Премини към съдържанието
Форумът в приложение

По-лесно сърфиране. Научи повече.

Kaldata.com - Форуми

Приложение на форума на цял екран с push известия, значки и други.

За да инсталирате това приложение на iOS и iPadOS
  1. Докоснете Иконата за споделяне в Safari
  2. Превъртете менюто и докоснете Добавяне към началния екран.
  3. Докоснете Добавяне в горния десен ъгъл.
За да инсталирате това приложение на Android
  1. Докоснете менюто с 3 точки (⋮) в горния десен ъгъл на браузъра.
  2. Докоснете Добавяне към началния екран или Инсталиране на приложение.
  3. Потвърдете, като докоснете Инсталиране.

Добре дошли!

Добре дошли в нашите форуми, пълни с полезна информация. Имате проблем с компютъра или телефона си? Публикувайте нова тема и ще намерите решение на всичките си проблеми. Общувайте свободно и открийте безброй нови приятели.

Моля, регистрирайте се за да публикувате тема и да получите пълен достъп до всички функции.

 

Проблем с AVG и Виста

Featured Replies

Здравейте , имам нужда от помощ.Появи се проблем с антивирусната ми програма и няма идея какво да направя.ОС е Vista SP1.Ползвам AVG от години и не искам да я сменям, но от вчера се случва нещо странно. Непрекъснато започна да ми излиза съобщение - AVG watchdog Service спря да работи.В същото време доск С започна да се запълва с бясна скорост - за около час почти 40 ГБ.Деинсталирах програмата , почистих регистрите и инсталирах на ново.Повтори се същата история.Пак деинсталирах и инсталирах АVG 8,5.Пак същото.Деинсталирах отново и опитах с НОД.Той откри приложения на AVG и отказа да рабори коректно.Деинсталирах и него , но остана един файл в C:\Documents and Settings\All users\Application data\Eset , който няма махане.Пак опитах с AVG , но този път с версия 8.Закрепи се и тъкмо се зарадвах , когато взе да си дърпа ъпдейти , обнови се до 8,5 и пак започна да изскача- AVG watchdog Service спря да работи и да ми пълни диска.Вече нямам идея какво да направя.

При инсталация на AVG9 ми излиза грешка -

Local machine: installation failed

Installation:

Error: Action failed for file avgwdsvc.exe: stopping service....

Исканото управление е невалидно за тази услуга.

Error: Preparation to unload of the service avg9wd failed.

Specified file was not found.

Моля за някакви идеи.Не ми се ще да си сменям антивирусната , харесвам я.В момента съм с версия 8 , но вероятно скоро ще си намери новите версии и всичко ще започне да се повтаря.

По съвет на съфорумец направих следното

Почистваш с това: http://www.avg.com/u.../download-tools в зависимост от ОС

ако има остатаци от есет виж тази тема http://www.eset.bg/f...c.php?f=3&t=466

после почисти диска с CCleaner или каквото използваш за почистване.

и слагай АВГ последната версия отново,успех.

Този пост е редактиран от ferio: Днес, 19:23

след , което проблемът се появи отново :super:

Снимката не е от моя комютър , но е идентична.

post-203695-1258318999,01_thumb.jpg

Редактирано от snejanal (преглед на промените)

  • Отговори 57
  • Прегледи 8,4k
  • Създадено
  • Последен отговор

Потребители с най-много отговори

Най-популярни публикации

  • Ако неможеш да изтриеш нещо използвай Unlocker мисля че в каталога го има, а за антивирусната ти препоръчвам Avast линка към нея е в подписа ми!

  • Ще работим ли по въпроса или се отказвате?

  • OTL.txt OTL logfile created on: 17.11.2009 г. 19:13:15 - Run 1 OTL by OldTimer - Version 3.1.6.0 Folder = C:\Users\Petia\Desktop Windows Vista Service Pack 1, v.275 (Version = 6.0.6001) - Ty

Публикувани изображения

  • Автор

Изтеглих Malwarebytes Anti-Malware 1.41

Сканирах, но нищо не се откри .

Malwarebytes' Anti-Malware 1.41

Версия на базата от данни: 3176

Windows 6.0.6001 Service Pack 1, v.275

16.11.2009 г. 00:00:46

mbam-log-2009-11-16 (00-00-46).txt

Тип сканиране: Пълно сканиране (C:\|D:\|)

Сканирани обекти: 142185

Изминало време: 1 hour(s), 8 minute(s), 50 second(s)

Заразени процеси в паметта: 0

Заразени модули в паметта: 0

Заразени ключове в регистратурата: 0

Заразени стойности в регистратурата: 0

Заразени информационни обекти в регистратурата: 0

Заразени папки: 0

Заразени файлове: 0

Заразени процеси в паметта:

(Не бяха открити заплахи)

Заразени модули в паметта:

(Не бяха открити заплахи)

Заразени ключове в регистратурата:

(Не бяха открити заплахи)

Заразени стойности в регистратурата:

(Не бяха открити заплахи)

Заразени информационни обекти в регистратурата:

(Не бяха открити заплахи)

Заразени папки:

(Не бяха открити заплахи)

Заразени файлове:

(Не бяха открити заплахи)

Има ли смисъл да продължавам по схемата?

От къде се е взел тогава проблема?!

Ето и втория лог

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 00:16 ч., on 16.11.2009 г.

Platform: Windows Vista SP1, v.275 (WinNT 6.00.1905)

MSIE: Internet Explorer v7.00 (7.00.6001.16659)

Boot mode: Normal

Running processes:

C:\Windows\system32\taskeng.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Windows\System32\igfxtray.exe

C:\Windows\System32\hkcmd.exe

C:\Windows\System32\igfxpers.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\Unlocker\UnlockerAssistant.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Windows\system32\igfxsrvc.exe

C:\Program Files\Windows Media Player\wmpnscfg.exe

C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\AVG\AVG8\avgscanx.exe

D:\Архив\HJT\Kaldata.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.bg/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll

O2 - BHO: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - (no file)

O3 - Toolbar: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - (no file)

O4 - HKLM\..\Run: [igfxTray] C:\Windows\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe

O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe

O4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [unlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"

O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe

O4 - HKCU\..\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe

O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL

O13 - Gopher Prefix:

O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O20 - AppInit_DLLs: avgrsstx.dll

O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

O23 - Service: Com4QLBEx - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe

O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe

O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--

End of file - 4579 bytes

  • Автор

Днес сутринта AVG отново си дръпна ъпдейти и се обнови до версия 8,5 , след което проблема се повтори отново :ph34r: Направих нов лог.Ето го.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 10:50 ч., on 16.11.2009 г.

Platform: Windows Vista SP1, v.275 (WinNT 6.00.1905)

MSIE: Internet Explorer v7.00 (7.00.6001.16659)

Boot mode: Normal

Running processes:

C:\Windows\system32\taskeng.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Windows\System32\igfxtray.exe

C:\Windows\System32\hkcmd.exe

C:\Windows\System32\igfxpers.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Windows\system32\igfxsrvc.exe

C:\Program Files\AVG\AVG8\avgtray.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

C:\Windows\system32\wermgr.exe

C:\Program Files\Internet Explorer\iexplore.exe

D:\Архив\HJT\Kaldata.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.bg/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll

O2 - BHO: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - (no file)

O3 - Toolbar: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - (no file)

O4 - HKLM\..\Run: [igfxTray] C:\Windows\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe

O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe

O4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [unlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"

O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe

O4 - HKCU\..\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe

O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL

O13 - Gopher Prefix:

O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O20 - AppInit_DLLs: avgrsstx.dll

O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

O23 - Service: Com4QLBEx - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe

O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe

O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--

End of file - 4460 bytes

Ако неможеш да изтриеш нещо използвай Unlocker мисля че в каталога го има, а за антивирусната ти препоръчвам Avast линка към нея е в подписа ми! :ph34r:

Деинсталирай под safe mode ! Пусни и някоя програма за изтриване на ненужни регистри! Пусни търсачката да ти намери останали файлове от програмата ! Друг начин е да върнеш с restore point положението преди да се появи проблема .

  • Автор

Вдигам ръце и се отказвам! От три дни си играя на криеница с AVG - то. След поредния опит да ми скъса нервите я деинсталирах и в момента оправям настройките на Avira :PNikeman Unlocker , не помогна .Файла C:\Documents and Settings\All users\Application data\Eset си стои все още там. Ако Avira не ми допадне със сигурност ще пробвам твоята.Мерси много ;)

Вдигам ръце и се отказвам! От три дни си играя на криеница с AVG - то. След поредния опит да ми скъса нервите я деинсталирах и в момента оправям настройките на Avira :mad:Nikeman Unlocker , не помогна .Файла C:\Documents and Settings\All users\Application data\Eset си стои все още там. Ако Avira не ми допадне със сигурност ще пробвам твоята.Мерси много :)

Ще работим ли по въпроса или се отказвате?

  • Автор

Ще работим ли по въпроса или се отказвате?

Отказвам се поне за сега.Всички опити да се справя завършват с провал.Реално след всяко инсталиране на AVG 8 , която работи , имам максимум час за да реагирам , преди да се обнови версията до 8,5 след което започва скоростно запълване на диск С . 30 мин. са достатъчни за да "изяде" до край 40 GB.Не помага нищо освен деинсталация.След деинсталацията диска се освобождава до нормалните преди това GB. Ползвам AVG от 2003-та , свикнала съм с нея , осигурява ми стабилна защита и до този момент намах никакви проблеми. Появилия се проблем се оказа твърде упорит и досаден.Освен, че ми "изяждаше" диска ,през 30 сек. на екрана се появяваше мигащо съобщение AVG watchdog Service спря да работи . което просто нямаше как да се махне.

Отворена съм към предложения и идеи.Ако някой има решение (което все още не съм приложила)как да запазя AVG , така че да работи коректно , бих опитала.

Стъпка 1:

Моля, изтеглете AppRemover на вашия десктоп. Кликнете два пъти върху AppRemover.exe .

Изберете Next>> . Посочете продукта за защита, който желаете да премахнете и отново посочете Next>> .

С повторен избор на Next>> , AppRemover ще започне процеса по деинсталиране. Това може да отнеме няколко минути.

Накрая рестартирайте вашия компютър.

Стъпка 2:

Изтеглете ComboFix от някой от следните линкове:

Линк 1

Линк 2

* ВАЖНО !!! Запазете ComboFix.exe на вашия десктоп

  • Изключете вашата антивирусна и антишпионска програма, обикновено това става чрез натискане на десния бутон на мишката върху иконата на програма в системния трей.

Бележка: Ако не можете я спрете или не сте сигурни коя програма да изключите, моля прегледайте информацията от този линк: How to Disable your Security Programs

  • Преименувайте ComboFix.exe на Tool.exe

  • Стартирайте Tool.exe и следвайте инструкциите.

Бележка: ComboFix ще се стартира без инсталирана Recovery Console.

  • Като част от неговата работа, ComboFix ще провери дали Microsoft Windows Recovery Console е инсталирана. Предвид бързо развиващия се зловреден софтуер е силно препоръчително да бъде инсталирана преди премахването на зловредния софтуер. Това ще Ви позволи да влезете в специален recovery/repair режим, който ще ни позволи по-лесно да решите проблем, който би могъл да възникне при премахване на зловредния софтуер.

  • Следвайте инструкциите, за да позволите на ComboFix да изтегли и инсталира Microsoft Windows Recovery Console. В един момент ще бъдете попитани дали сте съгласни с лицензното споразумение. Необходимо е да потвърдите, че сте съгласни, за да инсталирате Microsoft Windows Recovery Console.

** Забележете: Ако Microsoft Windows Recovery Console е вече инсталирана, ComboFix ще продължи към процеса по премахване на зловредния софтуер.

RcAuto1.gif

След като Microsoft Windows Recovery Console е инсталирана, използвайки ComboFix, Вие ще видите следното съобщение:

whatnext.png

Изберете Yes, за да продължи сканирането за зловреден софтуер.

Когато процесът приключи успешно, инструментът ще създаде лог файл. Моля, включете съдържанието на C:\ComboFix.txt в следващия Ви коментар в тази тема.

Бележка:

  1. Моля, не движете мишката, докато ComboFix работи. Това може да наруши процеса на работа.
  2. ComboFix ще нулира всички настройки на Microsoft Internet Explorer, включително да направи IE браузър по подразбиране.
  3. ComboFix ще изключи autorun функцията на ВСИЧКИ CD, Floppy и USB устройства, за да помогне при премахването на зловредния софтуер и Ви защити от бъдещи вируси/заплахи, които поразяват чрез autorun. Ако това е проблем за вас - моля, уведомете ме.
  4. ComboFix ще изключи вашата интернет връзка. Интернет връзката ще се възстанови автоматично, преди ComboFix да завърши процеса на работа. При проблем, той ще прекрати интернет връзката. За да възстановите интернет връзката си, рестартирайте компютъра си.
  5. В случай на проблем с ComboFix, той може да създаде лог файл. Моля, включете съдържанието на C:\BUG.txt в следващия Ви коментар в тази тема.

Работата на ComboFix, може да отнеме до 20-30 минути, за да завърши, моля имайте търпение.

Моля, не прикачвайте лог файла/овете от програмата, а го/ги копирайте и поставете в следващия Ви коментар в тази тема.

  • Автор

Здравейте. Следвах инструкциите Ви дословно. Изтеглих AppRemover и с него премахнах продуктите за защита - в случая Malwarebytes' Anti-Malware и Avira. Сканирах за отстатъци от неуспешни предишни инсталации , но такива не бяха открити.Прави впечатление , че програмата сканира нормално до около 40 % след , което почти направо прескача на 100% и извежда съобщение , че системата е чиста.

Изтеглих и преименувах ComboFix.Тъй като антивирусната програма бе деинсталирана не се наложи да изключвам нищо.Стартирах Tool.exe и веднага се появи това

015991800.jpg

Естествено нямаше как да спра програма , която уж не съществува на компютъра .Следващото съобщение беше

015991803.jpg

Изчаках около час , с надеждата програмата да изведе някакъв лог , но това не се случи. Рестартирах.

Ето съдържанието на BUG файла

CD /D C:\32788R22FWJFW

SET "Comspec=C:\32788R22FWJFW\cmd.cfxxe"

IF NOT EXIST C:\Windows\system32\cmd.exe GOTO Not_NT

VER 1>OsVer

GREP.cfxxe -F "5.1.2" OsVer 1>XP.mac

IF 1 == 0 GOTO NT

DEL XP.mac

GREP.cfxxe -F "6.0.6" OsVer 1>Vista.mac

IF 0 == 0 GOTO NT

GREP.cfxxe -isq "ProductType.*WinNT" WinNT00 || GOTO Not_NT

Error: Key: system\currentcontrolset\control\safeboot\option does not exist!

IF NOT EXIST NircmdB.exe COPY /Y Nircmd.cfxxe NircmdB.exe 1>N_\9475 2>&1

PEV UZIP License\pv_5_2_2.zip .\

MOVE /Y PV.exe PV.cfxxe 1>N_\11782 2>&1

IF NOT EXIST PEV.cfxxe COPY /Y PEV.exe PEV.cfxxe 1>N_\5981 2>&1

Could Not Find C:\32788R22FWJFW\temp0*

PEV -outputtemp00 -rtf -c:##5# .\* and { License.exe or 32788R22FWJFW.exe or OsVer.exe or WinNT.exe or N_.exe } && (

PV -o%f * 1>temp01

PEV -tf -t!o -files:temp01 -c:##5#b#f# -output:temp02

GREP -Fif temp00 temp02 1>temp03

SED "/.* /!d; s///" temp03 1>temp04

SED ":a; $!N; s/\n/\x22 \x22/; ta; s/.*/\x22&\x22/" temp04 1>temp05

FOR /F "TOKENS=*" %G IN (temp05) DO @NIRCMD KILLPROCESS %G

)

Active code page: 1251

CALL :MDCheck

PEV -rtf -md5BA466D165CB9190337C4F45276CBA15B .\md5sum.pif || CALL :MDFaiL ChkSum_Fail

.\md5sum.pif

PEV -tf -files:files.pif -c:##5#b#f# -output:mdCheck00.dat

GREP -vs "^!MD5:" mdCheck00.dat 1>mdCheck0a.dat

GREP -Fvf md5sum.pif mdCheck0a.dat 1>mdCheck01.dat && CALL :MDFaiL

GOTO :EOF

=============================================

ALLUSERSPROFILE=C:\ProgramData

APPDATA=C:\Users\Petia\AppData\Roaming

cfExt=cfxxe

CommonProgramFiles=C:\Program Files\Common Files

COMPUTERNAME=PETIA-PC

ComSpec=C:\32788R22FWJFW\cmd.cfxxe

FP_NO_HOST_CHECK=NO

HOMEDRIVE=C:

HOMEPATH=\Users\Petia

LOCALAPPDATA=C:\Users\Petia\AppData\Local

LOGONSERVER=\\PETIA-PC

OS=Windows_NT

Path=C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem

PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC

PROCESSOR_ARCHITECTURE=x86

PROCESSOR_IDENTIFIER=x86 Family 6 Model 14 Stepping 12, GenuineIntel

PROCESSOR_LEVEL=6

PROCESSOR_REVISION=0e0c

ProgramData=C:\ProgramData

ProgramFiles=C:\Program Files

PROMPT=$

PUBLIC=C:\Users\Public

SESSIONNAME=Console

sfxcmd="C:\Users\Petia\Desktop\tool.exe.exe"

sfxname=C:\Users\Petia\Desktop\tool.exe.exe

SystemDrive=C:

SystemRoot=C:\Windows

TEMP=C:\Users\Petia\AppData\Local\Temp

TMP=C:\Users\Petia\AppData\Local\Temp

USERDOMAIN=Petia-PC

USERNAME=Petia

USERPROFILE=C:\Users\Petia

windir=C:\Windows

=============================================

IF NOT DEFINED sfxname GOTO END

GREP -F \ temp01 && CALL :Aux

GREP -Fi "C:\Windows\system32\userinit.exe" Userinit00 || SWREG ADD "hklm\software\microsoft\windows nt\currentversion\winlogon" /v Userinit /d "C:\Windows\system32\userinit.exe,"

Userinit REG_SZ C:\Windows\system32\userinit.exe,

SET SfxCmd 1>SET00

SED -r "/SfxCmd=/I!d; s///; s/\s*$//; s/^(\x22[^\x22]*\x22|[^\x22]\S*) +//; s/^\x22*C:\\Users\\Petia\\Desktop\\tool.exe.exe\x22*//I; s/^([^\x22]\S*)/@SET SfxCmd=\x22\1\x22/; s/^(\x22.*)/@SET SfxCmd=\1/" SET00 1>sfx.cmd

DEL /A/F SET00

ECHO."C:\Users\Petia\Desktop\tool.exe.exe"1>MSName00

GREP -Ei "\\(wscntfy|winlogon|wininit|nvsvc|lsm|lsass|iexplore|svchost|spoolsv|smss|slsvc|services|explorer|ctfmon|csrss|alg)\.....$" MSName00 && (

CALL :MSNAME "C:\Users\Petia\Desktop\tool.exe.exe"

CALL MsName.bat

)

ATTRIB +R "C:\Users\Petia\Desktop\tool.exe.exe"

CALL sfx.cmd

CALL AV.cmd

SET /a AVCount+=1

NIRCMD EXEC HIDE PV -d9000 -kf CSCRIPT.EXE

CSCRIPT.exe //NOLOGO //E:VBSCRIPT //B //T:08 av.vbs

PV -kf CSCRIPT.exe PV.*

Killing 'CSCRIPT.exe'

Killing 'PV.*'

IF NOT EXIST AvBlack00 GREP -Fsf AVBlack resident.txt 1>AvBlack00 && (

SED -r "s/\x22//g; s/.*\) //; s/.*(\{.{8}-.{4}-.{4}-.{4}-.{12}\}).*/\1/" AvBlack00 1>AvBlack01

FOR /F "TOKENS=*" %G IN (AvBlack01) DO @CSCRIPT.EXE //NOLOGO //E:VBSCRIPT //T:5 wmi_rem.vbs "%~G"

NIRCMD EXEC HIDE PV -d6000 -kf CSCRIPT.EXE

CSCRIPT.exe //NOLOGO //E:VBSCRIPT //B //T:08 av.vbs

PV -kf CSCRIPT.exe PV.*

)

GREP -Fivf AVWhite resident.txt | GREP -E "^(AV|SP): .*enabled\* \(" 1>AVChk && (

SED -r "s/^AV:/antivirus: /; s/^SP:/antispyware: /; s/ \*(On-access scanning |)enabled\*.*//" AVChk | SED ":a; $!N;s/\n/~n/;ta" 1>AVChkB

NIRCMD LOOP 2 80 BEEP 3000 200

IF 1 LEQ 1 FOR /F "TOKENS=*" %G IN (AVChkB) DO @NIRCMD INFOBOX "ComboFix has detected the following real time scanner(s) to be active:~n~n%G~n~nAntivirus and intrusion prevention programs are known to interfere~nwith ComboFix's running. This may lead to unpredictable results or~npossible machine damage.~n~nPlease disable these scanners before clicking 'OK'." "Warning !!" "" && GOTO Av-check

IF 1 GTR 1 FOR /F "TOKENS=*" %G IN (AVChkB) DO @NIRCMD INFOBOX "%G~n~nThe above real time scanner(s) are still active but ComboFix shall~ncontinue to run. Kindly note that this is at your own risk" "Warning !!" ""

)

SET /a AVCount+=1

NIRCMD EXEC HIDE PV -d9000 -kf CSCRIPT.EXE

CSCRIPT.exe //NOLOGO //E:VBSCRIPT //B //T:08 av.vbs

PV -kf CSCRIPT.exe PV.*

Killing 'CSCRIPT.exe'

Killing 'PV.*'

IF NOT EXIST AvBlack00 GREP -Fsf AVBlack resident.txt 1>AvBlack00 && (

SED -r "s/\x22//g; s/.*\) //; s/.*(\{.{8}-.{4}-.{4}-.{4}-.{12}\}).*/\1/" AvBlack00 1>AvBlack01

FOR /F "TOKENS=*" %G IN (AvBlack01) DO @CSCRIPT.EXE //NOLOGO //E:VBSCRIPT //T:5 wmi_rem.vbs "%~G"

NIRCMD EXEC HIDE PV -d6000 -kf CSCRIPT.EXE

CSCRIPT.exe //NOLOGO //E:VBSCRIPT //B //T:08 av.vbs

PV -kf CSCRIPT.exe PV.*

)

GREP -Fivf AVWhite resident.txt | GREP -E "^(AV|SP): .*enabled\* \(" 1>AVChk && (

SED -r "s/^AV:/antivirus: /; s/^SP:/antispyware: /; s/ \*(On-access scanning |)enabled\*.*//" AVChk | SED ":a; $!N;s/\n/~n/;ta" 1>AVChkB

NIRCMD LOOP 2 80 BEEP 3000 200

IF 2 LEQ 1 FOR /F "TOKENS=*" %G IN (AVChkB) DO @NIRCMD INFOBOX "ComboFix has detected the following real time scanner(s) to be active:~n~n%G~n~nAntivirus and intrusion prevention programs are known to interfere~nwith ComboFix's running. This may lead to unpredictable results or~npossible machine damage.~n~nPlease disable these scanners before clicking 'OK'." "Warning !!" "" && GOTO Av-check

IF 2 GTR 1 FOR /F "TOKENS=*" %G IN (AVChkB) DO @NIRCMD INFOBOX "%G~n~nThe above real time scanner(s) are still active but ComboFix shall~ncontinue to run. Kindly note that this is at your own risk" "Warning !!" ""

)

DEL /A/F/Q AVChk? AvWhite AvBlack AvBlack0?

SET AVCount=

GREP -Fx "REGEDIT4" Fin.dat || (

ECHO.1>"C:\Users\Petia\AppData\Local\Temp\tdsstdss"

PEV -output:temp00 -rtf "C:\Users\Petia\AppData\Local\Temp\tdsstdss" || (

ECHO.1>wtf_tdssserv

CALL c.bat

GOTO END

)

GOTO AbortD

)

REGEDIT4

IF /I "C:\32788R22FWJFW" NEQ "C:\32788R22FWJFW" GOTO Abort

IF EXIST "C:\Users\Petia\AppData\Local\Temp\32788R22FWJFW32788R22FWJFW.log" DEL /A/F "C:\Users\Petia\AppData\Local\Temp\32788R22FWJFW32788R22FWJFW.log"

FOR /F "TOKENS=*" %G IN ("C:\Users\Petia\Desktop\tool.exe.exe") DO (

SET "FileName=%~NG"

SET "FilePath=%~DPG"

)

(

SET "FileName=tool.exe"

SET "FilePath=C:\Users\Petia\Desktop\"

)

SET FileName 1>FileName

GREP -ix "FileName=[-[:alnum:]@.]*" FileName || GOTO AbortB

FileName=tool.exe

DIR /AD/B C:\* 1>DirName00

GREP -ivx ComboFix DirName00 1>DirName01

GREP -Fisqx "tool.exe" DirName01 && CALL :NameChk

IF EXIST DirName0? DEL /A/F/Q DirName0?

IF EXIST Oldsfxname00 DEL /A/F Oldsfxname00

IF EXIST "C:\tool.exe\" (

SWXCACLS "C:\tool.exe" /RESET /Q

RD /S/Q "C:\tool.exe"

IF EXIST "C:\tool.exe\" (

PEV -k "C:\tool.exe\*"

RD /S/Q "C:\tool.exe"

)

IF EXIST "C:\tool.exe\" (

HANDLE "C:\tool.exe" 1>temp00

SED -R "/.* pid: (\d*) +(\S*):.*/I!d;s//@Handle -c \2 -y -p \1/" temp00 1>temp00.bat

CALL temp00.bat

DEL /A/F temp00.bat temp00

RD /S/Q "C:\tool.exe"

)

)

IF EXIST "C:\tool.exe\" RD /S/Q "C:\tool.exe"

IF EXIST "C:\tool.exe\" GOTO :EOF

PEV UZIP "License\streamtools.zip" License && MOVE /Y License\SF.exe 1>N_\28275 2>&1

GREP -Eisq "=.\/uninstall" sfx.cmd && IF EXIST MsName.bat (ECHO.@SET SfxCmd= 1>sfx.cmd ) ELSE echo..1>ItsBeenPhun

DEL /A/F prep.done MsName.bat

MD "C:\tool.exe" 1>N_\16755 2>&1

IF EXIST MUI FOR /F "TOKENS=*" %G IN (MUI) DO @(

MD "C:\tool.exe\%~G"

COPY /Y /B "%~G\*" "C:\tool.exe\%~G\"

) 1>N_\21590 2>&1

COPY /Y /B cmd.cfxxe "C:\tool.exe\CF31419.cfxxe" 1>N_\8697 2>&1

SET "COMSPEC=C:\tool.exe\CF31419.cfxxe"

CD ..

SWREG ADD "HKLM\Software\Swearware" /V LastDir /D "C:\tool.exe"

START /I /B HIDEC "C:\tool.exe\CF31419.cfxxe" /F:OFF /D /C C:\Start_.cmd

NIRCMD WAIT 2000

The batch file cannot be found.

Инсталирах отново AVG 9 , с надеждата , че след деинсталиране с АppRemover щесе почистят всички останали файлове , но до там бях с надеждите :)

Веднага се появи до болка познатото съобщение AVG watchdog Service спря да работи , диск С започна застрашително да губи гигабайти , а АppRemover изведе това:

015991802.jpg

След рестартиране на компютъра AVG си стоеше на мястото непокътната.Последва втори опит за почистване с AppRemover.Този път видимо програмата я нямаше , но когато отново опитах да стартирам Tool.exe излезе съобщение , че AVG пак е активна :)

Инсталирах Аvira за тази вечер , колкто да има някаква антивирусна , но да , бих искала да продължим да работим до отстраняването на проблема.

Благодаря за помощта.

Редактирано от snejanal (преглед на промените)

  • Автор

Добро утро , влючвам се за да се за да допълня , че днес изникна нов проблем . Стартирах GOM Player , филма тръгна нормално , но при опит да превъртя напред се появи съобщението от прикачения файл.И така всеки път , когато сеопитам да превъртя напред.

post-203695-1258449985,43_thumb.jpg

Редактирано от snejanal (преглед на промените)

Искам нещо много важно да уточня. Инструкциите ми се следват стриктно и без промени, които не съм посочил, защото след трето-четвърто.... двадесето инсталиране на различни продукти, губя обща картина за състоянието на системата, затова моля да не се инсталира нищо, нито пък да се премахва, каквото и да е без да съм посочил. Много хубаво правите, като ме уведомявате за евентуални промени, проблеми и напредък или обратното. Така трябва да работим.

Стъпка 1:

Моля, качете BUG.txt в www.rapidshare.de и пуснете линк за изтегляне в следващия Ви коментар.

Стъпка 2:

1) Изтеглете: ESET Online Scanner

2) Стартирайте esetsmartinstaller_enu.exe

3) Сложете отметка на YES, I accept the Terms of Use и изберете Start

4) Скенерът ще започне да изтегля компонентите, които са му необходими.

5) Уверете се, че има отметки на следните редове, включително и тези от менюто Advanced Settings:


  • Remove found threats
  • Scan archives
  • Scan for potentially unwanted applications
  • Scan for potentially unsafe applications
  • Enable Anti-Stealth technology

И накрая изберете Start

6) Скенерът ще започне да изтегля последните дефиниции.

7) След, като сканирането завърши изберете Finish.

8) Отидете в:

C:\Program Files\ESET\ESET Online Scanner

Отворете файла log.txt , копирайте съдържанието му и го поставете в следващия си пост тук.

  • Автор

Здравейте отново.Обещавам да спазвам инструкциите Ви стриктно , както и да не правя повече промени своеволно.

Ето линк за изтегляне на BUG.txt

Eто и съдържанието на log.txt от C:\Program Files\ESET\ESET Online Scanner

ESETSmartInstaller@High as downloader log:

all ok

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6211

# api_version=3.0.2

# EOSSerial=ac8ffc669db9d54796a218692d4bab4b

# end=stopped

# remove_checked=true

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=true

# antistealth_checked=true

# utc_time=2009-11-17 03:45:41

# local_time=2009-11-17 05:45:41 )

# country="Bulgaria"

# lang=1033

# osver=6.0.6001 NT Service Pack 1, v.275

# compatibility_mode=512 16777215 100 0 0 0 0 0

# compatibility_mode=1026 16777214 0 13 113438 115590 0 0

# compatibility_mode=1797 16775165 100 100 25554 34913297 14749 0

# compatibility_mode=5892 16776573 100 95 67561441 96005226 0 0

# compatibility_mode=8192 67108863 100 0 112 112 0 0

# scanned=3692

# found=0

# cleaned=0

# scan_time=283

# nod_component=V3 Build:0x30000000

ESETSmartInstaller@High as downloader log:

all ok

esets_scanner_update returned -1 esets_gle=53251

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6211

# api_version=3.0.2

# EOSSerial=ac8ffc669db9d54796a218692d4bab4b

# end=finished

# remove_checked=true

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=true

# antistealth_checked=true

# utc_time=2009-11-17 04:22:41

# local_time=2009-11-17 06:22:41 )

# country="Bulgaria"

# lang=1033

# osver=6.0.6001 NT Service Pack 1, v.275

# compatibility_mode=512 16777215 100 0 0 0 0 0

# compatibility_mode=1026 16777214 0 13 113787 115939 0 0

# compatibility_mode=1797 16775165 100 100 25903 34913646 15098 0

# compatibility_mode=5892 16776573 100 95 67561790 96005575 0 0

# compatibility_mode=8192 67108863 100 0 461 461 0 0

# scanned=52763

# found=1

# cleaned=1

# scan_time=2155

# nod_component=V3 Build:0x30000000

D:\Архив\unlocker1.8.8.exe Win32/Adware.ADON application (deleted - quarantined) 00000000000000000000000000000000 C

Това излезе след края на сканирането

015998704.jpg

Изтеглете OTL (от OldTimer) и го запазете на вашия десктоп.

Кликнете два пъти върху OTL.exe, за да стартирате програмата.

Сложете отметки преди следните неща:


  • Scan all users
  • Lop check
  • Purity check

Под секцията Extra Registry, изберете Use SafeList

Кликнете на Run Scan и изчакайте да завърши сканирането. (може да отнеме 10-15 минути)

Когато завърши, публикувайте следните два лог файла:

  • OTL.txt (намира се на вашия десктоп)
  • Extras.txt (ще Ви се отвори автоматично)

  • Автор

OTL.txt

OTL logfile created on: 17.11.2009 г. 19:13:15 - Run 1

OTL by OldTimer - Version 3.1.6.0 Folder = C:\Users\Petia\Desktop

Windows Vista Service Pack 1, v.275 (Version = 6.0.6001) - Type = NTWorkstation

Internet Explorer (Version = 7.0.6001.16659)

Locale: 00000402 | Country: България | Language: BGR | Date Format: d.M.yyyy 'г.'

2,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 100,00% Memory free

4,00 Gb Paging File | 4,00 Gb Available in Paging File | 100,00% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 39,06 Gb Total Space | 30,42 Gb Free Space | 77,87% Space Free | Partition Type: NTFS

Drive D: | 258,99 Gb Total Space | 252,12 Gb Free Space | 97,35% Space Free | Partition Type: NTFS

E: Drive not present or media not loaded

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

Computer Name: PETIA-PC

Current User Name: Petia

Logged in as Administrator.

Current Boot Mode: Normal

Scan Mode: All users

Company Name Whitelist: Off

Skip Microsoft Files: Off

File Age = 30 Days

Output = Standard

========== Processes (SafeList) ==========

PRC - [2009.11.17 19:11:23 | 00,529,408 | ---- | M] (OldTimer Tools) -- C:\Users\Petia\Desktop\OTL.exe

PRC - [2009.07.21 14:34:33 | 00,185,089 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe

PRC - [2009.05.13 16:48:22 | 00,108,289 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe

PRC - [2009.05.11 10:16:40 | 00,470,273 | ---- | M] (Avira GmbH) -- C:\program files\avira\antivir desktop\avcenter.exe

PRC - [2009.03.02 13:08:47 | 00,209,153 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

PRC - [2008.01.18 11:31:32 | 00,095,528 | ---- | M] (Synaptics, Inc.) -- C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

PRC - [2008.01.18 11:31:22 | 01,033,512 | ---- | M] (Synaptics, Inc.) -- C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

PRC - [2007.09.18 01:30:35 | 00,896,512 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Media Player\wmpnetwk.exe

PRC - [2007.09.18 01:30:35 | 00,201,728 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Media Player\wmpnscfg.exe

PRC - [2007.09.18 01:29:34 | 02,921,472 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe

PRC - [2007.09.18 01:29:10 | 00,017,408 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iashost.exe

PRC - [2007.09.18 01:28:48 | 00,625,152 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Internet Explorer\iexplore.exe

PRC - [2007.09.18 01:28:18 | 01,197,056 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Sidebar\sidebar.exe

PRC - [2007.09.13 06:34:02 | 00,141,848 | ---- | M] (Intel Corporation) -- C:\Windows\System32\igfxtray.exe

PRC - [2007.09.13 06:34:00 | 00,252,440 | ---- | M] (Intel Corporation) -- C:\Windows\System32\igfxsrvc.exe

PRC - [2007.09.13 06:33:56 | 00,129,560 | ---- | M] (Intel Corporation) -- C:\Windows\System32\igfxpers.exe

PRC - [2007.09.13 06:33:48 | 00,154,136 | ---- | M] (Intel Corporation) -- C:\Windows\System32\hkcmd.exe

PRC - [2006.11.28 10:44:58 | 00,386,560 | ---- | M] (Conexant Systems, Inc.) -- C:\Windows\System32\drivers\XAudio.exe

========== Modules (SafeList) ==========

MOD - [2009.11.17 19:11:23 | 00,529,408 | ---- | M] (OldTimer Tools) -- C:\Users\Petia\Desktop\OTL.exe

MOD - [2007.09.18 01:28:38 | 01,684,992 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6001.16659_none_5cdfda200835e6c0\comctl32.dll

========== Win32 Services (SafeList) ==========

SRV - File not found -- -- (ekrn)

SRV - [2009.07.21 14:34:33 | 00,185,089 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2009.05.13 16:48:22 | 00,108,289 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2008.05.01 16:25:56 | 00,165,192 | ---- | M] (Hewlett-Packard Development Company, L.P.) -- C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe -- (hpqwmiex)

SRV - [2008.04.03 11:33:26 | 00,193,840 | ---- | M] (Hewlett-Packard Development Company, L.P.) -- C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe -- (Com4QLBEx)

SRV - [2007.09.18 01:30:35 | 00,896,512 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)

SRV - [2007.09.18 01:30:26 | 00,122,880 | ---- | M] (Microsoft Corporation) -- C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe -- (NetTcpPortSharing)

SRV - [2007.09.18 01:30:25 | 00,864,256 | ---- | M] (Microsoft Corporation) -- C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe -- (idsvc)

SRV - [2007.09.18 01:30:23 | 00,036,864 | ---- | M] (Microsoft Corporation) -- C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe -- (FontCache3.0.0.0)

SRV - [2007.09.18 01:30:05 | 00,069,976 | ---- | M] (Microsoft Corporation) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)

SRV - [2007.09.18 01:28:22 | 00,272,568 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)

SRV - [2006.11.28 10:44:58 | 00,386,560 | ---- | M] (Conexant Systems, Inc.) -- C:\Windows\System32\drivers\XAudio.exe -- (XAudioService)

SRV - [2003.07.28 12:28:22 | 00,089,136 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose)

========== Driver Services (SafeList) ==========

DRV - [2009.11.12 00:10:22 | 00,721,904 | ---- | M] () -- C:\Windows\System32\Drivers\sptd.sys -- (sptd)

DRV - [2009.07.28 16:33:56 | 00,055,656 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)

DRV - [2009.05.12 06:34:32 | 00,093,312 | ---- | M] (ESET) -- C:\Windows\System32\drivers\epfwwfpr.sys -- (epfwwfpr)

DRV - [2009.05.12 06:33:48 | 00,107,256 | ---- | M] (ESET) -- C:\Windows\System32\drivers\ehdrv.sys -- (ehdrv)

DRV - [2009.05.12 06:31:54 | 00,114,472 | ---- | M] (ESET) -- C:\Windows\System32\drivers\eamon.sys -- (eamon)

DRV - [2009.05.11 10:12:24 | 00,028,520 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)

DRV - [2009.03.30 10:33:07 | 00,096,104 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)

DRV - [2009.02.13 12:35:05 | 00,011,608 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avgio.sys -- (avgio)

DRV - [2008.10.07 20:31:38 | 00,061,424 | ---- | M] (Cyberlink Corp.) -- C:\Program Files\CyberLink\PowerDVD8\000.fcl -- ({FE4C91E7-22C2-4D0C-9F6B-82F1B7742054})

DRV - [2008.04.14 14:39:06 | 00,009,344 | ---- | M] (Hewlett-Packard Development Company, L.P.) -- C:\Windows\System32\drivers\CPQBttn.sys -- (HBtnKey)

DRV - [2008.03.03 19:32:00 | 00,188,416 | ---- | M] (Conexant Systems Inc.) -- C:\Windows\System32\drivers\CHDRT32.sys -- (CnxtHdAudService)

DRV - [2008.01.18 11:31:26 | 00,196,784 | ---- | M] (Synaptics, Inc.) -- C:\Windows\System32\drivers\SynTP.sys -- (SynTP)

DRV - [2007.09.18 01:28:15 | 00,300,728 | ---- | M] (Adaptec, Inc.) -- C:\Windows\system32\drivers\adpahci.sys -- (adpahci)

DRV - [2007.09.18 01:28:15 | 00,159,744 | ---- | M] (Intel Corporation) -- C:\Windows\System32\drivers\e100b325.sys -- (E100B)

DRV - [2007.09.18 01:28:15 | 00,118,456 | ---- | M] (Promise Technology, Inc.) -- C:\Windows\system32\drivers\ulsata2.sys -- (ulsata2)

DRV - [2007.09.18 01:28:15 | 00,031,416 | ---- | M] (LSI Corporation) -- C:\Windows\system32\drivers\megasas.sys -- (megasas)

DRV - [2007.09.18 01:28:14 | 00,200,704 | ---- | M] (Conexant Systems, Inc.) -- C:\Windows\System32\drivers\VSTAZL3.SYS -- (HSFHWAZL)

DRV - [2007.09.18 01:28:14 | 00,118,784 | ---- | M] (Intel Corporation) -- C:\Windows\System32\drivers\E1G60I32.sys -- (E1G60)

DRV - [2007.09.18 01:28:14 | 00,103,096 | ---- | M] (NVIDIA Corporation) -- C:\Windows\system32\drivers\nvraid.sys -- (nvraid)

DRV - [2007.09.18 01:28:14 | 00,079,544 | ---- | M] (Adaptec, Inc.) -- C:\Windows\system32\drivers\arc.sys -- (arc)

DRV - [2007.09.18 01:28:14 | 00,045,240 | ---- | M] (NVIDIA Corporation) -- C:\Windows\system32\drivers\nvstor.sys -- (nvstor)

DRV - [2007.09.18 01:28:00 | 00,235,192 | ---- | M] (Intel Corporation) -- C:\Windows\system32\drivers\iastorv.sys -- (iaStorV)

DRV - [2007.09.18 01:28:00 | 00,040,632 | ---- | M] (Hewlett-Packard Company) -- C:\Windows\system32\drivers\hpcisss.sys -- (HpCISSs)

DRV - [2007.09.18 01:27:59 | 02,225,664 | ---- | M] (Intel Corporation) -- C:\Windows\System32\drivers\NETw3v32.sys -- (NETw3v32)

DRV - [2007.09.18 01:27:59 | 00,149,688 | ---- | M] (Adaptec, Inc.) -- C:\Windows\system32\drivers\adpu320.sys -- (adpu320)

DRV - [2007.09.18 01:27:59 | 00,096,440 | ---- | M] (LSI Logic) -- C:\Windows\system32\drivers\lsi_fc.sys -- (LSI_FC)

DRV - [2007.09.18 01:27:58 | 01,122,488 | ---- | M] (QLogic Corporation) -- C:\Windows\system32\drivers\ql2300.sys -- (ql2300)

DRV - [2007.09.18 01:27:58 | 00,074,936 | ---- | M] (Silicon Integrated Systems) -- C:\Windows\system32\drivers\sisraid4.sys -- (SiSRaid4)

DRV - [2007.09.18 01:27:56 | 00,423,096 | ---- | M] (Adaptec, Inc.) -- C:\Windows\system32\drivers\adp94xx.sys -- (adp94xx)

DRV - [2007.09.18 01:27:56 | 00,342,712 | ---- | M] (Emulex) -- C:\Windows\system32\drivers\elxstor.sys -- (elxstor)

DRV - [2007.09.18 01:27:56 | 00,080,056 | ---- | M] (Adaptec, Inc.) -- C:\Windows\system32\drivers\arcsas.sys -- (arcsas)

DRV - [2007.09.18 01:27:55 | 00,386,744 | ---- | M] (LSI Corporation, Inc.) -- C:\Windows\system32\drivers\megasr.sys -- (MegaSR)

DRV - [2007.09.18 01:27:55 | 00,238,776 | ---- | M] (ULi Electronics Inc.) -- C:\Windows\system32\drivers\uliahci.sys -- (uliahci)

DRV - [2007.09.18 01:27:55 | 00,089,784 | ---- | M] (LSI Logic) -- C:\Windows\system32\drivers\lsi_sas.sys -- (LSI_SAS)

DRV - [2007.09.18 01:27:54 | 00,130,744 | ---- | M] (VIA Technologies Inc.,Ltd) -- C:\Windows\system32\drivers\vsmraid.sys -- (vsmraid)

DRV - [2007.09.18 01:27:53 | 00,101,560 | ---- | M] (Adaptec, Inc.) -- C:\Windows\system32\drivers\adpu160m.sys -- (adpu160m)

DRV - [2007.09.18 01:27:53 | 00,096,440 | ---- | M] (LSI Logic) -- C:\Windows\system32\drivers\lsi_scsi.sys -- (LSI_SCSI)

DRV - [2007.09.18 01:27:52 | 00,020,152 | ---- | M] (VIA Technologies, Inc.) -- C:\Windows\system32\drivers\viaide.sys -- (viaide)

DRV - [2007.09.18 01:27:52 | 00,019,128 | ---- | M] (CMD Technology, Inc.) -- C:\Windows\system32\drivers\cmdide.sys -- (cmdide)

DRV - [2007.09.18 01:27:52 | 00,017,592 | ---- | M] (Acer Laboratories Inc.) -- C:\Windows\system32\drivers\aliide.sys -- (aliide)

DRV - [2007.08.25 01:39:56 | 01,899,008 | ---- | M] (Intel Corporation) -- C:\Windows\System32\drivers\igdkmd32.sys -- (igfx)

DRV - [2007.08.25 01:39:56 | 01,899,008 | ---- | M] (Intel Corporation) -- C:\Windows\System32\drivers\igdkmd32.sys -- (ialm)

DRV - [2007.06.18 17:12:04 | 00,016,768 | ---- | M] (Hewlett-Packard Development Company, L.P.) -- C:\Windows\System32\drivers\HpqKbFiltr.sys -- (HpqKbFiltr)

DRV - [2006.12.07 09:05:58 | 00,985,600 | ---- | M] (Conexant Systems, Inc.) -- C:\Windows\System32\drivers\HSX_DPV.sys -- (HSF_DPV)

DRV - [2006.12.07 09:04:36 | 00,207,360 | ---- | M] (Conexant Systems, Inc.) -- C:\Windows\System32\drivers\HSXHWAZL.sys -- (HSXHWAZL)

DRV - [2006.12.07 09:04:26 | 00,659,968 | ---- | M] (Conexant Systems, Inc.) -- C:\Windows\System32\drivers\HSX_CNXT.sys -- (winachsf)

DRV - [2006.11.28 10:44:52 | 00,008,192 | ---- | M] (Conexant Systems, Inc.) -- C:\Windows\System32\drivers\XAudio.sys -- (XAudio)

DRV - [2006.11.02 11:50:35 | 00,106,088 | ---- | M] (QLogic Corporation) -- C:\Windows\system32\drivers\ql40xx.sys -- (ql40xx)

DRV - [2006.11.02 11:50:35 | 00,098,408 | ---- | M] (Promise Technology, Inc.) -- C:\Windows\system32\drivers\ulsata.sys -- (UlSata)

DRV - [2006.11.02 11:50:19 | 00,045,160 | ---- | M] (IBM Corporation) -- C:\Windows\system32\drivers\nfrd960.sys -- (nfrd960)

DRV - [2006.11.02 11:50:17 | 00,041,576 | ---- | M] (Intel Corp./ICP vortex GmbH) -- C:\Windows\system32\drivers\iirsp.sys -- (iirsp)

DRV - [2006.11.02 11:50:11 | 00,071,272 | ---- | M] (Adaptec, Inc.) -- C:\Windows\system32\drivers\djsvs.sys -- (aic78xx)

DRV - [2006.11.02 11:50:09 | 00,035,944 | ---- | M] (Integrated Technology Express, Inc.) -- C:\Windows\system32\drivers\iteraid.sys -- (iteraid)

DRV - [2006.11.02 11:50:07 | 00,035,944 | ---- | M] (Integrated Technology Express, Inc.) -- C:\Windows\system32\drivers\iteatapi.sys -- (iteatapi)

DRV - [2006.11.02 11:50:05 | 00,035,944 | ---- | M] (LSI Logic) -- C:\Windows\system32\drivers\symc8xx.sys -- (Symc8xx)

DRV - [2006.11.02 11:50:03 | 00,034,920 | ---- | M] (LSI Logic) -- C:\Windows\system32\drivers\sym_u3.sys -- (Sym_u3)

DRV - [2006.11.02 11:49:59 | 00,033,384 | ---- | M] (LSI Logic Corporation) -- C:\Windows\system32\drivers\mraid35x.sys -- (Mraid35x)

DRV - [2006.11.02 11:49:56 | 00,031,848 | ---- | M] (LSI Logic) -- C:\Windows\system32\drivers\sym_hi.sys -- (Sym_hi)

DRV - [2006.11.02 10:25:24 | 00,071,808 | ---- | M] (Brother Industries Ltd.) -- C:\Windows\system32\drivers\brserid.sys -- (Brserid)

DRV - [2006.11.02 10:24:47 | 00,011,904 | ---- | M] (Brother Industries Ltd.) -- C:\Windows\system32\drivers\brusbser.sys -- (BrUsbSer)

DRV - [2006.11.02 10:24:46 | 00,005,248 | ---- | M] (Brother Industries, Ltd.) -- C:\Windows\system32\drivers\brfiltup.sys -- (BrFiltUp)

DRV - [2006.11.02 10:24:45 | 00,013,568 | ---- | M] (Brother Industries, Ltd.) -- C:\Windows\system32\drivers\brfiltlo.sys -- (BrFiltLo)

DRV - [2006.11.02 10:24:44 | 00,062,336 | ---- | M] (Brother Industries Ltd.) -- C:\Windows\system32\drivers\brserwdm.sys -- (BrSerWdm)

DRV - [2006.11.02 10:24:44 | 00,012,160 | ---- | M] (Brother Industries Ltd.) -- C:\Windows\system32\drivers\brusbmdm.sys -- (BrUsbMdm)

DRV - [2006.11.02 09:36:50 | 00,020,608 | ---- | M] (N-trig Innovative Technologies) -- C:\Windows\system32\drivers\ntrigdigi.sys -- (ntrigdigi)

DRV - [2006.11.02 08:37:21 | 00,020,480 | ---- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) -- C:\Windows\System32\drivers\secdrv.sys -- (secdrv)

DRV - [2006.06.19 08:26:58 | 00,012,672 | ---- | M] (Conexant) -- C:\Windows\System32\drivers\mdmxsdk.sys -- (mdmxsdk)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

IE - HKU\.DEFAULT\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-1028737740-397911081-13709980-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

IE - HKU\S-1-5-21-1028737740-397911081-13709980-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.bg/

IE - HKU\S-1-5-21-1028737740-397911081-13709980-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1

IE - HKU\S-1-5-21-1028737740-397911081-13709980-1000\S-1-5-21-1028737740-397911081-13709980-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:9.0.0.701

FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.5.3

FF - HKLM\software\mozilla\Mozilla Firefox 3.5.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009.11.12 00:07:35 | 00,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.5.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2009.11.12 00:16:53 | 00,000,000 | ---D | M]

[2009.11.12 00:07:41 | 00,000,000 | ---D | M] -- C:\Users\Petia\AppData\Roaming\mozilla\Extensions

[2009.11.12 00:07:41 | 00,000,000 | ---D | M] -- C:\Users\Petia\AppData\Roaming\mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}

[2009.11.12 08:50:33 | 00,000,000 | ---D | M] -- C:\Users\Petia\AppData\Roaming\mozilla\Firefox\Profiles\va7z7z0y.default\extensions

[2009.11.12 00:07:27 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions

[2009.11.12 00:07:27 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

[2009.08.24 22:16:36 | 00,023,544 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browserdirprovider.dll

[2009.08.24 22:16:36 | 00,137,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\brwsrcmp.dll

[2009.08.24 22:16:36 | 00,065,016 | ---- | M] (mozilla.org) -- C:\Program Files\mozilla firefox\plugins\npnul32.dll

[2003.07.14 22:56:52 | 00,013,888 | ---- | M] (Microsoft Corporation) -- C:\Program Files\mozilla firefox\plugins\NPOFFICE.DLL

[2008.06.11 22:45:28 | 00,103,792 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files\mozilla firefox\plugins\nppdf32.dll

[2009.08.24 21:22:00 | 00,001,083 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\911bg.xml

[2009.08.24 21:22:00 | 00,001,394 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom.xml

[2009.08.24 21:22:00 | 00,002,442 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\diribg.xml

[2009.08.24 21:22:00 | 00,002,371 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\google.xml

[2009.08.24 21:22:00 | 00,001,515 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\pe-bg.xml

[2009.08.24 21:22:00 | 00,001,857 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\portalbgdict.xml

[2009.08.24 21:22:00 | 00,001,220 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-bg.xml

O1 HOSTS File: (33 bytes) - C:\Windows\System32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1 localhost

O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

O2 - BHO: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - No CLSID value found.

O3 - HKLM\..\Toolbar: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - No CLSID value found.

O3 - HKU\S-1-5-21-1028737740-397911081-13709980-1000\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.

O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

O4 - HKLM..\Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe (Intel Corporation)

O4 - HKLM..\Run: [igfxTray] C:\Windows\System32\igfxtray.exe (Intel Corporation)

O4 - HKLM..\Run: [Persistence] C:\Windows\System32\igfxpers.exe (Intel Corporation)

O4 - HKLM..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics, Inc.)

O4 - HKLM..\Run: [unlockerAssistant] C:\Program Files\Unlocker\UnlockerAssistant.exe ()

O4 - HKU\S-1-5-21-1028737740-397911081-13709980-1000..\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe (Microsoft Corporation)

O4 - HKU\S-1-5-21-1028737740-397911081-13709980-1000..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe (Microsoft Corporation)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 2

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableInstallerDetection = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableSecureUIAPaths = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableVirtualization = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ValidateAdminCodeSignatures = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: scforceoption = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: FilterAdministratorToken = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableUIADesktopToggle = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_TEXT = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_BITMAP = 2

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_OEMTEXT = 7

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIB = 8

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_PALETTE = 9

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_UNICODETEXT = 13

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIBV5 = 17

O7 - HKU\S-1-5-21-1028737740-397911081-13709980-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0

O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Програмни файлове\Microsoft Office\OFFICE11\EXCEL.EXE File not found

O9 - Extra 'Tools' menuitem : Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe ()

O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)

O13 - gopher Prefix: missing

O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} http://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab (BDSCANONLINE Control)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1

O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp - No CLSID value found

O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL (Microsoft Corporation)

O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL (Microsoft Corporation)

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)

O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\Windows\System32\igfxdev.dll (Intel Corporation)

O31 - SafeBoot: AlternateShell - cmd.exe

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2006.09.18 23:43:36 | 00,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck) - File not found

O34 - HKLM BootExecute: (autochk) - C:\Windows\System32\autochk.exe (Microsoft Corporation)

O34 - HKLM BootExecute: (*) - File not found

O35 - comfile [open] -- "%1" %* File not found

O35 - exefile [open] -- "%1" %* File not found

========== Files/Folders - Created Within 30 Days ==========

[2009.11.17 19:11:20 | 00,529,408 | ---- | C] (OldTimer Tools) -- C:\Users\Petia\Desktop\OTL.exe

[2009.11.17 17:39:05 | 00,000,000 | ---D | C] -- C:\Program Files\ESET

[2009.11.17 09:47:52 | 00,000,000 | ---D | C] -- C:\Users\Petia\AppData\Local\Adobe

[2009.11.16 23:53:33 | 00,096,104 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys

[2009.11.16 23:53:33 | 00,055,656 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avgntflt.sys

[2009.11.16 23:53:33 | 00,028,520 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\ssmdrv.sys

[2009.11.16 23:53:32 | 00,000,000 | ---D | C] -- C:\ProgramData\Avira

[2009.11.16 23:53:32 | 00,000,000 | ---D | C] -- C:\ProgramData\Avira

[2009.11.16 23:53:32 | 00,000,000 | ---D | C] -- C:\Program Files\Avira

[2009.11.16 23:50:41 | 00,000,000 | --SD | C] -- C:\tool.exe

[2009.11.16 23:49:48 | 00,000,000 | ---D | C] -- C:\32788R22FWJFW

[2009.11.16 23:14:13 | 00,000,000 | ---D | C] -- C:\ProgramData\avg9

[2009.11.16 23:14:13 | 00,000,000 | ---D | C] -- C:\ProgramData\avg9

[2009.11.16 22:33:29 | 00,028,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\msahci.sys

[2009.11.16 22:32:54 | 00,212,480 | ---- | C] (SteelWerX) -- C:\Windows\SWXCACLS.exe

[2009.11.16 22:32:54 | 00,161,792 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe

[2009.11.16 22:32:54 | 00,136,704 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe

[2009.11.16 22:32:54 | 00,031,232 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe

[2009.11.16 22:32:48 | 00,000,000 | ---D | C] -- C:\Windows\ERDNT

[2009.11.16 22:30:00 | 00,000,000 | ---D | C] -- C:\Qoobox

[2009.11.16 22:25:37 | 00,000,000 | ---D | C] -- C:\Users\Petia\Documents\Проблем с AVG и Виста - kaldata_com - Форуми_файлове

[2009.11.16 22:07:46 | 03,484,528 | ---- | C] (OPSWAT, Inc.) -- C:\Users\Petia\Desktop\AppRemover.exe

[2009.11.15 22:47:55 | 00,000,000 | ---D | C] -- C:\Users\Petia\AppData\Roaming\Malwarebytes

[2009.11.15 20:02:57 | 00,000,000 | ---D | C] -- C:\Program Files\Panda Security

[2009.11.15 19:20:52 | 00,000,000 | ---D | C] -- C:\Windows\BDOSCAN8

[2009.11.15 00:03:05 | 00,000,000 | ---D | C] -- C:\Program Files\AVG

[2009.11.14 23:49:39 | 00,000,000 | ---D | C] -- C:\Program Files\Unlocker

[2009.11.14 22:37:19 | 00,000,000 | ---D | C] -- C:\Program Files\Wise Registry Cleaner

[2009.11.14 22:30:32 | 00,974,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfc70.dll

[2009.11.14 22:30:32 | 00,608,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\comctl32.ocx

[2009.11.14 22:30:32 | 00,487,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msvcp70.dll

[2009.11.14 22:30:32 | 00,344,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msvcr70.dll

[2009.11.14 22:30:31 | 00,000,000 | ---D | C] -- C:\Program Files\AML Products

[2009.11.14 22:07:36 | 00,000,000 | ---D | C] -- C:\Users\Petia\AppData\Roaming\iExpert Software

[2009.11.14 21:25:55 | 00,000,000 | ---D | C] -- C:\ProgramData\ESET

[2009.11.14 21:25:55 | 00,000,000 | ---D | C] -- C:\ProgramData\ESET

[2009.11.12 22:45:53 | 00,000,000 | ---D | C] -- C:\Windows\System32\DRVSTORE

[2009.11.12 22:45:45 | 00,093,360 | ---- | C] (Sunbelt Software) -- C:\Windows\System32\drivers\SBREDrv.sys

[2009.11.12 22:41:13 | 00,000,000 | ---D | C] -- C:\ProgramData\Lavasoft

[2009.11.12 22:41:13 | 00,000,000 | ---D | C] -- C:\ProgramData\Lavasoft

[2009.11.12 22:28:24 | 00,000,000 | ---D | C] -- C:\Program Files\SA Dictionary 2008 Beta 4

[2009.11.12 22:24:08 | 00,000,000 | ---D | C] -- C:\Users\Petia\AppData\Roaming\Winamp

[2009.11.12 22:24:08 | 00,000,000 | ---D | C] -- C:\Program Files\Winamp

[2009.11.12 22:19:06 | 00,000,000 | ---D | C] -- C:\Program Files\VS Revo Group

[2009.11.12 22:17:04 | 00,000,000 | ---D | C] -- C:\Users\Petia\Documents\Downloads

[2009.11.12 21:14:08 | 00,000,000 | ---D | C] -- C:\Program Files\Google

[2009.11.12 21:13:48 | 00,000,000 | ---D | C] -- C:\Program Files\CCleaner

[2009.11.12 13:52:29 | 00,000,000 | ---D | C] -- C:\Windows\Panther

[2009.11.12 13:52:12 | 00,000,000 | -HSD | C] -- C:\Boot

[2009.11.12 08:25:36 | 00,000,000 | ---D | C] -- C:\Users\Petia\AppData\Roaming\Nero

[2009.11.12 08:22:48 | 00,000,000 | ---D | C] -- C:\Users\Petia\Documents\CyberLink

[2009.11.12 08:22:46 | 00,000,000 | ---D | C] -- C:\Users\Petia\AppData\Roaming\CyberLink

[2009.11.12 08:22:15 | 00,000,000 | ---D | C] -- C:\ProgramData\CyberLink

[2009.11.12 08:22:15 | 00,000,000 | ---D | C] -- C:\ProgramData\CyberLink

[2009.11.12 08:22:01 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\CyberLink

[2009.11.12 08:21:06 | 00,000,000 | ---D | C] -- C:\Program Files\CyberLink

[2009.11.12 08:20:48 | 00,029,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msxml3a.dll

[2009.11.12 08:20:40 | 00,000,000 | ---D | C] -- C:\ProgramData\Temp

[2009.11.12 08:20:40 | 00,000,000 | ---D | C] -- C:\ProgramData\Temp

[2009.11.12 08:19:33 | 00,802,816 | ---- | C] (Pegasus Imaging Corp.) -- C:\Windows\System32\imagXRA7.dll

[2009.11.12 08:19:33 | 00,368,640 | ---- | C] (Pegasus Imaging Corporation) -- C:\Windows\System32\TwnLib4.dll

[2009.11.12 08:19:32 | 01,757,184 | ---- | C] (Pegasus Imaging Corp.) -- C:\Windows\System32\imagX7.dll

[2009.11.12 08:19:32 | 00,497,296 | ---- | C] (Pegasus Imaging Corp.) -- C:\Windows\System32\imagXpr7.dll

[2009.11.12 08:19:32 | 00,258,048 | ---- | C] (Pegasus Imaging Corp.) -- C:\Windows\System32\imagXR7.dll

[2009.11.12 08:19:31 | 00,000,000 | ---D | C] -- C:\ProgramData\Nero

[2009.11.12 08:19:31 | 00,000,000 | ---D | C] -- C:\ProgramData\Nero

[2009.11.12 08:19:31 | 00,000,000 | ---D | C] -- C:\Program Files\Nero

[2009.11.12 08:19:30 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\Nero

[2009.11.12 04:01:15 | 00,000,000 | R--D | C] -- C:\Users\Petia\Searches

[2009.11.12 04:01:06 | 00,000,000 | ---D | C] -- C:\Users\Petia\AppData\Roaming\Identities

[2009.11.12 04:01:05 | 00,000,000 | R--D | C] -- C:\Users\Petia\Contacts

[2009.11.12 04:01:04 | 00,000,000 | ---D | C] -- C:\Users\Petia\AppData\Local\VirtualStore

[2009.11.12 04:00:53 | 00,000,000 | --SD | C] -- C:\Users\Petia\AppData\Roaming\Microsoft

[2009.11.12 04:00:53 | 00,000,000 | R--D | C] -- C:\Users\Petia\Videos

[2009.11.12 04:00:53 | 00,000,000 | R--D | C] -- C:\Users\Petia\Saved Games

[2009.11.12 04:00:53 | 00,000,000 | R--D | C] -- C:\Users\Petia\Pictures

[2009.11.12 04:00:53 | 00,000,000 | R--D | C] -- C:\Users\Petia\Music

[2009.11.12 04:00:53 | 00,000,000 | R--D | C] -- C:\Users\Petia\Links

[2009.11.12 04:00:53 | 00,000,000 | R--D | C] -- C:\Users\Petia\Favorites

[2009.11.12 04:00:53 | 00,000,000 | R--D | C] -- C:\Users\Petia\Downloads

[2009.11.12 04:00:53 | 00,000,000 | R--D | C] -- C:\Users\Petia\Documents

[2009.11.12 04:00:53 | 00,000,000 | R--D | C] -- C:\Users\Petia\Desktop

[2009.11.12 04:00:53 | 00,000,000 | -H-D | C] -- C:\Users\Petia\AppData

[2009.11.12 04:00:53 | 00,000,000 | ---D | C] -- C:\Users\Petia\AppData\Local\Temp

[2009.11.12 04:00:53 | 00,000,000 | ---D | C] -- C:\Users\Petia\AppData\Local\Microsoft

[2009.11.12 04:00:07 | 00,000,000 | ---D | C] -- C:\Windows\Debug

[2009.11.12 03:56:28 | 00,000,000 | ---D | C] -- C:\Windows\SoftwareDistribution

[2009.11.12 03:53:36 | 00,000,000 | ---D | C] -- C:\Windows\Prefetch

[2009.11.12 03:53:25 | 00,000,000 | -HSD | C] -- C:\System Volume Information

[2009.11.12 00:30:10 | 00,000,000 | ---D | C] -- C:\Users\Petia\AppData\Roaming\WinRAR

[2009.11.12 00:29:23 | 00,000,000 | ---D | C] -- C:\Program Files\WinRAR

[2009.11.12 00:23:05 | 00,000,000 | ---D | C] -- C:\Program Files\uTorrent

[2009.11.12 00:22:13 | 00,000,000 | ---D | C] -- C:\Users\Petia\AppData\Roaming\uTorrent

[2009.11.12 00:17:35 | 00,017,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mdimon.dll

[2009.11.12 00:16:48 | 00,000,000 | ---D | C] -- C:\Program Files\Microsoft ActiveSync

[2009.11.12 00:16:46 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\DESIGNER

[2009.11.12 00:16:38 | 00,000,000 | ---D | C] -- C:\Windows\SHELLNEW

[2009.11.12 00:16:37 | 00,000,000 | ---D | C] -- C:\Windows\PCHEALTH

[2009.11.12 00:16:37 | 00,000,000 | ---D | C] -- C:\Program Files\Microsoft.NET

[2009.11.12 00:16:37 | 00,000,000 | ---D | C] -- C:\Program Files\Microsoft Office

[2009.11.12 00:12:56 | 00,000,000 | ---D | C] -- C:\ProgramData\DAEMON Tools Lite

[2009.11.12 00:12:56 | 00,000,000 | ---D | C] -- C:\ProgramData\DAEMON Tools Lite

[2009.11.12 00:12:39 | 00,000,000 | ---D | C] -- C:\Program Files\DAEMON Tools Toolbar

[2009.11.12 00:12:37 | 00,000,000 | ---D | C] -- C:\Program Files\DAEMON Tools Lite

[2009.11.12 00:10:21 | 00,000,000 | ---D | C] -- C:\Users\Petia\AppData\Roaming\DAEMON Tools Lite

[2009.11.12 00:09:50 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe AIR

[2009.11.12 00:09:48 | 00,000,000 | ---D | C] -- C:\Users\Petia\AppData\Roaming\Macromedia

[2009.11.12 00:09:11 | 00,000,000 | ---D | C] -- C:\ProgramData\Adobe

[2009.11.12 00:09:11 | 00,000,000 | ---D | C] -- C:\ProgramData\Adobe

[2009.11.12 00:09:10 | 00,000,000 | ---D | C] -- C:\Program Files\Adobe

[2009.11.12 00:07:33 | 00,000,000 | ---D | C] -- C:\Users\Petia\AppData\Roaming\Mozilla

[2009.11.12 00:07:33 | 00,000,000 | ---D | C] -- C:\Users\Petia\AppData\Local\Mozilla

[2009.11.12 00:07:26 | 00,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox

[2009.11.12 00:06:55 | 00,000,000 | ---D | C] -- C:\Windows\System32\Macromed

[2009.11.12 00:04:59 | 00,000,000 | ---D | C] -- C:\Users\Petia\Documents\GomPlayer

[2009.11.12 00:04:59 | 00,000,000 | ---D | C] -- C:\Users\Petia\AppData\Roaming\GRETECH

[2009.11.12 00:04:42 | 00,000,000 | ---D | C] -- C:\Program Files\GRETECH

[2009.11.12 00:04:03 | 00,000,000 | ---D | C] -- C:\Program Files\K-Lite Codec Pack

[2009.11.11 23:53:25 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe

[2009.11.11 23:53:24 | 00,000,000 | ---D | C] -- C:\Users\Petia\AppData\Roaming\Adobe

[2009.11.11 23:50:20 | 00,000,000 | ---D | C] -- C:\Users\Petia\AppData\Roaming\Skype

[2009.11.11 23:50:15 | 00,000,000 | R--D | C] -- C:\Program Files\Skype

[2009.11.11 23:50:15 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype

[2009.11.11 23:50:08 | 00,000,000 | ---D | C] -- C:\ProgramData\Skype

[2009.11.11 23:50:08 | 00,000,000 | ---D | C] -- C:\ProgramData\Skype

[2009.11.11 23:45:10 | 00,172,032 | ---- | C] (Intel Corporation) -- C:\Windows\System32\igfxres.dll

[2009.11.11 23:35:41 | 00,000,000 | ---D | C] -- C:\ProgramData\Downloaded Installations

[2009.11.11 23:35:41 | 00,000,000 | ---D | C] -- C:\ProgramData\Downloaded Installations

[2009.11.11 23:21:21 | 00,009,344 | ---- | C] (Hewlett-Packard Development Company, L.P.) -- C:\Windows\System32\drivers\CPQBttn.sys

[2009.11.11 23:21:20 | 01,560,576 | ---- | C] (Hewlett-Packard Company) -- C:\Windows\System32\BttnCmns_64.dll

[2009.11.11 23:21:20 | 01,560,576 | ---- | C] (Hewlett-Packard Company) -- C:\Windows\System32\BttnCmns.dll

[2009.11.11 23:21:20 | 01,419,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\wdfcoinstaller01005.dll

[2009.11.11 23:21:20 | 00,987,136 | ---- | C] (Hewlett-Packard Company) -- C:\Windows\System32\BttnCmn.dll

[2009.11.11 23:21:20 | 00,016,768 | ---- | C] (Hewlett-Packard Development Company, L.P.) -- C:\Windows\System32\drivers\HpqKbFiltr.sys

[2009.11.11 23:21:19 | 00,000,000 | -H-D | C] -- C:\Program Files\InstallShield Installation Information

[2009.11.11 23:21:01 | 00,000,000 | ---D | C] -- C:\Users\Petia\AppData\Roaming\InstallShield

[2009.11.11 23:20:42 | 00,000,000 | ---D | C] -- C:\Program Files\Synaptics

[2009.11.11 23:19:32 | 00,920,088 | ---- | C] (Intel® Corporation) -- C:\Windows\System32\igxpun.exe

[2009.11.11 23:19:32 | 00,319,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\difxapi.dll

[2009.11.11 23:19:32 | 00,000,000 | ---D | C] -- C:\Windows\System32\Lang

[2009.11.11 23:18:26 | 00,053,248 | ---- | C] (Windows XP Bundled build C-Centric Single User) -- C:\Windows\System32\CSVer.dll

[2009.11.11 23:18:26 | 00,000,000 | ---D | C] -- C:\Program Files\Intel

[2009.11.11 23:18:21 | 00,000,000 | ---D | C] -- C:\Intel

[2009.11.11 23:17:45 | 00,000,000 | ---D | C] -- C:\Program Files\Hewlett-Packard

[2009.11.11 23:17:33 | 00,000,000 | -HSD | C] -- C:\Windows\Installer

[2009.11.11 23:16:44 | 00,000,000 | ---D | C] -- C:\Program Files\CONEXANT

[2009.11.11 23:16:17 | 00,000,000 | ---D | C] -- C:\swsetup

========== Files - Modified Within 30 Days ==========

[2009.11.17 19:12:05 | 00,004,784 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

[2009.11.17 19:12:05 | 00,004,784 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

[2009.11.17 19:11:51 | 01,048,576 | ---- | M] () -- C:\Users\Petia\NTUSER.DAT

[2009.11.17 19:11:23 | 00,529,408 | ---- | M] (OldTimer Tools) -- C:\Users\Petia\Desktop\OTL.exe

[2009.11.17 18:18:00 | 00,001,066 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1028737740-397911081-13709980-1000UA.job

[2009.11.17 12:35:43 | 00,007,168 | ---- | M] () -- C:\Users\Petia\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2009.11.17 08:33:27 | 00,690,960 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI

[2009.11.17 08:33:27 | 00,587,178 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2009.11.17 08:33:27 | 00,101,250 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[2009.11.17 08:27:03 | 00,001,014 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1028737740-397911081-13709980-1000Core.job

[2009.11.17 08:27:03 | 00,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT

[2009.11.17 08:27:00 | 00,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2009.11.17 01:26:14 | 00,524,288 | -HS- | M] () -- C:\Users\Petia\NTUSER.DAT{95bfbcd6-d157-11de-aa28-001b38ec6abf}.TMContainer00000000000000000001.regtrans-ms

[2009.11.17 01:26:14 | 00,065,536 | -HS- | M] () -- C:\Users\Petia\NTUSER.DAT{95bfbcd6-d157-11de-aa28-001b38ec6abf}.TM.blf

[2009.11.17 01:26:11 | 02,111,806 | -H-- | M] () -- C:\Users\Petia\AppData\Local\IconCache.db

[2009.11.16 23:53:40 | 00,001,847 | ---- | M] () -- C:\Users\Public\Desktop\Avira AntiVir Control Center.lnk

[2009.11.16 22:28:56 | 03,560,773 | R--- | M] () -- C:\Users\Petia\Desktop\tool.exe.exe

[2009.11.16 22:25:44 | 00,132,752 | ---- | M] () -- C:\Users\Petia\Documents\Проблем с AVG и Виста - kaldata_com - Форуми.htm

[2009.11.16 22:07:55 | 03,484,528 | ---- | M] (OPSWAT, Inc.) -- C:\Users\Petia\Desktop\AppRemover.exe

[2009.11.15 20:38:28 | 00,000,950 | ---- | M] () -- C:\Users\Public\Desktop\Wise Registry Cleaner 4.lnk

[2009.11.15 20:18:51 | 00,002,537 | ---- | M] () -- C:\Users\Public\Desktop\SA Dictionary 2008 Beta 4.lnk

[2009.11.15 17:48:58 | 00,000,633 | ---- | M] () -- C:\Users\Petia\Documents\Виж темата - Правилният начин за деинсталиране-преинсталиране на AVG • Форуми за софтуер на Бизнес Софтуер Дистрибутор.mht

[2009.11.15 08:59:54 | 00,042,592 | ---- | M] () -- C:\Users\Petia\AppData\Local\GDIPFONTCACHEV1.DAT

[2009.11.15 00:13:46 | 00,002,042 | ---- | M] () -- C:\Users\Petia\Desktop\Google Chrome.lnk

[2009.11.14 23:00:45 | 00,200,936 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT

[2009.11.14 22:59:16 | 00,524,288 | -HS- | M] () -- C:\Users\Petia\NTUSER.DAT{95bfbcd6-d157-11de-aa28-001b38ec6abf}.TMContainer00000000000000000002.regtrans-ms

[2009.11.14 22:30:33 | 00,000,921 | ---- | M] () -- C:\Users\Petia\Desktop\AML Free Registry Cleaner.lnk

[2009.11.14 22:14:32 | 00,524,288 | -HS- | M] () -- C:\Users\Petia\NTUSER.DAT{d8932e6d-6a6f-11db-b6ab-a038f15a5785}.TMContainer00000000000000000001.regtrans-ms

[2009.11.14 22:14:32 | 00,065,536 | -HS- | M] () -- C:\Users\Petia\NTUSER.DAT{d8932e6d-6a6f-11db-b6ab-a038f15a5785}.TM.blf

[2009.11.14 20:51:50 | 00,000,466 | ---- | M] () -- C:\Windows\wininit.ini

[2009.11.14 12:52:57 | 00,001,254 | ---- | M] () -- C:\Users\Petia\Desktop\PhotoshopCS3portable.lnk

[2009.11.14 01:47:57 | 00,260,608 | ---- | M] () -- C:\Windows\PEV.exe

[2009.11.12 23:08:20 | 00,006,455 | ---- | M] () -- C:\Users\Petia\Documents\Моята предпочитана тема.theme

[2009.11.12 22:45:43 | 00,093,360 | ---- | M] (Sunbelt Software) -- C:\Windows\System32\drivers\SBREDrv.sys

[2009.11.12 22:24:10 | 00,000,786 | ---- | M] () -- C:\Users\Public\Desktop\Winamp.lnk

[2009.11.12 22:19:08 | 00,001,057 | ---- | M] () -- C:\Users\Petia\Desktop\Revo Uninstaller.lnk

[2009.11.12 22:04:46 | 00,001,770 | ---- | M] () -- C:\Users\Petia\Desktop\Windows Calendar.lnk

[2009.11.12 21:13:49 | 00,001,670 | ---- | M] () -- C:\Users\Petia\Desktop\CCleaner.lnk

[2009.11.12 20:35:24 | 00,024,206 | ---- | M] () -- C:\Users\Petia\AppData\Roaming\UserTile.png

[2009.11.12 13:52:14 | 00,008,192 | R-S- | M] () -- C:\BOOTSECT.BAK

[2009.11.12 08:25:25 | 00,000,871 | ---- | M] () -- C:\Users\Petia\Desktop\Nero Burning ROM.lnk

[2009.11.12 08:24:39 | 00,002,609 | ---- | M] () -- C:\Users\Petia\Desktop\Microsoft Office Word 2003.lnk

[2009.11.12 08:24:24 | 00,002,044 | ---- | M] () -- C:\Users\Petia\Desktop\Microsoft Office Excel 2003.lnk

[2009.11.12 08:22:03 | 00,001,840 | ---- | M] () -- C:\Users\Public\Desktop\CyberLink PowerDVD 8.lnk

[2009.11.12 08:20:37 | 00,029,480 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msxml3a.dll

[2009.11.12 04:00:53 | 00,000,020 | -HS- | M] () -- C:\Users\Petia\ntuser.ini

[2009.11.12 03:57:21 | 00,137,357 | ---- | M] () -- C:\Windows\System32\license.rtf

[2009.11.12 00:42:47 | 00,171,136 | RHS- | M] () -- C:\grldr

[2009.11.12 00:23:07 | 00,000,752 | ---- | M] () -- C:\Users\Public\Desktop\µTorrent.lnk

[2009.11.12 00:17:38 | 00,000,376 | ---- | M] () -- C:\Windows\ODBC.INI

[2009.11.12 00:17:22 | 00,000,240 | ---- | M] () -- C:\Windows\win.ini

[2009.11.12 00:12:38 | 00,001,735 | ---- | M] () -- C:\Users\Public\Desktop\DAEMON Tools Lite.lnk

[2009.11.12 00:10:22 | 00,721,904 | ---- | M] () -- C:\Windows\System32\drivers\sptd.sys

[2009.11.12 00:09:14 | 00,001,887 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader 9.lnk

[2009.11.12 00:07:36 | 00,000,000 | ---- | M] () -- C:\Windows\nsreg.dat

[2009.11.12 00:07:29 | 00,001,724 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk

[2009.11.12 00:04:50 | 00,000,902 | ---- | M] () -- C:\Users\Public\Desktop\GOM Player.lnk

[2009.11.11 23:50:15 | 00,001,878 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk

[2009.11.11 23:30:20 | 00,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_00_00.Wdf

[2009.11.11 23:24:49 | 00,016,052 | ---- | M] () -- C:\Windows\System32\results.xml

[2009.11.11 23:23:22 | 00,524,288 | -HS- | M] () -- C:\Users\Petia\NTUSER.DAT{d8932e6d-6a6f-11db-b6ab-a038f15a5785}.TMContainer00000000000000000002.regtrans-ms

[2009.11.11 23:20:55 | 00,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_Kernel_SynTP_01000.Wdf

[2009.11.11 23:17:50 | 00,000,000 | RHS- | M] () -- C:\Windows\System32\drivers\103C_HP_bNB_530 Notebook PC(KP479AA#AB9)_Y5336AN_0U_QCND8071F3M_EU_4A_I30D5_SHP_V82.15_68MVU F.06_T071210_WVH1_L402_M3063_J320_7Intel_86EC_92.17_#091111_N80861068;80864222_(KP479AA#AB9)_XMOBILE_CN10_Z_2F.06.MRK

[2009.10.25 06:11:34 | 00,077,312 | ---- | M] () -- C:\Windows\MBR.exe

========== Files Created - No Company Name ==========

[2009.11.16 23:53:40 | 00,001,847 | ---- | C] () -- C:\Users\Public\Desktop\Avira AntiVir Control Center.lnk

[2009.11.16 22:32:54 | 00,260,608 | ---- | C] () -- C:\Windows\PEV.exe

[2009.11.16 22:32:54 | 00,098,816 | ---- | C] () -- C:\Windows\sed.exe

[2009.11.16 22:32:54 | 00,080,412 | ---- | C] () -- C:\Windows\grep.exe

[2009.11.16 22:32:54 | 00,077,312 | ---- | C] () -- C:\Windows\MBR.exe

[2009.11.16 22:32:54 | 00,068,096 | ---- | C] () -- C:\Windows\zip.exe

[2009.11.16 22:28:56 | 03,560,773 | R--- | C] () -- C:\Users\Petia\Desktop\tool.exe.exe

[2009.11.16 22:25:36 | 00,132,752 | ---- | C] () -- C:\Users\Petia\Documents\Проблем с AVG и Виста - kaldata_com - Форуми.htm

[2009.11.15 18:32:22 | 00,007,168 | ---- | C] () -- C:\Users\Petia\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2009.11.15 17:48:58 | 00,000,633 | ---- | C] () -- C:\Users\Petia\Documents\Виж темата - Правилният начин за деинсталиране-преинсталиране на AVG • Форуми за софтуер на Бизнес Софтуер Дистрибутор.mht

[2009.11.15 08:59:54 | 00,042,592 | ---- | C] () -- C:\Users\Petia\AppData\Local\GDIPFONTCACHEV1.DAT

[2009.11.15 00:13:46 | 00,002,042 | ---- | C] () -- C:\Users\Petia\Desktop\Google Chrome.lnk

[2009.11.14 22:37:22 | 00,000,950 | ---- | C] () -- C:\Users\Public\Desktop\Wise Registry Cleaner 4.lnk

[2009.11.14 22:30:33 | 00,000,921 | ---- | C] () -- C:\Users\Petia\Desktop\AML Free Registry Cleaner.lnk

[2009.11.14 22:15:49 | 00,524,288 | -HS- | C] () -- C:\Users\Petia\NTUSER.DAT{95bfbcd6-d157-11de-aa28-001b38ec6abf}.TMContainer00000000000000000002.regtrans-ms

[2009.11.14 22:15:49 | 00,524,288 | -HS- | C] () -- C:\Users\Petia\NTUSER.DAT{95bfbcd6-d157-11de-aa28-001b38ec6abf}.TMContainer00000000000000000001.regtrans-ms

[2009.11.14 22:15:49 | 00,065,536 | -HS- | C] () -- C:\Users\Petia\NTUSER.DAT{95bfbcd6-d157-11de-aa28-001b38ec6abf}.TM.blf

[2009.11.14 20:51:25 | 00,000,466 | ---- | C] () -- C:\Windows\wininit.ini

[2009.11.14 20:21:58 | 02,111,806 | -H-- | C] () -- C:\Users\Petia\AppData\Local\IconCache.db

[2009.11.12 23:08:20 | 00,006,455 | ---- | C] () -- C:\Users\Petia\Documents\Моята предпочитана тема.theme

[2009.11.12 22:28:24 | 00,002,537 | ---- | C] () -- C:\Users\Public\Desktop\SA Dictionary 2008 Beta 4.lnk

[2009.11.12 22:24:10 | 00,000,786 | ---- | C] () -- C:\Users\Public\Desktop\Winamp.lnk

[2009.11.12 22:19:08 | 00,001,057 | ---- | C] () -- C:\Users\Petia\Desktop\Revo Uninstaller.lnk

[2009.11.12 22:14:18 | 00,001,066 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1028737740-397911081-13709980-1000UA.job

[2009.11.12 22:14:17 | 00,001,014 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1028737740-397911081-13709980-1000Core.job

[2009.11.12 22:04:46 | 00,001,770 | ---- | C] () -- C:\Users\Petia\Desktop\Windows Calendar.lnk

[2009.11.12 21:13:49 | 00,001,670 | ---- | C] () -- C:\Users\Petia\Desktop\CCleaner.lnk

[2009.11.12 20:35:24 | 00,024,206 | ---- | C] () -- C:\Users\Petia\AppData\Roaming\UserTile.png

[2009.11.12 13:52:14 | 00,008,192 | R-S- | C] () -- C:\BOOTSECT.BAK

[2009.11.12 13:52:13 | 00,332,497 | RHS- | C] () -- C:\bootmgr

[2009.11.12 08:25:25 | 00,000,871 | ---- | C] () -- C:\Users\Petia\Desktop\Nero Burning ROM.lnk

[2009.11.12 08:24:36 | 00,002,609 | ---- | C] () -- C:\Users\Petia\Desktop\Microsoft Office Word 2003.lnk

[2009.11.12 08:24:24 | 00,002,044 | ---- | C] () -- C:\Users\Petia\Desktop\Microsoft Office Excel 2003.lnk

[2009.11.12 08:22:03 | 00,001,840 | ---- | C] () -- C:\Users\Public\Desktop\CyberLink PowerDVD 8.lnk

[2009.11.12 04:00:53 | 01,048,576 | ---- | C] () -- C:\Users\Petia\NTUSER.DAT

[2009.11.12 04:00:53 | 00,524,288 | -HS- | C] () -- C:\Users\Petia\NTUSER.DAT{d8932e6d-6a6f-11db-b6ab-a038f15a5785}.TMContainer00000000000000000002.regtrans-ms

[2009.11.12 04:00:53 | 00,524,288 | -HS- | C] () -- C:\Users\Petia\NTUSER.DAT{d8932e6d-6a6f-11db-b6ab-a038f15a5785}.TMContainer00000000000000000001.regtrans-ms

[2009.11.12 04:00:53 | 00,065,536 | -HS- | C] () -- C:\Users\Petia\NTUSER.DAT{d8932e6d-6a6f-11db-b6ab-a038f15a5785}.TM.blf

[2009.11.12 04:00:53 | 00,000,020 | -HS- | C] () -- C:\Users\Petia\ntuser.ini

[2009.11.12 00:31:07 | 00,171,136 | RHS- | C] () -- C:\grldr

[2009.11.12 00:23:07 | 00,000,752 | ---- | C] () -- C:\Users\Public\Desktop\µTorrent.lnk

[2009.11.12 00:17:38 | 00,000,376 | ---- | C] () -- C:\Windows\ODBC.INI

[2009.11.12 00:12:38 | 00,001,735 | ---- | C] () -- C:\Users\Public\Desktop\DAEMON Tools Lite.lnk

[2009.11.12 00:10:21 | 00,721,904 | ---- | C] () -- C:\Windows\System32\drivers\sptd.sys

[2009.11.12 00:09:14 | 00,001,887 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader 9.lnk

[2009.11.12 00:07:36 | 00,000,000 | ---- | C] () -- C:\Windows\nsreg.dat

[2009.11.12 00:07:29 | 00,001,724 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk

[2009.11.12 00:04:50 | 00,000,902 | ---- | C] () -- C:\Users\Public\Desktop\GOM Player.lnk

[2009.11.12 00:04:04 | 00,178,176 | ---- | C] () -- C:\Windows\System32\unrar.dll

[2009.11.11 23:53:48 | 00,001,254 | ---- | C] () -- C:\Users\Petia\Desktop\PhotoshopCS3portable.lnk

[2009.11.11 23:50:15 | 00,001,878 | ---- | C] () -- C:\Users\Public\Desktop\Skype.lnk

[2009.11.11 23:30:20 | 00,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_00_00.Wdf

[2009.11.11 23:25:02 | 00,000,000 | ---- | C] () -- C:\Users\Petia\AppData\Local\QSwitch.txt

[2009.11.11 23:24:49 | 00,016,052 | ---- | C] () -- C:\Windows\System32\results.xml

[2009.11.11 23:20:55 | 00,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_Kernel_SynTP_01000.Wdf

[2009.11.11 23:17:50 | 00,000,000 | RHS- | C] () -- C:\Windows\System32\drivers\103C_HP_bNB_530 Notebook PC(KP479AA#AB9)_Y5336AN_0U_QCND8071F3M_EU_4A_I30D5_SHP_V82.15_68MVU F.06_T071210_WVH1_L402_M3063_J320_7Intel_86EC_92.17_#091111_N80861068;80864222_(KP479AA#AB9)_XMOBILE_CN10_Z_2F.06.MRK

[2009.01.05 15:44:10 | 00,000,453 | ---- | C] () -- C:\Windows\bdoscandellang.ini

[2007.08.25 01:46:48 | 00,147,456 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1322.dll

[2007.08.25 01:28:04 | 00,249,856 | ---- | C] () -- C:\Windows\System32\igfxTMM.dll

[2006.11.02 14:48:00 | 00,000,174 | -HS- | C] () -- C:\Program Files\desktop.ini

[2006.11.02 14:35:51 | 00,030,808 | ---- | C] () -- C:\Windows\Fonts\GlobalUserInterface.CompositeFont

[2006.11.02 14:35:51 | 00,029,779 | ---- | C] () -- C:\Windows\Fonts\GlobalSerif.CompositeFont

[2006.11.02 14:35:51 | 00,026,489 | ---- | C] () -- C:\Windows\Fonts\GlobalSansSerif.CompositeFont

[2006.11.02 14:35:51 | 00,026,040 | ---- | C] () -- C:\Windows\Fonts\GlobalMonospace.CompositeFont

[2006.11.02 12:23:31 | 00,000,240 | ---- | C] () -- C:\Windows\win.ini

[2006.11.02 12:23:31 | 00,000,219 | ---- | C] () -- C:\Windows\system.ini

[2006.11.02 09:40:29 | 00,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini

[2006.03.09 09:58:00 | 01,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll

[2003.01.07 15:05:08 | 00,002,695 | ---- | C] () -- C:\Windows\System32\OUTLPERF.INI

========== LOP Check ==========

[2009.11.12 00:14:16 | 00,000,000 | ---D | M] -- C:\Users\Petia\AppData\Roaming\DAEMON Tools Lite

[2009.11.14 22:07:36 | 00,000,000 | ---D | M] -- C:\Users\Petia\AppData\Roaming\iExpert Software

[2009.11.17 17:40:26 | 00,000,000 | ---D | M] -- C:\Users\Petia\AppData\Roaming\uTorrent

[2009.11.17 08:27:03 | 00,000,006 | -H-- | M] () -- C:\Windows\Tasks\SA.DAT

[2009.11.17 01:26:16 | 00,032,608 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

< End of report >

Extras.txt

OTL Extras logfile created on: 17.11.2009 г. 19:13:20 - Run 1

OTL by OldTimer - Version 3.1.6.0 Folder = C:\Users\Petia\Desktop

Windows Vista Service Pack 1, v.275 (Version = 6.0.6001) - Type = NTWorkstation

Internet Explorer (Version = 7.0.6001.16659)

Locale: 00000402 | Country: България | Language: BGR | Date Format: d.M.yyyy 'г.'

2,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 100,00% Memory free

4,00 Gb Paging File | 4,00 Gb Available in Paging File | 100,00% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 39,06 Gb Total Space | 30,42 Gb Free Space | 77,87% Space Free | Partition Type: NTFS

Drive D: | 258,99 Gb Total Space | 252,12 Gb Free Space | 97,35% Space Free | Partition Type: NTFS

E: Drive not present or media not loaded

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

Computer Name: PETIA-PC

Current User Name: Petia

Logged in as Administrator.

Current Boot Mode: Normal

Scan Mode: All users

Company Name Whitelist: Off

Skip Microsoft Files: Off

File Age = 30 Days

Output = Standard

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.chm [@ = chm.file] -- "%SystemRoot%\hh.exe" %1

.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %* File not found

chm.file [open] -- "%SystemRoot%\hh.exe" %1 File not found

cmdfile [open] -- "%1" %* File not found

comfile [open] -- "%1" %* File not found

exefile [open] -- "%1" %* File not found

helpfile [open] -- Reg Error: Key error.

hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)

htmlfile [edit] -- "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation)

htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)

htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

htmlfile [print] -- "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" /p %1 (Microsoft Corporation)

http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)

https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

piffile [open] -- "%1" %* File not found

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1" File not found

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)

scrfile [open] -- "%1" /S File not found

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 File not found

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)

Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"cval" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

"AntiVirusOverride" = 0

"AntiSpywareOverride" = 0

"FirewallOverride" = 0

"VistaSp1" = Reg Error: Unknown registry data type -- File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-1028737740-397911081-13709980-1000]

"EnableNotifications" = 0

"EnableNotificationsRef" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"EnableFirewall" = 0

"DisableNotifications" = 0

"DisableUnicastResponsesToMulticastBroadcast" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

========== Authorized Applications List ==========

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{01A0FD7A-0879-4780-9DAE-1E65CF3D4B1C}" = protocol=17 | dir=in | app=c:\program files\google\google talk\googletalk.exe |

"{6A9AF194-CC17-4320-BBB2-FCEE6442C9CC}" = protocol=6 | dir=in | app=c:\program files\google\google talk\googletalk.exe |

"{88B3AE19-C17A-45CE-A1E5-4D7BFDF13A80}" = protocol=6 | dir=in | app=c:\program files\utorrent\utorrent.exe |

"{89AC4AED-CFA7-40D1-B6BF-3516A675C7E1}" = protocol=17 | dir=in | app=c:\program files\utorrent\utorrent.exe |

"{AD24D8E8-D3A5-40F9-91AA-C4DB186045C8}" = dir=in | app=c:\program files\cyberlink\powerdvd8\powerdvd8.exe |

"{C81B843C-FC1C-4A15-9EE3-EF269F095E7D}" = dir=in | app=c:\program files\skype\phone\skype.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{00203668-8170-44A0-BE44-B632FA4D780F}" = Adobe AIR

"{055A5AF0-9FEB-440D-B00A-18935C7C171C}" = SA Dictionary 2008 Beta 4

"{12D61C9C-5E84-47F0-BD81-A48DF61A86D7}" = Vista Default Settings

"{226b64e8-dc75-4eea-a6c8-abcb496320f2}-Google Talk" = Google Talk (remove only)

"{24D753CA-6AE9-4E30-8F5F-EFC93E08BF3D}" = Skype™ 4.0

"{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}" = CyberLink PowerDVD 8

"{315F5FFC-1A5C-4A2A-B8E7-1C5B1174C198}_is1" = AML Free Registry Cleaner 4.20

"{34D2AB40-150D-475D-AE32-BD23FB5EE355}" = HP Quick Launch Buttons 6.40 F1

"{63A5B54D-0453-4815-ABF3-D156CD00E3FE}" = Bulgarian (Phonetic)

"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable

"{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com

"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable

"{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003

"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

"{AC76BA86-7AD7-1033-7B44-A90000000001}" = Adobe Reader 9

"{DBF1A661-AA7F-4C53-906C-C18E37BE4EC3}" = Bulgarian (Phonetic) - Original

"{E6B1698F-E5D1-4627-BCDB-F9C4CA27613F}" = ESU for Microsoft Vista

"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)

"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01

"Adobe AIR" = Adobe AIR

"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX

"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin

"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus

"CCleaner" = CCleaner

"CNXT_AUDIO_HDA" = Conexant HD Audio

"CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_5045&SUBSYS_103C30B7" = HDAUDIO Soft Data Fax Modem with SmartCP

"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com

"ESET Online Scanner" = ESET Online Scanner v3

"GOM Player" = GOM Player

"HDMI" = Intel® Graphics Media Accelerator Driver

"InstallShield_{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}" = CyberLink PowerDVD 8

"KLiteCodecPack_is1" = K-Lite Codec Pack 5.1.0 (Basic)

"Mozilla Firefox (3.5.3)" = Mozilla Firefox (3.5.3)

"Nero8Lite_is1" = Nero 8 Micro

"Revo Uninstaller" = Revo Uninstaller 1.83

"SynTPDeinstKey" = Synaptics Pointing Device Driver

"Unlocker" = Unlocker 1.8.8

"uTorrent" = µTorrent

"Winamp" = Winamp

"WinRAR archiver" = Архиватор WinRAR

"Wise Registry Cleaner_is1" = Wise Registry Cleaner 4 Free 4.86

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-1028737740-397911081-13709980-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"Google Chrome" = Google Chrome

========== Last 10 Event Log Errors ==========

[ Application Events ]

Error - 17.11.2009 г. 06:33:27 | Computer Name = Petia-PC | Source = Application Error | ID = 1000

Description = Приложение с грешки GOM.exe, версия 2.1.18.4762, времево клеймо 0x4a279319,

модул с грешки quartz.dll, версия 6.6.6001.16659, времево клеймо 0x46ede299, код

на изключение 0xc0000005, отместване на грешка 0x001098ac, ИД на процес 0xd50, час

на стартиране на приложение 0x01ca67715b516033.

Error - 17.11.2009 г. 06:35:19 | Computer Name = Petia-PC | Source = Application Error | ID = 1000

Description = Приложение с грешки GOM.exe, версия 2.1.18.4762, времево клеймо 0x4a279319,

модул с грешки quartz.dll, версия 6.6.6001.16659, времево клеймо 0x46ede299, код

на изключение 0xc0000005, отместване на грешка 0x001098ac, ИД на процес 0x564, час

на стартиране на приложение 0x01ca67716aa543d3.

Error - 17.11.2009 г. 06:35:36 | Computer Name = Petia-PC | Source = Application Error | ID = 1000

Description = Приложение с грешки GOM.exe, версия 2.1.18.4762, времево клеймо 0x4a279319,

модул с грешки quartz.dll, версия 6.6.6001.16659, времево клеймо 0x46ede299, код

на изключение 0xc0000005, отместване на грешка 0x001098ac, ИД на процес 0x1b4, час

на стартиране на приложение 0x01ca6771ac265e73.

Error - 17.11.2009 г. 06:35:49 | Computer Name = Petia-PC | Source = Application Error | ID = 1000

Description = Приложение с грешки GOM.exe, версия 2.1.18.4762, времево клеймо 0x4a279319,

модул с грешки quartz.dll, версия 6.6.6001.16659, времево клеймо 0x46ede299, код

на изключение 0xc0000005, отместване на грешка 0x001098ac, ИД на процес 0x67c, час

на стартиране на приложение 0x01ca6771b5deb613.

Error - 17.11.2009 г. 07:12:05 | Computer Name = Petia-PC | Source = Software Licensing Service | ID = 8193

Description = License Activation Scheduler (SLUINotify.dll) failed with the following

error code: 0x80004005

Error - 17.11.2009 г. 08:12:05 | Computer Name = Petia-PC | Source = Software Licensing Service | ID = 8193

Description = License Activation Scheduler (SLUINotify.dll) failed with the following

error code: 0x80004005

Error - 17.11.2009 г. 09:12:05 | Computer Name = Petia-PC | Source = Software Licensing Service | ID = 8193

Description = License Activation Scheduler (SLUINotify.dll) failed with the following

error code: 0x80004005

Error - 17.11.2009 г. 10:12:05 | Computer Name = Petia-PC | Source = Software Licensing Service | ID = 8193

Description = License Activation Scheduler (SLUINotify.dll) failed with the following

error code: 0x80004005

Error - 17.11.2009 г. 11:12:05 | Computer Name = Petia-PC | Source = Software Licensing Service | ID = 8193

Description = License Activation Scheduler (SLUINotify.dll) failed with the following

error code: 0x80004005

Error - 17.11.2009 г. 12:12:05 | Computer Name = Petia-PC | Source = Software Licensing Service | ID = 8193

Description = License Activation Scheduler (SLUINotify.dll) failed with the following

error code: 0x80004005

[ System Events ]

Error - 17.11.2009 г. 08:12:05 | Computer Name = Petia-PC | Source = Service Control Manager | ID = 7024

Description =

Error - 17.11.2009 г. 08:17:25 | Computer Name = Petia-PC | Source = Dhcp | ID = 1001

Description = Your computer was not assigned an address from the network (by the

DHCP Server) for the Network Card with network address 001CBF8FAAD0. The following

error occurred: %%121. Your computer will continue to try and obtain an address

on its own from the network address (DHCP) server.

Error - 17.11.2009 г. 08:23:25 | Computer Name = Petia-PC | Source = Dhcp | ID = 1001

Description = Your computer was not assigned an address from the network (by the

DHCP Server) for the Network Card with network address 001CBF8FAAD0. The following

error occurred: %%121. Your computer will continue to try and obtain an address

on its own from the network address (DHCP) server.

Error - 17.11.2009 г. 08:29:54 | Computer Name = Petia-PC | Source = Dhcp | ID = 1001

Description = Your computer was not assigned an address from the network (by the

DHCP Server) for the Network Card with network address 001CBF8FAAD0. The following

error occurred: %%121. Your computer will continue to try and obtain an address

on its own from the network address (DHCP) server.

Error - 17.11.2009 г. 08:42:17 | Computer Name = Petia-PC | Source = Dhcp | ID = 1001

Description = Your computer was not assigned an address from the network (by the

DHCP Server) for the Network Card with network address 001CBF8FAAD0. The following

error occurred: %%121. Your computer will continue to try and obtain an address

on its own from the network address (DHCP) server.

Error - 17.11.2009 г. 09:00:36 | Computer Name = Petia-PC | Source = Dhcp | ID = 1001

Description = Your computer was not assigned an address from the network (by the

DHCP Server) for the Network Card with network address 001CBF8FAAD0. The following

error occurred: %%1223. Your computer will continue to try and obtain an address

on its own from the network address (DHCP) server.

Error - 17.11.2009 г. 09:12:05 | Computer Name = Petia-PC | Source = Service Control Manager | ID = 7024

Description =

Error - 17.11.2009 г. 10:12:05 | Computer Name = Petia-PC | Source = Service Control Manager | ID = 7024

Description =

Error - 17.11.2009 г. 11:12:05 | Computer Name = Petia-PC | Source = Service Control Manager | ID = 7024

Description =

Error - 17.11.2009 г. 12:12:05 | Computer Name = Petia-PC | Source = Service Control Manager | ID = 7024

Description =

< End of report >

Стъпка 1:

Отворете C:\Program Files\ESET\ESET Online Scanner и стартирайте OnlineScannerUninstaller.exe. Следвайте инструкциите, за да деинсталирате успешно скенера.

Стъпка 2:

Моля, отидете на Start --> Settings --> Control Panel --> Add or Remove Programs, и деинсталирайте следните програми (Ако присъстват в списъка):

AML Free Registry Cleaner 4.20

HP Quick Launch Buttons 6.40 F1

Acrobat.com

Adobe Reader 9

Wise Registry Cleaner 4 Free 4.86

Относно чистачите на регистри, които използвате Ви препоръчвам да се отървете от тях, защото могат да бъдат по-скоро вредни за Вас. Бих Ви препоръчал, ако държите да използвате такъв, то да си използвате само CCleaner. Adobe Reader 9 е стара версия, затова силно Ви препоръчвам да си изтеглите и инсталирате актуална версия от:

http://www.kaldata.com/comments.php?id=50513&catid=1&highlight=adobe+reader

Нека все пак, това да стане, когато приключим с цялата тази работа.

Стъпка 3:

Изтеглете SREng от тук и го запишете на вашия десктоп.

  • Разархивирайте sreng2.zip на вашия десктоп и ще се появи папка, наречена sreng2
  • Отворете папката sreng2 и кликнете два пъти върху SREngLdr.exe, за да стартирате програмата
  • От панела в ляво, изберете System Repair
  • Кликнете на File Association
  • Сложете отметки пред всички редове, чиито статус е Error
  • Накрая изберете Repair

SystemRepair_FileAssocs.gif

Стъпка 4:

  • Стартирайте OTL.exe
  • Под Custom Scans/Fixes поставете следния скрипт:

:OTL

IE - HKU\.DEFAULT\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-1028737740-397911081-13709980-1000\S-1-5-21-1028737740-397911081-13709980-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

O2 - BHO: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - No CLSID value found.

O3 - HKLM\..\Toolbar: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - No CLSID value found.

O3 - HKU\S-1-5-21-1028737740-397911081-13709980-1000\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.

O7 - HKU\S-1-5-21-1028737740-397911081-13709980-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0

O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Програмни файлове\Microsoft Office\OFFICE11\EXCEL.EXE File not found

O13 - gopher Prefix: missing

O18 - Protocol\Handler\msdaipp - No CLSID value found

O34 - HKLM BootExecute: (autocheck) - File not found

O34 - HKLM BootExecute: (*) - File not found

O35 - comfile [open] -- "%1" %* File not found

O35 - exefile [open] -- "%1" %* File not found

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 File not found



:files

C:\ProgramData\avg9

C:\Program Files\AVG

C:\ProgramData\Lavasoft

C:\ProgramData\DAEMON Tools Lite

C:\ProgramData\DAEMON Tools Lite

C:\Program Files\DAEMON Tools Toolbar

C:\Program Files\DAEMON Tools Lite

C:\Users\Petia\AppData\Roaming\DAEMON Tools Lite

C:\Windows\System32\drivers\SBREDrv.sys

C:\Windows\tasks\SA.DAT

C:\Windows\bootstat.dat


:registry

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

"VistaSp1" =-



:Commands

[purity]

[emptytemp]

[Reboot]

  • След това, кликнете върху бутона Run Fix
  • Търпеливо изчакайте, докато програмата приключи своята работа. След, като нейната работа приключи, компютърът Ви ще се рестартира.

След рестартирането на компютъра, стартирайте отново OTL.exe и кликнете върху бутона Quick Scan. Накрая ще бъде генериран лог файл, който е необходимо да копирате и публикувате в следващия Ви коментар в тази тема.

  • Автор

Здравей Maniac, последвах инструкциите. Ето резултатите.

Деинсталирах ESET Online Scanner ,както и програмите от списъка.Всички бяха налични.

Ще послушам съветите за CCleaner и Adobe Reader :cool:

Изтеглих и стартирах SREng , но нямаше редове чийто статус да е Error.

016003526.jpg

Стартирах OTL.exe и поставих скрипта.След рестарта на компютъра се появи това

016003771.jpg

Файлът се намира в C:\_OTL\MovedFiles

Ето съдържанието му:

All processes killed

Error: Unable to interpret <:OTLIE - HKU\.DEFAULT\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0IE - HKU\S-1-5-18\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0IE - HKU\S-1-5-21-1028737740-397911081-13709980-1000\S-1-5-21-1028737740-397911081-13709980-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0O2 - BHO: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - No CLSID value found.O3 - HKLM\..\Toolbar: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - No CLSID value found.O3 - HKU\S-1-5-21-1028737740-397911081-13709980-1000\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.O7 - HKU\S-1-5-21-1028737740-397911081-13709980-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Програмни файлове\Microsoft Office\OFFICE11\EXCEL.EXE File not foundO13 - gopher Prefix: missingO18 - Proto> in the current context!

Error: Unable to interpret <col\Handler\msdaipp - No CLSID value foundO34 - HKLM BootExecute: (autocheck) - File not foundO34 - HKLM BootExecute: (*) - File not foundO35 - comfile [open] -- "%1" %* File not foundO35 - exefile [open] -- "%1" %* File not foundUnknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 File not found:filesC:\ProgramData\avg9C:\Program Files\AVGC:\ProgramData\LavasoftC:\ProgramData\DAEMON Tools LiteC:\ProgramData\DAEMON Tools LiteC:\Program Files\DAEMON Tools ToolbarC:\Program Files\DAEMON Tools LiteC:\Users\Petia\AppData\Roaming\DAEMON Tools LiteC:\Windows\System32\drivers\SBREDrv.sysC:\Windows\tasks\SA.DATC:\Windows\bootstat.dat:registry[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]"VistaSp1" =-:Commands[purity][emptytemp][Reboot]> in the current context!

OTL by OldTimer - Version 3.1.6.0 log created on 11172009_224531

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

Стартирах OTL.exe и кликнах върху бутона Quick Scan.

Ето лог файла:

OTL logfile created on: 17.11.2009 г. 22:48:07 - Run 2

OTL by OldTimer - Version 3.1.6.0 Folder = C:\Users\Petia\Desktop

Windows Vista Service Pack 1, v.275 (Version = 6.0.6001) - Type = NTWorkstation

Internet Explorer (Version = 7.0.6001.16659)

Locale: 00000402 | Country: България | Language: BGR | Date Format: d.M.yyyy 'г.'

2,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 100,00% Memory free

4,00 Gb Paging File | 4,00 Gb Available in Paging File | 100,00% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 39,06 Gb Total Space | 30,71 Gb Free Space | 78,62% Space Free | Partition Type: NTFS

Drive D: | 258,99 Gb Total Space | 252,12 Gb Free Space | 97,35% Space Free | Partition Type: NTFS

E: Drive not present or media not loaded

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

Drive X: | 79,96 Gb Total Space | 75,18 Gb Free Space | 94,02% Space Free | Partition Type: NTFS

Drive Y: | 22,46 Gb Total Space | 12,98 Gb Free Space | 57,78% Space Free | Partition Type: NTFS

Drive Z: | 328,65 Gb Total Space | 126,63 Gb Free Space | 38,53% Space Free | Partition Type: NTFS

Computer Name: PETIA-PC

Current User Name: Petia

Logged in as Administrator.

Current Boot Mode: Normal

Scan Mode: Current user

Company Name Whitelist: On

Skip Microsoft Files: On

File Age = 14 Days

Output = Standard

Quick Scan

========== Processes (SafeList) ==========

PRC - [2009.11.17 19:11:23 | 00,529,408 | ---- | M] (OldTimer Tools) -- C:\Users\Petia\Desktop\OTL.exe

PRC - [2009.10.26 09:33:41 | 00,015,872 | ---- | M] () -- C:\Program Files\Unlocker\UnlockerAssistant.exe

PRC - [2009.07.21 14:34:33 | 00,185,089 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe

PRC - [2009.05.13 16:48:22 | 00,108,289 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe

PRC - [2009.03.02 13:08:47 | 00,209,153 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

PRC - [2008.01.18 11:31:32 | 00,095,528 | ---- | M] (Synaptics, Inc.) -- C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

PRC - [2008.01.18 11:31:22 | 01,033,512 | ---- | M] (Synaptics, Inc.) -- C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

PRC - [2007.09.18 01:30:35 | 00,896,512 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Media Player\wmpnetwk.exe

PRC - [2007.09.18 01:30:35 | 00,201,728 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Media Player\wmpnscfg.exe

PRC - [2007.09.18 01:29:34 | 02,921,472 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe

PRC - [2007.09.18 01:29:10 | 00,017,408 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iashost.exe

PRC - [2007.09.18 01:28:48 | 00,625,152 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Internet Explorer\iexplore.exe

PRC - [2007.09.18 01:28:35 | 00,151,040 | ---- | M] (Microsoft Corporation) -- C:\Windows\notepad.exe

PRC - [2007.09.18 01:28:18 | 01,197,056 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Sidebar\sidebar.exe

PRC - [2007.09.13 06:34:02 | 00,141,848 | ---- | M] (Intel Corporation) -- C:\Windows\System32\igfxtray.exe

PRC - [2007.09.13 06:34:00 | 00,252,440 | ---- | M] (Intel Corporation) -- C:\Windows\System32\igfxsrvc.exe

PRC - [2007.09.13 06:33:56 | 00,129,560 | ---- | M] (Intel Corporation) -- C:\Windows\System32\igfxpers.exe

PRC - [2007.09.13 06:33:48 | 00,154,136 | ---- | M] (Intel Corporation) -- C:\Windows\System32\hkcmd.exe

PRC - [2006.11.28 10:44:58 | 00,386,560 | ---- | M] (Conexant Systems, Inc.) -- C:\Windows\System32\drivers\XAudio.exe

========== Modules (SafeList) ==========

MOD - [2009.11.17 19:11:23 | 00,529,408 | ---- | M] (OldTimer Tools) -- C:\Users\Petia\Desktop\OTL.exe

MOD - [2009.10.26 09:33:32 | 00,004,608 | ---- | M] () -- C:\Program Files\Unlocker\UnlockerHook.dll

MOD - [2007.09.18 01:28:38 | 01,684,992 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6001.16659_none_5cdfda200835e6c0\comctl32.dll

========== Win32 Services (SafeList) ==========

SRV - File not found -- -- (ekrn)

SRV - [2009.07.21 14:34:33 | 00,185,089 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2009.05.13 16:48:22 | 00,108,289 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2007.09.18 01:30:35 | 00,896,512 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)

SRV - [2007.09.18 01:30:26 | 00,122,880 | ---- | M] (Microsoft Corporation) -- C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe -- (NetTcpPortSharing)

SRV - [2007.09.18 01:30:25 | 00,864,256 | ---- | M] (Microsoft Corporation) -- C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe -- (idsvc)

SRV - [2007.09.18 01:30:23 | 00,036,864 | ---- | M] (Microsoft Corporation) -- C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe -- (FontCache3.0.0.0)

SRV - [2007.09.18 01:30:05 | 00,069,976 | ---- | M] (Microsoft Corporation) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)

SRV - [2007.09.18 01:28:22 | 00,272,568 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)

SRV - [2006.11.28 10:44:58 | 00,386,560 | ---- | M] (Conexant Systems, Inc.) -- C:\Windows\System32\drivers\XAudio.exe -- (XAudioService)

SRV - [2003.07.28 12:28:22 | 00,089,136 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.bg/

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:9.0.0.701

FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.5.3

FF - HKLM\software\mozilla\Mozilla Firefox 3.5.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009.11.12 00:07:35 | 00,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.5.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2009.11.17 22:31:04 | 00,000,000 | ---D | M]

[2009.11.12 00:07:41 | 00,000,000 | ---D | M] -- C:\Users\Petia\AppData\Roaming\mozilla\Extensions

[2009.11.12 00:07:41 | 00,000,000 | ---D | M] -- C:\Users\Petia\AppData\Roaming\mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}

[2009.11.12 08:50:33 | 00,000,000 | ---D | M] -- C:\Users\Petia\AppData\Roaming\mozilla\Firefox\Profiles\va7z7z0y.default\extensions

[2009.11.12 00:07:27 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions

[2009.11.12 00:07:27 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

[2009.08.24 22:16:36 | 00,023,544 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browserdirprovider.dll

[2009.08.24 22:16:36 | 00,137,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\brwsrcmp.dll

[2009.08.24 22:16:36 | 00,065,016 | ---- | M] (mozilla.org) -- C:\Program Files\mozilla firefox\plugins\npnul32.dll

[2003.07.14 22:56:52 | 00,013,888 | ---- | M] (Microsoft Corporation) -- C:\Program Files\mozilla firefox\plugins\NPOFFICE.DLL

[2009.08.24 21:22:00 | 00,001,083 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\911bg.xml

[2009.08.24 21:22:00 | 00,001,394 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom.xml

[2009.08.24 21:22:00 | 00,002,442 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\diribg.xml

[2009.08.24 21:22:00 | 00,002,371 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\google.xml

[2009.08.24 21:22:00 | 00,001,515 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\pe-bg.xml

[2009.08.24 21:22:00 | 00,001,857 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\portalbgdict.xml

[2009.08.24 21:22:00 | 00,001,220 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-bg.xml

O1 HOSTS File: (33 bytes) - C:\Windows\System32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1 localhost

O2 - BHO: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - No CLSID value found.

O3 - HKLM\..\Toolbar: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - No CLSID value found.

O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.

O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

O4 - HKLM..\Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe (Intel Corporation)

O4 - HKLM..\Run: [igfxTray] C:\Windows\System32\igfxtray.exe (Intel Corporation)

O4 - HKLM..\Run: [Persistence] C:\Windows\System32\igfxpers.exe (Intel Corporation)

O4 - HKLM..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics, Inc.)

O4 - HKLM..\Run: [unlockerAssistant] C:\Program Files\Unlocker\UnlockerAssistant.exe ()

O4 - HKCU..\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe (Microsoft Corporation)

O4 - HKCU..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe (Microsoft Corporation)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 2

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableInstallerDetection = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableSecureUIAPaths = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableVirtualization = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ValidateAdminCodeSignatures = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: scforceoption = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: FilterAdministratorToken = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableUIADesktopToggle = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_TEXT = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_BITMAP = 2

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_OEMTEXT = 7

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIB = 8

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_PALETTE = 9

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_UNICODETEXT = 13

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIBV5 = 17

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0

O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Програмни файлове\Microsoft Office\OFFICE11\EXCEL.EXE File not found

O9 - Extra 'Tools' menuitem : Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe ()

O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)

O13 - gopher Prefix: missing

O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} http://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab (BDSCANONLINE Control)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1

O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp - No CLSID value found

O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL (Microsoft Corporation)

O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL (Microsoft Corporation)

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)

O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\Windows\System32\igfxdev.dll (Intel Corporation)

O31 - SafeBoot: AlternateShell - cmd.exe

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2006.09.18 23:43:36 | 00,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O32 - AutoRun File - [2009.11.04 11:33:15 | 00,000,000 | ---- | M] () - Y:\AUTOEXEC.BAT -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck) - File not found

O34 - HKLM BootExecute: (autochk) - C:\Windows\System32\autochk.exe (Microsoft Corporation)

O34 - HKLM BootExecute: (*) - File not found

O35 - comfile [open] -- "%1" %* File not found

O35 - exefile [open] -- "%1" %* File not found

========== Files/Folders - Created Within 14 Days ==========

[2009.11.17 22:45:31 | 00,000,000 | ---D | C] -- C:\_OTL

[2009.11.17 22:37:49 | 00,000,000 | ---D | C] -- C:\Users\Petia\Desktop\sreng2

[2009.11.17 22:31:02 | 00,000,000 | -HSD | C] -- C:\Config.Msi

[2009.11.17 19:11:20 | 00,529,408 | ---- | C] (OldTimer Tools) -- C:\Users\Petia\Desktop\OTL.exe

[2009.11.17 09:47:52 | 00,000,000 | ---D | C] -- C:\Users\Petia\AppData\Local\Adobe

[2009.11.16 23:53:33 | 00,096,104 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys

[2009.11.16 23:53:33 | 00,055,656 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avgntflt.sys

[2009.11.16 23:53:33 | 00,028,520 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\ssmdrv.sys

[2009.11.16 23:53:32 | 00,000,000 | ---D | C] -- C:\ProgramData\Avira

[2009.11.16 23:53:32 | 00,000,000 | ---D | C] -- C:\ProgramData\Avira

[2009.11.16 23:53:32 | 00,000,000 | ---D | C] -- C:\Program Files\Avira

[2009.11.16 23:50:41 | 00,000,000 | --SD | C] -- C:\tool.exe

[2009.11.16 23:49:48 | 00,000,000 | ---D | C] -- C:\32788R22FWJFW

[2009.11.16 23:14:13 | 00,000,000 | ---D | C] -- C:\ProgramData\avg9

[2009.11.16 23:14:13 | 00,000,000 | ---D | C] -- C:\ProgramData\avg9

[2009.11.16 22:32:54 | 00,212,480 | ---- | C] (SteelWerX) -- C:\Windows\SWXCACLS.exe

[2009.11.16 22:32:54 | 00,161,792 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe

[2009.11.16 22:32:54 | 00,136,704 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe

[2009.11.16 22:32:54 | 00,031,232 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe

[2009.11.16 22:32:48 | 00,000,000 | ---D | C] -- C:\Windows\ERDNT

[2009.11.16 22:30:00 | 00,000,000 | ---D | C] -- C:\Qoobox

[2009.11.16 22:25:37 | 00,000,000 | ---D | C] -- C:\Users\Petia\Documents\Проблем с AVG и Виста - kaldata_com - Форуми_файлове

[2009.11.16 22:07:46 | 03,484,528 | ---- | C] (OPSWAT, Inc.) -- C:\Users\Petia\Desktop\AppRemover.exe

[2009.11.15 22:47:55 | 00,000,000 | ---D | C] -- C:\Users\Petia\AppData\Roaming\Malwarebytes

[2009.11.15 20:02:57 | 00,000,000 | ---D | C] -- C:\Program Files\Panda Security

[2009.11.15 19:20:52 | 00,000,000 | ---D | C] -- C:\Windows\BDOSCAN8

[2009.11.15 00:03:05 | 00,000,000 | ---D | C] -- C:\Program Files\AVG

[2009.11.14 23:49:39 | 00,000,000 | ---D | C] -- C:\Program Files\Unlocker

[2009.11.14 22:07:36 | 00,000,000 | ---D | C] -- C:\Users\Petia\AppData\Roaming\iExpert Software

[2009.11.14 21:25:55 | 00,000,000 | ---D | C] -- C:\ProgramData\ESET

[2009.11.14 21:25:55 | 00,000,000 | ---D | C] -- C:\ProgramData\ESET

[2009.11.12 22:45:53 | 00,000,000 | ---D | C] -- C:\Windows\System32\DRVSTORE

[2009.11.12 22:45:45 | 00,093,360 | ---- | C] (Sunbelt Software) -- C:\Windows\System32\drivers\SBREDrv.sys

[2009.11.12 22:41:13 | 00,000,000 | ---D | C] -- C:\ProgramData\Lavasoft

[2009.11.12 22:41:13 | 00,000,000 | ---D | C] -- C:\ProgramData\Lavasoft

[2009.11.12 22:28:24 | 00,000,000 | ---D | C] -- C:\Program Files\SA Dictionary 2008 Beta 4

[2009.11.12 22:24:08 | 00,000,000 | ---D | C] -- C:\Users\Petia\AppData\Roaming\Winamp

[2009.11.12 22:24:08 | 00,000,000 | ---D | C] -- C:\Program Files\Winamp

[2009.11.12 22:19:06 | 00,000,000 | ---D | C] -- C:\Program Files\VS Revo Group

[2009.11.12 22:17:04 | 00,000,000 | ---D | C] -- C:\Users\Petia\Documents\Downloads

[2009.11.12 21:14:08 | 00,000,000 | ---D | C] -- C:\Program Files\Google

[2009.11.12 21:13:48 | 00,000,000 | ---D | C] -- C:\Program Files\CCleaner

[2009.11.12 13:52:29 | 00,000,000 | ---D | C] -- C:\Windows\Panther

[2009.11.12 13:52:12 | 00,000,000 | -HSD | C] -- C:\Boot

[2009.11.12 08:25:36 | 00,000,000 | ---D | C] -- C:\Users\Petia\AppData\Roaming\Nero

[2009.11.12 08:22:48 | 00,000,000 | ---D | C] -- C:\Users\Petia\Documents\CyberLink

[2009.11.12 08:22:46 | 00,000,000 | ---D | C] -- C:\Users\Petia\AppData\Roaming\CyberLink

[2009.11.12 08:22:15 | 00,000,000 | ---D | C] -- C:\ProgramData\CyberLink

[2009.11.12 08:22:15 | 00,000,000 | ---D | C] -- C:\ProgramData\CyberLink

[2009.11.12 08:22:01 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\CyberLink

[2009.11.12 08:21:06 | 00,000,000 | ---D | C] -- C:\Program Files\CyberLink

[2009.11.12 08:20:40 | 00,000,000 | ---D | C] -- C:\ProgramData\Temp

[2009.11.12 08:20:40 | 00,000,000 | ---D | C] -- C:\ProgramData\Temp

[2009.11.12 08:19:33 | 00,802,816 | ---- | C] (Pegasus Imaging Corp.) -- C:\Windows\System32\imagXRA7.dll

[2009.11.12 08:19:33 | 00,368,640 | ---- | C] (Pegasus Imaging Corporation) -- C:\Windows\System32\TwnLib4.dll

[2009.11.12 08:19:32 | 01,757,184 | ---- | C] (Pegasus Imaging Corp.) -- C:\Windows\System32\imagX7.dll

[2009.11.12 08:19:32 | 00,497,296 | ---- | C] (Pegasus Imaging Corp.) -- C:\Windows\System32\imagXpr7.dll

[2009.11.12 08:19:32 | 00,258,048 | ---- | C] (Pegasus Imaging Corp.) -- C:\Windows\System32\imagXR7.dll

[2009.11.12 08:19:31 | 00,000,000 | ---D | C] -- C:\ProgramData\Nero

[2009.11.12 08:19:31 | 00,000,000 | ---D | C] -- C:\ProgramData\Nero

[2009.11.12 08:19:31 | 00,000,000 | ---D | C] -- C:\Program Files\Nero

[2009.11.12 08:19:30 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\Nero

[2009.11.12 04:01:15 | 00,000,000 | R--D | C] -- C:\Users\Petia\Searches

[2009.11.12 04:01:06 | 00,000,000 | ---D | C] -- C:\Users\Petia\AppData\Roaming\Identities

[2009.11.12 04:01:05 | 00,000,000 | R--D | C] -- C:\Users\Petia\Contacts

[2009.11.12 04:01:04 | 00,000,000 | ---D | C] -- C:\Users\Petia\AppData\Local\VirtualStore

[2009.11.12 04:00:53 | 00,000,000 | --SD | C] -- C:\Users\Petia\AppData\Roaming\Microsoft

[2009.11.12 04:00:53 | 00,000,000 | R--D | C] -- C:\Users\Petia\Videos

[2009.11.12 04:00:53 | 00,000,000 | R--D | C] -- C:\Users\Petia\Saved Games

[2009.11.12 04:00:53 | 00,000,000 | R--D | C] -- C:\Users\Petia\Pictures

[2009.11.12 04:00:53 | 00,000,000 | R--D | C] -- C:\Users\Petia\Music

[2009.11.12 04:00:53 | 00,000,000 | R--D | C] -- C:\Users\Petia\Links

[2009.11.12 04:00:53 | 00,000,000 | R--D | C] -- C:\Users\Petia\Favorites

[2009.11.12 04:00:53 | 00,000,000 | R--D | C] -- C:\Users\Petia\Downloads

[2009.11.12 04:00:53 | 00,000,000 | R--D | C] -- C:\Users\Petia\Documents

[2009.11.12 04:00:53 | 00,000,000 | R--D | C] -- C:\Users\Petia\Desktop

[2009.11.12 04:00:53 | 00,000,000 | -H-D | C] -- C:\Users\Petia\AppData

[2009.11.12 04:00:53 | 00,000,000 | ---D | C] -- C:\Users\Petia\AppData\Local\Temp

[2009.11.12 04:00:53 | 00,000,000 | ---D | C] -- C:\Users\Petia\AppData\Local\Microsoft

[2009.11.12 04:00:07 | 00,000,000 | ---D | C] -- C:\Windows\Debug

[2009.11.12 03:56:28 | 00,000,000 | ---D | C] -- C:\Windows\SoftwareDistribution

[2009.11.12 03:53:36 | 00,000,000 | ---D | C] -- C:\Windows\Prefetch

[2009.11.12 03:53:25 | 00,000,000 | -HSD | C] -- C:\System Volume Information

[2009.11.12 00:30:10 | 00,000,000 | ---D | C] -- C:\Users\Petia\AppData\Roaming\WinRAR

[2009.11.12 00:29:23 | 00,000,000 | ---D | C] -- C:\Program Files\WinRAR

[2009.11.12 00:23:05 | 00,000,000 | ---D | C] -- C:\Program Files\uTorrent

[2009.11.12 00:22:13 | 00,000,000 | ---D | C] -- C:\Users\Petia\AppData\Roaming\uTorrent

[2009.11.12 00:16:48 | 00,000,000 | ---D | C] -- C:\Program Files\Microsoft ActiveSync

[2009.11.12 00:16:46 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\DESIGNER

[2009.11.12 00:16:38 | 00,000,000 | ---D | C] -- C:\Windows\SHELLNEW

[2009.11.12 00:16:37 | 00,000,000 | ---D | C] -- C:\Windows\PCHEALTH

[2009.11.12 00:16:37 | 00,000,000 | ---D | C] -- C:\Program Files\Microsoft.NET

[2009.11.12 00:16:37 | 00,000,000 | ---D | C] -- C:\Program Files\Microsoft Office

[2009.11.12 00:12:56 | 00,000,000 | ---D | C] -- C:\ProgramData\DAEMON Tools Lite

[2009.11.12 00:12:56 | 00,000,000 | ---D | C] -- C:\ProgramData\DAEMON Tools Lite

[2009.11.12 00:12:39 | 00,000,000 | ---D | C] -- C:\Program Files\DAEMON Tools Toolbar

[2009.11.12 00:12:37 | 00,000,000 | ---D | C] -- C:\Program Files\DAEMON Tools Lite

[2009.11.12 00:10:21 | 00,000,000 | ---D | C] -- C:\Users\Petia\AppData\Roaming\DAEMON Tools Lite

[2009.11.12 00:09:50 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe AIR

[2009.11.12 00:09:48 | 00,000,000 | ---D | C] -- C:\Users\Petia\AppData\Roaming\Macromedia

[2009.11.12 00:09:11 | 00,000,000 | ---D | C] -- C:\ProgramData\Adobe

[2009.11.12 00:09:11 | 00,000,000 | ---D | C] -- C:\ProgramData\Adobe

[2009.11.12 00:09:10 | 00,000,000 | ---D | C] -- C:\Program Files\Adobe

[2009.11.12 00:07:33 | 00,000,000 | ---D | C] -- C:\Users\Petia\AppData\Roaming\Mozilla

[2009.11.12 00:07:33 | 00,000,000 | ---D | C] -- C:\Users\Petia\AppData\Local\Mozilla

[2009.11.12 00:07:26 | 00,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox

[2009.11.12 00:06:55 | 00,000,000 | ---D | C] -- C:\Windows\System32\Macromed

[2009.11.12 00:04:59 | 00,000,000 | ---D | C] -- C:\Users\Petia\Documents\GomPlayer

[2009.11.12 00:04:59 | 00,000,000 | ---D | C] -- C:\Users\Petia\AppData\Roaming\GRETECH

[2009.11.12 00:04:42 | 00,000,000 | ---D | C] -- C:\Program Files\GRETECH

[2009.11.12 00:04:03 | 00,000,000 | ---D | C] -- C:\Program Files\K-Lite Codec Pack

[2009.11.11 23:53:25 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe

[2009.11.11 23:53:24 | 00,000,000 | ---D | C] -- C:\Users\Petia\AppData\Roaming\Adobe

[2009.11.11 23:50:20 | 00,000,000 | ---D | C] -- C:\Users\Petia\AppData\Roaming\Skype

[2009.11.11 23:50:15 | 00,000,000 | R--D | C] -- C:\Program Files\Skype

[2009.11.11 23:50:15 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype

[2009.11.11 23:50:08 | 00,000,000 | ---D | C] -- C:\ProgramData\Skype

[2009.11.11 23:50:08 | 00,000,000 | ---D | C] -- C:\ProgramData\Skype

[2009.11.11 23:35:41 | 00,000,000 | ---D | C] -- C:\ProgramData\Downloaded Installations

[2009.11.11 23:35:41 | 00,000,000 | ---D | C] -- C:\ProgramData\Downloaded Installations

[2009.11.11 23:21:19 | 00,000,000 | -H-D | C] -- C:\Program Files\InstallShield Installation Information

[2009.11.11 23:20:42 | 00,000,000 | ---D | C] -- C:\Program Files\Synaptics

[2009.11.11 23:19:32 | 00,000,000 | ---D | C] -- C:\Windows\System32\Lang

[2009.11.11 23:18:26 | 00,053,248 | ---- | C] (Windows XP Bundled build C-Centric Single User) -- C:\Windows\System32\CSVer.dll

[2009.11.11 23:18:26 | 00,000,000 | ---D | C] -- C:\Program Files\Intel

[2009.11.11 23:18:21 | 00,000,000 | ---D | C] -- C:\Intel

[2009.11.11 23:17:45 | 00,000,000 | ---D | C] -- C:\Program Files\Hewlett-Packard

[2009.11.11 23:17:33 | 00,000,000 | -HSD | C] -- C:\Windows\Installer

[2009.11.11 23:16:44 | 00,000,000 | ---D | C] -- C:\Program Files\CONEXANT

[2009.11.11 23:16:17 | 00,000,000 | ---D | C] -- C:\swsetup

========== Files - Modified Within 14 Days ==========

[2009.11.17 22:48:12 | 01,048,576 | ---- | M] () -- C:\Users\Petia\NTUSER.DAT

[2009.11.17 22:46:19 | 00,004,784 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

[2009.11.17 22:46:19 | 00,004,784 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

[2009.11.17 22:46:18 | 00,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT

[2009.11.17 22:46:15 | 00,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2009.11.17 22:45:39 | 00,524,288 | -HS- | M] () -- C:\Users\Petia\NTUSER.DAT{95bfbcd6-d157-11de-aa28-001b38ec6abf}.TMContainer00000000000000000001.regtrans-ms

[2009.11.17 22:45:39 | 00,065,536 | -HS- | M] () -- C:\Users\Petia\NTUSER.DAT{95bfbcd6-d157-11de-aa28-001b38ec6abf}.TM.blf

[2009.11.17 22:37:26 | 00,868,323 | ---- | M] () -- C:\Users\Petia\Desktop\sreng2.zip

[2009.11.17 22:35:02 | 00,690,960 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI

[2009.11.17 22:35:02 | 00,587,178 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2009.11.17 22:35:02 | 00,101,250 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[2009.11.17 22:27:54 | 02,161,706 | -H-- | M] () -- C:\Users\Petia\AppData\Local\IconCache.db

[2009.11.17 21:02:23 | 00,002,537 | ---- | M] () -- C:\Users\Public\Desktop\SA Dictionary 2008 Beta 4.lnk

[2009.11.17 19:18:00 | 00,001,066 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1028737740-397911081-13709980-1000UA.job

[2009.11.17 19:11:23 | 00,529,408 | ---- | M] (OldTimer Tools) -- C:\Users\Petia\Desktop\OTL.exe

[2009.11.17 12:35:43 | 00,007,168 | ---- | M] () -- C:\Users\Petia\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2009.11.17 08:27:03 | 00,001,014 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1028737740-397911081-13709980-1000Core.job

[2009.11.16 23:53:40 | 00,001,847 | ---- | M] () -- C:\Users\Public\Desktop\Avira AntiVir Control Center.lnk

[2009.11.16 22:28:56 | 03,560,773 | R--- | M] () -- C:\Users\Petia\Desktop\tool.exe.exe

[2009.11.16 22:25:44 | 00,132,752 | ---- | M] () -- C:\Users\Petia\Documents\Проблем с AVG и Виста - kaldata_com - Форуми.htm

[2009.11.16 22:07:55 | 03,484,528 | ---- | M] (OPSWAT, Inc.) -- C:\Users\Petia\Desktop\AppRemover.exe

[2009.11.15 17:48:58 | 00,000,633 | ---- | M] () -- C:\Users\Petia\Documents\Виж темата - Правилният начин за деинсталиране-преинсталиране на AVG • Форуми за софтуер на Бизнес Софтуер Дистрибутор.mht

[2009.11.15 08:59:54 | 00,042,592 | ---- | M] () -- C:\Users\Petia\AppData\Local\GDIPFONTCACHEV1.DAT

[2009.11.15 00:13:46 | 00,002,042 | ---- | M] () -- C:\Users\Petia\Desktop\Google Chrome.lnk

[2009.11.14 23:00:45 | 00,200,936 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT

[2009.11.14 22:59:16 | 00,524,288 | -HS- | M] () -- C:\Users\Petia\NTUSER.DAT{95bfbcd6-d157-11de-aa28-001b38ec6abf}.TMContainer00000000000000000002.regtrans-ms

[2009.11.14 22:14:32 | 00,524,288 | -HS- | M] () -- C:\Users\Petia\NTUSER.DAT{d8932e6d-6a6f-11db-b6ab-a038f15a5785}.TMContainer00000000000000000001.regtrans-ms

[2009.11.14 22:14:32 | 00,065,536 | -HS- | M] () -- C:\Users\Petia\NTUSER.DAT{d8932e6d-6a6f-11db-b6ab-a038f15a5785}.TM.blf

[2009.11.14 20:51:50 | 00,000,466 | ---- | M] () -- C:\Windows\wininit.ini

[2009.11.14 12:52:57 | 00,001,254 | ---- | M] () -- C:\Users\Petia\Desktop\PhotoshopCS3portable.lnk

[2009.11.14 01:47:57 | 00,260,608 | ---- | M] () -- C:\Windows\PEV.exe

[2009.11.12 23:08:20 | 00,006,455 | ---- | M] () -- C:\Users\Petia\Documents\Моята предпочитана тема.theme

[2009.11.12 22:45:43 | 00,093,360 | ---- | M] (Sunbelt Software) -- C:\Windows\System32\drivers\SBREDrv.sys

[2009.11.12 22:24:10 | 00,000,786 | ---- | M] () -- C:\Users\Public\Desktop\Winamp.lnk

[2009.11.12 22:19:08 | 00,001,057 | ---- | M] () -- C:\Users\Petia\Desktop\Revo Uninstaller.lnk

[2009.11.12 22:04:46 | 00,001,770 | ---- | M] () -- C:\Users\Petia\Desktop\Windows Calendar.lnk

[2009.11.12 21:13:49 | 00,001,670 | ---- | M] () -- C:\Users\Petia\Desktop\CCleaner.lnk

[2009.11.12 20:35:24 | 00,024,206 | ---- | M] () -- C:\Users\Petia\AppData\Roaming\UserTile.png

[2009.11.12 13:52:14 | 00,008,192 | R-S- | M] () -- C:\BOOTSECT.BAK

[2009.11.12 08:25:25 | 00,000,871 | ---- | M] () -- C:\Users\Petia\Desktop\Nero Burning ROM.lnk

[2009.11.12 08:24:39 | 00,002,609 | ---- | M] () -- C:\Users\Petia\Desktop\Microsoft Office Word 2003.lnk

[2009.11.12 08:24:24 | 00,002,044 | ---- | M] () -- C:\Users\Petia\Desktop\Microsoft Office Excel 2003.lnk

[2009.11.12 08:22:03 | 00,001,840 | ---- | M] () -- C:\Users\Public\Desktop\CyberLink PowerDVD 8.lnk

[2009.11.12 04:00:53 | 00,000,020 | -HS- | M] () -- C:\Users\Petia\ntuser.ini

[2009.11.12 03:57:21 | 00,137,357 | ---- | M] () -- C:\Windows\System32\license.rtf

[2009.11.12 00:42:47 | 00,171,136 | RHS- | M] () -- C:\grldr

[2009.11.12 00:23:07 | 00,000,752 | ---- | M] () -- C:\Users\Public\Desktop\µTorrent.lnk

[2009.11.12 00:17:38 | 00,000,376 | ---- | M] () -- C:\Windows\ODBC.INI

[2009.11.12 00:17:22 | 00,000,240 | ---- | M] () -- C:\Windows\win.ini

[2009.11.12 00:12:38 | 00,001,735 | ---- | M] () -- C:\Users\Public\Desktop\DAEMON Tools Lite.lnk

[2009.11.12 00:10:22 | 00,721,904 | ---- | M] () -- C:\Windows\System32\drivers\sptd.sys

[2009.11.12 00:07:36 | 00,000,000 | ---- | M] () -- C:\Windows\nsreg.dat

[2009.11.12 00:07:29 | 00,001,724 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk

[2009.11.12 00:04:50 | 00,000,902 | ---- | M] () -- C:\Users\Public\Desktop\GOM Player.lnk

[2009.11.11 23:50:15 | 00,001,878 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk

[2009.11.11 23:30:20 | 00,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_00_00.Wdf

[2009.11.11 23:24:49 | 00,016,052 | ---- | M] () -- C:\Windows\System32\results.xml

[2009.11.11 23:23:22 | 00,524,288 | -HS- | M] () -- C:\Users\Petia\NTUSER.DAT{d8932e6d-6a6f-11db-b6ab-a038f15a5785}.TMContainer00000000000000000002.regtrans-ms

[2009.11.11 23:20:55 | 00,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_Kernel_SynTP_01000.Wdf

[2009.11.11 23:17:50 | 00,000,000 | RHS- | M] () -- C:\Windows\System32\drivers\103C_HP_bNB_530 Notebook PC(KP479AA#AB9)_Y5336AN_0U_QCND8071F3M_EU_4A_I30D5_SHP_V82.15_68MVU F.06_T071210_WVH1_L402_M3063_J320_7Intel_86EC_92.17_#091111_N80861068;80864222_(KP479AA#AB9)_XMOBILE_CN10_Z_2F.06.MRK

========== Files Created - No Company Name ==========

[2009.11.17 22:37:26 | 00,868,323 | ---- | C] () -- C:\Users\Petia\Desktop\sreng2.zip

[2009.11.16 23:53:40 | 00,001,847 | ---- | C] () -- C:\Users\Public\Desktop\Avira AntiVir Control Center.lnk

[2009.11.16 22:32:54 | 00,260,608 | ---- | C] () -- C:\Windows\PEV.exe

[2009.11.16 22:32:54 | 00,098,816 | ---- | C] () -- C:\Windows\sed.exe

[2009.11.16 22:32:54 | 00,080,412 | ---- | C] () -- C:\Windows\grep.exe

[2009.11.16 22:32:54 | 00,077,312 | ---- | C] () -- C:\Windows\MBR.exe

[2009.11.16 22:32:54 | 00,068,096 | ---- | C] () -- C:\Windows\zip.exe

[2009.11.16 22:28:56 | 03,560,773 | R--- | C] () -- C:\Users\Petia\Desktop\tool.exe.exe

[2009.11.16 22:25:36 | 00,132,752 | ---- | C] () -- C:\Users\Petia\Documents\Проблем с AVG и Виста - kaldata_com - Форуми.htm

[2009.11.15 18:32:22 | 00,007,168 | ---- | C] () -- C:\Users\Petia\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2009.11.15 17:48:58 | 00,000,633 | ---- | C] () -- C:\Users\Petia\Documents\Виж темата - Правилният начин за деинсталиране-преинсталиране на AVG • Форуми за софтуер на Бизнес Софтуер Дистрибутор.mht

[2009.11.15 08:59:54 | 00,042,592 | ---- | C] () -- C:\Users\Petia\AppData\Local\GDIPFONTCACHEV1.DAT

[2009.11.15 00:13:46 | 00,002,042 | ---- | C] () -- C:\Users\Petia\Desktop\Google Chrome.lnk

[2009.11.14 22:15:49 | 00,524,288 | -HS- | C] () -- C:\Users\Petia\NTUSER.DAT{95bfbcd6-d157-11de-aa28-001b38ec6abf}.TMContainer00000000000000000002.regtrans-ms

[2009.11.14 22:15:49 | 00,524,288 | -HS- | C] () -- C:\Users\Petia\NTUSER.DAT{95bfbcd6-d157-11de-aa28-001b38ec6abf}.TMContainer00000000000000000001.regtrans-ms

[2009.11.14 22:15:49 | 00,065,536 | -HS- | C] () -- C:\Users\Petia\NTUSER.DAT{95bfbcd6-d157-11de-aa28-001b38ec6abf}.TM.blf

[2009.11.14 20:51:25 | 00,000,466 | ---- | C] () -- C:\Windows\wininit.ini

[2009.11.14 20:21:58 | 02,161,706 | -H-- | C] () -- C:\Users\Petia\AppData\Local\IconCache.db

[2009.11.12 23:08:20 | 00,006,455 | ---- | C] () -- C:\Users\Petia\Documents\Моята предпочитана тема.theme

[2009.11.12 22:28:24 | 00,002,537 | ---- | C] () -- C:\Users\Public\Desktop\SA Dictionary 2008 Beta 4.lnk

[2009.11.12 22:24:10 | 00,000,786 | ---- | C] () -- C:\Users\Public\Desktop\Winamp.lnk

[2009.11.12 22:19:08 | 00,001,057 | ---- | C] () -- C:\Users\Petia\Desktop\Revo Uninstaller.lnk

[2009.11.12 22:14:18 | 00,001,066 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1028737740-397911081-13709980-1000UA.job

[2009.11.12 22:14:17 | 00,001,014 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1028737740-397911081-13709980-1000Core.job

[2009.11.12 22:04:46 | 00,001,770 | ---- | C] () -- C:\Users\Petia\Desktop\Windows Calendar.lnk

[2009.11.12 21:13:49 | 00,001,670 | ---- | C] () -- C:\Users\Petia\Desktop\CCleaner.lnk

[2009.11.12 20:35:24 | 00,024,206 | ---- | C] () -- C:\Users\Petia\AppData\Roaming\UserTile.png

[2009.11.12 13:52:14 | 00,008,192 | R-S- | C] () -- C:\BOOTSECT.BAK

[2009.11.12 13:52:13 | 00,332,497 | RHS- | C] () -- C:\bootmgr

[2009.11.12 08:25:25 | 00,000,871 | ---- | C] () -- C:\Users\Petia\Desktop\Nero Burning ROM.lnk

[2009.11.12 08:24:36 | 00,002,609 | ---- | C] () -- C:\Users\Petia\Desktop\Microsoft Office Word 2003.lnk

[2009.11.12 08:24:24 | 00,002,044 | ---- | C] () -- C:\Users\Petia\Desktop\Microsoft Office Excel 2003.lnk

[2009.11.12 08:22:03 | 00,001,840 | ---- | C] () -- C:\Users\Public\Desktop\CyberLink PowerDVD 8.lnk

[2009.11.12 04:00:53 | 01,048,576 | ---- | C] () -- C:\Users\Petia\NTUSER.DAT

[2009.11.12 04:00:53 | 00,524,288 | -HS- | C] () -- C:\Users\Petia\NTUSER.DAT{d8932e6d-6a6f-11db-b6ab-a038f15a5785}.TMContainer00000000000000000002.regtrans-ms

[2009.11.12 04:00:53 | 00,524,288 | -HS- | C] () -- C:\Users\Petia\NTUSER.DAT{d8932e6d-6a6f-11db-b6ab-a038f15a5785}.TMContainer00000000000000000001.regtrans-ms

[2009.11.12 04:00:53 | 00,065,536 | -HS- | C] () -- C:\Users\Petia\NTUSER.DAT{d8932e6d-6a6f-11db-b6ab-a038f15a5785}.TM.blf

[2009.11.12 04:00:53 | 00,000,020 | -HS- | C] () -- C:\Users\Petia\ntuser.ini

[2009.11.12 00:31:07 | 00,171,136 | RHS- | C] () -- C:\grldr

[2009.11.12 00:23:07 | 00,000,752 | ---- | C] () -- C:\Users\Public\Desktop\µTorrent.lnk

[2009.11.12 00:17:38 | 00,000,376 | ---- | C] () -- C:\Windows\ODBC.INI

[2009.11.12 00:12:38 | 00,001,735 | ---- | C] () -- C:\Users\Public\Desktop\DAEMON Tools Lite.lnk

[2009.11.12 00:10:21 | 00,721,904 | ---- | C] () -- C:\Windows\System32\drivers\sptd.sys

[2009.11.12 00:07:36 | 00,000,000 | ---- | C] () -- C:\Windows\nsreg.dat

[2009.11.12 00:07:29 | 00,001,724 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk

[2009.11.12 00:04:50 | 00,000,902 | ---- | C] () -- C:\Users\Public\Desktop\GOM Player.lnk

[2009.11.12 00:04:04 | 00,178,176 | ---- | C] () -- C:\Windows\System32\unrar.dll

[2009.11.11 23:53:48 | 00,001,254 | ---- | C] () -- C:\Users\Petia\Desktop\PhotoshopCS3portable.lnk

[2009.11.11 23:50:15 | 00,001,878 | ---- | C] () -- C:\Users\Public\Desktop\Skype.lnk

[2009.11.11 23:30:20 | 00,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_00_00.Wdf

[2009.11.11 23:25:02 | 00,000,000 | ---- | C] () -- C:\Users\Petia\AppData\Local\QSwitch.txt

[2009.11.11 23:24:49 | 00,016,052 | ---- | C] () -- C:\Windows\System32\results.xml

[2009.11.11 23:20:55 | 00,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_Kernel_SynTP_01000.Wdf

[2009.11.11 23:17:50 | 00,000,000 | RHS- | C] () -- C:\Windows\System32\drivers\103C_HP_bNB_530 Notebook PC(KP479AA#AB9)_Y5336AN_0U_QCND8071F3M_EU_4A_I30D5_SHP_V82.15_68MVU F.06_T071210_WVH1_L402_M3063_J320_7Intel_86EC_92.17_#091111_N80861068;80864222_(KP479AA#AB9)_XMOBILE_CN10_Z_2F.06.MRK

[2009.01.05 15:44:10 | 00,000,453 | ---- | C] () -- C:\Windows\bdoscandellang.ini

[2007.08.25 01:46:48 | 00,147,456 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1322.dll

[2007.08.25 01:28:04 | 00,249,856 | ---- | C] () -- C:\Windows\System32\igfxTMM.dll

[2006.11.02 14:48:00 | 00,000,174 | -HS- | C] () -- C:\Program Files\desktop.ini

[2006.11.02 14:35:51 | 00,030,808 | ---- | C] () -- C:\Windows\Fonts\GlobalUserInterface.CompositeFont

[2006.11.02 14:35:51 | 00,029,779 | ---- | C] () -- C:\Windows\Fonts\GlobalSerif.CompositeFont

[2006.11.02 14:35:51 | 00,026,489 | ---- | C] () -- C:\Windows\Fonts\GlobalSansSerif.CompositeFont

[2006.11.02 14:35:51 | 00,026,040 | ---- | C] () -- C:\Windows\Fonts\GlobalMonospace.CompositeFont

[2006.11.02 12:23:31 | 00,000,240 | ---- | C] () -- C:\Windows\win.ini

[2006.11.02 12:23:31 | 00,000,219 | ---- | C] () -- C:\Windows\system.ini

[2006.11.02 09:40:29 | 00,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini

[2006.03.09 09:58:00 | 01,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll

[2003.01.07 15:05:08 | 00,002,695 | ---- | C] () -- C:\Windows\System32\OUTLPERF.INI

========== LOP Check ==========

[2009.11.12 00:14:16 | 00,000,000 | ---D | M] -- C:\Users\Petia\AppData\Roaming\DAEMON Tools Lite

[2009.11.14 22:07:36 | 00,000,000 | ---D | M] -- C:\Users\Petia\AppData\Roaming\iExpert Software

[2009.11.17 17:40:26 | 00,000,000 | ---D | M] -- C:\Users\Petia\AppData\Roaming\uTorrent

[2009.11.17 22:46:18 | 00,000,006 | -H-- | M] () -- C:\Windows\Tasks\SA.DAT

[2009.11.17 22:45:40 | 00,032,608 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

< End of report >

P.S. Проблемът с GOM player си стои.

Редактирано от snejanal (преглед на промените)

Този проблем само при GOM Player ли се появява?

Стъпка 1:

Обновете ръчно MalwareBytes' Anti-Malware и пуснете Бързо сканиране (Quick Scan).

Стъпка 2:

gmer_zip.gif

Изтеглете GMER Rootkit Scanner. Разархивирайте го на вашия десктоп.

Преди да сканирате се уверете, че всички останали работещи програми в момента са изключени и вашия антивирусен софтуер няма да предприема никакви действия по време на сканирането на Gmer. Не използвайте компютъра си, докато трае сканирането.

Преименувайте GMER.exe на Tool.exe и кликнете два пъти пъти върху Tool.exe , за да стартирате програмата.

Внимание: Сканирането може да доведе до грешки, затова не предприемайте никакви действия върху редовете маркирани с "<--- ROOKIT" без да съм Ви посочил да го направите.

Ако е открита активност на rootkit ще бъдете попитани дали желаете да бъде направено пълно сканиране на системата.

  • Изберете NO.
  • В десния панел ще видите какво е било проверено, нека всичко си остане така. Необходимо е само да се уверите, че пред "Show All" няма отметка.
  • Сега кликнете върху бутона Scan .

След като сканирането приключи е възможно да получите информация за друга rootkit активност.

  • Изберете OK .
  • Gmer ще Ви отвори лог файла. Кликнете на бутона Save... и в полето за име на файла, напишете Gmer.txt .
  • Запишете лог файла на вашия десктоп.

Стъпка 3:

Изтеглете ComboFix от някой от следните линкове:

Линк 1

Линк 2

* ВАЖНО !!! Запазете ComboFix.exe на вашия десктоп

  • Изключете вашата антивирусна и антишпионска програма, обикновено това става чрез натискане на десния бутон на мишката върху иконата на програма в системния трей.

Бележка: Ако не можете я спрете или не сте сигурни коя програма да изключите, моля прегледайте информацията от този линк: How to Disable your Security Programs

  • Стартирайте ComboFix.exe и следвайте инструкциите.

Бележка: ComboFix ще се стартира без инсталирана Recovery Console.

  • Като част от неговата работа, ComboFix ще провери дали Microsoft Windows Recovery Console е инсталирана. Предвид бързо развиващия се зловреден софтуер е силно препоръчително да бъде инсталирана преди премахването на зловредния софтуер. Това ще Ви позволи да влезете в специален recovery/repair режим, който ще ни позволи по-лесно да решите проблем, който би могъл да възникне при премахване на зловредния софтуер.

  • Следвайте инструкциите, за да позволите на ComboFix да изтегли и инсталира Microsoft Windows Recovery Console. В един момент ще бъдете попитани дали сте съгласни с лицензното споразумение. Необходимо е да потвърдите, че сте съгласни, за да инсталирате Microsoft Windows Recovery Console.

** Забележете: Ако Microsoft Windows Recovery Console е вече инсталирана, ComboFix ще продължи към процеса по премахване на зловредния софтуер.

RcAuto1.gif

След като Microsoft Windows Recovery Console е инсталирана, използвайки ComboFix, Вие ще видите следното съобщение:

whatnext.png

Изберете Yes, за да продължи сканирането за зловреден софтуер.

Когато процесът приключи успешно, инструментът ще създаде лог файл. Моля, включете съдържанието на C:\ComboFix.txt в следващия Ви коментар в тази тема.

Бележка:

  1. Моля, не движете мишката, докато ComboFix работи. Това може да наруши процеса на работа.
  2. ComboFix ще нулира всички настройки на Microsoft Internet Explorer, включително да направи IE браузър по подразбиране.
  3. ComboFix ще изключи autorun функцията на ВСИЧКИ CD, Floppy и USB устройства, за да помогне при премахването на зловредния софтуер и Ви защити от бъдещи вируси/заплахи, които поразяват чрез autorun. Ако това е проблем за вас - моля, уведомете ме.
  4. ComboFix ще изключи вашата интернет връзка. Интернет връзката ще се възстанови автоматично, преди ComboFix да завърши процеса на работа. При проблем, той ще прекрати интернет връзката. За да възстановите интернет връзката си, рестартирайте компютъра си.
  5. В случай на проблем с ComboFix, той може да създаде лог файл. Моля, включете съдържанието на C:\BUG.txt в следващия Ви коментар в тази тема.

Работата на ComboFix, може да отнеме до 20-30 минути, за да завърши, моля имайте търпение.

Моля, не прикачвайте лог файла/овете от програмата, а го/ги копирайте и поставете в следващия Ви коментар в тази тема.

П.П.: Забележете, този път не правете никакви редакции по името или разширението на файла.

  • Автор

Здравейте , имам нужда от няколко уточнения преди за започна за да не объркам нещо. За сега нямам наблюдения дали и друга програма реагира странно освен GOM Player , откакто се появи проблема не съм ползвала друго.Бих могла да тествам останалите програми и да отговоря допълнително.

MalwareBytes' Anti-Malware беше деинсталиран от АppRemover вчера , както вече писах.Пазя архивния файл.До колкото разбирам трябва да го инсталирам отново , но какво означава да го обновя ръчно - в смисъл да изтегля актуални ъпдейти ли?

Относно стъпка 2 -

Първо изтеглям GMER.exe , запазвам на десктопа , разархивирам , преименувам на Tool.exe и чак тогава сканирам. Така ли е ?

Имам и друг въпрос.На десктопа вече имам една икона Tool.exe Това е програмата ComboFix.exe , която изтеглих на 16.11.2009 заедно с AppRemover (има го в постовете от стр.1) , какво да правя в този случай.Трябва ли да деинсталирам ComboFix и ако да с какво и как.

Следващ въпрос.Изключила съм screen saver , но след известно време бездействие екрана на монитора угасва и се налага да натисна произволен клавиш за да го активирам.При сканиране с ComboFix не се пипа нищо.Какво да направя ако екрана заспи?

Моля да ме извините за въпросите , но предпочитам така отколото да направя нещо погрешно .

Благодаря за помощта и отделеното време, оценям го :)

Радвам се, че питате преди да действате!

Здравейте , имам нужда от няколко уточнения преди за започна за да не объркам нещо. За сега нямам наблюдения дали и друга програма реагира странно освен GOM Player , откакто се появи проблема не съм ползвала друго.Бих могла да тествам останалите програми и да отговоря допълнително.

Ще направим това по-късно в такъв случай.

MalwareBytes' Anti-Malware беше деинсталиран от АppRemover вчера , както вече писах.Пазя архивния файл.До колкото разбирам трябва да го инсталирам отново , но какво означава да го обновя ръчно - в смисъл да изтегля актуални ъпдейти ли?

В такъв случай, изпълнете инструкциите отново:

Изтеглете Malwarebytes' Anti-Malware от тук

Кликнете два пъти върху mbam-setup.exe за да инсталирате програмата.

  • * Уверете се, че има отметки на Update Malwarebytes' Anti-Malware и Launch Malwarebytes' Anti-Malware, след това кликнете на Finish.
    * Ако има намерени по-нови обновления, тя ще ги изтегли и инсталира.
    * Стартирайте програмата и изберете "Perform Quick Scan", след това кликнете на Scan.
    * Сканирането ще отнеме малко време, затова моля бъдете търпеливи.
    * Когато сканирането завърши, кликнете на OK, след това Show Results, за да видите резултата.
    * Уверете се, че на всички редове има отметки, и кликнете Remove Selected.
    * Когато всичко бъде премахнато, логът ще бъде отворен в Notepad. Копирайте лога и го публикувайте в следващия си коментар в темата.

Бележка: Ако MalwareBytes' Anti-Malware се затрудни в премахването на откритите вируси/заплахи, той ще поиска да рестартира компютъра Ви и по време на рестартирането да премахне проблемните вируси/заплахи. Ако бъдете попитани, потвърдете че желаете вашия компютър да бъде рестартиран.

Първо изтеглям GMER.exe , запазвам на десктопа , разархивирам , преименувам на Tool.exe и чак тогава сканирам. Така ли е ?

Точно така!

Имам и друг въпрос.На десктопа вече имам една икона Tool.exe Това е програмата ComboFix.exe , която изтеглих на 16.11.2009 заедно с AppRemover (има го в постовете от стр.1) , какво да правя в този случай.Трябва ли да деинсталирам ComboFix и ако да с какво и как.

Преименувайте го в такъв случай на Tool2.

Следващ въпрос.Изключила съм screen saver , но след известно време бездействие екрана на монитора угасва и се налага да натисна произволен клавиш за да го активирам.При сканиране с ComboFix не се пипа нищо.Какво да направя ако екрана заспи?

Най-вероятно компютърът ще се рестартира, така че ще разберете. :)

  • Автор

Здравейте отново . Стигнах до стъпка 2 , стартирах Tool2.exe . и 10 секунди по-късно се появи това съобщение по-долу :) Как да продължа? Да опитам ли отново?

post-203695-1258559719,09_thumb.jpg

  • Автор

Tака направих , но излезе съобщение ,че AVG е активна и трябва да я дезактивирам преди да продължа .Не го прикачам , защото на стр.1 вече го показах. Иде ми да изхвърля лаптопа през прозореца! Да му дам ли ОК за да продължи и да чакам лог файл или да го спра? Пиша от друг компютър , така , че по лаптопа нищо не е пипано и съобщението все още си виси там :)

Редактирано от snejanal (преглед на промените)

Изтрийте ръчно следните папки:

C:\ProgramData\avg9

C:\Program Files\AVG

След това, рестартирайте компютъра и следвайте инструкциите за използването на ComboFix отново.

  • Автор

Отново същия проблем ! ComboFix твърди , че AVG е активна :)

Регистрирайте се или влезете в профила си за да коментирате

Разглеждащи това в момента 0

  • Няма регистрирани потребители разглеждащи тази страница.

Дарение

  • Подкрепи съществуването на форума - направи дарение
    32%
    Дарени 315 € от нужните 1 000 €

Бюлетин

Получавайте известие, когато има важна промяна или новина свързана с форума.

Профил

Навигация

Търсене

Търсене

Конфигуриране на push известия в браузъра

Chrome (Android)
  1. Докоснете иконата на катинар до адресната лента.
  2. Докоснете Разрешения → Известия.
  3. Променете предпочитанията си.
Chrome (Desktop)
  1. Кликнете върху иконата на катинар в адресната лента.
  2. Изберете Настройки на сайта.
  3. Намерете Известия и коригирайте предпочитанията си.