Май имам keylogger

18 февруари 201115 г.

Помогнете!Мисля ,че ми пратиха keylogger или троянец.Не съм много сигурен но мисля че ми вкараха.Как мога да проверя дали имам keylogger или троянец.Av не засича нищо.

18 февруари 201115 г.

ти с какво провери , че не си засякъл нищо ?!

18 февруари 201115 г.

Автор

Абе засечеми тука 7 вируса обаче нещо не е това което ми трябва.

18 февруари 201115 г.

Помогнете!Мисля ,че ми пратиха keylogger или троянец.Не съм много сигурен но мисля че ми вкараха.Как мога да проверя дали имам keylogger или троянец.Av не засича нищо.

Сложи Zemana Antilogger, въпреки, че постфактум не знам дали ще е отполза...

18 февруари 201115 г.

Автор

Как да я пусна да сканира?

18 февруари 201115 г.

Що не вземеш да направиш това а: http://www.kaldata.com/forums/index.php?showtopic=132819

18 февруари 201115 г.

Що не вземеш да направиш това а: http://www.kaldata.com/forums/index.php?showtopic=132819

това е най-разумното...

18 февруари 201115 г.

Автор

Malwarebytes' Anti-Malware 1.50.1.1100 www.malwarebytes.org Версия на базата от данни: 5794 Windows 6.1.7600 Internet Explorer 8.0.7600.16385 18.2.2011 г. 15:34:21 mbam-log-2011-02-18 (15-34-21).txt Тип сканиране: Пълно сканиране (C:\|D:\|) Сканирани обекти: 250683 Изминало време: 35 минута(и), 43 секунда(и) Заразени процеси в паметта: 0 Заразени модули в паметта: 0 Заразени ключове в регистратурата: 0 Заразени стойности в регистратурата: 0 Заразени информационни обекти в регистратурата: 0 Заразени папки: 0 Заразени файлове: 8 Заразени процеси в паметта: (Не бяха открити зловредни обекти) Заразени модули в паметта: (Не бяха открити зловредни обекти) Заразени ключове в регистратурата: (Не бяха открити зловредни обекти) Заразени стойности в регистратурата: (Не бяха открити зловредни обекти) Заразени информационни обекти в регистратурата: (Не бяха открити зловредни обекти) Заразени папки: (Не бяха открити зловредни обекти) Заразени файлове: c:\Users\Даниел\Desktop\revouninprosetup.exe (Trojan.Agent.CK) -> Quarantined and deleted successfully. c:\Users\Даниел\Desktop\freezer v1.0 repack\groundzero's facebook freezer.exe (HackTool.Agent) -> Quarantined and deleted successfully. c:\program files\realhideip\Patch.exe (RiskWare.Tool.CK) -> Quarantined and deleted successfully. d:\папка на дани\windows loader.exe (RiskWare.Tool.CK) -> Quarantined and deleted successfully. d:\папка на дани\removewat.exe (HackTool.Wpakill) -> Quarantined and deleted successfully. d:\папка на дани\easy gif animator pro 5.1.0.44\easy gif animator pro 5.1.0.44\български интерфейс за easy gif animator pro 5 +\български интерфейс за easy gif animator pro 5 +.exe (Trojan.Spambot) -> Quarantined and deleted successfully. d:\папка на дани\techsmith camtasia studio v5.1.0 build 505\keygen\keygen.exe (Backdoor.RBot) -> Quarantined and deleted successfully. d:\папка на дани\real hide ip v4.0.7.8 + portable\real hide ip v4.0.7.8\Patch.exe (RiskWare.Tool.CK) -> Quarantined and deleted successfully. http://dox.bg/files/dw?a=5198b2487f

18 февруари 201115 г.

Изглежда става въпрос за това, че системата ти е инфектирана, затова темата ще бъде преместена и някой от екипа ще се заеме с твоя случай.

19 февруари 201115 г.

Съжалявам за забавянето! Аз ще се опитам да ви помогна!

Моля, обновете Malwarebytes' Anti-Malware и след това направете бързо сканиране на системата.

Накрая, публикувайте резултатите от Malwarebytes' Anti-Malware, в допълнение с нови свежи лог файлове от DDS.

20 февруари 201115 г.

Автор

Malwarebytes' Anti-Malware 1.50.1.1100 www.malwarebytes.org Версия на базата от данни: 5816 Windows 6.1.7600 Internet Explorer 8.0.7600.16385 20.2.2011 г. 07:58:43 mbam-log-2011-02-20 (07-58-43).txt Тип сканиране: Бързо сканиране Сканирани обекти: 143976 Изминало време: 3 минута(и), 35 секунда(и) Заразени процеси в паметта: 0 Заразени модули в паметта: 0 Заразени ключове в регистратурата: 0 Заразени стойности в регистратурата: 0 Заразени информационни обекти в регистратурата: 0 Заразени папки: 0 Заразени файлове: 0 Заразени процеси в паметта: (Не бяха открити зловредни обекти) Заразени модули в паметта: (Не бяха открити зловредни обекти) Заразени ключове в регистратурата: (Не бяха открити зловредни обекти) Заразени стойности в регистратурата: (Не бяха открити зловредни обекти) Заразени информационни обекти в регистратурата: (Не бяха открити зловредни обекти) Заразени папки: (Не бяха открити зловредни обекти) Заразени файлове: (Не бяха открити зловредни обекти) http://dox.bg/files/dw?a=6c5147e605 http://dox.bg/files/dw?a=e9bd09466f

20 февруари 201115 г.

Накрая, публикувайте резултатите от Malwarebytes' Anti-Malware, в допълнение с нови свежи лог файлове от DDS.

20 февруари 201115 г.

Автор

Ами точно това направих.

20 февруари 201115 г.

Ами DDS.txt и Attach.txt защо не сте ги публикували? Само този на MBAM.

20 февруари 201115 г.

Автор

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT DDS (Ver_10-12-12.02) Microsoft Windows 7 Ultimate Boot Device: \Device\HarddiskVolume1 Install Date: 17.1.2011 г. 13:15:56 System Uptime: 20.2.2011 г. 07:40:49 (1 hours ago) Motherboard: ASRock | | N68-GS Processor: AMD Athlon II X2 245 Processor | CPUSocket | 2913/200mhz ==== Disk Partitions ========================= C: is FIXED (NTFS) - 98 GiB total, 53,907 GiB free. D: is FIXED (NTFS) - 368 GiB total, 315,198 GiB free. E: is CDROM () F: is CDROM (CDFS) ==== Disabled Device Manager Items ============= ==== System Restore Points =================== RP67: 14.2.2011 г. 13:13:51 - Installed Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 RP68: 14.2.2011 г. 13:47:35 - Installed Readon TV Movie Radio Player 6.3.1.0 RP69: 16.2.2011 г. 13:01:28 - Installed Oracle VM VirtualBox 4.0.2 RP70: 17.2.2011 г. 15:42:04 - Installed DriveHQ FileManager 5.0 RP71: 18.2.2011 г. 07:54:50 - Removed DriveHQ FileManager 5.0 RP72: 19.2.2011 г. 10:56:41 - Installed Test Drive Unlimited ==== Installed Programs ====================== WWW.ELIT-BG Домашен Кулинар XP µTorrent Български интерфейс за Easy GIF Animator Pro 5 + 18 Wheels of Steel: Haulin' 18 WoS Extreme Trucker 2 (v.1.0) AbiWord 2.8.6 Adobe AIR Adobe Anchor Service CS4 Adobe Bridge CS4 Adobe CMaps CS4 Adobe Color - Photoshop Specific CS4 Adobe Color EU Extra Settings CS4 Adobe Color JA Extra Settings CS4 Adobe Color NA Recommended Settings CS4 Adobe Color Video Profiles CS CS4 Adobe CSI CS4 Adobe Default Language CS4 Adobe Device Central CS4 Adobe Drive CS4 Adobe ExtendScript Toolkit CS4 Adobe Extension Manager CS4 Adobe Flash Player 10 ActiveX Adobe Flash Player 10 Plugin Adobe Fonts All Adobe Linguistics CS4 Adobe Media Player Adobe Output Module Adobe PDF Library Files CS4 Adobe Photoshop CS4 Adobe Photoshop CS4 Support Adobe Reader 9.1 Adobe Search for Help Adobe Service Manager Extension Adobe Setup Adobe Type Support CS4 Adobe Update Manager CS4 Adobe WinSoft Linguistics Plugin Adobe XMP Panels CS4 AdobeColorCommonSetCMYK AdobeColorCommonSetRGB Ask Toolbar ATI Catalyst Install Manager Belltech Business Card Designer Pro 5.2.3 Camtasia Studio 5 COMODO Internet Security Connect DAEMON Tools Lite DAEMON Tools Toolbar DoSHTTP 2.0 Driver Genius Professional Edition Easy-Hide-IP 3.7.4 Easy GIF Animator 5.1 Euro Truck Simulator EVEREST Corporate Edition v5.50 FlashGet 1.9.6.1073 Game Booster Havij 1.09 lite Hide IP Easy Inhatch web plugins kuler Malwarebytes' Anti-Malware Microsoft .NET Framework 4 Client Profile Microsoft .NET Framework 4 Extended Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Mozilla Firefox (3.6.13) MpcStar 4.9 Need for Speed™ Most Wanted NVIDIA Display Control Panel NVIDIA Drivers NVIDIA PhysX NVIDIA Stereoscopic 3D Driver Oracle VM VirtualBox 4.0.2 PDF Settings CS4 Photoshop Camera Raw Platform Readon TV Movie Radio Player 6.3.1.0 Real Hide IP RealPlayer Revo Uninstaller Pro 2.1.1 Security Update for Microsoft .NET Framework 4 Extended (KB2416472) Skype™ 3.8 SopCast 0.9.5 Star Wars Battlefront II Suite Shared Configuration CS4 Test Drive Unlimited The KMPlayer (remove only) Update for Microsoft .NET Framework 4 Client Profile (KB2473228) VIA п»ї Web Page Maker V3.03 Winamp Winamp Detector Plug-in WinRAR 4.00 beta 4 (32-bit) Xfire (remove only) ==== Event Viewer Messages From Past Week ======== 20.2.2011 г. 07:41:06, Error: Microsoft-Windows-Kernel-Processor-Power [6] - Some processor performance power management features have been disabled due to a known firmware problem. Check with the computer manufacturer for updated firmware. 19.2.2011 г. 21:53:28, Error: Service Control Manager [7016] - Услуга NVIDIA Stereoscopic 3D Driver Service съобщава невалидно текущо състояние 0. 19.2.2011 г. 17:38:55, Error: Microsoft-Windows-Kernel-Processor-Power [6] - Some processor performance power management features have been disabled due to a known firmware problem. Check with the computer manufacturer for updated firmware. 19.2.2011 г. 16:36:10, Error: Service Control Manager [7016] - Услуга NVIDIA Stereoscopic 3D Driver Service съобщава невалидно текущо състояние 0. 19.2.2011 г. 15:24:41, Error: Microsoft-Windows-Kernel-Processor-Power [6] - Some processor performance power management features have been disabled due to a known firmware problem. Check with the computer manufacturer for updated firmware. 19.2.2011 г. 12:42:03, Error: Service Control Manager [7016] - Услуга NVIDIA Stereoscopic 3D Driver Service съобщава невалидно текущо състояние 0. 19.2.2011 г. 07:09:45, Error: Microsoft-Windows-Kernel-Processor-Power [6] - Some processor performance power management features have been disabled due to a known firmware problem. Check with the computer manufacturer for updated firmware. 18.2.2011 г. 22:24:28, Error: Service Control Manager [7016] - Услуга NVIDIA Stereoscopic 3D Driver Service съобщава невалидно текущо състояние 0. 18.2.2011 г. 19:49:46, Error: Microsoft-Windows-Kernel-Processor-Power [6] - Some processor performance power management features have been disabled due to a known firmware problem. Check with the computer manufacturer for updated firmware. 18.2.2011 г. 16:18:47, Error: Service Control Manager [7016] - Услуга NVIDIA Stereoscopic 3D Driver Service съобщава невалидно текущо състояние 0. 18.2.2011 г. 07:50:26, Error: Microsoft-Windows-Kernel-Processor-Power [6] - Some processor performance power management features have been disabled due to a known firmware problem. Check with the computer manufacturer for updated firmware. 17.2.2011 г. 21:59:26, Error: Service Control Manager [7016] - Услуга NVIDIA Stereoscopic 3D Driver Service съобщава невалидно текущо състояние 0. 17.2.2011 г. 20:38:19, Error: BTHUSB [5] - Bluetooth драйверът очакваше HCI събитие с определен размер, но не го получи. 17.2.2011 г. 20:38:15, Error: BTHUSB [5] - Bluetooth драйверът очакваше HCI събитие с определен размер, но не го получи. 17.2.2011 г. 20:29:18, Error: BTHUSB [5] - Bluetooth драйверът очакваше HCI събитие с определен размер, но не го получи. 17.2.2011 г. 20:29:14, Error: BTHUSB [5] - Bluetooth драйверът очакваше HCI събитие с определен размер, но не го получи. 17.2.2011 г. 19:16:36, Error: BTHUSB [5] - Bluetooth драйверът очакваше HCI събитие с определен размер, но не го получи. 17.2.2011 г. 19:16:32, Error: BTHUSB [5] - Bluetooth драйверът очакваше HCI събитие с определен размер, но не го получи. 17.2.2011 г. 15:42:31, Error: Service Control Manager [7030] - Услуга FileManagerFun е маркирана като интерактивна услуга. Обаче системата е конфигурирана да не допуска интерактивни услуги. Тази услуга може да не функционира правилно. 17.2.2011 г. 11:57:18, Error: Microsoft-Windows-Kernel-Processor-Power [6] - Some processor performance power management features have been disabled due to a known firmware problem. Check with the computer manufacturer for updated firmware. 17.2.2011 г. 08:40:05, Error: Service Control Manager [7016] - Услуга NVIDIA Stereoscopic 3D Driver Service съобщава невалидно текущо състояние 0. 17.2.2011 г. 07:49:35, Error: Microsoft-Windows-Kernel-Processor-Power [6] - Some processor performance power management features have been disabled due to a known firmware problem. Check with the computer manufacturer for updated firmware. 16.2.2011 г. 22:10:18, Error: Service Control Manager [7016] - Услуга NVIDIA Stereoscopic 3D Driver Service съобщава невалидно текущо състояние 0. 16.2.2011 г. 20:09:03, Error: BTHUSB [5] - Bluetooth драйверът очакваше HCI събитие с определен размер, но не го получи. 16.2.2011 г. 20:08:59, Error: BTHUSB [5] - Bluetooth драйверът очакваше HCI събитие с определен размер, но не го получи. 16.2.2011 г. 11:55:27, Error: Microsoft-Windows-Kernel-Processor-Power [6] - Some processor performance power management features have been disabled due to a known firmware problem. Check with the computer manufacturer for updated firmware. 15.2.2011 г. 22:04:01, Error: Service Control Manager [7016] - Услуга NVIDIA Stereoscopic 3D Driver Service съобщава невалидно текущо състояние 0. 15.2.2011 г. 16:15:46, Error: Microsoft-Windows-Kernel-Processor-Power [6] - Some processor performance power management features have been disabled due to a known firmware problem. Check with the computer manufacturer for updated firmware. 15.2.2011 г. 14:15:40, Error: Service Control Manager [7016] - Услуга NVIDIA Stereoscopic 3D Driver Service съобщава невалидно текущо състояние 0. 15.2.2011 г. 11:44:57, Error: Microsoft-Windows-Kernel-Processor-Power [6] - Some processor performance power management features have been disabled due to a known firmware problem. Check with the computer manufacturer for updated firmware. 15.2.2011 г. 08:43:58, Error: Service Control Manager [7016] - Услуга NVIDIA Stereoscopic 3D Driver Service съобщава невалидно текущо състояние 0. 15.2.2011 г. 07:49:28, Error: Microsoft-Windows-Kernel-Processor-Power [6] - Some processor performance power management features have been disabled due to a known firmware problem. Check with the computer manufacturer for updated firmware. 15.2.2011 г. 02:47:22, Error: Service Control Manager [7016] - Услуга NVIDIA Stereoscopic 3D Driver Service съобщава невалидно текущо състояние 0. 14.2.2011 г. 17:00:51, Error: Microsoft-Windows-Kernel-Processor-Power [6] - Some processor performance power management features have been disabled due to a known firmware problem. Check with the computer manufacturer for updated firmware. 14.2.2011 г. 15:47:47, Error: Service Control Manager [7016] - Услуга NVIDIA Stereoscopic 3D Driver Service съобщава невалидно текущо състояние 0. 14.2.2011 г. 15:12:23, Error: Microsoft-Windows-Kernel-Processor-Power [6] - Some processor performance power management features have been disabled due to a known firmware problem. Check with the computer manufacturer for updated firmware. 14.2.2011 г. 14:12:32, Error: Service Control Manager [7016] - Услуга NVIDIA Stereoscopic 3D Driver Service съобщава невалидно текущо състояние 0. 14.2.2011 г. 13:03:37, Error: Microsoft-Windows-Kernel-Processor-Power [6] - Some processor performance power management features have been disabled due to a known firmware problem. Check with the computer manufacturer for updated firmware. 13.2.2011 г. 21:59:19, Error: Service Control Manager [7016] - Услуга NVIDIA Stereoscopic 3D Driver Service съобщава невалидно текущо състояние 0. 13.2.2011 г. 18:06:48, Error: Service Control Manager [7023] - Услуга Function Discovery Resource Publication прекъсна със следната грешка: %%-2147014847 13.2.2011 г. 18:06:36, Error: Microsoft-Windows-Kernel-Processor-Power [6] - Some processor performance power management features have been disabled due to a known firmware problem. Check with the computer manufacturer for updated firmware. 13.2.2011 г. 14:15:13, Error: Service Control Manager [7016] - Услуга NVIDIA Stereoscopic 3D Driver Service съобщава невалидно текущо състояние 0. 13.2.2011 г. 14:06:59, Error: Microsoft-Windows-Kernel-Processor-Power [6] - Some processor performance power management features have been disabled due to a known firmware problem. Check with the computer manufacturer for updated firmware. 13.2.2011 г. 00:28:45, Error: Service Control Manager [7016] - Услуга NVIDIA Stereoscopic 3D Driver Service съобщава невалидно текущо състояние 0. ==== End Of File =========================== DDS (Ver_10-12-12.02) - NTFSx86 Run by „ ЁҐ« at 8:14:35,86 on Ґ¤ 20.02.2011 Ј. Internet Explorer: 8.0.7600.16385 Microsoft Windows 7 Ultimate 6.1.7600.0.1251.359.1033.18.3071.1968 [GMT 2:00] AV: COMODO Antivirus *Enabled/Updated* {675CEE69-9702-A524-3989-6D7CC8BF3695} SP: COMODO Defense+ *Enabled/Updated* {DC3D0F8D-B138-AAAA-0339-560EB3387C28} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} FW: COMODO Firewall *Enabled* {5F676F4C-DD6D-A47C-12D6-C449366C71EE} ============== Running Processes =============== C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\nvvsvc.exe C:\Windows\system32\svchost.exe -k RPCSS C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\nvvsvc.exe C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe C:\Windows\system32\svchost.exe -k imgsvc C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Windows\system32\taskhost.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Program Files\COMODO\COMODO Internet Security\cfp.exe C:\Program Files\VIA\VIAudioi\VDeck\VDeck.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\DAEMON Tools Lite\DTLite.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Program Files\uTorrent\uTorrent.exe C:\Windows\system32\SearchIndexer.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Windows\System32\svchost.exe -k LocalServicePeerNet C:\Program Files\Skype\Phone\Skype.exe C:\Windows\system32\AUDIODG.EXE C:\Program Files\Skype\Plugin Manager\skypePM.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\plugin-container.exe C:\Users\Даниел\Desktop\dds.scr C:\Windows\system32\conhost.exe C:\Windows\system32\wbem\wmiprvse.exe ============== Pseudo HJT Report =============== uStart Page = hxxp://google.bg/ uInternet Settings,ProxyServer = http=;ftp=;https=; uURLSearchHooks: H - No File BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: Skype add-on (mastermind): {22bf413b-c6d2-4d91-82a9-a0f997ba588c} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll BHO: FGCatchUrl: {2f364306-aa45-47b5-9f9d-39a8b94e7ef7} - c:\program files\flashget\jccatch.dll BHO: PandoraTV Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll BHO: FlashGet GetFlash Class: {f156768e-81ef-470c-9057-481ba8380dba} - c:\program files\flashget\getflash.dll TB: PandoraTV Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll TB: DAEMON Tools Toolbar: {32099aac-c132-4136-9e9a-4e364a424e17} - c:\program files\daemon tools toolbar\DTToolbar.dll uRun: [AdobeBridge] uRun: [DAEMON Tools Lite] "c:\program files\daemon tools lite\DTLite.exe" -autorun uRun: [sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun uRun: [uTorrent] "c:\program files\utorrent\uTorrent.exe" mRun: [COMODO Internet Security] "c:\program files\comodo\comodo internet security\cfp.exe" -h mRun: [HDAudDeck] c:\program files\via\viaudioi\vdeck\VDeck.exe -r mRun: [WinampAgent] "c:\program files\winamp\winampa.exe" mRun: [AdobeCS4ServiceManager] "c:\program files\common files\adobe\cs4servicemanager\CS4ServiceManager.exe" -launchedbylogin mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe" StartupFolder: c:\users\6dfe~1\appdata\roaming\micros~1\windows\startm~1\programs\startup\utorre~1.lnk - c:\program files\ www.elit-bg\uTorrent-v2.2.exe mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0) mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3) mPolicies-system: EnableLUA = 0 (0x0) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) mPolicies-system: PromptOnSecureDesktop = 0 (0x0) IE: &Download All with FlashGet - c:\progra~1\flashget\jc_all.htm IE: &Download with FlashGet - c:\progra~1\flashget\jc_link.htm IE: {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - c:\program files\flashget\FlashGet.exe IE: {77BF5300-1474-4EC7-9980-D32B190E9B07} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab TCP: {AF700767-1490-408A-BE65-19B1001AE055} = 156.154.70.25,156.154.71.25 Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL AppInit_DLLs: c:\windows\system32\guard32.dll ================= FIREFOX =================== FF - ProfilePath - c:\users\6dfe~1\appdata\roaming\mozilla\firefox\profiles\qpnd7b5o.default\ FF - prefs.js: browser.search.selectedEngine - DAEMON Search FF - prefs.js: browser.startup.homepage - hxxp://www.google.bg/ FF - prefs.js: network.proxy.type - 0 FF - component: c:\users\даниел\appdata\roaming\mozilla\firefox\profiles\qpnd7b5o.default\extensions\[email protected]\components\DTToolbarFF.dll FF - plugin: c:\program files\inhatchteam\inhatch\npinhatch.dll FF - plugin: c:\program files\mozilla firefox\plugins\npwachk.dll FF - plugin: c:\program files\nvidia corporation\3d vision\npnv3dv.dll FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} FF - Ext: PandoraTV Toolbar: [email protected] - %profile%\extensions\[email protected] FF - Ext: DAEMON Tools Toolbar: [email protected] - %profile%\extensions\[email protected] FF - Ext: Real Hide IP: [email protected] - %profile%\extensions\[email protected] FF - Ext: Hide IP Easy: [email protected] - %profile%\extensions\[email protected] FF - Ext: Tor-Proxy.NET Toolbar: {9815d32d-08c2-42ca-a8c6-43e501a4512f} - %profile%\extensions\{9815d32d-08c2-42ca-a8c6-43e501a4512f} FF - Ext: Easy-Hide-IP Firefox Plugin: [email protected] - c:\program files\easy-hide-ip\ff-extension ============= SERVICES / DRIVERS =============== R1 cmderd;COMODO Internet Security Eradication Driver;c:\windows\system32\drivers\cmderd.sys [2011-1-6 17256] R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdGuard.sys [2011-1-6 236600] R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [2011-1-6 35768] R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\drivers\dtsoftbus01.sys [2011-1-24 218688] R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\nvidia corporation\3d vision\nvSCPAPISvr.exe [2010-4-3 240232] R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [2011-1-18 1127936] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-14 229888] S3 BthAvrcp;Bluetooth AVRCP Profile;c:\windows\system32\drivers\BthAvrcp.sys [2009-8-13 22528] S3 Revoflt;Revoflt;c:\windows\system32\drivers\revoflt.sys [2011-1-18 27064] S3 WatAdminSvc;Услуга на технологиите за активиране на Windows;c:\windows\system32\wat\WatAdminSvc.exe [2011-1-17 1343400] =============== Created Last 30 ================ 2011-02-19 09:02:57 49152 ----a-r- c:\users\6dfe~1\appdata\roaming\microsoft\installer\{c37a0bc1-52ee-4f97-8223-5ca9fc0357b0}\ARPPRODUCTICON.exe 2011-02-19 08:57:04 -------- d-----w- c:\program files\Atari 2011-02-18 12:57:52 -------- d-----w- c:\users\6dfe~1\appdata\roaming\Malwarebytes 2011-02-18 12:57:47 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2011-02-18 12:57:47 -------- d-----w- c:\progra~2\Malwarebytes 2011-02-18 12:57:44 20952 ----a-w- c:\windows\system32\drivers\mbam.sys 2011-02-18 12:57:44 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2011-02-18 12:40:59 -------- d-----w- c:\program files\AntiLogger 2011-02-18 10:35:28 140488 ----a-w- c:\windows\system32\comdlg32.ocx 2011-02-18 10:35:28 -------- d-----w- c:\program files\Havij 2011-02-17 13:42:40 -------- d-----w- c:\users\6dfe~1\appdata\roaming\DriveHQ 2011-02-17 13:42:17 -------- d-----w- c:\program files\DriveHQ 2011-02-17 13:22:58 -------- d-----w- c:\program files\HTV 2011-02-16 19:15:34 -------- d-----w- c:\users\6dfe~1\appdata\roaming\PhotoScape 2011-02-16 15:17:11 -------- d-----w- c:\users\6dfe~1\appdata\roaming\Babylon 2011-02-16 15:17:11 -------- d-----w- c:\users\6dfe~1\appdata\local\Babylon 2011-02-16 15:17:11 -------- d-----w- c:\progra~2\Babylon 2011-02-16 14:01:27 -------- d-----w- c:\users\6dfe~1\appdata\local\COMODO 2011-02-16 13:29:50 431616 ----a-w- c:\windows\system32\temp.000 2011-02-16 13:29:50 203976 ----a-w- c:\windows\system32\RICHTX32.OCX 2011-02-16 13:29:50 1081616 ----a-w- c:\windows\system32\Mscomctl.ocx 2011-02-16 13:29:49 124688 ----a-w- c:\windows\system32\MSWINSCK.OCX 2011-02-16 13:29:49 -------- d-----w- c:\program files\common files\SocketSecure 2011-02-16 13:29:40 -------- d-----w- c:\program files\Socketsoft 2011-02-16 11:05:35 -------- d-----w- c:\users\даниел\VirtualBox VMs 2011-02-16 11:02:49 -------- d-----w- c:\users\даниел\.VirtualBox 2011-02-16 11:02:15 158736 ----a-w- c:\windows\system32\drivers\VBoxDrv.sys 2011-02-16 11:02:02 42960 ----a-w- c:\windows\system32\drivers\VBoxUSBMon.sys 2011-02-16 11:01:59 -------- d-----w- c:\program files\Oracle 2011-02-14 11:48:00 -------- d-----w- c:\users\6dfe~1\appdata\local\Readon_Technology 2011-02-14 11:47:45 -------- d-----w- c:\program files\Readon Technology 2011-02-14 11:15:29 -------- d-----w- c:\users\даниел\AbiSuite 2011-02-14 11:13:47 -------- d-----w- c:\program files\AbiWord 2011-02-11 09:13:17 -------- d-----w- c:\program files\Belltech Business Card Designer Pro 2011-02-11 06:09:31 -------- d-----w- c:\program files\uTorrent 2011-02-09 02:33:59 3957120 ----a-w- c:\windows\system32\ntkrnlpa.exe 2011-02-07 15:22:14 -------- d-----w- c:\progra~2\boost_interprocess 2011-02-07 15:21:33 -------- d-----w- c:\users\6dfe~1\appdata\roaming\CometPlayer 2011-02-07 15:21:32 -------- d-----w- c:\users\6dfe~1\appdata\roaming\tigerplayer 2011-02-07 15:21:32 -------- d-----w- c:\program files\MpcStar 2011-02-06 10:08:48 -------- d-----w- c:\program files\Difference World 2011-02-06 09:13:51 -------- d-----w- c:\progra~2\Test Drive Unlimited 2011-02-05 17:34:49 -------- d-----w- c:\program files\SopCast 2011-02-05 14:40:00 -------- d-----w- c:\program files\Euro Truck Simulator 2011-02-04 15:52:00 -------- d-----w- c:\users\6dfe~1\appdata\roaming\HideIPEasy 2011-02-04 15:52:00 -------- d-----w- c:\progra~2\HideIPEasy 2011-02-04 15:51:56 -------- d-----w- c:\program files\HideIPEasy 2011-02-04 15:50:47 -------- d-----w- c:\users\6dfe~1\appdata\roaming\C__Users_Даниел_AppData_Local_Temp_ir_ext_temp_0_AutoPlay_Docs_Crack_HideIPEasy.exe 2011-02-04 15:50:47 -------- d-----w- c:\progra~2\C__Users_Даниел_AppData_Local_Temp_ir_ext_temp_0_AutoPlay_Docs_Crack_HideIPEasy.exe 2011-02-04 12:23:27 -------- d-----w- c:\program files\Easy-Hide-IP 2011-02-03 13:18:20 -------- d-----w- c:\users\6dfe~1\appdata\roaming\RealHideIP 2011-02-03 13:18:20 -------- d-----w- c:\progra~2\RealHideIP 2011-02-03 13:17:06 -------- d-----w- c:\program files\RealHideIP 2011-02-03 13:07:56 -------- d-----w- c:\users\6dfe~1\appdata\roaming\Hide IP NG 2011-02-03 13:04:20 -------- d-----w- c:\users\6dfe~1\appdata\roaming\HideIP 2011-02-01 14:02:29 -------- d-----w- c:\progra~2\IObit 2011-02-01 14:02:28 -------- d-----w- c:\program files\IObit 2011-02-01 13:50:51 -------- d-----w- c:\program files\18 WoS Extreme Trucker 2 2011-01-31 18:03:15 24621 ----a-w- c:\program files\mozilla firefox\plugins\nprjplug.dll 2011-01-31 18:03:14 -------- d-----w- c:\program files\common files\xing shared 2011-01-31 18:03:09 139305 ----a-w- c:\program files\mozilla firefox\plugins\nppl3260.dll 2011-01-31 18:03:07 81967 ----a-w- c:\program files\mozilla firefox\plugins\nprpjplug.dll 2011-01-31 18:03:01 -------- d-----w- c:\program files\common files\Real 2011-01-31 18:01:35 569397 ----a-w- c:\program files\internet explorer\plugins\richfx\player\nprfxins.dll 2011-01-31 16:46:49 -------- d-----w- c:\program files\18 Wheels of Steel Haulin 2011-01-31 16:27:50 -------- d-----w- c:\program files\ WWW.ELIT-BG 2011-01-30 18:33:43 -------- d-----w- c:\users\6dfe~1\appdata\roaming\uTorrent 2011-01-24 14:54:43 -------- d-----w- c:\progra~2\Xfire 2011-01-24 14:20:10 98304 ----a-w- c:\windows\system32\CmdLineExt.dll 2011-01-24 14:13:16 -------- d-----w- c:\users\6dfe~1\appdata\roaming\Xfire 2011-01-24 14:13:15 -------- d-s---w- c:\program files\Xfire 2011-01-24 14:06:05 753664 ----a-w- c:\program files\common files\installshield\professional\runtime\11\00\intel32\iKernel.dll 2011-01-24 14:06:05 69714 ----a-w- c:\program files\common files\installshield\professional\runtime\11\00\intel32\ctor.dll 2011-01-24 14:06:05 5632 ----a-w- c:\program files\common files\installshield\professional\runtime\11\00\intel32\DotNetInstaller.exe 2011-01-24 14:06:05 32768 ----a-w- c:\program files\common files\installshield\professional\runtime\Objectps.dll 2011-01-24 14:06:05 274432 ----a-w- c:\program files\common files\installshield\professional\runtime\11\00\intel32\iscript.dll 2011-01-24 14:06:05 184320 ----a-w- c:\program files\common files\installshield\professional\runtime\11\00\intel32\iuser.dll 2011-01-24 14:06:00 331908 ----a-w- c:\program files\common files\installshield\professional\runtime\11\00\intel32\setup.dll 2011-01-24 14:06:00 200836 ----a-w- c:\program files\common files\installshield\professional\runtime\11\00\intel32\iGdi.dll 2011-01-24 14:05:50 331908 ----a-w- c:\program files\common files\installshield\professional\runtime\11\00\intel32\ispcf74.tmp\setup.dll 2011-01-24 13:05:25 -------- d-----w- c:\users\6dfe~1\appdata\local\LucasArts 2011-01-24 08:30:01 453456 ----a-w- c:\windows\system32\d3dx10_41.dll 2011-01-24 08:30:01 4178264 ----a-w- c:\windows\system32\D3DX9_41.dll 2011-01-24 08:30:01 1846632 ----a-w- c:\windows\system32\D3DCompiler_41.dll 2011-01-24 08:30:00 70992 ----a-w- c:\windows\system32\XAPOFX1_2.dll 2011-01-24 08:30:00 69448 ----a-w- c:\windows\system32\XAPOFX1_3.dll 2011-01-24 08:30:00 517448 ----a-w- c:\windows\system32\XAudio2_4.dll 2011-01-24 08:30:00 514384 ----a-w- c:\windows\system32\XAudio2_3.dll 2011-01-24 08:30:00 452440 ----a-w- c:\windows\system32\d3dx10_40.dll 2011-01-24 08:30:00 4379984 ----a-w- c:\windows\system32\D3DX9_40.dll 2011-01-24 08:30:00 235352 ----a-w- c:\windows\system32\xactengine3_4.dll 2011-01-24 08:30:00 22360 ----a-w- c:\windows\system32\X3DAudio1_6.dll 2011-01-24 08:30:00 2036576 ----a-w- c:\windows\system32\D3DCompiler_40.dll 2011-01-24 08:06:48 218688 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys 2011-01-24 08:06:25 -------- d-----w- c:\program files\DAEMON Tools Lite 2011-01-23 18:36:38 697328 ----a-w- c:\windows\system32\drivers\sptd.sys 2011-01-23 17:26:58 -------- d-----w- c:\users\6dfe~1\appdata\roaming\goalbit 2011-01-23 17:26:13 -------- d-----w- c:\program files\InhatchTeam 2011-01-23 15:52:52 -------- d-----w- c:\users\6dfe~1\appdata\roaming\FlashGet 2011-01-23 15:52:47 -------- d-----w- c:\program files\FlashGet 2011-01-23 15:17:53 -------- d-----w- c:\users\6dfe~1\appdata\local\pLan 2011-01-23 14:38:32 -------- d-----w- c:\users\6dfe~1\appdata\local\TechSmith 2011-01-23 14:38:16 107864 ----a-w- c:\windows\system32\tsccvid.dll 2011-01-23 14:38:15 -------- d-----w- c:\windows\system32\QuickTime 2011-01-23 14:37:56 -------- d-----w- c:\program files\common files\TechSmith Shared 2011-01-22 17:36:48 -------- d-----w- c:\progra~2\Blumentals 2011-01-22 07:36:53 -------- d-----w- c:\program files\Easy GIF Animator 2011-01-21 13:27:13 -------- d-----w- c:\users\6dfe~1\appdata\roaming\Web Page Maker 2011-01-21 13:27:13 -------- d-----w- c:\program files\Web Page Maker ==================== Find3M ==================== 2011-01-18 15:43:24 133648 ----a-w- c:\windows\system32\VBoxNetFltNotify.dll 2011-01-17 15:42:59 249856 ----a-w- c:\windows\system32\uxtheme.dll 2011-01-17 15:42:56 2755072 ----a-w- c:\windows\system32\themeui.dll 2011-01-17 15:42:54 37376 ----a-w- c:\windows\system32\themeservice.dll 2011-01-17 14:48:56 1060864 ----a-w- c:\windows\system32\mfc71.dll 2011-01-17 12:06:08 811520 ----a-w- c:\windows\system32\user32.dll 2011-01-07 07:27:11 34304 ----a-w- c:\windows\system32\atmlib.dll 2011-01-07 05:33:11 294400 ----a-w- c:\windows\system32\atmfd.dll 2011-01-05 05:37:33 428032 ----a-w- c:\windows\system32\vbscript.dll 2011-01-05 03:37:38 2329088 ----a-w- c:\windows\system32\win32k.sys 2010-12-28 23:42:04 285480 ----a-w- c:\windows\system32\guard32.dll 2010-12-21 05:38:24 73728 ----a-w- c:\windows\system32\wscsvc.dll 2010-12-21 05:38:24 51200 ----a-w- c:\windows\system32\wscapi.dll 2010-12-21 05:38:22 981504 ----a-w- c:\windows\system32\wininet.dll 2010-12-21 05:38:22 350720 ----a-w- c:\windows\system32\winhttp.dll 2010-12-21 05:38:21 204800 ----a-w- c:\windows\system32\WebClnt.dll 2010-12-21 05:38:19 204288 ----a-w- c:\windows\system32\upnp.dll 2010-12-21 05:38:16 14336 ----a-w- c:\windows\system32\slwga.dll 2010-12-21 05:36:17 1389568 ----a-w- c:\windows\system32\msxml6.dll 2010-12-21 05:36:16 1236992 ----a-w- c:\windows\system32\msxml3.dll 2010-12-21 05:34:12 80384 ----a-w- c:\windows\system32\davclnt.dll 2010-12-18 05:29:40 44544 ----a-w- c:\windows\system32\licmgr10.dll 2010-12-18 05:29:31 541184 ----a-w- c:\windows\system32\kerberos.dll 2010-12-18 04:20:55 386048 ----a-w- c:\windows\system32\html.iec 2010-12-18 03:47:59 1638912 ----a-w- c:\windows\system32\mshtml.tlb ============= FINISH: 8:16:40,55 =============== Имам съмние че харда ми се пълни сам.Вчера имах 60 гб днес 54 гб .Не съм инсталирал нищо от тогава.

20 февруари 201115 г.

По отношение на keylogger, който предполагаш, че имаш. Как предполагаш, че някой просто го е сложил на компютъра ти? Дори да го нямаш в чистата му форма, то от лог файла на MBAM се виждат веднага следните неща:

аразени файлове:

c:\Users\Даниел\Desktop\revouninprosetup.exe (Trojan.Agent.CK) -> Quarantined and deleted successfully.

c:\Users\Даниел\Desktop\freezer v1.0 repack\groundzero's facebook freezer.exe (HackTool.Agent) -> Quarantined and deleted successfully.

c:\program files\realhideip\Patch.exe (RiskWare.Tool.CK) -> Quarantined and deleted successfully.

d:\папка на дани\windows loader.exe (RiskWare.Tool.CK) -> Quarantined and deleted successfully.

d:\папка на дани\removewat.exe (HackTool.Wpakill) -> Quarantined and deleted successfully.

d:\папка на дани\easy gif animator pro 5.1.0.44\easy gif animator pro 5.1.0.44\български интерфейс за easy gif animator pro 5 +\български интерфейс за easy gif animator pro 5 +.exe (Trojan.Spambot) -> Quarantined and deleted successfully.

d:\папка на дани\techsmith camtasia studio v5.1.0 build 505\keygen\keygen.exe (Backdoor.RBot) -> Quarantined and deleted successfully.

d:\папка на дани\real hide ip v4.0.7.8 + portable\real hide ip v4.0.7.8\Patch.exe (RiskWare.Tool.CK) -> Quarantined and deleted successfully.

Целият този открит зловреден код води до изтичане на информация, до взлом в системата, това се дължи на използването на пиратски софтуер. Нито е качествен, нито е сигурен, просто няма смисъл от него, има си достатъчно безплатни алтернативи, кой от кой по-хубав, а в краен случай просто си купуваш, това което ти трябва.

След като приключим работа, моля да си смениш абсолютно всички пароли и да преосмислиш пиратската си дейност.

Сега:

Изтеглете ComboFix от някой от следните линкове:

Линк 1

Линк 2

* ВАЖНО !!! Запазете ComboFix.exe на вашия десктоп

Изключете вашата антивирусна и антишпионска програма, обикновено това става чрез натискане на десния бутон на мишката върху иконата на програма в системния трей.

Бележка: Ако не можете я спрете или не сте сигурни коя програма да изключите, моля прегледайте информацията от този линк: How to Disable your Security Programs

Преименувайте ComboFix.exe на Tool.exe

Стартирайте Tool.exe и следвайте инструкциите.

Бележка: ComboFix ще се стартира без инсталирана Recovery Console.

Като част от неговата работа, ComboFix ще провери дали Microsoft Windows Recovery Console е инсталирана. Предвид бързо развиващия се зловреден софтуер е силно препоръчително да бъде инсталирана преди премахването на зловредния софтуер. Това ще Ви позволи да влезете в специален recovery/repair режим, който ще ни позволи по-лесно да решите проблем, който би могъл да възникне при премахване на зловредния софтуер.

Следвайте инструкциите, за да позволите на ComboFix да изтегли и инсталира Microsoft Windows Recovery Console. В един момент ще бъдете попитани дали сте съгласни с лицензното споразумение. Необходимо е да потвърдите, че сте съгласни, за да инсталирате Microsoft Windows Recovery Console.

** Забележете: Ако Microsoft Windows Recovery Console е вече инсталирана, ComboFix ще продължи към процеса по премахване на зловредния софтуер.

Публикувано изображение

След като Microsoft Windows Recovery Console е инсталирана, използвайки ComboFix, Вие ще видите следното съобщение:

Публикувано изображение

Изберете Yes, за да продължи сканирането за зловреден софтуер.

Когато процесът приключи успешно, инструментът ще създаде лог файл. Моля, включете съдържанието на C:\ComboFix.txt в следващия Ви коментар в тази тема.

Бележка:

Моля, не движете мишката, докато ComboFix работи. Това може да наруши процеса на работа.
ComboFix ще нулира всички настройки на Microsoft Internet Explorer, включително да направи IE браузър по подразбиране.
ComboFix ще изключи autorun функцията на ВСИЧКИ CD, Floppy и USB устройства, за да помогне при премахването на зловредния софтуер и Ви защити от бъдещи вируси/заплахи, които поразяват чрез autorun. Ако това е проблем за вас - моля, уведомете ме.
ComboFix ще изключи вашата интернет връзка. Интернет връзката ще се възстанови автоматично, преди ComboFix да завърши процеса на работа. При проблем, той ще прекрати интернет връзката. За да възстановите интернет връзката си, рестартирайте компютъра си.
В случай на проблем с ComboFix, той може да създаде лог файл. Моля, включете съдържанието на C:\BUG.txt в следващия Ви коментар в тази тема.

Работата на ComboFix, може да отнеме до 20-30 минути, за да завърши, моля имайте търпение.

Моля, не прикачвайте лог файла/овете от програмата, а го/ги копирайте и поставете в следващия Ви коментар в тази тема.

20 февруари 201115 г.

Автор

Няма bug има log ComboFix 11-02-19.02 - Даниел 02.2011 г. 15:15:03.1.2 - x86 Microsoft Windows 7 Ultimate 6.1.7600.0.1251.359.1033.18.3071.1820 [GMT 2:00] Running from: c:\users\Даниел\Desktop\Tool.exe AV: COMODO Antivirus *Disabled/Updated* {675CEE69-9702-A524-3989-6D7CC8BF3695} FW: COMODO Firewall *Disabled* {5F676F4C-DD6D-A47C-12D6-C449366C71EE} SP: COMODO Defense+ *Disabled/Updated* {DC3D0F8D-B138-AAAA-0339-560EB3387C28} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\program files\HTV c:\program files\HTV\akv.cfg c:\program files\HTV\HTV.001 c:\program files\HTV\HTV.002 c:\program files\HTV\HTV.005 c:\program files\HTV\HTV.006 c:\program files\HTV\HTV.009 c:\program files\HTV\test D:\install.exe . ((((((((((((((((((((((((( Files Created from 2011-01-20 to 2011-02-20 ))))))))))))))))))))))))))))))) . 2011-02-20 13:13 . 2011-02-20 13:14 -------- d-----w- C:\32788R22FWJFW 2011-02-20 12:15 . 2011-02-20 12:18 -------- d-----w- c:\users\Даниел\AppData\Local\360Amigo 2011-02-20 12:15 . 2011-02-20 12:19 -------- d-----w- c:\program files\360Amigo 2011-02-19 09:02 . 2011-02-19 09:02 49152 ----a-r- c:\users\Даниел\AppData\Roaming\Microsoft\Installer\{C37A0BC1-52EE-4F97-8223-5CA9FC0357B0}\ARPPRODUCTICON.exe 2011-02-19 08:57 . 2011-02-19 08:57 -------- d-----w- c:\program files\Atari 2011-02-18 12:57 . 2011-02-18 12:57 -------- d-----w- c:\users\Даниел\AppData\Roaming\Malwarebytes 2011-02-18 12:57 . 2011-02-18 12:57 -------- d-----w- c:\programdata\Malwarebytes 2011-02-18 12:57 . 2010-12-20 16:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2011-02-18 12:57 . 2011-02-18 12:57 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2011-02-18 12:57 . 2010-12-20 16:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys 2011-02-18 12:40 . 2011-02-18 13:03 -------- d-----w- c:\program files\AntiLogger 2011-02-18 10:35 . 2011-02-18 10:35 -------- d-----w- c:\program files\Havij 2011-02-18 10:35 . 2000-05-21 22:00 140488 ----a-w- c:\windows\system32\comdlg32.ocx 2011-02-17 13:42 . 2011-02-17 13:42 -------- d-----w- c:\users\Даниел\AppData\Roaming\DriveHQ 2011-02-17 13:42 . 2011-02-17 13:42 -------- d-----w- c:\program files\DriveHQ 2011-02-16 19:15 . 2011-02-16 19:19 -------- d-----w- c:\users\Даниел\AppData\Roaming\PhotoScape 2011-02-16 15:17 . 2011-02-16 15:17 -------- d-----w- c:\users\Даниел\AppData\Roaming\Babylon 2011-02-16 15:17 . 2011-02-16 15:17 -------- d-----w- c:\users\Даниел\AppData\Local\Babylon 2011-02-16 15:17 . 2011-02-16 15:17 -------- d-----w- c:\programdata\Babylon 2011-02-16 14:01 . 2011-02-16 14:01 -------- d-----w- c:\users\Даниел\AppData\Local\COMODO 2011-02-16 13:29 . 2004-08-04 01:56 431616 ----a-w- c:\windows\system32\temp.000 2011-02-16 13:29 . 2004-03-08 22:30 1081616 ----a-w- c:\windows\system32\Mscomctl.ocx 2011-02-16 13:29 . 2000-05-21 22:00 203976 ----a-w- c:\windows\system32\RICHTX32.OCX 2011-02-16 13:29 . 2011-02-16 13:29 -------- d-----w- c:\program files\Common Files\SocketSecure 2011-02-16 13:29 . 2004-03-08 21:00 124688 ----a-w- c:\windows\system32\MSWINSCK.OCX 2011-02-16 13:29 . 2011-02-16 13:29 -------- d-----w- c:\program files\Socketsoft 2011-02-16 11:05 . 2011-02-17 12:49 -------- d-----w- c:\users\Даниел\VirtualBox VMs 2011-02-16 11:02 . 2011-02-18 06:49 -------- d-----w- c:\users\Даниел\.VirtualBox 2011-02-16 11:02 . 2011-01-18 15:43 158736 ----a-w- c:\windows\system32\drivers\VBoxDrv.sys 2011-02-16 11:02 . 2011-02-16 11:02 -------- dc----w- c:\windows\system32\DRVSTORE 2011-02-16 11:02 . 2011-01-18 15:43 42960 ----a-w- c:\windows\system32\drivers\VBoxUSBMon.sys 2011-02-16 11:01 . 2011-02-16 11:01 -------- d-----w- c:\program files\Oracle 2011-02-14 11:48 . 2011-02-14 11:48 -------- d-----w- c:\users\Даниел\AppData\Local\Readon_Technology 2011-02-14 11:47 . 2011-02-14 11:47 -------- d-----w- c:\program files\Readon Technology 2011-02-14 11:15 . 2011-02-14 11:15 -------- d-----w- c:\users\Даниел\AbiSuite 2011-02-14 11:13 . 2011-02-14 11:14 -------- d-----w- c:\program files\AbiWord 2011-02-11 09:13 . 2011-02-11 09:13 -------- d-----w- c:\program files\Belltech Business Card Designer Pro 2011-02-11 06:09 . 2011-02-11 16:46 -------- d-----w- c:\program files\uTorrent 2011-02-09 02:33 . 2010-10-27 04:43 3901824 ----a-w- c:\windows\system32\ntoskrnl.exe 2011-02-07 15:22 . 2011-02-10 12:38 -------- d-----w- c:\programdata\boost_interprocess 2011-02-07 15:21 . 2011-02-07 15:21 -------- d-----w- c:\users\Даниел\AppData\Roaming\CometPlayer 2011-02-07 15:21 . 2011-02-07 15:23 -------- d-----w- c:\users\Даниел\AppData\Roaming\tigerplayer 2011-02-07 15:21 . 2011-02-07 15:21 -------- d-----w- c:\program files\MpcStar 2011-02-07 07:56 . 2011-02-07 07:56 -------- d-----w- c:\program files\Microsoft.NET 2011-02-06 10:08 . 2011-02-06 10:08 -------- d-----w- c:\program files\Difference World 2011-02-06 09:15 . 2011-02-06 09:15 -------- d--h--r- c:\users\Даниел\AppData\Roaming\SecuROM 2011-02-06 09:13 . 2011-02-20 12:52 -------- d-----w- c:\programdata\Test Drive Unlimited 2011-02-05 17:34 . 2011-02-06 13:12 -------- d-----w- c:\program files\SopCast 2011-02-05 14:40 . 2011-02-05 14:40 -------- d-----w- c:\program files\Euro Truck Simulator 2011-02-04 15:52 . 2011-02-04 15:52 -------- d-----w- c:\programdata\HideIPEasy 2011-02-04 15:51 . 2011-02-04 15:51 -------- d-----w- c:\program files\HideIPEasy 2011-02-04 15:50 . 2011-02-04 15:50 -------- d-----w- c:\users\Даниел\AppData\Roaming\C__Users_Даниел_AppData_Local_Temp_ir_ext_temp_0_AutoPlay_Docs_Crack_HideIPEasy.exe 2011-02-04 15:50 . 2011-02-04 15:50 -------- d-----w- c:\programdata\C__Users_Даниел_AppData_Local_Temp_ir_ext_temp_0_AutoPlay_Docs_Crack_HideIPEasy.exe 2011-02-04 12:23 . 2011-02-04 12:23 -------- d-----w- c:\program files\Easy-Hide-IP 2011-02-03 13:18 . 2011-02-03 13:18 -------- d-----w- c:\programdata\RealHideIP 2011-02-03 13:07 . 2011-02-03 13:15 -------- d-----w- c:\users\Даниел\AppData\Roaming\Hide IP NG 2011-02-03 13:04 . 2011-02-03 14:45 -------- d-----w- c:\users\Даниел\AppData\Roaming\HideIP 2011-02-01 15:55 . 2011-02-01 15:55 -------- d-----w- c:\users\7B82~1 2011-02-01 14:02 . 2011-02-01 14:02 -------- d-----w- c:\programdata\IObit 2011-02-01 14:02 . 2011-02-01 14:02 -------- d-----w- c:\program files\IObit 2011-02-01 13:50 . 2011-02-01 13:51 -------- d-----w- c:\program files\18 WoS Extreme Trucker 2 2011-01-31 18:03 . 2011-01-31 18:03 24621 ----a-w- c:\program files\Mozilla Firefox\plugins\nprjplug.dll 2011-01-31 18:03 . 2011-01-31 18:03 -------- d-----w- c:\program files\Common Files\xing shared 2011-01-31 18:03 . 2011-01-31 18:03 139305 ----a-w- c:\program files\Mozilla Firefox\plugins\nppl3260.dll 2011-01-31 18:03 . 2011-01-31 18:03 81967 ----a-w- c:\program files\Mozilla Firefox\plugins\nprpjplug.dll 2011-01-31 18:03 . 2011-01-31 18:03 -------- d-----w- c:\program files\Common Files\Real 2011-01-31 18:03 . 2011-01-31 18:03 -------- d-----w- c:\program files\Real 2011-01-31 18:02 . 2011-01-31 18:05 -------- d-----w- c:\users\Даниел\AppData\Roaming\Real 2011-01-31 18:01 . 2011-01-31 18:01 569397 ----a-w- c:\program files\Internet Explorer\PLUGINS\RichFX\Player\nprfxins.dll 2011-01-31 16:46 . 2011-01-31 16:46 -------- d-----w- c:\program files\18 Wheels of Steel Haulin 2011-01-31 16:27 . 2011-01-31 16:27 -------- d-----w- c:\program files\ WWW.ELIT-BG 2011-01-30 18:33 . 2011-02-20 13:14 -------- d-----w- c:\users\Даниел\AppData\Roaming\uTorrent 2011-01-24 14:54 . 2011-02-20 07:16 -------- d-----w- c:\programdata\Xfire 2011-01-24 14:20 . 2011-01-24 14:20 98304 ----a-w- c:\windows\system32\CmdLineExt.dll 2011-01-24 14:13 . 2011-01-24 17:09 -------- d-----w- c:\users\Даниел\AppData\Roaming\Xfire 2011-01-24 14:13 . 2011-01-25 04:54 -------- d-s---w- c:\program files\Xfire 2011-01-24 14:06 . 2005-04-03 21:02 753664 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iKernel.dll 2011-01-24 14:06 . 2005-04-03 21:02 69714 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\ctor.dll 2011-01-24 14:06 . 2005-04-03 21:01 274432 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iscript.dll 2011-01-24 14:06 . 2005-04-03 21:00 184320 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iuser.dll 2011-01-24 14:06 . 2005-04-03 20:59 5632 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\DotNetInstaller.exe 2011-01-24 14:06 . 2005-04-03 20:57 32768 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\Objectps.dll 2011-01-24 14:06 . 2011-01-24 14:06 331908 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\setup.dll 2011-01-24 14:06 . 2011-01-24 14:06 200836 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iGdi.dll 2011-01-24 14:05 . 2011-01-24 14:05 331908 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\ispCF74.tmp\setup.dll 2011-01-24 13:05 . 2011-01-24 13:05 -------- d-----w- c:\users\Даниел\AppData\Local\LucasArts 2011-01-24 08:30 . 2009-03-09 13:27 453456 ----a-w- c:\windows\system32\d3dx10_41.dll 2011-01-24 08:30 . 2009-03-09 13:27 4178264 ----a-w- c:\windows\system32\D3DX9_41.dll 2011-01-24 08:30 . 2009-03-09 13:27 1846632 ----a-w- c:\windows\system32\D3DCompiler_41.dll 2011-01-24 08:30 . 2009-03-16 12:18 69448 ----a-w- c:\windows\system32\XAPOFX1_3.dll 2011-01-24 08:30 . 2009-03-16 12:18 517448 ----a-w- c:\windows\system32\XAudio2_4.dll 2011-01-24 08:30 . 2009-03-16 12:18 235352 ----a-w- c:\windows\system32\xactengine3_4.dll 2011-01-24 08:30 . 2009-03-16 12:18 22360 ----a-w- c:\windows\system32\X3DAudio1_6.dll 2011-01-24 08:30 . 2008-10-15 05:03 70992 ----a-w- c:\windows\system32\XAPOFX1_2.dll 2011-01-24 08:30 . 2008-10-15 05:03 514384 ----a-w- c:\windows\system32\XAudio2_3.dll 2011-01-24 08:30 . 2008-10-15 04:22 452440 ----a-w- c:\windows\system32\d3dx10_40.dll 2011-01-24 08:30 . 2008-10-15 04:22 4379984 ----a-w- c:\windows\system32\D3DX9_40.dll 2011-01-24 08:30 . 2008-10-15 04:22 2036576 ----a-w- c:\windows\system32\D3DCompiler_40.dll 2011-01-24 08:06 . 2011-01-24 08:06 218688 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys 2011-01-24 08:06 . 2011-01-24 08:07 -------- d-----w- c:\program files\DAEMON Tools Lite 2011-01-23 18:36 . 2011-01-24 07:59 697328 ----a-w- c:\windows\system32\drivers\sptd.sys 2011-01-23 17:26 . 2011-02-17 19:32 -------- d-----w- c:\users\Даниел\AppData\Roaming\goalbit 2011-01-23 17:26 . 2011-01-23 17:26 -------- d-----w- c:\program files\InhatchTeam 2011-01-23 15:52 . 2011-01-23 15:52 -------- d-----w- c:\users\Даниел\AppData\Roaming\FlashGet 2011-01-23 15:52 . 2011-02-19 16:31 -------- d-----w- c:\program files\FlashGet 2011-01-23 15:17 . 2011-01-23 15:18 -------- d-----w- c:\users\Даниел\AppData\Local\pLan 2011-01-23 14:38 . 2011-01-23 14:38 -------- d-----w- c:\users\Даниел\AppData\Local\TechSmith 2011-01-23 14:38 . 2008-03-12 00:37 107864 ----a-w- c:\windows\system32\tsccvid.dll 2011-01-23 14:38 . 2011-01-23 14:38 -------- d-----w- c:\windows\system32\QuickTime 2011-01-23 14:38 . 2011-01-23 14:38 -------- d-----w- c:\programdata\TechSmith 2011-01-23 14:37 . 2011-01-23 14:37 -------- d-----w- c:\program files\TechSmith 2011-01-23 14:37 . 2011-01-23 14:37 -------- d-----w- c:\program files\Common Files\TechSmith Shared 2011-01-22 17:36 . 2011-01-22 17:36 -------- d-----w- c:\programdata\Blumentals 2011-01-22 07:36 . 2011-01-22 19:44 -------- d-----w- c:\program files\Easy GIF Animator 2011-01-21 13:27 . 2011-01-21 13:27 -------- d-----w- c:\users\Даниел\AppData\Roaming\Web Page Maker 2011-01-21 13:27 . 2011-01-21 13:27 -------- d-----w- c:\program files\Web Page Maker . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-02-19 09:02 . 2011-02-19 09:02 49152 ----a-r- c:\users\Даниел\AppData\Roaming\Microsoft\Installer\{C37A0BC1-52EE-4F97-8223-5CA9FC0357B0}\ARPPRODUCTICON.exe 2011-02-19 09:02 . 2011-02-19 09:02 49152 ----a-r- c:\users\Даниел\AppData\Roaming\Microsoft\Installer\{C37A0BC1-52EE-4F97-8223-5CA9FC0357B0}\ARPPRODUCTICON.exe 2011-01-18 15:43 . 2011-01-18 15:43 109328 ----a-w- c:\windows\system32\drivers\VBoxNetAdp.sys 2011-01-18 15:43 . 2011-01-18 15:43 133648 ----a-w- c:\windows\system32\VBoxNetFltNotify.dll 2011-01-18 15:43 . 2011-01-18 15:43 120208 ----a-w- c:\windows\system32\drivers\VBoxNetFlt.sys 2011-01-17 15:42 . 2009-07-13 23:40 249856 ----a-w- c:\windows\system32\uxtheme.dll 2011-01-17 15:42 . 2009-07-13 23:39 2755072 ----a-w- c:\windows\system32\themeui.dll 2011-01-17 15:42 . 2009-07-13 23:39 37376 ----a-w- c:\windows\system32\themeservice.dll 2011-01-17 14:48 . 2011-01-17 14:48 1060864 ----a-w- c:\windows\system32\mfc71.dll 2011-01-17 12:06 . 2009-07-13 23:24 811520 ----a-w- c:\windows\system32\user32.dll 2011-01-06 15:36 . 2011-01-06 15:36 80064 ----a-w- c:\windows\system32\drivers\inspect.sys 2011-01-06 15:36 . 2011-01-06 15:36 35768 ----a-w- c:\windows\system32\drivers\cmdhlp.sys 2011-01-06 15:36 . 2011-01-06 15:36 236600 ----a-w- c:\windows\system32\drivers\cmdGuard.sys 2011-01-06 15:36 . 2011-01-06 15:36 17256 ----a-w- c:\windows\system32\drivers\cmderd.sys 2010-12-28 23:42 . 2010-12-28 23:42 285480 ----a-w- c:\windows\system32\guard32.dll . ------- Sigcheck ------- [-] 2011-01-17 . 7BD7F45FF37FA0669CD32CA0EF46E22C . 811520 . . [6.1.7600.16385] . . c:\windows\System32\user32.dll [7] 2009-07-14 . 34B7E222E81FAFA885F0C5F2CFA56861 . 811520 . . [6.1.7600.16385] . . c:\windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}] 2010-09-28 20:44 1400712 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-09-28 1400712] [HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1] [HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] "{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-09-28 1400712] [HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1] [HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2011-01-20 1305408] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1173504] "uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2011-02-11 396664] "360Amigo"="c:\program files\360Amigo\360Amigo.exe" [2011-02-20 4807240] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cfp.exe" [2011-01-19 2548552] "HDAudDeck"="c:\program files\VIA\VIAudioi\VDeck\VDeck.exe" [2010-03-02 1778688] "WinampAgent"="c:\program files\Winamp\winampa.exe" [2010-12-09 74752] "AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712] "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2011-01-31 180269] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696] c:\users\„ ЁҐ«\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ uTorrent-v2.2.lnk - c:\program files\ WWW.ELIT-BG\uTorrent-v2.2.exe [2011-1-31 394616] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 0 (0x0) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=c:\windows\System32\guard32.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "aux2"=wdmaud.drv R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R3 BthAvrcp;Bluetooth AVRCP Profile;c:\windows\system32\DRIVERS\BthAvrcp.sys [2009-08-13 22528] R3 Revoflt;Revoflt;c:\windows\system32\DRIVERS\revoflt.sys [2009-12-30 27064] R3 WatAdminSvc;Услуга на технологиите за активиране на Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2011-01-17 1343400] S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2011-01-24 697328] S1 cmderd;COMODO Internet Security Eradication Driver;c:\windows\system32\DRIVERS\cmderd.sys [2011-01-06 17256] S1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\DRIVERS\cmdguard.sys [2011-01-06 236600] S1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\DRIVERS\cmdhlp.sys [2011-01-06 35768] S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2011-01-24 218688] S1 VBoxDrv;VirtualBox Service;c:\windows\system32\DRIVERS\VBoxDrv.sys [2011-01-18 158736] S1 VBoxUSBMon;VirtualBox USB Monitor Driver;c:\windows\system32\DRIVERS\VBoxUSBMon.sys [2011-01-18 42960] S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2010-04-03 240232] S3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\DRIVERS\VBoxNetAdp.sys [2011-01-18 109328] S3 VBoxNetFlt;VBoxNetFlt Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys [2011-01-18 120208] S3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [2010-03-02 1127936] . . ------- Supplementary Scan ------- . uStart Page = hxxp://google.bg/ uInternet Settings,ProxyServer = http=;ftp=;https=; IE: &Download All with FlashGet - c:\progra~1\FlashGet\jc_all.htm IE: &Download with FlashGet - c:\progra~1\FlashGet\jc_link.htm TCP: {AF700767-1490-408A-BE65-19B1001AE055} = 156.154.70.25,156.154.71.25 FF - ProfilePath - c:\users\Даниел\AppData\Roaming\Mozilla\Firefox\Profiles\qpnd7b5o.default\ FF - prefs.js: browser.search.selectedEngine - DAEMON Search FF - prefs.js: browser.startup.homepage - hxxp://www.google.bg/ FF - prefs.js: network.proxy.type - 0 FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} FF - Ext: PandoraTV Toolbar: [email protected] - %profile%\extensions\[email protected] FF - Ext: DAEMON Tools Toolbar: [email protected] - %profile%\extensions\[email protected] FF - Ext: Real Hide IP: [email protected] - %profile%\extensions\[email protected] FF - Ext: Hide IP Easy: [email protected] - %profile%\extensions\[email protected] FF - Ext: Tor-Proxy.NET Toolbar: {9815d32d-08c2-42ca-a8c6-43e501a4512f} - %profile%\extensions\{9815d32d-08c2-42ca-a8c6-43e501a4512f} FF - Ext: Easy-Hide-IP Firefox Plugin: [email protected] - c:\program files\Easy-Hide-IP\ff-extension . - - - - ORPHANS REMOVED - - - - URLSearchHooks-{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - (no file) HKCU-Run-AdobeBridge - (no file) . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(620) c:\windows\system32\guard32.dll - - - - - - - > 'lsass.exe'(552) c:\windows\system32\guard32.dll . Completion time: 2011-02-20 15:19:43 ComboFix-quarantined-files.txt 2011-02-20 13:19 Pre-Run: 58 307 461 120 bytes free Post-Run: 58 536 275 968 bytes free - - End Of File - - F7421182929A2D747989CAAFCD6DD417 Ето от ComboFix ComboFix 11-02-19.02 - Даниел 02.2011 г. 15:15:03.1.2 - x86 Microsoft Windows 7 Ultimate 6.1.7600.0.1251.359.1033.18.3071.1820 [GMT 2:00] Running from: c:\users\Даниел\Desktop\Tool.exe AV: COMODO Antivirus *Disabled/Updated* {675CEE69-9702-A524-3989-6D7CC8BF3695} FW: COMODO Firewall *Disabled* {5F676F4C-DD6D-A47C-12D6-C449366C71EE} SP: COMODO Defense+ *Disabled/Updated* {DC3D0F8D-B138-AAAA-0339-560EB3387C28} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\program files\HTV c:\program files\HTV\akv.cfg c:\program files\HTV\HTV.001 c:\program files\HTV\HTV.002 c:\program files\HTV\HTV.005 c:\program files\HTV\HTV.006 c:\program files\HTV\HTV.009 c:\program files\HTV\test D:\install.exe . ((((((((((((((((((((((((( Files Created from 2011-01-20 to 2011-02-20 ))))))))))))))))))))))))))))))) . 2011-02-20 13:13 . 2011-02-20 13:14 -------- d-----w- C:\32788R22FWJFW 2011-02-20 12:15 . 2011-02-20 12:18 -------- d-----w- c:\users\Даниел\AppData\Local\360Amigo 2011-02-20 12:15 . 2011-02-20 12:19 -------- d-----w- c:\program files\360Amigo 2011-02-19 09:02 . 2011-02-19 09:02 49152 ----a-r- c:\users\Даниел\AppData\Roaming\Microsoft\Installer\{C37A0BC1-52EE-4F97-8223-5CA9FC0357B0}\ARPPRODUCTICON.exe 2011-02-19 08:57 . 2011-02-19 08:57 -------- d-----w- c:\program files\Atari 2011-02-18 12:57 . 2011-02-18 12:57 -------- d-----w- c:\users\Даниел\AppData\Roaming\Malwarebytes 2011-02-18 12:57 . 2011-02-18 12:57 -------- d-----w- c:\programdata\Malwarebytes 2011-02-18 12:57 . 2010-12-20 16:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2011-02-18 12:57 . 2011-02-18 12:57 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2011-02-18 12:57 . 2010-12-20 16:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys 2011-02-18 12:40 . 2011-02-18 13:03 -------- d-----w- c:\program files\AntiLogger 2011-02-18 10:35 . 2011-02-18 10:35 -------- d-----w- c:\program files\Havij 2011-02-18 10:35 . 2000-05-21 22:00 140488 ----a-w- c:\windows\system32\comdlg32.ocx 2011-02-17 13:42 . 2011-02-17 13:42 -------- d-----w- c:\users\Даниел\AppData\Roaming\DriveHQ 2011-02-17 13:42 . 2011-02-17 13:42 -------- d-----w- c:\program files\DriveHQ 2011-02-16 19:15 . 2011-02-16 19:19 -------- d-----w- c:\users\Даниел\AppData\Roaming\PhotoScape 2011-02-16 15:17 . 2011-02-16 15:17 -------- d-----w- c:\users\Даниел\AppData\Roaming\Babylon 2011-02-16 15:17 . 2011-02-16 15:17 -------- d-----w- c:\users\Даниел\AppData\Local\Babylon 2011-02-16 15:17 . 2011-02-16 15:17 -------- d-----w- c:\programdata\Babylon 2011-02-16 14:01 . 2011-02-16 14:01 -------- d-----w- c:\users\Даниел\AppData\Local\COMODO 2011-02-16 13:29 . 2004-08-04 01:56 431616 ----a-w- c:\windows\system32\temp.000 2011-02-16 13:29 . 2004-03-08 22:30 1081616 ----a-w- c:\windows\system32\Mscomctl.ocx 2011-02-16 13:29 . 2000-05-21 22:00 203976 ----a-w- c:\windows\system32\RICHTX32.OCX 2011-02-16 13:29 . 2011-02-16 13:29 -------- d-----w- c:\program files\Common Files\SocketSecure 2011-02-16 13:29 . 2004-03-08 21:00 124688 ----a-w- c:\windows\system32\MSWINSCK.OCX 2011-02-16 13:29 . 2011-02-16 13:29 -------- d-----w- c:\program files\Socketsoft 2011-02-16 11:05 . 2011-02-17 12:49 -------- d-----w- c:\users\Даниел\VirtualBox VMs 2011-02-16 11:02 . 2011-02-18 06:49 -------- d-----w- c:\users\Даниел\.VirtualBox 2011-02-16 11:02 . 2011-01-18 15:43 158736 ----a-w- c:\windows\system32\drivers\VBoxDrv.sys 2011-02-16 11:02 . 2011-02-16 11:02 -------- dc----w- c:\windows\system32\DRVSTORE 2011-02-16 11:02 . 2011-01-18 15:43 42960 ----a-w- c:\windows\system32\drivers\VBoxUSBMon.sys 2011-02-16 11:01 . 2011-02-16 11:01 -------- d-----w- c:\program files\Oracle 2011-02-14 11:48 . 2011-02-14 11:48 -------- d-----w- c:\users\Даниел\AppData\Local\Readon_Technology 2011-02-14 11:47 . 2011-02-14 11:47 -------- d-----w- c:\program files\Readon Technology 2011-02-14 11:15 . 2011-02-14 11:15 -------- d-----w- c:\users\Даниел\AbiSuite 2011-02-14 11:13 . 2011-02-14 11:14 -------- d-----w- c:\program files\AbiWord 2011-02-11 09:13 . 2011-02-11 09:13 -------- d-----w- c:\program files\Belltech Business Card Designer Pro 2011-02-11 06:09 . 2011-02-11 16:46 -------- d-----w- c:\program files\uTorrent 2011-02-09 02:33 . 2010-10-27 04:43 3901824 ----a-w- c:\windows\system32\ntoskrnl.exe 2011-02-07 15:22 . 2011-02-10 12:38 -------- d-----w- c:\programdata\boost_interprocess 2011-02-07 15:21 . 2011-02-07 15:21 -------- d-----w- c:\users\Даниел\AppData\Roaming\CometPlayer 2011-02-07 15:21 . 2011-02-07 15:23 -------- d-----w- c:\users\Даниел\AppData\Roaming\tigerplayer 2011-02-07 15:21 . 2011-02-07 15:21 -------- d-----w- c:\program files\MpcStar 2011-02-07 07:56 . 2011-02-07 07:56 -------- d-----w- c:\program files\Microsoft.NET 2011-02-06 10:08 . 2011-02-06 10:08 -------- d-----w- c:\program files\Difference World 2011-02-06 09:15 . 2011-02-06 09:15 -------- d--h--r- c:\users\Даниел\AppData\Roaming\SecuROM 2011-02-06 09:13 . 2011-02-20 12:52 -------- d-----w- c:\programdata\Test Drive Unlimited 2011-02-05 17:34 . 2011-02-06 13:12 -------- d-----w- c:\program files\SopCast 2011-02-05 14:40 . 2011-02-05 14:40 -------- d-----w- c:\program files\Euro Truck Simulator 2011-02-04 15:52 . 2011-02-04 15:52 -------- d-----w- c:\programdata\HideIPEasy 2011-02-04 15:51 . 2011-02-04 15:51 -------- d-----w- c:\program files\HideIPEasy 2011-02-04 15:50 . 2011-02-04 15:50 -------- d-----w- c:\users\Даниел\AppData\Roaming\C__Users_Даниел_AppData_Local_Temp_ir_ext_temp_0_AutoPlay_Docs_Crack_HideIPEasy.exe 2011-02-04 15:50 . 2011-02-04 15:50 -------- d-----w- c:\programdata\C__Users_Даниел_AppData_Local_Temp_ir_ext_temp_0_AutoPlay_Docs_Crack_HideIPEasy.exe 2011-02-04 12:23 . 2011-02-04 12:23 -------- d-----w- c:\program files\Easy-Hide-IP 2011-02-03 13:18 . 2011-02-03 13:18 -------- d-----w- c:\programdata\RealHideIP 2011-02-03 13:07 . 2011-02-03 13:15 -------- d-----w- c:\users\Даниел\AppData\Roaming\Hide IP NG 2011-02-03 13:04 . 2011-02-03 14:45 -------- d-----w- c:\users\Даниел\AppData\Roaming\HideIP 2011-02-01 15:55 . 2011-02-01 15:55 -------- d-----w- c:\users\7B82~1 2011-02-01 14:02 . 2011-02-01 14:02 -------- d-----w- c:\programdata\IObit 2011-02-01 14:02 . 2011-02-01 14:02 -------- d-----w- c:\program files\IObit 2011-02-01 13:50 . 2011-02-01 13:51 -------- d-----w- c:\program files\18 WoS Extreme Trucker 2 2011-01-31 18:03 . 2011-01-31 18:03 24621 ----a-w- c:\program files\Mozilla Firefox\plugins\nprjplug.dll 2011-01-31 18:03 . 2011-01-31 18:03 -------- d-----w- c:\program files\Common Files\xing shared 2011-01-31 18:03 . 2011-01-31 18:03 139305 ----a-w- c:\program files\Mozilla Firefox\plugins\nppl3260.dll 2011-01-31 18:03 . 2011-01-31 18:03 81967 ----a-w- c:\program files\Mozilla Firefox\plugins\nprpjplug.dll 2011-01-31 18:03 . 2011-01-31 18:03 -------- d-----w- c:\program files\Common Files\Real 2011-01-31 18:03 . 2011-01-31 18:03 -------- d-----w- c:\program files\Real 2011-01-31 18:02 . 2011-01-31 18:05 -------- d-----w- c:\users\Даниел\AppData\Roaming\Real 2011-01-31 18:01 . 2011-01-31 18:01 569397 ----a-w- c:\program files\Internet Explorer\PLUGINS\RichFX\Player\nprfxins.dll 2011-01-31 16:46 . 2011-01-31 16:46 -------- d-----w- c:\program files\18 Wheels of Steel Haulin 2011-01-31 16:27 . 2011-01-31 16:27 -------- d-----w- c:\program files\ WWW.ELIT-BG 2011-01-30 18:33 . 2011-02-20 13:14 -------- d-----w- c:\users\Даниел\AppData\Roaming\uTorrent 2011-01-24 14:54 . 2011-02-20 07:16 -------- d-----w- c:\programdata\Xfire 2011-01-24 14:20 . 2011-01-24 14:20 98304 ----a-w- c:\windows\system32\CmdLineExt.dll 2011-01-24 14:13 . 2011-01-24 17:09 -------- d-----w- c:\users\Даниел\AppData\Roaming\Xfire 2011-01-24 14:13 . 2011-01-25 04:54 -------- d-s---w- c:\program files\Xfire 2011-01-24 14:06 . 2005-04-03 21:02 753664 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iKernel.dll 2011-01-24 14:06 . 2005-04-03 21:02 69714 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\ctor.dll 2011-01-24 14:06 . 2005-04-03 21:01 274432 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iscript.dll 2011-01-24 14:06 . 2005-04-03 21:00 184320 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iuser.dll 2011-01-24 14:06 . 2005-04-03 20:59 5632 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\DotNetInstaller.exe 2011-01-24 14:06 . 2005-04-03 20:57 32768 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\Objectps.dll 2011-01-24 14:06 . 2011-01-24 14:06 331908 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\setup.dll 2011-01-24 14:06 . 2011-01-24 14:06 200836 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iGdi.dll 2011-01-24 14:05 . 2011-01-24 14:05 331908 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\ispCF74.tmp\setup.dll 2011-01-24 13:05 . 2011-01-24 13:05 -------- d-----w- c:\users\Даниел\AppData\Local\LucasArts 2011-01-24 08:30 . 2009-03-09 13:27 453456 ----a-w- c:\windows\system32\d3dx10_41.dll 2011-01-24 08:30 . 2009-03-09 13:27 4178264 ----a-w- c:\windows\system32\D3DX9_41.dll 2011-01-24 08:30 . 2009-03-09 13:27 1846632 ----a-w- c:\windows\system32\D3DCompiler_41.dll 2011-01-24 08:30 . 2009-03-16 12:18 69448 ----a-w- c:\windows\system32\XAPOFX1_3.dll 2011-01-24 08:30 . 2009-03-16 12:18 517448 ----a-w- c:\windows\system32\XAudio2_4.dll 2011-01-24 08:30 . 2009-03-16 12:18 235352 ----a-w- c:\windows\system32\xactengine3_4.dll 2011-01-24 08:30 . 2009-03-16 12:18 22360 ----a-w- c:\windows\system32\X3DAudio1_6.dll 2011-01-24 08:30 . 2008-10-15 05:03 70992 ----a-w- c:\windows\system32\XAPOFX1_2.dll 2011-01-24 08:30 . 2008-10-15 05:03 514384 ----a-w- c:\windows\system32\XAudio2_3.dll 2011-01-24 08:30 . 2008-10-15 04:22 452440 ----a-w- c:\windows\system32\d3dx10_40.dll 2011-01-24 08:30 . 2008-10-15 04:22 4379984 ----a-w- c:\windows\system32\D3DX9_40.dll 2011-01-24 08:30 . 2008-10-15 04:22 2036576 ----a-w- c:\windows\system32\D3DCompiler_40.dll 2011-01-24 08:06 . 2011-01-24 08:06 218688 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys 2011-01-24 08:06 . 2011-01-24 08:07 -------- d-----w- c:\program files\DAEMON Tools Lite 2011-01-23 18:36 . 2011-01-24 07:59 697328 ----a-w- c:\windows\system32\drivers\sptd.sys 2011-01-23 17:26 . 2011-02-17 19:32 -------- d-----w- c:\users\Даниел\AppData\Roaming\goalbit 2011-01-23 17:26 . 2011-01-23 17:26 -------- d-----w- c:\program files\InhatchTeam 2011-01-23 15:52 . 2011-01-23 15:52 -------- d-----w- c:\users\Даниел\AppData\Roaming\FlashGet 2011-01-23 15:52 . 2011-02-19 16:31 -------- d-----w- c:\program files\FlashGet 2011-01-23 15:17 . 2011-01-23 15:18 -------- d-----w- c:\users\Даниел\AppData\Local\pLan 2011-01-23 14:38 . 2011-01-23 14:38 -------- d-----w- c:\users\Даниел\AppData\Local\TechSmith 2011-01-23 14:38 . 2008-03-12 00:37 107864 ----a-w- c:\windows\system32\tsccvid.dll 2011-01-23 14:38 . 2011-01-23 14:38 -------- d-----w- c:\windows\system32\QuickTime 2011-01-23 14:38 . 2011-01-23 14:38 -------- d-----w- c:\programdata\TechSmith 2011-01-23 14:37 . 2011-01-23 14:37 -------- d-----w- c:\program files\TechSmith 2011-01-23 14:37 . 2011-01-23 14:37 -------- d-----w- c:\program files\Common Files\TechSmith Shared 2011-01-22 17:36 . 2011-01-22 17:36 -------- d-----w- c:\programdata\Blumentals 2011-01-22 07:36 . 2011-01-22 19:44 -------- d-----w- c:\program files\Easy GIF Animator 2011-01-21 13:27 . 2011-01-21 13:27 -------- d-----w- c:\users\Даниел\AppData\Roaming\Web Page Maker 2011-01-21 13:27 . 2011-01-21 13:27 -------- d-----w- c:\program files\Web Page Maker . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-02-19 09:02 . 2011-02-19 09:02 49152 ----a-r- c:\users\Даниел\AppData\Roaming\Microsoft\Installer\{C37A0BC1-52EE-4F97-8223-5CA9FC0357B0}\ARPPRODUCTICON.exe 2011-02-19 09:02 . 2011-02-19 09:02 49152 ----a-r- c:\users\Даниел\AppData\Roaming\Microsoft\Installer\{C37A0BC1-52EE-4F97-8223-5CA9FC0357B0}\ARPPRODUCTICON.exe 2011-01-18 15:43 . 2011-01-18 15:43 109328 ----a-w- c:\windows\system32\drivers\VBoxNetAdp.sys 2011-01-18 15:43 . 2011-01-18 15:43 133648 ----a-w- c:\windows\system32\VBoxNetFltNotify.dll 2011-01-18 15:43 . 2011-01-18 15:43 120208 ----a-w- c:\windows\system32\drivers\VBoxNetFlt.sys 2011-01-17 15:42 . 2009-07-13 23:40 249856 ----a-w- c:\windows\system32\uxtheme.dll 2011-01-17 15:42 . 2009-07-13 23:39 2755072 ----a-w- c:\windows\system32\themeui.dll 2011-01-17 15:42 . 2009-07-13 23:39 37376 ----a-w- c:\windows\system32\themeservice.dll 2011-01-17 14:48 . 2011-01-17 14:48 1060864 ----a-w- c:\windows\system32\mfc71.dll 2011-01-17 12:06 . 2009-07-13 23:24 811520 ----a-w- c:\windows\system32\user32.dll 2011-01-06 15:36 . 2011-01-06 15:36 80064 ----a-w- c:\windows\system32\drivers\inspect.sys 2011-01-06 15:36 . 2011-01-06 15:36 35768 ----a-w- c:\windows\system32\drivers\cmdhlp.sys 2011-01-06 15:36 . 2011-01-06 15:36 236600 ----a-w- c:\windows\system32\drivers\cmdGuard.sys 2011-01-06 15:36 . 2011-01-06 15:36 17256 ----a-w- c:\windows\system32\drivers\cmderd.sys 2010-12-28 23:42 . 2010-12-28 23:42 285480 ----a-w- c:\windows\system32\guard32.dll . ------- Sigcheck ------- [-] 2011-01-17 . 7BD7F45FF37FA0669CD32CA0EF46E22C . 811520 . . [6.1.7600.16385] . . c:\windows\System32\user32.dll [7] 2009-07-14 . 34B7E222E81FAFA885F0C5F2CFA56861 . 811520 . . [6.1.7600.16385] . . c:\windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}] 2010-09-28 20:44 1400712 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-09-28 1400712] [HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1] [HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] "{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-09-28 1400712] [HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1] [HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2011-01-20 1305408] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1173504] "uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2011-02-11 396664] "360Amigo"="c:\program files\360Amigo\360Amigo.exe" [2011-02-20 4807240] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cfp.exe" [2011-01-19 2548552] "HDAudDeck"="c:\program files\VIA\VIAudioi\VDeck\VDeck.exe" [2010-03-02 1778688] "WinampAgent"="c:\program files\Winamp\winampa.exe" [2010-12-09 74752] "AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712] "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2011-01-31 180269] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696] c:\users\„ ЁҐ«\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ uTorrent-v2.2.lnk - c:\program files\ WWW.ELIT-BG\uTorrent-v2.2.exe [2011-1-31 394616] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 0 (0x0) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=c:\windows\System32\guard32.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "aux2"=wdmaud.drv R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R3 BthAvrcp;Bluetooth AVRCP Profile;c:\windows\system32\DRIVERS\BthAvrcp.sys [2009-08-13 22528] R3 Revoflt;Revoflt;c:\windows\system32\DRIVERS\revoflt.sys [2009-12-30 27064] R3 WatAdminSvc;Услуга на технологиите за активиране на Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2011-01-17 1343400] S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2011-01-24 697328] S1 cmderd;COMODO Internet Security Eradication Driver;c:\windows\system32\DRIVERS\cmderd.sys [2011-01-06 17256] S1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\DRIVERS\cmdguard.sys [2011-01-06 236600] S1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\DRIVERS\cmdhlp.sys [2011-01-06 35768] S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2011-01-24 218688] S1 VBoxDrv;VirtualBox Service;c:\windows\system32\DRIVERS\VBoxDrv.sys [2011-01-18 158736] S1 VBoxUSBMon;VirtualBox USB Monitor Driver;c:\windows\system32\DRIVERS\VBoxUSBMon.sys [2011-01-18 42960] S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2010-04-03 240232] S3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\DRIVERS\VBoxNetAdp.sys [2011-01-18 109328] S3 VBoxNetFlt;VBoxNetFlt Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys [2011-01-18 120208] S3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [2010-03-02 1127936] . . ------- Supplementary Scan ------- . uStart Page = hxxp://google.bg/ uInternet Settings,ProxyServer = http=;ftp=;https=; IE: &Download All with FlashGet - c:\progra~1\FlashGet\jc_all.htm IE: &Download with FlashGet - c:\progra~1\FlashGet\jc_link.htm TCP: {AF700767-1490-408A-BE65-19B1001AE055} = 156.154.70.25,156.154.71.25 FF - ProfilePath - c:\users\Даниел\AppData\Roaming\Mozilla\Firefox\Profiles\qpnd7b5o.default\ FF - prefs.js: browser.search.selectedEngine - DAEMON Search FF - prefs.js: browser.startup.homepage - hxxp://www.google.bg/ FF - prefs.js: network.proxy.type - 0 FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} FF - Ext: PandoraTV Toolbar: [email protected] - %profile%\extensions\[email protected] FF - Ext: DAEMON Tools Toolbar: [email protected] - %profile%\extensions\[email protected] FF - Ext: Real Hide IP: [email protected] - %profile%\extensions\[email protected] FF - Ext: Hide IP Easy: [email protected] - %profile%\extensions\[email protected] FF - Ext: Tor-Proxy.NET Toolbar: {9815d32d-08c2-42ca-a8c6-43e501a4512f} - %profile%\extensions\{9815d32d-08c2-42ca-a8c6-43e501a4512f} FF - Ext: Easy-Hide-IP Firefox Plugin: [email protected] - c:\program files\Easy-Hide-IP\ff-extension . - - - - ORPHANS REMOVED - - - - URLSearchHooks-{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - (no file) HKCU-Run-AdobeBridge - (no file) . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(620) c:\windows\system32\guard32.dll - - - - - - - > 'lsass.exe'(552) c:\windows\system32\guard32.dll . Completion time: 2011-02-20 15:19:43 ComboFix-quarantined-files.txt 2011-02-20 13:19 Pre-Run: 58 307 461 120 bytes free Post-Run: 58 536 275 968 bytes free - - End Of File - - F7421182929A2D747989CAAFCD6DD417

20 февруари 201115 г.

Отворете Notepad и чрез комбинацията copy/paste поставете следния текст:

File::
c:\windows\system32\temp.000

Folder::
c:\programdata\boost_interprocess

Fcopy::
c:\windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll | c:\windows\System32\user32.dll

DDS::
FF - prefs.js: browser.search.selectedEngine - DAEMON Search

FileLook::
c:\program files\ WWW.ELIT-BG\uTorrent-v2.2.exe

DirLook::
c:\users\7B82~1
c:\program files\Havij

Запазете файла с името CFScript.txt и го поставете върху ComboFix.

Публикувано изображение

След като, програмата приключи ще Ви изведе лог файла. Отново чрез комбинацията от Copy/Paste поставете информацията тук.

20 февруари 201115 г.

Автор

ComboFix 11-02-19.02 - Даниел 02.2011 г. 15:43:00.2.2 - x86 Microsoft Windows 7 Ultimate 6.1.7600.0.1251.359.1033.18.3071.1968 [GMT 2:00] Running from: c:\users\Даниел\Desktop\Tool.exe Command switches used :: c:\users\Даниел\Desktop\CFScript.txt AV: COMODO Antivirus *Disabled/Updated* {675CEE69-9702-A524-3989-6D7CC8BF3695} FW: COMODO Firewall *Enabled* {5F676F4C-DD6D-A47C-12D6-C449366C71EE} SP: COMODO Defense+ *Disabled/Updated* {DC3D0F8D-B138-AAAA-0339-560EB3387C28} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} FILE :: "c:\windows\system32\temp.000" . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\programdata\boost_interprocess c:\windows\system32\temp.000 . --------------- FCopy --------------- c:\windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll --> c:\windows\System32\user32.dll . ((((((((((((((((((((((((( Files Created from 2011-01-20 to 2011-02-20 ))))))))))))))))))))))))))))))) . 2011-02-20 13:46 . 2011-02-20 13:46 -------- d-----w- c:\users\Даниел\AppData\Local\temp 2011-02-20 13:46 . 2011-02-20 13:46 -------- d-----w- c:\users\Default\AppData\Local\temp 2011-02-20 12:15 . 2011-02-20 12:18 -------- d-----w- c:\users\Даниел\AppData\Local\360Amigo 2011-02-20 12:15 . 2011-02-20 12:19 -------- d-----w- c:\program files\360Amigo 2011-02-19 09:02 . 2011-02-19 09:02 49152 ----a-r- c:\users\Даниел\AppData\Roaming\Microsoft\Installer\{C37A0BC1-52EE-4F97-8223-5CA9FC0357B0}\ARPPRODUCTICON.exe 2011-02-19 08:57 . 2011-02-19 08:57 -------- d-----w- c:\program files\Atari 2011-02-18 12:57 . 2011-02-18 12:57 -------- d-----w- c:\users\Даниел\AppData\Roaming\Malwarebytes 2011-02-18 12:57 . 2011-02-18 12:57 -------- d-----w- c:\programdata\Malwarebytes 2011-02-18 12:57 . 2010-12-20 16:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2011-02-18 12:57 . 2011-02-18 12:57 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2011-02-18 12:57 . 2010-12-20 16:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys 2011-02-18 12:40 . 2011-02-18 13:03 -------- d-----w- c:\program files\AntiLogger 2011-02-18 10:35 . 2011-02-18 10:35 -------- d-----w- c:\program files\Havij 2011-02-18 10:35 . 2000-05-21 22:00 140488 ----a-w- c:\windows\system32\comdlg32.ocx 2011-02-17 13:42 . 2011-02-17 13:42 -------- d-----w- c:\users\Даниел\AppData\Roaming\DriveHQ 2011-02-17 13:42 . 2011-02-17 13:42 -------- d-----w- c:\program files\DriveHQ 2011-02-16 19:15 . 2011-02-16 19:19 -------- d-----w- c:\users\Даниел\AppData\Roaming\PhotoScape 2011-02-16 15:17 . 2011-02-16 15:17 -------- d-----w- c:\users\Даниел\AppData\Roaming\Babylon 2011-02-16 15:17 . 2011-02-16 15:17 -------- d-----w- c:\users\Даниел\AppData\Local\Babylon 2011-02-16 15:17 . 2011-02-16 15:17 -------- d-----w- c:\programdata\Babylon 2011-02-16 14:01 . 2011-02-16 14:01 -------- d-----w- c:\users\Даниел\AppData\Local\COMODO 2011-02-16 13:29 . 2004-03-08 22:30 1081616 ----a-w- c:\windows\system32\Mscomctl.ocx 2011-02-16 13:29 . 2000-05-21 22:00 203976 ----a-w- c:\windows\system32\RICHTX32.OCX 2011-02-16 13:29 . 2011-02-16 13:29 -------- d-----w- c:\program files\Common Files\SocketSecure 2011-02-16 13:29 . 2004-03-08 21:00 124688 ----a-w- c:\windows\system32\MSWINSCK.OCX 2011-02-16 13:29 . 2011-02-16 13:29 -------- d-----w- c:\program files\Socketsoft 2011-02-16 11:05 . 2011-02-17 12:49 -------- d-----w- c:\users\Даниел\VirtualBox VMs 2011-02-16 11:02 . 2011-02-18 06:49 -------- d-----w- c:\users\Даниел\.VirtualBox 2011-02-16 11:02 . 2011-01-18 15:43 158736 ----a-w- c:\windows\system32\drivers\VBoxDrv.sys 2011-02-16 11:02 . 2011-02-16 11:02 -------- dc----w- c:\windows\system32\DRVSTORE 2011-02-16 11:02 . 2011-01-18 15:43 42960 ----a-w- c:\windows\system32\drivers\VBoxUSBMon.sys 2011-02-16 11:01 . 2011-02-16 11:01 -------- d-----w- c:\program files\Oracle 2011-02-14 11:48 . 2011-02-14 11:48 -------- d-----w- c:\users\Даниел\AppData\Local\Readon_Technology 2011-02-14 11:47 . 2011-02-14 11:47 -------- d-----w- c:\program files\Readon Technology 2011-02-14 11:15 . 2011-02-14 11:15 -------- d-----w- c:\users\Даниел\AbiSuite 2011-02-14 11:13 . 2011-02-14 11:14 -------- d-----w- c:\program files\AbiWord 2011-02-11 09:13 . 2011-02-11 09:13 -------- d-----w- c:\program files\Belltech Business Card Designer Pro 2011-02-11 06:09 . 2011-02-11 16:46 -------- d-----w- c:\program files\uTorrent 2011-02-09 02:33 . 2010-10-27 04:43 3901824 ----a-w- c:\windows\system32\ntoskrnl.exe 2011-02-07 15:21 . 2011-02-07 15:21 -------- d-----w- c:\users\Даниел\AppData\Roaming\CometPlayer 2011-02-07 15:21 . 2011-02-07 15:23 -------- d-----w- c:\users\Даниел\AppData\Roaming\tigerplayer 2011-02-07 15:21 . 2011-02-07 15:21 -------- d-----w- c:\program files\MpcStar 2011-02-07 07:56 . 2011-02-07 07:56 -------- d-----w- c:\program files\Microsoft.NET 2011-02-06 10:08 . 2011-02-06 10:08 -------- d-----w- c:\program files\Difference World 2011-02-06 09:15 . 2011-02-06 09:15 -------- d--h--r- c:\users\Даниел\AppData\Roaming\SecuROM 2011-02-06 09:13 . 2011-02-20 12:52 -------- d-----w- c:\programdata\Test Drive Unlimited 2011-02-05 17:34 . 2011-02-06 13:12 -------- d-----w- c:\program files\SopCast 2011-02-05 14:40 . 2011-02-05 14:40 -------- d-----w- c:\program files\Euro Truck Simulator 2011-02-04 15:52 . 2011-02-04 15:52 -------- d-----w- c:\programdata\HideIPEasy 2011-02-04 15:51 . 2011-02-04 15:51 -------- d-----w- c:\program files\HideIPEasy 2011-02-04 15:50 . 2011-02-04 15:50 -------- d-----w- c:\users\Даниел\AppData\Roaming\C__Users_Даниел_AppData_Local_Temp_ir_ext_temp_0_AutoPlay_Docs_Crack_HideIPEasy.exe 2011-02-04 15:50 . 2011-02-04 15:50 -------- d-----w- c:\programdata\C__Users_Даниел_AppData_Local_Temp_ir_ext_temp_0_AutoPlay_Docs_Crack_HideIPEasy.exe 2011-02-04 12:23 . 2011-02-04 12:23 -------- d-----w- c:\program files\Easy-Hide-IP 2011-02-03 13:18 . 2011-02-03 13:18 -------- d-----w- c:\programdata\RealHideIP 2011-02-03 13:07 . 2011-02-03 13:15 -------- d-----w- c:\users\Даниел\AppData\Roaming\Hide IP NG 2011-02-03 13:04 . 2011-02-03 14:45 -------- d-----w- c:\users\Даниел\AppData\Roaming\HideIP 2011-02-01 15:55 . 2011-02-20 13:19 -------- d-----w- c:\users\7B82~1 2011-02-01 14:02 . 2011-02-01 14:02 -------- d-----w- c:\programdata\IObit 2011-02-01 14:02 . 2011-02-01 14:02 -------- d-----w- c:\program files\IObit 2011-02-01 13:50 . 2011-02-01 13:51 -------- d-----w- c:\program files\18 WoS Extreme Trucker 2 2011-01-31 18:03 . 2011-01-31 18:03 24621 ----a-w- c:\program files\Mozilla Firefox\plugins\nprjplug.dll 2011-01-31 18:03 . 2011-01-31 18:03 -------- d-----w- c:\program files\Common Files\xing shared 2011-01-31 18:03 . 2011-01-31 18:03 139305 ----a-w- c:\program files\Mozilla Firefox\plugins\nppl3260.dll 2011-01-31 18:03 . 2011-01-31 18:03 81967 ----a-w- c:\program files\Mozilla Firefox\plugins\nprpjplug.dll 2011-01-31 18:03 . 2011-01-31 18:03 -------- d-----w- c:\program files\Common Files\Real 2011-01-31 18:03 . 2011-01-31 18:03 -------- d-----w- c:\program files\Real 2011-01-31 18:02 . 2011-01-31 18:05 -------- d-----w- c:\users\Даниел\AppData\Roaming\Real 2011-01-31 18:01 . 2011-01-31 18:01 569397 ----a-w- c:\program files\Internet Explorer\PLUGINS\RichFX\Player\nprfxins.dll 2011-01-31 16:46 . 2011-01-31 16:46 -------- d-----w- c:\program files\18 Wheels of Steel Haulin 2011-01-31 16:27 . 2011-01-31 16:27 -------- d-----w- c:\program files\ WWW.ELIT-BG 2011-01-30 18:33 . 2011-02-20 13:45 -------- d-----w- c:\users\Даниел\AppData\Roaming\uTorrent 2011-01-24 14:54 . 2011-02-20 07:16 -------- d-----w- c:\programdata\Xfire 2011-01-24 14:20 . 2011-01-24 14:20 98304 ----a-w- c:\windows\system32\CmdLineExt.dll 2011-01-24 14:13 . 2011-01-24 17:09 -------- d-----w- c:\users\Даниел\AppData\Roaming\Xfire 2011-01-24 14:13 . 2011-01-25 04:54 -------- d-s---w- c:\program files\Xfire 2011-01-24 14:06 . 2005-04-03 21:02 753664 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iKernel.dll 2011-01-24 14:06 . 2005-04-03 21:02 69714 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\ctor.dll 2011-01-24 14:06 . 2005-04-03 21:01 274432 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iscript.dll 2011-01-24 14:06 . 2005-04-03 21:00 184320 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iuser.dll 2011-01-24 14:06 . 2005-04-03 20:59 5632 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\DotNetInstaller.exe 2011-01-24 14:06 . 2005-04-03 20:57 32768 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\Objectps.dll 2011-01-24 14:06 . 2011-01-24 14:06 331908 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\setup.dll 2011-01-24 14:06 . 2011-01-24 14:06 200836 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iGdi.dll 2011-01-24 14:05 . 2011-01-24 14:05 331908 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\ispCF74.tmp\setup.dll 2011-01-24 13:05 . 2011-01-24 13:05 -------- d-----w- c:\users\Даниел\AppData\Local\LucasArts 2011-01-24 08:30 . 2009-03-09 13:27 453456 ----a-w- c:\windows\system32\d3dx10_41.dll 2011-01-24 08:30 . 2009-03-09 13:27 4178264 ----a-w- c:\windows\system32\D3DX9_41.dll 2011-01-24 08:30 . 2009-03-09 13:27 1846632 ----a-w- c:\windows\system32\D3DCompiler_41.dll 2011-01-24 08:30 . 2009-03-16 12:18 69448 ----a-w- c:\windows\system32\XAPOFX1_3.dll 2011-01-24 08:30 . 2009-03-16 12:18 517448 ----a-w- c:\windows\system32\XAudio2_4.dll 2011-01-24 08:30 . 2009-03-16 12:18 235352 ----a-w- c:\windows\system32\xactengine3_4.dll 2011-01-24 08:30 . 2009-03-16 12:18 22360 ----a-w- c:\windows\system32\X3DAudio1_6.dll 2011-01-24 08:30 . 2008-10-15 05:03 70992 ----a-w- c:\windows\system32\XAPOFX1_2.dll 2011-01-24 08:30 . 2008-10-15 05:03 514384 ----a-w- c:\windows\system32\XAudio2_3.dll 2011-01-24 08:30 . 2008-10-15 04:22 452440 ----a-w- c:\windows\system32\d3dx10_40.dll 2011-01-24 08:30 . 2008-10-15 04:22 4379984 ----a-w- c:\windows\system32\D3DX9_40.dll 2011-01-24 08:30 . 2008-10-15 04:22 2036576 ----a-w- c:\windows\system32\D3DCompiler_40.dll 2011-01-24 08:06 . 2011-01-24 08:06 218688 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys 2011-01-24 08:06 . 2011-01-24 08:07 -------- d-----w- c:\program files\DAEMON Tools Lite 2011-01-23 18:36 . 2011-01-24 07:59 697328 ----a-w- c:\windows\system32\drivers\sptd.sys 2011-01-23 17:26 . 2011-02-17 19:32 -------- d-----w- c:\users\Даниел\AppData\Roaming\goalbit 2011-01-23 17:26 . 2011-01-23 17:26 -------- d-----w- c:\program files\InhatchTeam 2011-01-23 15:52 . 2011-01-23 15:52 -------- d-----w- c:\users\Даниел\AppData\Roaming\FlashGet 2011-01-23 15:52 . 2011-02-19 16:31 -------- d-----w- c:\program files\FlashGet 2011-01-23 15:17 . 2011-01-23 15:18 -------- d-----w- c:\users\Даниел\AppData\Local\pLan 2011-01-23 14:38 . 2011-01-23 14:38 -------- d-----w- c:\users\Даниел\AppData\Local\TechSmith 2011-01-23 14:38 . 2008-03-12 00:37 107864 ----a-w- c:\windows\system32\tsccvid.dll 2011-01-23 14:38 . 2011-01-23 14:38 -------- d-----w- c:\windows\system32\QuickTime 2011-01-23 14:38 . 2011-01-23 14:38 -------- d-----w- c:\programdata\TechSmith 2011-01-23 14:37 . 2011-01-23 14:37 -------- d-----w- c:\program files\TechSmith 2011-01-23 14:37 . 2011-01-23 14:37 -------- d-----w- c:\program files\Common Files\TechSmith Shared 2011-01-22 17:36 . 2011-01-22 17:36 -------- d-----w- c:\programdata\Blumentals 2011-01-22 07:36 . 2011-01-22 19:44 -------- d-----w- c:\program files\Easy GIF Animator . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-02-19 09:02 . 2011-02-19 09:02 49152 ----a-r- c:\users\Даниел\AppData\Roaming\Microsoft\Installer\{C37A0BC1-52EE-4F97-8223-5CA9FC0357B0}\ARPPRODUCTICON.exe 2011-02-19 09:02 . 2011-02-19 09:02 49152 ----a-r- c:\users\Даниел\AppData\Roaming\Microsoft\Installer\{C37A0BC1-52EE-4F97-8223-5CA9FC0357B0}\ARPPRODUCTICON.exe 2011-01-18 15:43 . 2011-01-18 15:43 109328 ----a-w- c:\windows\system32\drivers\VBoxNetAdp.sys 2011-01-18 15:43 . 2011-01-18 15:43 133648 ----a-w- c:\windows\system32\VBoxNetFltNotify.dll 2011-01-18 15:43 . 2011-01-18 15:43 120208 ----a-w- c:\windows\system32\drivers\VBoxNetFlt.sys 2011-01-17 15:42 . 2009-07-13 23:40 249856 ----a-w- c:\windows\system32\uxtheme.dll 2011-01-17 15:42 . 2009-07-13 23:39 2755072 ----a-w- c:\windows\system32\themeui.dll 2011-01-17 15:42 . 2009-07-13 23:39 37376 ----a-w- c:\windows\system32\themeservice.dll 2011-01-17 14:48 . 2011-01-17 14:48 1060864 ----a-w- c:\windows\system32\mfc71.dll 2011-01-06 15:36 . 2011-01-06 15:36 80064 ----a-w- c:\windows\system32\drivers\inspect.sys 2011-01-06 15:36 . 2011-01-06 15:36 35768 ----a-w- c:\windows\system32\drivers\cmdhlp.sys 2011-01-06 15:36 . 2011-01-06 15:36 236600 ----a-w- c:\windows\system32\drivers\cmdGuard.sys 2011-01-06 15:36 . 2011-01-06 15:36 17256 ----a-w- c:\windows\system32\drivers\cmderd.sys 2010-12-28 23:42 . 2010-12-28 23:42 285480 ----a-w- c:\windows\system32\guard32.dll . (((((((((((((((((((((((((((((((((((((((((((( Look ))))))))))))))))))))))))))))))))))))))))))))))))))))))))) . ---- Directory of c:\program files\Havij ---- 2011-02-18 10:35 . 2010-02-13 18:26 4305 ----a-w- c:\program files\Havij\admins.txt 2011-02-18 10:35 . 2010-05-05 13:05 4299 ----a-w- c:\program files\Havij\columns.txt 2011-02-18 10:35 . 2010-05-05 13:01 7131 ----a-w- c:\program files\Havij\tables.txt 2011-02-18 10:35 . 2004-04-30 20:40 743 ----a-w- c:\program files\Havij\Havij.exe.manifest 2011-02-18 10:35 . 2008-07-03 17:11 6438 ----a-w- c:\program files\Havij\Read Me.txt 2011-02-18 10:35 . 2010-05-06 18:34 1236992 ----a-w- c:\program files\Havij\Havij.exe 2011-02-18 10:35 . 2011-02-18 10:35 695578 ----a-w- c:\program files\Havij\unins000.exe 2011-02-18 10:35 . 2011-02-18 10:35 2094 ----a-w- c:\program files\Havij\unins000.dat ---- Directory of c:\users\7B82~1 ---- 2011-02-02 14:49 . 2011-02-02 14:49 8192 ----a-w- c:\users\7B82~1\Desktop\OperaTor\Opera\profile\oprand.dat 2011-02-02 14:49 . 2011-02-02 14:49 12 ----a-w- c:\users\7B82~1\Desktop\OperaTor\Opera\profile\vlink4.dat 2011-02-02 14:49 . 2011-02-02 14:49 434 ----a-w- c:\users\7B82~1\Desktop\OperaTor\Opera\profile\cookies4.dat 2011-02-02 14:49 . 2011-02-02 14:49 35 ----a-w- c:\users\7B82~1\Desktop\OperaTor\Opera\profile\webserver\users.xml 2011-02-02 14:49 . 2011-02-02 14:49 12304 ----a-w- c:\users\7B82~1\Desktop\OperaTor\Opera\mail\index.ini 2011-02-02 14:49 . 2011-02-02 14:49 726 ----a-w- c:\users\7B82~1\Desktop\OperaTor\Opera\mail\accounts.ini 2011-02-02 14:49 . 2011-02-02 14:49 2277 ----a-w- c:\users\7B82~1\Desktop\OperaTor\Opera\profile\sessions\autosave.win 2011-02-02 14:38 . 2011-02-02 14:49 12 ----a-w- c:\users\7B82~1\Desktop\OperaTor\Opera\profile\download.dat 2011-02-02 14:38 . 2011-02-02 14:38 2070 ----a-w- c:\users\7B82~1\Desktop\OperaTor\Opera\profile\autoupdate_response.xml 2011-02-02 14:38 . 2011-02-02 14:49 12 ----a-w- c:\users\7B82~1\Desktop\OperaTor\Opera\profile\optrust.dat 2011-02-02 14:38 . 2011-02-02 14:49 25286 ----a-w- c:\users\7B82~1\Desktop\OperaTor\Opera\profile\opcacrt6.dat 2011-02-02 14:38 . 2011-02-02 14:49 9042 ----a-w- c:\users\7B82~1\Desktop\OperaTor\Opera\profile\opicacrt6.dat 2011-02-02 14:38 . 2011-02-02 14:49 12 ----a-w- c:\users\7B82~1\Desktop\OperaTor\Opera\profile\opuntrust.dat 2011-02-02 14:36 . 2011-02-02 14:49 319 ----a-w- c:\users\7B82~1\Desktop\OperaTor\Opera\profile\opera.dir 2011-02-02 14:36 . 2011-02-02 14:49 356 ----a-w- c:\users\7B82~1\Desktop\OperaTor\Opera\profile\global.dat 2011-02-02 14:36 . 2011-02-02 14:36 249 ----a-w- c:\users\7B82~1\Desktop\OperaTor\Opera\profile\tasks.xml 2011-02-02 14:36 . 2011-02-02 14:36 512 ----a-w- c:\users\7B82~1\Desktop\OperaTor\Opera\mail\indexer\indexer.bx 2011-02-02 14:36 . 2011-02-02 14:36 7680 ----a-w- c:\users\7B82~1\Desktop\OperaTor\Opera\mail\indexer\indexer.axx 2011-02-02 14:36 . 2011-02-02 14:36 512 ----a-w- c:\users\7B82~1\Desktop\OperaTor\Opera\mail\lexicon\lexicon.bx 2011-02-02 14:36 . 2011-02-02 14:36 7680 ----a-w- c:\users\7B82~1\Desktop\OperaTor\Opera\mail\lexicon\lexicon.axx 2011-02-02 14:36 . 2011-02-02 14:36 1024 ----a-w- c:\users\7B82~1\Desktop\OperaTor\Opera\mail\indexer\message_id 2011-02-02 14:36 . 2011-02-02 14:49 1024 ----a-w- c:\users\7B82~1\Desktop\OperaTor\Opera\mail\omailbase.dat 2011-02-02 14:36 . 2011-02-02 14:49 27 ----a-w- c:\users\7B82~1\Desktop\OperaTor\Opera\profile\opcert6.dat 2011-02-02 14:36 . 2011-02-02 14:49 202 ----a-w- c:\users\7B82~1\Desktop\OperaTor\Opera\profile\opssl6.dat 2011-02-02 14:36 . 2011-02-02 14:36 88 ----a-w- c:\users\7B82~1\Desktop\OperaTor\Opera\profile\optrb.dat 2011-02-02 14:36 . 2008-03-14 08:49 4809 ----a-w- c:\users\7B82~1\Desktop\OperaTor\Opera\profile\styles\user\toc.css 2011-02-02 14:36 . 2008-03-14 08:49 258 ----a-w- c:\users\7B82~1\Desktop\OperaTor\Opera\profile\styles\user\tablelayout.css 2011-02-02 14:36 . 2008-03-14 08:49 2727 ----a-w- c:\users\7B82~1\Desktop\OperaTor\Opera\profile\styles\user\structuretables.css 2011-02-02 14:36 . 2008-03-14 08:49 2112 ----a-w- c:\users\7B82~1\Desktop\OperaTor\Opera\profile\styles\user\structureinline.css 2011-02-02 14:36 . 2008-03-14 08:49 4569 ----a-w- c:\users\7B82~1\Desktop\OperaTor\Opera\profile\styles\user\structureblock.css 2011-02-02 14:36 . 2008-03-14 08:49 735 ----a-w- c:\users\7B82~1\Desktop\OperaTor\Opera\profile\styles\user\outline.css 2011-02-02 14:36 . 2008-03-14 08:49 410 ----a-w- c:\users\7B82~1\Desktop\OperaTor\Opera\profile\styles\user\disabletables.css 2011-02-02 14:36 . 2008-03-14 08:49 243 ----a-w- c:\users\7B82~1\Desktop\OperaTor\Opera\profile\styles\user\disablepositioning.css 2011-02-02 14:36 . 2008-03-14 08:49 269 ----a-w- c:\users\7B82~1\Desktop\OperaTor\Opera\profile\styles\user\disableforms.css 2011-02-02 14:36 . 2008-03-14 08:49 229 ----a-w- c:\users\7B82~1\Desktop\OperaTor\Opera\profile\styles\user\disablefloats.css 2011-02-02 14:36 . 2008-03-14 08:49 213 ----a-w- c:\users\7B82~1\Desktop\OperaTor\Opera\profile\styles\user\disablebreaks.css 2011-02-02 14:36 . 2008-03-14 08:49 705 ----a-w- c:\users\7B82~1\Desktop\OperaTor\Opera\profile\styles\user\contrastwb.css 2011-02-02 14:36 . 2008-03-14 08:49 673 ----a-w- c:\users\7B82~1\Desktop\OperaTor\Opera\profile\styles\user\contrastbw.css 2011-02-02 14:36 . 2008-03-14 08:49 1225 ----a-w- c:\users\7B82~1\Desktop\OperaTor\Opera\profile\styles\user\classid.css 2011-02-02 14:36 . 2008-03-14 08:49 1353 ----a-w- c:\users\7B82~1\Desktop\OperaTor\Opera\profile\styles\user\altdebugger.css 2011-02-02 14:36 . 2008-03-14 08:49 2742 ----a-w- c:\users\7B82~1\Desktop\OperaTor\Opera\profile\styles\user\accessibility.css 2011-02-01 15:58 . 2011-02-01 15:58 8192 ----a-w- c:\users\7B82~1\Desktop\Opera\profile\oprand.dat 2011-02-01 15:58 . 2011-02-01 15:58 12 ----a-w- c:\users\7B82~1\Desktop\Opera\profile\vlink4.dat 2011-02-01 15:58 . 2011-02-01 15:58 13 ----a-w- c:\users\7B82~1\Desktop\Opera\profile\cookies4.dat 2011-02-01 15:58 . 2011-02-01 15:58 12 ----a-w- c:\users\7B82~1\Desktop\Opera\profile\widgets\288748439883736112011296575723\cache\vlink4.dat 2011-02-01 15:58 . 2011-02-01 15:58 20 ----a-w- c:\users\7B82~1\Desktop\Opera\profile\widgets\288748439883736112011296575723\cache\dcache4.url 2011-02-01 15:58 . 2011-02-01 15:58 12 ----a-w- c:\users\7B82~1\Desktop\Opera\profile\widgets\498058780325946211231296575723\cache\vlink4.dat 2011-02-01 15:58 . 2011-02-01 15:58 20 ----a-w- c:\users\7B82~1\Desktop\Opera\profile\widgets\498058780325946211231296575723\cache\dcache4.url 2011-02-01 15:58 . 2011-02-01 15:58 12 ----a-w- c:\users\7B82~1\Desktop\Opera\profile\widgets\631068862856043510421296575723\cache\vlink4.dat 2011-02-01 15:58 . 2011-02-01 15:58 20 ----a-w- c:\users\7B82~1\Desktop\Opera\profile\widgets\631068862856043510421296575723\cache\dcache4.url 2011-02-01 15:58 . 2011-02-01 15:58 12 ----a-w- c:\users\7B82~1\Desktop\Opera\profile\widgets\862178123397340811641296575723\cache\vlink4.dat 2011-02-01 15:58 . 2011-02-01 15:58 20 ----a-w- c:\users\7B82~1\Desktop\Opera\profile\widgets\862178123397340811641296575723\cache\dcache4.url 2011-02-01 15:58 . 2011-02-01 15:58 12 ----a-w- c:\users\7B82~1\Desktop\Opera\profile\widgets\003286485829468110741296575723\cache\vlink4.dat 2011-02-01 15:58 . 2011-02-01 15:58 20 ----a-w- c:\users\7B82~1\Desktop\Opera\profile\widgets\003286485829468110741296575723\cache\dcache4.url 2011-02-01 15:58 . 2011-02-01 15:58 12 ----a-w- c:\users\7B82~1\Desktop\Opera\profile\widgets\912095090064374409951296575723\cache\vlink4.dat 2011-02-01 15:58 . 2011-02-01 15:58 20 ----a-w- c:\users\7B82~1\Desktop\Opera\profile\widgets\912095090064374409951296575723\cache\dcache4.url 2011-02-01 15:58 . 2011-02-01 15:58 12 ----a-w- c:\users\7B82~1\Desktop\Opera\profile\widgets\739359415897189389101296575723\cache\vlink4.dat 2011-02-01 15:58 . 2011-02-01 15:58 20 ----a-w- c:\users\7B82~1\Desktop\Opera\profile\widgets\739359415897189389101296575723\cache\dcache4.url 2011-02-01 15:58 . 2011-02-01 15:58 35 ----a-w- c:\users\7B82~1\Desktop\Opera\profile\webserver\users.xml 2011-02-01 15:58 . 2011-02-01 15:58 12304 ----a-w- c:\users\7B82~1\Desktop\Opera\mail\index.ini 2011-02-01 15:58 . 2011-02-01 15:58 726 ----a-w- c:\users\7B82~1\Desktop\Opera\mail\accounts.ini 2011-02-01 15:58 . 2011-02-01 15:58 1414 ----a-w- c:\users\7B82~1\Desktop\Opera\profile\sessions\autosave.win 2011-02-01 15:56 . 2011-02-01 15:58 12 ----a-w- c:\users\7B82~1\Desktop\Opera\profile\optrust.dat 2011-02-01 15:56 . 2011-02-01 15:58 25286 ----a-w- c:\users\7B82~1\Desktop\Opera\profile\opcacrt6.dat 2011-02-01 15:56 . 2011-02-01 15:58 9042 ----a-w- c:\users\7B82~1\Desktop\Opera\profile\opicacrt6.dat 2011-02-01 15:56 . 2011-02-01 15:58 12 ----a-w- c:\users\7B82~1\Desktop\Opera\profile\opuntrust.dat 2011-02-01 15:55 . 2011-02-01 15:58 12 ----a-w- c:\users\7B82~1\Desktop\Opera\profile\download.dat 2011-02-01 15:55 . 2011-02-01 15:58 207 ----a-w- c:\users\7B82~1\Desktop\Opera\profile\opera.dir 2011-02-01 15:55 . 2011-02-01 15:58 249 ----a-w- c:\users\7B82~1\Desktop\Opera\profile\global.dat 2011-02-01 15:55 . 2011-02-01 15:55 1559 ----a-w- c:\users\7B82~1\Desktop\Opera\profile\unite.adr 2011-02-01 15:55 . 2011-02-01 15:55 1691 ----a-w- c:\users\7B82~1\Desktop\Opera\profile\opera6.adr 2011-02-01 15:55 . 2011-02-01 15:55 5689 ----a-w- c:\users\7B82~1\Desktop\Opera\profile\widgets\widgets.dat 2011-02-01 15:55 . 2011-02-01 15:55 249 ----a-w- c:\users\7B82~1\Desktop\Opera\profile\tasks.xml 2011-02-01 15:55 . 2011-02-01 15:55 282 ----a-w- c:\users\7B82~1\Desktop\Opera\profile\opthumb.dat 2011-02-01 15:55 . 2009-11-20 17:13 424 ----a-w- c:\users\7B82~1\Desktop\Opera\profile\speeddial.ini 2011-02-01 15:55 . 2011-02-01 15:58 512 ----a-w- c:\users\7B82~1\Desktop\Opera\mail\indexer\indexer.bx 2011-02-01 15:55 . 2011-02-01 15:58 7680 ----a-w- c:\users\7B82~1\Desktop\Opera\mail\indexer\indexer.axx 2011-02-01 15:55 . 2011-02-01 15:58 512 ----a-w- c:\users\7B82~1\Desktop\Opera\mail\lexicon\lexicon.bx 2011-02-01 15:55 . 2011-02-01 15:58 7680 ----a-w- c:\users\7B82~1\Desktop\Opera\mail\lexicon\lexicon.axx 2011-02-01 15:55 . 2011-02-01 15:58 1024 ----a-w- c:\users\7B82~1\Desktop\Opera\mail\indexer\message_id 2011-02-01 15:55 . 2011-02-01 15:58 1024 ----a-w- c:\users\7B82~1\Desktop\Opera\mail\omailbase.dat 2011-02-01 15:55 . 2011-02-01 15:58 27 ----a-w- c:\users\7B82~1\Desktop\Opera\profile\opcert6.dat 2011-02-01 15:55 . 2011-02-01 15:58 142 ----a-w- c:\users\7B82~1\Desktop\Opera\profile\opssl6.dat 2011-02-01 15:55 . 2011-02-01 15:55 88 ----a-w- c:\users\7B82~1\Desktop\Opera\profile\optrb.dat 2011-02-01 15:55 . 2008-03-14 08:49 4809 ----a-w- c:\users\7B82~1\Desktop\Opera\profile\styles\user\toc.css 2011-02-01 15:55 . 2008-03-14 08:49 258 ----a-w- c:\users\7B82~1\Desktop\Opera\profile\styles\user\tablelayout.css 2011-02-01 15:55 . 2008-03-14 08:49 2727 ----a-w- c:\users\7B82~1\Desktop\Opera\profile\styles\user\structuretables.css 2011-02-01 15:55 . 2008-03-14 08:49 2112 ----a-w- c:\users\7B82~1\Desktop\Opera\profile\styles\user\structureinline.css 2011-02-01 15:55 . 2008-03-14 08:49 4569 ----a-w- c:\users\7B82~1\Desktop\Opera\profile\styles\user\structureblock.css 2011-02-01 15:55 . 2008-03-14 08:49 735 ----a-w- c:\users\7B82~1\Desktop\Opera\profile\styles\user\outline.css 2011-02-01 15:55 . 2008-03-14 08:49 410 ----a-w- c:\users\7B82~1\Desktop\Opera\profile\styles\user\disabletables.css 2011-02-01 15:55 . 2008-03-14 08:49 243 ----a-w- c:\users\7B82~1\Desktop\Opera\profile\styles\user\disablepositioning.css 2011-02-01 15:55 . 2008-03-14 08:49 269 ----a-w- c:\users\7B82~1\Desktop\Opera\profile\styles\user\disableforms.css 2011-02-01 15:55 . 2008-03-14 08:49 229 ----a-w- c:\users\7B82~1\Desktop\Opera\profile\styles\user\disablefloats.css 2011-02-01 15:55 . 2008-03-14 08:49 213 ----a-w- c:\users\7B82~1\Desktop\Opera\profile\styles\user\disablebreaks.css 2011-02-01 15:55 . 2008-03-14 08:49 705 ----a-w- c:\users\7B82~1\Desktop\Opera\profile\styles\user\contrastwb.css 2011-02-01 15:55 . 2008-03-14 08:49 673 ----a-w- c:\users\7B82~1\Desktop\Opera\profile\styles\user\contrastbw.css 2011-02-01 15:55 . 2008-03-14 08:49 1225 ----a-w- c:\users\7B82~1\Desktop\Opera\profile\styles\user\classid.css 2011-02-01 15:55 . 2008-03-14 08:49 1353 ----a-w- c:\users\7B82~1\Desktop\Opera\profile\styles\user\altdebugger.css 2011-02-01 15:55 . 2008-03-14 08:49 2742 ----a-w- c:\users\7B82~1\Desktop\Opera\profile\styles\user\accessibility.css ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}] 2010-09-28 20:44 1400712 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-09-28 1400712] [HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1] [HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] "{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-09-28 1400712] [HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1] [HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2011-01-20 1305408] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1173504] "uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2011-02-11 396664] "360Amigo"="c:\program files\360Amigo\360Amigo.exe" [2011-02-20 4807240] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cfp.exe" [2011-01-19 2548552] "HDAudDeck"="c:\program files\VIA\VIAudioi\VDeck\VDeck.exe" [2010-03-02 1778688] "WinampAgent"="c:\program files\Winamp\winampa.exe" [2010-12-09 74752] "AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712] "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2011-01-31 180269] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696] c:\users\„ ЁҐ«\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ uTorrent-v2.2.lnk - c:\program files\ WWW.ELIT-BG\uTorrent-v2.2.exe [2011-1-31 394616] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 0 (0x0) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=c:\windows\System32\guard32.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "aux2"=wdmaud.drv R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R3 BthAvrcp;Bluetooth AVRCP Profile;c:\windows\system32\DRIVERS\BthAvrcp.sys [2009-08-13 22528] R3 Revoflt;Revoflt;c:\windows\system32\DRIVERS\revoflt.sys [2009-12-30 27064] R3 WatAdminSvc;Услуга на технологиите за активиране на Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2011-01-17 1343400] S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2011-01-24 697328] S1 cmderd;COMODO Internet Security Eradication Driver;c:\windows\system32\DRIVERS\cmderd.sys [2011-01-06 17256] S1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\DRIVERS\cmdguard.sys [2011-01-06 236600] S1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\DRIVERS\cmdhlp.sys [2011-01-06 35768] S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2011-01-24 218688] S1 VBoxDrv;VirtualBox Service;c:\windows\system32\DRIVERS\VBoxDrv.sys [2011-01-18 158736] S1 VBoxUSBMon;VirtualBox USB Monitor Driver;c:\windows\system32\DRIVERS\VBoxUSBMon.sys [2011-01-18 42960] S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2010-04-03 240232] S3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\DRIVERS\VBoxNetAdp.sys [2011-01-18 109328] S3 VBoxNetFlt;VBoxNetFlt Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys [2011-01-18 120208] S3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [2010-03-02 1127936] . . ------- Supplementary Scan ------- . uStart Page = hxxp://google.bg/ uInternet Settings,ProxyServer = http=;ftp=;https=; IE: &Download All with FlashGet - c:\progra~1\FlashGet\jc_all.htm IE: &Download with FlashGet - c:\progra~1\FlashGet\jc_link.htm TCP: {AF700767-1490-408A-BE65-19B1001AE055} = 156.154.70.25,156.154.71.25 FF - ProfilePath - c:\users\Даниел\AppData\Roaming\Mozilla\Firefox\Profiles\qpnd7b5o.default\ FF - prefs.js: browser.search.selectedEngine - DAEMON Search FF - prefs.js: browser.startup.homepage - hxxp://www.google.bg/ FF - prefs.js: network.proxy.type - 0 FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} FF - Ext: PandoraTV Toolbar: [email protected] - %profile%\extensions\[email protected] FF - Ext: DAEMON Tools Toolbar: [email protected] - %profile%\extensions\[email protected] FF - Ext: Real Hide IP: [email protected] - %profile%\extensions\[email protected] FF - Ext: Hide IP Easy: [email protected] - %profile%\extensions\[email protected] FF - Ext: Tor-Proxy.NET Toolbar: {9815d32d-08c2-42ca-a8c6-43e501a4512f} - %profile%\extensions\{9815d32d-08c2-42ca-a8c6-43e501a4512f} FF - Ext: Easy-Hide-IP Firefox Plugin: [email protected] - c:\program files\Easy-Hide-IP\ff-extension . . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(620) c:\windows\system32\guard32.dll - - - - - - - > 'lsass.exe'(552) c:\windows\system32\guard32.dll . Completion time: 2011-02-20 15:47:43 ComboFix-quarantined-files.txt 2011-02-20 13:47 ComboFix2.txt 2011-02-20 13:19 Pre-Run: 58 588 307 456 bytes free Post-Run: 58 536 652 800 bytes free - - End Of File - - 9D26F531FE67BD78986A46E68029DE0D

20 февруари 201115 г.

Деинсталирайте Ask Toolbar и ми кажете дали имаме някакъв прогрес.

20 февруари 201115 г.

Автор

Смисъл къв прогрес? Аз дори я нямам програмата.

20 февруари 201115 г.

Убеден ли си? В списъка от Attach.txt я има: http://www.kaldata.com/forums/index.php?showtopic=171952&view=findpost&p=1918072 Прогрес = Напредък

20 февруари 201115 г.

Автор

Убеден ли си? В списъка от Attach.txt я има:
http://www.kaldata.com/forums/index.php?showtopic=171952&view=findpost&p=1918072

Прогрес = Напредък

Да сигурен съм че я нямам.

20 февруари 201115 г.

Изтегли следното приложение, стартирай и следвай инструкциите, то трябва да изчисти остатъците от Ask Toolbar.

http://www.softpedia.com/dyn-postdownload.php?p=160388&t=4&i=1

След това, нека направим едно контролно сканиране, ей така за спорта:

1) Изтеглете: ESET Online Scanner

2) Стартирайте esetsmartinstaller_enu.exe

3) Сложете отметка на YES, I accept the Terms of Use и изберете Start

4) Скенерът ще започне да изтегля компонентите, които са му необходими.

5) Уверете се, че има отметки на следните редове, включително и тези от менюто Advanced Settings:

Remove found threats

Scan archivesScan for potentially unwanted applicationsScan for potentially unsafe applicationsEnable Anti-Stealth technology

И накрая изберете Start

6) Скенерът ще започне да изтегля последните дефиниции.

7) След, като сканирането завърши изберете Finish.

8) Отидете в:

C:\Program Files\ESET\ESET Online Scanner

Отворете файла log.txt , копирайте съдържанието му и го поставете в следващия си пост тук.

20 февруари 201115 г.

Автор

Само да кажа че вчера имах 60 гб днес имам 51.6 не съм инсталвал нищо моля помогнете сам ми се пълни харда.

Добре дошли!

Май имам keylogger

Featured Replies

Регистрирайте се или влезете в профила си за да коментирате

Разглеждащи това в момента 0

Дарение

Бюлетин

Профил

Навигация

Търсене

Конфигуриране на push известия в браузъра

Chrome (Android)

Chrome (Desktop)

Safari (iOS 16.4+)

Safari (macOS)

Edge (Android)

Edge (Desktop)

Firefox (Android)

Firefox (Desktop)