Jacky_Larkyn

Благодарим Ви! All the Best както се казва в Китай

В момента й тегля SP 3 и AVIRA. Аз отдавна работя с тази антивирусна и Павлина също. Инсталирах Скайп, но още не е влизал онлайн никой, първо мисля да сканирам пак с Авирата и тогава да правя следващите неща. Но самия факт, че успях да вляза в тази страница и да разглеждам тази тема и да пусна да се теглят Авирата и SP 3, означава че вече е чист Благодаря Ви много Павлина също Ви благодари Пожелаваме Ви весели празници Поздрави Иван и Павлина

Това е от Мalwarebytes Malwarebytes' Anti-Malware 1.42 Database version: 3421 Windows 5.1.2600 Service Pack 2 Internet Explorer 6.0.2900.2180 12/24/2009 4:58:30 PM mbam-log-2009-12-24 (16-58-30).txt Scan type: Full Scan (C:\|D:\|) Objects scanned: 176728 Time elapsed: 22 minute(s), 10 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 7 Registry Values Infected: 0 Registry Data Items Infected: 2 Folders Infected: 2 Files Infected: 4 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\473d1b29f95b96241830b6a6ade19368 (Rogue.RegistryBot) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5a144bd76064d1645b6e74c0734ee406 (Rogue.RegistryBot) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\965dcc82bc551df439b28676f8ab79e0 (Rogue.RegistryBot) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Bifrost (Backdoor.Bifrose) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\ErrorSmart (Rogue.ErrorSmart) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Bifrost (Backdoor.Bifrose) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\ErrorSmart (Rogue.ErrorSmart) -> Quarantined and deleted successfully. Registry Values Infected: (No malicious items detected) Registry Data Items Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools (Hijack.Regedit) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools (Hijack.Regedit) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. Folders Infected: C:\Program Files\Bifrost (Backdoor.Bifrose) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Start Menu\Programs\ErrorSmart (Rogue.ErrorSmart) -> Quarantined and deleted successfully. Files Infected: D:\Install\Nero\Ahead.Nero.Burning.ROM.v6.6.0.8.Incl.Keygen-ORiON\KeyGen\Keygen.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\Program Files\Bifrost\logg.dat (Backdoor.Bifrose) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Start Menu\Programs\ErrorSmart\ErrorSmart.lnk (Rogue.ErrorSmart) -> Quarantined and deleted successfully. C:\Documents and Settings\PL\Application Data\addon.dat (Malware.Trace) -> Quarantined and deleted successfully.

Това е лог фаила на ESETа ESETSmartInstaller@High as downloader log: all ok ESETSmartInstaller@High as downloader log: all ok # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6211 # api_version=3.0.2 # EOSSerial=400057aef6c25d4b94b26c26988d2ea0 # end=finished # remove_checked=true # archives_checked=true # unwanted_checked=true # unsafe_checked=true # antistealth_checked=true # utc_time=2009-12-25 03:41:56 # local_time=2009-12-24 03:41:56 (-1200, Dateline Standard Time) # country="Bulgaria" # lang=1033 # osver=5.1.2600 NT Service Pack 2 # compatibility_mode=8192 67108863 100 0 0 0 0 0 # scanned=75330 # found=10 # cleaned=10 # scan_time=2591 C:\enycjwhmv.bat a variant of Win32/AutoRun.Agent.UA worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\obqyjapylxown.bat a variant of Win32/AutoRun.Agent.UA worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\sdqwfuhozjy.bat a variant of Win32/AutoRun.Agent.UA worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\Documents and Settings\PL\Desktop\PavLiNA\Jacky.EXE Win32/Joke.ScreenMate application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\Documents and Settings\PL\Start Menu\Programs\Startup\PowerReg Scheduler.exe Win32/PowerReg application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C D:\enycjwhmv.bat a variant of Win32/AutoRun.Agent.UA worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C D:\obqyjapylxown.bat a variant of Win32/AutoRun.Agent.UA worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C D:\sdqwfuhozjy.bat a variant of Win32/AutoRun.Agent.UA worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C D:\Install\ipscan.exe Win32/NetTool.Portscan.C application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C D:\Install\RealVNC.Enterprise.v4.2.9.Incl.Keymaker-EMBRACE-ZWT-QSS\RealVNC.Enterprise.v4.2.9.Incl.Keymaker-EMBRACE.rar probably a variant of Win32/Agent trojan (deleted - quarantined) 00000000000000000000000000000000 C

All processes killed ========== OTL ========== No active process named evoapkdqhxsezoioe.exe was found! No active process named yfoqvgp.exe was found! Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\evoapkdqhxsezoioe deleted successfully. C:\Documents and Settings\PL\Local Settings\Temp\yrmarojyrjguriemext.exe moved successfully. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\sdqwfuhozjy deleted successfully. C:\WINDOWS\system32\lfbqigcsmfdsqifohbyq.exe moved successfully. Registry value HKEY_USERS\S-1-5-21-1060284298-1659004503-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Run\\pdtcogwguhziam deleted successfully. C:\WINDOWS\system32\nfzmcysgyplyukfmdv.exe moved successfully. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce\\pbpwgwksepfm deleted successfully. File C:\WINDOWS\System32\nfzmcysgyplyukfmdv.exe not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce\\xnfqeyqcshbmguns deleted successfully. C:\Documents and Settings\PL\Local Settings\Temp\avsibaxojdcsrkismhfys.exe moved successfully. Registry value HKEY_USERS\S-1-5-21-1060284298-1659004503-839522115-1003\Software\Microsoft\Windows\CurrentVersion\RunOnce\\pbpwgwksepfm deleted successfully. C:\Documents and Settings\PL\Local Settings\Temp\nfzmcysgyplyukfmdv.exe moved successfully. Registry value HKEY_USERS\S-1-5-21-1060284298-1659004503-839522115-1003\Software\Microsoft\Windows\CurrentVersion\RunOnce\\shyivofqftmwpcu deleted successfully. C:\WINDOWS\system32\yrmarojyrjguriemext.exe moved successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\\obqyjapylxown deleted successfully. C:\WINDOWS\nfzmcysgyplyukfmdv.exe moved successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\\xhtygugmwf deleted successfully. File C:\DOCUME~1\PL\LOCALS~1\Temp\avsibaxojdcsrkismhfys.exe not found. C:\AUTOEXEC.BAT moved successfully. C:\autorun.inf moved successfully. D:\autorun.inf moved successfully. C:\WINDOWS\system32\sdqwfuhozjyetcqqalzisdspahsflujwd.ynt moved successfully. C:\WINDOWS\sdqwfuhozjyetcqqalzisdspahsflujwd.ynt moved successfully. C:\Program Files\sdqwfuhozjyetcqqalzisdspahsflujwd.ynt moved successfully. C:\Documents and Settings\PL\Local Settings\Application Data\sdqwfuhozjyetcqqalzisdspahsflujwd.ynt moved successfully. C:\WINDOWS\system32\cdgcbgjghhminmqgghlkklq.ebc moved successfully. C:\WINDOWS\cdgcbgjghhminmqgghlkklq.ebc moved successfully. C:\Program Files\cdgcbgjghhminmqgghlkklq.ebc moved successfully. C:\Documents and Settings\PL\Local Settings\Application Data\cdgcbgjghhminmqgghlkklq.ebc moved successfully. C:\WINDOWS\system32\pdtcogwguhziamdgthykxlddrbpfoasisgtl.myp moved successfully. C:\WINDOWS\pdtcogwguhziamdgthykxlddrbpfoasisgtl.myp moved successfully. C:\Program Files\pdtcogwguhziamdgthykxlddrbpfoasisgtl.myp moved successfully. C:\Documents and Settings\PL\Local Settings\Application Data\pdtcogwguhziamdgthykxlddrbpfoasisgtl.myp moved successfully. C:\WINDOWS\yrmarojyrjguriemext.exe moved successfully. C:\WINDOWS\xnfqeyqcshbmguns.exe moved successfully. C:\WINDOWS\rnlcwwumidduuonytpoidz.exe moved successfully. File C:\WINDOWS\nfzmcysgyplyukfmdv.exe not found. C:\WINDOWS\lfbqigcsmfdsqifohbyq.exe moved successfully. C:\WINDOWS\evoapkdqhxsezoioe.exe moved successfully. C:\WINDOWS\avsibaxojdcsrkismhfys.exe moved successfully. File C:\autorun.inf not found. File C:\WINDOWS\System32\yrmarojyrjguriemext.exe not found. C:\WINDOWS\system32\rnlcwwumidduuonytpoidz.exe moved successfully. File C:\WINDOWS\System32\lfbqigcsmfdsqifohbyq.exe not found. C:\WINDOWS\system32\avsibaxojdcsrkismhfys.exe moved successfully. C:\WINDOWS\system32\xnfqeyqcshbmguns.exe moved successfully. File C:\WINDOWS\System32\nfzmcysgyplyukfmdv.exe not found. C:\WINDOWS\system32\evoapkdqhxsezoioe.exe moved successfully. C:\WINDOWS\system32\shyivofqftmwpcuymbtgujcdsdsjtgzqbqexh.nfj moved successfully. C:\WINDOWS\shyivofqftmwpcuymbtgujcdsdsjtgzqbqexh.nfj moved successfully. C:\Program Files\shyivofqftmwpcuymbtgujcdsdsjtgzqbqexh.nfj moved successfully. C:\Documents and Settings\PL\Local Settings\Application Data\shyivofqftmwpcuymbtgujcdsdsjtgzqbqexh.nfj moved successfully. C:\WINDOWS\system32\pbpwgwksepfmcmbcnzoyjvljvdpdkukygs.taq moved successfully. C:\WINDOWS\pbpwgwksepfmcmbcnzoyjvljvdpdkukygs.taq moved successfully. C:\Program Files\pbpwgwksepfmcmbcnzoyjvljvdpdkukygs.taq moved successfully. C:\Documents and Settings\PL\Local Settings\Application Data\pbpwgwksepfmcmbcnzoyjvljvdpdkukygs.taq moved successfully. ========== FILES ========== File\Folder C:\WINDOWS\system32\evoapkdqhxsezoioe.exe not found. C:\Documents and Settings\PL\Local Settings\Temp\yfoqvgp.exe moved successfully. C:\Documents and Settings\PL\Application Data\ErrorSmart\Registry Backups folder moved successfully. C:\Documents and Settings\PL\Application Data\ErrorSmart\Log folder moved successfully. C:\Documents and Settings\PL\Application Data\ErrorSmart folder moved successfully. ========== REGISTRY ========== Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\D:\Games\mc2\mc2.exe deleted successfully. Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\Skype\Phone\Skype.exe deleted successfully. Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Documents and Settings\PL\Local Settings\Temp\yfoqvgp.exe deleted successfully. ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: LocalService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: PL ->Temp folder emptied: 21736292 bytes ->Temporary Internet Files folder emptied: 40998 bytes ->Java cache emptied: 0 bytes ->FireFox cache emptied: 37397666 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes Windows Temp folder emptied: 16384 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes RecycleBin emptied: 13554 bytes Total Files Cleaned = 56.00 mb C:\WINDOWS\System32\drivers\etc\Hosts moved successfully. HOSTS file reset successfully OTL by OldTimer - Version 3.1.19.0 log created on 12232009_134238 Files\Folders moved on Reboot... Registry entries deleted on Reboot...

Това е от OTL.txt OTL logfile created on: 12/23/2009 1:06:42 PM - Run 2 OTL by OldTimer - Version 3.1.19.0 Folder = C:\Documents and Settings\PL\Desktop Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2900.2180) Locale: 00000402 | Country: United States | Language: ENU | Date Format: M/d/yyyy 1,015.00 Mb Total Physical Memory | 613.00 Mb Available Physical Memory | 60.00% Memory free 2.00 Gb Paging File | 1.00 Gb Available in Paging File | 82.00% Paging File free Paging file location(s): C:\pagefile.sys 756 1512 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 39.06 Gb Total Space | 15.75 Gb Free Space | 40.32% Space Free | Partition Type: NTFS Drive D: | 193.82 Gb Total Space | 175.69 Gb Free Space | 90.64% Space Free | Partition Type: NTFS E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: SS-CCDFCCD52405 Current User Name: PL Logged in as Administrator. Current Boot Mode: Normal Scan Mode: All users Company Name Whitelist: On Skip Microsoft Files: On File Age = 30 Days Output = Minimal ========== Processes (SafeList) ========== PRC - C:\WINDOWS\system32\evoapkdqhxsezoioe.exe () PRC - C:\Documents and Settings\PL\Local Settings\Temp\yfoqvgp.exe () PRC - C:\Documents and Settings\PL\Desktop\OTL.exe (OldTimer Tools) PRC - C:\Documents and Settings\PL\Desktop\TeamViewer 2.exe (TeamViewer GmbH) PRC - C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.) PRC - C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.) PRC - C:\Program Files\BitComet\BitComet.exe (www.BitComet.com) PRC - C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe (Microsoft Corporation) PRC - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation) PRC - C:\Program Files\Google\Google Talk\googletalk.exe (Google) PRC - C:\WINDOWS\system32\igfxsrvc.exe (Intel Corporation) PRC - C:\WINDOWS\system32\igfxpers.exe (Intel Corporation) PRC - C:\WINDOWS\system32\hkcmd.exe (Intel Corporation) PRC - C:\Program Files\CyberLink\Shared Files\RichVideo.exe () PRC - C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe (Cyberlink Corp.) PRC - C:\WINDOWS\RTHDCPL.exe (Realtek Semiconductor Corp.) PRC - C:\WINDOWS\VM305_STI.EXE (Vimicro) PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation) ========== Modules (SafeList) ========== MOD - C:\Documents and Settings\PL\Desktop\OTL.exe (OldTimer Tools) MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll (Microsoft Corporation) ========== Win32 Services (SafeList) ========== SRV - (JavaQuickStarterService) -- C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.) SRV - (odserv) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE (Microsoft Corporation) SRV - (Microsoft Office Groove Audit Service) -- C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe (Microsoft Corporation) SRV - (RichVideo) Cyberlink RichVideo Service(CRVS) -- C:\Program Files\CyberLink\Shared Files\RichVideo.exe () SRV - (ose) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation) SRV - (Irmon) -- C:\WINDOWS\system32\irmon.dll (Microsoft Corporation) ========== Driver Services (SafeList) ========== DRV - (RTL8023xp) -- C:\WINDOWS\system32\drivers\Rtnicxp.sys (Realtek Semiconductor Corporation ) DRV - (PxHelp20) -- C:\WINDOWS\System32\Drivers\PxHelp20.sys (Sonic Solutions) DRV - (ialm) -- C:\WINDOWS\system32\drivers\igxpmp32.sys (Intel Corporation) DRV - (ZSMC0305) -- C:\WINDOWS\system32\drivers\usbVM305.sys (Vimicro Corporation) DRV - (vvftav) -- C:\WINDOWS\system32\drivers\vvftav.sys (Vimicro Corporation) DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\WINDOWS\system32\drivers\RtkHDAud.Sys (Realtek Semiconductor Corp.) DRV - (RTLE8023xp) -- C:\WINDOWS\system32\drivers\Rtenicxp.sys (Realtek Semiconductor Corporation ) DRV - (HDAudBus) -- C:\WINDOWS\system32\drivers\Hdaudbus.sys (Windows ® Server 2003 DDK provider) DRV - (Secdrv) -- C:\WINDOWS\system32\drivers\secdrv.sys () DRV - (Ptilink) -- C:\WINDOWS\system32\drivers\ptilink.sys (Parallel Technologies, Inc.) DRV - (gameenum) -- C:\WINDOWS\system32\drivers\gameenum.sys (Microsoft Corporation) DRV - (PQNTDrv) -- C:\WINDOWS\system32\drivers\PQNTDRV.sys (PowerQuest Corporation) DRV - (irsir) -- C:\WINDOWS\system32\drivers\irsir.sys (Microsoft Corporation) DRV - (ms_mpu401) -- C:\WINDOWS\system32\drivers\msmpu401.sys (Microsoft Corporation) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie'>http://www.google.com/ie IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie'>http://www.google.com/ie IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie'>http://www.google.com/ie IE - HKU\.DEFAULT\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-1060284298-1659004503-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie'>http://www.google.com/ie IE - HKU\S-1-5-21-1060284298-1659004503-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com IE - HKU\S-1-5-21-1060284298-1659004503-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://google.atcomet.com/b/ IE - HKU\S-1-5-21-1060284298-1659004503-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie'>http://www.google.com/ie IE - HKU\S-1-5-21-1060284298-1659004503-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie'>http://www.google.com/ie IE - HKU\S-1-5-21-1060284298-1659004503-839522115-1003\S-1-5-21-1060284298-1659004503-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "http://google.com" FF - prefs.js..extensions.enabledItems: [email protected]:1.0 FF - HKLM\software\mozilla\Mozilla Firefox 3.0.16\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009/12/19 01:15:14 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.0.16\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2009/12/19 01:13:47 | 00,000,000 | ---D | M] [2009/04/10 07:45:59 | 00,000,000 | ---D | M] -- C:\Documents and Settings\PL\Application Data\Mozilla\Extensions [2009/06/21 20:21:42 | 00,000,000 | ---D | M] -- C:\Documents and Settings\PL\Application Data\Mozilla\Firefox\Profiles\zvsrqblg.default\extensions [2009/06/22 23:46:58 | 00,000,945 | ---- | M] () -- C:\Documents and Settings\PL\Application Data\Mozilla\Firefox\Profiles\zvsrqblg.default\searchplugins\youtube-video-search.xml [2009/12/22 06:56:19 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions O1 HOSTS File: (98 bytes) - C:\WINDOWS\system32\drivers\etc\Hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (BitComet Helper) - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.3.1.15.dll (BitComet) O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) O2 - BHO: (Java Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.) O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [bigDog305] C:\WINDOWS\VM305_STI.EXE (Vimicro) O4 - HKLM..\Run: [evoapkdqhxsezoioe] C:\Documents and Settings\PL\Local Settings\Temp\yrmarojyrjguriemext.exe () O4 - HKLM..\Run: [GrooveMonitor] C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe (Microsoft Corporation) O4 - HKLM..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe (Intel Corporation) O4 - HKLM..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exe (Intel Corporation) O4 - HKLM..\Run: [LanguageShortcut] C:\Program Files\CyberLink\PowerDVD\Language\Language.exe () O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe (Ahead Software Gmbh) O4 - HKLM..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe (Intel Corporation) O4 - HKLM..\Run: [RemoteControl] C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe (Cyberlink Corp.) O4 - HKLM..\Run: [RTHDCPL] C:\WINDOWS\RTHDCPL.exe (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [sdqwfuhozjy] C:\WINDOWS\System32\lfbqigcsmfdsqifohbyq.exe () O4 - HKLM..\Run: [skyTel] C:\WINDOWS\SkyTel.exe (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.) O4 - HKU\S-1-5-21-1060284298-1659004503-839522115-1003..\Run: [bitComet] C:\Program Files\BitComet\BitComet.exe (www.BitComet.com) O4 - HKU\S-1-5-21-1060284298-1659004503-839522115-1003..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe (Google) O4 - HKU\S-1-5-21-1060284298-1659004503-839522115-1003..\Run: [pdtcogwguhziam] C:\WINDOWS\System32\nfzmcysgyplyukfmdv.exe () O4 - HKU\S-1-5-21-1060284298-1659004503-839522115-1003..\Run: [sdqwfuhozjy] C:\Documents and Settings\PL\Local Settings\Temp\lfbqigcsmfdsqifohbyq.exe () O4 - HKLM..\RunOnce: [pbpwgwksepfm] C:\WINDOWS\System32\nfzmcysgyplyukfmdv.exe () O4 - HKLM..\RunOnce: [xnfqeyqcshbmguns] C:\Documents and Settings\PL\Local Settings\Temp\avsibaxojdcsrkismhfys.exe () O4 - HKU\.DEFAULT..\RunOnce: [RunNarrator] C:\WINDOWS\System32\narrator.exe (Microsoft Corporation) O4 - HKU\S-1-5-18..\RunOnce: [RunNarrator] C:\WINDOWS\System32\narrator.exe (Microsoft Corporation) O4 - HKU\S-1-5-21-1060284298-1659004503-839522115-1003..\RunOnce: [pbpwgwksepfm] C:\Documents and Settings\PL\Local Settings\Temp\nfzmcysgyplyukfmdv.exe () O4 - HKU\S-1-5-21-1060284298-1659004503-839522115-1003..\RunOnce: [shyivofqftmwpcu] C:\WINDOWS\System32\yrmarojyrjguriemext.exe () O4 - Startup: C:\Documents and Settings\PL\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation) O4 - Startup: C:\Documents and Settings\PL\Start Menu\Programs\Startup\PowerReg Scheduler.exe () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: obqyjapylxown = nfzmcysgyplyukfmdv.exe () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: xhtygugmwf = C:\DOCUME~1\PL\LOCALS~1\Temp\avsibaxojdcsrkismhfys.exe () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableInstallerDetection = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableSecureUIAPaths = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableVirtualization = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1 O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-21-1060284298-1659004503-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 1 O7 - HKU\S-1-5-21-1060284298-1659004503-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1 O8 - Extra context menu item: &С&валяне &с BitComet - C:\Program Files\BitComet\BitComet.exe (www.BitComet.com) O8 - Extra context menu item: &С&валяне на всички с BitComet - C:\Program Files\BitComet\BitComet.exe (www.BitComet.com) O8 - Extra context menu item: &С&валяне на всичкото видео с BitComet - C:\Program Files\BitComet\BitComet.exe (www.BitComet.com) O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.) O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O9 - Extra Button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - C:\Program Files\BitComet\tools\BitCometBHO_1.3.1.15.dll (BitComet) O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone. O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {CAFEEFAC-0015-0000-0008-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-1_5_0_08-windows-i586.cab (Java Plug-in 1.5.0_08) O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 85.239.155.1 85.239.152.129 O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation) O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2007/12/28 03:17:28 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O32 - AutoRun File - [2009/12/23 12:04:06 | 00,000,800 | RHS- | M] () - C:\autorun.inf -- [ NTFS ] O32 - AutoRun File - [2009/12/23 12:04:07 | 00,000,816 | RHS- | M] () - D:\autorun.inf -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - comfile [open] -- "%1" %* O35 - exefile [open] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2009/12/22 12:06:43 | 00,000,000 | ---D | C] -- C:\Documents and Settings\PL\Desktop\SKYPE PROBLEM [2009/12/22 11:17:18 | 00,000,000 | ---D | C] -- C:\_OTL [2009/12/22 11:13:21 | 00,513,536 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\PL\Desktop\OTL.exe [2009/12/20 10:12:38 | 00,000,000 | -H-D | C] -- C:\Documents and Settings\PL\Recent [2009/12/20 04:55:23 | 00,000,000 | R--D | C] -- C:\Documents and Settings\PL\Desktop\, [2009/12/20 02:26:05 | 00,000,000 | R--D | C] -- C:\Documents and Settings\PL\Desktop\' [2009/12/13 06:54:07 | 00,000,000 | ---D | C] -- C:\Documents and Settings\PL\Desktop\xhahxa [2009/12/04 05:00:22 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\KB905474 [2009/12/04 03:15:13 | 00,000,000 | ---D | C] -- C:\WINDOWS\ServicePackFiles [2009/12/03 03:01:04 | 00,000,000 | -H-D | C] -- C:\WINDOWS\$MSI31Uninstall_KB893803v2$ [2009/11/29 03:50:35 | 00,000,000 | ---D | C] -- C:\Documents and Settings\PL\Desktop\poli siwa [2009/11/25 10:08:33 | 00,000,000 | ---D | C] -- C:\Documents and Settings\PL\Desktop\Kartinki [2009/06/21 20:02:26 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\Adobe [2008/11/10 22:45:26 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ESET [2008/08/29 01:44:40 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft [2007/12/28 03:20:25 | 00,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Application Data\Microsoft [2007/12/28 03:20:11 | 00,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Application Data\Microsoft [2007/12/28 03:20:10 | 00,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft ========== Files - Modified Within 30 Days ========== [2009/12/23 13:08:39 | 00,002,408 | -H-- | M] () -- C:\WINDOWS\System32\sdqwfuhozjyetcqqalzisdspahsflujwd.ynt [2009/12/23 13:08:39 | 00,002,408 | -H-- | M] () -- C:\WINDOWS\sdqwfuhozjyetcqqalzisdspahsflujwd.ynt [2009/12/23 13:08:39 | 00,002,408 | -H-- | M] () -- C:\Program Files\sdqwfuhozjyetcqqalzisdspahsflujwd.ynt [2009/12/23 13:08:39 | 00,002,408 | -H-- | M] () -- C:\Documents and Settings\PL\Local Settings\Application Data\sdqwfuhozjyetcqqalzisdspahsflujwd.ynt [2009/12/23 13:08:39 | 00,000,280 | -H-- | M] () -- C:\WINDOWS\System32\cdgcbgjghhminmqgghlkklq.ebc [2009/12/23 13:08:39 | 00,000,280 | -H-- | M] () -- C:\WINDOWS\cdgcbgjghhminmqgghlkklq.ebc [2009/12/23 13:08:39 | 00,000,280 | -H-- | M] () -- C:\Program Files\cdgcbgjghhminmqgghlkklq.ebc [2009/12/23 13:08:39 | 00,000,280 | -H-- | M] () -- C:\Documents and Settings\PL\Local Settings\Application Data\cdgcbgjghhminmqgghlkklq.ebc [2009/12/23 13:08:15 | 00,000,316 | -H-- | M] () -- C:\WINDOWS\System32\pdtcogwguhziamdgthykxlddrbpfoasisgtl.myp [2009/12/23 13:08:15 | 00,000,316 | -H-- | M] () -- C:\WINDOWS\pdtcogwguhziamdgthykxlddrbpfoasisgtl.myp [2009/12/23 13:08:15 | 00,000,316 | -H-- | M] () -- C:\Program Files\pdtcogwguhziamdgthykxlddrbpfoasisgtl.myp [2009/12/23 13:08:15 | 00,000,316 | -H-- | M] () -- C:\Documents and Settings\PL\Local Settings\Application Data\pdtcogwguhziamdgthykxlddrbpfoasisgtl.myp [2009/12/23 13:08:10 | 00,573,440 | RHS- | M] () -- C:\WINDOWS\yrmarojyrjguriemext.exe [2009/12/23 13:08:10 | 00,573,440 | RHS- | M] () -- C:\WINDOWS\xnfqeyqcshbmguns.exe [2009/12/23 13:08:10 | 00,573,440 | RHS- | M] () -- C:\WINDOWS\rnlcwwumidduuonytpoidz.exe [2009/12/23 13:08:10 | 00,573,440 | RHS- | M] () -- C:\WINDOWS\nfzmcysgyplyukfmdv.exe [2009/12/23 13:08:10 | 00,573,440 | RHS- | M] () -- C:\WINDOWS\lfbqigcsmfdsqifohbyq.exe [2009/12/23 13:08:10 | 00,573,440 | RHS- | M] () -- C:\WINDOWS\evoapkdqhxsezoioe.exe [2009/12/23 13:08:10 | 00,573,440 | RHS- | M] () -- C:\WINDOWS\avsibaxojdcsrkismhfys.exe [2009/12/23 12:04:50 | 00,000,894 | ---- | M] () -- C:\Documents and Settings\PL\Desktop\Google Talk.lnk [2009/12/23 12:04:06 | 00,000,800 | RHS- | M] () -- C:\autorun.inf [2009/12/23 12:03:49 | 00,000,260 | ---- | M] () -- C:\WINDOWS\tasks\WGASetup.job [2009/12/23 12:03:28 | 00,573,440 | RHS- | M] () -- C:\WINDOWS\System32\yrmarojyrjguriemext.exe [2009/12/23 12:03:28 | 00,573,440 | RHS- | M] () -- C:\WINDOWS\System32\rnlcwwumidduuonytpoidz.exe [2009/12/23 12:03:28 | 00,573,440 | RHS- | M] () -- C:\WINDOWS\System32\lfbqigcsmfdsqifohbyq.exe [2009/12/23 12:03:28 | 00,573,440 | RHS- | M] () -- C:\WINDOWS\System32\avsibaxojdcsrkismhfys.exe [2009/12/23 12:03:27 | 00,573,440 | RHS- | M] () -- C:\WINDOWS\System32\xnfqeyqcshbmguns.exe [2009/12/23 12:03:27 | 00,573,440 | RHS- | M] () -- C:\WINDOWS\System32\nfzmcysgyplyukfmdv.exe [2009/12/23 12:03:19 | 00,573,440 | RHS- | M] () -- C:\WINDOWS\System32\evoapkdqhxsezoioe.exe [2009/12/23 12:03:13 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2009/12/23 12:03:09 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2009/12/23 04:52:07 | 00,000,463 | -H-- | M] () -- C:\WINDOWS\System32\shyivofqftmwpcuymbtgujcdsdsjtgzqbqexh.nfj [2009/12/23 04:52:07 | 00,000,463 | -H-- | M] () -- C:\WINDOWS\shyivofqftmwpcuymbtgujcdsdsjtgzqbqexh.nfj [2009/12/23 04:52:07 | 00,000,463 | -H-- | M] () -- C:\Program Files\shyivofqftmwpcuymbtgujcdsdsjtgzqbqexh.nfj [2009/12/23 04:52:07 | 00,000,463 | -H-- | M] () -- C:\Documents and Settings\PL\Local Settings\Application Data\shyivofqftmwpcuymbtgujcdsdsjtgzqbqexh.nfj [2009/12/22 23:55:33 | 00,004,248 | -H-- | M] () -- C:\WINDOWS\System32\pbpwgwksepfmcmbcnzoyjvljvdpdkukygs.taq [2009/12/22 23:55:33 | 00,004,248 | -H-- | M] () -- C:\WINDOWS\pbpwgwksepfmcmbcnzoyjvljvdpdkukygs.taq [2009/12/22 23:55:33 | 00,004,248 | -H-- | M] () -- C:\Program Files\pbpwgwksepfmcmbcnzoyjvljvdpdkukygs.taq [2009/12/22 23:55:33 | 00,004,248 | -H-- | M] () -- C:\Documents and Settings\PL\Local Settings\Application Data\pbpwgwksepfmcmbcnzoyjvljvdpdkukygs.taq [2009/12/22 23:54:18 | 08,912,896 | -H-- | M] () -- C:\Documents and Settings\PL\NTUSER.DAT [2009/12/22 23:54:18 | 00,000,178 | -HS- | M] () -- C:\Documents and Settings\PL\ntuser.ini [2009/12/22 23:52:11 | 00,000,098 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\Hosts [2009/12/22 12:45:29 | 00,000,116 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini [2009/12/22 05:47:21 | 00,001,729 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader 8.lnk [2009/12/20 17:53:43 | 00,513,536 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\PL\Desktop\OTL.exe [2009/12/20 10:35:24 | 00,005,096 | ---- | M] () -- C:\Documents and Settings\PL\My Documents\photoscape.cfg [2009/12/20 10:35:24 | 00,001,035 | ---- | M] () -- C:\Documents and Settings\PL\My Documents\phoobj.cfg [2009/12/20 10:35:24 | 00,000,043 | ---- | M] () -- C:\Documents and Settings\PL\My Documents\favorite.lst [2009/12/19 10:14:18 | 00,085,277 | ---- | M] () -- C:\Documents and Settings\PL\Desktop\6491_100235033327426_100000227884707_3522_5368382_n.jpg [2009/12/19 09:31:48 | 00,039,745 | ---- | M] () -- C:\Documents and Settings\PL\Desktop\13742_103984759620754_100000276905855_103942_2803951_n.jpg [2009/12/17 12:58:58 | 04,840,134 | -H-- | M] () -- C:\Documents and Settings\PL\Local Settings\Application Data\IconCache.db [2009/12/17 02:30:05 | 00,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2009/12/16 11:35:43 | 00,026,815 | ---- | M] () -- C:\Documents and Settings\PL\Desktop\14544_100666493293946_100000517871488_17099_385994_n.jpg [2009/12/16 11:05:28 | 00,015,360 | -H-- | M] () -- C:\Documents and Settings\PL\Desktop\photothumb.db [2009/12/16 11:04:30 | 00,020,148 | ---- | M] () -- C:\Documents and Settings\PL\Desktop\11169_102711916417297_100000354672339_63676_4501880_n.jpg [2009/12/16 05:56:31 | 00,023,824 | ---- | M] () -- C:\Documents and Settings\PL\Desktop\ca402d3b_0040022116873_00_600.jpg [2009/12/13 10:07:50 | 03,984,370 | ---- | M] () -- C:\Documents and Settings\PL\Desktop\Tose Proeski - Boze, brani je od zla.mp3 [2009/12/10 10:24:49 | 00,027,074 | ---- | M] () -- C:\Documents and Settings\PL\My Documents\intro.jpg [2009/12/09 04:52:50 | 00,351,272 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI [2009/12/09 04:52:50 | 00,308,552 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat [2009/12/09 04:52:50 | 00,038,808 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat [2009/12/08 10:46:06 | 00,069,232 | ---- | M] () -- C:\Documents and Settings\PL\Local Settings\Application Data\GDIPFONTCACHEV1.DAT [2009/12/08 04:20:17 | 00,264,616 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2009/12/08 03:03:06 | 00,001,041 | ---- | M] () -- C:\WINDOWS\win.ini [2009/12/08 02:37:44 | 00,056,816 | ---- | M] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntflt.sys [2009/11/29 12:44:28 | 03,932,214 | ---- | M] () -- C:\Documents and Settings\PL\Desktop\kilim.bmp [2009/11/28 08:40:40 | 08,573,432 | ---- | M] () -- C:\Documents and Settings\PL\Desktop\Galena - Na Dve Golemi2.mp3 [2009/11/26 08:59:50 | 03,530,672 | ---- | M] () -- C:\Documents and Settings\PL\Desktop\C-block - I'm So Strong Out.mp3 [2009/11/24 09:05:37 | 07,175,443 | ---- | M] () -- C:\Documents and Settings\PL\Desktop\Galena - Na dve golemi.mp3 ========== Files Created - No Company Name ========== [2009/12/22 23:55:41 | 00,000,463 | -H-- | C] () -- C:\WINDOWS\System32\shyivofqftmwpcuymbtgujcdsdsjtgzqbqexh.nfj [2009/12/22 23:55:41 | 00,000,463 | -H-- | C] () -- C:\WINDOWS\shyivofqftmwpcuymbtgujcdsdsjtgzqbqexh.nfj [2009/12/22 23:55:41 | 00,000,463 | -H-- | C] () -- C:\Program Files\shyivofqftmwpcuymbtgujcdsdsjtgzqbqexh.nfj [2009/12/22 23:55:41 | 00,000,463 | -H-- | C] () -- C:\Documents and Settings\PL\Local Settings\Application Data\shyivofqftmwpcuymbtgujcdsdsjtgzqbqexh.nfj [2009/12/22 23:55:33 | 00,004,248 | -H-- | C] () -- C:\WINDOWS\System32\pbpwgwksepfmcmbcnzoyjvljvdpdkukygs.taq [2009/12/22 23:55:33 | 00,004,248 | -H-- | C] () -- C:\WINDOWS\pbpwgwksepfmcmbcnzoyjvljvdpdkukygs.taq [2009/12/22 23:55:33 | 00,004,248 | -H-- | C] () -- C:\Program Files\pbpwgwksepfmcmbcnzoyjvljvdpdkukygs.taq [2009/12/22 23:55:33 | 00,004,248 | -H-- | C] () -- C:\Documents and Settings\PL\Local Settings\Application Data\pbpwgwksepfmcmbcnzoyjvljvdpdkukygs.taq [2009/12/22 23:54:08 | 00,000,800 | RHS- | C] () -- C:\autorun.inf [2009/12/22 23:51:59 | 00,002,408 | -H-- | C] () -- C:\WINDOWS\System32\sdqwfuhozjyetcqqalzisdspahsflujwd.ynt [2009/12/22 23:51:59 | 00,002,402 | -H-- | C] () -- C:\WINDOWS\sdqwfuhozjyetcqqalzisdspahsflujwd.ynt [2009/12/22 23:51:59 | 00,002,402 | -H-- | C] () -- C:\Program Files\sdqwfuhozjyetcqqalzisdspahsflujwd.ynt [2009/12/22 23:51:59 | 00,002,402 | -H-- | C] () -- C:\Documents and Settings\PL\Local Settings\Application Data\sdqwfuhozjyetcqqalzisdspahsflujwd.ynt [2009/12/22 23:51:57 | 00,000,316 | -H-- | C] () -- C:\WINDOWS\System32\pdtcogwguhziamdgthykxlddrbpfoasisgtl.myp [2009/12/22 23:51:57 | 00,000,316 | -H-- | C] () -- C:\WINDOWS\pdtcogwguhziamdgthykxlddrbpfoasisgtl.myp [2009/12/22 23:51:57 | 00,000,316 | -H-- | C] () -- C:\Program Files\pdtcogwguhziamdgthykxlddrbpfoasisgtl.myp [2009/12/22 23:51:57 | 00,000,316 | -H-- | C] () -- C:\Documents and Settings\PL\Local Settings\Application Data\pdtcogwguhziamdgthykxlddrbpfoasisgtl.myp [2009/12/22 23:51:57 | 00,000,280 | -H-- | C] () -- C:\WINDOWS\System32\cdgcbgjghhminmqgghlkklq.ebc [2009/12/22 23:51:57 | 00,000,280 | -H-- | C] () -- C:\WINDOWS\cdgcbgjghhminmqgghlkklq.ebc [2009/12/22 23:51:57 | 00,000,280 | -H-- | C] () -- C:\Program Files\cdgcbgjghhminmqgghlkklq.ebc [2009/12/22 23:51:57 | 00,000,280 | -H-- | C] () -- C:\Documents and Settings\PL\Local Settings\Application Data\cdgcbgjghhminmqgghlkklq.ebc [2009/12/22 05:00:27 | 00,573,440 | RHS- | C] () -- C:\WINDOWS\yrmarojyrjguriemext.exe [2009/12/22 05:00:27 | 00,573,440 | RHS- | C] () -- C:\WINDOWS\xnfqeyqcshbmguns.exe [2009/12/22 05:00:27 | 00,573,440 | RHS- | C] () -- C:\WINDOWS\rnlcwwumidduuonytpoidz.exe [2009/12/22 05:00:27 | 00,573,440 | RHS- | C] () -- C:\WINDOWS\nfzmcysgyplyukfmdv.exe [2009/12/22 05:00:27 | 00,573,440 | RHS- | C] () -- C:\WINDOWS\lfbqigcsmfdsqifohbyq.exe [2009/12/22 05:00:27 | 00,573,440 | RHS- | C] () -- C:\WINDOWS\evoapkdqhxsezoioe.exe [2009/12/22 05:00:27 | 00,573,440 | RHS- | C] () -- C:\WINDOWS\avsibaxojdcsrkismhfys.exe [2009/12/22 05:00:26 | 00,573,440 | RHS- | C] () -- C:\WINDOWS\System32\yrmarojyrjguriemext.exe [2009/12/22 05:00:26 | 00,573,440 | RHS- | C] () -- C:\WINDOWS\System32\rnlcwwumidduuonytpoidz.exe [2009/12/22 05:00:26 | 00,573,440 | RHS- | C] () -- C:\WINDOWS\System32\nfzmcysgyplyukfmdv.exe [2009/12/22 05:00:26 | 00,573,440 | RHS- | C] () -- C:\WINDOWS\System32\lfbqigcsmfdsqifohbyq.exe [2009/12/22 05:00:26 | 00,573,440 | RHS- | C] () -- C:\WINDOWS\System32\evoapkdqhxsezoioe.exe [2009/12/22 05:00:26 | 00,573,440 | RHS- | C] () -- C:\WINDOWS\System32\avsibaxojdcsrkismhfys.exe [2009/12/22 05:00:25 | 00,573,440 | RHS- | C] () -- C:\WINDOWS\System32\xnfqeyqcshbmguns.exe [2009/12/20 04:41:50 | 00,000,894 | ---- | C] () -- C:\Documents and Settings\PL\Desktop\Google Talk.lnk [2009/12/19 10:14:18 | 00,085,277 | ---- | C] () -- C:\Documents and Settings\PL\Desktop\6491_100235033327426_100000227884707_3522_5368382_n.jpg [2009/12/19 09:31:47 | 00,039,745 | ---- | C] () -- C:\Documents and Settings\PL\Desktop\13742_103984759620754_100000276905855_103942_2803951_n.jpg [2009/12/16 11:35:42 | 00,026,815 | ---- | C] () -- C:\Documents and Settings\PL\Desktop\14544_100666493293946_100000517871488_17099_385994_n.jpg [2009/12/16 11:04:27 | 00,020,148 | ---- | C] () -- C:\Documents and Settings\PL\Desktop\11169_102711916417297_100000354672339_63676_4501880_n.jpg [2009/12/16 05:56:10 | 00,023,824 | ---- | C] () -- C:\Documents and Settings\PL\Desktop\ca402d3b_0040022116873_00_600.jpg [2009/12/13 10:00:08 | 03,984,370 | ---- | C] () -- C:\Documents and Settings\PL\Desktop\Tose Proeski - Boze, brani je od zla.mp3 [2009/12/04 05:00:22 | 00,000,260 | ---- | C] () -- C:\WINDOWS\tasks\WGASetup.job [2009/12/01 09:25:28 | 00,015,360 | -H-- | C] () -- C:\Documents and Settings\PL\Desktop\photothumb.db [2009/11/29 12:43:09 | 03,932,214 | ---- | C] () -- C:\Documents and Settings\PL\Desktop\kilim.bmp [2009/11/28 08:37:28 | 08,573,432 | ---- | C] () -- C:\Documents and Settings\PL\Desktop\Galena - Na Dve Golemi2.mp3 [2009/11/26 08:57:44 | 03,530,672 | ---- | C] () -- C:\Documents and Settings\PL\Desktop\C-block - I'm So Strong Out.mp3 [2009/11/24 09:02:38 | 07,175,443 | ---- | C] () -- C:\Documents and Settings\PL\Desktop\Galena - Na dve golemi.mp3 [2009/09/30 16:42:27 | 00,000,032 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\ezsid.dat [2009/03/21 11:18:16 | 00,034,308 | ---- | C] () -- C:\WINDOWS\System32\BASSMOD.dll [2009/01/17 06:12:17 | 00,175,104 | ---- | C] () -- C:\WINDOWS\System32\RemoteControl.dll [2008/11/24 05:40:00 | 00,000,268 | ---- | C] () -- C:\WINDOWS\OWLCHESS.INI [2008/11/10 22:03:39 | 00,147,456 | R--- | C] () -- C:\WINDOWS\System32\igfxCoIn_v4885.dll [2008/08/29 02:04:13 | 00,000,900 | ---- | C] () -- C:\WINDOWS\rm305.ini [2008/08/29 01:43:06 | 00,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini [2008/02/08 04:22:07 | 00,051,712 | ---- | C] () -- C:\Documents and Settings\PL\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2007/12/28 03:24:23 | 00,204,800 | R--- | C] () -- C:\WINDOWS\System32\igfxCoIn_v4764.dll [2007/12/28 03:22:41 | 00,008,606 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini [2007/12/28 03:22:40 | 00,010,288 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS [2007/12/27 22:53:55 | 00,024,576 | R--- | C] () -- C:\WINDOWS\VMPipe.dll [2007/12/27 21:41:25 | 00,421,888 | ---- | C] () -- C:\WINDOWS\System32\OpenQuicktimeLib.dll [2007/12/27 21:41:24 | 00,679,936 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll [2007/12/27 21:41:24 | 00,157,696 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll [2007/12/27 21:41:22 | 00,019,968 | ---- | C] () -- C:\WINDOWS\System32\cpuinf32.dll [2007/12/27 21:39:14 | 00,028,672 | ---- | C] () -- C:\WINDOWS\System32\newdll.dll [2004/08/04 00:00:00 | 00,027,440 | ---- | C] () -- C:\WINDOWS\System32\drivers\secdrv.sys [2004/08/04 00:00:00 | 00,025,283 | ---- | C] () -- C:\Documents and Settings\PL\Application Data\addon.dat ========== LOP Check ========== [2008/08/29 01:40:19 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ESET [2009/03/10 00:19:18 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP [2008/12/19 07:21:02 | 00,000,000 | ---D | M] -- C:\Documents and Settings\PL\Application Data\BSplayer Pro [2009/04/10 07:45:55 | 00,000,000 | ---D | M] -- C:\Documents and Settings\PL\Application Data\CometNetwork [2009/09/18 18:09:32 | 00,000,000 | ---D | M] -- C:\Documents and Settings\PL\Application Data\ErrorSmart [2008/12/30 04:38:57 | 00,000,000 | ---D | M] -- C:\Documents and Settings\PL\Application Data\Home Sweet Home Christmas [2009/01/19 23:50:12 | 00,000,000 | ---D | M] -- C:\Documents and Settings\PL\Application Data\Pamela [2009/06/21 10:04:14 | 00,000,000 | ---D | M] -- C:\Documents and Settings\PL\Application Data\TeamViewer [2009/12/23 12:03:49 | 00,000,260 | ---- | M] () -- C:\WINDOWS\Tasks\WGASetup.job ========== Purity Check ========== ========== Files - Unicode (All) ========== [2009/12/22 10:26:29 | 00,000,143 | ---- | M] ()(C:\Documents and Settings\PL\Desktop\???? ?? ?????? 300,000 ?????? ?????? ???????? ?? ?????? ????? ???? ??!.URL) -- C:\Documents and Settings\PL\Desktop\Мога да събера 300,000 човека ПРОТИВ новините на турски преди тези ЗА!.URL [2009/12/22 10:26:29 | 00,000,143 | ---- | C] ()(C:\Documents and Settings\PL\Desktop\???? ?? ?????? 300,000 ?????? ?????? ???????? ?? ?????? ????? ???? ??!.URL) -- C:\Documents and Settings\PL\Desktop\Мога да събера 300,000 човека ПРОТИВ новините на турски преди тези ЗА!.URL [2009/10/20 20:59:17 | 01,067,881 | ---- | M] ()(C:\Documents and Settings\PL\My Documents\??????0034.jpg) -- C:\Documents and Settings\PL\My Documents\Снимки0034.jpg [2009/10/20 20:58:46 | 01,067,881 | ---- | C] ()(C:\Documents and Settings\PL\My Documents\??????0034.jpg) -- C:\Documents and Settings\PL\My Documents\Снимки0034.jpg [2009/03/19 10:12:26 | 00,273,095 | ---- | M] ()(C:\Documents and Settings\PL\My Documents\???????.008.jpg) -- C:\Documents and Settings\PL\My Documents\Изображ.008.jpg [2009/03/19 10:12:20 | 00,273,095 | ---- | C] ()(C:\Documents and Settings\PL\My Documents\???????.008.jpg) -- C:\Documents and Settings\PL\My Documents\Изображ.008.jpg [2009/03/19 10:11:59 | 00,270,133 | ---- | M] ()(C:\Documents and Settings\PL\My Documents\???????.007.jpg) -- C:\Documents and Settings\PL\My Documents\Изображ.007.jpg [2009/03/19 10:11:53 | 00,270,133 | ---- | C] ()(C:\Documents and Settings\PL\My Documents\???????.007.jpg) -- C:\Documents and Settings\PL\My Documents\Изображ.007.jpg [2009/03/05 03:20:44 | 00,052,971 | ---- | M] ()(C:\Documents and Settings\PL\My Documents\??? ???r5tyt.JPG) -- C:\Documents and Settings\PL\My Documents\без имеr5tyt.JPG [2009/03/05 03:20:41 | 00,052,971 | ---- | C] ()(C:\Documents and Settings\PL\My Documents\??? ???r5tyt.JPG) -- C:\Documents and Settings\PL\My Documents\без имеr5tyt.JPG [2009/03/05 03:19:43 | 00,043,274 | ---- | M] ()(C:\Documents and Settings\PL\My Documents\??? ???kk.JPG) -- C:\Documents and Settings\PL\My Documents\без имеkk.JPG [2009/03/05 03:19:40 | 00,043,274 | ---- | C] ()(C:\Documents and Settings\PL\My Documents\??? ???kk.JPG) -- C:\Documents and Settings\PL\My Documents\без имеkk.JPG [2009/03/04 07:59:07 | 01,224,704 | ---- | M] (German IT Development Ltd.)(C:\Documents and Settings\PL\My Documents\????? ?? bira.exe) -- C:\Documents and Settings\PL\My Documents\Копие от bira.exe [2009/03/04 07:58:04 | 01,224,704 | ---- | C] (German IT Development Ltd.)(C:\Documents and Settings\PL\My Documents\????? ?? bira.exe) -- C:\Documents and Settings\PL\My Documents\Копие от bira.exe [2009/03/04 06:40:09 | 00,115,357 | ---- | M] ()(C:\Documents and Settings\PL\My Documents\?????.000.jpg) -- C:\Documents and Settings\PL\My Documents\изобр.000.jpg [2009/03/04 06:40:02 | 00,115,357 | ---- | C] ()(C:\Documents and Settings\PL\My Documents\?????.000.jpg) -- C:\Documents and Settings\PL\My Documents\изобр.000.jpg [2009/03/04 06:40:00 | 00,103,860 | ---- | M] ()(C:\Documents and Settings\PL\My Documents\?????.002-001.jpg) -- C:\Documents and Settings\PL\My Documents\изобр.002-001.jpg [2009/03/04 06:39:55 | 00,103,860 | ---- | C] ()(C:\Documents and Settings\PL\My Documents\?????.002-001.jpg) -- C:\Documents and Settings\PL\My Documents\изобр.002-001.jpg [2009/03/04 05:56:59 | 00,077,290 | ---- | M] ()(C:\Documents and Settings\PL\My Documents\???????????002.jpg) -- C:\Documents and Settings\PL\My Documents\Изображение002.jpg [2009/03/04 05:56:49 | 00,077,290 | ---- | C] ()(C:\Documents and Settings\PL\My Documents\???????????002.jpg) -- C:\Documents and Settings\PL\My Documents\Изображение002.jpg [2009/03/04 05:56:11 | 00,061,410 | ---- | M] ()(C:\Documents and Settings\PL\My Documents\???????????001.jpg) -- C:\Documents and Settings\PL\My Documents\Изображение001.jpg [2009/03/04 05:56:05 | 00,061,410 | ---- | C] ()(C:\Documents and Settings\PL\My Documents\???????????001.jpg) -- C:\Documents and Settings\PL\My Documents\Изображение001.jpg [2009/03/04 05:55:57 | 00,062,646 | ---- | M] ()(C:\Documents and Settings\PL\My Documents\???????????000.jpg) -- C:\Documents and Settings\PL\My Documents\Изображение000.jpg [2009/03/04 05:55:51 | 00,062,646 | ---- | C] ()(C:\Documents and Settings\PL\My Documents\???????????000.jpg) -- C:\Documents and Settings\PL\My Documents\Изображение000.jpg [2009/02/22 23:48:54 | 00,035,328 | ---- | M] ()(C:\Documents and Settings\PL\My Documents\????? ?????? ?????? ?? ???????.doc) -- C:\Documents and Settings\PL\My Documents\КАКВО МИСЛЯТ ДЕЦАТА ЗА ЛЮБОВТА.doc [2009/02/22 23:48:49 | 00,035,328 | ---- | C] ()(C:\Documents and Settings\PL\My Documents\????? ?????? ?????? ?? ???????.doc) -- C:\Documents and Settings\PL\My Documents\КАКВО МИСЛЯТ ДЕЦАТА ЗА ЛЮБОВТА.doc ========== Alternate Data Streams ========== @Alternate Data Stream - 145 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:75EC4D20 < End of report > Tова е от Extras OTL Extras logfile created on: 12/23/2009 1:06:42 PM - Run 2 OTL by OldTimer - Version 3.1.19.0 Folder = C:\Documents and Settings\PL\Desktop Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2900.2180) Locale: 00000402 | Country: United States | Language: ENU | Date Format: M/d/yyyy 1,015.00 Mb Total Physical Memory | 613.00 Mb Available Physical Memory | 60.00% Memory free 2.00 Gb Paging File | 1.00 Gb Available in Paging File | 82.00% Paging File free Paging file location(s): C:\pagefile.sys 756 1512 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 39.06 Gb Total Space | 15.75 Gb Free Space | 40.32% Space Free | Partition Type: NTFS Drive D: | 193.82 Gb Total Space | 175.69 Gb Free Space | 90.64% Space Free | Partition Type: NTFS E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: SS-CCDFCCD52405 Current User Name: PL Logged in as Administrator. Current Boot Mode: Normal Scan Mode: All users Company Name Whitelist: On Skip Microsoft Files: On File Age = 30 Days Output = Minimal ========== Extra Registry (SafeList) ========== ========== File Associations ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) [HKEY_USERS\S-1-5-21-1060284298-1659004503-839522115-1003\SOFTWARE\Classes\<extension>] .html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) ========== Shell Spawning ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* exefile [open] -- "%1" %* htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation) htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation) htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation) htmlfile [print] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation) http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation) https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation) scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~2\Office12\ONENOTE.EXE "%L" (Microsoft Corporation) Directory [Winamp.Bookmark] -- "C:\Program Files\Winamp\Winamp.exe" /BOOKMARK "%1" (Nullsoft) Directory [Winamp.Enqueue] -- "C:\Program Files\Winamp\Winamp.exe" /ADD "%1" (Nullsoft) Directory [Winamp.Play] -- "C:\Program Files\Winamp\Winamp.exe" "%1" (Nullsoft) Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation) Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation) Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation) CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation) ========== Security Center Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "FirstRunDisabled" = 1 "AntiVirusDisableNotify" = 0 "FirewallDisableNotify" = 0 "UpdatesDisableNotify" = 0 "AntiVirusOverride" = 0 "FirewallOverride" = 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List] "1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007 "2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008 "17739:TCP" = 17739:TCP:*:Enabled:BitComet 17739 TCP "17739:UDP" = 17739:UDP:*:Enabled:BitComet 17739 UDP "13943:TCP" = 13943:TCP:*:Enabled:BitComet 13943 TCP "13943:UDP" = 13943:UDP:*:Enabled:BitComet 13943 UDP ========== Authorized Applications List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE" = C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook -- (Microsoft Corporation) "C:\Program Files\Microsoft Office\Office12\GROOVE.EXE" = C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove -- (Microsoft Corporation) "C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE" = C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote -- (Microsoft Corporation) "D:\Games\mc2\mc2.exe" = D:\Games\mc2\mc2.exe:*:Disabled:mc2 -- File not found "C:\Program Files\TeamViewer\Version4\TeamViewer.exe" = C:\Program Files\TeamViewer\Version4\TeamViewer.exe:*:Enabled:TeamViewer Remote Control Application -- File not found "C:\Program Files\BitComet\BitComet.exe" = C:\Program Files\BitComet\BitComet.exe:*:Enabled:BitComet - a BitTorrent Client -- (www.BitComet.com) "C:\WINDOWS\system32\dpvsetup.exe" = C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test -- (Microsoft Corporation) "C:\Program Files\Google\Google Talk\googletalk.exe" = C:\Program Files\Google\Google Talk\googletalk.exe:*:Enabled:Google Talk -- (Google) "C:\Documents and Settings\PL\Desktop\TeamViewer.exe" = C:\Documents and Settings\PL\Desktop\TeamViewer.exe:*:Enabled:TeamViewer Remote Control Application -- File not found "C:\Documents and Settings\PL\Desktop\Counter-Strike\hl.exe" = C:\Documents and Settings\PL\Desktop\Counter-Strike\hl.exe:*:Enabled:Half-Life Launcher -- (Valve) "C:\Documents and Settings\PL\Desktop\TeamViewer 2.exe" = C:\Documents and Settings\PL\Desktop\TeamViewer 2.exe:*:Disabled:TeamViewer Remote Control Application -- (TeamViewer GmbH) "C:\Program Files\Skype\Phone\Skype.exe" = C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype -- File not found "C:\Documents and Settings\PL\Local Settings\Temp\yfoqvgp.exe" = C:\Documents and Settings\PL\Local Settings\Temp\yfoqvgp.exe:*:Disabled:yfoqvgp -- () ========== HKEY_LOCAL_MACHINE Uninstall List ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 "{226b64e8-dc75-4eea-a6c8-abcb496320f2}-Google Talk" = Google Talk (remove only) "{26A24AE4-039D-4CA4-87B4-2F83216013FF}" = Java 6 Update 13 "{3248F0A8-6813-11D6-A77B-00B0D0150080}" = J2SE Runtime Environment 5.0 Update 8 "{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP "{66268879-215C-4D5B-B197-1D9868339BAD}" = ErrorSmart "{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD "{6BE2A4A4-99FB-48ED-AE1E-4E850389F804}" = PartitionMagic "{883C01B2-7C86-4797-86B3-BFB128A3100B}" = A4Tech PC Camera "{8AD824A5-1CCC-4BB7-82C9-E6FB25CC0479}" = Vimicro USB PC Camera(VC0305) "{90120000-0010-0409-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (English) 12 "{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007 "{90120000-0015-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007 "{90120000-0016-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007 "{90120000-0018-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007 "{90120000-0019-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007 "{90120000-001A-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007 "{90120000-001B-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007 "{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) "{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007 "{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) "{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007 "{90120000-001F-0C0A-0000-0000000FF1CE}_ENTERPRISE_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) "{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007 "{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007 "{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581) "{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007 "{90120000-0044-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007 "{90120000-006E-0409-0000-0000000FF1CE}_ENTERPRISE_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007 "{90120000-00A1-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2007 "{90120000-00BA-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-0114-0409-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (English) 2007 "{90120000-0114-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007 "{90120000-0115-0409-0000-0000000FF1CE}_ENTERPRISE_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007 "{90120000-0117-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2) "{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 "{AC76BA86-7AD7-1033-7B44-A81300000003}" = Adobe Reader 8.1.4 "{ACCA20B0-C4D1-4BF5-BF21-0A0EB5EF9730}" = REALTEK GbE & FE Ethernet PCI NIC Driver "{ADE16A9D-FBDC-4ECC-B6BD-9C31E51D0305}" = USB PC Camera VC305 "{C9BED750-1211-4480-B1A5-718A3BE15525}" = REALTEK GbE & FE Ethernet PCI-E NIC Driver "{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver "Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin "BitComet" = BitComet 1.09 "BSPlayer1" = BSPlayer "CCleaner" = CCleaner (remove only) "CleanUp!" = CleanUp! "CometBird (3.5.2)" = CometBird (3.5.2) "Counter-Strike" = Counter-Strike 1.0 "ENTERPRISE" = Microsoft Office Enterprise 2007 "HDMI" = Intel® Graphics Media Accelerator Driver "Home Sweet Home Christmas Edition1.00" = Home Sweet Home Christmas Edition "InstallShield_{6BE2A4A4-99FB-48ED-AE1E-4E850389F804}" = PowerQuest PartitionMagic 8.0 "KLiteCodecPack_is1" = K-Lite Codec Pack 2.47 Standard "Mozilla Firefox (3.0.16)" = Mozilla Firefox (3.0.16) "Nero - Burning Rom!UninstallKey" = Nero 6 Ultra Edition "PhotoScape" = PhotoScape "Picasa 3" = Picasa 3 "vloader 2.4" = vloader 2.4 "Winamp" = Winamp (remove only) "WinRAR archiver" = WinRAR archiver ========== Last 10 Event Log Errors ========== [ Application Events ] Error - 8/26/2009 1:54:36 PM | Computer Name = SS-CCDFCCD52405 | Source = Avira AntiVir | ID = 4118 Description = Error - 8/27/2009 2:18:18 AM | Computer Name = SS-CCDFCCD52405 | Source = ESENT | ID = 490 Description = svchost (880) An attempt to open the file "C:\WINDOWS\system32\CatRoot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb" for read / write access failed with system error 32 (0x00000020): "The process cannot access the file because it is being used by another process. ". The open file operation will fail with error -1032 (0xfffffbf8). Error - 9/10/2009 3:27:01 PM | Computer Name = SS-CCDFCCD52405 | Source = crypt32 | ID = 131080 Description = Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: The server name or address could not be resolved Error - 9/22/2009 11:46:02 AM | Computer Name = SS-CCDFCCD52405 | Source = Avira AntiVir | ID = 4118 Description = Error - 10/24/2009 12:07:13 AM | Computer Name = SS-CCDFCCD52405 | Source = crypt32 | ID = 131080 Description = Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: The server name or address could not be resolved Error - 12/12/2009 2:56:02 PM | Computer Name = SS-CCDFCCD52405 | Source = ESENT | ID = 490 Description = svchost (880) An attempt to open the file "C:\WINDOWS\system32\CatRoot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb" for read / write access failed with system error 32 (0x00000020): "The process cannot access the file because it is being used by another process. ". The open file operation will fail with error -1032 (0xfffffbf8). Error - 12/14/2009 10:52:09 AM | Computer Name = SS-CCDFCCD52405 | Source = ESENT | ID = 490 Description = svchost (880) An attempt to open the file "C:\WINDOWS\system32\CatRoot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb" for read / write access failed with system error 32 (0x00000020): "The process cannot access the file because it is being used by another process. ". The open file operation will fail with error -1032 (0xfffffbf8). Error - 12/21/2009 3:54:55 AM | Computer Name = SS-CCDFCCD52405 | Source = ESENT | ID = 490 Description = svchost (884) An attempt to open the file "C:\WINDOWS\system32\CatRoot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb" for read / write access failed with system error 32 (0x00000020): "The process cannot access the file because it is being used by another process. ". The open file operation will fail with error -1032 (0xfffffbf8). Error - 12/22/2009 1:00:15 PM | Computer Name = SS-CCDFCCD52405 | Source = Avira AntiVir | ID = 4118 Description = Error - 12/22/2009 1:04:00 PM | Computer Name = SS-CCDFCCD52405 | Source = ESENT | ID = 490 Description = svchost (880) An attempt to open the file "C:\WINDOWS\system32\CatRoot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb" for read / write access failed with system error 32 (0x00000020): "The process cannot access the file because it is being used by another process. ". The open file operation will fail with error -1032 (0xfffffbf8). [ System Events ] Error - 12/22/2009 2:37:44 PM | Computer Name = SS-CCDFCCD52405 | Source = Service Control Manager | ID = 7023 Description = The Computer Browser service terminated with the following error: %%1460 Error - 12/23/2009 7:43:08 AM | Computer Name = SS-CCDFCCD52405 | Source = sr | ID = 1 Description = The System Restore filter encountered the unexpected error '0xC0000034' while processing the file '_filelst.cfg' on the volume 'HarddiskVolume1'. It has stopped monitoring the volume. Error - 12/23/2009 7:43:29 AM | Computer Name = SS-CCDFCCD52405 | Source = Service Control Manager | ID = 7023 Description = The Windows Firewall/Internet Connection Sharing (ICS) service terminated with the following error: %%2147500053 Error - 12/23/2009 7:48:20 AM | Computer Name = SS-CCDFCCD52405 | Source = Service Control Manager | ID = 7023 Description = The Computer Browser service terminated with the following error: %%1460 Error - 12/23/2009 7:51:28 AM | Computer Name = SS-CCDFCCD52405 | Source = Service Control Manager | ID = 7034 Description = The Cyberlink RichVideo Service(CRVS) service terminated unexpectedly. It has done this 1 time(s). Error - 12/23/2009 7:51:31 AM | Computer Name = SS-CCDFCCD52405 | Source = Service Control Manager | ID = 7034 Description = The Java Quick Starter service terminated unexpectedly. It has done this 1 time(s). Error - 12/23/2009 3:55:06 PM | Computer Name = SS-CCDFCCD52405 | Source = Dhcp | ID = 1000 Description = Your computer has lost the lease to its IP address 192.168.55.80 on the Network Card with network address 001A4D3D580F. Error - 12/23/2009 8:03:33 PM | Computer Name = SS-CCDFCCD52405 | Source = sr | ID = 1 Description = The System Restore filter encountered the unexpected error '0xC0000034' while processing the file '_filelst.cfg' on the volume 'HarddiskVolume1'. It has stopped monitoring the volume. Error - 12/23/2009 8:03:50 PM | Computer Name = SS-CCDFCCD52405 | Source = Service Control Manager | ID = 7023 Description = The Windows Firewall/Internet Connection Sharing (ICS) service terminated with the following error: %%2147500053 Error - 12/23/2009 8:08:48 PM | Computer Name = SS-CCDFCCD52405 | Source = Service Control Manager | ID = 7023 Description = The Computer Browser service terminated with the following error: %%1460 < End of report >

А настройките на OTL как да са? Както в първата тема ли?

Лог фаила на Пажлина след стартиране на SafeBootKeyRepair.exe е Reg export of SafeBoot key after repair: ======================== Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot] "AlternateShell"="cmd.exe" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\AppMgmt] @="Service" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\Base] @="Driver Group" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\Boot Bus Extender] @="Driver Group" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\Boot file system] @="Driver Group" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\CryptSvc] @="Service" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\DcomLaunch] @="Service" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\dmadmin] @="Service" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\dmboot.sys] @="Driver" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\dmio.sys] @="Driver" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\dmload.sys] @="Driver" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\dmserver] @="Service" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\EventLog] @="Service" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\File system] @="Driver Group" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\Filter] @="Driver Group" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\HelpSvc] @="Service" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\Netlogon] @="Service" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\PCI Configuration] @="Driver Group" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\PlugPlay] @="Service" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\PNP Filter] @="Driver Group" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\Primary disk] @="Driver Group" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\RpcSs] @="Service" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\SCSI Class] @="Driver Group" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\sermouse.sys] @="Driver" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\sr.sys] @="FSFilter System Recovery" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\SRService] @="Service" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\System Bus Extender] @="Driver Group" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\vga.sys] @="Driver" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\vgasave.sys] @="Driver" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\WinMgmt] @="Service" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{36FC9E60-C465-11CF-8056-444553540000}] @="Universal Serial Bus controllers" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E965-E325-11CE-BFC1-08002BE10318}] @="CD-ROM Drive" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}] @="DiskDrive" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E969-E325-11CE-BFC1-08002BE10318}] @="Standard floppy disk controller" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E96A-E325-11CE-BFC1-08002BE10318}] @="Hdc" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E96B-E325-11CE-BFC1-08002BE10318}] @="Keyboard" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E96F-E325-11CE-BFC1-08002BE10318}] @="Mouse" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E977-E325-11CE-BFC1-08002BE10318}] @="PCMCIA Adapters" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E97B-E325-11CE-BFC1-08002BE10318}] @="SCSIAdapter" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E97D-E325-11CE-BFC1-08002BE10318}] @="System" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E980-E325-11CE-BFC1-08002BE10318}] @="Floppy disk drive" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{71A27CDD-812A-11D0-BEC7-08002BE2092F}] @="Volume" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}] @="Human Interface Devices" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\AFD] @="Service" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\AppMgmt] @="Service" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Base] @="Driver Group" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Boot Bus Extender] @="Driver Group" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Boot file system] @="Driver Group" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Browser] @="Service" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\CryptSvc] @="Service" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\DcomLaunch] @="Service" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Dhcp] @="Service" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\dmadmin] @="Service" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\dmboot.sys] @="Driver" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\dmio.sys] @="Driver" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\dmload.sys] @="Driver" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\dmserver] @="Service" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\DnsCache] @="Service" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\EventLog] @="Service" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\File system] @="Driver Group" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Filter] @="Driver Group" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\HelpSvc] @="Service" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\ip6fw.sys] @="Driver" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\ipnat.sys] @="Driver" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\LanmanServer] @="Service" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\LanmanWorkstation] @="Service" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\LmHosts] @="Service" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Messenger] @="Service" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NDIS] @="Driver Group" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NDIS Wrapper] @="Driver Group" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Ndisuio] @="Service" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NetBIOS] @="Service" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NetBIOSGroup] @="Driver Group" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NetBT] @="Service" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NetDDEGroup] @="Driver Group" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Netlogon] @="Service" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NetMan] @="Service" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Network] @="Driver Group" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NetworkProvider] @="Driver Group" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NtLmSsp] @="Service" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\PCI Configuration] @="Driver Group" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\PlugPlay] @="Service" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\PNP Filter] @="Driver Group" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\PNP_TDI] @="Driver Group" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Primary disk] @="Driver Group" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\rdpcdd.sys] @="Driver" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\rdpdd.sys] @="Driver" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\rdpwd.sys] @="Driver" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\rdsessmgr] @="Service" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\RpcSs] @="Service" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\SCSI Class] @="Driver Group" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\sermouse.sys] @="Driver" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\SharedAccess] @="Service" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\sr.sys] @="FSFilter System Recovery" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\SRService] @="Service" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Streams Drivers] @="Driver Group" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\System Bus Extender] @="Driver Group" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Tcpip] @="Service" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\TDI] @="Driver Group" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\tdpipe.sys] @="Driver" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\tdtcp.sys] @="Driver" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\termservice] @="Service" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\vga.sys] @="Driver" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\vgasave.sys] @="Driver" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\WinMgmt] @="Service" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\WZCSVC] @="Service" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{36FC9E60-C465-11CF-8056-444553540000}] @="Universal Serial Bus controllers" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E965-E325-11CE-BFC1-08002BE10318}] @="CD-ROM Drive" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}] @="DiskDrive" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E969-E325-11CE-BFC1-08002BE10318}] @="Standard floppy disk controller" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E96A-E325-11CE-BFC1-08002BE10318}] @="Hdc" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E96B-E325-11CE-BFC1-08002BE10318}] @="Keyboard" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E96F-E325-11CE-BFC1-08002BE10318}] @="Mouse" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}] @="Net" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E973-E325-11CE-BFC1-08002BE10318}] @="NetClient" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E974-E325-11CE-BFC1-08002BE10318}] @="NetService" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E975-E325-11CE-BFC1-08002BE10318}] @="NetTrans" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E977-E325-11CE-BFC1-08002BE10318}] @="PCMCIA Adapters" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E97B-E325-11CE-BFC1-08002BE10318}] @="SCSIAdapter" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E97D-E325-11CE-BFC1-08002BE10318}] @="System" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E980-E325-11CE-BFC1-08002BE10318}] @="Floppy disk drive" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{71A27CDD-812A-11D0-BEC7-08002BE2092F}] @="Volume" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}] @="Human Interface Devices" ======================== Сега ще стартирам и Malware На Павлина в компютъра се ровя със TeamViewer. До тук всичко е много добре, но сега не ми дава да инсталирам Malwarebytes Anti-Malware 1.42 (kaldata.com. Деинсталирах и Скайпа на Павлина Има ли нещо което може да се направи?

Това е от лог фаила на Павлина All processes killed ========== OTL ========== Process xnfqeyqcshbmguns.exe killed successfully! No active process named yfoqvgp.exe was found! No active process named ErrorSmart.exe was found! No active process named explorer.exe was found! Registry value HKEY_USERS\S-1-5-21-1060284298-1659004503-839522115-1003\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\ not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ErrorSmart deleted successfully. C:\Program Files\ErrorSmart\ErrorSmart.exe moved successfully. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\evoapkdqhxsezoioe deleted successfully. C:\Documents and Settings\PL\Local Settings\Temp\avsibaxojdcsrkismhfys.exe moved successfully. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\sdqwfuhozjy deleted successfully. C:\WINDOWS\system32\avsibaxojdcsrkismhfys.exe moved successfully. Registry value HKEY_USERS\S-1-5-21-1060284298-1659004503-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Run\\pdtcogwguhziam deleted successfully. C:\WINDOWS\system32\evoapkdqhxsezoioe.exe moved successfully. Registry value HKEY_USERS\S-1-5-21-1060284298-1659004503-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Run\\sdqwfuhozjy deleted successfully. C:\Documents and Settings\PL\Local Settings\Temp\nfzmcysgyplyukfmdv.exe moved successfully. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce\\pbpwgwksepfm deleted successfully. File C:\WINDOWS\System32\avsibaxojdcsrkismhfys.exe not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce\\xnfqeyqcshbmguns deleted successfully. C:\Documents and Settings\PL\Local Settings\Temp\evoapkdqhxsezoioe.exe moved successfully. Registry value HKEY_USERS\S-1-5-21-1060284298-1659004503-839522115-1003\Software\Microsoft\Windows\CurrentVersion\RunOnce\\pbpwgwksepfm deleted successfully. C:\Documents and Settings\PL\Local Settings\Temp\xnfqeyqcshbmguns.exe moved successfully. Registry value HKEY_USERS\S-1-5-21-1060284298-1659004503-839522115-1003\Software\Microsoft\Windows\CurrentVersion\RunOnce\\shyivofqftmwpcu deleted successfully. C:\WINDOWS\system32\lfbqigcsmfdsqifohbyq.exe moved successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\\obqyjapylxown deleted successfully. C:\WINDOWS\System32\nfzmcysgyplyukfmdv.exe moved successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\\xhtygugmwf deleted successfully. File C:\DOCUME~1\PL\LOCALS~1\Temp\xnfqeyqcshbmguns.exe not found. C:\autorun.inf moved successfully. D:\autorun.inf moved successfully. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{91b3a242-b567-11dc-bdd8-806d6172696f}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{91b3a242-b567-11dc-bdd8-806d6172696f}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{91b3a242-b567-11dc-bdd8-806d6172696f}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{91b3a242-b567-11dc-bdd8-806d6172696f}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{91b3a242-b567-11dc-bdd8-806d6172696f}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{91b3a242-b567-11dc-bdd8-806d6172696f}\ not found. File F:\AUTORUN.EXE MAIN\ASSETUP.EXE not found. C:\WINDOWS\sdqwfuhozjyetcqqalzisdspahsflujwd.ynt moved successfully. C:\Program Files\sdqwfuhozjyetcqqalzisdspahsflujwd.ynt moved successfully. C:\Documents and Settings\PL\Local Settings\Application Data\sdqwfuhozjyetcqqalzisdspahsflujwd.ynt moved successfully. C:\WINDOWS\cdgcbgjghhminmqgghlkklq.ebc moved successfully. C:\Program Files\cdgcbgjghhminmqgghlkklq.ebc moved successfully. C:\Documents and Settings\PL\Local Settings\Application Data\cdgcbgjghhminmqgghlkklq.ebc moved successfully. C:\WINDOWS\system32\cdgcbgjghhminmqgghlkklq.ebc moved successfully. C:\WINDOWS\system32\sdqwfuhozjyetcqqalzisdspahsflujwd.ynt moved successfully. C:\WINDOWS\pdtcogwguhziamdgthykxlddrbpfoasisgtl.myp moved successfully. C:\Documents and Settings\PL\Local Settings\Application Data\pdtcogwguhziamdgthykxlddrbpfoasisgtl.myp moved successfully. C:\WINDOWS\system32\pdtcogwguhziamdgthykxlddrbpfoasisgtl.myp moved successfully. C:\Program Files\pdtcogwguhziamdgthykxlddrbpfoasisgtl.myp moved successfully. C:\WINDOWS\yrmarojyrjguriemext.exe moved successfully. C:\WINDOWS\rnlcwwumidduuonytpoidz.exe moved successfully. C:\WINDOWS\nfzmcysgyplyukfmdv.exe moved successfully. C:\WINDOWS\lfbqigcsmfdsqifohbyq.exe moved successfully. C:\WINDOWS\avsibaxojdcsrkismhfys.exe moved successfully. C:\WINDOWS\xnfqeyqcshbmguns.exe moved successfully. C:\WINDOWS\evoapkdqhxsezoioe.exe moved successfully. C:\WINDOWS\system32\shyivofqftmwpcuymbtgujcdsdsjtgzqbqexh.nfj moved successfully. C:\WINDOWS\shyivofqftmwpcuymbtgujcdsdsjtgzqbqexh.nfj moved successfully. C:\Program Files\shyivofqftmwpcuymbtgujcdsdsjtgzqbqexh.nfj moved successfully. C:\Documents and Settings\PL\Local Settings\Application Data\shyivofqftmwpcuymbtgujcdsdsjtgzqbqexh.nfj moved successfully. C:\WINDOWS\tasks\ErrorSmart Scheduled Scan.job moved successfully. C:\WINDOWS\system32\yrmarojyrjguriemext.exe moved successfully. C:\WINDOWS\system32\rnlcwwumidduuonytpoidz.exe moved successfully. File C:\WINDOWS\System32\lfbqigcsmfdsqifohbyq.exe not found. File C:\WINDOWS\System32\avsibaxojdcsrkismhfys.exe not found. File C:\WINDOWS\System32\nfzmcysgyplyukfmdv.exe not found. File C:\WINDOWS\System32\evoapkdqhxsezoioe.exe not found. C:\WINDOWS\system32\xnfqeyqcshbmguns.exe moved successfully. C:\WINDOWS\system32\pbpwgwksepfmcmbcnzoyjvljvdpdkukygs.taq moved successfully. C:\WINDOWS\pbpwgwksepfmcmbcnzoyjvljvdpdkukygs.taq moved successfully. C:\Program Files\pbpwgwksepfmcmbcnzoyjvljvdpdkukygs.taq moved successfully. C:\Documents and Settings\PL\Local Settings\Application Data\pbpwgwksepfmcmbcnzoyjvljvdpdkukygs.taq moved successfully. ========== FILES ========== File\Folder C:\WINDOWS\system32\xnfqeyqcshbmguns.exe not found. C:\Documents and Settings\PL\Local Settings\Temp\yfoqvgp.exe moved successfully. C:\Program Files\ErrorSmart\Microsoft.VC80.MFC folder moved successfully. C:\Program Files\ErrorSmart\Microsoft.VC80.CRT folder moved successfully. C:\Program Files\ErrorSmart folder moved successfully. ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: LocalService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 5041816 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: PL ->Temp folder emptied: 1878665111 bytes ->Temporary Internet Files folder emptied: 158363 bytes ->Java cache emptied: 0 bytes ->FireFox cache emptied: 112698767 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 2142714 bytes %systemroot%\System32 .tmp files removed: 2577 bytes Windows Temp folder emptied: 15200750 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes RecycleBin emptied: 514004 bytes Total Files Cleaned = 1,921.00 mb C:\WINDOWS\System32\drivers\etc\Hosts moved successfully. HOSTS file reset successfully OTL by OldTimer - Version 3.1.19.0 log created on 12222009_235127 Files\Folders moved on Reboot... C:\Documents and Settings\PL\Local Settings\Temp\avsibaxojdcsrkismhfys.exe moved successfully. C:\Documents and Settings\PL\Local Settings\Temp\evoapkdqhxsezoioe.exe moved successfully. C:\Documents and Settings\PL\Local Settings\Temp\lfbqigcsmfdsqifohbyq.exe moved successfully. C:\Documents and Settings\PL\Local Settings\Temp\nfzmcysgyplyukfmdv.exe moved successfully. C:\Documents and Settings\PL\Local Settings\Temp\rnlcwwumidduuonytpoidz.exe moved successfully. C:\Documents and Settings\PL\Local Settings\Temp\xnfqeyqcshbmguns.exe moved successfully. C:\Documents and Settings\PL\Local Settings\Temp\yfoqvgp.exe moved successfully. C:\Documents and Settings\PL\Local Settings\Temp\yrmarojyrjguriemext.exe moved successfully. Registry entries deleted on Reboot... Това е от моя лог фаил Иван All processes killed ========== OTL ========== No active process named xnfqeyqcshbmguns.exe was found! No active process named yfoqvgp.exe was found! No active process named ErrorSmart.exe was found! No active process named explorer.exe was found! Registry key HKEY_USERS\S-1-5-21-1060284298-1659004503-839522115-1003\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\ not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ErrorSmart not found. File C:\Program Files\ErrorSmart\ErrorSmart.exe not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\evoapkdqhxsezoioe not found. File C:\Documents and Settings\PL\Local Settings\Temp\avsibaxojdcsrkismhfys.exe not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\sdqwfuhozjy not found. File C:\WINDOWS\System32\avsibaxojdcsrkismhfys.exe not found. Registry key HKEY_USERS\S-1-5-21-1060284298-1659004503-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Run not found. File C:\WINDOWS\System32\evoapkdqhxsezoioe.exe not found. Registry key HKEY_USERS\S-1-5-21-1060284298-1659004503-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Run not found. File C:\Documents and Settings\PL\Local Settings\Temp\nfzmcysgyplyukfmdv.exe not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce\\pbpwgwksepfm not found. File C:\WINDOWS\System32\avsibaxojdcsrkismhfys.exe not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce\\xnfqeyqcshbmguns not found. File C:\Documents and Settings\PL\Local Settings\Temp\evoapkdqhxsezoioe.exe not found. Registry key HKEY_USERS\S-1-5-21-1060284298-1659004503-839522115-1003\Software\Microsoft\Windows\CurrentVersion\RunOnce not found. File C:\Documents and Settings\PL\Local Settings\Temp\xnfqeyqcshbmguns.exe not found. Registry key HKEY_USERS\S-1-5-21-1060284298-1659004503-839522115-1003\Software\Microsoft\Windows\CurrentVersion\RunOnce not found. File C:\WINDOWS\System32\lfbqigcsmfdsqifohbyq.exe not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run not found. File nfzmcysgyplyukfmdv.exe not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run not found. File C:\DOCUME~1\PL\LOCALS~1\Temp\xnfqeyqcshbmguns.exe not found. File C:\autorun.inf not found. File D:\autorun.inf not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{91b3a242-b567-11dc-bdd8-806d6172696f}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{91b3a242-b567-11dc-bdd8-806d6172696f}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{91b3a242-b567-11dc-bdd8-806d6172696f}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{91b3a242-b567-11dc-bdd8-806d6172696f}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{91b3a242-b567-11dc-bdd8-806d6172696f}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{91b3a242-b567-11dc-bdd8-806d6172696f}\ not found. File F:\AUTORUN.EXE MAIN\ASSETUP.EXE not found. File C:\WINDOWS\sdqwfuhozjyetcqqalzisdspahsflujwd.ynt not found. File C:\Program Files\sdqwfuhozjyetcqqalzisdspahsflujwd.ynt not found. File C:\Documents and Settings\PL\Local Settings\Application Data\sdqwfuhozjyetcqqalzisdspahsflujwd.ynt not found. File C:\WINDOWS\cdgcbgjghhminmqgghlkklq.ebc not found. File C:\Program Files\cdgcbgjghhminmqgghlkklq.ebc not found. File C:\Documents and Settings\PL\Local Settings\Application Data\cdgcbgjghhminmqgghlkklq.ebc not found. File C:\WINDOWS\System32\cdgcbgjghhminmqgghlkklq.ebc not found. File C:\WINDOWS\System32\sdqwfuhozjyetcqqalzisdspahsflujwd.ynt not found. File C:\WINDOWS\pdtcogwguhziamdgthykxlddrbpfoasisgtl.myp not found. File C:\Documents and Settings\PL\Local Settings\Application Data\pdtcogwguhziamdgthykxlddrbpfoasisgtl.myp not found. File C:\WINDOWS\System32\pdtcogwguhziamdgthykxlddrbpfoasisgtl.myp not found. File C:\Program Files\pdtcogwguhziamdgthykxlddrbpfoasisgtl.myp not found. File C:\WINDOWS\yrmarojyrjguriemext.exe not found. File C:\WINDOWS\rnlcwwumidduuonytpoidz.exe not found. File C:\WINDOWS\nfzmcysgyplyukfmdv.exe not found. File C:\WINDOWS\lfbqigcsmfdsqifohbyq.exe not found. File C:\WINDOWS\avsibaxojdcsrkismhfys.exe not found. File C:\WINDOWS\xnfqeyqcshbmguns.exe not found. File C:\WINDOWS\evoapkdqhxsezoioe.exe not found. File C:\WINDOWS\System32\shyivofqftmwpcuymbtgujcdsdsjtgzqbqexh.nfj not found. File C:\WINDOWS\shyivofqftmwpcuymbtgujcdsdsjtgzqbqexh.nfj not found. File C:\Program Files\shyivofqftmwpcuymbtgujcdsdsjtgzqbqexh.nfj not found. File C:\Documents and Settings\PL\Local Settings\Application Data\shyivofqftmwpcuymbtgujcdsdsjtgzqbqexh.nfj not found. File C:\WINDOWS\tasks\ErrorSmart Scheduled Scan.job not found. File C:\WINDOWS\System32\yrmarojyrjguriemext.exe not found. File C:\WINDOWS\System32\rnlcwwumidduuonytpoidz.exe not found. File C:\WINDOWS\System32\lfbqigcsmfdsqifohbyq.exe not found. File C:\WINDOWS\System32\avsibaxojdcsrkismhfys.exe not found. File C:\WINDOWS\System32\nfzmcysgyplyukfmdv.exe not found. File C:\WINDOWS\System32\evoapkdqhxsezoioe.exe not found. File C:\WINDOWS\System32\xnfqeyqcshbmguns.exe not found. File C:\WINDOWS\System32\pbpwgwksepfmcmbcnzoyjvljvdpdkukygs.taq not found. File C:\WINDOWS\pbpwgwksepfmcmbcnzoyjvljvdpdkukygs.taq not found. File C:\Program Files\pbpwgwksepfmcmbcnzoyjvljvdpdkukygs.taq not found. File C:\Documents and Settings\PL\Local Settings\Application Data\pbpwgwksepfmcmbcnzoyjvljvdpdkukygs.taq not found. ========== FILES ========== File\Folder C:\WINDOWS\system32\xnfqeyqcshbmguns.exe not found. File\Folder C:\Documents and Settings\PL\Local Settings\Temp\yfoqvgp.exe not found. File\Folder C:\Program Files\ErrorSmart not found. ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: Jacky Larkyn ->Temp folder emptied: 22646014 bytes ->Temporary Internet Files folder emptied: 32902 bytes ->FireFox cache emptied: 115261383 bytes User: LocalService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 2176856 bytes %systemroot%\System32 .tmp files removed: 4743697 bytes Windows Temp folder emptied: 487 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 138,00 mb C:\WINDOWS\System32\drivers\etc\Hosts moved successfully. HOSTS file reset successfully OTL by OldTimer - Version 3.1.19.0 log created on 12232009_115129 Files\Folders moved on Reboot... Registry entries deleted on Reboot... Поздрави

Здравейте, ще Ви постна фаиловете които искате получени след сканирането сys OTL и предварително се извинявам, че ще бъдат по два. Проблема има моя приятелка на която опитвам да помогна чрез Вас и реших да сканирам и моя компютър въпреки, че не отворих линка в скайпа. Надявам се, че няма да се появи и при мен този проблем. Ще се радвам ако обърнете внимание и на фаиловете от моя компютър. Нейните са със име Павлина а от моя комп. със Иван Благодаря Поздрави OTL Pavlina.Txt Extras Pavlina.Txt OTL Ivan.Txt Extras Ivan.Txt