проблем с tmp60.exe

15 юни 201313 г.

Здравейте,преди три дни -12.06.2013 -от един блог свалих едно филмче с торент клиент,дойде в папка с него имаше и кодеци,пуснах филмчето,не тръгна и реших,че е от кодеците,инсталирах ги и след това антивирусната (панда-фрии) неутрализира зловреден софтуер с име - -tmp60.exe който се намираше : C:Documents and SettingsAll UsersApplication DataMicrosoftMedia Toolstemp

изтрих веднага кодеците и проверих с Malwarebytes anti-malware. нищо,ужким чисто.

днес 15.06.2013 - пуснах компа и по едно време Панда-та пак го хваща това - tmp60.ехе на същото място след като там беше чисто и без да съм инсталирал нещо.

явно се опитва да се инсталира,някой знае ли как да го спра?

някъде из гугле намерих това ---"the file tmp60.exe is identified as the trojan programthat is used for stealing bank information and user passwords."

малко помощ,не съм на ти с английския,за повече инфо и как да го преборя.

мерси предварително.

свалих DDS,ето какво има в DDS.txt :

DDS (Ver_2011-09-30.01) - NTFS_x86 Internet Explorer: 6.0.2900.5512 BrowserJavaVersion: 10.21.2 Run by pc at 22:52:00 on 2013-06-15 Microsoft Windows XP Professional 5.1.2600.3.1251.359.1033.18.1023.373 [GMT 3:00] . AV: Panda Cloud Antivirus *Disabled/Updated* {5AD27692-540A-464E-B625-78275FA38393} FW: Cloud Antivirus Firewall *Disabled* . ============== Running Processes ================ . C:WINDOWSsystem32Ati2evxx.exe C:WINDOWSsystem32spoolsv.exe C:Program FilesCommon FilesAutodata Limited SharedServiceADCDLicSvc.exe C:PROGRA~1CompaqCOMPAQ~1hibserv.exe C:Program FilesMalwarebytes' Anti-Malwarembamscheduler.exe C:Program FilesPanda SecurityPanda Cloud AntivirusPSANHost.exe C:Program FilesPanda SecurityPanda Cloud AntivirusPSUAService.exe C:Program FilesAnalog DevicesSoundMAXSMAgent.exe D:AUTOTECDOC_CD4_2008dbtbmux32.exe C:WINDOWSsystem32wltrysvc.exe C:WINDOWSsystem32bcmwltry.exe C:WINDOWSsystem32Ati2evxx.exe C:WINDOWSExplorer.EXE C:Program FilesCompaqEABEABSERVR.EXE C:Program FilesCompaqHotkey Softwarehkss.exe C:Program FilesSynapticsSynTPSynTPLpr.exe C:Program FilesSynapticsSynTPSynTPEnh.exe C:Program FilesUSBScanUSBScan.exe C:Program FilesPanda SecurityPanda Cloud AntivirusPSUAMain.exe C:WINDOWSsystem32ctfmon.exe C:Program FilesDAEMON Tools Litedaemon.exe C:Program FilesRocketDockRocketDock.exe C:Program FilesuTorrentuTorrent.exe C:WINDOWSSystem32alg.exe C:Program FilesMozilla Firefoxfirefox.exe C:Program FilesMozilla Firefoxplugin-container.exe C:WINDOWSsystem32wbemwmiprvse.exe C:WINDOWSSystem32svchost.exe -k netsvcs C:WINDOWSsystem32svchost.exe -k NetworkService C:WINDOWSsystem32svchost.exe -k LocalService C:WINDOWSsystem32svchost.exe -k LocalService C:WINDOWSsystem32svchost.exe -k imgsvc . ============== Pseudo HJT Report =============== . BHO: Adobe PDF Reader Link Helper: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:program filescommon filesadobeacrobatactivexAcroIEHelper.dll BHO: {D4027C7F-154A-4066-A1AD-4243D8127440} - <orphaned> uRun: [CTFMON.EXE] c:windowssystem32ctfmon.exe uRun: [DAEMON Tools Lite] "c:program filesdaemon tools litedaemon.exe" -autorun uRun: [RocketDock] "c:program filesrocketdockRocketDock.exe" mRun: [eabconfg.cpl] c:program filescompaqeabEABSERVR.EXE /Start mRun: [hkss] c:program filescompaqhotkey softwarehkss.exe mRun: [synTPLpr] c:program filessynapticssyntpSynTPLpr.exe mRun: [synTPEnh] c:program filessynapticssyntpSynTPEnh.exe mRun: [uSBScan.exe] c:program filesusbscanUSBScan.exe -Hide mRun: [PSUAMain] "c:program filespanda securitypanda cloud antivirusPSUAMain.exe" /LaunchSysTray dRun: [CTFMON.EXE] c:windowssystem32CTFMON.EXE uPolicies-Explorer: NoDriveTypeAutoRun = dword:255 mPolicies-Explorer: NoDriveTypeAutoRun = dword:145 IE: Add to Google Photos Screensa&ver - c:windowssystem32GPhotos.scr/200 IE: Download with &Media Finder - c:program filesmedia finderhook.html IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%Network Diagnosticxpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:program filesmessengermsmsgs.exe TCP: Interfaces{7A7CD101-9BFD-479B-8C98-DC15FE36C052} : NameServer = 8.26.56.26,156.154.70.22 TCP: Interfaces{C4161A17-743E-4670-90F6-3BC32E423B58} : NameServer = 8.26.56.26,156.154.70.22 Filter: text/x-mrml - {C51721BE-858B-4A66-A8BF-D2882FF49820} - c:program filescommon filesa&wMidRadio.ocx Notify: AtiExtEvent - Ati2evxx.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:windowssystem32wpdshserviceobj.dll . ================= FIREFOX =================== . FF - ProfilePath - c:documents and settingspcapplication datamozillafirefoxprofilesbmcbbry3.default FF - plugin: c:program filesgooglepicasa3npPicasa3.dll FF - plugin: c:program filesjavajre7binplugin2npjp2.dll FF - plugin: c:windowssystem32adobedirectornp32dsw_1202122.dll FF - plugin: c:windowssystem32macromedflashNPSWF32_11_7_700_224.dll FF - plugin: c:windowssystem32npDeployJava1.dll FF - plugin: c:windowssystem32npptools.dll . ---- FIREFOX POLICIES ---- FF - user.js: extensions.BabylonToolbar_i.newTab - false FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=112555&tt=280612_8_ FF - user.js: extensions.BabylonToolbar_i.babExt - FF - user.js: extensions.BabylonToolbar_i.srcExt - ss FF - user.js: extensions.BabylonToolbar_i.id - f8562cf7000000000000000b6b4c5c7f FF - user.js: extensions.BabylonToolbar_i.hardId - f8562cf7000000000000000b6b4c5c7f FF - user.js: extensions.BabylonToolbar_i.instlDay - 15520 FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17 FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17 FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.170:01:35 FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar FF - user.js: extensions.BabylonToolbar_i.aflt - babsst FF - user.js: extensions.BabylonToolbar_i.smplGrp - none FF - user.js: extensions.BabylonToolbar_i.tlbrId - base FF - user.js: extensions.BabylonToolbar_i.instlRef - sst . ============= SERVICES / DRIVERS =============== . R1 NNSALPC;NNSAlpc;c:windowssystem32driversNNSAlpc.sys [2012-11-26 82728] R1 NNSHTTP;NNSHttp;c:windowssystem32driversNNSHttp.sys [2012-11-26 119080] R1 NNSHTTPS;NNSHttps;c:windowssystem32driversNNSHttps.sys [2013-1-9 95584] R1 NNSIDS;NNSids;c:windowssystem32driversNNSIds.sys [2012-11-26 123944] R1 NNSPICC;NNSPicc;c:windowssystem32driversNNSpicc.sys [2012-11-26 94632] R1 NNSPIHS;NNSPihs;c:windowssystem32driversNNSpihs.sys [2012-11-26 51496] R1 NNSPOP3;NNSPop3;c:windowssystem32driversNNSPop3.sys [2012-11-26 105640] R1 NNSPROT;NNSProt;c:windowssystem32driversNNSProt.sys [2012-11-26 286888] R1 NNSPRV;NNSPrv;c:windowssystem32driversNNSPrv.sys [2012-11-26 159528] R1 NNSSMTP;NNSSmtp;c:windowssystem32driversNNSSmtp.sys [2012-11-26 108200] R1 NNSSTRM;NNSStrm;c:windowssystem32driversNNSStrm.sys [2012-11-28 218024] R1 NNSTLSC;NNSTlsc;c:windowssystem32driversNNStlsc.sys [2012-11-26 93096] R1 oreans32;oreans32;c:windowssystem32driversoreans32.sys [2011-4-19 33824] R1 PSINKNC;PSINKnc;c:windowssystem32driversPSINKNC.sys [2012-11-9 178728] R2 MBAMScheduler;MBAMScheduler;c:program filesmalwarebytes' anti-malwarembamscheduler.exe [2013-6-12 418376] R2 NanoServiceMain;Panda Cloud Antivirus Service;c:program filespanda securitypanda cloud antivirusPSANHost.exe [2013-1-27 140512] R2 PSINAflt;PSINAflt;c:windowssystem32driversPSINAflt.sys [2012-11-9 149288] R2 PSINFile;PSINFile;c:windowssystem32driversPSINFile.sys [2012-11-9 102184] R2 PSINProc;PSINProc;c:windowssystem32driversPSINProc.sys [2012-11-9 114216] R2 PSINProt;PSINProt;c:windowssystem32driversPSINProt.sys [2012-11-9 123560] R2 PSUAService;Panda Product Service;c:program filespanda securitypanda cloud antivirusPSUAService.exe [2013-1-27 37088] R2 Transbase TECDOC CD 4_2008 Service;Transbase TECDOC CD 4_2008 Service;d:autotecdoc_cd4_2008dbtbmux32.exe [2008-8-11 356352] R3 adatadrv;Autodata Protection Service;c:windowssystem32driversadatadrv.sys [2011-3-16 762112] R3 MBAMProtector;MBAMProtector;c:windowssystem32driversmbam.sys [2012-5-12 22856] R3 NNSNAHS;Network Activity Hook Server Service;c:windowssystem32driversNNSNAHS.sys [2012-10-22 38824] S2 HOSTNT;HOSTNT; [x] S2 MBAMService;MBAMService;c:program filesmalwarebytes' anti-malwarembamservice.exe [2012-5-12 701512] S3 3xHybrid;Philips SAA713x PCI Card;c:windowssystem32drivers3xHybrid.sys [2011-2-21 1121536] S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:windowssystem32macromedflashFlashPlayerUpdateService.exe [2012-9-1 256904] S3 DCamUSBMtk;Webcam phone;c:windowssystem32driversusbmtk.sys [2011-2-20 44032] . =============== Created Last 30 ================ . 2013-06-15 16:46:28 46672 ----a-w- c:windowssystem32driversPSKMAD.sys 2013-06-09 15:31:09 -------- d-----w- c:program filesVideoLAN 2013-06-08 17:56:36 262552 ----a-w- c:program filesmozilla firefoxbrowsercomponentsbrowsercomps.dll 2013-06-08 17:56:00 19449240 ----a-w- c:program filesmozilla firefoxxul.dll 2013-06-08 17:56:00 19352 ----a-w- c:program filesmozilla firefoxxpcom.dll 2013-06-02 19:55:00 144896 ----a-w- c:windowssystem32javacpl.cpl 2013-06-02 19:52:41 94112 ----a-w- c:windowssystem32WindowsAccessBridge.dll . ==================== Find3M ==================== . 2013-06-12 17:10:26 692104 ----a-w- c:windowssystem32FlashPlayerApp.exe 2013-06-12 17:10:25 71048 ----a-w- c:windowssystem32FlashPlayerCPLApp.cpl 2013-06-02 19:52:16 866720 ----a-w- c:windowssystem32npDeployJava1.dll 2013-06-02 19:52:15 788896 ----a-w- c:windowssystem32deployJava1.dll 2013-04-04 11:50:32 22856 ----a-w- c:windowssystem32driversmbam.sys 2008-03-09 05:25:10 236 -c--a-w- c:program filescommon filesdx.reg . ============= FINISH: 22:52:31,18 ===============

и какво в другия Attach.txt

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2011-09-30.01) . Microsoft Windows XP Professional Boot Device: DeviceHarddiskVolume1 Install Date: 2/20/2011 18:49:07 System Uptime: 6/15/2013 19:45:46 (3 hours ago) . Motherboard: Compaq | | 07F4 Processor: Mobile Intel® Pentium® 4 - M CPU 1.80GHz | J1 | 1794/100mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 12 GiB total, 4,986 GiB free. D: is FIXED (NTFS) - 39 GiB total, 11,248 GiB free. F: is CDROM () G: is CDROM () . ==== Disabled Device Manager Items ============= . Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318} Description: WLAN 802.11g mini-PCI Module Device ID: PCIVEN_14E4&DEV_4320&SUBSYS_1220185F&REV_034&139E449D&0&20F0 Manufacturer: Broadcom Name: WLAN 802.11g mini-PCI Module PNP Device ID: PCIVEN_14E4&DEV_4320&SUBSYS_1220185F&REV_034&139E449D&0&20F0 Service: BCM43XX . Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318} Description: Intel® PRO/100 VM Network Connection Device ID: PCIVEN_8086&DEV_1038&SUBSYS_00980E11&REV_424&139E449D&0&40F0 Manufacturer: Intel Name: Intel® PRO/100 VM Network Connection PNP Device ID: PCIVEN_8086&DEV_1038&SUBSYS_00980E11&REV_424&139E449D&0&40F0 Service: E100B . ==== System Restore Points =================== . RP76: 1/21/2013 22:29:46 - Removed Ask Toolbar. RP77: 3/16/2013 14:57:32 - Installed Sys Optimizer RP78: 3/16/2013 15:02:41 - Removed Sys Optimizer RP79: 5/21/2013 16:37:42 - System Checkpoint RP80: 6/2/2013 22:48:07 - Removed Google Drive RP81: 6/2/2013 22:51:20 - Removed Java 7 Update 5 RP82: 6/2/2013 22:52:06 - Installed Java 7 Update 21 RP83: 6/2/2013 22:54:42 - Removed Java 6 Update 24 RP84: 6/2/2013 22:56:13 - Removed Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 . ==== Installed Programs ====================== . µTorrent 7-Zip 9.20 Adobe Flash Player 11 Plugin Adobe Reader 8.1.2 Adobe Shockwave Player 12.0 Adobe SVG Viewer 3.0 ATI - Software Uninstall Utility ATI Control Panel ATI Display Driver BCM Wireless Network Adapter Big Kahuna Reef 2 - Chain Reaction BlazeDTV 6.0 CCleaner Compaq Easy Access Buttons 3.00 D2 Compaq HotKey Support Software Compaq Power Management DirectX10 RC2 Pre Fix 3 DivX 4.02 Codec doPDF 7.2 printer FiatECUScan Filters Foxit Reader FTDI USB Serial Converter Drivers Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595) Hotfix for Windows Media Format 11 SDK (KB929399) Hotfix for Windows Media Player 11 (KB939683) Hotfix for Windows XP (KB954550-v5) Hotfix for Windows XP (KB970653-v3) Hotfix for Windows XP (KB976002-v5) Java 7 Update 21 Java Auto Updater Java DB 10.6.2.1 Java SE Development Kit 6 Update 24 JavaFX 2.1.1 K-Lite Codec Pack 6.9.0 (Full) Malwarebytes Anti-Malware, версия 1.75.0.1300 Microsoft .NET Framework 2.0 Service Pack 2 Microsoft .NET Framework 3.0 Service Pack 2 Microsoft .NET Framework 3.5 SP1 Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 moDiag professional 2.0.1 Mozilla Firefox 21.0 (x86 en-US) MV2Player (remove only) OpenOffice.org 3.2 Panda Cloud Antivirus Picasa 3 ProScan Ricochet Infinity RocketDock 1.3.5 Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111) Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424) Security Update for Windows Media Player 11 (KB954154) Security Update for Windows XP (KB923789) Security Update for Windows XP (KB938464) Security Update for Windows XP (KB941569) Security Update for Windows XP (KB973346) Sentinel Protection Installer 7.5.0 Skype™ 5.5 SMS version 3.0.5.0 SoundMAX swMSM Synaptics Pointing Device Driver TECDOC CD TECDOC CD 4.2008 Unlocker 1.9.0 Update for Microsoft .NET Framework 3.5 SP1 (KB963707) USB Virus Scan 2.3 VLC media player 2.0.1 WebFldrs XP WLAN WLAN 802.11g mini-PCI Module YoWindow . ==== Event Viewer Messages From Past Week ======== . 6/12/2013 19:40:01, error: Service Control Manager [7000] - The HOSTNT service failed to start due to the following error: The system cannot find the file specified. 6/12/2013 18:52:38, error: Dhcp [1002] - The IP address lease 192.168.1.100 for the Network Card with network address 000B6B4C5C7F has been denied by the DHCP server 0.0.0.0 (The DHCP Server sent a DHCPNACK message). . ==== End Of File ===========================

Редактирано 28 юни 201313 г. от nologo (преглед на промените)

16 юни 201313 г.

Здравейте, сега ще видим за какво става дума. Следва:

1. Изтеглете ComboFix от BleepingComputer
и го запазете (бутон Save -> Save as) ComboFix на вашия десктоп:

След приключване на изтеглянето на ComboFix, иконката на програмата би трябвало да изглежда така:

2. Затворете всички работещи приложения, отворени прозорци и програми работещи във фонов режим. Спрете временно защитата в реално време на антивирусната програма и на другите програми за сигурност, ако има такива.

3. Стартирайте с двоен клик Combofix.exe. Изберете YES, за да се съгласите с условията за използване на програмата. Важно: По време на работата на ComboFix не бива да се движи мишката и да се натискат клавиши от клавиатурата. Просто търпеливо оставете ComboFix да си свърши работата, без да използвате компютъра за други цели.

4. ComboFix ще провери дали Windows Recovery Console e инсталиранa.

*Ако Windows Recovery Console не е инсталирана, ще е необходимо да използвате YES за инсталация на Windows Recovery Console
*Ако Windows Recovery Console е инсталирана, ComboFix ще продължи работата си.

Забележка: Необходимо е да сте свързани към Интернет за да може Windows Recovery Console да се изтегли.

След инсталация на Windows Recovery Console потвърдете с YES, за да продължите напред. Снимка:

5. ComboFix ще спре временно Интернет връзката, но след като приключи работата на програмата тази връзка ще бъде възстановена автоматично. ComboFix ще сканира за проблеми и за заразени файлове, като това може да отнеме известно време. Моля да бъдете търпеливи. Ако има проблем с Интернет връзката след приключване на работата на Combofix, моля да прочетете това: Manually restoring the Internet connection section.

6. Когато работата на ComboFix приключи, ще се появи текстов документ (log) в Notepad:

16 юни 201313 г.

Автор

Здравейте,мерси за бързия отговор.

извърших действията и ето какво има тектсовия документ :

ComboFix 13-06-15.01 - pc 06/16/2013 22:57:54.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1251.359.1033.18.1023.687 [GMT 3:00]
Running from: c:documents and settingspcDesktopComboFix.exe
AV: Panda Cloud Antivirus *Disabled/Updated* {5AD27692-540A-464E-B625-78275FA38393}
FW: Cloud Antivirus Firewall *Disabled* {1337562C-110A-4AF8-B12B-750C0B30E802}
* Created a new restore point
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:documents and settingsAll UsersApplication DataTEMP
.
.
((((((((((((((((((((((((( Files Created from 2013-05-16 to 2013-06-16 )))))))))))))))))))))))))))))))
.
.
2013-06-16 19:45 . 2012-11-07 07:00 46672 ----a-w- c:windowssystem32driversPSKMAD.sys
2013-06-09 15:32 . 2013-06-12 19:47 -------- d-----w- c:documents and settingspcApplication Datavlc
2013-06-09 15:31 . 2013-06-09 15:31 -------- d-----w- c:program filesVideoLAN
2013-06-02 19:55 . 2013-06-02 19:52 144896 ----a-w- c:windowssystem32javacpl.cpl
2013-06-02 19:53 . 2013-06-02 19:53 -------- d-----w- c:program filesCommon FilesJava
2013-06-02 19:52 . 2013-06-02 19:52 94112 ----a-w- c:windowssystem32WindowsAccessBridge.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-06-12 17:10 . 2012-04-01 11:37 692104 ----a-w- c:windowssystem32FlashPlayerApp.exe
2013-06-12 17:10 . 2011-06-03 18:56 71048 ----a-w- c:windowssystem32FlashPlayerCPLApp.cpl
2013-06-02 19:52 . 2012-07-03 20:36 866720 ----a-w- c:windowssystem32npDeployJava1.dll
2013-06-02 19:52 . 2011-02-22 19:36 788896 ----a-w- c:windowssystem32deployJava1.dll
2013-04-04 11:50 . 2012-05-11 21:43 22856 ----a-w- c:windowssystem32driversmbam.sys
2008-03-09 05:25 . 2011-02-20 20:26 236 -c--a-w- c:program filesCommon Filesdx.reg
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionexplorershelliconoverlayidentifiers1MediaIconsOverlay]
@="{1EC23CFF-4C58-458f-924C-8519AEF61B32}"
[HKEY_CLASSES_ROOTCLSID{1EC23CFF-4C58-458f-924C-8519AEF61B32}]
2013-06-12 18:22 225280 ----a-w- c:documents and settingsAll UsersApplication DataMicrosoftMedia ToolsMediaIconsOverlays.dll
.
[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
"DAEMON Tools Lite"="c:program filesDAEMON Tools Litedaemon.exe" [2008-07-17 490952]
"RocketDock"="c:program filesRocketDockRocketDock.exe" [2007-09-02 495616]
.
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
"eabconfg.cpl"="c:program filesCompaqEABEABSERVR.EXE" [2002-11-12 229376]
"hkss"="c:program filesCompaqHotkey Softwarehkss.exe" [2002-09-19 192512]
"SynTPLpr"="c:program filesSynapticsSynTPSynTPLpr.exe" [2004-11-04 98394]
"SynTPEnh"="c:program filesSynapticsSynTPSynTPEnh.exe" [2004-11-04 688218]
"USBScan.exe"="c:program filesUSBScanUSBScan.exe" [2009-10-21 1268736]
"PSUAMain"="c:program filesPanda SecurityPanda Cloud AntivirusPSUAMain.exe" [2013-01-27 32480]
.
[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
"CTFMON.EXE"="c:windowssystem32CTFMON.EXE" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootMinimalWdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregAdobe Reader Speed Launcher]
2008-01-11 20:16 39792 ----a-w- c:program filesAdobeReader 8.0Readerreader_sl.exe
.
[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregATIPTA]
2005-06-07 19:05 344064 ----a-w- c:program filesATI TechnologiesATI Control Panelatiptaxx.exe
.
[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregMalwarebytes' Anti-Malware]
2013-04-04 11:50 532040 ----a-w- c:program filesMalwarebytes' Anti-Malwarembamgui.exe
.
[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregSunJavaUpdateSched]
2013-03-12 04:32 253816 ----a-w- c:program filesCommon FilesJavaJava Updatejusched.exe
.
[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionrun-]
"FTweakFCleaner"=c:program filesFCleanerFCleaner.exe -a
.
[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionrun-]
"USBScan.exe"=c:program filesUSBScanUSBScan.exe -Hide
.
[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
"%windir%Network Diagnosticxpnetdiag.exe"=
"%windir%system32sessmgr.exe"=
"c:Program FilesuTorrentuTorrent.exe"=
"d:PC-ArhivProgramiOpera@USBOpera 10 B3OperaUSB.exe"=
"c:Program FilesSkypePhoneSkype.exe"=
"c:WINDOWSsystem32dplaysvr.exe"=
"d:PC-ArhivGamerevoltrevolt.exe"=
"c:Program Filesaircrack-ng-1.1-winbinbuddy-ng.exe"=
.
[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileGloballyOpenPortsList]
"2706:TCP"= 2706:TCP:Inhatch P2P Streaming
"2707:TCP"= 2707:TCP:Inhatch P2P Streaming
"2708:TCP"= 2708:TCP:Inhatch P2P Streaming
"2709:TCP"= 2709:TCP:Inhatch P2P Streaming
"10950:TCP"= 10950:TCP:Inhatch P2P Streaming
"10951:TCP"= 10951:TCP:Inhatch P2P Streaming
"10952:TCP"= 10952:TCP:Inhatch P2P Streaming
"10953:TCP"= 10953:TCP:Inhatch P2P Streaming
"49780:UDP"= 49780:UDP:Inhatch P2P Streaming
.
R0 sptd;sptd;c:windowssystem32driverssptd.sys [2/20/2011 23:45 717296]
R1 NNSALPC;NNSAlpc;c:windowssystem32driversNNSAlpc.sys [11/26/2012 17:48 82728]
R1 NNSHTTP;NNSHttp;c:windowssystem32driversNNSHttp.sys [11/26/2012 17:48 119080]
R1 NNSHTTPS;NNSHttps;c:windowssystem32driversNNSHttps.sys [1/9/2013 22:45 95584]
R1 NNSIDS;NNSids;c:windowssystem32driversNNSIds.sys [11/26/2012 17:48 123944]
R1 NNSPICC;NNSPicc;c:windowssystem32driversNNSpicc.sys [11/26/2012 17:48 94632]
R1 NNSPIHS;NNSPihs;c:windowssystem32driversNNSpihs.sys [11/26/2012 17:48 51496]
R1 NNSPOP3;NNSPop3;c:windowssystem32driversNNSPop3.sys [11/26/2012 17:48 105640]
R1 NNSPROT;NNSProt;c:windowssystem32driversNNSProt.sys [11/26/2012 17:48 286888]
R1 NNSPRV;NNSPrv;c:windowssystem32driversNNSPrv.sys [11/26/2012 17:48 159528]
R1 NNSSMTP;NNSSmtp;c:windowssystem32driversNNSSmtp.sys [11/26/2012 17:48 108200]
R1 NNSSTRM;NNSStrm;c:windowssystem32driversNNSStrm.sys [11/28/2012 15:04 218024]
R1 NNSTLSC;NNSTlsc;c:windowssystem32driversNNStlsc.sys [11/26/2012 17:48 93096]
R1 oreans32;oreans32;c:windowssystem32driversoreans32.sys [4/19/2011 23:22 33824]
R1 PSINKNC;PSINKnc;c:windowssystem32driversPSINKNC.sys [11/9/2012 20:01 178728]
R2 MBAMScheduler;MBAMScheduler;c:program filesMalwarebytes' Anti-Malwarembamscheduler.exe [6/12/2013 22:12 418376]
R2 NanoServiceMain;Panda Cloud Antivirus Service;c:program filesPanda SecurityPanda Cloud AntivirusPSANHost.exe [1/27/2013 21:16 140512]
R2 PSINAflt;PSINAflt;c:windowssystem32driversPSINAflt.sys [11/9/2012 20:01 149288]
R2 PSINFile;PSINFile;c:windowssystem32driversPSINFile.sys [11/9/2012 20:01 102184]
R2 PSINProc;PSINProc;c:windowssystem32driversPSINProc.sys [11/9/2012 20:01 114216]
R2 PSINProt;PSINProt;c:windowssystem32driversPSINProt.sys [11/9/2012 20:01 123560]
R2 PSUAService;Panda Product Service;c:program filesPanda SecurityPanda Cloud AntivirusPSUAService.exe [1/27/2013 23:38 37088]
R2 Transbase TECDOC CD 4_2008 Service;Transbase TECDOC CD 4_2008 Service;d:autoTECDOC_CD4_2008dbtbmux32.exe [8/11/2008 10:24 356352]
R3 adatadrv;Autodata Protection Service;c:windowssystem32driversadatadrv.sys [3/16/2011 21:41 762112]
R3 MBAMProtector;MBAMProtector;c:windowssystem32driversmbam.sys [5/12/2012 00:43 22856]
R3 NNSNAHS;Network Activity Hook Server Service;c:windowssystem32driversNNSNAHS.sys [10/22/2012 13:08 38824]
S2 HOSTNT;HOSTNT; [x]
S2 MBAMService;MBAMService;c:program filesMalwarebytes' Anti-Malwarembamservice.exe [5/12/2012 00:43 701512]
S3 3xHybrid;Philips SAA713x PCI Card;c:windowssystem32drivers3xHybrid.sys [2/21/2011 00:07 1121536]
S3 DCamUSBMtk;Webcam phone;c:windowssystem32driversusbmtk.sys [2/20/2011 22:12 44032]
.
--- Other Services/Drivers In Memory ---
.
*Deregistered* - PSKMAD
.
Contents of the 'Scheduled Tasks' folder
.
2013-06-16 c:windowsTasksAdobe Flash Player Updater.job
- c:windowssystem32MacromedFlashFlashPlayerUpdateService.exe [2012-09-01 17:10]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://search.babylon.com/?affID=112555&tt=280612_8_&babsrc=HP_ss&mntrId=f8562cf7000000000000000b6b4c5c7f
IE: Add to Google Photos Screensa&ver - c:windowssystem32GPhotos.scr/200
IE: Download with &Media Finder - c:program filesMedia Finderhook.html
TCP: DhcpNameServer = 95.87.194.4 8.8.8.8
TCP: Interfaces{7A7CD101-9BFD-479B-8C98-DC15FE36C052}: NameServer = 8.26.56.26,156.154.70.22
TCP: Interfaces{C4161A17-743E-4670-90F6-3BC32E423B58}: NameServer = 8.26.56.26,156.154.70.22
FF - ProfilePath - c:documents and settingspcApplication DataMozillaFirefoxProfilesbmcbbry3.default
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2571160&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.startup.homepage - hxxp://www.google.bg/
FF - prefs.js: keyword.URL - hxxp://search.babylon.com/?affID=112555&tt=280612_8_&babsrc=KW_ss&mntrId=f8562cf7000000000000000b6b4c5c7f&q=
FF - ExtSQL: 2013-06-09 18:27; [email protected]; c:documents and settingspcApplication DataMozillaFirefoxProfilesbmcbbry3.defaultextensionsxxxxx@xxxxx.xxxx.xpi
FF - ExtSQL: 2013-06-09 18:27; [email protected]; c:documents and settingspcApplication DataMozillaFirefoxProfilesbmcbbry3.defaultextensionsvlcplaylist@helgatauscher.de.xpi
FF - ExtSQL: 2013-06-09 18:27; [email protected]; c:documents and settingspcApplication DataMozillaFirefoxProfilesbmcbbry3.defaultextensionsbernd@staege.info.xpi
FF - user.js: extensions.BabylonToolbar_i.newTab - false
FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=112555&tt=280612_8_
FF - user.js: extensions.BabylonToolbar_i.babExt -
FF - user.js: extensions.BabylonToolbar_i.srcExt - ss
FF - user.js: extensions.BabylonToolbar_i.id - f8562cf7000000000000000b6b4c5c7f
FF - user.js: extensions.BabylonToolbar_i.hardId - f8562cf7000000000000000b6b4c5c7f
FF - user.js: extensions.BabylonToolbar_i.instlDay - 15520
FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.170:01
FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar_i.aflt - babsst
FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
FF - user.js: extensions.BabylonToolbar_i.tlbrId - base
FF - user.js: extensions.BabylonToolbar_i.instlRef - sst
.
- - - - ORPHANS REMOVED - - - -
.
ShellIconOverlayIdentifiers-{F5D1CF73-C196-48F8-AAAC-B9181E22B4E6} - (no file)
ShellIconOverlayIdentifiers-{9AE343CB-BA45-4618-AF6A-0230EE6FC793} - (no file)
MSConfigStartUp-Google Update - c:documents and settingspcLocal SettingsApplication DataGoogleUpdateGoogleUpdate.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-06-16 23:04
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(1536)
c:windowssystem32Ati2evxx.dll
.
- - - - - - - > 'explorer.exe'(3872)
c:documents and settingsAll UsersApplication DataMicrosoftMedia ToolsMediaIconsOverlays.dll
c:windowssystem32wpdshserviceobj.dll
c:windowssystem32portabledevicetypes.dll
c:windowssystem32portabledeviceapi.dll
.
Completion time: 2013-06-16 23:06:49
ComboFix-quarantined-files.txt 2013-06-16 20:06
.
Pre-Run: 5 253 132 288 bytes free
Post-Run: 5 238 050 816 bytes free
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)WINDOWS
[operating systems]
c:cmdconsBOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - ECB22D4030EDD13ED5158AB3EEA58C5B
10AE9EB13951B8E206480773F877A330

поздрави.

p.s.

интерсно нещо ми се струва,че защитната стена (уиндоската) досега не ме е питала дали да блокира уиндоус експлорер,а сега след всяко включване.

Редактирано 16 юни 201313 г. от tsetso (преглед на промените)

17 юни 201313 г.

От лога на ComboFix излезе ето това:

aircrack-ng-1.1-winbinbuddy-ng.exe

Използвате ли приложения за хакване на безжични мрежи?

Следва:

СТЪПКА 1

Изтеглете и стартирайте програмата AdwCleaner
Затворете всички стартирани програми и браузъри
Стартирайте adwcleaner.exe
Маркирайте Delete
Вашият компютър ще се рестартира автоматично. Текстовият файл ще се отвори след рестарта
Публикувайте съдържанието на този лог в следващия си коментар (който можете да намерите тук > C:AdwCleaner[s1].txt)

СТЪПКА 2

Изтеглете Junkware Removal Tool на вашия десктоп
Спрете временно работата на защитните програми
Стартирайте JRT.exe
Ще се отвори DOS прозорец. Натиснете което и да е копче от клавиатурата
Затворете излишните приложения и всички браузъри и изчакайте проверката да завърши
Ще се появи лог файл (който можете да намерите на десктопа > JRT.txt)
Копирайте съдържанието на лог файла в следващия си коментар

СТЪПКА 3

Изтеглете и стартирайте програмата Farbar Service Scanner
Сложете всички отметки и натиснете бутона "Scan"
Ще се създаде лог файл с името (FSS.txt) в папката, откъдето стартирате инструмента
Копирайте съдържанието на лог файла в следващия си коментар

17 юни 201313 г.

Автор

Използвате ли приложения за хакване на безжични мрежи?

--чиста проба любопитство,от типа-"я да видя какво има тук" познанията ми са далече,далече,и там си е останало.компа си го ползвам за служебни цели и имам много неща които не ми се губят-може би трябва някога да му направя бек-ъп

AdwCleaner.txt

# AdwCleaner v2.303 - Logfile created 06/18/2013 at 00:12:31

# Updated 08/06/2013 by Xplode

# Operating system : Microsoft Windows XP Service Pack 3 (32 bits)

# User : pc - PC-F39903DD3E68

# Boot Mode : Normal

# Running from : C:Documents and SettingspcDesktopadwcleaner.exe

# Option [Delete]

***** [services] *****

***** [Files / Folders] *****

File Deleted : C:Documents and SettingspcApplication DataMozillaFirefoxProfilesbmcbbry3.defaultsearchpluginsConduit.xml

File Deleted : C:Documents and SettingspcApplication DataMozillaFirefoxProfilesbmcbbry3.defaultsearchpluginsdaemon-search.xml

File Deleted : C:user.js

Folder Deleted : C:Documents and SettingspcApplication DataMozillaExtensions{ec8030f7-c20a-464f-9b0e-13a3a9e97384}[email protected]

***** [Registry] *****

Key Deleted : HKCUSoftwareMediaFinder

Key Deleted : HKCUSoftwareMicrosoftInternet ExplorerMenuExtDownload with &Media Finder

Key Deleted : HKCUSoftwareMicrosoftInternet ExplorerSearchScopes{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}

Key Deleted : HKCUSoftwareMicrosoftInternet ExplorerSearchScopes{AD22EBAF-0D18-4FC7-90CC-5EA0ABBE9EB9}

Key Deleted : HKCUSoftwareMicrosoftWindowsCurrentVersionExtSettings{32099AAC-C132-4136-9E9A-4E364A424E17}

Key Deleted : HKCUSoftwareMicrosoftWindowsCurrentVersionExtStats{2EECD738-5844-4A99-B4B6-146BF802613B}

Key Deleted : HKCUSoftwareMicrosoftWindowsCurrentVersionExtStats{32099AAC-C132-4136-9E9A-4E364A424E17}

Key Deleted : HKCUSoftwareYourFileDownloader

Key Deleted : HKLMSoftwareBabylon

Key Deleted : HKLMSOFTWAREClassesAppID{09C554C3-109B-483C-A06B-F14172F1A947}

Key Deleted : HKLMSOFTWAREClassesAppID{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}

Key Deleted : HKLMSOFTWAREClassesAppID{BDB69379-802F-4EAF-B541-F8DE92DD98DB}

Key Deleted : HKLMSOFTWAREClassesAppIDescort.DLL

Key Deleted : HKLMSOFTWAREClassesAppIDGenericAskToolbar.DLL

Key Deleted : HKLMSOFTWAREClassesbbylntlbr.bbylntlbrHlpr

Key Deleted : HKLMSOFTWAREClassesbbylntlbr.bbylntlbrHlpr.1

Key Deleted : HKLMSOFTWAREClassesgencrawler_gc.GenCrawler

Key Deleted : HKLMSOFTWAREClassesGenericAskToolbar.ToolbarWnd

Key Deleted : HKLMSOFTWAREClassesGenericAskToolbar.ToolbarWnd.1

Key Deleted : HKLMSOFTWAREClassesInterface{6C434537-053E-486D-B62A-160059D9D456}

Key Deleted : HKLMSOFTWAREClassesInterface{91CF619A-4686-4CA4-9232-3B2E6B63AA92}

Key Deleted : HKLMSOFTWAREClassesInterface{AC71B60E-94C9-4EDE-BA46-E146747BB67E}

Key Deleted : HKLMSOFTWAREClassesMF

Key Deleted : HKLMSOFTWAREClassesProd.cap

Key Deleted : HKLMSOFTWAREClassesTypeLib{2996F0E7-292B-4CAE-893F-47B8B1C05B56}

Key Deleted : HKLMSOFTWAREGoogleChromeExtensionsdednnpigldgdbpgcdpfppmlcnnbjciel

Key Deleted : HKLMSOFTWAREGoogleChromeExtensionslpmkgpnbiojfaoklbkpfneikocaobfai

Key Deleted : HKLMSOFTWAREMicrosoftWindowsCurrentVersionApp ManagementARPCache{414C790F-E24E-461B-983A-2AD84474DE4B}_is1

Key Deleted : HKLMSOFTWAREMicrosoftWindowsCurrentVersionApp ManagementARPCache{86D4B82A-ABED-442A-BE86-96357B70F4FE}

Key Deleted : HKLMSoftwareYourFileDownloader

Value Deleted : HKCUSoftwareMicrosoftInternet ExplorerToolbarWebBrowser [{32099AAC-C132-4136-9E9A-4E364A424E17}]

***** [internet Browsers] *****

- Internet Explorer v6.0.2900.5512

Replaced : [HKCUSoftwareMicrosoftInternet ExplorerMain - Start Page] = hxxp://search.babylon.com/?affID=112555&tt=280612_8_&babsrc=HP_ss&mntrId=f8562cf7000000000000000b6b4c5c7f --> hxxp://www.google.com

- Mozilla Firefox v21.0 (en-US)

File : C:Documents and SettingspcApplication DataMozillaFirefoxProfilesbmcbbry3.defaultprefs.js

C:Documents and SettingspcApplication DataMozillaFirefoxProfilesbmcbbry3.defaultuser.js ... Deleted !

Deleted : user_pref("browser.babylon.HPOnNewTab", "search.babylon.com");

Deleted : user_pref("browser.newtab.url", "hxxp://search.babylon.com/?affID=112555&tt=280612_8_&babsrc=NT_ss&m[...]

Deleted : user_pref("browser.search.defaultenginename", "Search the web (Babylon)");

Deleted : user_pref("browser.search.defaultthis.engineName", "Conduit Apps Customized Web Search");

Deleted : user_pref("browser.search.defaulturl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2571160&Sea[...]

Deleted : user_pref("browser.search.order.1", "Search the web (Babylon)");

Deleted : user_pref("extensions.BabylonToolbar.admin", false);

Deleted : user_pref("extensions.BabylonToolbar.aflt", "babsst");

Deleted : user_pref("extensions.BabylonToolbar.babExt", "");

Deleted : user_pref("extensions.BabylonToolbar.babTrack", "affID=112555&tt=280612_8_");

Deleted : user_pref("extensions.BabylonToolbar.bbDpng", 30);

Deleted : user_pref("extensions.BabylonToolbar.dfltSrch", false);

Deleted : user_pref("extensions.BabylonToolbar.hmpg", false);

Deleted : user_pref("extensions.BabylonToolbar.id", "f8562cf7000000000000000b6b4c5c7f");

Deleted : user_pref("extensions.BabylonToolbar.instlDay", "15520");

Deleted : user_pref("extensions.BabylonToolbar.instlRef", "sst");

Deleted : user_pref("extensions.BabylonToolbar.lastDP", 30);

Deleted : user_pref("extensions.BabylonToolbar.lastVrsnTs", "1.5.3.170:01:35");

Deleted : user_pref("extensions.BabylonToolbar.mntrFFxVrsn", "13.0");

Deleted : user_pref("extensions.BabylonToolbar.newTab", true);

Deleted : user_pref("extensions.BabylonToolbar.newTabUrl", "hxxp://search.babylon.com/?babsrc=NT_bb");

Deleted : user_pref("extensions.BabylonToolbar.noFFXTlbr", false);

Deleted : user_pref("extensions.BabylonToolbar.prdct", "BabylonToolbar");

Deleted : user_pref("extensions.BabylonToolbar.propectorlck", 79563850);

Deleted : user_pref("extensions.BabylonToolbar.prtkDS", 1);

Deleted : user_pref("extensions.BabylonToolbar.prtkHmpg", 1);

Deleted : user_pref("extensions.BabylonToolbar.prtnrId", "babylon");

Deleted : user_pref("extensions.BabylonToolbar.ptch_0717", true);

Deleted : user_pref("extensions.BabylonToolbar.smplGrp", "none");

Deleted : user_pref("extensions.BabylonToolbar.srcExt", "ss");

Deleted : user_pref("extensions.BabylonToolbar.tlbrId", "base");

Deleted : user_pref("extensions.BabylonToolbar.vrsn", "1.5.3.17");

Deleted : user_pref("extensions.BabylonToolbar.vrsnTs", "1.5.3.170:01:35");

Deleted : user_pref("extensions.BabylonToolbar.vrsni", "1.5.3.17");

Deleted : user_pref("extensions.BabylonToolbar_i.aflt", "babsst");

Deleted : user_pref("extensions.BabylonToolbar_i.babExt", "");

Deleted : user_pref("extensions.BabylonToolbar_i.babTrack", "affID=112555&tt=280612_8_");

Deleted : user_pref("extensions.BabylonToolbar_i.hardId", "f8562cf7000000000000000b6b4c5c7f");

Deleted : user_pref("extensions.BabylonToolbar_i.id", "f8562cf7000000000000000b6b4c5c7f");

Deleted : user_pref("extensions.BabylonToolbar_i.instlDay", "15520");

Deleted : user_pref("extensions.BabylonToolbar_i.instlRef", "sst");

Deleted : user_pref("extensions.BabylonToolbar_i.newTab", false);

Deleted : user_pref("extensions.BabylonToolbar_i.newTabUrl", "hxxp://search.babylon.com/?affID=112555&tt=28061[...]

Deleted : user_pref("extensions.BabylonToolbar_i.prdct", "BabylonToolbar");

Deleted : user_pref("extensions.BabylonToolbar_i.prtnrId", "babylon");

Deleted : user_pref("extensions.BabylonToolbar_i.smplGrp", "none");

Deleted : user_pref("extensions.BabylonToolbar_i.srcExt", "ss");

Deleted : user_pref("extensions.BabylonToolbar_i.tlbrId", "base");

Deleted : user_pref("extensions.BabylonToolbar_i.vrsn", "1.5.3.17");

Deleted : user_pref("extensions.BabylonToolbar_i.vrsnTs", "1.5.3.170:01:35");

Deleted : user_pref("extensions.BabylonToolbar_i.vrsni", "1.5.3.17");

Deleted : user_pref("keyword.URL", "hxxp://search.babylon.com/?affID=112555&tt=280612_8_&babsrc=KW_ss&mntrId=f[...]

*************************

AdwCleaner[s1].txt - [7853 octets] - [18/06/2013 00:12:31]

########## EOF - C:AdwCleaner[s1].txt - [7913 octets] ##########

JRT.txt

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 4.9.4 (05.06.2013:1)

OS: Microsoft Windows XP x86

Ran by pc on ўв®аЁЄ 06/18/2013 at 0:22:46,95

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USERSoftwaretorch

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINESoftwaretorch

~~~ Files

~~~ Folders

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on ўв®аЁЄ 06/18/2013 at 0:27:59,55

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FSS.txt

Farbar Service Scanner Version: 16-06-2013

Ran by pc (administrator) on 18-06-2013 at 00:32:24

Running from "C:Documents and SettingspcDesktop"

Microsoft Windows XP Service Pack 3 (X86)

Boot Mode: Normal

****************************************************************

Internet Services:

============

Connection Status:

==============

Localhost is accessible.

LAN connected.

Google IP is accessible.

Google.com is accessible.

Yahoo.com is accessible.

Windows Firewall:

=============

Firewall Disabled Policy:

==================

System Restore:

============

System Restore Disabled Policy:

========================

Security Center:

============

Windows Update:

============

Windows Autoupdate Disabled Policy:

============================

File Check:

========

C:WINDOWSsystem32dhcpcsvc.dll => MD5 is legit

C:WINDOWSsystem32Driversafd.sys => MD5 is legit

C:WINDOWSsystem32Driversnetbt.sys => MD5 is legit

C:WINDOWSsystem32Driverstcpip.sys => MD5 is legit

C:WINDOWSsystem32Driversipsec.sys => MD5 is legit

C:WINDOWSsystem32dnsrslvr.dll => MD5 is legit

C:WINDOWSsystem32ipnathlp.dll => MD5 is legit

C:WINDOWSsystem32netman.dll => MD5 is legit

C:WINDOWSsystem32wbemWMIsvc.dll => MD5 is legit

C:WINDOWSsystem32srsvc.dll => MD5 is legit

C:WINDOWSsystem32Driverssr.sys => MD5 is legit

C:WINDOWSsystem32wscsvc.dll => MD5 is legit

C:WINDOWSsystem32wbemWMIsvc.dll => MD5 is legit

C:WINDOWSsystem32wuauserv.dll => MD5 is legit

C:WINDOWSsystem32qmgr.dll => MD5 is legit

C:WINDOWSsystem32es.dll => MD5 is legit

C:WINDOWSsystem32cryptsvc.dll => MD5 is legit

C:WINDOWSsystem32svchost.exe => MD5 is legit

C:WINDOWSsystem32rpcss.dll => MD5 is legit

C:WINDOWSsystem32services.exe => MD5 is legit

Extra List:

=======

Gpc(4) IPSec(6) irda(3) NetBT(7) PSched(8) Tcpip(5)

0x0A0000000600000001000000020000000300000004000000050000000700000008000000090000000A000000

IpSec Tag value is correct.

**** End of log ****

p.s.

чудех се от доста време как да се оттърва от този babylon-тулбар,мерси,абе като гледам от това чисто любопитсво,май доста неща са се закачили.

17 юни 201313 г.

Добре, утре ще продължим. Пуснете отново лог от DDS.

Редактирано 17 юни 201313 г. от nologo (преглед на промените)

18 юни 201313 г.

Автор

Добре, утре ще продължим. Пуснете отново лог от DDS.

DDS.txt

DDS (Ver_2011-09-30.01) - NTFS_x86 Internet Explorer: 6.0.2900.5512 BrowserJavaVersion: 10.21.2 Run by pc at 1:22:12 on 2013-06-18 Microsoft Windows XP Professional 5.1.2600.3.1251.359.1033.18.1023.696 [GMT 3:00] . AV: Panda Cloud Antivirus *Disabled/Updated* {5AD27692-540A-464E-B625-78275FA38393} FW: Cloud Antivirus Firewall *Disabled* . ============== Running Processes ================ . C:WINDOWSsystem32Ati2evxx.exe C:WINDOWSsystem32spoolsv.exe C:Program FilesCommon FilesAutodata Limited SharedServiceADCDLicSvc.exe C:PROGRA~1CompaqCOMPAQ~1hibserv.exe C:Program FilesMalwarebytes' Anti-Malwarembamscheduler.exe C:Program FilesPanda SecurityPanda Cloud AntivirusPSANHost.exe C:Program FilesPanda SecurityPanda Cloud AntivirusPSUAService.exe C:Program FilesAnalog DevicesSoundMAXSMAgent.exe D:AUTOTECDOC_CD4_2008dbtbmux32.exe C:WINDOWSsystem32Ati2evxx.exe C:WINDOWSsystem32wltrysvc.exe C:WINDOWSsystem32bcmwltry.exe C:WINDOWSsystem32wscntfy.exe C:Program FilesCompaqEABEABSERVR.EXE C:Program FilesCompaqHotkey Softwarehkss.exe C:Program FilesSynapticsSynTPSynTPLpr.exe C:Program FilesSynapticsSynTPSynTPEnh.exe C:Program FilesPanda SecurityPanda Cloud AntivirusPSUAMain.exe C:Program FilesRocketDockRocketDock.exe C:WINDOWSsystem32ctfmon.exe C:WINDOWSSystem32alg.exe C:WINDOWSexplorer.exe C:WINDOWSsystem32wbemwmiprvse.exe C:WINDOWSsystem32svchost.exe -k DcomLaunch C:WINDOWSsystem32svchost.exe -k rpcss C:WINDOWSSystem32svchost.exe -k netsvcs C:WINDOWSsystem32svchost.exe -k NetworkService C:WINDOWSsystem32svchost.exe -k LocalService C:WINDOWSsystem32svchost.exe -k LocalService C:WINDOWSsystem32svchost.exe -k imgsvc C:WINDOWSsystem32svchost.exe -k netsvcs . ============== Pseudo HJT Report =============== . uStart Page = hxxp://www.google.com BHO: Adobe PDF Reader Link Helper: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:program filescommon filesadobeacrobatactivexAcroIEHelper.dll uRun: [DAEMON Tools Lite] "c:program filesdaemon tools litedaemon.exe" -autorun uRun: [RocketDock] "c:program filesrocketdockRocketDock.exe" uRun: [ctfmon.exe] c:windowssystem32ctfmon.exe mRun: [eabconfg.cpl] c:program filescompaqeabEABSERVR.EXE /Start mRun: [hkss] c:program filescompaqhotkey softwarehkss.exe mRun: [synTPLpr] c:program filessynapticssyntpSynTPLpr.exe mRun: [synTPEnh] c:program filessynapticssyntpSynTPEnh.exe mRun: [uSBScan.exe] c:program filesusbscanUSBScan.exe -Hide mRun: [PSUAMain] "c:program filespanda securitypanda cloud antivirusPSUAMain.exe" /LaunchSysTray dRun: [CTFMON.EXE] c:windowssystem32CTFMON.EXE uPolicies-Explorer: NoDriveTypeAutoRun = dword:323 uPolicies-Explorer: NoDriveAutoRun = dword:67108863 uPolicies-Explorer: NoDrives = dword:0 mPolicies-Explorer: NoDriveAutoRun = dword:67108863 mPolicies-Explorer: NoDriveTypeAutoRun = dword:323 mPolicies-Explorer: NoDrives = dword:0 mPolicies-Explorer: NoDriveTypeAutoRun = dword:323 mPolicies-Explorer: NoDriveAutoRun = dword:67108863 IE: Add to Google Photos Screensa&ver - c:windowssystem32GPhotos.scr/200 IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%Network Diagnosticxpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:program filesmessengermsmsgs.exe DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab DPF: {CAFEEFAC-0017-0000-0021-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab TCP: Interfaces{7A7CD101-9BFD-479B-8C98-DC15FE36C052} : NameServer = 8.26.56.26,156.154.70.22 TCP: Interfaces{C4161A17-743E-4670-90F6-3BC32E423B58} : NameServer = 8.26.56.26,156.154.70.22 Filter: text/x-mrml - {C51721BE-858B-4A66-A8BF-D2882FF49820} - c:program filescommon filesa&wMidRadio.ocx Notify: AtiExtEvent - Ati2evxx.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:windowssystem32wpdshserviceobj.dll . ================= FIREFOX =================== . FF - ProfilePath - c:documents and settingspcapplication datamozillafirefoxprofilesbmcbbry3.default FF - prefs.js: browser.startup.homepage - hxxp://www.google.bg/ FF - plugin: c:program filesgooglepicasa3npPicasa3.dll FF - plugin: c:program filesjavajre7binplugin2npjp2.dll FF - plugin: c:windowssystem32adobedirectornp32dsw_1202122.dll FF - plugin: c:windowssystem32macromedflashNPSWF32_11_7_700_224.dll FF - plugin: c:windowssystem32npDeployJava1.dll FF - plugin: c:windowssystem32npptools.dll . ============= SERVICES / DRIVERS =============== . R1 NNSALPC;NNSAlpc;c:windowssystem32driversNNSAlpc.sys [2012-11-26 82728] R1 NNSHTTP;NNSHttp;c:windowssystem32driversNNSHttp.sys [2012-11-26 119080] R1 NNSHTTPS;NNSHttps;c:windowssystem32driversNNSHttps.sys [2013-1-9 95584] R1 NNSIDS;NNSids;c:windowssystem32driversNNSIds.sys [2012-11-26 123944] R1 NNSPICC;NNSPicc;c:windowssystem32driversNNSpicc.sys [2012-11-26 94632] R1 NNSPIHS;NNSPihs;c:windowssystem32driversNNSpihs.sys [2012-11-26 51496] R1 NNSPOP3;NNSPop3;c:windowssystem32driversNNSPop3.sys [2012-11-26 105640] R1 NNSPROT;NNSProt;c:windowssystem32driversNNSProt.sys [2012-11-26 286888] R1 NNSPRV;NNSPrv;c:windowssystem32driversNNSPrv.sys [2012-11-26 159528] R1 NNSSMTP;NNSSmtp;c:windowssystem32driversNNSSmtp.sys [2012-11-26 108200] R1 NNSSTRM;NNSStrm;c:windowssystem32driversNNSStrm.sys [2012-11-28 218024] R1 NNSTLSC;NNSTlsc;c:windowssystem32driversNNStlsc.sys [2012-11-26 93096] R1 oreans32;oreans32;c:windowssystem32driversoreans32.sys [2011-4-19 33824] R1 PSINKNC;PSINKnc;c:windowssystem32driversPSINKNC.sys [2012-11-9 178728] R2 MBAMScheduler;MBAMScheduler;c:program filesmalwarebytes' anti-malwarembamscheduler.exe [2013-6-12 418376] R2 NanoServiceMain;Panda Cloud Antivirus Service;c:program filespanda securitypanda cloud antivirusPSANHost.exe [2013-1-27 140512] R2 PSINAflt;PSINAflt;c:windowssystem32driversPSINAflt.sys [2012-11-9 149288] R2 PSINFile;PSINFile;c:windowssystem32driversPSINFile.sys [2012-11-9 102184] R2 PSINProc;PSINProc;c:windowssystem32driversPSINProc.sys [2012-11-9 114216] R2 PSINProt;PSINProt;c:windowssystem32driversPSINProt.sys [2012-11-9 123560] R2 PSUAService;Panda Product Service;c:program filespanda securitypanda cloud antivirusPSUAService.exe [2013-1-27 37088] R2 Transbase TECDOC CD 4_2008 Service;Transbase TECDOC CD 4_2008 Service;d:autotecdoc_cd4_2008dbtbmux32.exe [2008-8-11 356352] R3 adatadrv;Autodata Protection Service;c:windowssystem32driversadatadrv.sys [2011-3-16 762112] R3 MBAMProtector;MBAMProtector;c:windowssystem32driversmbam.sys [2012-5-12 22856] R3 NNSNAHS;Network Activity Hook Server Service;c:windowssystem32driversNNSNAHS.sys [2012-10-22 38824] S2 HOSTNT;HOSTNT; [x] S2 MBAMService;MBAMService;c:program filesmalwarebytes' anti-malwarembamservice.exe [2012-5-12 701512] S3 3xHybrid;Philips SAA713x PCI Card;c:windowssystem32drivers3xHybrid.sys [2011-2-21 1121536] S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:windowssystem32macromedflashFlashPlayerUpdateService.exe [2012-9-1 256904] S3 DCamUSBMtk;Webcam phone;c:windowssystem32driversusbmtk.sys [2011-2-20 44032] . =============== Created Last 30 ================ . 2013-06-17 21:22:44 -------- d-----w- c:windowsERUNT 2013-06-17 21:22:38 -------- d-----w- C:JRT 2013-06-17 21:15:22 46672 ----a-w- c:windowssystem32driversPSKMAD.sys 2013-06-16 19:56:26 -------- d-sha-r- C:cmdcons 2013-06-16 19:54:42 98816 ----a-w- c:windowssed.exe 2013-06-16 19:54:42 256000 ----a-w- c:windowsPEV.exe 2013-06-16 19:54:42 208896 ----a-w- c:windowsMBR.exe 2013-06-09 15:31:09 -------- d-----w- c:program filesVideoLAN 2013-06-08 17:56:36 262552 ----a-w- c:program filesmozilla firefoxbrowsercomponentsbrowsercomps.dll 2013-06-08 17:56:00 19449240 ----a-w- c:program filesmozilla firefoxxul.dll 2013-06-08 17:56:00 19352 ----a-w- c:program filesmozilla firefoxxpcom.dll 2013-06-02 19:55:00 144896 ----a-w- c:windowssystem32javacpl.cpl 2013-06-02 19:52:41 94112 ----a-w- c:windowssystem32WindowsAccessBridge.dll . ==================== Find3M ==================== . 2013-06-12 17:10:26 692104 ----a-w- c:windowssystem32FlashPlayerApp.exe 2013-06-12 17:10:25 71048 ----a-w- c:windowssystem32FlashPlayerCPLApp.cpl 2013-06-02 19:52:16 866720 ----a-w- c:windowssystem32npDeployJava1.dll 2013-06-02 19:52:15 788896 ----a-w- c:windowssystem32deployJava1.dll 2013-04-04 11:50:32 22856 ----a-w- c:windowssystem32driversmbam.sys 2008-03-09 05:25:10 236 -c--a-w- c:program filescommon filesdx.reg . ============= FINISH: 1:22:44,67 ===============

attach.txt

. UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2011-09-30.01) . Microsoft Windows XP Professional Boot Device: DeviceHarddiskVolume1 Install Date: 2/20/2011 18:49:07 System Uptime: 6/18/2013 00:14:26 (1 hours ago) . Motherboard: Compaq | | 07F4 Processor: Mobile Intel® Pentium® 4 - M CPU 1.80GHz | J1 | 1793/100mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 12 GiB total, 4,872 GiB free. D: is FIXED (NTFS) - 39 GiB total, 11,248 GiB free. F: is CDROM () G: is CDROM () . ==== Disabled Device Manager Items ============= . Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318} Description: WLAN 802.11g mini-PCI Module Device ID: PCIVEN_14E4&DEV_4320&SUBSYS_1220185F&REV_034&139E449D&0&20F0 Manufacturer: Broadcom Name: WLAN 802.11g mini-PCI Module PNP Device ID: PCIVEN_14E4&DEV_4320&SUBSYS_1220185F&REV_034&139E449D&0&20F0 Service: BCM43XX . Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318} Description: Intel® PRO/100 VM Network Connection Device ID: PCIVEN_8086&DEV_1038&SUBSYS_00980E11&REV_424&139E449D&0&40F0 Manufacturer: Intel Name: Intel® PRO/100 VM Network Connection PNP Device ID: PCIVEN_8086&DEV_1038&SUBSYS_00980E11&REV_424&139E449D&0&40F0 Service: E100B . ==== System Restore Points =================== . RP76: 1/21/2013 22:29:46 - Removed Ask Toolbar. RP77: 3/16/2013 14:57:32 - Installed Sys Optimizer RP78: 3/16/2013 15:02:41 - Removed Sys Optimizer RP79: 5/21/2013 16:37:42 - System Checkpoint RP80: 6/2/2013 22:48:07 - Removed Google Drive RP81: 6/2/2013 22:51:20 - Removed Java 7 Update 5 RP82: 6/2/2013 22:52:06 - Installed Java 7 Update 21 RP83: 6/2/2013 22:54:42 - Removed Java 6 Update 24 RP84: 6/2/2013 22:56:13 - Removed Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 RP85: 6/16/2013 22:55:00 - ComboFix created restore point . ==== Installed Programs ====================== . µTorrent 7-Zip 9.20 Adobe Flash Player 11 Plugin Adobe Reader 8.1.2 Adobe Shockwave Player 12.0 Adobe SVG Viewer 3.0 ATI - Software Uninstall Utility ATI Control Panel ATI Display Driver BCM Wireless Network Adapter Big Kahuna Reef 2 - Chain Reaction BlazeDTV 6.0 CCleaner Compaq Easy Access Buttons 3.00 D2 Compaq HotKey Support Software Compaq Power Management DirectX10 RC2 Pre Fix 3 DivX 4.02 Codec doPDF 7.2 printer FiatECUScan Filters Foxit Reader FTDI USB Serial Converter Drivers Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595) Hotfix for Windows Media Format 11 SDK (KB929399) Hotfix for Windows Media Player 11 (KB939683) Hotfix for Windows XP (KB954550-v5) Hotfix for Windows XP (KB970653-v3) Hotfix for Windows XP (KB976002-v5) Java 7 Update 21 Java Auto Updater Java DB 10.6.2.1 Java SE Development Kit 6 Update 24 JavaFX 2.1.1 K-Lite Codec Pack 6.9.0 (Full) Malwarebytes Anti-Malware, версия 1.75.0.1300 Microsoft .NET Framework 2.0 Service Pack 2 Microsoft .NET Framework 3.0 Service Pack 2 Microsoft .NET Framework 3.5 SP1 Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 moDiag professional 2.0.1 Mozilla Firefox 21.0 (x86 en-US) MV2Player (remove only) OpenOffice.org 3.2 Panda Cloud Antivirus Picasa 3 ProScan Ricochet Infinity RocketDock 1.3.5 Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111) Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424) Security Update for Windows Media Player 11 (KB954154) Security Update for Windows XP (KB923789) Security Update for Windows XP (KB938464) Security Update for Windows XP (KB941569) Security Update for Windows XP (KB973346) Sentinel Protection Installer 7.5.0 Skype™ 5.5 SMS version 3.0.5.0 SoundMAX swMSM Synaptics Pointing Device Driver TECDOC CD TECDOC CD 4.2008 Unlocker 1.9.0 Update for Microsoft .NET Framework 3.5 SP1 (KB963707) USB Virus Scan 2.3 VLC media player 2.0.1 WebFldrs XP WLAN WLAN 802.11g mini-PCI Module . ==== Event Viewer Messages From Past Week ======== . 6/16/2013 23:04:42, error: PlugPlayManager [11] - The device RootLEGACY_UNLOCKERDRIVER50000 disappeared from the system without first being prepared for removal. 6/16/2013 22:57:30, error: Service Control Manager [7034] - The WLTRYSVC service terminated unexpectedly. It has done this 1 time(s). 6/16/2013 22:54:17, error: Service Control Manager [7031] - The Hibernation service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service. 6/13/2013 17:59:44, error: Service Control Manager [7000] - The HOSTNT service failed to start due to the following error: The system cannot find the file specified. 6/12/2013 18:52:38, error: Dhcp [1002] - The IP address lease 192.168.1.100 for the Network Card with network address 000B6B4C5C7F has been denied by the DHCP server 0.0.0.0 (The DHCP Server sent a DHCPNACK message). . ==== End Of File ===========================

18 юни 201313 г.

Хм, има някакъв проблем, затова:

1) Изтеглете: ESET Online Scanner
2) Стартирайте esetsmartinstaller_enu.exe
3) Сложете отметка на YES, I accept the Terms of Use и изберете Start
4) Скенерът ще започне да изтегля компонентите, които са му необходими.
5) Уверете се, че има отметки на следните редове, включително и тези от менюто Advanced Settings:

[*]

Scan archives [*]Scan for potentially unwanted applications [*]Scan for potentially unsafe applications [*]Enable Anti-Stealth technology

Уверете се че, Remove found threats няма отметка!

И накрая изберете Start

6) Скенерът ще започне да изтегля последните дефиниции.
7) След като сканирането завърши, изберете Finish.
8) Отворете папката C:Program FilesESETESET Online Scanner.

9) Публикувайте съдържанието на лога или го прикачете в следващия си коментар (виж опцията "прикачени файлове", когато публикувате коментар).

18 юни 201313 г.

Автор

готово,сканирах само С: -то, D:-то,не искам да пипа.

намери троянец.

мерси за отделеното време.

поздрави . до утре.

log.txt

18 юни 201313 г.

Сега има ли проблем с Panda и файлове в temp папките?

18 юни 201313 г.

Автор

Сега има ли проблем с Panda и файлове в temp папките?

не,не се е обаждала от вчера,както и експлолъра не е искал да го отблокира стената.

мерси пак.

на друг дял имам качено ксубунту,за да го ползвам само за нет,ама то мързел,да не превключвам....

18 юни 201313 г.

Според мен Panda Cloud не е добро решение за защита. Препоръчвам да не бързате и да следите раздела "Сигурност и антивирусна защита", както и подфорума с промоциите. Ми пуснете Kubuntu, няма лошо. Имате ли някакъв друг проблем с Windows?

18 юни 201313 г.

Автор

Според мен Panda Cloud не е добро решение за защита. Препоръчвам да не бързате и да следите раздела "Сигурност и антивирусна защита", както и подфорума с промоциите. Ми пуснете Kubuntu, няма лошо. Имате ли някакъв друг проблем с Windows?

по принцип исках нещо леко(антивирус) с идеята да не го ползвам много онлайн,но да помага и офлайн (флашки,сд-та),но явно съм сбъркал.

общо взето не се ровичкам много,опитвам се да го почиствам от време на време (Ccleaner).

мерси пак за отделеното време,ще гледам да следя раздела.

18 юни 201313 г.

Това, което намери EOS → D:ADCDA2adbcd.dll е "троянец" от Autodata, нелицензирана версия.

Следва:

1. Start > Run > в полето за търсене с Copy/ Paste въведете следната команда, маркирана в синьо:

Combofix /Uninstall

Ако решите да я въведете ръчно, има място между Combofix и /Uninstall. Снимка:

2. Изтеглете Delfix.exe и го стартирайте. Сложете отметка пред Remove disinfection tools и натиснете бутона Run. Инструментът ще се самоизтрие, след като приключи работата си.

Изтрийте логовете и програмите, които използвахме в темата, ако има останали. EOS се деинсталира като всяка друга програма. Пишете дали сте завършили с почистването.

19 юни 201313 г.

Автор

Това, което намери EOS → D:ADCDA2adbcd.dll е "троянец" от Autodata, нелицензирана версия.

Следва:

1. Start > Run > в полето за търсене с Copy/ Paste въведете следната команда, маркирана в синьо:

Combofix /Uninstall

Ако решите да я въведете ръчно, има място между Combofix и /Uninstall. Снимка:

2. Изтеглете Delfix.exe и го стартирайте. Сложете отметка пред Remove disinfection tools и натиснете бутона Run. Инструментът ще се самоизтрие, след като приключи работата си.

Изтрийте логовете и програмите, които използвахме в темата, ако има останали. EOS се деинсталира като всяка друга програма. Пишете дали сте завършили с почистването.

# DelFix v10.3 - Logfile created 19/06/2013 at 00:10:08

# Updated 08/06/2013 by Xplode

# Username : pc - PC-F39903DD3E68

# Operating System : Microsoft Windows XP Service Pack 3 (32 bits)

~ Removing disinfection tools ...

Deleted : C:Qoobox

Deleted : C:JRT

Deleted : C:Documents and SettingspcDesktopdds.exe

Deleted : C:WINDOWSgrep.exe

Deleted : C:WINDOWSPEV.exe

Deleted : C:WINDOWSNIRCMD.exe

Deleted : C:WINDOWSMBR.exe

Deleted : C:WINDOWSSED.exe

Deleted : C:WINDOWSSWREG.exe

Deleted : C:WINDOWSSWSC.exe

Deleted : C:WINDOWSSWXCACLS.exe

Deleted : C:WINDOWSZip.exe

Deleted : HKLMSOFTWAREAdwCleaner

Deleted : HKLMSOFTWARESwearware

########## - EOF - ##########

готово,свърших с почистването.

все още не се е обаждала Панда-та,явно сме решили пролема,макар и да не разбрах каква беше гадината (не че ми трябва име за да я смачкаме-ха ха).

пак благодаря за отделеното време,за съжаление аз не мога да върна жеста.

20 юни 201313 г.

Да, много неща бяха премахнати. Сега има ли някакви проблеми с Windows?

27 юни 201313 г.

Автор

Да, много неща бяха премахнати. Сега има ли някакви проблеми с Windows?

не.

сложих аваст фрии,по-добре ли е?

28 юни 201313 г.

Да, според мен Avast е по-добре. Маркирам проблема като решен. Приятен ден и успех!

Добре дошли!

проблем с tmp60.exe

Featured Replies

Архивирана тема

Разглеждащи това в момента 0

Дарение

Бюлетин

Профил

Навигация

Търсене

Конфигуриране на push известия в браузъра

Chrome (Android)

Chrome (Desktop)

Safari (iOS 16.4+)

Safari (macOS)

Edge (Android)

Edge (Desktop)

Firefox (Android)

Firefox (Desktop)