129.exec:program filesAsk.comGenericAskToolbar.dllc:program filesChatZum ToolbartbunsvF96D.tmptbcore3.dllc:program filesAsk.comUpdaterUpdater.exec:program filesMcAfee Security Scan3.0.207SSScheduler.exec:program filesMcAfee Security Scan3.0.207McCHSvc.exe Registry::[-HKEY_CLASSES_ROOTclsid{00000000-6e41-4fd3-8538-502f5495e5fc}][-HKEY_CLASSES_ROOTclsid{37d48d9c-3f7e-412f-b5bf-611be7ccfca1}][-HKEY_CLASSES_ROOTTBSB09850.TBSB09850.3][-HKEY_CLASSES_ROOTTypeLib{EC4085F2-8DB3-45a6-AD0B-CA289F3C5D7E}][-HKEY_CLASSES_ROOTTBSB09850.TBSB09850][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]"ApnUpdater"=- Driver::McComponentHostService DirLook::c:usersЁєьяшDDS::uStart Page = hxxp://search.chatzum.com/mStart Page = hxxp://search.chatzum.com/ Firefox::FF - ProfilePath - c:usersрумпиAppDataRoamingMozillaFirefoxProfilesv71qqp7o.defaultFF - prefs.js: browser.search.selectedEngine - Search SaferFF - prefs.js: browser.startup.homepage - searchsafer.comFF - prefs.js: keyword.URL - hxxp://utils.chatzum.com/?url= 

След съхранението преместете  CFScript.txt на иконата на ComboFix.exe

 

 

Генерирания рапорт копирайте  и го поставете в следващия си коментар...!

Мисля че не сте изпълнили правилно скрипта ми (пост 4).....няма никаква промяна в дневника....!

Редактирано 15 април 201313 г. от VipKokata (преглед на промените)

Не,не ми харесва тази работа...!

 

А тези неща какви са ? (вероятно са вируси) Тези файлове се намират в :

c:usersрумпиAppDataRoaming6B4.exe
c:usersрумпиAppDataRoaming7C6C.exe
c:usersрумпиAppDataRoaming8830.exe
c:usersрумпиAppDataRoaming9EB0.exe
c:usersрумпиAppDataRoamingFD9F.exe

 
 
Еххххх.....!Май започнахте да ме учите....а...?

 

 

• [*]Моля изтеглете

Farbar Recovery Scan Tool и го запазете на  флашка. [*]Сложете вашата флашка в заразения компютър. [*]Рестартирайте компютъра натискайки F8 и изберете Repair Your Computer. (дано да е налично - иначе ще е необходим инсталационен диск с Windows 7 за достигане до това меню). [*]Изберете английски език и натиснете Next. [*]Изберете потребителския си акаунт и въведете администраторската си парола (ако имате такава) и натиснете ОK. (ако нямате просто натиснете OK). [*]Изберете Command Prompt категорията.
[*]Когато се появи графата за команди въведете командата notepad и натиснете Enter [*]В notepad от менютo File => изберете Open => посочете My Computer => и намерете буквата на вашата флашка и затворете notepad-a. [*]От менюто за команди напишете e:frst64.exe (заменете буквата на e: с тази на вашата флашка). [*]Програмата ще се стартира. Натиснете YES за да се съгласите с лицензионното споразумение. [*]Натиснете бутона SCAN [*]Ще се създаде лог файл с името - FRST.txt на флашката. [*]Копирайте текста в следващия си пост.

 

 

    Еххххх.....!Май започнахте да ме учите....а...?

 

 

Ако съм те обидил извинявай просто исках да ти покажа, че тези неща са стартирани и показах пътя къде се намират. Обаче нямам флашка остана в чичо това утре ще го направя .

Здравей ето го и лога от FRST : Проблем ли е, че съм изтеглил 32 битовата версия ? 

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 11-04-2013

Ran by SYSTEM at 16-04-2013 17:11:46

Running from H:

Windows 7 Ultimate   (X86) OS Language: English(US) 

The current controlset is ControlSet001

 

==================== Registry (Whitelisted) ===================

 

HKLM...Run: [startCCC] C:Program FilesATI TechnologiesATI.ACECore-StaticCLIStart.exe [90112 2006-11-10] ()

HKLM...Run: [soundMan] SOUNDMAN.EXE [x]

HKLM...Run: [sunJavaUpdateSched] "C:Program FilesCommon FilesJavaJava Updatejusched.exe" [254696 2011-04-08] (Sun Microsystems, Inc.)

HKLM...Run: [HP Software Update] C:Program FilesHPHP Software UpdateHPWuSchd2.exe [54840 2007-05-08] (Hewlett-Packard)

HKLM...Run: [hpqSRMon] C:Program FilesHPDigital ImagingbinhpqSRMon.exe [150528 2008-07-22] (Hewlett-Packard)

HKLM...Run: [RemoteControl] "C:Program FilesCyberLinkPowerDVDPDVDServ.exe" [87336 2008-04-02] (Cyberlink Corp.)

HKLM...Run: [LanguageShortcut] "C:Program FilesCyberLinkPowerDVDLanguageLanguage.exe" [62760 2008-02-22] ()

HKLM...Run: [updatePPShortCut] "C:Program FilesCyberLinkPowerProducerMUITransferMUIStartMenu.exe" "C:Program FilesCyberLinkPowerProducer" update "SoftwareCyberLinkPowerProducer4.0" [222504 2008-01-04] (CyberLink Corp.)

HKLM...Run: [TkBellExe] "C:Program FilesRealRealPlayerUpdaterealsched.exe" -osboot [296056 2011-12-02] (RealNetworks, Inc.)

HKLM...Run: [egui] "C:Program FilesESETESET Smart Securityegui.exe" /hide /waitservice [3080264 2011-09-22] (ESET)

HKLM...Run: [ApnUpdater] "C:Program FilesAsk.comUpdaterUpdater.exe" [1557160 2012-04-09] (Ask)

HKLM...Run: [Adobe Reader Speed Launcher] "C:Program FilesAdobeReader 9.0ReaderReader_sl.exe" [37296 2012-01-03] (Adobe Systems Incorporated)

HKLM...Run: [Adobe ARM] "C:Program FilesCommon FilesAdobeARM1.0AdobeARM.exe" [843712 2012-01-01] (Adobe Systems Incorporated)

HKLM...Run: [unlockerAssistant] "C:Program FilesUnlockerUnlockerAssistant.exe" [17408 2010-07-04] ()

TcpipParameters: [DhcpNameServer] 212.233.128.2 212.233.128.1

Startup: C:ProgramDataStart MenuProgramsStartupHP Digital Imaging Monitor.lnk

ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:Program FilesHPDigital Imagingbinhpqtra08.exe (Hewlett-Packard Co.)

Startup: C:ProgramDataStart MenuProgramsStartupMcAfee Security Scan Plus.lnk

ShortcutTarget: McAfee Security Scan Plus.lnk -> C:Program FilesMcAfee Security Scan3.0.207SSScheduler.exe (McAfee, Inc.)

 

==================== Services (Whitelisted) ===================

 

2 ekrn; "C:Program FilesESETESET Smart Securityekrn.exe" [974944 2011-09-22] (ESET)

3 McComponentHostService; "C:Program FilesMcAfee Security Scan3.0.207McCHSvc.exe" [237008 2011-06-17] (McAfee, Inc.)

2 RealNetworks Downloader Resolver Service; "C:Program FilesRealNetworksRealDownloaderrndlresolversvc.exe" [31408 2011-08-15] ()

2 RichVideo; "C:Program FilesCyberLinkShared FilesRichVideo.exe" [272024 2007-01-08] ()

 

==================== Drivers (Whitelisted) ====================

 

3 ALCXWDM; C:WindowsSystem32driversRTKVAC.SYS [4132640 2008-01-24] (Realtek Semiconductor Corp.)

2 eamonm; C:WindowsSystem32DRIVERSeamonm.sys [163424 2011-08-09] (ESET)

1 ehdrv; C:WindowsSystem32DRIVERSehdrv.sys [118104 2011-08-03] (ESET)

2 epfw; C:WindowsSystem32DRIVERSepfw.sys [147480 2011-08-03] (ESET)

1 EpfwLWF; C:WindowsSystem32DRIVERSEpfwLWF.sys [33656 2011-08-03] (ESET)

0 epfwwfp; C:WindowsSystem32DRIVERSepfwwfp.sys [50624 2011-08-03] (ESET)

1 jecaypvc; ??C:Windowssystem32driversjecaypvc.sys [43600 2013-04-16] (Microsoft Corporation)

3 netr28u; C:WindowsSystem32DRIVERSnetr28u.sys [657408 2009-07-13] (Ralink Technology Corp.)

3 phaudlwr; C:WindowsSystem32DRIVERSphaudlwr.sys [89648 2009-10-20] (Philips Applied Technologies)

3 SPC530; C:WindowsSystem32driversSPC530.sys [486912 2008-05-21] (                                                            )

3 SPC530m; C:WindowsSystem32driversSPC530m.sys [7680 2008-05-21] (                                                            )

0 sptd; C:WindowsSystem32Driverssptd.sys [721904 2011-06-24] (Duplex Secure Ltd.)

3 catchme; ??C:UsersE1CB~1AppDataLocalTempcatchme.sys [x]

3 Synth3dVsc; C:WindowsSystem32driverssynth3dvsc.sys [x]

3 tsusbhub; C:WindowsSystem32driverstsusbhub.sys [x]

3 VGPU; C:WindowsSystem32driversrdvgkmd.sys [x]

 

==================== NetSvcs (Whitelisted) ===================

 

 

==================== One Month Created Files and Folders ========

 

2013-04-16 06:05 - 2013-04-16 06:05 - 00043600 ____A (Microsoft Corporation) C:WindowsSystem32Driversjecaypvc.sys

2013-04-16 03:40 - 2013-04-16 03:42 - 00000112 ____A C:Windowssetupact.log

2013-04-16 03:40 - 2013-04-16 03:40 - 00000000 ____A C:Windowssetuperr.log

2013-04-16 03:39 - 2013-04-16 03:39 - 00001916 ____A C:WindowsPFRO.log

2013-04-15 12:34 - 2012-12-16 06:13 - 00295424 ____A (Adobe Systems Incorporated) C:WindowsSystem32atmfd.dll

2013-04-15 12:34 - 2012-12-16 06:13 - 00034304 ____A (Adobe Systems) C:WindowsSystem32atmlib.dll

2013-04-15 12:22 - 2012-07-25 19:39 - 00526952 ____A (Microsoft Corporation) C:WindowsSystem32DriversWdf01000.sys

2013-04-15 12:22 - 2012-07-25 19:39 - 00047720 ____A (Microsoft Corporation) C:WindowsSystem32DriversWdfLdr.sys

2013-04-15 12:22 - 2012-07-25 19:21 - 00196608 ____A (Microsoft Corporation) C:WindowsSystem32WUDFHost.exe

2013-04-15 12:22 - 2012-07-25 19:20 - 00613888 ____A (Microsoft Corporation) C:WindowsSystem32WUDFx.dll

2013-04-15 12:22 - 2012-07-25 19:20 - 00172032 ____A (Microsoft Corporation) C:WindowsSystem32WUDFPlatform.dll

2013-04-15 12:22 - 2012-07-25 19:20 - 00073216 ____A (Microsoft Corporation) C:WindowsSystem32WUDFSvc.dll

2013-04-15 12:22 - 2012-07-25 19:20 - 00038912 ____A (Microsoft Corporation) C:WindowsSystem32WUDFCoinstaller.dll

2013-04-15 12:22 - 2012-07-25 18:46 - 00009728 ____A (Microsoft Corporation) C:WindowsSystem32Wdfres.dll

2013-04-15 12:22 - 2012-07-25 18:33 - 00066560 ____A (Microsoft Corporation) C:WindowsSystem32DriversWUDFPf.sys

2013-04-15 12:22 - 2012-07-25 18:32 - 00155136 ____A (Microsoft Corporation) C:WindowsSystem32DriversWUDFRd.sys

2013-04-15 12:22 - 2012-06-02 06:57 - 00000003 ____A C:WindowsSystem32DriversMsftWdf_User_01_11_00_Inbox_Critical.Wdf

2013-04-15 12:22 - 2012-06-02 06:34 - 00000003 ____A C:WindowsSystem32DriversMsftWdf_Kernel_01011_Inbox_Critical.Wdf

2013-04-15 11:27 - 2013-04-15 11:27 - 00009676 ____A C:ComboFix.txt

2013-04-15 09:54 - 2012-11-29 20:47 - 00868352 ____A (Microsoft Corporation) C:WindowsSystem32kernel32.dll

2013-04-15 09:54 - 2012-11-29 20:47 - 00293376 ____A (Microsoft Corporation) C:WindowsSystem32KernelBase.dll

2013-04-15 09:54 - 2012-11-29 20:45 - 00005120 ___AH (Microsoft Corporation) C:WindowsSystem32api-ms-win-core-file-l1-1-0.dll

2013-04-15 09:54 - 2012-11-29 20:45 - 00004608 ___AH (Microsoft Corporation) C:WindowsSystem32api-ms-win-core-processthreads-l1-1-0.dll

2013-04-15 09:54 - 2012-11-29 20:45 - 00004096 ___AH (Microsoft Corporation) C:WindowsSystem32api-ms-win-core-sysinfo-l1-1-0.dll

2013-04-15 09:54 - 2012-11-29 20:45 - 00004096 ___AH (Microsoft Corporation) C:WindowsSystem32api-ms-win-core-synch-l1-1-0.dll

2013-04-15 09:54 - 2012-11-29 20:45 - 00004096 ___AH (Microsoft Corporation) C:WindowsSystem32api-ms-win-core-misc-l1-1-0.dll

2013-04-15 09:54 - 2012-11-29 20:45 - 00004096 ___AH (Microsoft Corporation) C:WindowsSystem32api-ms-win-core-localregistry-l1-1-0.dll

2013-04-15 09:54 - 2012-11-29 20:45 - 00004096 ___AH (Microsoft Corporation) C:WindowsSystem32api-ms-win-core-localization-l1-1-0.dll

2013-04-15 09:54 - 2012-11-29 20:45 - 00003584 ___AH (Microsoft Corporation) C:WindowsSystem32api-ms-win-core-processenvironment-l1-1-0.dll

2013-04-15 09:54 - 2012-11-29 20:45 - 00003584 ___AH (Microsoft Corporation) C:WindowsSystem32api-ms-win-core-namedpipe-l1-1-0.dll

2013-04-15 09:54 - 2012-11-29 20:45 - 00003584 ___AH (Microsoft Corporation) C:WindowsSystem32api-ms-win-core-memory-l1-1-0.dll

2013-04-15 09:54 - 2012-11-29 20:45 - 00003584 ___AH (Microsoft Corporation) C:WindowsSystem32api-ms-win-core-libraryloader-l1-1-0.dll

2013-04-15 09:54 - 2012-11-29 20:45 - 00003584 ___AH (Microsoft Corporation) C:WindowsSystem32api-ms-win-core-interlocked-l1-1-0.dll

2013-04-15 09:54 - 2012-11-29 20:45 - 00003584 ___AH (Microsoft Corporation) C:WindowsSystem32api-ms-win-core-heap-l1-1-0.dll

2013-04-15 09:54 - 2012-11-29 20:45 - 00003072 ___AH (Microsoft Corporation) C:WindowsSystem32api-ms-win-core-string-l1-1-0.dll

2013-04-15 09:54 - 2012-11-29 20:45 - 00003072 ___AH (Microsoft Corporation) C:WindowsSystem32api-ms-win-core-rtlsupport-l1-1-0.dll

2013-04-15 09:54 - 2012-11-29 20:45 - 00003072 ___AH (Microsoft Corporation) C:WindowsSystem32api-ms-win-core-profile-l1-1-0.dll

2013-04-15 09:54 - 2012-11-29 20:45 - 00003072 ___AH (Microsoft Corporation) C:WindowsSystem32api-ms-win-core-io-l1-1-0.dll

2013-04-15 09:54 - 2012-11-29 20:45 - 00003072 ___AH (Microsoft Corporation) C:WindowsSystem32api-ms-win-core-handle-l1-1-0.dll

2013-04-15 09:54 - 2012-11-29 20:45 - 00003072 ___AH (Microsoft Corporation) C:WindowsSystem32api-ms-win-core-fibers-l1-1-0.dll

2013-04-15 09:54 - 2012-11-29 20:45 - 00003072 ___AH (Microsoft Corporation) C:WindowsSystem32api-ms-win-core-errorhandling-l1-1-0.dll

2013-04-15 09:54 - 2012-11-29 20:45 - 00003072 ___AH (Microsoft Corporation) C:WindowsSystem32api-ms-win-core-delayload-l1-1-0.dll

2013-04-15 09:54 - 2012-11-29 20:45 - 00003072 ___AH (Microsoft Corporation) C:WindowsSystem32api-ms-win-core-debug-l1-1-0.dll

2013-04-15 09:54 - 2012-11-29 20:45 - 00003072 ___AH (Microsoft Corporation) C:WindowsSystem32api-ms-win-core-datetime-l1-1-0.dll

2013-04-15 09:54 - 2012-11-29 20:45 - 00003072 ___AH (Microsoft Corporation) C:WindowsSystem32api-ms-win-core-console-l1-1-0.dll

2013-04-15 09:54 - 2012-11-29 18:55 - 00271360 ____A (Microsoft Corporation) C:WindowsSystem32conhost.exe

2013-04-15 09:54 - 2012-11-29 18:38 - 00006144 ___AH (Microsoft Corporation) C:WindowsSystem32api-ms-win-security-base-l1-1-0.dll

2013-04-15 09:54 - 2012-11-29 18:38 - 00004608 ___AH (Microsoft Corporation) C:WindowsSystem32api-ms-win-core-threadpool-l1-1-0.dll

2013-04-15 09:54 - 2012-11-29 18:38 - 00003584 ___AH (Microsoft Corporation) C:WindowsSystem32api-ms-win-core-xstate-l1-1-0.dll

2013-04-15 09:54 - 2012-11-29 18:38 - 00003072 ___AH (Microsoft Corporation) C:WindowsSystem32api-ms-win-core-util-l1-1-0.dll

2013-04-15 09:54 - 2012-11-29 15:17 - 00420064 ____A C:WindowsSystem32locale.nls

2013-04-15 09:54 - 2012-06-01 20:36 - 01159680 ____A (Microsoft Corporation) C:WindowsSystem32crypt32.dll

2013-04-15 09:54 - 2012-06-01 20:36 - 00140288 ____A (Microsoft Corporation) C:WindowsSystem32cryptsvc.dll

2013-04-15 09:54 - 2012-06-01 20:36 - 00103936 ____A (Microsoft Corporation) C:WindowsSystem32cryptnet.dll

2013-04-15 09:54 - 2012-02-10 21:37 - 00317440 ____A (Microsoft Corporation) C:WindowsSystem32spoolsv.exe

2013-04-15 09:53 - 2013-03-18 21:04 - 03968856 ____A (Microsoft Corporation) C:WindowsSystem32ntkrnlpa.exe

2013-04-15 09:53 - 2013-03-18 21:04 - 03913560 ____A (Microsoft Corporation) C:WindowsSystem32ntoskrnl.exe

2013-04-15 09:53 - 2013-03-18 20:48 - 00038912 ____A (Microsoft Corporation) C:WindowsSystem32csrsrv.dll

2013-04-15 09:53 - 2013-03-18 18:49 - 00069632 ____A (Microsoft Corporation) C:WindowsSystem32smss.exe

2013-04-15 09:53 - 2012-11-21 20:45 - 00626688 ____A (Microsoft Corporation) C:WindowsSystem32usp10.dll

2013-04-15 09:52 - 2013-03-01 20:58 - 01231872 ____A (Microsoft Corporation) C:WindowsSystem32urlmon.dll

2013-04-15 09:52 - 2013-03-01 20:58 - 00981504 ____A (Microsoft Corporation) C:WindowsSystem32wininet.dll

2013-04-15 09:52 - 2013-03-01 20:58 - 00132096 ____A (Microsoft Corporation) C:WindowsSystem32url.dll

2013-04-15 09:52 - 2013-03-01 20:54 - 06032384 ____A (Microsoft Corporation) C:WindowsSystem32mshtml.dll

2013-04-15 09:52 - 2013-03-01 20:54 - 00627712 ____A (Microsoft Corporation) C:WindowsSystem32msfeeds.dll

2013-04-15 09:52 - 2013-03-01 20:54 - 00067584 ____A (Microsoft Corporation) C:WindowsSystem32mshtmled.dll

2013-04-15 09:52 - 2013-03-01 20:53 - 00048128 ____A (Microsoft Corporation) C:WindowsSystem32jsproxy.dll

2013-04-15 09:52 - 2013-03-01 20:52 - 11020800 ____A (Microsoft Corporation) C:WindowsSystem32ieframe.dll

2013-04-15 09:52 - 2013-03-01 20:52 - 02078208 ____A (Microsoft Corporation) C:WindowsSystem32iertutil.dll

2013-04-15 09:52 - 2013-03-01 20:52 - 00176640 ____A (Microsoft Corporation) C:WindowsSystem32ieui.dll

2013-04-15 09:52 - 2013-03-01 19:22 - 01638912 ____A (Microsoft Corporation) C:WindowsSystem32mshtml.tlb

2013-04-15 09:52 - 2013-02-14 20:37 - 03217408 ____A (Microsoft Corporation) C:WindowsSystem32mstscax.dll

2013-04-15 09:52 - 2013-02-14 20:34 - 00131584 ____A (Microsoft Corporation) C:WindowsSystem32aaclient.dll

2013-04-15 09:52 - 2013-02-14 19:25 - 00036864 ____A (Microsoft Corporation) C:WindowsSystem32tsgqec.dll

2013-04-15 09:52 - 2012-08-21 12:12 - 00245760 ____A (Microsoft Corporation) C:WindowsSystem32OxpsConverter.exe

2013-04-15 09:07 - 2013-04-15 11:27 - 00000000 ____D C:Qoobox

2013-04-15 09:07 - 2011-06-25 22:45 - 00256000 ____A C:WindowsPEV.exe

2013-04-15 09:07 - 2010-11-07 09:20 - 00208896 ____A C:WindowsMBR.exe

2013-04-15 09:07 - 2009-04-19 20:56 - 00060416 ____A (NirSoft) C:WindowsNIRCMD.exe

2013-04-15 09:07 - 2000-08-30 16:00 - 00518144 ____A (SteelWerX) C:WindowsSWREG.exe

2013-04-15 09:07 - 2000-08-30 16:00 - 00406528 ____A (SteelWerX) C:WindowsSWSC.exe

2013-04-15 09:07 - 2000-08-30 16:00 - 00098816 ____A C:Windowssed.exe

2013-04-15 09:07 - 2000-08-30 16:00 - 00080412 ____A C:Windowsgrep.exe

2013-04-15 09:07 - 2000-08-30 16:00 - 00068096 ____A C:Windowszip.exe

2013-04-15 09:06 - 2013-04-15 09:32 - 00000000 ____D C:Windowserdnt

2013-04-15 06:47 - 2013-02-28 19:09 - 02347008 ____A (Microsoft Corporation) C:WindowsSystem32win32k.sys

2013-04-15 06:47 - 2013-02-11 19:32 - 00015872 ____A (Microsoft Corporation) C:WindowsSystem32Driversusb8023.sys

2013-04-15 06:47 - 2012-10-31 20:47 - 01389568 ____A (Microsoft Corporation) C:WindowsSystem32msxml6.dll

2013-04-15 06:47 - 2012-08-31 09:18 - 01211760 ____A (Microsoft Corporation) C:WindowsSystem32Driversntfs.sys

2013-04-15 06:47 - 2012-08-22 09:16 - 00712048 ____A (Microsoft Corporation) C:WindowsSystem32Driversndis.sys

2013-04-15 06:47 - 2012-07-04 11:45 - 00033280 ____A (Microsoft Corporation) C:WindowsSystem32DriversRNDISMP.sys

2013-04-15 06:46 - 2013-01-23 20:47 - 00196328 ____A (Microsoft Corporation) C:WindowsSystem32Driversfvevol.sys

2013-04-15 06:46 - 2013-01-02 21:05 - 01293672 ____A (Microsoft Corporation) C:WindowsSystem32Driverstcpip.sys

2013-04-15 06:46 - 2013-01-02 21:04 - 00187752 ____A (Microsoft Corporation) C:WindowsSystem32DriversFWPKCLNT.SYS

2013-04-15 06:46 - 2012-11-08 20:43 - 00492032 ____A (Microsoft Corporation) C:WindowsSystem32win32spl.dll

2013-04-15 06:46 - 2012-11-01 21:11 - 00376832 ____A (Microsoft Corporation) C:WindowsSystem32dpnet.dll

2013-04-15 06:46 - 2012-10-03 08:42 - 00242176 ____A (Microsoft Corporation) C:WindowsSystem32nlasvc.dll

2013-04-15 06:46 - 2012-10-03 08:42 - 00175104 ____A (Microsoft Corporation) C:WindowsSystem32netcorehc.dll

2013-04-15 06:46 - 2012-10-03 08:42 - 00156672 ____A (Microsoft Corporation) C:WindowsSystem32ncsi.dll

2013-04-15 06:46 - 2012-10-03 08:42 - 00052224 ____A (Microsoft Corporation) C:WindowsSystem32nlaapi.dll

2013-04-15 06:46 - 2012-10-03 08:42 - 00018944 ____A (Microsoft Corporation) C:WindowsSystem32netevent.dll

2013-04-15 06:46 - 2012-10-03 08:40 - 00499712 ____A (Microsoft Corporation) C:WindowsSystem32iphlpsvc.dll

2013-04-15 06:46 - 2012-10-03 07:21 - 00035328 ____A (Microsoft Corporation) C:WindowsSystem32Driverstcpipreg.sys

2013-04-15 06:46 - 2012-08-24 08:57 - 00172544 ____A (Microsoft Corporation) C:WindowsSystem32wintrust.dll

2013-04-15 06:46 - 2012-08-22 09:16 - 00240496 ____A (Microsoft Corporation) C:WindowsSystem32Driversnetio.sys

2013-04-15 06:46 - 2012-07-04 13:16 - 00057344 ____A (Microsoft Corporation) C:WindowsSystem32netapi32.dll

2013-04-15 06:46 - 2012-07-04 13:14 - 00102912 ____A (Microsoft Corporation) C:WindowsSystem32browser.dll

2013-04-15 06:46 - 2012-07-04 13:14 - 00041984 ____A (Microsoft Corporation) C:WindowsSystem32browcli.dll

2013-04-15 06:46 - 2012-05-04 23:46 - 00400896 ____A (Microsoft Corporation) C:WindowsSystem32srcore.dll

2013-04-15 06:45 - 2012-12-07 04:26 - 00308736 ____A (Microsoft Corporation) C:WindowsSystem32Wpc.dll

2013-04-15 06:45 - 2012-12-07 04:20 - 02576384 ____A (Microsoft Corporation) C:WindowsSystem32gameux.dll

2013-04-15 06:45 - 2012-12-07 02:46 - 00055296 ____A (Microsoft) C:WindowsSystem32cero.rs

2013-04-15 06:45 - 2012-12-07 02:46 - 00051712 ____A (Microsoft) C:WindowsSystem32esrb.rs

2013-04-15 06:45 - 2012-12-07 02:46 - 00046592 ____A (Microsoft) C:WindowsSystem32fpb.rs

2013-04-15 06:45 - 2012-12-07 02:46 - 00045568 ____A (Microsoft) C:WindowsSystem32oflc-nz.rs

2013-04-15 06:45 - 2012-12-07 02:46 - 00044544 ____A (Microsoft) C:WindowsSystem32pegibbfc.rs

2013-04-15 06:45 - 2012-12-07 02:46 - 00043520 ____A (Microsoft) C:WindowsSystem32csrr.rs

2013-04-15 06:45 - 2012-12-07 02:46 - 00040960 ____A (Microsoft) C:WindowsSystem32cob-au.rs

2013-04-15 06:45 - 2012-12-07 02:46 - 00030720 ____A (Microsoft) C:WindowsSystem32usk.rs

2013-04-15 06:45 - 2012-12-07 02:46 - 00023552 ____A (Microsoft) C:WindowsSystem32oflc.rs

2013-04-15 06:45 - 2012-12-07 02:46 - 00021504 ____A (Microsoft) C:WindowsSystem32grb.rs

2013-04-15 06:45 - 2012-12-07 02:46 - 00020480 ____A (Microsoft) C:WindowsSystem32pegi-pt.rs

2013-04-15 06:45 - 2012-12-07 02:46 - 00020480 ____A (Microsoft) C:WindowsSystem32pegi-fi.rs

2013-04-15 06:45 - 2012-12-07 02:46 - 00020480 ____A (Microsoft) C:WindowsSystem32pegi.rs

2013-04-15 06:45 - 2012-12-07 02:46 - 00015360 ____A (Microsoft) C:WindowsSystem32djctq.rs

2013-04-15 06:45 - 2012-11-22 18:48 - 00049152 ____A (Microsoft Corporation) C:WindowsSystem32taskhost.exe

2013-04-15 06:45 - 2012-11-19 20:51 - 00220160 ____A (Microsoft Corporation) C:WindowsSystem32ncrypt.dll

2013-04-15 06:45 - 2012-10-09 09:40 - 00193536 ____A (Microsoft Corporation) C:WindowsSystem32dhcpcore6.dll

2013-04-15 06:45 - 2012-10-09 09:40 - 00044032 ____A (Microsoft Corporation) C:WindowsSystem32dhcpcsvc6.dll

2013-04-15 06:45 - 2012-09-25 14:47 - 00078336 ____A (Microsoft Corporation) C:WindowsSystem32synceng.dll

2013-04-15 06:45 - 2012-08-10 15:56 - 00542208 ____A (Microsoft Corporation) C:WindowsSystem32kerberos.dll

2013-04-15 06:45 - 2012-05-13 20:33 - 00769024 ____A (Microsoft Corporation) C:WindowsSystem32localspl.dll

2013-04-15 06:44 - 2012-11-08 20:42 - 00002048 ____A (Microsoft Corporation) C:WindowsSystem32tzres.dll

2013-04-15 06:43 - 2013-01-03 20:50 - 00169984 ____A (Microsoft Corporation) C:WindowsSystem32winsrv.dll

2013-04-15 04:56 - 2013-04-15 04:56 - 00000000 ____D C:users?????

 

 

==================== One Month Modified Files and Folders ========

 

2013-04-16 06:05 - 2013-04-16 06:05 - 00043600 ____A (Microsoft Corporation) C:WindowsSystem32Driversjecaypvc.sys

2013-04-16 06:05 - 2011-07-03 04:26 - 00000984 ____A C:WindowsTasksGoogleUpdateTaskMachineUA.job

2013-04-16 06:04 - 2006-12-31 13:43 - 00726316 ____A C:WindowsSystem32PerfStringBackup.INI

2013-04-16 05:45 - 2012-07-28 00:18 - 00000830 ____A C:WindowsTasksAdobe Flash Player Updater.job

2013-04-16 05:05 - 2011-07-03 04:26 - 00000980 ____A C:WindowsTasksGoogleUpdateTaskMachineCore.job

2013-04-16 04:55 - 2009-07-13 20:34 - 00017168 ___AH C:WindowsSystem327B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2013-04-16 04:55 - 2009-07-13 20:34 - 00017168 ___AH C:WindowsSystem327B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2013-04-16 04:24 - 2009-07-13 18:37 - 00000000 ____D C:WindowsMicrosoft.NET

2013-04-16 03:45 - 2006-12-31 13:40 - 02032881 ____A C:WindowsWindowsUpdate.log

2013-04-16 03:42 - 2013-04-16 03:40 - 00000112 ____A C:Windowssetupact.log

2013-04-16 03:42 - 2009-07-13 20:53 - 00000006 ___AH C:WindowsTasksSA.DAT

2013-04-16 03:42 - 2009-07-13 20:33 - 00413384 ____A C:WindowsSystem32FNTCACHE.DAT

2013-04-16 03:40 - 2013-04-16 03:40 - 00000000 ____A C:Windowssetuperr.log

2013-04-16 03:40 - 2009-07-13 18:37 - 00000000 ____D C:WindowsSystem32DriverStore

2013-04-16 03:40 - 2009-07-13 18:37 - 00000000 ____D C:WindowsSystem32bg-BG

2013-04-16 03:39 - 2013-04-16 03:39 - 00001916 ____A C:WindowsPFRO.log

2013-04-15 11:27 - 2013-04-15 11:27 - 00009676 ____A C:ComboFix.txt

2013-04-15 11:27 - 2013-04-15 09:07 - 00000000 ____D C:Qoobox

2013-04-15 11:26 - 2009-07-13 18:04 - 00000215 ____A C:Windowssystem.ini

2013-04-15 09:33 - 2009-07-13 18:37 - 00000000 __RHD C:usersDefault

2013-04-15 09:33 - 2009-07-13 18:37 - 00000000 ___RD C:usersPublic

2013-04-15 09:32 - 2013-04-15 09:06 - 00000000 ____D C:Windowserdnt

2013-04-15 09:30 - 2006-12-31 13:58 - 00000000 ____D C:Program FilesESET

2013-04-15 09:18 - 2006-12-31 23:00 - 00000000 ____D C:WindowsPanther

2013-04-15 05:45 - 2012-07-28 00:18 - 00693976 ____A (Adobe Systems Incorporated) C:WindowsSystem32FlashPlayerApp.exe

2013-04-15 05:45 - 2006-12-31 14:19 - 00073432 ____A (Adobe Systems Incorporated) C:WindowsSystem32FlashPlayerCPLApp.cpl

2013-04-15 05:06 - 2011-07-03 04:26 - 00000000 ____D C:Program FilesGoogle

2013-04-15 04:56 - 2013-04-15 04:56 - 00000000 ____D C:users?????

2013-04-15 04:55 - 2009-07-13 18:37 - 00000000 ____D C:WindowsSystem32LogFiles

2013-04-01 08:48 - 2011-07-03 00:04 - 70490256 ____A (Microsoft Corporation) C:WindowsSystem32MRT.exe

2013-03-18 21:04 - 2013-04-15 09:53 - 03968856 ____A (Microsoft Corporation) C:WindowsSystem32ntkrnlpa.exe

2013-03-18 21:04 - 2013-04-15 09:53 - 03913560 ____A (Microsoft Corporation) C:WindowsSystem32ntoskrnl.exe

2013-03-18 20:48 - 2013-04-15 09:53 - 00038912 ____A (Microsoft Corporation) C:WindowsSystem32csrsrv.dll

2013-03-18 18:49 - 2013-04-15 09:53 - 00069632 ____A (Microsoft Corporation) C:WindowsSystem32smss.exe

 

 

==================== Known DLLs (Whitelisted) =================

 

 

==================== Bamital & volsnap Check =================

 

C:Windowsexplorer.exe => MD5 is legit

C:WindowsSystem32winlogon.exe => MD5 is legit

C:WindowsSystem32wininit.exe => MD5 is legit

C:WindowsSystem32svchost.exe => MD5 is legit

C:WindowsSystem32services.exe => MD5 is legit

C:WindowsSystem32User32.dll => MD5 is legit

C:WindowsSystem32userinit.exe => MD5 is legit

C:WindowsSystem32Driversvolsnap.sys => MD5 is legit

 

==================== EXE ASSOCIATION =====================

 

HKLM....exe: exefile => OK

HKLM...exefileDefaultIcon: %1 => OK

HKLM...exefileopencommand: "%1" %* => OK

 

==================== Restore Points  =========================

 

Restore point made on: 2013-04-16 06:05:39

 

==================== Memory info =========================== 

 

Percentage of memory in use: 20%

Total physical RAM: 1919.49 MB

Available physical RAM: 1518.35 MB

Total Pagefile: 1919.49 MB

Available Pagefile: 1516.63 MB

Total Virtual: 2047.88 MB

Available Virtual: 1952.7 MB

 

==================== Partitions =============================

 

1 Drive c: () (Fixed) (Total:36.04 GB) (Free:11.57 GB) NTFS

2 Drive d: () (Fixed) (Total:58.61 GB) (Free:15.88 GB) NTFS

3 Drive e: () (Fixed) (Total:58.63 GB) (Free:21.73 GB) NTFS

5 Drive h: () (Removable) (Total:3.72 GB) (Free:3.72 GB) FAT32

6 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

7 Drive y: (??????????? ?? ?????????) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[system with boot components (obtained from reading drive)]

 

  Disk ###  Status         Size     Free     Dyn  Gpt

  --------  -------------  -------  -------  ---  ---

  Disk 0    Online          153 GB  6144 KB      

  Disk 1    Online         3816 MB      0 B      

 

Partitions of Disk 0:

===============

 

Disk ID: 849A87BA

 

  Partition ###  Type              Size     Offset

  -------------  ----------------  -------  -------

  Partition 1    Primary            100 MB  1024 KB

  Partition 2    Primary             36 GB   101 MB

  Partition 0    Extended           117 GB    36 GB

  Partition 3    Logical             58 GB    36 GB

  Partition 4    Logical             58 GB    94 GB

 

=========================================================

 

Disk: 0

Partition 1

Type  : 07

Hidden: No

Active: Yes

 

  Volume ###  Ltr  Label        Fs     Type        Size     Status     Info

  ----------  ---  -----------  -----  ----------  -------  ---------  --------

* Volume 1     Y   ???????????  NTFS   Partition    100 MB  Healthy            

 

=========================================================

 

Disk: 0

Partition 2

Type  : 07

Hidden: No

Active: No

 

  Volume ###  Ltr  Label        Fs     Type        Size     Status     Info

  ----------  ---  -----------  -----  ----------  -------  ---------  --------

* Volume 2     C                NTFS   Partition     36 GB  Healthy            

 

=========================================================

 

Disk: 0

Partition 3

Type  : 07

Hidden: No

Active: No

 

  Volume ###  Ltr  Label        Fs     Type        Size     Status     Info

  ----------  ---  -----------  -----  ----------  -------  ---------  --------

* Volume 3     D                NTFS   Partition     58 GB  Healthy            

 

=========================================================

 

Disk: 0

Partition 4

Type  : 07

Hidden: No

Active: No

 

  Volume ###  Ltr  Label        Fs     Type        Size     Status     Info

  ----------  ---  -----------  -----  ----------  -------  ---------  --------

* Volume 4     E                NTFS   Partition     58 GB  Healthy            

 

=========================================================

 

Partitions of Disk 1:

===============

 

Disk ID: 00000001

 

  Partition ###  Type              Size     Offset

  -------------  ----------------  -------  -------

* Partition 1    Primary           3816 MB      0 B

 

=========================================================

 

Disk: 1

There is no partition selected.

 

There is no partition selected.

Please select a partition and try again.

 

=========================================================

============================== MBR Partition Table ==================

 

==============================

Partitions of Disk 0:

===============

Disk ID: 849A87BA

 

Partition 1:

=========

Hex: 8020210007DF130C0008000000200300

Active: YES

Type: 07 (NTFS)

Size: 100 MB

 

Partition 2:

=========

Hex: 00DF140C07FEFFFF0028030000208104

Active: NO

Type: 07 (NTFS)

Size: 36 GB

 

Partition 3:

=========

Hex: 00FEFFFF0FFEFFFF2D4A840489C0A70E

Active: NO

Type: OF (Extended)

Size: 117 GB

 

==============================

Partitions of Disk 1:

===============

Disk ID: 6F20736B

 

Partition 1:

=========

Hex: 6F74686572206D656469612EFF0D0A44

Active: NO

Type: 72

Size: 544 GB

 

Partition 2:

=========

Hex: 69736B206572726F72FF0D0A50726573

Active: NO

Type: 65

Size: 923 GB

 

Partition 3:

=========

Hex: 7320616E79206B657920746F20726573

Active: NO

Type: 79

Size: 923 GB

 

Partition 4:

=========

Hex: 746172740D0A0000000000ACCBD80000

Active: NO

Type: 0D

Size: 27 MB

 

 

Last Boot: 2013-04-13 23:07

 

==================== End Of Log ============================

Редактирано 16 април 201313 г. от VipKokata (преглед на промените)

Изтеглете прикачения файл =>   и го копирайте в свободната директория на флашката (където се намира и файла frst.exe)

Заредете отново в тази програма (от която изготвихте лог файла) и натиснете бутона Fix (веднъж!!!) и изчакайте.

Ще се създаде лог файла на флашката с името - Fixlog.txt
Публикувайте го в следващия си пост..!

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 11-04-2013

Ran by румпи at 2013-04-16 20:39:42 Run:1

Running from I:

 

ATTENTION: THE TOOL IS NOT RUN FROM RECOVERY ENVIRONMENT AND WILL NOT FUNCTION PROPERLY.

 

==============================================

 

C:WindowsSystem32Driversjecaypvc.sys not found.

C:Program FilesAsk.comUpdaterUpdater.exe moved successfully.

C:Program FilesMcAfee Security Scan3.0.207SSScheduler.exe  moved successfully.

C:Program FilesMcAfee Security Scan3.0.207McCHSvc.exe moved successfully.

 

==== End of Fixlog ==== Това го направих без да влизам в Repair Your Computer

Редактирано 16 април 201313 г. от VipKokata (преглед на промените)

Архивирайте папките C:Qoobox и C:FRST|Quarantine , качете ги на някой сървър (по ваше желание) и публикувайте линкове за да ги изтегля и пратя за анализ..!
 
Изтрийте вашето копие на Комбофикс (като изтриете иконата от вашия десктоп)...изтеглете ново свежо копие от тук и го запазете на десктопа си.Направете нова проверка по инструкцията от пост 2.

Редактирано 16 април 201313 г. от VipKokata (преглед на промените)

C:Qoobox/Quarantinex есет-а взе под карантина някакви 3 файла от папката MinoDLogin . 

Редактирано 18 април 201313 г. от VipKokata (преглед на промените)

Копирайте текста в карето на notepad и го запазвате с име CFScript.txt на десктопа си:

KILLALL::ClearJavaCache:: File::c:recyclerS-1-5-21-0243556031-888888379-781863308-17251proxzy1.exe011c:usersрумпиAppDataRoamingMicrosoftXpwswp.exec:usersрумпиAppDataRoamingtemp.binc:usersрумпиAppDataRoamingScreenSaverPro.scrc:usersрумпиAppDataRoaming5C7C.exec:usersрумпиAppDataRoaming51A2.exec:usersрумпиAppDataRoaming4504.exec:usersрумпиAppDataRoaming268B.exe Folder::c:program filesAsk.comc:program filesChatZum Toolbarc:program filesMcAfee Security Scan  Registry::[-HKEY_CLASSES_ROOTclsid{37d48d9c-3f7e-412f-b5bf-611be7ccfca1}][-HKEY_CLASSES_ROOTTBSB09850.TBSB09850.3][-HKEY_CLASSES_ROOTTypeLib{EC4085F2-8DB3-45a6-AD0B-CA289F3C5D7E}][-HKEY_CLASSES_ROOTTBSB09850.TBSB09850][HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]"proxzy021"=-"Xpwswp"=-"Screen Saver Pro 3.1"=- Driver::McComponentHostServiceDDS::uStart Page = hxxp://search.chatzum.com/mStart Page = hxxp://search.chatzum.com/ Firefox::FF - ProfilePath - c:usersрумпиAppDataRoamingMozillaFirefoxProfilesv71qqp7o.defaultFF - prefs.js: browser.search.selectedEngine - Search SaferFF - prefs.js: browser.startup.homepage - searchsafer.comFF - prefs.js: keyword.URL - hxxp://utils.chatzum.com/?url=FF - prefs.js: network.proxy.type - 0 

След съхранението преместете  CFScript.txt на иконата на ComboFix.exe

 

 

Генерирания рапорт копирайте  и го поставете в следващия си коментар...!

Ееее..разгеле...този път скрипта сработи....! Обаче искам да направим още проверки...!
 
Изтеглете Malwarebytes' Anti-Malware или от тук (не забравяйте да обновите програмата с нови дефиниции)
* Кликнете два пъти върху mbam-setup.exe, за да инсталирате програмата.
* Уверете се, че са поставени отметки на Update Malwarebytes' Anti-Malware и Launch Malwarebytes' Anti-Malware. След това кликнете на Finish.
* Ако има намерени обновявания, тя ще ги изтегли и инсталира.
* Стартирайте програмата и изберете "Perform Full Scan", след това кликнете на Scan.
* Сканирането ще отнеме малко време, затова моля да бъдете търпеливи.
* Когато сканирането завърши, кликнете на OK, след това Show Results, за да видите резултата
* Уверете се, че на всички редове има отметки, и кликнете на Remove Selected.
* Когато всичко бъде премахнато, в Notepad ще бъде отворен лог.
Копирайте този лог и го публикувайте в следващия си коментар по темата.

  Забележка: Ако MalwareBytes' Anti-Malware се затрудни в премахването на откритите вируси/заплахи, той ще поиска да рестартира компютъра Ви и по време на рестартирането да премахне проблемните вируси/заплахи. Ако бъдете попитани, потвърдете че желаете вашия компютър да бъде рестартиран.
 
 
Изтеглете OTL (от OldTimer) и го запазете на вашия десктоп.
Кликнете два пъти върху OTL.exe, за да стартирате програмата.
Сложете отметки преди следните неща:

• [*]

Scan all users [*]Lop check [*]Purity check

Под секцията Extra Registry, изберете Use SafeList
Кликнете на Run Scan и изчакайте да завърши сканирането. (може да отнеме 10-15 минути)
Когато завърши, публикувайте следните два лог файла:

• [*]

OTL.txt (намира се на вашия десктоп) [*]Extras.txt (ще Ви се отвори автоматично)

Редактирано 18 април 201313 г. от VipKokata (преглед на промените)

http://www.disc-tools.com/download/daemon Може ли да ъпдейтна тази програмка ? Обаче есет-а реве, че има вирус дали е фалшива тревога ?

Стартирайте отново OTL, копирайте (Copy) и поставете (Paste) скриптовия текст от текстовото поле по-долу под колонката Custom Scans/Fixes, като не забравяте да копирате скрипта 1 към 1, както и двете точки преди първия ред на скрипта.

:OTLIE - HKUS-1-5-21-1332344740-2044337220-1678987382-1000..SearchScopes{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.chatzu...q={searchTerms}IE - HKUS-1-5-21-1332344740-2044337220-1678987382-1000..SearchScopes{0FDA9AD2-F4A1-445A-B635-6F2332EF077C}: "URL" = http://websearch.ask...4B-CF721B732053IE - HKUS-1-5-21-1332344740-2044337220-1678987382-1000..SearchScopes{96bd48dd-741b-41ae-ac4a-aff96ba00f7e}: "URL" = http://search.chatzu...q={SearchTerms}IE - HKLM..SearchScopes{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.chatzu...q={searchTerms}FF - prefs.js..browser.search.defaultengine: "Ask.com"FF - prefs.js..browser.search.defaultenginename: "Ask.com"FF - prefs.js..browser.search.order.1: "Ask.com"[2012.05.16 16:55:51 | 000,002,400 | ---- | M] () -- C:UsersрумпиAppDataRoamingmozillafirefoxprofilesv71qqp7o.defaultsearchpluginsaskcom.xmlO2 - BHO: (TBSB09850 Class) - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:Program FilesChatZum ToolbartbunsvF96D.tmptbcore3.dll File not foundautorun.inf /alldrivesrecycler /alldrivesipconfig /flushdns /c:Commands[purity][emptytemp][clearallrestorepoints][Reboot]

След като въведете скрипта от цитата по-горе натиснете бутона, маркиран в червено: Run Fix
Windows ще се рестартира и ще се създаде лог файл. Публикувайте съдържанието му с Copy/Paste в следващия си коментар.

По време на фикса с инструмента, не използвайте компютъра си!

Здравей All processes killed

========== OTL ==========

Registry key HKEY_USERSS-1-5-21-1332344740-2044337220-1678987382-1000SoftwareMicrosoftInternet ExplorerSearchScopes{0633EE93-D776-472f-A0FF-E1416B8B2E3A} deleted successfully.

Registry key HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{0633EE93-D776-472f-A0FF-E1416B8B2E3A} not found.

Registry key HKEY_USERSS-1-5-21-1332344740-2044337220-1678987382-1000SoftwareMicrosoftInternet ExplorerSearchScopes{0FDA9AD2-F4A1-445A-B635-6F2332EF077C} deleted successfully.

Registry key HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{0FDA9AD2-F4A1-445A-B635-6F2332EF077C} not found.

Registry key HKEY_USERSS-1-5-21-1332344740-2044337220-1678987382-1000SoftwareMicrosoftInternet ExplorerSearchScopes{96bd48dd-741b-41ae-ac4a-aff96ba00f7e} deleted successfully.

Registry key HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{96bd48dd-741b-41ae-ac4a-aff96ba00f7e} not found.

Registry key HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerSearchScopes{0633EE93-D776-472f-A0FF-E1416B8B2E3A} deleted successfully.

Registry key HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{0633EE93-D776-472f-A0FF-E1416B8B2E3A} not found.

Prefs.js: "Ask.com" removed from browser.search.defaultengine

Prefs.js: "Ask.com" removed from browser.search.defaultenginename

Prefs.js: "Ask.com" removed from browser.search.order.1

C:UsersрумпиAppDataRoamingmozillafirefoxprofilesv71qqp7o.defaultsearchpluginsaskcom.xml moved successfully.

Registry key HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{FCBCCB87-9224-4B8D-B117-F56D924BEB18} deleted successfully.

Registry key HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{FCBCCB87-9224-4B8D-B117-F56D924BEB18} deleted successfully.

========== COMMANDS ==========

 

[EMPTYTEMP]

 

User: All Users

 

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

User: Public

->Temp folder emptied: 0 bytes

 

User: Ёєьяш

->Temp folder emptied: 0 bytes

 

User: румпи

->Temp folder emptied: 50730186 bytes

->Temporary Internet Files folder emptied: 618 bytes

->Java cache emptied: 0 bytes

->FireFox cache emptied: 233397945 bytes

->Google Chrome cache emptied: 8674724 bytes

->Flash cache emptied: 3205 bytes

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%System32 .tmp files removed: 0 bytes

%systemroot%System32drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 3273080 bytes

RecycleBin emptied: 0 bytes

 

Total Files Cleaned = 282,00 mb

 

Restore point Set: OTL Restore Point

 

OTL by OldTimer - Version 3.2.69.0 log created on 04212013_140238

 

FilesFolders moved on Reboot...

C:UsersрумпиAppDataLocalMicrosoftWindowsTemporary Internet Filescounters.dat moved successfully.

 

PendingFileRenameOperations files...

 

Registry entries deleted on Reboot...

Прекрасно...!Мисля че нещата сега са добре...!Вие наблюдавате ли някакви проблеми със системата ..?

Не, системата си върви много-добре ! А и вече по-малко рам харчи ( или на мен май така ми се струва ) . А двете папки да ги трия ли от локален диск C ? Става въпрос за тези две папки C:Qoobox и C:FRST|Quarantine. Да изтрия ли всички логове и всичките програми които сме използвали до сега ? И да оставя ли Malwarebytes Anti-Malware ? 

Редактирано 21 април 201313 г. от VipKokata (преглед на промените)

Не бъразай..имаме още малко работа...!
 
Изтеглете Security Check (автор: screen317) от тук или от тук и го запишете на десктопа.

• [*]Кликнете два пъти върху

SecurityCheck.exe и следвайте инструкциите. [*]Когато програмата завърши работата си, ще се отвори един текстов документ: checkup.txt. [*]Копирайте съдържанието на checkup.txt с Копирай (Copy) и с Постави (Paste) го поставете в следващия си коментар.

 

+ контролни сканирания с:
 
Изтеглете Malwarebytes' Anti-Malware или от тук (не забравяйте да обновите програмата с нови дефиниции)
* Кликнете два пъти върху mbam-setup.exe, за да инсталирате програмата.
* Уверете се, че са поставени отметки на Update Malwarebytes' Anti-Malware и Launch Malwarebytes' Anti-Malware. След това кликнете на Finish.
* Ако има намерени обновявания, тя ще ги изтегли и инсталира.
* Стартирайте програмата и изберете "Perform Full Scan", след това кликнете на Scan.
* Сканирането ще отнеме малко време, затова моля да бъдете търпеливи.
* Когато сканирането завърши, кликнете на OK, след това Show Results, за да видите резултата
* Уверете се, че на всички редове има отметки, и кликнете на Remove Selected.
* Когато всичко бъде премахнато, в Notepad ще бъде отворен лог.
Копирайте този лог и го публикувайте в следващия си коментар по темата.
  Забележка: Ако MalwareBytes' Anti-Malware се затрудни в премахването на откритите вируси/заплахи, той ще поиска да рестартира компютъра Ви и по време на рестартирането да премахне проблемните вируси/заплахи. Ако бъдете попитани, потвърдете че желаете вашия компютър да бъде рестартиран.

 

Изтеглете програмата: ESET Online Scanner

• [*]Стартирайте esetsmartinstaller_enu.exe [*]Сложете отметка на

YES, I accept the Terms of Use и изберете Start:

• [*]
  

• [*]Скенерът ще започне да изтегля компонентите, които са му необходими:
  

• [*]
  

Уверете се, че е премахната отметката от:

• [*]

Remove found threats

Уверете се че са маркирани следните позиции:

• [*]

Scan Archives

Кликнете върху Advanced Settings и маркирайте следните опции:

• [*]

Scan for potentially unwanted applications [*]Scan for potentially unsafe applications [*]Enable Anti-Stealth Technology

Накрая изберете Start
Скенерът ще започне да изтегля последните дефиниции.

• [*]След, като сканирането завърши изберете

Finish. [*]Отидете в: C:Program FilesESETESET Online Scanner [*]Отворете файла log.txt , копирайте съдържанието му и го поставете в следващия си коментар.