Здравейте , HJT Team

 

Сканирах с каквото можах , но системата си е бавна.

'Аваст' откри някакъв спайуеър, премахна го...и толкова.

'Malwarebytes' не открива нищо.

Модифицирания Хост файл трябваше да забърза зареждането на интернет страниците....

DDS (Ver_2011-09-30.01) - NTFS_x86 Internet Explorer: 8.0.6001.18702Run by User1 at 22:29:22 on 2013-05-03Microsoft Windows XP Professional  5.1.2600.3.1251.359.1033.18.511.277 [GMT 3:00].AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}.============== Running Processes ================.C:WINDOWSExplorer.EXEC:Program FilesAVAST SoftwareAvastAvastSvc.exeC:Program FilesMalwarebytes' Anti-Malwarembamscheduler.exeC:WINDOWSsystem32umonit.exeC:Program FilesAVAST SoftwareAvastavastUI.exeC:WINDOWSsystem32ctfmon.exeC:Program FilesDatecsFlexType 2KFType2K.exeC:WINDOWSSystem32alg.exeC:WINDOWSsystem32wbemwmiprvse.exeC:WINDOWSsystem32svchost.exe -k netsvcsC:WINDOWSsystem32svchost.exe -k WudfServiceGroupC:WINDOWSsystem32svchost.exe -k NetworkServiceC:WINDOWSsystem32svchost.exe -k LocalServiceC:WINDOWSsystem32svchost.exe -k imgsvc.============== Pseudo HJT Report ===============.uStart Page = about:blankBHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:program filescommon filesadobeacrobatactivexAcroIEHelperShim.dllBHO: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - c:program filesavast softwareavastaswWebRepIE.dllBHO: Skype add-on for Internet Explorer: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - c:program filesskypetoolbarsinternet explorerskypeieplugin.dllBHO: QUICKfind BHO Object: {C08DF07A-3E49-4E25-9AB0-D3882835F153} - c:program filesidmquickfindpluginsIEHelp.dllTB: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - c:program filesavast softwareavastaswWebRepIE.dlluRun: [ctfmon.exe] c:windowssystem32ctfmon.exemRun: [NvCplDaemon] RUNDLL32.EXE c:windowssystem32NvCpl.dll,NvStartupmRun: [UMonit] c:windowssystem32umonit.exemRun: [avast] "c:program filesavast softwareavastavastUI.exe" /noguimRun: [QuickTime Task] "c:program filesquicktimeQTTask.exe" -atboottimemRun: [Adobe ARM] "c:program filescommon filesadobearm1.0AdobeARM.exe"dRun: [CTFMON.EXE] c:windowssystem32CTFMON.EXEStartupFolder: c:docume~1alluse~1.winstartm~1programsstartupflexty~1.lnk - c:program filesdatecsflextype 2kFType2K.exeuPolicies-Explorer: NoDriveTypeAutoRun = dword:145mPolicies-Explorer: NoDriveTypeAutoRun = dword:145IE: &D&ownload &with BitComet - c:program filesbitcometBitComet.exe/AddLink.htmIE: &D&ownload all video with BitComet - c:program filesbitcometBitComet.exe/AddVideo.htmIE: &D&ownload all with BitComet - c:program filesbitcometBitComet.exe/AddAllLink.htmIE: Е&кспортирай в Microsoft Excel - c:progra~1micros~2office10EXCEL.EXE/3000IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:program filesskypetoolbarsinternet explorerskypeieplugin.dllIE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%Network Diagnosticxpnetdiag.exeDPF: {31435657-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cabDPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cabTCP: NameServer = 46.40.72.17 46.40.72.18TCP: Interfaces{69FC2BF8-7D64-4D89-BB9E-029A30B79724} : DHCPNameServer = 46.40.72.17 46.40.72.18Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:program filescommon filesmicrosoft sharedweb foldersPKMCDO.DLLHandler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:program filesskypetoolbarsinternet explorerskypeieplugin.dllHandler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:program filescommon filesskypeSkype4COM.dllSSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:windowssystem32WPDShServiceObj.dllmASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "c:program filesgooglechromeapplication26.0.1410.64installerchrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chromeHosts: 127.0.0.1 ads.mcafee.comHosts: 127.0.0.1 analytics.microsoft.comHosts: 127.0.0.1 metrics.bitdefender.comHosts: 127.0.0.1 metrics.mcafee.comHosts: 127.0.0.1  om.symantec.com.Note: multiple HOSTS entries found. Please refer to Attach.txt.================= FIREFOX ===================.FF - ProfilePath - c:documents and settingsuser1application datamozillafirefoxprofilesvwn7cq7j.defaultFF - prefs.js: browser.startup.homepage - FF - plugin: c:documents and settingsuser1application datamozillafirefoxprofilesvwn7cq7j.defaultextensions{195a3098-0bd5-4e90-ae22-ba1c540afd1e}pluginsnpGarmin.dllFF - plugin: c:program filesadobereader 10.0readerairnppdf32.dllFF - plugin: c:program filesgoogleupdate1.3.21.145npGoogleUpdate3.dllFF - plugin: c:windowssystem32macromedflashNPSWF32_11_2_202_235.dll.============= SERVICES / DRIVERS ===============.R1 aswSnx;aswSnx;c:windowssystem32driversaswSnx.sys [2011-8-28 729752]R1 aswSP;aswSP;c:windowssystem32driversaswSP.sys [2011-8-28 355632]R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:windowssystem32driverscmdguard.sys [2009-5-12 110992]R2 aswFsBlk;aswFsBlk;c:windowssystem32driversaswFsBlk.sys [2011-8-28 21256]R2 avast! Antivirus;avast! Antivirus;c:program filesavast softwareavastAvastSvc.exe [2011-8-28 44808]R2 MBAMScheduler;MBAMScheduler;c:program filesmalwarebytes' anti-malwarembamscheduler.exe [2013-4-20 418376]R3 MBAMProtector;MBAMProtector;c:windowssystem32driversmbam.sys [2010-3-30 22856]S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:windowsmicrosoft.netframeworkv4.0.30319mscorsvw.exe [2010-3-18 130384]S2 gupdate;Ус»уі° Ѕ° Google рєту°»ё·°цёя (gupdate);c:program filesgoogleupdateGoogleUpdate.exe [2012-4-28 136176]S2 MBAMService;MBAMService;c:program filesmalwarebytes' anti-malwarembamservice.exe [2010-3-30 701512]S3 ALSysIO;ALSysIO;??c:docume~1user1locals~1tempalsysio.sys --> c:docume~1user1locals~1tempALSysIO.sys [?]S3 fixustor;fixustor;c:windowssystem32driversfixustor.sys [2011-1-3 6656]S3 gupdatem;Ус»уі° Ѕ° Google рєту°»ё·°цёя (gupdatem);c:program filesgoogleupdateGoogleUpdate.exe [2012-4-28 136176]S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:windowsmicrosoft.netframeworkv4.0.30319wpfWPFFontCache_v0400.exe [2010-3-18 753504]S4 cmdAgent;COMODO Internet Security Helper Service;c:program filescomodocomodo internet securitycmdagent.exe [2009-5-12 700152].=============== File Associations ===============.ShellExec: BitComet.exe: open="c:program filesbitcometBitComet.exe".=============== Created Last 30 ================.2013-04-11 14:56:55	--------	d-----w-	c:documents and settingsall users.windowsapplication dataPackage Cache2013-04-11 14:23:15	--------	d-----w-	c:documents and settingsuser1application dataGarmin.==================== Find3M  ====================.2013-04-04 11:50:32	22856	----a-w-	c:windowssystem32driversmbam.sys2009-02-08 06:51:37	26884384	----a-w-	c:program filesFreeVideoConverter(2).exe.============= FINISH: 22:29:47,06 ===============

.UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.IF REQUESTED, ZIP IT UP & ATTACH IT.DDS (Ver_2011-09-30.01).Microsoft Windows XP ProfessionalBoot Device: DeviceHarddiskVolume1Install Date: 29.12.2008 г. 20:42:24System Uptime: 03.5.2013 г. 20:57:45 (2 hours ago).Motherboard: Gigabyte Technology Co., Ltd. |  | GA-7S748Processor: AMD Sempron(tm)  | Socket A | 2002/167mhz.==== Disk Partitions =========================.A: is RemovableC: is FIXED (NTFS) - 18 GiB total, 10,197 GiB free.D: is FIXED (NTFS) - 47 GiB total, 33,169 GiB free.E: is FIXED (NTFS) - 12 GiB total, 11,748 GiB free.F: is CDROM ().==== Disabled Device Manager Items =============.Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}Description: Hamachi Network InterfaceDevice ID: ROOTNET0000Manufacturer: LogMeIn, Inc.Name: Hamachi Network InterfacePNP Device ID: ROOTNET0000Service: hamachi.Class GUID: {EEC5AD98-8080-425F-922A-DABF3DE3F69A}Description: N78Device ID: ROOTWPD0000Manufacturer: NokiaName: N78PNP Device ID: ROOTWPD0000Service: WUDFRd.==== System Restore Points ===================.No restore point in system..==== Hosts File Hijack ======================.Hosts: 127.0.0.1  ads.mcafee.comHosts: 127.0.0.1  analytics.microsoft.comHosts: 127.0.0.1  metrics.bitdefender.comHosts: 127.0.0.1  metrics.mcafee.comHosts: 127.0.0.1  om.symantec.comHosts: 127.0.0.1  ox-d.majorgeeks.comHosts: 127.0.0.1  ads.bleepingcomputer.comHosts: 127.0.0.1  wdcs.trendmicro.com.==== Installed Programs ======================..==== End Of File ===========================

Редактирано 3 май 201313 г. от nikolaijelev (преглед на промените)

Защо винаги се смята че е вирус????

Моля, дайте първо конфигурация, операционна система и работни температури.

Като включите компютъра първите 10 20 минути пак ли е бавен ?

Понеже ,  46 градуса на процесора, 36 на твърдия диск , 26 на дъното,  са температури които не си струва да се коментират.

Днес го почиствах компютъра.Операционната система я има в лога....нали?!

Не е това което трябва да бъде....и мисля , че е от остатъци от вируси.

Не се сърди, но като гледам машината е допотопна и е нормално да не върви както трябва - самите параметри са напълно недостатъчни ако използваш последни версии на браузър и антивирусна. Също така разгледай за подути кондензатори по дъно и захранване. Пусни тест и на самия твърд диск за грешки. Аз използвам HDD essential.

Тогава остава другото заразена ОС или проблем с ОС кога е преинсталиран за последно ?

Редактирано 3 май 201313 г. от jordan_951 (преглед на промените)

Рамта е малко, но подути кондензатори няма. Тест на диска не е правен.

Преинсталиран е преди няколко години.

 

П.П. Стар -да , обаче допотопен....ахахахах. Допотопен е 'Правец'-а на който навремето съм полагал изпити в училище.

Редактирано 3 май 201313 г. от nikolaijelev (преглед на промените)

Преди няколко години - май е дошъл времето му за преинстал или можеш да почистиш със CCleaner ненужните файлове и регистрите.    Ако не си го правил де !

Мисля, че е нужна преинсталация. Регистрите как са?

Oмазани от програми за автоматично почистване  на регистрите.

Здравейте...!Hosts File вие ли променихте..?

Да  , да ...аз го промених....

Изтеглете Security Check (автор: screen317) от тук или от тук и го запишете на десктопа.

• [*]Кликнете два пъти върху

SecurityCheck.exe и следвайте инструкциите. [*]Когато програмата завърши работата си, ще се отвори един текстов документ: checkup.txt. [*]Копирайте съдържанието на checkup.txt с Копирай (Copy) и с Постави (Paste) го поставете в следващия си коментар.

 

Изтеглете OTL (от OldTimer) и го запазете на вашия десктоп.
Кликнете два пъти върху OTL.exe, за да стартирате програмата.
Сложете отметки преди следните неща:

• [*]

Scan all users [*]Lop check [*]Purity check

Под секцията Extra Registry, изберете Use SafeList
Кликнете на Run Scan и изчакайте да завърши сканирането. (може да отнеме 10-15 минути)
Когато завърши, публикувайте следните два лог файла:

• [*]

OTL.txt (намира се на вашия десктоп) [*]Extras.txt (ще Ви се отвори автоматично)

Не се получи с двете...

На 'SecurityCheck' излезе прозорец , но не се появи текстов файл.

Оtl се стартира...

OTL logfile created on: 04.5.2013 г. 10:56:16 - Run 1OTL by OldTimer - Version 3.2.69.0     Folder = C:Documents and SettingsUser1DesktopWindows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstationInternet Explorer (Version = 8.0.6001.18702)Locale: 00000402 | Country: Bulgaria | Language: BGR | Date Format: dd.M.yyyy 'г.' 511,49 Mb Total Physical Memory | 228,23 Mb Available Physical Memory | 44,62% Memory free1,22 Gb Paging File | 0,96 Gb Available in Paging File | 78,57% Paging File freePaging file location(s): C:pagefile.sys 768 1536 [binary data] %SystemDrive% = C: | %SystemRoot% = C:WINDOWS | %ProgramFiles% = C:Program FilesDrive C: | 17,58 Gb Total Space | 10,18 Gb Free Space | 57,92% Space Free | Partition Type: NTFSDrive D: | 47,26 Gb Total Space | 33,15 Gb Free Space | 70,15% Space Free | Partition Type: NTFSDrive E: | 11,85 Gb Total Space | 11,75 Gb Free Space | 99,14% Space Free | Partition Type: NTFS Computer Name: HOME-F7D6C5A168 | User Name: User1 | Logged in as Administrator.Boot Mode: Normal | Scan Mode: All usersCompany Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days [color=#E56717]========== Processes (SafeList) ==========[/color] PRC - [2013.05.04 10:42:17 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:Documents and SettingsUser1DesktopOTL.exePRC - [2013.04.09 11:57:09 | 001,312,720 | ---- | M] (Google Inc.) -- C:Program FilesGoogleChromeApplicationchrome.exePRC - [2012.08.21 12:12:26 | 004,282,728 | ---- | M] (AVAST Software) -- C:Program FilesAVAST SoftwareAvastAvastUI.exePRC - [2012.08.21 12:12:25 | 000,044,808 | ---- | M] (AVAST Software) -- C:Program FilesAVAST SoftwareAvastAvastSvc.exePRC - [2008.04.14 15:00:00 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:WINDOWSexplorer.exePRC - [2005.08.06 06:31:16 | 000,053,248 | R--- | M] (General) -- C:WINDOWSsystem32umonit.exePRC - [2002.05.19 10:24:00 | 000,095,232 | ---- | M] () -- C:Program FilesDatecsFlexType 2KFType2K.exe  [color=#E56717]========== Modules (No Company Name) ==========[/color] MOD - [2013.05.03 22:41:49 | 002,082,816 | ---- | M] () -- C:Program FilesAVAST SoftwareAvastdefs13050301algo.dllMOD - [2013.04.09 11:57:07 | 000,390,096 | ---- | M] () -- C:Program FilesGoogleChromeApplication26.0.1410.64ppgooglenaclpluginchrome.dllMOD - [2013.04.09 11:57:05 | 004,050,896 | ---- | M] () -- C:Program FilesGoogleChromeApplication26.0.1410.64pdf.dllMOD - [2013.04.09 11:56:13 | 001,606,096 | ---- | M] () -- C:Program FilesGoogleChromeApplication26.0.1410.64ffmpegsumo.dllMOD - [2009.05.12 21:21:53 | 000,274,168 | ---- | M] () -- C:Program FilesCOMODOCOMODO Internet Securitycavshell.dllMOD - [2007.10.04 17:14:00 | 000,466,944 | ---- | M] () -- C:WINDOWSsystem32nvshell.dllMOD - [2006.09.07 10:58:16 | 000,008,704 | ---- | M] () -- C:Program FilesUnlockerUnlockerCOM.dllMOD - [2005.10.07 16:05:32 | 000,125,440 | ---- | M] () -- C:Program FilesWinRARRarExt.dllMOD - [2002.05.19 10:24:00 | 000,095,232 | ---- | M] () -- C:Program FilesDatecsFlexType 2KFType2K.exeMOD - [2002.04.23 01:17:06 | 000,045,056 | ---- | M] () -- C:WINDOWSsystem32newdll.dll  [color=#E56717]========== Services (SafeList) ==========[/color] SRV - [2012.08.21 12:12:25 | 000,044,808 | ---- | M] (AVAST Software) [Auto | Running] -- C:Program FilesAVAST SoftwareAvastAvastSvc.exe -- (avast! Antivirus)SRV - [2009.05.12 21:21:52 | 000,700,152 | ---- | M] () [Disabled | Stopped] -- C:Program FilesCOMODOCOMODO Internet Securitycmdagent.exe -- (cmdAgent)SRV - [2008.09.08 08:59:00 | 000,575,488 | ---- | M] (Nokia.) [On_Demand | Stopped] -- C:Program FilesNokiaPC Connectivity SolutionServiceLayer.exe -- (ServiceLayer)  [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV - File not found [Kernel | On_Demand | Stopped] --  -- (WDICA)DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRFRAME)DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRELI)DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDFRAME)DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDCOMP)DRV - File not found [Kernel | System | Stopped] --  -- (PCIDump)DRV - File not found [Kernel | System | Stopped] --  -- (lbrtfdc)DRV - File not found [Kernel | System | Stopped] --  -- (i2omgmt)DRV - File not found [Kernel | System | Stopped] --  -- (Changer)DRV - File not found [Kernel | On_Demand | Stopped] -- C:DOCUME~1User1LOCALS~1TempALSysIO.sys -- (ALSysIO)DRV - File not found [Kernel | On_Demand | Unknown] --  -- (a6v5augl)DRV - [2012.08.21 12:13:15 | 000,729,752 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:WINDOWSSystem32driversaswSnx.sys -- (aswSnx)DRV - [2012.08.21 12:13:15 | 000,355,632 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:WINDOWSSystem32driversaswSP.sys -- (aswSP)DRV - [2012.08.21 12:13:15 | 000,054,232 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:WINDOWSSystem32driversaswTdi.sys -- (aswTdi)DRV - [2012.08.21 12:13:14 | 000,097,608 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:WINDOWSSystem32driversaswmon2.sys -- (aswMon2)DRV - [2012.08.21 12:13:14 | 000,035,928 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:WINDOWSSystem32driversaswRdr.sys -- (aswRdr)DRV - [2012.08.21 12:13:13 | 000,025,256 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:WINDOWSSystem32driversaavmker4.sys -- (Aavmker4)DRV - [2012.08.21 12:13:13 | 000,021,256 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:WINDOWSSystem32driversaswFsBlk.sys -- (aswFsBlk)DRV - [2011.01.20 13:35:55 | 000,025,280 | ---- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Stopped] -- C:WINDOWSsystem32drivershamachi.sys -- (hamachi)DRV - [2009.05.12 21:22:01 | 000,110,992 | ---- | M] (COMODO) [File_System | System | Running] -- C:WINDOWSsystem32driverscmdguard.sys -- (cmdGuard)DRV - [2008.12.29 22:34:39 | 000,611,064 | ---- | M] () [Kernel | Boot | Running] -- C:WINDOWSsystem32driverssptd.sys -- (sptd)DRV - [2008.06.06 10:24:44 | 000,008,064 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Stopped] -- C:WINDOWSsystem32driversusbser_lowerflt.sys -- (upperdev)DRV - [2008.05.07 08:38:36 | 000,008,064 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Stopped] -- C:WINDOWSsystem32driversusbser_lowerfltj.sys -- (UsbserFilt)DRV - [2008.05.07 08:38:20 | 000,020,864 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:WINDOWSsystem32driversccdcmbo.sys -- (nmwcdc)DRV - [2008.05.07 08:38:20 | 000,017,536 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:WINDOWSsystem32driversccdcmb.sys -- (nmwcd)DRV - [2008.04.14 03:15:30 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:WINDOWSsystem32driversgameenum.sys -- (gameenum)DRV - [2008.04.14 01:05:40 | 000,020,992 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Running] -- C:WINDOWSsystem32driversRTL8139.sys -- (rtl8139)DRV - [2006.09.07 10:58:35 | 000,004,096 | ---- | M] () [Kernel | Unavailable | Unknown] -- C:Program FilesUnlockerUnlockerDriver5.sys -- (UnlockerDriver5)DRV - [2005.08.06 06:31:16 | 000,006,656 | R--- | M] (Genesys Logic) [Kernel | On_Demand | Stopped] -- C:WINDOWSsystem32driversfixustor.sys -- (fixustor)DRV - [2005.03.03 20:53:57 | 000,048,640 | ---- | M] (Protection Technology) [Kernel | Boot | Running] -- C:WINDOWSsystem32driverssfdrv01.sys -- (sfdrv01)DRV - [2005.02.23 18:59:54 | 000,006,656 | ---- | M] (Protection Technology) [Kernel | Boot | Running] -- C:WINDOWSsystem32driverssfhlp02.sys -- (sfhlp02)DRV - [2004.12.03 13:20:41 | 000,020,544 | ---- | M] (Protection Technology) [Kernel | Boot | Running] -- C:WINDOWSsystem32driverssfsync02.sys -- (sfsync02)DRV - [2003.08.15 10:53:12 | 000,462,684 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:WINDOWSsystem32driversALCXWDM.SYS -- (ALCXWDM)DRV - [2003.08.14 18:16:38 | 000,404,736 | ---- | M] (Sensaura Ltd) [Kernel | On_Demand | Running] -- C:WINDOWSsystem32driversALCXSENS.SYS -- (ALCXSENS)DRV - [2003.02.20 04:18:36 | 000,036,608 | R--- | M] (Silicon Integrated Systems Corporation) [Kernel | Boot | Running] -- C:WINDOWSsystem32driversSISAGPX.SYS -- (SISAGP)  [color=#E56717]========== Standard Registry (SafeList) ==========[/color]  [color=#E56717]========== Internet Explorer ==========[/color] IE - HKLM..SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}IE - HKLM..SearchScopes{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}  IE - HKU.DEFAULTSoftwareMicrosoftWindowsCurrentVersionInternet Settings: "ProxyEnable" = 0 IE - HKUS-1-5-18SoftwareMicrosoftWindowsCurrentVersionInternet Settings: "ProxyEnable" = 0   IE - HKUS-1-5-21-1757981266-115176313-1417001333-1003SOFTWAREMicrosoftInternet ExplorerMain,Start Page = about:blankIE - HKUS-1-5-21-1757981266-115176313-1417001333-1003..SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}IE - HKUS-1-5-21-1757981266-115176313-1417001333-1003..SearchScopes{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRCIE - HKUS-1-5-21-1757981266-115176313-1417001333-1003SoftwareMicrosoftWindowsCurrentVersionInternet Settings: "ProxyEnable" = 0 [color=#E56717]========== FireFox ==========[/color] FF - prefs.js..browser.search.update: falseFF - prefs.js..browser.startup.homepage: ""FF - prefs.js..extensions.enabledAddons: [email protected]:7.0.1466FF - prefs.js..extensions.enabledAddons: {195A3098-0BD5-4e90-AE22-BA1C540AFD1E}:4.0.4FF - user.js - File not found FF - [email protected]/FlashPlayer: C:WINDOWSsystem32MacromedFlashNPSWF32_11_2_202_235.dll ()FF - [email protected]/WPF,version=3.5: C:WINDOWSMicrosoft.NETFrameworkv3.5Windows Presentation FoundationNPWPF.dll (Microsoft Corporation)FF - [email protected]/Google Update;version=3: C:Program FilesGoogleUpdate1.3.21.145npGoogleUpdate3.dll (Google Inc.)FF - [email protected]/Google Update;version=9: C:Program FilesGoogleUpdate1.3.21.145npGoogleUpdate3.dll (Google Inc.)FF - HKLMSoftwareMozillaPluginsAdobe Reader: C:Program FilesAdobeReader 10.0ReaderAIRnppdf32.dll (Adobe Systems Inc.) FF - [email protected]: C:Program FilesAVAST SoftwareAvastWebRepFF [2012.08.22 20:58:01 | 000,000,000 | ---D | M]FF - HKEY_LOCAL_MACHINEsoftwaremozillaMozilla Firefox 3.6.15extensionsComponents: C:Program FilesMozilla Firefoxcomponents [2011.10.04 20:59:43 | 000,000,000 | ---D | M]FF - HKEY_LOCAL_MACHINEsoftwaremozillaMozilla Firefox 3.6.15extensionsPlugins: C:Program FilesMozilla Firefoxplugins [2013.03.20 07:56:43 | 000,000,000 | ---D | M] [2009.01.14 11:53:12 | 000,000,000 | ---D | M] (No name found) -- C:Documents and SettingsUser1Application DataMozillaExtensions[2013.04.11 17:19:06 | 000,000,000 | ---D | M] (No name found) -- C:Documents and SettingsUser1Application DataMozillaFirefoxProfilesvwn7cq7j.defaultextensions[2013.04.11 17:19:06 | 000,000,000 | ---D | M] (Garmin Communicator) -- C:Documents and SettingsUser1Application DataMozillaFirefoxProfilesvwn7cq7j.defaultextensions{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}[2009.01.14 11:53:13 | 000,000,000 | ---D | M] (No name found) -- C:Program FilesMozilla Firefoxextensions[2012.08.22 20:58:01 | 000,000,000 | ---D | M] (avast! WebRep) -- C:PROGRAM FILESAVAST SOFTWAREAVASTWEBREPFF[2011.06.24 08:39:45 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:Program Filesmozilla firefoxcomponentsbrowsercomps.dll[2011.05.07 12:35:12 | 000,001,083 | ---- | M] () -- C:Program Filesmozilla firefoxsearchplugins911bg.xml[2011.05.07 12:35:12 | 000,002,442 | ---- | M] () -- C:Program Filesmozilla firefoxsearchpluginsdiribg.xml[2011.05.07 12:35:12 | 000,001,515 | ---- | M] () -- C:Program Filesmozilla firefoxsearchpluginspe-bg.xml[2011.05.07 12:35:12 | 000,001,857 | ---- | M] () -- C:Program Filesmozilla firefoxsearchpluginsportalbgdict.xml[2011.05.07 12:35:12 | 000,001,220 | ---- | M] () -- C:Program Filesmozilla firefoxsearchpluginswikipedia-bg.xml [color=#E56717]========== Chrome  ==========[/color] CHR - default_search_provider: Google (Enabled)CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter}CHR - homepage: http://www.google.comCHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewerCHR - plugin: Native Client (Enabled) = C:Program FilesGoogleChromeApplication26.0.1410.64ppGoogleNaClPluginChrome.dllCHR - plugin: Chrome PDF Viewer (Enabled) = C:Program FilesGoogleChromeApplication26.0.1410.64pdf.dllCHR - plugin: Shockwave Flash (Enabled) = C:Program FilesGoogleChromeApplication26.0.1410.64gcswf32.dllCHR - plugin: Shockwave Flash (Enabled) = C:WINDOWSsystem32MacromedFlashNPSWF32_11_2_202_235.dllCHR - plugin: Adobe Acrobat (Enabled) = C:Program FilesAdobeReader 10.0ReaderBrowsernppdf32.dllCHR - plugin: Microsoftu00AE Windows Media Player Firefox Plugin (Enabled) = C:Program FilesMozilla Firefoxpluginsnp-mswmp.dllCHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:Program FilesMozilla Firefoxpluginsnpqtplugin.dllCHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:Program FilesMozilla Firefoxpluginsnpqtplugin2.dllCHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:Program FilesMozilla Firefoxpluginsnpqtplugin3.dllCHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:Program FilesMozilla Firefoxpluginsnpqtplugin4.dllCHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:Program FilesMozilla Firefoxpluginsnpqtplugin5.dllCHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:Program FilesMozilla Firefoxpluginsnpqtplugin6.dllCHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:Program FilesMozilla Firefoxpluginsnpqtplugin7.dllCHR - plugin: Google Update (Enabled) = C:Program FilesGoogleUpdate1.3.21.111npGoogleUpdate3.dllCHR - plugin: Windows Presentation Foundation (Enabled) = C:WINDOWSMicrosoft.NETFrameworkv3.5Windows Presentation FoundationNPWPF.dllCHR - Extension: YouTube = C:Documents and SettingsUser1Local SettingsApplication DataGoogleChromeUser DataDefaultExtensionsblpcfgokakmgnkcojhhkbfbldkacnbeo4.2.6_0CHR - Extension: Google u0422u044Au0440u0441u0435u043Du0435 = C:Documents and SettingsUser1Local SettingsApplication DataGoogleChromeUser DataDefaultExtensionscoobgpohoikkiipiblmjeljniedjpjpf0.0.0.20_0CHR - Extension: avast! WebRep = C:Documents and SettingsUser1Local SettingsApplication DataGoogleChromeUser DataDefaultExtensionsicmlaeflemplmjndnaapfdbbnpncnbda7.0.1466_0CHR - Extension: Gmail = C:Documents and SettingsUser1Local SettingsApplication DataGoogleChromeUser DataDefaultExtensionspjkljhegncpnkpknbcohdijeoejaedia7_1 O1 HOSTS File: ([2005.01.01 00:14:16 | 000,572,150 | ---- | M]) - C:WINDOWSsystem32driversetchostsO1 - Hosts: 127.0.0.1  localhostO1 - Hosts: ::1  localhost #[IPv6]O1 - Hosts: 127.0.0.1  fr.a2dfp.netO1 - Hosts: 127.0.0.1  m.fr.a2dfp.netO1 - Hosts: 127.0.0.1  ad.a8.netO1 - Hosts: 127.0.0.1  asy.a8ww.netO1 - Hosts: 127.0.0.1  abcstats.comO1 - Hosts: 127.0.0.1  a.abv.bgO1 - Hosts: 127.0.0.1  adserver.abv.bgO1 - Hosts: 127.0.0.1  adv.abv.bgO1 - Hosts: 127.0.0.1  bimg.abv.bgO1 - Hosts: 127.0.0.1  ca.abv.bgO1 - Hosts: 127.0.0.1  www2.a-counter.kiev.uaO1 - Hosts: 127.0.0.1  track.acclaimnetwork.comO1 - Hosts: 127.0.0.1  accuserveadsystem.comO1 - Hosts: 127.0.0.1  www.accuserveadsystem.comO1 - Hosts: 127.0.0.1  achmedia.comO1 - Hosts: 127.0.0.1  aconti.netO1 - Hosts: 127.0.0.1  secure.aconti.netO1 - Hosts: 127.0.0.1  www.aconti.net #[Dialer.Aconti]O1 - Hosts: 127.0.0.1  csh.actiondesk.comO1 - Hosts: 127.0.0.1  www.activemeter.com #[Tracking.Cookie]O1 - Hosts: 127.0.0.1  ads.activepower.netO1 - Hosts: 127.0.0.1  stat.active24stats.nl #[Tracking.Cookie]O1 - Hosts: 127.0.0.1  cms.ad2click.nlO1 - Hosts: 15485 more lines...O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:Program FilesAVAST SoftwareAvastaswWebRepIE.dll (AVAST Software)O2 - BHO: (QUICKfind BHO Object) - {C08DF07A-3E49-4E25-9AB0-D3882835F153} - C:Program FilesIDMQUICKfindPlugInsIEHelp.dll (IDM)O3 - HKLM..Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:Program FilesAVAST SoftwareAvastaswWebRepIE.dll (AVAST Software)O3 - HKLM..Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - No CLSID value found.O4 - HKLM..Run: [avast] C:Program FilesAVAST SoftwareAvastavastUI.exe (AVAST Software)O4 - HKLM..Run: [NvCplDaemon] C:WINDOWSSystem32NvCpl.dll (NVIDIA Corporation)O4 - HKLM..Run: [UMonit] C:WINDOWSsystem32umonit.exe (General)O4 - Startup: C:Documents and SettingsAll Users.WINDOWSStart MenuProgramsStartupFlexType 2K.lnk = C:Program FilesDatecsFlexType 2KFType2K.exe ()O7 - HKU.DEFAULTSOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorer: NoDriveTypeAutoRun = 145O7 - HKUS-1-5-18SOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorer: NoDriveTypeAutoRun = 145O7 - HKUS-1-5-19SOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorer: NoDriveTypeAutoRun = 145O7 - HKUS-1-5-20SOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorer: NoDriveTypeAutoRun = 145O7 - HKUS-1-5-21-1757981266-115176313-1417001333-1003SOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorer: NoDriveTypeAutoRun = 145O8 - Extra context menu item: &D&ownload &with BitComet - C:Program FilesBitCometBitComet.exe (www.BitComet.com)O8 - Extra context menu item: &D&ownload all video with BitComet - C:Program FilesBitCometBitComet.exe (www.BitComet.com)O8 - Extra context menu item: &D&ownload all with BitComet - C:Program FilesBitCometBitComet.exe (www.BitComet.com)O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} http://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab (Reg Error: Key error.)O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)O17 - HKLMSystemCCSServicesTcpipParameters: DhcpNameServer = 46.40.72.17 46.40.72.18O17 - HKLMSystemCCSServicesTcpipParametersInterfaces{69FC2BF8-7D64-4D89-BB9E-029A30B79724}: DhcpNameServer = 46.40.72.17 46.40.72.18O18 - ProtocolHandlerskype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:Program FilesCommon FilesSkypeSkype4COM.dll (Skype Technologies)O18 - ProtocolFilterapplication/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll File not foundO18 - ProtocolFilterapplication/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll File not foundO18 - ProtocolFilterapplication/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll File not foundO20 - HKLM Winlogon: Shell - (Explorer.exe) -  File not foundO20 - HKLM Winlogon: UserInit - (C:WINDOWSsystem32userinit.exe) - C:WINDOWSsystem32userinit.exe (Microsoft Corporation)O20 - HKLM Winlogon: UIHost - (logonui.exe) -  File not foundO20 - HKLM Winlogon: VMApplet - (Control_RunDLL "sysdm.cpl") -  File not foundO20 - WinlogonNotifycrypt32chain: DllName - (crypt32.dll) -  File not foundO20 - WinlogonNotifycryptnet: DllName - (cryptnet.dll) -  File not foundO20 - WinlogonNotifycscdll: DllName - (cscdll.dll) -  File not foundO20 - WinlogonNotifyScCertProp: DllName - (wlnotify.dll) -  File not foundO20 - WinlogonNotifySchedule: DllName - (wlnotify.dll) -  File not foundO20 - WinlogonNotifysclgntfy: DllName - (sclgntfy.dll) -  File not foundO20 - WinlogonNotifySensLogn: DllName - (WlNotify.dll) -  File not foundO20 - WinlogonNotifytermsrv: DllName - (wlnotify.dll) -  File not foundO20 - WinlogonNotifywlballoon: DllName - (wlnotify.dll) -  File not foundO24 - Desktop WallPaper: C:Documents and SettingsUser1Local SettingsApplication DataMicrosoftWallpaper1.bmpO24 - Desktop BackupWallPaper: C:Documents and SettingsUser1Local SettingsApplication DataMicrosoftWallpaper1.bmpO28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - shell32.dll File not foundO29 - HKLM SecurityProviders - (msapsspc.dll) -  File not foundO29 - HKLM SecurityProviders - (schannel.dll) -  File not foundO29 - HKLM SecurityProviders - (digest.dll) -  File not foundO29 - HKLM SecurityProviders - (msnsspc.dll) -  File not foundO32 - HKLM CDRom: AutoRun - 1O32 - AutoRun File - [1988.08.31 02:12:06 | 000,000,000 | ---- | M] () - C:AUTOEXEC.BAT -- [ NTFS ]O33 - MountPoints2{212b3af6-a69d-11e2-a28b-4c001023495c}ShellAutoRuncommand - "" = J:Setup.exeO33 - MountPoints2KShellAutoRuncommand - "" = K:wd_windows_toolsWDSetup.exeO34 - HKLM BootExecute: (autocheck autochk *)O35 - HKLM..comfile [open] -- "%1" %*O35 - HKLM..exefile [open] -- "%1" %*O37 - HKLM...com [@ = comfile] -- "%1" %*O37 - HKLM...exe [@ = exefile] -- "%1" %*O38 - SubSystemsWindows: (ServerDll=winsrv:UserServerDllInitialization,3)O38 - SubSystemsWindows: (ServerDll=winsrv:ConServerDllInitialization,2) [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [2013.05.04 10:54:58 | 000,174,592 | ---- | C] (Microsoft Corporation) -- C:WINDOWSSystem32framedyn.dll[2013.05.04 10:54:31 | 000,174,592 | ---- | C] (Microsoft Corporation) -- C:Documents and SettingsUser1Desktopframedyn.dll[2013.05.04 10:42:14 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:Documents and SettingsUser1DesktopOTL.exe[2013.05.04 04:26:15 | 000,000,000 | ---D | C] -- C:Documents and SettingsUser1Doctor Web[2013.05.04 03:58:25 | 000,000,000 | ---D | C] -- C:Documents and SettingsAll Users.WINDOWSStart MenuProgramsCCleaner[2013.05.04 03:58:20 | 000,000,000 | ---D | C] -- C:Program FilesCCleaner[2013.05.03 22:26:31 | 000,492,146 | R--- | C] (Swearware) -- C:Documents and SettingsUser1Desktopdds.exe[2013.04.11 17:56:55 | 000,000,000 | ---D | C] -- C:Documents and SettingsAll Users.WINDOWSApplication DataPackage Cache[2013.04.11 17:23:15 | 000,000,000 | ---D | C] -- C:Documents and SettingsUser1Application DataGarmin[2009.02.08 09:50:28 | 026,884,384 | ---- | C] (Extensoft) -- C:Program FilesFreeVideoConverter(2).exe[4 C:WINDOWSSystem32*.tmp files -> C:WINDOWSSystem32*.tmp -> ][3 C:WINDOWS*.tmp files -> C:WINDOWS*.tmp -> ] [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [2013.05.04 10:42:17 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:Documents and SettingsUser1DesktopOTL.exe[2013.05.04 10:40:37 | 000,890,825 | ---- | M] () -- C:Documents and SettingsUser1DesktopSecurityCheck.exe[2013.05.04 10:25:00 | 000,000,984 | ---- | M] () -- C:WINDOWStasksGoogleUpdateTaskMachineUA.job[2013.05.04 09:21:03 | 000,000,116 | ---- | M] () -- C:WINDOWSNeroDigital.ini[2013.05.04 09:11:10 | 000,472,732 | ---- | M] () -- C:WINDOWSSystem32perfh009.dat[2013.05.04 09:11:10 | 000,075,574 | ---- | M] () -- C:WINDOWSSystem32perfc009.dat[2013.05.04 09:10:49 | 000,000,364 | -H-- | M] () -- C:WINDOWStasksavast! Emergency Update.job[2013.05.04 09:10:06 | 000,000,980 | ---- | M] () -- C:WINDOWStasksGoogleUpdateTaskMachineCore.job[2013.05.04 09:09:54 | 000,002,206 | ---- | M] () -- C:WINDOWSSystem32wpa.dbl[2013.05.04 09:09:53 | 000,002,048 | --S- | M] () -- C:WINDOWSbootstat.dat[2013.05.04 09:09:51 | 536,403,968 | -HS- | M] () -- C:hiberfil.sys[2013.05.04 03:58:25 | 000,000,682 | ---- | M] () -- C:Documents and SettingsAll Users.WINDOWSDesktopCCleaner.lnk[2013.05.03 23:20:13 | 000,000,658 | ---- | M] () -- C:Documents and SettingsUser1DesktopПряк път до everest.lnk[2013.05.03 22:26:39 | 000,492,146 | R--- | M] (Swearware) -- C:Documents and SettingsUser1Desktopdds.exe[2013.04.22 21:42:27 | 000,000,038 | ---- | M] () -- C:WINDOWSavisplitter.INI[2013.04.21 23:40:02 | 000,000,155 | ---- | M] () -- C:WINDOWSwinamp.ini[2013.04.19 20:13:55 | 000,002,541 | ---- | M] () -- C:Documents and SettingsUser1DesktopMicrosoft Word.lnk[2013.04.10 08:21:30 | 000,001,815 | ---- | M] () -- C:Documents and SettingsAll Users.WINDOWSDesktopGoogle Chrome.lnk[4 C:WINDOWSSystem32*.tmp files -> C:WINDOWSSystem32*.tmp -> ][3 C:WINDOWS*.tmp files -> C:WINDOWS*.tmp -> ] [color=#E56717]========== Files Created - No Company Name ==========[/color] [2013.05.04 10:40:34 | 000,890,825 | ---- | C] () -- C:Documents and SettingsUser1DesktopSecurityCheck.exe[2013.05.04 03:58:25 | 000,000,682 | ---- | C] () -- C:Documents and SettingsAll Users.WINDOWSDesktopCCleaner.lnk[2013.05.03 23:20:13 | 000,000,658 | ---- | C] () -- C:Documents and SettingsUser1DesktopПряк път до everest.lnk[2011.07.18 21:43:43 | 000,000,012 | ---- | C] () -- C:Documents and SettingsAll Users.WINDOWSApplication DataReminderNextRun[2011.07.10 07:36:47 | 000,000,107 | ---- | C] () -- C:WINDOWSWET.INI[2009.01.24 20:12:00 | 000,000,008 | ---- | C] () -- C:Documents and SettingsUser1Application DataNMM-MetaData.db[2008.12.30 00:41:10 | 000,084,480 | ---- | C] () -- C:Documents and SettingsUser1Local SettingsApplication DataDCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [color=#E56717]========== ZeroAccess Check ==========[/color] [2009.01.08 17:37:12 | 000,000,227 | RHS- | M] () -- C:WINDOWSassemblyDesktop.ini [HKEY_CURRENT_USERSoftwareClassesclsid{42aedc87-2188-41fd-b9a3-0c966feabec1}InProcServer32] [HKEY_CURRENT_USERSoftwareClassesclsid{fbeb8a05-beee-4442-804e-409d6c4515e9}InProcServer32] [HKEY_LOCAL_MACHINESoftwareClassesclsid{42aedc87-2188-41fd-b9a3-0c966feabec1}InProcServer32]"" = %SystemRoot%system32shdocvw.dll -- [2008.04.14 15:00:00 | 001,499,136 | ---- | M] (Microsoft Corporation)"ThreadingModel" = Apartment [HKEY_LOCAL_MACHINESoftwareClassesclsid{5839FCA9-774D-42A1-ACDA-D6A79037F57F}InProcServer32]"" = C:WINDOWSsystem32wbemfastprox.dll -- [2008.04.14 15:00:00 | 000,472,064 | ---- | M] (Microsoft Corporation)"ThreadingModel" = Free [HKEY_LOCAL_MACHINESoftwareClassesclsid{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}InProcServer32]"" = C:WINDOWSsystem32wbemwbemess.dll -- [2008.04.14 15:00:00 | 000,273,920 | ---- | M] (Microsoft Corporation)"ThreadingModel" = Both [color=#E56717]========== LOP Check ==========[/color] [2007.12.31 00:55:40 | 000,000,000 | ---D | M] -- C:Documents and SettingsAll UsersApplication Datan7-89-o9-3r-4t-r9[2007.11.08 23:05:28 | 000,000,000 | ---D | M] -- C:Documents and SettingsAll UsersApplication DataTEMP[2010.05.12 08:33:38 | 000,000,000 | ---D | M] -- C:Documents and SettingsAll Users.WINDOWSApplication DataAlawarWrapper[2011.08.28 20:31:52 | 000,000,000 | ---D | M] -- C:Documents and SettingsAll Users.WINDOWSApplication DataAVAST Software[2008.12.29 22:36:42 | 000,000,000 | ---D | M] -- C:Documents and SettingsAll Users.WINDOWSApplication DataESET[2009.07.23 16:55:15 | 000,000,000 | ---D | M] -- C:Documents and SettingsAll Users.WINDOWSApplication DataF-Secure[2011.07.21 14:51:40 | 000,000,000 | ---D | M] -- C:Documents and SettingsAll Users.WINDOWSApplication DataFarmFrenzy2[2009.01.08 17:48:13 | 000,000,000 | ---D | M] -- C:Documents and SettingsAll Users.WINDOWSApplication DataInstallations[2009.01.08 17:46:50 | 000,000,000 | ---D | M] -- C:Documents and SettingsAll Users.WINDOWSApplication DataNokiaMusic[2013.04.11 18:36:59 | 000,000,000 | ---D | M] -- C:Documents and SettingsAll Users.WINDOWSApplication DataPackage Cache[2009.01.08 18:00:33 | 000,000,000 | ---D | M] -- C:Documents and SettingsAll Users.WINDOWSApplication DataPC Suite[2011.07.30 11:40:26 | 000,000,000 | ---D | M] -- C:Documents and SettingsAll Users.WINDOWSApplication DataTEMP[2004.08.31 01:38:56 | 000,000,000 | ---D | M] -- C:Documents and SettingsLocalServiceApplication DataAVG7[2011.07.09 16:35:32 | 000,000,000 | ---D | M] -- C:Documents and SettingsUser1Application DataAlawar[2011.03.16 19:58:17 | 000,000,000 | ---D | M] -- C:Documents and SettingsUser1Application DataAny Video Converter[2010.11.06 22:53:15 | 000,000,000 | ---D | M] -- C:Documents and SettingsUser1Application Datacald3[2012.05.13 18:39:07 | 000,000,000 | ---D | M] -- C:Documents and SettingsUser1Application DataDisplayTune[2010.05.11 22:58:43 | 000,000,000 | ---D | M] -- C:Documents and SettingsUser1Application DataFriday's games[2011.07.21 14:53:19 | 000,000,000 | ---D | M] -- C:Documents and SettingsUser1Application DataFrogwares[2013.04.11 17:23:15 | 000,000,000 | ---D | M] -- C:Documents and SettingsUser1Application DataGarmin[2009.06.01 01:09:18 | 000,000,000 | ---D | M] -- C:Documents and SettingsUser1Application DataJane s Hotel[2011.07.30 11:34:17 | 000,000,000 | ---D | M] -- C:Documents and SettingsUser1Application DataMeridian93[2009.01.28 13:35:37 | 000,000,000 | ---D | M] -- C:Documents and SettingsUser1Application DataNokia[2009.01.24 20:12:00 | 000,000,000 | ---D | M] -- C:Documents and SettingsUser1Application DataNseries[2009.02.06 21:54:31 | 000,000,000 | ---D | M] -- C:Documents and SettingsUser1Application DataOxin's Style![2009.01.08 18:22:18 | 000,000,000 | ---D | M] -- C:Documents and SettingsUser1Application DataPC Suite[2009.05.15 20:52:12 | 000,000,000 | ---D | M] -- C:Documents and SettingsUser1Application DataPGP [color=#E56717]========== Purity Check ==========[/color]   [color=#E56717]========== Alternate Data Streams ==========[/color] @Alternate Data Stream - 139 bytes -> C:Documents and SettingsAll Users.WINDOWSApplication DataTEMP:5520ED93@Alternate Data Stream - 117 bytes -> C:Documents and SettingsAll Users.WINDOWSApplication DataTEMP:B19CC382< End of report >

OTL Extras logfile created on: 04.5.2013 г. 10:56:16 - Run 1OTL by OldTimer - Version 3.2.69.0     Folder = C:Documents and SettingsUser1DesktopWindows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstationInternet Explorer (Version = 8.0.6001.18702)Locale: 00000402 | Country: Bulgaria | Language: BGR | Date Format: dd.M.yyyy 'г.' 511,49 Mb Total Physical Memory | 228,23 Mb Available Physical Memory | 44,62% Memory free1,22 Gb Paging File | 0,96 Gb Available in Paging File | 78,57% Paging File freePaging file location(s): C:pagefile.sys 768 1536 [binary data] %SystemDrive% = C: | %SystemRoot% = C:WINDOWS | %ProgramFiles% = C:Program FilesDrive C: | 17,58 Gb Total Space | 10,18 Gb Free Space | 57,92% Space Free | Partition Type: NTFSDrive D: | 47,26 Gb Total Space | 33,15 Gb Free Space | 70,15% Space Free | Partition Type: NTFSDrive E: | 11,85 Gb Total Space | 11,75 Gb Free Space | 99,14% Space Free | Partition Type: NTFS Computer Name: HOME-F7D6C5A168 | User Name: User1 | Logged in as Administrator.Boot Mode: Normal | Scan Mode: All usersCompany Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days [color=#E56717]========== Extra Registry (SafeList) ==========[/color]  [color=#E56717]========== File Associations ==========[/color] [HKEY_LOCAL_MACHINESOFTWAREClasses<extension>].cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*.html [@ = ChromeHTML] -- C:Program FilesGoogleChromeApplicationchrome.exe (Google Inc.).reg [@ = regfile] -- regedit.exe "%1" [HKEY_USERSS-1-5-21-1757981266-115176313-1417001333-1003SOFTWAREClasses<extension>].html [@ = ChromeHTML] -- Reg Error: Key error. File not found [color=#E56717]========== Shell Spawning ==========[/color] [HKEY_LOCAL_MACHINESOFTWAREClasses<key>shell[command]command]batfile [open] -- "%1" %*cmdfile [open] -- "%1" %*comfile [open] -- "%1" %*cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*exefile [open] -- "%1" %*helpfile [open] -- winhlp32.exe %1http [open] -- "C:Program FilesGoogleChromeApplicationchrome.exe" -- "%1" (Google Inc.)https [open] -- "C:Program FilesGoogleChromeApplicationchrome.exe" -- "%1" (Google Inc.)piffile [open] -- "%1" %*regfile [open] -- regedit.exe "%1"regfile [merge] -- Reg Error: Key error.scrfile [config] -- "%1"scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %lscrfile [open] -- "%1" /Stxtfile [edit] -- Reg Error: Key error.Unknown [openas] -- %SystemRoot%system32rundll32.exe %SystemRoot%system32shell32.dll,OpenAs_RunDLL %1Directory [find] -- %SystemRoot%Explorer.exe (Microsoft Corporation)Directory [Winamp.Bookmark] -- "C:Program FilesWinampWinamp.exe" /BOOKMARK "%1" (Nullsoft)Directory [Winamp.Enqueue] -- "C:Program FilesWinampWinamp.exe" /ADD "%1" (Nullsoft)Directory [Winamp.Play] -- "C:Program FilesWinampWinamp.exe" "%1" (Nullsoft)Folder [open] -- %SystemRoot%Explorer.exe /idlist,%I,%L (Microsoft Corporation)Folder [explore] -- %SystemRoot%Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)Drive [find] -- %SystemRoot%Explorer.exe (Microsoft Corporation) [color=#E56717]========== Security Center Settings ==========[/color] [HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity Center]"FirstRunDisabled" = 1"AntiVirusDisableNotify" = 1"FirewallDisableNotify" = 1"AntiVirusOverride" = 0"FirewallOverride" = 0"UpdatesDisableNotify" = 1 [HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoring] [HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringAhnlabAntiVirus] [HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringComputerAssociatesAntiVirus] [HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringKasperskyAntiVirus] [HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringMcAfeeAntiVirus] [HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringMcAfeeFirewall] [HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringPandaAntiVirus] [HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringPandaFirewall] [HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringSophosAntiVirus] [HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringSymantecAntiVirus] [HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringSymantecFirewall] [HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringTinyFirewall] [HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringTrendAntiVirus] [HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringTrendFirewall] [HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringZoneLabsFirewall] [color=#E56717]========== System Restore Settings ==========[/color] [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionSystemRestore]"DisableSR" = 1 [HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSr]"Start" = 4 [HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSrService]"Start" = 2 [color=#E56717]========== Firewall Settings ==========[/color] [HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyDomainProfile] [HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyStandardProfile]"EnableFirewall" = 1"DoNotAllowExceptions" = 0"DisableNotifications" = 0 [HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyStandardProfileGloballyOpenPortsList]"24712:TCP" = 24712:TCP:*:Enabled:BitComet 24712 TCP"24712:UDP" = 24712:UDP:*:Enabled:BitComet 24712 UDP"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008"139:TCP" = 139:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22004"445:TCP" = 445:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22005"137:UDP" = 137:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22001"138:UDP" = 138:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22002 [color=#E56717]========== Authorized Applications List ==========[/color] [HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyDomainProfileAuthorizedApplicationsList]"%windir%system32sessmgr.exe" = %windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation) [HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyStandardProfileAuthorizedApplicationsList]"%windir%system32sessmgr.exe" = %windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)"C:Program FilesGGNDC++PeerWeb DC++.exe" = C:Program FilesGGNDC++PeerWeb DC++.exe:*:Enabled:Peerweb DC++ -- (PeerWeb DC Development Team)"C:Program FilesBitCometBitComet.exe" = C:Program FilesBitCometBitComet.exe:*:Enabled:BitComet - a BitTorrent Client -- (www.BitComet.com)"C:Program FilesMozilla Firefoxfirefox.exe" = C:Program FilesMozilla Firefoxfirefox.exe:*:Enabled:Firefox -- (Mozilla Corporation)"C:Program FilesSkypePlugin ManagerskypePM.exe" = C:Program FilesSkypePlugin ManagerskypePM.exe:*:Enabled:Skype Extras Manager -- (Skype Technologies)"C:WINDOWSsystem32dplaysvr.exe" = C:WINDOWSsystem32dplaysvr.exe:*:Enabled:Microsoft DirectPlay Helper -- (Microsoft Corporation)"C:Program Files3DOHeroes 3 CompleteHEROES3.EXE" = C:Program Files3DOHeroes 3 CompleteHEROES3.EXE:*:Enabled:Heroes of Might and Magic® III"D:gamesHeroes of Might and Magic III  In the Wake of GodsHeroes3h3wog.exe" = D:gamesHeroes of Might and Magic III  In the Wake of GodsHeroes3h3wog.exe:*:Enabled:Heroes of Might and Magic® III"C:Program FilesCommon FilesAppleApple Application SupportWebKit2WebProcess.exe" = C:Program FilesCommon FilesAppleApple Application SupportWebKit2WebProcess.exe:*:Enabled:WebKit -- (Apple Inc.)"C:Program FilesSkypePhoneSkype.exe" = C:Program FilesSkypePhoneSkype.exe:*:Enabled:Skype -- (Skype Technologies S.A.)  [color=#E56717]========== HKEY_LOCAL_MACHINE Uninstall List ==========[/color] [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstall]"{0DEA342C-15CB-4F52-97B6-06A9C4B9C06F}" = SDK"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148"{2BA00471-0328-3743-93BD-FA813353A783}" = Microsoft .NET Framework 3.0 Service Pack 1"{2FC099BD-AC9B-33EB-809C-D332E1B27C40}" = Microsoft .NET Framework 3.5"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin"{6A3F9D74-BB80-4451-8CA1-4B3A857F1359}" = Apple Application Support"{787A0869-88F7-49CA-A762-1166A0F358B1}" = Пакет за езиков интерфейс на Windows"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update"{83258E90-1F76-4E13-9F60-A0F8ED41E76F}" = PC Connectivity Solution"{90110402-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional"{A4E0CA0F-1903-440A-9B98-FEA6CB049999}" = Nokia Flashing Cable Driver"{A586DC50-B18D-48FB-B7CC-A598200457C2}" = Acer eDisplay Management"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper"{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.6)"{B4BF87C8-3EEC-4774-82A2-584F109187B1}" = Hama USB Mass Storage Device"{B508B3F1-A24A-32C0-B310-85786919EF28}" = Microsoft .NET Framework 2.0 Service Pack 1"{C3F19A5F-35A8-4FDB-A6ED-0F4CE398DA48}" = Nokia Connectivity Cable Driver"{C9E14402-3631-4182-B377-6B0DFB1C0339}" = QuickTime"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2"{FB08F381-6533-4108-B7DD-039E11FBC27E}" = Realtek AC'97 Audio"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin"avast" = avast! Free Antivirus"BSPlayer1" = BSPlayer"CCleaner" = CCleaner"Enable S3 for USB Device" = Enable S3 for USB Device"FlexType 2K" = FlexType 2K"Google Chrome" = Google Chrome"Hamachi" = Hamachi 1.0.3.0"ie8" = Windows Internet Explorer 8"KLiteCodecPack_is1" = K-Lite Codec Pack 3.5.7 Full"LHTTSENG" = L&H TTS3000 British English"Microsoft .NET Framework 3.5" = Microsoft .NET Framework 3.5"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile"Mozilla Firefox (3.6.15)" = Mozilla Firefox (3.6.15)"Nero - Burning Rom!UninstallKey" = Nero 6 Ultra Edition"NVIDIA Drivers" = NVIDIA Drivers"QUICKfind" = QUICKfind server v1.1"UltraISO_is1" = UltraISO 8.0 Premium Edition"Unlocker" = Unlocker 1.8.5"Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5"Winamp" = Winamp (remove only)"Windows Media Format Runtime" = Windows Media Format 11 runtime"WinPcapInst" = WinPcap 2.3"WinRAR archiver" = Архиватор WinRAR"WMFDist11" = Windows Media Format 11 runtime"Wudf01005" = Microsoft User-Mode Driver Framework Feature Pack 1.5"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0"Български интерфейс за Nero 6 Reloaded" = Български интерфейс за Nero 6 Reloaded 6.6.1.4 [color=#E56717]========== Last 20 Event Log Errors ==========[/color] [ Application Events ]Error - 26.5.2012 г. 14:16:04 | Computer Name = HOME-F7D6C5A168 | Source = Application Hang | ID = 1002Description = Hanging application firefox.exe, version 5.0.0.4183, hang module hungapp, version 0.0.0.0, hang address 0x00000000. Error - 28.5.2012 г. 11:56:27 | Computer Name = HOME-F7D6C5A168 | Source = Application Error | ID = 1000Description = Faulting application iexplore.exe, version 8.0.6001.18702, faulting module msxml3.dll, version 8.90.1101.0, fault address 0x000a0aff. Error - 28.6.2012 г. 00:23:27 | Computer Name = HOME-F7D6C5A168 | Source = Application Error | ID = 1000Description = Faulting application bsplayer.exe, version 1.2.1.816, faulting module unknown, version 0.0.0.0, fault address 0x33919c63. Error - 12.8.2012 г. 10:20:22 | Computer Name = HOME-F7D6C5A168 | Source = Application Hang | ID = 1002Description = Hanging application firefox.exe, version 5.0.0.4183, hang module hungapp, version 0.0.0.0, hang address 0x00000000. Error - 11.4.2013 г. 11:06:09 | Computer Name = HOME-F7D6C5A168 | Source = MsiInstaller | ID = 11719Description = Product: Garmin Update Service -- Error 1719. The Windows Installer Service could not be accessed. This can occur if you are running Windows in safe mode, or if the Windows Installer is not correctly installed. Contact your support personnel for assistance. Error - 02.5.2013 г. 18:24:24 | Computer Name = HOME-F7D6C5A168 | Source = Application Hang | ID = 1002Description = Hanging application bsplayer.exe, version 1.2.1.816, hang module hungapp, version 0.0.0.0, hang address 0x00000000. Error - 04.5.2013 г. 02:10:00 | Computer Name = HOME-F7D6C5A168 | Source = SecurityCenter | ID = 1802Description = The Windows Security Center Service was unable to establish event queries with WMI to monitor third party AntiVirus and Firewall. [ System Events ]Error - 02.5.2013 г. 15:29:32 | Computer Name = HOME-F7D6C5A168 | Source = Service Control Manager | ID = 7009Description = Timeout (30000 milliseconds) waiting for the Услуга на Google Актуализация (gupdate) service to connect. Error - 02.5.2013 г. 15:29:32 | Computer Name = HOME-F7D6C5A168 | Source = Service Control Manager | ID = 7000Description = The Услуга на Google Актуализация (gupdate) service failed to start due to the following error:   %%1053 Error - 02.5.2013 г. 15:37:22 | Computer Name = HOME-F7D6C5A168 | Source = NetBT | ID = 4311Description = Initialization failed because the driver device could not be created. Error - 02.5.2013 г. 15:37:22 | Computer Name = HOME-F7D6C5A168 | Source = NetBT | ID = 4311Description = Initialization failed because the driver device could not be created. Error - 02.5.2013 г. 15:37:22 | Computer Name = HOME-F7D6C5A168 | Source = NetBT | ID = 4311Description = Initialization failed because the driver device could not be created. Error - 02.5.2013 г. 18:27:03 | Computer Name = HOME-F7D6C5A168 | Source = NetBT | ID = 4311Description = Initialization failed because the driver device could not be created. Error - 03.5.2013 г. 16:10:11 | Computer Name = HOME-F7D6C5A168 | Source = Dhcp | ID = 1000Description = Your computer has lost the lease to its IP address 46.47.117.42 on the  Network Card with network address 00508B119C5B. Error - 04.5.2013 г. 02:10:14 | Computer Name = HOME-F7D6C5A168 | Source = NetBT | ID = 4311Description = Initialization failed because the driver device could not be created. Error - 04.5.2013 г. 02:10:14 | Computer Name = HOME-F7D6C5A168 | Source = NetBT | ID = 4311Description = Initialization failed because the driver device could not be created. Error - 04.5.2013 г. 02:10:14 | Computer Name = HOME-F7D6C5A168 | Source = NetBT | ID = 4311Description = Initialization failed because the driver device could not be created.  < End of report >

Редактирано 4 май 201313 г. от nikolaijelev (преглед на промените)

Отново се сблъсквам със случай в който има две антивирусни програми....в случая AVAST и COMODO....Колко пъти тук е коментирано по този въпрос ...за конфликта между тях, което води до нестабилна работа на системата..?!? Моля динсталирайте и почистете остатъците от едната антивирусна програма....!!!После ще продължим...!!!

Само Аваст е активен...

Редактирано 4 май 201313 г. от nikolaijelev (преглед на промените)

Изтеглете и използвайте този инструмент Comodo Products Uninstaller Tool - разархивирате и стартирате файла "Uninstaller Tool.exe". Изберете програмата която искате да премахнете и маркирате "Uninstall ***".След процедурата рестартирате компютъра си...!

Готово!

Стартирайте отново OTL, копирайте (Copy) и поставете (Paste) скриптовия текст от текстовото поле по-долу под колонката Custom Scans/Fixes, като не забравяте да копирате скрипта 1 към 1, както и двете точки преди първия ред на скрипта.

:OTLDRV - File not found [Kernel | On_Demand | Unknown] --  -- (a6v5augl)O3 - HKLM..Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - No CLSID value found.O33 - MountPoints2{212b3af6-a69d-11e2-a28b-4c001023495c}ShellAutoRuncommand - "" = J:Setup.exeO33 - MountPoints2KShellAutoRuncommand - "" = K:wd_windows_toolsWDSetup.exe@Alternate Data Stream - 139 bytes -> C:Documents and SettingsAll Users.WINDOWSApplication DataTEMP:5520ED93@Alternate Data Stream - 117 bytes -> C:Documents and SettingsAll Users.WINDOWSApplication DataTEMP:B19CC382autorun.inf /alldrivesrecycler /alldrivesipconfig /flushdns /c:Commands[purity][emptytemp][resethosts][clearallrestorepoints][Reboot]

След като въведете скрипта от цитата по-горе натиснете бутона, маркиран в червено: Run Fix
Windows ще се рестартира и ще се създаде лог файл. Публикувайте съдържанието му с Copy/Paste в следващия си коментар.
По време на фикса с инструмента, не използвайте компютъра си!

Има папка 'Recycled' изглеждаща като кошче и папка  RECYCLER.Eдната не е ли в повече?

All processes killed========== OTL ==========Error: No service named a6v5augl was found to stop!ServiceDriver key a6v5augl not found.Registry value HKEY_LOCAL_MACHINESoftwareMicrosoftInternet ExplorerToolbar{E0E899AB-F487-11D5-8D29-0050BA6940E3} deleted successfully.Registry key HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{E0E899AB-F487-11D5-8D29-0050BA6940E3} not found.Registry key HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerMountPoints2{212b3af6-a69d-11e2-a28b-4c001023495c} deleted successfully.Registry key HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{212b3af6-a69d-11e2-a28b-4c001023495c} not found.File J:Setup.exe not found.Registry key HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerMountPoints2K deleted successfully.File K:wd_windows_toolsWDSetup.exe not found.ADS C:Documents and SettingsAll Users.WINDOWSApplication DataTEMP:5520ED93 deleted successfully.ADS C:Documents and SettingsAll Users.WINDOWSApplication DataTEMP:B19CC382 deleted successfully.========== COMMANDS ========== [EMPTYTEMP] User: Administrator->Temp folder emptied: 0 bytes->Temporary Internet Files folder emptied: 67 bytes->Flash cache emptied: 300 bytes User: All Users User: All Users.WINDOWS User: Default User->Temp folder emptied: 0 bytes->Temporary Internet Files folder emptied: 67 bytes User: Default User.WINDOWS->Temp folder emptied: 0 bytes->Temporary Internet Files folder emptied: 33170 bytes User: LocalService->Temp folder emptied: 0 bytes->Temporary Internet Files folder emptied: 33170 bytes->FireFox cache emptied: 720145 bytes User: LocalService.NT AUTHORITY->Temp folder emptied: 0 bytes->Temporary Internet Files folder emptied: 32902 bytes User: NetworkService->Temp folder emptied: 0 bytes->Temporary Internet Files folder emptied: 67 bytes User: NetworkService.NT AUTHORITY->Temp folder emptied: 0 bytes->Temporary Internet Files folder emptied: 619521 bytes User: User1->Temp folder emptied: 4041 bytes->Temporary Internet Files folder emptied: 1753490 bytes->FireFox cache emptied: 70031562 bytes->Google Chrome cache emptied: 6452300 bytes->Flash cache emptied: 664 bytes %systemdrive% .tmp files removed: 0 bytes%systemroot% .tmp files removed: 2402044 bytes%systemroot%System32 .tmp files removed: 2832913 bytes%systemroot%System32dllcache .tmp files removed: 0 bytes%systemroot%System32drivers .tmp files removed: 0 bytesWindows Temp folder emptied: 81920 bytes%systemroot%system32configsystemprofileLocal SettingsTemp folder emptied: 402653605 bytes%systemroot%system32configsystemprofileLocal SettingsTemporary Internet Files folder emptied: 33170 bytesRecycleBin emptied: 5771043 bytes Total Files Cleaned = 471,00 mb C:WINDOWSSystem32driversetcHosts moved successfully.HOSTS file reset successfullySystem Restore Service not available. OTL by OldTimer - Version 3.2.69.0 log created on 05042013_124115FilesFolders moved on Reboot...PendingFileRenameOperations files...Registry entries deleted on Reboot...

Редактирано 4 май 201313 г. от nikolaijelev (преглед на промените)

Какво е състоянието на системата ви след процедурите до тук...?

Mалко по-добре, но антивирусната изглежда ще трябва да я махна.

Mалко по-добре, но антивирусната изглежда ще трябва да я махна.

 

Защо..?Може да я спрете и да тествате системата си....и ако всичко е наред да мигрирате към друга защита...Но без антивирусна аз лично не ви съветвам...!

 

 

  Моля, изтеглете Sophos Virus Removal Tool    и го запазете навашия десктоп.

[*]Стартирайте Sophos Virus Removal Tool.exe

[*]Следвайте указанията,  приемете лицензионното споразумение,  приемате стандартно местоположение.

[*]Ще се появи съобщение "InstallShield Wizard Completed".

[*]Кликнете върху "Finish" за да стартирате програмата.

[*]След като програмата се  актуализира  в долния десен ъгъл се появява бутон "Start Scanning"

  Прекъснете  връзката с Интернет или физически изключите кабелен интернет.

  Затворете всички отворени приложения.

  Временно деактивирате защитата  в реално време на вашия антивирусен и анти-спайуер софтуер.

[*]Кликнете върху "Start Scanning" бутона в долния десен, за да стартирате сканирането.

[*]След стартиране на сканиране, не използвайте компютъра, докато то не приключи.

[*]Ако след процедурата е открито нещо ще има "Start Clean-up" бутон, щракнете върху него и го оставете да довърши.

[*]Когато процедурата приключи, активирайте отново антивирусната /антиспайуер си защита  и след това можете да свържете към интернет.

[*]Ще се генерира дневник на следното място:

Vista/7/8..: C:ProgramDataSophosSophos Virus Removal ToolLogsSophosVirusRemovalTool.log

за 64-bit: C:Program Files (x86)SophosSophos Virus Removal ToolLogsSophosVirusRemovalTool.log

2000/XP/Server 2003: C:Documents and SettingsAll UsersApplication DataSophosSophos Virus Removal ToolLogsSophosVirusRemovalTool.log

[*]Моля, публикувайте съдържанието на дневника в следващия си отговор.

2013-05-04 16:36:16	Sophos Virus Removal Tool version 2.32013-05-04 16:36:16	Copyright (c) 2009-2012 Sophos Limited. All rights reserved.2013-05-04 16:36:16	This tool will scan your computer for viruses and other threats. If it finds any, it will give you the option to remove them.2013-05-04 16:36:16	Windows version 5.1 SP 3.0 Service Pack 3 build 2600 SM=0x100 PT=0x1 Win322013-05-04 16:36:16	Checking for updates...2013-05-04 16:36:17	Update progress: proxy server not available2013-05-04 16:36:33	Option all = no2013-05-04 16:36:33	Option recurse = yes2013-05-04 16:36:33	Option archive = no2013-05-04 16:36:33	Option service = yes2013-05-04 16:36:33	Option confirm = yes2013-05-04 16:36:33	Option sxl = yes2013-05-04 16:36:33	Option max-data-age = 352013-05-04 16:36:33	Component SVRTcli.exe version 2.32013-05-04 16:36:33	Component control.dll version 2.32013-05-04 16:36:33	Component SVRTservice.exe version 2.32013-05-04 16:36:33	Component engineosdp.dll version 1.44.0.20702013-05-04 16:36:33	Component engineveex.dll version 3.42.0.20702013-05-04 16:36:33	Component enginesavi.dll version 7.5.11.20702013-05-04 16:36:33	Component rkdisk.dll version 1.5.30.02013-05-04 16:36:33	Version info:	Product version	2.32013-05-04 16:36:33	Version info:	Detection engine	3.42.02013-05-04 16:36:33	Version info:	Detection data	4.882013-05-04 16:36:33	Version info:	Build date	10.4.2013 ?.2013-05-04 16:36:33	Version info:	Data files added	4302013-05-04 16:36:33	Version info:	Last successful update	(not yet updated)2013-05-04 16:37:43	Downloading updates...2013-05-04 16:37:43	Update progress: [I96736] Looking for package C1A903B2-E63E-483b-982D-04BB9C457C60 1.0 2013-05-04 16:37:43	Update progress: [I49502] Found supplement SAVIW32 LATEST 42013-05-04 16:37:43	Update progress: [I49502] Found supplement IDE489 LATEST 2013-05-04 16:37:43	Update progress: [I49502] Found supplement IDE490 LATEST 2013-05-04 16:37:43	Update progress: [I49502] Found supplement IDE491 LATEST 2013-05-04 16:37:43	Update progress: [I49502] Found supplement IDE492 LATEST 2013-05-04 16:37:43	Update progress: [I19463] Syncing product C1A903B2-E63E-483b-982D-04BB9C457C60 12013-05-04 16:37:43	Update progress: [I19463] Syncing product SAVIW32 262013-05-04 16:37:53	Update progress: [I19463] Syncing product IDE489 2212013-05-04 16:37:55	Installing updates...2013-05-04 16:37:57	Update progress: [I19463] Syncing product IDE490 1822013-05-04 16:37:57	Update progress: [I19463] Syncing product IDE491 312013-05-04 16:37:57	Update progress: [I19463] Syncing product IDE492 12013-05-04 16:38:10	Update successful2013-05-04 16:38:26	Option all = no2013-05-04 16:38:26	Option recurse = yes2013-05-04 16:38:26	Option archive = no2013-05-04 16:38:26	Option service = yes2013-05-04 16:38:26	Option confirm = yes2013-05-04 16:38:26	Option sxl = yes2013-05-04 16:38:26	Option max-data-age = 352013-05-04 16:38:26	Component SVRTcli.exe version 2.32013-05-04 16:38:26	Component control.dll version 2.32013-05-04 16:38:26	Component SVRTservice.exe version 2.32013-05-04 16:38:26	Component engineosdp.dll version 1.44.0.20702013-05-04 16:38:26	Component engineveex.dll version 3.42.0.20702013-05-04 16:38:26	Component enginesavi.dll version 7.5.11.20702013-05-04 16:38:26	Component rkdisk.dll version 1.5.30.02013-05-04 16:38:26	Version info:	Product version	2.32013-05-04 16:38:26	Version info:	Detection engine	3.42.02013-05-04 16:38:26	Version info:	Detection data	4.88G2013-05-04 16:38:26	Version info:	Build date	10.4.2013 ?.2013-05-04 16:38:26	Version info:	Data files added	4302013-05-04 16:38:26	Version info:	Last successful update	04.5.2013 ?. 16:38:102013-05-04 16:42:14	Could not open C:hiberfil.sys2013-05-04 16:44:16	>>> Virus 'Mal/Generic-L' found in file C:Program FilesDatecsFlexType 2KLiveLive.exe2013-05-04 16:44:16	>>> Virus 'Mal/Generic-L' found in file HKLMSOFTWAREMicrosoftSecurity CenterAntiVirusDisableNotify2013-05-04 16:44:16	>>> Virus 'Mal/Generic-L' found in file HKLMSOFTWAREMicrosoftSecurity CenterFirewallDisableNotify2013-05-04 16:44:16	>>> Virus 'Mal/Generic-L' found in file HKLMSOFTWAREMicrosoftSecurity CenterUpdatesDisableNotify2013-05-04 16:50:20	Could not open C:WINDOWSsystem32driverssptd.sys2013-05-04 16:52:27	>>> Virus 'Mal/KeyGen-C' found in file D:InstallAbbyy fine readerfrp7kg.exe2013-05-04 16:52:27	>>> Virus 'Mal/KeyGen-C' found in file HKLMSOFTWAREMicrosoftSecurity CenterAntiVirusDisableNotify2013-05-04 16:52:27	>>> Virus 'Mal/KeyGen-C' found in file HKLMSOFTWAREMicrosoftSecurity CenterFirewallDisableNotify2013-05-04 16:52:27	>>> Virus 'Mal/KeyGen-C' found in file HKLMSOFTWAREMicrosoftSecurity CenterUpdatesDisableNotify2013-05-04 16:52:30	>>> Virus 'Troj/ParaKey-A' found in file D:InstallAdobe Photoshop CS2 v.9.0Adobe.PhotoshopCS2.Keygen.exe2013-05-04 16:52:30	>>> Virus 'Troj/ParaKey-A' found in file HKLMSOFTWAREMicrosoftSecurity CenterAntiVirusDisableNotify2013-05-04 16:52:30	>>> Virus 'Troj/ParaKey-A' found in file HKLMSOFTWAREMicrosoftSecurity CenterFirewallDisableNotify2013-05-04 16:52:30	>>> Virus 'Troj/ParaKey-A' found in file HKLMSOFTWAREMicrosoftSecurity CenterUpdatesDisableNotify2013-05-04 16:54:54	>>> Virus 'Mal/Generic-L' found in file D:InstallSudoku - GamefscommandSetup.exe2013-05-04 16:54:54	>>> Virus 'Mal/Generic-L' found in file HKLMSOFTWAREMicrosoftSecurity CenterAntiVirusDisableNotify2013-05-04 16:54:54	>>> Virus 'Mal/Generic-L' found in file HKLMSOFTWAREMicrosoftSecurity CenterFirewallDisableNotify2013-05-04 16:54:54	>>> Virus 'Mal/Generic-L' found in file HKLMSOFTWAREMicrosoftSecurity CenterUpdatesDisableNotify2013-05-04 16:55:07	>>> Virus 'Mal/Generic-L' found in file D:InstallWinamp1Bulgarian_Languege.exe2013-05-04 16:55:07	>>> Virus 'Mal/Generic-L' found in file HKLMSOFTWAREMicrosoftSecurity CenterAntiVirusDisableNotify2013-05-04 16:55:07	>>> Virus 'Mal/Generic-L' found in file HKLMSOFTWAREMicrosoftSecurity CenterFirewallDisableNotify2013-05-04 16:55:07	>>> Virus 'Mal/Generic-L' found in file HKLMSOFTWAREMicrosoftSecurity CenterUpdatesDisableNotify2013-05-04 16:55:10	>>> Virus 'Mal/KeyGen-E' found in file D:InstallWinamp1Crackcr_wp50.exe2013-05-04 16:55:10	>>> Virus 'Mal/KeyGen-E' found in file HKLMSOFTWAREMicrosoftSecurity CenterAntiVirusDisableNotify2013-05-04 16:55:10	>>> Virus 'Mal/KeyGen-E' found in file HKLMSOFTWAREMicrosoftSecurity CenterFirewallDisableNotify2013-05-04 16:55:10	>>> Virus 'Mal/KeyGen-E' found in file HKLMSOFTWAREMicrosoftSecurity CenterUpdatesDisableNotify2013-05-04 16:55:28	>>> Virus 'W32/AutoRun-BSY' found in file G:DCIMWindows Loader.exe2013-05-04 16:55:28	>>> Virus 'W32/AutoRun-BSY' found in file HKLMSOFTWAREMicrosoftSecurity CenterAntiVirusDisableNotify2013-05-04 16:55:28	>>> Virus 'W32/AutoRun-BSY' found in file HKLMSOFTWAREMicrosoftSecurity CenterFirewallDisableNotify2013-05-04 16:55:28	>>> Virus 'W32/AutoRun-BSY' found in file HKLMSOFTWAREMicrosoftSecurity CenterUpdatesDisableNotify2013-05-04 16:55:32	>>> Virus 'Troj/Agent-OIK' found in file G:DCIMRemoveWAT.exe2013-05-04 16:55:32	>>> Virus 'Troj/Agent-OIK' found in file HKLMSOFTWAREMicrosoftSecurity CenterAntiVirusDisableNotify2013-05-04 16:55:32	>>> Virus 'Troj/Agent-OIK' found in file HKLMSOFTWAREMicrosoftSecurity CenterFirewallDisableNotify2013-05-04 16:55:32	>>> Virus 'Troj/Agent-OIK' found in file HKLMSOFTWAREMicrosoftSecurity CenterUpdatesDisableNotify2013-05-04 16:56:46	>>> Virus 'Mal/Generic-S' found in file G:otherKrypkiY_MUI_BG.EXE2013-05-04 16:56:46	>>> Virus 'Mal/Generic-S' found in file HKLMSOFTWAREMicrosoftSecurity CenterAntiVirusDisableNotify2013-05-04 16:56:46	>>> Virus 'Mal/Generic-S' found in file HKLMSOFTWAREMicrosoftSecurity CenterFirewallDisableNotify2013-05-04 16:56:46	>>> Virus 'Mal/Generic-S' found in file HKLMSOFTWAREMicrosoftSecurity CenterUpdatesDisableNotify2013-05-04 16:57:35	Could not open LOGICAL:0007:000000002013-05-04 16:57:35	Could not open H:2013-05-04 16:57:36	Could not open PHYSICAL:0082:0000:0000:00012013-05-04 16:57:36	The following items will be cleaned up:2013-05-04 16:57:36	Mal/Generic-L2013-05-04 16:57:36	Mal/KeyGen-C2013-05-04 16:57:36	Troj/ParaKey-A2013-05-04 16:57:36	Mal/KeyGen-E2013-05-04 16:57:36	W32/AutoRun-BSY2013-05-04 16:57:36	Troj/Agent-OIK2013-05-04 16:57:36	Mal/Generic-S2013-05-04 17:02:20	Threat 'Mal/Generic-L' has been cleaned up.2013-05-04 17:02:20	File "C:Program FilesDatecsFlexType 2KLiveLive.exe" belongs to malware 'Mal/Generic-L'.2013-05-04 17:02:20	File "C:Program FilesDatecsFlexType 2KLiveLive.exe" has been cleaned up.2013-05-04 17:02:20	File "D:InstallSudoku - GamefscommandSetup.exe" belongs to malware 'Mal/Generic-L'.2013-05-04 17:02:20	File "D:InstallSudoku - GamefscommandSetup.exe" has been cleaned up.2013-05-04 17:02:20	File "D:InstallWinamp1Bulgarian_Languege.exe" belongs to malware 'Mal/Generic-L'.2013-05-04 17:02:20	File "D:InstallWinamp1Bulgarian_Languege.exe" has been cleaned up.2013-05-04 17:02:20	Registry value "HKLMSOFTWAREMicrosoftSecurity CenterAntiVirusDisableNotify" belongs to malware 'Mal/Generic-L'.2013-05-04 17:02:20	Registry value "HKLMSOFTWAREMicrosoftSecurity CenterAntiVirusDisableNotify" has been cleaned up.2013-05-04 17:02:20	Registry value "HKLMSOFTWAREMicrosoftSecurity CenterFirewallDisableNotify" belongs to malware 'Mal/Generic-L'.2013-05-04 17:02:20	Registry value "HKLMSOFTWAREMicrosoftSecurity CenterFirewallDisableNotify" has been cleaned up.2013-05-04 17:02:20	Registry value "HKLMSOFTWAREMicrosoftSecurity CenterUpdatesDisableNotify" belongs to malware 'Mal/Generic-L'.2013-05-04 17:02:20	Registry value "HKLMSOFTWAREMicrosoftSecurity CenterUpdatesDisableNotify" has been cleaned up.2013-05-04 17:02:20	Removal successful2013-05-04 17:02:23	Threat 'Mal/KeyGen-C' has been cleaned up.2013-05-04 17:02:23	File "D:InstallAbbyy fine readerfrp7kg.exe" belongs to malware 'Mal/KeyGen-C'.2013-05-04 17:02:23	File "D:InstallAbbyy fine readerfrp7kg.exe" has been cleaned up.2013-05-04 17:02:23	Removal successful2013-05-04 17:02:27	Threat 'Troj/ParaKey-A' has been cleaned up.2013-05-04 17:02:27	File "D:InstallAdobe Photoshop CS2 v.9.0Adobe.PhotoshopCS2.Keygen.exe" belongs to 'Troj/ParaKey-A'.2013-05-04 17:02:27	File "D:InstallAdobe Photoshop CS2 v.9.0Adobe.PhotoshopCS2.Keygen.exe" has been cleaned up.2013-05-04 17:02:27	Removal successful2013-05-04 17:02:29	Threat 'Mal/KeyGen-E' has been cleaned up.2013-05-04 17:02:29	File "D:InstallWinamp1Crackcr_wp50.exe" belongs to malware 'Mal/KeyGen-E'.2013-05-04 17:02:29	File "D:InstallWinamp1Crackcr_wp50.exe" has been cleaned up.2013-05-04 17:02:29	Removal successful2013-05-04 17:02:36	Threat 'W32/AutoRun-BSY' has been cleaned up.2013-05-04 17:02:36	File "G:DCIMWindows Loader.exe" belongs to 'W32/AutoRun-BSY'.2013-05-04 17:02:36	File "G:DCIMWindows Loader.exe" has been cleaned up.2013-05-04 17:02:36	Removal successful2013-05-04 17:02:39	Threat 'Troj/Agent-OIK' has been cleaned up.2013-05-04 17:02:39	File "G:DCIMRemoveWAT.exe" belongs to 'Troj/Agent-OIK'.2013-05-04 17:02:39	File "G:DCIMRemoveWAT.exe" has been cleaned up.2013-05-04 17:02:39	Removal successful2013-05-04 17:02:43	Threat 'Mal/Generic-S' has been cleaned up.2013-05-04 17:02:43	File "G:otherKrypkiY_MUI_BG.EXE" belongs to malware 'Mal/Generic-S'.2013-05-04 17:02:43	File "G:otherKrypkiY_MUI_BG.EXE" has been cleaned up.2013-05-04 17:02:43	Removal successful2013-05-04 17:02:57	Scan completed.2013-05-04 17:02:57	------------------------------------------------------------2013-05-04 17:18:03	Sophos Virus Removal Tool version 2.32013-05-04 17:18:03	Copyright (c) 2009-2012 Sophos Limited. All rights reserved.2013-05-04 17:18:03	This tool will scan your computer for viruses and other threats. If it finds any, it will give you the option to remove them.2013-05-04 17:18:03	Windows version 5.1 SP 3.0 Service Pack 3 build 2600 SM=0x100 PT=0x1 Win322013-05-04 17:18:03	Checking for updates...2013-05-04 17:18:03	Update progress: proxy server not available2013-05-04 17:18:43	Option all = no2013-05-04 17:18:43	Option recurse = yes2013-05-04 17:18:43	Option archive = no2013-05-04 17:18:43	Option service = yes2013-05-04 17:18:43	Option confirm = yes2013-05-04 17:18:43	Option sxl = yes2013-05-04 17:18:43	Option max-data-age = 352013-05-04 17:18:43	Component SVRTcli.exe version 2.32013-05-04 17:18:43	Component control.dll version 2.32013-05-04 17:18:43	Component SVRTservice.exe version 2.32013-05-04 17:18:43	Component engineosdp.dll version 1.44.0.20702013-05-04 17:18:43	Component engineveex.dll version 3.42.0.20702013-05-04 17:18:43	Component enginesavi.dll version 7.5.11.20702013-05-04 17:18:43	Component rkdisk.dll version 1.5.30.02013-05-04 17:18:43	Version info:	Product version	2.32013-05-04 17:18:43	Version info:	Detection engine	3.42.02013-05-04 17:18:43	Version info:	Detection data	4.88G2013-05-04 17:18:43	Version info:	Build date	10.4.2013 ?.2013-05-04 17:18:43	Version info:	Data files added	4302013-05-04 17:18:43	Version info:	Last successful update	04.5.2013 ?. 16:38:102013-05-04 17:18:51	Update not required 

Не разбирам защо не си пази настройките? Стартира на нормалната резолюция(1024х768) и после минава на друга(800х600)... Батерията на дъното е изтощена , но това няма много общо! Софос откри някакви гадини...кракове и ги изтри. Предлагам да приключваме! Не искам да ви занимавам с дреболии по време на празниците.

 

П.П.Интересно...вече се стартира в нормалната резолюция!!

Редактирано 4 май 201313 г. от nikolaijelev (преглед на промените)