Това е от Хай джак

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 20:42:42, on 12.1.2010 г.

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\WINDOWS\FixCamera.exe

C:\WINDOWS\tsnp2std.exe

C:\WINDOWS\vsnp2std.exe

C:\Program Files\ESET\ESET Smart Security\egui.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\DAEMON Tools Lite\daemon.exe

C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe

C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe

C:\Program Files\ESET\ESET Smart Security\ekrn.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\wscntfy.exe

D:\Program Files\Skype\Phone\Skype.exe

C:\Program Files\Skype\Plugin Manager\skypePM.exe

D:\Program Files\Skype\Phone\Skype.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Skype\Toolbars\Shared\SkypeNames.exe

C:\Program Files\Trend Micro\HijackThis\Kaldata.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ask.com?o=15187&l=dis

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL

O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll

O3 - Toolbar: PandoraTV Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [FixCamera] C:\WINDOWS\FixCamera.exe

O4 - HKLM\..\Run: [tsnp2std] C:\WINDOWS\tsnp2std.exe

O4 - HKLM\..\Run: [snp2std] C:\WINDOWS\vsnp2std.exe

O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun

O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O17 - HKLM\System\CCS\Services\Tcpip\..\{453FC4C9-5EFC-41E9-B15D-2104CE3263D6}: NameServer = 91.193.156.4 91.193.156.5

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe

O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--

End of file - 5284 bytes

А това е другото

Malwarebytes' Anti-Malware 1.44

Версия на базата от данни: 3548

Windows 5.1.2600 Service Pack 2

Internet Explorer 6.0.2900.2180

12.1.2010 г. 19:41:39

mbam-log-2010-01-12 (19-41-39).txt

Тип сканиране: Пълно сканиране (C:\|D:\|)

Сканирани обекти: 159630

Изминало време: 33 minute(s), 34 second(s)

Заразени процеси в паметта: 0

Заразени модули в паметта: 1

Заразени ключове в регистратурата: 2

Заразени стойности в регистратурата: 0

Заразени информационни обекти в регистратурата: 0

Заразени папки: 0

Заразени файлове: 1

Заразени процеси в паметта:

(Не бяха открити заплахи)

Заразени модули в паметта:

C:\WINDOWS\system32\winxwt32.dll (Trojan.Agent) -> Delete on reboot.

Заразени ключове в регистратурата:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSSMGR (Trojan.Downloader) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\winxwt32 (Trojan.Dialer) -> Quarantined and deleted successfully.

Заразени стойности в регистратурата:

(Не бяха открити заплахи)

Заразени информационни обекти в регистратурата:

(Не бяха открити заплахи)

Заразени папки:

(Не бяха открити заплахи)

Заразени файлове:

C:\WINDOWS\system32\winxwt32.dll (Trojan.Agent) -> Delete on reboot.

СТЪПКА 1

Изтегли DDS от тук.

Запази го на десктопа.

Изключи защитата в реално време на антивирусната си програма (ако е инсталирана такава).Накрая, стартирай инструмента.

• Когато DDS приключи успешно анализа на системата ще отвори два лог файла.

1. 
   
2. DDS.txt
   
3. Attach.txt
   

• Запази ги на десктопа и след това ги прикачи към следващия си пост.

СТЪПКА 2

Изтегли GMER и го разархивирай на десктопа.

Преди да сканираш се увери, че всички останали работещи програми в момента са изключени и антивирусния софтуер няма да предприема никакви действия по време на сканирането на Gmer. Не използвай компютъра си, докато трае сканирането.

Кликни два пъти пъти върху gmer.exe , за да стартираш програмата.

Тя ще направи начално сканиране за секунди. След като то приключи НЕ натискайте бутона Scan, а избери бутона Copy и постави съдържанието на лог файла в следващия си пост.

GMER 1.0.15.15281 - http://www.gmer.net

Rootkit quick scan 2010-01-13 13:52:43

Windows 5.1.2600 Service Pack 2

Running: gmer.exe; Driver: C:\DOCUME~1\EmBlaNce\LOCALS~1\Temp\kwqyqaow.sys

---- System - GMER 1.0.15 ----

SSDT spum.sys ZwEnumerateKey [0xF8433CA2]

SSDT spum.sys ZwEnumerateValueKey [0xF8434030]

---- Devices - GMER 1.0.15 ----

Device \FileSystem\Ntfs \Ntfs 823DE1F8

AttachedDevice \FileSystem\Ntfs \Ntfs eamon.sys (Amon monitor/ESET)

Device \FileSystem\Fastfat \Fat 82282500

AttachedDevice \FileSystem\Fastfat \Fat eamon.sys (Amon monitor/ESET)

AttachedDevice \Driver\Tcpip \Device\Tcp epfwtdir.sys (ESET Antivirus Network Redirector/ESET)

---- Threads - GMER 1.0.15 ----

Thread System [4:380] 81A23930

---- EOF - GMER 1.0.15 ----

едното

DDS (Ver_09-12-01.01) - NTFSx86

Run by EmBlaNce at 13:50:56,17 on 13.01.2010 Ј.

Internet Explorer: 6.0.2900.2180

Microsoft Windows XP Professional 5.1.2600.2.1251.359.1033.18.511.153 [GMT 2:00]

AV: ESET NOD32 Antivirus 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\WINDOWS\SOUNDMAN.EXE

C:\WINDOWS\FixCamera.exe

C:\WINDOWS\tsnp2std.exe

C:\WINDOWS\vsnp2std.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe

C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\DAEMON Tools Lite\daemon.exe

C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe

C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe

C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe

C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe

C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Documents and Settings\EmBlaNce\Desktop\New Folder\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.ask.com?o=15187&l=dis

uSearch Page = hxxp://www.google.com

uSearch Bar = hxxp://www.google.com/ie

uDefault_Search_URL = hxxp://www.google.com/ie

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\progra~1\micros~2\office12\GRA8E1~1.DLL

BHO: PandoraTV Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll

TB: PandoraTV Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll

uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe

uRun: [DAEMON Tools Lite] "c:\program files\daemon tools lite\daemon.exe" -autorun

uRun: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "c:\program files\common files\ahead\lib\NMBgMonitor.exe"

uRun: [PC Suite Tray] "c:\program files\nokia\nokia pc suite 7\PCSuite.exe" -onlytray

mRun: [soundMan] SOUNDMAN.EXE

mRun: [FixCamera] c:\windows\FixCamera.exe

mRun: [tsnp2std] c:\windows\tsnp2std.exe

mRun: [snp2std] c:\windows\vsnp2std.exe

mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup

mRun: [nwiz] nwiz.exe /install

mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit

mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

mRun: [NeroFilterCheck] c:\program files\common files\ahead\lib\NeroCheck.exe

mRun: [egui] "c:\program files\eset\eset nod32 antivirus\egui.exe" /hide /waitservice

dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

TCP: {453FC4C9-5EFC-41E9-B15D-2104CE3263D6} = 91.193.156.4 91.193.156.5

Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\progra~1\micros~2\office12\GR99D3~1.DLL

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL

SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~1\micros~2\office12\GRA8E1~1.DLL

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\emblance\applic~1\mozilla\firefox\profiles\umtvt833.default\

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - hxxp://bg.start3.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:bg:official

FF - prefs.js: keyword.URL - hxxp://supertoolbar.ask.com/redirect?client=ff&src=kw&tb=PTV&o=&locale=&q=

FF - component: c:\program files\nokia\nokia pc suite 7\bkmrksync\components\BkMrkExt.dll

FF - plugin: c:\program files\google\picasa3\npPicasa3.dll

FF - plugin: c:\program files\k-lite codec pack\real\browser\plugins\nppl3260.dll

FF - plugin: c:\program files\k-lite codec pack\real\browser\plugins\nprpjplug.dll

---- FIREFOX POLICIES ----

FF - user.js: network.http.max-persistent-connections-per-server - 4

FF - user.js: nglayout.initialpaint.delay - 600

FF - user.js: content.notify.interval - 600000

FF - user.js: content.max.tokenizing.time - 1800000

FF - user.js: content.switch.threshold - 600000

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

============= SERVICES / DRIVERS ===============

R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [2009-11-16 108792]

R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2009-11-16 96408]

R2 ekrn;ESET Service;c:\program files\eset\eset nod32 antivirus\ekrn.exe [2009-11-16 735960]

S3 GarenaPEngine;GarenaPEngine;c:\docume~1\emblance\locals~1\temp\GEUA0D.tmp [2010-1-3 25616]

=============== Created Last 30 ================

2010-01-12 20:05:47 25600 -c--a-w- c:\windows\system32\dllcache\usbser.sys

2010-01-12 20:05:47 25600 ----a-w- c:\windows\system32\drivers\usbser.sys

2010-01-12 20:05:25 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01007.Wdf

2010-01-12 20:05:23 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf

2010-01-12 20:02:36 14640 ------w- c:\windows\system32\spmsgXP_2k3.dll

2010-01-12 20:02:13 23856 ----a-w- c:\windows\system32\spupdsvc.exe

2010-01-12 20:00:32 0 d-----w- c:\program files\common files\PCSuite

2010-01-12 19:59:33 0 d-----w- c:\program files\common files\Nokia

2010-01-12 19:57:48 18816 ----a-w- c:\windows\system32\drivers\pccsmcfd.sys

2010-01-12 19:56:45 0 d-----w- c:\program files\PC Connectivity Solution

2010-01-12 19:55:50 7936 ----a-w- c:\windows\system32\drivers\usbser_lowerfltj.sys

2010-01-12 19:55:41 7936 ----a-w- c:\windows\system32\drivers\usbser_lowerflt.sys

2010-01-12 19:55:34 22016 ----a-w- c:\windows\system32\drivers\ccdcmbo.sys

2010-01-12 19:55:22 17664 ----a-w- c:\windows\system32\drivers\ccdcmb.sys

2010-01-12 19:55:21 660480 ----a-w- c:\windows\system32\nmwcdcocls.dll

2010-01-12 19:55:21 1112288 ----a-w- c:\windows\system32\wdfcoinstaller01007.dll

2010-01-12 19:54:30 91136 ----a-w- c:\windows\system32\nmwcdcls.dll

2010-01-12 19:54:20 0 d-----w- c:\program files\Nokia

2010-01-12 19:23:12 0 d-----w- c:\program files\ESET

2010-01-12 18:58:18 10 ----a-w- c:\windows\system32\kr_done1

2010-01-12 18:41:45 0 d-----w- c:\program files\Trend Micro

2010-01-12 16:45:09 0 d-----w- c:\docume~1\emblance\applic~1\Malwarebytes

2010-01-12 16:45:00 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-01-12 16:44:55 0 d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes

2010-01-12 16:44:54 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-01-12 16:44:52 0 d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-01-08 16:28:17 26496 -c--a-w- c:\windows\system32\dllcache\usbstor.sys

2010-01-06 14:42:17 0 d-----w- C:\Downloads

2010-01-06 14:40:57 0 d-----w- c:\program files\BitComet

2010-01-06 13:09:02 0 d-----w- c:\docume~1\alluse~1\applic~1\Blizzard

2009-12-17 17:48:06 0 d-----w- c:\program files\common files\Real

2009-12-17 17:41:46 0 d-----w- c:\program files\VideoLAN

2009-12-17 16:47:28 69 ----a-w- c:\windows\NeroDigital.ini

2009-12-17 16:46:57 93 ----a-w- c:\documents and settings\emblance\default.pls

2009-12-17 12:44:24 0 d-----w- c:\program files\Nero

2009-12-17 12:06:56 90112 ----a-w- c:\windows\system32\dpl100.dll

2009-12-17 12:06:56 3596288 ----a-w- c:\windows\system32\qt-dx331.dll

2009-12-17 12:06:44 685056 ----a-w- c:\windows\system32\divx.dll

2009-12-17 12:06:40 85504 ----a-w- c:\windows\system32\ff_vfw.dll

2009-12-17 12:06:40 547 ----a-w- c:\windows\system32\ff_vfw.dll.manifest

2009-12-17 11:48:37 23600 ----a-w- c:\windows\system32\drivers\TVICHW32.SYS

2009-12-15 16:40:14 0 d-----w- c:\windows\CS 1.6 COOL EDiTiON

2009-12-14 17:54:00 146650 ----a-w- c:\windows\system32\BuzzingBee.wav

2009-12-14 17:54:00 125690 ----a-w- c:\windows\system32\LoopyMusic.wav

2009-12-14 17:53:58 0 d-----w- c:\windows\system32\Lang

2009-12-14 17:17:29 0 d-----w- c:\program files\Ask.com

2009-12-14 17:14:30 0 d-----w- c:\program files\The KMPlayer

==================== Find3M ====================

2009-12-17 17:48:10 348160 ----a-w- c:\windows\system32\msvcr71.dll

2009-12-17 17:48:09 499712 ----a-w- c:\windows\system32\msvcp71.dll

2009-12-17 12:36:48 502272 ----a-w- c:\windows\system32\winlogon.exe

2009-12-09 18:39:33 68220 ----a-w- c:\windows\War3Unin.dat

2009-12-09 18:34:23 2829 ----a-w- c:\windows\War3Unin.pif

2009-12-09 18:34:22 139264 ----a-w- c:\windows\War3Unin.exe

2009-12-07 16:05:10 717296 ----a-w- c:\windows\system32\drivers\sptd.sys

2009-12-07 16:01:53 4608 ---ha-w- c:\windows\system32\SYSLIB32.DLL

2009-12-07 15:40:42 21640 ----a-w- c:\windows\system32\emptyregdb.dat

2009-11-16 07:06:50 96408 ----a-w- c:\windows\system32\drivers\epfwtdir.sys

2009-11-16 07:03:36 108792 ----a-w- c:\windows\system32\drivers\ehdrv.sys

2009-11-16 06:56:12 116520 ----a-w- c:\windows\system32\drivers\eamon.sys

============= FINISH: 13:51:15,37 ===============

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-12-01.01)

Microsoft Windows XP Professional

Boot Device: \Device\HarddiskVolume1

Install Date: 07.12.2009 г. 17:48:34

System Uptime: 13.1.2010 г. 13:43:55 (0 hours ago)

Motherboard: Gigabyte Technology Co., Ltd. | | 8IPE1000-G

Processor: Intel® Celeron® CPU 2.70GHz | Socket 478 | 2726/100mhz

==== Disk Partitions =========================

A: is Removable

C: is FIXED (NTFS) - 20 GiB total, 12,517 GiB free.

D: is FIXED (NTFS) - 92 GiB total, 24,015 GiB free.

E: is CDROM ()

F: is CDROM ()

==== Disabled Device Manager Items =============

Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}

Description: Ethernet Controller

Device ID: PCI\VEN_13F0&DEV_0200&SUBSYS_82131043&REV_31\4&1F7DBC9F&0&10F0

Manufacturer:

Name: Ethernet Controller

PNP Device ID: PCI\VEN_13F0&DEV_0200&SUBSYS_82131043&REV_31\4&1F7DBC9F&0&10F0

Service:

==== System Restore Points ===================

RP18: 23.12.2009 г. 20:31:22 - System Checkpoint

RP19: 03.1.2010 г. 20:21:30 - System Checkpoint

RP20: 04.1.2010 г. 17:24:11 - Installed WinZip 14.0

RP21: 06.1.2010 г. 16:15:46 - System Checkpoint

RP22: 07.1.2010 г. 20:23:35 - System Checkpoint

RP23: 08.1.2010 г. 20:37:02 - System Checkpoint

RP24: 11.1.2010 г. 19:44:14 - System Checkpoint

RP25: 12.1.2010 г. 21:18:25 - Removed ESET Smart Security

RP26: 12.1.2010 г. 21:23:09 - ESET NOD32 Antivirus е инсталиран

RP27: 12.1.2010 г. 22:02:36 - Installed Windows XP Wdf01007.

==== Installed Programs ======================

µTorrent

Adobe Flash Player 10 Plugin

Adobe Reader 9.2

Ask Toolbar

BFL_FIFA_10

BitComet 1.17

CheMax 10.4

CS 1.6 COOL EDiTiON

DriverAgent by eSupport.com

Enable S3 for USB Device

ESET NOD32 Antivirus

FIFA 10

Garena

HijackThis 2.0.2

K-Lite Mega Codec Pack 5.4.4

Malwarebytes' Anti-Malware

Marvell Miniport Driver

Microsoft Kernel-Mode Driver Framework Feature Pack 1.7

Microsoft Office Access MUI (English) 2007

Microsoft Office Access Setup Metadata MUI (English) 2007

Microsoft Office Enterprise 2007

Microsoft Office Excel MUI (English) 2007

Microsoft Office Groove MUI (English) 2007

Microsoft Office Groove Setup Metadata MUI (English) 2007

Microsoft Office InfoPath MUI (English) 2007

Microsoft Office OneNote MUI (English) 2007

Microsoft Office Outlook MUI (English) 2007

Microsoft Office PowerPoint MUI (English) 2007

Microsoft Office Proof (English) 2007

Microsoft Office Proof (French) 2007

Microsoft Office Proof (Spanish) 2007

Microsoft Office Proofing (English) 2007

Microsoft Office Publisher MUI (English) 2007

Microsoft Office Shared MUI (English) 2007

Microsoft Office Shared Setup Metadata MUI (English) 2007

Microsoft Office Word MUI (English) 2007

Microsoft Software Update for Web Folders (English) 12

Microsoft Visual C++ 2005 Redistributable

Mozilla Firefox (3.5.7)

MSVC80_x86_v2

Nero 7 Ultra Edition

Nokia Connectivity Cable Driver

Nokia PC Suite

Notepad++

NVIDIA Drivers

PC Connectivity Solution

Picasa 3

Realtek AC'97 Audio

SHOUTcast Source DSP 1.8.2 (remove only)

Skype web features

Skype™ 4.1

The KMPlayer (remove only)

USB2.0 PC Camera (SN9C201&202)

VLC media player 1.0.3

Warcraft III: All Products

WebFldrs XP

Winamp

Windows Driver Package - Nokia Modem (06/01/2009 7.01.0.4)

Windows Driver Package - Nokia Modem (10/05/2009 4.2)

Windows Driver Package - Nokia pccsmcfd (08/22/2008 7.0.0.0)

WinRAR archiver

WinZip 14.0

WWW File Share Pro 5.40

==== Event Viewer Messages From Past Week ========

13.1.2010 г. 12:41:58, error: MRxSmb [8003] - The master browser has received a server announcement from the computer GLOBUL-PC that believes that it is the master browser for the domain on transport NetBT_Tcpip_{2E7659C3-DAEF-48B9. The master browser is stopping or an election is being forced.

13.1.2010 г. 11:13:23, error: MRxSmb [8003] - The master browser has received a server announcement from the computer GLOBUL-PC that believes that it is the master browser for the domain on transport NetBT_Tcpip_{2E7659C3-DAEF-48B9. The master browser is stopping or an election is being forced.

13.1.2010 г. 09:37:24, error: MRxSmb [8003] - The master browser has received a server announcement from the computer GLOBUL-PC that believes that it is the master browser for the domain on transport NetBT_Tcpip_{2E7659C3-DAEF-48B9. The master browser is stopping or an election is being forced.

12.1.2010 г. 20:55:52, error: MRxSmb [8003] - The master browser has received a server announcement from the computer GLOBUL-PC that believes that it is the master browser for the domain on transport NetBT_Tcpip_{2E7659C3-DAEF-48B9. The master browser is stopping or an election is being forced.

12.1.2010 г. 19:51:58, error: MRxSmb [8003] - The master browser has received a server announcement from the computer GLOBUL-PC that believes that it is the master browser for the domain on transport NetBT_Tcpip_{2E7659C3-DAEF-48B9. The master browser is stopping or an election is being forced.

12.1.2010 г. 19:44:54, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: IntelIde

12.1.2010 г. 19:16:01, error: MRxSmb [8003] - The master browser has received a server announcement from the computer GLOBUL-PC that believes that it is the master browser for the domain on transport NetBT_Tcpip_{2E7659C3-DAEF-48B9. The master browser is stopping or an election is being forced.

12.1.2010 г. 17:40:04, error: MRxSmb [8003] - The master browser has received a server announcement from the computer GLOBUL-PC that believes that it is the master browser for the domain on transport NetBT_Tcpip_{2E7659C3-DAEF-48B9. The master browser is stopping or an election is being forced.

12.1.2010 г. 16:28:03, error: MRxSmb [8003] - The master browser has received a server announcement from the computer GLOBUL-PC that believes that it is the master browser for the domain on transport NetBT_Tcpip_{2E7659C3-DAEF-48B9. The master browser is stopping or an election is being forced.

12.1.2010 г. 15:28:01, error: MRxSmb [8003] - The master browser has received a server announcement from the computer GLOBUL-PC that believes that it is the master browser for the domain on transport NetBT_Tcpip_{2E7659C3-DAEF-48B9. The master browser is stopping or an election is being forced.

12.1.2010 г. 13:52:03, error: MRxSmb [8003] - The master browser has received a server announcement from the computer GLOBUL-PC that believes that it is the master browser for the domain on transport NetBT_Tcpip_{2E7659C3-DAEF-48B9. The master browser is stopping or an election is being forced.

12.1.2010 г. 12:40:07, error: MRxSmb [8003] - The master browser has received a server announcement from the computer GLOBUL-PC that believes that it is the master browser for the domain on transport NetBT_Tcpip_{2E7659C3-DAEF-48B9. The master browser is stopping or an election is being forced.

12.1.2010 г. 09:52:08, error: MRxSmb [8003] - The master browser has received a server announcement from the computer GLOBUL-PC that believes that it is the master browser for the domain on transport NetBT_Tcpip_{2E7659C3-DAEF-48B9. The master browser is stopping or an election is being forced.

11.1.2010 г. 20:45:43, error: MRxSmb [8003] - The master browser has received a server announcement from the computer GLOBUL-PC that believes that it is the master browser for the domain on transport NetBT_Tcpip_{2E7659C3-DAEF-48B9. The master browser is stopping or an election is being forced.

11.1.2010 г. 19:39:18, error: MRxSmb [8003] - The master browser has received a server announcement from the computer GLOBUL-PC that believes that it is the master browser for the domain on transport NetBT_Tcpip_{2E7659C3-DAEF-48B9. The master browser is stopping or an election is being forced.

11.1.2010 г. 18:03:14, error: MRxSmb [8003] - The master browser has received a server announcement from the computer GLOBUL-PC that believes that it is the master browser for the domain on transport NetBT_Tcpip_{2E7659C3-DAEF-48B9. The master browser is stopping or an election is being forced.

11.1.2010 г. 17:03:13, error: MRxSmb [8003] - The master browser has received a server announcement from the computer GLOBUL-PC that believes that it is the master browser for the domain on transport NetBT_Tcpip_{2E7659C3-DAEF-48B9. The master browser is stopping or an election is being forced.

11.1.2010 г. 15:56:30, error: MRxSmb [8003] - The master browser has received a server announcement from the computer GLOBUL-PC that believes that it is the master browser for the domain on transport NetBT_Tcpip_{2E7659C3-DAEF-48B9. The master browser is stopping or an election is being forced.

11.1.2010 г. 15:46:07, error: W32Time [17] - Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup again in 15 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751)

11.1.2010 г. 15:46:07, error: W32Time [17] - Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup again in 15 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751)

09.1.2010 г. 13:54:56, error: MRxSmb [8003] - The master browser has received a server announcement from the computer GLOBUL-PC that believes that it is the master browser for the domain on transport NetBT_Tcpip_{2E7659C3-DAEF-48B9. The master browser is stopping or an election is being forced.

07.1.2010 г. 21:53:25, error: MRxSmb [8003] - The master browser has received a server announcement from the computer GLOBUL-PC that believes that it is the master browser for the domain on transport NetBT_Tcpip_{2E7659C3-DAEF-48B9. The master browser is stopping or an election is being forced.

07.1.2010 г. 20:53:21, error: MRxSmb [8003] - The master browser has received a server announcement from the computer GLOBUL-PC that believes that it is the master browser for the domain on transport NetBT_Tcpip_{2E7659C3-DAEF-48B9. The master browser is stopping or an election is being forced.

07.1.2010 г. 19:17:23, error: MRxSmb [8003] - The master browser has received a server announcement from the computer GLOBUL-PC that believes that it is the master browser for the domain on transport NetBT_Tcpip_{2E7659C3-DAEF-48B9. The master browser is stopping or an election is being forced.

==== End Of File ===========================

Аз проблеми в логовете не намирам.

От Control Panel-a => деинсталирайте следните програми:

Adobe Reader 9.2 => заменете я с Foxit Reader 3.1.4 Build 1125

Ask Toolbar

Инсталирайте Service Pack 3.

Обновете дефинициите на Malwarebytes' Anti-Malware и направете нова проверка.

Публикувайте лог файла.

Обновете антивирусната си и сканирайте системата си и с нея.

Кажете дали открива нещо.