помогнете вирус

23 декември 200916 г.

gecaywusqom.exe

ESETSmartInstaller@High as downloader log:

all ok

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6211

# api_version=3.0.2

# EOSSerial=58172ca982bcc149823fa27ae9276baa

# end=finished

# remove_checked=true

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=true

# antistealth_checked=true

# utc_time=2009-12-23 03:02:44

# local_time=2009-12-23 05:02:44 (+0200, FLE Standard Time)

# country="Bulgaria"

# lang=1033

# osver=6.0.6001 NT Service Pack 1

# compatibility_mode=5892 16776574 100 95 59861215 99107755 0 0

# compatibility_mode=8194 67108221 100 100 8286 35496706 0 0

# scanned=111641

# found=12

# cleaned=12

# scan_time=5537

# nod_component=NOD32MOD_WINNT_ENGLISH_BASE Build:0x11081627

# nod_component=NOD32MOD_WINNT_ENGLISH_INET Build:0x11081627

# nod_component=NOD32MOD_WINNT_ENGLISH_STANDARD Build:0x11081627

C:\Program Files\Belltech Business Card Designer Pro\Business Card Designer 5.0_Key.exe probably a variant of Win32/Agent trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\Program Files\BitComet\Downloads\BSPlayer Pro 2.26 Build 956+Keygen\keygen.exe probably a variant of Win32/Agent trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\Program Files\ESET\nod32fix.reg Win32/HackAV.G application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\Program Files\SkyCode\WebTrance25\Crack WebTrance v2.5.0.01 Bilingual.exe a variant of Win32/HackTool.Patcher.A application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\Users\toshiba\Desktop\penipa.bat a variant of Win32/AutoRun.Agent.UA worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\Users\toshiba\Downloads\Crack WebTrance v2.5.0.01 Bilingual.exe a variant of Win32/HackTool.Patcher.A application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

D:\filmi\vistaBgSp2\2. NGC Genuine\NGC Genuine!.exe probably a variant of Win32/IRCBot trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

D:\filmi\Vista_Bg_sp2_86\NGC Genuine\NGC Genuine!.exe probably a variant of Win32/IRCBot trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

D:\Programi\Driver Genius Professional 8\Keygen\keygen.exe probably a variant of Win32/Agent trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

D:\Programi\Hiren's BootCD v9.7 witch Keyboard Patch\Hiren's.BootCD.9.7.iso probably unknown NewHeur_PE virus (deleted - quarantined) 00000000000000000000000000000000 C

D:\Programi\SkyCode WebTrance v.2.5.0.01\Crack\Patch.exe a variant of Win32/HackTool.Patcher.A application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

D:\Programi\WebTrance е програма, която извършва автоматичен превод на текстове\Web Trance 3.0\webtrance.3.xx.(universal.patch).exe a variant of Win32/HackTool.Patcher.A application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

Редактирано 23 декември 200916 г. от penipa (преглед на промените)

24 декември 200916 г.

Изтеглете OTL (от OldTimer) и го запазете на вашия десктоп.

Кликнете два пъти върху OTL.exe, за да стартирате програмата.

Сложете отметки преди следните неща:

Scan all users
Lop check
Purity check

Под секцията Extra Registry, изберете Use SafeList

Кликнете на Run Scan и изчакайте да завърши сканирането. (може да отнеме 10-15 минути)

Когато завърши, публикувайте следните два лог файла:

OTL.txt (намира се на вашия десктоп)
Extras.txt (ще Ви се отвори автоматично)

1

24 декември 200916 г.

Автор

OTL logfile created on: 24.12.2009 г. 16:39:06 - Run 1

OTL by OldTimer - Version 3.1.20.0 Folder = C:\Users\toshiba\Desktop

Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation

Internet Explorer (Version = 7.0.6001.18000)

Locale: 00000402 | Country: Bulgaria | Language: BGR | Date Format: d.M.yyyy 'г.'

3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 65,00% Memory free

6,00 Gb Paging File | 5,00 Gb Available in Paging File | 85,00% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 60,07 Gb Total Space | 20,94 Gb Free Space | 34,85% Space Free | Partition Type: NTFS

Drive D: | 236,55 Gb Total Space | 163,31 Gb Free Space | 69,04% Space Free | Partition Type: NTFS

E: Drive not present or media not loaded

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

Computer Name: PC

Current User Name: toshiba

Logged in as Administrator.

Current Boot Mode: Normal

Scan Mode: All users

Company Name Whitelist: Off

Skip Microsoft Files: Off

File Age = 30 Days

Output = Standard

========== Processes (SafeList) ==========

PRC - [2009.12.24 16:37:21 | 00,514,048 | ---- | M] (OldTimer Tools) -- C:\Users\toshiba\Desktop\OTL.exe

PRC - [2009.10.26 08:23:21 | 00,039,408 | ---- | M] (Google Inc.) -- C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

PRC - [2009.10.09 13:11:12 | 25,623,336 | R--- | M] (Skype Technologies S.A.) -- C:\Program Files\Skype\Phone\Skype.exe

PRC - [2008.11.07 20:18:41 | 00,949,376 | ---- | M] (Eset ) -- C:\Program Files\ESET\nod32kui.exe

PRC - [2008.11.07 20:18:41 | 00,552,064 | ---- | M] (Eset ) -- C:\Program Files\ESET\nod32krn.exe

PRC - [2008.05.30 18:27:52 | 00,083,312 | ---- | M] (TOSHIBA Corporation) -- C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe

PRC - [2008.05.28 16:06:02 | 06,144,000 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe

PRC - [2008.04.24 19:35:46 | 00,073,728 | ---- | M] (Toshiba) -- C:\Program Files\Toshiba\SmartFaceV\SmartFaceVWatchSrv.exe

PRC - [2008.04.24 11:21:56 | 00,099,720 | ---- | M] (Toshiba Europe GmbH) -- C:\Program Files\Toshiba TEMPRO\TempoSVC.exe

PRC - [2008.04.22 12:44:00 | 00,648,520 | ---- | M] (TOSHIBA CORPORATION.) -- c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe

PRC - [2008.04.18 20:27:52 | 00,316,744 | ---- | M] (TOSHIBA CORPORATION.) -- c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosOBEX.exe

PRC - [2008.04.18 20:27:40 | 00,288,072 | ---- | M] (TOSHIBA CORPORATION.) -- c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHSP.exe

PRC - [2008.04.17 01:19:48 | 00,040,960 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files\Toshiba\ConfigFree\CFSvcs.exe

PRC - [2008.04.16 17:43:32 | 02,577,736 | ---- | M] (TOSHIBA CORPORATION.) -- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtProc.exe

PRC - [2008.04.15 00:05:40 | 02,979,144 | ---- | M] (TOSHIBA CORPORATION.) -- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe

PRC - [2008.04.11 12:57:14 | 00,124,264 | ---- | M] (TOSHIBA CORPORATION) -- c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe

PRC - [2008.03.31 20:08:50 | 00,083,272 | ---- | M] (TOSHIBA CORPORATION.) -- c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe

PRC - [2008.01.21 04:25:33 | 00,202,240 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Media Player\wmpnscfg.exe

PRC - [2008.01.21 04:24:24 | 02,927,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe

PRC - [2008.01.21 04:24:13 | 00,069,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conime.exe

PRC - [2008.01.21 04:23:52 | 00,037,888 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wbem\unsecapp.exe

PRC - [2008.01.21 04:23:50 | 00,625,664 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Internet Explorer\iexplore.exe

PRC - [2008.01.17 17:27:52 | 00,431,456 | ---- | M] (TOSHIBA Corporation) -- C:\Program Files\Toshiba\Power Saver\TPwrMain.exe

PRC - [2008.01.17 17:27:34 | 00,431,456 | ---- | M] (TOSHIBA Corporation) -- c:\Program Files\Toshiba\Power Saver\TosCoSrv.exe

PRC - [2008.01.09 11:38:44 | 00,288,072 | ---- | M] (TOSHIBA CORPORATION.) -- c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe

PRC - [2007.12.15 15:29:06 | 00,184,320 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Program Files\Apoint2K\Apoint.exe

PRC - [2007.12.03 18:03:52 | 00,126,976 | ---- | M] (TOSHIBA Corporation) -- c:\Program Files\Toshiba\SMARTLogService\TosIPCSrv.exe

PRC - [2007.11.21 18:23:32 | 00,129,632 | ---- | M] (TOSHIBA Corporation) -- C:\Windows\System32\TODDSrv.exe

PRC - [2007.10.25 17:23:36 | 00,049,152 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Program Files\Apoint2K\ApntEx.exe

PRC - [2007.09.28 17:03:46 | 00,075,136 | ---- | M] ( TOSHIBA CORPORATION) -- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\ItSecMng.exe

PRC - [2007.09.12 14:40:38 | 00,050,472 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Program Files\Apoint2K\ApMsgFwd.exe

PRC - [2007.07.24 11:15:14 | 00,185,632 | ---- | M] (Protexis Inc.) -- c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe

PRC - [2006.10.05 12:10:12 | 00,009,216 | ---- | M] (Agere Systems) -- C:\Windows\System32\agrsmsvc.exe

PRC - [2006.08.23 16:39:48 | 00,049,152 | ---- | M] (Ulead Systems, Inc.) -- C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

========== Modules (SafeList) ==========

MOD - [2009.12.24 16:37:21 | 00,514,048 | ---- | M] (OldTimer Tools) -- C:\Users\toshiba\Desktop\OTL.exe

MOD - [2008.01.21 04:23:44 | 01,684,480 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6001.18000_none_5cdbaa5a083979cc\comctl32.dll

========== Win32 Services (SafeList) ==========

SRV - [2009.10.26 08:23:20 | 00,182,768 | ---- | M] (Google) [On_Demand | Stopped] -- C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe -- (gusvc)

SRV - [2008.11.07 20:18:41 | 00,552,064 | ---- | M] (Eset ) [Auto | Running] -- C:\Program Files\Eset\nod32krn.exe -- (NOD32krn)

SRV - [2008.05.30 18:27:52 | 00,083,312 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe -- (TNaviSrv)

SRV - [2008.05.29 07:11:00 | 00,196,608 | ---- | M] (NVIDIA Corporation) [Disabled | Stopped] -- C:\Windows\System32\nvvsvc.exe -- (nvsvc)

SRV - [2008.04.24 19:35:46 | 00,073,728 | ---- | M] (Toshiba) [On_Demand | Running] -- C:\Program Files\Toshiba\SmartFaceV\SmartFaceVWatchSrv.exe -- (SmartFaceVWatchSrv)

SRV - [2008.04.24 11:21:56 | 00,099,720 | ---- | M] (Toshiba Europe GmbH) [Auto | Running] -- C:\Program Files\Toshiba TEMPRO\TempoSVC.exe -- (TempoMonitoringService)

SRV - [2008.04.17 01:19:48 | 00,040,960 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe -- (ConfigFree Service)

SRV - [2008.04.11 12:57:14 | 00,124,264 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe -- (TOSHIBA Bluetooth Service)

SRV - [2008.01.21 04:23:32 | 00,272,952 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)

SRV - [2008.01.17 17:27:34 | 00,431,456 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- c:\Program Files\Toshiba\Power Saver\TosCoSrv.exe -- (TosCoSrv)

SRV - [2007.12.03 18:03:52 | 00,126,976 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- c:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe -- (TOSHIBA SMART Log Service)

SRV - [2007.11.21 18:23:32 | 00,129,632 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Windows\System32\TODDSrv.exe -- (TODDSrv)

SRV - [2007.08.24 03:19:12 | 00,443,776 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv)

SRV - [2007.07.24 11:15:14 | 00,185,632 | ---- | M] (Protexis Inc.) [Auto | Running] -- c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe -- (PSI_SVC_2)

SRV - [2007.03.12 13:49:46 | 00,271,920 | ---- | M] (Nero AG) [On_Demand | Stopped] -- C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe -- (NMIndexingService)

SRV - [2006.11.02 14:35:29 | 00,013,312 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\ehome\ehstart.dll -- (ehstart)

SRV - [2006.10.26 14:03:08 | 00,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose)

SRV - [2006.10.05 12:10:12 | 00,009,216 | ---- | M] (Agere Systems) [Auto | Running] -- C:\Windows\System32\agrsmsvc.exe -- (AgereModemAudio)

SRV - [2006.08.23 16:39:48 | 00,049,152 | ---- | M] (Ulead Systems, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe -- (UleadBurningHelper)

SRV - [2005.04.04 00:41:10 | 00,069,632 | ---- | M] (Macrovision Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe -- (IDriverT)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | Disabled | Running] -- -- (ps7am8ub) KDS 4 Synchronization Driver (ps7am8ub)

DRV - [2008.11.07 20:18:41 | 00,512,096 | ---- | M] (Eset ) [Kernel | Auto | Running] -- C:\Windows\system32\drivers\amon.sys -- (AMON)

DRV - [2008.11.07 20:18:41 | 00,015,424 | ---- | M] () [Kernel | System | Running] -- C:\Windows\system32\drivers\nod32drv.sys -- (nod32drv)

DRV - [2008.11.07 19:22:51 | 00,717,296 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\Drivers\sptd.sys -- (sptd)

DRV - [2008.06.02 18:11:40 | 02,147,544 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\RTKVHDA.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)

DRV - [2008.05.30 16:53:58 | 00,285,184 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\tos_sps32.sys -- (tos_sps32)

DRV - [2008.05.29 07:11:00 | 07,497,792 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)

DRV - [2008.05.29 07:11:00 | 00,043,040 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvhda32v.sys -- (NVHDA)

DRV - [2008.05.21 16:11:06 | 00,086,672 | ---- | M] (JMicron Technology Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\jmcr.sys -- (JMCR)

DRV - [2008.05.07 12:30:12 | 00,025,896 | ---- | M] (COMPAL ELECTRONIC INC.) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\LPCFilter.sys -- (LPCFilter)

DRV - [2008.05.02 13:59:40 | 00,122,368 | ---- | M] (Realtek Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169)

DRV - [2008.04.28 06:29:26 | 03,658,752 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NETw5v32.sys -- (NETw5v32) Intel®

DRV - [2008.04.23 18:15:26 | 00,131,712 | ---- | M] (TOSHIBA CORPORATION) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tosrfbd.sys -- (tosrfbd)

DRV - [2008.04.15 19:53:44 | 00,312,344 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\iaStor.sys -- (iaStor)

DRV - [2008.03.25 14:54:02 | 00,041,472 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tosporte.sys -- (tosporte)

DRV - [2008.03.19 12:38:24 | 00,074,112 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Tosrfhid.sys -- (Tosrfhid)

DRV - [2008.02.07 00:23:46 | 00,166,448 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Apfiltr.sys -- (ApfiltrService)

DRV - [2008.01.22 21:57:48 | 00,054,144 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TosRfSnd.sys -- (TosRfSnd)

DRV - [2008.01.21 04:23:27 | 00,386,616 | ---- | M] (LSI Corporation, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\megasr.sys -- (MegaSR)

DRV - [2008.01.21 04:23:27 | 00,149,560 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu320.sys -- (adpu320)

DRV - [2008.01.21 04:23:27 | 00,031,288 | ---- | M] (LSI Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\megasas.sys -- (megasas)

DRV - [2008.01.21 04:23:26 | 00,101,432 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu160m.sys -- (adpu160m)

DRV - [2008.01.21 04:23:26 | 00,074,808 | ---- | M] (Silicon Integrated Systems) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sisraid4.sys -- (SiSRaid4)

DRV - [2008.01.21 04:23:26 | 00,040,504 | ---- | M] (Hewlett-Packard Company) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\hpcisss.sys -- (HpCISSs)

DRV - [2008.01.21 04:23:25 | 00,300,600 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpahci.sys -- (adpahci)

DRV - [2008.01.21 04:23:25 | 00,089,656 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_sas.sys -- (LSI_SAS)

DRV - [2008.01.21 04:23:24 | 01,122,360 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql2300.sys -- (ql2300)

DRV - [2008.01.21 04:23:24 | 00,118,784 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\E1G60I32.sys -- (E1G60) Intel®

DRV - [2008.01.21 04:23:24 | 00,079,928 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arcsas.sys -- (arcsas)

DRV - [2008.01.21 04:23:23 | 00,235,064 | ---- | M] (Intel Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iastorv.sys -- (iaStorV)

DRV - [2008.01.21 04:23:23 | 00,130,616 | ---- | M] (VIA Technologies Inc.,Ltd) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\vsmraid.sys -- (vsmraid)

DRV - [2008.01.21 04:23:23 | 00,115,816 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata2.sys -- (ulsata2)

DRV - [2008.01.21 04:23:23 | 00,096,312 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_scsi.sys -- (LSI_SCSI)

DRV - [2008.01.21 04:23:23 | 00,096,312 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_fc.sys -- (LSI_FC)

DRV - [2008.01.21 04:23:23 | 00,079,416 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arc.sys -- (arc)

DRV - [2008.01.21 04:23:22 | 00,342,584 | ---- | M] (Emulex) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\elxstor.sys -- (elxstor)

DRV - [2008.01.21 04:23:21 | 00,422,968 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adp94xx.sys -- (adp94xx)

DRV - [2008.01.21 04:23:21 | 00,102,968 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvraid.sys -- (nvraid)

DRV - [2008.01.21 04:23:21 | 00,045,112 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvstor.sys -- (nvstor)

DRV - [2008.01.21 04:23:20 | 00,238,648 | ---- | M] (ULi Electronics Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\uliahci.sys -- (uliahci)

DRV - [2008.01.21 04:23:00 | 00,020,024 | ---- | M] (VIA Technologies, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\viaide.sys -- (viaide)

DRV - [2008.01.21 04:23:00 | 00,019,000 | ---- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\cmdide.sys -- (cmdide)

DRV - [2008.01.21 04:23:00 | 00,017,464 | ---- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\aliide.sys -- (aliide)

DRV - [2007.12.17 12:45:20 | 00,018,432 | ---- | M] (Chicony Electronics Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\UVCFTR_S.SYS -- (UVCFTR)

DRV - [2007.11.29 10:45:44 | 00,036,608 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tosrfbnp.sys -- (tosrfbnp)

DRV - [2007.11.09 15:00:52 | 00,023,640 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\TVALZ_O.SYS -- (TVALZ)

DRV - [2007.10.18 15:25:00 | 00,041,856 | ---- | M] (TOSHIBA CORPORATION) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tosrfusb.sys -- (Tosrfusb)

DRV - [2007.10.02 12:43:22 | 00,064,128 | ---- | M] (TOSHIBA Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\tosrfcom.sys -- (Tosrfcom)

DRV - [2006.11.28 15:11:00 | 01,161,888 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem)

DRV - [2006.11.02 11:50:35 | 00,106,088 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql40xx.sys -- (ql40xx)

DRV - [2006.11.02 11:50:35 | 00,098,408 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata.sys -- (UlSata)

DRV - [2006.11.02 11:50:19 | 00,045,160 | ---- | M] (IBM Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nfrd960.sys -- (nfrd960)

DRV - [2006.11.02 11:50:17 | 00,041,576 | ---- | M] (Intel Corp./ICP vortex GmbH) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iirsp.sys -- (iirsp)

DRV - [2006.11.02 11:50:11 | 00,071,272 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\djsvs.sys -- (aic78xx)

DRV - [2006.11.02 11:50:09 | 00,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteraid.sys -- (iteraid)

DRV - [2006.11.02 11:50:07 | 00,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteatapi.sys -- (iteatapi)

DRV - [2006.11.02 11:50:05 | 00,035,944 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\symc8xx.sys -- (Symc8xx)

DRV - [2006.11.02 11:50:03 | 00,034,920 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_u3.sys -- (Sym_u3)

DRV - [2006.11.02 11:49:59 | 00,033,384 | ---- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\mraid35x.sys -- (Mraid35x)

DRV - [2006.11.02 11:49:56 | 00,031,848 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_hi.sys -- (Sym_hi)

DRV - [2006.11.02 10:25:24 | 00,071,808 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserid.sys -- (Brserid) Brother MFC Serial Port Interface Driver (WDM)

DRV - [2006.11.02 10:24:47 | 00,011,904 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brusbser.sys -- (BrUsbSer)

DRV - [2006.11.02 10:24:46 | 00,005,248 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltup.sys -- (BrFiltUp)

DRV - [2006.11.02 10:24:45 | 00,013,568 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltlo.sys -- (BrFiltLo)

DRV - [2006.11.02 10:24:44 | 00,062,336 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserwdm.sys -- (BrSerWdm)

DRV - [2006.11.02 10:24:44 | 00,012,160 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brusbmdm.sys -- (BrUsbMdm)

DRV - [2006.11.02 09:41:49 | 01,010,560 | ---- | M] (Motorola Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\smserial.sys -- (smserial)

DRV - [2006.11.02 09:36:50 | 00,020,608 | ---- | M] (N-trig Innovative Technologies) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ntrigdigi.sys -- (ntrigdigi)

DRV - [2006.11.02 08:37:21 | 00,020,480 | ---- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\secdrv.sys -- (secdrv)

DRV - [2006.10.23 17:32:20 | 00,009,216 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tosrfec.sys -- (tosrfec)

DRV - [2006.10.18 12:50:04 | 00,016,128 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tdcmdpst.sys -- (tdcmdpst)

DRV - [2005.01.07 06:42:00 | 00,018,612 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tosrfnds.sys -- (tosrfnds)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig/redirectdomain?brand=TSEA&bmod=TSEA;'>http://www.google.com/ig/redirectdomain?brand=TSEA&bmod=TSEA;

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/ig/redirectdomain?brand=TSEA&bmod=TSEA

IE - HKU\.DEFAULT\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-2399308913-3005331986-738048551-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig/redirectdomain?brand=TSEA&bmod=TSEA;'>http://www.google.com/ig/redirectdomain?brand=TSEA&bmod=TSEA;

IE - HKU\S-1-5-21-2399308913-3005331986-738048551-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/ig/redirectdomain?brand=TSEA&bmod=TSEA;'>http://www.google.com/ig/redirectdomain?brand=TSEA&bmod=TSEA;

IE - HKU\S-1-5-21-2399308913-3005331986-738048551-1000\S-1-5-21-2399308913-3005331986-738048551-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - HKLM\software\mozilla\Mozilla Firefox 2.0.0.20\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009.12.02 13:41:28 | 00,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 2.0.0.20\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2009.12.02 13:41:28 | 00,000,000 | ---D | M]

[2009.04.22 17:08:45 | 00,000,000 | ---D | M] -- C:\Users\toshiba\AppData\Roaming\Mozilla\Firefox\Profiles\kbku0uso.default\extensions

[2009.01.15 14:30:36 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions

[2009.12.02 13:41:28 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions\[email protected]

[2009.12.02 13:41:17 | 00,067,688 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\jar50.dll

[2009.12.02 13:41:17 | 00,054,368 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\jsd3250.dll

[2009.12.02 13:41:17 | 00,034,944 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\myspell.dll

[2009.12.02 13:41:19 | 00,046,712 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\spellchk.dll

[2009.12.02 13:41:19 | 00,172,136 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\xpinstal.dll

[2009.07.17 20:21:00 | 03,883,424 | ---- | M] () -- C:\Program Files\Mozilla Firefox\plugins\NPSWF32.dll

[2009.12.02 13:41:26 | 00,001,040 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-bg.xml

O1 HOSTS File: (761 bytes) - C:\Windows\System32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1 localhost

O1 - Hosts: ::1 localhost

O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll (Sun Microsystems, Inc.)

O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll (Google Inc.)

O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

O3 - HKU\S-1-5-21-2399308913-3005331986-738048551-1000\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

O4 - HKLM..\Run: [Adobe ARM] C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)

O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)

O4 - HKLM..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe (Alps Electric Co., Ltd.)

O4 - HKLM..\Run: [iTSecMng] C:\Program Files\Toshiba\Bluetooth Toshiba Stack\ItSecMng.exe ( TOSHIBA CORPORATION)

O4 - HKLM..\Run: [nod32kui] C:\Program Files\Eset\nod32kui.exe (Eset )

O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)

O4 - HKLM..\Run: [Toshiba TEMPO] C:\Program Files\Toshiba TEMPRO\Toshiba.Tempo.UI.TrayApplication.exe (Toshiba Europe GmbH)

O4 - HKLM..\Run: [TPwrMain] C:\Program Files\Toshiba\Power Saver\TPwrMain.exe (TOSHIBA Corporation)

O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)

O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)

O4 - HKU\S-1-5-21-2399308913-3005331986-738048551-1000..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\daemon.exe (DT Soft Ltd)

O4 - HKU\S-1-5-21-2399308913-3005331986-738048551-1000..\Run: [EA Core] D:\games\NFS SHIFT\EADM\Core.exe (Electronic Arts)

O4 - HKU\S-1-5-21-2399308913-3005331986-738048551-1000..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)

O4 - HKU\S-1-5-21-2399308913-3005331986-738048551-1000..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)

O4 - Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk = C:\Program Files\Toshiba\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)

O4 - Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk = C:\Program Files\Toshiba\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0

O7 - HKU\S-1-5-21-2399308913-3005331986-738048551-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-21-2399308913-3005331986-738048551-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSimpleStartMenu = 1

O7 - HKU\S-1-5-21-2399308913-3005331986-738048551-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktopCleanupWizard = 1

O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)

O8 - Extra context menu item: Google Sidewiki... - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll (Google Inc.)

O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll (Sun Microsystems, Inc.)

O9 - Extra Button: eBay.co.uk - Buy It Sell It Love It - {76577871-04EC-495E-A12B-91F7C3600AFA} - File not found

O9 - Extra Button: Amazon.co.uk - {8A918C1D-E123-4E36-B562-5C1519E434CE} - File not found

O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)

O9 - Extra Button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe (ICQ, Inc.)

O9 - Extra 'Tools' menuitem : ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe (ICQ, Inc.)

O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\System32\imon.dll (Eset )

O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Windows\System32\imon.dll (Eset )

O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Windows\System32\imon.dll (Eset )

O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Windows\System32\imon.dll (Eset )

O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Windows\System32\imon.dll (Eset )

O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Windows\System32\imon.dll (Eset )

O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Windows\System32\imon.dll (Eset )

O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Windows\System32\imon.dll (Eset )

O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\Windows\System32\imon.dll (Eset )

O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\Windows\System32\imon.dll (Eset )

O10 - Protocol_Catalog9\Catalog_Entries\000000000043 - C:\Windows\System32\imon.dll (Eset )

O13 - gopher Prefix: missing

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)

O16 - DPF: {ADACAA8F-3595-47FE-9C31-9C7471B9BEC7} http://87.126.125.249/cab/OCXChecker_8000.cab (OCXDownloadChecker Control)

O16 - DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab (Java Plug-in 1.6.0_06)

O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)

O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)

O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2006.09.18 23:43:36 | 00,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *) - File not found

O35 - comfile [open] -- "%1" %*

O35 - exefile [open] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2009.12.24 16:37:05 | 00,514,048 | ---- | C] (OldTimer Tools) -- C:\Users\toshiba\Desktop\OTL.exe

[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2009.12.24 16:41:01 | 02,097,152 | -HS- | M] () -- C:\Users\toshiba\NTUSER.DAT

[2009.12.24 16:37:21 | 00,514,048 | ---- | M] (OldTimer Tools) -- C:\Users\toshiba\Desktop\OTL.exe

[2009.12.24 16:32:22 | 00,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2009.12.24 16:32:18 | 00,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

[2009.12.24 16:32:18 | 00,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

[2009.12.23 17:55:29 | 00,000,069 | ---- | M] () -- C:\Windows\NeroDigital.ini

[2009.12.23 16:20:16 | 00,064,605 | ---- | M] () -- C:\ProgramData\nvModes.001

[2009.12.23 15:27:55 | 02,672,312 | ---- | M] () -- C:\Users\toshiba\Desktop\esetsmartinstaller_enu.exe

[2009.12.23 15:00:18 | 00,524,320 | ---- | M] () -- C:\Users\toshiba\Desktop\SP_A0138.jpg

[2009.12.23 14:58:51 | 00,049,840 | ---- | M] () -- C:\Users\toshiba\Desktop\DSC00475(1).JPG

[2009.12.23 14:58:34 | 00,050,402 | ---- | M] () -- C:\Users\toshiba\Desktop\DSC00475(2).JPG

[2009.12.23 14:58:18 | 00,055,653 | ---- | M] () -- C:\Users\toshiba\Desktop\DSC00475.JPG

[2009.12.18 15:26:38 | 00,025,600 | ---- | M] () -- C:\Users\toshiba\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2009.12.13 09:03:16 | 00,009,578 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI

[2009.12.11 18:16:52 | 00,065,536 | ---- | M] () -- C:\Windows\System32\Ikeext.etl

[2009.12.11 18:16:50 | 00,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT

[2009.12.11 18:16:42 | 32,158,63808 | -HS- | M] () -- C:\hiberfil.sys

[2009.11.30 17:01:47 | 00,011,609 | ---- | M] () -- C:\Users\toshiba\Desktop\The.Final.Destination.BDRip.XviD_iMBT.(subs.sab.bz).rar

[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2009.12.23 15:27:51 | 02,672,312 | ---- | C] () -- C:\Users\toshiba\Desktop\esetsmartinstaller_enu.exe

[2009.12.23 15:00:03 | 00,524,320 | ---- | C] () -- C:\Users\toshiba\Desktop\SP_A0138.jpg

[2009.12.23 14:58:50 | 00,049,840 | ---- | C] () -- C:\Users\toshiba\Desktop\DSC00475(1).JPG

[2009.12.23 14:58:33 | 00,050,402 | ---- | C] () -- C:\Users\toshiba\Desktop\DSC00475(2).JPG

[2009.12.23 14:58:17 | 00,055,653 | ---- | C] () -- C:\Users\toshiba\Desktop\DSC00475.JPG

[2009.11.30 17:01:47 | 00,011,609 | ---- | C] () -- C:\Users\toshiba\Desktop\The.Final.Destination.BDRip.XviD_iMBT.(subs.sab.bz).rar

[2009.08.20 16:02:59 | 00,000,098 | ---- | C] () -- C:\Windows\WirelessFTP.INI

[2009.06.19 19:06:22 | 00,197,912 | ---- | C] () -- C:\Windows\System32\physxcudart_20.dll

[2009.06.19 19:06:22 | 00,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelTraditionalChinese.dll

[2009.06.19 19:06:22 | 00,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSwedish.dll

[2009.06.19 19:06:22 | 00,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSpanish.dll

[2009.06.19 19:06:22 | 00,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSimplifiedChinese.dll

[2009.06.19 19:06:22 | 00,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelPortugese.dll

[2009.06.19 19:06:22 | 00,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelKorean.dll

[2009.06.19 19:06:22 | 00,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelJapanese.dll

[2009.06.19 19:06:22 | 00,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelGerman.dll

[2009.06.19 19:06:22 | 00,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelFrench.dll

[2009.01.20 23:58:25 | 00,034,308 | ---- | C] () -- C:\Windows\System32\BASSMOD.dll

[2009.01.05 17:45:48 | 00,024,206 | ---- | C] () -- C:\Users\toshiba\AppData\Roaming\UserTile.png

[2008.12.20 23:03:08 | 00,000,000 | ---- | C] () -- C:\Windows\ToDisc.INI

[2008.12.07 14:52:23 | 00,000,001 | ---- | C] () -- C:\Windows\System32\cth.dll

[2008.12.07 14:52:23 | 00,000,000 | ---- | C] () -- C:\Windows\System32\sth.dll

[2008.12.07 10:51:50 | 00,002,828 | -HS- | C] () -- C:\ProgramData\KGyGaAvL.sys

[2008.12.07 10:51:50 | 00,000,088 | RHS- | C] () -- C:\ProgramData\7182D1457C.sys

[2008.11.12 03:04:45 | 00,000,038 | ---- | C] () -- C:\Windows\AviSplitter.INI

[2008.11.08 21:29:29 | 00,022,328 | ---- | C] () -- C:\Windows\System32\drivers\PnkBstrK.sys

[2008.11.08 16:41:45 | 00,025,600 | ---- | C] () -- C:\Users\toshiba\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2008.11.07 20:18:49 | 00,015,424 | ---- | C] () -- C:\Windows\System32\drivers\nod32drv.sys

[2008.11.07 20:09:53 | 00,000,000 | ---- | C] () -- C:\Windows\tosOBEX.INI

[2008.11.07 19:38:31 | 00,000,069 | ---- | C] () -- C:\Windows\NeroDigital.ini

[2008.11.07 19:22:51 | 00,717,296 | ---- | C] () -- C:\Windows\System32\drivers\sptd.sys

[2008.11.07 18:03:26 | 00,204,800 | ---- | C] () -- C:\Windows\System32\IVIresizeW7.dll

[2008.11.07 18:03:26 | 00,200,704 | ---- | C] () -- C:\Windows\System32\IVIresizeA6.dll

[2008.11.07 18:03:26 | 00,192,512 | ---- | C] () -- C:\Windows\System32\IVIresizeP6.dll

[2008.11.07 18:03:26 | 00,192,512 | ---- | C] () -- C:\Windows\System32\IVIresizeM6.dll

[2008.11.07 18:03:26 | 00,188,416 | ---- | C] () -- C:\Windows\System32\IVIresizePX.dll

[2008.11.07 18:03:26 | 00,020,480 | ---- | C] () -- C:\Windows\System32\IVIresize.dll

[2008.11.07 17:50:21 | 00,128,113 | ---- | C] () -- C:\Windows\System32\csellang.ini

[2008.11.07 17:50:21 | 00,045,056 | ---- | C] () -- C:\Windows\System32\csellang.dll

[2008.11.07 17:50:21 | 00,010,150 | ---- | C] () -- C:\Windows\System32\tosmreg.ini

[2008.11.07 17:50:21 | 00,007,671 | ---- | C] () -- C:\Windows\System32\cseltbl.ini

[2008.06.30 16:24:05 | 00,000,000 | ---- | C] () -- C:\Windows\NDSTray.INI

[2008.06.30 15:48:00 | 00,040,960 | ---- | C] () -- C:\Windows\System32\HWS_Ctrl.dll

[2008.06.30 15:23:32 | 00,064,605 | ---- | C] () -- C:\ProgramData\nvModes.001

[2008.06.30 15:23:29 | 00,064,605 | ---- | C] () -- C:\ProgramData\nvModes.dat

[2008.04.24 19:43:50 | 00,057,344 | ---- | C] () -- C:\Windows\System32\SmartFaceVCapt.dll

[2008.04.24 19:42:44 | 00,479,232 | ---- | C] () -- C:\Windows\System32\SmartFaceVCP.dll

[2008.04.24 19:25:46 | 06,701,056 | ---- | C] () -- C:\Windows\System32\FaceHI.dll

[2008.04.24 19:25:46 | 00,995,328 | ---- | C] () -- C:\Windows\System32\FaceRec.dll

[2008.04.24 19:25:46 | 00,126,976 | ---- | C] () -- C:\Windows\System32\SmartFaceVCtrl.dll

[2008.04.24 19:23:58 | 00,094,208 | ---- | C] () -- C:\Windows\System32\IppLib.dll

[2007.12.21 17:46:32 | 00,118,784 | ---- | C] () -- C:\Windows\System32\TosBtAcc.dll

[2006.11.02 14:35:32 | 00,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll

[2006.11.02 09:40:29 | 00,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini

[2005.11.23 14:55:42 | 00,024,576 | ---- | C] () -- C:\Windows\System32\SPCtl.dll

[2005.07.22 22:30:18 | 00,065,536 | ---- | C] () -- C:\Windows\System32\TosCommAPI.dll

========== LOP Check ==========

[2008.12.07 10:51:49 | 00,000,000 | ---D | M] -- C:\Users\toshiba\AppData\Roaming\Bitstream

[2008.11.07 19:22:51 | 00,000,000 | ---D | M] -- C:\Users\toshiba\AppData\Roaming\DAEMON Tools

[2008.11.07 20:16:59 | 00,000,000 | ---D | M] -- C:\Users\toshiba\AppData\Roaming\ICQ

[2008.11.08 20:01:08 | 00,000,000 | ---D | M] -- C:\Users\toshiba\AppData\Roaming\Leadertech

[2009.01.21 12:34:01 | 00,000,000 | ---D | M] -- C:\Users\toshiba\AppData\Roaming\mojosoft

[2009.01.05 17:45:48 | 00,000,000 | ---D | M] -- C:\Users\toshiba\AppData\Roaming\PeerNetworking

[2008.11.10 10:49:56 | 00,000,000 | ---D | M] -- C:\Users\toshiba\AppData\Roaming\temp

[2008.11.08 22:19:53 | 00,000,000 | ---D | M] -- C:\Users\toshiba\AppData\Roaming\TOSHIBA

[2009.12.23 14:55:07 | 00,000,000 | ---D | M] -- C:\Users\toshiba\AppData\Roaming\uTorrent

[2009.01.22 08:08:31 | 00,000,000 | ---D | M] -- C:\Users\toshiba\AppData\Roaming\XnView

[2009.11.17 10:35:30 | 00,032,624 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

< End of report >

OTL Extras logfile created on: 24.12.2009 г. 16:39:06 - Run 1

OTL by OldTimer - Version 3.1.20.0 Folder = C:\Users\toshiba\Desktop

Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation

Internet Explorer (Version = 7.0.6001.18000)

Locale: 00000402 | Country: Bulgaria | Language: BGR | Date Format: d.M.yyyy 'г.'

3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 65,00% Memory free

6,00 Gb Paging File | 5,00 Gb Available in Paging File | 85,00% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 60,07 Gb Total Space | 20,94 Gb Free Space | 34,85% Space Free | Partition Type: NTFS

Drive D: | 236,55 Gb Total Space | 163,31 Gb Free Space | 69,04% Space Free | Partition Type: NTFS

E: Drive not present or media not loaded

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

Computer Name: PC

Current User Name: toshiba

Logged in as Administrator.

Current Boot Mode: Normal

Scan Mode: All users

Company Name Whitelist: Off

Skip Microsoft Files: Off

File Age = 30 Days

Output = Standard

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.chm [@ = chm.file] -- "%SystemRoot%\hh.exe" %1

.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)

.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

chm.file [open] -- "%SystemRoot%\hh.exe" %1

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)

htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)

htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)

htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

htmlfile [print] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)

http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)

https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Directory [Разглеждане с XnView] -- "C:\Program Files\XnView\xnview.exe" "%1" (XnView, http://www.xnview.com)

Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)

Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"cval" = 0

"UACDisableNotify" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiSpyware]

"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

"AntiVirusOverride" = 0

"AntiSpywareOverride" = 0

"FirewallOverride" = 0

"VistaSp1" = Reg Error: Unknown registry data type -- File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-2399308913-3005331986-738048551-1000]

"EnableNotifications" = 0

"EnableNotificationsRef" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

========== Authorized Applications List ==========

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{18FF0071-390B-4EBB-A658-CD85C56F638D}" = protocol=17 | dir=in | app=c:\program files\utorrent\utorrent.exe |

"{692A66A7-9191-4849-8BF4-5419A0B4697E}" = dir=in | app=c:\program files\skype\phone\skype.exe |

"{8396D884-F981-4981-B79B-214BE115587F}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |

"{DF870B05-C04F-45FF-97E0-9355ADD03DE4}" = protocol=6 | dir=in | app=c:\program files\utorrent\utorrent.exe |

"{FB1D0A41-7187-41E8-BCB2-34264C2B7810}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"_{7F05E704-30A6-421A-97A7-8EEB1C7FF010}" = CorelDRAW® Graphics Suite X4

"_{CE2DA11A-917F-4CF5-AB55-755EC115DD10}" = CorelDRAW® Graphics Suite X4 - Windows Shell Extension

"{03FAA727-E2B7-471C-AC41-2E1C7F29C7EA}" = Toshiba TEMPRO

"{0CD39B4C-5483-461D-ADE1-F7C4772C88FE}" = SA Dictionary T4

"{0D5D0BEE-FBA9-4928-A50D-6CDFAB827755}" = TOSHIBA ConfigFree

"{11202615-E557-4ECF-9B86-F59C81E52909}" = FIFA 10

"{12688FD7-CB92-4A5B-BEE4-5C8E0574434F}" = Utility Common Driver

"{12B3A009-A080-4619-9A2A-C6DB151D8D67}" = TOSHIBA Assist

"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer

"{1A9DAB4D-46CD-4CBF-A9FC-28D8AA8D2FCF}" = CorelDRAW Graphics Suite X4 - Lang BR

"{2290A680-4083-410A-ADCC-7092C67FC052}" = Toshiba Online Product Information

"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer

"{26604C7E-A313-4D12-867F-7C6E7820BE4C}" = JMicron JMB38X Flash Media Controller

"{283FFB23-8751-4B08-ACB8-5E0F8BCF7727}" = Pro Evolution Soccer 2010

"{287ECFA4-719A-2143-A09B-D6A12DE54E40}" = Acrobat.com

"{3248F0A8-6813-11D6-A77B-00B0D0160060}" = Java 6 Update 6

"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java 6 Update 7

"{37C866E4-AA67-4725-9E95-A39968DD7960}" = Camera Assistant Software for Toshiba

"{43FFE159-3199-4188-A1CD-629166AD1033}" = Nero 7 Ultra Edition

"{44A27085-0616-4181-A0C3-81C7ECA17F73}" = CorelDRAW Graphics Suite X4

"{4E79AC14-1F0A-4044-B069-126EDCD2308F}" = Vista Manager

"{51B4E156-14A5-4904-9AE4-B1AA2A0E46BE}" = TOSHIBA Supervisor Password

"{5279374D-87FE-4879-9385-F17278EBB9D3}" = TOSHIBA Hardware Setup

"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml

"{5DA0E02F-970B-424B-BF41-513A5018E4C0}" = TOSHIBA Disc Creator

"{5DB65884-C963-4454-AABA-4CA3089281FA}" = NVIDIA PhysX

"{60DE4033-9503-48D1-A483-7846BD217CA9}" = ICQ6

"{617C36FD-0CBE-4600-84B2-441CEB12FADF}" = TOSHIBA Extended Tiles for Windows Mobility Center

"{620BBA5E-F848-4D56-8BDA-584E44584C5E}" = TOSHIBA Flash Cards Support Utility

"{6C5F3BDC-0A1B-4436-A696-5939629D5C31}" = TOSHIBA DVD PLAYER

"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable

"{773970F1-5EBA-4474-ADEE-1EA3B0A59492}" = TRDCReminder

"{7F05E704-30A6-421A-97A7-8EEB1C7FF010}" = CorelDRAW Graphics SUite X4 - ICA

"{7F05E704-30A6-421A-97A7-8EEB1C7FF012}" = CorelDRAW Graphics Suite X4 - Capture

"{7F05E704-30A6-421A-97A7-8EEB1C7FF013}" = CorelDRAW Graphics Suite X4 - Draw

"{7F05E704-30A6-421A-97A7-8EEB1C7FF014}" = CorelDRAW Graphics Suite X4 - PP

"{7F05E704-30A6-421A-97A7-8EEB1C7FF016}" = CorelDRAW Graphics Suite X4 - Content

"{7F05E704-30A6-421A-97A7-8EEB1C7FF017}" = CorelDRAW Graphics Suite X4 - Filters

"{7F05E704-30A6-421A-97A7-8EEB1C7FF019}" = CorelDRAW Graphics Suite X4 - FontNav

"{7F05E704-30A6-421A-97A7-8EEB1C7FF100}" = CorelDRAW Graphics Suite X4 - Lang EN

"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8169 8168 8101E 8102E Ethernet Driver

"{90120000-0016-0000-0000-0000000FF1CE}" = Microsoft Office Excel 2007

"{90120000-0016-0000-0000-0000000FF1CE}_EXCEL_{BEE75E01-DD3F-4D5F-B96C-609E6538D419}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)

"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007

"{90120000-0016-0409-0000-0000000FF1CE}_EXCEL_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)

"{90120000-0018-0000-0000-0000000FF1CE}" = Microsoft Office PowerPoint 2007

"{90120000-0018-0000-0000-0000000FF1CE}_POWERPOINT_{BEE75E01-DD3F-4D5F-B96C-609E6538D419}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)

"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007

"{90120000-0018-0409-0000-0000000FF1CE}_POWERPOINT_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)

"{90120000-001B-0000-0000-0000000FF1CE}" = Microsoft Office Word 2007

"{90120000-001B-0000-0000-0000000FF1CE}_WORD_{BEE75E01-DD3F-4D5F-B96C-609E6538D419}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)

"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007

"{90120000-001B-0409-0000-0000000FF1CE}_WORD_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)

"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007

"{90120000-001F-0409-0000-0000000FF1CE}_EXCEL_{3EC77D26-799B-4CD8-914F-C1565E796173}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)

"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007

"{90120000-001F-040C-0000-0000000FF1CE}_EXCEL_{430971B1-C31E-45DA-81E0-72C095BAB72C}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)

"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007

"{90120000-001F-0C0A-0000-0000000FF1CE}_EXCEL_{F7A31780-33C4-4E39-951A-5EC9B91D7BF1}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)

"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system

"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007

"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007

"{90120000-006E-0409-0000-0000000FF1CE}_EXCEL_{FAD8A83E-9BAC-4179-9268-A35948034D85}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)

"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007

"{90120000-0115-0409-0000-0000000FF1CE}_EXCEL_{FAD8A83E-9BAC-4179-9268-A35948034D85}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)

"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager

"{9D0798D0-AF6C-4E62-94B1-AEBF1A43E00A}" = CorelDRAW Graphics Suite X4 - IPM

"{9D306690-3173-42CD-94C6-9EF9318AF24B}" = CorelDRAW Graphics Suite X4 - Lang FR

"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = ALPS Touch Pad Driver

"{9FE35071-CAB2-4E79-93E7-BFC6A2DC5C5D}" = CD/DVD Drive Acoustic Silencer

"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR

"{A6C27FFF-75EF-4B5B-A64E-F9E128994908}" = CorelDRAW Graphics Suite X4 - Lang NL

"{AC76BA86-7AD7-1033-7B44-A92000000001}" = Adobe Reader 9.2

"{AC76BA86-7AD7-5464-3428-800000000003}" = Spelling Dictionaries Support For Adobe Reader 8

"{AEFBAC58-2DDD-4CEF-BDFD-52A5A5F432ED}" = CorelDRAW Graphics Suite X4 - Lang DE

"{B5FDA445-CAC4-4BA6-A8FB-A7212BD439DE}" = Microsoft XML Parser

"{B61D21B6-469D-4423-B161-62DB20B8A70E}" = Visual Basic for Applications ® Core - English

"{B65BBB06-1F8E-48F5-8A54-B024A9E15FDF}" = TOSHIBA Recovery Disc Creator

"{BBF0A67B-5DBA-452F-9D2E-6F168BC226E4}" = Need for Speed™ SHIFT

"{BF439B41-0252-48DE-8B8B-0430CB26A181}" = CorelDRAW Graphics Suite X4 - VBA

"{C730E42C-935A-45BB-A0C5-37E5234D111B}" = TOSHIBA Face Recognition

"{CE2DA11A-917F-4CF5-AB55-755EC115DD10}" = CorelDRAW® Graphics Suite X4 - Windows Shell Extension

"{CEBB6BFB-D708-4F99-A633-BC2600E01EF6}" = Bluetooth Stack for Windows by Toshiba

"{D0160DD3-6F62-4F1E-B999-6C68D3AE7390}" = CorelDRAW Graphics Suite X4 - Lang IT

"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.1

"{D2827848-7D2A-4547-9AD1-C965FB3E6344}" = CorelDRAW Graphics Suite X4 - Lang ES

"{DB81779E-7CC5-4630-BCFC-754004956444}" = Visual Basic for Applications ® Core

"{DBC3FDEC-D5F4-439C-9A18-EF454A74E3DE}_is1" = NOD32 FiX

"{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}" = Windows Media Encoder 9 Series

"{E65C7D8E-186D-484B-BEA8-DEF0331CE600}" = TRORDCLauncher

"{E7271ABF-69D3-4E9D-AA0A-2DE34C10A93D}" = TOSHIBA Manuals

"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver

"{F214EAA4-A069-4BAF-9DA4-4DB8BEEDE485}" = DVD MovieFactory for TOSHIBA

"{F485E43D-18B1-4B40-AF4B-EDA78E91DA80}" = Dolby Control Center

"{F81AB80B-5BB7-4E36-8BA5-E07541CE1BFC}" = HDMI Control Manager

"{FEDD27A0-B306-45EF-BF58-B527406B42C8}" = TOSHIBA Value Added Package

"AC3Filter" = AC3Filter (remove only)

"Adobe AIR" = Adobe AIR

"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX

"BCDP9_is1" = Business Card Designer Plus 9.5.0.0

"Belltech Business Card Designer Pro 5.1_is1" = Belltech Business Card Designer Pro 5.1

"BusinessCardsMX3_is1" = BusinessCardsMX 3.94

"CSI - Deadly Intent" = CSI - Deadly Intent

"EADM" = EA Download Manager

"ESET Online Scanner" = ESET Online Scanner v3

"EXCEL" = Microsoft Office Excel 2007

"InstallShield_{51B4E156-14A5-4904-9AE4-B1AA2A0E46BE}" = TOSHIBA Supervisor Password

"InstallShield_{5279374D-87FE-4879-9385-F17278EBB9D3}" = TOSHIBA Hardware Setup

"InstallShield_{617C36FD-0CBE-4600-84B2-441CEB12FADF}" = TOSHIBA Extended Tiles for Windows Mobility Center

"InstallShield_{620BBA5E-F848-4D56-8BDA-584E44584C5E}" = TOSHIBA Flash Cards Support Utility

"InstallShield_{773970F1-5EBA-4474-ADEE-1EA3B0A59492}" = TRDCReminder

"InstallShield_{C730E42C-935A-45BB-A0C5-37E5234D111B}" = TOSHIBA Face Recognition

"InstallShield_{E65C7D8E-186D-484B-BEA8-DEF0331CE600}" = TRORDCLauncher

"InstallShield_{FEDD27A0-B306-45EF-BF58-B527406B42C8}" = TOSHIBA Value Added Package

"Mozilla Firefox (2.0.0.20)" = Mozilla Firefox (2.0.0.20)

"Neighbours From Hell 5" = Neighbours From Hell 5

"NOD32" = NOD32 antivirus system

"NVIDIA Drivers" = NVIDIA Drivers

"ParadisePoker" = ParadisePoker

"POWERPOINT" = Microsoft Office PowerPoint 2007

"QuicktimeAlt_is1" = QuickTime Alternative 2.7.0

"RealAlt_is1" = Real Alternative 1.9.0

"SopCast" = SopCast 2.0.4

"The KMPlayer" = The KMPlayer (remove only)

"TOSHIBA Software Modem" = TOSHIBA Software Modem

"UltraISO_is1" = UltraISO Premium V9.0

"WebTrance25" = WebTrance2.5 (деинсталиране)

"Winamp" = Winamp

"Windows Media Encoder 9" = Windows Media Encoder 9 Series

"WORD" = Microsoft Office Word 2007

"XnView_is1" = XnView 1.94.1

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-2399308913-3005331986-738048551-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"uTorrent" = µTorrent

========== Last 10 Event Log Errors ==========

[ Application Events ]

Error - 18.9.2009 г. 09:14:20 | Computer Name = toshiba-PC | Source = LoadPerf | ID = 3001

Description =

Error - 21.9.2009 г. 14:32:13 | Computer Name = toshiba-PC | Source = Application Error | ID = 1000

Description = Faulting application webtrance25.exe, version 0.0.0.0, time stamp

0x2a425e19, faulting module webtrance25.exe, version 0.0.0.0, time stamp 0x2a425e19,

exception code 0xc0000005, fault offset 0x00001f70, process id 0xa24, application

start time 0x01ca3ae78481a610.

Error - 29.9.2009 г. 15:56:14 | Computer Name = toshiba-PC | Source = Application Error | ID = 1000

Description = Faulting application webtrance25.exe, version 0.0.0.0, time stamp

0x2a425e19, faulting module webtrance25.exe, version 0.0.0.0, time stamp 0x2a425e19,

exception code 0xc0000005, fault offset 0x0000228c, process id 0x1918, application

start time 0x01ca4001b3d48210.

Error - 6.10.2009 г. 08:00:45 | Computer Name = toshiba-PC | Source = WinMgmt | ID = 10

Description =

Error - 6.10.2009 г. 08:03:57 | Computer Name = toshiba-PC | Source = LoadPerf | ID = 3001

Description =

Error - 7.10.2009 г. 07:01:46 | Computer Name = toshiba-PC | Source = LoadPerf | ID = 3001

Description =

Error - 7.10.2009 г. 10:32:25 | Computer Name = toshiba-PC | Source = WinMgmt | ID = 10

Description =

Error - 7.10.2009 г. 10:35:11 | Computer Name = toshiba-PC | Source = LoadPerf | ID = 3001

Description =

Error - 7.10.2009 г. 18:50:58 | Computer Name = toshiba-PC | Source = WinMgmt | ID = 10

Description =

Error - 7.10.2009 г. 18:54:01 | Computer Name = toshiba-PC | Source = LoadPerf | ID = 3001

Description =

[ Media Center Events ]

Error - 12.1.2009 г. 06:53:42 | Computer Name = toshiba-PC | Source = Media Center Guide | ID = 0

Description = Event Info: ERROR: SqmApiWrapper.SqmFlushSession failed; Win32 GetLastError

returned 0D Process: DefaultDomain Object Name: Media Center Guide

[ System Events ]

Error - 13.4.2009 г. 15:02:29 | Computer Name = toshiba-PC | Source = Service Control Manager | ID = 7001

Description =

Error - 13.4.2009 г. 15:02:29 | Computer Name = toshiba-PC | Source = HTTP | ID = 15016

Description =

Error - 22.4.2009 г. 11:16:00 | Computer Name = toshiba-PC | Source = Service Control Manager | ID = 7000

Description =

Error - 22.4.2009 г. 11:17:01 | Computer Name = toshiba-PC | Source = Service Control Manager | ID = 7001

Description =

Error - 22.4.2009 г. 11:17:01 | Computer Name = toshiba-PC | Source = HTTP | ID = 15016

Description =

Error - 11.6.2009 г. 16:36:28 | Computer Name = toshiba-PC | Source = EventLog | ID = 6008

Description = The previous system shutdown at 08:58 ч. on 10.6.2009 г. was unexpected.

Error - 11.6.2009 г. 16:38:47 | Computer Name = toshiba-PC | Source = HTTP | ID = 15016

Description =

Error - 20.6.2009 г. 02:54:45 | Computer Name = toshiba-PC | Source = EventLog | ID = 6008

Description = The previous system shutdown at 23:31 ч. on 18.6.2009 г. was unexpected.

Error - 20.6.2009 г. 02:57:10 | Computer Name = toshiba-PC | Source = HTTP | ID = 15016

Description =

Error - 21.6.2009 г. 17:01:39 | Computer Name = toshiba-PC | Source = Dhcp | ID = 1002

Description = The IP address lease 192.168.0.102 for the Network Card with network

address 0016EAB6A196 has been denied by the DHCP server 192.168.1.1 (The DHCP Server

sent a DHCPNACK message).

< End of report >

24 декември 200916 г.

Стъпка 1:

Стартирайте OTL.exe
Под Custom Scans/Fixes поставете следния скрипт:

:OTL

O9 - Extra Button: eBay.co.uk - Buy It Sell It Love It - {76577871-04EC-495E-A12B-91F7C3600AFA} - File not found

O9 - Extra Button: Amazon.co.uk - {8A918C1D-E123-4E36-B562-5C1519E434CE} - File not found

O13 - gopher Prefix: missing

O32 - AutoRun File - [2006.09.18 23:43:36 | 00,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]


:Commands

[purity]

[emptytemp]

[Reboot]

След това, кликнете върху бутона Run Fix
Търпеливо изчакайте, докато програмата приключи своята работа. След, като нейната работа приключи, компютърът Ви ще се рестартира.

След рестартирането на компютъра, стартирайте отново OTL.exe и кликнете върху бутона Quick Scan. Накрая ще бъде генериран лог файл, който е необходимо да копирате и публикувате в следващия Ви коментар в тази тема.

Стъпка 2:

Моля, отидете на Start --> Settings --> Control Panel --> Add or Remove Programs, и деинсталирайте следните програми (Ако присъстват в списъка):

NOD32 FiX

NOD32 antivirus system

Стъпка 3:

Моля, изтеглете JavaRa и го разархивирайте на вашия десктоп.

***! Моля, преди да започнете с процедурата, затворете Internet Explorer !***

Кликнете два пъти върху JavaRa.exe, за да стартирате програмата
От падащото меню, изберете English ...и изберете Select.
JavaRa ще се стартира; Изберете Remove Older Versions, за да премахнете по-старата версия от вашия компютър.
Посочете Yes, когато бъдете попитани. Когато JavaRa приключи успешно премахването на старата версия, ще получите съобщение, че лог файла от извършената процедура е създаден. Изберете OK.
Лог файлът ще изскочи. Моля, запазете го на вашия десктоп.
Копирайте и поставете лог файла от JavaRa в следващия Ви пост в тази тема.

Стъпка 4:

Изтеглете ComboFix от някой от следните линкове:

Линк 1

Линк 2

* ВАЖНО !!! Запазете ComboFix.exe на вашия десктоп

Изключете вашата антивирусна и антишпионска програма, обикновено това става чрез натискане на десния бутон на мишката върху иконата на програма в системния трей.

Бележка: Ако не можете я спрете или не сте сигурни коя програма да изключите, моля прегледайте информацията от този линк: How to Disable your Security Programs

Преименувайте ComboFix.exe на Tool.exe

Стартирайте Tool.exe и следвайте инструкциите.

Бележка: ComboFix ще се стартира без инсталирана Recovery Console.

Като част от неговата работа, ComboFix ще провери дали Microsoft Windows Recovery Console е инсталирана. Предвид бързо развиващия се зловреден софтуер е силно препоръчително да бъде инсталирана преди премахването на зловредния софтуер. Това ще Ви позволи да влезете в специален recovery/repair режим, който ще ни позволи по-лесно да решите проблем, който би могъл да възникне при премахване на зловредния софтуер.

Следвайте инструкциите, за да позволите на ComboFix да изтегли и инсталира Microsoft Windows Recovery Console. В един момент ще бъдете попитани дали сте съгласни с лицензното споразумение. Необходимо е да потвърдите, че сте съгласни, за да инсталирате Microsoft Windows Recovery Console.

** Забележете: Ако Microsoft Windows Recovery Console е вече инсталирана, ComboFix ще продължи към процеса по премахване на зловредния софтуер.

След като Microsoft Windows Recovery Console е инсталирана, използвайки ComboFix, Вие ще видите следното съобщение:

Изберете Yes, за да продължи сканирането за зловреден софтуер.

Когато процесът приключи успешно, инструментът ще създаде лог файл. Моля, включете съдържанието на C:\ComboFix.txt в следващия Ви коментар в тази тема.

Бележка:

Моля, не движете мишката, докато ComboFix работи. Това може да наруши процеса на работа.
ComboFix ще нулира всички настройки на Microsoft Internet Explorer, включително да направи IE браузър по подразбиране.
ComboFix ще изключи autorun функцията на ВСИЧКИ CD, Floppy и USB устройства, за да помогне при премахването на зловредния софтуер и Ви защити от бъдещи вируси/заплахи, които поразяват чрез autorun. Ако това е проблем за вас - моля, уведомете ме.
ComboFix ще изключи вашата интернет връзка. Интернет връзката ще се възстанови автоматично, преди ComboFix да завърши процеса на работа. При проблем, той ще прекрати интернет връзката. За да възстановите интернет връзката си, рестартирайте компютъра си.
В случай на проблем с ComboFix, той може да създаде лог файл. Моля, включете съдържанието на C:\BUG.txt в следващия Ви коментар в тази тема.

Работата на ComboFix, може да отнеме до 20-30 минути, за да завърши, моля имайте търпение.

Моля, не прикачвайте лог файла/овете от програмата, а го/ги копирайте и поставете в следващия Ви коментар в тази тема.

1

24 декември 200916 г.

Автор

защо да махам нот32 нямам го после да го сложа пак

24 декември 200916 г.

Вие използвате много стара версия на ESET NOD32 Antivirus. В момента очевидно се борим със зловреден софтуер, а NOD32 е стара версия, която е неспособна да се справи с него. Освен това, Вие използвате и Fix, който допълнително усложнява нещата, при положение че в него също има зловреден код, не виждам смисъл да стои въобще. След като приключим с почистването ще сложим актуална версия на ESET NOD32 Antivirus.

1

24 декември 200916 г.

Автор

OTL logfile created on: 24.12.2009 г. 17:51:09 - Run 4

OTL by OldTimer - Version 3.1.20.0 Folder = C:\Users\toshiba\Desktop

Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation

Internet Explorer (Version = 7.0.6001.18000)

Locale: 00000402 | Country: Bulgaria | Language: BGR | Date Format: d.M.yyyy 'г.'

3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 77,00% Memory free

6,00 Gb Paging File | 6,00 Gb Available in Paging File | 89,00% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 60,07 Gb Total Space | 21,10 Gb Free Space | 35,12% Space Free | Partition Type: NTFS

Drive D: | 236,55 Gb Total Space | 163,31 Gb Free Space | 69,04% Space Free | Partition Type: NTFS

E: Drive not present or media not loaded

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

Computer Name: PC

Current User Name: toshiba

Logged in as Administrator.

Current Boot Mode: Normal

Scan Mode: Current user

Company Name Whitelist: On

Skip Microsoft Files: On

File Age = 14 Days

Output = Standard

Quick Scan

========== Processes (SafeList) ==========

PRC - [2009.12.24 16:37:21 | 00,514,048 | ---- | M] (OldTimer Tools) -- C:\Users\toshiba\Desktop\OTL.exe

PRC - [2009.10.26 08:23:21 | 00,039,408 | ---- | M] (Google Inc.) -- C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

PRC - [2009.10.03 03:08:38 | 00,035,696 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Adobe\Reader 9.0\Reader\reader_sl.exe

PRC - [2009.09.03 23:17:14 | 03,342,336 | ---- | M] (Electronic Arts) -- D:\games\NFS SHIFT\EADM\Core.exe

PRC - [2008.07.24 17:02:06 | 00,490,952 | ---- | M] (DT Soft Ltd) -- C:\Program Files\DAEMON Tools Lite\daemon.exe

PRC - [2008.05.30 18:27:52 | 00,083,312 | ---- | M] (TOSHIBA Corporation) -- C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe

PRC - [2008.05.28 16:06:02 | 06,144,000 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe

PRC - [2008.04.24 19:35:46 | 00,073,728 | ---- | M] (Toshiba) -- C:\Program Files\Toshiba\SmartFaceV\SmartFaceVWatchSrv.exe

PRC - [2008.04.24 11:22:10 | 00,103,824 | ---- | M] (Toshiba Europe GmbH) -- C:\Program Files\Toshiba TEMPRO\Toshiba.Tempo.UI.TrayApplication.exe