Проблемът е там, че температурата на процесора ми става много висока ако не правя нищо. Примерно съм си отворил някакъв 10 минутен клип в ютюб и след 5-6 мин. градусите рязко скачат. Ако почна да мърдам мишката или тръгна да работя с браузъра или отворя друга програма температурите падат. С лаптоп на самсунг съм. Същата дивотия стана преди няколко месеца и бях направил една тема. Случих на доста учтив колега, който ми препоръча използване на OTL.ехе

 

Проблемът изчезна. Решиш да пробвам пак, но този път не става и имам същия проблем, но не се оправя по същия начин.

 

Ето информацията от DDS лог файла.

DDS (Ver_2011-09-30.01) - NTFS_x86 Internet Explorer: 9.10.9200.16540  BrowserJavaVersion: 10.10.2Run by boywindows at 23:59:38 on 2013-05-02Microsoft Windows 7 Professional   6.1.7601.1.1252.1.1033.18.2732.1573 [GMT 3:00].SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}.============== Running Processes ================.C:Windowssystem32wininit.exeC:Windowssystem32lsm.exeC:Windowssystem32nvvsvc.exeC:Program FilesNVIDIA CorporationDisplaynvxdsync.exeC:Windowssystem32nvvsvc.exeC:WindowsSystem32spoolsv.exeC:Program FilesCommon FilesAdobeARM1.0armsvc.exeC:Windowssystem32taskhost.exeC:Windowssystem32Dwm.exeC:Program FilesCommon FilesAppleMobile Device SupportAppleMobileDeviceService.exeC:WindowsExplorer.EXEC:Program FilesApplication UpdaterApplicationUpdater.exeC:Program FilesBonjourmDNSResponder.exeC:Program FilesPC Auto ShutdownShutdownService.exeC:Program FilesTeamViewerVersion8TeamViewer_Service.exec:Program FilesCommon FilesMicrosoft SharedWindows LiveWLIDSVC.EXEC:Program FilesYontooY2Desktop.Updater.exec:Program FilesCommon FilesMicrosoft SharedWindows LiveWLIDSvcM.exeC:Windowssystem32SearchIndexer.exeC:Program FilesRealtekAudioHDARtHDVCpl.exeC:WindowsSystem32igfxtray.exeC:WindowsSystem32hkcmd.exeC:WindowsSystem32igfxpers.exeC:UsersboywindowsAppDataRoamingSoftware Informershockwave.exeC:Program FilesNVIDIA CorporationDisplaynvtray.exeC:UsersboywindowsAppDataRoamingYontooYontooDesktop.exeC:Windowssystem32taskhost.exeC:Program FilesMozilla Firefoxfirefox.exeC:Program FilesMozilla Firefoxplugin-container.exeC:Windowssystem32MacromedFlashFlashPlayerPlugin_11_6_602_180.exeC:Windowssystem32MacromedFlashFlashPlayerPlugin_11_6_602_180.exeC:Program FilesIntelBluetoothHSBTHSAmpPalService.exeC:Program FilesIntelBluetoothHSBTHSSecurityMgr.exeC:Program FilesIntelIntel(R) Management Engine ComponentsLMSLMS.exeC:Program FilesNVIDIA CorporationNVIDIA Update Coredaemonu.exeC:Program FilesIntelIntel(R) Management Engine ComponentsUNSUNS.exeC:Windowssystem32SearchProtocolHost.exeC:Windowssystem32SearchFilterHost.exeC:Windowssystem32conhost.exeC:Windowssystem32wbemwmiprvse.exeC:Windowssystem32svchost.exe -k DcomLaunchC:Windowssystem32svchost.exe -k RPCSSC:WindowsSystem32svchost.exe -k LocalServiceNetworkRestrictedC:WindowsSystem32svchost.exe -k LocalSystemNetworkRestrictedC:Windowssystem32svchost.exe -k LocalServiceC:Windowssystem32svchost.exe -k netsvcsC:Windowssystem32svchost.exe -k GPSvcGroupC:Windowssystem32svchost.exe -k NetworkServiceC:Windowssystem32svchost.exe -k LocalServiceNoNetworkC:Windowssystem32svchost.exe -k imgsvcC:Windowssystem32svchost.exe -k bthsvcsC:Windowssystem32svchost.exe -k LocalServiceAndNoImpersonationC:WindowsSystem32svchost.exe -k secsvcs.============== Pseudo HJT Report ===============.uStart Page = hxxp://www.search.ask.com/?l=dis&o=15003uURLSearchHooks: IObit Apps Toolbar: {03EB0E9C-7A91-4381-A220-9B52B641CDB1} - c:program filesiobit apps toolbarie7.0iobitappsToolbarIE.dlldURLSearchHooks: IObit Apps Toolbar: {03EB0E9C-7A91-4381-A220-9B52B641CDB1} - c:program filesiobit apps toolbarie7.0iobitappsToolbarIE.dllBHO: IObit Apps Toolbar: {03EB0E9C-7A91-4381-A220-9B52B641CDB1} - c:program filesiobit apps toolbarie7.0iobitappsToolbarIE.dllBHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:program filescommon filesadobeacrobatactivexAcroIEHelperShim.dllBHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - c:program filesmicrosoft officeoffice14GROOVEEX.DLLBHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:program filesjavajre7binssv.dllBHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:program filescommon filesmicrosoft sharedwindows liveWindowsLiveLogin.dllBHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - c:program filesmicrosoft officeoffice14URLREDIR.DLLBHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:program filesjavajre7binjp2ssv.dllBHO: Yontoo: {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - c:program filesyontooYontooIEClient.dllTB: IObit Apps Toolbar: {03EB0E9C-7A91-4381-A220-9B52B641CDB1} - c:program filesiobit apps toolbarie7.0iobitappsToolbarIE.dlluRun: [Keyboard Inf.] c:usersboywindowsappdataroamingsoftware informershockwave.exeuRun: [Google Update] "c:usersboywindowsappdatalocalgoogleupdateGoogleUpdate.exe" /cuRun: [Yontoo Desktop] "c:usersboywindowsappdataroamingyontooYontooDesktop.exe"mRun: [RtHDVCpl] c:program filesrealtekaudiohdaRtHDVCpl.exe -smRun: [Microsoft Windows Service Host!] c:windowsexplorer.exe "mRun: [Adobe ARM] "c:program filescommon filesadobearm1.0AdobeARM.exe"mRun: [IgfxTray] c:windowssystem32igfxtray.exemRun: [HotKeysCmds] c:windowssystem32hkcmd.exemRun: [Persistence] c:windowssystem32igfxpers.exemRun: [BCSSync] "c:program filesmicrosoft officeoffice14BCSSync.exe" /DelayServicesmRun: [APSDaemon] "c:program filescommon filesappleapple application supportAPSDaemon.exe"mPolicies-System: ConsentPromptBehaviorAdmin = dword:0mPolicies-System: ConsentPromptBehaviorUser = dword:3mPolicies-System: EnableUIADesktopToggle = dword:0IE: E&xport to Microsoft Excel - c:progra~1micros~1office14EXCEL.EXE/3000IE: Se&nd to OneNote - c:progra~1micros~1office14ONBttnIE.dll/105IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:program filesmicrosoft officeoffice14ONBttnIE.dllIE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - c:program filesmicrosoft officeoffice14ONBttnIELinkedNotes.dll.INFO: HKCU has more than 50 listed domains.If you wish to scan all of them, select the 'Force scan all domains' option..TCP: Interfaces{088ED2E2-8F07-4749-B8E5-1B6713257FE7} : DHCPNameServer = 192.168.1.1TCP: Interfaces{088ED2E2-8F07-4749-B8E5-1B6713257FE7}2496F6B61627075647022474D27657563747 : DHCPNameServer = 91.211.191.1TCP: Interfaces{088ED2E2-8F07-4749-B8E5-1B6713257FE7}6594651434F4D4F5E45445 : DHCPNameServer = 192.168.1.1TCP: Interfaces{088ED2E2-8F07-4749-B8E5-1B6713257FE7}A4F627F6 : DHCPNameServer = 192.168.1.1TCP: Interfaces{088ED2E2-8F07-4749-B8E5-1B6713257FE7}E494B494 : DHCPNameServer = 89.215.233.2 89.215.246.40TCP: Interfaces{088ED2E2-8F07-4749-B8E5-1B6713257FE7}F4D465 : DHCPNameServer = 192.168.1.1TCP: Interfaces{A5A5B288-E30A-4336-BF55-B79686B2861D} : NameServer = 95.111.36.51,89.190.192.247TCP: Interfaces{AC282E77-31F5-4811-893B-2C58B60358BD} : NameServer = 89.215.233.2 89.215.246.40Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:program filescommon filesmicrosoft sharedoffice14MSOXMLMF.DLLHandler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:program filescommon filesskypeSkype4COM.dllNotify: igfxcui - igfxdev.dllSSODL: WebCheck - <orphaned>SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - c:program filesmicrosoft officeoffice14GROOVEEX.DLLLSA: Security Packages =  kerberos msv1_0 schannel wdigest tspkg pku2u livessp.================= FIREFOX ===================.FF - ProfilePath - c:usersboywindowsappdataroamingmozillafirefoxprofiles04e2rub9.default-1361214403999FF - prefs.js: browser.startup.homepage - hxxps://www.google.com/FF - plugin: c:progra~1micros~1office14NPAUTHZ.DLLFF - plugin: c:progra~1micros~1office14NPSPWRAP.DLLFF - plugin: c:program filesadobereader 10.0readerairnppdf32.dllFF - plugin: c:program filescommon filesadobeoobepdappccmutilitiesnpAdobeAAMDetect32.dllFF - plugin: c:program filescommon filesadobeoobepdappccmutilitiesnpAdobeAAMDetect64.dllFF - plugin: c:program filesjavajre7binplugin2npjp2.dllFF - plugin: c:program filesmozilla firefoxpluginsnpwachk.dllFF - plugin: c:program filesubisoftubisoft game launchernpuplaypc.dllFF - plugin: c:program filesubisoftubisoft game launchernpuplaypchub.dllFF - plugin: c:usersboywindowsappdatalocalgoogleupdate1.3.21.145npGoogleUpdate3.dllFF - plugin: c:windowssystem32macromedflashNPSWF32_11_6_602_180.dll.---- FIREFOX POLICIES ----FF - user.js: extentions.y2layers.installId - aaf0c8cf-082e-4364-b379-b7a6ec3d4a39FF - user.js: extentions.y2layers.defaultEnableAppsList - twittube,buzzdock,YontooNewOffersFF - user.js: extensions.delta.tlbrSrchUrl - FF - user.js: extensions.delta.id - d41598e3000000000000000000000000FF - user.js: extensions.delta.appId - {C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}FF - user.js: extensions.delta.instlDay - 15825FF - user.js: extensions.delta.vrsn - 1.8.16.16FF - user.js: extensions.delta.vrsni - 1.8.16.16FF - user.js: extensions.delta.vrsnTs - 1.8.16.1622:47:05FF - user.js: extensions.delta.prtnrId - deltaFF - user.js: extensions.delta.prdct - deltaFF - user.js: extensions.delta.aflt - babsstFF - user.js: extensions.delta.smplGrp - noneFF - user.js: extensions.delta.tlbrId - baseFF - user.js: extensions.delta.instlRef - sstFF - user.js: extensions.delta.dfltLng - enFF - user.js: extensions.delta.excTlbr - falseFF - user.js: extensions.delta.ffxUnstlRst - trueFF - user.js: extensions.delta.admin - falseFF - user.js: extensions.delta.autoRvrt - falseFF - user.js: extensions.delta.rvrt - falseFF - user.js: extensions.delta.newTab - false.============= SERVICES / DRIVERS ===============.R0 nvpciflt;nvpciflt;c:windowssystem32driversnvpciflt.sys [2013-4-27 25376]R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:windowssystem32driversdtsoftbus01.sys [2013-1-1 242240]R1 vwififlt;Virtual WiFi Filter Driver;c:windowssystem32driversvwififlt.sys [2009-7-14 48128]R2 AdobeARMservice;Adobe Acrobat Update Service;c:program filescommon filesadobearm1.0armsvc.exe [2012-12-18 65192]R2 AMPPALR3;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Service;c:program filesintelbluetoothhsBTHSAmpPalService.exe [2011-12-5 509440]R2 Application Updater;Application Updater;c:program filesapplication updaterApplicationUpdater.exe [2013-2-23 805752]R2 BTHSSecurityMgr;Intel(R) Centrino(R) Wireless Bluetooth(R) 3.0 + High Speed Security Service;c:program filesintelbluetoothhsBTHSSecurityMgr.exe [2011-12-5 104208]R2 nvUpdatusService;NVIDIA Update Service Daemon;c:program filesnvidia corporationnvidia update coredaemonu.exe [2013-4-27 1364256]R2 PCAutoShutdown_Service;PCAutoShutdown_Service;c:program filespc auto shutdownShutdownService.exe [2013-3-19 442136]R2 TeamViewer8;TeamViewer 8;c:program filesteamviewerversion8TeamViewer_Service.exe [2013-2-26 3467768]R2 UNS;Intel(R) Management and Security Application User Notification Service;c:program filesintelintel(r) management engine componentsunsUNS.exe [2012-9-5 2656536]R2 Yontoo Desktop Updater;Yontoo Desktop Updater;c:program filesyontooY2Desktop.Updater.exe [2013-4-30 23552]R3 AMPPAL;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Virtual Adapter;c:windowssystem32driversAmpPal.sys [2011-12-5 141312]R3 btmhsf;btmhsf;c:windowssystem32driversbtmhsf.sys [2011-11-15 263680]R3 iBtFltCoex;iBtFltCoex;c:windowssystem32driversiBtFltCoex.sys [2011-12-9 47616]R3 IntcDAud;Intel(R) Display Audio;c:windowssystem32driversIntcDAud.sys [2011-12-6 280576]R3 MEI;Intel(R) Management Engine Interface;c:windowssystem32driversHECI.sys [2012-9-5 41088]R3 NETwNs32;___ Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 32 Bit;c:windowssystem32driversNetwsn00.sys [2012-4-18 10339840]R3 RTL8167;Realtek 8167 NT Driver;c:windowssystem32driversRt86win7.sys [2012-9-5 381032]S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:windowsmicrosoft.netframeworkv4.0.30319mscorsvw.exe [2010-3-18 130384]S2 SkypeUpdate;Skype Updater;c:program filesskypeupdaterUpdater.exe [2013-2-28 161384]S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:windowssystem32macromedflashFlashPlayerUpdateService.exe [2012-9-5 253656]S3 AMPPALP;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Protocol;c:windowssystem32driversAmpPal.sys [2011-12-5 141312]S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:windowssystem32driversb57nd60x.sys [2009-7-14 229888]S3 cphs;Intel(R) Content Protection HECI Service;c:windowssystem32IntelCpHeciSvc.exe [2012-12-14 277616]S3 Futuremark SystemInfo Service;Futuremark SystemInfo Service;c:program filesfuturemarkfuturemark systeminfoFMSISvc.exe [2012-9-5 150464]S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:program filesmicrosoft officeoffice14GROOVE.EXE [2012-9-20 30785672]S3 MozillaMaintenance;Mozilla Maintenance Service;c:program filesmozilla maintenance servicemaintenanceservice.exe [2012-10-23 115608]S3 osppsvc;Office Software Protection Platform;c:program filescommon filesmicrosoft sharedofficesoftwareprotectionplatformOSPPSVC.EXE [2010-1-9 4640000]S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:windowssystem32driversrdpvideominiport.sys [2012-11-27 14848]S3 StorSvc;Storage Service;c:windowssystem32svchost.exe -k LocalSystemNetworkRestricted [2009-7-14 20992]S3 SwitchBoard;Adobe SwitchBoard;c:program filescommon filesadobeswitchboardSwitchBoard.exe [2010-2-19 517096]S3 TsUsbFlt;TsUsbFlt;c:windowssystem32driversTsUsbFlt.sys [2012-11-27 49664]S3 WatAdminSvc;Windows Activation Technologies Service;c:windowssystem32watWatAdminSvc.exe [2012-9-6 1343400]S4 SearchIndexer;Search Indexer;c:windowssystem32svchost.exe -k netsvcs [2009-7-14 20992].=============== File Associations ===============.FileExt: .txt: Applicationsfirefox.exe="c:program filesmozilla firefoxfirefox.exe" "%1" [UserChoice].=============== Created Last 30 ================.2013-05-02 19:54:34	--------	d-----w-	C:_OTL2013-04-30 20:07:21	--------	d-----w-	c:program filesLSHunter.TV2013-04-30 19:46:32	--------	d-----w-	c:usersboywindowsappdataroamingBabylon2013-04-30 19:46:32	--------	d-----w-	c:programdataBabylon2013-04-30 19:46:17	--------	d-----w-	c:usersboywindowsappdataroamingYontoo2013-04-30 19:46:17	--------	d-----w-	c:program filesYontoo2013-04-30 19:46:11	--------	d-----w-	c:programdataTarma Installer2013-04-30 19:45:52	--------	d-----w-	c:program fileshdvidcodec.com2013-04-30 08:30:51	6906960	----a-w-	c:programdatamicrosoftwindows defenderdefinition updates{7febda86-7829-485c-a8ab-c455ee6f40d8}mpengine.dll2013-04-29 20:12:43	--------	d-----w-	c:programdata188F1432-103A-4ffb-80F1-36B633C5C9E12013-04-27 17:22:59	--------	d-----w-	c:program filesPoker Night 22013-04-27 10:08:54	--------	d-----w-	c:usersboywindowsappdatalocalOpera2013-04-26 21:25:50	--------	d-----w-	c:windowssystem32NV2013-04-26 21:24:20	869152	----a-w-	c:windowssystem32nv3dappshext.dll2013-04-26 21:24:20	66560	----a-w-	c:windowssystem32nv3dappshextr.dll2013-04-26 21:24:20	640288	----a-w-	c:windowssystem32nvvsvc.exe2013-04-26 21:24:20	62752	----a-w-	c:windowssystem32nvshext.dll2013-04-26 21:24:20	4185888	----a-w-	c:windowssystem32nvcpl.dll2013-04-26 21:24:20	3122645	----a-w-	c:windowssystem32nvcoproc.bin2013-04-26 21:24:20	3042080	----a-w-	c:windowssystem32nvsvc.dll2013-04-26 21:24:20	2555168	----a-w-	c:windowssystem32nvsvcr.dll2013-04-26 21:24:20	223008	----a-w-	c:windowssystem32nvmctray.dll2013-04-26 21:23:38	--------	d-----w-	c:programdataNVIDIA Corporation2013-04-24 04:15:34	1211752	----a-w-	c:windowssystem32driversntfs.sys2013-04-23 17:12:43	--------	d-----w-	c:usersboywindowsappdatalocalApple Computer2013-04-23 17:10:29	--------	d-----w-	c:usersboywindowsappdatalocalApple2013-04-23 17:10:02	--------	d-----w-	c:program filesBonjour2013-04-22 18:14:02	--------	d-----w-	c:program filesRAR Password Recovery Professional2013-04-18 19:10:54	--------	d-----w-	C:Games2013-04-10 06:10:07	2706432	----a-w-	c:windowssystem32mshtml.tlb2013-04-10 05:21:07	2347008	----a-w-	c:windowssystem32win32k.sys2013-04-10 05:21:06	196328	----a-w-	c:windowssystem32driversfvevol.sys2013-04-10 05:21:03	3968856	----a-w-	c:windowssystem32ntkrnlpa.exe2013-04-10 05:21:03	3913560	----a-w-	c:windowssystem32ntoskrnl.exe2013-04-10 05:21:02	69632	----a-w-	c:windowssystem32smss.exe2013-04-10 05:21:02	38912	----a-w-	c:windowssystem32csrsrv.dll.==================== Find3M  ====================.2013-03-18 22:13:00	745472	----a-w-	c:windowssystem32MsSpellCheckingFacility.exe2013-03-18 22:13:00	185344	----a-w-	c:windowssystem32elshyph.dll2013-03-13 18:39:12	73432	----a-w-	c:windowssystem32FlashPlayerCPLApp.cpl2013-03-13 18:39:12	693976	----a-w-	c:windowssystem32FlashPlayerApp.exe2013-03-11 22:10:56	237088	------w-	c:windowssystem32MpSigStub.exe2013-02-26 06:55:22	65536	----a-w-	c:windowssystem32frapsvid.dll2013-02-21 10:30:16	1766912	----a-w-	c:windowssystem32wininet.dll2013-02-21 10:29:39	2877440	----a-w-	c:windowssystem32jscript9.dll2013-02-21 10:29:37	61440	----a-w-	c:windowssystem32iesetup.dll2013-02-21 10:29:37	109056	----a-w-	c:windowssystem32iesysprep.dll2013-02-19 11:10:53	71680	----a-w-	c:windowssystem32RegisterIEPKEYs.exe2013-02-12 04:48:31	474112	----a-w-	c:windowsapppatchAcSpecfc.dll2013-02-12 04:48:26	2176512	----a-w-	c:windowsapppatchAcGenral.dll2013-02-12 03:32:45	15872	----a-w-	c:windowssystem32driversusb8023.sys.============= FINISH:  0:01:02.62 ===============

Всякаква помощ е добре дошла!

Редактирано 3 май 201313 г. от B-boy[StyLe] (преглед на промените)

OTL не е виновен в случая...просто скриптовете се пишат индивидуално за всеки един случай. Не може с един скрипт да се решат всички проблеми универсално.

Аз видях къде е проблема, но искам да направим една по-солидна проверка този път!

 

Здравейте,

 

 

1. Изтеглете ComboFix от BleepingComputer и го запазете (бутон Save -> Save as) ComboFix на вашия десктоп:




След приключване на изтеглянето на ComboFix, иконката на програмата би трябвало да изглежда така:


2.Затворете всички работещи приложения, отворени прозорци и програми работещи във фонов режим. Спрете временно защитата в реално време на антивирусната програма и на другите програми за сигурност, ако има такива.


3. Стартирайте с двоен клик Combofix.exe. Изберете YES, за да се съгласите с условията за използване на програмата. Важно: По време на работата на ComboFix не бива да се движи мишката и да се натискат клавиши от клавиатурата. Просто търпеливо оставете ComboFix да си свърши работата, без да използвате компютъра за други цели.


4. Ако получите предупреждение от UAC, съгласете се.


5 ComboFix ще спре временно Интернет връзката, но след като приключи работата на програмата тази връзка ще бъде възстановена автоматично. ComboFix ще сканира за проблеми и за заразени файлове, като това може да отнеме известно време. Моля да бъдете търпеливи. Ако има проблем с Интернет връзката след приключване на работата на Combofix, моля да прочетете това: Manually restoring the Internet connection section.


6 Когато работата на ComboFix приключи, ще се появи текстов документ (log) в Notepad:



Копирайте с (Copy) и поставете с (Paste) съдържанието на лога в следващия си коментар.

 

Забележка: Ако се появи следното съобщение при отварянето на различни програми след завършване на сканирането с Combofix - "illegal operation on a registry key that has been marked for deletion." просто рестартирайте компютъра още веднъж и то ще изчезне.

 

 

По време на сканирането не използвайте компютъра си !

Ето информацията от log файла.

ComboFix 13-05-01.03 - boywindows 05/03/2013  10:07:06.1.2 - x86Microsoft Windows 7 Professional   6.1.7601.1.1252.1.1033.18.2732.1879 [GMT 3:00]Running from: c:usersboywindowsDownloadsComboFix.exeSP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}..(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))..c:usersboywindowsAppDataRoamingAdobeshock.exec:usersboywindowsAppDataRoamingAdobewnms.exec:windowssystem32frapsvid.dllc:windowssystem32ubiorbitapi_r2_loader.dllc:windowssystem32updatec:windowssystem32updatediablo121016.clc:windowssystem32updatediakgcn121016.clc:windowssystem32updatelibcurl-4.dllc:windowssystem32updatelibeay32.dllc:windowssystem32updatelibidn-11.dllc:windowssystem32updatelibusb-1.0.dllc:windowssystem32updatephatk121016.clc:windowssystem32updatepoclbm121016.clc:windowssystem32updatepoclbm121016GeForce 315Mv1w256l4.binc:windowssystem32updatepthreadGC2.dllc:windowssystem32updatescrypt121016.clc:windowssystem32updatessleay32.dllc:windowssystem32updatezlib1.dll..(((((((((((((((((((((((((   Files Created from 2013-04-03 to 2013-05-03  )))))))))))))))))))))))))))))))..2013-05-03 07:16 . 2013-05-03 07:18	--------	d-----w-	c:usersboywindowsAppDataLocaltemp2013-05-03 07:16 . 2013-05-03 07:16	--------	d-----w-	c:usersDefaultAppDataLocaltemp2013-05-03 07:14 . 2013-05-03 07:14	60872	----a-w-	c:programdataMicrosoftWindows DefenderDefinition Updates{0AFA2977-8C8C-4FD3-A529-1EE6BABF95AF}offreg.dll2013-05-03 05:42 . 2013-04-10 03:08	6906960	----a-w-	c:programdataMicrosoftWindows DefenderDefinition Updates{0AFA2977-8C8C-4FD3-A529-1EE6BABF95AF}mpengine.dll2013-05-02 19:54 . 2013-05-02 19:54	--------	d-----w-	C:_OTL2013-04-30 20:07 . 2013-04-30 20:12	--------	d-----w-	c:program filesLSHunter.TV2013-04-30 19:46 . 2013-04-30 19:46	--------	d-----w-	c:usersboywindowsAppDataRoamingBabylon2013-04-30 19:46 . 2013-04-30 19:46	--------	d-----w-	c:programdataBabylon2013-04-30 19:46 . 2013-05-02 20:52	--------	d-----w-	c:usersboywindowsAppDataRoamingYontoo2013-04-30 19:46 . 2013-04-30 19:46	--------	d-----w-	c:program filesYontoo2013-04-30 19:46 . 2013-04-30 20:12	--------	d-----w-	c:programdataTarma Installer2013-04-30 19:45 . 2013-04-30 19:48	--------	d-----w-	c:program fileshdvidcodec.com2013-04-29 20:12 . 2013-04-29 20:43	--------	d-----w-	c:programdata188F1432-103A-4ffb-80F1-36B633C5C9E12013-04-27 17:22 . 2013-04-27 17:23	--------	d-----w-	c:program filesPoker Night 22013-04-27 10:08 . 2013-04-27 10:08	--------	d-----w-	c:usersboywindowsAppDataLocalOpera2013-04-27 10:08 . 2013-04-27 10:08	--------	d-----w-	c:program filesOpera2013-04-27 10:03 . 2013-04-27 10:03	--------	d-----w-	c:program filesCommon FilesSkype2013-04-26 21:25 . 2013-04-26 21:25	--------	d-----w-	c:windowssystem32NV2013-04-26 21:24 . 2013-05-03 05:40	--------	d-----w-	c:usersUpdatusUser.boywindows-PC2013-04-26 21:24 . 2013-04-19 02:23	4185888	----a-w-	c:windowssystem32nvcpl.dll2013-04-26 21:24 . 2013-04-19 02:23	3042080	----a-w-	c:windowssystem32nvsvc.dll2013-04-26 21:24 . 2013-04-19 02:23	640288	----a-w-	c:windowssystem32nvvsvc.exe2013-04-26 21:24 . 2013-04-19 02:23	869152	----a-w-	c:windowssystem32nv3dappshext.dll2013-04-26 21:24 . 2013-04-19 02:23	66560	----a-w-	c:windowssystem32nv3dappshextr.dll2013-04-26 21:24 . 2013-04-19 02:23	62752	----a-w-	c:windowssystem32nvshext.dll2013-04-26 21:24 . 2013-04-19 02:23	2555168	----a-w-	c:windowssystem32nvsvcr.dll2013-04-26 21:24 . 2013-04-19 02:23	223008	----a-w-	c:windowssystem32nvmctray.dll2013-04-26 21:24 . 2013-04-18 00:03	3122645	----a-w-	c:windowssystem32nvcoproc.bin2013-04-26 21:23 . 2013-04-26 21:23	--------	d-----w-	c:programdataNVIDIA Corporation2013-04-24 04:15 . 2013-04-12 13:45	1211752	----a-w-	c:windowssystem32driversntfs.sys2013-04-23 17:12 . 2013-04-23 17:12	--------	d-----w-	c:usersboywindowsAppDataLocalApple Computer2013-04-23 17:11 . 2013-04-29 20:43	--------	dc----w-	c:windowssystem32DRVSTORE2013-04-23 17:11 . 2013-04-23 17:11	--------	d-----w-	c:programdataApple Computer2013-04-23 17:10 . 2013-04-23 17:10	--------	d-----w-	c:usersboywindowsAppDataLocalApple2013-04-23 17:10 . 2013-04-23 17:10	--------	d-----w-	c:program filesApple Software Update2013-04-23 17:10 . 2013-04-23 17:10	--------	d-----w-	c:program filesBonjour2013-04-23 17:09 . 2013-04-29 20:43	--------	d-----w-	c:program filesCommon FilesApple2013-04-23 17:09 . 2013-04-23 17:10	--------	d-----w-	c:programdataApple2013-04-22 18:14 . 2013-04-22 18:17	--------	d-----w-	c:program filesRAR Password Recovery Professional2013-04-18 19:10 . 2013-04-30 20:09	--------	d-----w-	C:Games2013-04-10 05:21 . 2013-03-01 03:09	2347008	----a-w-	c:windowssystem32win32k.sys2013-04-10 05:21 . 2013-01-24 04:47	196328	----a-w-	c:windowssystem32driversfvevol.sys2013-04-10 05:21 . 2013-03-19 05:04	3968856	----a-w-	c:windowssystem32ntkrnlpa.exe2013-04-10 05:21 . 2013-03-19 05:04	3913560	----a-w-	c:windowssystem32ntoskrnl.exe2013-04-10 05:21 . 2013-03-19 04:48	38912	----a-w-	c:windowssystem32csrsrv.dll2013-04-10 05:21 . 2013-03-19 02:49	69632	----a-w-	c:windowssystem32smss.exe...((((((((((((((((((((((((((((((((((((((((   Find3M Report   )))))))))))))))))))))))))))))))))))))))))))))))))))).2013-05-01 23:06 . 2012-09-05 18:14	238872	------w-	c:windowssystem32MpSigStub.exe2013-03-18 22:13 . 2013-03-18 22:13	745472	----a-w-	c:windowssystem32MsSpellCheckingFacility.exe2013-03-18 22:13 . 2013-03-18 22:13	185344	----a-w-	c:windowssystem32elshyph.dll2013-03-18 22:12 . 2013-03-18 22:12	73728	----a-w-	c:windowssystem32SetIEInstalledDate.exe2013-03-18 22:12 . 2013-03-18 22:12	719360	----a-w-	c:windowssystem32mshtmlmedia.dll2013-03-18 22:12 . 2013-03-18 22:12	61952	----a-w-	c:windowssystem32tdc.ocx2013-03-18 22:12 . 2013-03-18 22:12	523264	----a-w-	c:windowssystem32vbscript.dll2013-03-18 22:12 . 2013-03-18 22:12	48640	----a-w-	c:windowssystem32mshtmler.dll2013-03-18 22:12 . 2013-03-18 22:12	38400	----a-w-	c:windowssystem32imgutil.dll2013-03-18 22:12 . 2013-03-18 22:12	361984	----a-w-	c:windowssystem32html.iec2013-03-18 22:12 . 2013-03-18 22:12	23040	----a-w-	c:windowssystem32licmgr10.dll2013-03-18 22:12 . 2013-03-18 22:12	158720	----a-w-	c:windowssystem32msls31.dll2013-03-18 22:12 . 2013-03-18 22:12	150528	----a-w-	c:windowssystem32iexpress.exe2013-03-18 22:12 . 2013-03-18 22:12	1441280	----a-w-	c:windowssystem32inetcpl.cpl2013-03-18 22:12 . 2013-03-18 22:12	138752	----a-w-	c:windowssystem32wextract.exe2013-03-18 22:12 . 2013-03-18 22:12	137216	----a-w-	c:windowssystem32ieUnatt.exe2013-03-18 22:12 . 2013-03-18 22:12	12800	----a-w-	c:windowssystem32mshta.exe2013-03-18 22:12 . 2013-03-18 22:12	110592	----a-w-	c:windowssystem32IEAdvpack.dll2013-03-13 18:39 . 2012-09-05 18:07	73432	----a-w-	c:windowssystem32FlashPlayerCPLApp.cpl2013-03-13 18:39 . 2012-09-05 18:07	693976	----a-w-	c:windowssystem32FlashPlayerApp.exe2013-02-12 04:48 . 2013-03-13 18:00	474112	----a-w-	c:windowsapppatchAcSpecfc.dll2013-02-12 04:48 . 2013-03-13 18:00	2176512	----a-w-	c:windowsapppatchAcGenral.dll2013-02-12 03:32 . 2013-03-15 04:46	15872	----a-w-	c:windowssystem32driversusb8023.sys2013-02-09 22:22 . 2009-08-18 09:30	564632	----a-w-	c:programdataMicrosoftIdentityCRLproductionwlidui.dll2013-02-09 22:22 . 2009-08-18 09:24	19696	----a-w-	c:programdataMicrosoftIdentityCRLproductionppcrlconfig600.dll2013-04-12 06:13 . 2013-04-12 06:13	263064	----a-w-	c:program filesmozilla firefoxcomponentsbrowsercomps.dll..(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shown REGEDIT4.[HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerURLSearchHooks]"{03EB0E9C-7A91-4381-A220-9B52B641CDB1}"= "c:program filesIObit Apps ToolbarIE7.0iobitappsToolbarIE.dll" [2013-02-23 1352512].[HKEY_CLASSES_ROOTclsid{03eb0e9c-7a91-4381-a220-9b52b641cdb1}].[HKEY_LOCAL_MACHINESOFTWARE~Browser Helper Objects{03EB0E9C-7A91-4381-A220-9B52B641CDB1}]2013-02-23 17:17	1352512	----a-w-	c:program filesIObit Apps ToolbarIE7.0iobitappsToolbarIE.dll.[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]"{03EB0E9C-7A91-4381-A220-9B52B641CDB1}"= "c:program filesIObit Apps ToolbarIE7.0iobitappsToolbarIE.dll" [2013-02-23 1352512].[HKEY_CLASSES_ROOTclsid{03eb0e9c-7a91-4381-a220-9b52b641cdb1}].[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]"Keyboard Inf."="c:usersboywindowsAppDataRoamingSoftware Informershockwave.exe" [2013-03-26 5127680]"Yontoo Desktop"="c:usersboywindowsAppDataRoamingYontooYontooDesktop.exe" [2013-04-17 42784].[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]"RtHDVCpl"="c:program filesRealtekAudioHDARtHDVCpl.exe" [2011-07-12 10754664]"Microsoft Windows Service Host!"="c:windowsexplorer.exe" [2011-02-25 2616320]"Adobe ARM"="c:program filesCommon FilesAdobeARM1.0AdobeARM.exe" [2012-12-03 946352]"IgfxTray"="c:windowssystem32igfxtray.exe" [2012-12-14 146032]"HotKeysCmds"="c:windowssystem32hkcmd.exe" [2012-12-14 181360]"Persistence"="c:windowssystem32igfxpers.exe" [2012-12-14 190064]"BCSSync"="c:program filesMicrosoft OfficeOffice14BCSSync.exe" [2010-03-13 91520]"APSDaemon"="c:program filesCommon FilesAppleApple Application SupportAPSDaemon.exe" [2013-01-28 59720].[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionpoliciessystem]"ConsentPromptBehaviorAdmin"= 0 (0x0)"ConsentPromptBehaviorUser"= 3 (0x3)"EnableUIADesktopToggle"= 0 (0x0).[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversionwindows]"AppInit_DLLs"=c:windowsSystem32nvinit.dll.[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversiondrivers32]"aux1"=wdmaud.drv.[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregAdobe ARM]2012-12-03 07:35	946352	----a-w-	c:program filesCommon FilesAdobeARM1.0AdobeARM.exe.[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregAdobeAAMUpdater-1.0]2012-09-20 05:27	444904	----a-w-	c:program filesCommon FilesAdobeOOBEPDAppUWAupdaterstartuputility.exe.[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregAdobeCS5.5ServiceManager]2011-01-12 04:08	1523360	----a-w-	c:program filesCommon FilesAdobeCS5.5ServiceManagerCS5.5ServiceManager.exe.[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregBCSSync]2010-03-13 11:54	91520	----a-w-	c:program filesMicrosoft OfficeOffice14BCSSync.exe.[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregDAEMON Tools Lite]2012-11-06 10:46	3673728	----a-w-	c:program filesDAEMON Tools LiteDTLite.exe.[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregIgfxTray]2012-12-14 00:02	146032	----a-w-	c:windowsSystem32igfxtray.exe.[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregPC Auto Shutdown]2012-11-14 13:57	1438000	----a-w-	c:program filesPC Auto ShutdownAutoShutdown.exe.[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregPersistence]2012-12-14 00:02	190064	----a-w-	c:windowsSystem32igfxpers.exe.[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregSearchSettings]2013-02-23 17:16	1297728	----a-w-	c:program filesCommon FilesSpigotSearch SettingsSearchSettings.exe.[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregSkype]2013-02-28 15:50	18642024	----a-r-	c:program filesSkypePhoneSkype.exe.[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregSteam]2012-12-25 18:08	1354736	----a-w-	c:program filesSteamSteam.exe.[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregSunJavaUpdateSched]2012-07-03 06:04	252848	----a-w-	c:program filesCommon FilesJavaJava Updatejusched.exe.[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregSwitchBoard]2010-02-19 10:37	517096	----a-w-	c:program filesCommon FilesAdobeSwitchBoardSwitchBoard.exe.[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregWinampAgent]2012-06-28 15:40	74752	----a-w-	c:program filesWinampwinampa.exe.R2 SkypeUpdate;Skype Updater;c:program filesSkypeUpdaterUpdater.exe [x]R3 ALSysIO;ALSysIO;c:usersBOYWIN~1AppDataLocalTempALSysIO.sys [x]R3 AMPPALP;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Protocol;c:windowssystem32DRIVERSamppal.sys [x]R3 cpuz135;cpuz135;c:windowsTEMPcpuz135cpuz135_x32.sys [x]R3 Futuremark SystemInfo Service;Futuremark SystemInfo Service;c:program filesFuturemarkFuturemark SystemInfoFMSISvc.exe [x]R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:windowssystem32driversrdpvideominiport.sys [x]R3 SwitchBoard;Adobe SwitchBoard;c:program filesCommon FilesAdobeSwitchBoardSwitchBoard.exe [x]R3 TsUsbFlt;TsUsbFlt;c:windowssystem32driverstsusbflt.sys [x]R3 WatAdminSvc;Windows Activation Technologies Service;c:windowssystem32WatWatAdminSvc.exe [x]R4 SearchIndexer;Search Indexer;c:windowssystem32svchost.exe [x]S0 nvpciflt;nvpciflt;c:windowssystem32DRIVERSnvpciflt.sys [x]S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:windowssystem32DRIVERSdtsoftbus01.sys [x]S2 AMPPALR3;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Service;c:program filesIntelBluetoothHSBTHSAmpPalService.exe [x]S2 Application Updater;Application Updater;c:program filesApplication UpdaterApplicationUpdater.exe [x]S2 BTHSSecurityMgr;Intel(R) Centrino(R) Wireless Bluetooth(R) 3.0 + High Speed Security Service;c:program filesIntelBluetoothHSBTHSSecurityMgr.exe [x]S2 PCAutoShutdown_Service;PCAutoShutdown_Service;c:program filesPC Auto ShutdownShutdownService.exe [x]S2 TeamViewer8;TeamViewer 8;c:program filesTeamViewerVersion8TeamViewer_Service.exe [x]S2 UNS;Intel(R) Management and Security Application User Notification Service;c:program filesIntelIntel(R) Management Engine ComponentsUNSUNS.exe [x]S2 Yontoo Desktop Updater;Yontoo Desktop Updater;c:program filesYontooY2Desktop.Updater.exe [x]S3 AMPPAL;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Virtual Adapter;c:windowssystem32DRIVERSAMPPAL.sys [x]S3 btmhsf;btmhsf;c:windowssystem32DRIVERSbtmhsf.sys [x]S3 iBtFltCoex;iBtFltCoex;c:windowssystem32DRIVERSiBtFltCoex.sys [x]S3 IntcDAud;Intel(R) Display Audio;c:windowssystem32DRIVERSIntcDAud.sys [x]S3 MEI;Intel(R) Management Engine Interface;c:windowssystem32DRIVERSHECI.sys [x]S3 NETwNs32;___ Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 32 Bit;c:windowssystem32DRIVERSNetwsn00.sys [x]S3 RTL8167;Realtek 8167 NT Driver;c:windowssystem32DRIVERSRt86win7.sys [x]..[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversionsvchost]LocalServiceAndNoImpersonation	REG_MULTI_SZ   	SSDPSRV upnphost SCardSvr TBS fdrespub AppIDSvc QWAVE wcncsvc Mcx2Svc SensrSvcGPSvcGroup	REG_MULTI_SZ   	GPSvc.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionSvchost  - NetSvcsSearchIndexerSearchIndexerSearchIndexerSearchIndexerSearchIndexerSearchIndexerSearchIndexer.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionSvchost  - LocalServiceFontCache..Contents of the 'Scheduled Tasks' folder.2013-05-03 c:windowsTasksAdobe Flash Player Updater.job- c:windowssystem32MacromedFlashFlashPlayerUpdateService.exe [2012-09-05 18:39].2013-05-02 c:windowsTasksGoogleUpdateTaskUserS-1-5-21-682926853-2598639674-846204972-1000Core.job- c:usersboywindowsAppDataLocalGoogleUpdateGoogleUpdate.exe [2013-04-02 18:25].2013-05-03 c:windowsTasksGoogleUpdateTaskUserS-1-5-21-682926853-2598639674-846204972-1000UA.job- c:usersboywindowsAppDataLocalGoogleUpdateGoogleUpdate.exe [2013-04-02 18:25]..------- Supplementary Scan -------.uStart Page = hxxp://www.search.ask.com/?l=dis&o=15003IE: E&xport to Microsoft Excel - c:progra~1MICROS~1Office14EXCEL.EXE/3000IE: Se&nd to OneNote - c:progra~1MICROS~1Office14ONBttnIE.dll/105TCP: Interfaces{A5A5B288-E30A-4336-BF55-B79686B2861D}: NameServer = 95.111.36.51,89.190.192.247TCP: Interfaces{AC282E77-31F5-4811-893B-2C58B60358BD}: NameServer = 89.215.233.2 89.215.246.40FF - ProfilePath - c:usersboywindowsAppDataRoamingMozillaFirefoxProfiles04e2rub9.default-1361214403999FF - prefs.js: browser.startup.homepage - hxxps://www.google.com/FF - ExtSQL: 2013-04-30 23:07; [email protected]; c:usersboywindowsAppDataRoamingMozillaFirefoxProfiles04e2rub9.default-1361214403999extensionsfhdp@fhdp.tv.xpiFF - user.js: extentions.y2layers.installId - aaf0c8cf-082e-4364-b379-b7a6ec3d4a39FF - user.js: extentions.y2layers.defaultEnableAppsList - twittube,buzzdock,YontooNewOffersFF - user.js: extensions.delta.tlbrSrchUrl - FF - user.js: extensions.delta.id - d41598e3000000000000000000000000FF - user.js: extensions.delta.appId - {C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}FF - user.js: extensions.delta.instlDay - 15825FF - user.js: extensions.delta.vrsn - 1.8.16.16FF - user.js: extensions.delta.vrsni - 1.8.16.16FF - user.js: extensions.delta.vrsnTs - 1.8.16.1622:47FF - user.js: extensions.delta.prtnrId - deltaFF - user.js: extensions.delta.prdct - deltaFF - user.js: extensions.delta.aflt - babsstFF - user.js: extensions.delta.smplGrp - noneFF - user.js: extensions.delta.tlbrId - baseFF - user.js: extensions.delta.instlRef - sstFF - user.js: extensions.delta.dfltLng - enFF - user.js: extensions.delta.excTlbr - falseFF - user.js: extensions.delta.ffxUnstlRst - trueFF - user.js: extensions.delta.admin - falseFF - user.js: extensions.delta.autoRvrt - falseFF - user.js: extensions.delta.rvrt - falseFF - user.js: extensions.delta.newTab - false.- - - - ORPHANS REMOVED - - - -.MSConfigStartUp-Advanced SystemCare 5 - c:program filesIObitAdvanced SystemCare 5ASCTray.exeMSConfigStartUp-DAEMON Tools Pro Agent - c:program filesDAEMON Tools ProDTAgent.exeMSConfigStartUp-Pando Media Booster - c:program filesPando NetworksMedia BoosterPMB.exeMSConfigStartUp-RGSC - c:program filesRockstar GamesRockstar Games Social ClubRGSCLauncher.exeMSConfigStartUp-SMS by Jeko Ianev - c:program filessmssms.exeAddRemove-{6D87CAD9-9B94-4421-A439-B25F8DE14575} - c:program files (x86)InstallShield Installation Information{6D87CAD9-9B94-4421-A439-B25F8DE14575}setup.exe...--------------------- LOCKED REGISTRY KEYS ---------------------.[HKEY_USERSS-1-5-21-682926853-2598639674-846204972-1000SoftwareSecuROM!CAUTION! NEVER A OR CHANGE ANY KEY*]@Allowed: (Read) (RestrictedCode)"??"=hex:88,3e,a7,d7,c8,b9,20,af,a7,2f,7c,f5,25,e9,8c,3a,7c,25,e8,07,f7,9d,16,   59,d8,d2,ab,fa,7e,ec,5a,69,3c,d8,5b,3c,10,a7,02,47,a3,5a,f7,24,a5,5a,02,12,"??"=hex:35,fc,c6,3d,c9,02,ad,db,37,1f,61,de,0f,33,8f,50.[HKEY_LOCAL_MACHINEsystemControlSet001ControlClass{4D36E96D-E325-11CE-BFC1-08002BE10318}0000AllUserSettings]@Denied: (A) (Users)@Denied: (A) (Everyone)@Allowed: (B 1 2 3 4 5) (S-1-5-20)"BlindDial"=dword:00000000.[HKEY_LOCAL_MACHINEsystemControlSet001ControlPCWSecurity]@Denied: (Full) (Everyone).------------------------ Other Running Processes ------------------------.c:windowssystem32nvvsvc.exec:program filesNVIDIA CorporationDisplaynvxdsync.exec:windowssystem32nvvsvc.exec:program filesCommon FilesAdobeARM1.0armsvc.exec:windowssystem32taskhost.exec:program filesCommon FilesAppleMobile Device SupportAppleMobileDeviceService.exec:program filesBonjourmDNSResponder.exec:program filesCommon FilesMicrosoft SharedWindows LiveWLIDSVC.EXEc:program filesCommon FilesMicrosoft SharedWindows LiveWLIDSvcM.exec:program filesNVIDIA CorporationDisplaynvtray.exec:windowssystem32conhost.exec:windowssystem32taskhost.exec:program filesIntelIntel(R) Management Engine ComponentsLMSLMS.exec:program filesNVIDIA CorporationNVIDIA Update Coredaemonu.exec:windowssystem32sppsvc.exe.**************************************************************************.Completion time: 2013-05-03  10:21:54 - machine was rebootedComboFix-quarantined-files.txt  2013-05-03 07:21.Pre-Run: 110,542,516,224 bytes freePost-Run: 110,433,013,760 bytes free.- - End Of File - - FE70661E4B26116DEFB42C5DBDF0DDFF

[*]Отворете notepad и се уверете че пред Format няма отметка пред Word Wrap

[*]С copy/paste въведете следната информация:

Driver::Application UpdaterYontoo Desktop UpdaterFile::c:usersboywindowsAppDataRoamingSoftware Informershockwave.exeFileLook::c:windowsexplorer.exeSRPeek::c:windowsexplorer.exeFolder::c:usersboywindowsAppDataRoamingBabylonc:usersboywindowsAppDataRoamingYontooc:programdataBabylonc:programdataTarma Installerc:program filesApplication Updaterc:program filesIObit Apps Toolbarc:program filesYontooRegistry::[HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerURLSearchHooks]"{03EB0E9C-7A91-4381-A220-9B52B641CDB1}"=-[-HKEY_LOCAL_MACHINESOFTWARE~Browser Helper Objects{03EB0E9C-7A91-4381-A220-9B52B641CDB1}][HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]"{03EB0E9C-7A91-4381-A220-9B52B641CDB1}"=-[-HKEY_CLASSES_ROOTclsid{03eb0e9c-7a91-4381-a220-9b52b641cdb1}][HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]"Keyboard Inf."=-"Yontoo Desktop"=-[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]"Microsoft Windows Service Host!"=-[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogon]"Shell"="explorer.exe"DDS::uStart Page = hxxp://www.search.ask.com/?l=dis&o=15003Firefox::FF - ProfilePath - c:usersboywindowsAppDataRoamingMozillaFirefoxProfiles04e2rub9.default-1361214403999FF - user.js: extentions.y2layers.installId - aaf0c8cf-082e-4364-b379-b7a6ec3d4a39FF - user.js: extentions.y2layers.defaultEnableAppsList - twittube,buzzdock,YontooNewOffersFF - user.js: extensions.delta.tlbrSrchUrl -FF - user.js: extensions.delta.id - d41598e3000000000000000000000000FF - user.js: extensions.delta.appId - {C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}FF - user.js: extensions.delta.instlDay - 15825FF - user.js: extensions.delta.vrsn - 1.8.16.16FF - user.js: extensions.delta.vrsni - 1.8.16.16FF - user.js: extensions.delta.vrsnTs - 1.8.16.1622:47FF - user.js: extensions.delta.prtnrId - deltaFF - user.js: extensions.delta.prdct - deltaFF - user.js: extensions.delta.aflt - babsstFF - user.js: extensions.delta.smplGrp - noneFF - user.js: extensions.delta.tlbrId - baseFF - user.js: extensions.delta.instlRef - sstFF - user.js: extensions.delta.dfltLng - enFF - user.js: extensions.delta.excTlbr - falseFF - user.js: extensions.delta.ffxUnstlRst - trueFF - user.js: extensions.delta.admin - falseFF - user.js: extensions.delta.autoRvrt - falseFF - user.js: extensions.delta.rvrt - falseFF - user.js: extensions.delta.newTab - false

Запазете файла с име CFScript и го провлачете и пуснете в Combofix (както е показано на картинката отдолу).

[*]

[*]По време на сканиране от страна на ComboFix не стартирайте никакви други приложения, не натискайте клавиши от клавиатурата и не местете мишката!

[*]Публикувайте лог файла, който ще се създаде след рестарта на компютъра в следващия си пост.

[*]Също така архивирайте и папката C:Qoobox и я качете тук. Публикувайте линк за download в следващия си коментар.

Ето инфото:

ComboFix 13-05-01.03 - boywindows 05/03/2013  11:01:20.2.2 - x86Microsoft Windows 7 Professional   6.1.7601.1.1252.1.1033.18.2732.1913 [GMT 3:00]Running from: c:usersboywindowsDesktopComboFix.exeCommand switches used :: c:usersboywindowsDesktopCFScript.txtSP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}.FILE ::"c:usersboywindowsAppDataRoamingSoftware Informershockwave.exe"..(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))..c:program filesApplication Updaterc:program filesApplication UpdaterApplicationUpdater.exec:program filesApplication Updaterconfig.inic:program filesIObit Apps Toolbarc:program filesIObit Apps ToolbarFFchrome.manifestc:program filesIObit Apps ToolbarFFchromechrome.jarc:program filesIObit Apps ToolbarFFcomponentsIFBHOHelperWidgiToolbar.xptc:program filesIObit Apps ToolbarFFcomponentsIFBHOWidgiToolbar.xptc:program filesIObit Apps ToolbarFFcomponentsiobitappsFF.dllc:program filesIObit Apps ToolbarFFcomponentsiobitappsFF.dll.10c:program filesIObit Apps ToolbarFFcomponentsiobitappsFF.dll.11c:program filesIObit Apps ToolbarFFcomponentsiobitappsFF.dll.12c:program filesIObit Apps ToolbarFFcomponentsiobitappsFF.dll.13c:program filesIObit Apps ToolbarFFcomponentsiobitappsFF.dll.14c:program filesIObit Apps ToolbarFFcomponentsiobitappsFF.dll.15c:program filesIObit Apps ToolbarFFcomponentsiobitappsFF.dll.16c:program filesIObit Apps ToolbarFFcomponentsiobitappsFF.dll.17c:program filesIObit Apps ToolbarFFcomponentsiobitappsFF.dll.18c:program filesIObit Apps ToolbarFFcomponentsiobitappsFF.dll.19c:program filesIObit Apps ToolbarFFcomponentsiobitappsFF.dll.20c:program filesIObit Apps ToolbarFFcomponentsiobitappsFF.dll.21c:program filesIObit Apps ToolbarFFcomponentsiobitappsFF.dll.5c:program filesIObit Apps ToolbarFFcomponentsiobitappsFF.dll.6c:program filesIObit Apps ToolbarFFcomponentsiobitappsFF.dll.7c:program filesIObit Apps ToolbarFFcomponentsiobitappsFF.dll.8c:program filesIObit Apps ToolbarFFcomponentsiobitappsFF.dll.9c:program filesIObit Apps ToolbarFFinstall.rdfc:program filesIObit Apps ToolbarIE7.0config.inic:program filesIObit Apps ToolbarIE7.0iobitappsToolbarIE.dllc:program filesIObit Apps ToolbarResamazon.gifc:program filesIObit Apps ToolbarResebay.gifc:program filesIObit Apps ToolbarResfacebook.gifc:program filesIObit Apps ToolbarResgoogleplus.gifc:program filesIObit Apps ToolbarResicon_settings.gifc:program filesIObit Apps ToolbarResiobit-toolbar-logo-hover.gifc:program filesIObit Apps ToolbarResiobit-toolbar-logo.gifc:program filesIObit Apps ToolbarResLangRes1031.inic:program filesIObit Apps ToolbarResLangRes1033.inic:program filesIObit Apps ToolbarResLangRes1034.inic:program filesIObit Apps ToolbarResLangRes1036.inic:program filesIObit Apps ToolbarResLangRes1040.inic:program filesIObit Apps ToolbarResradio-close.gifc:program filesIObit Apps ToolbarResradio-minimize.gifc:program filesIObit Apps ToolbarResradiobeta.gifc:program filesIObit Apps ToolbarRessearch-button-hover.gifc:program filesIObit Apps ToolbarRessearch-button.gifc:program filesIObit Apps ToolbarRessearch-chevron-hover.gifc:program filesIObit Apps ToolbarRessearch-chevron.gifc:program filesIObit Apps ToolbarRessearch_amazon.gifc:program filesIObit Apps ToolbarRessearch_baidu.gifc:program filesIObit Apps ToolbarRessearch_ebay.gifc:program filesIObit Apps ToolbarRessearch_yahoo.gifc:program filesIObit Apps ToolbarRessearch_yandex.gifc:program filesIObit Apps ToolbarRestoolbar-icon.gifc:program filesIObit Apps ToolbarRestwitter.gifc:program filesIObit Apps ToolbarReswidgets.xmlc:program filesIObit Apps ToolbarWidgiHelper.exec:program filesYontooc:program filesYontooOptChrome.exec:program filesYontoosqlite3.exec:program filesYontooY2Desktop.Updater.exec:program filesYontooYontooIEClient.dllc:program filesYontooYontooLayers.crxc:programdataBabylonc:programdatantuser.datc:programdataTarma Installerc:programdataTarma Installer{361E80BE-388B-4270-BF54-A10C2B756504}_Setup.dllc:programdataTarma Installer{361E80BE-388B-4270-BF54-A10C2B756504}_Setupx.dllc:programdataTarma Installer{361E80BE-388B-4270-BF54-A10C2B756504}Setup.datc:programdataTarma Installer{361E80BE-388B-4270-BF54-A10C2B756504}Setup.exec:programdataTarma Installer{361E80BE-388B-4270-BF54-A10C2B756504}Setup.icoc:programdataTarma Installer{889DF117-14D1-44EE-9F31-C5FB5D47F68B}_Setup.dllc:programdataTarma Installer{889DF117-14D1-44EE-9F31-C5FB5D47F68B}_Setupx.dllc:programdataTarma Installer{889DF117-14D1-44EE-9F31-C5FB5D47F68B}Setup.datc:programdataTarma Installer{889DF117-14D1-44EE-9F31-C5FB5D47F68B}Setup.exec:programdataTarma Installer{889DF117-14D1-44EE-9F31-C5FB5D47F68B}Setup.icoc:usersboywindowsAppDataRoamingBabylonc:usersboywindowsAppDataRoamingBabylonlog_file.txtc:usersboywindowsAppDataRoamingSoftware Informershockwave.exec:usersboywindowsAppDataRoamingYontooc:usersboywindowsAppDataRoamingYontoodatDesktop.OS.dllc:usersboywindowsAppDataRoamingYontoodatDesktop.OS.Plugin.dllc:usersboywindowsAppDataRoamingYontoodatHealthMonitor.datc:usersboywindowsAppDataRoamingYontoodatHeartBeat.datc:usersboywindowsAppDataRoamingYontooPlugIns.cachec:usersboywindowsAppDataRoamingYontooYontooDesktop.exec:windowssystem32driversetchosts.ics..(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))..-------Service_Application Updater-------Service_Yontoo Desktop Updater..(((((((((((((((((((((((((   Files Created from 2013-04-03 to 2013-05-03  )))))))))))))))))))))))))))))))..2013-05-03 08:10 . 2013-05-03 08:10	--------	d-----w-	c:usersUpdatusUserAppDataLocaltemp2013-05-03 08:10 . 2013-05-03 08:10	--------	d-----w-	c:usersDefaultAppDataLocaltemp2013-05-03 07:14 . 2013-05-03 07:14	60872	----a-w-	c:programdataMicrosoftWindows DefenderDefinition Updates{0AFA2977-8C8C-4FD3-A529-1EE6BABF95AF}offreg.dll2013-05-03 05:42 . 2013-04-10 03:08	6906960	----a-w-	c:programdataMicrosoftWindows DefenderDefinition Updates{0AFA2977-8C8C-4FD3-A529-1EE6BABF95AF}mpengine.dll2013-05-02 19:54 . 2013-05-02 19:54	--------	d-----w-	C:_OTL2013-04-30 20:07 . 2013-04-30 20:12	--------	d-----w-	c:program filesLSHunter.TV2013-04-30 19:45 . 2013-04-30 19:48	--------	d-----w-	c:program fileshdvidcodec.com2013-04-29 20:12 . 2013-04-29 20:43	--------	d-----w-	c:programdata188F1432-103A-4ffb-80F1-36B633C5C9E12013-04-27 17:22 . 2013-04-27 17:23	--------	d-----w-	c:program filesPoker Night 22013-04-27 10:08 . 2013-04-27 10:08	--------	d-----w-	c:usersboywindowsAppDataLocalOpera2013-04-27 10:08 . 2013-04-27 10:08	--------	d-----w-	c:program filesOpera2013-04-27 10:03 . 2013-04-27 10:03	--------	d-----w-	c:program filesCommon FilesSkype2013-04-26 21:25 . 2013-04-26 21:25	--------	d-----w-	c:windowssystem32NV2013-04-26 21:24 . 2013-05-03 05:40	--------	d-----w-	c:usersUpdatusUser.boywindows-PC2013-04-26 21:24 . 2013-04-19 02:23	4185888	----a-w-	c:windowssystem32nvcpl.dll2013-04-26 21:24 . 2013-04-19 02:23	3042080	----a-w-	c:windowssystem32nvsvc.dll2013-04-26 21:24 . 2013-04-19 02:23	640288	----a-w-	c:windowssystem32nvvsvc.exe2013-04-26 21:24 . 2013-04-19 02:23	869152	----a-w-	c:windowssystem32nv3dappshext.dll2013-04-26 21:24 . 2013-04-19 02:23	66560	----a-w-	c:windowssystem32nv3dappshextr.dll2013-04-26 21:24 . 2013-04-19 02:23	62752	----a-w-	c:windowssystem32nvshext.dll2013-04-26 21:24 . 2013-04-19 02:23	2555168	----a-w-	c:windowssystem32nvsvcr.dll2013-04-26 21:24 . 2013-04-19 02:23	223008	----a-w-	c:windowssystem32nvmctray.dll2013-04-26 21:24 . 2013-04-18 00:03	3122645	----a-w-	c:windowssystem32nvcoproc.bin2013-04-26 21:23 . 2013-04-26 21:23	--------	d-----w-	c:programdataNVIDIA Corporation2013-04-24 04:15 . 2013-04-12 13:45	1211752	----a-w-	c:windowssystem32driversntfs.sys2013-04-23 17:12 . 2013-04-23 17:12	--------	d-----w-	c:usersboywindowsAppDataLocalApple Computer2013-04-23 17:11 . 2013-04-29 20:43	--------	dc----w-	c:windowssystem32DRVSTORE2013-04-23 17:11 . 2013-04-23 17:11	--------	d-----w-	c:programdataApple Computer2013-04-23 17:10 . 2013-04-23 17:10	--------	d-----w-	c:usersboywindowsAppDataLocalApple2013-04-23 17:10 . 2013-04-23 17:10	--------	d-----w-	c:program filesApple Software Update2013-04-23 17:10 . 2013-04-23 17:10	--------	d-----w-	c:program filesBonjour2013-04-23 17:09 . 2013-04-29 20:43	--------	d-----w-	c:program filesCommon FilesApple2013-04-23 17:09 . 2013-04-23 17:10	--------	d-----w-	c:programdataApple2013-04-22 18:14 . 2013-04-22 18:17	--------	d-----w-	c:program filesRAR Password Recovery Professional2013-04-18 19:10 . 2013-04-30 20:09	--------	d-----w-	C:Games2013-04-10 05:21 . 2013-03-01 03:09	2347008	----a-w-	c:windowssystem32win32k.sys2013-04-10 05:21 . 2013-01-24 04:47	196328	----a-w-	c:windowssystem32driversfvevol.sys2013-04-10 05:21 . 2013-03-19 05:04	3968856	----a-w-	c:windowssystem32ntkrnlpa.exe2013-04-10 05:21 . 2013-03-19 05:04	3913560	----a-w-	c:windowssystem32ntoskrnl.exe2013-04-10 05:21 . 2013-03-19 04:48	38912	----a-w-	c:windowssystem32csrsrv.dll2013-04-10 05:21 . 2013-03-19 02:49	69632	----a-w-	c:windowssystem32smss.exe...((((((((((((((((((((((((((((((((((((((((   Find3M Report   )))))))))))))))))))))))))))))))))))))))))))))))))))).2013-05-01 23:06 . 2012-09-05 18:14	238872	------w-	c:windowssystem32MpSigStub.exe2013-03-18 22:13 . 2013-03-18 22:13	745472	----a-w-	c:windowssystem32MsSpellCheckingFacility.exe2013-03-18 22:13 . 2013-03-18 22:13	185344	----a-w-	c:windowssystem32elshyph.dll2013-03-18 22:12 . 2013-03-18 22:12	73728	----a-w-	c:windowssystem32SetIEInstalledDate.exe2013-03-18 22:12 . 2013-03-18 22:12	719360	----a-w-	c:windowssystem32mshtmlmedia.dll2013-03-18 22:12 . 2013-03-18 22:12	61952	----a-w-	c:windowssystem32tdc.ocx2013-03-18 22:12 . 2013-03-18 22:12	523264	----a-w-	c:windowssystem32vbscript.dll2013-03-18 22:12 . 2013-03-18 22:12	48640	----a-w-	c:windowssystem32mshtmler.dll2013-03-18 22:12 . 2013-03-18 22:12	38400	----a-w-	c:windowssystem32imgutil.dll2013-03-18 22:12 . 2013-03-18 22:12	361984	----a-w-	c:windowssystem32html.iec2013-03-18 22:12 . 2013-03-18 22:12	23040	----a-w-	c:windowssystem32licmgr10.dll2013-03-18 22:12 . 2013-03-18 22:12	158720	----a-w-	c:windowssystem32msls31.dll2013-03-18 22:12 . 2013-03-18 22:12	150528	----a-w-	c:windowssystem32iexpress.exe2013-03-18 22:12 . 2013-03-18 22:12	1441280	----a-w-	c:windowssystem32inetcpl.cpl2013-03-18 22:12 . 2013-03-18 22:12	138752	----a-w-	c:windowssystem32wextract.exe2013-03-18 22:12 . 2013-03-18 22:12	137216	----a-w-	c:windowssystem32ieUnatt.exe2013-03-18 22:12 . 2013-03-18 22:12	12800	----a-w-	c:windowssystem32mshta.exe2013-03-18 22:12 . 2013-03-18 22:12	110592	----a-w-	c:windowssystem32IEAdvpack.dll2013-03-13 18:39 . 2012-09-05 18:07	73432	----a-w-	c:windowssystem32FlashPlayerCPLApp.cpl2013-03-13 18:39 . 2012-09-05 18:07	693976	----a-w-	c:windowssystem32FlashPlayerApp.exe2013-02-12 04:48 . 2013-03-13 18:00	474112	----a-w-	c:windowsapppatchAcSpecfc.dll2013-02-12 04:48 . 2013-03-13 18:00	2176512	----a-w-	c:windowsapppatchAcGenral.dll2013-02-12 03:32 . 2013-03-15 04:46	15872	----a-w-	c:windowssystem32driversusb8023.sys2013-02-09 22:22 . 2009-08-18 09:30	564632	----a-w-	c:programdataMicrosoftIdentityCRLproductionwlidui.dll2013-02-09 22:22 . 2009-08-18 09:24	19696	----a-w-	c:programdataMicrosoftIdentityCRLproductionppcrlconfig600.dll2013-04-12 06:13 . 2013-04-12 06:13	263064	----a-w-	c:program filesmozilla firefoxcomponentsbrowsercomps.dll..((((((((((((((((((((((((((((((((((((((((((((   Look   )))))))))))))))))))))))))))))))))))))))))))))))))))))))))..--- c:windowsexplorer.exe ---Company: Microsoft CorporationFile Description: Windows ExplorerFile Version: 6.1.7600.16385 (win7_rtm.090713-1255)Product Name: Microsoft® Windows® Operating SystemCopyright: © Microsoft Corporation. All rights reserved.Original Filename: EXPLORER.EXE.MUIFile size: 2616320Created time: 2012-09-06 05:45Modified time: 2011-02-25 05:30MD5: 8B88EBBB05A0E56B7DCC708498C02B3ESHA1: CEA0890D4B99BAE3F635A16DAE71F69D137027B9..(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shown REGEDIT4.[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]"RtHDVCpl"="c:program filesRealtekAudioHDARtHDVCpl.exe" [2011-07-12 10754664]"Adobe ARM"="c:program filesCommon FilesAdobeARM1.0AdobeARM.exe" [2012-12-03 946352]"IgfxTray"="c:windowssystem32igfxtray.exe" [2012-12-14 146032]"HotKeysCmds"="c:windowssystem32hkcmd.exe" [2012-12-14 181360]"Persistence"="c:windowssystem32igfxpers.exe" [2012-12-14 190064]"BCSSync"="c:program filesMicrosoft OfficeOffice14BCSSync.exe" [2010-03-13 91520]"APSDaemon"="c:program filesCommon FilesAppleApple Application SupportAPSDaemon.exe" [2013-01-28 59720].[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionpoliciessystem]"ConsentPromptBehaviorAdmin"= 0 (0x0)"ConsentPromptBehaviorUser"= 3 (0x3)"EnableUIADesktopToggle"= 0 (0x0).[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversionwindows]"AppInit_DLLs"=c:windowsSystem32nvinit.dll.[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversiondrivers32]"aux1"=wdmaud.drv.[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregAdobe ARM]2012-12-03 07:35	946352	----a-w-	c:program filesCommon FilesAdobeARM1.0AdobeARM.exe.[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregAdobeAAMUpdater-1.0]2012-09-20 05:27	444904	----a-w-	c:program filesCommon FilesAdobeOOBEPDAppUWAupdaterstartuputility.exe.[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregAdobeCS5.5ServiceManager]2011-01-12 04:08	1523360	----a-w-	c:program filesCommon FilesAdobeCS5.5ServiceManagerCS5.5ServiceManager.exe.[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregBCSSync]2010-03-13 11:54	91520	----a-w-	c:program filesMicrosoft OfficeOffice14BCSSync.exe.[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregDAEMON Tools Lite]2012-11-06 10:46	3673728	----a-w-	c:program filesDAEMON Tools LiteDTLite.exe.[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregIgfxTray]2012-12-14 00:02	146032	----a-w-	c:windowsSystem32igfxtray.exe.[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregPC Auto Shutdown]2012-11-14 13:57	1438000	----a-w-	c:program filesPC Auto ShutdownAutoShutdown.exe.[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregPersistence]2012-12-14 00:02	190064	----a-w-	c:windowsSystem32igfxpers.exe.[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregSearchSettings]2013-02-23 17:16	1297728	----a-w-	c:program filesCommon FilesSpigotSearch SettingsSearchSettings.exe.[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregSkype]2013-02-28 15:50	18642024	----a-r-	c:program filesSkypePhoneSkype.exe.[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregSteam]2012-12-25 18:08	1354736	----a-w-	c:program filesSteamSteam.exe.[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregSunJavaUpdateSched]2012-07-03 06:04	252848	----a-w-	c:program filesCommon FilesJavaJava Updatejusched.exe.[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregSwitchBoard]2010-02-19 10:37	517096	----a-w-	c:program filesCommon FilesAdobeSwitchBoardSwitchBoard.exe.[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregWinampAgent]2012-06-28 15:40	74752	----a-w-	c:program filesWinampwinampa.exe.R2 SkypeUpdate;Skype Updater;c:program filesSkypeUpdaterUpdater.exe [x]R3 ALSysIO;ALSysIO;c:usersBOYWIN~1AppDataLocalTempALSysIO.sys [x]R3 AMPPALP;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Protocol;c:windowssystem32DRIVERSamppal.sys [x]R3 cpuz135;cpuz135;c:windowsTEMPcpuz135cpuz135_x32.sys [x]R3 Futuremark SystemInfo Service;Futuremark SystemInfo Service;c:program filesFuturemarkFuturemark SystemInfoFMSISvc.exe [x]R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:windowssystem32driversrdpvideominiport.sys [x]R3 SwitchBoard;Adobe SwitchBoard;c:program filesCommon FilesAdobeSwitchBoardSwitchBoard.exe [x]R3 TsUsbFlt;TsUsbFlt;c:windowssystem32driverstsusbflt.sys [x]R3 WatAdminSvc;Windows Activation Technologies Service;c:windowssystem32WatWatAdminSvc.exe [x]R4 SearchIndexer;Search Indexer;c:windowssystem32svchost.exe [x]S0 nvpciflt;nvpciflt;c:windowssystem32DRIVERSnvpciflt.sys [x]S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:windowssystem32DRIVERSdtsoftbus01.sys [x]S2 AMPPALR3;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Service;c:program filesIntelBluetoothHSBTHSAmpPalService.exe [x]S2 BTHSSecurityMgr;Intel(R) Centrino(R) Wireless Bluetooth(R) 3.0 + High Speed Security Service;c:program filesIntelBluetoothHSBTHSSecurityMgr.exe [x]S2 PCAutoShutdown_Service;PCAutoShutdown_Service;c:program filesPC Auto ShutdownShutdownService.exe [x]S2 TeamViewer8;TeamViewer 8;c:program filesTeamViewerVersion8TeamViewer_Service.exe [x]S2 UNS;Intel(R) Management and Security Application User Notification Service;c:program filesIntelIntel(R) Management Engine ComponentsUNSUNS.exe [x]S3 AMPPAL;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Virtual Adapter;c:windowssystem32DRIVERSAMPPAL.sys [x]S3 btmhsf;btmhsf;c:windowssystem32DRIVERSbtmhsf.sys [x]S3 iBtFltCoex;iBtFltCoex;c:windowssystem32DRIVERSiBtFltCoex.sys [x]S3 IntcDAud;Intel(R) Display Audio;c:windowssystem32DRIVERSIntcDAud.sys [x]S3 MEI;Intel(R) Management Engine Interface;c:windowssystem32DRIVERSHECI.sys [x]S3 NETwNs32;___ Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 32 Bit;c:windowssystem32DRIVERSNetwsn00.sys [x]S3 RTL8167;Realtek 8167 NT Driver;c:windowssystem32DRIVERSRt86win7.sys [x]..[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversionsvchost]LocalServiceAndNoImpersonation	REG_MULTI_SZ   	SSDPSRV upnphost SCardSvr TBS fdrespub AppIDSvc QWAVE wcncsvc Mcx2Svc SensrSvcGPSvcGroup	REG_MULTI_SZ   	GPSvc.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionSvchost  - NetSvcsSearchIndexerSearchIndexerSearchIndexerSearchIndexerSearchIndexerSearchIndexerSearchIndexer.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionSvchost  - LocalServiceFontCache..Contents of the 'Scheduled Tasks' folder.2013-05-03 c:windowsTasksAdobe Flash Player Updater.job- c:windowssystem32MacromedFlashFlashPlayerUpdateService.exe [2012-09-05 18:39].2013-05-02 c:windowsTasksGoogleUpdateTaskUserS-1-5-21-682926853-2598639674-846204972-1000Core.job- c:usersboywindowsAppDataLocalGoogleUpdateGoogleUpdate.exe [2013-04-02 18:25].2013-05-03 c:windowsTasksGoogleUpdateTaskUserS-1-5-21-682926853-2598639674-846204972-1000UA.job- c:usersboywindowsAppDataLocalGoogleUpdateGoogleUpdate.exe [2013-04-02 18:25]..------- Supplementary Scan -------.IE: E&xport to Microsoft Excel - c:progra~1MICROS~1Office14EXCEL.EXE/3000IE: Se&nd to OneNote - c:progra~1MICROS~1Office14ONBttnIE.dll/105TCP: Interfaces{A5A5B288-E30A-4336-BF55-B79686B2861D}: NameServer = 95.111.36.51,89.190.192.247TCP: Interfaces{AC282E77-31F5-4811-893B-2C58B60358BD}: NameServer = 89.215.233.2 89.215.246.40FF - ProfilePath - c:usersboywindowsAppDataRoamingMozillaFirefoxProfiles04e2rub9.default-1361214403999FF - prefs.js: browser.startup.homepage - hxxps://www.google.com/FF - ExtSQL: 2013-04-30 23:07; [email protected]; c:usersboywindowsAppDataRoamingMozillaFirefoxProfiles04e2rub9.default-1361214403999extensionsfhdp@fhdp.tv.xpi.- - - - ORPHANS REMOVED - - - -.AddRemove-{889DF117-14D1-44EE-9F31-C5FB5D47F68B} - c:progra~2TARMAI~1{889DF~1Setup.exe...--------------------- LOCKED REGISTRY KEYS ---------------------.[HKEY_USERSS-1-5-21-682926853-2598639674-846204972-1000SoftwareSecuROM!CAUTION! NEVER A OR CHANGE ANY KEY*]@Allowed: (Read) (RestrictedCode)"??"=hex:88,3e,a7,d7,c8,b9,20,af,a7,2f,7c,f5,25,e9,8c,3a,7c,25,e8,07,f7,9d,16,   59,d8,d2,ab,fa,7e,ec,5a,69,3c,d8,5b,3c,10,a7,02,47,a3,5a,f7,24,a5,5a,02,12,"??"=hex:35,fc,c6,3d,c9,02,ad,db,37,1f,61,de,0f,33,8f,50.[HKEY_LOCAL_MACHINEsystemControlSet001ControlClass{4D36E96D-E325-11CE-BFC1-08002BE10318}0000AllUserSettings]@Denied: (A) (Users)@Denied: (A) (Everyone)@Allowed: (B 1 2 3 4 5) (S-1-5-20)"BlindDial"=dword:00000000.[HKEY_LOCAL_MACHINEsystemControlSet001ControlPCWSecurity]@Denied: (Full) (Everyone).------------------------ Other Running Processes ------------------------.c:windowssystem32nvvsvc.exec:program filesNVIDIA CorporationDisplaynvxdsync.exec:windowssystem32nvvsvc.exec:program filesCommon FilesAdobeARM1.0armsvc.exec:program filesCommon FilesAppleMobile Device SupportAppleMobileDeviceService.exec:windowssystem32taskhost.exec:program filesBonjourmDNSResponder.exec:program filesCommon FilesMicrosoft SharedWindows LiveWLIDSVC.EXEc:program filesCommon FilesMicrosoft SharedWindows LiveWLIDSvcM.exec:windowssystem32taskhost.exec:windowssystem32conhost.exec:program filesNVIDIA CorporationDisplaynvtray.exec:program filesIntelIntel(R) Management Engine ComponentsLMSLMS.exec:program filesNVIDIA CorporationNVIDIA Update Coredaemonu.exec:windowssystem32sppsvc.exe.**************************************************************************.Completion time: 2013-05-03  11:16:22 - machine was rebootedComboFix-quarantined-files.txt  2013-05-03 08:16ComboFix2.txt  2013-05-03 07:21.Pre-Run: 110,345,216,000 bytes freePost-Run: 109,900,722,176 bytes free.- - End Of File - - A40170121AD19906DFDF6433A2197B1D

Обаче не ми дава да направя архив. В папката има друга папка BackEnv , която прави проблем и уинрара дава access denied

Има още малко боклуци за разчистване:

 

С copy/paste въведете следната информация:

Folder::c:program filesCommon FilesSpigotc:usersboywindowsAppDataRoamingSoftware InformerRegistry::[-HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregSearchSettings]

Запазете файла с име CFScript и го провлачете и пуснете в Combofix.

Публикувайте новия лог файл.

 

Архивирайте тогава всичко без BackEnv папката...Отворете C:Qoobox и натиснете Ctrl + A => след като маркирате всичко, задръжте Ctrl и кликнете върху BackEnv за да я отмаркирате.

Архивирайте всичко останало и го качете на линка, който ви дадох в предишния коментар и публикувайте линка за download.

След това пишете дали има още проблеми с компютъра.

 

Поздрави!

ComboFix 13-05-01.03 - boywindows 05/03/2013  11:51:58.3.2 - x86Microsoft Windows 7 Professional   6.1.7601.1.1252.1.1033.18.2732.1915 [GMT 3:00]Running from: c:usersboywindowsDesktopComboFix.exeCommand switches used :: c:usersboywindowsDesktopCFScript.txtSP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}..(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))..c:program filesCommon FilesSpigotc:program filesCommon FilesSpigotGCcoupons_2.3.crxc:program filesCommon FilesSpigotGCerrorassistant_1.1.crxc:program filesCommon FilesSpigotGCsaamazon_1.0.crxc:program filesCommon FilesSpigotGCsaebay_1.0.crxc:program filesCommon FilesSpigotSearch Settingsbaidu_ff.xmlc:program filesCommon FilesSpigotSearch Settingsbaidu_ie.xmlc:program filesCommon FilesSpigotSearch Settingsconfig.inic:program filesCommon FilesSpigotSearch SettingsLangres1031.inic:program filesCommon FilesSpigotSearch SettingsLangres1033.inic:program filesCommon FilesSpigotSearch SettingsLangres1034.inic:program filesCommon FilesSpigotSearch SettingsLangres1036.inic:program filesCommon FilesSpigotSearch SettingsLangres1040.inic:program filesCommon FilesSpigotSearch Settingssearchcom_ff.xmlc:program filesCommon FilesSpigotSearch Settingssearchcom_ie.xmlc:program filesCommon FilesSpigotSearch SettingsSearchSettings.exec:program filesCommon FilesSpigotSearch SettingsSearchSettings64.exec:program filesCommon FilesSpigotSearch Settingswth160.dllc:program filesCommon FilesSpigotSearch Settingswthx160.dllc:program filesCommon FilesSpigotSearch Settingsyahoo_ff.xmlc:program filesCommon FilesSpigotSearch Settingsyahoo_ie.xmlc:program filesCommon FilesSpigotSearch Settingsyandex_ff.xmlc:program filesCommon FilesSpigotSearch Settingsyandex_ie.xmlc:usersboywindowsAppDataRoamingSoftware Informerc:usersboywindowsAppDataRoamingSoftware Informerassociations.xmlc:usersboywindowsAppDataRoamingSoftware Informerava48.gifc:usersboywindowsAppDataRoamingSoftware Informerbundler.xmlc:usersboywindowsAppDataRoamingSoftware Informercachefiles02868164361fe41ab00382ba52ef8717c:usersboywindowsAppDataRoamingSoftware Informercachefiles03b6e9b14c30ebb20558a1d4047154fec:usersboywindowsAppDataRoamingSoftware Informercachefiles048dc6e00ab4c693f2fa5ed48233dd78c:usersboywindowsAppDataRoamingSoftware Informercachefiles0abb1618fbf41ff9f68320ef05153b66c:usersboywindowsAppDataRoamingSoftware Informercachefiles0ad123020d07cf555a55da71a7b6defac:usersboywindowsAppDataRoamingSoftware Informercachefiles0d5b45b04db6d6e265ee2b431578527bc:usersboywindowsAppDataRoamingSoftware Informercachefiles12a91e191835008ab4f35d25fe863571c:usersboywindowsAppDataRoamingSoftware Informercachefiles13b6b229ab000d3e555c459e54067a60c:usersboywindowsAppDataRoamingSoftware Informercachefiles13ca18edd843bab499b457f4ff807168c:usersboywindowsAppDataRoamingSoftware Informercachefiles17877cf2e54a3a7e5270fcf7a62511fdc:usersboywindowsAppDataRoamingSoftware Informercachefiles1a4837061e3cdd8e4f34fc3cd98609dac:usersboywindowsAppDataRoamingSoftware Informercachefiles1c41029592d412b0f260c9f8d5e745d1c:usersboywindowsAppDataRoamingSoftware Informercachefiles213b711b2e57f554b6cfc664046c178dc:usersboywindowsAppDataRoamingSoftware Informercachefiles24073b86558889bb67edde3fe2380b3fc:usersboywindowsAppDataRoamingSoftware Informercachefiles2895a09a7aaa7e9e686fe2d401b33101c:usersboywindowsAppDataRoamingSoftware Informercachefiles3bde4201fca05e778f3efc0bc1909622c:usersboywindowsAppDataRoamingSoftware Informercachefiles45eab1a670f6698455c55c80425e30cdc:usersboywindowsAppDataRoamingSoftware Informercachefiles478b94b334ebde4c12988a516dcd4b43c:usersboywindowsAppDataRoamingSoftware Informercachefiles61084535cfd8cc4fd84f695a2c8a838ac:usersboywindowsAppDataRoamingSoftware Informercachefiles695f129c1d04673cf2c91f0da5d8a23ac:usersboywindowsAppDataRoamingSoftware Informercachefiles6b205e679a3509071d209ec6d909d243c:usersboywindowsAppDataRoamingSoftware Informercachefiles6d931750aad7b7c3915dfb2d6516fa99c:usersboywindowsAppDataRoamingSoftware Informercachefiles700b177227b33153209cc279a4c1d860c:usersboywindowsAppDataRoamingSoftware Informercachefiles77595c66b87cf601349f20d1bc32722bc:usersboywindowsAppDataRoamingSoftware Informercachefiles7ad65186fc128d6af7c19c43e7c791aec:usersboywindowsAppDataRoamingSoftware Informercachefiles8039051e2621864a1c3547d92bb3bfefc:usersboywindowsAppDataRoamingSoftware Informercachefiles83536d5c9fe7329d66028d5ca1218e46c:usersboywindowsAppDataRoamingSoftware Informercachefiles8362b087bf724d903069949d6de2f178c:usersboywindowsAppDataRoamingSoftware Informercachefiles881d19a717902065e76ca7c3f98b4340c:usersboywindowsAppDataRoamingSoftware Informercachefiles9129cd271933799d937f35a9cbd43326c:usersboywindowsAppDataRoamingSoftware Informercachefiles9681080ae8c9758af570a6453f25feecc:usersboywindowsAppDataRoamingSoftware Informercachefiles992e7710fddf05d5414b5d4a3a8a5532c:usersboywindowsAppDataRoamingSoftware Informercachefilesac5a611b0517eb0c3427fc77f97db7c3c:usersboywindowsAppDataRoamingSoftware Informercachefilesb0c323172e504a2aa4df7ecaaaf24cb7c:usersboywindowsAppDataRoamingSoftware Informercachefilesbdb0abbead450ec5d58c81a4e6031300c:usersboywindowsAppDataRoamingSoftware Informercachefilesc0f5cee923e62288d4679f552d9172efc:usersboywindowsAppDataRoamingSoftware Informercachefilesc88e2a5bfc4e98507ae9c8852333823fc:usersboywindowsAppDataRoamingSoftware Informercachefilescf335302921160e4ae8b27d2534689f6c:usersboywindowsAppDataRoamingSoftware Informercachefilescfb4b80e85a89debdb1f0f20a9ef43d6c:usersboywindowsAppDataRoamingSoftware Informercachefilesdd4a3a42305e0607c9cc3f84d07f03d3c:usersboywindowsAppDataRoamingSoftware Informercachefilese644ab5e3631ea922100cdfbf4418d35c:usersboywindowsAppDataRoamingSoftware Informercachefilesea96f5b6ce854eb4424746629a3ac4fec:usersboywindowsAppDataRoamingSoftware Informercachefilesfa852ebc57da4e5f06188004de1b0890c:usersboywindowsAppDataRoamingSoftware Informercachefilesfbc46f7cb489073a1787d78d6a9feca0c:usersboywindowsAppDataRoamingSoftware Informercachefilesfbccfb9e708230e7e8add69fec40c958c:usersboywindowsAppDataRoamingSoftware Informercachefilesfdf2b16ea49fd18d70b7798cba863a60c:usersboywindowsAppDataRoamingSoftware Informercachefilesff6db0043e6e3cf26f00f886bd7c4e35c:usersboywindowsAppDataRoamingSoftware Informercachefilesffa27f2122f6c71d04e5b1ce98ad5700c:usersboywindowsAppDataRoamingSoftware Informercacheicons1190219_032_1771862079.icoc:usersboywindowsAppDataRoamingSoftware Informercacheicons1190220_032_709866058.icoc:usersboywindowsAppDataRoamingSoftware Informercacheicons1190222_032_392408842.icoc:usersboywindowsAppDataRoamingSoftware Informercacheicons1190223_032_3010695485.icoc:usersboywindowsAppDataRoamingSoftware Informercacheicons1196_032_3792847361.icoc:usersboywindowsAppDataRoamingSoftware Informercacheicons1599129_032_3464962806.icoc:usersboywindowsAppDataRoamingSoftware Informercacheicons1859729_032_1088709902.icoc:usersboywindowsAppDataRoamingSoftware Informercacheicons1905850_032_1550286538.icoc:usersboywindowsAppDataRoamingSoftware Informercacheicons216_032_1610507213.icoc:usersboywindowsAppDataRoamingSoftware Informercacheicons2294_032_3698860248.icoc:usersboywindowsAppDataRoamingSoftware Informercacheicons2330226_032_1266641185.icoc:usersboywindowsAppDataRoamingSoftware Informercacheicons2354347_032_2062261531.icoc:usersboywindowsAppDataRoamingSoftware Informercacheicons2481311_032_4025901400.icoc:usersboywindowsAppDataRoamingSoftware Informercacheicons2527422_032_3218280811.icoc:usersboywindowsAppDataRoamingSoftware Informercacheicons2548281_032_2826280069.icoc:usersboywindowsAppDataRoamingSoftware Informercacheicons2592803_032_2190212844.icoc:usersboywindowsAppDataRoamingSoftware Informercacheicons2710752_032_968381496.icoc:usersboywindowsAppDataRoamingSoftware Informercacheicons2878152_032_2149569022.icoc:usersboywindowsAppDataRoamingSoftware Informercacheicons2896909_032_709866058.icoc:usersboywindowsAppDataRoamingSoftware Informercacheicons2929620_032_893024884.icoc:usersboywindowsAppDataRoamingSoftware Informercacheicons2990607_032_76423116.icoc:usersboywindowsAppDataRoamingSoftware Informercacheicons3085707_032_37043174.icoc:usersboywindowsAppDataRoamingSoftware Informercacheicons308674_032_705353653.icoc:usersboywindowsAppDataRoamingSoftware Informercacheicons3089813_032_2138135450.icoc:usersboywindowsAppDataRoamingSoftware Informercacheicons3096710_032_1853702277.icoc:usersboywindowsAppDataRoamingSoftware Informercacheicons3123837_032_3920780318.icoc:usersboywindowsAppDataRoamingSoftware Informercacheicons3168922_032_3801458347.icoc:usersboywindowsAppDataRoamingSoftware Informercacheicons317006_032_756985516.icoc:usersboywindowsAppDataRoamingSoftware Informercacheicons3174163_032_233326420.icoc:usersboywindowsAppDataRoamingSoftware Informercacheicons3243224_032_641785894.icoc:usersboywindowsAppDataRoamingSoftware Informercacheicons3314036_032_3767566347.icoc:usersboywindowsAppDataRoamingSoftware Informercacheicons3532576_032_3766966796.icoc:usersboywindowsAppDataRoamingSoftware Informercacheicons3581721_032_2576088687.icoc:usersboywindowsAppDataRoamingSoftware Informercacheicons3645712_032_4002727011.icoc:usersboywindowsAppDataRoamingSoftware Informercacheicons3647012_032_1037055990.icoc:usersboywindowsAppDataRoamingSoftware Informercacheicons3647287_032_1335633164.icoc:usersboywindowsAppDataRoamingSoftware Informercacheicons3660369_032_2047775617.icoc:usersboywindowsAppDataRoamingSoftware Informercacheicons3761536_032_3222339862.icoc:usersboywindowsAppDataRoamingSoftware Informercacheicons3772329_032_3051189544.icoc:usersboywindowsAppDataRoamingSoftware Informercacheicons3804331_032_973534824.icoc:usersboywindowsAppDataRoamingSoftware Informercacheicons3808771_032_3582731317.icoc:usersboywindowsAppDataRoamingSoftware Informercacheicons3837930_032_2487960360.icoc:usersboywindowsAppDataRoamingSoftware Informercacheicons3857795_032_3044266728.icoc:usersboywindowsAppDataRoamingSoftware Informercacheicons3868075_032_201003365.icoc:usersboywindowsAppDataRoamingSoftware Informercacheicons3868146_032_1937914898.icoc:usersboywindowsAppDataRoamingSoftware Informercacheicons3876435_032_4253229146.icoc:usersboywindowsAppDataRoamingSoftware Informercacheicons3888161_032_2599268304.icoc:usersboywindowsAppDataRoamingSoftware Informercacheicons3954588_032_2116326299.icoc:usersboywindowsAppDataRoamingSoftware Informercacheicons3967841_032_2432835147.icoc:usersboywindowsAppDataRoamingSoftware Informercacheicons4026068_032_4065319896.icoc:usersboywindowsAppDataRoamingSoftware Informercacheicons4028548_032_2216598103.icoc:usersboywindowsAppDataRoamingSoftware Informercacheicons59177_032_1648728407.icoc:usersboywindowsAppDataRoamingSoftware Informercacheicons922013_032_1931758031.icoc:usersboywindowsAppDataRoamingSoftware InformercacheiconssiAAC.tmpc:usersboywindowsAppDataRoamingSoftware InformercacheiconssiAAD.tmpc:usersboywindowsAppDataRoamingSoftware InformercacheiconssiACD.tmpc:usersboywindowsAppDataRoamingSoftware InformercacheiconssiACE.tmpc:usersboywindowsAppDataRoamingSoftware InformercacheiconssiACF.tmpc:usersboywindowsAppDataRoamingSoftware InformercacheiconssiAE0.tmpc:usersboywindowsAppDataRoamingSoftware Informercomments.xmlc:usersboywindowsAppDataRoamingSoftware Informerdeskshcuts.xmlc:usersboywindowsAppDataRoamingSoftware InformerdrvList.xmlc:usersboywindowsAppDataRoamingSoftware Informergaotd.xmlc:usersboywindowsAppDataRoamingSoftware Informerifcache.xmlc:usersboywindowsAppDataRoamingSoftware InformerIMG_61846_359718.jpgc:usersboywindowsAppDataRoamingSoftware Informerlogin.xmlc:usersboywindowsAppDataRoamingSoftware Informernhistory.xmlc:usersboywindowsAppDataRoamingSoftware Informerserver.xmlc:usersboywindowsAppDataRoamingSoftware Informershtree.xmlc:usersboywindowsAppDataRoamingSoftware Informersiapp.xmlc:usersboywindowsAppDataRoamingSoftware InformersoftList.xmlc:usersboywindowsAppDataRoamingSoftware Informersoftusg.xmlc:usersboywindowsAppDataRoamingSoftware InformersuggestList.xmlc:usersboywindowsAppDataRoamingSoftware Informerukey.xml..(((((((((((((((((((((((((   Files Created from 2013-04-03 to 2013-05-03  )))))))))))))))))))))))))))))))..2013-05-03 09:00 . 2013-05-03 09:00	--------	d-----w-	c:usersboywindowsAppDataLocaltemp2013-05-03 09:00 . 2013-05-03 09:00	--------	d-----w-	c:usersUpdatusUserAppDataLocaltemp2013-05-03 09:00 . 2013-05-03 09:00	--------	d-----w-	c:usersDefaultAppDataLocaltemp2013-05-03 07:14 . 2013-05-03 07:14	60872	----a-w-	c:programdataMicrosoftWindows DefenderDefinition Updates{0AFA2977-8C8C-4FD3-A529-1EE6BABF95AF}offreg.dll2013-05-03 05:42 . 2013-04-10 03:08	6906960	----a-w-	c:programdataMicrosoftWindows DefenderDefinition Updates{0AFA2977-8C8C-4FD3-A529-1EE6BABF95AF}mpengine.dll2013-05-02 19:54 . 2013-05-02 19:54	--------	d-----w-	C:_OTL2013-04-30 20:07 . 2013-04-30 20:12	--------	d-----w-	c:program filesLSHunter.TV2013-04-30 19:45 . 2013-04-30 19:48	--------	d-----w-	c:program fileshdvidcodec.com2013-04-29 20:12 . 2013-04-29 20:43	--------	d-----w-	c:programdata188F1432-103A-4ffb-80F1-36B633C5C9E12013-04-27 17:22 . 2013-04-27 17:23	--------	d-----w-	c:program filesPoker Night 22013-04-27 10:08 . 2013-04-27 10:08	--------	d-----w-	c:usersboywindowsAppDataLocalOpera2013-04-27 10:08 . 2013-04-27 10:08	--------	d-----w-	c:program filesOpera2013-04-27 10:03 . 2013-04-27 10:03	--------	d-----w-	c:program filesCommon FilesSkype2013-04-26 21:25 . 2013-04-26 21:25	--------	d-----w-	c:windowssystem32NV2013-04-26 21:24 . 2013-05-03 05:40	--------	d-----w-	c:usersUpdatusUser.boywindows-PC2013-04-26 21:24 . 2013-04-19 02:23	4185888	----a-w-	c:windowssystem32nvcpl.dll2013-04-26 21:24 . 2013-04-19 02:23	3042080	----a-w-	c:windowssystem32nvsvc.dll2013-04-26 21:24 . 2013-04-19 02:23	640288	----a-w-	c:windowssystem32nvvsvc.exe2013-04-26 21:24 . 2013-04-19 02:23	869152	----a-w-	c:windowssystem32nv3dappshext.dll2013-04-26 21:24 . 2013-04-19 02:23	66560	----a-w-	c:windowssystem32nv3dappshextr.dll2013-04-26 21:24 . 2013-04-19 02:23	62752	----a-w-	c:windowssystem32nvshext.dll2013-04-26 21:24 . 2013-04-19 02:23	2555168	----a-w-	c:windowssystem32nvsvcr.dll2013-04-26 21:24 . 2013-04-19 02:23	223008	----a-w-	c:windowssystem32nvmctray.dll2013-04-26 21:24 . 2013-04-18 00:03	3122645	----a-w-	c:windowssystem32nvcoproc.bin2013-04-26 21:23 . 2013-04-26 21:23	--------	d-----w-	c:programdataNVIDIA Corporation2013-04-24 04:15 . 2013-04-12 13:45	1211752	----a-w-	c:windowssystem32driversntfs.sys2013-04-23 17:12 . 2013-04-23 17:12	--------	d-----w-	c:usersboywindowsAppDataLocalApple Computer2013-04-23 17:11 . 2013-04-29 20:43	--------	dc----w-	c:windowssystem32DRVSTORE2013-04-23 17:11 . 2013-04-23 17:11	--------	d-----w-	c:programdataApple Computer2013-04-23 17:10 . 2013-04-23 17:10	--------	d-----w-	c:usersboywindowsAppDataLocalApple2013-04-23 17:10 . 2013-04-23 17:10	--------	d-----w-	c:program filesApple Software Update2013-04-23 17:10 . 2013-04-23 17:10	--------	d-----w-	c:program filesBonjour2013-04-23 17:09 . 2013-04-29 20:43	--------	d-----w-	c:program filesCommon FilesApple2013-04-23 17:09 . 2013-04-23 17:10	--------	d-----w-	c:programdataApple2013-04-22 18:14 . 2013-04-22 18:17	--------	d-----w-	c:program filesRAR Password Recovery Professional2013-04-18 19:10 . 2013-04-30 20:09	--------	d-----w-	C:Games2013-04-10 05:21 . 2013-03-01 03:09	2347008	----a-w-	c:windowssystem32win32k.sys2013-04-10 05:21 . 2013-01-24 04:47	196328	----a-w-	c:windowssystem32driversfvevol.sys2013-04-10 05:21 . 2013-03-19 05:04	3968856	----a-w-	c:windowssystem32ntkrnlpa.exe2013-04-10 05:21 . 2013-03-19 05:04	3913560	----a-w-	c:windowssystem32ntoskrnl.exe2013-04-10 05:21 . 2013-03-19 04:48	38912	----a-w-	c:windowssystem32csrsrv.dll2013-04-10 05:21 . 2013-03-19 02:49	69632	----a-w-	c:windowssystem32smss.exe...((((((((((((((((((((((((((((((((((((((((   Find3M Report   )))))))))))))))))))))))))))))))))))))))))))))))))))).2013-05-01 23:06 . 2012-09-05 18:14	238872	------w-	c:windowssystem32MpSigStub.exe2013-03-18 22:13 . 2013-03-18 22:13	745472	----a-w-	c:windowssystem32MsSpellCheckingFacility.exe2013-03-18 22:13 . 2013-03-18 22:13	185344	----a-w-	c:windowssystem32elshyph.dll2013-03-18 22:12 . 2013-03-18 22:12	73728	----a-w-	c:windowssystem32SetIEInstalledDate.exe2013-03-18 22:12 . 2013-03-18 22:12	719360	----a-w-	c:windowssystem32mshtmlmedia.dll2013-03-18 22:12 . 2013-03-18 22:12	61952	----a-w-	c:windowssystem32tdc.ocx2013-03-18 22:12 . 2013-03-18 22:12	523264	----a-w-	c:windowssystem32vbscript.dll2013-03-18 22:12 . 2013-03-18 22:12	48640	----a-w-	c:windowssystem32mshtmler.dll2013-03-18 22:12 . 2013-03-18 22:12	38400	----a-w-	c:windowssystem32imgutil.dll2013-03-18 22:12 . 2013-03-18 22:12	361984	----a-w-	c:windowssystem32html.iec2013-03-18 22:12 . 2013-03-18 22:12	23040	----a-w-	c:windowssystem32licmgr10.dll2013-03-18 22:12 . 2013-03-18 22:12	158720	----a-w-	c:windowssystem32msls31.dll2013-03-18 22:12 . 2013-03-18 22:12	150528	----a-w-	c:windowssystem32iexpress.exe2013-03-18 22:12 . 2013-03-18 22:12	1441280	----a-w-	c:windowssystem32inetcpl.cpl2013-03-18 22:12 . 2013-03-18 22:12	138752	----a-w-	c:windowssystem32wextract.exe2013-03-18 22:12 . 2013-03-18 22:12	137216	----a-w-	c:windowssystem32ieUnatt.exe2013-03-18 22:12 . 2013-03-18 22:12	12800	----a-w-	c:windowssystem32mshta.exe2013-03-18 22:12 . 2013-03-18 22:12	110592	----a-w-	c:windowssystem32IEAdvpack.dll2013-03-13 18:39 . 2012-09-05 18:07	73432	----a-w-	c:windowssystem32FlashPlayerCPLApp.cpl2013-03-13 18:39 . 2012-09-05 18:07	693976	----a-w-	c:windowssystem32FlashPlayerApp.exe2013-02-12 04:48 . 2013-03-13 18:00	474112	----a-w-	c:windowsapppatchAcSpecfc.dll2013-02-12 04:48 . 2013-03-13 18:00	2176512	----a-w-	c:windowsapppatchAcGenral.dll2013-02-12 03:32 . 2013-03-15 04:46	15872	----a-w-	c:windowssystem32driversusb8023.sys2013-02-09 22:22 . 2009-08-18 09:30	564632	----a-w-	c:programdataMicrosoftIdentityCRLproductionwlidui.dll2013-02-09 22:22 . 2009-08-18 09:24	19696	----a-w-	c:programdataMicrosoftIdentityCRLproductionppcrlconfig600.dll2013-04-12 06:13 . 2013-04-12 06:13	263064	----a-w-	c:program filesmozilla firefoxcomponentsbrowsercomps.dll..(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shown REGEDIT4.[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]"RtHDVCpl"="c:program filesRealtekAudioHDARtHDVCpl.exe" [2011-07-12 10754664]"Adobe ARM"="c:program filesCommon FilesAdobeARM1.0AdobeARM.exe" [2012-12-03 946352]"IgfxTray"="c:windowssystem32igfxtray.exe" [2012-12-14 146032]"HotKeysCmds"="c:windowssystem32hkcmd.exe" [2012-12-14 181360]"Persistence"="c:windowssystem32igfxpers.exe" [2012-12-14 190064]"BCSSync"="c:program filesMicrosoft OfficeOffice14BCSSync.exe" [2010-03-13 91520]"APSDaemon"="c:program filesCommon FilesAppleApple Application SupportAPSDaemon.exe" [2013-01-28 59720].[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionpoliciessystem]"ConsentPromptBehaviorAdmin"= 0 (0x0)"ConsentPromptBehaviorUser"= 3 (0x3)"EnableUIADesktopToggle"= 0 (0x0).[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversionwindows]"AppInit_DLLs"=c:windowsSystem32nvinit.dll.[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversiondrivers32]"aux1"=wdmaud.drv.[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregAdobe ARM]2012-12-03 07:35	946352	----a-w-	c:program filesCommon FilesAdobeARM1.0AdobeARM.exe.[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregAdobeAAMUpdater-1.0]2012-09-20 05:27	444904	----a-w-	c:program filesCommon FilesAdobeOOBEPDAppUWAupdaterstartuputility.exe.[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregAdobeCS5.5ServiceManager]2011-01-12 04:08	1523360	----a-w-	c:program filesCommon FilesAdobeCS5.5ServiceManagerCS5.5ServiceManager.exe.[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregBCSSync]2010-03-13 11:54	91520	----a-w-	c:program filesMicrosoft OfficeOffice14BCSSync.exe.[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregDAEMON Tools Lite]2012-11-06 10:46	3673728	----a-w-	c:program filesDAEMON Tools LiteDTLite.exe.[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregIgfxTray]2012-12-14 00:02	146032	----a-w-	c:windowsSystem32igfxtray.exe.[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregPC Auto Shutdown]2012-11-14 13:57	1438000	----a-w-	c:program filesPC Auto ShutdownAutoShutdown.exe.[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregPersistence]2012-12-14 00:02	190064	----a-w-	c:windowsSystem32igfxpers.exe.[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregSkype]2013-02-28 15:50	18642024	----a-r-	c:program filesSkypePhoneSkype.exe.[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregSteam]2012-12-25 18:08	1354736	----a-w-	c:program filesSteamSteam.exe.[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregSunJavaUpdateSched]2012-07-03 06:04	252848	----a-w-	c:program filesCommon FilesJavaJava Updatejusched.exe.[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregSwitchBoard]2010-02-19 10:37	517096	----a-w-	c:program filesCommon FilesAdobeSwitchBoardSwitchBoard.exe.[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregWinampAgent]2012-06-28 15:40	74752	----a-w-	c:program filesWinampwinampa.exe.R2 SkypeUpdate;Skype Updater;c:program filesSkypeUpdaterUpdater.exe [x]R3 ALSysIO;ALSysIO;c:usersBOYWIN~1AppDataLocalTempALSysIO.sys [x]R3 AMPPALP;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Protocol;c:windowssystem32DRIVERSamppal.sys [x]R3 cpuz135;cpuz135;c:windowsTEMPcpuz135cpuz135_x32.sys [x]R3 Futuremark SystemInfo Service;Futuremark SystemInfo Service;c:program filesFuturemarkFuturemark SystemInfoFMSISvc.exe [x]R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:windowssystem32driversrdpvideominiport.sys [x]R3 SwitchBoard;Adobe SwitchBoard;c:program filesCommon FilesAdobeSwitchBoardSwitchBoard.exe [x]R3 TsUsbFlt;TsUsbFlt;c:windowssystem32driverstsusbflt.sys [x]R3 WatAdminSvc;Windows Activation Technologies Service;c:windowssystem32WatWatAdminSvc.exe [x]R4 SearchIndexer;Search Indexer;c:windowssystem32svchost.exe [x]S0 nvpciflt;nvpciflt;c:windowssystem32DRIVERSnvpciflt.sys [x]S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:windowssystem32DRIVERSdtsoftbus01.sys [x]S2 AMPPALR3;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Service;c:program filesIntelBluetoothHSBTHSAmpPalService.exe [x]S2 BTHSSecurityMgr;Intel(R) Centrino(R) Wireless Bluetooth(R) 3.0 + High Speed Security Service;c:program filesIntelBluetoothHSBTHSSecurityMgr.exe [x]S2 PCAutoShutdown_Service;PCAutoShutdown_Service;c:program filesPC Auto ShutdownShutdownService.exe [x]S2 TeamViewer8;TeamViewer 8;c:program filesTeamViewerVersion8TeamViewer_Service.exe [x]S2 UNS;Intel(R) Management and Security Application User Notification Service;c:program filesIntelIntel(R) Management Engine ComponentsUNSUNS.exe [x]S3 AMPPAL;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Virtual Adapter;c:windowssystem32DRIVERSAMPPAL.sys [x]S3 btmhsf;btmhsf;c:windowssystem32DRIVERSbtmhsf.sys [x]S3 iBtFltCoex;iBtFltCoex;c:windowssystem32DRIVERSiBtFltCoex.sys [x]S3 IntcDAud;Intel(R) Display Audio;c:windowssystem32DRIVERSIntcDAud.sys [x]S3 MEI;Intel(R) Management Engine Interface;c:windowssystem32DRIVERSHECI.sys [x]S3 NETwNs32;___ Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 32 Bit;c:windowssystem32DRIVERSNetwsn00.sys [x]S3 RTL8167;Realtek 8167 NT Driver;c:windowssystem32DRIVERSRt86win7.sys [x]..[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversionsvchost]LocalServiceAndNoImpersonation	REG_MULTI_SZ   	SSDPSRV upnphost SCardSvr TBS fdrespub AppIDSvc QWAVE wcncsvc Mcx2Svc SensrSvcGPSvcGroup	REG_MULTI_SZ   	GPSvc.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionSvchost  - NetSvcsSearchIndexerSearchIndexerSearchIndexerSearchIndexerSearchIndexerSearchIndexerSearchIndexer.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionSvchost  - LocalServiceFontCache..Contents of the 'Scheduled Tasks' folder.2013-05-03 c:windowsTasksAdobe Flash Player Updater.job- c:windowssystem32MacromedFlashFlashPlayerUpdateService.exe [2012-09-05 18:39].2013-05-02 c:windowsTasksGoogleUpdateTaskUserS-1-5-21-682926853-2598639674-846204972-1000Core.job- c:usersboywindowsAppDataLocalGoogleUpdateGoogleUpdate.exe [2013-04-02 18:25].2013-05-03 c:windowsTasksGoogleUpdateTaskUserS-1-5-21-682926853-2598639674-846204972-1000UA.job- c:usersboywindowsAppDataLocalGoogleUpdateGoogleUpdate.exe [2013-04-02 18:25]..------- Supplementary Scan -------.IE: E&xport to Microsoft Excel - c:progra~1MICROS~1Office14EXCEL.EXE/3000IE: Se&nd to OneNote - c:progra~1MICROS~1Office14ONBttnIE.dll/105TCP: Interfaces{A5A5B288-E30A-4336-BF55-B79686B2861D}: NameServer = 95.111.36.51,89.190.192.247TCP: Interfaces{AC282E77-31F5-4811-893B-2C58B60358BD}: NameServer = 89.215.233.2 89.215.246.40FF - ProfilePath - c:usersboywindowsAppDataRoamingMozillaFirefoxProfiles04e2rub9.default-1361214403999FF - prefs.js: browser.startup.homepage - hxxps://www.google.com/FF - ExtSQL: 2013-04-30 23:07; [email protected]; c:usersboywindowsAppDataRoamingMozillaFirefoxProfiles04e2rub9.default-1361214403999extensionsfhdp@fhdp.tv.xpi..--------------------- LOCKED REGISTRY KEYS ---------------------.[HKEY_USERSS-1-5-21-682926853-2598639674-846204972-1000SoftwareSecuROM!CAUTION! NEVER A OR CHANGE ANY KEY*]@Allowed: (Read) (RestrictedCode)"??"=hex:88,3e,a7,d7,c8,b9,20,af,a7,2f,7c,f5,25,e9,8c,3a,7c,25,e8,07,f7,9d,16,   59,d8,d2,ab,fa,7e,ec,5a,69,3c,d8,5b,3c,10,a7,02,47,a3,5a,f7,24,a5,5a,02,12,"??"=hex:35,fc,c6,3d,c9,02,ad,db,37,1f,61,de,0f,33,8f,50.[HKEY_LOCAL_MACHINEsystemControlSet001ControlClass{4D36E96D-E325-11CE-BFC1-08002BE10318}0000AllUserSettings]@Denied: (A) (Users)@Denied: (A) (Everyone)@Allowed: (B 1 2 3 4 5) (S-1-5-20)"BlindDial"=dword:00000000.[HKEY_LOCAL_MACHINEsystemControlSet001ControlPCWSecurity]@Denied: (Full) (Everyone).Completion time: 2013-05-03  12:01:37ComboFix-quarantined-files.txt  2013-05-03 09:01ComboFix2.txt  2013-05-03 08:16ComboFix3.txt  2013-05-03 07:21.Pre-Run: 109,965,447,168 bytes freePost-Run: 109,675,700,224 bytes free.- - End Of File - - 83BAD75F988DF537D9525F14A0B345C6

Ето линк:

Сега ще видим дали има проблем. Ако няма да трия ли папката?

Редактирано 3 май 201313 г. от B-boy[StyLe]
Премахнат опасен линк! :) (преглед на промените)

Още не...имаме да възстановим малко погрешно изтрити файлове от Combofix (след първоначалното стартиране на програмата)...ако не ги върнем предполагам игрите, асоциирани с тях няма да вървят.

 

С copy/paste въведете следната информация:

 

Dequarantine:: c:qooboxquarantinecwindowssystem32frapsvid.dll.vir c:qooboxquarantinecwindowssystem32ubiorbitapi_r2_loader.dll.vir C:QooboxQuarantineCwindowssystem32update C:QooboxQuarantineCwindowssystem32updatediablo121016.cl.vir C:QooboxQuarantineCwindowssystem32updatediakgcn121016.cl.vir C:QooboxQuarantineCwindowssystem32updatelibcurl-4.dll.vir C:QooboxQuarantineCwindowssystem32updatelibeay32.dll.vir C:QooboxQuarantineCwindowssystem32updatelibidn-11.dll.vir C:QooboxQuarantineCwindowssystem32updatelibusb-1.0.dll.vir C:QooboxQuarantineCwindowssystem32updatephatk121016.cl.vir C:QooboxQuarantineCwindowssystem32updatepoclbm121016.cl.vir C:QooboxQuarantineCwindowssystem32updatepoclbm121016GeForce 315Mv1w256l4.bin.vir C:QooboxQuarantineCwindowssystem32updatepthreadGC2.dll.vir C:QooboxQuarantineCwindowssystem32updatescrypt121016.cl.vir C:QooboxQuarantineCwindowssystem32updatessleay32.dll.vir C:QooboxQuarantineCwindowssystem32updatezlib1.dll.vir Quit::

 

Запазете файла с име CFScript и го провлачете и пуснете в Combofix.

Публикувайте новия лог файл.

И след това ако няма повече проблеми ще деинсталираме Combofix и папката ще изчезна сама!

Проблема го няма вече, но след пускане с горния код, combo fix от къде да го махна? В С-панела го няма.

Няма го в Control Panel-a.

Искам първо да видя лог файла и след това ще ви кажа от къде да го махнете.

Май много държите да се самолекувате...хем имате проблем, хем препирате да правите нещата на своя глава.

c:qooboxquarantinecwindowssystem32frapsvid.dll.vir -> c:windowssystem32frapsvid.dll ( 65536 bytes ) c:qooboxquarantinecwindowssystem32ubiorbitapi_r2_loader.dll.vir -> c:windowssystem32ubiorbitapi_r2_loader.dll ( 228864 bytes ) C:QooboxQuarantineCwindowssystem32updatediablo121016.cl.vir -> C:windowssystem32updatediablo121016.cl ( 44223 bytes ) C:QooboxQuarantineCwindowssystem32updatediakgcn121016.cl.vir -> C:windowssystem32updatediakgcn121016.cl ( 30802 bytes ) C:QooboxQuarantineCwindowssystem32updatelibcurl-4.dll.vir -> C:windowssystem32updatelibcurl-4.dll ( 322048 bytes ) C:QooboxQuarantineCwindowssystem32updatelibeay32.dll.vir -> C:windowssystem32updatelibeay32.dll ( 1479680 bytes ) C:QooboxQuarantineCwindowssystem32updatelibidn-11.dll.vir -> C:windowssystem32updatelibidn-11.dll ( 224256 bytes ) C:QooboxQuarantineCwindowssystem32updatelibusb-1.0.dll.vir -> C:windowssystem32updatelibusb-1.0.dll ( 109568 bytes ) C:QooboxQuarantineCwindowssystem32updatephatk121016.cl.vir -> C:windowssystem32updatephatk121016.cl ( 13062 bytes ) C:QooboxQuarantineCwindowssystem32updatepoclbm121016.cl.vir -> C:windowssystem32updatepoclbm121016.cl ( 42958 bytes ) C:QooboxQuarantineCwindowssystem32updatepoclbm121016GeForce 315Mv1w256l4.bin.vir -> C:windowssystem32updatepoclbm121016GeForce 315Mv1w256l4.bin ( 200697 bytes ) C:QooboxQuarantineCwindowssystem32updatepthreadGC2.dll.vir -> C:windowssystem32updatepthreadGC2.dll ( 45056 bytes ) C:QooboxQuarantineCwindowssystem32updatescrypt121016.cl.vir -> C:windowssystem32updatescrypt121016.cl ( 23124 bytes ) C:QooboxQuarantineCwindowssystem32updatessleay32.dll.vir -> C:windowssystem32updatessleay32.dll ( 323584 bytes ) C:QooboxQuarantineCwindowssystem32updatezlib1.dll.vir -> C:windowssystem32updatezlib1.dll ( 122368 bytes ) C:QooboxQuarantineCwindowssystem32updatediablo121016.cl -> C:windowssystem32updatediablo121016.clC:QooboxQuarantineCwindowssystem32updatediakgcn121016.cl -> C:windowssystem32updatediakgcn121016.clC:QooboxQuarantineCwindowssystem32updatelibcurl-4.dll -> C:windowssystem32updatelibcurl-4.dllC:QooboxQuarantineCwindowssystem32updatelibeay32.dll -> C:windowssystem32updatelibeay32.dllC:QooboxQuarantineCwindowssystem32updatelibidn-11.dll -> C:windowssystem32updatelibidn-11.dllC:QooboxQuarantineCwindowssystem32updatelibusb-1.0.dll -> C:windowssystem32updatelibusb-1.0.dllC:QooboxQuarantineCwindowssystem32updatephatk121016.cl -> C:windowssystem32updatephatk121016.clC:QooboxQuarantineCwindowssystem32updatepoclbm121016.cl -> C:windowssystem32updatepoclbm121016.clC:QooboxQuarantineCwindowssystem32updatepoclbm121016GeForce 315Mv1w256l4.bin -> C:windowssystem32updatepoclbm121016GeForce 315Mv1w256l4.binC:QooboxQuarantineCwindowssystem32updatepthreadGC2.dll -> C:windowssystem32updatepthreadGC2.dllC:QooboxQuarantineCwindowssystem32updatescrypt121016.cl -> C:windowssystem32updatescrypt121016.clC:QooboxQuarantineCwindowssystem32updatessleay32.dll -> C:windowssystem32updatessleay32.dllC:QooboxQuarantineCwindowssystem32updatezlib1.dll -> C:windowssystem32updatezlib1.dll13 File(s) copied

Остава само да почистим:

 

Отворете Start => Run => и въведете командата Combofix /Uninstall (Има интервал място между Combofix и /Uninstall) => натиснете Enter

 

Изтеглете OTC.exe и го стартирайте. Натиснете бутона CleanUp!.
Рестартирайте компютъра, ако ви попита!

 

Обновете всички старти приложения, ако има засечени такива с помощта на PatchMyPC

 

Направете една контролна проверка с Eset Online Scanner и Malwarebytes' Anti-Malware.

 

Инсталирайте безплатна антивирусна програма по-избор, обновете дефинициите и и направете пълна проверка на системата си за всеки случай!

 

Поздрави!

 

Макирам случая като РЕШЕН!

Голям си! Не знам за кой път ми помагаш, не само в тази тема, но и в други мои теми, а също и в теми на други потребители, които прочитам при необходимост.

Правим каквото можем.

Поздрави и хубав ден!