Skype вирусен проблем

16 декември 200916 г.

@lubo55

СТЪПКА 1

Изтеглете този файл и го стартирайте.

Следвайте инструкциите.

Публикувайте лог файла.

СТЪПКА 2

Моля, отворете Notepad.exe и с copy/paste въведете следната информация:

KILLALL::

File::

c:\program files\vgajeldrhvddtdpevzgtyvgzkgrlupwocsgoo.oap

c:\program files\deonyvdhnrpfllnsztqtobclmyz.itq

c:\program files\qebnlvqharcfylasmtdtbbplzymjvtdypizkngti.ubl

c:\program files\bqobalhztlxbvjzsnvgxghwtiixvihsogaseicqgz.cne

c:\program files\amhrnvodujstkviyqvdrxvhbnkwrbxfynetcdu.sia

Folder::

c:\program files\Ask.com

Registry::

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

"{9CB65206-89C4-402c-BA80-02D8C59F9B1D}"=-

[-HKEY_CLASSES_ROOT\clsid\{9cb65206-89c4-402c-ba80-02d8c59f9b1d}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{D4027C7F-154A-4066-A1AD-4243D8127440}"=-

[-HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]

-[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]

[-HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]

[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"beqredn"=-

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

"quhjxxip"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"uudb"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

"deony"=-

[HKEY_LOCAL_MACHINE\software\microsoft\windows\Currentversion\policies\explorer\Run]

"oqbbnl"=-

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uudb]

Firefox::

FF - prefs.js: browser.search.selectedEngine - Ask.com

Запазете файла с име CFScript (както е на картинката) и го провлачете и го пуснете в Combofix.

Това ще стартира Combofix още веднъж. Моля не местете мишката, не натискайте клавиши от клавиатурата по време на проверката.

След рестарта, ще се създаде нов лог файл. Публикувайте го в следващия си пост.

http://file.bg/c32888yWdUt .Това са файловете от сканирането през OTL на мой приятел.

Стартирайте OTL.exe и copy/paste под колонката "Custom Scans/Fixes" въведете това:

:OTL

PRC - [2009.12.16 09:57:33 | 00,512,000 | RHS- | M] () -- C:\WINDOWS\system32\reaqizmgwpkqlljlkj.exe

PRC - [2009.12.15 20:12:34 | 00,741,376 | ---- | M] () -- C:\Documents and Settings\Admin\Local Settings\Temp\eenqv.exe

PRC - [2008.04.14 02:12:19 | 01,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe

O4 - HKLM..\Run: [cepubhj] C:\WINDOWS\System32\pecuohwskfckhjjnophd.exe ()

O4 - HKLM..\Run: [MyWebSearch Plugin] C:\PROGRA~1\MYWEBS~1\bar\2.bin\M3PLUGIN.DLL File not found

O4 - HKLM..\Run: [sarcpbjyjxnoe] C:\Documents and Settings\Admin\Local Settings\Temp\cqnexpdypjfmijilllc.exe ()

O4 - HKCU..\Run: [bgucmvamuf] C:\WINDOWS\System32\eutmhbrohdbkilmrtvolw.exe ()

O4 - HKCU..\Run: [cepubhj] C:\Documents and Settings\Admin\Local Settings\Temp\reaqizmgwpkqlljlkj.exe ()

O4 - HKCU..\Run: [WhenUSave] C:\Program Files\Save\Save.exe File not found

O4 - HKLM..\RunOnce: [rugmubeo] C:\WINDOWS\System32\eutmhbrohdbkilmrtvolw.exe ()

O4 - HKLM..\RunOnce: [taqamxescpee] C:\Documents and Settings\Admin\Local Settings\Temp\eutmhbrohdbkilmrtvolw.exe ()

O4 - HKCU..\RunOnce: [rugmubeo] C:\Documents and Settings\Admin\Local Settings\Temp\reaqizmgwpkqlljlkj.exe ()

O4 - HKCU..\RunOnce: [wcralvboxjx] C:\WINDOWS\System32\pecuohwskfckhjjnophd.exe ()

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: imzgpxbmt = pecuohwskfckhjjnophd.exe ()

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: pqaekp = C:\DOCUME~1\Admin\LOCALS~1\Temp\iupevlxqfxrwqpmnl.exe ()

O32 - AutoRun File - [2009.12.16 19:27:51 | 00,000,828 | RHS- | M] () - C:\autorun.inf -- [ NTFS ]

O32 - AutoRun File - [2009.12.16 19:27:52 | 00,000,814 | RHS- | M] () - D:\autorun.inf -- [ NTFS ]

O32 - AutoRun File - [2009.12.16 19:27:52 | 00,000,836 | RHS- | M] () - E:\autorun.inf -- [ NTFS ]

O32 - AutoRun File - [2009.12.16 19:27:53 | 00,000,853 | RHS- | M] () - F:\autorun.inf -- [ NTFS ]

O33 - MountPoints2\{80f1ef57-7a84-11dd-9d72-806d6172696f}\Shell\AutoRun\command - "" = C:\bgucmvamuf.bat -- [2009.04.15 04:35:55 | 00,512,000 | RHS- | M] ()

O33 - MountPoints2\{80f1ef57-7a84-11dd-9d72-806d6172696f}\Shell\explore\Command - "" = C:\tcuguhqgshyarn.bat -- [2009.06.09 09:07:15 | 00,512,000 | RHS- | M] ()

O33 - MountPoints2\{80f1ef57-7a84-11dd-9d72-806d6172696f}\Shell\open\Command - "" = C:\taqamxescpee.bat -- [2009.03.07 07:46:01 | 00,512,000 | RHS- | M] ()

O33 - MountPoints2\{80f1ef58-7a84-11dd-9d72-806d6172696f}\Shell\AutoRun\command - "" = D:\bgucmvamuf.bat -- [2009.04.19 05:30:18 | 00,512,000 | RHS- | M] ()

O33 - MountPoints2\{80f1ef58-7a84-11dd-9d72-806d6172696f}\Shell\explore\Command - "" = D:\tcuguhqgshyarn.bat -- [2009.07.12 12:34:51 | 00,512,000 | RHS- | M] ()

O33 - MountPoints2\{80f1ef58-7a84-11dd-9d72-806d6172696f}\Shell\open\Command - "" = D:\taqamxescpee.bat -- [2009.03.06 03:14:44 | 00,512,000 | RHS- | M] ()

O33 - MountPoints2\{80f1ef59-7a84-11dd-9d72-806d6172696f}\Shell\AutoRun\command - "" = E:\bgucmvamuf.bat -- [2009.02.17 04:20:41 | 00,512,000 | RHS- | M] ()

O33 - MountPoints2\{80f1ef59-7a84-11dd-9d72-806d6172696f}\Shell\explore\Command - "" = E:\tcuguhqgshyarn.bat -- [2009.04.08 11:28:25 | 00,512,000 | RHS- | M] ()

O33 - MountPoints2\{80f1ef59-7a84-11dd-9d72-806d6172696f}\Shell\open\Command - "" = E:\taqamxescpee.bat -- [2009.12.16 19:27:52 | 00,512,000 | RHS- | M] ()

O33 - MountPoints2\{80f1ef5a-7a84-11dd-9d72-806d6172696f}\Shell\AutoRun\command - "" = F:\bgucmvamuf.bat -- [2009.07.12 12:04:12 | 00,512,000 | RHS- | M] ()

O33 - MountPoints2\{80f1ef5a-7a84-11dd-9d72-806d6172696f}\Shell\explore\Command - "" = F:\tcuguhqgshyarn.bat -- [2009.06.20 11:44:05 | 00,512,000 | RHS- | M] ()

O33 - MountPoints2\{80f1ef5a-7a84-11dd-9d72-806d6172696f}\Shell\open\Command - "" = F:\taqamxescpee.bat -- [2009.07.15 08:18:30 | 00,512,000 | RHS- | M] ()

O33 - MountPoints2\{e0a3bf62-87c0-11dd-a06d-00e04d445b7d}\Shell\Auto\command - "" = L:\new.exe -- File not found

:files

C:\WINDOWS\System32\sarcpbjyjxnoezspjdodgeefufnepcowlwk.brm

C:\WINDOWS\sarcpbjyjxnoezspjdodgeefufnepcowlwk.brm

C:\Program Files\sarcpbjyjxnoezspjdodgeefufnepcowlwk.brm

C:\Documents and Settings\Admin\Local Settings\Application Data\sarcpbjyjxnoezspjdodgeefufnepcowlwk.brm

C:\WINDOWS\omtuxzxcdhnekverblmrkyofk.jqr

C:\Program Files\omtuxzxcdhnekverblmrkyofk.jqr

C:\Documents and Settings\Admin\Local Settings\Application Data\omtuxzxcdhnekverblmrkyofk.jqr

C:\WINDOWS\System32\omtuxzxcdhnekverblmrkyofk.jqr

C:\WINDOWS\System32\bmgukzkcqhaexvrrolzrxybfxlwqeujumarkoh.bby

C:\WINDOWS\bmgukzkcqhaexvrrolzrxybfxlwqeujumarkoh.bby

C:\Program Files\bmgukzkcqhaexvrrolzrxybfxlwqeujumarkoh.bby

C:\Documents and Settings\Admin\Local Settings\Application Data\bmgukzkcqhaexvrrolzrxybfxlwqeujumarkoh.bby

C:\WINDOWS\vmmgcxomgdcmlprxadxvho.exe

C:\WINDOWS\reaqizmgwpkqlljlkj.exe

C:\WINDOWS\pecuohwskfckhjjnophd.exe

C:\WINDOWS\iupevlxqfxrwqpmnl.exe

C:\WINDOWS\eutmhbrohdbkilmrtvolw.exe

C:\WINDOWS\cqnexpdypjfmijilllc.exe

C:\WINDOWS\bmgukzkcqhaexvrr.exe

C:\WINDOWS\System32\iupevlxqfxrwqpmnljyryaejcrdyneugzogafzy.wus

C:\WINDOWS\iupevlxqfxrwqpmnljyryaejcrdyneugzogafzy.wus

C:\Program Files\iupevlxqfxrwqpmnljyryaejcrdyneugzogafzy.wus

C:\Documents and Settings\Admin\Local Settings\Application Data\iupevlxqfxrwqpmnljyryaejcrdyneugzogafzy.wus

C:\autorun.inf

C:\WINDOWS\System32\vmmgcxomgdcmlprxadxvho.exe

C:\WINDOWS\System32\pecuohwskfckhjjnophd.exe

C:\WINDOWS\System32\iupevlxqfxrwqpmnl.exe

C:\WINDOWS\System32\cqnexpdypjfmijilllc.exe

C:\WINDOWS\System32\bmgukzkcqhaexvrr.exe

C:\WINDOWS\System32\eutmhbrohdbkilmrtvolw.exe

C:\WINDOWS\System32\reaqizmgwpkqlljlkj.exe

C:\WINDOWS\tcuguhqgshyarnhfavhxbabdtfogsgtcsetk.dzt

C:\WINDOWS\System32\tcuguhqgshyarnhfavhxbabdtfogsgtcsetk.dzt

C:\Program Files\tcuguhqgshyarnhfavhxbabdtfogsgtcsetk.dzt

C:\Documents and Settings\Admin\Local Settings\Application Data\tcuguhqgshyarnhfavhxbabdtfogsgtcsetk.dzt

C:\WINDOWS\System32\klipxm32.dll

:Commands

[purity]

[emptytemp]

[resethosts]

[Reboot]

Натиснете бутона Run Fix

Ще се създаде лог файл. Копирайте го в следващия си пост.

Някой ще каже ли какво трябва да copy/paste от моите log файлове ?

Стартирайте OTL.exe и copy/paste под колонката "Custom Scans/Fixes" въведете това:

:OTL

PRC - C:\WINDOWS\system32\zmmbuljepkvzjghsuez.exe ()

PRC - C:\Documents and Settings\Mariqn\Local Settings\Temp\zaorydp.exe ()

O4 - HKLM..\Run: [mmzbhl] C:\WINDOWS\System32\yifrhvqiqiqrysqy.exe ()

O4 - HKLM..\Run: [qwpxjtkycqur] C:\Documents and Settings\Mariqn\Local Settings\Temp\oaznfvsmwqadmiistc.exe ()

O4 - HKU\S-1-5-21-1123561945-73586283-1606980848-1003..\Run: [fiydmthst] C:\WINDOWS\System32\yifrhvqiqiqrysqy.exe ()

O4 - HKU\S-1-5-21-1123561945-73586283-1606980848-1003..\Run: [mmzbhl] C:\Documents and Settings\Mariqn\Local Settings\Temp\fqobshdwfyhjrmluu.exe ()

O4 - HKLM..\RunOnce: [tyqxirhuxkn] C:\Documents and Settings\Mariqn\Local Settings\Temp\mabrldcykgsxigiuxieq.exe ()

O4 - HKLM..\RunOnce: [zaorydp] C:\WINDOWS\System32\mabrldcykgsxigiuxieq.exe ()

O4 - HKU\S-1-5-21-1123561945-73586283-1606980848-1003..\RunOnce: [yctzjrgsug] C:\WINDOWS\System32\oaznfvsmwqadmiistc.exe ()

O4 - HKU\S-1-5-21-1123561945-73586283-1606980848-1003..\RunOnce: [zaorydp] C:\Documents and Settings\Mariqn\Local Settings\Temp\zmmbuljepkvzjghsuez.exe ()

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: oqfjrxku = yifrhvqiqiqrysqy.exe ()

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: bamns = C:\DOCUME~1\Mariqn\LOCALS~1\Temp\bqsjexxuherxjilycolye.exe ()

O32 - AutoRun File - [2009.12.16 19:32:44 | 00,000,800 | RHS- | M] () - C:\autorun.inf -- [ NTFS ]

O32 - AutoRun File - [2009.12.16 19:32:45 | 00,000,814 | RHS- | M] () - D:\autorun.inf -- [ NTFS ]

:files

C:\RECYCLER

C:\WINDOWS\yctzjrgsugideskmfgsupcbumosjpzhw.kwy

C:\Program Files\yctzjrgsugideskmfgsupcbumosjpzhw.kwy

C:\Documents and Settings\Mariqn\Local Settings\Application Data\yctzjrgsugideskmfgsupcbumosjpzhw.kwy

C:\Program Files\cwdzzxcewyqbswewfwyqbe.ckc

C:\Documents and Settings\Mariqn\Local Settings\Application Data\cwdzzxcewyqbswewfwyqbe.ckc

C:\WINDOWS\System32\yctzjrgsugideskmfgsupcbumosjpzhw.kwy

C:\WINDOWS\cwdzzxcewyqbswewfwyqbe.ckc

C:\WINDOWS\System32\cwdzzxcewyqbswewfwyqbe.ckc

C:\WINDOWS\zmmbuljepkvzjghsuez.exe

C:\WINDOWS\sildztusgeszmmqejwuipo.exe

C:\WINDOWS\oaznfvsmwqadmiistc.exe

C:\WINDOWS\mabrldcykgsxigiuxieq.exe

C:\WINDOWS\bqsjexxuherxjilycolye.exe

C:\WINDOWS\yifrhvqiqiqrysqy.exe

C:\WINDOWS\fqobshdwfyhjrmluu.exe

C:\tyqxirhuxkn.bat

C:\autorun.inf

C:\WINDOWS\System32\yifrhvqiqiqrysqy.exe

C:\WINDOWS\System32\sildztusgeszmmqejwuipo.exe

C:\WINDOWS\System32\oaznfvsmwqadmiistc.exe

C:\WINDOWS\System32\mabrldcykgsxigiuxieq.exe

C:\WINDOWS\System32\fqobshdwfyhjrmluu.exe

C:\WINDOWS\System32\bqsjexxuherxjilycolye.exe

C:\WINDOWS\System32\pwqzmxpejydbfwrwswlqoegcxcjdmzkcrwl.osj

C:\WINDOWS\pwqzmxpejydbfwrwswlqoegcxcjdmzkcrwl.osj

C:\Program Files\pwqzmxpejydbfwrwswlqoegcxcjdmzkcrwl.osj

C:\Documents and Settings\Mariqn\Local Settings\Application Data\pwqzmxpejydbfwrwswlqoegcxcjdmzkcrwl.osj

C:\WINDOWS\System32\qytdrdwmsionskgmjoekjadawckfpdpiyeua.ews

C:\WINDOWS\qytdrdwmsionskgmjoekjadawckfpdpiyeua.ews

C:\Program Files\qytdrdwmsionskgmjoekjadawckfpdpiyeua.ews

C:\Documents and Settings\Mariqn\Local Settings\Application Data\qytdrdwmsionskgmjoekjadawckfpdpiyeua.ews

C:\WINDOWS\System32\zmmbuljepkvzjghsuez.exe

C:\WINDOWS\tyqxirhuxknjlatwqsfiessmfinfmxgwj.zcy

C:\WINDOWS\System32\tyqxirhuxknjlatwqsfiessmfinfmxgwj.zcy

C:\Program Files\tyqxirhuxknjlatwqsfiessmfinfmxgwj.zcy

C:\Documents and Settings\Mariqn\Local Settings\Application Data\tyqxirhuxknjlatwqsfiessmfinfmxgwj.zcy

:Commands

[purity]

[emptytemp]

[resethosts]

[Reboot]

Натиснете бутона Run Fix

Ще се създаде лог файл. Копирайте го в следващия си пост.

Ще ми трябва отпуск.... :cool:

16 декември 200916 г.

Такам ето лога:

All processes killed
========== OTL ==========
No active process named navxphyxqdrwhshuprjb.exe was found!
Process cagtw.exe killed successfully!
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\amghypfdvhuyisgsmne deleted successfully.
File move failed. C:\Documents and Settings\User\Local Settings\Temp\zizxlzmhwfpqxepy.exe scheduled to be moved on reboot.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\qwkfqbldpvcae deleted successfully.
File move failed. C:\WINDOWS\system32\pattjzolcnzcluhsll.exe scheduled to be moved on reboot.
Registry value HKEY_USERS\S-1-5-21-602162358-746137067-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Run\\DriverCure deleted successfully.
Registry value HKEY_USERS\S-1-5-21-602162358-746137067-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Run\\Power2GoExpress deleted successfully.
Registry value HKEY_USERS\S-1-5-21-602162358-746137067-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Run\\qwkfqbldpvcae deleted successfully.
File move failed. C:\Documents and Settings\User\Local Settings\Temp\gqihwlzvlvgiqykum.exe scheduled to be moved on reboot.
Registry value HKEY_USERS\S-1-5-21-602162358-746137067-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Run\\zizxlzmhwfpqxepy deleted successfully.
File move failed. C:\WINDOWS\system32\cqmpibttnbqwiukyuxqjb.exe scheduled to be moved on reboot.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce\\pattjzolcnzcluhsll deleted successfully.
File move failed. C:\Documents and Settings\User\Local Settings\Temp\zizxlzmhwfpqxepy.exe scheduled to be moved on reboot.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce\\rynjvhslyfnmrw deleted successfully.
File move failed. C:\WINDOWS\system32\gqihwlzvlvgiqykum.exe scheduled to be moved on reboot.
Registry value HKEY_USERS\S-1-5-21-602162358-746137067-725345543-1003\Software\Microsoft\Windows\CurrentVersion\RunOnce\\gqihwlzvlvgiqykum deleted successfully.
File move failed. C:\WINDOWS\system32\zizxlzmhwfpqxepy.exe scheduled to be moved on reboot.
Registry value HKEY_USERS\S-1-5-21-602162358-746137067-725345543-1003\Software\Microsoft\Windows\CurrentVersion\RunOnce\\rynjvhslyfnmrw deleted successfully.
File move failed. C:\Documents and Settings\User\Local Settings\Temp\cqmpibttnbqwiukyuxqjb.exe scheduled to be moved on reboot.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\\ucspcpbvjraagmw deleted successfully.
File move failed. C:\WINDOWS\System32\zizxlzmhwfpqxepy.exe scheduled to be moved on reboot.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\\rwjdnxgxintq deleted successfully.
File move failed. C:\Documents and Settings\User\Local Settings\Temp\gqihwlzvlvgiqykum.exe scheduled to be moved on reboot.
C:\autorun.inf moved successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2ca14044-4ab7-11dd-811a-806d6172696f}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2ca14044-4ab7-11dd-811a-806d6172696f}\ not found.
C:\uykdmvdtdhm.bat moved successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2ca14044-4ab7-11dd-811a-806d6172696f}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2ca14044-4ab7-11dd-811a-806d6172696f}\ not found.
C:\ucspcpbvjraagmw.bat moved successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2ca14044-4ab7-11dd-811a-806d6172696f}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2ca14044-4ab7-11dd-811a-806d6172696f}\ not found.
C:\qwkfqbldpvcae.bat moved successfully.
========== FILES ==========
C:\WINDOWS\zcnfnvcradhcdejmxpxfmbknrmnotwhz.pwl moved successfully.
C:\WINDOWS\System32\zcnfnvcradhcdejmxpxfmbknrmnotwhz.pwl moved successfully.
C:\Program Files\zcnfnvcradhcdejmxpxfmbknrmnotwhz.pwl moved successfully.
C:\Documents and Settings\User\Local Settings\Application Data\zcnfnvcradhcdejmxpxfmbknrmnotwhz.pwl moved successfully.
C:\WINDOWS\System32\dwxfdbydcvparidwxfdbyd.vpa moved successfully.
C:\WINDOWS\dwxfdbydcvparidwxfdbyd.vpa moved successfully.
C:\Program Files\dwxfdbydcvparidwxfdbyd.vpa moved successfully.
C:\Documents and Settings\User\Local Settings\Application Data\dwxfdbydcvparidwxfdbyd.vpa moved successfully.
C:\WINDOWS\System32\qwkfqbldpvcaeiqwkfqbldpvcaeiqwkfqbl.pvc moved successfully.
C:\WINDOWS\qwkfqbldpvcaeiqwkfqbldpvcaeiqwkfqbl.pvc moved successfully.
C:\Program Files\qwkfqbldpvcaeiqwkfqbldpvcaeiqwkfqbl.pvc moved successfully.
C:\Documents and Settings\User\Local Settings\Application Data\qwkfqbldpvcaeiqwkfqbldpvcaeiqwkfqbl.pvc moved successfully.
C:\WINDOWS\zizxlzmhwfpqxepy.exe moved successfully.
C:\WINDOWS\tifjdxqrmbrylypebfztmn.exe moved successfully.
C:\WINDOWS\pattjzolcnzcluhsll.exe moved successfully.
C:\WINDOWS\navxphyxqdrwhshuprjb.exe moved successfully.
C:\WINDOWS\gqihwlzvlvgiqykum.exe moved successfully.
C:\WINDOWS\cqmpibttnbqwiukyuxqjb.exe moved successfully.
C:\WINDOWS\amghypfdvhuyisgsmne.exe moved successfully.
File\Folder C:\autorun.inf not found.
File\Folder C:\uykdmvdtdhm.bat not found.
File move failed. C:\WINDOWS\System32\zizxlzmhwfpqxepy.exe scheduled to be moved on reboot.
File move failed. C:\WINDOWS\System32\tifjdxqrmbrylypebfztmn.exe scheduled to be moved on reboot.
File move failed. C:\WINDOWS\System32\pattjzolcnzcluhsll.exe scheduled to be moved on reboot.
File move failed. C:\WINDOWS\System32\cqmpibttnbqwiukyuxqjb.exe scheduled to be moved on reboot.
File move failed. C:\WINDOWS\System32\amghypfdvhuyisgsmne.exe scheduled to be moved on reboot.
C:\WINDOWS\System32\rynjvhslyfnmrwfmbxjvgzmtbafktaplxjun.hpo moved successfully.
C:\WINDOWS\rynjvhslyfnmrwfmbxjvgzmtbafktaplxjun.hpo moved successfully.
C:\Program Files\rynjvhslyfnmrwfmbxjvgzmtbafktaplxjun.hpo moved successfully.
C:\Documents and Settings\User\Local Settings\Application Data\rynjvhslyfnmrwfmbxjvgzmtbafktaplxjun.hpo moved successfully.
File move failed. C:\WINDOWS\System32\gqihwlzvlvgiqykum.exe scheduled to be moved on reboot.
File move failed. C:\WINDOWS\System32\navxphyxqdrwhshuprjb.exe scheduled to be moved on reboot.
C:\WINDOWS\uykdmvdtdhmikmswibktbrbfkgikqugzi.zpz moved successfully.
C:\WINDOWS\System32\uykdmvdtdhmikmswibktbrbfkgikqugzi.zpz moved successfully.
C:\Program Files\uykdmvdtdhmikmswibktbrbfkgikqugzi.zpz moved successfully.
C:\Documents and Settings\User\Local Settings\Application Data\uykdmvdtdhmikmswibktbrbfkgikqugzi.zpz moved successfully.
C:\Documents and Settings\All Users\Application Data\ParetoLogic\UUS2\Temp folder moved successfully.
C:\Documents and Settings\All Users\Application Data\ParetoLogic\UUS2\DriverCure\Temp folder moved successfully.
C:\Documents and Settings\All Users\Application Data\ParetoLogic\UUS2\DriverCure folder moved successfully.
C:\Documents and Settings\All Users\Application Data\ParetoLogic\UUS2 folder moved successfully.
C:\Documents and Settings\All Users\Application Data\ParetoLogic folder moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 402 bytes

User: User
->Temp folder emptied: 1643926911 bytes
->Temporary Internet Files folder emptied: 73529649 bytes
->Java cache emptied: 19517151 bytes
->FireFox cache emptied: 71863090 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 2244203 bytes
%systemroot%\System32 .tmp files removed: 2577 bytes
Windows Temp folder emptied: 17934786 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 23945878 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 122953 bytes
RecycleBin emptied: 43685398 bytes

Total Files Cleaned = 1809,03 mb

C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

OTL by OldTimer - Version 3.1.17.0 log created on 12162009_235142

Files\Folders moved on Reboot...
File\Folder C:\Documents and Settings\User\Local Settings\Temp\zizxlzmhwfpqxepy.exe not found!
C:\WINDOWS\system32\pattjzolcnzcluhsll.exe moved successfully.
File\Folder C:\Documents and Settings\User\Local Settings\Temp\gqihwlzvlvgiqykum.exe not found!
C:\WINDOWS\system32\cqmpibttnbqwiukyuxqjb.exe moved successfully.
C:\WINDOWS\system32\gqihwlzvlvgiqykum.exe moved successfully.
C:\WINDOWS\system32\zizxlzmhwfpqxepy.exe moved successfully.
File\Folder C:\Documents and Settings\User\Local Settings\Temp\cqmpibttnbqwiukyuxqjb.exe not found!
C:\WINDOWS\System32\tifjdxqrmbrylypebfztmn.exe moved successfully.
C:\WINDOWS\System32\amghypfdvhuyisgsmne.exe moved successfully.
C:\WINDOWS\System32\navxphyxqdrwhshuprjb.exe moved successfully.

Registry entries deleted on Reboot...

Редактирано 16 декември 200916 г. от daniel1995 (преглед на промените)

16 декември 200916 г.

@daniel1995

Архивирайте папката C:\_OTL и я качете на този адрес: http://www.rapidshare.de

Публикувайте линк за да я изтеглим, след това я изтрийте !

СТЪПКА 1

Изтеглете => FixPolicies

Запазете го някъде на декстопа.Кликнете два пъти върху файла и изберете Install.Ще се създаде папка с името FixPolicies на десктопа.Отворете я и стартирайте файла Fix_policies.cmd.

СТЪПКА 2

Изтеглете този файл и го стартирайте.

Следвайте инструкциите.

Публикувайте лог файла.

СТЪПКА 3

Изтеглете програмата => Dr.Web CureIt

Алтернативен линк => http://www.freedrweb.com/download+cureit/gr/

*Стартирайте я.

*Натиснете клавиш F9 и направете следните настройки:

-В категория проверка се придвижете до списък с изключени файлове.

-Маркирайте всичките и изберете Изтрий. Потвърдете с Apply.

-Придвижете се до категория действия.

Приложете настройките от снимката и натиснете Apply.

-Пуснете пълна проверка на системата.

-Публикувайте лог файла (DrWeb.csv) от проверката в следващия си пост или го качете на адрес http://rapidshare.de/ и публикувайте линка за да го изтеглим.

17 декември 200916 г.

http://rapidshare.de/files/48848657/_OTL.rar.html

Стъпка 2

Reg export of SafeBoot key after repair:

========================

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot]

"AlternateShell"="cmd.exe"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\AppMgmt]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\Base]

@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\Boot Bus Extender]

@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\Boot file system]

@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\CryptSvc]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\DcomLaunch]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\dmadmin]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\dmboot.sys]

@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\dmio.sys]

@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\dmload.sys]

@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\dmserver]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\EventLog]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\File system]

@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\Filter]

@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\HelpSvc]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\Netlogon]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\PCI Configuration]

@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\PlugPlay]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\PNP Filter]

@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\Primary disk]

@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\RpcSs]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\SCSI Class]

@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\sermouse.sys]

@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\sr.sys]

@="FSFilter System Recovery"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\SRService]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\System Bus Extender]

@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\vga.sys]

@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\vgasave.sys]

@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\WinMgmt]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{36FC9E60-C465-11CF-8056-444553540000}]

@="Universal Serial Bus controllers"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E965-E325-11CE-BFC1-08002BE10318}]

@="CD-ROM Drive"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}]

@="DiskDrive"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E969-E325-11CE-BFC1-08002BE10318}]

@="Standard floppy disk controller"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E96A-E325-11CE-BFC1-08002BE10318}]

@="Hdc"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E96B-E325-11CE-BFC1-08002BE10318}]

@="Keyboard"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E96F-E325-11CE-BFC1-08002BE10318}]

@="Mouse"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E977-E325-11CE-BFC1-08002BE10318}]

@="PCMCIA Adapters"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E97B-E325-11CE-BFC1-08002BE10318}]

@="SCSIAdapter"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E97D-E325-11CE-BFC1-08002BE10318}]

@="System"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E980-E325-11CE-BFC1-08002BE10318}]

@="Floppy disk drive"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{71A27CDD-812A-11D0-BEC7-08002BE2092F}]

@="Volume"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}]

@="Human Interface Devices"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\AFD]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\AppMgmt]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Base]

@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Boot Bus Extender]

@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Boot file system]

@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Browser]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\CryptSvc]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\DcomLaunch]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Dhcp]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\dmadmin]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\dmboot.sys]

@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\dmio.sys]

@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\dmload.sys]

@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\dmserver]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\DnsCache]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\EventLog]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\File system]

@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Filter]

@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\HelpSvc]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\ip6fw.sys]

@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\ipnat.sys]

@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\LanmanServer]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\LanmanWorkstation]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\LmHosts]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Messenger]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NDIS]

@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NDIS Wrapper]

@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Ndisuio]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NetBIOS]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NetBIOSGroup]

@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NetBT]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NetDDEGroup]

@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Netlogon]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NetMan]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Network]

@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NetworkProvider]

@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NtLmSsp]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\PCI Configuration]

@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\PlugPlay]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\PNP Filter]

@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\PNP_TDI]

@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Primary disk]

@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\rdpcdd.sys]

@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\rdpdd.sys]

@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\rdpwd.sys]

@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\rdsessmgr]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\RpcSs]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\SCSI Class]

@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\sermouse.sys]

@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\SharedAccess]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\sr.sys]

@="FSFilter System Recovery"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\SRService]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Streams Drivers]

@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\System Bus Extender]

@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Tcpip]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\TDI]

@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\tdpipe.sys]

@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\tdtcp.sys]

@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\termservice]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\vga.sys]

@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\vgasave.sys]

@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\WinMgmt]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\WZCSVC]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{36FC9E60-C465-11CF-8056-444553540000}]

@="Universal Serial Bus controllers"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E965-E325-11CE-BFC1-08002BE10318}]

@="CD-ROM Drive"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}]

@="DiskDrive"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E969-E325-11CE-BFC1-08002BE10318}]

@="Standard floppy disk controller"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E96A-E325-11CE-BFC1-08002BE10318}]

@="Hdc"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E96B-E325-11CE-BFC1-08002BE10318}]

@="Keyboard"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E96F-E325-11CE-BFC1-08002BE10318}]

@="Mouse"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}]

@="Net"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E973-E325-11CE-BFC1-08002BE10318}]

@="NetClient"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E974-E325-11CE-BFC1-08002BE10318}]

@="NetService"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E975-E325-11CE-BFC1-08002BE10318}]

@="NetTrans"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E977-E325-11CE-BFC1-08002BE10318}]

@="PCMCIA Adapters"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E97B-E325-11CE-BFC1-08002BE10318}]

@="SCSIAdapter"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E97D-E325-11CE-BFC1-08002BE10318}]

@="System"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E980-E325-11CE-BFC1-08002BE10318}]

@="Floppy disk drive"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{71A27CDD-812A-11D0-BEC7-08002BE2092F}]

@="Volume"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}]

@="Human Interface Devices"

========================

Dr.Web не изкара лог и затова влезнах в папката на user/Dr.Web и имаше един файл CoreIt май (текстов) и ще постна него

http://rapidshare.de/files/48848976/CureIt.log.html

лека нощ от мен

17 декември 200916 г.

Изглежда Dr.Web е намерил и поправил само файла Hosts.

Как се държи сега машината ?

Стартирайте OTL.exe и натиснете бутона вдясно - CleanUp!

Ако се наложи рестартирайте машината.

Поздрави

17 декември 200916 г.

http://dox.bg/files/dw?a=7f2ce2e0b0 - OTL.Txt

http://dox.bg/files/dw?a=bff7f200a1 - Extras.Txt

17 декември 200916 г.

ето и моите логове,иначе проблема ми е същия-вирус с линк по скайп,затрита антивирусна,невъзможност да се отворят сканиращи програми,не помогна и преинсталиция,мисля че червея се е копирал във всичките дялове

Extras.Txt

OTL.Txt

17 декември 200916 г.

@zaro_gt

Стартирайте OTL.exe и copy/paste под колонката "Custom Scans/Fixes" въведете това:

:OTL
PRC - C:\Windows\System32\pdxthzolxszennzwfw.exe ()
PRC - C:\Users\DENIO\AppData\Local\Temp\npxhjp.exe ()
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - - No CLSID value found.
O4 - HKLM..\Run: [zfrflvcrvi] C:\Windows\System32\zldxjzmhrkpszxhc.exe ()
O4 - HKLM..\Run: [zldxjzmhrkpszxhc] C:\Users\DENIO\AppData\Local\Temp\zldxjzmhrkpszxhc.exe ()
O4 - HKU\S-1-5-21-3900525688-3745060740-1413258781-1000..\Run: [qzofobldkaccg] C:\Windows\System32\ctqpgbttigqyknccoiqhe.exe ()
O4 - HKU\S-1-5-21-3900525688-3745060740-1413258781-1000..\Run: [zfrflvcrvi] C:\Users\DENIO\AppData\Local\Temp\ctqpgbttigqyknccoiqhe.exe ()
O4 - HKLM..\RunOnce: [ubodkvdtymm] C:\Windows\System32\ndzxnhyxliryjlzyjcjz.exe ()
O4 - HKLM..\RunOnce: [ufwpapbvewacifo] C:\Users\DENIO\AppData\Local\Temp\apkhwpfdqmuaklywgye.exe ()
O4 - HKU\S-1-5-21-3900525688-3745060740-1413258781-1000..\RunOnce: [rbrjthsltknotp] C:\Windows\System32\ctqpgbttigqyknccoiqhe.exe ()
O4 - HKU\S-1-5-21-3900525688-3745060740-1413258781-1000..\RunOnce: [ubodkvdtymm] C:\Users\DENIO\AppData\Local\Temp\ctqpgbttigqyknccoiqhe.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: rzndlxgxdsts = ndzxnhyxliryjlzyjcjz.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: glwjoxdru = C:\Users\DENIO\AppData\Local\Temp\pdxthzolxszennzwfw.exe ()
O32 - AutoRun File - [2009.12.17 10:58:52 | 00,000,828 | RHS- | M] () - C:\autorun.inf -- [ NTFS ]
O33 - MountPoints2\{46f63a6f-9e38-11de-82f0-002433d316b7}\Shell\AutoRun\command - "" = I:\RunGame.exe -- File not found
O33 - MountPoints2\{4cb1a4ea-9e17-11de-ac38-002433d316b7}\Shell\AutoRun\command - "" = G:\AutoRun.exe -- File not found
O33 - MountPoints2\{4cb1a4fa-9e17-11de-ac38-002433d316b7}\Shell\AutoRun\command - "" = G:\AutoRun.exe -- File not found
O33 - MountPoints2\{64e51ff5-a474-11de-b146-001dbaf319e9}\Shell\AutoRun\command - "" = J:\Setup.exe -- File not found
O33 - MountPoints2\{a3eb0a62-b010-11de-8e6e-001dbaf319e9}\Shell\AutoRun\command - "" = H:\ptdptbgt.bat -- File not found
O33 - MountPoints2\{a3eb0a62-b010-11de-8e6e-001dbaf319e9}\Shell\explore\Command - "" = H:\rzndlxgxdsts.bat -- File not found
O33 - MountPoints2\{a3eb0a62-b010-11de-8e6e-001dbaf319e9}\Shell\open\Command - "" = H:\zfrflvcrvi.bat -- File not found
O33 - MountPoints2\{b67319f7-a5ab-11de-9136-001dbaf319e9}\Shell\AutoRun\command - "" = G:\AutoRun.exe -- File not found
O33 - MountPoints2\H\Shell\AutoRun\command - "" = H:\AutoRun.exe -- File not found
O33 - MountPoints2\K\Shell\AutoRun\command - "" = K:\Autorun\Autorun.exe -- File not found
:files
C:\Windows\System32\pdxthzolxszennzwfw.exe
C:\Users\DENIO\AppData\Local\Temp\npxhjp.exe
C:\Windows\ufwpapbvewacifoiocepgzkzlfogkmspysymo.qju
C:\Users\DENIO\AppData\Local\ufwpapbvewacifoiocepgzkzlfogkmspysymo.qju
C:\Program Files\ufwpapbvewacifoiocepgzkzlfogkmspysymo.qju
C:\Windows\rzndlxgxdstsvpvmpazhvltfoflabadxdu.ihp
C:\Users\DENIO\AppData\Local\rzndlxgxdstsvpvmpazhvltfoflabadxdu.ihp
C:\Program Files\rzndlxgxdstsvpvmpazhvltfoflabadxdu.ihp
C:\Windows\hfjpnpovrwncvfbibcrptzxz.fbg
C:\Users\DENIO\AppData\Local\hfjpnpovrwncvfbibcrptzxz.fbg
C:\Program Files\hfjpnpovrwncvfbibcrptzxz.fbg
C:\Windows\zldxjzmhrkpszxhc.exe
C:\Windows\tljjbxqrhgranrhivqzrpp.exe
C:\Windows\pdxthzolxszennzwfw.exe
C:\Windows\ndzxnhyxliryjlzyjcjz.exe
C:\Windows\gtmhulzvgagksrcyg.exe
C:\Windows\ctqpgbttigqyknccoiqhe.exe
C:\Windows\apkhwpfdqmuaklywgye.exe
C:\Windows\System32\rzndlxgxdstsvpvmpazhvltfoflabadxdu.ihp
C:\Windows\System32\hfjpnpovrwncvfbibcrptzxz.fbg
C:\Windows\System32\ufwpapbvewacifoiocepgzkzlfogkmspysymo.qju
C:\Windows\System32\qzofobldkaccgbiaeqqzofobldkaccgbiae.qzo
C:\Windows\qzofobldkaccgbiaeqqzofobldkaccgbiae.qzo
C:\Users\DENIO\AppData\Local\qzofobldkaccgbiaeqqzofobldkaccgbiae.qzo
C:\Program Files\qzofobldkaccgbiaeqqzofobldkaccgbiae.qzo
C:\Windows\zldxjzmhrkpszxhcjybnfzlbojtmrubzjeladp.bnd
C:\Windows\System32\zldxjzmhrkpszxhcjybnfzlbojtmrubzjeladp.bnd
C:\Users\DENIO\AppData\Local\zldxjzmhrkpszxhcjybnfzlbojtmrubzjeladp.bnd
C:\Program Files\zldxjzmhrkpszxhcjybnfzlbojtmrubzjeladp.bndC:\rzndlxgxdsts.bat
C:\Windows\System32\tljjbxqrhgranrhivqzrpp.exe
C:\Windows\System32\ndzxnhyxliryjlzyjcjz.exe
C:\Windows\System32\ctqpgbttigqyknccoiqhe.exe
C:\Windows\System32\apkhwpfdqmuaklywgye.exe
C:\Windows\System32\zldxjzmhrkpszxhc.exe
C:\Windows\System32\pdxthzolxszennzwfw.exe
C:\Windows\System32\gtmhulzvgagksrcyg.exe
:Commands
[purity]
[emptytemp]
[resethosts]
[Reboot]

Натиснете бутона Run Fix

Ще се създаде лог файл. Копирайте го в следващия си пост.

17 декември 200916 г.

Ето го и следващия лог файл: ЦЪК

17 декември 200916 г.

@tbmtbm

Стартирайте OTL.exe и copy/paste под колонката "Custom Scans/Fixes" въведете това:

:OTL
PRC - C:\WINDOWS\system32\leawrdarmfckgpvujcuf.exe ()
PRC - C:\Documents and Settings\GOGO\Local Settings\temp\lqygnl.exe ()
O4 - HKLM..\Run: [emxistflv] C:\WINDOWS\System32\xmewnvobshaewbdy.exe ()
O4 - HKLM..\Run: [sgxoeldpftlofjk] C:\Documents and Settings\GOGO\Local Settings\temp\yqlgalhxrjfmhpusgyp.exe ()
O4 - HKU\S-1-5-21-1123561945-362288127-839522115-1003..\Run: [emxistflv] C:\Documents and Settings\GOGO\Local Settings\temp\xmewnvobshaewbdy.exe ()
O4 - HKU\S-1-5-21-1123561945-362288127-839522115-1003..\Run: [paocptirepee] C:\WINDOWS\System32\eungyhbphxrwpvyug.exe ()
O4 - HKLM..\RunOnce: [pcsixdufuhyaqt] C:\Documents and Settings\GOGO\Local Settings\temp\xmewnvobshaewbdy.exe ()
O4 - HKLM..\RunOnce: [xgseprelwf] C:\WINDOWS\System32\aurokxvnjdbkhryyoibng.exe ()
O4 - HKU\S-1-5-21-1123561945-362288127-839522115-1003..\RunOnce: [oapesxnxlxnod] C:\WINDOWS\System32\eungyhbphxrwpvyug.exe ()
O4 - HKU\S-1-5-21-1123561945-362288127-839522115-1003..\RunOnce: [xgseprelwf] C:\Documents and Settings\GOGO\Local Settings\temp\aurokxvnjdbkhryyoibng.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: scpcorfnzjx = neyslvqfypkqkrvsfw.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: nueoxxin = C:\DOCUME~1\GOGO\LOCALS~1\Temp\yqlgalhxrjfmhpusgyp.exe ()
O32 - AutoRun File - [2009.12.17 14:19:38 | 00,000,840 | RHS- | M] () - C:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2009.12.17 14:19:38 | 00,000,802 | RHS- | M] () - D:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2009.12.17 14:19:38 | 00,000,826 | RHS- | M] () - E:\autorun.inf -- [ NTFS ]
:files
C:\32788R22FWJFW
C:\WINDOWS\System32\paocptirepeestripaknxtkxjdocqdhwfs.ssg
C:\WINDOWS\paocptirepeestripaknxtkxjdocqdhwfs.ssg
C:\Program Files\paocptirepeestripaknxtkxjdocqdhwfs.ssg
C:\Documents and Settings\GOGO\Local Settings\Application Data\paocptirepeestripaknxtkxjdocqdhwfs.ssg
C:\WINDOWS\System32\emxistflvdpmxvqeiqxxexlvevdozjk.cmu
C:\WINDOWS\emxistflvdpmxvqeiqxxexlvevdozjk.cmu
C:\Program Files\emxistflvdpmxvqeiqxxexlvevdozjk.cmu
C:\Documents and Settings\GOGO\Local Settings\Application Data\emxistflvdpmxvqeiqxxexlvevdozjk.cmu
C:\WINDOWS\System32\cabcctvrrprefteicaxnk.xxw
C:\WINDOWS\cabcctvrrprefteicaxnk.xxw
C:\Program Files\cabcctvrrprefteicaxnk.xxw
C:\Documents and Settings\GOGO\Local Settings\Application Data\cabcctvrrprefteicaxnk.xxwC:\WINDOWS\yqlgalhxrjfmhpusgyp.exe
C:\WINDOWS\xmewnvobshaewbdy.exe
C:\WINDOWS\rmkiftslidcmkvdevqkxrx.exe
C:\WINDOWS\neyslvqfypkqkrvsfw.exe
C:\WINDOWS\leawrdarmfckgpvujcuf.exe
C:\WINDOWS\eungyhbphxrwpvyug.exe
C:\WINDOWS\aurokxvnjdbkhryyoibng.exe
C:\autorun.inf
C:\WINDOWS\System32\yqlgalhxrjfmhpusgyp.exe
C:\WINDOWS\System32\rmkiftslidcmkvdevqkxrx.exe
C:\WINDOWS\System32\neyslvqfypkqkrvsfw.exe
C:\WINDOWS\System32\leawrdarmfckgpvujcuf.exe
C:\WINDOWS\System32\eungyhbphxrwpvyug.exe
C:\WINDOWS\System32\aurokxvnjdbkhryyoibng.exe
C:\WINDOWS\System32\xmewnvobshaewbdy.exe
C:\Documents and Settings\GOGO\Desktop\KittyFix.exe
C:\WINDOWS\System32\oapesxnxlxnodfeweqbfqnftgbncrfkakyk.bqs
C:\WINDOWS\oapesxnxlxnodfeweqbfqnftgbncrfkakyk.bqs
C:\Program Files\oapesxnxlxnodfeweqbfqnftgbncrfkakyk.bqs
C:\Documents and Settings\GOGO\Local Settings\Application Data\oapesxnxlxnodfeweqbfqnftgbncrfkakyk.bqs
C:\WINDOWS\xgseprelwfsqcbxmraijrlalvnwiufhu.mvi
C:\WINDOWS\System32\xgseprelwfsqcbxmraijrlalvnwiufhu.mvi
C:\Program Files\xgseprelwfsqcbxmraijrlalvnwiufhu.mvi
C:\Documents and Settings\GOGO\Local Settings\Application Data\xgseprelwfsqcbxmraijrlalvnwiufhu.mvi
:Commands
[purity]
[emptytemp]
[resethosts]
[Reboot]

Натиснете бутона Run Fix

Ще се създаде лог файл. Копирайте го в следващия си пост.

@tNDrRr

Вече можете да преминете към изпълнението на стъпките от този пост:

http://www.kaldata.com/forums/index.php?showtopic=144659&view=findpost&p=1583504

17 декември 200916 г.

Линк към архивираната папка: ЦЪК

Линк и към следващия лог файл: ЦЪК

Редактирано 17 декември 200916 г. от tNDrRr (преглед на промените)

17 декември 200916 г.

Здравейте,

ами и аз имам проблем като този на Bace-kz и направо стартирах ОТL и под custom scans ваведох първия лог които беше пост-нат

netsvcs

%SYSTEMDRIVE%\*.exe

%SYSTEMDRIVE%\eventlog.dll /s /md5

%SYSTEMDRIVE%\scecli.dll /s /md5

%SYSTEMDRIVE%\netlogon.dll /s /md5

%SYSTEMDRIVE%\cngaudit.dll /s /md5

%SYSTEMDRIVE%\sceclt.dll /s /md5

и ще публикувам и моя лог и ще чакам.Някои да хвърли един поглед ,тай като аз почти нищо не разбирам от нещата които правя и от всичко написано по горе се обърках...OTL.Txt

Extras.Txt

17 декември 200916 г.

Здравейте,
ами и аз имам проблем като този на Bace-kz и направо стартирах ОТL и под custom scans ваведох първия лог които беше пост-нат
netsvcs
%SYSTEMDRIVE%\*.exe
%SYSTEMDRIVE%\eventlog.dll /s /md5
%SYSTEMDRIVE%\scecli.dll /s /md5
%SYSTEMDRIVE%\netlogon.dll /s /md5
%SYSTEMDRIVE%\cngaudit.dll /s /md5
%SYSTEMDRIVE%\sceclt.dll /s /md5

и ще публикувам и моя лог и ще чакам.Някои да хвърли един поглед ,тай като аз почти нищо не разбирам от нещата които правя и от всичко написано по горе се обърках...OTL.Txt

Стартирайте OTL.exe и copy/paste под колонката "Custom Scans/Fixes" въведете това:

:OTL
PRC - C:\WINDOWS\system32\pfzrldarkfplvaddvqdt.exe ()
PRC - C:\Documents and Settings\UserXP\Local Settings\Temp\prxbhl.exe ()
O3 - HKLM\..\Toolbar: (BS.Player ControlBar) - {2C688203-7EB3-4327-9995-1CB417BA23F9} - C:\Program Files\BS.Player ControlBar\BSToolbar.dll ()
O3 - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll ()
O3 - HKU\S-1-5-21-2000478354-1637723038-725345543-1003\..\Toolbar\WebBrowser: (BS.Player ControlBar) - {2C688203-7EB3-4327-9995-1CB417BA23F9} - C:\Program Files\BS.Player ControlBar\BSToolbar.dll ()
O3 - HKU\S-1-5-21-2000478354-1637723038-725345543-1003\..\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll ()
O4 - HKLM..\Run: [bhrzjreluf] C:\Documents and Settings\UserXP\Local Settings\Temp\ivmbshbpfxexeggds.exe ()
O4 - HKLM..\Run: [vvzb] C:\WINDOWS\System32\bndrhvobqhnflmlh.exe ()
O4 - HKU\S-1-5-21-2000478354-1637723038-725345543-1003..\Run: [cfmrydn] C:\WINDOWS\System32\pfzrldarkfplvaddvqdt.exe ()
O4 - HKU\S-1-5-21-2000478354-1637723038-725345543-1003..\Run: [vvzb] C:\Documents and Settings\UserXP\Local Settings\Temp\rfxnfvqfwpxrzcdbrk.exe ()
O4 - HKLM..\RunOnce: [efkns] C:\WINDOWS\System32\bndrhvobqhnflmlh.exe ()
O4 - HKLM..\RunOnce: [inwdmtflt] C:\Documents and Settings\UserXP\Local Settings\Temp\evqjexvnhdolwcghawkbu.exe ()
O4 - HKU\S-1-5-21-2000478354-1637723038-725345543-1003..\RunOnce: [efkns] C:\Documents and Settings\UserXP\Local Settings\Temp\evqjexvnhdolwcghawkbu.exe ()
O4 - HKU\S-1-5-21-2000478354-1637723038-725345543-1003..\RunOnce: [rvdjrxin] C:\WINDOWS\System32\pfzrldarkfplvaddvqdt.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: prxbhl = bndrhvobqhnflmlh.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: onq = C:\DOCUME~1\UserXP\LOCALS~1\Temp\pfzrldarkfplvaddvqdt.exe ()
O32 - AutoRun File - [2009.12.17 14:49:53 | 00,000,776 | RHS- | M] () - C:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2009.12.17 14:49:53 | 00,000,809 | RHS- | M] () - D:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2009.12.17 14:58:50 | 00,000,812 | RHS- | M] () - G:\autorun.inf -- [ FAT32 ]
O33 - MountPoints2\{71dbeaa8-f883-11dd-b520-001b77acd5d2}\Shell\AutoRun\command - "" = F:\gzvlgo.exe -- File not found
O33 - MountPoints2\{71dbeaa8-f883-11dd-b520-001b77acd5d2}\Shell\explore\Command - "" = F:\gzvlgo.exe -- File not found
O33 - MountPoints2\{71dbeaa8-f883-11dd-b520-001b77acd5d2}\Shell\open\Command - "" = F:\gzvlgo.exe -- File not found
:files
C:\WINDOWS\vnjdztslgdpnzglnhetlfs.exe
C:\WINDOWS\rfxnfvqfwpxrzcdbrk.exe
C:\WINDOWS\pfzrldarkfplvaddvqdt.exe
C:\WINDOWS\ivmbshbpfxexeggds.exe
C:\WINDOWS\evqjexvnhdolwcghawkbu.exe
C:\WINDOWS\crkbulhxpjsnwacbsmy.exe
C:\WINDOWS\bndrhvobqhnflmlh.exe
C:\WINDOWS\System32\vnjdztslgdpnzglnhetlfs.exe
C:\WINDOWS\System32\rfxnfvqfwpxrzcdbrk.exe
C:\WINDOWS\System32\ivmbshbpfxexeggds.exe
C:\WINDOWS\System32\evqjexvnhdolwcghawkbu.exe
C:\WINDOWS\System32\crkbulhxpjsnwacbsmy.exe
C:\WINDOWS\System32\inwdmtfltdcnmgynueglssognzenudk.cku
C:\WINDOWS\inwdmtfltdcnmgynueglssognzenudk.cku
C:\Program Files\inwdmtfltdcnmgynueglssognzenudk.cku
C:\Documents and Settings\UserXP\Local Settings\Application Data\inwdmtfltdcnmgynueglssognzenudk.cku
C:\WINDOWS\System32\gbaxwtvrppefuemroogby.aif
C:\WINDOWS\gbaxwtvrppefuemroogby.aif
C:\Program Files\gbaxwtvrppefuemroogby.aif
C:\Documents and Settings\UserXP\Local Settings\Application Data\gbaxwtvrppefuemroogby.aif
C:\autorun.inf
C:\WINDOWS\System32\pfzrldarkfplvaddvqdt.exe
C:\WINDOWS\System32\bndrhvobqhnflmlh.exe
C:\WINDOWS\tbnxjtircprfhezrbotblonishpblxhwfq.ftv
C:\WINDOWS\System32\tbnxjtircprfhezrbotblonishpblxhwfq.ftv
C:\Program Files\tbnxjtircprfhezrbotblonishpblxhwfq.ftv
C:\Documents and Settings\UserXP\Local Settings\Application Data\tbnxjtircprfhezrbotblonishpblxhwfq.ftv
C:\WINDOWS\System32\sbozmxnxjxapsqmfqekteiiepfobmzkakwk.cfd
C:\WINDOWS\sbozmxnxjxapsqmfqekteiiepfobmzkakwk.cfd
C:\Program Files\sbozmxnxjxapsqmfqekteiiepfobmzkakwk.cfd
C:\Documents and Settings\UserXP\Local Settings\Application Data\sbozmxnxjxapsqmfqekteiiepfobmzkakwk.cfd
C:\WINDOWS\System32\bhrzjreluffrrmfvdorxfgdwerxhpzhu.kvv
C:\WINDOWS\bhrzjreluffrrmfvdorxfgdwerxhpzhu.kvv
C:\Program Files\bhrzjreluffrrmfvdorxfgdwerxhpzhu.kvv
C:\Documents and Settings\UserXP\Local Settings\Application Data\bhrzjreluffrrmfvdorxfgdwerxhpzhu.kvv
:reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
"csrcs"=-
:Commands
[purity]
[emptytemp]
[resethosts]
[Reboot]

Натиснете бутона Run Fix

Ще се създаде лог файл. Копирайте го в следващия си пост.

17 декември 200916 г.

а да слагам ли пак отметките както първия път? или да ги оставя така както са си

Редактирано 17 декември 200916 г. от tripka (преглед на промените)

17 декември 200916 г.

а да слагам ли пак отметките както първия път? или да ги оставя така както са си

Не, не слагайте никакви отметки. Само прекопирайте скрипта в празното поле и натиснете Run Fix.

Забележка...има две точки преди OTL в началото на скрипта. :OTL

Това е важно да се знае, защото без тях скрипта ще е невалиден.

След като приключите с тази стъпка се насочете към този коментар (номер 28):

http://www.kaldata.com/forums/index.php?showtopic=144659&view=findpost&p=1583504

(Това с е отнася за всички...след като изпълните скрипта с OTL.exe отивайте на 28 коментар)!!!

Благодарим

17 декември 200916 г.

колеги при мен е същият проблем сега почвам да изпълнявам предписаното и да видим какво ще стане

17 декември 200916 г.

Момчета, създавайте си отделни тема в същия подфорум.

Колега, след този случай затвори темата! Тук стана някакъв ужас!

1

17 декември 200916 г.

OTL logfile created on: 17.12.2009 a. 15:36:40 - Run 1

OTL by OldTimer - Version 3.1.17.0 Folder = C:\Documents and Settings\asen\My Documents\Изтегляния

Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 7.0.5730.13)

Locale: 00000402 | Country: Bulgaria | Language: BGR | Date Format: dd.M.yyyy 'ã.'

501,98 Mb Total Physical Memory | 194,66 Mb Available Physical Memory | 38,78% Memory free

1,20 Gb Paging File | 0,95 Gb Available in Paging File | 78,95% Paging File free

Paging file location(s): C:\pagefile.sys 756 1512 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS.0 | %ProgramFiles% = C:\Program Files

Drive C: | 10,39 Gb Total Space | 4,25 Gb Free Space | 40,96% Space Free | Partition Type: NTFS

Drive D: | 64,17 Gb Total Space | 42,24 Gb Free Space | 65,83% Space Free | Partition Type: NTFS

E: Drive not present or media not loaded

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

Computer Name: ASEN-E21F07E1A9

Current User Name: asen

Logged in as Administrator.

Current Boot Mode: Normal

Scan Mode: All users

Company Name Whitelist: On

Skip Microsoft Files: On

File Age = 30 Days

Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\asen\My Documents\Изтегляния\OTL.exe (OldTimer Tools)

PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

PRC - C:\WINDOWS.0\system32\hyjdsnxpfxwvwhkuh.exe ()

PRC - C:\Documents and Settings\asen\Local Settings\Temp\bijtyjj.exe ()

PRC - C:\Program Files\Skype\Phone\Skype.exe (Skype Technologies S.A.)

PRC - C:\WINDOWS.0\explorer.exe (Microsoft Corporation)

PRC - C:\Program Files\FlashGet\flashget.exe (FlashGet.com)

PRC - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics, Inc.)

PRC - C:\WINDOWS.0\system32\igfxpers.exe (Intel Corporation)

PRC - C:\WINDOWS.0\system32\igfxtray.exe (Intel Corporation)

PRC - C:\WINDOWS.0\system32\hkcmd.exe (Intel Corporation)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\asen\My Documents\Изтегляния\OTL.exe (OldTimer Tools)

MOD - C:\Program Files\FlashGet\fgmgr.dll (www.flashget.com)

========== Win32 Services (SafeList) ==========

========== Driver Services (SafeList) ==========

DRV - (Secdrv) -- C:\WINDOWS.0\system32\drivers\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)

DRV - (HDAudBus) -- C:\WINDOWS.0\system32\drivers\hdaudbus.sys (Windows ® Server 2003 DDK provider)

DRV - (BCM43XX) -- C:\WINDOWS.0\system32\drivers\BCMWL5.SYS (Broadcom Corporation)

DRV - (SynTP) -- C:\WINDOWS.0\system32\drivers\SynTP.sys (Synaptics, Inc.)

DRV - (ialm) -- C:\WINDOWS.0\system32\drivers\ialmnt5.sys (Intel Corporation)

DRV - (E100B) Intel® -- C:\WINDOWS.0\system32\drivers\e100b325.sys (Intel Corporation)

DRV - (Ptilink) -- C:\WINDOWS.0\system32\drivers\ptilink.sys (Parallel Technologies, Inc.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKU\.DEFAULT\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-1757981266-1614895754-1177238915-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.ask.com?o=15187&l=dis

IE - HKU\S-1-5-21-1757981266-1614895754-1177238915-1003\S-1-5-21-1757981266-1614895754-1177238915-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultengine: "Ask.com"

FF - prefs.js..browser.search.defaultenginename: "Ask.com"

FF - prefs.js..browser.search.order.1: "Ask.com"

FF - prefs.js..browser.search.selectedEngine: "Google"

FF - prefs.js..browser.search.useDBForOrder: true

FF - prefs.js..browser.startup.homepage: "http://www.ask.com?o=15187&l=dis"

FF - prefs.js..extensions.enabledItems: [email protected]:3.5.0.145

FF - prefs.js..keyword.URL: "http://supertoolbar.ask.com/redirect?client=ff&src=kw&tb=PTV&o=15184&locale=en_US&q="

FF - HKLM\software\mozilla\Mozilla Firefox 3.5.6\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009.12.17 15:29:45 | 00,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.5.6\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2009.12.17 15:29:45 | 00,000,000 | ---D | M]

[2009.12.12 14:11:19 | 00,000,000 | ---D | M] -- C:\Documents and Settings\asen\Application Data\Mozilla\Extensions

[2009.12.15 18:21:21 | 00,000,000 | ---D | M] -- C:\Documents and Settings\asen\Application Data\Mozilla\Firefox\Profiles\2vg0yny8.default\extensions

[2009.12.12 15:18:27 | 00,000,000 | ---D | M] -- C:\Documents and Settings\asen\Application Data\Mozilla\Firefox\Profiles\2vg0yny8.default\extensions\[email protected]

[2009.12.12 21:19:59 | 00,002,255 | ---- | M] () -- C:\Documents and Settings\asen\Application Data\Mozilla\Firefox\Profiles\2vg0yny8.default\searchplugins\askcom.xml

[2009.12.15 18:21:21 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions

[2009.11.03 03:57:59 | 00,001,083 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\911bg.xml

[2009.11.03 03:57:59 | 00,002,442 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\diribg.xml

[2009.11.03 03:57:59 | 00,001,515 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\pe-bg.xml

[2009.11.03 03:57:59 | 00,001,857 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\portalbgdict.xml

[2009.11.03 03:57:59 | 00,001,220 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-bg.xml

O1 HOSTS File: (734 bytes) - C:\WINDOWS.0\system32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1 localhost

O2 - BHO: (FGCatchUrl) - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll (www.flashget.com)

O2 - BHO: (PandoraTV Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll File not found

O2 - BHO: (FlashGet GetFlash Class) - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll (www.flashget.com)

O3 - HKLM\..\Toolbar: (PandoraTV Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll File not found

O3 - HKU\S-1-5-21-1757981266-1614895754-1177238915-1003\..\Toolbar\WebBrowser: (PandoraTV Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll File not found

O4 - HKLM..\Run: [Flashget] C:\Program Files\FlashGet\FlashGet.exe (FlashGet.com)

O4 - HKLM..\Run: [igfxhkcmd] C:\WINDOWS.0\system32\hkcmd.exe (Intel Corporation)

O4 - HKLM..\Run: [igfxpers] C:\WINDOWS.0\system32\igfxpers.exe (Intel Corporation)

O4 - HKLM..\Run: [igfxtray] C:\WINDOWS.0\system32\igfxtray.exe (Intel Corporation)

O4 - HKLM..\Run: [qyalrden] C:\WINDOWS.0\System32\aqathbkbqhfddnpy.exe ()

O4 - HKLM..\Run: [sgofrjqfshdzxf] C:\Documents and Settings\asen\Local Settings\Temp\aqathbkbqhfddnpy.exe ()

O4 - HKLM..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics, Inc.)

O4 - HKLM..\Run: [uIUCU] C:\Documents and Settings\asen\Local Settings\Temp\UIUCU.EXE (Conexant Systems, Inc.)

O4 - HKU\S-1-5-21-1757981266-1614895754-1177238915-1003..\Run: [qyalrden] C:\Documents and Settings\asen\Local Settings\Temp\dynledrnhdgjodkypplzw.exe ()

O4 - HKU\S-1-5-21-1757981266-1614895754-1177238915-1003..\Run: [skype] C:\Program Files\Skype\Phone\Skype.exe (Skype Technologies S.A.)

O4 - HKU\S-1-5-21-1757981266-1614895754-1177238915-1003..\Run: [vglzixbnxjc] C:\WINDOWS.0\System32\oiwtljwrkfhjnbhukjer.exe ()

O4 - HKLM..\RunOnce: [hqtfmzblt] C:\WINDOWS.0\System32\dynledrnhdgjodkypplzw.exe ()

O4 - HKLM..\RunOnce: [relbmdjxjxsnk] C:\Documents and Settings\asen\Local Settings\Temp\hyjdsnxpfxwvwhkuh.exe ()

O4 - HKU\.DEFAULT..\RunOnce: [nltide_2] File not found

O4 - HKU\S-1-5-18..\RunOnce: [nltide_2] File not found

O4 - HKU\S-1-5-19..\RunOnce: [nltide_2] File not found

O4 - HKU\S-1-5-20..\RunOnce: [nltide_2] File not found

O4 - HKU\S-1-5-21-1757981266-1614895754-1177238915-1003..\RunOnce: [hqtfmzblt] C:\Documents and Settings\asen\Local Settings\Temp\buhdurdxpjklobgshfz.exe ()

O4 - HKU\S-1-5-21-1757981266-1614895754-1177238915-1003..\RunOnce: [sekzjzercpjd] C:\WINDOWS.0\System32\aqathbkbqhfddnpy.exe ()

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: akobjxaluf = buhdurdxpjklobgshfz.exe ()

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: bijtyjj = C:\DOCUME~1\asen\LOCALS~1\Temp\oiwtljwrkfhjnbhukjer.exe ()

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableInstallerDetection = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableSecureUIAPaths = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableVirtualization = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0

O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-21-1757981266-1614895754-1177238915-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 1

O7 - HKU\S-1-5-21-1757981266-1614895754-1177238915-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1

O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\JC_ALL.HTM ()

O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\JC_LINK.HTM ()

O9 - Extra Button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\flashget.exe (FlashGet.com)

O9 - Extra 'Tools' menuitem : FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\flashget.exe (FlashGet.com)

O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS.0\Network Diagnostic\xpnetdiag.exe File not found

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 78.90.248.1 192.168.0.1

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS.0\explorer.exe (Microsoft Corporation)

O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS.0\System32\igfxdev.dll (Intel Corporation)

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - CLSID or File not found.

O24 - Desktop Components:0 (Моята текуща начална страница) - About:Home

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2009.12.12 13:41:40 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

O32 - AutoRun File - [2009.12.17 15:29:39 | 00,000,837 | RHS- | M] () - C:\autorun.inf -- [ NTFS ]

O32 - AutoRun File - [2009.12.17 15:29:43 | 00,000,829 | RHS- | M] () - D:\autorun.inf -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *) - File not found

O35 - comfile [open] -- "%1" %*

O35 - exefile [open] -- "%1" %*

NetSvcs: 6to4 - File not found

NetSvcs: Ias - C:\WINDOWS.0\system32\ias [2009.12.12 13:40:55 | 00,000,000 | ---D | M]

NetSvcs: Iprip - File not found

NetSvcs: Irmon - File not found

NetSvcs: NWCWorkstation - File not found

NetSvcs: Nwsapagent - File not found

NetSvcs: WmdmPmSp - File not found

========== Files/Folders - Created Within 30 Days ==========

[2009.12.13 15:33:34 | 00,000,000 | ---D | C] -- C:\Documents and Settings\asen\Local Settings\Application Data\Identities

[2009.12.13 15:33:34 | 00,000,000 | ---D | C] -- C:\Documents and Settings\asen\Application Data\Identities

[2009.12.13 14:29:28 | 00,000,000 | ---D | C] -- C:\Program Files\C-Media USB Sound

[2009.12.13 09:14:11 | 00,000,000 | ---D | C] -- C:\Documents and Settings\asen\Local Settings\Application Data\AskToolbar

[2009.12.12 15:27:57 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\System32\x64

[2009.12.12 15:27:45 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\System32\DRVSTORE

[2009.12.12 15:24:35 | 00,000,000 | R--D | C] -- C:\Documents and Settings\All Users\Documents\My Music

[2009.12.12 15:20:10 | 00,000,000 | -HSD | C] -- C:\WINDOWS.0\Installer

[2009.12.12 15:20:08 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\ODBC

[2009.12.12 15:20:04 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\SpeechEngines

[2009.12.12 15:20:03 | 00,000,000 | R--D | C] -- C:\Program Files

[2009.12.12 15:20:03 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\Microsoft Shared

[2009.12.12 15:20:03 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files

[2009.12.12 15:19:34 | 00,000,000 | R--D | C] -- C:\Documents and Settings\All Users\Start Menu

[2009.12.12 15:19:34 | 00,000,000 | R--D | C] -- C:\Documents and Settings\All Users\Documents

[2009.12.12 15:19:34 | 00,000,000 | -H-D | C] -- C:\Documents and Settings\All Users\Templates

[2009.12.12 15:19:34 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Favorites

[2009.12.12 15:19:34 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Desktop

[2009.12.12 15:19:17 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\System32\CatRoot2

[2009.12.12 15:19:17 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\System32\CatRoot

[2009.12.12 15:19:11 | 00,000,000 | --SD | C] -- C:\Documents and Settings\All Users\Application Data\Microsoft

[2009.12.12 15:19:11 | 00,000,000 | RH-D | C] -- C:\Documents and Settings\All Users\Application Data

[2009.12.12 15:09:19 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\DriverPacks

[2009.12.12 15:09:04 | 00,000,000 | ---D | C] -- C:\Documents and Settings

[2009.12.12 15:09:03 | 00,000,000 | -HSD | C] -- C:\System Volume Information

[2009.12.12 15:05:49 | 00,000,000 | ---D | C] -- C:\Program Files\HP

[2009.12.12 15:05:02 | 00,000,000 | -H-D | C] -- C:\Program Files\InstallShield Installation Information

[2009.12.12 15:05:02 | 00,000,000 | ---D | C] -- C:\Program Files\Hewlett-Packard

[2009.12.12 15:03:42 | 00,000,000 | --SD | C] -- C:\WINDOWS.0\Downloaded Program Files

[2009.12.12 15:03:42 | 00,000,000 | R-SD | C] -- C:\WINDOWS.0\Fonts

[2009.12.12 15:03:42 | 00,000,000 | RHSD | C] -- C:\WINDOWS.0\System32\dllcache

[2009.12.12 15:03:42 | 00,000,000 | R--D | C] -- C:\WINDOWS.0\Web

[2009.12.12 15:03:42 | 00,000,000 | -H-D | C] -- C:\WINDOWS.0\inf

[2009.12.12 15:03:42 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\WinSxS

[2009.12.12 15:03:42 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\System32\wins

[2009.12.12 15:03:42 | 00,000,000 | ---D | C] -- C:\WINDOWS.0

[2009.12.12 15:03:42 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\WBEM

[2009.12.12 15:03:42 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\System32\wbem

[2009.12.12 15:03:42 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\System32\usmt

[2009.12.12 15:03:42 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\System32\drivers\UMDF

[2009.12.12 15:03:42 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\twain_32

[2009.12.12 15:03:42 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\Temp

[2009.12.12 15:03:42 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\system32

[2009.12.12 15:03:42 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\system

[2009.12.12 15:03:42 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\System32\spool

[2009.12.12 15:03:42 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\System32\ShellExt

[2009.12.12 15:03:42 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\System32\Setup

[2009.12.12 15:03:42 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\security

[2009.12.12 15:03:42 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\System32\scripting

[2009.12.12 15:03:42 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\Resources

[2009.12.12 15:03:42 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\repair

[2009.12.12 15:03:42 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\System32\ras

[2009.12.12 15:03:42 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\Provisioning

[2009.12.12 15:03:42 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\System32\PreInstall

[2009.12.12 15:03:42 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\PeerNet

[2009.12.12 15:03:42 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\pchealth

[2009.12.12 15:03:42 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\System32\oobe

[2009.12.12 15:03:42 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\Offline Web Pages

[2009.12.12 15:03:42 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\System32\npp

[2009.12.12 15:03:42 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\Network Diagnostic

[2009.12.12 15:03:42 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\System32\mui

[2009.12.12 15:03:42 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\mui

[2009.12.12 15:03:42 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\msapps

[2009.12.12 15:03:42 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\msagent

[2009.12.12 15:03:42 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\Media

[2009.12.12 15:03:42 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\L2Schemas

[2009.12.12 15:03:42 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\java

[2009.12.12 15:03:42 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\System32\inetsrv

[2009.12.12 15:03:42 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\System32\IME

[2009.12.12 15:03:42 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\ime

[2009.12.12 15:03:42 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\System32\icsxml

[2009.12.12 15:03:42 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\System32\ias

[2009.12.12 15:03:42 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\Help

[2009.12.12 15:03:42 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\System32\export

[2009.12.12 15:03:42 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\System32\drivers\etc

[2009.12.12 15:03:42 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\System32\en-US

[2009.12.12 15:03:42 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\System32\en

[2009.12.12 15:03:42 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\ehome

[2009.12.12 15:03:42 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\System32\drivers

[2009.12.12 15:03:42 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\Driver Cache

[2009.12.12 15:03:42 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\System32\drivers\disdn

[2009.12.12 15:03:42 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\System32\dhcp

[2009.12.12 15:03:42 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\Debug

[2009.12.12 15:03:42 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\Cursors

[2009.12.12 15:03:42 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\Connection Wizard

[2009.12.12 15:03:42 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\System32\config

[2009.12.12 15:03:42 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\Config

[2009.12.12 15:03:42 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\AppPatch

[2009.12.12 15:03:42 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\addins

[2009.12.12 15:03:42 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\System32\3com_dmi

[2009.12.12 15:03:42 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\System32\3076

[2009.12.12 15:03:42 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\System32\2052

[2009.12.12 15:03:42 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\System32\1054

[2009.12.12 15:03:42 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\System32\1042

[2009.12.12 15:03:42 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\System32\1041

[2009.12.12 15:03:42 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\System32\1037

[2009.12.12 15:03:42 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\System32\1033

[2009.12.12 15:03:42 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\System32\1031

[2009.12.12 15:03:42 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\System32\1028

[2009.12.12 15:03:42 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\System32\1025

[2009.12.12 15:01:58 | 00,000,000 | ---D | C] -- C:\Program Files\Intel

[2009.12.12 15:00:51 | 00,000,000 | ---D | C] -- C:\Program Files\Broadcom

[2009.12.12 15:00:22 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\System32\ReinstallBackups

[2009.12.12 15:00:16 | 00,193,056 | ---- | C] (Synaptics, Inc.) -- C:\WINDOWS.0\System32\drivers\SynTP.sys

[2009.12.12 15:00:16 | 00,114,688 | ---- | C] (Synaptics, Inc.) -- C:\WINDOWS.0\System32\SynCtrl.dll

[2009.12.12 15:00:16 | 00,094,298 | ---- | C] (Synaptics, Inc.) -- C:\WINDOWS.0\System32\SynTPAPI.dll

[2009.12.12 15:00:16 | 00,082,013 | ---- | C] (Synaptics, Inc.) -- C:\WINDOWS.0\System32\SynCOM.dll

[2009.12.12 15:00:16 | 00,081,920 | ---- | C] (Synaptics, Inc.) -- C:\WINDOWS.0\System32\SynTPCo2.dll

[2009.12.12 15:00:16 | 00,069,722 | ---- | C] (Synaptics, Inc.) -- C:\WINDOWS.0\System32\SynTPFcs.dll

[2009.12.12 15:00:16 | 00,000,000 | ---D | C] -- C:\Program Files\Synaptics

[2009.12.12 15:00:09 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\InstallShield

[2009.12.12 14:55:49 | 00,000,000 | ---D | C] -- C:\swsetup

[2009.12.12 14:54:35 | 00,000,000 | ---D | C] -- C:\WINDOWS

[2009.12.12 14:47:45 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files

[2009.12.12 14:47:16 | 00,000,000 | ---D | C] -- C:\Documents and Settings\asen\My Documents\The KMPlayer

[2009.12.12 14:46:33 | 00,000,000 | ---D | C] -- C:\Program Files\The KMPlayer

[2009.12.12 14:45:32 | 00,000,000 | ---D | C] -- C:\Downloads

[2009.12.12 14:28:49 | 00,000,000 | ---D | C] -- C:\Documents and Settings\asen\Application Data\WinRAR

[2009.12.12 14:28:07 | 00,000,000 | ---D | C] -- C:\Program Files\WinRAR

[2009.12.12 14:26:39 | 00,000,000 | ---D | C] -- C:\Program Files\FlashGet

[2009.12.12 14:24:59 | 00,000,000 | -HSD | C] -- C:\RECYCLER

[2009.12.12 14:19:58 | 00,000,000 | ---D | C] -- C:\Documents and Settings\asen\Application Data\Macromedia

[2009.12.12 14:19:58 | 00,000,000 | ---D | C] -- C:\Documents and Settings\asen\Application Data\Adobe

[2009.12.12 14:19:11 | 00,000,000 | ---D | C] -- C:\Documents and Settings\asen\Application Data\skypePM

[2009.12.12 14:17:50 | 00,000,000 | ---D | C] -- C:\Documents and Settings\asen\Application Data\Skype

[2009.12.12 14:17:19 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype

[2009.12.12 14:17:17 | 00,000,000 | R--D | C] -- C:\Program Files\Skype

[2009.12.12 14:17:12 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Skype

[2009.12.12 14:15:16 | 00,000,000 | ---D | C] -- C:\Documents and Settings\asen\My Documents\Изтегляния

[2009.12.12 14:11:07 | 00,000,000 | ---D | C] -- C:\Documents and Settings\asen\Local Settings\Application Data\Mozilla

[2009.12.12 14:11:07 | 00,000,000 | ---D | C] -- C:\Documents and Settings\asen\Application Data\Mozilla

[2009.12.12 14:10:48 | 00,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox

[2009.12.12 14:07:08 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\System32\LogFiles

[2009.12.12 14:05:18 | 00,000,000 | R--D | C] -- C:\Documents and Settings\asen\My Documents\My Pictures

[2009.12.12 14:05:18 | 00,000,000 | R--D | C] -- C:\Documents and Settings\asen\My Documents\My Music

[2009.12.12 13:51:09 | 00,000,000 | --SD | C] -- C:\Documents and Settings\asen\Application Data\Microsoft

[2009.12.12 13:51:09 | 00,000,000 | RH-D | C] -- C:\Documents and Settings\asen\Application Data

[2009.12.12 13:51:08 | 00,000,000 | --SD | C] -- C:\Documents and Settings\asen\Local Settings\Application Data\Microsoft

[2009.12.12 13:51:08 | 00,000,000 | RH-D | C] -- C:\Documents and Settings\asen\SendTo

[2009.12.12 13:51:08 | 00,000,000 | RH-D | C] -- C:\Documents and Settings\asen\Recent

[2009.12.12 13:51:08 | 00,000,000 | R--D | C] -- C:\Documents and Settings\asen\Start Menu

[2009.12.12 13:51:08 | 00,000,000 | R--D | C] -- C:\Documents and Settings\asen\My Documents

[2009.12.12 13:51:08 | 00,000,000 | R--D | C] -- C:\Documents and Settings\asen\Favorites

[2009.12.12 13:51:08 | 00,000,000 | -HSD | C] -- C:\Documents and Settings\asen\Cookies

[2009.12.12 13:51:08 | 00,000,000 | -H-D | C] -- C:\Documents and Settings\asen\Templates

[2009.12.12 13:51:08 | 00,000,000 | -H-D | C] -- C:\Documents and Settings\asen\PrintHood

[2009.12.12 13:51:08 | 00,000,000 | -H-D | C] -- C:\Documents and Settings\asen\NetHood

[2009.12.12 13:51:08 | 00,000,000 | -H-D | C] -- C:\Documents and Settings\asen\Local Settings

[2009.12.12 13:51:08 | 00,000,000 | ---D | C] -- C:\Documents and Settings\asen\Desktop

[2009.12.12 13:49:21 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\SoftwareDistribution

[2009.12.12 13:49:14 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\Prefetch

[2009.12.12 13:49:13 | 00,000,000 | --SD | C] -- C:\WINDOWS.0\System32\Microsoft

[2009.12.12 13:49:12 | 00,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Application Data\Microsoft

[2009.12.12 13:48:56 | 00,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Application Data\Microsoft

[2009.12.12 13:46:52 | 00,079,872 | ---- | C] (Ricoh Co., Ltd.) -- C:\WINDOWS.0\System32\dllcache\rwia330.dll

[2009.12.12 13:46:52 | 00,079,872 | ---- | C] (Ricoh Co., Ltd.) -- C:\WINDOWS.0\System32\dllcache\rwia001.dll

[2009.12.12 13:46:52 | 00,029,184 | ---- | C] (Ricoh Co., Ltd.) -- C:\WINDOWS.0\System32\dllcache\rw330ext.dll

[2009.12.12 13:46:07 | 00,057,856 | ---- | C] (SEIKO EPSON CORP.) -- C:\WINDOWS.0\System32\dllcache\esuimgd.dll

[2009.12.12 13:46:07 | 00,045,056 | ---- | C] (SEIKO EPSON CORP.) -- C:\WINDOWS.0\System32\dllcache\esunid.dll

[2009.12.12 13:46:07 | 00,031,744 | ---- | C] (SEIKO EPSON CORP.) -- C:\WINDOWS.0\System32\dllcache\esucmd.dll

[2009.12.12 13:45:53 | 00,054,528 | ---- | C] (Philips Semiconductors GmbH) -- C:\WINDOWS.0\System32\dllcache\cap7146.sys

[2009.12.12 13:45:22 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\System32\xircom

[2009.12.12 13:45:22 | 00,000,000 | ---D | C] -- C:\Program Files\xerox

[2009.12.12 13:45:22 | 00,000,000 | ---D | C] -- C:\Program Files\microsoft frontpage

[2009.12.12 13:45:03 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\System32\bg-bg

[2009.12.12 13:44:13 | 00,000,000 | ---D | C] -- C:\Program Files\MSXML 4.0

[2009.12.12 13:41:55 | 00,000,000 | -H-D | C] -- C:\WINDOWS.0\$hf_mig$

[2009.12.12 13:41:32 | 00,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft

[2009.12.12 13:41:32 | 00,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft

[2009.12.12 13:40:20 | 00,000,000 | -HSD | C] -- C:\Documents and Settings\All Users\DRM

[2009.12.12 13:39:55 | 00,000,000 | -H-D | C] -- C:\Program Files\WindowsUpdate

[2009.12.12 13:39:29 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\System32\DirectX

[2009.12.12 13:39:10 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\Services

[2009.12.12 13:39:08 | 00,000,000 | --SD | C] -- C:\WINDOWS.0\Tasks

[2009.12.12 13:39:07 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\MSSoap

[2009.12.12 13:39:02 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\srchasst

[2009.12.12 13:39:01 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\System32\Macromed

[2009.12.12 13:38:54 | 00,000,000 | ---D | C] -- C:\Program Files\Movie Maker

[2009.12.12 13:38:31 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\System32\Restore

[2009.12.12 13:38:27 | 00,000,000 | ---D | C] -- C:\Program Files\NetMeeting

[2009.12.12 13:38:23 | 00,000,000 | ---D | C] -- C:\Program Files\Outlook Express

[2009.12.12 13:38:17 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\System

[2009.12.12 13:38:13 | 00,000,000 | ---D | C] -- C:\Program Files\Internet Explorer

[2009.12.12 13:38:11 | 00,000,000 | R--D | C] -- C:\Documents and Settings\All Users\Documents\My Pictures

[2009.12.12 13:37:23 | 00,000,000 | ---D | C] -- C:\Program Files\ComPlus Applications

[2009.12.12 13:37:14 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\Registration

[2009.12.12 13:37:02 | 00,000,000 | ---D | C] -- C:\Program Files\Online Services

[2009.12.12 13:36:45 | 00,000,000 | ---D | C] -- C:\Program Files\Windows Media Connect 2

[2009.12.12 13:36:44 | 00,000,000 | ---D | C] -- C:\Program Files\Windows Media Player

[2009.12.12 13:36:42 | 00,000,000 | ---D | C] -- C:\Program Files\Messenger

[2009.12.12 13:36:39 | 00,000,000 | ---D | C] -- C:\Program Files\MSN Gaming Zone

[2009.12.12 13:36:02 | 00,000,000 | ---D | C] -- C:\Program Files\MSN

[2009.12.12 13:36:01 | 00,281,088 | ---- | C] (Cinematronics) -- C:\WINDOWS.0\System32\dllcache\pinball.exe

[2009.12.12 13:36:00 | 00,000,000 | ---D | C] -- C:\Program Files\Windows NT

[2009.12.12 13:35:55 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\System32\MsDtc

[2009.12.12 13:35:53 | 00,000,000 | ---D | C] -- C:\WINDOWS.0\System32\Com

[2009.12.12 13:35:41 | 00,000,000 | R--D | C] -- C:\Documents and Settings\All Users\Documents\My Videos

[3 C:\WINDOWS.0\*.tmp files -> C:\WINDOWS.0\*.tmp -> ]

[1 C:\WINDOWS.0\System32\*.tmp files -> C:\WINDOWS.0\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2009.12.17 15:39:57 | 00,002,408 | -H-- | M] () -- C:\WINDOWS.0\hqtfmzbltdulehcejxhjukkhyyhkwdq.cku

[2009.12.17 15:39:57 | 00,002,408 | -H-- | M] () -- C:\Program Files\hqtfmzbltdulehcejxhjukkhyyhkwdq.cku

[2009.12.17 15:39:57 | 00,002,408 | -H-- | M] () -- C:\Documents and Settings\asen\Local Settings\Application Data\hqtfmzbltdulehcejxhjukkhyyhkwdq.cku

[2009.12.17 15:39:57 | 00,000,272 | -H-- | M] () -- C:\WINDOWS.0\fexzwzrrppwdmfqidhhza.wjq

[2009.12.17 15:39:57 | 00,000,272 | -H-- | M] () -- C:\Program Files\fexzwzrrppwdmfqidhhza.wjq

[2009.12.17 15:39:57 | 00,000,272 | -H-- | M] () -- C:\Documents and Settings\asen\Local Settings\Application Data\fexzwzrrppwdmfqidhhza.wjq

[2009.12.17 15:39:44 | 00,557,056 | RHS- | M] () -- C:\WINDOWS.0\uqgfzzolgdhlrhpewxujhk.exe

[2009.12.17 15:39:44 | 00,557,056 | RHS- | M] () -- C:\WINDOWS.0\qiupfbmfwppprdhsgd.exe

[2009.12.17 15:39:44 | 00,557,056 | RHS- | M] () -- C:\WINDOWS.0\oiwtljwrkfhjnbhukjer.exe

[2009.12.17 15:39:44 | 00,557,056 | RHS- | M] () -- C:\WINDOWS.0\hyjdsnxpfxwvwhkuh.exe

[2009.12.17 15:39:44 | 00,557,056 | RHS- | M] () -- C:\WINDOWS.0\dynledrnhdgjodkypplzw.exe

[2009.12.17 15:39:44 | 00,557,056 | RHS- | M] () -- C:\WINDOWS.0\buhdurdxpjklobgshfz.exe

[2009.12.17 15:39:44 | 00,557,056 | RHS- | M] () -- C:\WINDOWS.0\aqathbkbqhfddnpy.exe

[2009.12.17 15:39:29 | 00,000,779 | -H-- | M] () -- C:\WINDOWS.0\System32\sekzjzercpjdzfdiqhuzngjjdgsynxnsfq.xrn

[2009.12.17 15:39:29 | 00,000,779 | -H-- | M] () -- C:\WINDOWS.0\sekzjzercpjdzfdiqhuzngjjdgsynxnsfq.xrn

[2009.12.17 15:39:29 | 00,000,779 | -H-- | M] () -- C:\Program Files\sekzjzercpjdzfdiqhuzngjjdgsynxnsfq.xrn

[2009.12.17 15:39:29 | 00,000,779 | -H-- | M] () -- C:\Documents and Settings\asen\Local Settings\Application Data\sekzjzercpjdzfdiqhuzngjjdgsynxnsfq.xrn

[2009.12.17 15:39:26 | 00,002,408 | -H-- | M] () -- C:\WINDOWS.0\System32\hqtfmzbltdulehcejxhjukkhyyhkwdq.cku

[2009.12.17 15:39:26 | 00,000,272 | -H-- | M] () -- C:\WINDOWS.0\System32\fexzwzrrppwdmfqidhhza.wjq

[2009.12.17 15:34:50 | 00,000,631 | ---- | M] () -- C:\Documents and Settings\asen\Desktop\Пряк път до OTL.lnk

[2009.12.17 15:33:20 | 00,356,120 | ---- | M] () -- C:\WINDOWS.0\System32\PerfStringBackup.INI

[2009.12.17 15:33:20 | 00,311,938 | ---- | M] () -- C:\WINDOWS.0\System32\perfh009.dat

[2009.12.17 15:33:20 | 00,040,326 | ---- | M] () -- C:\WINDOWS.0\System32\perfc009.dat

[2009.12.17 15:29:39 | 00,000,837 | RHS- | M] () -- C:\autorun.inf

[2009.12.17 15:29:30 | 00,001,503 | -H-- | M] () -- C:\WINDOWS.0\System32\relbmdjxjxsnkrqwfxlrgaefaeryozqwkwk.axe

[2009.12.17 15:29:30 | 00,001,503 | -H-- | M] () -- C:\WINDOWS.0\relbmdjxjxsnkrqwfxlrgaefaeryozqwkwk.axe

[2009.12.17 15:29:30 | 00,001,503 | -H-- | M] () -- C:\Program Files\relbmdjxjxsnkrqwfxlrgaefaeryozqwkwk.axe

[2009.12.17 15:29:30 | 00,001,503 | -H-- | M] () -- C:\Documents and Settings\asen\Local Settings\Application Data\relbmdjxjxsnkrqwfxlrgaefaeryozqwkwk.axe

[2009.12.17 15:29:29 | 00,004,488 | -H-- | M] () -- C:\WINDOWS.0\System32\akobjxalufxpjnjmshsvhyzxpqaerznq.kvn

[2009.12.17 15:29:29 | 00,004,488 | -H-- | M] () -- C:\WINDOWS.0\akobjxalufxpjnjmshsvhyzxpqaerznq.kvn

[2009.12.17 15:29:29 | 00,004,488 | -H-- | M] () -- C:\Program Files\akobjxalufxpjnjmshsvhyzxpqaerznq.kvn

[2009.12.17 15:29:29 | 00,004,488 | -H-- | M] () -- C:\Documents and Settings\asen\Local Settings\Application Data\akobjxalufxpjnjmshsvhyzxpqaerznq.kvn

[2009.12.17 15:29:10 | 00,512,000 | RHS- | M] () -- C:\WINDOWS.0\System32\uqgfzzolgdhlrhpewxujhk.exe

[2009.12.17 15:29:10 | 00,512,000 | RHS- | M] () -- C:\WINDOWS.0\System32\qiupfbmfwppprdhsgd.exe

[2009.12.17 15:29:10 | 00,512,000 | RHS- | M] () -- C:\WINDOWS.0\System32\oiwtljwrkfhjnbhukjer.exe

[2009.12.17 15:29:10 | 00,512,000 | RHS- | M] () -- C:\WINDOWS.0\System32\dynledrnhdgjodkypplzw.exe

[2009.12.17 15:29:10 | 00,512,000 | RHS- | M] () -- C:\WINDOWS.0\System32\buhdurdxpjklobgshfz.exe

[2009.12.17 15:29:10 | 00,512,000 | RHS- | M] () -- C:\WINDOWS.0\System32\aqathbkbqhfddnpy.exe

[2009.12.17 15:29:02 | 00,512,000 | RHS- | M] () -- C:\WINDOWS.0\System32\hyjdsnxpfxwvwhkuh.exe

[2009.12.17 15:29:00 | 00,000,006 | -H-- | M] () -- C:\WINDOWS.0\tasks\SA.DAT

[2009.12.17 15:28:58 | 00,002,048 | --S- | M] () -- C:\WINDOWS.0\bootstat.dat

[2009.12.17 15:28:56 | 52,643,8400 | -HS- | M] () -- C:\hiberfil.sys

[2009.12.16 23:50:02 | 01,048,576 | -H-- | M] () -- C:\Documents and Settings\asen\NTUSER.DAT

[2009.12.16 23:50:02 | 00,000,178 | -HS- | M] () -- C:\Documents and Settings\asen\ntuser.ini

[2009.12.16 23:01:00 | 00,000,232 | ---- | M] () -- C:\WINDOWS.0\tasks\Scheduled Update for Ask Toolbar.job

[2009.12.16 18:58:02 | 00,002,206 | ---- | M] () -- C:\WINDOWS.0\System32\wpa.dbl

[2009.12.14 23:16:12 | 05,868,650 | -H-- | M] () -- C:\Documents and Settings\asen\Local Settings\Application Data\IconCache.db

[2009.12.13 14:55:46 | 00,003,584 | ---- | M] () -- C:\Documents and Settings\asen\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2009.12.13 14:39:22 | 00,000,103 | ---- | M] () -- C:\WINDOWS.0\System\CmiInst.Ini

[2009.12.12 15:30:33 | 00,004,452 | ---- | M] () -- C:\WINDOWS.0\System32\pid.PNF

[2009.12.12 15:16:14 | 00,009,392 | ---- | M] () -- C:\Documents and Settings\asen\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

[2009.12.12 14:46:47 | 00,000,710 | ---- | M] () -- C:\Documents and Settings\asen\Desktop\KMPlayer.lnk

[2009.12.12 14:26:41 | 00,000,682 | ---- | M] () -- C:\Documents and Settings\asen\Desktop\FlashGet.lnk

[2009.12.12 14:19:11 | 00,000,056 | -H-- | M] () -- C:\WINDOWS.0\System32\ezsidmv.dat

[2009.12.12 14:17:19 | 00,001,882 | ---- | M] () -- C:\Documents and Settings\asen\Desktop\Skype.lnk

[2009.12.12 14:11:11 | 00,000,000 | ---- | M] () -- C:\WINDOWS.0\nsreg.dat

[2009.12.12 14:10:51 | 00,001,602 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk

[2009.12.12 13:51:23 | 00,010,117 | ---- | M] () -- C:\hwids.dat

[2009.12.12 13:48:59 | 00,008,192 | ---- | M] () -- C:\WINDOWS.0\REGLOCS.OLD

[2009.12.12 13:48:39 | 00,090,296 | ---- | M] () -- C:\WINDOWS.0\System32\FNTCACHE.DAT

[2009.12.12 13:47:39 | 00,000,361 | ---- | M] () -- C:\WINDOWS.0\System32\$winnt$.inf

[2009.12.12 13:45:01 | 00,000,231 | ---- | M] () -- C:\WINDOWS.0\system.ini

[2009.12.12 13:41:40 | 00,002,577 | ---- | M] () -- C:\WINDOWS.0\System32\CONFIG.NT

[2009.12.12 13:41:40 | 00,000,000 | RHS- | M] () -- C:\MSDOS.SYS

[2009.12.12 13:41:40 | 00,000,000 | RHS- | M] () -- C:\IO.SYS

[2009.12.12 13:41:40 | 00,000,000 | ---- | M] () -- C:\WINDOWS.0\control.ini

[2009.12.12 13:41:40 | 00,000,000 | ---- | M] () -- C:\CONFIG.SYS

[2009.12.12 13:41:40 | 00,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT

[2009.12.12 13:41:37 | 00,000,507 | ---- | M] () -- C:\WINDOWS.0\win.ini

[2009.12.12 13:41:31 | 00,023,392 | ---- | M] () -- C:\WINDOWS.0\System32\nscompat.tlb

[2009.12.12 13:41:31 | 00,016,832 | ---- | M] () -- C:\WINDOWS.0\System32\amcompat.tlb

[2009.12.12 13:41:29 | 00,316,640 | ---- | M] () -- C:\WINDOWS.0\WMSysPr9.prx

[2009.12.12 13:41:15 | 00,004,249 | ---- | M] () -- C:\WINDOWS.0\ODBCINST.INI

[2009.12.12 13:40:08 | 00,000,488 | RH-- | M] () -- C:\WINDOWS.0\System32\WindowsLogon.manifest

[2009.12.12 13:40:08 | 00,000,488 | RH-- | M] () -- C:\WINDOWS.0\System32\logonui.exe.manifest

[2009.12.12 13:40:04 | 00,000,749 | RH-- | M] () -- C:\WINDOWS.0\System32\wuaucpl.cpl.manifest

[2009.12.12 13:40:04 | 00,000,749 | RH-- | M] () -- C:\WINDOWS.0\WindowsShell.Manifest

[2009.12.12 13:40:04 | 00,000,749 | RH-- | M] () -- C:\WINDOWS.0\System32\sapi.cpl.manifest

[2009.12.12 13:40:04 | 00,000,749 | RH-- | M] () -- C:\WINDOWS.0\System32\nwc.cpl.manifest

[2009.12.12 13:40:04 | 00,000,749 | RH-- | M] () -- C:\WINDOWS.0\System32\ncpa.cpl.manifest

[2009.12.12 13:40:04 | 00,000,749 | RH-- | M] () -- C:\WINDOWS.0\System32\cdplayer.exe.manifest

[2009.12.12 13:37:35 | 00,021,640 | ---- | M] () -- C:\WINDOWS.0\System32\emptyregdb.dat

[2009.12.12 13:37:20 | 00,000,037 | ---- | M] () -- C:\WINDOWS.0\vbaddin.ini

[2009.12.12 13:37:20 | 00,000,036 | ---- | M] () -- C:\WINDOWS.0\vb.ini

[2009.12.12 13:32:01 | 00,000,325 | -HS- | M] () -- C:\boot.ini

[3 C:\WINDOWS.0\*.tmp files -> C:\WINDOWS.0\*.tmp -> ]

[1 C:\WINDOWS.0\System32\*.tmp files -> C:\WINDOWS.0\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2009.12.17 15:34:50 | 00,000,631 | ---- | C] () -- C:\Documents and Settings\asen\Desktop\Пряк път до OTL.lnk

[2009.12.13 14:55:39 | 00,003,584 | ---- | C] () -- C:\Documents and Settings\asen\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2009.12.13 14:29:37 | 00,000,103 | ---- | C] () -- C:\WINDOWS.0\System\CmiInst.Ini

[2009.12.13 14:29:36 | 00,024,576 | ---- | C] () -- C:\WINDOWS.0\CmiUSB2Uninstall.exe

[2009.12.13 10:49:01 | 00,007,680 | ---- | C] () -- C:\WINDOWS.0\System32\kbdBPKL.dll

[2009.12.12 18:16:02 | 00,001,503 | -H-- | C] () -- C:\WINDOWS.0\System32\relbmdjxjxsnkrqwfxlrgaefaeryozqwkwk.axe

[2009.12.12 18:16:02 | 00,001,503 | -H-- | C] () -- C:\WINDOWS.0\relbmdjxjxsnkrqwfxlrgaefaeryozqwkwk.axe

[2009.12.12 18:16:02 | 00,001,503 | -H-- | C] () -- C:\Program Files\relbmdjxjxsnkrqwfxlrgaefaeryozqwkwk.axe

[2009.12.12 18:16:02 | 00,001,503 | -H-- | C] () -- C:\Documents and Settings\asen\Local Settings\Application Data\relbmdjxjxsnkrqwfxlrgaefaeryozqwkwk.axe

[2009.12.12 18:16:02 | 00,000,779 | -H-- | C] () -- C:\WINDOWS.0\System32\sekzjzercpjdzfdiqhuzngjjdgsynxnsfq.xrn

[2009.12.12 18:16:02 | 00,000,779 | -H-- | C] () -- C:\WINDOWS.0\sekzjzercpjdzfdiqhuzngjjdgsynxnsfq.xrn

[2009.12.12 18:16:02 | 00,000,779 | -H-- | C] () -- C:\Program Files\sekzjzercpjdzfdiqhuzngjjdgsynxnsfq.xrn

[2009.12.12 18:16:02 | 00,000,779 | -H-- | C] () -- C:\Documents and Settings\asen\Local Settings\Application Data\sekzjzercpjdzfdiqhuzngjjdgsynxnsfq.xrn

[2009.12.12 15:30:33 | 00,004,452 | ---- | C] () -- C:\WINDOWS.0\System32\pid.PNF

[2009.12.12 15:20:05 | 01,685,606 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\sam.spd

[2009.12.12 15:20:05 | 00,605,050 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\r1033tts.lxa

[2009.12.12 15:20:05 | 00,000,888 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\sam.sdf

[2009.12.12 15:20:04 | 00,643,717 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\ltts1033.lxa

[2009.12.12 15:19:58 | 00,066,082 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\c_28603.nls

[2009.12.12 15:19:58 | 00,066,082 | ---- | C] () -- C:\WINDOWS.0\System32\c_28603.nls

[2009.12.12 15:19:57 | 00,066,594 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\c_857.nls

[2009.12.12 15:19:57 | 00,066,594 | ---- | C] () -- C:\WINDOWS.0\System32\c_857.nls

[2009.12.12 15:19:57 | 00,066,082 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\c_28599.nls

[2009.12.12 15:19:57 | 00,066,082 | ---- | C] () -- C:\WINDOWS.0\System32\c_28599.nls

[2009.12.12 15:19:57 | 00,066,082 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\c_10081.nls

[2009.12.12 15:19:57 | 00,066,082 | ---- | C] () -- C:\WINDOWS.0\System32\c_10081.nls

[2009.12.12 15:19:55 | 00,066,594 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\c_869.nls

[2009.12.12 15:19:55 | 00,066,594 | ---- | C] () -- C:\WINDOWS.0\System32\c_869.nls

[2009.12.12 15:19:55 | 00,066,594 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\c_737.nls

[2009.12.12 15:19:55 | 00,066,594 | ---- | C] () -- C:\WINDOWS.0\System32\c_737.nls

[2009.12.12 15:19:55 | 00,066,082 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\c_875.nls

[2009.12.12 15:19:55 | 00,066,082 | ---- | C] () -- C:\WINDOWS.0\System32\c_875.nls

[2009.12.12 15:19:55 | 00,066,082 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\c_28597.nls

[2009.12.12 15:19:55 | 00,066,082 | ---- | C] () -- C:\WINDOWS.0\System32\C_28597.NLS

[2009.12.12 15:19:55 | 00,066,082 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\c_28595.nls

[2009.12.12 15:19:55 | 00,066,082 | ---- | C] () -- C:\WINDOWS.0\System32\C_28595.NLS

[2009.12.12 15:19:55 | 00,066,082 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\c_10017.nls

[2009.12.12 15:19:55 | 00,066,082 | ---- | C] () -- C:\WINDOWS.0\System32\c_10017.nls

[2009.12.12 15:19:55 | 00,066,082 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\c_10007.nls

[2009.12.12 15:19:55 | 00,066,082 | ---- | C] () -- C:\WINDOWS.0\System32\c_10007.nls

[2009.12.12 15:19:55 | 00,066,082 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\c_10006.nls

[2009.12.12 15:19:55 | 00,066,082 | ---- | C] () -- C:\WINDOWS.0\System32\c_10006.nls

[2009.12.12 15:19:54 | 00,066,594 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\c_866.nls

[2009.12.12 15:19:54 | 00,066,594 | ---- | C] () -- C:\WINDOWS.0\System32\c_866.nls

[2009.12.12 15:19:54 | 00,066,594 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\c_855.nls

[2009.12.12 15:19:54 | 00,066,594 | ---- | C] () -- C:\WINDOWS.0\System32\c_855.nls

[2009.12.12 15:19:54 | 00,066,082 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\c_28594.nls

[2009.12.12 15:19:54 | 00,066,082 | ---- | C] () -- C:\WINDOWS.0\System32\C_28594.NLS

[2009.12.12 15:19:53 | 00,066,594 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\c_852.nls

[2009.12.12 15:19:53 | 00,066,594 | ---- | C] () -- C:\WINDOWS.0\System32\c_852.nls

[2009.12.12 15:19:53 | 00,066,082 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\c_10082.nls

[2009.12.12 15:19:53 | 00,066,082 | ---- | C] () -- C:\WINDOWS.0\System32\c_10082.nls

[2009.12.12 15:19:53 | 00,066,082 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\c_10029.nls

[2009.12.12 15:19:53 | 00,066,082 | ---- | C] () -- C:\WINDOWS.0\System32\c_10029.nls

[2009.12.12 15:19:53 | 00,066,082 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\c_10010.nls

[2009.12.12 15:19:53 | 00,066,082 | ---- | C] () -- C:\WINDOWS.0\System32\c_10010.nls

[2009.12.12 15:19:49 | 00,066,082 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\c_20127.nls

[2009.12.12 15:19:49 | 00,066,082 | ---- | C] () -- C:\WINDOWS.0\System32\c_20127.nls

[2009.12.12 15:19:46 | 00,001,688 | ---- | C] () -- C:\WINDOWS.0\System32\AUTOEXEC.NT

[2009.12.12 15:19:32 | 00,797,189 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\NT5IIS.CAT

[2009.12.12 15:19:32 | 00,399,645 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\MAPIMIG.CAT

[2009.12.12 15:19:32 | 00,144,484 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\netfx.cat

[2009.12.12 15:19:32 | 00,112,918 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\tabletpc.cat

[2009.12.12 15:19:32 | 00,037,484 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\MW770.CAT

[2009.12.12 15:19:32 | 00,034,747 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\mediactr.cat

[2009.12.12 15:19:32 | 00,034,063 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\FP4.CAT

[2009.12.12 15:19:32 | 00,026,991 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\msn7.cat

[2009.12.12 15:19:32 | 00,016,535 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\IMS.CAT

[2009.12.12 15:19:32 | 00,014,433 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\msn9.cat

[2009.12.12 15:19:32 | 00,013,472 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\HPCRDP.CAT

[2009.12.12 15:19:32 | 00,012,363 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\MSMSGS.CAT

[2009.12.12 15:19:32 | 00,010,027 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\MSTSWEB.CAT

[2009.12.12 15:19:32 | 00,008,574 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\IASNT4.CAT

[2009.12.12 15:19:32 | 00,007,382 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\OEMBIOS.CAT

[2009.12.12 15:19:32 | 00,007,334 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\wmerrenu.cat

[2009.12.12 15:19:31 | 02,144,487 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\NT5.CAT

[2009.12.12 15:19:31 | 01,296,669 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\SP3.CAT

[2009.12.12 15:19:31 | 00,522,220 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\NT5INF.CAT

[2009.12.12 15:18:49 | 00,364,721 | ---- | C] () -- C:\DPsFnshr.exe

[2009.12.12 15:18:49 | 00,282,725 | ---- | C] () -- C:\DSPdsblr.exe

[2009.12.12 15:18:49 | 00,235,131 | ---- | C] () -- C:\pmtimer.exe

[2009.12.12 15:18:49 | 00,137,728 | ---- | C] () -- C:\mute.exe

[2009.12.12 15:18:49 | 00,020,992 | ---- | C] () -- C:\makePNF.exe

[2009.12.12 15:18:49 | 00,000,632 | ---- | C] () -- C:\DPsFnshr.ini

[2009.12.12 15:16:45 | 00,003,525 | ---- | C] () -- C:\DriverPack_Sound_B_wnt5_x86-32.ini

[2009.12.12 15:15:38 | 00,004,214 | ---- | C] () -- C:\DriverPack_Sound_A_wnt5_x86-32.ini

[2009.12.12 15:15:09 | 00,075,188 | ---- | C] () -- C:\DriverPack_MassStorage_wnt5_x86-32.ini

[2009.12.12 15:14:47 | 00,005,110 | ---- | C] () -- C:\WINDOWS.0\System32\e100b325.din

[2009.12.12 15:14:45 | 00,000,770 | ---- | C] () -- C:\DriverPack_LAN_wnt5_x86-32.ini

[2009.12.12 15:13:39 | 00,001,822 | ---- | C] () -- C:\DriverPack_Graphics_C_wnt5_x86-32.ini

[2009.12.12 15:12:57 | 00,147,456 | ---- | C] () -- C:\WINDOWS.0\System32\igfxCoIn_v4906.dll

[2009.12.12 15:12:23 | 00,058,704 | ---- | C] () -- C:\WINDOWS.0\System32\igxpxk32.vp

[2009.12.12 15:12:23 | 00,023,216 | ---- | C] () -- C:\WINDOWS.0\System32\igxpxs32.vp

[2009.12.12 15:12:17 | 00,001,653 | ---- | C] () -- C:\DriverPack_Graphics_B_wnt5_x86-32.ini

[2009.12.12 15:10:00 | 00,001,279 | ---- | C] () -- C:\DriverPack_Graphics_A_wnt5_x86-32.ini

[2009.12.12 15:09:32 | 00,000,420 | ---- | C] () -- C:\DriverPack_CPU_wnt5_x86-32.ini

[2009.12.12 15:09:02 | 00,090,296 | ---- | C] () -- C:\WINDOWS.0\System32\FNTCACHE.DAT

[2009.12.12 15:08:08 | 00,000,361 | ---- | C] () -- C:\WINDOWS.0\System32\$winnt$.inf

[2009.12.12 15:03:26 | 00,001,902 | ---- | C] () -- C:\WINDOWS.0\System32\SetupBD.din

[2009.12.12 14:59:01 | 00,000,325 | -HS- | C] () -- C:\boot.ini

[2009.12.12 14:47:23 | 00,000,232 | ---- | C] () -- C:\WINDOWS.0\tasks\Scheduled Update for Ask Toolbar.job

[2009.12.12 14:46:47 | 00,000,710 | ---- | C] () -- C:\Documents and Settings\asen\Desktop\KMPlayer.lnk

[2009.12.12 14:26:41 | 00,000,682 | ---- | C] () -- C:\Documents and Settings\asen\Desktop\FlashGet.lnk

[2009.12.12 14:19:11 | 00,000,056 | -H-- | C] () -- C:\WINDOWS.0\System32\ezsidmv.dat

[2009.12.12 14:17:19 | 00,001,882 | ---- | C] () -- C:\Documents and Settings\asen\Desktop\Skype.lnk

[2009.12.12 14:11:11 | 00,000,000 | ---- | C] () -- C:\WINDOWS.0\nsreg.dat

[2009.12.12 14:10:51 | 00,001,602 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk

[2009.12.12 14:08:39 | 00,002,408 | -H-- | C] () -- C:\WINDOWS.0\hqtfmzbltdulehcejxhjukkhyyhkwdq.cku

[2009.12.12 14:08:39 | 00,002,408 | -H-- | C] () -- C:\Program Files\hqtfmzbltdulehcejxhjukkhyyhkwdq.cku

[2009.12.12 14:08:39 | 00,002,408 | -H-- | C] () -- C:\Documents and Settings\asen\Local Settings\Application Data\hqtfmzbltdulehcejxhjukkhyyhkwdq.cku

[2009.12.12 14:08:39 | 00,002,402 | -H-- | C] () -- C:\WINDOWS.0\System32\hqtfmzbltdulehcejxhjukkhyyhkwdq.cku

[2009.12.12 14:08:26 | 00,000,837 | RHS- | C] () -- C:\autorun.inf

[2009.12.12 14:05:55 | 00,004,488 | -H-- | C] () -- C:\WINDOWS.0\System32\akobjxalufxpjnjmshsvhyzxpqaerznq.kvn

[2009.12.12 14:05:55 | 00,004,488 | -H-- | C] () -- C:\WINDOWS.0\akobjxalufxpjnjmshsvhyzxpqaerznq.kvn

[2009.12.12 14:05:55 | 00,004,488 | -H-- | C] () -- C:\Program Files\akobjxalufxpjnjmshsvhyzxpqaerznq.kvn

[2009.12.12 14:05:55 | 00,004,488 | -H-- | C] () -- C:\Documents and Settings\asen\Local Settings\Application Data\akobjxalufxpjnjmshsvhyzxpqaerznq.kvn

[2009.12.12 14:05:55 | 00,000,272 | -H-- | C] () -- C:\WINDOWS.0\System32\fexzwzrrppwdmfqidhhza.wjq

[2009.12.12 14:05:55 | 00,000,272 | -H-- | C] () -- C:\WINDOWS.0\fexzwzrrppwdmfqidhhza.wjq

[2009.12.12 14:05:55 | 00,000,272 | -H-- | C] () -- C:\Program Files\fexzwzrrppwdmfqidhhza.wjq

[2009.12.12 14:05:55 | 00,000,272 | -H-- | C] () -- C:\Documents and Settings\asen\Local Settings\Application Data\fexzwzrrppwdmfqidhhza.wjq

[2009.12.12 14:05:39 | 00,557,056 | RHS- | C] () -- C:\WINDOWS.0\uqgfzzolgdhlrhpewxujhk.exe

[2009.12.12 14:05:39 | 00,557,056 | RHS- | C] () -- C:\WINDOWS.0\qiupfbmfwppprdhsgd.exe

[2009.12.12 14:05:39 | 00,557,056 | RHS- | C] () -- C:\WINDOWS.0\oiwtljwrkfhjnbhukjer.exe

[2009.12.12 14:05:39 | 00,557,056 | RHS- | C] () -- C:\WINDOWS.0\hyjdsnxpfxwvwhkuh.exe

[2009.12.12 14:05:39 | 00,557,056 | RHS- | C] () -- C:\WINDOWS.0\dynledrnhdgjodkypplzw.exe

[2009.12.12 14:05:39 | 00,557,056 | RHS- | C] () -- C:\WINDOWS.0\buhdurdxpjklobgshfz.exe

[2009.12.12 14:05:39 | 00,557,056 | RHS- | C] () -- C:\WINDOWS.0\aqathbkbqhfddnpy.exe

[2009.12.12 14:05:39 | 00,512,000 | RHS- | C] () -- C:\WINDOWS.0\System32\uqgfzzolgdhlrhpewxujhk.exe

[2009.12.12 14:05:38 | 00,512,000 | RHS- | C] () -- C:\WINDOWS.0\System32\qiupfbmfwppprdhsgd.exe

[2009.12.12 14:05:38 | 00,512,000 | RHS- | C] () -- C:\WINDOWS.0\System32\oiwtljwrkfhjnbhukjer.exe

[2009.12.12 14:05:38 | 00,512,000 | RHS- | C] () -- C:\WINDOWS.0\System32\hyjdsnxpfxwvwhkuh.exe

[2009.12.12 14:05:38 | 00,512,000 | RHS- | C] () -- C:\WINDOWS.0\System32\dynledrnhdgjodkypplzw.exe

[2009.12.12 14:05:38 | 00,512,000 | RHS- | C] () -- C:\WINDOWS.0\System32\buhdurdxpjklobgshfz.exe

[2009.12.12 14:05:38 | 00,512,000 | RHS- | C] () -- C:\WINDOWS.0\System32\aqathbkbqhfddnpy.exe

[2009.12.12 13:51:23 | 00,010,117 | ---- | C] () -- C:\hwids.dat

[2009.12.12 13:51:11 | 00,000,178 | -HS- | C] () -- C:\Documents and Settings\asen\ntuser.ini

[2009.12.12 13:51:08 | 01,048,576 | -H-- | C] () -- C:\Documents and Settings\asen\NTUSER.DAT

[2009.12.12 13:51:04 | 52,643,8400 | -HS- | C] () -- C:\hiberfil.sys

[2009.12.12 13:48:59 | 00,008,192 | ---- | C] () -- C:\WINDOWS.0\REGLOCS.OLD

[2009.12.12 13:47:39 | 00,002,048 | --S- | C] () -- C:\WINDOWS.0\bootstat.dat

[2009.12.12 13:47:23 | 00,028,288 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\xjis.nls

[2009.12.12 13:47:22 | 00,239,616 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\wstrendr.ax

[2009.12.12 13:46:47 | 00,083,748 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\prcp.nls

[2009.12.12 13:46:47 | 00,083,748 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\prc.nls

[2009.12.12 13:46:46 | 00,167,219 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\pagefile.vbs

[2009.12.12 13:46:36 | 00,355,112 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\msjetol1.dll

[2009.12.12 13:46:25 | 00,047,066 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\ksc.nls

[2009.12.12 13:46:24 | 01,158,818 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\korwbrkr.lex

[2009.12.12 13:46:11 | 00,094,208 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\fpencode.dll

[2009.12.12 13:46:07 | 00,097,965 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\evtquery.vbs

[2009.12.12 13:45:53 | 00,066,594 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\c_864.nls

[2009.12.12 13:45:53 | 00,066,594 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\c_862.nls

[2009.12.12 13:45:53 | 00,066,594 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\c_858.nls

[2009.12.12 13:45:53 | 00,066,082 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\c_870.nls

[2009.12.12 13:45:52 | 00,180,770 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\c_20932.nls

[2009.12.12 13:45:52 | 00,177,698 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\c_20949.nls

[2009.12.12 13:45:52 | 00,173,602 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\c_20936.nls

[2009.12.12 13:45:52 | 00,066,594 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\c_720.nls

[2009.12.12 13:45:52 | 00,066,082 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\c_708.nls

[2009.12.12 13:45:52 | 00,066,082 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\c_28596.nls

[2009.12.12 13:45:52 | 00,066,082 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\c_21027.nls

[2009.12.12 13:45:52 | 00,066,082 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\c_21025.nls

[2009.12.12 13:45:52 | 00,066,082 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\c_20924.nls

[2009.12.12 13:45:51 | 00,066,082 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\c_20880.nls

[2009.12.12 13:45:51 | 00,066,082 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\c_20871.nls

[2009.12.12 13:45:51 | 00,066,082 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\c_20838.nls

[2009.12.12 13:45:51 | 00,066,082 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\c_20833.nls

[2009.12.12 13:45:51 | 00,066,082 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\c_20424.nls

[2009.12.12 13:45:51 | 00,066,082 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\c_20423.nls

[2009.12.12 13:45:51 | 00,066,082 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\c_20420.nls

[2009.12.12 13:45:51 | 00,066,082 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\c_20297.nls

[2009.12.12 13:45:51 | 00,066,082 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\c_20290.nls

[2009.12.12 13:45:51 | 00,066,082 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\c_20285.nls

[2009.12.12 13:45:51 | 00,066,082 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\c_20284.nls

[2009.12.12 13:45:51 | 00,066,082 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\c_20280.nls

[2009.12.12 13:45:51 | 00,066,082 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\c_20278.nls

[2009.12.12 13:45:51 | 00,066,082 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\c_20277.nls

[2009.12.12 13:45:51 | 00,066,082 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\c_20273.nls

[2009.12.12 13:45:50 | 00,187,938 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\c_20005.nls

[2009.12.12 13:45:50 | 00,186,402 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\c_20001.nls

[2009.12.12 13:45:50 | 00,185,378 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\c_20003.nls

[2009.12.12 13:45:50 | 00,180,258 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\c_20004.nls

[2009.12.12 13:45:50 | 00,173,602 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\c_20002.nls

[2009.12.12 13:45:50 | 00,066,082 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\c_20269.nls

[2009.12.12 13:45:50 | 00,066,082 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\c_20108.nls

[2009.12.12 13:45:50 | 00,066,082 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\c_20107.nls

[2009.12.12 13:45:50 | 00,066,082 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\c_20106.nls

[2009.12.12 13:45:50 | 00,066,082 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\c_20105.nls

[2009.12.12 13:45:49 | 00,189,986 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\c_1361.nls

[2009.12.12 13:45:49 | 00,180,258 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\c_20000.nls

[2009.12.12 13:45:49 | 00,066,082 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\c_1149.nls

[2009.12.12 13:45:49 | 00,066,082 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\c_1148.nls

[2009.12.12 13:45:49 | 00,066,082 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\c_1147.nls

[2009.12.12 13:45:49 | 00,066,082 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\c_1146.nls

[2009.12.12 13:45:49 | 00,066,082 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\c_1145.nls

[2009.12.12 13:45:49 | 00,066,082 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\c_1144.nls

[2009.12.12 13:45:49 | 00,066,082 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\c_1143.nls

[2009.12.12 13:45:49 | 00,066,082 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\c_1142.nls

[2009.12.12 13:45:48 | 00,195,618 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\c_10002.nls

[2009.12.12 13:45:48 | 00,177,698 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\c_10003.nls

[2009.12.12 13:45:48 | 00,173,602 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\c_10008.nls

[2009.12.12 13:45:48 | 00,162,850 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\c_10001.nls

[2009.12.12 13:45:48 | 00,066,082 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\c_1141.nls

[2009.12.12 13:45:48 | 00,066,082 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\c_1140.nls

[2009.12.12 13:45:48 | 00,066,082 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\c_1047.nls

[2009.12.12 13:45:48 | 00,066,082 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\c_10021.nls

[2009.12.12 13:45:48 | 00,066,082 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\c_10005.nls

[2009.12.12 13:45:48 | 00,066,082 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\c_10004.nls

[2009.12.12 13:45:47 | 00,082,172 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\bopomofo.nls

[2009.12.12 13:45:47 | 00,066,728 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\big5.nls

[2009.12.12 13:41:40 | 00,002,577 | ---- | C] () -- C:\WINDOWS.0\System32\CONFIG.NT

[2009.12.12 13:41:40 | 00,000,000 | RHS- | C] () -- C:\MSDOS.SYS

[2009.12.12 13:41:40 | 00,000,000 | RHS- | C] () -- C:\IO.SYS

[2009.12.12 13:41:40 | 00,000,000 | ---- | C] () -- C:\CONFIG.SYS

[2009.12.12 13:41:40 | 00,000,000 | ---- | C] () -- C:\AUTOEXEC.BAT

[2009.12.12 13:41:31 | 00,023,392 | ---- | C] () -- C:\WINDOWS.0\System32\nscompat.tlb

[2009.12.12 13:41:31 | 00,016,832 | ---- | C] () -- C:\WINDOWS.0\System32\amcompat.tlb

[2009.12.12 13:41:29 | 00,316,640 | ---- | C] () -- C:\WINDOWS.0\WMSysPr9.prx

[2009.12.12 13:40:08 | 00,000,488 | RH-- | C] () -- C:\WINDOWS.0\System32\WindowsLogon.manifest

[2009.12.12 13:40:08 | 00,000,488 | RH-- | C] () -- C:\WINDOWS.0\System32\logonui.exe.manifest

[2009.12.12 13:40:04 | 00,000,749 | RH-- | C] () -- C:\WINDOWS.0\System32\wuaucpl.cpl.manifest

[2009.12.12 13:40:04 | 00,000,749 | RH-- | C] () -- C:\WINDOWS.0\WindowsShell.Manifest

[2009.12.12 13:40:04 | 00,000,749 | RH-- | C] () -- C:\WINDOWS.0\System32\sapi.cpl.manifest

[2009.12.12 13:40:04 | 00,000,749 | RH-- | C] () -- C:\WINDOWS.0\System32\nwc.cpl.manifest

[2009.12.12 13:40:04 | 00,000,749 | RH-- | C] () -- C:\WINDOWS.0\System32\ncpa.cpl.manifest

[2009.12.12 13:40:04 | 00,000,749 | RH-- | C] () -- C:\WINDOWS.0\System32\cdplayer.exe.manifest

[2009.12.12 13:39:36 | 04,399,505 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\nls302en.lex

[2009.12.12 13:39:18 | 00,048,680 | -HS- | C] () -- C:\WINDOWS.0\winnt256.bmp

[2009.12.12 13:39:18 | 00,048,680 | -HS- | C] () -- C:\WINDOWS.0\winnt.bmp

[2009.12.12 13:39:12 | 00,000,984 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\srframe.mmf

[2009.12.12 13:38:33 | 00,376,832 | ---- | C] () -- C:\WINDOWS.0\System32\dllcache\msinfo.dll

[2009.12.12 13:37:35 | 00,021,640 | ---- | C] () -- C:\WINDOWS.0\System32\emptyregdb.dat

[2009.12.12 13:36:25 | 00,065,954 | ---- | C] () -- C:\WINDOWS.0\Prairie Wind.bmp

[2009.12.12 13:36:25 | 00,065,832 | ---- | C] () -- C:\WINDOWS.0\Santa Fe Stucco.bmp

[2009.12.12 13:36:25 | 00,026,680 | ---- | C] () -- C:\WINDOWS.0\River Sumida.bmp

[2009.12.12 13:36:25 | 00,026,582 | ---- | C] () -- C:\WINDOWS.0\Greenstone.bmp

[2009.12.12 13:36:25 | 00,017,362 | ---- | C] () -- C:\WINDOWS.0\Rhododendron.bmp

[2009.12.12 13:36:25 | 00,017,336 | ---- | C] () -- C:\WINDOWS.0\Gone Fishing.bmp

[2009.12.12 13:36:25 | 00,017,062 | ---- | C] () -- C:\WINDOWS.0\Coffee Bean.bmp

[2009.12.12 13:36:25 | 00,016,730 | ---- | C] () -- C:\WINDOWS.0\FeatherTexture.bmp

[2009.12.12 13:36:25 | 00,009,522 | ---- | C] () -- C:\WINDOWS.0\Zapotec.bmp

[2009.12.12 13:36:24 | 00,093,702 | ---- | C] () -- C:\WINDOWS.0\System32\subrange.uce

[2009.12.12 13:36:24 | 00,065,978 | ---- | C] () -- C:\WINDOWS.0\Soap Bubbles.bmp

[2009.12.12 13:36:24 | 00,060,458 | ---- | C] () -- C:\WINDOWS.0\System32\ideograf.uce

[2009.12.12 13:36:24 | 00,024,006 | ---- | C] () -- C:\WINDOWS.0\System32\gb2312.uce

[2009.12.12 13:36:24 | 00,016,740 | ---- | C] () -- C:\WINDOWS.0\System32\shiftjis.uce

[2009.12.12 13:36:24 | 00,012,876 | ---- | C] () -- C:\WINDOWS.0\System32\korean.uce

[2009.12.12 13:36:24 | 00,008,484 | ---- | C] () -- C:\WINDOWS.0\System32\kanji_2.uce

[2009.12.12 13:36:24 | 00,006,948 | ---- | C] () -- C:\WINDOWS.0\System32\kanji_1.uce

[2009.12.12 13:36:24 | 00,001,272 | ---- | C] () -- C:\WINDOWS.0\Blue Lace 16.bmp

[2009.12.12 13:36:23 | 00,022,984 | ---- | C] () -- C:\WINDOWS.0\System32\bopomofo.uce

[2009.12.12 13:36:22 | 00,003,286 | ---- | C] () -- C:\WINDOWS.0\System32\tslabels.h

[2009.12.12 13:36:22 | 00,001,161 | ---- | C] () -- C:\WINDOWS.0\System32\usrlogon.cmd

[2009.12.12 13:36:21 | 00,000,768 | ---- | C] () -- C:\WINDOWS.0\System32\msdtcprf.h

[2009.12.12 13:36:16 | 00,063,488 | ---- | C] () -- C:\WINDOWS.0\System32\wmimgmt.msc

[2007.04.02 17:19:22 | 00,355,112 | ---- | C] () -- C:\WINDOWS.0\System32\msjetol1.dll

[2002.12.11 23:00:00 | 00,007,680 | ---- | C] () -- C:\WINDOWS.0\System32\kbdBF.dll

========== LOP Check ==========

[2009.12.16 23:01:00 | 00,000,232 | ---- | M] () -- C:\WINDOWS.0\Tasks\Scheduled Update for Ask Toolbar.job

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >

[2008.04.08 12:46:45 | 00,055,808 | ---- | M] (Microsoft Corporation) -- C:\devcon.exe

[2008.05.02 11:11:10 | 00,364,721 | ---- | M] () -- C:\DPsFnshr.exe

[2008.05.02 11:11:14 | 00,282,725 | ---- | M] () -- C:\DSPdsblr.exe

[2008.04.08 12:46:45 | 00,020,992 | ---- | M] () -- C:\makePNF.exe

[2008.04.08 12:46:45 | 00,137,728 | ---- | M] () -- C:\mute.exe

[2008.05.02 11:11:17 | 00,235,131 | ---- | M] () -- C:\pmtimer.exe

< %SYSTEMDRIVE%\eventlog.dll /s /md5 >

[2008.04.14 04:41:54 | 00,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS.0\system32\eventlog.dll

[1 C:\WINDOWS.0\system32\*.tmp files -> C:\WINDOWS.0\system32\*.tmp -> ]

[2008.04.14 04:41:54 | 00,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS.0\system32\dllcache\eventlog.dll

[2008.04.14 04:41:54 | 00,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\system32\eventlog.dll

< %SYSTEMDRIVE%\scecli.dll /s /md5 >

[2008.04.14 04:42:06 | 00,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS.0\system32\scecli.dll

[1 C:\WINDOWS.0\system32\*.tmp files -> C:\WINDOWS.0\system32\*.tmp -> ]

[2008.04.14 04:42:06 | 00,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS.0\system32\dllcache\scecli.dll

[2008.04.14 04:42:06 | 00,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\system32\scecli.dll

< %SYSTEMDRIVE%\netlogon.dll /s /md5 >

[2008.04.14 04:42:02 | 00,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS.0\system32\netlogon.dll

[1 C:\WINDOWS.0\system32\*.tmp files -> C:\WINDOWS.0\system32\*.tmp -> ]

[2008.04.14 04:42:02 | 00,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS.0\system32\dllcache\netlogon.dll

[2008.04.14 04:42:02 | 00,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\system32\netlogon.dll

< %SYSTEMDRIVE%\cngaudit.dll /s /md5 >

< %SYSTEMDRIVE%\sceclt.dll /s /md5 >

< %SYSTEMDRIVE%\ntelogon.dll /s /md5 >

< %SYSTEMDRIVE%\logevent.dll /s /md5 >

< %SYSTEMDRIVE%\iaStor.sys /s /md5 >

[2007.09.29 23:03:12 | 00,308,248 | ---- | M] (Intel Corporation) MD5=E5A0034847537EAEE3C00349D5C34C5F -- C:\WINDOWS.0\DriverPacks\M\I3\IaStor.sys

< %SYSTEMDRIVE%\nvstor.sys /s /md5 >

< %SYSTEMDRIVE%\atapi.sys /s /md5 >

[2008.04.13 23:10:32 | 00,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS.0\system32\drivers\atapi.sys

[2008.04.13 23:10:32 | 00,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys

< %SYSTEMDRIVE%\IdeChnDr.sys /s /md5 >

< %SYSTEMDRIVE%\viasraid.sys /s /md5 >

< %SYSTEMDRIVE%\AGP440.sys /s /md5 >

< %SYSTEMDRIVE%\vaxscsi.sys /s /md5 >

< %SYSTEMDRIVE%\nvatabus.sys /s /md5 >

[2006.02.26 17:21:18 | 00,089,856 | ---- | M] (NVIDIA Corporation) MD5=83F0275A21D9772B51CEF57E35AFAE61 -- C:\WINDOWS.0\DriverPacks\M\N\123\NVATABUS.sys

[2006.04.24 17:52:28 | 00,100,736 | ---- | M] (NVIDIA Corporation) MD5=C03E15101F6D9E82CD9B0E7D715F5DE3 -- C:\WINDOWS.0\DriverPacks\M\N\TM\NVATABUS.sys

< %SYSTEMDRIVE%\viamraid.sys /s /md5 >

[2008.01.22 20:02:24 | 00,117,248 | ---- | M] (VIA Technologies inc,.ltd) MD5=3A82A61E312ADDB3BE8F1FE3481842B1 -- C:\WINDOWS.0\DriverPacks\M\V\viamraid.sys

< %SYSTEMDRIVE%\nvata.sys /s /md5 >

< %SYSTEMDRIVE%\nvgts.sys /s /md5 >

[2007.07.27 22:16:02 | 00,105,984 | ---- | M] (NVIDIA Corporation) MD5=4BC4BAAED05161E0D331627E90A10745 -- C:\WINDOWS.0\DriverPacks\M\N\6\nvgts.sys

< %SYSTEMDRIVE%\explorer.exe /s /md5 >

[2008.04.14 04:42:20 | 01,033,728 | ---- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS.0\explorer.exe

[3 C:\WINDOWS.0\*.tmp files -> C:\WINDOWS.0\*.tmp -> ]

[2008.04.14 04:42:20 | 01,033,728 | ---- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS.0\system32\dllcache\explorer.exe

[2008.04.14 04:42:20 | 01,033,728 | ---- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS\explorer.exe

< %SYSTEMDRIVE%\svchost.exe /s /md5 >

[2008.04.14 04:42:38 | 00,014,336 | ---- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 -- C:\WINDOWS.0\system32\svchost.exe

[1 C:\WINDOWS.0\system32\*.tmp files -> C:\WINDOWS.0\system32\*.tmp -> ]

[2008.04.14 04:42:38 | 00,014,336 | ---- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 -- C:\WINDOWS.0\system32\dllcache\svchost.exe

[2008.04.14 04:42:38 | 00,014,336 | ---- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 -- C:\WINDOWS\system32\svchost.exe

< %SYSTEMDRIVE%\userinit.exe /s /md5 >

[2008.04.14 04:42:40 | 00,026,112 | ---- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 -- C:\WINDOWS.0\system32\userinit.exe

[1 C:\WINDOWS.0\system32\*.tmp files -> C:\WINDOWS.0\system32\*.tmp -> ]

[2008.04.14 04:42:40 | 00,026,112 | ---- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 -- C:\WINDOWS.0\system32\dllcache\userinit.exe

[2008.04.14 04:42:40 | 00,026,112 | ---- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 -- C:\WINDOWS\system32\userinit.exe

< %SYSTEMDRIVE%\qmgr.dll /s /md5 >

[2008.04.14 04:42:04 | 00,409,088 | ---- | M] (Microsoft Corporation) MD5=574738F61FCA2935F5265DC4E5691314 -- C:\WINDOWS.0\system32\qmgr.dll

[1 C:\WINDOWS.0\system32\*.tmp files -> C:\WINDOWS.0\system32\*.tmp -> ]

[2008.04.14 04:42:04 | 00,409,088 | ---- | M] (Microsoft Corporation) MD5=574738F61FCA2935F5265DC4E5691314 -- C:\WINDOWS.0\system32\dllcache\qmgr.dll

< %SYSTEMDRIVE%\ws2_32.dll /s /md5 >

[2008.04.14 04:42:12 | 00,082,432 | ---- | M] (Microsoft Corporation) MD5=2CCC474EB85CEAA3E1FA1726580A3E5A -- C:\WINDOWS.0\system32\ws2_32.dll

[1 C:\WINDOWS.0\system32\*.tmp files -> C:\WINDOWS.0\system32\*.tmp -> ]

[2008.04.14 04:42:12 | 00,082,432 | ---- | M] (Microsoft Corporation) MD5=2CCC474EB85CEAA3E1FA1726580A3E5A -- C:\WINDOWS.0\system32\dllcache\ws2_32.dll

[2008.04.14 04:42:12 | 00,082,432 | ---- | M] (Microsoft Corporation) MD5=2CCC474EB85CEAA3E1FA1726580A3E5A -- C:\WINDOWS\system32\ws2_32.dll

< %SYSTEMDRIVE%\proquota.exe /s /md5 >

[2008.04.14 04:42:34 | 00,050,176 | ---- | M] (Microsoft Corporation) MD5=F6465A2EEF75468988A4FCF124148FA8 -- C:\WINDOWS.0\system32\proquota.exe

[1 C:\WINDOWS.0\system32\*.tmp files -> C:\WINDOWS.0\system32\*.tmp -> ]

[2008.04.14 04:42:34 | 00,050,176 | ---- | M] (Microsoft Corporation) MD5=F6465A2EEF75468988A4FCF124148FA8 -- C:\WINDOWS.0\system32\dllcache\proquota.exe

[2008.04.14 04:42:34 | 00,050,176 | ---- | M] (Microsoft Corporation) MD5=F6465A2EEF75468988A4FCF124148FA8 -- C:\WINDOWS\system32\proquota.exe

< %SYSTEMDRIVE%\iastorv.sys /s /md5 >

< End of report >

OTL Extras logfile created on: 17.12.2009 a. 15:36:40 - Run 1

OTL by OldTimer - Version 3.1.17.0 Folder = C:\Documents and Settings\asen\My Documents\Изтегляния

Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 7.0.5730.13)

Locale: 00000402 | Country: Bulgaria | Language: BGR | Date Format: dd.M.yyyy 'ã.'

501,98 Mb Total Physical Memory | 194,66 Mb Available Physical Memory | 38,78% Memory free

1,20 Gb Paging File | 0,95 Gb Available in Paging File | 78,95% Paging File free

Paging file location(s): C:\pagefile.sys 756 1512 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS.0 | %ProgramFiles% = C:\Program Files

Drive C: | 10,39 Gb Total Space | 4,25 Gb Free Space | 40,96% Space Free | Partition Type: NTFS

Drive D: | 64,17 Gb Total Space | 42,24 Gb Free Space | 65,83% Space Free | Partition Type: NTFS

E: Drive not present or media not loaded

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

Computer Name: ASEN-E21F07E1A9

Current User Name: asen

Logged in as Administrator.

Current Boot Mode: Normal

Scan Mode: All users

Company Name Whitelist: On

Skip Microsoft Files: On

File Age = 30 Days

Output = Minimal

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)

[HKEY_USERS\S-1-5-21-1757981266-1614895754-1177238915-1003\SOFTWARE\Classes\<extension>]

.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

exefile [open] -- "%1" %*

htmlfile [edit] -- Reg Error: Key error.

htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)

htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)

https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)

Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"FirstRunDisabled" = 1

"AntiVirusDisableNotify" = 0

"FirewallDisableNotify" = 0

"UpdatesDisableNotify" = 0

"AntiVirusOverride" = 0

"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- File not found

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- File not found

"C:\Program Files\FlashGet\flashget.exe" = C:\Program Files\FlashGet\flashget.exe:*:Enabled:FlashGet -- (FlashGet.com)

"C:\Documents and Settings\asen\Local Settings\Temp\bijtyjj.exe" = C:\Documents and Settings\asen\Local Settings\Temp\bijtyjj.exe:*:Disabled:bijtyjj -- ()

"C:\Program Files\Skype\Phone\Skype.exe" = C:\Program Files\Skype\Phone\Skype.exe:*:Disabled:Skype -- (Skype Technologies S.A.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{09D8492A-C8E2-421E-927D-46800FB327A3}" = Wireless Home Network Setup

"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP

"{541DEAC0-5F3D-45E6-B7CB-94ECF3B96748}" = Skype web features

"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar

"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel® Graphics Media Accelerator Driver

"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.1

"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX

"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin

"Broadcom 802.11b Network Adapter" = Broadcom 802.11 Wireless LAN Adapter

"Bulgarian Phonetic" = Bulgarian Phonetic Keyboard Layout

"C-Media USB Sound" = C-Media USB Sound

"FlashGet" = FlashGet 1.9.6.1073

"HDMI" = Intel® Graphics Media Accelerator Driver

"Mozilla Firefox (3.5.6)" = Mozilla Firefox (3.5.6)

"PROSet" = Intel® PRO Network Connections Drivers

"SynTPDeinstKey" = Synaptics Pointing Device Driver

"The KMPlayer" = The KMPlayer (remove only)

"WinRAR archiver" = WinRAR archiver

========== Last 10 Event Log Errors ==========

[ Application Events ]

Error - 12.12.2009 a. 08:19:15 | Computer Name = ASEN-E21F07E1A9 | Source = crypt32 | ID = 131083

Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>

with error: An internal certificate chaining error has occurred.

Error - 13.12.2009 a. 08:38:33 | Computer Name = ASEN-E21F07E1A9 | Source = Application Error | ID = 1000

Description = Faulting application heli.exe, version 1.0.0.1, faulting module heli.exe,

version 1.0.0.1, fault address 0x0000189b.

Error - 13.12.2009 a. 08:38:43 | Computer Name = ASEN-E21F07E1A9 | Source = Application Error | ID = 1000

Description = Faulting application star.exe, version 1.0.0.1, faulting module star.exe,

version 1.0.0.1, fault address 0x000015cb.

[ System Events ]

Error - 13.12.2009 a. 02:55:11 | Computer Name = ASEN-E21F07E1A9 | Source = sr | ID = 1

Description = The System Restore filter encountered the unexpected error '0xC0000034'

while processing the file '_filelst.cfg' on the volume 'HarddiskVolume1'. It has

stopped monitoring the volume.

Error - 13.12.2009 a. 02:55:43 | Computer Name = ASEN-E21F07E1A9 | Source = Service Control Manager | ID = 7023

Description = The Windows Firewall/Internet Connection Sharing (ICS) service terminated

with the following error: %%2147500053

Error - 13.12.2009 a. 09:00:22 | Computer Name = ASEN-E21F07E1A9 | Source = Cdrom | ID = 262151

Description = The device, \Device\CdRom0, has a bad block.

Error - 14.12.2009 a. 16:30:41 | Computer Name = ASEN-E21F07E1A9 | Source = Dhcp | ID = 1000

Description = Your computer has lost the lease to its IP address 192.168.0.198 on

the Network Card with network address 0014A5B0CDFC.

Error - 15.12.2009 a. 12:10:54 | Computer Name = ASEN-E21F07E1A9 | Source = sr | ID = 1

Description = The System Restore filter encountered the unexpected error '0xC0000034'

while processing the file '_filelst.cfg' on the volume 'HarddiskVolume1'. It has

stopped monitoring the volume.

Error - 15.12.2009 a. 12:11:06 | Computer Name = ASEN-E21F07E1A9 | Source = Service Control Manager | ID = 7023

Description = The Windows Firewall/Internet Connection Sharing (ICS) service terminated

with the following error: %%2147500053

Error - 16.12.2009 a. 12:58:28 | Computer Name = ASEN-E21F07E1A9 | Source = sr | ID = 1

Description = The System Restore filter encountered the unexpected error '0xC0000034'

while processing the file '_filelst.cfg' on the volume 'HarddiskVolume1'. It has

stopped monitoring the volume.

Error - 16.12.2009 a. 12:58:38 | Computer Name = ASEN-E21F07E1A9 | Source = Service Control Manager | ID = 7023

Description = The Windows Firewall/Internet Connection Sharing (ICS) service terminated

with the following error: %%2147500053

Error - 17.12.2009 a. 09:29:20 | Computer Name = ASEN-E21F07E1A9 | Source = Service Control Manager | ID = 7023

Description = The Windows Firewall/Internet Connection Sharing (ICS) service terminated

with the following error: %%2147500053

Error - 17.12.2009 a. 09:29:25 | Computer Name = ASEN-E21F07E1A9 | Source = sr | ID = 1

Description = The System Restore filter encountered the unexpected error '0xC0000034'

while processing the file '_filelst.cfg' on the volume 'HarddiskVolume1'. It has

stopped monitoring the volume.

< End of report >

17 декември 200916 г.

Момчета, създавайте си отделни тема в същия подфорум.

Колега, след този случай затвори темата! Тук стана някакъв ужас!

Съгласен съм да се затвори, но уж очаквам отговори от тези на които съм написал скрипта...ама отговор няма.

Би ли поел тези които не съм, че трябва да заминавам за работа ?

Мерси.

Когато решиш удари един катинар на темата.

Поздрави !

17 декември 200916 г.

http://rapidshare.de/files/48851059/_OTL.rar.html

17 декември 200916 г.

Всичко хубаво, но аз бързам, че имам доста за учене. Когато имаш време, тогава им обърни внимание.

17 декември 200916 г.

Всичко хубаво, но аз бързам, че имам доста за учене. Когато имаш време, тогава им обърни внимание.

O.K. Обещавам до довечера да затворя темата, като намалеят случаите...и се замислям за една важна тема по този проблем...

Детайлите ще ги обсъдим после на Л.С.

Лек ден.

17 декември 200916 г.

ето

,

о незнам дали ви дразня...и каде да пиша точно...но ...sorry...

добре,сега сканирам и ще публикувам лог-а след минутки,но трябва ли чакам после още нещо или това беше?

SAFEBOOT_REPAIR.TXT

17 декември 200916 г.

това ми дава след Kittyfix

ComboFix 09-12-16.05 - asen 12.2009 a. 16:38:37.3.1 - x86

Microsoft Windows XP Professional 5.1.2600.3.1251.359.1033.18.502.124 [GMT 2:00]

Running from: c:\documents and settings\asen\Desktop\KittyFix.exe

Command switches used :: c:\documents and settings\asen\Desktop\CFScript.txt

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\autorun.inf

C:\relbmdjxjxsnk.bat

C:\vglzixbnxjc.bat

C:\vktlyrzpdtqnmvw.bat

D:\Autorun.inf

D:\relbmdjxjxsnk.bat

D:\vglzixbnxjc.bat

D:\vktlyrzpdtqnmvw.bat

.

((((((((((((((((((((((((( Files Created from 2009-11-17 to 2009-12-17 )))))))))))))))))))))))))))))))

.

2009-12-17 13:47 . 2009-12-17 13:47 -------- d-----w- C:\_OTL

2009-12-13 13:33 . 2009-12-13 13:33 -------- d-----w- c:\documents and settings\asen\Local Settings\Application Data\Identities

2009-12-13 12:29 . 2003-10-29 06:21 24576 ----a-w- c:\windows.0\CmiUSB2Uninstall.exe

2009-12-13 12:29 . 2009-12-13 12:39 -------- d-----w- c:\program files\C-Media USB Sound

2009-12-13 12:29 . 1998-10-29 14:45 306688 ----a-w- c:\windows.0\IsUninst.exe

2009-12-13 10:40 . 2009-12-13 10:40 8992 ----a-w- c:\windows.0\system32\kbdbph.dll

2009-12-13 07:14 . 2009-12-13 07:17 -------- d-----w- c:\documents and settings\asen\Local Settings\Application Data\AskToolbar

2009-12-12 15:13 . 2009-12-12 15:13 -------- d--h--w- c:\documents and settings\Default User.WINDOWS

2009-12-12 15:13 . 2009-12-12 15:13 -------- d-----w- c:\documents and settings\All Users.WINDOWS

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-12-17 14:37 . 2009-12-12 16:16 779 ---h--w- c:\program files\sekzjzercpjdzfdiqhuzngjjdgsynxnsfq.xrn

2009-12-17 14:37 . 2009-12-12 12:08 2408 ---h--w- c:\program files\hqtfmzbltdulehcejxhjukkhyyhkwdq.cku

2009-12-17 14:37 . 2009-12-12 12:05 272 ---h--w- c:\program files\fexzwzrrppwdmfqidhhza.wjq

2009-12-17 13:29 . 2009-12-12 16:16 1503 ---h--w- c:\program files\relbmdjxjxsnkrqwfxlrgaefaeryozqwkwk.axe

2009-12-17 13:29 . 2009-12-12 12:05 4488 ---h--w- c:\program files\akobjxalufxpjnjmshsvhyzxpqaerznq.kvn

2009-12-16 16:58 . 2009-12-12 12:17 -------- d-----w- c:\documents and settings\asen\Application Data\Skype

2009-12-14 19:59 . 2009-12-12 11:36 -------- d-----w- c:\program files\Windows Media Connect 2

2009-12-14 14:08 . 2009-12-12 12:19 -------- d-----w- c:\documents and settings\asen\Application Data\skypePM

2009-12-12 13:16 . 2009-12-12 13:16 9392 ----a-w- c:\documents and settings\asen\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2009-12-12 13:07 . 2009-12-12 11:40 87031 ----a-w- c:\windows.0\pchealth\helpctr\OfflineCache\index.dat

2009-12-12 13:05 . 2009-12-12 13:05 -------- d-----w- c:\program files\HP

2009-12-12 13:05 . 2009-12-12 13:05 -------- d--h--w- c:\program files\InstallShield Installation Information

2009-12-12 13:05 . 2009-12-12 13:05 -------- d-----w- c:\program files\Hewlett-Packard

2009-12-12 13:04 . 2009-12-12 13:00 -------- d-----w- c:\program files\Common Files\InstallShield

2009-12-12 13:01 . 2009-12-12 13:01 -------- d-----w- c:\program files\Intel

2009-12-12 13:00 . 2009-12-12 13:00 -------- d-----w- c:\program files\Broadcom

2009-12-12 13:00 . 2009-12-12 13:00 -------- d-----w- c:\program files\Synaptics

2009-12-12 12:47 . 2009-12-12 12:47 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files

2009-12-12 12:47 . 2009-12-12 12:46 -------- d-----w- c:\program files\The KMPlayer

2009-12-12 12:19 . 2009-12-12 12:19 56 ---ha-w- c:\windows.0\system32\ezsidmv.dat

2009-12-12 12:17 . 2009-12-12 12:17 -------- d-----r- c:\program files\Skype

2009-12-12 12:17 . 2009-12-12 12:17 -------- d-----w- c:\program files\Common Files\Skype

2009-12-12 12:17 . 2009-12-12 12:17 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype

2009-12-12 12:11 . 2009-12-12 12:11 0 ----a-w- c:\windows.0\nsreg.dat

2009-12-12 11:51 . 2009-12-12 11:51 10117 ----a-w- C:\hwids.dat

2009-12-12 11:45 . 2009-12-12 11:45 -------- d-----w- c:\program files\microsoft frontpage

2009-12-12 11:44 . 2009-12-12 11:44 -------- d-----w- c:\program files\MSXML 4.0

2009-12-12 11:37 . 2009-12-12 11:37 21640 ----a-w- c:\windows.0\system32\emptyregdb.dat

2009-10-20 16:54 . 2009-10-20 16:54 59976 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Anti-Virus 2010 9.0.0.736\English\setup.exe

.

------- Sigcheck -------

[-] 2008-07-26 . 6CDB0EB2C6D05ACE8C29C9B1B82C377B . 1614848 . . [5.1.2600.5512] . . c:\windows.0\system32\sfcfiles.dll

.

((((((((((((((((((((((((((((( SnapShot@2009-12-17_14.10.24 )))))))))))))))))))))))))))))))))))))))))

.

+ 2009-12-12 12:05 . 2009-12-17 14:39 557056 c:\windows.0\uqgfzzolgdhlrhpewxujhk.exe

- 2009-12-12 12:05 . 2009-12-17 14:07 557056 c:\windows.0\uqgfzzolgdhlrhpewxujhk.exe

- 2009-12-12 12:05 . 2009-12-17 14:07 512000 c:\windows.0\system32\uqgfzzolgdhlrhpewxujhk.exe

+ 2009-12-12 12:05 . 2009-12-17 14:39 512000 c:\windows.0\system32\uqgfzzolgdhlrhpewxujhk.exe

- 2009-12-12 12:05 . 2009-12-17 14:07 512000 c:\windows.0\system32\qiupfbmfwppprdhsgd.exe

+ 2009-12-12 12:05 . 2009-12-17 14:39 512000 c:\windows.0\system32\qiupfbmfwppprdhsgd.exe

- 2009-12-12 12:05 . 2009-12-17 14:07 512000 c:\windows.0\system32\oiwtljwrkfhjnbhukjer.exe

+ 2009-12-12 12:05 . 2009-12-17 14:39 512000 c:\windows.0\system32\oiwtljwrkfhjnbhukjer.exe

- 2009-12-12 12:05 . 2009-12-17 14:07 512000 c:\windows.0\system32\hyjdsnxpfxwvwhkuh.exe

+ 2009-12-12 12:05 . 2009-12-17 14:39 512000 c:\windows.0\system32\hyjdsnxpfxwvwhkuh.exe

+ 2009-12-12 12:05 . 2009-12-17 14:39 512000 c:\windows.0\system32\dynledrnhdgjodkypplzw.exe

- 2009-12-12 12:05 . 2009-12-17 14:07 512000 c:\windows.0\system32\dynledrnhdgjodkypplzw.exe

- 2009-12-12 12:05 . 2009-12-17 14:07 512000 c:\windows.0\system32\buhdurdxpjklobgshfz.exe

+ 2009-12-12 12:05 . 2009-12-17 14:39 512000 c:\windows.0\system32\buhdurdxpjklobgshfz.exe

+ 2009-12-12 12:05 . 2009-12-17 14:39 512000 c:\windows.0\system32\aqathbkbqhfddnpy.exe

- 2009-12-12 12:05 . 2009-12-17 14:07 512000 c:\windows.0\system32\aqathbkbqhfddnpy.exe

+ 2009-12-12 12:05 . 2009-12-17 14:39 557056 c:\windows.0\qiupfbmfwppprdhsgd.exe

- 2009-12-12 12:05 . 2009-12-17 14:07 557056 c:\windows.0\qiupfbmfwppprdhsgd.exe

- 2009-12-12 12:05 . 2009-12-17 14:07 557056 c:\windows.0\oiwtljwrkfhjnbhukjer.exe

+ 2009-12-12 12:05 . 2009-12-17 14:39 557056 c:\windows.0\oiwtljwrkfhjnbhukjer.exe

+ 2009-12-12 12:05 . 2009-12-17 14:39 557056 c:\windows.0\hyjdsnxpfxwvwhkuh.exe

- 2009-12-12 12:05 . 2009-12-17 14:07 557056 c:\windows.0\hyjdsnxpfxwvwhkuh.exe

- 2009-12-12 12:05 . 2009-12-17 14:07 557056 c:\windows.0\dynledrnhdgjodkypplzw.exe

+ 2009-12-12 12:05 . 2009-12-17 14:39 557056 c:\windows.0\dynledrnhdgjodkypplzw.exe

- 2009-12-12 12:05 . 2009-12-17 14:07 557056 c:\windows.0\buhdurdxpjklobgshfz.exe

+ 2009-12-12 12:05 . 2009-12-17 14:39 557056 c:\windows.0\buhdurdxpjklobgshfz.exe

+ 2009-12-12 12:05 . 2009-12-17 14:39 557056 c:\windows.0\aqathbkbqhfddnpy.exe

- 2009-12-12 12:05 . 2009-12-17 14:07 557056 c:\windows.0\aqathbkbqhfddnpy.exe

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"vglzixbnxjc"="oiwtljwrkfhjnbhukjer.exe" [2009-12-17 512000]

"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-10-09 25623336]

"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

"sekzjzercpjd"="qiupfbmfwppprdhsgd.exe ." [X]

"hqtfmzblt"="c:\docume~1\asen\LOCALS~1\Temp\aqathbkbqhfddnpy.exe" [bU]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"qyalrden"="qiupfbmfwppprdhsgd.exe" [2009-12-17 512000]

"Flashget"="c:\program files\FlashGet\FlashGet.exe" [2007-09-25 2007088]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-31 761946]

"igfxtray"="c:\windows.0\system32\igfxtray.exe" [2006-03-23 94208]

"igfxhkcmd"="c:\windows.0\system32\hkcmd.exe" [2006-03-23 77824]

"igfxpers"="c:\windows.0\system32\igfxpers.exe" [2006-03-23 118784]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

"hqtfmzblt"="dynledrnhdgjodkypplzw.exe ." [X]

"relbmdjxjxsnk"="c:\docume~1\asen\LOCALS~1\Temp\qiupfbmfwppprdhsgd.exe" [bU]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows.0\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"nltide_2"="shell32" [X]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\Currentversion\policies\explorer\Run]

"akobjxaluf"="qiupfbmfwppprdhsgd.exe" [2009-12-17 512000]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 0 (0x0)

"ConsentPromptBehaviorUser"= 0 (0x0)

"EnableInstallerDetection"= 0 (0x0)

"EnableSecureUIAPaths"= 0 (0x0)

"EnableVirtualization"= 0 (0x0)

"PromptOnSecureDesktop"= 0 (0x0)

SafeBoot registry key needs repairs. This machine cannot enter Safe Mode.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\File system]

@="Driver Group"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vgasave.sys]

@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}]

@="DiskDrive"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96A-E325-11CE-BFC1-08002BE10318}]

@="Hdc"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96B-E325-11CE-BFC1-08002BE10318}]

@="Keyboard"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96F-E325-11CE-BFC1-08002BE10318}]

@="Mouse"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E97D-E325-11CE-BFC1-08002BE10318}]

@="System"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{71A27CDD-812A-11D0-BEC7-08002BE2092F}]

@="Volume"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\FlashGet\\flashget.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.ask.com?o=15187&l=dis

IE: &Download All with FlashGet - c:\program files\FlashGet\jc_all.htm

IE: &Download with FlashGet - c:\program files\FlashGet\jc_link.htm

FF - ProfilePath - c:\documents and settings\asen\Application Data\Mozilla\Firefox\Profiles\2vg0yny8.default\

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - hxxp://www.ask.com?o=15187&l=dis

FF - prefs.js: keyword.URL - hxxp://supertoolbar.ask.com/redirect?client=ff&src=kw&tb=PTV&o=15184&locale=en_US&q=

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-12-17 16:41

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

Completion time: 2009-12-17 16:43:03

ComboFix-quarantined-files.txt 2009-12-17 14:43

ComboFix2.txt 2009-12-17 14:32

ComboFix3.txt 2009-12-17 14:11

Pre-Run: 4 991 479 808 bytes free

Post-Run: 4 990 205 952 bytes free

- - End Of File - - A6710381748F709E02D7155DF00B0951

17 декември 200916 г.

ето

,

о незнам дали ви дразня...и каде да пиша точно...но ...sorry...

добре,сега сканирам и ще публикувам лог-а след минутки,но трябва ли чакам после още нещо или това беше?

@ Не не се дразним, но къде е лог файла от OTL.exe след изпълнението на скрипта ?

това ми дава след Kittyfix

Моля не стартирайте програми за които не е изискано лично от вас.

Kittyfix е много мощна програма и все още е в бета стадий.

Изпълнете тези стъпки:

http://www.kaldata.com/forums/index.php?showtopic=144659&view=findpost&p=1582468

КЪМ ВСИЧКИ...нека в тази тема да пишат само потребителите които са участвали до момента и получават помощ в момента.

ВСИЧКИ останали които не са писали тук и имат същия проблем нека да си отворят нови теми в този раздел. Всички нови мнения на НОВИ потребители с този проблем в тази тема вече ще бъдат игнорирани !

БЛАГОДАРИМ !

На работа съм и ще мога да пиша след 24.00 Ако не сте на линия тогава просто проверете темата утре. Мерси !

Добре дошли!

Skype вирусен проблем

Featured Replies

Потребители с най-много отговори

Популярни дни

Най-популярни публикации

charlyd

Maniac

Maniac

Разглеждащи това в момента 0

Дарение

Бюлетин

Профил

Навигация

Търсене

Конфигуриране на push известия в браузъра

Chrome (Android)

Chrome (Desktop)

Safari (iOS 16.4+)

Safari (macOS)

Edge (Android)

Edge (Desktop)

Firefox (Android)

Firefox (Desktop)