Проблем с интернета

16 октомври 200916 г.

Имам следния проблем:интернета ми прекасва много често.Понякога веднъж на ден друг път през 5 минути.Изписва ми : Network cable is unplugged.Почти съм сигурен че не е от доставчика.Смениха ми кабела , сложиха нова Lan карта и пак прекъсва.Възможно ли е проблема да е свързан с зловреден софтуер.Надявам се да можете да ми помогнете.Благодаря предварително !

16 октомври 200916 г.

При зловредния софтуер, Windows OS и някои видове софтуер, всичко е възможно. Следвайте инструкциите от тази тема:

http://www.kaldata.com/forums/index.php?showtopic=132819

1

16 октомври 200916 г.

Автор

Сканирах с Malwarebytes но нищо не беше намерено.

Malwarebytes' Anti-Malware 1.41

Database version: 2972

Windows 5.1.2600 Service Pack 3

16.10.2009 г. 23:51:11

mbam-log-2009-10-16 (23-51-11).txt

Scan type: Full Scan (C:\|D:\|E:\|)

Objects scanned: 166948

Time elapsed: 22 minute(s), 19 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 23:54:45, on 16.10.2009 г.

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16791)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\RUNDLL32.EXE

C:\WINDOWS\RTHDCPL.EXE

C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

C:\Program Files\Winamp\winampa.exe

C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe

C:\WINDOWS\vsnpstd3.exe

C:\Program Files\Eset\nod32kui.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Eset\nod32krn.exe

C:\WINDOWS\system32\IoctlSvc.exe

C:\WINDOWS\system32\PnkBstrA.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Malwarebytes\Malwarebytes' Anti-Malware\mbam.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Program Files\HiJackThis\Kaldata.exe.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.bg/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll

O4 - HKLM\..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nView\nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [skyTel] SkyTel.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"

O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe

O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"

O4 - HKLM\..\Run: [snpstd3] C:\WINDOWS\vsnpstd3.exe

O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE

O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript

O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-20\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - HKUS\.DEFAULT\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

O8 - Extra context menu item: Е&кспортирай в Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000

O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} (AxisMediaControlEmb Class) - http://87.120.43.139/activex/AMC.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{30564426-6383-42AF-B910-74ADD32B43A7}: NameServer = 212.25.58.8 212.25.58.2

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe

O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe

O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe

O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe

O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

--

End of file - 5985 bytes

16 октомври 200916 г.

Стъпка 1:

Изтеглете Security Check от screen317 от тук или тук и го запаметете на вашия десктоп.

Кликнете два пъти върху SecurityCheck.exe и следвайте инструкциите.
Накрая, автоматично ще се отвори текстов документ, наречен checkup.txt, моля поставете съдържанието му в следващия Ви коментар в тази тема.

Стъпка 2:

Изтеглете RootRepeal от тук и го запазете на вашия десктоп. След това, разархивирайте го на вашия десктоп, отново.

Кликнете два пъти върху RootRepeal.exe , за да стартирате програмата
Кликнете на таба Report в долната част на прозореца
Кликнете на бутона Scan
Сложете отметки пред следното:

Drivers
Processes
SSDT
Hidden Services

Кликнете на бутона OK
На следващия диалогов прозорец, сложете отметки преди всички дялове (C:\ , D:\ ....)
Кликнете на OK, за да започне процеса на сканиране

Бележка: Процеса на сканиране може да отнеме време. Моля,

не стартирайте

никакви програми, докато програмата сканира.

Когато сканирането завърши успешно ще се появи бутона Save Report
Кликнете върху Save Report и запишете лог файла на вашия десктоп, с име RootRepeal.txt
Отворете File, след което Exit , за да затворите програмата.

Копирайте и поставете съдържанието на RootRepeal.txt в следващия си пост.

Стъпка 3:

Изтеглете OTL (от OldTimer) и го запазете на вашия десктоп.

Кликнете два пъти върху OTL.exe, за да стартирате програмата.

Сложете отметки преди следните неща:

Scan all users
Lop check
Purity check

Под секцията Extra Registry, изберете Use SafeList

Кликнете на Run Scan и изчакайте да завърши сканирането. (може да отнеме 10-15 минути)

Когато завърши, публикувайте следните два лог файла:

OTL.txt (намира се на вашия десктоп)
Extras.txt (ще Ви се отвори автоматично)

1

16 октомври 200916 г.

Автор

Само не ведях къде да сложа отметки преди дяловете.

Results of screen317's Security Check version 0.99.0

Windows XP Service Pack 3

``````````````````````````````

Antivirus/Firewall Check:

Windows Security Center service is not running! This report may not be accurate!

Windows Firewall Disabled!

NOD32 Antivirus System

Antivirus out of date!

``````````````````````````````

Anti-malware/Other Utilities Check:

HijackThis 2.0.2

``````````````````````````````

Process Check:

objlist.exe by Laurent

Eset nod32kui.exe

Eset nod32krn.exe

``````````````````````````````

DNS Vulnerability Check:

POOR! (Vulnerable to DNS cache poisoning!!-- Consider OPENDNS)

`````````End of Log```````````

ROOTREPEAL © AD, 2007-2009

==================================================

Scan Start Time: 2009/10/17 00:22

Program Version: Version 1.3.5.0

Windows Version: Windows XP SP3

==================================================

Drivers

-------------------

Name: dump_atapi.sys

Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys

Address: 0xB4A57000 Size: 98304 File Visible: No Signed: -

Status: -

Name: dump_WMILIB.SYS

Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS

Address: 0xB85F6000 Size: 8192 File Visible: No Signed: -

Status: -

Name: PCI_PNP5256

Image Path: \Driver\PCI_PNP5256

Address: 0x00000000 Size: 0 File Visible: No Signed: -

Status: -

Name: rootrepeal.sys

Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys

Address: 0xB3BB6000 Size: 49152 File Visible: No Signed: -

Status: -

Name: spnj.sys

Image Path: spnj.sys

Address: 0xB7EA7000 Size: 1048576 File Visible: No Signed: -

Status: -

Name: sptd

Image Path: \Driver\sptd

Address: 0x00000000 Size: 0 File Visible: No Signed: -

Status: -

SSDT

-------------------

#: 041 Function Name: NtCreateKey

Status: Hooked by "spnj.sys" at address 0xb7ea80e0

#: 071 Function Name: NtEnumerateKey

Status: Hooked by "spnj.sys" at address 0xb7ec6ca2

#: 073 Function Name: NtEnumerateValueKey

Status: Hooked by "spnj.sys" at address 0xb7ec7030

#: 119 Function Name: NtOpenKey

Status: Hooked by "spnj.sys" at address 0xb7ea80c0

#: 160 Function Name: NtQueryKey

Status: Hooked by "spnj.sys" at address 0xb7ec7108

#: 177 Function Name: NtQueryValueKey

Status: Hooked by "spnj.sys" at address 0xb7ec6f88

#: 247 Function Name: NtSetValueKey

Status: Hooked by "spnj.sys" at address 0xb7ec719a

==EOF==

OTL logfile created on: 17.10.2009 г. 00:30:15 - Run 1

OTL by OldTimer - Version 3.0.21.0 Folder = C:\Documents and Settings\User\Desktop

Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 7.0.5730.13)

Locale: 00000402 | Country: Bulgaria | Language: BGR | Date Format: dd.M.yyyy 'г.'

2,00 Gb Total Physical Memory | 1,35 Gb Available Physical Memory | 67,35% Memory free

3,85 Gb Paging File | 3,22 Gb Available in Paging File | 83,76% Paging File free

Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 25,00 Gb Total Space | 15,81 Gb Free Space | 63,22% Space Free | Partition Type: NTFS

Drive D: | 136,52 Gb Total Space | 28,81 Gb Free Space | 21,11% Space Free | Partition Type: NTFS

Drive E: | 136,55 Gb Total Space | 65,76 Gb Free Space | 48,16% Space Free | Partition Type: NTFS

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

Computer Name: ADMIN

Current User Name: User

Logged in as Administrator.

Current Boot Mode: Normal

Scan Mode: All users

Company Name Whitelist: Off

Skip Microsoft Files: Off

File Age = 30 Days

Output = Standard

========== Processes (SafeList) ==========

PRC - [2009.10.17 00:28:52 | 00,521,216 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\User\Desktop\OTL.exe

PRC - [2009.10.17 00:19:16 | 00,843,167 | ---- | M] () -- C:\Documents and Settings\User\Desktop\SecurityCheck.exe

PRC - [2009.10.16 23:53:31 | 00,401,720 | ---- | M] (Trend Micro Inc.) -- C:\Program Files\HiJackThis\Kaldata.exe.exe

PRC - [2009.09.12 16:28:14 | 00,949,376 | ---- | M] (Eset ) -- C:\Program Files\Eset\nod32kui.exe

PRC - [2009.09.12 16:28:14 | 00,552,064 | ---- | M] (Eset ) -- C:\Program Files\Eset\nod32krn.exe

PRC - [2009.08.19 19:31:09 | 00,066,872 | ---- | M] () -- C:\WINDOWS\System32\PnkBstrA.exe

PRC - [2009.07.14 13:34:58 | 00,168,004 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\System32\nvsvc32.exe

PRC - [2009.02.26 00:26:00 | 00,037,888 | ---- | M] () -- C:\Program Files\Winamp\winampa.exe

PRC - [2009.01.08 22:07:03 | 01,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Explorer.EXE

PRC - [2008.12.19 07:25:25 | 00,634,024 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Internet Explorer\IEXPLORE.EXE

PRC - [2008.04.14 07:42:16 | 00,389,120 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\cmd.exe

PRC - [2008.02.18 17:29:12 | 00,877,864 | ---- | M] (Nero AG) -- C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe

PRC - [2007.09.27 14:20:18 | 16,844,800 | R--- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\RTHDCPL.EXE

PRC - [2006.12.19 10:30:26 | 00,081,920 | ---- | M] (Prolific Technology Inc.) -- C:\WINDOWS\System32\IoctlSvc.exe

PRC - [2004.11.02 20:24:46 | 00,032,768 | ---- | M] (Cyberlink Corp.) -- C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

PRC - [2004.07.30 18:50:24 | 00,286,720 | ---- | M] () -- C:\WINDOWS\vsnpstd3.exe

========== Win32 Services (SafeList) ==========

SRV - [2009.09.12 16:28:14 | 00,552,064 | ---- | M] (Eset ) -- C:\Program Files\Eset\nod32krn.exe -- (NOD32krn [Auto | Running])

SRV - [2009.08.19 19:31:09 | 00,066,872 | ---- | M] () -- C:\WINDOWS\System32\PnkBstrA.exe -- (PnkBstrA [Auto | Running])

SRV - [2009.07.14 13:34:58 | 00,168,004 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\System32\nvsvc32.exe -- (nvsvc [Auto | Running])

SRV - [2008.07.29 21:10:04 | 00,046,104 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe -- (FontCache3.0.0.0 [On_Demand | Stopped])

SRV - [2008.07.29 19:24:50 | 00,881,664 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe -- (idsvc [unknown | Stopped])

SRV - [2008.07.29 19:16:38 | 00,132,096 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe -- (NetTcpPortSharing [Disabled | Stopped])

SRV - [2008.07.25 11:17:02 | 00,069,632 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32 [On_Demand | Stopped])

SRV - [2008.07.25 11:16:40 | 00,034,312 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe -- (aspnet_state [On_Demand | Stopped])

SRV - [2008.04.14 07:42:04 | 00,038,400 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll -- (helpsvc [Auto | Running])

SRV - [2008.02.28 18:07:48 | 00,529,704 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe -- (NMIndexingService [On_Demand | Stopped])

SRV - [2008.02.18 17:29:12 | 00,877,864 | ---- | M] (Nero AG) -- C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe -- (Nero BackItUp Scheduler 3 [Auto | Running])

SRV - [2006.12.19 10:30:26 | 00,081,920 | ---- | M] (Prolific Technology Inc.) -- C:\WINDOWS\System32\IoctlSvc.exe -- (PLFlash DeviceIoControl Service [Auto | Running])

SRV - [2006.10.18 19:05:24 | 00,913,408 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Media Player\WMPNetwk.exe -- (WMPNetworkSvc [On_Demand | Stopped])

========== Driver Services (SafeList) ==========

DRV - [2009.09.12 16:28:14 | 00,512,096 | ---- | M] (Eset ) -- C:\WINDOWS\system32\drivers\amon.sys -- (AMON [Auto | Running])

DRV - [2009.09.12 16:28:14 | 00,015,424 | ---- | M] () -- C:\WINDOWS\system32\drivers\nod32drv.sys -- (nod32drv [system | Running])

DRV - [2009.08.17 14:57:12 | 00,717,296 | ---- | M] () -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd [boot | Running])

DRV - [2009.07.14 21:54:00 | 07,741,664 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\System32\DRIVERS\nv4_mini.sys -- (nv [On_Demand | Running])

DRV - [2008.08.20 20:58:58 | 00,044,944 | ---- | M] (Sonic Solutions) -- C:\WINDOWS\System32\Drivers\PxHelp20.sys -- (PxHelp20 [boot | Running])

DRV - [2008.04.14 01:05:40 | 00,020,992 | ---- | M] (Realtek Semiconductor Corporation) -- C:\WINDOWS\System32\DRIVERS\RTL8139.SYS -- (rtl8139 [On_Demand | Running])

DRV - [2008.04.14 00:09:16 | 00,020,480 | ---- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) -- C:\WINDOWS\System32\DRIVERS\secdrv.sys -- (Secdrv [On_Demand | Stopped])

DRV - [2008.04.14 00:06:06 | 00,144,384 | ---- | M] (Windows ® Server 2003 DDK provider) -- C:\WINDOWS\System32\DRIVERS\HDAudBus.sys -- (HDAudBus [On_Demand | Running])

DRV - [2007.10.02 16:32:14 | 04,613,120 | R--- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\System32\drivers\RtkHDAud.sys -- (IntcAzAudAddService [On_Demand | Running])

DRV - [2004.11.25 15:42:34 | 00,419,200 | ---- | M] () -- C:\WINDOWS\System32\DRIVERS\snpstd3.sys -- (SNPSTD3 [On_Demand | Running])

DRV - [2001.08.23 14:00:00 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) -- C:\WINDOWS\System32\DRIVERS\ptilink.sys -- (Ptilink [On_Demand | Running])

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

IE - HKU\.DEFAULT\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-583907252-1757981266-682003330-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm

IE - HKU\S-1-5-21-583907252-1757981266-682003330-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

IE - HKU\S-1-5-21-583907252-1757981266-682003330-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://google.bg/

IE - HKU\S-1-5-21-583907252-1757981266-682003330-1003\S-1-5-21-583907252-1757981266-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\software\mozilla\Firefox\Extensions\\{20a82645-c095-46ed-80e3-08825760534b}: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [2009.09.13 22:24:51 | 00,000,000 | ---D | M]

O1 HOSTS File: (734 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts

O1 - Hosts: 127.0.0.1 localhost

O2 - BHO: (Skype add-on (mastermind)) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)

O3 - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll ()

O3 - HKU\S-1-5-21-583907252-1757981266-682003330-1003\..\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll ()

O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\ALCMTR.EXE (Realtek Semiconductor Corp.)

O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files\Malwarebytes\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)

O4 - HKLM..\Run: [NBKeyScan] C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe (Nero AG)

O4 - HKLM..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe (Nero AG)

O4 - HKLM..\Run: [nod32kui] C:\Program Files\Eset\nod32kui.exe (Eset )

O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)

O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation)

O4 - HKLM..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nView\nwiz.exe ()

O4 - HKLM..\Run: [RemoteControl] C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe (Cyberlink Corp.)

O4 - HKLM..\Run: [RTHDCPL] C:\WINDOWS\RTHDCPL.EXE (Realtek Semiconductor Corp.)

O4 - HKLM..\Run: [skyTel] C:\WINDOWS\SkyTel.EXE (Realtek Semiconductor Corp.)

O4 - HKLM..\Run: [snpstd3] C:\WINDOWS\vsnpstd3.exe ()

O4 - HKLM..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe ()

O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)

O4 - HKU\.DEFAULT..\RunOnce: [_nltide_2] File not found

O4 - HKU\S-1-5-18..\RunOnce: [_nltide_2] File not found

O4 - HKU\S-1-5-19..\RunOnce: [_nltide_2] File not found

O4 - HKU\S-1-5-20..\RunOnce: [_nltide_2] File not found

O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1

O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1

O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1

O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-21-583907252-1757981266-682003330-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-21-583907252-1757981266-682003330-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0

O8 - Extra context menu item: Е&кспортирай в Microsoft Excel - C:\Program Files\Microsoft Office\Office10\EXCEL.EXE (Microsoft Corporation)

O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)

O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (Microsoft Corporation)

O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\WINDOWS\System32\imon.dll (Eset )

O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\WINDOWS\System32\imon.dll (Eset )

O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\WINDOWS\System32\imon.dll (Eset )

O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\WINDOWS\System32\imon.dll (Eset )

O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\WINDOWS\System32\imon.dll (Eset )

O10 - Protocol_Catalog9\Catalog_Entries\000000000023 - C:\WINDOWS\System32\imon.dll (Eset )

O16 - DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} http://87.120.43.139/activex/AMC.cab (AxisMediaControlEmb Class)

O18 - Protocol\Handler\cdo {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation)

O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)

O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)

O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)

O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)

O18 - Protocol\Handler\ipp - No CLSID value found

O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp - No CLSID value found

O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)

O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation)

O20 - Winlogon\Notify\WgaLogon: DllName - WgaLogon.dll - File not found

O24 - Desktop Components:0 (My Current Home Page) - About:Home

O31 - SafeBoot: AlternateShell - cmd.exe

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2009.07.29 23:10:07 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck) - File not found

O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation)

O34 - HKLM BootExecute: (*) - File not found

O35 - comfile [open] -- "%1" %* File not found

O35 - exefile [open] -- "%1" %* File not found

========== Files/Folders - Created Within 30 Days ==========

[2009.09.21 21:58:42 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Blizzard

[2009.09.18 16:32:57 | 00,000,000 | ---D | C] -- C:\Documents and Settings\User\Application Data\Capcom

[2009.09.20 18:27:36 | 00,000,000 | ---D | C] -- C:\Documents and Settings\User\Application Data\Dev-Cpp

[2009.09.17 15:44:55 | 00,000,000 | ---D | C] -- C:\Documents and Settings\User\Local Settings\Application Data\Rockstar Games

[2009.09.20 18:14:35 | 00,000,000 | ---D | C] -- C:\Program Files\DevCpp

[2009.10.16 23:53:19 | 00,000,000 | ---D | C] -- C:\Program Files\HiJackThis

[2009.09.26 14:13:20 | 00,000,000 | ---D | C] -- C:\Program Files\Networx-BG

[2009.10.17 00:28:38 | 00,521,216 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\User\Desktop\OTL.exe

[2009.10.17 00:21:49 | 00,472,064 | ---- | C] ( ) -- C:\Documents and Settings\User\Desktop\RootRepeal.exe

[2009.10.16 23:27:18 | 00,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys

[2009.10.16 23:27:17 | 00,019,160 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys

[2009.10.16 21:51:24 | 00,000,000 | ---D | C] -- C:\Documents and Settings\User\My Documents\18 WoS Extreme Trucker

[2009.10.14 18:39:42 | 00,000,000 | ---D | C] -- C:\Documents and Settings\User\My Documents\FIFA 10

[2009.10.10 14:29:41 | 00,000,000 | ---D | C] -- C:\Documents and Settings\User\Desktop\Music

[2009.10.09 18:46:12 | 00,000,000 | ---D | C] -- C:\Documents and Settings\User\Desktop\New Folder

[2009.10.09 18:26:06 | 00,000,000 | ---D | C] -- C:\Documents and Settings\User\Desktop\Музика

[2009.09.26 22:20:17 | 00,009,728 | ---- | C] (by NiO_ShOoTer) -- C:\Documents and Settings\User\Desktop\RORO2.exe

[2009.09.26 14:22:15 | 00,000,000 | ---D | C] -- C:\Documents and Settings\User\Desktop\Free Servers

[2009.09.20 23:28:57 | 00,000,000 | ---D | C] -- C:\Documents and Settings\User\My Documents\FIFA 09

[2009.09.20 18:38:47 | 00,000,000 | ---D | C] -- C:\Documents and Settings\User\My Documents\DevC++

[2009.09.17 14:33:59 | 00,000,000 | ---D | C] -- C:\Documents and Settings\User\My Documents\Rockstar Games

[2009.08.30 22:58:08 | 00,061,440 | ---- | C] ( ) -- C:\WINDOWS\System32\csnpstd3.dll

[2009.08.30 22:58:08 | 00,057,344 | ---- | C] ( ) -- C:\WINDOWS\System32\rsnpstd3.dll

[2009.08.30 22:58:08 | 00,036,864 | ---- | C] ( ) -- C:\WINDOWS\System32\vsnpstd3.dll

========== Files - Modified Within 30 Days ==========

[1 C:\WINDOWS\System32\*.tmp files]

[3 C:\WINDOWS\*.tmp files]

[2009.10.17 00:28:52 | 00,521,216 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\User\Desktop\OTL.exe

[2009.10.17 00:22:11 | 00,000,000 | ---- | M] () -- C:\Documents and Settings\User\Desktop\settings.dat

[2009.10.17 00:21:39 | 00,464,491 | ---- | M] () -- C:\Documents and Settings\User\Desktop\RootRepeal.zip

[2009.10.17 00:19:16 | 00,843,167 | ---- | M] () -- C:\Documents and Settings\User\Desktop\SecurityCheck.exe

[2009.10.16 23:27:21 | 00,000,807 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk

[2009.10.16 23:23:37 | 00,243,457 | ---- | M] () -- C:\WINDOWS\System32\NvApps.xml

[2009.10.16 23:23:35 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT

[2009.10.16 23:23:34 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2009.10.16 23:22:41 | 02,641,962 | -H-- | M] () -- C:\Documents and Settings\User\Local Settings\Application Data\IconCache.db

[2009.10.16 23:21:12 | 00,005,188 | ---- | M] () -- C:\Documents and Settings\User\Local Settings\Application Data\devcpp.ini

[2009.10.16 23:21:12 | 00,000,462 | ---- | M] () -- C:\Documents and Settings\User\Local Settings\Application Data\devcpp.cfg

[2009.10.16 21:12:33 | 00,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini

[2009.10.16 21:11:54 | 00,002,257 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Skype.lnk

[2009.10.16 15:20:55 | 00,000,196 | ---- | M] () -- C:\Documents and Settings\User\Desktop\options.bel

[2009.10.16 12:51:54 | 00,193,420 | ---- | M] () -- C:\Documents and Settings\User\Desktop\tortskr.jpg

[2009.10.15 16:17:37 | 00,002,353 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\SA Dictionary 2008 Beta 4.lnk

[2009.10.14 18:36:36 | 00,001,603 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\FIFA 10.lnk

[2009.10.12 23:26:19 | 00,000,076 | ---- | M] () -- C:\Documents and Settings\User\Desktop\settings.ini

[2009.10.12 14:53:49 | 00,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl

[2009.10.10 15:59:12 | 00,000,340 | ---- | M] () -- C:\WINDOWS\MP3trt.ini

[2009.10.09 21:46:14 | 09,162,753 | ---- | M] () -- C:\Documents and Settings\User\Desktop\12.Toni Dacheva i ork.Kristal - Bedni i bogati.mp3

[2009.10.07 21:48:55 | 00,402,838 | ---- | M] () -- C:\Documents and Settings\User\Desktop\061020091457.jpg

[2009.10.07 21:48:44 | 00,437,015 | ---- | M] () -- C:\Documents and Settings\User\Desktop\061020091463.jpg

[2009.10.07 20:28:07 | 00,891,960 | ---- | M] () -- C:\Documents and Settings\User\Desktop\Screen(10_07-20_24)-0000.jpg

[2009.09.29 22:51:36 | 00,000,040 | ---- | M] () -- C:\WINDOWS\System32\imon1.dat

[2009.09.26 22:20:17 | 00,009,728 | ---- | M] (by NiO_ShOoTer) -- C:\Documents and Settings\User\Desktop\RORO2.exe

[2009.09.26 15:37:29 | 00,000,618 | ---- | M] () -- C:\Documents and Settings\User\Desktop\cs1.6.lnk

[2009.09.23 17:44:08 | 00,051,872 | ---- | M] () -- C:\Documents and Settings\User\My Documents\1rad.jpg

[2009.09.22 19:59:34 | 00,000,558 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Favorite-Games.lnk

[2009.09.19 22:16:27 | 00,000,681 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\FIFA 09.lnk

[2009.09.19 22:14:42 | 00,000,706 | ---- | M] () -- C:\Documents and Settings\User\Desktop\MP3 To Ringtone Gold.lnk

[2009.09.18 14:10:55 | 00,014,336 | ---- | M] () -- C:\Documents and Settings\User\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2009.09.17 15:44:42 | 00,018,904 | ---- | M] () -- C:\Documents and Settings\User\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

========== Files - No Company Name ==========

[2009.10.17 00:22:11 | 00,000,000 | ---- | C] () -- C:\Documents and Settings\User\Desktop\settings.dat

[2009.10.17 00:21:33 | 00,464,491 | ---- | C] () -- C:\Documents and Settings\User\Desktop\RootRepeal.zip

[2009.10.17 00:19:10 | 00,843,167 | ---- | C] () -- C:\Documents and Settings\User\Desktop\SecurityCheck.exe

[2009.10.16 23:27:21 | 00,000,807 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk

[2009.10.16 12:52:12 | 00,193,420 | ---- | C] () -- C:\Documents and Settings\User\Desktop\tortskr.jpg

[2009.10.14 18:36:36 | 00,001,603 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\FIFA 10.lnk

[2009.10.09 21:45:57 | 09,162,753 | ---- | C] () -- C:\Documents and Settings\User\Desktop\12.Toni Dacheva i ork.Kristal - Bedni i bogati.mp3

[2009.10.07 21:48:51 | 00,402,838 | ---- | C] () -- C:\Documents and Settings\User\Desktop\061020091457.jpg

[2009.10.07 21:48:40 | 00,437,015 | ---- | C] () -- C:\Documents and Settings\User\Desktop\061020091463.jpg

[2009.10.07 20:25:25 | 00,891,960 | ---- | C] () -- C:\Documents and Settings\User\Desktop\Screen(10_07-20_24)-0000.jpg

[2009.10.07 13:51:01 | 00,000,076 | ---- | C] () -- C:\Documents and Settings\User\Desktop\settings.ini

[2009.10.06 13:42:11 | 00,000,196 | ---- | C] () -- C:\Documents and Settings\User\Desktop\options.bel

[2009.09.29 22:51:36 | 00,000,040 | ---- | C] () -- C:\WINDOWS\System32\imon1.dat

[2009.09.26 15:37:28 | 00,000,618 | ---- | C] () -- C:\Documents and Settings\User\Desktop\cs1.6.lnk

[2009.09.23 17:44:06 | 00,051,872 | ---- | C] () -- C:\Documents and Settings\User\My Documents\1rad.jpg

[2009.09.22 19:59:34 | 00,000,558 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Favorite-Games.lnk

[2009.09.20 18:42:26 | 00,000,462 | ---- | C] () -- C:\Documents and Settings\User\Local Settings\Application Data\devcpp.cfg

[2009.09.20 18:42:24 | 00,005,188 | ---- | C] () -- C:\Documents and Settings\User\Local Settings\Application Data\devcpp.ini

[2009.09.12 23:24:47 | 00,000,340 | ---- | C] () -- C:\WINDOWS\MP3trt.ini

[2009.09.12 23:24:45 | 00,278,528 | ---- | C] () -- C:\WINDOWS\System32\ammpp.dll

[2009.09.12 23:24:45 | 00,065,536 | ---- | C] () -- C:\WINDOWS\System32\a1.dll

[2009.09.12 15:49:37 | 00,015,424 | ---- | C] () -- C:\WINDOWS\System32\drivers\nod32drv.sys

[2009.09.09 13:05:38 | 00,043,520 | ---- | C] () -- C:\WINDOWS\System32\CmdLineExt03.dll

[2009.09.07 00:59:38 | 00,018,904 | ---- | C] () -- C:\Documents and Settings\User\Application Data\GDIPFONTCACHEV1.DAT

[2009.08.30 22:58:09 | 00,419,200 | ---- | C] () -- C:\WINDOWS\System32\drivers\snpstd3.sys

[2009.08.30 22:58:09 | 00,053,248 | ---- | C] () -- C:\WINDOWS\System32\dsnpstd3.dll

[2009.08.30 22:58:09 | 00,015,498 | ---- | C] () -- C:\WINDOWS\snpstd3.ini

[2009.08.30 22:55:50 | 00,172,032 | ---- | C] () -- C:\WINDOWS\JAPI2.DLL

[2009.08.30 22:55:50 | 00,106,496 | ---- | C] () -- C:\WINDOWS\JAPI.DLL

[2009.08.28 12:03:18 | 00,354,816 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll

[2009.08.19 19:31:22 | 00,022,328 | ---- | C] () -- C:\WINDOWS\System32\drivers\PnkBstrK.sys

[2009.08.17 15:12:50 | 00,000,273 | ---- | C] () -- C:\WINDOWS\game.ini

[2009.08.17 14:57:12 | 00,717,296 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys

[2009.08.10 14:17:00 | 00,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini

[2009.08.07 19:51:34 | 00,178,430 | ---- | C] () -- C:\WINDOWS\System32\xlive.dll.cat

[2009.07.30 01:59:10 | 00,000,062 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\desktop.ini

[2009.07.30 00:49:44 | 00,168,448 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll

[2009.07.30 00:49:44 | 00,000,038 | ---- | C] () -- C:\WINDOWS\avisplitter.ini

[2009.07.30 00:49:42 | 00,795,648 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll

[2009.07.30 00:49:42 | 00,130,048 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll

[2009.07.30 00:49:41 | 03,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll

[2009.07.30 00:49:39 | 00,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest

[2009.07.30 00:49:38 | 00,084,480 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll

[2009.07.30 00:10:15 | 00,014,336 | ---- | C] () -- C:\Documents and Settings\User\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2009.07.30 00:07:37 | 00,000,406 | ---- | C] () -- C:\WINDOWS\ODBC.INI

[2009.07.30 00:03:54 | 02,641,962 | -H-- | C] () -- C:\Documents and Settings\User\Local Settings\Application Data\IconCache.db

[2009.07.29 23:27:46 | 00,018,904 | ---- | C] () -- C:\Documents and Settings\User\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

[2009.07.29 23:23:14 | 00,000,062 | -HS- | C] () -- C:\Documents and Settings\User\Application Data\desktop.ini

[2009.06.19 20:06:22 | 00,197,912 | ---- | C] () -- C:\WINDOWS\System32\physxcudart_20.dll

[2009.06.19 20:06:22 | 00,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelTraditionalChinese.dll

[2009.06.19 20:06:22 | 00,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSwedish.dll

[2009.06.19 20:06:22 | 00,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSpanish.dll

[2009.06.19 20:06:22 | 00,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSimplifiedChinese.dll

[2009.06.19 20:06:22 | 00,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelPortugese.dll

[2009.06.19 20:06:22 | 00,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelKorean.dll

[2009.06.19 20:06:22 | 00,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelJapanese.dll

[2009.06.19 20:06:22 | 00,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelGerman.dll

[2009.06.19 20:06:22 | 00,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelFrench.dll

[2001.08.23 14:00:00 | 00,000,927 | ---- | C] () -- C:\WINDOWS\win.ini

[2001.08.23 14:00:00 | 00,000,231 | ---- | C] () -- C:\WINDOWS\system.ini

========== LOP Check ==========

[2009.10.05 17:40:56 | 00,000,000 | RH-D | M] -- C:\Documents and Settings\All Users\Application Data

[2009.09.21 21:58:42 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Blizzard

[2009.07.30 00:47:48 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\CyberLink

[2009.08.17 14:59:32 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\DAEMON Tools Lite

[2009.08.20 22:07:29 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP

[2009.09.01 18:27:32 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Ubisoft

[2009.07.30 01:59:10 | 00,000,000 | RH-D | M] -- C:\Documents and Settings\Default User\Application Data

[2009.07.29 23:12:43 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data

[2009.07.29 23:12:28 | 00,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Application Data

[2009.09.20 18:27:36 | 00,000,000 | RH-D | M] -- C:\Documents and Settings\User\Application Data

[2009.10.16 22:12:48 | 00,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\BitTorrent

[2009.09.18 16:32:57 | 00,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\Capcom

[2009.08.17 15:00:13 | 00,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\DAEMON Tools

[2009.08.17 15:01:54 | 00,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\DAEMON Tools Lite

[2009.08.17 15:00:13 | 00,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\DAEMON Tools Pro

[2009.09.20 18:38:32 | 00,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\Dev-Cpp

[2009.08.18 00:32:44 | 00,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\DNA

[2009.08.17 16:58:58 | 00,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\Leadertech

[2009.08.20 21:57:58 | 00,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\Sammsoft

[2009.09.11 19:55:42 | 00,000,000 | RH-D | M] -- C:\Documents and Settings\User\Application Data\SecuROM

[2009.09.01 18:27:32 | 00,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\Ubisoft

[2001.08.23 14:00:00 | 00,000,065 | RH-- | M] () -- C:\WINDOWS\Tasks\desktop.ini

[2009.10.16 23:23:35 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\Tasks\SA.DAT

========== Purity Check ==========

========== Alternate Data Streams ==========

@Alternate Data Stream - 110 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2

< End of report >

OTL Extras logfile created on: 17.10.2009 г. 00:30:15 - Run 1