Как да премахна Win32/Olmarik trojan и H8SRTxtvpfeotv.dll [РЕШЕН]

27 януари 201016 г.

и другият проблем, не знам дали е от вирусите е, че Internet Explorer присъства в task manager и се включва отново и отново без да има нищо на desktop-a, както и това, че след успешна инсталация на Malwarebytes' Anti-Malware просто не иска да тръгне, тръгва само hijackthis, ето и лог-а от него..

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 14:05:34, on 27.1.2010 г.

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Automatic Update\AutoUpdate.exe

C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Program Files\CDBurnerXP\NMSAccessU.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Automatic Update\AutoUpdateGUI.exe

C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\WINDOWS\Explorer.exe

F:\BitComet\BitComet.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.bg

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.bg

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dir.bg/'>http://www.dir.bg/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dir.bg

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.bg

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.bg

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dir.bg

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

R3 - URLSearchHook: UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll

F2 - REG:system.ini: Shell=

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - F:\BitComet\tools\BitCometBHO_1.1.8.30.dll

O2 - BHO: (no name) - {474C31C5-578B-4192-8562-2E474578DC27} - C:\WINDOWS\system32\mlJDurSk.dll (file missing)

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll

O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)

O3 - Toolbar: Nero Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll

O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice

O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"

O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')

O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')

O8 - Extra context menu item: &D&ownload &with BitComet - res://F:\BitComet\BitComet.exe/AddLink.htm

O8 - Extra context menu item: &D&ownload all video with BitComet - res://F:\BitComet\BitComet.exe/AddVideo.htm

O8 - Extra context menu item: &D&ownload all with BitComet - res://F:\BitComet\BitComet.exe/AddAllLink.htm

O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=GRxdm059YYBG

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll

O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra button: TricksandTweaks - {3037FC09-62A6-4446-AA30-BB9DB0CD9B65} - E:\Program Files\Tricks&Tweaks\tat.htm

O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - F:\BitComet\tools\BitCometBHO_1.1.8.30.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - E:\Program Files\ICQ6\ICQ.exe

O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - E:\Program Files\ICQ6\ICQ.exe

O15 - Trusted Zone: http://*.amadeusproweb.com

O15 - Trusted Zone: http://*.amadeusvista.com

O15 - Trusted Zone: http://content.amadeus.com (HKLM)

O15 - Trusted Zone: http://content.1a.amadeus.net (HKLM)

O15 - Trusted Zone: http://*.amadeusproweb.com (HKLM)

O15 - Trusted Zone: http://Muc.http.farm6.software.amadeusvista.com (HKLM)

O15 - Trusted Zone: http://Muc.http.farm8.software.amadeusvista.com (HKLM)

O15 - Trusted Zone: http://Muc.https.farm11.software.amadeusvista.com (HKLM)

O15 - Trusted Zone: http://Muc.https.farm5.software.amadeusvista.com (HKLM)

O15 - Trusted Zone: http://*.amadeusvista.com (HKLM)

O16 - DPF: {051FE707-9706-11D5-A836-000102A7C938} (Amadeus Automatic Update) - http://certificates.amadeusvista.com/sgwadmin/common/AutoUpdateATL26P502.CAB

O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei-5/myWebFaceInitialSetup1.0.1.2.cab

O16 - DPF: {266BB960-7DA8-11D4-A849-00008321B7D9} (Amadeus Cmd Page Cross Communication) - http://amadeusvista.com/vwp/common/cabs/VistaPWComms.CAB

O16 - DPF: {F96020DD-C373-44A0-82B6-064EF0AEEAE3} (RegSiteClientTools Class) - http://certificates.amadeusvista.com/sgwadmin/RegSiteTools.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{695A2EC9-7538-493B-A2EA-6EE937B14228}: NameServer = 212.72.193.50 212.72.193.55

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O20 - Winlogon Notify: mlJDurSk - mlJDurSk.dll (file missing)

O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Amadeus Automatic Update - Amadeus - C:\Program Files\Automatic Update\AutoUpdate.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe

O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe

O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

O23 - Service: Icecast Media Server (Icecast) - Unknown owner - E:\ICECAST\Icecast2 Win32\icecastService.exe (file missing)

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: iolo DMV Service (ioloDMV) - Unknown owner - C:\Program Files\iolo\Common\Lib\ioloDMVSvc.exe (file missing)

O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe

O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe

O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

--

End of file - 8718 bytes

27 януари 201016 г.

*. Временно спрете защитата на антивирусната си програма!.

*. Изтеглете Combofix.

*. Запазете го на на декстопа.

*. Стартирайте инструмента с двукратен клик на мишката.

*. По време на сканиране от страна на ComboFix не стартирайте никакви други приложения, не натискайте клавиши от клавиатурата и не местете мишката !

*. Публикувайте лог файла, който ще се създаде след рестарта на компютъра в следващия си пост.

27 януари 201016 г.

Автор

*. Изтеглете Combofix.

"Cannot find server" не ми отваря линк-а..

Редактирано 27 януари 201016 г. от FEMINEMA (преглед на промените)

27 януари 201016 г.

Пробвайте да го изтеглите оттук.

Нарочно съм го преименувал на caramba.exe

27 януари 201016 г.

Автор

Стана, извинявам се за забавянето..

ComboFix 10-01-26.05 - Ninoslav Arbaliyski 01.2010 г. 15:30:31.1.1 - x86

Microsoft Windows XP Professional 5.1.2600.2.1251.359.1033.18.2047.1647 [GMT 2:00]

Running from: c:\documents and settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\caramba.exe

AV: AVG Anti-Virus 7.0.289 *On-access scanning enabled* (Outdated) {41564737-3200-1071-989B-0000E87B4FB1}

AV: ESET NOD32 Antivirus 4.0 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

* Resident AV is active

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Local Settings\Temporary Internet Files\releasenote.txt

c:\windows\system32\28463

c:\windows\system32\28463\AGJW.001

c:\windows\system32\28463\AGJW.002

c:\windows\system32\28463\akv.cfg

c:\windows\system32\28463\VASF.001

c:\windows\system32\28463\XQSB.001

c:\windows\system32\drivers\H8SRTdxcnoeyacq.sys

c:\windows\system32\H8SRTcrmkovirdt.dat

c:\windows\system32\H8SRTggqamslecd.dll

c:\windows\system32\h8srtkrl32mainweq.dll

c:\windows\system32\H8SRTlhylvnmxxb.dll

c:\windows\system32\h8srtshsyst.dll

c:\windows\system32\H8SRTublniunben.dll

c:\windows\system32\H8SRTxtvxpfeotv.dll

c:\windows\system32\klipxm32.dll

c:\windows\system32\mlJDurSk.dll

c:\windows\system32\msconfig.exe

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Service_H8SRTd.sys

-------\Legacy_H8SRTd.sys

-------\Legacy_NPF

((((((((((((((((((((((((( Files Created from 2009-12-27 to 2010-01-27 )))))))))))))))))))))))))))))))

.

2010-01-27 12:05 . 2010-01-27 12:05 -------- d-----w- c:\program files\Trend Micro

2010-01-27 12:00 . 2010-01-07 14:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-01-27 12:00 . 2010-01-27 12:00 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-01-27 12:00 . 2010-01-27 12:00 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2010-01-27 12:00 . 2010-01-07 14:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-01-27 11:40 . 2010-01-27 11:40 -------- d-----w- C:\KAV

2010-01-27 10:05 . 2010-01-27 11:07 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{BC9FCCF7-E686-494B-8C9B-55C9A39A7CA9}

2010-01-27 10:05 . 2009-12-07 14:10 2953352 -c----w- c:\documents and settings\All Users\Application Data\{BC9FCCF7-E686-494B-8C9B-55C9A39A7CA9}\Ad-AwareInstallation.exe

2010-01-27 10:05 . 2010-01-27 11:06 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft

2010-01-27 09:46 . 2010-01-27 09:46 -------- d-----w- c:\documents and settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Application Data\AVG8

2010-01-27 08:41 . 2010-01-27 08:41 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\ESET

2010-01-26 20:26 . 2010-01-26 20:26 -------- d-----w- c:\documents and settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Local Settings\Application Data\ESET

2010-01-26 20:25 . 2010-01-26 20:25 -------- d-----w- c:\program files\ESET

2010-01-26 20:25 . 2010-01-26 20:25 -------- d-----w- c:\documents and settings\All Users\Application Data\ESET

2010-01-26 18:18 . 2010-01-26 18:17 245760 ----a-w- c:\windows\system32\imon.dll

2010-01-26 18:18 . 2010-01-26 18:17 114688 ----a-w- c:\windows\system32\nms32.dll

2010-01-24 15:20 . 2010-01-24 15:20 -------- d-----w- c:\documents and settings\Amadeus\Local Settings\Application Data\Help

2010-01-23 21:47 . 2005-02-12 19:05 516096 ------w- c:\windows\system32\ati2sgag.exe

2010-01-23 21:47 . 2005-02-13 04:38 299008 ----a-r- c:\windows\system32\atiiiexx.dll

2010-01-23 21:47 . 2005-01-18 23:05 79320 ----a-r- c:\windows\system32\atiicdxx.dat

2010-01-23 21:46 . 2010-01-23 21:47 -------- d-----w- c:\program files\ATI Technologies

2010-01-23 20:21 . 2010-01-23 21:47 -------- d--h--w- c:\program files\InstallShield Installation Information

2010-01-23 20:21 . 2010-01-23 20:21 -------- d-----w- c:\documents and settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Local Settings\Application Data\Downloaded Installations

2010-01-23 20:13 . 2010-01-23 20:13 -------- d-----w- c:\documents and settings\All Users\Application Data\UAB

2010-01-23 20:13 . 2010-01-23 20:13 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Drivers HeadQuarters

2010-01-23 20:13 . 2010-01-23 20:13 -------- d-----w- c:\documents and settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Local Settings\Application Data\PC_Drivers_Headquarters

2010-01-23 20:12 . 2010-01-23 20:12 -------- d-----w- c:\program files\PC Drivers HeadQuarters

2010-01-23 19:56 . 2010-01-23 19:56 -------- d-----w- c:\documents and settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Application Data\Canneverbe_Limited

2010-01-23 19:56 . 2010-01-23 19:56 -------- d-----w- c:\documents and settings\All Users\Application Data\Canneverbe Limited

2010-01-23 19:56 . 2010-01-23 20:42 -------- d-----w- c:\program files\CDBurnerXP

2010-01-23 19:20 . 2010-01-23 19:20 -------- d-----w- c:\documents and settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Application Data\Ahead

2010-01-23 19:19 . 2010-01-23 19:19 -------- d-----w- c:\program files\Nero

2010-01-23 19:01 . 2010-01-24 17:53 -------- d-----w- c:\documents and settings\Amadeus\Local Settings\Application Data\AskToolbar

2010-01-23 10:35 . 2010-01-27 09:57 1014 ----a-w- c:\documents and settings\All Users\Application Data\h8srtkrl32mainweq.dll

2010-01-22 14:20 . 2010-01-22 14:20 -------- d-----w- c:\documents and settings\Amadeus\Application Data\AdobeUM

2010-01-22 14:19 . 2010-01-22 14:19 -------- d-----w- c:\documents and settings\Amadeus\Local Settings\Application Data\Adobe

2010-01-22 09:15 . 2010-01-22 09:15 -------- d-----w- c:\documents and settings\Amadeus\Application Data\skypePM

2010-01-22 09:13 . 2010-01-22 20:23 -------- d-----w- c:\documents and settings\Amadeus\Application Data\Skype

2010-01-14 10:15 . 2010-01-14 10:15 -------- d-----w- c:\documents and settings\Amadeus\Local Settings\Application Data\Identities

2010-01-06 13:27 . 2010-01-06 13:27 -------- d-----w- c:\windows\system32\config\systemprofile\Application Data\Amadeus

2010-01-05 21:30 . 2010-01-05 21:30 -------- d-----w- c:\documents and settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\H10 (5 6GB) UMS Firmware Backup

2010-01-05 20:12 . 2010-01-05 20:12 -------- d-----w- c:\documents and settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Application Data\rockbox.org

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-01-27 13:03 . 2008-03-07 12:47 -------- d-----w- c:\documents and settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Application Data\Skype

2010-01-27 10:57 . 2008-01-05 14:56 -------- d-----w- c:\program files\HTV

2010-01-24 16:09 . 2009-05-01 13:27 -------- d-----w- c:\documents and settings\Amadeus\Application Data\Amadeus

2010-01-23 19:21 . 2006-07-13 11:17 -------- d-----w- c:\program files\Common Files\Ahead

2010-01-21 15:16 . 2009-01-10 15:32 -------- d-----w- c:\documents and settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Application Data\skypePM

2010-01-09 17:38 . 2009-05-01 13:35 815104 ----a-w- c:\documents and settings\Amadeus\Application Data\Amadeus\Viewer\Showcase.exe

2010-01-06 13:27 . 2009-11-28 17:38 -------- d-----w- c:\program files\Automatic Update

2009-12-09 20:15 . 2009-10-03 17:04 -------- d-----w- c:\documents and settings\Amadeus\Application Data\PC Suite

2009-11-12 11:48 . 2007-11-04 20:25 7168 ----a-w- c:\windows\system32\drivers\StarOpen.sys

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-02-12 339968]

"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-05-12 2029640]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-03 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"RunNarrator"="Narrator.exe" [2004-08-03 53760]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]

"MaxRecentDocs"= 7 (0x7)

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute REG_MULTI_SZ autocheck autochk *\0smrgdf c:\program files\iolo\System Mechanic Professional 6\

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

[HKLM\~\startupfolder\C:^Documents and Settings^Ninoslav Arbaliyski.ARBALIYS-DQRY21^Start Menu^Programs^Startup^Configure Bulgarian Speech.lnk]

path=c:\documents and settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Start Menu\Programs\Startup\Configure Bulgarian Speech.lnk

backup=c:\windows\pss\Configure Bulgarian Speech.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Ninoslav Arbaliyski.ARBALIYS-DQRY21^Start Menu^Programs^Startup^hamachi.lnk]

path=c:\documents and settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Start Menu\Programs\Startup\hamachi.lnk

backup=c:\windows\pss\hamachi.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Ninoslav Arbaliyski.ARBALIYS-DQRY21^Start Menu^Programs^Startup^Last.fm Helper.lnk]

path=c:\documents and settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Start Menu\Programs\Startup\Last.fm Helper.lnk

backup=c:\windows\pss\Last.fm Helper.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]

2008-07-04 15:01 486856 ----a-w- e:\program files\DAEMON Tools Lite\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]

2007-10-18 09:34 5724184 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]

2009-06-25 12:12 1414144 ----a-w- e:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]

"Skype"="c:\program files\Skype\Phone\Skype.exe" /nosplash /minimized

"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\lib\NMBgMonitor.exe"

"Talisman 2 - shell and desktop manager"=c:\program files\Talisman 2\talisman.exe

"MsnMsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" /background

"CTFMON.EXE"=c:\windows\system32\ctfmon.exe

"Microsoft Office Outlook"=c:\progra~1\MICROS~2\Office12\OUTLOOK.EXE /recycle

"ICQ"="e:\program files\ICQ6\ICQ.exe" silent

"ActiveKeyboard"=e:\program files\Active Keyboard\HotFiles.exe

"ChristmasTree"=f:\my documents\Fun\Koledna elha.exe

"HackAttack"=c:\documents and settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\HackAttack.exe

"PC Suite Tray"="e:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"SurfAnonymous"=e:\mirc\SurfAnonymous 1.0.1.0 REGISTERED FINALLY PEOPLE !.exe\SurfAnonymous1.0.1.0_registered\SurfAnonymous\SurfAnonymous.exe -1

"Cmaudio"=RunDll32 cmicnfg.cpl,CMICtrlWnd

"avast!"=c:\progra~1\ALWILS~1\Avast4\ashDisp.exe

"HTV Agent"=c:\program files\HTV\HTV.exe

"snpstd"=c:\windows\vsnpstd.exe

"LVCOMSX"=c:\windows\system32\LVCOMSX.EXE

"MyWebSearch Plugin"=rundll32 c:\progra~1\MYWEBS~1\bar\1.bin\M3PLUGIN.DLL,UPF

"My Web Search Bar"=rundll32 c:\progra~1\MYWEBS~1\bar\1.bin\MWSBAR.DLL,S

"NvCplDaemon"=RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]

"Easy-PrintToolBox"=c:\program files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"e:\\mIRC\\m00n Script by FEMINEMA™\\mirc.exe"=

"e:\\mIRC\\HackAttack TriviQ\\eggdrop.exe"=

"e:\\mIRC\\SurfAnonymous 1.0.1.0 REGISTERED FINALLY PEOPLE !.exe\\SurfAnonymous1.0.1.0_registered\\SurfAnonymous\\SurfAnonymous.exe"=

"e:\\mIRC\\My scripts\\HackAttack\\HackAttack.exe"=

"e:\\mIRC\\My scripts\\UnderAttack\\EggBot.exe"=

"e:\\mIRC\\My scripts\\VirusAlert Eggbot\\mirc.exe"=

"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=

"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=

"e:\\mIRC\\triviq\\Windrop\\eggdrop.exe"=

"e:\\mIRC\\Batman_Inviter\\UniBG.exe"=

"e:\\mIRC\\Batman_Inviter\\UniBG_original.exe"=

"c:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"=

"f:\\Games\\CS1.6\\hl.exe"=

"e:\\Program Files\\ICQ6\\ICQ.exe"=

"e:\\Program Files\\uTorrent\\uTorrent.exe"=

"f:\\Games\\CSSv34\\hl2.exe"=

"f:\\Games\\CS1.6\\87490399635842422409.exe"=

"f:\\Games\\CS1.6\\18620163875862260276.exe"=

"f:\\Games\\CS1.6\\46363022019984683260.exe"=

"f:\\Games\\CS1.6\\37302044934507448061.exe"=

"f:\\Games\\CS1.6\\89717897544993839310.exe"=

"f:\\Games\\CS1.6\\94225354114254776487.exe"=

"f:\\Games\\CS1.6\\91297880738655603369.exe"=

"f:\\Games\\CS1.6\\20263383694886559014.exe"=

"f:\\Games\\CS1.6\\73697098847968077660.exe"=

"f:\\Games\\CS1.6\\88562270040609616556.exe"=

"f:\\Games\\CS1.6\\97360273714495492501.exe"=

"c:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=

"c:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=

"f:\\Games\\CS1.6\\57627468768442414184.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

"f:\\Games\\CS1.6\\47360162383515530936.exe"=

"c:\\Program Files\\Nero\\Nero 7\\Nero Home\\NeroHome.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"14815:TCP"= 14815:TCP:BitComet 14815 TCP

"14815:UDP"= 14815:UDP:BitComet 14815 UDP

R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [12.5.2009 г. 06:33 107256]

R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [12.5.2009 г. 06:34 94360]

R1 kbfilter;Keyboard Filter Driver;c:\windows\system32\drivers\kbfilter.sys [20.7.2007 г. 11:38 11776]

R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [12.5.2009 г. 06:33 731840]

R2 SVKP;SVKP;c:\windows\system32\SVKP.sys [12.3.2007 г. 16:06 2368]

S1 MUsbFltr;WayTechUSBFilterDriver; [x]

S1 UsbFltr;WayTechUSBFilterDriver; [x]

S2 Icecast;Icecast Media Server;"e:\icecast\Icecast2 Win32\icecastService.exe" "e:\icecast\Icecast2 Win32" --> e:\icecast\Icecast2 Win32\icecastService.exe [?]

S3 KS-959;Kingsun KS-959 USB Infrared Adapter;c:\windows\system32\drivers\KS-959.sys [25.11.2006 г. 18:06 19034]

S3 mirrorv3;mirrorv3;c:\windows\system32\drivers\rminiv3.sys [01.11.2006 г. 05:01 3328]

S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [02.10.2009 г. 22:06 136704]

S3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [02.10.2009 г. 22:06 8320]

S3 PRODIGY;PRODIGY;c:\windows\system32\drivers\prodigy.sys [03.10.2009 г. 17:52 32377]

S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [21.7.2006 г. 16:18 717296]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs

UxTuneUp

.

Contents of the 'Scheduled Tasks' folder

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.dir.bg/

mStart Page = hxxp://www.dir.bg

mWindow Title = FEMINEMA

uInternet Connection Wizard,ShellNext = iexplore

IE: &D&ownload &with BitComet - f:\bitcomet\BitComet.exe/AddLink.htm

IE: &D&ownload all video with BitComet - f:\bitcomet\BitComet.exe/AddVideo.htm

IE: &D&ownload all with BitComet - f:\bitcomet\BitComet.exe/AddAllLink.htm

IE: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=GRxdm059YYBG

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

IE: {{3037FC09-62A6-4446-AA30-BB9DB0CD9B65} - e:\program files\Tricks&Tweaks\tat.htm

Trusted Zone: amadeusproweb.com

Trusted Zone: amadeusvista.com

Trusted Zone: amadeus.com\content

Trusted Zone: amadeus.net\content.1a

Trusted Zone: amadeusproweb.com

Trusted Zone: amadeusvista.com

Trusted Zone: amadeusvista.com\Muc.http.farm6.software

Trusted Zone: amadeusvista.com\Muc.http.farm8.software

Trusted Zone: amadeusvista.com\Muc.https.farm11.software

Trusted Zone: amadeusvista.com\Muc.https.farm5.software

DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab

DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - hxxp://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei-5/myWebFaceInitialSetup1.0.1.2.cab

DPF: {266BB960-7DA8-11D4-A849-00008321B7D9} - hxxp://amadeusvista.com/vwp/common/cabs/VistaPWComms.CAB

DPF: {F96020DD-C373-44A0-82B6-064EF0AEEAE3} - hxxp://certificates.amadeusvista.com/sgwadmin/RegSiteTools.cab

.

------- File Associations -------

.

JSEFile=NOTEPAD.EXE %1

.

- - - - ORPHANS REMOVED - - - -

BHO-{474C31C5-578B-4192-8562-2E474578DC27} - c:\windows\system32\mlJDurSk.dll

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)

ShellExecuteHooks-{474C31C5-578B-4192-8562-2E474578DC27} - c:\windows\system32\mlJDurSk.dll

Notify-mlJDurSk - mlJDurSk.dll

Notify-NavLogon - (no file)

MSConfigStartUp-Malware Defense - c:\program files\Malware Defense\mdefense.exe

MSConfigStartUp-twunk_32x - c:\docume~1\NINOSL~1.ARB\LOCALS~1\Temp\twunk_32x.exe

ActiveSetup-{28ABC5C0-4FCB-11CF-AAX5-81CX1C635612} - c:\recycler\S-1-5-21-1482476501-1644491937-682003330-1013\stcvhost.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-01-27 15:40

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(736)

c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(3992)

c:\windows\system32\WPDShServiceObj.dll

e:\program files\Nokia\Nokia PC Suite 7\PhoneBrowser.dll

e:\program files\Nokia\Nokia PC Suite 7\NGSCM.DLL

e:\program files\Nokia\Nokia PC Suite 7\Lang\PhoneBrowser_eng.nlr

e:\program files\Nokia\Nokia PC Suite 7\Resource\PhoneBrowser_Nokia.ngr

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

------------------------ Other Running Processes ------------------------

.

c:\windows\system32\Ati2evxx.exe

c:\program files\Automatic Update\AutoUpdate.exe

c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

c:\program files\CDBurnerXP\NMSAccessU.exe

c:\program files\Automatic Update\AutoUpdateGUI.exe

c:\windows\system32\wscntfy.exe

c:\windows\System32\scrnsave.scr

.

**************************************************************************

.

Completion time: 2010-01-27 15:44:36 - machine was rebooted

ComboFix-quarantined-files.txt 2010-01-27 13:44

Pre-Run: 4 889 702 400 bytes free

Post-Run: 6 961 139 712 bytes free

Current=2 Default=2 Failed=3 LastKnownGood=4 Sets=1,2,3,4

- - End Of File - - 6522A95CD0A6673AF74A57D40118BEC5

27 януари 201016 г.

Ще пиша малко по-късно, защото съм на работа в момента а дотогава:

Вече стартирайте отново Malwarebytes, обновете дефинициите, сканирайте и публукувайте лог файла.

И второ:

Изтеглете GMER и го разархивирайте на десктопа.

Преди да сканирате се уверете, че всички останали работещи програми в момента са изключени и антивирусния софтуер няма да предприема никакви действия по време на сканирането на Gmer. Не използвайте компютъра си, докато трае сканирането.

Кликнете два пъти пъти върху gmer.exe , за да стартирате програмата.

Тя ще направи начално сканиране за секунди. След като то приключи НЕ натискайте бутона Scan, а изберете бутона Copy и поставете съдържанието на лог файла в следващия си пост.

27 януари 201016 г.

Автор

Извинявам се за забавянето, ето лог-а, а сега пускам и gmer..

Malwarebytes' Anti-Malware 1.44

Database version: 3645

Windows 5.1.2600 Service Pack 2

Internet Explorer 6.0.2900.2180

27.1.2010 г. 20:55:42

mbam-log-2010-01-27 (20-55-42).txt

Scan type: Full Scan (A:\|C:\|D:\|E:\|F:\|)

Objects scanned: 326045

Time elapsed: 1 hour(s), 0 minute(s), 54 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 14

Registry Values Infected: 1

Registry Data Items Infected: 0

Folders Infected: 1

Files Infected: 21

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_CLASSES_ROOT\CLSID\{147a976f-eee1-4377-8ea7-4716e4cdd239} (Adware.MyWebSearch) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{28abc5c0-4fcb-11cf-aax5-81cx1c635612} (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59c7fc09-1c83-4648-b3e6-003d2bbc7481} (Adware.MyWebSearch) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68af847f-6e91-45dd-9b68-d6a12c30e5d7} (Adware.MyWebSearch) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170b96c-28d4-4626-8358-27e6caeef907} (Adware.MyWebSearch) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{d1a71fa0-ff48-48dd-9b6d-7a13a3e42127} (Adware.MyWebSearch) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ddb1968e-ead6-40fd-8dae-ff14757f60c7} (Adware.MyWebSearch) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{f138d901-86f0-4383-99b6-9cdd406036da} (Adware.MyWebSearch) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Registry Values Infected:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\MenuExt\&Search\(default) (Adware.Hotbar) -> Quarantined and deleted successfully.

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

C:\Documents and Settings\All Users\Start Menu\Programs\Ardamax Keylogger (PUP.ArdamaxKeyLogger) -> Quarantined and deleted successfully.

Files Infected:

C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\otvarqm s vb.scr (Backdoor.Bot) -> Quarantined and deleted successfully.

C:\Qoobox\Quarantine\C\WINDOWS\system32\H8SRTlhylvnmxxb.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Qoobox\Quarantine\C\WINDOWS\system32\H8SRTublniunben.dll.vir (Rootkit.TDSS.Gen) -> Quarantined and deleted successfully.

C:\Qoobox\Quarantine\C\WINDOWS\system32\H8SRTxtvxpfeotv.dll.vir (Rootkit.TDSS.Gen) -> Quarantined and deleted successfully.

C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\H8SRTdxcnoeyacq.sys.vir (Rootkit.TDSS) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\HEViewer.exe (Trojan.Skillis) -> Quarantined and deleted successfully.

E:\mIRC\Hackers Script by Kondor\system\ipscan.exe (PUP.Malware.Tool) -> Quarantined and deleted successfully.

E:\mIRC\My scripts\chalga script\mIRC.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

E:\mIRC\My scripts\chalga script\programs\IPScanner\ipscan.exe (PUP.Malware.Tool) -> Quarantined and deleted successfully.

E:\Fruity loops\FLStudio5\UNWISE.EXE (Malware.Packer.Morphine) -> Quarantined and deleted successfully.

E:\Program Files\Bluetooth Remote Control\PATCH.EXE (Trojan.Downloader) -> Quarantined and deleted successfully.

E:\System Volume Information\_restore{5F60C3E8-2DD3-4A82-BCF1-3D8660D3BD2E}\RP87\A0026972.exe (Trojan.LDPinch) -> Quarantined and deleted successfully.

F:\BitComet\Downloads\Picture Resize Genius 2.9.8\PACH\patch.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

F:\BitComet\Downloads\Sandboxie v3.43.12 Beta CRD ZW DM999\keygen-ZWT.exe (Malware.Tool) -> Quarantined and deleted successfully.

F:\Exe-ta\Flv to Avi Converter v1.1.0 WinALL Cracked\Flv to Avi Converter.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

F:\Exe-ta\Photo Collage Studio\wondershare.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

F:\Exe-ta\Plato DVD Copy v6.68 WinALL Cracked\Plato dvd copy v6.68.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\Documents and Settings\All Users\Start Menu\Programs\Ardamax Keylogger\Help.lnk (PUP.ArdamaxKeyLogger) -> Quarantined and deleted successfully.

GMER 1.0.15.15281 - http://www.gmer.net

Rootkit quick scan 2010-01-27 21:09:42

Windows 5.1.2600 Service Pack 2

Running: gmer.exe; Driver: C:\DOCUME~1\NINOSL~1.ARB\LOCALS~1\Temp\pxryypod.sys

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs eamon.sys (Amon monitor/ESET)

AttachedDevice \Driver\Tcpip \Device\Tcp epfwtdir.sys (ESET Antivirus Network Redirector/ESET)

---- Threads - GMER 1.0.15 ----

Thread System [4:440] 8A079930

---- EOF - GMER 1.0.15 ----

Редактирано 27 януари 201016 г. от FEMINEMA (преглед на промените)

27 януари 201016 г.

СТЪПКА 1

Временно деинсталирайте Daemon Tools от Add or Remove Programs от Control Panel-a.

Рестартирайте машината.

СТЪПКА 2

Моля, изтеглете mbr.exe и го запазете C:\ . (Важно е да го направите!).

Отворете Start -> Run и напишете: cmd /c mbr.exe -t >log.txt&start log.txt
Потвърдете с клавишния бутон Enter
Излезте от Command Prompt

Публикувайте лог файла.

СТЪПКА 3

Моля изтеглете OTL.exe и го запазете на десктопа.

Стартирайте файла с двукратен клик на мишката.

Направете следните настройки:

Под "Custom Scans/Fixes" с copy/paste въведете следната информация:

netsvcs

msconfig

safebootminimal

safebootnetwork

activex

drivers32

%SYSTEMDRIVE%\*.*

/md5start

d3d8thk.dll

eventlog.dll

scecli.dll

netlogon.dll

cngaudit.dll

sceclt.dll

ntelogon.dll

logevent.dll

iaStor.sys

nvstor.sys

atapi.sys

IdeChnDr.sys

viasraid.sys

AGP440.sys

vaxscsi.sys

nvatabus.sys

viamraid.sys

nvata.sys

nvgts.sys

iastorv.sys

ViPrt.sys

eNetHook.dll

ahcix86.sys

KR10N.sys

nvstor32.sys

ahcix86s.sys

nvrd32.sys

/md5stop

%systemroot%\*. /mp /s

%systemroot%\system32\*.dll /lockedfiles

%systemroot%\Tasks\*.job /lockedfiles

%PROGRAMFILES%\*.

%userprofile%\Desktop\*.*

%userprofile%\Desktop\*.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs

Натиснете Run Scan.

Като приключи проверката публикувайте двата лог файла - OTL.Txt и Extras.Txt.

27 януари 201016 г.

Автор

mbr.exe log ->

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully

user: MBR read successfully

called modules: TUKERNEL.EXE CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS

kernel: MBR read successfully

user & kernel MBR OK

OTL.txt

OTL logfile created on: 27.1.2010 г. 21:35:46 - Run 1

OTL by OldTimer - Version 3.1.27.0 Folder = C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop

Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 6.0.2900.2180)

Locale: 00000402 | Country: Bulgaria | Language: BGR | Date Format: dd.M.yyyy 'г.'

2,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 76,00% Memory free

3,00 Gb Paging File | 2,00 Gb Available in Paging File | 89,00% Paging File free

Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 15,93 Gb Total Space | 5,67 Gb Free Space | 35,63% Space Free | Partition Type: NTFS

D: Drive not present or media not loaded

Drive E: | 58,60 Gb Total Space | 27,35 Gb Free Space | 46,67% Space Free | Partition Type: NTFS

Drive F: | 298,08 Gb Total Space | 59,41 Gb Free Space | 19,93% Space Free | Partition Type: NTFS

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

Computer Name: FEMIN3MA

Current User Name: Ninoslav Arbaliyski

Logged in as Administrator.

Current Boot Mode: Normal

Scan Mode: All users

Company Name Whitelist: On

Skip Microsoft Files: On

File Age = 30 Days

Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\OTL.exe (OldTimer Tools)

PRC - C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\gmer.exe ()

PRC - C:\Program Files\Automatic Update\AutoUpdateGUI.exe (AMADEUS)

PRC - C:\Program Files\Automatic Update\AutoUpdate.exe (Amadeus)

PRC - C:\Program Files\CDBurnerXP\NMSAccessU.exe ()

PRC - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe (ESET)

PRC - C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe (ESET)

PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)

PRC - C:\WINDOWS\system32\ati2evxx.exe (ATI Technologies Inc.)

PRC - C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe (ATI Technologies, Inc.)

PRC - C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\OTL.exe (OldTimer Tools)

MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll (Microsoft Corporation)

MOD - C:\WINDOWS\system32\framedyn.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (ioloDMV) -- File not found

SRV - (Icecast) -- File not found

SRV - (Amadeus Automatic Update) -- C:\Program Files\Automatic Update\AutoUpdate.exe (Amadeus)

SRV - (NMSAccessU) -- C:\Program Files\CDBurnerXP\NMSAccessU.exe ()

SRV - (ServiceLayer) -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (Nokia.)

SRV - (EhttpSrv) -- C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe (ESET)

SRV - (ekrn) -- C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe (ESET)

SRV - (UxTuneUp) -- C:\WINDOWS\system32\uxtuneup.dll (TuneUp Software GmbH)

SRV - (WLSetupSvc) -- C:\Program Files\Windows Live\installer\WLSetupSvc.exe (Microsoft Corporation)

SRV - (usnjsvc) -- C:\Program Files\Windows Live\Messenger\usnsvc.exe (Microsoft Corporation)

SRV - (Microsoft Office Groove Audit Service) -- C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe (Microsoft Corporation)

SRV - (odserv) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE (Microsoft Corporation)

SRV - (ose) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)

SRV - (NBService) -- C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe (Nero AG)

SRV - (Adobe LM Service) -- C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe ()

SRV - (IDriverT) -- C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe (Macrovision Corporation)

SRV - (Ati HotKey Poller) -- C:\WINDOWS\system32\ati2evxx.exe (ATI Technologies Inc.)

SRV - (ATI Smart) -- C:\WINDOWS\system32\ati2sgag.exe ()

SRV - (Irmon) -- C:\WINDOWS\system32\irmon.dll (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV - (StarOpen) -- C:\WINDOWS\system32\drivers\StarOpen.sys ()

DRV - (sptd) -- C:\WINDOWS\system32\drivers\sptd.sys (Duplex Secure Ltd.)

DRV - (hamachi) -- C:\WINDOWS\system32\drivers\hamachi.sys (LogMeIn, Inc.)

DRV - (epfwtdir) -- C:\WINDOWS\system32\drivers\epfwtdir.sys (ESET)

DRV - (ehdrv) -- C:\WINDOWS\system32\drivers\ehdrv.sys (ESET)

DRV - (eamon) -- C:\WINDOWS\system32\drivers\eamon.sys (ESET)

DRV - (nmwcdnsu) -- C:\WINDOWS\system32\drivers\nmwcdnsu.sys (Nokia)

DRV - (nmwcdnsuc) -- C:\WINDOWS\system32\drivers\nmwcdnsuc.sys (Nokia)

DRV - (UsbserFilt) -- C:\WINDOWS\system32\drivers\usbser_lowerfltj.sys (Nokia)

DRV - (upperdev) -- C:\WINDOWS\system32\drivers\usbser_lowerflt.sys (Nokia)

DRV - (nmwcdc) -- C:\WINDOWS\system32\drivers\ccdcmbo.sys (Nokia)

DRV - (nmwcd) -- C:\WINDOWS\system32\drivers\ccdcmb.sys (Nokia)

DRV - (pccsmcfd) -- C:\WINDOWS\system32\drivers\pccsmcfd.sys (Nokia)

DRV - (Secdrv) -- C:\WINDOWS\system32\drivers\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)

DRV - (BT) -- C:\WINDOWS\system32\drivers\btnetdrv.sys (IVT Corporation.)

DRV - (Btcsrusb) -- C:\WINDOWS\system32\drivers\btcusb.sys (IVT Corporation.)

DRV - (BlueletAudio) -- C:\WINDOWS\system32\drivers\blueletaudio.sys (IVT Corporation.)

DRV - (SVKP) -- C:\WINDOWS\system32\SVKP.sys (AntiCracking)

DRV - (PxHelp20) -- C:\WINDOWS\system32\DRIVERS\PxHelp20.sys (Sonic Solutions)

DRV - (BlueletSCOAudio) -- C:\WINDOWS\system32\drivers\BlueletSCOAudio.sys (IVT Corporation.)

DRV - (BTHidMgr) -- C:\WINDOWS\System32\Drivers\BTHidMgr.sys (IVT Corporation.)

DRV - (BTHidEnum) -- C:\WINDOWS\System32\Drivers\vbtenum.sys (IVT Corporation.)

DRV - (VcommMgr) -- C:\WINDOWS\system32\drivers\VcommMgr.sys (IVT Corporation.)

DRV - (VComm) -- C:\WINDOWS\system32\drivers\VComm.sys (IVT Corporation.)

DRV - (BTNetFilter) -- C:\Program Files\IVT Corporation\BlueSoleil\device\Win2k\BTNetFilter.sys (IVT Corporation.)

DRV - (mirrorv3) -- C:\WINDOWS\system32\drivers\rminiv3.sys (Famatech International Corp.)

DRV - (PRODIGY) -- C:\WINDOWS\system32\drivers\prodigy.sys (B-phreaks)

DRV - (KS-959) -- C:\WINDOWS\system32\drivers\KS-959.sys (Kingsun Corporation)

DRV - (ss_mdm) -- C:\WINDOWS\system32\drivers\ss_mdm.sys (MCCI)

DRV - (ss_mdfl) -- C:\WINDOWS\system32\drivers\ss_mdfl.sys (MCCI)

DRV - (ss_bus) SAMSUNG Mobile USB Device 1.0 driver (WDM) -- C:\WINDOWS\system32\drivers\ss_bus.sys (MCCI)

DRV - (ati2mtag) -- C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)

DRV - (PID_08A0) QuickCam IM(PID_08A0) -- C:\WINDOWS\system32\drivers\LV302AV.SYS (Logitech Inc.)

DRV - (LVUSBSta) -- C:\WINDOWS\system32\drivers\LVUSBSta.sys (Logitech Inc.)

DRV - (snpstd) USB PC Camera (SN9C102) -- C:\WINDOWS\system32\drivers\snpstd.sys ()

DRV - (moufiltr) -- C:\WINDOWS\system32\drivers\moufiltr.sys (Windows ® 2000 DDK provider)

DRV - (usbser) -- C:\WINDOWS\system32\drivers\usbser.sys (Microsoft Corporation)

DRV - (gameenum) -- C:\WINDOWS\system32\drivers\gameenum.sys (Microsoft Corporation)

DRV - (usbaudio) USB Audio Driver (WDM) -- C:\WINDOWS\system32\drivers\USBAUDIO.sys (Microsoft Corporation)

DRV - (nm) -- C:\WINDOWS\system32\drivers\nmnt.sys (Microsoft Corporation)

DRV - (SISNIC) -- C:\WINDOWS\system32\drivers\sisnic.sys (SiS Corporation)

DRV - (rtl8139) Realtek RTL8139(A/B/C) -- C:\WINDOWS\system32\drivers\rtl8139.sys (Realtek Semiconductor Corporation)

DRV - (cmuda) -- C:\WINDOWS\system32\drivers\cmuda.sys (C-Media Inc)

DRV - (SISAGP) -- C:\WINDOWS\system32\DRIVERS\SISAGPX.sys (Silicon Integrated Systems Corporation)

DRV - (kbfilter) -- C:\WINDOWS\system32\drivers\kbfilter.sys (WayTech Development, Inc.)

DRV - (Ptilink) -- C:\WINDOWS\system32\drivers\ptilink.sys (Parallel Technologies, Inc.)

DRV - (ROOTMODEM) -- C:\WINDOWS\system32\drivers\rootmdm.sys (Microsoft Corporation)

DRV - (giveio) -- C:\WINDOWS\system32\giveio.sys ()

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.dir.bg

IE - HKU\.DEFAULT\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-20\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-796845957-725345543-839522115-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.dir.bg/

IE - HKU\S-1-5-21-796845957-725345543-839522115-1006\S-1-5-21-796845957-725345543-839522115-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.selectedEngine: "Google"

FF - user.js..network.proxy.type: 0

FF - user.js..network.proxy.http: ""

FF - user.js..network.proxy.http_port:

FF - user.js..network.proxy.no_proxies_on: ""

FF - HKLM\software\mozilla\Firefox\Extensions\\[email protected]: E:\Program Files\Nokia\Nokia PC Suite 7\bkmrksync\ [2009.10.02 22:07:38 | 00,000,000 | ---D | M]

FF - HKLM\software\mozilla\Flock\Extensions\\Plugins: C:\Program Files\Flock\flock\plugins

FF - HKLM\software\mozilla\Thunderbird\Extensions\\[email protected]: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird [2010.01.26 22:25:06 | 00,000,000 | ---D | M]

[2007.10.28 11:45:28 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Application Data\Mozilla\Firefox\Profiles\w47j0aoy.default\extensions

O1 HOSTS File: ([2010.01.27 15:39:39 | 00,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1 localhost

O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)

O2 - BHO: (BitComet Helper) - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - F:\BitComet\tools\BitCometBHO_1.1.8.30.dll (BitComet)

O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)

O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll (Sun Microsystems, Inc.)

O3 - HKLM\..\Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - No CLSID value found.

O3 - HKU\S-1-5-21-796845957-725345543-839522115-1006\..\Toolbar\WebBrowser: (no name) - {DB87BFA2-A2E3-451E-8E5A-C89982D87CBF} - No CLSID value found.

O4 - HKLM..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe (ATI Technologies, Inc.)

O4 - HKLM..\Run: [egui] C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe (ESET)

O4 - HKU\.DEFAULT..\RunOnce: [RunNarrator] C:\WINDOWS\System32\narrator.exe (Microsoft Corporation)

O4 - HKU\S-1-5-18..\RunOnce: [RunNarrator] C:\WINDOWS\System32\narrator.exe (Microsoft Corporation)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-19_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-20_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-21-796845957-725345543-839522115-1006\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-21-796845957-725345543-839522115-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O7 - HKU\S-1-5-21-796845957-725345543-839522115-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: MaxRecentDocs = 7

O7 - HKU\S-1-5-21-796845957-725345543-839522115-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoUserNameInStartMenu = 1

O7 - HKU\S-1-5-21-796845957-725345543-839522115-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O7 - HKU\S-1-5-21-796845957-725345543-839522115-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O7 - HKU\S-1-5-21-796845957-725345543-839522115-1006_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O8 - Extra context menu item: &D&ownload &with BitComet - F:\BitComet\BitComet.exe (www.BitComet.com)

O8 - Extra context menu item: &D&ownload all video with BitComet - F:\BitComet\BitComet.exe (www.BitComet.com)

O8 - Extra context menu item: &D&ownload all with BitComet - F:\BitComet\BitComet.exe (www.BitComet.com)

O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)

O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra Button: TricksandTweaks - {3037FC09-62A6-4446-AA30-BB9DB0CD9B65} - E:\Program Files\Tricks&Tweaks\tat.htm ()

O9 - Extra Button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - F:\BitComet\tools\BitCometBHO_1.1.8.30.dll (BitComet)

O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)

O9 - Extra Button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - E:\Program Files\ICQ6\ICQ.exe (ICQ, Inc.)

O9 - Extra 'Tools' menuitem : ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - E:\Program Files\ICQ6\ICQ.exe (ICQ, Inc.)

O15 - HKLM\..Trusted Domains: amadeus.com ([content] http in Trusted sites)

O15 - HKLM\..Trusted Domains: amadeus.net ([content.1a] http in Trusted sites)

O15 - HKLM\..Trusted Domains: amadeusproweb.com ([]http in Trusted sites)

O15 - HKLM\..Trusted Domains: amadeusvista.com ([]http in Trusted sites)

O15 - HKLM\..Trusted Domains: amadeusvista.com ([Muc.http.farm6.software] http in Trusted sites)

O15 - HKLM\..Trusted Domains: amadeusvista.com ([Muc.http.farm8.software] http in Trusted sites)

O15 - HKLM\..Trusted Domains: amadeusvista.com ([Muc.https.farm11.software] http in Trusted sites)

O15 - HKLM\..Trusted Domains: amadeusvista.com ([Muc.https.farm5.software] http in Trusted sites)

O15 - HKLM\..Trusted Domains: 3 domain(s) and sub-domain(s) not assigned to a zone.

O15 - HKU\S-1-5-21-796845957-725345543-839522115-1006\..Trusted Domains: amadeusproweb.com ([]http in Trusted sites)

O15 - HKU\S-1-5-21-796845957-725345543-839522115-1006\..Trusted Domains: amadeusvista.com ([]http in Trusted sites)

O16 - DPF: {051FE707-9706-11D5-A836-000102A7C938} http://certificates.amadeusvista.com/sgwadmin/common/AutoUpdateATL26P502.CAB (Amadeus Automatic Update)

O16 - DPF: {266BB960-7DA8-11D4-A849-00008321B7D9} http://amadeusvista.com/vwp/common/cabs/VistaPWComms.CAB (Amadeus Cmd Page Cross Communication)

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1264597671156 (WUWebControl Class)

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1264597661062 (MUWebControl Class)

O16 - DPF: {F96020DD-C373-44A0-82B6-064EF0AEEAE3} http://certificates.amadeusvista.com/sgwadmin/RegSiteTools.cab (RegSiteClientTools Class)

O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)

O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)

O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll (Microsoft Corporation)

O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)

O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll (Microsoft Corporation)

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)

O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)

O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)

O20 - Winlogon\Notify\WgaLogon: DllName - WgaLogon.dll - File not found

O24 - Desktop WallPaper: C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Local Settings\Application Data\Microsoft\Wallpaper1.bmp

O24 - Desktop BackupWallPaper: C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Local Settings\Application Data\Microsoft\Wallpaper1.bmp

O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)

O32 - HKLM CDRom: AutoRun - 1

O34 - HKLM BootExecute: (autocheck autochk *) - File not found

O34 - HKLM BootExecute: (smrgdf C:\Program Files\iolo\System Mechanic Professional 6\) - File not found

O35 - comfile [open] -- "%1" %*

O35 - exefile [open] -- "%1" %*

NetSvcs: 6to4 - File not found

NetSvcs: Ias - C:\WINDOWS\system32\ias [2006.07.13 08:57:07 | 00,000,000 | ---D | M]

NetSvcs: Iprip - File not found

NetSvcs: Irmon - C:\WINDOWS\system32\irmon.dll (Microsoft Corporation)

NetSvcs: NWCWorkstation - File not found

NetSvcs: Nwsapagent - File not found

NetSvcs: UxTuneUp - C:\WINDOWS\system32\uxtuneup.dll (TuneUp Software GmbH)

NetSvcs: WmdmPmSp - File not found

MsConfig - StartUpFolder: C:^Documents and Settings^Ninoslav Arbaliyski.ARBALIYS-DQRY21^Start Menu^Programs^Startup^Configure Bulgarian Speech.lnk - C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Application Data\Microsoft\Installer\{319A3CA9-DA63-4D65-8B25-403CF9CBF087}\_5af141bb.exe - ()

MsConfig - StartUpFolder: C:^Documents and Settings^Ninoslav Arbaliyski.ARBALIYS-DQRY21^Start Menu^Programs^Startup^hamachi.lnk - E:\Program Files\Hamachi\hamachi.exe - (LogMeIn Inc.)

MsConfig - StartUpFolder: C:^Documents and Settings^Ninoslav Arbaliyski.ARBALIYS-DQRY21^Start Menu^Programs^Startup^Last.fm Helper.lnk - C:\Program Files\Last.fm\LastFMHelper.exe - (Last.fm)

MsConfig - StartUpReg: DAEMON Tools Lite - hkey= - key= - E:\Program Files\DAEMON Tools Lite\daemon.exe File not found

MsConfig - StartUpReg: msnmsgr - hkey= - key= - C:\Program Files\Windows Live\Messenger\msnmsgr.exe (Microsoft Corporation)

MsConfig - StartUpReg: PC Suite Tray - hkey= - key= - E:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe (Nokia)

MsConfig - State: "system.ini" - 0

MsConfig - State: "win.ini" - 0

MsConfig - State: "bootini" - 0

MsConfig - State: "services" - 0

MsConfig - State: "startup" - 2

SafeBootMin: Base - Driver Group

SafeBootMin: Boot Bus Extender - Driver Group

SafeBootMin: Boot file system - Driver Group

SafeBootMin: File system - Driver Group

SafeBootMin: Filter - Driver Group

SafeBootMin: PCI Configuration - Driver Group

SafeBootMin: PNP Filter - Driver Group

SafeBootMin: Primary disk - Driver Group

SafeBootMin: SCSI Class - Driver Group

SafeBootMin: sermouse.sys - Driver

SafeBootMin: System Bus Extender - Driver Group

SafeBootMin: vds - Service

SafeBootMin: vga.sys - Driver

SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: Base - Driver Group

SafeBootNet: Boot Bus Extender - Driver Group

SafeBootNet: Boot file system - Driver Group

SafeBootNet: File system - Driver Group

SafeBootNet: Filter - Driver Group

SafeBootNet: NDIS Wrapper - Driver Group

SafeBootNet: NetBIOSGroup - Driver Group

SafeBootNet: NetDDEGroup - Driver Group

SafeBootNet: Network - Driver Group

SafeBootNet: NetworkProvider - Driver Group

SafeBootNet: PCI Configuration - Driver Group

SafeBootNet: PNP Filter - Driver Group

SafeBootNet: PNP_TDI - Driver Group

SafeBootNet: Primary disk - Driver Group

SafeBootNet: SCSI Class - Driver Group

SafeBootNet: sermouse.sys - Driver

SafeBootNet: Streams Drivers - Driver Group

SafeBootNet: System Bus Extender - Driver Group

SafeBootNet: TDI - Driver Group

SafeBootNet: vga.sys - Driver

SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Microsoft VM

ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vector Graphics Rendering (VML)

ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4

ActiveX: {233C1507-6A77-46A4-9443-F871F945D258} - Macromedia Shockwave Director 10.1.1

ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation

ActiveX: {2A202491-F00D-11cf-87CC-0020AFEECF20} - Macromedia Shockwave Director 10.1.1

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML Data Binding for Java

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe

ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Advanced Authoring

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install

ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT

ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4b218e3e-bc98-4770-93d3-2731b9329278} - %SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection MarketplaceLinkInstall 896 %systemroot%\inf\ie.inf

ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser

ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework

ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Web Folders

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install

ActiveX: {8056AC9E-49C5-4375-9ADE-B2F862C9DF51} - Security Update for Microsoft .NET Framework 2.0 (KB928365)

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - %SystemRoot%\system32\ie4uinit.exe

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Task Scheduler

ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1

ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP

ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

ActiveX: Microsoft Base Smart Card Crypto Provider Package -

Drivers32: msacm.ac3filter - C:\WINDOWS\System32\ac3filter.acm ()

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)

Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: msacm.siren - C:\WINDOWS\System32\sirenacm.dll (Microsoft Corporation)

Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)

Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)

Drivers32: msacm.vorbis - C:\WINDOWS\System32\vorbis.acm (HMS http://hp.vector.co.jp/authors/VA012897/)

Drivers32: MSVideo - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)

Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)

Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)

Drivers32: vidc.ffds - C:\WINDOWS\System32\ffdshow.ax ()

Drivers32: VIDC.I420 - C:\WINDOWS\System32\lvcodec2.dll (Logitech Inc.)

Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()

Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()

Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)

Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)

Drivers32: VIDC.MJPG - C:\WINDOWS\System32\mtkjpeg.dll ()

========== Files/Folders - Created Within 30 Days ==========

[2010.01.27 21:32:23 | 00,548,864 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\OTL.exe

[2010.01.27 21:28:41 | 00,000,000 | -HSD | C] -- C:\RECYCLER

[2010.01.27 21:11:07 | 00,000,000 | ---D | C] -- C:\WINDOWS\LastGood

[2010.01.27 18:28:26 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\CatRoot_bak

[2010.01.27 17:22:44 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Application Data\Malwarebytes

[2010.01.27 15:44:39 | 00,000,000 | ---D | C] -- C:\WINDOWS\temp

[2010.01.27 15:22:29 | 00,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe

[2010.01.27 15:22:29 | 00,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe

[2010.01.27 15:22:29 | 00,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe

[2010.01.27 15:22:29 | 00,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe

[2010.01.27 15:21:58 | 00,000,000 | ---D | C] -- C:\WINDOWS\ERDNT

[2010.01.27 15:14:47 | 00,000,000 | ---D | C] -- C:\Config.Msi

[2010.01.27 15:10:54 | 00,000,000 | ---D | C] -- C:\Qoobox

[2010.01.27 14:05:23 | 00,000,000 | ---D | C] -- C:\Program Files\Trend Micro

[2010.01.27 14:00:02 | 00,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys

[2010.01.27 14:00:00 | 00,019,160 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys

[2010.01.27 14:00:00 | 00,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware

[2010.01.27 14:00:00 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes

[2010.01.27 13:40:21 | 00,000,000 | ---D | C] -- C:\KAV

[2010.01.27 12:15:29 | 00,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft

[2010.01.27 12:05:16 | 00,000,000 | -H-D | C] -- C:\Documents and Settings\All Users\Application Data\{BC9FCCF7-E686-494B-8C9B-55C9A39A7CA9}

[2010.01.27 12:05:06 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Lavasoft

[2010.01.27 11:46:24 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Application Data\AVG8

[2010.01.27 11:44:39 | 00,891,248 | ---- | C] (AVG Technologies) -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\avg_free_stb_all_9_40_cnet.exe

[2010.01.27 10:41:46 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ESET

[2010.01.26 22:26:07 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Local Settings\Application Data\ESET

[2010.01.26 22:25:04 | 00,000,000 | ---D | C] -- C:\Program Files\ESET

[2010.01.26 22:25:04 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\ESET

[2010.01.26 22:10:38 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\Kaspersky 2010 9.0.0.736 Final

[2010.01.26 22:09:29 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\ESET NOD32 Antivirus 4.0.435 Bulgarian

[2010.01.23 23:46:45 | 00,000,000 | ---D | C] -- C:\Program Files\ATI Technologies

[2010.01.23 22:21:21 | 00,000,000 | -H-D | C] -- C:\Program Files\InstallShield Installation Information

[2010.01.23 22:21:01 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Local Settings\Application Data\Downloaded Installations

[2010.01.23 22:13:39 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\UAB

[2010.01.23 22:13:38 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\PC Drivers HeadQuarters

[2010.01.23 22:13:36 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Local Settings\Application Data\PC_Drivers_Headquarters

[2010.01.23 22:12:19 | 00,000,000 | ---D | C] -- C:\Program Files\PC Drivers HeadQuarters

[2010.01.23 21:56:36 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Application Data\Canneverbe_Limited

[2010.01.23 21:56:35 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Canneverbe Limited

[2010.01.23 21:56:18 | 00,000,000 | ---D | C] -- C:\Program Files\CDBurnerXP

[2010.01.23 21:20:35 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Application Data\Ahead

[2010.01.23 21:19:17 | 00,000,000 | ---D | C] -- C:\Program Files\Nero

[2010.01.17 18:38:56 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\DISC

[2010.01.05 23:30:53 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\H10 (5 6GB) UMS Firmware Backup

[2010.01.05 22:12:06 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Application Data\rockbox.org

[2010.01.03 22:54:41 | 00,000,000 | -H-D | C] -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\NG

[2007.11.06 18:20:03 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft

[2007.10.08 14:12:02 | 00,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Apple

[2007.08.30 13:52:40 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\Skype

[2007.08.30 13:40:25 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\Macromedia

[2007.07.03 18:53:17 | 00,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Application Data\Microsoft

[2007.07.03 17:37:23 | 00,061,440 | ---- | C] ( ) -- C:\WINDOWS\System32\rsnpstd.dll

[2007.07.03 17:37:23 | 00,061,440 | ---- | C] ( ) -- C:\WINDOWS\System32\csnpstd.dll

[2007.07.03 17:37:23 | 00,036,864 | ---- | C] ( ) -- C:\WINDOWS\System32\vsnpstd.dll

[2007.02.05 19:22:45 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\iolo

[2006.07.13 09:01:08 | 00,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Application Data\Microsoft

[2004.11.24 21:25:52 | 00,335,872 | ---- | C] ( ) -- C:\WINDOWS\System32\drvc.dll

========== Files - Modified Within 30 Days ==========

[2010.01.27 21:32:35 | 00,548,864 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\OTL.exe

[2010.01.27 21:29:41 | 00,077,312 | ---- | M] () -- C:\mbr.exe

[2010.01.27 21:28:28 | 14,417,920 | ---- | M] () -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\ntuser.dat

[2010.01.27 21:07:38 | 00,284,915 | ---- | M] () -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\gmer.zip

[2010.01.27 21:00:47 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT

[2010.01.27 21:00:44 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2010.01.27 20:59:41 | 00,000,178 | -HS- | M] () -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\ntuser.ini

[2010.01.27 15:40:01 | 00,000,253 | ---- | M] () -- C:\WINDOWS\system.ini

[2010.01.27 15:39:39 | 00,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts

[2010.01.27 15:10:33 | 03,838,105 | R--- | M] () -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\caramba.exe

[2010.01.27 14:05:23 | 00,001,741 | ---- | M] () -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\HijackThis.lnk

[2010.01.27 14:00:05 | 00,000,703 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk

[2010.01.27 11:57:44 | 00,001,014 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\h8srtkrl32mainweq.dll

[2010.01.27 11:51:40 | 00,002,577 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT

[2010.01.27 11:44:43 | 00,891,248 | ---- | M] (AVG Technologies) -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\avg_free_stb_all_9_40_cnet.exe

[2010.01.26 23:47:23 | 00,017,920 | ---- | M] () -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2010.01.26 23:42:37 | 00,000,116 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini

[2010.01.26 21:30:00 | 00,049,513 | ---- | M] () -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\Zamunda_NET Details for torrent Kaspersky Anti-Virus - Kaspersky Internet Security 2010 9_0_0_736 Final.htm

[2010.01.26 20:18:25 | 00,000,442 | ---- | M] () -- C:\WINDOWS\System32\mapisvc.inf

[2010.01.26 20:17:50 | 00,245,760 | ---- | M] () -- C:\WINDOWS\System32\imon.dll

[2010.01.26 20:17:50 | 00,114,688 | ---- | M] () -- C:\WINDOWS\System32\nms32.dll

[2010.01.24 19:07:28 | 00,000,022 | ---- | M] () -- C:\WINDOWS\System32\ati64hlp.stb

[2010.01.24 18:56:21 | 00,000,147 | ---- | M] () -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\default.pls

[2010.01.24 18:52:42 | 00,000,022 | ---- | M] () -- C:\WINDOWS\System32\ati64hl2.stb

[2010.01.24 18:36:46 | 00,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl

[2010.01.24 00:09:50 | 02,113,042 | -H-- | M] () -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Local Settings\Application Data\IconCache.db

[2010.01.23 22:36:13 | 00,002,394 | ---- | M] () -- C:\WINDOWS\Ascd_tmp.ini

[2010.01.23 21:58:11 | 00,001,611 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\CDBurnerXP.lnk

[2010.01.23 21:21:12 | 00,002,368 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Nero StartSmart.lnk

[2010.01.23 20:37:04 | 00,594,322 | ---- | M] () -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\Компакт-дискови устройства- видове технологии.ppsx

[2010.01.23 20:32:32 | 00,594,154 | ---- | M] () -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\Компакт-дискови устройства- видове технологии.pptx

[2010.01.20 18:38:20 | 00,001,635 | ---- | M] () -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\Nokia PC Suite.lnk

[2010.01.19 21:09:52 | 00,156,241 | ---- | M] () -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\My Documents\19012010(001).jpg

[2010.01.19 21:07:04 | 00,190,609 | ---- | M] () -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\My Documents\19012010.jpg

[2010.01.19 21:05:50 | 00,196,538 | ---- | M] () -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\My Documents\12012010.jpg

[2010.01.17 22:39:06 | 00,000,008 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\sysReserve.ini

[2010.01.16 16:45:23 | 00,000,372 | ---- | M] () -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\My Documents\spider.sav

[2010.01.13 22:10:23 | 00,019,535 | ---- | M] () -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\My Documents\По жицата.docx

[2010.01.13 16:11:35 | 00,001,125 | ---- | M] () -- C:\WINDOWS\win.ini

[2010.01.13 16:11:35 | 00,000,389 | RHS- | M] () -- C:\boot.ini

[2010.01.07 16:07:14 | 00,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys

[2010.01.07 16:07:04 | 00,019,160 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys

[2010.01.06 21:33:22 | 00,563,388 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI

[2010.01.06 21:33:22 | 00,476,200 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat

[2010.01.06 21:33:22 | 00,078,160 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat

[2010.01.06 19:02:16 | 00,000,038 | ---- | M] () -- C:\WINDOWS\AviSplitter.INI

========== Files Created - No Company Name ==========

[2010.01.27 21:29:40 | 00,077,312 | ---- | C] () -- C:\mbr.exe

[2010.01.27 21:08:30 | 00,293,376 | ---- | C] () -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\gmer.exe

[2010.01.27 21:07:34 | 00,284,915 | ---- | C] () -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\gmer.zip

[2010.01.27 15:22:29 | 00,261,632 | ---- | C] () -- C:\WINDOWS\PEV.exe

[2010.01.27 15:22:29 | 00,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe

[2010.01.27 15:22:29 | 00,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe

[2010.01.27 15:22:29 | 00,077,312 | ---- | C] () -- C:\WINDOWS\MBR.exe

[2010.01.27 15:22:29 | 00,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe

[2010.01.27 15:10:33 | 03,838,105 | R--- | C] () -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\caramba.exe

[2010.01.27 14:05:23 | 00,001,741 | ---- | C] () -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\HijackThis.lnk

[2010.01.27 14:00:05 | 00,000,703 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk

[2010.01.26 22:09:38 | 00,049,513 | ---- | C] () -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\Zamunda_NET Details for torrent Kaspersky Anti-Virus - Kaspersky Internet Security 2010 9_0_0_736 Final.htm

[2010.01.26 20:18:21 | 00,245,760 | ---- | C] () -- C:\WINDOWS\System32\imon.dll

[2010.01.26 20:18:21 | 00,114,688 | ---- | C] () -- C:\WINDOWS\System32\nms32.dll

[2010.01.24 19:07:28 | 00,000,022 | ---- | C] () -- C:\WINDOWS\System32\ati64hlp.stb

[2010.01.24 18:56:21 | 00,000,147 | ---- | C] () -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\default.pls

[2010.01.24 18:52:42 | 00,000,022 | ---- | C] () -- C:\WINDOWS\System32\ati64hl2.stb

[2010.01.23 23:47:25 | 00,516,096 | ---- | C] () -- C:\WINDOWS\System32\ati2sgag.exe

[2010.01.23 23:47:17 | 00,009,490 | R--- | C] () -- C:\WINDOWS\System32\atifglpf.xml

[2010.01.23 23:47:16 | 00,079,320 | R--- | C] () -- C:\WINDOWS\System32\atiicdxx.dat

[2010.01.23 21:56:22 | 00,001,611 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\CDBurnerXP.lnk

[2010.01.23 21:21:12 | 00,002,368 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Nero StartSmart.lnk

[2010.01.23 20:33:11 | 00,594,322 | ---- | C] () -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\Компакт-дискови устройства- видове технологии.ppsx

[2010.01.23 20:32:31 | 00,594,154 | ---- | C] () -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\Компакт-дискови устройства- видове технологии.pptx

[2010.01.23 12:35:07 | 00,001,014 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\h8srtkrl32mainweq.dll

[2010.01.20 18:38:20 | 00,001,635 | ---- | C] () -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\Nokia PC Suite.lnk

[2010.01.19 21:58:47 | 00,636,224 | ---- | C] () -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\21112009294.jpg

[2010.01.19 21:09:51 | 00,156,241 | ---- | C] () -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\My Documents\19012010(001).jpg

[2010.01.19 21:07:03 | 00,190,609 | ---- | C] () -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\My Documents\19012010.jpg

[2010.01.19 21:05:49 | 00,196,538 | ---- | C] () -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\My Documents\12012010.jpg

[2010.01.19 21:02:24 | 00,810,056 | ---- | C] () -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\14122009033.jpg

[2010.01.13 22:10:22 | 00,019,535 | ---- | C] () -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\My Documents\По жицата.docx

[2010.01.12 23:04:50 | 00,000,442 | ---- | C] () -- C:\WINDOWS\System32\mapisvc.inf

[2010.01.12 22:36:23 | 00,000,008 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\sysReserve.ini

[2008.11.25 21:47:31 | 00,000,510 | ---- | C] () -- C:\WINDOWS\wincmd.ini

[2008.11.23 19:51:42 | 00,000,160 | ---- | C] () -- C:\WINDOWS\mafosav.INI

[2008.11.09 20:31:11 | 00,000,103 | ---- | C] () -- C:\WINDOWS\pro.INI

[2008.10.11 14:27:39 | 00,000,037 | ---- | C] () -- C:\WINDOWS\iltwain.ini

[2008.10.01 19:22:38 | 00,000,565 | ---- | C] () -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Application Data\alarms.ini

[2008.10.01 19:22:37 | 00,000,716 | ---- | C] () -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Application Data\AtomicAlarmClock.ini

[2008.09.28 11:11:53 | 00,009,255 | ---- | C] () -- C:\WINDOWS\System32\lvcoinst.ini

[2008.09.28 11:10:51 | 00,000,288 | ---- | C] () -- C:\WINDOWS\_delis32.ini

[2008.06.18 14:49:13 | 00,000,038 | ---- | C] () -- C:\WINDOWS\AviSplitter.INI

[2008.01.20 18:51:47 | 00,131,072 | R--- | C] () -- C:\WINDOWS\System32\mtkjpeg.dll

[2007.11.23 22:42:14 | 00,000,032 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\ezsid.dat

[2007.11.04 22:25:34 | 00,007,168 | ---- | C] () -- C:\WINDOWS\System32\drivers\StarOpen.sys

[2007.11.02 16:27:40 | 00,008,802 | ---- | C] () -- C:\WINDOWS\AmvTransform.ini

[2007.11.02 16:27:40 | 00,007,763 | ---- | C] () -- C:\WINDOWS\AmvPlayer.ini

[2007.10.20 11:23:50 | 00,034,308 | ---- | C] () -- C:\WINDOWS\System32\BASSMOD.dll

[2007.10.06 16:51:46 | 00,001,763 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache

[2007.08.27 18:36:47 | 00,000,036 | ---- | C] () -- C:\WINDOWS\Tiny_Run.ini

[2007.07.30 08:38:12 | 00,001,786 | ---- | C] () -- C:\WINDOWS\1aAutoUpdate.ini

[2007.07.25 13:26:02 | 00,207,966 | ---- | C] () -- C:\WINDOWS\xobglu32.dll

[2007.07.25 13:26:02 | 00,063,488 | ---- | C] () -- C:\WINDOWS\xobglu16.dll

[2007.07.20 11:38:16 | 00,057,344 | ---- | C] () -- C:\WINDOWS\System32\HKLock.dll

[2007.07.20 11:38:16 | 00,057,344 | ---- | C] () -- C:\WINDOWS\HKLock.dll

[2007.07.03 17:37:29 | 00,053,248 | ---- | C] () -- C:\WINDOWS\System32\dsnpstd.dll

[2007.07.03 17:37:29 | 00,015,541 | ---- | C] () -- C:\WINDOWS\snpstd.ini

[2007.07.03 17:37:26 | 00,345,728 | ---- | C] () -- C:\WINDOWS\System32\drivers\snpstd.sys

[2007.07.02 15:01:06 | 00,017,920 | ---- | C] () -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2007.07.01 13:12:14 | 03,145,728 | ---- | C] () -- C:\WINDOWS\System32\libavcodec.dll

[2007.07.01 12:59:22 | 00,517,632 | ---- | C] () -- C:\WINDOWS\System32\ff_x264.dll

[2007.06.17 13:43:56 | 00,405,504 | ---- | C] () -- C:\WINDOWS\System32\libmplayer.dll

[2007.06.12 13:21:26 | 00,208,896 | ---- | C] () -- C:\WINDOWS\System32\ff_theora.dll

[2007.02.05 19:22:45 | 00,696,320 | ---- | C] () -- C:\WINDOWS\System32\libeay32.dll

[2007.02.05 19:22:45 | 00,155,648 | ---- | C] () -- C:\WINDOWS\System32\ssleay32.dll

[2007.02.05 19:22:39 | 01,212,416 | ---- | C] () -- C:\WINDOWS\System32\Incinerator.dll

[2007.01.09 19:05:50 | 00,026,112 | ---- | C] () -- C:\WINDOWS\System32\ff_wmv9.dll

[2006.10.24 20:09:58 | 00,000,395 | ---- | C] () -- C:\WINDOWS\MCT.INI

[2006.10.10 18:02:58 | 00,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI

[2006.09.13 17:39:35 | 00,000,171 | ---- | C] () -- C:\WINDOWS\icecast2.ini

[2006.09.11 11:47:05 | 00,000,087 | ---- | C] () -- C:\WINDOWS\EntPack.ini

[2006.09.11 10:49:38 | 00,000,054 | ---- | C] () -- C:\WINDOWS\wslam.ini

[2006.08.03 15:21:19 | 00,000,373 | ---- | C] () -- C:\WINDOWS\SYMGAMES.INI

[2006.07.25 21:13:16 | 00,000,032 | ---- | C] () -- C:\WINDOWS\tdlp32.ini

[2006.07.21 14:08:15 | 00,040,960 | ---- | C] () -- C:\WINDOWS\System32\dsplib.dll

[2006.07.13 20:27:14 | 00,000,019 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\DragToDiscUserNameF.txt

[2006.07.13 19:51:16 | 00,001,452 | ---- | C] () -- C:\WINDOWS\X3D.INI

[2006.07.13 19:49:06 | 00,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini

[2006.07.13 17:35:19 | 00,007,680 | ---- | C] () -- C:\WINDOWS\System32\CNMVS5y.DLL

[2006.07.13 13:54:36 | 00,018,053 | ---- | C] () -- C:\WINDOWS\irunin.ini

[2006.07.13 10:59:45 | 00,000,636 | ---- | C] () -- C:\WINDOWS\ODBC.INI

[2006.07.13 10:12:51 | 00,000,092 | ---- | C] () -- C:\WINDOWS\CMISETUP.INI

[2006.07.13 10:12:51 | 00,000,026 | ---- | C] () -- C:\WINDOWS\CMCDPLAY.INI

[2006.07.13 10:12:50 | 00,000,092 | ---- | C] () -- C:\WINDOWS\wininit.ini

[2006.07.13 10:12:49 | 00,028,672 | ---- | C] () -- C:\WINDOWS\System32\cmirmdrv.dll

[2006.07.13 10:12:46 | 00,028,672 | ---- | C] () -- C:\WINDOWS\CMIRmDriver.dll

[2006.07.13 10:11:52 | 00,032,768 | ---- | C] () -- C:\WINDOWS\SIS_LIB.DLL

[2006.07.13 10:11:23 | 00,002,394 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini

[2006.07.13 10:11:22 | 00,005,824 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS

[2006.07.13 09:42:25 | 00,081,920 | ---- | C] () -- C:\WINDOWS\System32\ieencode.dll

[2006.05.03 00:38:24 | 00,000,748 | ---- | C] () -- C:\WINDOWS\SetBrowser.ini

[2006.03.19 14:34:58 | 00,167,936 | ---- | C] () -- C:\WINDOWS\System32\SerialCE.dll

[2006.03.19 14:34:42 | 00,167,936 | ---- | C] () -- C:\WINDOWS\System32\SerialXP.dll

[2005.10.15 11:58:04 | 00,007,680 | ---- | C] () -- C:\WINDOWS\System32\kbdBF.dll

[2004.10.03 19:50:54 | 00,129,024 | ---- | C] () -- C:\WINDOWS\System32\ff_mpeg2enc.dll

[2004.09.16 13:26:40 | 00,012,634 | ---- | C] () -- C:\WINDOWS\System32\drivers\ADFUUD.SYS

[2004.09.16 13:26:40 | 00,012,634 | ---- | C] () -- C:\WINDOWS\ADFUUD.SYS

[2002.05.04 12:04:45 | 00,094,636 | ---- | C] () -- C:\WINDOWS\dropcpyr.dll

[2002.03.19 17:30:00 | 00,010,752 | ---- | C] () -- C:\WINDOWS\System32\mag.dll

[1998.06.09 23:00:00 | 00,015,120 | ---- | C] () -- C:\WINDOWS\System32\REPUTIL.DLL

[1996.04.03 21:33:26 | 00,005,248 | ---- | C] () -- C:\WINDOWS\System32\giveio.sys

========== LOP Check ==========

[2008.01.12 12:06:16 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Amadeus

[2007.11.06 17:44:31 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVG7

[2007.09.21 13:41:07 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Bluetooth

[2010.01.23 21:56:35 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Canneverbe Limited

[2010.01.26 22:25:04 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ESET

[2007.08.27 18:38:54 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Global Software Publishing

[2009.10.03 17:01:14 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Installations

[2007.09.03 20:31:09 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Kaspersky Anti-Virus Personal

[2008.01.14 20:45:44 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Last.fm

[2009.10.03 17:02:32 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Nokia

[2010.01.23 22:13:38 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PC Drivers HeadQuarters

[2009.10.02 22:46:53 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PC Suite

[2007.10.10 22:12:39 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TuneUp Software

[2010.01.23 22:13:39 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\UAB

[2009.04.02 21:58:20 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{7DF8F2B2-6EEE-454A-961D-3EAFDB177EDA}

[2010.01.27 13:07:19 | 00,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\{BC9FCCF7-E686-494B-8C9B-55C9A39A7CA9}

[2010.01.24 18:09:52 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Amadeus\Application Data\Amadeus

[2009.12.09 22:15:32 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Amadeus\Application Data\PC Suite

[2007.02.05 19:22:45 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\iolo

[2008.11.30 20:08:44 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Application Data\Active Whois

[2009.07.01 11:53:10 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Application Data\Amadeus

[2008.05.08 18:05:05 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Application Data\BSplayer Pro

[2010.01.23 21:56:36 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Application Data\Canneverbe_Limited

[2007.11.05 18:29:14 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Application Data\ConvertTemp

[2008.04.13 14:54:06 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Application Data\COWON

[2009.06.02 19:06:58 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Application Data\DAEMON Tools

[2007.08.24 13:51:29 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Application Data\GlarySoft

[2008.10.03 14:03:52 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Application Data\ICQ

[2007.08.27 14:01:07 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Application Data\ICQLite

[2007.09.05 21:32:01 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Application Data\MobileAction

[2009.10.06 20:17:41 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Application Data\Nokia

[2009.10.02 22:47:06 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Application Data\PC Suite

[2010.01.05 22:12:06 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Application Data\rockbox.org

[2009.09.17 19:23:28 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Application Data\Samsung

[2009.08.10 21:22:05 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Application Data\TeamViewer

[2009.11.17 23:06:59 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Application Data\Temporary

[2008.10.06 21:32:47 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Application Data\TransRender

[2007.06.27 16:55:12 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Application Data\TuneUp Software

[2007.07.04 13:29:54 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Application Data\Uniblue

[2009.01.06 15:24:55 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Application Data\uTorrent

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >

[2010.01.13 16:11:35 | 00,000,389 | RHS- | M] () -- C:\boot.ini

[2010.01.27 15:44:37 | 00,019,962 | ---- | M] () -- C:\ComboFix.txt

[2007.10.01 12:14:03 | 01,640,402 | ---- | M] () -- C:\ikonlist.ils

[2006.07.13 08:57:31 | 00,000,000 | RHS- | M] () -- C:\IO.SYS

[2010.01.27 21:29:41 | 00,077,312 | ---- | M] () -- C:\mbr.exe

[2006.07.13 08:57:31 | 00,000,000 | RHS- | M] () -- C:\MSDOS.SYS

[2006.10.25 22:58:44 | 00,000,182 | ---- | M] () -- C:\npclntax.xpt

[2006.07.13 09:38:01 | 00,047,564 | RHS- | M] () -- C:\NTDETECT.COM

[2006.07.13 09:38:01 | 00,250,032 | RHS- | M] () -- C:\ntldr

[2010.01.27 21:00:40 | 80,530,6368 | -HS- | M] () -- C:\pagefile.sys

[2008.04.26 13:33:48 | 00,003,012 | ---- | M] () -- C:\ra_master.log

[2008.10.11 14:27:39 | 01,244,393 | ---- | M] () -- C:\REGSVR32.EXE

[2009.12.19 17:34:24 | 00,000,268 | -H-- | M] () -- C:\sqmdata00.sqm

[2009.12.19 17:34:24 | 00,000,244 | -H-- | M] () -- C:\sqmnoopt00.sqm

[2010.01.13 16:13:08 | 00,000,182 | ---- | M] () -- C:\Startup.txt

[2008.11.25 21:49:05 | 00,347,062 | -H-- | M] () -- C:\treeinfo.wc

< MD5 for: AGP440.SYS >

[2004.08.04 00:05:44 | 18,738,937 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys

[2004.08.04 00:05:44 | 18,738,937 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp2.cab:AGP440.sys

[2004.08.03 22:07:42 | 00,042,368 | ---- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB -- C:\WINDOWS\ERDNT\cache\agp440.sys

[2004.08.03 22:07:42 | 00,042,368 | ---- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys

[2004.08.03 22:07:42 | 00,042,368 | ---- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB -- C:\WINDOWS\system32\drivers\agp440.sys

< MD5 for: ATAPI.SYS >

[2004.08.04 00:05:44 | 18,738,937 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys

[2004.08.04 00:05:44 | 18,738,937 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp2.cab:atapi.sys

[2001.08.23 14:00:00 | 00,086,656 | ---- | M] (Microsoft Corporation) MD5=A64013E98426E1877CB653685C5C0009 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys

[2004.08.03 21:59:44 | 00,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\ERDNT\cache\atapi.sys

[2004.08.03 21:59:44 | 00,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys

[2004.08.03 21:59:44 | 00,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\dllcache\atapi.sys

[2004.08.03 21:59:44 | 00,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\drivers\atapi.sys

< MD5 for: D3D8THK.DLL >

[2004.08.03 23:56:42 | 00,008,192 | ---- | M] (Microsoft Corporation) MD5=8D9210E9858D525646251DFA1FE37EBE -- C:\WINDOWS\ServicePackFiles\i386\d3d8thk.dll

[2004.08.03 23:56:42 | 00,008,192 | ---- | M] (Microsoft Corporation) MD5=8D9210E9858D525646251DFA1FE37EBE -- C:\WINDOWS\system32\d3d8thk.dll

[2001.08.23 14:00:00 | 00,008,192 | ---- | M] (Microsoft Corporation) MD5=E2FDC90E13ED451A1CF0C8B262FEF745 -- C:\WINDOWS\$NtServicePackUninstall$\d3d8thk.dll

< MD5 for: EVENTLOG.DLL >

[2004.08.03 23:56:44 | 00,055,808 | ---- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 -- C:\WINDOWS\ERDNT\cache\eventlog.dll

[2004.08.03 23:56:44 | 00,055,808 | ---- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll

[2004.08.03 23:56:44 | 00,055,808 | ---- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 -- C:\WINDOWS\system32\eventlog.dll

[2001.08.23 14:00:00 | 00,047,616 | ---- | M] (Microsoft Corporation) MD5=A510B91253544D56B5712D66BE8371E9 -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll

< MD5 for: NETLOGON.DLL >

[2009.02.06 20:46:09 | 00,408,064 | ---- | M] (Microsoft Corporation) MD5=6C476D33D82F1054849790181E8F7772 -- C:\WINDOWS\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\sp2qfe\netlogon.dll

[2009.02.06 20:46:09 | 00,408,064 | ---- | M] (Microsoft Corporation) MD5=6C476D33D82F1054849790181E8F7772 -- C:\WINDOWS\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\sp2qfe\netlogon.dll

[2004.08.03 23:56:46 | 00,407,040 | ---- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A -- C:\WINDOWS\ERDNT\cache\netlogon.dll

[2004.08.03 23:56:46 | 00,407,040 | ---- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll

[2004.08.03 23:56:46 | 00,407,040 | ---- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A -- C:\WINDOWS\system32\netlogon.dll

[2001.08.23 14:00:00 | 00,397,824 | ---- | M] (Microsoft Corporation) MD5=F41C1602DC79AB72035F2388FCA0255F -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll

< MD5 for: SCECLI.DLL >

[2004.08.03 23:56:46 | 00,180,224 | ---- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A -- C:\WINDOWS\ERDNT\cache\scecli.dll

[2004.08.03 23:56:46 | 00,180,224 | ---- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll

[2004.08.03 23:56:46 | 00,180,224 | ---- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A -- C:\WINDOWS\system32\scecli.dll

[2001.08.23 14:00:00 | 00,174,080 | ---- | M] (Microsoft Corporation) MD5=73968C834C316ADC7A2F07DC4B5F3665 -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >

[2007.10.11 07:57:30 | 00,357,888 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\dxtmsft.dll

[2007.10.11 07:57:30 | 00,205,824 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\dxtrans.dll

< %systemroot%\Tasks\*.job /lockedfiles >

< %PROGRAMFILES%\*. >

[2006.07.13 12:42:06 | 00,000,000 | ---D | M] -- C:\Program Files\Adobe

[2008.01.12 12:14:23 | 00,000,000 | ---D | M] -- C:\Program Files\Amadeus

[2010.01.23 23:47:46 | 00,000,000 | ---D | M] -- C:\Program Files\ATI Technologies

[2010.01.06 15:27:26 | 00,000,000 | ---D | M] -- C:\Program Files\Automatic Update

[2006.07.13 10:25:49 | 00,000,000 | ---D | M] -- C:\Program Files\AutoPatcher

[2008.02.28 14:20:01 | 00,000,000 | ---D | M] -- C:\Program Files\AVI ReComp

[2007.03.14 15:03:20 | 00,000,000 | ---D | M] -- C:\Program Files\AVIConverter

[2008.01.11 17:21:29 | 00,000,000 | ---D | M] -- C:\Program Files\AviSynth 2.5

[2009.05.30 14:18:35 | 00,000,000 | ---D | M] -- C:\Program Files\Axis Communications

[2007.03.31 15:19:53 | 00,000,000 | ---D | M] -- C:\Program Files\BSplayerPro

[2006.07.13 10:12:46 | 00,000,000 | ---D | M] -- C:\Program Files\C-Media 3D Audio

[2007.04.11 16:11:46 | 00,000,000 | ---D | M] -- C:\Program Files\Canon

[2010.01.23 22:42:39 | 00,000,000 | ---D | M] -- C:\Program Files\CDBurnerXP

[2010.01.27 15:34:09 | 00,000,000 | ---D | M] -- C:\Program Files\Common Files

[2009.10.02 22:07:15 | 00,000,000 | ---D | M] -- C:\Program Files\DIFX

[2010.01.26 22:25:04 | 00,000,000 | ---D | M] -- C:\Program Files\ESET

[2010.01.27 12:57:08 | 00,000,000 | ---D | M] -- C:\Program Files\HTV

[2008.01.06 16:48:15 | 00,000,000 | ---D | M] -- C:\Program Files\IconChanger

[2008.09.28 20:21:06 | 00,000,000 | ---D | M] -- C:\Program Files\ICQLite

[2010.01.23 23:47:45 | 00,000,000 | -H-D | M] -- C:\Program Files\InstallShield Installation Information

[2007.12.12 22:11:11 | 00,000,000 | ---D | M] -- C:\Program Files\Internet Explorer

[2007.09.21 13:26:44 | 00,000,000 | ---D | M] -- C:\Program Files\IVT Corporation

[2006.07.13 10:34:50 | 00,000,000 | ---D | M] -- C:\Program Files\Java

[2008.02.28 14:19:57 | 00,000,000 | ---D | M] -- C:\Program Files\Last.fm

[2010.01.27 14:00:05 | 00,000,000 | ---D | M] -- C:\Program Files\Malwarebytes' Anti-Malware

[2007.12.04 08:57:12 | 00,000,000 | ---D | M] -- C:\Program Files\Microsoft CAPICOM 2.1.0.2

[2006.07.13 08:57:50 | 00,000,000 | ---D | M] -- C:\Program Files\microsoft frontpage

[2006.11.17 22:33:58 | 00,000,000 | ---D | M] -- C:\Program Files\Microsoft Office

[2006.07.13 10:58:29 | 00,000,000 | ---D | M] -- C:\Program Files\Microsoft Visual Studio

[2006.11.17 22:34:21 | 00,000,000 | ---D | M] -- C:\Program Files\Microsoft Works

[2008.02.28 14:19:57 | 00,000,000 | ---D | M] -- C:\Program Files\Movie Maker

[2006.11.17 22:34:09 | 00,000,000 | ---D | M] -- C:\Program Files\MSBuild

[2006.07.13 08:54:16 | 00,000,000 | ---D | M] -- C:\Program Files\MSN Gaming Zone

[2009.06.12 21:02:31 | 00,000,000 | ---D | M] -- C:\Program Files\MSSOAP

[2009.10.03 17:01:44 | 00,000,000 | ---D | M] -- C:\Program Files\MSXML 6.0

[2010.01.23 21:19:17 | 00,000,000 | ---D | M] -- C:\Program Files\Nero

[2006.07.13 09:40:02 | 00,000,000 | ---D | M] -- C:\Program Files\NetMeeting

[2009.10.03 17:01:55 | 00,000,000 | ---D | M] -- C:\Program Files\Nokia

[2009.10.03 17:52:11 | 00,000,000 | ---D | M] -- C:\Program Files\NSS

[2006.12.29 18:09:59 | 00,000,000 | ---D | M] -- C:\Program Files\Online Services

[2007.07.03 21:04:10 | 00,000,000 | ---D | M] -- C:\Program Files\Outlook Express

[2009.10.02 22:07:05 | 00,000,000 | ---D | M] -- C:\Program Files\PC Connectivity Solution

[2010.01.23 22:12:19 | 00,000,000 | ---D | M] -- C:\Program Files\PC Drivers HeadQuarters

[2006.07.13 12:55:36 | 00,000,000 | ---D | M] -- C:\Program Files\SA Dictionary 2004 Datacenter

[2008.09.25 20:54:03 | 00,000,000 | ---D | M] -- C:\Program Files\Samsung

[2009.02.22 19:27:23 | 00,000,000 | ---D | M] -- C:\Program Files\ScreenMates

[2008.09.20 19:35:02 | 00,000,000 | ---D | M] -- C:\Program Files\SIM editor

[2006.07.13 10:12:09 | 00,000,000 | ---D | M] -- C:\Program Files\SiSLan

[2007.12.03 19:52:31 | 00,000,000 | ---D | M] -- C:\Program Files\Skype

[2008.04.12 18:09:39 | 00,000,000 | ---D | M] -- C:\Program Files\Talisman

[2008.04.12 18:07:34 | 00,000,000 | ---D | M] -- C:\Program Files\Talisman 2

[2009.01.05 17:49:27 | 00,000,000 | ---D | M] -- C:\Program Files\Total Video Converter

[2010.01.27 14:05:23 | 00,000,000 | ---D | M] -- C:\Program Files\Trend Micro

[2007.02.08 17:30:01 | 00,000,000 | ---D | M] -- C:\Program Files\TuneUp Utilities 2007

[2007.09.19 16:21:23 | 00,000,000 | -H-D | M] -- C:\Program Files\Uninstall Information

[2008.10.11 14:34:45 | 00,000,000 | ---D | M] -- C:\Program Files\Web Publish

[2009.08.21 18:33:54 | 00,000,000 | ---D | M] -- C:\Program Files\Winamp

[2007.12.03 20:32:30 | 00,000,000 | ---D | M] -- C:\Program Files\Windows Live

[2008.03.07 14:40:25 | 00,000,000 | ---D | M] -- C:\Program Files\Windows Media Connect 2

[2008.02.28 14:19:57 | 00,000,000 | ---D | M] -- C:\Program Files\Windows Media Player

[2006.07.13 09:39:58 | 00,000,000 | ---D | M] -- C:\Program Files\Windows NT

[2008.02.28 14:19:57 | 00,000,000 | ---D | M] -- C:\Program Files\WinRAR

[2006.07.13 08:57:50 | 00,000,000 | ---D | M] -- C:\Program Files\xerox

[2008.05.08 19:09:31 | 00,000,000 | ---D | M] -- C:\Program Files\XP Codec Pack

< %userprofile%\Desktop\*.* >

[2009.12.14 10:43:44 | 00,810,056 | ---- | M] () -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\14122009033.jpg

[2009.11.21 00:04:02 | 00,636,224 | ---- | M] () -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\21112009294.jpg

[2008.11.13 19:47:24 | 00,000,766 | ---- | M] () -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\AMADEUS.url

[2010.01.27 11:44:43 | 00,891,248 | ---- | M] (AVG Technologies) -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\avg_free_stb_all_9_40_cnet.exe

[2009.12.03 21:23:31 | 00,000,720 | ---- | M] () -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\bal.txt

[2009.04.26 21:27:14 | 00,000,350 | ---- | M] () -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\BEBE MAGI.lnk

[2008.06.12 19:42:18 | 00,000,536 | ---- | M] () -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\BitComet.lnk

[2010.01.27 15:10:33 | 03,838,105 | R--- | M] () -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\caramba.exe

[2008.12.16 21:24:30 | 00,000,342 | ---- | M] () -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\DESKTOP.lnk

[2009.12.15 11:24:48 | 00,293,376 | ---- | M] () -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\gmer.exe

[2010.01.27 21:07:38 | 00,284,915 | ---- | M] () -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\gmer.zip

[2007.12.17 13:03:20 | 02,315,048 | ---- | M] (HackAttack) -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\HackAttack.exe

[2010.01.27 14:05:23 | 00,001,741 | ---- | M] () -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\HijackThis.lnk

[2010.01.27 14:35:20 | 00,008,719 | ---- | M] () -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\hijackthis.log

[2008.07.30 22:18:02 | 00,000,839 | ---- | M] () -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\inbox.lnk

[2007.10.01 13:11:58 | 00,000,846 | ---- | M] () -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\Internet Explorer.lnk

[2010.01.27 20:58:17 | 00,005,959 | ---- | M] () -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\mbam-log-2010-01-27 (20-55-42).txt

[2010.01.20 22:42:07 | 00,010,328 | ---- | M] () -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\Mudrosti.txt

[2007.09.17 17:32:42 | 00,000,168 | ---- | M] () -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\My Computer.lnk

[2008.06.13 13:48:54 | 00,001,323 | ---- | M] () -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\My Documents.lnk

[2010.01.27 21:30:04 | 00,000,526 | ---- | M] () -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\New Text Document.txt

[2010.01.26 21:57:04 | 00,000,929 | ---- | M] () -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\NOD.txt

[2010.01.20 18:38:20 | 00,001,635 | ---- | M] () -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\Nokia PC Suite.lnk

[2010.01.27 21:32:35 | 00,548,864 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\OTL.exe

[2007.10.01 13:09:17 | 00,000,656 | ---- | M] () -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\Paint.lnk

[2009.12.21 22:59:46 | 00,000,853 | ---- | M] () -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\Programa 12e_1vi Srok.txt

[2009.02.13 21:27:14 | 00,000,580 | ---- | M] () -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\QuickSMS.lnk

[2008.04.18 17:41:52 | 00,001,607 | ---- | M] () -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\Skype.lnk

[2008.10.11 20:27:43 | 00,000,339 | ---- | M] () -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\Snimki.lnk

[2009.12.26 18:43:34 | 05,509,304 | ---- | M] () -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\Video_2009-12-26_173512.wmv

[2009.12.26 19:07:22 | 04,286,085 | ---- | M] () -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\Video_2009-12-26_180033.wmv

[2010.01.26 21:30:00 | 00,049,513 | ---- | M] () -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\Zamunda_NET Details for torrent Kaspersky Anti-Virus - Kaspersky Internet Security 2010 9_0_0_736 Final.htm

[2009.08.10 21:34:01 | 00,001,701 | ---- | M] () -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\Гаси Тока.lnk

[2010.01.23 20:37:04 | 00,594,322 | ---- | M] () -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\Компакт-дискови устройства- видове технологии.ppsx

[2010.01.23 20:32:32 | 00,594,154 | ---- | M] () -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\Компакт-дискови устройства- видове технологии.pptx

[2008.06.13 13:54:39 | 00,000,471 | ---- | M] () -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\Разни.lnk

[2009.07.05 15:33:42 | 00,012,281 | ---- | M] () -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\Ябълков сладкиш.docx

< %userprofile%\Desktop\*. >

[2009.12.16 19:18:55 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\daskalo

[2009.10.27 20:09:07 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\DETSTVO

[2010.01.18 12:42:16 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\DISC

[2010.01.26 22:10:38 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\ESET NOD32 Antivirus 4.0.435 Bulgarian

[2009.02.15 14:31:47 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\HackAttack

[2010.01.19 22:32:17 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\hadji

[2010.01.26 21:03:59 | 00,000,000 | -H-D | M] -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\hid

[2010.01.27 15:11:52 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\Igri i chistota

[2010.01.27 10:56:09 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\Kaspersky 2010 9.0.0.736 Final

[2010.01.19 21:02:09 | 00,000,000 | R--D | M] -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\Lubimite na Nino

[2010.01.03 22:59:41 | 00,000,000 | -H-D | M] -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\NG

[2010.01.27 21:28:42 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\Мой Програми

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-01-27 19:04:53

< End of report >

Extras.txt

OTL Extras logfile created on: 27.1.2010 г. 21:35:46 - Run 1

OTL by OldTimer - Version 3.1.27.0 Folder = C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop

Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 6.0.2900.2180)

Locale: 00000402 | Country: Bulgaria | Language: BGR | Date Format: dd.M.yyyy 'г.'

2,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 76,00% Memory free

3,00 Gb Paging File | 2,00 Gb Available in Paging File | 89,00% Paging File free

Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 15,93 Gb Total Space | 5,67 Gb Free Space | 35,63% Space Free | Partition Type: NTFS

D: Drive not present or media not loaded

Drive E: | 58,60 Gb Total Space | 27,35 Gb Free Space | 46,67% Space Free | Partition Type: NTFS

Drive F: | 298,08 Gb Total Space | 59,41 Gb Free Space | 19,93% Space Free | Partition Type: NTFS

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

Computer Name: FEMIN3MA

Current User Name: Ninoslav Arbaliyski

Logged in as Administrator.

Current Boot Mode: Normal

Scan Mode: All users

Company Name Whitelist: On

Skip Microsoft Files: On

File Age = 30 Days

Output = Minimal

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\IEXPLORE.EXE (Microsoft Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

exefile [open] -- "%1" %*

htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)

htmlfile [open] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome (Microsoft Corporation)

htmlfile [opennew] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation)

http [open] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome (Microsoft Corporation)

https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~2\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)

Directory [Winamp.Bookmark] -- "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft)

Directory [Winamp.Enqueue] -- "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft)

Directory [Winamp.Play] -- "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft)

Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)

Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation)

CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "%programfiles%\internet explorer\iexplore.exe" (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"AntiVirusDisableNotify" = 0

"FirewallDisableNotify" = 0

"UpdatesDisableNotify" = 0

"AntiVirusOverride" = 1

"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"EnableFirewall" = 1

"DoNotAllowExceptions" = 0

"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

"14815:TCP" = 14815:TCP:*:Enabled:BitComet 14815 TCP

"14815:UDP" = 14815:UDP:*:Enabled:BitComet 14815 UDP

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

"C:\Program Files\Windows Live\Messenger\livecall.exe" = C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone) -- (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

"E:\mIRC\m00n Script by FEMINEMA™\mirc.exe" = E:\mIRC\m00n Script by FEMINEMA™\mirc.exe:*:Enabled:mirc.exe -- (mIRC Co. Ltd.)

"E:\mIRC\HackAttack TriviQ\eggdrop.exe" = E:\mIRC\HackAttack TriviQ\eggdrop.exe:*:Enabled:eggdrop -- ()

"E:\mIRC\SurfAnonymous 1.0.1.0 REGISTERED FINALLY PEOPLE !.exe\SurfAnonymous1.0.1.0_registered\SurfAnonymous\SurfAnonymous.exe" = E:\mIRC\SurfAnonymous 1.0.1.0 REGISTERED FINALLY PEOPLE !.exe\SurfAnonymous1.0.1.0_registered\SurfAnonymous\SurfAnonymous.exe:*:Enabled:SurfAnonymous -- (Sa6ry Software House)

"E:\mIRC\My scripts\HackAttack\HackAttack.exe" = E:\mIRC\My scripts\HackAttack\HackAttack.exe:*:Enabled:mIRC -- (mIRC Co. Ltd.)

"E:\mIRC\My scripts\UnderAttack\EggBot.exe" = E:\mIRC\My scripts\UnderAttack\EggBot.exe:*:Enabled:mIRC -- (mIRC Co. Ltd.)

"E:\mIRC\My scripts\VirusAlert Eggbot\mirc.exe" = E:\mIRC\My scripts\VirusAlert Eggbot\mirc.exe:*:Enabled:mIRC -- (mIRC Co. Ltd.)

"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE" = C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook -- (Microsoft Corporation)

"C:\Program Files\Microsoft Office\Office12\GROOVE.EXE" = C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove -- (Microsoft Corporation)

"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE" = C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote -- (Microsoft Corporation)

"E:\mIRC\triviq\Windrop\eggdrop.exe" = E:\mIRC\triviq\Windrop\eggdrop.exe:*:Enabled:eggdrop -- ()

"E:\mIRC\Batman_Inviter\UniBG.exe" = E:\mIRC\Batman_Inviter\UniBG.exe:*:Enabled:MVPs -- (MVPsoft. .)

"E:\mIRC\Batman_Inviter\UniBG_original.exe" = E:\mIRC\Batman_Inviter\UniBG_original.exe:*:Enabled:MVPs -- (MVPsoft. .)

"C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe" = C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe:*:Enabled:BlueSoleil -- (IVT Corporation.)

"F:\Games\CS1.6\hl.exe" = F:\Games\CS1.6\hl.exe:*:Enabled:Half-Life Launcher -- (Valve)

"E:\Program Files\ICQ6\ICQ.exe" = E:\Program Files\ICQ6\ICQ.exe:*:Enabled:ICQ6 -- (ICQ, Inc.)

"E:\Program Files\uTorrent\uTorrent.exe" = E:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent -- (BitTorrent, Inc.)

"F:\Games\CSSv34\hl2.exe" = F:\Games\CSSv34\hl2.exe:*:Enabled:hl2 -- ()

"F:\Games\CS1.6\87490399635842422409.exe" = F:\Games\CS1.6\87490399635842422409.exe:*:Enabled:Half-Life Launcher by FLEX -- (Valve)

"F:\Games\CS1.6\18620163875862260276.exe" = F:\Games\CS1.6\18620163875862260276.exe:*:Enabled:Half-Life Launcher by FLEX -- (Valve)

"F:\Games\CS1.6\46363022019984683260.exe" = F:\Games\CS1.6\46363022019984683260.exe:*:Enabled:Half-Life Launcher by FLEX -- (Valve)

"F:\Games\CS1.6\37302044934507448061.exe" = F:\Games\CS1.6\37302044934507448061.exe:*:Enabled:Half-Life Launcher by FLEX -- (Valve)

"F:\Games\CS1.6\89717897544993839310.exe" = F:\Games\CS1.6\89717897544993839310.exe:*:Enabled:Half-Life Launcher by FLEX -- (Valve)

"F:\Games\CS1.6\94225354114254776487.exe" = F:\Games\CS1.6\94225354114254776487.exe:*:Enabled:Half-Life Launcher by FLEX -- (Valve)

"F:\Games\CS1.6\91297880738655603369.exe" = F:\Games\CS1.6\91297880738655603369.exe:*:Enabled:Half-Life Launcher by FLEX -- (Valve)

"F:\Games\CS1.6\20263383694886559014.exe" = F:\Games\CS1.6\20263383694886559014.exe:*:Enabled:Half-Life Launcher by FLEX -- (Valve)

"F:\Games\CS1.6\73697098847968077660.exe" = F:\Games\CS1.6\73697098847968077660.exe:*:Enabled:Half-Life Launcher by FLEX -- (Valve)

"F:\Games\CS1.6\88562270040609616556.exe" = F:\Games\CS1.6\88562270040609616556.exe:*:Enabled:Half-Life Launcher by FLEX -- (Valve)

"F:\Games\CS1.6\97360273714495492501.exe" = F:\Games\CS1.6\97360273714495492501.exe:*:Enabled:Half-Life Launcher by FLEX -- (Valve)

"C:\Program Files\Nokia\Nokia Software Updater\nsu_ui_client.exe" = C:\Program Files\Nokia\Nokia Software Updater\nsu_ui_client.exe:*:Enabled:Nokia Software Updater -- (Nokia Corporation)

"C:\Program Files\Common Files\Nokia\Service Layer\A\nsl_host_process.exe" = C:\Program Files\Common Files\Nokia\Service Layer\A\nsl_host_process.exe:*:Enabled:Nokia Service Layer Host Process -- (Nokia Corporation)

"F:\Games\CS1.6\57627468768442414184.exe" = F:\Games\CS1.6\57627468768442414184.exe:*:Enabled:Half-Life Launcher by FLEX -- (Valve)

"C:\Program Files\Windows Live\Messenger\livecall.exe" = C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone) -- (Microsoft Corporation)

"F:\Games\CS1.6\47360162383515530936.exe" = F:\Games\CS1.6\47360162383515530936.exe:*:Enabled:Half-Life Launcher by FLEX -- (Valve)

"C:\Program Files\Nero\Nero 7\Nero Home\NeroHome.exe" = C:\Program Files\Nero\Nero 7\Nero Home\NeroHome.exe:*:Enabled:Nero Home -- (Nero AG)

"C:\Program Files\Skype\Phone\Skype.exe" = C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype -- (Skype Technologies S.A.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{07A540AB-D785-11D5-8E89-0090275862A0}" = Corel Graphics Suite 11

"{0BEDBD4E-2D34-47B5-9973-57E62B29307C}" = ATI Control Panel

"{0C973594-7DDF-4BD0-84ED-3517F7622037}" = PC Connectivity Solution

"{1E04F83B-2AB9-4301-9EF7-E86307F79C72}" = Google Earth

"{1E460998-5C2C-4ACF-A9AA-3629BD9C06C2}" = Samsung PC Studio

"{212748BB-0DA5-46DE-82A1-403736DC9F27}" = MSVC80_x86

"{2FBF04DC-404C-4FA4-BA28-99903080D2B9}" = Magnifier Powertoy for Windows XP

"{319A3CA9-DA63-4D65-8B25-403CF9CBF087}" = SpeechLab

"{3248F0A8-6813-11D6-A77B-00B0D0150060}" = J2SE Runtime Environment 5.0 Update 6

"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP

"{3D39E775-DDDA-4327-B747-0BDC5F191331}" = Nokia PC Suite

"{52D02A2B-03D2-4E34-A358-DC5D951FD296}" = Nokia Connectivity Cable Driver

"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml

"{5A325490-FAC5-45A9-A954-5B140D916D91}" = WinLbd Data Plug Developer

"{5C82DAE5-6EB0-4374-9254-BE3319BA4E82}" = Skype™ 3.8

"{5E8A1B08-0FBD-4543-9646-F2C2D0D05750}" = Macromedia Flash Player 8

"{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}" = Microsoft .NET Framework 2.0

"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable

"{7784A172-61F1-445E-8368-601607E0DD22}" = MP3 Player Utilities 4.00

"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP

"{846AC73B-9394-48B9-B941-8F7F472F0047}" = Bluesoleil2.6.0.9 Release 070606

"{875FC2BF-BF34-4F26-B579-CFC7CE2FFAEA}" = ESET NOD32 Antivirus

"{90120000-0010-0409-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (English) 12

"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007

"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007

"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007

"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007

"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007

"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007

"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007

"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007

"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007

"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007

"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007

"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007

"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007

"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007

"{90120000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2007

"{90120000-0114-0409-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (English) 2007

"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007

"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007

"{901F0409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office 2003 Proofing Tools

"{A43BF6A5-D5F0-4AAA-BF41-65995063EC44}" = MSXML 6.0 Parser

"{A7050037-F0EA-4BAB-BCD5-FC05507D6147}" = Alt-Tab Task Switcher Powertoy for Windows XP

"{AC76BA86-7AD7-1033-7B44-A70000000000}" = Adobe Reader 7.0

"{B37C842A-B624-46B8-A727-654E72F1C91A}" = Calculator Powertoy for Windows XP

"{BACEDB6C-D282-4201-9BD4-97425B8A91B7}" = Windows Live Messenger

"{BCB4C18A-ACA6-4383-8688-E19933A705DD}" = Microsoft SOAP Toolkit 3.0

"{BE47DBD4-72DF-424F-80FB-B42145DBCD47}" = Windows Live installer

"{BEAD39CD-901D-4267-8B8B-EAA83CB4B70D}" = Pivot Stickfigure Animator

"{C39DE425-6CCF-4B12-A101-3CB5CF3AF3AD}" = Slideshow Generator Powertoy for Windows XP

"{C8BB4912-12D9-42AE-B571-E580D8CD1B5B}" = TuneUp Utilities 2007

"{C912EFA0-0076-11d5-B04A-BD6C80DF2479}" = IconChanger

"{C9E4932C-8417-4E4C-A0E3-EE534810AB4D}" = ClearType Tuning Control Panel Applet

"{D958FAC4-BAE0-4B1D-A42E-DE9BFDE7DDEE}" = Canon PhotoRecord

"{E3D278BD-FC97-4F87-BB1F-689AE0CB9122}" = Macromedia Flash Player 8 Plugin

"{F14B8ECC-BDA0-4987-9201-D7B7DBE11033}" = Nero 7 Ultra Edition

"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)

"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01

"{F3B6CF89-B918-4DDE-A7F7-B4D4C3E6D033}" = BluetoothRemoteControl

"{F7AD1EF2-2670-40C2-A541-939265AF2F18}_is1" = Privacy Eraser Pro

"{F983B4FE-547B-4C44-BAF7-4F4DBA93D548}" = Nokia Software Updater

"{FCA211BA-1A9F-4128-8DAE-96192C68816D}" = Samsung PC Studio

"504244733D18C8F63FF584AEB290E3904E791693" = Windows Driver Package - Nokia pccsmcfd (08/22/2008 7.0.0.0)

"Active Keyboard_is1" = Active Keyboard 3.1

"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX

"All ATI Software" = ATI - Software Uninstall Utility

"Ardamax Keylogger" = Ardamax Keylogger 2.8

"ASCII Art Generator_is1" = ASCII Art Generator 3.2.2

"ATI Display Driver" = ATI Display Driver

"AVConverter" = AVConverter 1.0

"AVI ReComp" = AVI ReComp 1.2.3

"AVIConverter" = AVIConverter 3.0

"AviSynth" = AviSynth 2.5

"AXIS Media Control Embedded" = AXIS Media Control Embedded

"BSPlayer1" = BSPlayer

"Cain & Abel v4.9.23" = Cain & Abel v4.9.23

"CANONBJ_Deinstall_CNMCP5y.DLL" = Canon PIXMA iP1500

"ClassicPro" = ClassicPro© v1.12

"C-Media Audio" = C-Media 3D Audio

"E8A6D621B6D3FC5D43C68C549D959DE76EEF5D84" = Windows Driver Package - Nokia Modem (06/01/2009 4.1)

"EasyH10" = EasyH10

"Easy-PhotoPrint" = Canon Utilities Easy-PhotoPrint

"Easy-PrintToolBox" = Canon Utilities Easy-PrintToolBox

"ENTERPRISE" = Microsoft Office Enterprise 2007

"EVEREST Ultimate Edition_is1" = EVEREST Ultimate Edition v4.50

"F779F5541ABD99C95C03B0FD5E3C058B22DA0FF7" = Windows Driver Package - Nokia Modem (06/01/2009 7.01.0.3)

"FlashGet" = FlashGet 1.9.4.1063

"Fruity Loops Studio XXL 5.01" = Fruity Loops Studio XXL 5.01

"Gaberoff Koral German Dictionary 1.01" = Gaberoff Koral German Dictionary 1.01

"Hamachi" = Hamachi 1.0.3.0

"HeViewUns110" = HTML Executable Viewer 1.1.0

"HijackThis" = HijackThis 2.0.2

"InstallShield_{07A540AB-D785-11D5-8E89-0090275862A0}" = Corel Graphics Suite 11

"LastFM_is1" = Last.fm 1.4.2.59470

"Macromedia Shockwave Player" = Macromedia Shockwave Player

"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware

"Mario Forever v 2.16 !" = Mario Forever v 2.16 !

"Microsoft .NET Framework 2.0" = Microsoft .NET Framework 2.0

"MiniLyrics" = Minilyrics(remove only)

"mIRC" = mIRC

"Mortal Kombat 4" = Mortal Kombat 4

"mosascii m2_is1" = mosascii m2 2.1.200 Beta 3

"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP

"Nokia PC Suite" = Nokia PC Suite

"NSS" = NSS (remove only)

"QcDrv" = ##CAMERADRIVERNAME##

"QuickSMS" = QuickSMS

"QuicktimeAlt_is1" = QuickTime Alternative 2.7.0

"RAR Key Demo" = RAR Key 8.3 Demo

"RoyaleTheme" = XP Royale Theme

"SA Dictionary 2004 Datacenter" = SA Dictionary 2004 Datacenter

"SAMSUNG CDMA Modem" = SAMSUNG CDMA Modem Driver Set

"SAMSUNG Mobile Composite Device" = SAMSUNG Mobile Composite Device Software

"Samsung Mobile phone USB driver" = Samsung Mobile phone USB driver Software

"SAMSUNG Mobile USB Modem" = SAMSUNG Mobile USB Modem Software

"SAMSUNG Mobile USB Modem 1.0" = SAMSUNG Mobile USB Modem 1.0 Software

"SIM editor" = SIM editor 4.0

"SMS-it!" = SMS-it!

"Snow for Windows" = Snow for Windows

"SurfAnonymous" = SurfAnonymous (Remove Only)

"Talisman 2" = Talisman 2

"Teleport Pro" = Teleport Pro

"Totalcmd" = Total Commander (Remove or Repair)

"TricksandTweaks" = Tricks&Tweaks

"Unlocker" = Unlocker 1.8.8

"VentriloMIX" = VentriloMIX

"Visual Basic 6.0 Professional Edition" = Microsoft Visual Basic 6.0 Professional Edition

"vloader" = vloader 2.3

"Wdf01007" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.7

"WebPost" = Microsoft Web Publishing Wizard 1.53

"Winamp" = Winamp

"WinAVI Video Converter 9.09.0" = WinAVI Video Converter 9.0

"Windows Media Format Runtime" = Windows Media Format 11 runtime

"Windows Media Player" = Windows Media Player 11

"Windows XP Service Pack" = Windows XP Service Pack 2

"WinRAR archiver" = WinRAR archiver

"WMFDist11" = Windows Media Format 11 runtime

"wmp11" = Windows Media Player 11

"Wudf01007" = Microsoft User-Mode Driver Framework Feature Pack 1.7

"XP Codec Pack" = XP Codec Pack

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-796845957-725345543-839522115-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"uTorrent" = µTorrent

========== Last 10 Event Log Errors ==========

[ Application Events ]

Error - 09.12.2009 г. 13:30:23 | Computer Name = FEMIN3MA | Source = EventSystem | ID = 4609

Description = The COM+ Event System detected a bad return code during its internal

processing. HRESULT was 80070422 from line 44 of d:\qxp_slp\com\com1x\src\events\tier1\eventsystemobj.cpp.

Please contact Microsoft Product Support Services to report this erro

Error - 09.12.2009 г. 13:30:24 | Computer Name = FEMIN3MA | Source = VSS | ID = 8193

Description = Volume Shadow Copy Service error: Unexpected error calling routine

CoCreateInstance. hr = 0x80040206.

Error - 11.12.2009 г. 03:00:52 | Computer Name = FEMIN3MA | Source = EventSystem | ID = 4609

Description = The COM+ Event System detected a bad return code during its internal

processing. HRESULT was 80070422 from line 44 of d:\qxp_slp\com\com1x\src\events\tier1\eventsystemobj.cpp.

Please contact Microsoft Product Support Services to report this erro

Error - 11.12.2009 г. 03:00:52 | Computer Name = FEMIN3MA | Source = VSS | ID = 8193

Description = Volume Shadow Copy Service error: Unexpected error calling routine

CoCreateInstance. hr = 0x80040206.

Error - 12.12.2009 г. 05:25:34 | Computer Name = FEMIN3MA | Source = EventSystem | ID = 4609

Description = The COM+ Event System detected a bad return code during its internal

processing. HRESULT was 80070422 from line 44 of d:\qxp_slp\com\com1x\src\events\tier1\eventsystemobj.cpp.

Please contact Microsoft Product Support Services to report this erro

Error - 12.12.2009 г. 05:25:34 | Computer Name = FEMIN3MA | Source = VSS | ID = 8193

Description = Volume Shadow Copy Service error: Unexpected error calling routine

CoCreateInstance. hr = 0x80040206.

Error - 13.12.2009 г. 06:33:12 | Computer Name = FEMIN3MA | Source = EventSystem | ID = 4609

Description = The COM+ Event System detected a bad return code during its internal

processing. HRESULT was 80070422 from line 44 of d:\qxp_slp\com\com1x\src\events\tier1\eventsystemobj.cpp.

Please contact Microsoft Product Support Services to report this erro

Error - 13.12.2009 г. 06:33:12 | Computer Name = FEMIN3MA | Source = VSS | ID = 8193

Description = Volume Shadow Copy Service error: Unexpected error calling routine

CoCreateInstance. hr = 0x80040206.

Error - 13.12.2009 г. 08:38:25 | Computer Name = FEMIN3MA | Source = EventSystem | ID = 4609

Description = The COM+ Event System detected a bad return code during its internal

processing. HRESULT was 80070422 from line 44 of d:\qxp_slp\com\com1x\src\events\tier1\eventsystemobj.cpp.

Please contact Microsoft Product Support Services to report this erro

Error - 13.12.2009 г. 08:38:25 | Computer Name = FEMIN3MA | Source = VSS | ID = 8193

Description = Volume Shadow Copy Service error: Unexpected error calling routine

CoCreateInstance. hr = 0x80040206.

[ System Events ]

Error - 27.1.2010 г. 14:58:38 | Computer Name = FEMIN3MA | Source = DCOM | ID = 10005

Description = DCOM got error "%1058" attempting to start the service EventSystem

with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 27.1.2010 г. 15:01:02 | Computer Name = FEMIN3MA | Source = NETLOGON | ID = 3095

Description = This computer is configured as a member of a workgroup, not as a member

of a domain. The Netlogon service does not need to run in this configuration.

Error - 27.1.2010 г. 15:01:11 | Computer Name = FEMIN3MA | Source = DCOM | ID = 10005

Description = DCOM got error "%1058" attempting to start the service EventSystem

with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 27.1.2010 г. 15:01:12 | Computer Name = FEMIN3MA | Source = SRService | ID = 104

Description = The System Restore initialization process failed.

Error - 27.1.2010 г. 15:01:12 | Computer Name = FEMIN3MA | Source = DCOM | ID = 10005

Description = DCOM got error "%1058" attempting to start the service EventSystem

with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 27.1.2010 г. 15:01:13 | Computer Name = FEMIN3MA | Source = Service Control Manager | ID = 7001

Description = The Computer Browser service depends on the Server service which failed

to start because of the following error: %%1058

Error - 27.1.2010 г. 15:01:13 | Computer Name = FEMIN3MA | Source = Service Control Manager | ID = 7023

Description = The HID Input Service service terminated with the following error:

%%2

Error - 27.1.2010 г. 15:01:13 | Computer Name = FEMIN3MA | Source = Service Control Manager | ID = 7001

Description = The System Event Notification service depends on the COM+ Event System

service which failed to start because of the following error: %%1058

Error - 27.1.2010 г. 15:01:13 | Computer Name = FEMIN3MA | Source = Service Control Manager | ID = 7023

Description = The System Restore Service service terminated with the following error:

%%1359

Error - 27.1.2010 г. 15:01:17 | Computer Name = FEMIN3MA | Source = Service Control Manager | ID = 7026

Description = The following boot-start or system-start driver(s) failed to load:

uagp35

< End of report >

Да затворя ли GMER? и да спомена, във версията(3.1.27.0) за която ми дадохте линк на OTL.exe липсва "Include 64bit Scans" всичко друго направих.

Редактирано 27 януари 201016 г. от FEMINEMA (преглед на промените)

27 януари 201016 г.

СТЪПКА 1

От Add or Remove Programs деинсталирайте следните програми:

J2SE Runtime Environment 5.0 Update 6

Adobe Reader 7.0

СТЪПКА 2

Стартирайте OTL.exe отдолу под "Custom Scans/Fixes" с copy/paste въведете следната информация.

Внимавайте да копирате скрипта 1 към 1 (започва с двуточието пред OTL)!

:OTL

SRV - (ioloDMV) -- File not found

SRV - (Icecast) -- File not found

O3 - HKLM\..\Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - No CLSID value found.

O3 - HKU\S-1-5-21-796845957-725345543-839522115-1006\..\Toolbar\WebBrowser: (no name) - {DB87BFA2-A2E3-451E-8E5A-C89982D87CBF} - No CLSID value found.

O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)

O20 - Winlogon\Notify\WgaLogon: DllName - WgaLogon.dll - File not found

MsConfig - StartUpReg: DAEMON Tools Lite - hkey= - key= - E:\Program Files\DAEMON Tools Lite\daemon.exe File not found

:files

C:\KAV

C:\Documents and Settings\All Users\Application Data\Lavasoft

C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Application Data\AVG8

C:\Documents and Settings\All Users\Application Data\AVG7

C:\Documents and Settings\All Users\Application Data\Kaspersky Anti-Virus Personal

C:\Documents and Settings\All Users\Application Data\h8srtkrl32mainweq.dll

C:\RECYCLER

:commands

[purity]

[emptytemp]

[reboot]

Натиснете Run Fix.

Публикувайте лог файла в следващия си пост.

СТЪПКА 3

Отворете Notepad.exe и с copy/paste въведете следната информация:

KILLALL::

Mia::

C:\WINDOWS\system32\dxtmsft.dll

C:\WINDOWS\system32\dxtrans.dll

SRpeek::

C:\WINDOWS\system32\dxtmsft.dll

C:\WINDOWS\system32\dxtrans.dll

FixcSet::

Запазете файла с име CFScript и го провлачете в Combofix.exe

По време на сканиране от страна на ComboFix не стартирайте никакви други приложения, не натискайте клавиши от клавиатурата и не местете мишката !

Публикувайте лог файла, който ще се създаде след рестарта на компютъра в следващия си пост.

27 януари 201016 г.

Автор

All processes killed

========== OTL ==========

Service ioloDMV stopped successfully!

Service ioloDMV deleted successfully!

File File not found not found.

Service Icecast stopped successfully!

Service Icecast deleted successfully!

File File not found not found.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{E0E899AB-F487-11D5-8D29-0050BA6940E3} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E0E899AB-F487-11D5-8D29-0050BA6940E3}\ not found.

Registry value HKEY_USERS\S-1-5-21-796845957-725345543-839522115-1006\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{DB87BFA2-A2E3-451E-8E5A-C89982D87CBF} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DB87BFA2-A2E3-451E-8E5A-C89982D87CBF}\ not found.

File oft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab not found.

Starting removal of ActiveX control Microsoft XML Parser for Java

Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Microsoft XML Parser for Java\DownloadInformation\\INF .

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Microsoft XML Parser for Java\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\Microsoft XML Parser for Java\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\StartUpReg\DAEMON Tools Lite\ deleted successfully.

========== FILES ==========

C:\KAV\KasperskyAV6.0.2.621\english folder moved successfully.

C:\KAV\KasperskyAV6.0.2.621 folder moved successfully.

C:\KAV folder moved successfully.

C:\Documents and Settings\All Users\Application Data\Lavasoft\License folder moved successfully.

C:\Documents and Settings\All Users\Application Data\Lavasoft folder moved successfully.

C:\Documents and Settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Application Data\AVG8 folder moved successfully.

C:\Documents and Settings\All Users\Application Data\AVG7 folder moved successfully.

C:\Documents and Settings\All Users\Application Data\Kaspersky Anti-Virus Personal\5.0\Bases\Patches folder moved successfully.

C:\Documents and Settings\All Users\Application Data\Kaspersky Anti-Virus Personal\5.0\Bases folder moved successfully.

C:\Documents and Settings\All Users\Application Data\Kaspersky Anti-Virus Personal\5.0 folder moved successfully.

C:\Documents and Settings\All Users\Application Data\Kaspersky Anti-Virus Personal folder moved successfully.

C:\Documents and Settings\All Users\Application Data\h8srtkrl32mainweq.dll moved successfully.

C:\RECYCLER\S-1-5-21-796845957-725345543-839522115-1006 folder moved successfully.

C:\RECYCLER folder moved successfully.

========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator

User: All Users

User: Amadeus

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 67 bytes

User: Default User

User: LocalService

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 32902 bytes

User: NetworkService

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 67 bytes

User: Ninoslav Arbaliyski.ARBALIYS-DQRY21

->Temp folder emptied: 1436498 bytes

->Temporary Internet Files folder emptied: 9202412 bytes

->Java cache emptied: 0 bytes

->Google Chrome cache emptied: 6643033 bytes

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32\dllcache .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 0 bytes

%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes

%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 67 bytes

RecycleBin emptied: 0 bytes

Total Files Cleaned = 17,00 mb

OTL by OldTimer - Version 3.1.27.0 log created on 01272010_230241

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

27 януари 201016 г.

Здравей, ако Nod 32 не ти е лицензен ще ти пропуска доста вируси и то с "усмивка". Изтегли си Avira Personal Edition и я комбинирай със SpyBot Search&Destroy(има български фейс)или със Spyware Terminator(всички са безплатни и ги има тук), които са антишпионски програми, пасват си идеално и не си пречат. С антишпионските програми можеш да имунизираш. Към терминатора можеш да прибавиш и антивирусната ClamAV по-желание. Някои вируси не позволяват инстал на други антивирусни, но терминатора се инсталира. Нямам идея дали тези вируси са в базата му данни, но пробвай с него и ClamAv. Сканирането няма да е за 5-10 минути и внимавай какво триеш. Успех! Помисли и за стена!

27 януари 201016 г.

Автор

Warning!! Изписа, че има активна AVG, потърсих изтрих всички файлове на AVG, но в таск мениджъра не виждам нейн файл.., дадох ок и..

Warning!!

antivirus: AVG Anti-Virus 7.0.289

The above real time scanner(s) are still active but ComboFix shall continue to run. Kindly note that this is at your risk

И отдолу единствено бутон OK. Натискам?

27 януари 201016 г.

И отдолу единствено бутон OK. Натискам?

Да :rolleyes:

27 януари 201016 г.

Автор

' date='27 януари 2010 - 23:19 ' timestamp='1264627156' post='1619460']
Да

There's a newer version of ComboFix avaible. Would you like to update ComboFix?

Yes / No

27 януари 201016 г.

There's a newer version of ComboFix avaible. Would you like to update ComboFix?

Yes / No

YES. :rolleyes:

27 януари 201016 г.

Автор

' date='27 януари 2010 - 23:28 ' timestamp='1264627682' post='1619469']
YES.

ComboFix 10-01-27.03 - Ninoslav Arbaliyski 01.2010 г. 23:38:21.2.1 - x86

Microsoft Windows XP Professional 5.1.2600.2.1251.359.1033.18.2047.1580 [GMT 2:00]

Running from: c:\documents and settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\caramba.exe

Command switches used :: c:\documents and settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Desktop\CFScript.txt

AV: AVG Anti-Virus 7.0.289 *On-access scanning enabled* (Outdated) {41564737-3200-1071-989B-0000E87B4FB1}

AV: ESET NOD32 Antivirus 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

.

((((((((((((((((((((((((( Files Created from 2009-12-27 to 2010-01-27 )))))))))))))))))))))))))))))))

.

2010-01-27 21:02 . 2010-01-27 21:02 -------- d-----w- C:\_OTL

2010-01-27 19:29 . 2010-01-27 19:29 77312 ----a-w- C:\mbr.exe

2010-01-27 16:28 . 2010-01-27 16:28 -------- d-----w- c:\windows\system32\CatRoot_bak

2010-01-27 15:22 . 2010-01-27 15:22 -------- d-----w- c:\documents and settings\Ninoslav Arbaliyski.ARBALIYS-DQRY21\Application Data\Malwarebytes