Премини към съдържанието
Форумът в приложение

По-лесно сърфиране. Научи повече.
Kaldata.com - Форуми

Приложение на форума на цял екран с push известия, значки и други.

За да инсталирате това приложение на iOS и iPadOS
  1. Докоснете Иконата за споделяне в Safari
  2. Превъртете менюто и докоснете Добавяне към началния екран.
  3. Докоснете Добавяне в горния десен ъгъл.
За да инсталирате това приложение на Android
  1. Докоснете менюто с 3 точки (⋮) в горния десен ъгъл на браузъра.
  2. Докоснете Добавяне към началния екран или Инсталиране на приложение.
  3. Потвърдете, като докоснете Инсталиране.
Добави Kaldata.com в предпочитани източници в Google

Добре дошли!

Добре дошли в нашите форуми, пълни с полезна информация. Имате проблем с компютъра или телефона си? Публикувайте нова тема и ще намерите решение на всичките си проблеми. Общувайте свободно и открийте безброй нови приятели.

Моля, регистрирайте се за да публикувате тема и да получите пълен достъп до всички функции.

 

Инфектирана системa! [РЕШЕН]

nikolaijelev
в Премахване на зловреден софтуер

Featured Replies

WIN XP SP3

ToBa e Bupyca!

CkanaH DaTekc...

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 21:00:33, on 04.11.2009 г.

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16762)

Boot mode: Safe mode with network support

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Documents and Settings\Gencho\Desktop\is.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/'>http://www.yahoo.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll

R3 - URLSearchHook: (no name) - {9CB65206-89C4-402c-BA80-02D8C59F9B1D} - C:\Program Files\AskTBar\SrchAstt\1.bin\A5SRCHAS.DLL

O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: Seekmo /fleok=1D8A83A5C2ED127E9DAB6C2A1FBB39BFE4976E26CAEDA120180A196D6093 - {07AA283A-43D7-4CBE-A064-32A21112D94D} - C:\Program Files\Seekmo\bin\10.0.431.0\HostIE.dll

O2 - BHO: ShoppingReport - {100EB1FD-D03E-47FD-81F3-EE91287F9465} - C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll

O2 - BHO: (no name) - {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - C:\WINDOWS\system32\fccyvWNe.dll (file missing)

O2 - BHO: Ask Search Assistant BHO - {9CB65201-89C4-402c-BA80-02D8C59F9B1D} - C:\Program Files\AskTBar\SrchAstt\1.bin\A5SRCHAS.DLL

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll

O2 - BHO: (no name) - {B76E96B0-09FB-47AC-B557-A8572C9B34F8} - C:\WINDOWS\system32\nnnmnNDu.dll (file missing)

O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll

O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\YTSingleInstance.dll

O2 - BHO: Ask Toolbar BHO - {FE063DB1-4EC0-403e-8DD8-394C54984B2C} - C:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll

O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (file missing)

O3 - Toolbar: Ask Toolbar - {FE063DB9-4EC0-403e-8DD8-394C54984B2C} - C:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL

O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [avast!] "C:\Program Files\Alwil Software\Avast4\ashDisp.exe"

O4 - HKLM\..\Run: [Anti Trojan Elite] C:\Program Files\Anti Trojan Elite\TJEnder.exe :NO

O4 - HKLM\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"

O4 - HKLM\..\Run: [VirtualCloneDrive] "C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s

O4 - HKLM\..\Run: [uPAS] C:\DOCUME~1\Gencho\LOCALS~1\Temp\personalantispy_ifree.exe

O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [sysgif32] C:\WINDOWS\Temp\wpv151257179558.exe

O4 - HKLM\..\Run: [restorer32_a] C:\WINDOWS\system32\restorer32_a.exe

O4 - HKLM\..\Run: [47185227] C:\DOCUME~1\ALLUSE~1\APPLIC~1\47185227\47185227.exe

O4 - HKLM\..\Run: [PromoReg] C:\WINDOWS\Temp\_ex-08.exe

O4 - HKLM\..\Run: [Regedit32] C:\WINDOWS\system32\regedit.exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [search Protection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe

O4 - HKCU\..\Run: [YSearchProtection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe

O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

O4 - HKCU\..\Run: [restorer32_a] C:\Documents and Settings\Gencho\restorer32_a.exe

O4 - HKLM\..\Policies\Explorer\Run: [3R0uaBao0C] C:\Documents and Settings\All Users\Application Data\gvopkzgz\qzwpaxol.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')

O4 - Startup: zavupd32.exe

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: BlueSoleil.lnk = ?

O4 - Global Startup: FlexType 2K.lnk = C:\WINDOWS\Datecs\FType2K.exe

O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: ShopperReports - Compare product prices - {C5428486-50A0-4a02-9D20-520B59A9F9B2} - C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll

O9 - Extra button: ShopperReports - Compare travel rates - {C5428486-50A0-4a02-9D20-520B59A9F9B3} - C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper200711281.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\Skype4COM.dll

O20 - AppInit_DLLs: karna.dat

O20 - Winlogon Notify: fccyvWNe - fccyvWNe.dll (file missing)

O20 - Winlogon Notify: hgGywtQH - hgGywtQH.dll (file missing)

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe

O23 - Service: Служба Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe

O23 - Service: StarWind iSCSI Service (StarWindService) - Unknown owner - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe (file missing)

O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

--

End of file - 9310 bytes

mbam-log-2009-11-04 (21-26-56).txt

Редактирано от nikolaijelev (преглед на промените)

  • Автор

Пише, че не е предприето действие. След края на сканирането, избрахте ли Remove Selected?

He caM.

  • Автор

Новия лог.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 22:04:21, on 04.11.2009 г.

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16762)

Boot mode: Normal


Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\Alwil Software\Avast4\ashDisp.exe

C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe

C:\WINDOWS\Datecs\FType2K.exe

C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\PSIService.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Documents and Settings\Gencho\Desktop\is.exe


R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 

O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll

O2 - BHO: (no name) - {B76E96B0-09FB-47AC-B557-A8572C9B34F8} - C:\WINDOWS\system32\nnnmnNDu.dll (file missing)

O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll

O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (file missing)

O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [avast!] "C:\Program Files\Alwil Software\Avast4\ashDisp.exe"

O4 - HKLM\..\Run: [Anti Trojan Elite] C:\Program Files\Anti Trojan Elite\TJEnder.exe :NO

O4 - HKLM\..\Run: [VirtualCloneDrive] "C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s

O4 - HKLM\..\Run: [UPAS] C:\DOCUME~1\Gencho\LOCALS~1\Temp\personalantispy_ifree.exe

O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [Search Protection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe

O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

O4 - HKLM\..\Policies\Explorer\Run: [3R0uaBao0C] C:\Documents and Settings\All Users\Application Data\gvopkzgz\qzwpaxol.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: BlueSoleil.lnk = ?

O4 - Global Startup: FlexType 2K.lnk = C:\WINDOWS\Datecs\FType2K.exe

O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\Skype4COM.dll

O20 - AppInit_DLLs: karna.dat

O20 - Winlogon Notify: hgGywtQH - hgGywtQH.dll (file missing)

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe

O23 - Service: Служба Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe

O23 - Service: StarWind iSCSI Service (StarWindService) - Unknown owner - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe (file missing)


--

End of file - 7651 bytes

mbam-log-2009-11-04 (21-58-07).txt

Редактирано от nikolaijelev (преглед на промените)

Много добре, сега пуснете нов лог файл от HiJackThis.

П.П.: Благодаря много! При първа възможност, колегата ще Ви поеме. Лека вечер от мен!

    •
    • Харесване 2

    Здравейте nikolaijelev,

    СТЪПКА 1

    Стартирайте HijackThis и изберете "Do a system scan only"

    Маркирайте следните обекти:

    O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)

    O2 - BHO: (no name) - {B76E96B0-09FB-47AC-B557-A8572C9B34F8} - C:\WINDOWS\system32\nnnmnNDu.dll (file missing)

    O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (file missing)

    O4 - HKLM\..\Run: [uPAS] C:\DOCUME~1\Gencho\LOCALS~1\Temp\personalantispy_ifree.exe

    O4 - HKLM\..\Policies\Explorer\Run: [3R0uaBao0C] C:\Documents and Settings\All Users\Application Data\gvopkzgz\qzwpaxol.exe

    O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'LOCAL SERVICE')

    O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'NETWORK SERVICE')

    O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')

    O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')

    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

    O20 - AppInit_DLLs: karna.dat

    O20 - Winlogon Notify: hgGywtQH - hgGywtQH.dll (file missing)

    Натиснете Fix Checked.

    СТЪПКА 2

    *. Временно спрете защитата на антивирусната си програма в реално време.

    *. Изтеглете Combofix.

    *. Запазете го на Десктопа.

    *. Отворете Start => run => и въведете следната команда:

    "%userprofile%\desktop\ComboFix.exe" /KillAll

    *. По време на сканиране от страна на ComboFix не стартирайте никакви други приложения, не натискайте клавиши от клавиатурата и не местете мишката !

    *. Публикувайте лог файла, който ще се създаде след рестарта на компютъра в следващия си пост.

    СТЪПКА 3

    Изтеглете GMER и го разархивирайте го на вашия десктоп.

    Преди да сканирате се уверете, че всички останали работещи програми в момента са изключени и вашия антивирусен софтуер няма да предприема никакви действия по време на сканирането на Gmer. Не използвайте компютъра си, докато трае сканирането.

    Кликнете два пъти пъти върху gmer.exe , за да стартирате програмата.

    Тя ще направи начално сканиране за секунди. След като то приключи НЕ натискайте бутона Scan, а изберете бутона Copy и поставете съдържанието на лог файла в следващия си пост.

    СТЪПКА 4

    Изтеглете Security Check от screen317 от тук или тук и го запаметете на вашия десктоп.

    • Кликнете два пъти върху SecurityCheck.exe и следвайте инструкциите.
    • Накрая, автоматично ще се отвори текстов документ, наречен checkup.txt, моля поставете съдържанието му в следващия Ви коментар в тази тема.

    •
    • Харесване 2
    • Автор

    Съжалявам,B-boy[styLe]!

    Заспал съм!

    Включи се автоматичното обновяване.Повторното сканиране с "Malwarebytes'' показва че гадините са в системата за възстановяване.

    Колегата е свалял някакви дивотии от сайтове!

    Malwarebytes' Anti-Malware 1.41

    Database version: 3101

    Windows 5.1.2600 Service Pack 3

    05.11.2009 г. 05:06:34

    mbam-log-2009-11-05 (05-06-31).txt

    Scan type: Full Scan (C:\|E:\|)

    Objects scanned: 187119

    Time elapsed: 20 minute(s), 15 second(s)

    Memory Processes Infected: 0

    Memory Modules Infected: 0

    Registry Keys Infected: 0

    Registry Values Infected: 0

    Registry Data Items Infected: 3

    Folders Infected: 0

    Files Infected: 18

    Memory Processes Infected:

    (No malicious items detected)

    Memory Modules Infected:

    (No malicious items detected)

    Registry Keys Infected:

    (No malicious items detected)

    Registry Values Infected:

    (No malicious items detected)

    Registry Data Items Infected:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

    Folders Infected:

    (No malicious items detected)

    Files Infected:

    C:\System Volume Information\_restore{7579CC9C-A4DE-4706-9E45-29ECB36D769B}\RP385\A0193069.dll (Adware.Seekmo) -> No action taken.

    C:\System Volume Information\_restore{7579CC9C-A4DE-4706-9E45-29ECB36D769B}\RP385\A0193070.dll (Adware.Zango) -> No action taken.

    C:\System Volume Information\_restore{7579CC9C-A4DE-4706-9E45-29ECB36D769B}\RP385\A0193071.dll (Adware.Zango) -> No action taken.

    C:\System Volume Information\_restore{7579CC9C-A4DE-4706-9E45-29ECB36D769B}\RP385\A0193072.dll (Adware.Shopper) -> No action taken.

    C:\System Volume Information\_restore{7579CC9C-A4DE-4706-9E45-29ECB36D769B}\RP385\A0193073.dll (Adware.Zango) -> No action taken.

    C:\System Volume Information\_restore{7579CC9C-A4DE-4706-9E45-29ECB36D769B}\RP385\A0193074.exe (Adware.Zango) -> No action taken.

    C:\System Volume Information\_restore{7579CC9C-A4DE-4706-9E45-29ECB36D769B}\RP385\A0193075.dll (Adware.Zango) -> No action taken.

    C:\System Volume Information\_restore{7579CC9C-A4DE-4706-9E45-29ECB36D769B}\RP385\A0193076.exe (Adware.Seekmo) -> No action taken.

    C:\System Volume Information\_restore{7579CC9C-A4DE-4706-9E45-29ECB36D769B}\RP385\A0193077.dll (Adware.Zango) -> No action taken.

    C:\System Volume Information\_restore{7579CC9C-A4DE-4706-9E45-29ECB36D769B}\RP385\A0193078.exe (Adware.Seekmo) -> No action taken.

    C:\System Volume Information\_restore{7579CC9C-A4DE-4706-9E45-29ECB36D769B}\RP385\A0193079.dll (Adware.Zango) -> No action taken.

    C:\System Volume Information\_restore{7579CC9C-A4DE-4706-9E45-29ECB36D769B}\RP385\A0193080.exe (Adware.Seekmo) -> No action taken.

    C:\System Volume Information\_restore{7579CC9C-A4DE-4706-9E45-29ECB36D769B}\RP385\A0193081.dll (Adware.Seekmo) -> No action taken.

    C:\System Volume Information\_restore{7579CC9C-A4DE-4706-9E45-29ECB36D769B}\RP385\A0193083.dll (Adware.Seekmo) -> No action taken.

    C:\System Volume Information\_restore{7579CC9C-A4DE-4706-9E45-29ECB36D769B}\RP385\A0193084.exe (Adware.Seekmo) -> No action taken.

    C:\System Volume Information\_restore{7579CC9C-A4DE-4706-9E45-29ECB36D769B}\RP385\A0193082.exe (Adware.Seekmo) -> No action taken.

    E:\System Volume Information\_restore{7579CC9C-A4DE-4706-9E45-29ECB36D769B}\RP385\A0193085.exe (Trojan.Downloader) -> No action taken.

    E:\System Volume Information\_restore{7579CC9C-A4DE-4706-9E45-29ECB36D769B}\RP385\A0193086.exe (Trojan.Downloader) -> No action taken.

    GMER 1.0.15.15163 - http://www.gmer.net

    Rootkit quick scan 2009-11-05 05:26:52

    Windows 5.1.2600 Service Pack 3

    Running: gmer.exe; Driver: C:\DOCUME~1\Gencho\LOCALS~1\Temp\pwdcqpob.sys

    ---- System - GMER 1.0.15 ----

    SSDT spom.sys ZwEnumerateKey [0xBA6C6CA2]

    SSDT spom.sys ZwEnumerateValueKey [0xBA6C7030]

    ---- Devices - GMER 1.0.15 ----

    Device \FileSystem\Ntfs \Ntfs 8A5CA1F8

    AttachedDevice \FileSystem\Ntfs \Ntfs aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software)

    AttachedDevice \Driver\Tcpip \Device\Ip aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

    AttachedDevice \Driver\Tcpip \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

    AttachedDevice \Driver\Tcpip \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

    AttachedDevice \Driver\Tcpip \Device\RawIp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

    ---- EOF - GMER 1.0.15 ----

     Results of screen317's Security Check version 0.99.0 

 Windows XP Service Pack 3 

[b]`````````````````````````````` 

[u]Antivirus/Firewall Check:[/u][/b] 

 Windows Firewall Enabled! 

 avast! Antivirus 	

 [color=red][b]Antivirus out of date![/b][/color] (On Access scanning [b]disabled[/b]!) 

[b]`````````````````````````````` 

[u]Anti-malware/Other Utilities Check:[/u][/b] 

 CCleaner (remove only) 

 Adobe Flash Player 10 

Adobe Reader 7.0.8 

[color=red][b]Out of date Adobe Reader installed![/b][/color] 

[b]`````````````````````````````` 

Process Check: 

[u]objlist.exe by Laurent[/u][/b] 

 Alwil Software Avast4 aswUpdSv.exe 

 Alwil Software Avast4 ashServ.exe 

 Alwil Software Avast4 ashDisp.exe 

[b]``````````````````````````````

[u]DNS Vulnerability Check:[/u][/b]

 GREAT! (Not vulnerable to DNS cache poisoning) 


[b]`````````End of Log```````````[/b]

    ComboFix_log.txt

    Редактирано от nikolaijelev (преглед на промените)

    Добра работа.

    Временно изключете System Restore:

    Десен бутон на My Computer => Properties => System Restore => сложете отметка пред "Turn off System Restore on all drives" и потвърдете с Apply.

    Моля преинсталирайте Service Pack 3 за Windows, защото имате липсващи и модифицирани файлове:

    [-] 2008-07-12 . 362BC5AF8EAF712832C58CC13AE05750 . 1614848 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll

    c:\windows\system32\drivers\beep.sys ... is missing !!

    Деинсталирайте AVG Antivirus, защото е стара версия (8) и имате и avast!

    Използването на две антивирусни програми в реално време не е препоръчително !

    S4 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [22.11.2008 і. 18:52 231704]

    Ако са остатъци, просто почистете след AVG.

    Съветвам ви да деинсталирате и Anti Trojan Elite и Adobe Reader 7.

    Заменете Adobe Reader с Foxit Reader или го обновете до по-нова версия.

    След като изпълните тези инструкции моля обновете Malwarebytes' Anti-Malware и направете нова проверка с инструмента.

    Публикувайте лог файла.

    За финал направете нова проверка с Combofix и с HijackThis и публикувайте и техните логове.

    Поздрави :)

    •
    • Харесване 2
    • Автор

    Malwarebytes' Anti-Malware

    Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 06:38:21, on 05.11.2009 г.

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16915)

Boot mode: Normal


Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\Program Files\Alwil Software\Avast4\ashDisp.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

C:\WINDOWS\explorer.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Documents and Settings\Gencho\Desktop\is.exe

C:\WINDOWS\system32\svchost.exe


R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll

O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll

O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

O4 - HKLM\..\Run: [avast!] "C:\Program Files\Alwil Software\Avast4\ashDisp.exe"

O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Global Startup: BlueSoleil.lnk = ?

O4 - Global Startup: FlexType 2K.lnk = C:\WINDOWS\Datecs\FType2K.exe

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\Skype4COM.dll

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe

O23 - Service: Служба Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe

O23 - Service: StarWind iSCSI Service (StarWindService) - Unknown owner - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe (file missing)


--

End of file - 4917 bytes


    ComboFix 09-11-04.02 - Gencho 11.2009 г. 6:40.2.2 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.3.1251.359.1033.18.2047.1391 [GMT 2:00]

Running from: c:\documents and settings\Gencho\Desktop\ComboFix.exe

AV: avast! antivirus 4.8.1356 [VPS 091104-1] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

AV: AVG *On-access scanning disabled* (Outdated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}


WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.


((((((((((((((((((((((((( Files Created from 2009-10-05 to 2009-11-05 )))))))))))))))))))))))))))))))

.


2009-11-05 03:15 . 2008-05-03 11:55	2560	------w-	c:\windows\system32\xpsp4res.dll

2009-11-04 19:09 . 2009-11-04 19:09	--------	d-----w-	c:\documents and settings\Gencho\Application Data\Malwarebytes

2009-11-04 19:09 . 2009-09-10 12:54	38224	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys

2009-11-04 19:08 . 2009-11-04 19:09	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware

2009-11-04 19:08 . 2009-11-04 19:08	--------	d-----w-	c:\documents and settings\All Users\Application Data\Malwarebytes

2009-11-04 19:08 . 2009-09-10 12:53	19160	----a-w-	c:\windows\system32\drivers\mbam.sys

2009-11-04 19:05 . 2009-11-04 19:05	--------	d-----w-	c:\program files\Unlocker

2009-11-04 18:59 . 2009-11-04 18:59	--------	d-----w-	c:\program files\Trend Micro

2009-10-07 18:44 . 2009-10-07 18:45	--------	d-----w-	C:\MIG-29 FULCRUM (C) NOVALOGIC

2009-10-07 17:13 . 1998-09-20 21:04	20480	----a-w-	C:\RegSetup.exe

2009-10-07 17:13 . 1998-09-20 19:50	1618432	----a-w-	C:\M29.exe

2009-10-07 17:13 . 1998-09-17 08:10	30	----a-w-	C:\checkftp.bat

2009-10-07 17:13 . 1998-09-16 18:40	97280	----a-w-	C:\Hw_3dfx.dll

2009-10-07 17:13 . 1998-09-15 18:36	5285	----a-w-	C:\Appstr.bin

2009-10-07 17:13 . 1998-09-08 12:34	102912	----a-w-	C:\Novawrld.exe

2009-10-07 17:13 . 1998-08-24 08:12	17920	----a-w-	C:\Netsock.dll

2009-10-07 17:13 . 1998-04-02 05:17	29696	----a-w-	C:\Revupdat.exe

2009-10-07 17:13 . 1997-11-03 19:10	277776	----a-w-	C:\Msvcrt.dll


.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-11-05 03:57 . 2008-09-27 17:45	--------	d-----w-	c:\program files\Google

2009-11-05 03:16 . 2008-11-22 16:38	44880	----a-w-	c:\windows\system32\GDIPFONTCACHEV1.DAT

2009-11-04 19:59 . 2008-09-27 16:43	--------	d-----w-	c:\program files\Yahoo!

2009-11-04 19:14 . 2008-12-08 17:35	--------	d-----w-	c:\documents and settings\All Users\Application Data\Yahoo!

2009-11-04 19:14 . 2008-12-08 17:34	--------	d-----w-	c:\documents and settings\Gencho\Application Data\Yahoo!

2009-11-03 20:04 . 2008-10-11 14:25	--------	d--h--w-	c:\documents and settings\Gencho\Application Data\Skype

2009-11-03 18:28 . 2008-10-11 14:41	--------	d--h--w-	c:\documents and settings\Gencho\Application Data\skypePM

2009-11-02 17:17 . 2009-03-14 00:08	--------	d-----w-	c:\program files\Favorite-Games

2009-10-29 15:32 . 2008-10-04 13:41	--------	d--h--w-	c:\documents and settings\Gencho\Application Data\dvdcss

2009-09-25 14:39 . 2009-09-25 14:38	--------	d-----w-	c:\program files\Foto2Avi

2009-09-25 14:38 . 2009-09-25 14:38	--------	d-----w-	c:\program files\AviSynth 2.5

2009-09-15 10:59 . 2008-11-22 20:24	1279968	----a-w-	c:\windows\system32\aswBoot.exe

2009-09-15 10:56 . 2008-11-22 20:25	93424	----a-w-	c:\windows\system32\drivers\aswmon.sys

2009-09-15 10:56 . 2008-11-22 20:25	94160	----a-w-	c:\windows\system32\drivers\aswmon2.sys

2009-09-15 10:55 . 2008-11-22 20:25	114768	----a-w-	c:\windows\system32\drivers\aswSP.sys

2009-09-15 10:55 . 2008-11-22 20:25	20560	----a-w-	c:\windows\system32\drivers\aswFsBlk.sys

2009-09-15 10:54 . 2008-11-22 20:25	52368	----a-w-	c:\windows\system32\drivers\aswTdi.sys

2009-09-15 10:54 . 2008-11-22 20:25	23152	----a-w-	c:\windows\system32\drivers\aswRdr.sys

2009-09-15 10:53 . 2008-11-22 20:25	27408	----a-w-	c:\windows\system32\drivers\aavmker4.sys

2009-09-15 10:53 . 2008-11-22 20:25	97480	----a-w-	c:\windows\system32\AvastSS.scr

2009-09-11 14:18 . 2008-04-14 08:00	136192	----a-w-	c:\windows\system32\msv1_0.dll

2009-09-04 21:03 . 2008-04-14 08:00	58880	----a-w-	c:\windows\system32\msasn1.dll

2009-08-29 07:36 . 2008-04-23 00:16	832512	----a-w-	c:\windows\system32\wininet.dll

2009-08-29 07:36 . 2008-07-12 19:10	78336	----a-w-	c:\windows\system32\ieencode.dll

2009-08-29 07:36 . 2008-07-12 19:09	17408	----a-w-	c:\windows\system32\corpol.dll

2009-08-26 08:00 . 2008-04-14 08:00	247326	----a-w-	c:\windows\system32\strmdll.dll

2008-12-30 19:17 . 2008-12-29 19:12	88	--sha-r-	c:\windows\system32\33B73A79B6.sys

2008-12-30 19:17 . 2008-12-29 19:12	848	--sha-w-	c:\windows\system32\KGyGaAvL.sys

.


------- Sigcheck -------



[-] 2008-07-12 . 362BC5AF8EAF712832C58CC13AE05750 . 1614848 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll


c:\windows\system32\drivers\beep.sys ... is missing !!

.

((((((((((((((((((((((((((((( SnapShot@2009-11-05_03.13.21 )))))))))))))))))))))))))))))))))))))))))

.

+ 2009-11-05 03:56 . 2009-11-05 03:56	16384 	c:\windows\Temp\Perflib_Perfdata_684.dat

+ 2008-04-14 08:00 . 2009-06-25 08:25	54272 	c:\windows\system32\wdigest.dll

+ 2008-07-12 19:08 . 2009-07-14 11:03	46080 	c:\windows\system32\tzchange.exe

+ 2008-04-14 08:00 . 2009-06-12 12:31	80896 	c:\windows\system32\tlntsess.exe

+ 2008-04-14 08:00 . 2009-06-12 12:31	76288 	c:\windows\system32\telnet.exe

+ 2008-09-19 17:18 . 2008-07-09 07:38	26488 	c:\windows\system32\spupdsvc.exe

+ 2008-04-14 08:00 . 2009-06-25 08:25	56832 	c:\windows\system32\secur32.dll

+ 2008-04-14 08:00 . 2009-02-06 10:39	35328 	c:\windows\system32\sc.exe

- 2008-04-23 00:16 . 2008-10-16 20:38	44544 	c:\windows\system32\pngfilt.dll

+ 2008-04-23 00:16 . 2009-08-29 07:36	44544 	c:\windows\system32\pngfilt.dll

+ 2008-04-14 08:00 . 2009-11-05 04:00	53744 	c:\windows\system32\perfc009.dat

- 2008-04-14 08:00 . 2009-10-25 11:32	53744 	c:\windows\system32\perfc009.dat

- 2008-09-19 17:14 . 2008-04-14 08:00	91648 	c:\windows\system32\mtxoci.dll

+ 2008-09-19 17:14 . 2008-06-12 14:23	91648 	c:\windows\system32\mtxoci.dll

+ 2008-04-14 08:00 . 2008-06-12 14:23	66560 	c:\windows\system32\mtxclu.dll

- 2008-04-14 08:00 . 2008-04-14 08:00	66560 	c:\windows\system32\mtxclu.dll

- 2008-04-23 00:16 . 2008-10-16 20:38	52224 	c:\windows\system32\msfeedsbs.dll

+ 2008-04-23 00:16 . 2009-08-29 07:36	52224 	c:\windows\system32\msfeedsbs.dll

+ 2008-09-19 17:14 . 2008-06-12 14:23	58880 	c:\windows\system32\msdtclog.dll

- 2008-09-19 17:14 . 2008-04-14 08:00	58880 	c:\windows\system32\msdtclog.dll

+ 2008-04-23 00:16 . 2009-08-29 07:36	27648 	c:\windows\system32\jsproxy.dll

- 2008-04-23 00:16 . 2008-10-16 20:38	27648 	c:\windows\system32\jsproxy.dll

+ 2008-04-22 03:39 . 2009-08-28 10:28	13824 	c:\windows\system32\ieudinit.exe

- 2008-04-22 03:39 . 2008-10-16 13:11	13824 	c:\windows\system32\ieudinit.exe

+ 2008-04-23 00:16 . 2009-08-29 07:36	44544 	c:\windows\system32\iernonce.dll

- 2008-04-23 00:16 . 2008-10-16 20:38	44544 	c:\windows\system32\iernonce.dll

+ 2008-04-22 03:39 . 2009-08-28 10:28	70656 	c:\windows\system32\ie4uinit.exe

- 2008-04-22 03:39 . 2008-10-16 13:11	70656 	c:\windows\system32\ie4uinit.exe

+ 2008-04-23 00:16 . 2009-08-29 07:36	63488 	c:\windows\system32\icardie.dll

- 2008-04-23 00:16 . 2008-10-16 20:38	63488 	c:\windows\system32\icardie.dll

+ 2008-04-14 08:00 . 2009-07-29 04:37	81920 	c:\windows\system32\fontsub.dll

+ 2008-04-14 08:00 . 2009-06-24 11:18	92928 	c:\windows\system32\drivers\ksecdd.sys

+ 2008-04-14 08:00 . 2009-06-25 08:25	54272 	c:\windows\system32\dllcache\wdigest.dll

+ 2008-04-14 08:00 . 2009-06-12 12:31	80896 	c:\windows\system32\dllcache\tlntsess.exe

+ 2008-04-14 08:00 . 2009-06-12 12:31	76288 	c:\windows\system32\dllcache\telnet.exe

+ 2008-04-14 08:00 . 2009-06-25 08:25	56832 	c:\windows\system32\dllcache\secur32.dll

+ 2008-04-14 08:00 . 2009-02-06 10:39	35328 	c:\windows\system32\dllcache\sc.exe

+ 2008-04-23 00:16 . 2009-08-29 07:36	44544 	c:\windows\system32\dllcache\pngfilt.dll

- 2008-04-23 00:16 . 2008-10-16 20:38	44544 	c:\windows\system32\dllcache\pngfilt.dll

- 2008-09-19 17:14 . 2008-04-14 08:00	91648 	c:\windows\system32\dllcache\mtxoci.dll

+ 2008-09-19 17:14 . 2008-06-12 14:23	91648 	c:\windows\system32\dllcache\mtxoci.dll

- 2008-04-14 08:00 . 2008-04-14 08:00	66560 	c:\windows\system32\dllcache\mtxclu.dll

+ 2008-04-14 08:00 . 2008-06-12 14:23	66560 	c:\windows\system32\dllcache\mtxclu.dll

- 2008-09-19 17:18 . 2008-10-16 20:38	52224 	c:\windows\system32\dllcache\msfeedsbs.dll

+ 2008-09-19 17:18 . 2009-08-29 07:36	52224 	c:\windows\system32\dllcache\msfeedsbs.dll

+ 2008-09-19 17:14 . 2008-06-12 14:23	58880 	c:\windows\system32\dllcache\msdtclog.dll

- 2008-09-19 17:14 . 2008-04-14 08:00	58880 	c:\windows\system32\dllcache\msdtclog.dll

+ 2008-04-14 08:00 . 2009-09-04 21:03	58880 	c:\windows\system32\dllcache\msasn1.dll

+ 2008-04-14 08:00 . 2009-06-24 11:18	92928 	c:\windows\system32\dllcache\ksecdd.sys

+ 2008-04-23 00:16 . 2009-08-29 07:36	27648 	c:\windows\system32\dllcache\jsproxy.dll

- 2008-04-23 00:16 . 2008-10-16 20:38	27648 	c:\windows\system32\dllcache\jsproxy.dll

- 2008-09-19 17:18 . 2008-10-16 13:11	13824 	c:\windows\system32\dllcache\ieudinit.exe

+ 2008-09-19 17:18 . 2009-08-28 10:28	13824 	c:\windows\system32\dllcache\ieudinit.exe

- 2008-04-23 00:16 . 2008-10-16 20:38	44544 	c:\windows\system32\dllcache\iernonce.dll

+ 2008-04-23 00:16 . 2009-08-29 07:36	44544 	c:\windows\system32\dllcache\iernonce.dll

- 2008-07-12 19:10 . 2008-07-12 19:10	78336 	c:\windows\system32\dllcache\ieencode.dll

+ 2008-07-12 19:10 . 2009-08-29 07:36	78336 	c:\windows\system32\dllcache\ieencode.dll

+ 2008-04-22 03:39 . 2009-08-28 10:28	70656 	c:\windows\system32\dllcache\ie4uinit.exe

- 2008-04-22 03:39 . 2008-10-16 13:11	70656 	c:\windows\system32\dllcache\ie4uinit.exe

+ 2008-09-19 17:18 . 2009-08-29 07:36	63488 	c:\windows\system32\dllcache\icardie.dll

- 2008-09-19 17:18 . 2008-10-16 20:38	63488 	c:\windows\system32\dllcache\icardie.dll

+ 2008-04-14 08:00 . 2009-07-29 04:37	81920 	c:\windows\system32\dllcache\fontsub.dll

+ 2008-07-12 19:09 . 2009-08-29 07:36	17408 	c:\windows\system32\dllcache\corpol.dll

- 2008-07-12 19:09 . 2008-07-12 19:09	17408 	c:\windows\system32\dllcache\corpol.dll

- 2008-04-14 08:00 . 2008-04-14 08:00	84992 	c:\windows\system32\dllcache\avifil32.dll

+ 2008-04-14 08:00 . 2009-06-10 14:13	84992 	c:\windows\system32\dllcache\avifil32.dll

+ 2008-04-14 08:00 . 2009-07-17 19:01	58880 	c:\windows\system32\dllcache\atl.dll

- 2008-04-14 08:00 . 2008-04-14 08:00	58880 	c:\windows\system32\dllcache\atl.dll

+ 2008-04-14 08:00 . 2009-06-10 14:13	84992 	c:\windows\system32\avifil32.dll

- 2008-04-14 08:00 . 2008-04-14 08:00	84992 	c:\windows\system32\avifil32.dll

+ 2008-04-14 08:00 . 2009-07-17 19:01	58880 	c:\windows\system32\atl.dll

- 2008-04-14 08:00 . 2008-04-14 08:00	58880 	c:\windows\system32\atl.dll

+ 2009-06-24 17:56 . 2009-06-24 17:56	73728 	c:\windows\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe

+ 2008-05-27 22:49 . 2008-05-27 22:49	77824 	c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorsn.dll

- 2007-04-13 17:58 . 2007-04-13 17:58	77824 	c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorsn.dll

- 2007-04-13 17:57 . 2007-04-13 17:57	86016 	c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorie.dll

+ 2008-05-27 22:49 . 2008-05-27 22:49	86016 	c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorie.dll

+ 2008-05-27 22:49 . 2008-05-27 22:49	81920 	c:\windows\Microsoft.NET\Framework\v1.1.4322\CORPerfMonExt.dll

- 2007-04-13 17:57 . 2007-04-13 17:57	81920 	c:\windows\Microsoft.NET\Framework\v1.1.4322\CORPerfMonExt.dll

- 2007-04-13 18:30 . 2007-04-13 18:30	32768 	c:\windows\Microsoft.NET\Framework\v1.1.4322\aspnet_wp.exe

+ 2008-05-27 23:30 . 2008-05-27 23:30	32768 	c:\windows\Microsoft.NET\Framework\v1.1.4322\aspnet_wp.exe

+ 2009-11-05 03:53 . 2008-10-16 20:38	44544 	c:\windows\ie7updates\KB974455-IE7\pngfilt.dll

+ 2009-11-05 03:53 . 2008-10-16 20:38	52224 	c:\windows\ie7updates\KB974455-IE7\msfeedsbs.dll

+ 2009-11-05 03:53 . 2008-10-16 20:38	27648 	c:\windows\ie7updates\KB974455-IE7\jsproxy.dll

+ 2009-11-05 03:53 . 2008-10-16 13:11	13824 	c:\windows\ie7updates\KB974455-IE7\ieudinit.exe

+ 2009-11-05 03:53 . 2008-10-16 20:38	44544 	c:\windows\ie7updates\KB974455-IE7\iernonce.dll

+ 2009-11-05 03:53 . 2008-07-12 19:10	78336 	c:\windows\ie7updates\KB974455-IE7\ieencode.dll

+ 2009-11-05 03:53 . 2008-10-16 13:11	70656 	c:\windows\ie7updates\KB974455-IE7\ie4uinit.exe

+ 2009-11-05 03:53 . 2008-10-16 20:38	63488 	c:\windows\ie7updates\KB974455-IE7\icardie.dll

+ 2009-11-05 03:53 . 2008-07-12 19:09	17408 	c:\windows\ie7updates\KB974455-IE7\corpol.dll

+ 2009-11-05 03:52 . 2009-11-05 03:52	90112 	c:\windows\assembly\NativeImages1_v1.1.4322\System.Drawing.Design\1.0.5000.0__b03f5f7f11d50a3a_3916e22f\System.Drawing.Design.dll

+ 2009-11-05 03:52 . 2009-11-05 03:52	61440 	c:\windows\assembly\NativeImages1_v1.1.4322\CustomMarshalers\1.0.5000.0__b03f5f7f11d50a3a_491de5d0\CustomMarshalers.dll

+ 2008-07-12 19:25 . 2009-04-01 21:02	604160 	c:\windows\system32\wmspdmod.dll

+ 2008-07-12 19:25 . 2009-07-13 21:43	286208 	c:\windows\system32\wmpdxm.dll

- 2008-04-14 08:00 . 2008-04-14 08:00	132096 	c:\windows\system32\wkssvc.dll

+ 2008-04-14 08:00 . 2009-06-10 06:14	132096 	c:\windows\system32\wkssvc.dll

- 2008-04-14 08:00 . 2008-04-14 08:00	354304 	c:\windows\system32\winhttp.dll

+ 2008-04-14 08:00 . 2008-12-16 12:30	354304 	c:\windows\system32\winhttp.dll

+ 2008-04-23 00:16 . 2009-08-29 07:36	233472 	c:\windows\system32\webcheck.dll

- 2008-04-23 00:16 . 2008-10-16 20:38	233472 	c:\windows\system32\webcheck.dll

+ 2008-09-19 17:14 . 2009-02-06 10:10	227840 	c:\windows\system32\wbem\wmiprvse.exe

+ 2008-09-19 17:14 . 2009-02-09 12:10	453120 	c:\windows\system32\wbem\wmiprvsd.dll

+ 2008-09-19 17:13 . 2009-02-09 12:10	473600 	c:\windows\system32\wbem\fastprox.dll

- 2008-04-23 00:16 . 2008-10-16 20:38	105984 	c:\windows\system32\url.dll

+ 2008-04-23 00:16 . 2009-08-29 07:36	105984 	c:\windows\system32\url.dll

+ 2008-04-14 08:00 . 2009-07-29 04:37	119808 	c:\windows\system32\t2embed.dll

+ 2008-04-14 08:00 . 2009-02-06 11:11	110592 	c:\windows\system32\services.exe

+ 2008-04-14 08:00 . 2009-06-25 08:25	147456 	c:\windows\system32\schannel.dll

+ 2008-04-14 08:00 . 2009-02-09 12:10	401408 	c:\windows\system32\rpcss.dll

+ 2008-04-14 08:00 . 2009-04-15 14:51	585216 	c:\windows\system32\rpcrt4.dll

+ 2008-04-14 08:00 . 2009-11-05 04:00	383390 	c:\windows\system32\perfh009.dat

- 2008-04-14 08:00 . 2009-10-25 11:32	383390 	c:\windows\system32\perfh009.dat

- 2008-04-14 08:00 . 2008-04-14 08:00	284160 	c:\windows\system32\pdh.dll

+ 2008-04-14 08:00 . 2009-03-06 14:22	284160 	c:\windows\system32\pdh.dll

- 2008-04-23 00:16 . 2008-10-16 20:38	102912 	c:\windows\system32\occache.dll

+ 2008-04-23 00:16 . 2009-08-29 07:36	102912 	c:\windows\system32\occache.dll

+ 2008-04-14 08:00 . 2009-02-09 12:10	714752 	c:\windows\system32\ntdll.dll

+ 2008-04-14 08:00 . 2009-08-05 09:01	204800 	c:\windows\system32\mswebdvd.dll

+ 2008-04-23 00:16 . 2009-08-29 07:36	671232 	c:\windows\system32\mstime.dll

- 2008-04-23 00:16 . 2008-10-16 20:38	671232 	c:\windows\system32\mstime.dll

+ 2008-04-23 00:16 . 2009-08-29 07:36	193024 	c:\windows\system32\msrating.dll

- 2008-04-23 00:16 . 2008-10-16 20:38	193024 	c:\windows\system32\msrating.dll

- 2008-04-23 00:16 . 2008-10-16 20:38	477696 	c:\windows\system32\mshtmled.dll

+ 2008-04-23 00:16 . 2009-08-29 07:36	477696 	c:\windows\system32\mshtmled.dll

- 2008-04-23 00:16 . 2008-10-16 20:38	459264 	c:\windows\system32\msfeeds.dll

+ 2008-04-23 00:16 . 2009-08-29 07:36	459264 	c:\windows\system32\msfeeds.dll

- 2008-09-19 17:14 . 2008-04-14 08:00	161792 	c:\windows\system32\msdtcuiu.dll

+ 2008-09-19 17:14 . 2008-06-12 14:23	161792 	c:\windows\system32\msdtcuiu.dll

- 2008-09-19 17:14 . 2008-04-14 08:00	956928 	c:\windows\system32\msdtctm.dll

+ 2008-09-19 17:14 . 2008-06-12 14:23	956928 	c:\windows\system32\msdtctm.dll

+ 2008-09-19 17:14 . 2008-06-12 14:23	428032 	c:\windows\system32\msdtcprx.dll

+ 2008-04-14 08:00 . 2009-06-25 08:25	730112 	c:\windows\system32\lsasrv.dll

+ 2008-04-14 08:00 . 2009-05-07 15:32	345600 	c:\windows\system32\localspl.dll

+ 2008-04-14 08:00 . 2009-03-21 14:06	989696 	c:\windows\system32\kernel32.dll

- 2008-04-14 08:00 . 2008-04-14 08:00	989696 	c:\windows\system32\kernel32.dll

+ 2008-04-14 08:00 . 2009-06-25 08:25	301568 	c:\windows\system32\kerberos.dll

- 2008-07-12 19:09 . 2008-07-12 19:09	512000 	c:\windows\system32\jscript.dll

+ 2008-07-12 19:09 . 2009-08-13 15:02	512000 	c:\windows\system32\jscript.dll

+ 2008-04-23 00:16 . 2009-08-29 07:36	268288 	c:\windows\system32\iertutil.dll

+ 2008-04-23 00:16 . 2009-08-29 07:36	385024 	c:\windows\system32\iedkcs32.dll

+ 2008-04-23 00:16 . 2009-08-29 07:36	380928 	c:\windows\system32\ieapfltr.dll

+ 2008-04-20 01:07 . 2009-08-27 05:18	161792 	c:\windows\system32\ieakui.dll

- 2008-04-20 01:07 . 2008-10-15 07:04	161792 	c:\windows\system32\ieakui.dll

+ 2008-04-23 00:16 . 2009-08-29 07:36	230400 	c:\windows\system32\ieaksie.dll

- 2008-04-23 00:16 . 2008-10-16 20:38	230400 	c:\windows\system32\ieaksie.dll

- 2008-04-23 00:16 . 2008-10-16 20:38	153088 	c:\windows\system32\ieakeng.dll

+ 2008-04-23 00:16 . 2009-08-29 07:36	153088 	c:\windows\system32\ieakeng.dll

+ 2008-09-20 02:07 . 2009-11-05 03:56	198552 	c:\windows\system32\FNTCACHE.DAT

- 2008-09-20 02:07 . 2009-11-04 20:55	198552 	c:\windows\system32\FNTCACHE.DAT

- 2008-04-23 00:16 . 2008-10-16 20:38	133120 	c:\windows\system32\extmgr.dll

+ 2008-04-23 00:16 . 2009-08-29 07:36	133120 	c:\windows\system32\extmgr.dll

+ 2008-04-23 00:16 . 2009-08-29 07:36	214528 	c:\windows\system32\dxtrans.dll

- 2008-04-23 00:16 . 2008-10-16 20:38	214528 	c:\windows\system32\dxtrans.dll

- 2008-04-23 00:16 . 2008-10-16 20:38	347136 	c:\windows\system32\dxtmsft.dll

+ 2008-04-23 00:16 . 2009-08-29 07:36	347136 	c:\windows\system32\dxtmsft.dll

+ 2008-04-14 08:00 . 2008-12-11 10:57	333952 	c:\windows\system32\drivers\srv.sys

+ 2008-09-19 17:14 . 2008-04-21 12:08	215552 	c:\windows\system32\dllcache\wordpad.exe

+ 2008-07-12 19:25 . 2009-04-01 21:02	604160 	c:\windows\system32\dllcache\wmspdmod.dll

+ 2008-07-12 19:25 . 2009-07-13 21:43	286208 	c:\windows\system32\dllcache\wmpdxm.dll

+ 2008-09-19 17:14 . 2009-02-06 10:10	227840 	c:\windows\system32\dllcache\wmiprvse.exe

+ 2008-09-19 17:14 . 2009-02-09 12:10	453120 	c:\windows\system32\dllcache\wmiprvsd.dll

+ 2008-04-14 08:00 . 2009-06-10 06:14	132096 	c:\windows\system32\dllcache\wkssvc.dll

- 2008-04-14 08:00 . 2008-04-14 08:00	132096 	c:\windows\system32\dllcache\wkssvc.dll

+ 2008-04-23 00:16 . 2009-08-29 07:36	832512 	c:\windows\system32\dllcache\wininet.dll

+ 2008-04-14 08:00 . 2008-12-16 12:30	354304 	c:\windows\system32\dllcache\winhttp.dll

- 2008-04-14 08:00 . 2008-04-14 08:00	354304 	c:\windows\system32\dllcache\winhttp.dll

- 2008-04-23 00:16 . 2008-10-16 20:38	233472 	c:\windows\system32\dllcache\webcheck.dll

+ 2008-04-23 00:16 . 2009-08-29 07:36	233472 	c:\windows\system32\dllcache\webcheck.dll

+ 2008-04-23 00:16 . 2009-08-29 07:36	105984 	c:\windows\system32\dllcache\url.dll

- 2008-04-23 00:16 . 2008-10-16 20:38	105984 	c:\windows\system32\dllcache\url.dll

+ 2008-09-19 17:15 . 2009-06-21 21:44	153088 	c:\windows\system32\dllcache\triedit.dll

- 2008-09-19 17:15 . 2008-04-14 08:00	153088 	c:\windows\system32\dllcache\triedit.dll

+ 2008-04-14 08:00 . 2009-07-29 04:37	119808 	c:\windows\system32\dllcache\t2embed.dll

- 2008-04-14 08:00 . 2008-10-03 10:02	247326 	c:\windows\system32\dllcache\strmdll.dll

+ 2008-04-14 08:00 . 2009-08-26 08:00	247326 	c:\windows\system32\dllcache\strmdll.dll

+ 2008-04-14 08:00 . 2008-12-11 10:57	333952 	c:\windows\system32\dllcache\srv.sys

+ 2008-04-14 08:00 . 2009-02-06 11:11	110592 	c:\windows\system32\dllcache\services.exe

+ 2008-04-14 08:00 . 2009-06-25 08:25	147456 	c:\windows\system32\dllcache\schannel.dll

+ 2008-04-14 08:00 . 2009-02-09 12:10	401408 	c:\windows\system32\dllcache\rpcss.dll

+ 2008-04-14 08:00 . 2009-04-15 14:51	585216 	c:\windows\system32\dllcache\rpcrt4.dll

- 2008-04-14 08:00 . 2008-04-14 08:00	284160 	c:\windows\system32\dllcache\pdh.dll

+ 2008-04-14 08:00 . 2009-03-06 14:22	284160 	c:\windows\system32\dllcache\pdh.dll

- 2008-04-23 00:16 . 2008-10-16 20:38	102912 	c:\windows\system32\dllcache\occache.dll

+ 2008-04-23 00:16 . 2009-08-29 07:36	102912 	c:\windows\system32\dllcache\occache.dll

+ 2008-04-14 08:00 . 2009-02-09 12:10	714752 	c:\windows\system32\dllcache\ntdll.dll

+ 2008-04-14 08:00 . 2009-08-05 09:01	204800 	c:\windows\system32\dllcache\mswebdvd.dll

+ 2008-04-14 08:00 . 2009-09-11 14:18	136192 	c:\windows\system32\dllcache\msv1_0.dll

+ 2008-04-23 00:16 . 2009-08-29 07:36	671232 	c:\windows\system32\dllcache\mstime.dll

- 2008-04-23 00:16 . 2008-10-16 20:38	671232 	c:\windows\system32\dllcache\mstime.dll

- 2008-04-23 00:16 . 2008-10-16 20:38	193024 	c:\windows\system32\dllcache\msrating.dll

+ 2008-04-23 00:16 . 2009-08-29 07:36	193024 	c:\windows\system32\dllcache\msrating.dll

+ 2008-04-23 00:16 . 2009-08-29 07:36	477696 	c:\windows\system32\dllcache\mshtmled.dll

- 2008-04-23 00:16 . 2008-10-16 20:38	477696 	c:\windows\system32\dllcache\mshtmled.dll

+ 2008-09-19 17:18 . 2009-08-29 07:36	459264 	c:\windows\system32\dllcache\msfeeds.dll

- 2008-09-19 17:18 . 2008-10-16 20:38	459264 	c:\windows\system32\dllcache\msfeeds.dll

- 2008-09-19 17:14 . 2008-04-14 08:00	161792 	c:\windows\system32\dllcache\msdtcuiu.dll

+ 2008-09-19 17:14 . 2008-06-12 14:23	161792 	c:\windows\system32\dllcache\msdtcuiu.dll

+ 2008-09-19 17:14 . 2008-06-12 14:23	956928 	c:\windows\system32\dllcache\msdtctm.dll

- 2008-09-19 17:14 . 2008-04-14 08:00	956928 	c:\windows\system32\dllcache\msdtctm.dll

+ 2008-09-19 17:14 . 2008-06-12 14:23	428032 	c:\windows\system32\dllcache\msdtcprx.dll

+ 2008-04-14 08:00 . 2009-06-25 08:25	730112 	c:\windows\system32\dllcache\lsasrv.dll

+ 2008-04-14 08:00 . 2009-05-07 15:32	345600 	c:\windows\system32\dllcache\localspl.dll

- 2008-04-14 08:00 . 2008-04-14 08:00	989696 	c:\windows\system32\dllcache\kernel32.dll

+ 2008-04-14 08:00 . 2009-03-21 14:06	989696 	c:\windows\system32\dllcache\kernel32.dll

+ 2008-04-14 08:00 . 2009-06-25 08:25	301568 	c:\windows\system32\dllcache\kerberos.dll

- 2008-07-12 19:09 . 2008-07-12 19:09	512000 	c:\windows\system32\dllcache\jscript.dll

+ 2008-07-12 19:09 . 2009-08-13 15:02	512000 	c:\windows\system32\dllcache\jscript.dll

+ 2008-09-19 17:15 . 2009-08-27 05:18	634648 	c:\windows\system32\dllcache\iexplore.exe

+ 2008-09-19 17:18 . 2009-08-29 07:36	268288 	c:\windows\system32\dllcache\iertutil.dll

+ 2008-04-23 00:16 . 2009-08-29 07:36	385024 	c:\windows\system32\dllcache\iedkcs32.dll

+ 2008-09-19 17:18 . 2009-08-29 07:36	380928 	c:\windows\system32\dllcache\ieapfltr.dll

- 2008-04-20 01:07 . 2008-10-15 07:04	161792 	c:\windows\system32\dllcache\ieakui.dll

+ 2008-04-20 01:07 . 2009-08-27 05:18	161792 	c:\windows\system32\dllcache\ieakui.dll

- 2008-04-23 00:16 . 2008-10-16 20:38	230400 	c:\windows\system32\dllcache\ieaksie.dll

+ 2008-04-23 00:16 . 2009-08-29 07:36	230400 	c:\windows\system32\dllcache\ieaksie.dll

- 2008-04-23 00:16 . 2008-10-16 20:38	153088 	c:\windows\system32\dllcache\ieakeng.dll

+ 2008-04-23 00:16 . 2009-08-29 07:36	153088 	c:\windows\system32\dllcache\ieakeng.dll

+ 2008-09-19 17:13 . 2009-02-09 12:10	473600 	c:\windows\system32\dllcache\fastprox.dll

- 2008-04-23 00:16 . 2008-10-16 20:38	133120 	c:\windows\system32\dllcache\extmgr.dll

+ 2008-04-23 00:16 . 2009-08-29 07:36	133120 	c:\windows\system32\dllcache\extmgr.dll

+ 2008-04-23 00:16 . 2009-08-29 07:36	214528 	c:\windows\system32\dllcache\dxtrans.dll

- 2008-04-23 00:16 . 2008-10-16 20:38	214528 	c:\windows\system32\dllcache\dxtrans.dll

- 2008-04-23 00:16 . 2008-10-16 20:38	347136 	c:\windows\system32\dllcache\dxtmsft.dll

+ 2008-04-23 00:16 . 2009-08-29 07:36	347136 	c:\windows\system32\dllcache\dxtmsft.dll

+ 2008-04-23 00:16 . 2009-08-29 07:36	124928 	c:\windows\system32\dllcache\advpack.dll

- 2008-04-23 00:16 . 2008-10-16 20:38	124928 	c:\windows\system32\dllcache\advpack.dll

- 2008-04-14 08:00 . 2008-04-14 08:00	617472 	c:\windows\system32\dllcache\advapi32.dll

+ 2008-04-14 08:00 . 2009-02-09 12:10	617472 	c:\windows\system32\dllcache\advapi32.dll

+ 2008-04-23 00:16 . 2009-08-29 07:36	124928 	c:\windows\system32\advpack.dll

- 2008-04-23 00:16 . 2008-10-16 20:38	124928 	c:\windows\system32\advpack.dll

+ 2008-04-14 08:00 . 2009-02-09 12:10	617472 	c:\windows\system32\advapi32.dll

- 2008-04-14 08:00 . 2008-04-14 08:00	617472 	c:\windows\system32\advapi32.dll

- 2007-04-13 17:58 . 2007-04-13 17:58	102400 	c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorld.dll

+ 2008-05-27 22:49 . 2008-05-27 22:49	102400 	c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorld.dll

+ 2008-05-27 22:48 . 2008-05-27 22:48	315392 	c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorjit.dll

- 2007-04-13 17:56 . 2007-04-13 17:56	315392 	c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorjit.dll

- 2007-04-13 18:30 . 2007-04-13 18:30	258048 	c:\windows\Microsoft.NET\Framework\v1.1.4322\aspnet_isapi.dll

+ 2008-05-27 23:30 . 2008-05-27 23:30	258048 	c:\windows\Microsoft.NET\Framework\v1.1.4322\aspnet_isapi.dll

+ 2009-11-05 03:53 . 2008-10-16 20:38	826368 	c:\windows\ie7updates\KB974455-IE7\wininet.dll

+ 2009-11-05 03:53 . 2008-10-16 20:38	233472 	c:\windows\ie7updates\KB974455-IE7\webcheck.dll

+ 2009-11-05 03:53 . 2008-10-16 20:38	105984 	c:\windows\ie7updates\KB974455-IE7\url.dll

+ 2009-11-05 03:53 . 2009-05-26 11:40	382840 	c:\windows\ie7updates\KB974455-IE7\spuninst\updspapi.dll

+ 2009-11-05 03:53 . 2009-05-26 11:40	231288 	c:\windows\ie7updates\KB974455-IE7\spuninst\spuninst.exe

+ 2009-11-05 03:53 . 2008-10-16 20:38	102912 	c:\windows\ie7updates\KB974455-IE7\occache.dll

+ 2009-11-05 03:53 . 2008-10-16 20:38	671232 	c:\windows\ie7updates\KB974455-IE7\mstime.dll

+ 2009-11-05 03:53 . 2008-10-16 20:38	193024 	c:\windows\ie7updates\KB974455-IE7\msrating.dll

+ 2009-11-05 03:53 . 2008-10-16 20:38	477696 	c:\windows\ie7updates\KB974455-IE7\mshtmled.dll

+ 2009-11-05 03:53 . 2008-10-16 20:38	459264 	c:\windows\ie7updates\KB974455-IE7\msfeeds.dll

+ 2009-11-05 03:53 . 2008-10-15 07:06	633632 	c:\windows\ie7updates\KB974455-IE7\iexplore.exe

+ 2009-11-05 03:53 . 2008-10-16 20:38	267776 	c:\windows\ie7updates\KB974455-IE7\iertutil.dll

+ 2009-11-05 03:53 . 2008-10-16 20:38	384512 	c:\windows\ie7updates\KB974455-IE7\iedkcs32.dll

+ 2009-11-05 03:53 . 2008-10-16 20:38	383488 	c:\windows\ie7updates\KB974455-IE7\ieapfltr.dll

+ 2009-11-05 03:53 . 2008-10-15 07:04	161792 	c:\windows\ie7updates\KB974455-IE7\ieakui.dll

+ 2009-11-05 03:53 . 2008-10-16 20:38	230400 	c:\windows\ie7updates\KB974455-IE7\ieaksie.dll

+ 2009-11-05 03:53 . 2008-10-16 20:38	153088 	c:\windows\ie7updates\KB974455-IE7\ieakeng.dll

+ 2009-11-05 03:53 . 2008-10-16 20:38	133120 	c:\windows\ie7updates\KB974455-IE7\extmgr.dll

+ 2009-11-05 03:53 . 2008-10-16 20:38	214528 	c:\windows\ie7updates\KB974455-IE7\dxtrans.dll

+ 2009-11-05 03:53 . 2008-10-16 20:38	347136 	c:\windows\ie7updates\KB974455-IE7\dxtmsft.dll

+ 2009-11-05 03:53 . 2008-10-16 20:38	124928 	c:\windows\ie7updates\KB974455-IE7\advpack.dll

+ 2009-11-05 03:53 . 2009-11-05 03:53	835584 	c:\windows\assembly\NativeImages1_v1.1.4322\System.Drawing\1.0.5000.0__b03f5f7f11d50a3a_e6e6fd9d\System.Drawing.dll

+ 2009-11-05 03:17 . 2009-08-13 13:55	1748992 	c:\windows\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.6001.22319_x-ww_f0b4c2df\GdiPlus.dll

- 2008-07-12 19:25 . 2008-06-18 03:03	2458112 	c:\windows\system32\WMVCore.dll

+ 2008-07-12 19:25 . 2009-05-20 02:56	2458112 	c:\windows\system32\WMVCore.dll

+ 2008-04-14 08:00 . 2009-04-17 12:26	1847168 	c:\windows\system32\win32k.sys

+ 2008-04-23 00:16 . 2009-08-29 07:36	1168384 	c:\windows\system32\urlmon.dll

+ 2008-04-14 08:00 . 2008-06-17 19:02	8461312 	c:\windows\system32\shell32.dll

- 2008-04-14 08:00 . 2008-04-14 08:00	8461312 	c:\windows\system32\shell32.dll

+ 2008-04-14 08:00 . 2009-07-17 16:22	1435648 	c:\windows\system32\query.dll

- 2008-04-14 08:00 . 2008-04-14 08:00	1435648 	c:\windows\system32\query.dll

+ 2008-07-12 19:09 . 2009-06-03 19:12	1291264 	c:\windows\system32\quartz.dll

+ 2008-04-14 08:00 . 2009-08-04 15:13	2145280 	c:\windows\system32\ntoskrnl.exe

- 2008-04-14 08:00 . 2008-08-14 10:09	2145280 	c:\windows\system32\ntoskrnl.exe

- 2008-04-14 04:01 . 2008-08-14 09:33	2023936 	c:\windows\system32\ntkrnlpa.exe

+ 2008-04-14 04:01 . 2009-08-04 14:20	2023936 	c:\windows\system32\ntkrnlpa.exe

+ 2008-09-19 17:14 . 2009-06-10 07:19	2066432 	c:\windows\system32\mstscax.dll

+ 2008-04-23 22:16 . 2009-08-29 07:36	3598336 	c:\windows\system32\mshtml.dll

+ 2008-04-23 00:16 . 2009-08-29 07:36	6067200 	c:\windows\system32\ieframe.dll

+ 2007-04-17 05:32 . 2009-06-29 08:33	2452872 	c:\windows\system32\ieapfltr.dat

+ 2008-07-12 19:25 . 2009-05-20 02:56	2458112 	c:\windows\system32\dllcache\WMVCore.dll

- 2008-07-12 19:25 . 2008-06-18 03:03	2458112 	c:\windows\system32\dllcache\WMVCore.dll

+ 2008-04-14 08:00 . 2009-04-17 12:26	1847168 	c:\windows\system32\dllcache\win32k.sys

+ 2008-04-23 00:16 . 2009-08-29 07:36	1168384 	c:\windows\system32\dllcache\urlmon.dll

+ 2008-04-14 08:00 . 2008-06-17 19:02	8461312 	c:\windows\system32\dllcache\shell32.dll

- 2008-04-14 08:00 . 2008-04-14 08:00	8461312 	c:\windows\system32\dllcache\shell32.dll

+ 2008-04-14 08:00 . 2009-07-17 16:22	1435648 	c:\windows\system32\dllcache\query.dll

- 2008-04-14 08:00 . 2008-04-14 08:00	1435648 	c:\windows\system32\dllcache\query.dll

+ 2008-07-12 19:09 . 2009-06-03 19:12	1291264 	c:\windows\system32\dllcache\quartz.dll

+ 2008-10-15 06:56 . 2009-08-04 18:44	2189184 	c:\windows\system32\dllcache\ntoskrnl.exe

- 2008-10-15 06:56 . 2008-08-14 10:11	2189184 	c:\windows\system32\dllcache\ntoskrnl.exe

+ 2008-10-15 06:56 . 2009-08-04 14:20	2023936 	c:\windows\system32\dllcache\ntkrpamp.exe

- 2008-10-15 06:56 . 2008-08-14 09:33	2023936 	c:\windows\system32\dllcache\ntkrpamp.exe

+ 2008-10-15 06:56 . 2009-08-04 14:20	2066048 	c:\windows\system32\dllcache\ntkrnlpa.exe

- 2008-10-15 06:56 . 2008-08-14 09:33	2066048 	c:\windows\system32\dllcache\ntkrnlpa.exe

+ 2008-10-15 06:56 . 2009-08-04 15:13	2145280 	c:\windows\system32\dllcache\ntkrnlmp.exe

- 2008-10-15 06:56 . 2008-08-14 10:09	2145280 	c:\windows\system32\dllcache\ntkrnlmp.exe

+ 2009-06-10 07:19 . 2009-06-10 07:19	2066432 	c:\windows\system32\dllcache\mstscax.dll

+ 2008-09-19 17:15 . 2009-07-10 13:27	1315328 	c:\windows\system32\dllcache\msoe.dll

+ 2008-04-23 22:16 . 2009-08-29 07:36	3598336 	c:\windows\system32\dllcache\mshtml.dll

+ 2008-09-19 17:18 . 2009-08-29 07:36	6067200 	c:\windows\system32\dllcache\ieframe.dll

+ 2008-09-19 17:18 . 2009-06-29 08:33	2452872 	c:\windows\system32\dllcache\ieapfltr.dat

+ 2008-05-27 23:35 . 2008-05-27 23:35	1265664 	c:\windows\Microsoft.NET\Framework\v1.1.4322\System.Web.dll

- 2007-04-13 18:35 . 2007-04-13 18:35	1265664 	c:\windows\Microsoft.NET\Framework\v1.1.4322\System.Web.dll

- 2007-04-13 18:35 . 2007-04-13 18:35	1232896 	c:\windows\Microsoft.NET\Framework\v1.1.4322\System.dll

+ 2008-05-27 23:35 . 2008-05-27 23:35	1232896 	c:\windows\Microsoft.NET\Framework\v1.1.4322\System.dll

+ 2008-05-27 22:48 . 2008-05-27 22:48	2514944 	c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll

- 2007-04-13 17:57 . 2007-04-13 17:57	2514944 	c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll

+ 2008-05-27 22:48 . 2008-05-27 22:48	2523136 	c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorsvr.dll

- 2007-04-13 17:57 . 2007-04-13 17:57	2523136 	c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorsvr.dll

+ 2008-05-27 22:43 . 2008-05-27 22:43	2142208 	c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorlib.dll

- 2007-04-13 17:50 . 2007-04-13 17:50	2142208 	c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorlib.dll

+ 2009-11-05 03:53 . 2008-10-16 20:38	1160192 	c:\windows\ie7updates\KB974455-IE7\urlmon.dll

+ 2009-11-05 03:53 . 2008-12-13 06:40	3593216 	c:\windows\ie7updates\KB974455-IE7\mshtml.dll

+ 2009-11-05 03:53 . 2008-10-16 20:38	6066176 	c:\windows\ie7updates\KB974455-IE7\ieframe.dll

+ 2009-11-05 03:53 . 2007-04-17 05:32	2455488 	c:\windows\ie7updates\KB974455-IE7\ieapfltr.dat

- 2008-10-15 06:56 . 2008-08-14 10:11	2189184 	c:\windows\Driver Cache\i386\ntoskrnl.exe

+ 2008-10-15 06:56 . 2009-08-04 18:44	2189184 	c:\windows\Driver Cache\i386\ntoskrnl.exe

+ 2008-10-15 06:56 . 2009-08-04 14:20	2023936 	c:\windows\Driver Cache\i386\ntkrpamp.exe

- 2008-10-15 06:56 . 2008-08-14 09:33	2023936 	c:\windows\Driver Cache\i386\ntkrpamp.exe

- 2008-10-15 06:56 . 2008-08-14 09:33	2066048 	c:\windows\Driver Cache\i386\ntkrnlpa.exe

+ 2008-10-15 06:56 . 2009-08-04 14:20	2066048 	c:\windows\Driver Cache\i386\ntkrnlpa.exe

+ 2008-10-15 06:56 . 2009-08-04 15:13	2145280 	c:\windows\Driver Cache\i386\ntkrnlmp.exe

- 2008-10-15 06:56 . 2008-08-14 10:09	2145280 	c:\windows\Driver Cache\i386\ntkrnlmp.exe

+ 2009-11-05 03:52 . 2009-11-05 03:52	1966080 	c:\windows\assembly\NativeImages1_v1.1.4322\System\1.0.5000.0__b77a5c561934e089_f864f3f3\System.dll

+ 2009-11-05 03:52 . 2009-11-05 03:52	2088960 	c:\windows\assembly\NativeImages1_v1.1.4322\System.Xml\1.0.5000.0__b77a5c561934e089_e62cfe35\System.Xml.dll

+ 2009-11-05 03:52 . 2009-11-05 03:52	3018752 	c:\windows\assembly\NativeImages1_v1.1.4322\System.Windows.Forms\1.0.5000.0__b77a5c561934e089_f0f47456\System.Windows.Forms.dll

+ 2009-11-05 03:52 . 2009-11-05 03:52	1470464 	c:\windows\assembly\NativeImages1_v1.1.4322\System.Design\1.0.5000.0__b03f5f7f11d50a3a_7acd6fd2\System.Design.dll

+ 2009-11-05 03:53 . 2009-11-05 03:53	3391488 	c:\windows\assembly\NativeImages1_v1.1.4322\mscorlib\1.0.5000.0__b77a5c561934e089_eb8647e1\mscorlib.dll

+ 2009-11-05 03:52 . 2009-11-05 03:52	1232896 	c:\windows\assembly\GAC\System\1.0.5000.0__b77a5c561934e089\System.dll

- 2008-10-10 22:03 . 2008-10-10 22:03	1232896 	c:\windows\assembly\GAC\System\1.0.5000.0__b77a5c561934e089\System.dll

- 2008-10-10 22:03 . 2008-10-10 22:03	1265664 	c:\windows\assembly\GAC\System.Web\1.0.5000.0__b03f5f7f11d50a3a\System.Web.dll

+ 2009-11-05 03:52 . 2009-11-05 03:52	1265664 	c:\windows\assembly\GAC\System.Web\1.0.5000.0__b03f5f7f11d50a3a\System.Web.dll

+ 2008-07-12 19:25 . 2009-07-13 21:43	10841088 	c:\windows\system32\wmp.dll

+ 2008-10-17 15:00 . 2009-10-02 09:01	25198016 	c:\windows\system32\MRT.exe

+ 2008-07-12 19:25 . 2009-07-13 21:43	10841088 	c:\windows\system32\dllcache\wmp.dll

+ 2009-08-10 19:08 . 2009-08-10 19:08	11315712 	c:\windows\Microsoft.NET\Framework\v1.1.4322\Updates\M953297\M953297Uninstall.msp

+ 2009-08-10 12:09 . 2009-08-10 12:09	17254912 	c:\windows\Installer\2461ed.msp

.

-- Snapshot reset to current date --

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown 

REGEDIT4


[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-10-10 39408]


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"avast!"="c:\program files\Alwil Software\Avast4\ashDisp.exe" [2009-09-15 81000]

"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-01-08 8523776]


[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]


c:\documents and settings\All Users\Start Menu\Programs\Startup\

BlueSoleil.lnk - c:\program files\IVT Corporation\BlueSoleil\BlueSoleil.exe [2009-3-19 1044480]

FlexType 2K.lnk - c:\windows\Datecs\FType2K.exe [2008-11-1 95232]


[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]

"NoResolveTrack"= 1 (0x1)


[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Authentication Packages	REG_MULTI_SZ 	msv1_0 nwprovau


[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk

backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup


[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk

backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup


[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"=

"c:\\WINDOWS\\system32\\dpvsetup.exe"=

"c:\\Program Files\\Fiat\\ePER\\j2sdk1.4.1\\bin\\javaw.exe"=

"c:\\Program Files\\BitComet\\BitComet.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=


[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"17164:TCP"= 17164:TCP:BitComet 17164 TCP

"17164:UDP"= 17164:UDP:BitComet 17164 UDP

"23772:TCP"= 23772:TCP:BitComet 23772 TCP

"23772:UDP"= 23772:UDP:BitComet 23772 UDP


R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [22.11.2008 і. 22:25 114768]

R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [22.11.2008 і. 22:25 20560]

R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [04.11.2009 і. 21:09 38224]

S3 ATE_PROCMON;ATE_PROCMON;\??\c:\program files\Anti Trojan Elite\ATEPMon.sys --> c:\program files\Anti Trojan Elite\ATEPMon.sys [?]

S3 gupdate;ѻ󶱰 Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [27.9.2009 і. 12:46 133104]

S4 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe --> c:\progra~1\AVG\AVG8\avgwdsvc.exe [?]


--- Other Services/Drivers In Memory ---


*NewlyCreated* - MBAMSWISSARMY

*Deregistered* - mbr

*Deregistered* - PROCEXP113


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

HPZ12	REG_MULTI_SZ 	Pml Driver HPZ12 Net Driver HPZ12

hpdevmgmt	REG_MULTI_SZ 	hpqcxs08 hpqddsvc

.

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.yahoo.com/

mStart Page = hxxp://www.yahoo.com

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

FF - ProfilePath - c:\documents and settings\Gencho\Application Data\Mozilla\Firefox\Profiles\g06h8nwg.default\


---- FIREFOX POLICIES ----

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

.


**************************************************************************


catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-11-05 06:43

Windows 5.1.2600 Service Pack 3 NTFS


scanning hidden processes ... 


scanning hidden autostart entries ... 


scanning hidden files ... 


scan completed successfully

hidden files: 0


**************************************************************************


Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net


device: opened successfully

user: MBR read successfully

called modules: ntkrnlpa.exe catchme.sys CLASSPNP.SYS disk.sys ACPI.sys hal.dll sfsync02.sys atapi.sys spkw.sys >>UNKNOWN [0x8A804938]<< 

kernel: MBR read successfully

user & kernel MBR OK 

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net


atapi.sys @ 0x0 0x0 bytes


\Driver\atapi [ IRP_MJ_CREATE ] 0xA6F2 != 0xBA5FCB40 atapi.sys

\Driver\atapi [ IRP_MJ_CLOSE ] 0xA6F2 != 0xBA5FCB40 atapi.sys

\Driver\atapi [ IRP_MJ_DEVICE_CONTROL ] 0xA712 != 0xBA5FCB40 atapi.sys

\Driver\atapi [ IRP_MJ_INTERNAL_DEVICE_CONTROL ] 0x6852 != 0xBAB38D60 sfsync02.sys

\Driver\atapi [ IRP_MJ_POWER ] 0xA73C != 0xBA5FCB40 atapi.sys

\Driver\atapi [ IRP_MJ_SYSTEM_CONTROL ] 0x11336 != 0xBA5FCB40 atapi.sys

\Driver\atapi IRP hooks detected !


**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------


- - - - - - - > 'explorer.exe'(2480)

c:\windows\system32\WININET.dll

c:\windows\system32\ieframe.dll

c:\windows\system32\wpdshserviceobj.dll

c:\windows\system32\portabledevicetypes.dll

c:\windows\system32\portabledeviceapi.dll

.

Completion time: 2009-11-05 6:44

ComboFix-quarantined-files.txt 2009-11-05 04:44

ComboFix2.txt 2009-11-05 03:14


Pre-Run: 29 031 374 848 bytes free

Post-Run: 29 001 236 480 bytes free

    П.П. Спрях няколко процеса колкото да ускоря сканирането, но 32 процеса ми се струват доста(това е при стартиране) .

    mbam-log-2009-11-05 (06-35-06).txt

    Редактирано от nikolaijelev (преглед на промените)

    • Харесване 1

    Лог файла от HijackThis изглежда добре.

    Отново не сте избрали Remove Selected в Malwarebytes ?

    Моля повторете проверката и премахнете намерените обекти.

    Спряхте ли System Restore ?

    Моля, изтеглете SystemLook и запазете програмата на десктопа.

    # Кликнете два пъти върху SystemLook.exe, за да стартирате програмата.

    # Копирайте съдържанието на следния код в текстовото поле на програмата

    Цитат

    :filefind

    sfcfiles.dll

    beep.sys

    * Кликнете на бутона Look, за да започне сканирането.

    * Когато сканирането завърши ще Ви се отвори Notepad с резултата от сканирането. Моля, публикувайте лог файла в следващия си коментар.

    • Харесване 2
    • Автор

    Спрях "възстановяването".

    SystemLook v1.0 by jpshortstuff (29.08.09)

Log created at 07:06 on 05/11/2009 by Gencho (Administrator - Elevation successful)


========== filefind ==========


Searching for "sfcfiles.dll"

C:\WINDOWS\system32\sfcfiles.dll	--a--- 1614848 bytes	[19:20 12/07/2008]	[19:20 12/07/2008] 362BC5AF8EAF712832C58CC13AE05750


Searching for "beep.sys"

No files found.


-=End Of File=-

    Съжалявам, но трябва да тръгвам за работа...

    Редактирано от nikolaijelev (преглед на промените)

    Спрях "възстановяването".

    Какво възстановяване ? Repair на Windows ли сте пуснали или просто не сте до преинсталирали Service Pack 3 до края ?

    И моля не спирайте процеси преди проверката с HijackThis. Нали целта е да се види дали всичко е наред.

    За да възстановим тези два системни файла ще ни е необходим инсталационен диск с Windows.

    Поставете диска в оптичното устройство и въведете следната командта от Start => Run => Напишете => CMD => Натиснете [ENTER]

    Expand X:\i386\beep.sy_ c:\windows\system32\drivers\beep.sys (заменете X:\ с буквата на CD/DVD устройството за вашия компютър).

    Сега е рад на другия файл:

    Expand X:\i386\sfcfiles.dl_ C:\Windows\System32

    (заменете X с буквата на оптичното устройство за вашия компютър)

    Натиснете [Enter]

    Сега въведете следната команда:

    Expand X:\i386\sfcfiles.dl_ C:\Windows\System32\dllcache

    (заменете X с буквата на оптичното устройство за вашия компютър)

    Натиснете Enter

    сега напишете Exit

    Отворете Notepad и с copy/paste поставете следната информация:

    @Echo Off

    Ren C:\Windows\System32\sfcfiles.dl_ sfcfiles.dll

    Ren C:\Windows\System32\dllcache\sfcfiles.dl_ sfcfiles.dll

    Del %0

    Запазете файла с име Fix.bat и го стартирайте.

    Направете нова проверка с Combofix и публикувайте лог файла в следващия си пост.

    Добра работа.

    Въведете следната команда от Start => Run => напишете => sc delete avg8wd и натиснете [Enter]

    Изтрийте следната папка => c:\program files\AVG

    Деинсталирайте Combofix с командата:

    Start => Run => напишете => combofix /u => натисни [Enter]

    (има разстояние между combofix и /u)

    Изтеглете JavaRa и го разархивирайте на десктопа.

    ***! Моля, преди да започнете с процедурата, затворете Internet Explorer !***

    Кликнете два пъти върху JavaRa.exe, за да стартирате програмата

    От падащото меню, изберете English ...и посочете Select.

    JavaRa ще се стартира; Изберете Remove Older Versions, за да премахнете по-старата версия от компютъра си.

    Посочете Yes, когато бъдете попитан. Когато JavaRa приключи успешно премахването на старата версия, ще получите съобщение, че е създаден лог от извършената процедура.

    Изберете OK.Лог файлът ще се визуализира. Запазете го на десктопа.

    Копирайте съдържанието му в следващия си пост в тази тема.

    СТЪПКА 1

    За да премахнете всички инструменти, коити използвахме, а също файловете и папките, които те създават, моля, направете следното:

    Моля, изтеглете OTCleanIt създаден от OldTimer:

    Запезете го на вашия десктоп.

    Кликнете два пъти върху OTCleanIt.exe.

    Кликнете на бутона CleanUp!.

    Ако по време на почистването Ви се появи предложение за рестартиране на компютъра, изберете Yes. Инструментът ще се премахне сам, след като почистването приключи.

    СТЪПКА 2

    1) Изтеглете: ESET Online Scanner

    2) Стартирайте esetsmartinstaller_enu.exe

    3) Сложете отметка на YES, I accept the Terms of Use и изберете Start

    4) Скенерът ще започне да изтегля компонентите, които са му необходими.

    5) Уверете се, че има отметки на следните редове, включително и тези от менюто Advanced Settings:


    • Remove found threats
    • Scan archives
    • Scan for potentially unwanted applications
    • Scan for potentially unsafe applications
    • Enable Anti-Stealth technology

    И накрая изберете Start

    6) Скенерът ще започне да изтегля последните дефиниции.

    7) След, като сканирането завърши изберете Finish.

    8) Отидете в:

    C:\Program Files\ESET\ESET Online Scanner

    Отворете файла log.txt , копирайте съдържанието му и го поставете в следващия си пост тук.

    За финал публикувайте два нови лог файлове от Malwarebytes и от HijackThis.

    • Автор

    B-boy[styLe],

    Налага се да върна компютъра на собственика му.

    Искаше да го оптимизирам, но май ще си остане с 30 стартиращи се процеса..

    Сърдечно благодаря за отделеното време и оказаната помощ! Страхотни сте!

    B-boy[styLe],

    Налага се да върна компютъра на собственика му.

    Искаше да го оптимизирам, но май ще си остане с 30 стартиращи се процеса..

    Сърдечно благодаря за отделеното време и оказаната помощ! Страхотни сте!

    30 Процеса, не са чак толкова много. Зависи какви са те.

    Можете да използвате това за да премахнете ненужните програми стартиращи се с Windows:

    Изтеглете => StartupLite и премахнете излишните програми стартиращи се с Операционната Система. (Само сложете отметка - NO ACTION за CFTMON.exe, антивирусната програма и защитната стена !!!)

    Поздрави и лека вечер. ;)

    Регистрирайте се или влезете в профила си за да коментирате
    Назад

    Разглеждащи това в момента 0

    • Няма регистрирани потребители разглеждащи тази страница.

    Дарение

    • Подкрепи съществуването на форума - направи дарение
      32%
      Дарени 315 € от нужните 1 000 €

    Бюлетин

    Получавайте известие, когато има важна промяна или новина свързана с форума.
    Абонирайте се

    Профил

    Навигация

    Търсене

    Търсене

    Конфигуриране на push известия в браузъра
    Chrome (Android)
    1. Докоснете иконата на катинар до адресната лента.
    2. Докоснете Разрешения → Известия.
    3. Променете предпочитанията си.
    Chrome (Desktop)
    1. Кликнете върху иконата на катинар в адресната лента.
    2. Изберете Настройки на сайта.
    3. Намерете Известия и коригирайте предпочитанията си.