Как е името на програмата, която те кара да теглиш или към кой сайт те препраща?

Ето към този сайт http://www.spylocked.com/?aff=334

Ето към този сайт http://www.spylocked.com/?aff=334

http://fix-computer-problem.com/rogue-anti.../spylocked.html

А таз програма Spy Sweeper да деинсталирвам ли?

Ми не, тя си е класика в жанра. В случая става въпрос за т.нар rogue софтуер (фалшив и зловреден, уж антиспай софтуер) и то за нещо съвсем ново.

В този сайт има статия за него и инструкции за премахване: http://www.bleepingcomputer.com/forums/topic85376.html

В гугъл също излязоха доста варианти за "трепане на бубата" - основното е да изключиш System restore и да чистиш под Safe mode

http://www.bleepingcomputer.com/files/smitfraudfix.php

Пускаш го в Safe Mode, би трябвало да се справи. По принцип никоя от комерсиалните или безплатни antispyware програми не се справя с по- добре направените зарази като тази, в смисъл недей сканира с безброй програми, ако горната не помогне (напълно) пусни лог от HiJackThis.

Сега сканирах с XoftSpySE пак ми откри хиляда гадории.Махнах ги,рестартирах но все същото.

До тук файда никаква...

Утре ще пробвам и с SmitFraudFix и ако с нея не стане вече не знам...

http://www.bleepingcomputer.com/files/smitfraudfix.php

Пускаш го в Safe Mode, би трябвало да се справи. По принцип никоя от комерсиалните или безплатни antispyware програми не се справя с по- добре направените зарази като тази, в смисъл недей сканира с безброй програми, ако горната не помогне (напълно) пусни лог от HiJackThis.

С тази програма SmitfraudFix се махна само единият балон който излизаше в дясно,но рекламните прозорци продължават да излизат.

Eто това е log файла който сейфах.

Logfile of HijackThis v1.97.7

Scan saved at 11:17:56, on 25.03.2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:

C:\windows\System32\smss.exe

C:\windows\system32\winlogon.exe

C:\windows\system32\services.exe

C:\windows\system32\lsass.exe

C:\windows\system32\svchost.exe

C:\windows\System32\svchost.exe

C:\windows\system32\spoolsv.exe

C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe

C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe

C:\PROGRA~1\Grisoft\AVG7\avgemc.exe

D:\Program files\cbService.exe

C:\CFusionMX7\db\slserver54\bin\swagent.exe

C:\CFusionMX7\db\slserver54\bin\swstrtr.exe

C:\CFusionMX7\db\slserver54\bin\swsoc.exe

C:\windows\system32\nvsvc32.exe

C:\windows\system32\svchost.exe

C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

C:\PROGRA~1\Grisoft\AVG7\avgfwsrv.exe

C:\windows\Explorer.EXE

C:\Program Files\Video Access ActiveX Object\isamntr.exe

C:\Program Files\Video Access ActiveX Object\pmsnrr.exe

D:\Program files\Unlocker\UnlockerAssistant.exe

C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe

C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe

C:\Program Files\SysMetrix\SysMetrix.exe

C:\Program Files\Video Access ActiveX Object\pmmnt.exe

C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe

C:\Program Files\Video Access ActiveX Object\isamini.exe

D:\Program files\cbInterface.exe

C:\Program Files\Winamp\winampa.exe

C:\Program Files\QuickTime\qttask.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe

C:\windows\system32\ctfmon.exe

C:\Program Files\Windows Media Player\WMPNSCFG.exe

C:\windows\System32\svchost.exe

C:\Program Files\Philips\SPC 200NC PC Camera\TrayMin200.exe

d:\My Documents\ПРОГРАМИ\PowerMenu_1_5_1\PowerMenu.exe

C:\WINDOWS\BricoPacks\Vista Inspirat\ObjectDock\ObjectDock.exe

C:\WINDOWS\BricoPacks\Vista Inspirat\UberIcon\UberIcon Manager.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Webroot\Spy Sweeper\SSU.EXE

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\TechSmith\SnagIt 8\SnagIt32.exe

C:\Program Files\TechSmith\SnagIt 8\TSCHelp.exe

C:\Program Files\TechSmith\SnagIt 8\SnagPriv.exe

C:\Program Files\WinRAR\WinRAR.exe

C:\Documents and Settings\-\Desktop\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com/0SEENUS/SAOS01

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://zavarchik.dir.bg/

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.rambler.ru/ra/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul...rch/search.html

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R3 - URLSearchHook: Rambler-Ассистент - {468CD8A9-7C25-45FA-969E-3D925C689DC4} - C:\Program Files\Rambler Assistant\ramblertoolbarU0.dll

R3 - URLSearchHook: (no name) - {BE89472C-B803-4D1D-9A9A-0A63660E0FE3} - (no file)

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)

O2 - BHO: (no name) - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 8\SnagItBHO.dll

O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO.dll

O2 - BHO: (no name) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll

O2 - BHO: (no name) - {A6ACAE64-F798-4930-AD86-BD3FB32038DB} - C:\Program Files\Video Access ActiveX Object\isadd.dll

O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)

O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 8\SnagItIEAddin.dll

O3 - Toolbar: (no name) - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - (no file)

O3 - Toolbar: Underground Toolbar - {CCA00000-0000-0000-0000-000000000000} - (no file)

O3 - Toolbar: MyRadioRU Toolbar - {67984beb-075d-49ae-a50b-352e145faab8} - C:\Program Files\MyRadioRU\tbMyRa.dll

O3 - Toolbar: Rambler-Ассистент - {468CD8A9-7C25-45FA-969E-3D925C689DC4} - C:\Program Files\Rambler Assistant\ramblertoolbarU0.dll

O3 - Toolbar: (no name) - {84938242-5C5B-4A55-B6B9-A1507543B418} - (no file)

O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\windows\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [unlockerAssistant] "D:\Program files\Unlocker\UnlockerAssistant.exe"

O4 - HKLM\..\Run: [eabconfg.cpl] "C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe" /Start

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"

O4 - HKLM\..\Run: [sysMetrix] "C:\Program Files\SysMetrix\SysMetrix.exe"

O4 - HKLM\..\Run: [iSUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup

O4 - HKLM\..\Run: [iSUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start

O4 - HKLM\..\Run: [Cobian Backup 8 interface] "D:\Program files\cbInterface.exe" -service

O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install

O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [spySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [ctfmon.exe] C:\windows\system32\ctfmon.exe

O4 - HKCU\..\Run: [WMPNSCFG] "C:\Program Files\Windows Media Player\WMPNSCFG.exe"

O4 - HKCU\..\Run: [DesktopX] ""C:\Program Files\Stardock\Object Desktop\DesktopX\DesktopX Builder.exe" -noui"

O4 - Startup: ComNet.lnk = ?

O4 - Startup: PowerMenu.lnk = ?

O4 - Startup: Stardock ObjectDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat\ObjectDock\ObjectDock.exe

O4 - Startup: UberIcon.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat\UberIcon\UberIcon Manager.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

O4 - Global Startup: TrayMin200.exe.lnk = ?

O8 - Extra context menu item: Download all links using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm

O8 - Extra context menu item: Download all videos using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm

O8 - Extra context menu item: Download link using &BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O8 - Extra context menu item: Open Link Target in Firefox - file://C:\Documents and Settings\-\Application Data\Mozilla\Firefox\Profiles\hn3icw2a.default\extensions\{5D558C43-550F-4b12-84AB-0D8ABDA9F975}\firefoxviewlink.html

O8 - Extra context menu item: View This Page in Firefox - file://C:\Documents and Settings\-\Application Data\Mozilla\Firefox\Profiles\hn3icw2a.default\extensions\{5D558C43-550F-4b12-84AB-0D8ABDA9F975}\firefoxviewpage.html

O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm

O8 - Extra context menu item: Найти с помощью Рамблера - res://C:\Program Files\Rambler Assistant\ramblertoolbarU0.dll/search.htm

O8 - Extra context menu item: Перевести с помощью словарей Рамблера - res://C:\Program Files\Rambler Assistant\ramblertoolbarU0.dll/dic.htm

O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)

O9 - Extra button: Преведи (HKLM)

O9 - Extra button: Download5000 Toolbar (HKLM)

O9 - Extra 'Tools' menuitem: Download5000 Toolbar (HKLM)

O9 - Extra button: ICQ Lite (HKLM)

O9 - Extra 'Tools' menuitem: ICQ Lite (HKLM)

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 (HKLM)

O9 - Extra button: Messenger (HKLM)

O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)

O9 - Extra button: Webaroo: Capture Page (HKCU)

O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll

O11 - Options group: [iNTERNATIONAL] International*

O12 - Plugin for .swf: C:\Program Files\Netscape\Netscape Browser\PLUGINS\NPSWF32.dll

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1165945631468

O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secur...loadManager.ocx

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub/shock...ash/swflash.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{12BFF79A-B7DF-45AE-9839-31E2B1EE25E4}: NameServer = 84.54.128.9 84.54.128.8

O17 - HKLM\System\CCS\Services\Tcpip\..\{D46BD610-B760-4D40-B7A2-009174EA2248}: NameServer = 212.39.90.42,212.39.90.43

Редактирано 25 март 200719 г. от AleksofT (преглед на промените)

R3 - URLSearchHook: (no name) - {BE89472C-B803-4D1D-9A9A-0A63660E0FE3} - (no file)

O2 - BHO: (no name) - {A6ACAE64-F798-4930-AD86-BD3FB32038DB} - C:\Program Files\Video Access ActiveX Object\isadd.dll

O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)

O3 - Toolbar: (no name) - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - (no file)

O3 - Toolbar: Underground Toolbar - {CCA00000-0000-0000-0000-000000000000} - (no file)

O3 - Toolbar: (no name) - {84938242-5C5B-4A55-B6B9-A1507543B418} - (no file)

Слагаш отметки на следните и натискаш FIX NOW при затворени задължително Internet explorer и explorer.exe/my computer

Това не е и пълният лог, след като фискнеш горните пусни нов лог тук и се увери че е излязал целият, ако трябва го прикрепи като txt или zip файл към поста ти.

Интересно къде ми изчезна мнението точно преди последното ти...

edit: също с unlocker изтрий цялата папка C:\Program Files\Video Access ActiveX Object и рестартирай преди новият лог.

Редактирано 25 март 200719 г. от newb (преглед на промените)

Това е .log-а след махането на:

R3 - URLSearchHook: (no name) - {BE89472C-B803-4D1D-9A9A-0A63660E0FE3} - (no file)

O2 - BHO: (no name) - {A6ACAE64-F798-4930-AD86-BD3FB32038DB} - C:\Program Files\Video Access ActiveX Object\isadd.dll

O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)

O3 - Toolbar: (no name) - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - (no file)

O3 - Toolbar: Underground Toolbar - {CCA00000-0000-0000-0000-000000000000} - (no file)

O3 - Toolbar: (no name) - {84938242-5C5B-4A55-B6B9-A1507543B418} - (no file)

Logfile of HijackThis v1.97.7

Scan saved at 14:32:55, on 25.03.2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:

C:\windows\System32\smss.exe

C:\windows\system32\winlogon.exe

C:\windows\system32\services.exe

C:\windows\system32\lsass.exe

C:\windows\system32\svchost.exe

C:\windows\System32\svchost.exe

C:\windows\system32\spoolsv.exe

C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe

C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe

C:\PROGRA~1\Grisoft\AVG7\avgemc.exe

D:\Program files\cbService.exe

C:\CFusionMX7\db\slserver54\bin\swagent.exe

C:\CFusionMX7\db\slserver54\bin\swstrtr.exe

C:\CFusionMX7\db\slserver54\bin\swsoc.exe

C:\windows\system32\nvsvc32.exe

C:\windows\system32\svchost.exe

C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

C:\PROGRA~1\Grisoft\AVG7\avgfwsrv.exe

C:\windows\Explorer.EXE

C:\Program Files\Video Access ActiveX Object\isamntr.exe

C:\Program Files\Video Access ActiveX Object\pmsnrr.exe

D:\Program files\Unlocker\UnlockerAssistant.exe

C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe

C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe

C:\Program Files\SysMetrix\SysMetrix.exe

C:\Program Files\Video Access ActiveX Object\pmmnt.exe

C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe

C:\Program Files\Video Access ActiveX Object\isamini.exe

D:\Program files\cbInterface.exe

C:\Program Files\Winamp\winampa.exe

C:\Program Files\QuickTime\qttask.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe

C:\windows\system32\ctfmon.exe

C:\Program Files\Windows Media Player\WMPNSCFG.exe

C:\windows\System32\svchost.exe

C:\Program Files\Philips\SPC 200NC PC Camera\TrayMin200.exe

d:\My Documents\ПРОГРАМИ\PowerMenu_1_5_1\PowerMenu.exe

C:\WINDOWS\BricoPacks\Vista Inspirat\ObjectDock\ObjectDock.exe

C:\WINDOWS\BricoPacks\Vista Inspirat\UberIcon\UberIcon Manager.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Webroot\Spy Sweeper\SSU.EXE

C:\Program Files\TechSmith\SnagIt 8\SnagIt32.exe

C:\Program Files\TechSmith\SnagIt 8\TSCHelp.exe

C:\Program Files\TechSmith\SnagIt 8\SnagPriv.exe

C:\Documents and Settings\-\Desktop\hijackthis\HijackThis.exe

C:\Program Files\JGsoft\EditPadPro6\EditPadPro.exe

C:\Documents and Settings\-\Desktop\hfs.exe

C:\Program Files\Mozilla Firefox\firefox.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com/0SEENUS/SAOS01

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://zavarchik.dir.bg/

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.rambler.ru/ra/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul...rch/search.html

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R3 - URLSearchHook: Rambler-Ассистент - {468CD8A9-7C25-45FA-969E-3D925C689DC4} - C:\Program Files\Rambler Assistant\ramblertoolbarU0.dll

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)

O2 - BHO: (no name) - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 8\SnagItBHO.dll

O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO.dll

O2 - BHO: (no name) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll

O2 - BHO: (no name) - {A6ACAE64-F798-4930-AD86-BD3FB32038DB} - C:\Program Files\Video Access ActiveX Object\isadd.dll

O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 8\SnagItIEAddin.dll

O3 - Toolbar: MyRadioRU Toolbar - {67984beb-075d-49ae-a50b-352e145faab8} - C:\Program Files\MyRadioRU\tbMyRa.dll

O3 - Toolbar: Rambler-Ассистент - {468CD8A9-7C25-45FA-969E-3D925C689DC4} - C:\Program Files\Rambler Assistant\ramblertoolbarU0.dll

O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\windows\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [unlockerAssistant] "D:\Program files\Unlocker\UnlockerAssistant.exe"

O4 - HKLM\..\Run: [eabconfg.cpl] "C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe" /Start

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"

O4 - HKLM\..\Run: [sysMetrix] "C:\Program Files\SysMetrix\SysMetrix.exe"

O4 - HKLM\..\Run: [iSUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup

O4 - HKLM\..\Run: [iSUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start

O4 - HKLM\..\Run: [Cobian Backup 8 interface] "D:\Program files\cbInterface.exe" -service

O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install

O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [spySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [ctfmon.exe] C:\windows\system32\ctfmon.exe

O4 - HKCU\..\Run: [WMPNSCFG] "C:\Program Files\Windows Media Player\WMPNSCFG.exe"

O4 - HKCU\..\Run: [DesktopX] ""C:\Program Files\Stardock\Object Desktop\DesktopX\DesktopX Builder.exe" -noui"

O4 - Startup: ComNet.lnk = ?

O4 - Startup: PowerMenu.lnk = ?

O4 - Startup: Stardock ObjectDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat\ObjectDock\ObjectDock.exe

O4 - Startup: UberIcon.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat\UberIcon\UberIcon Manager.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

O4 - Global Startup: TrayMin200.exe.lnk = ?

O8 - Extra context menu item: Download all links using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm

O8 - Extra context menu item: Download all videos using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm

O8 - Extra context menu item: Download link using &BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O8 - Extra context menu item: Open Link Target in Firefox - file://C:\Documents and Settings\-\Application Data\Mozilla\Firefox\Profiles\hn3icw2a.default\extensions\{5D558C43-550F-4b12-84AB-0D8ABDA9F975}\firefoxviewlink.html

O8 - Extra context menu item: View This Page in Firefox - file://C:\Documents and Settings\-\Application Data\Mozilla\Firefox\Profiles\hn3icw2a.default\extensions\{5D558C43-550F-4b12-84AB-0D8ABDA9F975}\firefoxviewpage.html

O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm

O8 - Extra context menu item: Найти с помощью Рамблера - res://C:\Program Files\Rambler Assistant\ramblertoolbarU0.dll/search.htm

O8 - Extra context menu item: Перевести с помощью словарей Рамблера - res://C:\Program Files\Rambler Assistant\ramblertoolbarU0.dll/dic.htm

O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)

O9 - Extra button: Преведи (HKLM)

O9 - Extra button: Download5000 Toolbar (HKLM)

O9 - Extra 'Tools' menuitem: Download5000 Toolbar (HKLM)

O9 - Extra button: ICQ Lite (HKLM)

O9 - Extra 'Tools' menuitem: ICQ Lite (HKLM)

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 (HKLM)

O9 - Extra button: Messenger (HKLM)

O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)

O9 - Extra button: Webaroo: Capture Page (HKCU)

O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll

O11 - Options group: [iNTERNATIONAL] International*

O12 - Plugin for .swf: C:\Program Files\Netscape\Netscape Browser\PLUGINS\NPSWF32.dll

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1165945631468

O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secur...loadManager.ocx

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub/shock...ash/swflash.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{12BFF79A-B7DF-45AE-9839-31E2B1EE25E4}: NameServer = 84.54.128.9 84.54.128.8

O17 - HKLM\System\CCS\Services\Tcpip\..\{D46BD610-B760-4D40-B7A2-009174EA2248}: NameServer = 212.39.90.42,212.39.90.43

П.П.Изтрих и тази папка:

C:\Program Files\Video Access ActiveX Object

Засега спря да се показва онова натрапчиво съобщение,ще изчакам малко,но мисля че проблема е решен благодаря на всички ви.

Редактирано 25 март 200719 г. от AleksofT (преглед на промените)

Виждам че пак има 2 процеса от C:\Program Files\Video Access ActiveX Object- сигурен ли се че папката я няма и че лога е след като я изтри?

И това не е пълният лог, липсва последната част с winlogon и services.

Виждам че пак има 2 процеса от C:\Program Files\Video Access ActiveX Object- сигурен ли се че папката я няма и че лога е след като я изтри?

И това не е пълният лог, липсва последната част с winlogon и services.

Да сигурен съм че я няма,вече няколко пъти проверих,аз я изтрих след като направих .log-а.

Лога е пълен,но и да не е вече няма значение проблема е решен за което много ти благодаря.

Редактирано 25 март 200719 г. от AleksofT (преглед на промените)

Аз пак ще си настоявам, мисля че не сме приключили, направи това за последно- дръпни SilentRunners и го пусни, ако антивирусната примрънка го разреши или я спри временно, след като го пуснеш изчакай 1-2 мин да завърши напълно и в Notepad ще се появи нов лог, пусни го тук.

Аз пак ще си настоявам, мисля че не сме приключили, направи това за последно- дръпни SilentRunners и го пусни, ако антивирусната примрънка го разреши или я спри временно, след като го пуснеш изчакай 1-2 мин да завърши напълно и в Notepad ще се появи нов лог, пусни го тук.

Били обяснил как точно да я дръпна таз "програмка",защото ми излиза някаква Интернет страница която не разбирам...

Редактирано 25 март 200719 г. от AleksofT (преглед на промените)

десен бутон върху линка->save as

Ето това излезе:

"Silent Runners.vbs", revision R50, http://www.silentrunners.org/

Operating System: Windows XP SP2

Output limited to non-default values, except where indicated by "{++}"

Startup items buried in registry:

---------------------------------

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++}

"MSMSGS" = ""C:\Program Files\Messenger\msmsgs.exe" /background" [file not found]

"VD" = "KdKd***" (unwritable string) [file not found]

"ctfmon.exe" = "C:\windows\system32\ctfmon.exe" [MS]

"WMPNSCFG" = ""C:\Program Files\Windows Media Player\WMPNSCFG.exe"" [MS]

"DesktopX" = """C:\Program Files\Stardock\Object Desktop\DesktopX\DesktopX Builder.exe" -noui"" [file not found]

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ {++}

"user32.dll" = "C:\Program Files\Video Access ActiveX Object\isamntr.exe" [file not found]

"rare" = "C:\Program Files\Video Access ActiveX Object\pmsnrr.exe" [file not found]

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++}

"NvCplDaemon" = ""RUNDLL32.EXE" C:\windows\system32\NvCpl.dll,NvStartup" [MS]

"DAEMON Tools" = "(empty string)" [file not found]

"UnlockerAssistant" = ""D:\Program files\Unlocker\UnlockerAssistant.exe"" [null data]

"eabconfg.cpl" = ""C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe" /Start" ["Hewlett-Packard "]

"SunJavaUpdateSched" = ""C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"" ["Sun Microsystems, Inc."]

"SysMetrix" = "C:\Program Files\SysMetrix\SysMetrix.exe" ["Nicholas Decker"]

"ISUSPM Startup" = ""C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup" ["Macrovision Corporation"]

"ISUSScheduler" = ""C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start" ["Macrovision Corporation"]

"Cobian Backup 8 interface" = ""D:\Program files\cbInterface.exe" -service" ["Luis Cobian"]

"nwiz" = ""nwiz.exe" /install" ["NVIDIA Corporation"]

"WinampAgent" = ""C:\Program Files\Winamp\winampa.exe"" [null data]

"QuickTime Task" = ""C:\Program Files\QuickTime\qttask.exe" -atboottime" ["Apple Computer, Inc."]

"iTunesHelper" = ""C:\Program Files\iTunes\iTunesHelper.exe"" ["Apple Inc."]

"SpySweeper" = "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe /startintray" ["Webroot Software, Inc."]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\

{00C6482D-C502-44C8-8409-FCE54AD9C208}\(Default) = (no title provided)

-> {HKLM...CLSID} = "SnagIt Toolbar Loader"

\InProcServer32\(Default) = "C:\Program Files\TechSmith\SnagIt 8\SnagItBHO.dll" ["TechSmith Corporation"]

{39F7E362-828A-4B5A-BCAF-5B79BFDFEA60}\(Default) = "BitComet ClickCapture"

-> {HKLM...CLSID} = "BitComet Helper"

\InProcServer32\(Default) = "C:\Program Files\BitComet\tools\BitCometBHO.dll" ["BitComet"]

{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided)

-> {HKLM...CLSID} = "SSVHelper Class"

\InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll" ["Sun Microsystems, Inc."]

{A6ACAE64-F798-4930-AD86-BD3FB32038DB}\(Default) = (no title provided)

-> {HKLM...CLSID} = (no title provided)

\InProcServer32\(Default) = "C:\Program Files\Video Access ActiveX Object\isadd.dll" [file not found]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\

"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Display Panning CPL Extension"

-> {HKLM...CLSID} = "Display Panning CPL Extension"

\InProcServer32\(Default) = "deskpan.dll" [file not found]

"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "HyperTerminal Icon Ext"

-> {HKLM...CLSID} = "HyperTerminal Icon Ext"

\InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."]

"{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class"

-> {HKLM...CLSID} = "DesktopContext Class"

\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]

"{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper"

-> {HKLM...CLSID} = "NVIDIA CPL Extension"

\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]

"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer"

-> {HKLM...CLSID} = "Desktop Explorer"

\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]

"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"

-> {HKLM...CLSID} = (no title provided)

\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]

"{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu"

-> {HKLM...CLSID} = "nView Desktop Context Menu"

\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]

"{CA5FEE26-14C1-4B5A-86E9-233FC0EE2682}" = "IZArc DragDrop Menu"

-> {HKLM...CLSID} = "IZArc DragDrop Menu"

\InProcServer32\(Default) = "C:\PROGRA~1\IZArc\IZArcCM.dll" [null data]

"{8D9D4D0D-FDDD-44CB-AAB2-6161FA0757C5}" = "IZArc Shell Context Menu"

-> {HKLM...CLSID} = "IZArc Shell Context Menu"

\InProcServer32\(Default) = "C:\PROGRA~1\IZArc\IZArcCM.dll" [null data]

"{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}" = "AVG7 Shell Extension"

-> {HKLM...CLSID} = "AVG7 Shell Extension Class"

\InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG7\avgse.dll" ["GRISOFT, s.r.o."]

"{9F97547E-460A-42C5-AE0C-81C61FFAEBC3}" = "AVG7 Find Extension"

-> {HKLM...CLSID} = "AVG7 Find Extension Class"

\InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG7\avgse.dll" ["GRISOFT, s.r.o."]

"{73B24247-042E-4EF5-ADC2-42F62E6FD654}" = "ICQ Lite Shell Extension"

-> {HKLM...CLSID} = "MCLiteShellExt Class"

\InProcServer32\(Default) = "D:\Program files\ICQLite\ICQLiteShell.dll" [empty string]

"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"

-> {HKLM...CLSID} = "WinRAR"

\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

"{EDB0E980-90BD-11D4-8599-0008C7D3B6F8}" = "Eudora's Shell Extension"

-> {HKLM...CLSID} = "Eudora's Shell Extension"

\InProcServer32\(Default) = "C:\Program Files\Qualcomm\Eudora\EuShlExt.dll" [file not found]

"{ABC70703-32AF-11d4-90C4-D483A70F4825}" = "CMenuExtender"

-> {HKLM...CLSID} = "CMenuExtender"

\InProcServer32\(Default) = "C:\windows\BricoPacks\Vista Inspirat\iColorFolder\CMExt.dll" ["Revenger inc."]

"{B327765E-D724-4347-8B16-78AE18552FC3}" = "NeroDigitalIconHandler"

-> {HKLM...CLSID} = "NeroDigitalIconHandler Class"

\InProcServer32\(Default) = "C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll" ["Nero AG"]

"{7F1CF152-04F8-453A-B34C-E609530A9DC8}" = "NeroDigitalPropSheetHandler"

-> {HKLM...CLSID} = "NeroDigitalPropSheetHandler Class"

\InProcServer32\(Default) = "C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll" ["Nero AG"]

"{709C6E11-538F-4759-86AC-6ACB302AA0DE}" = "Desktop Manager"

-> {HKLM...CLSID} = "Desktop Manager"

\InProcServer32\(Default) = "C:\windows\system32\msvdm.dll" [null data]

"{1530F7EE-5128-43BD-9977-84A4B0FAD7DF}" = "PhotoToys"

-> {HKLM...CLSID} = (no title provided)

\InProcServer32\(Default) = "C:\windows\system32\phototoys.dll" [MS]

"{efb97cb8-a4a4-4357-a261-002ffaed0267}" = "CD Slideshow Powertoy"

-> {HKLM...CLSID} = "CD Burn Slideshow Hook"

\InProcServer32\(Default) = "C:\windows\system32\slideshow.dll" [MS]

"{8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3}" = "SnagIt"

-> {HKLM...CLSID} = "SnagIt"

\InProcServer32\(Default) = "C:\Program Files\TechSmith\SnagIt 8\SnagItIEAddin.dll" ["TechSmith Corporation"]

"{CF74B903-3389-469c-B3B6-0204D204FCBD}" = "SnagIt Shell Extension"

-> {HKLM...CLSID} = "SnagItShellExt Class"

\InProcServer32\(Default) = "C:\Program Files\TechSmith\SnagIt 8\SnagItShellExt.dll" ["TechSmith Corporation"]

"{B8323370-FF27-11D2-97B6-204C4F4F5020}" = "SmartFTP Shell Extension DLL"

-> {HKLM...CLSID} = "SmartFTP Shell Extension DLL"

\InProcServer32\(Default) = "C:\Program Files\SmartFTP Client 2.0\smarthook.dll" [file not found]

"{DB7CFAED-842B-47E7-9FF4-92852D617958}" = "ConvShlExt"

-> {HKLM...CLSID} = "ConvShlExt Class"

\InProcServer32\(Default) = "C:\PROGRA~1\BEETHI~1.0\YJ.dll" [empty string]

"{DB7CFAEE-842B-47E7-9FF4-92852D617958}" = "ConvShlExt"

-> {HKLM...CLSID} = "ConvShlExt Class"

\InProcServer32\(Default) = "C:\PROGRA~1\BEETHI~1.0\TL.dll" [empty string]

"{DDE4BEEB-DDE6-48fd-8EB5-035C09923F83}" = "UnlockerShellExtension"

-> {HKLM...CLSID} = "UnlockerShellExtension"

\InProcServer32\(Default) = "D:\Program files\Unlocker\UnlockerCOM.dll" [null data]

"{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF}" = "iTunes"

-> {HKLM...CLSID} = "iTunes"

\InProcServer32\(Default) = "C:\Program Files\iTunes\iTunesMiniPlayer.dll" ["Apple Inc."]

"{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"

-> {HKLM...CLSID} = (no title provided)

\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office10\msohev.dll" [MS]

"{7C9D5882-CB4A-4090-96C8-430BFE8B795B}" = "Webroot Spy Sweeper Context Menu Integration"

-> {HKLM...CLSID} = "Webroot Spy Sweeper Context Menu Integration"

\InProcServer32\(Default) = "C:\PROGRA~1\Webroot\SPYSWE~1\SSCtxMnu.dll" ["Webroot Software, Inc."]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\

<<!>> "{b292ec9f-a074-4115-8342-1f459702d8d2}" = "characterizing"

-> {HKLM...CLSID} = (no title provided)

\InProcServer32\(Default) = "C:\windows\system32\fyxkaah.dll" [file not found]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\

<<!>> "{EDB0E980-90BD-11D4-8599-0008C7D3B6F8}" = "Eudora's Shell Extension"

-> {HKLM...CLSID} = "Eudora's Shell Extension"

\InProcServer32\(Default) = "C:\Program Files\Qualcomm\Eudora\EuShlExt.dll" [file not found]

HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\

"WPDShServiceObj" = "{AAA288BA-9A4C-45B0-95D7-94D524869DB5}"

-> {HKLM...CLSID} = "WPDShServiceObj Class"

\InProcServer32\(Default) = "C:\windows\system32\WPDShServiceObj.dll" [MS]

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\

<<!>> WRNotifier\DLLName = "WRLogonNTF.dll" ["Webroot Software, Inc."]

HKLM\Software\Classes\Folder\shellex\ColumnHandlers\

{7D4D6379-F301-4311-BEBA-E26EB0561882}\(Default) = "NeroDigitalExt.NeroDigitalColumnHandler"

-> {HKLM...CLSID} = "NeroDigitalColumnHandler Class"

\InProcServer32\(Default) = "C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll" ["Nero AG"]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\

AVG7 Shell Extension\(Default) = "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}"

-> {HKLM...CLSID} = "AVG7 Shell Extension Class"

\InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG7\avgse.dll" ["GRISOFT, s.r.o."]

ConvShlExt\(Default) = "{DB7CFAED-842B-47E7-9FF4-92852D617958}"

-> {HKLM...CLSID} = "ConvShlExt Class"

\InProcServer32\(Default) = "C:\PROGRA~1\BEETHI~1.0\YJ.dll" [empty string]

ICQLiteMenu\(Default) = "{73B24247-042E-4EF5-ADC2-42F62E6FD654}"

-> {HKLM...CLSID} = "MCLiteShellExt Class"

\InProcServer32\(Default) = "D:\Program files\ICQLite\ICQLiteShell.dll" [empty string]

IZArcCM\(Default) = "{8D9D4D0D-FDDD-44CB-AAB2-6161FA0757C5}"

-> {HKLM...CLSID} = "IZArc Shell Context Menu"

\InProcServer32\(Default) = "C:\PROGRA~1\IZArc\IZArcCM.dll" [null data]

SnagItMainShellExt\(Default) = "{CF74B903-3389-469c-B3B6-0204D204FCBD}"

-> {HKLM...CLSID} = "SnagItShellExt Class"

\InProcServer32\(Default) = "C:\Program Files\TechSmith\SnagIt 8\SnagItShellExt.dll" ["TechSmith Corporation"]

WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"

-> {HKLM...CLSID} = "WinRAR"

\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\

CMenuExtender\(Default) = "{ABC70703-32AF-11d4-90C4-D483A70F4825}"

-> {HKLM...CLSID} = "CMenuExtender"

\InProcServer32\(Default) = "C:\windows\BricoPacks\Vista Inspirat\iColorFolder\CMExt.dll" ["Revenger inc."]

ICQLiteMenu\(Default) = "{73B24247-042E-4EF5-ADC2-42F62E6FD654}"

-> {HKLM...CLSID} = "MCLiteShellExt Class"

\InProcServer32\(Default) = "D:\Program files\ICQLite\ICQLiteShell.dll" [empty string]

IZArcCM\(Default) = "{8D9D4D0D-FDDD-44CB-AAB2-6161FA0757C5}"

-> {HKLM...CLSID} = "IZArc Shell Context Menu"

\InProcServer32\(Default) = "C:\PROGRA~1\IZArc\IZArcCM.dll" [null data]

SnagItMainShellExt\(Default) = "{CF74B903-3389-469c-B3B6-0204D204FCBD}"

-> {HKLM...CLSID} = "SnagItShellExt Class"

\InProcServer32\(Default) = "C:\Program Files\TechSmith\SnagIt 8\SnagItShellExt.dll" ["TechSmith Corporation"]

WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"

-> {HKLM...CLSID} = "WinRAR"

\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\

AVG7 Shell Extension\(Default) = "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}"

-> {HKLM...CLSID} = "AVG7 Shell Extension Class"

\InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG7\avgse.dll" ["GRISOFT, s.r.o."]

ConvShlExt\(Default) = "{DB7CFAED-842B-47E7-9FF4-92852D617958}"

-> {HKLM...CLSID} = "ConvShlExt Class"

\InProcServer32\(Default) = "C:\PROGRA~1\BEETHI~1.0\YJ.dll" [empty string]

SpySweeper\(Default) = "{7C9D5882-CB4A-4090-96C8-430BFE8B795B}"

-> {HKLM...CLSID} = "Webroot Spy Sweeper Context Menu Integration"

\InProcServer32\(Default) = "C:\PROGRA~1\Webroot\SPYSWE~1\SSCtxMnu.dll" ["Webroot Software, Inc."]

UnlockerShellExtension\(Default) = "{DDE4BEEB-DDE6-48fd-8EB5-035C09923F83}"

-> {HKLM...CLSID} = "UnlockerShellExtension"

\InProcServer32\(Default) = "D:\Program files\Unlocker\UnlockerCOM.dll" [null data]

WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"

-> {HKLM...CLSID} = "WinRAR"

\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\

SpySweeper\(Default) = "{7C9D5882-CB4A-4090-96C8-430BFE8B795B}"

-> {HKLM...CLSID} = "Webroot Spy Sweeper Context Menu Integration"

\InProcServer32\(Default) = "C:\PROGRA~1\Webroot\SPYSWE~1\SSCtxMnu.dll" ["Webroot Software, Inc."]

UnlockerShellExtension\(Default) = "{DDE4BEEB-DDE6-48fd-8EB5-035C09923F83}"

-> {HKLM...CLSID} = "UnlockerShellExtension"

\InProcServer32\(Default) = "D:\Program files\Unlocker\UnlockerCOM.dll" [null data]

Default executables:

--------------------

HKLM\Software\Classes\.scr\(Default) = "3DPhotoBrowser.scr.1"

<<!>> HKLM\Software\Classes\3DPhotoBrowser.scr.1\shell\open\ddeexec\(Default) = "[OpenFile "%1"]"

<<!>> HKLM\Software\Classes\3DPhotoBrowser.scr.1\shell\open\command\(Default) = ""c:\program files\3d photo browser\3dphotobrowser.exe" "%1"" [file not found]

<<!>> HKLM\Software\Classes\3DPhotoBrowser.scr.1\shell\open\ddeexec\(Default) = "[OpenFile "%1"]"

Group Policies {policy setting}:

--------------------------------

Note: detected settings may not have any effect.

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\

"shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001

{Shutdown: Allow system to be shut down without having to log on}

"undockwithoutlogon" = (REG_DWORD) hex:0x00000001

{Devices: Allow undock without having to log on}

Active Desktop and Wallpaper:

-----------------------------

Active Desktop may be disabled at this entry:

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

Displayed if Active Desktop enabled and wallpaper not set by Group Policy:

HKCU\Software\Microsoft\Internet Explorer\Desktop\General\

"Wallpaper" = "C:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Wallpaper1.bmp"

Displayed if Active Desktop disabled and wallpaper not set by Group Policy:

HKCU\Control Panel\Desktop\

"Wallpaper" = "C:\Documents and Settings\-\Application Data\Mozilla\Firefox\Desktop Background.bmp"

Enabled Screen Saver:

---------------------

HKCU\Control Panel\Desktop\

"SCRNSAVE.EXE" = "C:\windows\BIOHAZ~1.SCR" (BIOHAZARD SCREEN SAVER.scr) [null data]

Startup items in "-" & "All Users" startup folders:

---------------------------------------------------

C:\Documents and Settings\-\Start Menu\Programs\Startup

"ComNet" -> shortcut to: "" [file not found]

"PowerMenu" -> shortcut to: "d:\My Documents\ПРОГРАМИ\PowerMenu_1_5_1\PowerMenu.exe" ["Thong Nguyen"]

"Stardock ObjectDock" -> shortcut to: "C:\WINDOWS\BricoPacks\Vista Inspirat\ObjectDock\ObjectDock.exe" ["Stardock"]

"UberIcon" -> shortcut to: "C:\WINDOWS\BricoPacks\Vista Inspirat\UberIcon\UberIcon Manager.exe" [null data]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup

"Microsoft Office" -> shortcut to: "C:\Program Files\Microsoft Office\Office10\OSA.EXE -b -l" [MS]

"TrayMin200.exe" -> shortcut to: "C:\Program Files\Philips\SPC 200NC PC Camera\TrayMin200.exe" [empty string]

Enabled Scheduled Tasks:

------------------------

"AppleSoftwareUpdate" -> launches: "C:\Program Files\Apple Software Update\SoftwareUpdate.exe -Task" ["Apple Computer, Inc."]

"XoftSpySE" -> launches: "C:\Program Files\XoftSpySE\XoftSpy.exe -t" ["ParetoLogic"]

Winsock2 Service Provider DLLs:

-------------------------------

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}

000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]

000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}

0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:

C:\WINDOWS\system32\avgfwafu.dll ["GRISOFT, s.r.o."], 01 - 05

%SystemRoot%\system32\mswsock.dll [MS], 06 - 08, 11 - 26

%SystemRoot%\system32\rsvpsp.dll [MS], 09 - 10

Toolbars, Explorer Bars, Extensions:

------------------------------------

Toolbars

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\

"{67984BEB-075D-49AE-A50B-352E145FAAB8}"

-> {HKLM...CLSID} = "MyRadioRU Toolbar"

\InProcServer32\(Default) = "C:\Program Files\MyRadioRU\tbMyRa.dll" ["Conduit Ltd."]

"{F2CF5485-4E02-4F68-819C-B92DE9277049}"

-> {HKLM...CLSID} = "&Links"

\InProcServer32\(Default) = "C:\windows\system32\ieframe.dll" [MS]

"{468CD8A9-7C25-45FA-969E-3D925C689DC4}"

-> {HKLM...CLSID} = "Rambler-Ассистент"

\InProcServer32\(Default) = "C:\Program Files\Rambler Assistant\ramblertoolbarU0.dll" ["Rambler.ru"]

HKLM\Software\Microsoft\Internet Explorer\Toolbar\

"{8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3}" = (no title provided)

-> {HKLM...CLSID} = "SnagIt"

\InProcServer32\(Default) = "C:\Program Files\TechSmith\SnagIt 8\SnagItIEAddin.dll" ["TechSmith Corporation"]

"{67984BEB-075D-49AE-A50B-352E145FAAB8}" = "MyRadioRU Toolbar"

-> {HKLM...CLSID} = "MyRadioRU Toolbar"

\InProcServer32\(Default) = "C:\Program Files\MyRadioRU\tbMyRa.dll" ["Conduit Ltd."]

"{468CD8A9-7C25-45FA-969E-3D925C689DC4}" = (no title provided)

-> {HKLM...CLSID} = "Rambler-Ассистент"

\InProcServer32\(Default) = "C:\Program Files\Rambler Assistant\ramblertoolbarU0.dll" ["Rambler.ru"]

Extensions (Tools menu items, main toolbar menu buttons)

HKCU\Software\Microsoft\Internet Explorer\Extensions\

{670FC370-FCFE-11DA-92E3-0800200C9A66}\

"ButtonText" = "Webaroo: Capture Page"

"CLSIDExtension" = "{D700729C-E1F0-4D92-8C00-DEDEB6A69D88}"

-> {HKLM...CLSID} = "MasterObject Class"

\InProcServer32\(Default) = "C:\Program Files\Webaroo\IEToolbar\ToolbarProcessor.dll" [null data]

HKLM\Software\Microsoft\Internet Explorer\Extensions\

{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\

"MenuText" = "Sun Java Console"

"CLSIDExtension" = "{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBC}"

-> {HKCU...CLSID} = "Java Plug-in 1.5.0_10"

\InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll" ["Sun Microsystems, Inc."]

-> {HKLM...CLSID} = "Java Plug-in 1.5.0_10"

\InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_10\bin\npjpi150_10.dll" ["Sun Microsystems, Inc."]

{60237576-B24C-4BA9-9740-C9F3EC9DB557}\

"ButtonText" = "Преведи"

"CLSIDExtension" = "{EAADF17C-B6EA-4511-8549-A67CFD406EAF}"

-> {HKLM...CLSID} = "TWTIEHelper Object"

\InProcServer32\(Default) = "D:\PROGRA~1\WEBTRA~1\wt2ie.dll" [empty string]

{8DAE90AD-4583-4977-9DD4-4360F7A45C74}\

{9D931726-DFBC-480E-851A-20C397E1A2C8}\

"ButtonText" = "Download5000 Toolbar"

"MenuText" = "Download5000 Toolbar"

{B863453A-26C3-4E1F-A54D-A2CD196348E9}\

"ButtonText" = "ICQ Lite"

"MenuText" = "ICQ Lite"

"Exec" = "D:\Program files\ICQLite\ICQLite.exe" ["ICQ Ltd."]

{C7849820-7A7E-11D3-8AEB-00608CB35B18}\

{E2E2DD38-D088-4134-82B7-F2BA38496583}\

"MenuText" = "@xpsp3res.dll,-20001"

"Exec" = "%windir%\Network Diagnostic\xpnetdiag.exe" [MS]

{FB5F1910-F110-11D2-BB9E-00C04F795683}\

"ButtonText" = "Messenger"

"MenuText" = "Windows Messenger"

"Exec" = "C:\Program Files\Messenger\msmsgs.exe" [file not found]

Miscellaneous IE Hijack Points

------------------------------

HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\

<<H>> "{468CD8A9-7C25-45FA-969E-3D925C689DC4}" = "rambler toolbar"

-> {HKLM...CLSID} = "Rambler-Ассистент"

\InProcServer32\(Default) = "C:\Program Files\Rambler Assistant\ramblertoolbarU0.dll" ["Rambler.ru"]

Running Services (Display Name, Service Name, Path {Service DLL}):

------------------------------------------------------------------

AVG E-mail Scanner, AVGEMS, "C:\PROGRA~1\Grisoft\AVG7\avgemc.exe" ["GRISOFT, s.r.o."]

AVG Firewall, AVGFwSrv, "C:\PROGRA~1\Grisoft\AVG7\avgfwsrv.exe /srvfsys" ["GRISOFT, s.r.o."]

AVG7 Alert Manager Server, Avg7Alrt, "C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe" ["GRISOFT, s.r.o."]

AVG7 Update Service, Avg7UpdSvc, "C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe" ["GRISOFT, s.r.o."]

Cobian Backup 8 service, CobBMService, "D:\Program files\cbService.exe" ["Luis Cobian"]

ColdFusion MX 7 ODBC Agent, ColdFusion MX 7 ODBC Agent, "C:\CFusionMX7\db\slserver54\bin\swagent.exe "ColdFusion MX 7 ODBC Agent"" ["DataDirect Technologies"]

ColdFusion MX 7 ODBC Server, ColdFusion MX 7 ODBC Server, "C:\CFusionMX7\db\slserver54\bin\swstrtr.exe "ColdFusion MX 7 ODBC Server"" ["DataDirect Technologies"]

iPod Service, iPod Service, ""C:\Program Files\iPod\bin\iPodService.exe"" ["Apple Inc."]

NVIDIA Display Driver Service, NVSvc, "C:\windows\system32\nvsvc32.exe" ["NVIDIA Corporation"]

Ulead Burning Helper, UleadBurningHelper, "C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe" ["Ulead Systems, Inc."]

Webroot Spy Sweeper Engine, WebrootSpySweeperService, ""C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe"" ["Webroot Software, Inc."]

Windows Media Player Network Sharing Service, WMPNetworkSvc, ""C:\Program Files\Windows Media Player\WMPNetwk.exe"" [MS]

Keyboard Driver Filters:

------------------------

HKLM\System\CurrentControlSet\Control\Class\{4D36E96B-E325-11CE-BFC1-08002BE10318}\

"UpperFilters" = <<!>> "SSKBFD" ["Webroot Software Inc (www.webroot.com)"]

Print Monitors:

---------------

HKLM\System\CurrentControlSet\Control\Print\Monitors\

APFMON40\Driver = "APFMON40.DLL" ["TurboPower Software Company"]

Microsoft Shared Fax Monitor\Driver = "FXSMON.DLL" [MS]

----------

<<!>>: Suspicious data at a malware launch point.

<<H>>: Suspicious data at a browser hijack point.

+ This report excludes default entries except where indicated.

+ To see *everywhere* the script checks and *everything* it finds,

launch it from a command prompt or a shortcut with the -all parameter.

+ To search all directories of local fixed drives for DESKTOP.INI

DLL launch points, use the -supp parameter or answer "No" at the

first message box and "Yes" at the second message box.

---------- (total run time: 61 seconds, including 9 seconds for message boxes)

Редактирано 25 март 200719 г. от AleksofT (преглед на промените)

Мисля че е добре, останали са няколко записа в регистъра, но водещи до несъществуващи вече файлове, не е проблем но ако искаш можеш да ги махнеш и от там. BTW тази зараза използва няколко много хитри места, които HJT не сканира.

С registry editor махни следните ключове ако искаш, пак повтарям, не е задължително и ако не се чустваш уверен при работа с regedit недей ги пипа.:

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ там махаш следните 2:

"user32.dll" = "C:\Program Files\Video Access ActiveX Object\isamntr.exe"

"rare" = "C:\Program Files\Video Access ActiveX Object\pmsnrr.exe"

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\ там махаш това:

"{b292ec9f-a074-4115-8342-1f459702d8d2}" = "characterizing"

А с HJT фиксни само това:

O2 - BHO: (no name) - {A6ACAE64-F798-4930-AD86-BD3FB32038DB} - C:\Program Files\Video Access ActiveX Object\isadd.dll

start->run-> regedit

Но по- добре да не пипаш, безболезни са тези записи ако файловете, към които водят липсват.

Махнах всичко което ми каза.

За пореден път ти благодаря много.

Моля, надявам се всичко ще е наред

-> {HKLM...CLSID} = "Rambler-Ассистент"

\InProcServer32\(Default) = "C:\Program Files\Rambler Assistant\ramblertoolbarU0.dll" ["Rambler.ru"]

<<H>> "{468CD8A9-7C25-45FA-969E-3D925C689DC4}" = "rambler toolbar"

Тия не са опасни да попитам аз.

Ако не го ползваш можеш да го махнеш, предполагам не е опасен, от този сайт е- Rambler.ru

Можеш да го махнеш с HJT:

O3 - Toolbar: Rambler-Ассистент - {468CD8A9-7C25-45FA-969E-3D925C689DC4} - C:\Program Files\Rambler Assistant\ramblertoolbarU0.dll

или ако е написан свястно от add/remove programs

И аз имах същия проблем. За мой голям късмет се оказа че има тема за този проблем. Оправих си компа за минути. Благодаря на всички които са помогнали на колегата (и на мен).

Поздрави.

Всичко пробвах, но безрезултзтатно. Само Уиндолс-а не съм преинсталирал, но сървиз пак-а, с който съм работи безпроблемно на още няколко други компютъра (също и на моя до преди извесно време). Ще опитам и с някой друг де, няма сантиментална стойност за мен Преди два дни, най-достоверното обяснение ми се стори : csrss.exeжива реклама . Но нямаше нищо в регистрите, а и след хилядите сканирания и тестове малко ме съмнява, че точно пандата сте хване нещо.На всичко отгоре exe-то е едно и май си е чисто УЙ-ндолско Та добре, че компа няма да разбере следното, но ХОРА ТУК ИМАМ КОМПЮТЪР ЗА МЪЧЕНЕ F1 F1 F1 F1 F1 F1 F1 F1

Редактирано 29 март 200719 г. от kunchito (преглед на промените)

Така и така го мъчиш, стартирай пак autoruns и изключи (или изтрий) всичко, свързано с Acrobat, FlashGet и ICQ. Изключи и записите на nVidia, но само тези, които са за видеото, т. е., остави включени записите на nVidia в предпоследния раздел - HKLM\System\CurrentControlSet\Services. Можеш да изключиш и следните записи в този раздел:

+ k750bus Sony Ericsson 750 Driver MCCI c:\windows\system32\drivers\k750bus.sys

+ k750mdfl Sony Ericsson 750 USB WMC Modem Filter MCCI c:\windows\system32\drivers\k750mdfl.sys

+ k750mdm Sony Ericsson 750 USB WMC Modem Drivers MCCI c:\windows\system32\drivers\k750mdm.sys

+ k750mgmt Sony Ericsson 750 USB WMC Device Management Drivers MCCI c:\windows\system32\drivers\k750mgmt.sys

+ k750obex Sony Ericsson 750 USB WMC OBEX Interface Drivers MCCI c:\windows\system32\drivers\k750obex.sys

+ Klif spuper-ptor Kaspersky Labs c:\windows\system32\drivers\klif.sys

+ snpstd PC Camera driver c:\windows\system32\drivers\snpstd.sys

+ WINIO c:\program files\project1\winio.sys.

Много съвети много нещо. Ще ти предложа нещо малко по-различно. И аз съм имал тези проблеми. Първо деинталирай всякакви антивирусни програми. Даже ако имаш и защитна стена и нея деинсталирай. Ако имаш интернет извади кабела от LAN картата. Пусни проверка за липсващи системни файлове по следния начин : Първо постави инсталационния диск с Windows XP от който си инсталирайл Windowя. Второ отиди в Start->Run и напиши sfc /scannow и после натисни OK. Дефрагментирай хард диска с PerfectDisk. Сканирай регистрите за проблеми с jv16 PowerTools и ги премахни с Remove. Ако нищо от това не помогне потърси по-нови драйвери за всеки един хардуерен компонент, който имаш и ги свали. Деинсталирай старите един по един (тоест след всеки деинсталиран драйвер прави рестарт на компютъра). След като ги махнеш всичките инсталирай новите пак един по един (тоест след всеки инсталиран драйвер прави рестарт на компютъра). Като направиш всичко това направи и един рестарт ей така за раздвижване на Windows-а. Ако нищо от това не помогне пиши пак да ти напиша нещо по-сложно, което съм убеден че ще ти помогне 90%.

panevdd , направих това което ми каза, но единственото което се получи е неработещо ICQ (другото дето го спрях несъм го пробвал).Мерси все пак Сега се захващам със *.sys - овете.Ще пробвам въпреки че всичко, включително и драйвърите си работиха съвсем нормално няколко месеца (имам в предвид, че тогава правих пълна преинсталация, а после имидж), после пак преинсталирах наново(след формат с PQ Mgic-a под дос) и пак грда Дрйвърите си ги ползвам поне от 2 години, но ще пробвам! Дано 90% сигурния вариант да не включва магнитна терапия на всички компоненти