Fixer32 и друг проблем

18 юли 201016 г.

Здравейте от няколко дена ми се явява следното съобщение при стартиране на операционната система Vista Home Premium SP2,освен това бавно зарежда и не минават последните ъпдейти.

18 юли 201016 г.

Четете и изпълнете условията описани в тази тема:

Системата ми е инфектирана - Какво да правя сега?

2

18 юли 201016 г.

Автор

Благодаря за упътването, ето резултата от тестовете.

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4323

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18928

18.7.2010 г. 19:08:05
mbam-log-2010-07-18 (19-08-05).txt

Scan type: Full scan (C:\|D:\|E:\|F:\|)
Objects scanned: 245894
Time elapsed: 1 hour(s), 37 minute(s), 54 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 1
Files Infected: 4

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\windows security service (Trojan.Agent) -> No action taken.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013 (Trojan.Agent) -> No action taken.

Files Infected:
C:\Downloads\GetData Recover My Files Professional Edition v4.5.2.751 - FFF\Crack\armaccess.dll (Malware.Packer) -> No action taken.
C:\Program Files\GetData\Recover My Files v4\armaccess.dll (Malware.Packer) -> No action taken.
C:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\Desktop.ini (Trojan.Agent) -> No action taken.
C:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\Fixer32.exe (Trojan.Agent) -> No action taken.

Редактирано 18 юли 201016 г. от nologo (преглед на промените)

18 юли 201016 г.

Привет, ALEXONE™. Може ли да направиш следното, стъпка по стъпка. Обърни внимание на Remove Selected за MBAM, както и да я обновиш преди сканиране:

Стъпка 1

Пуснете отново MalwareBytes' Anti-Malware (MBAM) и направете бързо сканиране - Quick Scan. Ето как:

Стартирайте програмата, направете обновяване на дефинициите (Update) и изберете Quick Scan, след това натиснете бутона "Сканиране" (Scan).
Сканирането ще отнеме малко време, затова моля бъдете търпеливи.
Когато сканирането завърши, кликнете на OK, след това Show Results, за да видите резултата.
Уверете се, че на всички редове има отметки, и кликнете Remove Selected (Премахни избраните)
Когато всичко бъде премахнато, логът ще бъде отворен в Notepad. Копирайте лога и го публикувайте в следващия си коментар в темата.

Забележка: Ако MalwareBytes' Anti-Malware се затрудни в премахването на откритите вируси/заплахи, той ще поиска да рестартира компютъра Ви и по време на рестартирането да премахне проблемните вируси/заплахи. Ако бъдете попитани, потвърдете че желаете вашия компютър да бъде рестартиран.

Стъпка 2

Следвайте следната инструкция за работа със Security Check:

Изтеглете Security Check (автор: screen317) от тук или от тук и го запишете на десктопа.
Кликнете два пъти върху SecurityCheck.exe и следвайте инструкциите.
Когато програмата завърши работата си, ще се отвори един текстов документ: checkup.txt.
Копирайте съдържанието с Копирай (Copy) на checkup.txt и с Постави (Paste) го поставете в следващия си коментар.

Стъпка 3

Сканирайте с Sophos Anti-Rootkit. Ето как: изтеглете Sophos Anti-Rootkit от тук (изисква се регистрация), стартирайте sarsfx.exe, пуснете да сканира (Start scan). Когато сканирането завърши, пуснете Windows Explorer и отидете в папка %temp%. Там трябва да има файл с име sarscan.log.

18 юли 201016 г.

Автор

Стъпка 1

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4324

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18928

18.7.2010 г. 20:09:50
mbam-log-2010-07-18 (20-09-50).txt

Scan type: Quick scan
Objects scanned: 133415
Time elapsed: 19 minute(s), 2 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 1
Files Infected: 2

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\windows security service (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013 (Trojan.Agent) -> Quarantined and deleted successfully.

Files Infected:
C:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\Desktop.ini (Trojan.Agent) -> Quarantined and deleted successfully.
C:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\Fixer32.exe (Trojan.Agent) -> Quarantined and deleted successfully.

Стъпка 2

Results of screen317's Security Check version 0.99.4
Windows Vista Service Pack 2 (UAC is enabled)
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
Antivirus out of date! (On Access scanning disabled!)
```````````````````````````````
Anti-malware/Other Utilities Check:
Malwarebytes' Anti-Malware
Java 6 Update 20
Java SE Runtime Environment 6
Java 6 Update 2
Java 6 Update 3
Out of date Java installed!
Adobe Flash Player 10.0.22.87
Adobe Reader 8.1.2
Out of date Adobe Reader installed!
````````````````````````````````
Process Check:
objlist.exe by Laurent
Windows Defender MSASCui.exe
Malwarebytes' Anti-Malware mbam.exe
Windows Defender MSASCui.exe
````````````````````````````````
DNS Vulnerability Check:
GREAT! (Not vulnerable to DNS cache poisoning)

``````````End of Log````````````

Стъпка 3

Started logging on 18.7.2010 г. at 19:55 ч.

User "pmsacks" on computer "PMSACKS-PC"

Windows version 6.0 SP 2.0 Service Pack 2 build 6002 SM=0x300 PT=0x1 Win32

Info: Starting process scan.

Info: Starting registry scan.

Info: Starting disk scan of C: (NTFS).

Hidden: file C:\Downloads\NAVTEQ_Q4_2008\MapRegions\BalticStatesKaliningradMR.psf.bc!

Hidden: file C:\Downloads\NAVTEQ_Q4_2008\MapRegions\MoldovaMR.psf.bc!

Stopped logging on 18.7.2010 г. at 20:47 ч.

Благодаря за съдействието.

18 юли 201016 г.

Ще трябва да се пооправи системата. Следва:

Стъпка 1

Изтеглете последната версия на Java SE Runtime Environment 6 Update 21, като отидете на тази страница и изберете Download JRE, после Windows Offline Installation. След инсталацията на JRE следва:

Следвайте следната инструкция за работа с инструмента JavaRa:

Изтеглете JavaRa и я разархивирайте на десктопа.

Важно: Преди да започнете работа с JavaRa, затворете Internet Explorer!
Кликнете два пъти върху JavaRa.exe, за да стартирате програмата
От падащото меню, изберете English, после Select.
JavaRa ще се стартира.
За да премахнете по-старите версия от компютъра изберете опцията Remove Older Versions.
Посочете Yes, когато ви бъде зададен въпрос.
Когато JavaRa приключи успешно премахването на старите версии, ще получите съобщение, че лог файлът от извършената процедура е създаден. Изберете OK. Лог файлът ще появи. Запазете го на десктопа и го прикачете към следващия си коментар или на rapidshare.com, като дадете линк към файла.

Стъпка 2

Обновете Adobe Reader до последната версия. Детайли може да намерите тук.

Стъпка 3

Следвайте следната инструкция за работа с OTL:

Изтеглете OTL.exe и го запазете на десктопа.
Стартирайте файла с двукратен клик на мишката.
Направете следните настройки:

Под "Custom Scans/Fixes" с Copy/ Paste въведете изцяло следната текстова информация (само това, което е поставено в карето):


netsvcs

drivers32 /all

%SYSTEMDRIVE%\*.*

%systemroot%\Fonts\*.com

%systemroot%\Fonts\*.dll

%systemroot%\Fonts\*.ini

%systemroot%\Fonts\*.ini2

%systemroot%\*.scr

%systemroot%\*._sy

%systemroot%\REPAIR\*.bak1

%systemroot%\REPAIR\*.ini

%systemroot%\system32\*.wt

%systemroot%\system32\*.ruy

%systemroot%\system32\*.jpg

%systemroot%\system32\spool\prtprocs\w32x86\*.*

%APPDATA%\Update\*.*

%APPDATA%\Microsoft\*.*

%APPDATA%\Adobe\Update\*.*

%ALLUSERSPROFILE%\Favorites\*.*

%PROGRAMFILES%\*.*

%systemroot%\*. /mp /s

CREATERESTOREPOINT

%systemroot%\system32\*.dll /lockedfiles

%systemroot%\Tasks\*.job /lockedfiles

%systemroot%\System32\config\*.sav

%systemroot%\system32\user32.dll /md5

%systemroot%\system32\ws2_32.dll /md5

%systemroot%\system32\ws2help.dll /md5

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs

Натиснете маркираният в синьо бутон: .
Като приключи проверката, ще се създадат два файла - OTL.Txt и Extras.Txt.
Прикачете в следващия си коментар (погледнете опцията "прикачени файлове", когато публикувате мнение) логовете от OTL: OTL.Txt, Extras.Txt.

19 юли 201016 г.

Автор

Благодаря за помощта и отделеното внимание.

Системата доста се е бъгнала и се явява един след друг проблем, при обновяване на JAVA стига до средата и спира със следното съобщение.

Като никой от бутоните не води до не води до продължение на инсталацията.

19 юли 201016 г.

Има ли проблем да пуснеш OTL? Ако има проблем, ще пробваме друга програма.

19 юли 201016 г.

Автор

Понеже квотата ми е изчерпана за прикачване то копирам файловете

OTL logfile created on: 19.7.2010 г. 22:07:36 - Run 2
OTL by OldTimer - Version 3.2.9.1 Folder = C:\Users\pmsacks\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18928)
Locale: 00000402 | Country: Bulgaria | Language: BGR | Date Format: d.M.yyyy 'г.'

2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 43,00% Memory free
4,00 Gb Paging File | 3,00 Gb Available in Paging File | 66,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 105,18 Gb Total Space | 47,42 Gb Free Space | 45,09% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: PMSACKS-PC
Current User Name: pmsacks
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Users\pmsacks\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Avant Browser\avantab.exe (Avant Force)
PRC - C:\Program Files\Avant Browser\avant.exe (Avant Force)
PRC - C:\Windows\System32\msfeedssync.exe (Microsoft Corporation)
PRC - C:\Program Files\Sony\VAIO Care\VCsystray.exe (Sony Corporation)
PRC - C:\Program Files\Sony\VAIO Care\VAIOCareService.exe (Sony Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - c:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe (Microsoft Corporation)
PRC - C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
PRC - c:\Program Files\Windows Defender\MpCmdRun.exe (Microsoft Corporation)
PRC - C:\Windows\System32\iashost.exe (Microsoft Corporation)
PRC - C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe (Sony Corporation)
PRC - C:\Program Files\Apoint\Apoint.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\Apoint\ApntEx.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\Apoint\ApMsgFwd.exe (Alps Electric Co., Ltd.)
PRC - C:\Windows\WindowsMobile\wmdSync.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe (Macrovision Corporation)
PRC - C:\Windows\VM_STI.EXE (BIGDOG)

========== Modules (SafeList) ==========

MOD - C:\Users\pmsacks\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\System32\vbscript.dll (Microsoft Corporation)
MOD - C:\Windows\System32\wbem\wmiutils.dll (Microsoft Corporation)
MOD - C:\Windows\System32\wbem\wbemsvc.dll (Microsoft Corporation)
MOD - C:\Windows\System32\wbem\wbemprox.dll (Microsoft Corporation)
MOD - C:\Windows\System32\wbem\fastprox.dll (Microsoft Corporation)
MOD - C:\Windows\System32\rsaenh.dll (Microsoft Corporation)
MOD - C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\GdiPlus.dll (Microsoft Corporation)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0\comctl32.dll (Microsoft Corporation)
MOD - C:\Windows\System32\wbem\wbemdisp.dll (Microsoft Corporation)
MOD - C:\Windows\System32\wbemcomn.dll (Microsoft Corporation)
MOD - C:\Windows\System32\sxs.dll (Microsoft Corporation)
MOD - C:\Windows\System32\msscript.ocx (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (SBAMSvc) -- File not found
SRV - (RoxLiveShare9) -- File not found
SRV - (MotoHelper.exe) -- File not found
SRV - (WPFFontCache_v0400) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe (Microsoft Corporation)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (FontCache) -- C:\Windows\System32\FntCache.dll (Microsoft Corporation)
SRV - (SampleCollector) Intel® -- C:\Program Files\Sony\VAIO Care\collsvc.exe (Intel Corporation)
SRV - (MSSQLServerADHelper100) -- c:\Program Files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE (Microsoft Corporation)
SRV - (sdCoreService) -- C:\Program Files\Spyware Doctor\pctsSvc.exe (PC Tools)
SRV - (MSSQL$SQLEXPRESS) SQL Server (SQLEXPRESS) -- c:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe (Microsoft Corporation)
SRV - (SQLAgent$SQLEXPRESS) SQL Server Agent (SQLEXPRESS) -- c:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE (Microsoft Corporation)
SRV - (sdAuxService) -- C:\Program Files\Spyware Doctor\pctsAuxs.exe (PC Tools)
SRV - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (WcesComm) -- C:\Windows\WindowsMobile\wcescomm.dll (Microsoft Corporation)
SRV - (RapiMgr) -- C:\Windows\WindowsMobile\rapimgr.dll (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV - (MEMSWEEP2) -- C:\Windows\System32\D700.tmp File not found
DRV - (LMIInfo) -- C:\Program Files\LogMeIn\x86\RaInfo.sys File not found
DRV - (Revoflt) -- C:\Windows\System32\drivers\revoflt.sys (VS Revo Group)
DRV - (LMIRfsClientNP) -- C:\Windows\System32\LMIRfsClientNP.dll (LogMeIn, Inc.)
DRV - (motmodem) -- C:\Windows\System32\drivers\motmodem.sys (Motorola)
DRV - (LMIRfsDriver) -- C:\Windows\System32\drivers\LMIRfsDriver.sys (LogMeIn, Inc.)
DRV - (NuidFltr) -- C:\Windows\System32\drivers\nuidfltr.sys (Microsoft Corporation)
DRV - (usbaudio) USB Audio Driver (WDM) -- C:\Windows\System32\drivers\USBAUDIO.sys (Microsoft Corporation)
DRV - (winusb) -- C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (PCTCore) -- C:\Windows\system32\drivers\PCTCore.sys (PC Tools)
DRV - (RsFx0103) -- C:\Windows\System32\drivers\RsFx0103.sys (Microsoft Corporation)
DRV - (SBRE) -- C:\Windows\System32\drivers\SBREDrv.sys (Sunbelt Software)
DRV - (sbtis) -- C:\Windows\System32\drivers\sbtis.sys (Sunbelt Software)
DRV - (sbapifs) -- C:\Windows\System32\drivers\sbapifs.sys (Sunbelt Software)
DRV - (athr) -- C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.)
DRV - (vncmirror) -- C:\Windows\System32\drivers\vncmirror.sys (RealVNC Ltd.)
DRV - (ti21sony) -- C:\Windows\System32\drivers\ti21sony.sys (Texas Instruments)
DRV - (Cdralw2k) -- C:\Windows\System32\drivers\cdralw2k.sys (Sonic Solutions)
DRV - (Cdr4_xp) -- C:\Windows\System32\drivers\cdr4_xp.sys (Sonic Solutions)
DRV - (SNC) -- C:\Windows\System32\drivers\SonyNC.sys (Sony Corporation)
DRV - (yukonwlh) -- C:\Windows\System32\drivers\yk60x86.sys (Marvell)
DRV - (igfx) -- C:\Windows\System32\drivers\igdkmd32.sys (Intel Corporation)
DRV - (ialm) -- C:\Windows\System32\drivers\igdkmd32.sys (Intel Corporation)
DRV - (ApfiltrService) -- C:\Windows\System32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)
DRV - (ql2300) -- C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)
DRV - (adp94xx) -- C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)
DRV - (elxstor) -- C:\Windows\system32\drivers\elxstor.sys (Emulex)
DRV - (adpahci) -- C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)
DRV - (uliahci) -- C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)
DRV - (iaStorV) -- C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)
DRV - (adpu320) -- C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)
DRV - (ulsata2) -- C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)
DRV - (vsmraid) -- C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (ql40xx) -- C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)
DRV - (UlSata) -- C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)
DRV - (adpu160m) -- C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)
DRV - (nvraid) -- C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)
DRV - (nfrd960) -- C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)
DRV - (iirsp) -- C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (SiSRaid4) -- C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)
DRV - (nvstor) -- C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)
DRV - (aic78xx) -- C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)
DRV - (arcsas) -- C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)
DRV - (LSI_SCSI) -- C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)
DRV - (SiSRaid2) -- C:\Windows\system32\drivers\sisraid2.sys (Silicon Integrated Systems Corp.)
DRV - (HpCISSs) -- C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)
DRV - (arc) -- C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)
DRV - (iteraid) -- C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)
DRV - (iteatapi) -- C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)
DRV - (LSI_SAS) -- C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)
DRV - (Symc8xx) -- C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)
DRV - (LSI_FC) -- C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)
DRV - (Sym_u3) -- C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)
DRV - (Mraid35x) -- C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)
DRV - (Sym_hi) -- C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)
DRV - (megasas) -- C:\Windows\system32\drivers\megasas.sys (LSI Logic Corporation)
DRV - (viaide) -- C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)
DRV - (cmdide) -- C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)
DRV - (aliide) -- C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) -- C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)
DRV - (BrFiltUp) -- C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)
DRV - (BrFiltLo) -- C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)
DRV - (BrSerWdm) -- C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)
DRV - (BrUsbMdm) -- C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)
DRV - (HSF_DPV) -- C:\Windows\System32\drivers\VSTDPV3.SYS (Conexant Systems, Inc.)
DRV - (HSFHWAZL) -- C:\Windows\System32\drivers\VSTAZL3.SYS (Conexant Systems, Inc.)
DRV - (winachsf) -- C:\Windows\System32\drivers\VSTCNXT3.SYS (Conexant Systems, Inc.)
DRV - (ntrigdigi) -- C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)
DRV - (E1G60) Intel® -- C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation)
DRV - (wanatw) WAN Miniport (ATW) -- C:\Windows\System32\drivers\wanatw4.sys (America Online, Inc.)
DRV - (DMICall) -- C:\Windows\System32\drivers\DMICall.sys (Sony Corporation)
DRV - (WimFltr) -- C:\Windows\System32\drivers\WimFltr.sys (Microsoft Corporation)
DRV - (ADM851X) -- C:\Windows\System32\drivers\ADM851X.sys (DAVICOM Semiconductor, Inc. )
DRV - (QCMerced) -- C:\Windows\System32\drivers\lvcm.sys ()
DRV - (LVUSBSta) -- C:\Windows\System32\drivers\LVUSBSta.sys (Logitech Inc.)
DRV - (ZSMC301b) -- C:\Windows\System32\drivers\usbVM31b.sys (VM)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sony.com/vaiopeople

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-203263742-2692646269-238311384-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data over 100 bytes]
IE - HKU\S-1-5-21-203263742-2692646269-238311384-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.bing.com/?pc=AVBR
IE - HKU\S-1-5-21-203263742-2692646269-238311384-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.mercedes-club-bg.com/
IE - HKU\S-1-5-21-203263742-2692646269-238311384-1005\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-203263742-2692646269-238311384-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Google"
FF - prefs.js..browser.search.defaulturl: "http://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q="
FF - prefs.js..extensions.enabledItems: [email protected]:1.0.13966

FF - HKLM\software\mozilla\Firefox\Extensions\\{3112ca9c-de6d-4884-a869-9855de68056c}: C:\ProgramData\Google\Toolbar for Firefox\{3112ca9c-de6d-4884-a869-9855de68056c} [2009.06.13 07:02:05 | 000,000,000 | ---D | M]

[2009.06.14 11:10:18 | 000,000,000 | ---D | M] -- C:\Users\pmsacks\AppData\Roaming\Mozilla\Extensions
[2009.06.14 11:24:45 | 000,000,000 | ---D | M] -- C:\Users\pmsacks\AppData\Roaming\Mozilla\Firefox\Profiles\w74jbost.default\extensions
[2009.06.14 11:24:44 | 000,000,000 | ---D | M] (Google Toolbar for Firefox) -- C:\Users\pmsacks\AppData\Roaming\Mozilla\Firefox\Profiles\w74jbost.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}

O1 HOSTS File: ([2010.06.24 07:14:52 | 000,000,911 | R--- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O1 - Hosts: 127.0.0.1 mynortonaccount.conxion.com
O1 - Hosts: 127.0.0.1 www.mynortonaccount.com
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (BitComet Helper) - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.8.7.dll (BitComet)
O3 - HKLM\..\Toolbar: (ImageShack Toolbar) - {6932D140-ABC4-4073-A44C-D4A541665E35} - C:\Program Files\ImageShackToolbar\ImageShackToolbar.dll (ImageShack Corp.)
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (no name) - {EBF2BA02-9094-4C5A-858B-BB198F3D8DE2} - No CLSID value found.
O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (no name) - {EBF2BA02-9094-4C5A-858B-BB198F3D8DE2} - No CLSID value found.
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [bigDogPath] C:\Windows\VM_STI.EXE (BIGDOG)
O4 - HKLM..\Run: [iSBMgr.exe] C:\Program Files\Sony\ISB Utility\ISBMgr.exe (Sony Corporation)
O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [Windows Mobile-based device management] C:\Windows\WindowsMobile\wmdSync.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-21-203263742-2692646269-238311384-1005..\Run: [iSUSPM] C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe (Macrovision Corporation)
O7 - HKU\S-1-5-21-203263742-2692646269-238311384-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: &D&ownload &with BitComet - C:\Program Files\BitComet\BitComet.exe (www.BitComet.com)
O8 - Extra context menu item: &D&ownload all video with BitComet - C:\Program Files\BitComet\BitComet.exe (www.BitComet.com)
O8 - Extra context menu item: &D&ownload all with BitComet - C:\Program Files\BitComet\BitComet.exe (www.BitComet.com)
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Post Image to Blog - C:\Program Files\ImageShackToolbar\ImageShackToolbar.dll (ImageShack Corp.)
O8 - Extra context menu item: Tag This Image - C:\Program Files\ImageShackToolbar\ImageShackToolbar.dll (ImageShack Corp.)
O8 - Extra context menu item: Transload Image to ImageShack - C:\Program Files\ImageShackToolbar\ImageShackToolbar.dll (ImageShack Corp.)
O8 - Extra context menu item: Upload All Images to ImageShack - C:\Program Files\ImageShackToolbar\ImageShackToolbar.dll (ImageShack Corp.)
O8 - Extra context menu item: Upload Image to ImageShack - C:\Program Files\ImageShackToolbar\ImageShackToolbar.dll (ImageShack Corp.)
O9 - Extra 'Tools' menuitem : Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - Reg Error: Value error. File not found
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O13 - gopher Prefix: missing
O15 - HKU\S-1-5-21-203263742-2692646269-238311384-1005\..Trusted Domains: aol.com ([objects] * is out of zone range - 5)
O15 - HKU\S-1-5-21-203263742-2692646269-238311384-1005\..Trusted Domains: google.com ([picasa] https in Trusted sites)
O15 - HKU\S-1-5-21-203263742-2692646269-238311384-1005\..Trusted Domains: imo.im ([]https in Trusted sites)
O15 - HKU\S-1-5-21-203263742-2692646269-238311384-1005\..Trusted Domains: zurla.net ([www] https in Trusted sites)
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab (Symantec AntiVirus scanner)
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab (Symantec RuFSI Utility Class)
O16 - DPF: {6932D140-ABC4-4073-A44C-D4A541665E35} http://toolbar.imageshack.us/toolbar/ImageShackToolbar.cab (ImageShack Toolbar)
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab (Java Plug-in 1.6.0)
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Java Plug-in 1.6.0_02)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Java Plug-in 1.6.0_03)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} http://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_intel_4.1.66.0.cab (SysInfo Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 91.193.156.4 91.193.156.5
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\Windows\System32\igfxdev.dll (Intel Corporation)
O20 - Winlogon\Notify\VESWinlogon: DllName - VESWinlogon.dll - C:\Windows\System32\VESWinlogon.dll (Sony Corporation)
O24 - Desktop WallPaper: C:\Users\pmsacks\AppData\Roaming\Microsoft\Internet Explorer\Internet Explorer Wallpaper.bmp
O24 - Desktop BackupWallPaper: C:\Users\pmsacks\AppData\Roaming\Microsoft\Internet Explorer\Internet Explorer Wallpaper.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.19 00:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{322e8162-7a0d-11df-ab21-b2e39df21c82}\Shell\AutoRun\command - "" = G:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\Fixer32.exe -- File not found
O33 - MountPoints2\{322e8162-7a0d-11df-ab21-b2e39df21c82}\Shell\open\command - "" = G:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\Fixer32.exe -- File not found
O33 - MountPoints2\{43ca9ad8-5459-11dc-b558-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{43ca9ad8-5459-11dc-b558-00038a000015}\Shell\AutoRun\command - "" = H:\LaunchU3.exe -- File not found
O33 - MountPoints2\H\Shell - "" = AutoRun
O33 - MountPoints2\H\Shell\AutoRun\command - "" = H:\LaunchU3.exe -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - File not found
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: Wmi - C:\Windows\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

Drivers32: aux - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: aux1 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: aux2 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: aux3 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: aux4 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: aux5 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: aux6 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi1 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi2 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi3 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi4 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi5 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi6 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midimapper - C:\Windows\System32\midimap.dll (Microsoft Corporation)
Drivers32: mixer - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: mixer1 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: mixer2 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: mixer3 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: mixer4 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: mixer5 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: mixer6 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: msacm.avis - C:\Windows\System32\ff_acm.acm ()
Drivers32: msacm.imaadpcm - C:\Windows\System32\imaadp32.acm (Microsoft Corporation)
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.msadpcm - C:\Windows\System32\msadp32.acm (Microsoft Corporation)
Drivers32: msacm.msg711 - C:\Windows\System32\msg711.acm (Microsoft Corporation)
Drivers32: msacm.msgsm610 - C:\Windows\System32\msgsm32.acm (Microsoft Corporation)
Drivers32: MSVideo - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.ffds - C:\Windows\System32\ff_vfw.dll ()
Drivers32: VIDC.I420 - C:\Windows\System32\lvcodec2.dll (Logitech Inc.)
Drivers32: VIDC.IYUV - C:\Windows\System32\iyuv_32.dll (Microsoft Corporation)
Drivers32: vidc.mrle - C:\Windows\System32\msrle32.dll (Microsoft Corporation)
Drivers32: vidc.msvc - C:\Windows\System32\msvidc32.dll (Microsoft Corporation)
Drivers32: VIDC.UYVY - C:\Windows\System32\msyuv.dll (Microsoft Corporation)
Drivers32: VIDC.YUY2 - C:\Windows\System32\msyuv.dll (Microsoft Corporation)
Drivers32: VIDC.YVU9 - C:\Windows\System32\tsbyuv.dll (Microsoft Corporation)
Drivers32: VIDC.YVYU - C:\Windows\System32\msyuv.dll (Microsoft Corporation)
Drivers32: wave - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wave1 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wave2 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wave3 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wave4 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wave5 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wave6 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wavemapper - C:\Windows\System32\msacm32.drv (Microsoft Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2010.07.19 11:17:24 | 000,574,976 | ---- | C] (OldTimer Tools) -- C:\Users\pmsacks\Desktop\OTL.exe
[2010.07.19 08:58:50 | 016,066,336 | ---- | C] (Oracle) -- C:\Users\pmsacks\Desktop\jre-6u21-windows-i586.exe
[2010.07.18 19:55:44 | 000,000,000 | ---D | C] -- C:\Program Files\Sophos
[2010.07.18 17:27:45 | 000,000,000 | ---D | C] -- C:\Users\pmsacks\AppData\Roaming\Malwarebytes
[2010.07.18 17:27:34 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2010.07.18 17:27:32 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2010.07.18 17:27:32 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010.07.18 17:27:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2010.07.11 18:01:00 | 000,000,000 | ---D | C] -- C:\Users\pmsacks\Desktop\New Folder
[2010.07.08 09:48:19 | 000,000,000 | ---D | C] -- C:\Users\pmsacks\Desktop\Metal Church
[2010.06.24 11:41:10 | 000,000,000 | ---D | C] -- C:\Users\pmsacks\AppData\Roaming\Avant Profiles
[2010.06.24 11:41:02 | 000,000,000 | ---D | C] -- C:\Program Files\Avant Browser
[2010.06.22 13:27:21 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft F#
[2010.06.22 11:46:49 | 000,000,000 | ---D | C] -- C:\Windows\System32\RsFx
[2010.06.22 11:44:38 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Visual Studio 9.0
[2010.06.22 11:28:18 | 000,000,000 | ---D | C] -- C:\Users\pmsacks\Documents\Visual Studio 2010
[2010.06.22 11:23:22 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft SDKs
[2010.06.22 11:23:22 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Help Viewer

========== Files - Modified Within 30 Days ==========

[2010.07.19 22:13:43 | 007,340,032 | ---- | M] () -- C:\Users\pmsacks\NTUSER.DAT
[2010.07.19 22:12:42 | 000,000,422 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{B6C1BFDC-B045-40A2-9D0B-976C849B0355}.job
[2010.07.19 21:47:00 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010.07.19 13:04:06 | 000,003,696 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010.07.19 13:04:06 | 000,003,696 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010.07.19 11:17:30 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Users\pmsacks\Desktop\OTL.exe
[2010.07.19 11:04:58 | 000,000,542 | ---- | M] () -- C:\Windows\tasks\Norton Internet Security - pmsacks - Full System Scan.job
[2010.07.19 08:59:42 | 016,066,336 | ---- | M] (Oracle) -- C:\Users\pmsacks\Desktop\jre-6u21-windows-i586.exe
[2010.07.19 08:52:04 | 000,821,800 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI
[2010.07.19 08:52:04 | 000,679,420 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2010.07.19 08:52:04 | 000,136,022 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2010.07.19 08:46:41 | 000,000,436 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts.ics
[2010.07.19 08:46:11 | 000,065,536 | ---- | M] () -- C:\Windows\System32\Ikeext.etl
[2010.07.19 08:46:01 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2010.07.19 00:25:59 | 000,524,288 | -HS- | M] () -- C:\Users\pmsacks\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms
[2010.07.19 00:25:59 | 000,065,536 | -HS- | M] () -- C:\Users\pmsacks\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf
[2010.07.19 00:25:51 | 003,717,956 | -H-- | M] () -- C:\Users\pmsacks\AppData\Local\IconCache.db
[2010.07.18 22:12:01 | 000,035,328 | ---- | M] () -- C:\Users\pmsacks\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.07.18 19:47:55 | 000,867,892 | ---- | M] () -- C:\Users\pmsacks\Desktop\SecurityCheck.exe
[2010.07.18 17:27:36 | 000,000,818 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.07.18 16:36:49 | 000,122,721 | ---- | M] () -- C:\Users\pmsacks\Desktop\fixer32.jpg
[2010.07.18 09:55:17 | 003,874,399 | ---- | M] () -- C:\Users\pmsacks\Desktop\IMG_8914.JPG
[2010.07.17 22:01:15 | 000,148,745 | ---- | M] () -- C:\Users\pmsacks\Desktop\spalnia1.jpg
[2010.07.17 21:57:21 | 000,149,245 | ---- | M] () -- C:\Users\pmsacks\Desktop\spalnia.jpg
[2010.07.17 21:40:46 | 000,153,529 | ---- | M] () -- C:\Users\pmsacks\Desktop\nisha.jpg
[2010.07.17 00:33:32 | 000,125,098 | ---- | M] () -- C:\test.xml
[2010.07.13 22:49:41 | 000,057,850 | ---- | M] () -- C:\Users\pmsacks\Desktop\Swedish-Inspiration-White-Apartment-in-Goteborg-12.jpg
[2010.07.13 22:49:40 | 000,043,516 | ---- | M] () -- C:\Users\pmsacks\Desktop\Swedish-Inspiration-White-Apartment-in-Goteborg-6.jpg
[2010.07.13 22:49:40 | 000,032,112 | ---- | M] () -- C:\Users\pmsacks\Desktop\Swedish-Inspiration-White-Apartment-in-Goteborg-7.jpg
[2010.07.13 18:51:47 | 000,610,634 | ---- | M] () -- C:\Users\pmsacks\Desktop\sofa_VkMSX_7287.jpg
[2010.07.11 18:02:25 | 014,044,692 | ---- | M] () -- C:\Users\pmsacks\Desktop\New Folder.rar
[2010.07.06 08:00:58 | 000,154,582 | ---- | M] () -- C:\Users\pmsacks\Desktop\Art_sex_porno258.jpg
[2010.07.06 07:59:30 | 000,396,310 | ---- | M] () -- C:\Users\pmsacks\Desktop\deisy-bloom.bmp
[2010.06.24 07:14:52 | 000,000,911 | R--- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2010.06.23 20:05:47 | 000,002,964 | ---- | M] () -- C:\Users\pmsacks\Desktop\imagesCAO9EHO3.jpg
[2010.06.20 11:22:41 | 000,299,448 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT

========== Files Created - No Company Name ==========

[2010.07.18 19:47:36 | 000,867,892 | ---- | C] () -- C:\Users\pmsacks\Desktop\SecurityCheck.exe
[2010.07.18 17:27:36 | 000,000,818 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.07.18 16:36:48 | 000,122,721 | ---- | C] () -- C:\Users\pmsacks\Desktop\fixer32.jpg
[2010.07.18 09:55:15 | 003,874,399 | ---- | C] () -- C:\Users\pmsacks\Desktop\IMG_8914.JPG
[2010.07.17 22:01:15 | 000,148,745 | ---- | C] () -- C:\Users\pmsacks\Desktop\spalnia1.jpg
[2010.07.17 21:57:20 | 000,149,245 | ---- | C] () -- C:\Users\pmsacks\Desktop\spalnia.jpg
[2010.07.17 21:40:46 | 000,153,529 | ---- | C] () -- C:\Users\pmsacks\Desktop\nisha.jpg
[2010.07.13 22:54:45 | 000,043,516 | ---- | C] () -- C:\Users\pmsacks\Desktop\Swedish-Inspiration-White-Apartment-in-Goteborg-6.jpg
[2010.07.13 22:54:14 | 000,032,112 | ---- | C] () -- C:\Users\pmsacks\Desktop\Swedish-Inspiration-White-Apartment-in-Goteborg-7.jpg
[2010.07.13 22:53:32 | 000,057,850 | ---- | C] () -- C:\Users\pmsacks\Desktop\Swedish-Inspiration-White-Apartment-in-Goteborg-12.jpg
[2010.07.13 18:54:07 | 000,610,634 | ---- | C] () -- C:\Users\pmsacks\Desktop\sofa_VkMSX_7287.jpg
[2010.07.11 18:02:09 | 014,044,692 | ---- | C] () -- C:\Users\pmsacks\Desktop\New Folder.rar
[2010.07.06 08:00:58 | 000,154,582 | ---- | C] () -- C:\Users\pmsacks\Desktop\Art_sex_porno258.jpg
[2010.07.06 07:59:29 | 000,396,310 | ---- | C] () -- C:\Users\pmsacks\Desktop\deisy-bloom.bmp
[2010.06.23 20:07:24 | 000,002,964 | ---- | C] () -- C:\Users\pmsacks\Desktop\imagesCAO9EHO3.jpg
[2010.06.19 09:46:54 | 000,085,504 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll
[2009.10.07 19:28:45 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009.05.14 15:29:30 | 000,008,520 | ---- | C] () -- C:\Windows\System32\ractrlkeyhook.dll
[2008.02.24 19:56:18 | 000,077,824 | ---- | C] () -- C:\Windows\System32\hccutils.dll
[2008.02.24 19:56:18 | 000,061,440 | ---- | C] () -- C:\Windows\System32\igfxTMM.dll
[2008.02.24 19:56:18 | 000,053,248 | ---- | C] () -- C:\Windows\System32\oemdspif.dll
[2008.02.24 19:56:17 | 000,204,800 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1151.dll
[2007.11.07 16:07:02 | 000,000,221 | ---- | C] () -- C:\Windows\NCLogConfig.ini
[2007.07.11 16:30:39 | 001,317,152 | ---- | C] () -- C:\Windows\System32\drivers\lvcm.sys
[2007.07.11 16:30:39 | 000,009,255 | ---- | C] () -- C:\Windows\System32\lvcoinst.ini
[2007.05.08 12:59:20 | 000,532,480 | ---- | C] () -- C:\Windows\System32\CddbPlaylist2Sony.dll
[2007.02.24 21:59:14 | 000,000,000 | ---- | C] () -- C:\Windows\VAIOUpdt.INI
[2006.11.02 15:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 10:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini

========== LOP Check ==========

[2010.06.13 08:00:55 | 000,000,000 | ---D | M] -- C:\Users\pmsacks\AppData\Roaming\Auslogics
[2010.03.11 19:38:10 | 000,000,000 | ---D | M] -- C:\Users\pmsacks\AppData\Roaming\BSplayer
[2009.10.29 16:10:03 | 000,000,000 | ---D | M] -- C:\Users\pmsacks\AppData\Roaming\BSplayer Pro
[2010.03.28 15:25:56 | 000,000,000 | ---D | M] -- C:\Users\pmsacks\AppData\Roaming\Facebook
[2009.10.23 17:35:48 | 000,000,000 | ---D | M] -- C:\Users\pmsacks\AppData\Roaming\GHISLER
[2009.06.15 16:32:07 | 000,000,000 | ---D | M] -- C:\Users\pmsacks\AppData\Roaming\ICAClient
[2008.10.01 12:01:35 | 000,000,000 | ---D | M] -- C:\Users\pmsacks\AppData\Roaming\Image Zone Express
[2010.01.19 14:50:58 | 000,000,000 | ---D | M] -- C:\Users\pmsacks\AppData\Roaming\Notepad++
[2007.07.06 15:14:13 | 000,000,000 | ---D | M] -- C:\Users\pmsacks\AppData\Roaming\PeerNetworking
[2007.08.01 12:45:39 | 000,000,000 | ---D | M] -- C:\Users\pmsacks\AppData\Roaming\Printer Info Cache
[2007.08.23 14:46:54 | 000,000,000 | ---D | M] -- C:\Users\pmsacks\AppData\Roaming\SmartDraw
[2010.06.17 15:59:24 | 000,000,000 | ---D | M] -- C:\Users\pmsacks\AppData\Roaming\Tific
[2010.05.13 14:01:34 | 000,000,000 | ---D | M] -- C:\Users\pmsacks\AppData\Roaming\uTorrent
[2010.07.19 00:26:01 | 000,032,612 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2010.07.19 22:12:42 | 000,000,422 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{B6C1BFDC-B045-40A2-9D0B-976C849B0355}.job

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2008.01.15 17:07:03 | 000,001,024 | ---- | M] () -- C:\.rnd
[2006.09.19 00:43:36 | 000,000,024 | ---- | M] () -- C:\autoexec.bat
[2009.04.11 09:36:36 | 000,333,257 | RHS- | M] () -- C:\bootmgr
[2008.02.24 19:25:33 | 000,008,192 | R-S- | M] () -- C:\BOOTSECT.BAK
[2006.09.19 00:43:37 | 000,000,010 | ---- | M] () -- C:\config.sys
[2009.08.29 08:08:20 | 000,000,775 | -H-- | M] () -- C:\IPH.PH
[2010.07.19 08:45:42 | 2450,989,056 | -HS- | M] () -- C:\pagefile.sys
[2009.08.29 08:08:20 | 000,000,297 | -H-- | M] () -- C:\T4Metrics.log
[2010.07.17 00:33:32 | 000,125,098 | ---- | M] () -- C:\test.xml
[2007.05.08 13:10:47 | 000,389,980 | ---- | M] () -- C:\vcredist_x86.log

< %systemroot%\Fonts\*.com >
[2006.11.02 15:37:12 | 000,026,040 | ---- | M] () -- C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2006.11.02 15:37:12 | 000,026,489 | ---- | M] () -- C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2006.11.02 15:37:12 | 000,029,779 | ---- | M] () -- C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009.10.07 19:48:56 | 000,037,665 | ---- | M] () -- C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2006.09.19 00:37:34 | 000,000,065 | ---- | M] () -- C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.wt >

< %systemroot%\system32\*.ruy >

< %systemroot%\system32\*.jpg >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008.01.19 10:34:28 | 000,089,600 | ---- | M] (Hewlett-Packard Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\HPZPPLHN.DLL
[2006.11.02 15:35:48 | 000,022,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\jnwppr.dll
[2009.12.07 21:06:46 | 000,047,416 | ---- | M] (LogMeIn, Inc.) -- C:\Windows\System32\spool\prtprocs\w32x86\LMIproc.dll
[2006.10.27 05:56:12 | 000,033,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\msonpppr.dll

< %APPDATA%\Update\*.* >

< %APPDATA%\Microsoft\*.* >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %PROGRAMFILES%\*.* >
[2009.08.29 07:14:58 | 000,000,174 | -HS- | M] () -- C:\Program Files\desktop.ini
[2007.08.27 17:14:38 | 010,342,366 | ---- | M] () -- C:\Program Files\Windows6.0-KB938979-x86.msu

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[2009.03.08 14:31:42 | 000,348,160 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\dxtmsft.dll
[2009.03.08 14:31:37 | 000,216,064 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\dxtrans.dll
[2009.04.11 09:27:47 | 000,241,128 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\rsaenh.dll
[2009.04.11 09:28:23 | 000,228,352 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\SLC.dll
[2010.03.05 17:01:02 | 000,420,352 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\vbscript.dll

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2006.11.02 13:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV
[2006.11.02 13:34:05 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV
[2006.11.02 13:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV
[2006.11.02 13:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV
[2006.11.02 13:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV

< %systemroot%\system32\user32.dll /md5 >
[2009.04.11 09:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\user32.dll

< %systemroot%\system32\ws2_32.dll /md5 >
[2008.01.19 10:37:09 | 000,179,200 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\ws2_32.dll

< %systemroot%\system32\ws2help.dll /md5 >
[2006.11.02 12:44:30 | 000,004,608 | ---- | M] (Microsoft Corporation) MD5=17C0671BF57057108A6D949510EE42C8 -- C:\Windows\System32\ws2help.dll

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-07-19 05:51:17

========== Alternate Data Streams ==========

@Alternate Data Stream - 214 bytes -> C:\ProgramData\TEMP:DFC5A2B2
@Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:63238B95
< End of report >

OTL Extras logfile created on: 19.7.2010 г. 22:07:36 - Run 2
OTL by OldTimer - Version 3.2.9.1 Folder = C:\Users\pmsacks\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18928)
Locale: 00000402 | Country: Bulgaria | Language: BGR | Date Format: d.M.yyyy 'г.'

2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 43,00% Memory free
4,00 Gb Paging File | 3,00 Gb Available in Paging File | 66,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 105,18 Gb Total Space | 47,42 Gb Free Space | 45,09% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: PMSACKS-PC
Current User Name: pmsacks
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 30 Days
Output = Minimal

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = Reg Error: Key error.] -- Reg Error: Key error. File not found

[HKEY_USERS\.DEFAULT\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe File not found

[HKEY_USERS\S-1-5-18\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- Reg Error: Key error.
htmlfile [opennew] -- Reg Error: Key error.
htmlfile [print] -- Reg Error: Key error.
http [open] -- Reg Error: Key error.
https [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Winamp.Bookmark] -- "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"UacDisableNotify" = 1
"InternetSettingsDisableNotify" = 1
"AutoUpdateDisableNotify" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{03DECCAD-65A3-4609-9DFA-98EB29E47F73}" = lport=12345 | protocol=6 | dir=in | name=motorola helper |
"{079E0414-2312-4A68-A3B3-AECDA4C43A88}" = rport=2869 | protocol=6 | dir=out | app=system |
"{085F3C34-D909-471B-9C73-7ED3F01E4DEE}" = lport=12345 | protocol=6 | dir=in | name=motorola helper |
"{095AD5DB-FAA4-4493-87EE-4778E83098D3}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{19F111F3-12AA-4D73-9D88-7E5C9E15CFB7}" = lport=12345 | protocol=6 | dir=in | name=motorola helper |
"{21904915-5C5C-4738-98CC-3AF89CBC6707}" = lport=12345 | protocol=6 | dir=in | name=motorola helper |
"{274AA65F-FB7B-45A5-9663-E9DF0600A302}" = lport=12345 | protocol=6 | dir=in | name=motorola helper |
"{2D3F01CF-62F8-43CF-B5BB-8D8A81D4393D}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{3244F6BC-736B-4187-87B3-F5335D9F492B}" = lport=12345 | protocol=6 | dir=in | name=motorola helper |
"{324AAF92-8C7E-412D-AC83-9A219036BF4B}" = lport=2869 | protocol=6 | dir=in | app=system |
"{34344FC6-DF68-4F9A-90D4-88791A9F7FF1}" = lport=12345 | protocol=6 | dir=in | name=motorola helper |
"{414E29C3-9667-439F-9F82-0DB8F77E5F5A}" = lport=12345 | protocol=6 | dir=in | name=motorola helper |
"{48DBFC4C-E95D-4C4F-926E-10587FA2FB5D}" = lport=12345 | protocol=6 | dir=in | name=motorola helper |
"{522BE19E-7E16-4C40-979F-FD1A3A670F7A}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{53F1DC3A-99EF-4955-977F-98E03B98D7C8}" = lport=12345 | protocol=6 | dir=in | name=motorola helper |
"{57416AC4-4FA5-4125-B5ED-53A74B39CE70}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe |
"{6408674B-36A5-491C-90C0-331E34865560}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{771E2179-1CB1-4610-89C6-A6DB475763B4}" = lport=2869 | protocol=6 | dir=in | app=system |
"{80FF1206-BABB-49CB-8932-FCEBC20D7976}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{8519C654-A1D7-4867-B6F3-E0C7B1E1BE2A}" = lport=547 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{8F0D5643-F826-40E6-9E63-8AA3476D8DAC}" = lport=10243 | protocol=6 | dir=in | app=system |
"{8FFED2E9-799F-4385-AFF7-FFD26F9931C7}" = rport=10243 | protocol=6 | dir=out | app=system |
"{9A18527A-696B-46EC-B74C-427361671779}" = lport=12345 | protocol=6 | dir=in | name=motorola helper |
"{A946AFA8-8232-45DE-9DC1-5FF33BBB7DEA}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{AAEF747A-1A2E-46E4-919A-769EEB2DDB39}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{B1841EA4-01F0-48A8-ADB4-1CD50149B973}" = lport=12345 | protocol=6 | dir=in | name=motorola helper |
"{B3DFCC0D-32AA-4E02-BDFE-8D5D501381BD}" = lport=808 | protocol=6 | dir=in | svc=nettcpactivator | app=%systemroot%\microsoft.net\framework\v3.0\windows communication foundation\smsvchost.exe |
"{CD6E1FCA-36D6-4EBD-BA71-43BD99E9740D}" = lport=12345 | protocol=6 | dir=in | name=motorola helper |
"{D9467B3B-8B7E-4697-98BD-B50C2E89D6AF}" = lport=68 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{D9CCC334-DA89-4175-9271-A280C0CFD777}" = lport=12345 | protocol=6 | dir=in | name=motorola helper |
"{DA5CAFA5-7216-4B98-9416-17AB9F6AABE0}" = lport=12345 | protocol=6 | dir=in | name=motorola helper |
"{DB061537-CD71-4433-B38A-311E8BEA0966}" = lport=12345 | protocol=6 | dir=in | name=motorola helper |
"{DB0CF38F-23CE-43FC-82FE-748585B5F5CE}" = lport=53 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{FB76E796-E261-4DE4-B107-FD059BE354B8}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{FCADD9B3-7B70-4EAC-BE71-E3164A06254D}" = lport=67 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{16A25056-97B0-4059-A76B-DFB7071B4282}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{29F678CB-361A-4173-A84D-61F724145299}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{2FB12362-12C7-4446-9B07-1F92B140DE1B}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{386E9F76-6387-441F-8290-E5B6381999B8}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{39521C5D-1B27-40BC-84E4-F08955481084}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{43C7CA55-C732-47BD-8993-21A73C0E6577}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{4EC60089-5F11-4C08-9E2D-82560FF40632}" = protocol=6 | dir=out | app=system |
"{5C7E6F89-7468-4D54-9449-5AB6D230F10F}" = protocol=58 | dir=in | [email protected],-148 |
"{6539706F-57C6-45E2-B924-FA32A6F03114}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{8AD14E41-E0E9-4B9D-945B-1457B68ABFE7}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{910093B9-BD97-40FE-9CB8-3522833C639B}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{9DE7A48A-EA23-44A6-B1FD-7BBB26DF0CCB}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{B8301703-4B40-4B78-B8D2-B4B5DF02F5BE}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{D4996661-332F-45E0-912A-8853B6C4A5B2}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{F8CC9AE2-CDBA-4B11-A425-0BA7B0A949F5}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{FC9745F2-AA26-4015-AB07-7153FD2B7D17}" = dir=out | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"TCP Query User{51D2EB8F-7702-4415-9460-22021CA698A2}C:\program files\totalcmd\totalcmd.exe" = protocol=6 | dir=in | app=c:\program files\totalcmd\totalcmd.exe |
"TCP Query User{8532E55A-E11B-4D99-A57A-B53955709A3C}C:\program files\totalcmd\totalcmd.exe" = protocol=6 | dir=in | app=c:\program files\totalcmd\totalcmd.exe |
"TCP Query User{CA62ECEE-A6BA-4B8F-A1A1-551FAF749028}C:\program files\bitcomet\bitcomet.exe" = protocol=6 | dir=in | app=c:\program files\bitcomet\bitcomet.exe |
"TCP Query User{D7A2C7AE-78EE-404E-A1AA-0490006326A4}C:\program files\bitcomet\bitcomet.exe" = protocol=6 | dir=in | app=c:\program files\bitcomet\bitcomet.exe |
"TCP Query User{DCE64B30-5C34-49F9-8992-8D01071EE94A}C:\program files\java\jre6\bin\java.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\java.exe |
"UDP Query User{0DE63AA8-9B6D-47BB-B326-95E40297CD43}C:\program files\totalcmd\totalcmd.exe" = protocol=17 | dir=in | app=c:\program files\totalcmd\totalcmd.exe |
"UDP Query User{46665569-9109-4C34-9D7B-AEBC13A07449}C:\program files\bitcomet\bitcomet.exe" = protocol=17 | dir=in | app=c:\program files\bitcomet\bitcomet.exe |
"UDP Query User{4F419DDE-EE59-4468-B5D8-CD0191029755}C:\program files\bitcomet\bitcomet.exe" = protocol=17 | dir=in | app=c:\program files\bitcomet\bitcomet.exe |
"UDP Query User{7E839C9D-BB0D-42FC-8C74-380E479268E5}C:\program files\totalcmd\totalcmd.exe" = protocol=17 | dir=in | app=c:\program files\totalcmd\totalcmd.exe |
"UDP Query User{BA0570CF-E618-4ACF-8AFE-4C827FC170BA}C:\program files\java\jre6\bin\java.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\java.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{196E77C5-F524-4B50-BD1A-2C21EEE9B8F7}" = Microsoft SQL Server 2008 Common Files
"{2012098D-EEE9-4769-8DD3-B038050854D4}" = Microsoft Silverlight 3 SDK
"{223A0070-C924-48E3-AEB6-2E06CC835CC0}" = VAIO Care
"{26A24AE4-039D-4CA4-87B4-2F83216015FF}" = Java 6 Update 20
"{27B6D024-FD7E-4A88-BC17-5AFBE33EC072}" = Microsoft F# Runtime for Silvelight 4
"{2A0F3EF9-68EE-49E9-A05B-ED5B82DF63E5}" = Wireless Switch Setting Utility
"{3248F0A8-6813-11D6-A77B-00B0D0160000}" = Java SE Runtime Environment 6
"{3248F0A8-6813-11D6-A77B-00B0D0160020}" = Java 6 Update 2
"{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java 6 Update 3
"{33AE9E89-47C9-4A0D-9E9D-BDD6966A3804}" = Microsoft SQL Server 2008 RsFx Driver
"{36C5BBF0-E5BF-4DE1-B684-7E90B0C93FB5}" = VAIO Care
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{44CDBD1B-89FB-4E02-8319-2A4C550F664A}" = RTC Client API v1.2
"{47C39E4A-28F2-33B1-B9B7-97F24E52D917}" = Microsoft Help Viewer 1.0
"{4815BD99-96A4-49FE-A885-DCF06E9E4E78}" = Microsoft SQL Server 2008 Database Engine Shared
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A6F34E2-09E5-4616-B227-4A26A488A6F9}" = Microsoft SQL Server 2008 Common Files
"{558358E5-E4F3-4374-BA1D-26FF39EF87D9}" = Microsoft Silverlight 4 Tools for Visual Studio 2010
"{58721EC3-8D4E-4B79-BC51-1054E2DDCD10}" = Microsoft SQL Server 2008 Database Engine Services
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{67579783-0FB7-4F7B-B881-E5BE47C9DBE0}_is1" = Revo Uninstaller Pro 2.1.5
"{6D52C408-B09A-4520-9B18-475B81D393F1}" = Microsoft Works
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{801B0DA3-A3FF-46CC-B97F-D76D510AF5AE}" = Microsoft Silverlight 4 SDK
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8BCD7AE7-F713-4D50-BAB9-7839B9386870}" = ImageShack Uploader 2.2.0
"{8DC42D05-680B-41B0-8878-6C14D24602DB}" = QuickTime
"{8DCE550C-CA43-4E82-92DF-FFC4A48F5BE1}" = Napster Burn Engine
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_STANDARDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_STANDARDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_STANDARDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_STANDARDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_STANDARDR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_STANDARDR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_STANDARDR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_STANDARDR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_STANDARDR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-0012-0000-0000-0000000FF1CE}" = Microsoft Office Standard 2007
"{91120000-0012-0000-0000-0000000FF1CE}_STANDARDR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-0012-0000-0000-0000000FF1CE}_STANDARDR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{91208A47-5D08-4C79-986F-1931940F51BB}" = QuickBooks Product Listing Service
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{95120000-0122-0409-0000-0000000FF1CE}" = Microsoft Office Outlook Connector
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = Alps Pointing-device for VAIO
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{AC76BA86-7AD7-1033-7B44-A81200000003}" = Adobe Reader 8.1.2
"{AE3CF174-872C-46C6-B9F6-C0593F3BC7B8}" = Microsoft Office Live Add-in 1.4
"{B5153233-9AEE-4CD4-9D2C-4FAAC870DBE2}" = Microsoft SQL Server 2008 Database Engine Services
"{C965F01C-76EA-4BD7-973E-46236AE312D7}" = Sql Server Customer Experience Improvement Program
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{EBFEEB3F-3E3B-4725-A4E0-376144CE4F76}" = Citrix XenApp Web Plugin
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F1E63043-54FC-429B-AB2C-31AF9FBA4BC7}" = 32 Bit HP CIO Components Installer
"{F3494AB6-6900-41C6-AF57-823626827ED8}" = Microsoft SQL Server 2008 Database Engine Shared
"{F7FC9307-374E-4017-8E9D-DE1154780480}" = System Requirements Lab for Intel
"7-Zip" = 7-Zip 9.13 beta
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"AvantBrowser" = Avant Browser (remove only)
"BitComet" = BitComet 1.05
"BSPlayerf" = BS.Player FREE
"Combined Community Codec Pack_is1" = Combined Community Codec Pack 2009-09-09
"ffdshow_is1" = ffdshow [rev 3154] [2009-12-09]
"HDMI" = Intel® Graphics Media Accelerator Driver
"HijackThis" = HijackThis 2.0.0
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft Help Viewer 1.0" = Microsoft Help Viewer 1.0
"Notepad++" = Notepad++
"Picasa 3" = Picasa 3
"Recover My Files_is1" = Recover My Files
"Sophos-AntiRootkit" = Sophos Anti-Rootkit 1.5.4
"Spyware Doctor" = Spyware Doctor 6.1
"STANDARDR" = Microsoft Office Standard 2007
"Totalcmd" = Total Commander (Remove or Repair)
"ViewpointMediaPlayer" = Viewpoint Media Player
"Winamp" = Winamp
"WinRAR archiver" = WinRAR archiver

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-203263742-2692646269-238311384-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Facebook Plug-In" = Facebook Plug-In
"Winamp Detect" = Winamp Detector Plug-in

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 9.7.2010 г. 18:56:22 | Computer Name = pmsacks-PC | Source = MsiInstaller | ID = 11714
Description =

Error - 11.7.2010 г. 10:35:07 | Computer Name = pmsacks-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

Error - 11.7.2010 г. 10:56:31 | Computer Name = pmsacks-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

Error - 13.7.2010 г. 15:55:12 | Computer Name = pmsacks-PC | Source = Application Error | ID = 1000
Description = Faulting application avantab.exe, version 11.8.0.3, time stamp 0x4c1f3bb4,
faulting module mshtml.dll, version 8.0.6001.18928, time stamp 0x4bdfb76d, exception
code 0xc0000005, fault offset 0x000d68f5, process id 0x1134, application start time
0x01cb21a774913700.

Error - 14.7.2010 г. 08:51:13 | Computer Name = pmsacks-PC | Source = Application Error | ID = 1000
Description = Faulting application avantab.exe, version 11.8.0.3, time stamp 0x4c1f3bb4,
faulting module avantab.exe, version 11.8.0.3, time stamp 0x4c1f3bb4, exception
code 0xc00000fd, fault offset 0x0010f3df, process id 0x744, application start time
0x01cb234e0718fb10.

Error - 18.7.2010 г. 07:38:11 | Computer Name = pmsacks-PC | Source = MsiInstaller | ID = 11714
Description =

Error - 18.7.2010 г. 09:31:34 | Computer Name = pmsacks-PC | Source = Application Error | ID = 1000
Description = Faulting application svchost.exe_RemoteAccess, version 6.0.6001.18000,
time stamp 0x47918b89, faulting module ntdll.dll, version 6.0.6002.18005, time
stamp 0x49e03821, exception code 0xc0000005, fault offset 0x00067409, process id
0x45c, application start time 0x01cb267d624276ec.

Error - 18.7.2010 г. 15:19:14 | Computer Name = pmsacks-PC | Source = MsiInstaller | ID = 11714
Description =

Error - 19.7.2010 г. 02:03:02 | Computer Name = pmsacks-PC | Source = MsiInstaller | ID = 11714
Description =

Error - 19.7.2010 г. 04:24:40 | Computer Name = pmsacks-PC | Source = Application Hang | ID = 1002
Description = The program OTL.exe version 3.2.9.1 stopped interacting with Windows
and was closed. To see if more information about the problem is available, check
the problem history in the Problem Reports and Solutions control panel. Process
ID: 1438 Start Time: 01cb271ae0c3c370 Termination Time: 23

[ Media Center Events ]
Error - 30.10.2009 г. 03:54:13 | Computer Name = pmsacks-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

[ System Events ]
Error - 19.7.2010 г. 01:47:01 | Computer Name = pmsacks-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 19.7.2010 г. 01:47:01 | Computer Name = pmsacks-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 19.7.2010 г. 01:48:24 | Computer Name = pmsacks-PC | Source = ipnathlp | ID = 31004
Description = The DNS proxy agent was unable to allocate 0 bytes of memory. This
may indicate that the system is low on virtual memory, or that the memory manager
has encountered an internal error.

Error - 19.7.2010 г. 01:52:47 | Computer Name = pmsacks-PC | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20
Description =

Error - 19.7.2010 г. 02:37:53 | Computer Name = pmsacks-PC | Source = ipnathlp | ID = 31004
Description = The DNS proxy agent was unable to allocate 0 bytes of memory. This
may indicate that the system is low on virtual memory, or that the memory manager
has encountered an internal error.

Error - 19.7.2010 г. 04:04:15 | Computer Name = pmsacks-PC | Source = ipnathlp | ID = 31004
Description = The DNS proxy agent was unable to allocate 0 bytes of memory. This
may indicate that the system is low on virtual memory, or that the memory manager
has encountered an internal error.

Error - 19.7.2010 г. 04:04:34 | Computer Name = pmsacks-PC | Source = ipnathlp | ID = 31004
Description = The DNS proxy agent was unable to allocate 0 bytes of memory. This
may indicate that the system is low on virtual memory, or that the memory manager
has encountered an internal error.

Error - 19.7.2010 г. 14:47:06 | Computer Name = pmsacks-PC | Source = ipnathlp | ID = 31004
Description = The DNS proxy agent was unable to allocate 0 bytes of memory. This
may indicate that the system is low on virtual memory, or that the memory manager
has encountered an internal error.

Error - 19.7.2010 г. 14:47:24 | Computer Name = pmsacks-PC | Source = ipnathlp | ID = 31004
Description = The DNS proxy agent was unable to allocate 0 bytes of memory. This
may indicate that the system is low on virtual memory, or that the memory manager
has encountered an internal error.

Error - 19.7.2010 г. 14:47:28 | Computer Name = pmsacks-PC | Source = ipnathlp | ID = 31004
Description = The DNS proxy agent was unable to allocate 0 bytes of memory. This
may indicate that the system is low on virtual memory, or that the memory manager
has encountered an internal error.

< End of report >

19 юли 201016 г.

Ето какво следва:

Стъпка 1

Стартирайте пак OTL.exe и с Copy/ Paste под колонката Custom Scans/Fixes въведете скриптовия текст от текста в бялото поле по-долу, като не забравяте да копирате скрипта 1 към 1, както и двете точки преди първия ред на скрипта!


:OTL

SRV - (SBAMSvc) -- File not found

SRV - (RoxLiveShare9) -- File not found

SRV - (MotoHelper.exe) -- File not found

DRV - (LMIInfo) -- C:\Program Files\LogMeIn\x86\RaInfo.sys File not found

O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (no name) - {EBF2BA02-9094-4C5A-858B-BB198F3D8DE2} - No CLSID value found.

O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (no name) - {EBF2BA02-9094-4C5A-858B-BB198F3D8DE2} - No CLSID value found.

O9 - Extra 'Tools' menuitem : Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - Reg Error: Value error. File not found

O13 - gopher Prefix: missing

O15 - HKU\S-1-5-21-203263742-2692646269-238311384-1005\..Trusted Domains: aol.com ([objects] * is out of zone range - 5)

O15 - HKU\S-1-5-21-203263742-2692646269-238311384-1005\..Trusted Domains: google.com ([picasa] https in Trusted sites)

O15 - HKU\S-1-5-21-203263742-2692646269-238311384-1005\..Trusted Domains: imo.im ([]https in Trusted sites)

O15 - HKU\S-1-5-21-203263742-2692646269-238311384-1005\..Trusted Domains: zurla.net ([www] https in Trusted sites)

O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.ma...r/ultrashim.cab (Reg Error: Key error.)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_20)

O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.ma...r/ultrashim.cab (Reg Error: Key error.)

O16 - DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0)

O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_02)

O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_03)

O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_20)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_20)

O33 - MountPoints2\{322e8162-7a0d-11df-ab21-b2e39df21c82}\Shell\AutoRun\command - "" = G:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\Fixer32.exe -- File not found

O33 - MountPoints2\{322e8162-7a0d-11df-ab21-b2e39df21c82}\Shell\open\command - "" = G:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\Fixer32.exe -- File not found

O33 - MountPoints2\{43ca9ad8-5459-11dc-b558-00038a000015}\Shell - "" = AutoRun

O33 - MountPoints2\{43ca9ad8-5459-11dc-b558-00038a000015}\Shell\AutoRun\command - "" = H:\LaunchU3.exe -- File not found

O33 - MountPoints2\H\Shell - "" = AutoRun

O33 - MountPoints2\H\Shell\AutoRun\command - "" = H:\LaunchU3.exe -- File not found

O34 - HKLM BootExecute: (autocheck autochk *) - File not found

@Alternate Data Stream - 214 bytes -> C:\ProgramData\TEMP:DFC5A2B2

@Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:63238B95


:Commands

[purity]

[resethosts]

[emptytemp]

[Reboot]

След като въведете скрипта натиснете бутона, маркиран в червено: Run Fix. Ще се създаде лог файл. Публикувайте съдържанието му в следващия си коментар.

Стъпка 2

Следвайте следната инструкция за работа с TDSSKiller.

Изтеглете TDSSKiller (zip архив) и го разархивирайте на вашия десктоп.
Закачих файла fix.bat като ZIP архив към този коментар. Изтеглете го и го разархивирайте на десктопа. Стартирайте fix.bat и публикувайте лог файла или го прикачете в следващия си коментар.

Стъпка 3

Стартирайте отново OTL и натиснете бутона Quick Scan. Когато свърши сканирането, публикувайте съдържанието на лога от OTL в следващия си коментар.

P.S. Ще оставим за по-нататък ъпдейта на Java.

20 юли 201016 г.

Автор

Благосаря за съветите.

Стъпка 1

All processes killed
========== OTL ==========
Service SBAMSvc stopped successfully!
Service SBAMSvc deleted successfully!
File File not found not found.
Service RoxLiveShare9 stopped successfully!
Service RoxLiveShare9 deleted successfully!
File File not found not found.
Service MotoHelper.exe stopped successfully!
Service MotoHelper.exe deleted successfully!
File File not found not found.
Service LMIInfo stopped successfully!
Service LMIInfo deleted successfully!
File C:\Program Files\LogMeIn\x86\RaInfo.sys File not found not found.
Registry value HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}\ not found.
Registry value HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{85d1f590-48f4-11d9-9669-0800200c9a66}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{85d1f590-48f4-11d9-9669-0800200c9a66}\ not found.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\Prefixes\\gopher|:gopher:// /E : value set successfully!
Registry key HKEY_USERS\S-1-5-21-203263742-2692646269-238311384-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\aol.com\objects\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-203263742-2692646269-238311384-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\google.com\picasa\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-203263742-2692646269-238311384-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\imo.im\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-203263742-2692646269-238311384-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\zurla.net\www\ deleted successfully.
Starting removal of ActiveX control {8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
C:\Windows\Downloaded Program Files\erma.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Starting removal of ActiveX control {8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{322e8162-7a0d-11df-ab21-b2e39df21c82}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{322e8162-7a0d-11df-ab21-b2e39df21c82}\ not found.
File G:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\Fixer32.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{322e8162-7a0d-11df-ab21-b2e39df21c82}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{322e8162-7a0d-11df-ab21-b2e39df21c82}\ not found.
File G:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\Fixer32.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{43ca9ad8-5459-11dc-b558-00038a000015}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{43ca9ad8-5459-11dc-b558-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{43ca9ad8-5459-11dc-b558-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{43ca9ad8-5459-11dc-b558-00038a000015}\ not found.
File H:\LaunchU3.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\H\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\H\ not found.
File H:\LaunchU3.exe not found.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session manager\\BootExecute:autocheck autochk * deleted successfully.
ADS C:\ProgramData\TEMP:DFC5A2B2 deleted successfully.
ADS C:\ProgramData\TEMP:63238B95 deleted successfully.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: Administrator

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 83 bytes

User: Default User

User: pmsacks
->Temp folder emptied: 8995664 bytes
->Temporary Internet Files folder emptied: 23440904 bytes
->Java cache emptied: 42124931 bytes
->FireFox cache emptied: 79937149 bytes
->Apple Safari cache emptied: 1291264 bytes
->Flash cache emptied: 159113 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 667339 bytes
RecycleBin emptied: 581139445 bytes

Total Files Cleaned = 704,00 mb

OTL by OldTimer - Version 3.2.9.1 log created on 07202010_211349

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

Стъпка 2

21:38:13:941 4016 TDSS rootkit removing tool 2.3.2.2 Jun 30 2010 17:23:49
21:38:13:941 4016 ================================================================================
21:38:13:941 4016 SystemInfo:

21:38:13:942 4016 OS Version: 6.0.6002 ServicePack: 2.0
21:38:13:942 4016 Product type: Workstation
21:38:13:942 4016 ComputerName: PMSACKS-PC
21:38:13:942 4016 UserName: pmsacks
21:38:13:943 4016 Windows directory: C:\Windows
21:38:13:943 4016 System windows directory: C:\Windows
21:38:13:943 4016 Processor architecture: Intel x86
21:38:13:943 4016 Number of processors: 2
21:38:13:943 4016 Page size: 0x1000
21:38:13:947 4016 Boot type: Normal boot
21:38:13:947 4016 ================================================================================
21:38:14:435 4016 Initialize success
21:38:14:436 4016
21:38:14:436 4016 Scanning Services ...
21:38:15:244 4016 Raw services enum returned 459 services
21:38:15:273 4016
21:38:15:274 4016 Scanning Drivers ...
21:38:16:183 4016 ACPI (82b296ae1892fe3dbee00c9cf92f8ac7) C:\Windows\system32\drivers\acpi.sys
21:38:16:934 4016 ADM851X (0f7b802ecbf2fe6a834facaf0268aad8) C:\Windows\system32\DRIVERS\ADM851X.sys
21:38:18:120 4016 adp94xx (2edc5bbac6c651ece337bde8ed97c9fb) C:\Windows\system32\drivers\adp94xx.sys
21:38:18:249 4016 adpahci (b84088ca3cdca97da44a984c6ce1ccad) C:\Windows\system32\drivers\adpahci.sys
21:38:18:301 4016 adpu160m (7880c67bccc27c86fd05aa2afb5ea469) C:\Windows\system32\drivers\adpu160m.sys
21:38:18:363 4016 adpu320 (9ae713f8e30efc2abccd84904333df4d) C:\Windows\system32\drivers\adpu320.sys
21:38:18:437 4016 AFD (a201207363aa900abf1a388468688570) C:\Windows\system32\drivers\afd.sys
21:38:18:546 4016 agp440 (ef23439cdd587f64c2c1b8825cead7d8) C:\Windows\system32\drivers\agp440.sys
21:38:18:606 4016 aic78xx (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys
21:38:18:653 4016 aliide (90395b64600ebb4552e26e178c94b2e4) C:\Windows\system32\drivers\aliide.sys
21:38:18:695 4016 amdagp (2b13e304c9dfdfa5eb582f6a149fa2c7) C:\Windows\system32\drivers\amdagp.sys
21:38:18:731 4016 amdide (0577df1d323fe75a739c787893d300ea) C:\Windows\system32\drivers\amdide.sys
21:38:18:772 4016 AmdK7 (dc487885bcef9f28eece6fac0e5ddfc5) C:\Windows\system32\drivers\amdk7.sys
21:38:18:880 4016 AmdK8 (0ca0071da4315b00fc1328ca86b425da) C:\Windows\system32\drivers\amdk8.sys
21:38:18:927 4016 ApfiltrService (7c2f57bce81fa74933f0e1c84a97c9db) C:\Windows\system32\DRIVERS\Apfiltr.sys
21:38:18:960 4016 arc (5f673180268bb1fdb69c99b6619fe379) C:\Windows\system32\drivers\arc.sys
21:38:18:990 4016 arcsas (957f7540b5e7f602e44648c7de5a1c05) C:\Windows\system32\drivers\arcsas.sys
21:38:19:039 4016 AsyncMac (53b202abee6455406254444303e87be1) C:\Windows\system32\DRIVERS\asyncmac.sys
21:38:19:155 4016 atapi (1f05b78ab91c9075565a9d8a4b880bc4) C:\Windows\system32\drivers\atapi.sys
21:38:19:235 4016 athr (7fa516fc81dd5931f389b56279a27a3e) C:\Windows\system32\DRIVERS\athr.sys
21:38:19:361 4016 Beep (67e506b75bd5326a3ec7b70bd014dfb6) C:\Windows\system32\drivers\Beep.sys
21:38:19:476 4016 bowser (74b442b2be1260b7588c136177ceac66) C:\Windows\system32\DRIVERS\bowser.sys
21:38:19:527 4016 BrFiltLo (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys
21:38:19:569 4016 BrFiltUp (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys
21:38:19:691 4016 Brserid (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys
21:38:19:730 4016 BrSerWdm (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys
21:38:19:761 4016 BrUsbMdm (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys
21:38:19:797 4016 BrUsbSer (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys
21:38:19:833 4016 BTHMODEM (ad07c1ec6665b8b35741ab91200c6b68) C:\Windows\system32\drivers\bthmodem.sys
21:38:19:945 4016 cdfs (7add03e75beb9e6dd102c3081d29840a) C:\Windows\system32\DRIVERS\cdfs.sys
21:38:19:993 4016 Cdr4_xp (837eef65af62d4e8a37c41d3879f7274) C:\Windows\system32\drivers\Cdr4_xp.sys
21:38:20:011 4016 Cdralw2k (579da2f9f5401f55dae2cf8779d61dfc) C:\Windows\system32\drivers\Cdralw2k.sys
21:38:20:062 4016 cdrom (6b4bffb9becd728097024276430db314) C:\Windows\system32\DRIVERS\cdrom.sys
21:38:20:095 4016 circlass (da8e0afc7baa226c538ef53ac2f90897) C:\Windows\system32\drivers\circlass.sys
21:38:20:211 4016 CLFS (d7659d3b5b92c31e84e53c1431f35132) C:\Windows\system32\CLFS.sys
21:38:20:263 4016 CmBatt (99afc3795b58cc478fbbbcdc658fcb56) C:\Windows\system32\DRIVERS\CmBatt.sys
21:38:20:308 4016 cmdide (45201046c776ffdaf3fc8a0029c581c8) C:\Windows\system32\drivers\cmdide.sys
21:38:20:345 4016 Compbatt (6afef0b60fa25de07c0968983ee4f60a) C:\Windows\system32\DRIVERS\compbatt.sys
21:38:20:437 4016 crcdisk (2a213ae086bbec5e937553c7d9a2b22c) C:\Windows\system32\drivers\crcdisk.sys
21:38:20:481 4016 Crusoe (22a7f883508176489f559ee745b5bf5d) C:\Windows\system32\drivers\crusoe.sys
21:38:20:532 4016 DfsC (218d8ae46c88e82014f5d73d0236d9b2) C:\Windows\system32\Drivers\dfsc.sys
21:38:20:583 4016 disk (5d4aefc3386920236a548271f8f1af6a) C:\Windows\system32\drivers\disk.sys
21:38:20:599 4016 DMICall (f206e28ed74c491fd5d7c0a1119ce37f) C:\Windows\system32\DRIVERS\DMICall.sys
21:38:20:663 4016 Dot4 (57b2d433a08b95e4f1b53a919937f3e5) C:\Windows\system32\DRIVERS\Dot4.sys
21:38:20:784 4016 Dot4Print (d93fa484bb62fbe7e5ef335c5415d3cf) C:\Windows\system32\DRIVERS\Dot4Prt.sys
21:38:20:818 4016 dot4usb (599742c4260fb3e8edb3be148b8ce856) C:\Windows\system32\DRIVERS\dot4usb.sys
21:38:20:871 4016 drmkaud (97fef831ab90bee128c9af390e243f80) C:\Windows\system32\drivers\drmkaud.sys
21:38:20:934 4016 DXGKrnl (5c7e2097b91d689ded7a6ff90f0f3a25) C:\Windows\System32\drivers\dxgkrnl.sys
21:38:21:057 4016 E1G60 (f88fb26547fd2ce6d0a5af2985892c48) C:\Windows\system32\DRIVERS\E1G60I32.sys
21:38:21:114 4016 Ecache (7f64ea048dcfac7acf8b4d7b4e6fe371) C:\Windows\system32\drivers\ecache.sys
21:38:21:158 4016 elxstor (e8f3f21a71720c84bcf423b80028359f) C:\Windows\system32\drivers\elxstor.sys
21:38:21:205 4016 exfat (22b408651f9123527bcee54b4f6c5cae) C:\Windows\system32\drivers\exfat.sys
21:38:21:342 4016 fastfat (1e9b9a70d332103c52995e957dc09ef8) C:\Windows\system32\drivers\fastfat.sys
21:38:21:390 4016 fdc (63bdada84951b9c03e641800e176898a) C:\Windows\system32\DRIVERS\fdc.sys
21:38:21:432 4016 FileInfo (a8c0139a884861e3aae9cfe73b208a9f) C:\Windows\system32\drivers\fileinfo.sys
21:38:21:496 4016 Filetrace (0ae429a696aecbc5970e3cf2c62635ae) C:\Windows\system32\drivers\filetrace.sys
21:38:21:611 4016 flpydisk (6603957eff5ec62d25075ea8ac27de68) C:\Windows\system32\DRIVERS\flpydisk.sys
21:38:21:677 4016 FltMgr (01334f9ea68e6877c4ef05d3ea8abb05) C:\Windows\system32\drivers\fltmgr.sys
21:38:21:712 4016 Fs_Rec (65ea8b77b5851854f0c55c43fa51a198) C:\Windows\system32\drivers\Fs_Rec.sys
21:38:21:747 4016 gagp30kx (4e1cd0a45c50a8882616cae5bf82f3c5) C:\Windows\system32\drivers\gagp30kx.sys
21:38:21:824 4016 HdAudAddService (3f90e001369a07243763bd5a523d8722) C:\Windows\system32\drivers\HdAudio.sys
21:38:21:964 4016 HDAudBus (062452b7ffd68c8c042a6261fe8dff4a) C:\Windows\system32\DRIVERS\HDAudBus.sys
21:38:22:039 4016 HidBth (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys
21:38:22:086 4016 HidIr (ff3160c3a2445128c5a6d9b076da519e) C:\Windows\system32\drivers\hidir.sys
21:38:22:127 4016 HidUsb (cca4b519b17e23a00b826c55716809cc) C:\Windows\system32\DRIVERS\hidusb.sys
21:38:22:204 4016 HpCISSs (df353b401001246853763c4b7aaa6f50) C:\Windows\system32\drivers\hpcisss.sys
21:38:22:285 4016 HSFHWAZL (46d67209550973257601a533e2ac5785) C:\Windows\system32\DRIVERS\VSTAZL3.SYS
21:38:22:352 4016 HSF_DPV (ec36f1d542ed4252390d446bf6d4dfd0) C:\Windows\system32\DRIVERS\VSTDPV3.SYS
21:38:22:509 4016 HTTP (f870aa3e254628ebeafe754108d664de) C:\Windows\system32\drivers\HTTP.sys
21:38:22:565 4016 i2omp (324c2152ff2c61abae92d09f3cca4d63) C:\Windows\system32\drivers\i2omp.sys
21:38:22:618 4016 i8042prt (22d56c8184586b7a1f6fa60be5f5a2bd) C:\Windows\system32\DRIVERS\i8042prt.sys
21:38:22:815 4016 ialm (a4fba5b34e69e46315a7c5223a470a17) C:\Windows\system32\DRIVERS\igdkmd32.sys
21:38:22:934 4016 iaStorV (c957bf4b5d80b46c5017bf0101e6c906) C:\Windows\system32\drivers\iastorv.sys
21:38:23:049 4016 igfx (a4fba5b34e69e46315a7c5223a470a17) C:\Windows\system32\DRIVERS\igdkmd32.sys
21:38:23:211 4016 iirsp (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys
21:38:23:264 4016 intelide (83aa759f3189e6370c30de5dc5590718) C:\Windows\system32\drivers\intelide.sys
21:38:23:289 4016 intelppm (224191001e78c89dfa78924c3ea595ff) C:\Windows\system32\DRIVERS\intelppm.sys
21:38:23:335 4016 IpFilterDriver (62c265c38769b864cb25b4bcf62df6c3) C:\Windows\system32\DRIVERS\ipfltdrv.sys
21:38:23:471 4016 IPMIDRV (40f34f8aba2a015d780e4b09138b6c17) C:\Windows\system32\drivers\ipmidrv.sys
21:38:23:514 4016 IPNAT (8793643a67b42cec66490b2a0cf92d68) C:\Windows\system32\DRIVERS\ipnat.sys
21:38:23:582 4016 IRENUM (109c0dfb82c3632fbd11949b73aeeac9) C:\Windows\system32\drivers\irenum.sys
21:38:23:615 4016 isapnp (350fca7e73cf65bcef43fae1e4e91293) C:\Windows\system32\drivers\isapnp.sys
21:38:23:662 4016 iScsiPrt (232fa340531d940aac623b121a595034) C:\Windows\system32\DRIVERS\msiscsi.sys
21:38:23:793 4016 iteatapi (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys
21:38:23:817 4016 iteraid (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys
21:38:23:862 4016 kbdclass (37605e0a8cf00cbba538e753e4344c6e) C:\Windows\system32\DRIVERS\kbdclass.sys
21:38:23:899 4016 kbdhid (ede59ec70e25c24581add1fbec7325f7) C:\Windows\system32\DRIVERS\kbdhid.sys
21:38:23:967 4016 klmd23 (316353165feba3d0538eaa9c2f60c5b7) C:\Windows\system32\drivers\klmd.sys
21:38:24:079 4016 KSecDD (86165728af9bf72d6442a894fdfb4f8b) C:\Windows\system32\Drivers\ksecdd.sys
21:38:24:154 4016 lltdio (d1c5883087a0c3f1344d9d55a44901f6) C:\Windows\system32\DRIVERS\lltdio.sys
21:38:24:208 4016 lmimirr (4477689e2d8ae6b78ba34c9af4cc1ed1) C:\Windows\system32\DRIVERS\lmimirr.sys
21:38:24:314 4016 LMIRfsDriver (3faa563ddf853320f90259d455a01d79) C:\Windows\system32\drivers\LMIRfsDriver.sys
21:38:24:357 4016 LSI_FC (a2262fb9f28935e862b4db46438c80d2) C:\Windows\system32\drivers\lsi_fc.sys
21:38:24:388 4016 LSI_SAS (30d73327d390f72a62f32c103daf1d6d) C:\Windows\system32\drivers\lsi_sas.sys
21:38:24:464 4016 LSI_SCSI (e1e36fefd45849a95f1ab81de0159fe3) C:\Windows\system32\drivers\lsi_scsi.sys
21:38:24:565 4016 luafv (8f5c7426567798e62a3b3614965d62cc) C:\Windows\system32\drivers\luafv.sys
21:38:24:633 4016 LVUSBSta (c5efbd05a5195402121711a6ebbb271f) C:\Windows\system32\drivers\lvusbsta.sys
21:38:24:705 4016 megasas (d153b14fc6598eae8422a2037553adce) C:\Windows\system32\drivers\megasas.sys
21:38:24:784 4016 Modem (e13b5ea0f51ba5b1512ec671393d09ba) C:\Windows\system32\drivers\modem.sys
21:38:24:872 4016 monitor (0a9bb33b56e294f686abb7c1e4e2d8a8) C:\Windows\system32\DRIVERS\monitor.sys
21:38:24:941 4016 motmodem (54fee02961c70fd9d4d7e2f87afa23fa) C:\Windows\system32\DRIVERS\motmodem.sys
21:38:24:985 4016 mouclass (5bf6a1326a335c5298477754a506d263) C:\Windows\system32\DRIVERS\mouclass.sys
21:38:25:009 4016 mouhid (93b8d4869e12cfbe663915502900876f) C:\Windows\system32\DRIVERS\mouhid.sys
21:38:25:060 4016 MountMgr (bdafc88aa6b92f7842416ea6a48e1600) C:\Windows\system32\drivers\mountmgr.sys
21:38:25:182 4016 mpio (583a41f26278d9e0ea548163d6139397) C:\Windows\system32\drivers\mpio.sys
21:38:25:250 4016 mpsdrv (22241feba9b2defa669c8cb0a8dd7d2e) C:\Windows\system32\drivers\mpsdrv.sys
21:38:25:292 4016 Mraid35x (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys
21:38:25:336 4016 MRxDAV (82cea0395524aacfeb58ba1448e8325c) C:\Windows\system32\drivers\mrxdav.sys
21:38:25:437 4016 mrxsmb (454341e652bdf5e01b0f2140232b073e) C:\Windows\system32\DRIVERS\mrxsmb.sys
21:38:25:498 4016 mrxsmb10 (2a4901aff069944fa945ed5bbf4dcde3) C:\Windows\system32\DRIVERS\mrxsmb10.sys
21:38:25:550 4016 mrxsmb20 (28b3f1ab44bdd4432c041581412f17d9) C:\Windows\system32\DRIVERS\mrxsmb20.sys
21:38:25:586 4016 msahci (742aed7939e734c36b7e8d6228ce26b7) C:\Windows\system32\drivers\msahci.sys
21:38:25:728 4016 msdsm (3fc82a2ae4cc149165a94699183d3028) C:\Windows\system32\drivers\msdsm.sys
21:38:25:801 4016 Msfs (a9927f4a46b816c92f461acb90cf8515) C:\Windows\system32\drivers\Msfs.sys
21:38:25:859 4016 msisadrv (0f400e306f385c56317357d6dea56f62) C:\Windows\system32\drivers\msisadrv.sys
21:38:25:966 4016 MSKSSRV (d8c63d34d9c9e56c059e24ec7185cc07) C:\Windows\system32\drivers\MSKSSRV.sys
21:38:26:013 4016 MSPCLOCK (1d373c90d62ddb641d50e55b9e78d65e) C:\Windows\system32\drivers\MSPCLOCK.sys
21:38:26:055 4016 MSPQM (b572da05bf4e098d4bba3a4734fb505b) C:\Windows\system32\drivers\MSPQM.sys
21:38:26:115 4016 MsRPC (b49456d70555de905c311bcda6ec6adb) C:\Windows\system32\drivers\MsRPC.sys
21:38:26:205 4016 mssmbios (e384487cb84be41d09711c30ca79646c) C:\Windows\system32\DRIVERS\mssmbios.sys
21:38:26:267 4016 MSTEE (7199c1eec1e4993caf96b8c0a26bd58a) C:\Windows\system32\drivers\MSTEE.sys
21:38:26:299 4016 Mup (6a57b5733d4cb702c8ea4542e836b96c) C:\Windows\system32\Drivers\mup.sys
21:38:26:350 4016 NativeWifiP (85c44fdff9cf7e72a40dcb7ec06a4416) C:\Windows\system32\DRIVERS\nwifi.sys
21:38:26:469 4016 NDIS (1357274d1883f68300aeadd15d7bbb42) C:\Windows\system32\drivers\ndis.sys
21:38:26:584 4016 NdisTapi (0e186e90404980569fb449ba7519ae61) C:\Windows\system32\DRIVERS\ndistapi.sys
21:38:26:641 4016 Ndisuio (d6973aa34c4d5d76c0430b181c3cd389) C:\Windows\system32\DRIVERS\ndisuio.sys
21:38:26:737 4016 NdisWan (818f648618ae34f729fdb47ec68345c3) C:\Windows\system32\DRIVERS\ndiswan.sys
21:38:26:853 4016 NDProxy (71dab552b41936358f3b541ae5997fb3) C:\Windows\system32\drivers\NDProxy.sys
21:38:26:905 4016 NetBIOS (bcd093a5a6777cf626434568dc7dba78) C:\Windows\system32\DRIVERS\netbios.sys
21:38:26:951 4016 netbt (ecd64230a59cbd93c85f1cd1cab9f3f6) C:\Windows\system32\DRIVERS\netbt.sys
21:38:27:004 4016 nfrd960 (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys
21:38:27:113 4016 Npfs (d36f239d7cce1931598e8fb90a0dbc26) C:\Windows\system32\drivers\Npfs.sys
21:38:27:162 4016 nsiproxy (609773e344a97410ce4ebf74a8914fcf) C:\Windows\system32\drivers\nsiproxy.sys
21:38:27:255 4016 Ntfs (6a4a98cee84cf9e99564510dda4baa47) C:\Windows\system32\drivers\Ntfs.sys
21:38:27:381 4016 ntrigdigi (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys
21:38:27:438 4016 NuidFltr (cf7e041663119e09d2e118521ada9300) C:\Windows\system32\DRIVERS\NuidFltr.sys
21:38:27:492 4016 Null (c5dbbcda07d780bda9b685df333bb41e) C:\Windows\system32\drivers\Null.sys
21:38:27:541 4016 nvraid (e69e946f80c1c31c53003bfbf50cbb7c) C:\Windows\system32\drivers\nvraid.sys
21:38:27:667 4016 nvstor (9e0ba19a28c498a6d323d065db76dffc) C:\Windows\system32\drivers\nvstor.sys
21:38:27:710 4016 nv_agp (07c186427eb8fcc3d8d7927187f260f7) C:\Windows\system32\drivers\nv_agp.sys
21:38:27:779 4016 ohci1394 (6f310e890d46e246e0e261a63d9b36b4) C:\Windows\system32\DRIVERS\ohci1394.sys
21:38:27:806 4016 Parport (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32\drivers\parport.sys
21:38:27:859 4016 partmgr (57389fa59a36d96b3eb09d0cb91e9cdc) C:\Windows\system32\drivers\partmgr.sys
21:38:28:027 4016 Parvdm (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32\drivers\parvdm.sys
21:38:28:125 4016 pci (941dc1d19e7e8620f40bbc206981efdb) C:\Windows\system32\drivers\pci.sys
21:38:28:668 4016 pciide (3b1901e401473e03eb8c874271e50c26) C:\Windows\system32\DRIVERS\pciide.sys
21:38:29:150 4016 pcmcia (3bb2244f343b610c29c98035504c9b75) C:\Windows\system32\DRIVERS\pcmcia.sys
21:38:29:352 4016 PCTCore (aa9cfa67850893fbb168b9c4e4c86952) C:\Windows\system32\drivers\PCTCore.sys
21:38:29:796 4016 PEAUTH (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys
21:38:30:171 4016 PptpMiniport (ecfffaec0c1ecd8dbc77f39070ea1db1) C:\Windows\system32\DRIVERS\raspptp.sys
21:38:30:324 4016 Processor (0e3cef5d28b40cf273281d620c50700a) C:\Windows\system32\drivers\processr.sys
21:38:30:709 4016 PSched (99514faa8df93d34b5589187db3aa0ba) C:\Windows\system32\DRIVERS\pacer.sys
21:38:30:851 4016 PxHelp20 (49452bfcec22f36a7a9b9c2181bc3042) C:\Windows\system32\Drivers\PxHelp20.sys
21:38:31:399 4016 QCMerced (9a155d31b8e52f41b258282092cc93a7) C:\Windows\system32\DRIVERS\LVCM.sys
21:38:31:963 4016 ql2300 (ccdac889326317792480c0a67156a1ec) C:\Windows\system32\drivers\ql2300.sys
21:38:32:315 4016 ql40xx (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys
21:38:32:382 4016 QWAVEdrv (9f5e0e1926014d17486901c88eca2db7) C:\Windows\system32\drivers\qwavedrv.sys
21:38:32:443 4016 RasAcd (147d7f9c556d259924351feb0de606c3) C:\Windows\system32\DRIVERS\rasacd.sys
21:38:32:568 4016 Rasl2tp (a214adbaf4cb47dd2728859ef31f26b0) C:\Windows\system32\DRIVERS\rasl2tp.sys
21:38:32:630 4016 RasPppoe (509a98dd18af4375e1fc40bc175f1def) C:\Windows\system32\DRIVERS\raspppoe.sys
21:38:32:811 4016 RasSstp (2005f4a1e05fa09389ac85840f0a9e4d) C:\Windows\system32\DRIVERS\rassstp.sys
21:38:33:107 4016 rdbss (b14c9d5b9add2f84f70570bbbfaa7935) C:\Windows\system32\DRIVERS\rdbss.sys
21:38:33:250 4016 RDPCDD (89e59be9a564262a3fb6c4f4f1cd9899) C:\Windows\system32\DRIVERS\RDPCDD.sys
21:38:33:377 4016 rdpdr (e8bd98d46f2ed77132ba927fccb47d8b) C:\Windows\system32\drivers\rdpdr.sys
21:38:33:396 4016 RDPENCDD (9d91fe5286f748862ecffa05f8a0710c) C:\Windows\system32\drivers\rdpencdd.sys
21:38:33:471 4016 RDPWD (30bfbdfb7f95559ede971f9ddb9a00ba) C:\Windows\system32\drivers\RDPWD.sys
21:38:33:628 4016 Revoflt (b9bb8e2093c1615ad6ea55ad96214354) C:\Windows\system32\DRIVERS\revoflt.sys
21:38:33:808 4016 RimVSerPort (d9b34325ee5df78b8f28a3de9f577c7d) C:\Windows\system32\DRIVERS\RimSerial.sys
21:38:33:852 4016 ROOTMODEM (75e8a6bfa7374aba833ae92bf41ae4e6) C:\Windows\system32\Drivers\RootMdm.sys
21:38:34:202 4016 RsFx0103 (fd692c6ffade58f7c4c3c3c9a0ec35bd) C:\Windows\system32\DRIVERS\RsFx0103.sys
21:38:34:789 4016 rspndr (9c508f4074a39e8b4b31d27198146fad) C:\Windows\system32\DRIVERS\rspndr.sys
21:38:34:900 4016 sbapifs (cdfe59b67752d5a8f999dfcce1717f6d) C:\Windows\system32\DRIVERS\sbapifs.sys
21:38:34:957 4016 sbp2port (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys
21:38:35:008 4016 SBRE (c201db8a39293e51fd292be663ad6176) C:\Windows\system32\drivers\SBREdrv.sys
21:38:35:075 4016 sbtis (d23b2615f9af5c8a6f74634344a5a216) C:\Windows\system32\drivers\sbtis.sys
21:38:35:203 4016 secdrv (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys
21:38:35:248 4016 Serenum (68e44e331d46f0fb38f0863a84cd1a31) C:\Windows\system32\drivers\serenum.sys
21:38:35:302 4016 Serial (c70d69a918b178d3c3b06339b40c2e1b) C:\Windows\system32\drivers\serial.sys
21:38:35:448 4016 sermouse (8af3d28a879bf75db53a0ee7a4289624) C:\Windows\system32\drivers\sermouse.sys
21:38:35:732 4016 sffdisk (103b79418da647736ee95645f305f68a) C:\Windows\system32\drivers\sffdisk.sys
21:38:35:874 4016 sffp_mmc (8fd08a310645fe872eeec6e08c6bf3ee) C:\Windows\system32\drivers\sffp_mmc.sys
21:38:36:301 4016 sffp_sd (9cfa05fcfcb7124e69cfc812b72f9614) C:\Windows\system32\drivers\sffp_sd.sys
21:38:36:426 4016 sfloppy (46ed8e91793b2e6f848015445a0ac188) C:\Windows\system32\DRIVERS\sfloppy.sys
21:38:36:782 4016 sisagp (d2a595d6eebeeaf4334f8e50efbc9931) C:\Windows\system32\drivers\sisagp.sys
21:38:36:944 4016 SiSRaid2 (cedd6f4e7d84e9f98b34b3fe988373aa) C:\Windows\system32\drivers\sisraid2.sys
21:38:37:399 4016 SiSRaid4 (df843c528c4f69d12ce41ce462e973a7) C:\Windows\system32\drivers\sisraid4.sys
21:38:37:554 4016 Smb (7b75299a4d201d6a6533603d6914ab04) C:\Windows\system32\DRIVERS\smb.sys
21:38:38:085 4016 SNC (db31d8989b3450569c29780e7fa98c48) C:\Windows\system32\Drivers\SonyNC.sys
21:38:38:334 4016 spldr (7aebdeef071fe28b0eef2cdd69102bff) C:\Windows\system32\drivers\spldr.sys
21:38:38:551 4016 srv (0debafcc0e3591fca34f077cab62f7f7) C:\Windows\system32\DRIVERS\srv.sys
21:38:38:812 4016 srv2 (6b6f3658e0a58c6c50c5f7fbdf3df633) C:\Windows\system32\DRIVERS\srv2.sys
21:38:39:117 4016 srvnet (0c5ab1892ae0fa504218db094bf6d041) C:\Windows\system32\DRIVERS\srvnet.sys
21:38:39:342 4016 swenum (7ba58ecf0c0a9a69d44b3dca62becf56) C:\Windows\system32\DRIVERS\swenum.sys
21:38:39:707 4016 Symc8xx (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys
21:38:40:157 4016 Sym_hi (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys
21:38:40:540 4016 Sym_u3 (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys
21:38:40:661 4016 Tcpip (48cbe6d53632d0067c2d6b20f90d84ca) C:\Windows\system32\drivers\tcpip.sys
21:38:40:930 4016 Tcpip6 (48cbe6d53632d0067c2d6b20f90d84ca) C:\Windows\system32\DRIVERS\tcpip.sys
21:38:41:074 4016 tcpipreg (608c345a255d82a6289c2d468eb41fd7) C:\Windows\system32\drivers\tcpipreg.sys
21:38:41:119 4016 TDPIPE (5dcf5e267be67a1ae926f2df77fbcc56) C:\Windows\system32\drivers\tdpipe.sys
21:38:41:154 4016 TDTCP (389c63e32b3cefed425b61ed92d3f021) C:\Windows\system32\drivers\tdtcp.sys
21:38:41:203 4016 tdx (76b06eb8a01fc8624d699e7045303e54) C:\Windows\system32\DRIVERS\tdx.sys
21:38:41:328 4016 TermDD (3cad38910468eab9a6479e2f01db43c7) C:\Windows\system32\DRIVERS\termdd.sys
21:38:41:392 4016 ti21sony (dcd46a3fc856167fd985507492ae610a) C:\Windows\system32\drivers\ti21sony.sys
21:38:41:530 4016 tssecsrv (dcf0f056a2e4f52287264f5ab29cf206) C:\Windows\system32\DRIVERS\tssecsrv.sys
21:38:41:584 4016 tunmp (caecc0120ac49e3d2f758b9169872d38) C:\Windows\system32\DRIVERS\tunmp.sys
21:38:41:640 4016 tunnel (300db877ac094feab0be7688c3454a9c) C:\Windows\system32\DRIVERS\tunnel.sys
21:38:41:706 4016 uagp35 (c3ade15414120033a36c0f293d4a4121) C:\Windows\system32\drivers\uagp35.sys
21:38:41:898 4016 udfs (d9728af68c4c7693cb100b8441cbdec6) C:\Windows\system32\DRIVERS\udfs.sys
21:38:41:987 4016 uliagpkx (75e6890ebfce0841d3291b02e7a8bdb0) C:\Windows\system32\drivers\uliagpkx.sys
21:38:42:089 4016 uliahci (3cd4ea35a6221b85dcc25daa46313f8d) C:\Windows\system32\drivers\uliahci.sys
21:38:42:256 4016 UlSata (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys
21:38:42:297 4016 ulsata2 (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys
21:38:42:349 4016 umbus (32cff9f809ae9aed85464492bf3e32d2) C:\Windows\system32\DRIVERS\umbus.sys
21:38:42:393 4016 usbaudio (32db9517628ff0d070682aab61e688f0) C:\Windows\system32\drivers\usbaudio.sys
21:38:42:536 4016 usbccgp (caf811ae4c147ffcd5b51750c7f09142) C:\Windows\system32\DRIVERS\usbccgp.sys
21:38:42:594 4016 usbcir (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys
21:38:42:644 4016 usbehci (79e96c23a97ce7b8f14d310da2db0c9b) C:\Windows\system32\DRIVERS\usbehci.sys
21:38:42:696 4016 usbhub (4673bbcb006af60e7abddbe7a130ba42) C:\Windows\system32\DRIVERS\usbhub.sys
21:38:42:814 4016 usbohci (38dbc7dd6cc5a72011f187425384388b) C:\Windows\system32\drivers\usbohci.sys
21:38:42:862 4016 usbprint (b51e52acf758be00ef3a58ea452fe360) C:\Windows\system32\DRIVERS\usbprint.sys
21:38:42:926 4016 usbscan (b1f95285c08ddfe00c0b955462637ec7) C:\Windows\system32\DRIVERS\usbscan.sys
21:38:42:979 4016 USBSTOR (be3da31c191bc222d9ad503c5224f2ad) C:\Windows\system32\DRIVERS\USBSTOR.SYS
21:38:43:134 4016 usbuhci (814d653efc4d48be3b04a307eceff56f) C:\Windows\system32\DRIVERS\usbuhci.sys
21:38:43:183 4016 vga (7d92be0028ecdedec74617009084b5ef) C:\Windows\system32\DRIVERS\vgapnp.sys
21:38:43:227 4016 VgaSave (2e93ac0a1d8c79d019db6c51f036636c) C:\Windows\System32\drivers\vga.sys
21:38:43:273 4016 viaagp (045d9961e591cf0674a920b6ba3ba5cb) C:\Windows\system32\drivers\viaagp.sys
21:38:43:527 4016 ViaC7 (56a4de5f02f2e88182b0981119b4dd98) C:\Windows\system32\drivers\viac7.sys
21:38:43:597 4016 viaide (fd2e3175fcada350c7ab4521dca187ec) C:\Windows\system32\drivers\viaide.sys
21:38:43:765 4016 vncmirror (efc092b667cbbe3b0a089db902df7ff6) C:\Windows\system32\DRIVERS\vncmirror.sys
21:38:43:849 4016 volmgr (69503668ac66c77c6cd7af86fbdf8c43) C:\Windows\system32\drivers\volmgr.sys
21:38:43:927 4016 volmgrx (23e41b834759917bfd6b9a0d625d0c28) C:\Windows\system32\drivers\volmgrx.sys
21:38:44:180 4016 volsnap (147281c01fcb1df9252de2a10d5e7093) C:\Windows\system32\drivers\volsnap.sys
21:38:44:380 4016 vsmraid (d984439746d42b30fc65a4c3546c6829) C:\Windows\system32\drivers\vsmraid.sys
21:38:44:447 4016 WacomPen (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys
21:38:44:600 4016 Wanarp (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
21:38:44:607 4016 Wanarpv6 (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
21:38:44:709 4016 wanatw (0a716c08cb13c3a8f4f51e882dbf7416) C:\Windows\system32\DRIVERS\wanatw4.sys
21:38:44:850 4016 Wd (afc5ad65b991c1e205cf25cfdbf7a6f4) C:\Windows\system32\drivers\wd.sys
21:38:45:059 4016 Wdf01000 (b6f0a7ad6d4bd325fbcd8bac96cd8d96) C:\Windows\system32\drivers\Wdf01000.sys
21:38:45:216 4016 WimFltr (c8d53a13e867d5a7eafb19400016560f) C:\Windows\system32\DRIVERS\wimfltr.sys
21:38:45:325 4016 winachsf (5c7bdcf5864db00323fe2d90fa26a8a2) C:\Windows\system32\DRIVERS\VSTCNXT3.SYS
21:38:45:432 4016 winusb (676f4b665bdd8053eaa53ac1695b8074) C:\Windows\system32\DRIVERS\winusb.sys
21:38:45:536 4016 WmiAcpi (701a9f884a294327e9141d73746ee279) C:\Windows\system32\drivers\wmiacpi.sys
21:38:45:598 4016 WpdUsb (de9d36f91a4df3d911626643debf11ea) C:\Windows\system32\DRIVERS\wpdusb.sys
21:38:45:854 4016 ws2ifsl (e3a3cb253c0ec2494d4a61f5e43a389c) C:\Windows\system32\drivers\ws2ifsl.sys
21:38:46:041 4016 WUDFRd (ac13cb789d93412106b0fb6c7eb2bcb6) C:\Windows\system32\DRIVERS\WUDFRd.sys
21:38:46:185 4016 yukonwlh (69222091b6285906aff82e43681cf826) C:\Windows\system32\DRIVERS\yk60x86.sys
21:38:46:239 4016 ZSMC301b (7481637a50a0468cf46c719672bc7eaa) C:\Windows\system32\Drivers\usbVM31b.sys
21:38:46:243 4016
21:38:46:244 4016 Completed
21:38:46:244 4016
21:38:46:245 4016 Results:
21:38:46:246 4016 Registry objects infected / cured / cured on reboot: 0 / 0 / 0
21:38:46:247 4016 File objects infected / cured / cured on reboot: 0 / 0 / 0
21:38:46:248 4016
21:38:46:258 4016 KLMD(ARK) unloaded successfully

Стъпка 3

OTL logfile created on: 20.7.2010 г. 21:41:41 - Run 3
OTL by OldTimer - Version 3.2.9.1 Folder = C:\Users\pmsacks\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18928)
Locale: 00000402 | Country: Bulgaria | Language: BGR | Date Format: d.M.yyyy 'г.'

2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 50,00% Memory free
4,00 Gb Paging File | 3,00 Gb Available in Paging File | 72,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 105,18 Gb Total Space | 47,37 Gb Free Space | 45,03% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: PMSACKS-PC
Current User Name: pmsacks
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Minimal
Quick Scan

========== Processes (SafeList) ==========

PRC - C:\Users\pmsacks\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Avant Browser\avantab.exe (Avant Force)
PRC - C:\Program Files\Avant Browser\avant.exe (Avant Force)
PRC - C:\Program Files\Sony\VAIO Care\VCsystray.exe (Sony Corporation)
PRC - C:\Program Files\Sony\VAIO Care\VAIOCareService.exe (Sony Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Windows\System32\conime.exe (Microsoft Corporation)
PRC - c:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe (Microsoft Corporation)
PRC - C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
PRC - c:\Program Files\Windows Defender\MpCmdRun.exe (Microsoft Corporation)
PRC - C:\Windows\System32\iashost.exe (Microsoft Corporation)
PRC - C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe (Sony Corporation)
PRC - C:\Program Files\Apoint\Apoint.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\Apoint\ApntEx.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\Apoint\ApMsgFwd.exe (Alps Electric Co., Ltd.)
PRC - C:\Windows\WindowsMobile\wmdSync.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe (Macrovision Corporation)
PRC - C:\Windows\VM_STI.EXE (BIGDOG)

========== Modules (SafeList) ==========

MOD - C:\Users\pmsacks\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0\comctl32.dll (Microsoft Corporation)
MOD - C:\Windows\System32\msscript.ocx (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (WPFFontCache_v0400) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe (Microsoft Corporation)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (FontCache) -- C:\Windows\System32\FntCache.dll (Microsoft Corporation)
SRV - (SampleCollector) Intel® -- C:\Program Files\Sony\VAIO Care\collsvc.exe (Intel Corporation)
SRV - (MSSQLServerADHelper100) -- c:\Program Files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE (Microsoft Corporation)
SRV - (sdCoreService) -- C:\Program Files\Spyware Doctor\pctsSvc.exe (PC Tools)
SRV - (MSSQL$SQLEXPRESS) SQL Server (SQLEXPRESS) -- c:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe (Microsoft Corporation)
SRV - (SQLAgent$SQLEXPRESS) SQL Server Agent (SQLEXPRESS) -- c:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE (Microsoft Corporation)
SRV - (sdAuxService) -- C:\Program Files\Spyware Doctor\pctsAuxs.exe (PC Tools)
SRV - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (WcesComm) -- C:\Windows\WindowsMobile\wcescomm.dll (Microsoft Corporation)
SRV - (RapiMgr) -- C:\Windows\WindowsMobile\rapimgr.dll (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV - (MEMSWEEP2) -- C:\Windows\System32\D700.tmp File not found
DRV - (Revoflt) -- C:\Windows\System32\drivers\revoflt.sys (VS Revo Group)
DRV - (LMIRfsClientNP) -- C:\Windows\System32\LMIRfsClientNP.dll (LogMeIn, Inc.)
DRV - (motmodem) -- C:\Windows\System32\drivers\motmodem.sys (Motorola)
DRV - (LMIRfsDriver) -- C:\Windows\System32\drivers\LMIRfsDriver.sys (LogMeIn, Inc.)
DRV - (NuidFltr) -- C:\Windows\System32\drivers\nuidfltr.sys (Microsoft Corporation)
DRV - (usbaudio) USB Audio Driver (WDM) -- C:\Windows\System32\drivers\USBAUDIO.sys (Microsoft Corporation)
DRV - (winusb) -- C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (PCTCore) -- C:\Windows\system32\drivers\PCTCore.sys (PC Tools)
DRV - (RsFx0103) -- C:\Windows\System32\drivers\RsFx0103.sys (Microsoft Corporation)
DRV - (SBRE) -- C:\Windows\System32\drivers\SBREDrv.sys (Sunbelt Software)
DRV - (sbtis) -- C:\Windows\System32\drivers\sbtis.sys (Sunbelt Software)
DRV - (sbapifs) -- C:\Windows\System32\drivers\sbapifs.sys (Sunbelt Software)
DRV - (athr) -- C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.)
DRV - (vncmirror) -- C:\Windows\System32\drivers\vncmirror.sys (RealVNC Ltd.)
DRV - (ti21sony) -- C:\Windows\System32\drivers\ti21sony.sys (Texas Instruments)
DRV - (Cdralw2k) -- C:\Windows\System32\drivers\cdralw2k.sys (Sonic Solutions)
DRV - (Cdr4_xp) -- C:\Windows\System32\drivers\cdr4_xp.sys (Sonic Solutions)
DRV - (SNC) -- C:\Windows\System32\drivers\SonyNC.sys (Sony Corporation)
DRV - (yukonwlh) -- C:\Windows\System32\drivers\yk60x86.sys (Marvell)
DRV - (igfx) -- C:\Windows\System32\drivers\igdkmd32.sys (Intel Corporation)
DRV - (ialm) -- C:\Windows\System32\drivers\igdkmd32.sys (Intel Corporation)
DRV - (ApfiltrService) -- C:\Windows\System32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)
DRV - (ql2300) -- C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)
DRV - (adp94xx) -- C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)
DRV - (elxstor) -- C:\Windows\system32\drivers\elxstor.sys (Emulex)
DRV - (adpahci) -- C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)
DRV - (uliahci) -- C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)
DRV - (iaStorV) -- C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)
DRV - (adpu320) -- C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)
DRV - (ulsata2) -- C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)
DRV - (vsmraid) -- C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (ql40xx) -- C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)
DRV - (UlSata) -- C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)
DRV - (adpu160m) -- C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)
DRV - (nvraid) -- C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)
DRV - (nfrd960) -- C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)
DRV - (iirsp) -- C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (SiSRaid4) -- C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)
DRV - (nvstor) -- C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)
DRV - (aic78xx) -- C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)
DRV - (arcsas) -- C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)
DRV - (LSI_SCSI) -- C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)
DRV - (SiSRaid2) -- C:\Windows\system32\drivers\sisraid2.sys (Silicon Integrated Systems Corp.)
DRV - (HpCISSs) -- C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)
DRV - (arc) -- C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)
DRV - (iteraid) -- C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)
DRV - (iteatapi) -- C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)
DRV - (LSI_SAS) -- C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)
DRV - (Symc8xx) -- C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)
DRV - (LSI_FC) -- C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)
DRV - (Sym_u3) -- C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)
DRV - (Mraid35x) -- C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)
DRV - (Sym_hi) -- C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)
DRV - (megasas) -- C:\Windows\system32\drivers\megasas.sys (LSI Logic Corporation)
DRV - (viaide) -- C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)
DRV - (cmdide) -- C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)
DRV - (aliide) -- C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) -- C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)
DRV - (BrFiltUp) -- C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)
DRV - (BrFiltLo) -- C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)
DRV - (BrSerWdm) -- C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)
DRV - (BrUsbMdm) -- C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)
DRV - (HSF_DPV) -- C:\Windows\System32\drivers\VSTDPV3.SYS (Conexant Systems, Inc.)
DRV - (HSFHWAZL) -- C:\Windows\System32\drivers\VSTAZL3.SYS (Conexant Systems, Inc.)
DRV - (winachsf) -- C:\Windows\System32\drivers\VSTCNXT3.SYS (Conexant Systems, Inc.)
DRV - (ntrigdigi) -- C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)
DRV - (E1G60) Intel® -- C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation)
DRV - (wanatw) WAN Miniport (ATW) -- C:\Windows\System32\drivers\wanatw4.sys (America Online, Inc.)
DRV - (DMICall) -- C:\Windows\System32\drivers\DMICall.sys (Sony Corporation)
DRV - (WimFltr) -- C:\Windows\System32\drivers\WimFltr.sys (Microsoft Corporation)
DRV - (ADM851X) -- C:\Windows\System32\drivers\ADM851X.sys (DAVICOM Semiconductor, Inc. )
DRV - (QCMerced) -- C:\Windows\System32\drivers\lvcm.sys ()
DRV - (LVUSBSta) -- C:\Windows\System32\drivers\LVUSBSta.sys (Logitech Inc.)
DRV - (ZSMC301b) -- C:\Windows\System32\drivers\usbVM31b.sys (VM)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sony.com/vaiopeople

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data over 100 bytes]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.bing.com/?pc=AVBR
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.mercedes-club-bg.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Google"
FF - prefs.js..browser.search.defaulturl: "http://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q="
FF - prefs.js..extensions.enabledItems: [email protected]:1.0.13966

FF - HKLM\software\mozilla\Firefox\Extensions\\{3112ca9c-de6d-4884-a869-9855de68056c}: C:\ProgramData\Google\Toolbar for Firefox\{3112ca9c-de6d-4884-a869-9855de68056c} [2009.06.13 07:02:05 | 000,000,000 | ---D | M]

[2009.06.14 11:10:18 | 000,000,000 | ---D | M] -- C:\Users\pmsacks\AppData\Roaming\Mozilla\Extensions
[2009.06.14 11:24:45 | 000,000,000 | ---D | M] -- C:\Users\pmsacks\AppData\Roaming\Mozilla\Firefox\Profiles\w74jbost.default\extensions
[2009.06.14 11:24:44 | 000,000,000 | ---D | M] (Google Toolbar for Firefox) -- C:\Users\pmsacks\AppData\Roaming\Mozilla\Firefox\Profiles\w74jbost.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}

O1 HOSTS File: ([2010.07.20 21:14:50 | 000,000,098 | ---- | M]) - C:\Windows\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (BitComet Helper) - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.8.7.dll (BitComet)
O3 - HKLM\..\Toolbar: (ImageShack Toolbar) - {6932D140-ABC4-4073-A44C-D4A541665E35} - C:\Program Files\ImageShackToolbar\ImageShackToolbar.dll (ImageShack Corp.)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [bigDogPath] C:\Windows\VM_STI.EXE (BIGDOG)
O4 - HKLM..\Run: [iSBMgr.exe] C:\Program Files\Sony\ISB Utility\ISBMgr.exe (Sony Corporation)
O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [Windows Mobile-based device management] C:\Windows\WindowsMobile\wmdSync.exe (Microsoft Corporation)
O4 - HKCU..\Run: [iSUSPM] C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe (Macrovision Corporation)
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: &D&ownload &with BitComet - C:\Program Files\BitComet\BitComet.exe (www.BitComet.com)
O8 - Extra context menu item: &D&ownload all video with BitComet - C:\Program Files\BitComet\BitComet.exe (www.BitComet.com)
O8 - Extra context menu item: &D&ownload all with BitComet - C:\Program Files\BitComet\BitComet.exe (www.BitComet.com)
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Post Image to Blog - C:\Program Files\ImageShackToolbar\ImageShackToolbar.dll (ImageShack Corp.)
O8 - Extra context menu item: Tag This Image - C:\Program Files\ImageShackToolbar\ImageShackToolbar.dll (ImageShack Corp.)
O8 - Extra context menu item: Transload Image to ImageShack - C:\Program Files\ImageShackToolbar\ImageShackToolbar.dll (ImageShack Corp.)
O8 - Extra context menu item: Upload All Images to ImageShack - C:\Program Files\ImageShackToolbar\ImageShackToolbar.dll (ImageShack Corp.)
O8 - Extra context menu item: Upload Image to ImageShack - C:\Program Files\ImageShackToolbar\ImageShackToolbar.dll (ImageShack Corp.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab (Symantec AntiVirus scanner)
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab (Symantec RuFSI Utility Class)
O16 - DPF: {6932D140-ABC4-4073-A44C-D4A541665E35} http://toolbar.imageshack.us/toolbar/ImageShackToolbar.cab (ImageShack Toolbar)
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} http://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_intel_4.1.66.0.cab (SysInfo Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 91.193.156.4 91.193.156.5
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\Windows\System32\igfxdev.dll (Intel Corporation)
O20 - Winlogon\Notify\VESWinlogon: DllName - VESWinlogon.dll - C:\Windows\System32\VESWinlogon.dll (Sony Corporation)
O24 - Desktop WallPaper: C:\Users\pmsacks\AppData\Roaming\Microsoft\Internet Explorer\Internet Explorer Wallpaper.bmp
O24 - Desktop BackupWallPaper: C:\Users\pmsacks\AppData\Roaming\Microsoft\Internet Explorer\Internet Explorer Wallpaper.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.19 00:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 90 Days ==========

[2010.07.20 21:28:03 | 001,013,584 | ---- | C] (Kaspersky Lab) -- C:\Users\pmsacks\Desktop\TDSSKiller.exe
[2010.07.20 21:13:49 | 000,000,000 | ---D | C] -- C:\_OTL
[2010.07.19 11:17:24 | 000,574,976 | ---- | C] (OldTimer Tools) -- C:\Users\pmsacks\Desktop\OTL.exe
[2010.07.19 08:58:50 | 016,066,336 | ---- | C] (Oracle) -- C:\Users\pmsacks\Desktop\jre-6u21-windows-i586.exe
[2010.07.18 19:55:44 | 000,000,000 | ---D | C] -- C:\Program Files\Sophos
[2010.07.18 17:27:45 | 000,000,000 | ---D | C] -- C:\Users\pmsacks\AppData\Roaming\Malwarebytes
[2010.07.18 17:27:34 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2010.07.18 17:27:32 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2010.07.18 17:27:32 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010.07.18 17:27:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2010.07.11 18:01:00 | 000,000,000 | ---D | C] -- C:\Users\pmsacks\Desktop\New Folder
[2010.07.08 09:48:19 | 000,000,000 | ---D | C] -- C:\Users\pmsacks\Desktop\Metal Church
[2010.06.24 11:41:10 | 000,000,000 | ---D | C] -- C:\Users\pmsacks\AppData\Roaming\Avant Profiles
[2010.06.24 11:41:02 | 000,000,000 | ---D | C] -- C:\Program Files\Avant Browser
[2010.06.22 13:27:21 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft F#
[2010.06.22 11:46:49 | 000,000,000 | ---D | C] -- C:\Windows\System32\RsFx
[2010.06.22 11:44:38 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Visual Studio 9.0
[2010.06.22 11:28:18 | 000,000,000 | ---D | C] -- C:\Users\pmsacks\Documents\Visual Studio 2010
[2010.06.22 11:23:22 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft SDKs
[2010.06.22 11:23:22 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Help Viewer
[2010.06.18 01:10:52 | 000,000,000 | ---D | C] -- C:\Program Files\Winamp Detect
[2010.06.17 18:51:54 | 000,000,000 | RHSD | C] -- C:\RECYCLER
[2010.06.17 15:59:24 | 000,000,000 | ---D | C] -- C:\Users\pmsacks\AppData\Roaming\Tific
[2010.06.13 06:40:48 | 000,000,000 | ---D | C] -- C:\Users\pmsacks\AppData\Roaming\Auslogics
[2010.05.31 08:54:31 | 000,000,000 | ---D | C] -- C:\Program Files\GetData
[2010.05.25 08:22:45 | 000,000,000 | ---D | C] -- C:\Users\pmsacks\Desktop\nav_sep3
[2010.05.15 17:45:33 | 000,000,000 | ---D | C] -- C:\Users\pmsacks\AppData\Local\CrashDumps
[2010.05.15 13:48:45 | 000,000,000 | ---D | C] -- C:\Program Files\ImageShackToolbar
[2010.05.13 14:17:16 | 000,000,000 | ---D | C] -- C:\ProgramData\PCSettings
[2010.05.13 13:31:00 | 000,000,000 | ---D | C] -- C:\Users\pmsacks\AppData\Local\VS Revo Group
[2010.05.13 13:30:50 | 000,027,192 | ---- | C] (VS Revo Group) -- C:\Windows\System32\drivers\revoflt.sys
[2010.05.13 13:30:33 | 000,000,000 | ---D | C] -- C:\Program Files\VS Revo Group
[2010.05.12 18:30:55 | 000,000,000 | ---D | C] -- C:\Program Files\7-Zip
[2010.05.01 10:58:52 | 000,000,000 | ---D | C] -- C:\Program Files\DIFX
[2010.05.01 10:28:28 | 000,000,000 | ---D | C] -- C:\Intel
[2010.05.01 10:25:22 | 000,000,000 | ---D | C] -- C:\Users\pmsacks\Desktop\medion
[2010.05.01 10:19:22 | 000,000,000 | ---D | C] -- C:\Program Files\SystemRequirementsLab
[2010.04.30 13:58:05 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\MSSoap

========== Files - Modified Within 90 Days ==========

[2010.07.20 21:47:38 | 000,000,422 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{B6C1BFDC-B045-40A2-9D0B-976C849B0355}.job
[2010.07.20 21:45:16 | 007,340,032 | ---- | M] () -- C:\Users\pmsacks\NTUSER.DAT
[2010.07.20 21:34:23 | 000,000,179 | ---- | M] () -- C:\Users\pmsacks\Desktop\fix.zip
[2010.07.20 21:25:44 | 000,981,780 | ---- | M] () -- C:\Users\pmsacks\Desktop\tdsskiller.zip
[2010.07.20 21:24:17 | 000,821,800 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI
[2010.07.20 21:24:17 | 000,679,420 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2010.07.20 21:24:17 | 000,136,022 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2010.07.20 21:18:24 | 000,000,436 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts.ics
[2010.07.20 21:18:05 | 000,065,536 | ---- | M] () -- C:\Windows\System32\Ikeext.etl
[2010.07.20 21:18:04 | 000,003,696 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010.07.20 21:18:04 | 000,003,696 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010.07.20 21:17:52 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2010.07.20 21:17:41 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010.07.20 21:16:04 | 000,524,288 | -HS- | M] () -- C:\Users\pmsacks\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms
[2010.07.20 21:16:04 | 000,065,536 | -HS- | M] () -- C:\Users\pmsacks\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf
[2010.07.20 21:14:50 | 000,000,098 | ---- | M] () -- C:\Windows\System32\drivers\etc\Hosts
[2010.07.19 22:41:27 | 003,719,658 | -H-- | M] () -- C:\Users\pmsacks\AppData\Local\IconCache.db
[2010.07.19 11:17:30 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Users\pmsacks\Desktop\OTL.exe
[2010.07.19 11:04:58 | 000,000,542 | ---- | M] () -- C:\Windows\tasks\Norton Internet Security - pmsacks - Full System Scan.job
[2010.07.19 08:59:42 | 016,066,336 | ---- | M] (Oracle) -- C:\Users\pmsacks\Desktop\jre-6u21-windows-i586.exe
[2010.07.18 22:12:01 | 000,035,328 | ---- | M] () -- C:\Users\pmsacks\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.07.18 19:47:55 | 000,867,892 | ---- | M] () -- C:\Users\pmsacks\Desktop\SecurityCheck.exe
[2010.07.18 17:27:36 | 000,000,818 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.07.18 16:36:49 | 000,122,721 | ---- | M] () -- C:\Users\pmsacks\Desktop\fixer32.jpg
[2010.07.18 09:55:17 | 003,874,399 | ---- | M] () -- C:\Users\pmsacks\Desktop\IMG_8914.JPG
[2010.07.17 22:01:15 | 000,148,745 | ---- | M] () -- C:\Users\pmsacks\Desktop\spalnia1.jpg
[2010.07.17 21:57:21 | 000,149,245 | ---- | M] () -- C:\Users\pmsacks\Desktop\spalnia.jpg
[2010.07.17 21:40:46 | 000,153,529 | ---- | M] () -- C:\Users\pmsacks\Desktop\nisha.jpg
[2010.07.17 00:33:32 | 000,125,098 | ---- | M] () -- C:\test.xml
[2010.07.13 22:49:41 | 000,057,850 | ---- | M] () -- C:\Users\pmsacks\Desktop\Swedish-Inspiration-White-Apartment-in-Goteborg-12.jpg
[2010.07.13 22:49:40 | 000,043,516 | ---- | M] () -- C:\Users\pmsacks\Desktop\Swedish-Inspiration-White-Apartment-in-Goteborg-6.jpg
[2010.07.13 22:49:40 | 000,032,112 | ---- | M] () -- C:\Users\pmsacks\Desktop\Swedish-Inspiration-White-Apartment-in-Goteborg-7.jpg
[2010.07.13 18:51:47 | 000,610,634 | ---- | M] () -- C:\Users\pmsacks\Desktop\sofa_VkMSX_7287.jpg
[2010.07.11 18:02:25 | 014,044,692 | ---- | M] () -- C:\Users\pmsacks\Desktop\New Folder.rar
[2010.07.06 08:00:58 | 000,154,582 | ---- | M] () -- C:\Users\pmsacks\Desktop\Art_sex_porno258.jpg
[2010.07.06 07:59:30 | 000,396,310 | ---- | M] () -- C:\Users\pmsacks\Desktop\deisy-bloom.bmp
[2010.06.30 17:25:08 | 001,013,584 | ---- | M] (Kaspersky Lab) -- C:\Users\pmsacks\Desktop\TDSSKiller.exe
[2010.06.23 20:05:47 | 000,002,964 | ---- | M] () -- C:\Users\pmsacks\Desktop\imagesCAO9EHO3.jpg
[2010.06.20 11:22:41 | 000,299,448 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2010.05.31 11:23:27 | 209,715,200 | ---- | M] () -- C:\Users\pmsacks\Desktop\Mercedes_Actros_950_954_www.avtoman.org.ua.part3.rar
[2010.05.31 09:08:03 | 000,001,029 | ---- | M] () -- C:\Users\pmsacks\Desktop\RecoverMyFiles.exe - Shortcut.lnk
[2010.05.26 11:34:22 | 000,000,020 | -HS- | M] () -- C:\Users\pmsacks\ntuser.ini
[2010.05.19 18:08:03 | 254,287,891 | ---- | M] () -- C:\Users\pmsacks\Desktop\viara.rar
[2010.04.29 12:19:24 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2010.04.29 12:19:14 | 000,020,952 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2010.04.28 19:12:02 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_User_WpdRapi_01_00_00.Wdf

========== Files Created - No Company Name ==========

[2010.07.20 21:34:18 | 000,000,179 | ---- | C] () -- C:\Users\pmsacks\Desktop\fix.zip
[2010.07.20 21:25:32 | 000,981,780 | ---- | C] () -- C:\Users\pmsacks\Desktop\tdsskiller.zip
[2010.07.18 19:47:36 | 000,867,892 | ---- | C] () -- C:\Users\pmsacks\Desktop\SecurityCheck.exe
[2010.07.18 17:27:36 | 000,000,818 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.07.18 16:36:48 | 000,122,721 | ---- | C] () -- C:\Users\pmsacks\Desktop\fixer32.jpg
[2010.07.18 09:55:15 | 003,874,399 | ---- | C] () -- C:\Users\pmsacks\Desktop\IMG_8914.JPG
[2010.07.17 22:01:15 | 000,148,745 | ---- | C] () -- C:\Users\pmsacks\Desktop\spalnia1.jpg
[2010.07.17 21:57:20 | 000,149,245 | ---- | C] () -- C:\Users\pmsacks\Desktop\spalnia.jpg
[2010.07.17 21:40:46 | 000,153,529 | ---- | C] () -- C:\Users\pmsacks\Desktop\nisha.jpg
[2010.07.13 22:54:45 | 000,043,516 | ---- | C] () -- C:\Users\pmsacks\Desktop\Swedish-Inspiration-White-Apartment-in-Goteborg-6.jpg
[2010.07.13 22:54:14 | 000,032,112 | ---- | C] () -- C:\Users\pmsacks\Desktop\Swedish-Inspiration-White-Apartment-in-Goteborg-7.jpg
[2010.07.13 22:53:32 | 000,057,850 | ---- | C] () -- C:\Users\pmsacks\Desktop\Swedish-Inspiration-White-Apartment-in-Goteborg-12.jpg
[2010.07.13 18:54:07 | 000,610,634 | ---- | C] () -- C:\Users\pmsacks\Desktop\sofa_VkMSX_7287.jpg
[2010.07.11 18:02:09 | 014,044,692 | ---- | C] () -- C:\Users\pmsacks\Desktop\New Folder.rar
[2010.07.06 08:00:58 | 000,154,582 | ---- | C] () -- C:\Users\pmsacks\Desktop\Art_sex_porno258.jpg
[2010.07.06 07:59:29 | 000,396,310 | ---- | C] () -- C:\Users\pmsacks\Desktop\deisy-bloom.bmp
[2010.06.23 20:07:24 | 000,002,964 | ---- | C] () -- C:\Users\pmsacks\Desktop\imagesCAO9EHO3.jpg
[2010.06.19 09:46:54 | 000,085,504 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll
[2010.06.19 09:46:54 | 000,050,688 | ---- | C] () -- C:\Windows\System32\ff_acm.acm
[2010.06.16 16:09:48 | 000,125,098 | ---- | C] () -- C:\test.xml
[2010.05.31 11:21:50 | 209,715,200 | ---- | C] () -- C:\Users\pmsacks\Desktop\Mercedes_Actros_950_954_www.avtoman.org.ua.part3.rar
[2010.05.31 09:08:03 | 000,001,029 | ---- | C] () -- C:\Users\pmsacks\Desktop\RecoverMyFiles.exe - Shortcut.lnk
[2010.05.26 11:34:22 | 000,000,020 | -HS- | C] () -- C:\Users\pmsacks\ntuser.ini
[2010.05.17 11:56:27 | 000,000,542 | ---- | C] () -- C:\Windows\tasks\Norton Internet Security - pmsacks - Full System Scan.job
[2010.04.28 19:12:02 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_User_WpdRapi_01_00_00.Wdf
[2010.04.27 22:24:48 | 254,287,891 | ---- | C] () -- C:\Users\pmsacks\Desktop\viara.rar
[2009.10.07 19:28:45 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009.05.14 15:29:30 | 000,008,520 | ---- | C] () -- C:\Windows\System32\ractrlkeyhook.dll
[2008.02.24 19:56:18 | 000,077,824 | ---- | C] () -- C:\Windows\System32\hccutils.dll
[2008.02.24 19:56:18 | 000,061,440 | ---- | C] () -- C:\Windows\System32\igfxTMM.dll
[2008.02.24 19:56:18 | 000,053,248 | ---- | C] () -- C:\Windows\System32\oemdspif.dll
[2008.02.24 19:56:17 | 000,204,800 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1151.dll
[2007.11.07 16:07:02 | 000,000,221 | ---- | C] () -- C:\Windows\NCLogConfig.ini
[2007.07.11 16:30:39 | 001,317,152 | ---- | C] () -- C:\Windows\System32\drivers\lvcm.sys
[2007.07.11 16:30:39 | 000,009,255 | ---- | C] () -- C:\Windows\System32\lvcoinst.ini
[2007.05.08 12:59:20 | 000,532,480 | ---- | C] () -- C:\Windows\System32\CddbPlaylist2Sony.dll
[2007.02.24 21:59:14 | 000,000,000 | ---- | C] () -- C:\Windows\VAIOUpdt.INI
[2006.11.02 15:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 10:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini

========== LOP Check ==========

[2010.06.13 08:00:55 | 000,000,000 | ---D | M] -- C:\Users\pmsacks\AppData\Roaming\Auslogics
[2010.03.11 19:38:10 | 000,000,000 | ---D | M] -- C:\Users\pmsacks\AppData\Roaming\BSplayer
[2009.10.29 16:10:03 | 000,000,000 | ---D | M] -- C:\Users\pmsacks\AppData\Roaming\BSplayer Pro
[2010.03.28 15:25:56 | 000,000,000 | ---D | M] -- C:\Users\pmsacks\AppData\Roaming\Facebook
[2009.10.23 17:35:48 | 000,000,000 | ---D | M] -- C:\Users\pmsacks\AppData\Roaming\GHISLER
[2009.06.15 16:32:07 | 000,000,000 | ---D | M] -- C:\Users\pmsacks\AppData\Roaming\ICAClient
[2008.10.01 12:01:35 | 000,000,000 | ---D | M] -- C:\Users\pmsacks\AppData\Roaming\Image Zone Express
[2010.01.19 14:50:58 | 000,000,000 | ---D | M] -- C:\Users\pmsacks\AppData\Roaming\Notepad++
[2007.07.06 15:14:13 | 000,000,000 | ---D | M] -- C:\Users\pmsacks\AppData\Roaming\PeerNetworking
[2007.08.01 12:45:39 | 000,000,000 | ---D | M] -- C:\Users\pmsacks\AppData\Roaming\Printer Info Cache
[2007.08.23 14:46:54 | 000,000,000 | ---D | M] -- C:\Users\pmsacks\AppData\Roaming\SmartDraw
[2010.06.17 15:59:24 | 000,000,000 | ---D | M] -- C:\Users\pmsacks\AppData\Roaming\Tific
[2010.05.13 14:01:34 | 000,000,000 | ---D | M] -- C:\Users\pmsacks\AppData\Roaming\uTorrent
[2010.07.20 21:16:06 | 000,032,612 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2010.07.20 21:47:38 | 000,000,422 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{B6C1BFDC-B045-40A2-9D0B-976C849B0355}.job

========== Purity Check ==========

< End of report >

20 юли 201016 г.

Добре. Сега има ли проблем със зареждането на Vista, както и със съобщението при стартиране?

20 юли 201016 г.

Автор

След стъпка 1 и ребут-а ли не няма съобщения.Стартирането е нормално. Ъпдейти отново не минават.

20 юли 201016 г.

Добре, сега опитай да стартираш един фикс (ZIP архив, който съдържа BAT файл), който закачам към това съобщение. Рестартирай и пиши дали има ефект.

21 юли 201016 г.

Автор

Примяна на кое да има?

Преди последния фикс единствената разлика беше това.

Ако питате за инсталирането на джавата и ъпдеитите, не няма промяна, отново е неуспешно.

21 юли 201016 г.

Добре. Сега ще може ли да използвате следното за деинсталация на Java: Windows Installer CleanUp Utility? После да обновите Java до последната версия и да почистите с JavaRa.

За ъпдейтите на Windows: Start -> копирате (Copy) и поставяте в полето следния текст (който съм маркирал в синьо):

regsvr32 %windir%\system32\wups2.dll

натискате ENTER и би трябвало да стане.

Редактирано 21 юли 201016 г. от nologo (преглед на промените)

21 юли 201016 г.

Автор

Благодаря, може ли да ползвам Revo Uninstaller Pro тъй като го имам наличен?

Проблема не е само в Джавата а и при други инсталции и ъпдейти.

Сега ще направя това което сте написали и ще докладвам.

21 юли 201016 г.

Не, само с Windows Installer CleanUp Utility. После може да го махнете.

21 юли 201016 г.

Автор

Свалих програмата и изпълних указанията.

После копирах regsvr32 %windir%\system32\wups2.dll в RUN конзолата и получих

Новата джава се инсталира без проблем.

Благодаря Ви за отделеното внимание и време!

Редактирано 21 юли 201016 г. от ALEXONE™ (преглед на промените)

21 юли 201016 г.

Хм, на мен ми прилича на проблем с .NET framework. Затова стартирайте sfc /scannow в конзолата. Възможно е SFC да поиска инсталационен диск на Vista. После опитайте да деинсталирате и да инсталирате .NET Framework.

Никак не е лесно да се поправя .NET framework на Vista, защото информацията в регистрите за .NET е защитена с Windows Resource Protection (WRP). Засега нямам 100% работещ вариант за успешно поправяне на .NET на Vista, даже за по-старите версии на .NET...

21 юли 201016 г.

Автор

Vista та ми е пригинална с лепенка на дъното, но диск нямам.

стартирах sfc /scannow в run конзолата без резултат.

Преди малко рестартирах и пробввах последните ъпдейти който не минаха също.

Редактирано 21 юли 201016 г. от ALEXONE™ (преглед на промените)

21 юли 201016 г.

Ако е лаптоп - би трябвало да има дял за възстановяване - recovery partition. Също така и вариант за създаване на дискове за възстановяване на Vista. Засега нямам идея как да се поправи тази Vista, освен Repair Install или чиста инсталация със заводски (за лаптопа) настройки. Но първо проверете дали има дял за възстановяване.

21 юли 201016 г.

Всъщност може да пробваме ComboFix. Ето как:

Следвайте следната инструкция за проверка с ComboFix:

Изтеглете ComboFix от следния мирър: от BleepingComputer. След изтегляне на файла го запишете (бутон Save -> Save as) ComboFix на вашия десктоп, снимка:
Затворете всички работещи приложения или отворени прозорци. Прекратете временно работата на антивирусната програма и на други програми за сигурност, (ако има такива)
Преименувайте ComboFix.exe на ff2.exe
Стартирайте с двоен клик ff2.exe. За целта използвайте YES, за да се съгласите с условията за използване на програмата. Важно: след като се стартира ComboFix не бива да се движи мишката или да се кликва върху отворения прозорец на програмата. Просто търпеливо оставете ComboFix да си свърши работата (20-30 минути), без да използвате компютъра за други цели.
ComboFix ще спре временно Интернет връзката, но след като приключи работата на програмата тази връзка ще бъде възстановена автоматично. ComboFix ще сканира за проблеми и за заразени файлове, като това може да отнеме известно време. Моля да бъдете търпеливи. Ако има проблем с Интернет връзката, моля да прочетете това: Manually restoring the Internet connection section.
Забележка: При проблеми с ComboFix копирайте (Copy) и поставете (Paste) съдържанието на C:\BUG.txt в следващия си коментар.
Когато работата на ComboFix приключи, ще се появи текстов документ (log) в Notepad, виж снимката:
Копирайте (Copy) и поставете (Paste) съдържанието на лога в следващия си коментар или го прикачете към коментара си.

22 юли 201016 г.

Автор

Явно сте взели проблема ми при сърце за което съм Ви благодарен!

Ето лог-а от последния-fix

ComboFix 10-07-21.02 - pmsacks 07.2010 г. 9:07.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1251.359.1033.18.2037.1059 [GMT 3:00]
Running from: c:\users\pmsacks\Desktop\ff2.exe
AV: Sunbelt VIPRE *On-access scanning disabled* (Outdated) {964FCE60-0B18-4D30-ADD6-EB178909041C}
SP: Sunbelt VIPRE *disabled* (Outdated) {9817B764-AE4E-4B29-AEE7-725B7A50BD48}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\programdata\pswi_preloaded.exe

.
((((((((((((((((((((((((( Files Created from 2010-06-22 to 2010-07-22 )))))))))))))))))))))))))))))))
.

2010-07-22 06:02 . 2010-07-22 06:03 -------- d-----w- C:\32788R22FWJFW
2010-07-21 16:47 . 2009-10-09 21:56 2048 ----a-w- c:\windows\system32\winrsmgr.dll
2010-07-21 12:20 . 2010-07-21 12:20 3584 ----a-r- c:\users\pmsacks\AppData\Roaming\Microsoft\Installer\{121634B0-2F4B-11D3-ADA3-00C04F52DD52}\Icon386ED4E3.exe
2010-07-21 12:19 . 2010-07-21 12:19 -------- d-----w- c:\program files\Windows Installer Clean Up
2010-07-21 12:19 . 2010-07-21 12:19 -------- d-----w- c:\program files\MSECACHE
2010-07-20 18:13 . 2010-07-20 18:13 -------- d-----w- C:\_OTL
2010-07-18 16:55 . 2010-07-18 16:55 -------- d-----w- c:\program files\Sophos
2010-07-18 14:27 . 2010-07-18 14:27 -------- d-----w- c:\users\pmsacks\AppData\Roaming\Malwarebytes
2010-07-18 14:27 . 2010-04-29 09:19 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-07-18 14:27 . 2010-07-18 14:27 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-07-18 14:27 . 2010-07-18 14:27 -------- d-----w- c:\programdata\Malwarebytes
2010-07-18 14:27 . 2010-04-29 09:19 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-06-24 08:41 . 2010-07-10 07:12 -------- d-----w- c:\users\pmsacks\AppData\Roaming\Avant Profiles
2010-06-24 08:41 . 2010-06-24 08:41 -------- d-----w- c:\program files\Avant Browser
2010-06-24 07:16 . 2010-04-16 16:43 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2010-06-24 07:16 . 2010-04-16 14:39 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2010-06-22 10:27 . 2010-06-22 10:27 -------- d-----w- c:\program files\Microsoft F#
2010-06-22 08:49 . 2009-07-23 03:08 50200 ----a-w- c:\windows\system32\perf-SQLAgent$SQLEXPRESS-sqlagtctr10.1.2531.0.dll
2010-06-22 08:48 . 2009-07-23 03:08 79896 ----a-w- c:\windows\system32\perf-MSSQL$SQLEXPRESS-sqlctr10.1.2531.0.dll
2010-06-22 08:46 . 2010-06-22 08:46 -------- d-----w- c:\windows\system32\RsFx
2010-06-22 08:44 . 2010-06-22 08:44 -------- d-----w- c:\program files\Microsoft Visual Studio 9.0
2010-06-22 08:29 . 2010-06-24 04:55 547296 ----a-w- c:\programdata\Microsoft\VWDExpress\10.0\1033\ResourceCache.dll
2010-06-22 08:23 . 2010-06-24 06:45 -------- d-----w- c:\program files\Microsoft SDKs
2010-06-22 08:23 . 2010-06-22 08:23 -------- d-----w- c:\program files\Microsoft Help Viewer
2010-06-22 07:57 . 2009-11-08 17:55 99176 ----a-w- c:\windows\system32\PresentationHostProxy.dll
2010-06-22 07:57 . 2009-11-08 17:55 49472 ----a-w- c:\windows\system32\netfxperf.dll
2010-06-22 07:57 . 2009-11-08 17:55 297808 ----a-w- c:\windows\system32\mscoree.dll
2010-06-22 07:57 . 2009-11-08 17:55 295264 ----a-w- c:\windows\system32\PresentationHost.exe
2010-06-22 07:57 . 2009-11-08 17:55 1130824 ----a-w- c:\windows\system32\dfshim.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-21 17:00 . 2007-06-29 14:25 -------- d-----w- c:\users\pmsacks\AppData\Roaming\Skype
2010-07-21 12:37 . 2010-05-11 06:13 423656 ----a-w- c:\windows\system32\deployJava1.dll
2010-07-15 21:53 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2010-07-07 06:33 . 2009-12-16 20:10 -------- d-----w- c:\users\pmsacks\AppData\Roaming\Winamp
2010-06-27 11:39 . 2009-06-30 01:54 -------- d-----w- c:\program files\Common Files\PC Tools
2010-06-25 10:02 . 2007-06-29 14:33 -------- d-----w- c:\program files\Picasa2
2010-06-24 07:58 . 2007-02-24 18:48 -------- d-----w- c:\program files\Microsoft.NET
2010-06-24 06:26 . 2009-12-29 18:06 -------- d-----w- c:\program files\Microsoft
2010-06-24 06:09 . 2007-05-08 09:28 -------- d-----w- c:\program files\Common Files\Symantec Shared
2010-06-22 08:47 . 2007-02-24 18:47 -------- d-----w- c:\program files\Microsoft SQL Server
2010-06-17 22:51 . 2009-08-24 18:10 -------- d-----w- c:\program files\Winamp
2010-06-17 22:10 . 2010-06-17 22:10 -------- d-----w- c:\program files\Winamp Detect
2010-06-17 12:59 . 2010-06-17 12:59 -------- d-----w- c:\users\pmsacks\AppData\Roaming\Tific
2010-06-13 05:00 . 2010-06-13 03:40 -------- d-----w- c:\users\pmsacks\AppData\Roaming\Auslogics
2010-06-03 02:41 . 2010-06-03 02:41 3600384 ----a-w- c:\windows\system32\GPhotos.scr
2010-05-31 05:54 . 2010-05-31 05:54 -------- d-----w- c:\program files\GetData
2010-05-26 17:06 . 2010-06-20 07:52 34304 ----a-w- c:\windows\system32\atmlib.dll
2010-05-26 14:47 . 2010-06-20 07:52 289792 ----a-w- c:\windows\system32\atmfd.dll
2010-05-21 11:14 . 2009-10-03 05:46 221568 ------w- c:\windows\system32\MpSigStub.exe
2010-05-07 14:35 . 2010-05-07 14:35 690952 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2010-05-04 05:59 . 2010-06-20 07:50 916480 ----a-w- c:\windows\system32\wininet.dll
2010-05-04 05:55 . 2010-06-20 07:50 71680 ----a-w- c:\windows\system32\iesetup.dll
2010-05-04 05:55 . 2010-06-20 07:50 109056 ----a-w- c:\windows\system32\iesysprep.dll
2010-05-04 04:31 . 2010-06-20 07:50 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2010-05-01 14:13 . 2010-06-20 07:52 2037248 ----a-w- c:\windows\system32\win32k.sys
2010-04-23 14:13 . 2010-06-20 07:52 2048 ----a-w- c:\windows\system32\tzres.dll
2007-08-27 14:14 . 2007-08-27 14:14 10342366 ----a-w- c:\program files\Windows6.0-KB938979-x86.msu
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-09-11 218032]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-19 1008184]
"Apoint"="c:\program files\Apoint\Apoint.exe" [2006-11-13 118784]
"ISBMgr.exe"="c:\program files\Sony\ISB Utility\ISBMgr.exe" [2007-01-23 321656]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-01-23 98304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-01-23 106496]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-01-23 81920]
"BigDogPath"="c:\windows\VM_STI.EXE" [2004-06-09 40960]
"Windows Mobile-based device management"="c:\windows\WindowsMobile\wmdSync.exe" [2006-11-02 215552]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]
2007-02-13 23:19 98304 ----a-w- c:\windows\System32\VESWinlogon.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux6"=wdmaud.drv

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ \0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):42,29,0a,fd,74,47,ca,01

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 ADM851X;ADM851X USB To Fast Ethernet Adapter;c:\windows\system32\DRIVERS\ADM851X.sys [2006-07-19 26190]
R3 MEMSWEEP2;MEMSWEEP2;c:\windows\system32\D700.tmp [x]
R3 Revoflt;Revoflt;c:\windows\system32\DRIVERS\revoflt.sys [2009-12-30 27192]
R3 SampleCollector;Intel® Sample Collector;c:\program files\Sony\VAIO Care\collsvc.exe [2009-09-16 122880]
R3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [2009-01-07 348752]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
R4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [2009-07-23 47128]
R4 RsFx0103;RsFx0103 Driver;c:\windows\system32\DRIVERS\RsFx0103.sys [2009-03-30 239336]
R4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [2009-03-30 366936]
S0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2009-04-03 130936]
S1 SBRE;SBRE;c:\windows\system32\drivers\SBREdrv.sys [2008-10-23 92464]
S1 sbtis;sbtis;c:\windows\system32\drivers\sbtis.sys [2008-10-09 202928]
S2 sbapifs;sbapifs;c:\windows\system32\DRIVERS\sbapifs.sys [2008-09-12 69168]
S3 ti21sony;ti21sony;c:\windows\system32\drivers\ti21sony.sys [2007-02-08 807424]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
.
Contents of the 'Scheduled Tasks' folder

2010-07-22 c:\windows\Tasks\User_Feed_Synchronization-{B6C1BFDC-B045-40A2-9D0B-976C849B0355}.job
- c:\windows\system32\msfeedssync.exe [2010-06-20 04:30]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.mercedes-club-bg.com/
IE: &D&ownload &with BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm
IE: &D&ownload all video with BitComet - c:\program files\BitComet\BitComet.exe/AddVideo.htm
IE: &D&ownload all with BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
IE: Google AdSense Preview Tool - http://pagead2.googlesyndication.com/pagead/preview/en/preview.html
IE: Post Image to Blog - c:\program files\ImageShackToolbar\ImageShackToolbar.dll/5003
IE: Tag This Image - c:\program files\ImageShackToolbar\ImageShackToolbar.dll/5002
IE: Transload Image to ImageShack - c:\program files\ImageShackToolbar\ImageShackToolbar.dll/5004
IE: Upload All Images to ImageShack - c:\program files\ImageShackToolbar\ImageShackToolbar.dll/5000
IE: Upload Image to ImageShack - c:\program files\ImageShackToolbar\ImageShackToolbar.dll/5001
.
- - - - ORPHANS REMOVED - - - -

SafeBoot-SBAMSvc
AddRemove-HijackThis - c:\users\pmsacks\Desktop\Software2\HijackThis.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-07-22 09:27
Windows 6.0.6002 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SampleCollector]
"ImagePath"="\"c:\program files\Sony\VAIO Care\collsvc.exe\" \"/service\" \"/counter=\Processor(_Total)\% Processor Time:5\" \"/counter=\PhysicalDisk(_Total)\Disk Bytes/sec:5\" \"/counter=\Network Interface(*)\Bytes Total/sec:5\" \"/directory=inteldata\""

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MEMSWEEP2]
"ImagePath"="\??\c:\windows\system32\D700.tmp"
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="FirefoxHTML"

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="FirefoxHTML"

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="FirefoxHTML"

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="FirefoxHTML"

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="FirefoxHTML"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:0000001b

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2010-07-22 09:35:27
ComboFix-quarantined-files.txt 2010-07-22 06:35

Pre-Run: 53 109 825 536 bytes free
Post-Run: 54 407 925 760 bytes free

- - End Of File - - 7FFAAF78696828E00472352D0690FB65

Да лап топ е машината. А къде да намеря recovery partition?

Редактирано 22 юли 201016 г. от ALEXONE™ (преглед на промените)

22 юли 201016 г.

Добре, може ли разберем какъв е точно моделът на лаптопа?

Добре дошли!

Fixer32 и друг проблем

Featured Replies

Регистрирайте се или влезете в профила си за да коментирате

Разглеждащи това в момента 0

Дарение

Бюлетин

Профил

Навигация

Търсене

Конфигуриране на push известия в браузъра

Chrome (Android)

Chrome (Desktop)

Safari (iOS 16.4+)

Safari (macOS)

Edge (Android)

Edge (Desktop)

Firefox (Android)

Firefox (Desktop)