Хей, пич евалата вече всичко е ок! Нямаш представа колко съм ти благодарен!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

Здравейте отново! След като го оправих с Combofix, днес чак вечерта ми се появи пак, моля помагайте!

Здравейте отново! След като го оправих с Combofix, днес чак вечерта ми се появи пак, моля помагайте!

1.Изпълни стъпка две от предишния ми пост...и дай лог от HijackThis.

2.Спри System Restore и почисти стартите точки на възстановяване

Десен бутон на My Computer => Properties => System Restore => слагао отметка пред Turn Off System Restore


Start => run => cleanmgr => More Options => System Restore => Clean UP

3.Провери с тези инструменти и изтрий намерените паразити:

http://www.kaldata.com/forums/index.php?s=...st&p=739080

Здравейте,

От 3 дена се опитвам да се преборя с този троянски кон,пробвах какви ли не програми,но той толкова яко се е залипил в c:\windows\system32\cdfvie.dll ,че няма махане.Моля ви помогнете .

Изтегли Hijackthis от: http://www.trendsecure.com/portal/en-US/th.../HiJackThis.zip

1. Сваляш го в негова собствена папка, например C:\HiJackThis

2. Преиминуваш го на "Program"

3. Влизаш в него

4. Избираш до Do scan system and save a log file

5. Копираш, каквото се появи в Notepad и го copy/paste в следващия си коментар тук.

Здравей, направих твоята втора стъпка от предният ти пост и след това почистих с COMBOFIX. Няма проблеми засега! Ако пак се появи пак ще пиша!

Редактирано 8 март 200818 г. от vladols (преглед на промените)

Направих това което ми каза ! Резултаът е следния:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 21:55:43, on 08.3.2008 г.

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\SOUNDMAN.EXE

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\Program Files\DAEMON Tools\daemon.exe

C:\Program Files\BitComet\BitComet.exe

C:\Program Files\Datecs\FlexType 2K\FType2K.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\Program Files\Skype\Phone\Skype.exe

C:\Program Files\Winamp\Winamp.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Program\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://######/torrents.php

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.8.30.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: (no name) - {6BF7E0C6-2B74-4ECC-87AD-AA1140EC1E78} - C:\WINDOWS\system32\cdfvie.dll

O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033

O4 - HKCU\..\Run: [bitComet] "C:\Program Files\BitComet\BitComet.exe" /tray

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Startup: Internet.lnk = ?

O4 - Global Startup: FlexType 2K.lnk = C:\Program Files\Datecs\FlexType 2K\FType2K.exe

O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm

O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm

O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.8.30.dll

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe

O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab

O16 - DPF: {6531D99C-0D0E-4293-B3CB-A3E1D0D41847} (AhnASP Control) - http://aspglobal.ahnlab.com/asp/cab/AhnASP.cab

O16 - DPF: {6CCE3920-3183-4B3D-808A-B12EB769DE12} (CSS Web Installer Class) - http://www.commandondemand.com/eval/cod/cabs/cssweb.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{58DF6045-891D-433B-B07A-4523FA28CDD5}: NameServer = 212.73.154.2 212.73.154.10

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--

End of file - 5091 bytes

Надявам се да помогнеш,, защото вече съм обезнадежден ....

Чист си, според мен. Сега ще видим какво ще предложи колегата (B-boy[styLe])

1.Спри System Restore и почисти стартите точки за възстановяване:

Десен бутон на My Computer => Properties => System Restore => слагао отметка пред Turn Off System Restore

Start => run => cleanmgr => More Options => System Restore => Clean UP

2.В HijackThis маркирай следните неща и избери FIX CHECKED:

O2 - BHO: (no name) - {6BF7E0C6-2B74-4ECC-87AD-AA1140EC1E78} - C:\WINDOWS\system32\cdfvie.dll

O4 - Startup: Internet.lnk = ?

3.Ако не можеш да изтриеш файла трябва да го от-регистрираш...

Start => run => cmd => посочи точната директория на файла regsvr32 /u cdfvie.dll

Виждам че се намира в C:\Windows\system32

Start => run => cmd => cd.. След това пак cd.. После cd Windows После cd system32 Накрая командата regsvr32 /u cdfvie.dll

Можеш да пробваш и с Unlocker

http://www.kaldata.com/comments.php?id=302...hlight=unlocker

PS: Името на гадинката, която е свързана с cdfvie.dll е Trojan.Dropper-Delf Сканирай с добра анти-шпионска програма с обновени дефиниции за да изтриеш останалите инфектирани файлове и ключове в регистъра!

Редактирано 8 март 200818 г. от B-boy[StyLe] (преглед на промените)

Ако искаш, промени името на HijackThis. След това пак пусни лог, защото може да имаш маскирани процеси. Taзи проблем със cdfvie.dll може да е причинен и от Vundo.

Редактирано 8 март 200818 г. от Mithu (преглед на промените)

Пак се появи, Spyware doctor ми показва, че в тези 2 файла има вирус, трия ги и веднага след това те се заместват от нови (пак същите) файлове! Моля, помагайте! Според мен вируса си сваля автоматично файловет му, всеки път щом го изтрия.

Редактирано 9 март 200818 г. от vladols (преглед на промените)

Дай лог файл от HiJackThis.

1.Нещо не виждам лог файла от HijackThis за който те моля вече 3-ти пост...

2.Вируса може би се възползва от някой exploit => изтегли всички критични актуализации за Операционната Система - примерно с WBSA 2.1 beta 2

http://download.microsoft.com/download/9/d...3/mbsasetup.msi

3.Инсталирай някаква защитна стена, която да блокирва изходящия трафик за да спреш вируса от това постоянно да се изтегля...

4.Почисти ненужните временни файлове примерно с ATF-CLEANER и CCLEANER.Може в папките TEMP да се е загнездил някой паразит.

5.Инунизирай браузърите примерно с Spyware Blaster, Advanced WindowsCare, Spybot Search & Destroy.

6.Spyware Doctor има и безплтана версия, която ще премахне намерените неща без да се налага да правиш това ръчно.Сканирай и с някоя от следните безплатни програми.Инсталирай ги една по една...обновявай им дефинициите - сканирай и премахни намерените неща.След това можеш да ги деинсталираш...между тях има и инструменти които не се нуждаят от инсталиране (темата за StandAlone вирус скенери)

http://www.kaldata.com/forums/index.php?s=...st&p=841925

.....спомни си точно датата ,на която ти се появи тазе гад,влез в system32 ,подреди файловете по дата и изтрий съмнителните с датата на появяване на заразата....

Изключи System Restore и направи сканиране с нещата, които ти препоръча B-boy.

Logfile of Trend Micro HijackThis v2.0.0 (BETA)

Scan saved at 13:35:39, on 09.3.2008 г.

Platform: Windows XP SP2 (WinNT 5.01.2600)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Windows Defender\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE

C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE

C:\WINDOWS\System32\PAStiSvc.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\RunDll32.exe

C:\Program Files\ATI Technologies\ATI.ACE\cli.exe

C:\Program Files\Common Files\Symantec Shared\ccApp.exe

C:\Program Files\LClock\LClock.exe

C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe

C:\Program Files\QuickTime\qttask.exe

C:\Program Files\Windows Defender\MSASCui.exe

C:\Program Files\Winamp\winampa.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files\Skype\Phone\Skype.exe

C:\Program Files\ooVoo\ooVoo.exe

C:\Program Files\Winamp Remote\bin\OrbTray.exe

D:\uTorrent\uTorrent.exe

C:\Program Files\Winamp Remote\bin\Orb.exe

C:\Program Files\TuneUp Utilities 2007\MemOptimizer.exe

C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe

C:\Program Files\TechSmith\SnagIt 8\SnagIt32.exe

C:\Program Files\Skype\Plugin Manager\SkypePM.exe

C:\Program Files\TechSmith\SnagIt 8\TSCHelp.exe

C:\Program Files\TechSmith\SnagIt 8\SnagPriv.exe

C:\WINDOWS\system32\taskmgr.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Documents and Settings\~~~FIRED~FOREVER~~~\Desktop\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

O2 - BHO: IE7Pro - {00011268-E188-40DF-A514-835FCD78B1BF} - C:\Program Files\IEPro\iepro.dll

O2 - BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 8\SnagItBHO.dll

O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O2 - BHO: Winamp Toolbar BHO - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll

O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - D:\Bit Comet\tools\BitCometBHO_1.1.7.4.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.1121.2472\swg.dll

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll

O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 8\SnagItIEAddin.dll

O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll

O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd

O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime

O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [LClock] C:\Program Files\LClock\LClock.exe

O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide

O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - HKCU\..\Run: [Norton SystemWorks] "C:\Program Files\Norton SystemWorks\cfgwiz.exe" /GUID {05858CFD-5CC4-4ceb-AAAF-CF00BF39736A} /MODE CfgWiz

O4 - HKCU\..\Run: [ooVoo.exe] C:\Program Files\ooVoo\ooVoo.exe /minimized

O4 - HKCU\..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background

O4 - HKCU\..\Run: [uTorrent] "D:\uTorrent\uTorrent.exe"

O4 - HKCU\..\Run: [TuneUp MemOptimizer] "C:\Program Files\TuneUp Utilities 2007\MemOptimizer.exe" autostart

O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"

O4 - HKCU\..\Run: [LClock] C:\Program Files\LClock\lclock.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Startup: WallpaperSlideshow.lnk = C:\Program Files\Breit Technologies\Wallpaper Slideshow\WallpaperSlideshow.exe

O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe

O4 - Global Startup: SnagIt 8.lnk = C:\Program Files\TechSmith\SnagIt 8\SnagIt32.exe

O8 - Extra context menu item: &D&ownload &with BitComet - res://D:\Bit Comet\BitComet.exe/AddLink.htm

O8 - Extra context menu item: &D&ownload all video with BitComet - res://D:\Bit Comet\BitComet.exe/AddVideo.htm

O8 - Extra context menu item: &D&ownload all with BitComet - res://D:\Bit Comet\BitComet.exe/AddAllLink.htm

O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html

O9 - Extra button: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\iepro.dll

O9 - Extra 'Tools' menuitem: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\iepro.dll

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - D:\Bit Comet\tools\BitCometBHO_1.1.7.4.dll

O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab

O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O17 - HKLM\System\CS1\Services\Tcpip\..\{5A904B1B-73AB-49D7-830F-F2B06E2BCBA5}: NameServer = 83.148.97.1

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O21 - SSODL: apdqnxp - {4C5F8123-CDF9-48D6-9C34-83E107F1D558} - C:\WINDOWS\apdqnxp.dll

O21 - SSODL: btrklfr - {4692B9E0-7D41-4768-B89C-306AA1099899} - (no file)

O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll

O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE

O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE

O23 - Service: You Are Empty Drivers Auto Removal (pr2akdnc) (pr2akdnc) - Cenega Publishing - C:\WINDOWS\system32\pr2akdnc.exe

O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe

O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe

O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE

O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe

O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

O24 - Desktop Component 0: (no name) - http://needforspeed.sk/pictures/galeria/nfsc/wall/2390.jpg

O24 - Desktop Component 1: (no name) - http://needforspeed.sk/pictures/galeria/nf...cr/2204_big.jpg

O24 - Desktop Component 2: (no name) - http://stalker-portal.ru/datas/users/1-wal...er_fromleks.jpg

O24 - Desktop Component 3: (no name) - http://stalker-portal.ru/datas/users/1-w13.jpg

O24 - Desktop Component 4: (no name) - http://content.answers.com/main/content/wp...derground_2.PNG

O24 - Desktop Component 5: (no name) - http://needforspeed.sk/pictures/galeria/nf...ll/2370_big.jpg

O24 - Desktop Component 7: kaldata.com - IT News, Software, Hardware, Games - http://www.kaldata.com/

O24 - Desktop Component 8: kaldata.com - Форуми - http://www.kaldata.com/forums/

O24 - Desktop Component 9: ###### - http://www.######/browse.php

--

End of file - 13632 bytes

Ето!

Влез в HiJackThis, избери Do scan a system only и сложи отметки на следните неща:

O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)

O4 - Startup: WallpaperSlideshow.lnk = C:\Program Files\Breit Technologies\Wallpaper Slideshow\WallpaperSlideshow.exe - Ето това мисля, че е проблема

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

След, което натисни Fix Checked и рестартирай компютъра.

Би ли ми изпратил, като прикачен файл, ето това C:\WINDOWS\apdqnxp.dll на e-mail [email protected] ?

Можеш да сложиш и да поправиш и следните неща:

O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html - мисля че това е Toolbar-a който се инсталира заедно с Winamp - за мен е излишен

O21 - SSODL: apdqnxp - {4C5F8123-CDF9-48D6-9C34-83E107F1D558} - C:\WINDOWS\apdqnxp.dll - свързан е с Downloader.Zlob.ABN

O21 - SSODL: btrklfr - {4692B9E0-7D41-4768-B89C-306AA1099899} - (no file)

Редактирано 9 март 200818 г. от B-boy[StyLe] (преглед на промените)

Влез в HiJackThis, избери Do scan a system only и сложи отметки на следните неща:

След, което натисни Fix Checked и рестартирай компютъра.

Би ли ми изпратил, като прикачен файл, ето това C:\WINDOWS\apdqnxp.dll на e-mail [email protected] ?

Нищо пак се показва!

B-boy[styLe], сканирах с почти всички програми където си ми дал и нищо. Това за защитната стена въобше не ми дава проблем.

Нищо пак се показва!

B-boy[styLe], сканирах с почти всички програми където си ми дал и нищо. Това за защитната стена въобше не ми дава проблем.

Малко ме съмнява да си проверил толкова бързо с всичките програми от този пост:

http://www.kaldata.com/forums/index.php?s=...st&p=841925

и този пост:

http://www.kaldata.com/forums/index.php?s=...st&p=739080

Защитната стена на Windows няма да помогне в случая, защото не следи за изходящ трафик...Това е оправено чак при Windows VISTA! Сложи си алтернативна като ZoneAlarm, COMODO и т.н.

Можеш да пробваш и друго - създай нов акаунт влез през него и изтрий този...е вярно че ще се загубят доста от настройките които си правил, но е за предпочитане пред преинсталация на Windows!

Редактирано 9 март 200818 г. от B-boy[StyLe] (преглед на промените)

Не е от WallpaperSlideShow.lnk! Това е програма за сменяне на фона на десктопа в зададен от теб период от време.

Аз имам 3 акаунта във Windowsa и навсякъде се появява тая напаст! Още щом ми се стартира Windowsa!

Изтегли Microsoft AutoRuns

http://download.sysinternals.com/Files/Autoruns.zip

Разархивирай AutoRuns в негова собствена папка и стартирай exe файла с име autoruns

1. Избери Options -> Hide Microsoft Entries

2. Избери File -> Refresh

3. Избери File -> Save as

Избери да запазиш файла някъде и след това ,използвайки Copy/Paste , постави този log файл в отговора си.

Не е от WallpaperSlideShow.lnk! Това е програма за сменяне на фона на десктопа в зададен от теб период от време.

Аз имам 3 акаунта във Windowsa и навсякъде се появява тая напаст! Още щом ми се стартира Windowsa!

Ти обаче изобщо не се вслушваш в съветите...

1.Къде са лог файловете от проверките с различните програми и извършените от тях процедури? (особено от SmitfraudFix, Malwarebytes Anti-Malware, Rogue Remover, VundoFix, RemoveIt Pro, AVZ)

2.Нищо че имаш 3-акаунта...Създай нов и изтрий всички останали щом са инфектирани!

http://www.kaldata.com/forums/index.php?s=...st&p=674615

3.Виж тези стъпки за решаване на проблема: (в Google Има много писано по въпроса стига да знаеш къде да търсиш)

http://www.bleepingcomputer.com/forums/ind...st&p=757051

4.Маркира ли и моите предложения за поправяне в HijackThis? Преименувай програмата примерно на alabala.exe и дай пак лог файл!

5.Важно е да дадеш лог файл от Autoruns както посъветва и Fixer!

Редактирано 9 март 200818 г. от B-boy[StyLe] (преглед на промените)

Не е от WallpaperSlideShow.lnk! Това е програма за сменяне на фона на десктопа в зададен от теб период от време.

Аз имам 3 акаунта във Windowsa и навсякъде се появява тая напаст! Още щом ми се стартира Windowsa!

Дай лог файловете от HjackThis и AutoRuns и сканирай с spybot , Malware Bytes' , SuperAntiSpyware , и т.н

Всички очакваме LOG-file-a

Редактирано 9 март 200818 г. от Haryy_Potter (преглед на промените)

Ето от Аutoruns:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

+ Adobe Photo Downloader Adobe Photoshop Album Starter Edition 3.0 component Adobe Systems Incorporated c:\program files\adobe\photoshop album starter edition\3.0\apps\apdproxy.exe

+ ATICCC CLI Application (Command Line Interface) ATI Technologies Inc. c:\program files\ati technologies\ati.ace\cli.exe

+ ATIPTA ATI Desktop Control Panel ATI Technologies, Inc. c:\program files\ati technologies\ati control panel\atiptaxx.exe

+ avast! avast! service GUI component ALWIL Software c:\program files\alwil software\avast4\ashdisp.exe

+ ccApp Symantec User Session Symantec Corporation c:\program files\common files\symantec shared\ccapp.exe

+ Cmaudio CmiCnfg DLL C-Media Corporation c:\windows\system\cmicnfg.cpl

+ ISTray PC Tools Tray Application PC Tools c:\program files\spyware doctor\pctstray.exe

+ LClock LClock Application c:\program files\lclock\lclock.exe

+ QuickTime Task QuickTime Task Apple Computer, Inc. c:\program files\quicktime\qttask.exe

+ SunJavaUpdateSched Java Platform SE binary Sun Microsystems, Inc. c:\program files\java\jre1.6.0_05\bin\jusched.exe

+ WinampAgent c:\program files\winamp\winampa.exe

C:\Documents and Settings\All Users\Start Menu\Programs\Startup

+ ATI CATALYST System Tray.lnk CLI Application (Command Line Interface) ATI Technologies Inc. c:\program files\ati technologies\ati.ace\cli.exe

+ SnagIt 8.lnk SnagIt 8 TechSmith Corporation c:\program files\techsmith\snagit 8\snagit32.exe

C:\Documents and Settings\~~~FIRED~FOREVER~~~\Start Menu\Programs\Startup

+ WallpaperSlideshow.lnk Breit Technologies c:\program files\breit technologies\wallpaper slideshow\wallpaperslideshow.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Run

+ LClock LClock Application c:\program files\lclock\lclock.exe

+ NBJ Nero BackItUp Scheduler Application Ahead Software AG c:\program files\ahead\nero backitup\nbj.exe

+ Norton SystemWorks Symantec Internal Component Symantec Corporation c:\program files\norton systemworks\cfgwiz.exe

+ ooVoo.exe ooVoo ooVoo c:\program files\oovoo\oovoo.exe

+ Orb Orb Orb Networks c:\program files\winamp remote\bin\orbtray.exe

+ Skype Skype. Take a deep breath Skype Technologies S.A. c:\program files\skype\phone\skype.exe

+ swg GoogleToolbarNotifier Google Inc. c:\program files\google\googletoolbarnotifier\googletoolbarnotifier.exe

+ TuneUp MemOptimizer TuneUp MemOptimizer TuneUp Software GmbH c:\program files\tuneup utilities 2007\memoptimizer.exe

+ uTorrent d:\utorrent\utorrent.exe

HKLM\SOFTWARE\Classes\Protocols\Handler

+ skype4com Skype for COM API Skype Technologies c:\program files\common files\skype\skype4com.dll

+ textwareilluminatorbase c:\windows\system32\textwareilluminatorbaseprotocol.dll

HKCU\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components

+ 0 File not found: http://needforspeed.sk/pictures/galeria/nfsc/wall/2390.jpg

+ 1 File not found: http://needforspeed.sk/pictures/galeria/nf...cr/2204_big.jpg

+ 10 File not found: http://www.######/browse.php

+ 2 File not found: http://stalker-portal.ru/datas/users/1-wal...er_fromleks.jpg

+ 3 File not found: http://stalker-portal.ru/datas/users/1-w13.jpg

+ 4 File not found: http://content.answers.com/main/content/wp...derground_2.PNG

+ 5 File not found: http://needforspeed.sk/pictures/galeria/nf...ll/2370_big.jpg

+ 6 File not found: file:///C:\WINDOWS\privacy_danger\index.htm

+ 7 File not found: About:Home

+ 8 File not found: http://www.kaldata.com/

+ 9 File not found: http://www.kaldata.com/forums/

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad

+ apdqnxp apdqnxp c:\windows\apdqnxp.dll

HKLM\Software\Classes\*\ShellEx\ContextMenuHandlers

+ avast avast! Shell Extension ALWIL Software c:\program files\alwil software\avast4\ashshell.dll

+ SnagItMainShellExt SnagIt Shell Extension DLL TechSmith Corporation c:\program files\techsmith\snagit 8\snagitshellext.dll

+ TuneUp Shredder Shell Extension TuneUp Shredder Shell Extension TuneUp Software GmbH c:\program files\tuneup utilities 2007\sdshelex-win32.dll

+ WinRAR c:\program files\winrar\rarext.dll

HKLM\Software\Classes\Folder\ShellEx\ContextMenuHandlers

+ avast avast! Shell Extension ALWIL Software c:\program files\alwil software\avast4\ashshell.dll

+ WinRAR c:\program files\winrar\rarext.dll

HKLM\Software\Classes\Directory\ShellEx\ContextMenuHandlers

+ SnagItMainShellExt SnagIt Shell Extension DLL TechSmith Corporation c:\program files\techsmith\snagit 8\snagitshellext.dll

+ TuneUp Shredder Shell Extension TuneUp Shredder Shell Extension TuneUp Software GmbH c:\program files\tuneup utilities 2007\sdshelex-win32.dll

+ WinRAR c:\program files\winrar\rarext.dll

HKLM\Software\Classes\Directory\Background\ShellEx\ContextMenuHandlers

+ ACE ACE Context Menu c:\program files\ati technologies\ati.ace\atiacmxx.dll

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved

+ avast avast! Shell Extension ALWIL Software c:\program files\alwil software\avast4\ashshell.dll

+ Catalyst Context Menu extension ACE Context Menu c:\program files\ati technologies\ati.ace\atiacmxx.dll

+ HyperTerminal Icon Ext HyperTerminal Applet Library Hilgraeve, Inc. c:\windows\system32\hticons.dll

+ SnagIt SnagIt Add-in for Internet Explorer TechSmith Corporation c:\program files\techsmith\snagit 8\snagitieaddin.dll

+ SnagIt Shell Extension SnagIt Shell Extension DLL TechSmith Corporation c:\program files\techsmith\snagit 8\snagitshellext.dll

+ TuneUp Shredder Shell Extension TuneUp Shredder Shell Extension TuneUp Software GmbH c:\program files\tuneup utilities 2007\sdshelex-win32.dll

+ TuneUp Theme Extension TuneUp Theme Extension TuneUp Software GmbH c:\windows\system32\uxtuneup.dll

+ WinRAR shell extension c:\program files\winrar\rarext.dll

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects

+ AcroIEHlprObj Class Adobe Acrobat IE Helper Version 6.0 for ActivieX Adobe Systems Incorporated c:\program files\adobe\acrobat 6.0\reader\activex\acroiehelper.dll

+ BitComet Helper BitCometBHO BitComet d:\bit comet\tools\bitcometbho_1.1.7.4.dll

+ Google Toolbar Helper Google IE Client Toolbar Google Inc. c:\program files\google\googletoolbar3.dll

+ Google Toolbar Notifier BHO GoogleToolbarNotifier Google Inc. c:\program files\google\googletoolbarnotifier\2.0.1121.2472\swg.dll

+ IE7Pro BHO IE7Pro Module IE7Pro.com c:\program files\iepro\iepro.dll

+ Skype add-on (mastermind) Skype add-on for IE Skype Technologies S.A. c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll

+ SnagIt Toolbar Loader SnagIt Browser Helper Object for Internet Explorer TechSmith Corporation c:\program files\techsmith\snagit 8\snagitbho.dll

+ SSVHelper Class Java Platform SE binary Sun Microsystems, Inc. c:\program files\java\jre1.6.0_05\bin\ssv.dll

+ Winamp Toolbar BHO Winamp IE Toolbar Dynamic Link Library AOL LLC c:\program files\winamp toolbar\winamptb.dll

+ Yahoo! Toolbar Helper Yahoo! Toolbar Yahoo! Inc. c:\program files\yahoo!\companion\installs\cpn\yt.dll

HKLM\Software\Microsoft\Internet Explorer\Toolbar

+ &Google Google IE Client Toolbar Google Inc. c:\program files\google\googletoolbar3.dll

+ SnagIt SnagIt Add-in for Internet Explorer TechSmith Corporation c:\program files\techsmith\snagit 8\snagitieaddin.dll

+ Winamp Toolbar Winamp IE Toolbar Dynamic Link Library AOL LLC c:\program files\winamp toolbar\winamptb.dll

+ Yahoo! Toolbar Yahoo! Toolbar Yahoo! Inc. c:\program files\yahoo!\companion\installs\cpn\yt.dll

Task Scheduler

+ 1-Click Maintenance.job TuneUp System Optimizer TuneUp Software GmbH c:\program files\tuneup utilities 2007\systemoptimizer.exe

+ AppleSoftwareUpdate.job Apple Software Update Apple Inc. c:\program files\apple software update\softwareupdate.exe

+ Norton SystemWorks One Button Checkup.job One Button Checkup Symantec Corporation c:\program files\norton systemworks\obc.exe

+ Symantec Drmc.job Symantec Shared File Symantec Corporation c:\program files\common files\symantec shared\symdrmc.exe

HKLM\System\CurrentControlSet\Services

+ aswUpdSv Осигурява авотматични обновявания на компонентите на avast!. ALWIL Software c:\program files\alwil software\avast4\aswupdsv.exe

+ Ati HotKey Poller ATI External Event Utility EXE Module ATI Technologies Inc. c:\windows\system32\ati2evxx.exe

+ ATI Smart ATI Smart c:\windows\system32\ati2sgag.exe

+ Automatic LiveUpdate Scheduler Manages the scheduling of Automatic LiveUpdate sessions Symantec Corporation c:\program files\symantec\liveupdate\aluschedulersvc.exe

+ avast! Antivirus Управлява и изпълнява антивирусните услуги на avast! на този компютър. Това включва резидентна защита, клетката за вируси и планировчика. ALWIL Software c:\program files\alwil software\avast4\ashserv.exe

+ ccEvtMgr Event propagation and logging service Symantec Corporation c:\program files\common files\symantec shared\ccsvchst.exe

+ ccSetMgr Settings storage and management service Symantec Corporation c:\program files\common files\symantec shared\ccsvchst.exe

+ CLTNetCnService Symantec Lic NetConnect Service Symantec Corporation c:\program files\common files\symantec shared\ccsvchst.exe

+ NProtectService Protects files deleted from command line prompt and applications Symantec Corporation c:\program files\norton systemworks\norton utilities\nprotect.exe

+ pr2akdnc This service automatically uninstalls You Are Empty drivers after You Are Empty is uninstalled. After the drivers are uninstalled, the service uninstalls itself as well. If You Are Empty is reinstalled, the drivers as well as this service will be also reinstalled at the first run of the application. This service is not constantly operating and does not use memory. It is launched automatically on operating system startup and unloads itself from memory after completing all tasks described above. Cenega Publishing c:\windows\system32\pr2akdnc.exe

+ sdAuxService Provides auxiliary PC Tools Security services. If this service is disabled spyware protection will be reduced. PC Tools c:\program files\spyware doctor\pctsauxs.exe

+ sdCoreService Provides spyware and malware protection for the system. If this service is disabled spyware protection will be disabled. PC Tools c:\program files\spyware doctor\pctssvc.exe

+ Speed Disk service Used to schedule disk defragmentation Symantec Corporation c:\program files\norton systemworks\norton utilities\speed disk\nopdb.exe

+ STI Simulator c:\windows\system32\pastisvc.exe

+ Symantec Core LC Symantec Core LC Symantec Corporation c:\program files\common files\symantec shared\ccpd-lc\symlcsvc.exe

+ UxTuneUp Allows to use visual styles without Microsoft signature. TuneUp Software GmbH c:\windows\system32\uxtuneup.dll

HKLM\System\CurrentControlSet\Services

+ Aavmker4 avast! Base Kernel-Mode Device Driver for Windows NT/2000/XP ALWIL Software c:\windows\system32\drivers\aavmker4.sys

+ ACEDRV07 Helper Driver - Access Level 1a Protect Software GmbH c:\windows\system32\drivers\acedrv07.sys

+ aswMon2 avast! File System Filter Driver for Windows XP ALWIL Software c:\windows\system32\drivers\aswmon2.sys

+ aswRdr avast! TDI RDR Driver ALWIL Software c:\windows\system32\drivers\aswrdr.sys

+ aswTdi avast! TDI Filter Driver ALWIL Software c:\windows\system32\drivers\aswtdi.sys

+ ati2mtag ATI Radeon WindowsNT Miniport Driver ATI Technologies Inc. c:\windows\system32\drivers\ati2mtag.sys

+ Changer File not found: C:\WINDOWS\System32\Drivers\Changer.sys

+ cmuda C-Media Audio WDM Driver C-Media Inc c:\windows\system32\drivers\cmuda.sys

+ dtscsi c:\windows\system32\drivers\dtscsi.sys

+ EagleNT File not found: C:\WINDOWS\system32\drivers\EagleNT.sys

+ FETNDIS NDIS 5.0 miniport driver VIA Technologies, Inc. c:\windows\system32\drivers\fetnd5.sys

+ FETNDISB NDIS 5.0 miniport driver VIA Technologies, Inc. c:\windows\system32\drivers\fetnd5b.sys

+ GVCplDrv c:\windows\system32\drivers\gvcpldrv.sys

+ hamachi Hamachi Virtual Network Interface Driver Applied Networking Inc. c:\windows\system32\drivers\hamachi.sys

+ i2omgmt File not found: C:\WINDOWS\System32\Drivers\i2omgmt.sys

+ IKFileSec File Security Device Driver PCTools Research Pty Ltd. c:\windows\system32\drivers\ikfilesec.sys

+ IKSysFlt System Filter Device Driver PCTools Research Pty Ltd. c:\windows\system32\drivers\iksysflt.sys

+ IKSysSec System Security Device Driver PCTools Research Pty Ltd. c:\windows\system32\drivers\iksyssec.sys

+ lbrtfdc File not found: C:\WINDOWS\System32\Drivers\lbrtfdc.sys

+ NPDriver Norton Protection Driver Symantec Corporation c:\windows\system32\drivers\npdriver.sys

+ NTSIM Network Device Monitor Utility VIA Networking Technologies, Inc. c:\windows\system32\ntsim.sys

+ PAC207 c:\windows\system32\drivers\pfc027.sys

+ PCIDump File not found: C:\WINDOWS\System32\Drivers\PCIDump.sys

+ PDCOMP File not found: C:\WINDOWS\System32\Drivers\PDCOMP.sys

+ PDFRAME File not found: C:\WINDOWS\System32\Drivers\PDFRAME.sys

+ PDRELI File not found: C:\WINDOWS\System32\Drivers\PDRELI.sys

+ PDRFRAME File not found: C:\WINDOWS\System32\Drivers\PDRFRAME.sys

+ pe3akdnc You Are Empty Environment Driver Cenega Publishing c:\windows\system32\drivers\pe3akdnc.sys

+ prodrv06 StarForce Protection Environment Driver Protection Technology c:\windows\system32\drivers\prodrv06.sys

+ prohlp02 StarForce Protection Helper Driver Protection Technology c:\windows\system32\drivers\prohlp02.sys

+ prosync1 StarForce Protection Synchronization Driver Protection Technology c:\windows\system32\drivers\prosync1.sys

+ ps6akdnc You Are Empty Synchronization Driver Cenega Publishing c:\windows\system32\drivers\ps6akdnc.sys

+ Ptilink Direct Parallel Link Driver Parallel Technologies, Inc. c:\windows\system32\drivers\ptilink.sys

+ PxHelp20 Px Engine Device Driver for Windows 2000/XP Sonic Solutions c:\windows\system32\drivers\pxhelp20.sys

+ SASKUTIL File not found: C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys

+ SDdriver SDDRIVER Symantec Corporation c:\windows\system32\drivers\sddriver.sys

+ Secdrv SafeDisc driver Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K. c:\windows\system32\drivers\secdrv.sys

+ sfdrv01 StarForce Protection Environment Driver Protection Technology c:\windows\system32\drivers\sfdrv01.sys

+ sfhlp01 StarForce Protection Helper Driver Protection Technology c:\windows\system32\drivers\sfhlp01.sys

+ sfhlp02 StarForce Protection Helper Driver Protection Technology c:\windows\system32\drivers\sfhlp02.sys

+ sptd c:\windows\system32\drivers\sptd.sys

+ SymEvent Symantec Event Library Symantec Corporation c:\windows\system32\drivers\symevent.sys

+ symlcbrd Symantec Core Component Symantec Corporation c:\windows\system32\drivers\symlcbrd.sys

+ viaagp1 VIA NT AGP Filter VIA Technologies, Inc. c:\windows\system32\drivers\viaagp1.sys

+ viamraid VIA RAID DRIVER FOR WINXP VIA Technologies inc,.ltd c:\windows\system32\drivers\viamraid.sys

+ w200bus Sony Ericsson W200 Driver MCCI c:\windows\system32\drivers\w200bus.sys

+ w200mdfl Sony Ericsson W200 USB WMC Modem Filter MCCI c:\windows\system32\drivers\w200mdfl.sys

+ w200mdm Sony Ericsson W200 USB WMC Modem Driver MCCI c:\windows\system32\drivers\w200mdm.sys

+ w200mgmt Sony Ericsson W200 USB WMC Device Management Drivers (WDM) MCCI c:\windows\system32\drivers\w200mgmt.sys

+ w200obex Sony Ericsson W200 USB WMC OBEX Interface MCCI c:\windows\system32\drivers\w200obex.sys

+ WDICA File not found: C:\WINDOWS\System32\Drivers\WDICA.sys

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify

+ AtiExtEvent ATI External Event Utility DLL Module ATI Technologies Inc. c:\windows\system32\ati2evxx.dll