Направете следното:

Стъпка 1

Следвайте следната инструкция за работа с ERUNT (програмата ще направи бекъп на регистрите):

• Изтеглете програмата ERUNT
  
• Инсталирайте и стартирате ERUNT.
  
• Изберете папка за съхранение в секцията Backup options, като трябва да бъдат маркирани "System registry", "Current user registry" и "Other open user registries". Натиснете "Ok" и потвърдете създаването на папка. Описание с картинки на ERUNT: тук.
  

Стъпка 2

Следвайте следната инструкция за работа с TDSSKiller (по-подробна инструкция на английски език: TDSSKiller):

• Изтеглете TDSSKiller и го разархивирайте на десктопa.
  
• Стартирайте TDSSKiller.exe, след това Start Scan.
  
• Ако бъде открит инфектиран (infected) файл, проверете дали е избрана опцията Cure (по подразбиране). Ако е избрана Cure - натиснете Continue, снимка:
  
  
• Ако бъде открит подозрителен (suspicious) файл, проверете дали е избрана опцията Skip (по подразбиране). Ако е избрана Skip - натиснете Continue.
  
• Възможно е програмата да изиска рестарт. Ако е така - потвърдете с Reboot Now.
  -Ако няма рестартиране, отидете на Report. Ще се появи лог файл. Копирайте и поставете съдържанието му в следващия си коментар.
  -Ако има рестартиране, отидете на в системната директория. Там трябва да има файл с формат: TDSSKiller.[Version]_[Date]_[Time]_log.txt. Отворете го, копирайте и поставете съдържанието му в следващия си коментар.
  

Забележка: За sptd.sys натиснете Skip.

Стъпка 3

Следвайте следната инструкция за работа с Random's System Information Tool (RSIT):

• Изтеглете RSIT от тук и го запишете на десктопа.
  
• Кликнете два пъти върху RSIT.exe, за да стартирате програмата. Натиснете Continue.
  
• Когато програмата завърши работата си, ще се отворят два текстови документа: log.txt и info.txt. Двата файла също могат да се намерят в папка RSIT на системния дял.
  
• Прикачете двата файла или копирайте последователно съдържанието им с Копирай (Copy) и с Постави (Paste) ги поставете в следващия си коментар.
  

Така ето изглежда чисто с този инструмент

2010/08/22 16:24:16.0171 TDSS rootkit removing tool 2.4.1.2 Aug 16 2010 09:46:23

2010/08/22 16:24:16.0171 ================================================================================

2010/08/22 16:24:16.0171 SystemInfo:

2010/08/22 16:24:16.0171

2010/08/22 16:24:16.0171 OS Version: 5.1.2600 ServicePack: 3.0

2010/08/22 16:24:16.0171 Product type: Workstation

2010/08/22 16:24:16.0171 ComputerName: GANGOSAN-9708CA

2010/08/22 16:24:16.0171 UserName: Ghost

2010/08/22 16:24:16.0171 Windows directory: C:\WINDOWS

2010/08/22 16:24:16.0171 System windows directory: C:\WINDOWS

2010/08/22 16:24:16.0171 Processor architecture: Intel x86

2010/08/22 16:24:16.0171 Number of processors: 2

2010/08/22 16:24:16.0171 Page size: 0x1000

2010/08/22 16:24:16.0171 Boot type: Normal boot

2010/08/22 16:24:16.0171 ================================================================================

2010/08/22 16:24:16.0781 Initialize success

2010/08/22 16:24:20.0671 ================================================================================

2010/08/22 16:24:20.0671 Scan started

2010/08/22 16:24:20.0671 Mode: Manual;

2010/08/22 16:24:20.0671 ================================================================================

2010/08/22 16:24:26.0390 Aavmker4 (467f062f76e07512ecc1f5f60aab2988) C:\WINDOWS\system32\drivers\Aavmker4.sys

2010/08/22 16:24:27.0265 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys

2010/08/22 16:24:27.0578 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys

2010/08/22 16:24:28.0078 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys

2010/08/22 16:24:28.0375 Afc (fe3ea6e9afc1a78e6edca121e006afb7) C:\WINDOWS\system32\drivers\Afc.sys

2010/08/22 16:24:28.0656 AFD (4d43e74f2a1239d53929b82600f1971c) C:\WINDOWS\System32\drivers\afd.sys

2010/08/22 16:24:30.0546 Ambfilt (267fc636801edc5ab28e14036349e3be) C:\WINDOWS\system32\drivers\Ambfilt.sys

2010/08/22 16:24:32.0343 aswFsBlk (0c0b08847f2f24baa7bd43d8f2c6c8b0) C:\WINDOWS\system32\drivers\aswFsBlk.sys

2010/08/22 16:24:32.0843 aswMon2 (aa504fa592c9ed79174cb06b8ae340aa) C:\WINDOWS\system32\drivers\aswMon2.sys

2010/08/22 16:24:33.0312 aswRdr (f385ffd39165453fda96736aa3edfd9d) C:\WINDOWS\system32\drivers\aswRdr.sys

2010/08/22 16:24:33.0609 aswSP (45adea26bf613a54fed64ecdd12e58a7) C:\WINDOWS\system32\drivers\aswSP.sys

2010/08/22 16:24:33.0906 aswTdi (c4ee975c87176f1900662d2874233c7f) C:\WINDOWS\system32\drivers\aswTdi.sys

2010/08/22 16:24:34.0156 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys

2010/08/22 16:24:34.0453 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys

2010/08/22 16:24:34.0906 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys

2010/08/22 16:24:35.0156 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys

2010/08/22 16:24:35.0453 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys

2010/08/22 16:24:35.0687 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys

2010/08/22 16:24:35.0953 CCDECODE (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys

2010/08/22 16:24:36.0468 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys

2010/08/22 16:24:36.0734 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys

2010/08/22 16:24:37.0015 Cdrom (4b0a100eaf5c49ef3cca8c641431eacc) C:\WINDOWS\system32\DRIVERS\cdrom.sys

2010/08/22 16:24:38.0375 DeskLock (a07ac13b971bc310d1f32671d2b6e93a) C:\WINDOWS\system32\drivers\DeskLock.sys

2010/08/22 16:24:38.0609 Disk (47b6aaec570f2c11d8bad80a064d8ed1) C:\WINDOWS\system32\DRIVERS\disk.sys

2010/08/22 16:24:39.0125 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys

2010/08/22 16:24:39.0687 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys

2010/08/22 16:24:40.0015 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys

2010/08/22 16:24:40.0312 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys

2010/08/22 16:24:40.0796 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys

2010/08/22 16:24:41.0046 DrvAgent32 (651554e483712b708ede864d0ca1aa73) C:\WINDOWS\system32\Drivers\DrvAgent32.sys

2010/08/22 16:24:41.0328 ExterminateIt (7dff7a3413acea90f7ffabc1f2cac24b) C:\WINDOWS\system32\drivers\extit.sys

2010/08/22 16:24:41.0718 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys

2010/08/22 16:24:42.0031 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys

2010/08/22 16:24:42.0296 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys

2010/08/22 16:24:42.0531 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys

2010/08/22 16:24:42.0796 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\DRIVERS\fltMgr.sys

2010/08/22 16:24:43.0078 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys

2010/08/22 16:24:43.0359 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys

2010/08/22 16:24:43.0640 GEARAspiWDM (4ac51459805264affd5f6fdfb9d9235f) C:\WINDOWS\system32\Drivers\GEARAspiWDM.sys

2010/08/22 16:24:43.0890 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys

2010/08/22 16:24:44.0171 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys

2010/08/22 16:24:44.0843 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys

2010/08/22 16:24:45.0609 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys

2010/08/22 16:24:46.0484 ialm (c5db546f9028cd00e64335091860d8f3) C:\WINDOWS\system32\DRIVERS\igxpmp32.sys

2010/08/22 16:24:47.0375 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys

2010/08/22 16:24:50.0031 IntcAzAudAddService (988a112c4061f309ce9c1abfc971d001) C:\WINDOWS\system32\drivers\RtkHDAud.sys

2010/08/22 16:24:53.0187 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys

2010/08/22 16:24:53.0437 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys

2010/08/22 16:24:53.0687 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys

2010/08/22 16:24:53.0921 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys

2010/08/22 16:24:54.0203 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys

2010/08/22 16:24:54.0515 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys

2010/08/22 16:24:54.0812 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys

2010/08/22 16:24:55.0046 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys

2010/08/22 16:24:55.0171 ISODrive (0ae61463adda697a6291155ce6b08aaf) C:\Program Files\UltraISO\drivers\ISODrive.sys

2010/08/22 16:24:55.0500 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys

2010/08/22 16:24:55.0796 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys

2010/08/22 16:24:56.0125 KSecDD (c6ebf1d6ad71df30db49b8d3287e1368) C:\WINDOWS\system32\drivers\KSecDD.sys

2010/08/22 16:24:56.0687 m4301a (a0911a1867a3d132a744c08b5b1ece61) C:\WINDOWS\system32\DRIVERS\m4301A.sys

2010/08/22 16:24:56.0968 MBAMProtector (67b48a903430c6d4fb58cbaca1866601) C:\WINDOWS\system32\drivers\mbam.sys

2010/08/22 16:24:57.0250 mcdbus (8fd868e32459ece2a1bb0169f513d31e) C:\WINDOWS\system32\DRIVERS\mcdbus.sys

2010/08/22 16:24:57.0531 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys

2010/08/22 16:24:57.0765 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys

2010/08/22 16:24:58.0515 Monfilt (c7d9f9717916b34c1b00dd4834af485c) C:\WINDOWS\system32\drivers\Monfilt.sys

2010/08/22 16:24:59.0296 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys

2010/08/22 16:24:59.0578 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys

2010/08/22 16:25:00.0125 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys

2010/08/22 16:25:00.0609 MRxSmb (d09b9f0b9960dd41e73127b7814c115f) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys

2010/08/22 16:25:01.0031 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys

2010/08/22 16:25:01.0296 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys

2010/08/22 16:25:01.0531 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys

2010/08/22 16:25:01.0750 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys

2010/08/22 16:25:01.0984 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys

2010/08/22 16:25:02.0218 MSTEE (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys

2010/08/22 16:25:02.0484 MTsensor (d48659bb24c48345d926ecb45c1ebdf5) C:\WINDOWS\system32\DRIVERS\ASACPI.sys

2010/08/22 16:25:02.0750 Mup (6546fe6639499fa4bef180bdf08266a1) C:\WINDOWS\system32\drivers\Mup.sys

2010/08/22 16:25:03.0046 NABTSFEC (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys

2010/08/22 16:25:03.0390 NDIS (b5b1080d35974c0e718d64280761bcd5) C:\WINDOWS\system32\drivers\NDIS.sys

2010/08/22 16:25:03.0687 NdisIP (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys

2010/08/22 16:25:03.0921 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys

2010/08/22 16:25:04.0187 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys

2010/08/22 16:25:04.0437 NdisWan (b053a8411045fd0664b389a090cb2bbc) C:\WINDOWS\system32\DRIVERS\ndiswan.sys

2010/08/22 16:25:04.0703 NDProxy (6215023940cfd3702b46abc304e1d45a) C:\WINDOWS\system32\drivers\NDProxy.sys

2010/08/22 16:25:04.0968 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys

2010/08/22 16:25:05.0312 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys

2010/08/22 16:25:05.0921 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys

2010/08/22 16:25:06.0375 Ntfs (a0857c97770034fd2af17dc4014b5abd) C:\WINDOWS\system32\drivers\Ntfs.sys

2010/08/22 16:25:06.0812 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys

2010/08/22 16:25:07.0062 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys

2010/08/22 16:25:07.0296 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys

2010/08/22 16:25:07.0578 NwlnkIpx (8b8b1be2dba4025da6786c645f77f123) C:\WINDOWS\system32\DRIVERS\nwlnkipx.sys

2010/08/22 16:25:07.0859 NwlnkNb (56d34a67c05e94e16377c60609741ff8) C:\WINDOWS\system32\DRIVERS\nwlnknb.sys

2010/08/22 16:25:08.0125 NwlnkSpx (c0bb7d1615e1acbdc99757f6ceaf8cf0) C:\WINDOWS\system32\DRIVERS\nwlnkspx.sys

2010/08/22 16:25:08.0437 NWRDR (36b9b950e3d2e100970a48d8bad86740) C:\WINDOWS\system32\DRIVERS\nwrdr.sys

2010/08/22 16:25:08.0765 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\drivers\Parport.sys

2010/08/22 16:25:09.0046 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys

2010/08/22 16:25:09.0281 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys

2010/08/22 16:25:09.0546 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys

2010/08/22 16:25:10.0000 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys

2010/08/22 16:25:10.0312 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys

2010/08/22 16:25:11.0875 pnarp (36fcac4fa28b462ca867742dea59b0d0) C:\WINDOWS\system32\DRIVERS\pnarp.sys

2010/08/22 16:25:12.0109 pnpcap (429e80e63d78c131f30e62d657e2735a) C:\WINDOWS\system32\DRIVERS\pnpcap.sys

2010/08/22 16:25:12.0375 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys

2010/08/22 16:25:12.0656 PQNTDrv (04f3971b70a7855f04d351aa4bee7799) C:\WINDOWS\system32\drivers\PQNTDrv.sys

2010/08/22 16:25:12.0937 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys

2010/08/22 16:25:13.0203 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys

2010/08/22 16:25:13.0468 purendis (d8ac00388262b1a4878a7ee12f31d376) C:\WINDOWS\system32\DRIVERS\purendis.sys

2010/08/22 16:25:13.0718 PxHelp20 (153d02480a0a2f45785522e814c634b6) C:\WINDOWS\system32\Drivers\PxHelp20.sys

2010/08/22 16:25:15.0015 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys

2010/08/22 16:25:15.0265 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys

2010/08/22 16:25:15.0546 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys

2010/08/22 16:25:15.0796 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys

2010/08/22 16:25:16.0093 Rdbss (9629383f70db691cb6aa5bbd828cd9a9) C:\WINDOWS\system32\DRIVERS\rdbss.sys

2010/08/22 16:25:16.0406 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys

2010/08/22 16:25:16.0718 rdpdr (3a99642ed25a2fad5b0ba55f09ba2f93) C:\WINDOWS\system32\DRIVERS\rdpdr.sys

2010/08/22 16:25:17.0078 RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys

2010/08/22 16:25:17.0390 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys

2010/08/22 16:25:17.0671 rspndr (743d7d59767073a617b1dcc6c546f234) C:\WINDOWS\system32\DRIVERS\rspndr.sys

2010/08/22 16:25:18.0000 RTLE8023xp (c6d34a1874cd2b212dc3e788091c64b4) C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys

2010/08/22 16:25:18.0375 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys

2010/08/22 16:25:18.0609 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys

2010/08/22 16:25:18.0859 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\DRIVERS\serial.sys

2010/08/22 16:25:19.0156 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys

2010/08/22 16:25:19.0625 SLIP (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys

2010/08/22 16:25:20.0093 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys

2010/08/22 16:25:20.0640 sptd (c4bb8a12843d9cbb65f5ff617f389bbd) C:\WINDOWS\system32\Drivers\sptd.sys

2010/08/22 16:25:21.0140 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys

2010/08/22 16:25:21.0515 Srv (da852e3e0bf1cea75d756f9866241e57) C:\WINDOWS\system32\DRIVERS\srv.sys

2010/08/22 16:25:21.0875 streamip (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys

2010/08/22 16:25:22.0125 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys

2010/08/22 16:25:22.0406 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys

2010/08/22 16:25:23.0546 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys

2010/08/22 16:25:23.0937 Tcpip (ad978a1b783b5719720cff204b666c8e) C:\WINDOWS\system32\DRIVERS\tcpip.sys

2010/08/22 16:25:24.0312 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys

2010/08/22 16:25:24.0546 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys

2010/08/22 16:25:24.0812 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys

2010/08/22 16:25:25.0437 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys

2010/08/22 16:25:26.0062 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys

2010/08/22 16:25:26.0484 usbaudio (e919708db44ed8543a7c017953148330) C:\WINDOWS\system32\drivers\usbaudio.sys

2010/08/22 16:25:26.0734 usbccgp (c18d6c74953621346df6b0a11f80c1cc) C:\WINDOWS\system32\DRIVERS\usbccgp.sys

2010/08/22 16:25:27.0015 usbehci (152ee0baa614388273a0b9ae9c9fd5a0) C:\WINDOWS\system32\DRIVERS\usbehci.sys

2010/08/22 16:25:27.0265 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys

2010/08/22 16:25:27.0546 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS

2010/08/22 16:25:27.0796 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys

2010/08/22 16:25:28.0093 usbvideo (63bbfca7f390f4c49ed4b96bfb1633e0) C:\WINDOWS\system32\Drivers\usbvideo.sys

2010/08/22 16:25:28.0390 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys

2010/08/22 16:25:28.0890 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys

2010/08/22 16:25:29.0171 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys

2010/08/22 16:25:29.0671 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys

2010/08/22 16:25:29.0984 WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys

2010/08/22 16:25:30.0265 WSTCODEC (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS

2010/08/22 16:25:30.0328 ================================================================================

2010/08/22 16:25:30.0328 Scan finished

2010/08/22 16:25:30.0328 ================================================================================

info.txt logfile of random's system information tool 1.08 2010-08-22 16:30:33

======Uninstall list======

-->"C:\Program Files\InstallShield Installation Information\{BB8AE808-F003-4C7F-B56B-8C80EEAFFE23}\setup.exe" --u:{BB8AE808-F003-4C7F-B56B-8C80EEAFFE23}

-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf

µTorrent-->"C:\Program Files\uTorrent\uTorrent.exe" /UNINSTALL

22.0-->"C:\Program Files\gps\unins000.exe"

3D World Map 2.1-->"C:\Program Files\Longgame\3D World Map\uninstall.exe" /uninstall

888poker-->C:\PROGRA~1\PACIFI~1\UNWISE.EXE C:\PROGRA~1\PACIFI~1\INSTALL.LOG

ActionPoker.com-->C:\Program Files\Action Poker\uninst.exe

Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\FlashUtil10h_ActiveX.exe -maintain activex

Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\FlashUtil10h_Plugin.exe -maintain plugin

Adobe Flash Player 9 ActiveX-->MsiExec.exe /X{8E9DB7EF-5DD3-499E-BA2A-A1F3153A4DF8}

Advanced IP Scanner v1.5-->C:\Program Files\Advanced IP Scanner\uninstal.exe

Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}

ArcSoft PhotoImpression 5-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{E629851A-1B1A-4671-961A-A9AF549E03A2}\SETUP.EXE" -l0x9

ArcSoft TotalMedia Extreme-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{0B68672F-C64F-4D29-9EDC-ECDCBE3C5F19}\Setup.exe" -l0x9

Auslogics BoostSpeed-->"C:\Program Files\Auslogics\Auslogics BoostSpeed\unins000.exe"

Avant Browser (remove only)-->"C:\Program Files\Avant Browser\uninst.exe"

avast! Free Antivirus-->C:\Program Files\Alwil Software\Avast5\aswRunDll.exe "C:\Program Files\Alwil Software\Avast5\Setup\setiface.dll" RunSetup

BackRex Expert Backup-->C:\PROGRA~1\BACKRE~2\UNWISE.EXE C:\PROGRA~1\BACKRE~2\INSTALL.LOG

BeFaster-->"C:\Program Files\BeFaster\uninstall.exe"

BS.Player PRO-->"C:\Program Files\Webteh\BSplayerPro\uninstall.exe"

Bulgarian (Phonetic) by Iliya Dankov-->MsiExec.exe /I{57BA3105-8E44-45BD-BB3A-F0BD5EA0575B}

ChessRally 2.6-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{235B3B96-A129-411C-A0DE-DA154590F5D3}\setup.exe" -l0x9 -removeonly

ClassicPro© v1.14-->"C:\Program Files\Winamp\Uninstall ClassicPro.exe"

Components Setup-->C:\Program Files\InstallShield Installation Information\{31187E06-E131-4709-9285-7D105D77AA89}\setup.exe -runfromtemp -l0x0009

Contents-->MsiExec.exe /I{F6A76E9C-C299-4CFA-AD2A-57FE9DD68B70}

Corel VideoStudio Pro X3-->c:\Program Files\Corel\Corel VideoStudio Pro X3\Setup\{F072CA07-A781-45E4-9975-C033A73019CF}\SetupARP.exe /arp

Daihinia-->C:\Program Files\Daihinia\uninstall.exe

Definition update for Microsoft Office 2010 (KB982726)-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0011-0000-0000-0000000FF1CE}" "{691FAD36-EC97-46FA-9F96-4CA91C126ECA}" "1033" "0"

Desktop Lock Business Edition 7.1-->C:\Program Files\Desktop Lock\uninst.exe

DeviceIO-->MsiExec.exe /I{F4E9851F-765E-40B7-9859-237C2724E62C}

DH Driver Cleaner Professional Edition-->C:\Program Files\Driver Cleaner Pro\Uninstall.exe

Driver Genius Professional Edition-->"C:\Program Files\Driver-Soft\DriverGenius\unins000.exe"

Driver Magician 3.48-->"C:\Program Files\Driver Magician\unins000.exe"

Driver Robot-->"C:\Program Files\Driver Robot\1.2.0.5\unins000.exe"

DriverAgent by eSupport.com-->RunDll32.exe advpack.dll,LaunchINFSection driveragent_exe.inf,TVICHW32Remove

Easy MP3 Downloader-->"C:\Program Files\EasyMP3Downloader\uninst.exe"

Easy Video Splitter 1.28-->"C:\Program Files\Easy Video Splitter\unins000.exe"

ERUNT 1.1j-->"C:\Program Files\ERUNT\unins000.exe"

EVEREST Corporate Edition v5.50-->"C:\Program Files\Lavalys\EVEREST Corporate Edition\unins000.exe"

Exterminate It!-->C:\Program Files\Exterminate It!\ExterminateIt_Uninst.exe

FastStone Capture 6.5-->C:\Program Files\FastStone Capture\uninst.exe

FastStone Image Viewer 4.1 Beta 2-->C:\Program Files\FastStone Image Viewer\uninst.exe

Firefox Preloader-->"C:\Program Files\FirefoxPreloader\unins000.exe"

FlexType 2K-->C:\WINDOWS\Datecs\SXUNINST.EXE

Foxit Reader-->C:\Program Files\Foxit Software\Foxit Reader\Uninstall.exe

Free ISO Creator version 2.8-->"C:\Program Files\Free ISO Creator\unins000.exe"

'Full Speed' Internet Booster + Performance Tests-->"C:\WINDOWS\'Full Speed' Internet Booster + Performance Tests\uninstall.exe" "/U:C:\Program Files\'Full Speed' Internet Booster + Performance Tests\Uninstall\uninstall.xml"

Glary Utilities Pro 2.26.0.956-->"C:\Program Files\Glary Utilities\unins000.exe"

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall /qb+ REBOOTPROMPT=""

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""

Hotfix for Windows XP (KB961118)-->"C:\WINDOWS\$NtUninstallKB961118$\spuninst\spuninst.exe"

Hotfix for Windows XP (KB981793)-->"C:\WINDOWS\$NtUninstallKB981793$\spuninst\spuninst.exe"

HP USB Disk Storage Format Tool-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{0E0DF90C-D0BA-4C89-9262-AD78D1A3DE51}\Setup.exe" -l0x9 anything

ICA-->MsiExec.exe /I{F072CA07-A781-45E4-9975-C033A73019CF}

IM Magician-->C:\Program Files\InstallShield Installation Information\{2969CB97-DF91-4752-BE47-8A73AE810E6C}\setup.exe -runfromtemp -l0x0009 -removeonly

ImgBurn-->"C:\Program Files\ImgBurn\uninstall.exe"

Intel® Graphics Media Accelerator Driver-->C:\WINDOWS\system32\igxpun.exe -uninstall

Internet Download Manager-->C:\Program Files\Internet Download Manager\Uninstall.exe

IPM_VS_Pro-->MsiExec.exe /I{FD67D9F3-FED6-4A2E-9D6C-8C8C44DEF8FF}

ISO Recorder-->MsiExec.exe /I{DFC6573E-124D-4026-BFA4-B433C9D3FF21}

Java 6 Update 13-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216013FF}

KillProcess 2.44-->C:\Program Files\KillProcess\uninst.exe

K-Lite Codec Pack 5.7.0 (Full)-->"C:\Program Files\K-Lite Codec Pack\unins000.exe"

L&H TTS3000 Russian-->RunDll32 advpack.dll,LaunchINFSection C:\WINDOWS\INF\LHTTSRUR.inf, Uninstall

Lernout & Hauspie TruVoice American English TTS Engine-->RunDll32 advpack.dll,LaunchINFSection C:\WINDOWS\INF\tv_enua.inf, Uninstall

MagicDisc 2.7.106-->C:\PROGRA~1\MAGICD~1\UNWISE.EXE C:\PROGRA~1\MAGICD~1\INSTALL.LOG

Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"

Microsoft .NET Framework 1.1 Security Update (KB979906)-->"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M979906\M979906Uninstall.msp"

Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}

Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}

Microsoft .NET Framework 2.0 Service Pack 2-->MsiExec.exe /I{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}

Microsoft .NET Framework 3.0 Service Pack 2-->MsiExec.exe /I{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}

Microsoft .NET Framework 3.5 SP1-->C:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe

Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}

Microsoft Calculator Plus-->MsiExec.exe /I{83073C45-3003-4671-9A86-243AAADD915A}

Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0016-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}

Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0018-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}

Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001A-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}

Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001B-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}

Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {DE5A002D-8122-4278-A7EE-3121E7EA254E}

Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0115-0409-0000-0000000FF1CE} /uninstall {DE5A002D-8122-4278-A7EE-3121E7EA254E}

Microsoft Office Access MUI (English) 2010-->MsiExec.exe /X{90140000-0015-0409-0000-0000000FF1CE}

Microsoft Office Access Setup Metadata MUI (English) 2010-->MsiExec.exe /X{90140000-0117-0409-0000-0000000FF1CE}

Microsoft Office Excel MUI (English) 2007-->MsiExec.exe /X{90120000-0016-0409-0000-0000000FF1CE}

Microsoft Office Excel MUI (English) 2010-->MsiExec.exe /X{90140000-0016-0409-0000-0000000FF1CE}

Microsoft Office Groove MUI (English) 2010-->MsiExec.exe /X{90140000-00BA-0409-0000-0000000FF1CE}

Microsoft Office InfoPath MUI (English) 2010-->MsiExec.exe /X{90140000-0044-0409-0000-0000000FF1CE}

Microsoft Office OneNote MUI (English) 2010-->MsiExec.exe /X{90140000-00A1-0409-0000-0000000FF1CE}

Microsoft Office Outlook MUI (English) 2007-->MsiExec.exe /X{90120000-001A-0409-0000-0000000FF1CE}

Microsoft Office Outlook MUI (English) 2010-->MsiExec.exe /X{90140000-001A-0409-0000-0000000FF1CE}

Microsoft Office PowerPoint MUI (English) 2007-->MsiExec.exe /X{90120000-0018-0409-0000-0000000FF1CE}

Microsoft Office PowerPoint MUI (English) 2010-->MsiExec.exe /X{90140000-0018-0409-0000-0000000FF1CE}

Microsoft Office Professional Plus 2010-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\setup.exe" /uninstall PROPLUS

Microsoft Office Professional Plus 2010-->MsiExec.exe /X{90140000-0011-0000-0000-0000000FF1CE}

Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}

Microsoft Office Proof (English) 2010-->MsiExec.exe /X{90140000-001F-0409-0000-0000000FF1CE}

Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}

Microsoft Office Proof (French) 2010-->MsiExec.exe /X{90140000-001F-040C-0000-0000000FF1CE}

Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}

Microsoft Office Proof (Spanish) 2010-->MsiExec.exe /X{90140000-001F-0C0A-0000-0000000FF1CE}

Microsoft Office Proofing (English) 2007-->MsiExec.exe /X{90120000-002C-0409-0000-0000000FF1CE}

Microsoft Office Proofing (English) 2010-->MsiExec.exe /X{90140000-002C-0409-0000-0000000FF1CE}

Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {ABDDE972-355B-4AF1-89A8-DA50B7B5C045}

Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {F580DDD5-8D37-4998-968E-EBB76BB86787}

Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0C0A-0000-0000000FF1CE} /uninstall {187308AB-5FA7-4F14-9AB9-D290383A10D9}

Microsoft Office Publisher MUI (English) 2010-->MsiExec.exe /X{90140000-0019-0409-0000-0000000FF1CE}

Microsoft Office Shared MUI (English) 2007-->MsiExec.exe /X{90120000-006E-0409-0000-0000000FF1CE}

Microsoft Office Shared MUI (English) 2010-->MsiExec.exe /X{90140000-006E-0409-0000-0000000FF1CE}

Microsoft Office Shared Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0115-0409-0000-0000000FF1CE}

Microsoft Office Shared Setup Metadata MUI (English) 2010-->MsiExec.exe /X{90140000-0115-0409-0000-0000000FF1CE}

Microsoft Office Word MUI (English) 2007-->MsiExec.exe /X{90120000-001B-0409-0000-0000000FF1CE}

Microsoft Office Word MUI (English) 2010-->MsiExec.exe /X{90140000-001B-0409-0000-0000000FF1CE}

Microsoft Silverlight-->MsiExec.exe /I{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}

Microsoft Silverlight-->MsiExec.exe /X{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053-->MsiExec.exe /X{770657D0-A123-3C07-8E44-1C83EC895118}

Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{837b34e3-7c30-493c-8f6a-2b0f04e2912c}

Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148-->MsiExec.exe /X{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17-->MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148-->MsiExec.exe /X{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}

MLE-->MsiExec.exe /I{7E4CB404-F1E4-4E81-A1CB-2CBB310481D1}

Morphyre-->"C:\Program Files\Morphyre\uninstall.exe"

Mozilla Firefox (3.6.8)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe

MSXML 4.0 SP2 (KB941833)-->MsiExec.exe /I{C523D256-313D-4866-B36A-F3DE528246EF}

MSXML 4.0 SP2 (KB941833)-->MsiExec.exe /X{C523D256-313D-4866-B36A-F3DE528246EF}

MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}

MSXML 4.0 SP2 (KB973688)-->MsiExec.exe /I{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}

Need For Speed Underground-->C:\Program Files\EA GAMES\Need For Speed Underground\EAUninstall.exe

Online TV Player 4-->"C:\Program Files\Online TV Player 4\unins000.exe"

Opera 10.60-->MsiExec.exe /X{90BC5F99-9172-43B1-805F-77BCC800CAB7}

Photoshop cs4 ME-->C:\Program Files\Photoshop cs4 ME\ЫнС нСЯшИ. exe

PokerStars-->"C:\Program Files\PokerStars\PokerStarsUninstall.exe" /u:PokerStars

PureHD-->MsiExec.exe /I{F8423392-2296-4748-9B66-344432459632}

QuickTime-->MsiExec.exe /I{BFD96B89-B769-4CD6-B11E-E79FFD46F067}

RAR Password Recovery v1.1 RC16 (remove only)-->C:\Program Files\Intelore\RAR-PR\uninstall.exe

Readon TV Movie Radio Player 7.2.0.0-->MsiExec.exe /I{1584854C-1513-40EA-96D4-493384D0A3C7}

Real Hide IP-->"C:\Program Files\RealHideIP\uninst.exe"

REALTEK GbE & FE Ethernet PCI-E NIC Driver-->C:\Program Files\InstallShield Installation Information\{C9BED750-1211-4480-B1A5-718A3BE15525}\setup.exe -runfromtemp -removeonly

Realtek High Definition Audio Driver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\Setup.exe" -l0x9 -removeonly

SeaMonkey (2.0.4)-->C:\Program Files\SeaMonkey\uninstall\helper.exe

Security Update for Windows Internet Explorer 7 (KB982381)-->"C:\WINDOWS\ie7updates\KB982381-IE7\spuninst\spuninst.exe"

Security Update for Windows Internet Explorer 8 (KB2183461)-->"C:\WINDOWS\ie8updates\KB2183461-IE8\spuninst\spuninst.exe"

Security Update for Windows Internet Explorer 8 (KB971961)-->"C:\WINDOWS\ie8updates\KB971961-IE8\spuninst\spuninst.exe"

Security Update for Windows Internet Explorer 8 (KB981332)-->"C:\WINDOWS\ie8updates\KB981332-IE8\spuninst\spuninst.exe"

Security Update for Windows Internet Explorer 8 (KB982381)-->"C:\WINDOWS\ie8updates\KB982381-IE8\spuninst\spuninst.exe"

Security Update for Windows Media Encoder (KB954156)-->"C:\WINDOWS\$NtUninstallKB954156_WM9L$\spuninst\spuninst.exe"

Security Update for Windows Media Player (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"

Security Update for Windows Media Player (KB954155)-->"C:\WINDOWS\$NtUninstallKB954155_WM9$\spuninst\spuninst.exe"

Security Update for Windows Media Player (KB973540)-->"C:\WINDOWS\$NtUninstallKB973540_WM9$\spuninst\spuninst.exe"

Security Update for Windows Media Player (KB978695)-->"C:\WINDOWS\$NtUninstallKB978695_WM9$\spuninst\spuninst.exe"

Security Update for Windows Media Player 11 (KB954154)-->"C:\WINDOWS\$NtUninstallKB954154_WM11$\spuninst\spuninst.exe"

Security Update for Windows XP (KB2079403)-->"C:\WINDOWS\$NtUninstallKB2079403$\spuninst\spuninst.exe"

Security Update for Windows XP (KB2115168)-->"C:\WINDOWS\$NtUninstallKB2115168$\spuninst\spuninst.exe"

Security Update for Windows XP (KB2160329)-->"C:\WINDOWS\$NtUninstallKB2160329$\spuninst\spuninst.exe"

Security Update for Windows XP (KB2229593)-->"C:\WINDOWS\$NtUninstallKB2229593$\spuninst\spuninst.exe"

Security Update for Windows XP (KB2286198)-->"C:\WINDOWS\$NtUninstallKB2286198$\spuninst\spuninst.exe"

Security Update for Windows XP (KB923561)-->"C:\WINDOWS\$NtUninstallKB923561$\spuninst\spuninst.exe"

Security Update for Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"

Security Update for Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"

Security Update for Windows XP (KB952004)-->"C:\WINDOWS\$NtUninstallKB952004$\spuninst\spuninst.exe"

Security Update for Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"

Security Update for Windows XP (KB954459)-->"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe"

Security Update for Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"

Security Update for Windows XP (KB956572)-->"C:\WINDOWS\$NtUninstallKB956572$\spuninst\spuninst.exe"

Security Update for Windows XP (KB956744)-->"C:\WINDOWS\$NtUninstallKB956744$\spuninst\spuninst.exe"

Security Update for Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"

Security Update for Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"

Security Update for Windows XP (KB956844)-->"C:\WINDOWS\$NtUninstallKB956844$\spuninst\spuninst.exe"

Security Update for Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"

Security Update for Windows XP (KB958869)-->"C:\WINDOWS\$NtUninstallKB958869$\spuninst\spuninst.exe"

Security Update for Windows XP (KB959426)-->"C:\WINDOWS\$NtUninstallKB959426$\spuninst\spuninst.exe"

Security Update for Windows XP (KB960225)-->"C:\WINDOWS\$NtUninstallKB960225$\spuninst\spuninst.exe"

Security Update for Windows XP (KB960803)-->"C:\WINDOWS\$NtUninstallKB960803$\spuninst\spuninst.exe"

Security Update for Windows XP (KB960859)-->"C:\WINDOWS\$NtUninstallKB960859$\spuninst\spuninst.exe"

Security Update for Windows XP (KB961501)-->"C:\WINDOWS\$NtUninstallKB961501$\spuninst\spuninst.exe"

Security Update for Windows XP (KB969059)-->"C:\WINDOWS\$NtUninstallKB969059$\spuninst\spuninst.exe"

Security Update for Windows XP (KB970238)-->"C:\WINDOWS\$NtUninstallKB970238$\spuninst\spuninst.exe"

Security Update for Windows XP (KB970430)-->"C:\WINDOWS\$NtUninstallKB970430$\spuninst\spuninst.exe"

Security Update for Windows XP (KB971468)-->"C:\WINDOWS\$NtUninstallKB971468$\spuninst\spuninst.exe"

Security Update for Windows XP (KB971657)-->"C:\WINDOWS\$NtUninstallKB971657$\spuninst\spuninst.exe"

Security Update for Windows XP (KB971961)-->"C:\WINDOWS\$NtUninstallKB971961$\spuninst\spuninst.exe"

Security Update for Windows XP (KB972270)-->"C:\WINDOWS\$NtUninstallKB972270$\spuninst\spuninst.exe"

Security Update for Windows XP (KB973507)-->"C:\WINDOWS\$NtUninstallKB973507$\spuninst\spuninst.exe"

Security Update for Windows XP (KB973869)-->"C:\WINDOWS\$NtUninstallKB973869$\spuninst\spuninst.exe"

Security Update for Windows XP (KB973904)-->"C:\WINDOWS\$NtUninstallKB973904$\spuninst\spuninst.exe"

Security Update for Windows XP (KB974112)-->"C:\WINDOWS\$NtUninstallKB974112$\spuninst\spuninst.exe"

Security Update for Windows XP (KB974318)-->"C:\WINDOWS\$NtUninstallKB974318$\spuninst\spuninst.exe"

Security Update for Windows XP (KB974392)-->"C:\WINDOWS\$NtUninstallKB974392$\spuninst\spuninst.exe"

Security Update for Windows XP (KB974571)-->"C:\WINDOWS\$NtUninstallKB974571$\spuninst\spuninst.exe"

Security Update for Windows XP (KB975025)-->"C:\WINDOWS\$NtUninstallKB975025$\spuninst\spuninst.exe"

Security Update for Windows XP (KB975467)-->"C:\WINDOWS\$NtUninstallKB975467$\spuninst\spuninst.exe"

Security Update for Windows XP (KB975560)-->"C:\WINDOWS\$NtUninstallKB975560$\spuninst\spuninst.exe"

Security Update for Windows XP (KB975561)-->"C:\WINDOWS\$NtUninstallKB975561$\spuninst\spuninst.exe"

Security Update for Windows XP (KB975562)-->"C:\WINDOWS\$NtUninstallKB975562$\spuninst\spuninst.exe"

Security Update for Windows XP (KB975713)-->"C:\WINDOWS\$NtUninstallKB975713$\spuninst\spuninst.exe"

Security Update for Windows XP (KB977816)-->"C:\WINDOWS\$NtUninstallKB977816$\spuninst\spuninst.exe"

Security Update for Windows XP (KB977914)-->"C:\WINDOWS\$NtUninstallKB977914$\spuninst\spuninst.exe"

Security Update for Windows XP (KB978037)-->"C:\WINDOWS\$NtUninstallKB978037$\spuninst\spuninst.exe"

Security Update for Windows XP (KB978338)-->"C:\WINDOWS\$NtUninstallKB978338$\spuninst\spuninst.exe"

Security Update for Windows XP (KB978542)-->"C:\WINDOWS\$NtUninstallKB978542$\spuninst\spuninst.exe"

Security Update for Windows XP (KB978601)-->"C:\WINDOWS\$NtUninstallKB978601$\spuninst\spuninst.exe"

Security Update for Windows XP (KB978706)-->"C:\WINDOWS\$NtUninstallKB978706$\spuninst\spuninst.exe"

Security Update for Windows XP (KB979309)-->"C:\WINDOWS\$NtUninstallKB979309$\spuninst\spuninst.exe"

Security Update for Windows XP (KB979482)-->"C:\WINDOWS\$NtUninstallKB979482$\spuninst\spuninst.exe"

Security Update for Windows XP (KB979559)-->"C:\WINDOWS\$NtUninstallKB979559$\spuninst\spuninst.exe"

Security Update for Windows XP (KB979683)-->"C:\WINDOWS\$NtUninstallKB979683$\spuninst\spuninst.exe"

Security Update for Windows XP (KB980195)-->"C:\WINDOWS\$NtUninstallKB980195$\spuninst\spuninst.exe"

Security Update for Windows XP (KB980218)-->"C:\WINDOWS\$NtUninstallKB980218$\spuninst\spuninst.exe"

Security Update for Windows XP (KB980232)-->"C:\WINDOWS\$NtUninstallKB980232$\spuninst\spuninst.exe"

Security Update for Windows XP (KB980436)-->"C:\WINDOWS\$NtUninstallKB980436$\spuninst\spuninst.exe"

Security Update for Windows XP (KB981349)-->"C:\WINDOWS\$NtUninstallKB981349$\spuninst\spuninst.exe"

Security Update for Windows XP (KB981852)-->"C:\WINDOWS\$NtUninstallKB981852$\spuninst\spuninst.exe"

Security Update for Windows XP (KB981997)-->"C:\WINDOWS\$NtUninstallKB981997$\spuninst\spuninst.exe"

Security Update for Windows XP (KB982214)-->"C:\WINDOWS\$NtUninstallKB982214$\spuninst\spuninst.exe"

Security Update for Windows XP (KB982665)-->"C:\WINDOWS\$NtUninstallKB982665$\spuninst\spuninst.exe"

Setup-->MsiExec.exe /I{F069C491-69E6-4D9B-9A0C-B7894A1FA97C}

Share-->MsiExec.exe /I{F909BD3C-8684-4ACF-B7C3-33F4F9F901B7}

Skype™ 4.2-->MsiExec.exe /X{5C474A83-A45F-470C-9AC8-2BD1C251BF9A}

SmartSound Common Data-->"C:\Program Files\InstallShield Installation Information\{B8A2869E-30CA-40C5-9CF8-BD7354E57EF8}\setup.exe" -runfromtemp -l0x0409 -removeonly

SmartSound Common Data-->MsiExec.exe /I{B8A2869E-30CA-40C5-9CF8-BD7354E57EF8}

SmartSound Quicktracks 5-->"C:\Program Files\InstallShield Installation Information\{2F8BA3FD-1FA9-4279-B696-712ABB12F09F}\setup.exe" -runfromtemp -l0x0409 -removeonly

SmartSound Quicktracks 5-->MsiExec.exe /I{2F8BA3FD-1FA9-4279-B696-712ABB12F09F}

SMS Free Sender version 2.8.0-->"C:\Program Files\SMS Free Sender\unins000.exe"

Songbird 1.7.3 (Build 1700)-->"C:\Program Files\Songbird\Songbird-Uninstall.exe"

Sony Vegas Pro 8.0-->MsiExec.exe /X{0F31532A-16F1-4812-8B7B-D321A4CE91A6}

SopCast 3.0.3-->C:\Program Files\SopCast\uninst.exe

Speaking Notepad-->"C:\Program Files\Speaking Notepad\unins000.exe"

Speed Meter Pro-->C:\Documents and Settings\All Users\Application Data\Pure Networks\Setup\smpsetup.exe /uninstall

UltraISO Premium V9.35-->"C:\Program Files\UltraISO\unins000.exe"

Unibet-->C:\MicroGaming\Poker\unibetpokerMPP\install.exe -uninstall

Uniblue DiskRescue 2009-->"C:\Documents and Settings\All Users\Application Data\{8A09CD83-59E1-4DB1-AAFC-E25174FC6706}\Uniblue DiskRescue.exe" REMOVE=TRUE MODIFY=FALSE

Uniblue DiskRescue 2009-->C:\Documents and Settings\All Users\Application Data\{8A09CD83-59E1-4DB1-AAFC-E25174FC6706}\Uniblue DiskRescue.exe

Uniblue DriverScanner-->"C:\Program Files\Uniblue\DriverScanner\unins000.exe"

Uniblue RegistryBooster 2009-->"C:\Documents and Settings\All Users\Application Data\{B46E1EF5-0B37-4DB4-A4E2-9F2B41036185}\Uniblue RegistryBooster.exe" REMOVE=TRUE MODIFY=FALSE

Uniblue RegistryBooster 2009-->C:\Documents and Settings\All Users\Application Data\{B46E1EF5-0B37-4DB4-A4E2-9F2B41036185}\Uniblue RegistryBooster.exe

Unlocker 1.9.0-->C:\Program Files\Unlocker\uninst.exe

Update for Windows Internet Explorer 8 (KB976662)-->"C:\WINDOWS\ie8updates\KB976662-IE8\spuninst\spuninst.exe"

Update for Windows Internet Explorer 8 (KB982632)-->"C:\WINDOWS\ie8updates\KB982632-IE8\spuninst\spuninst.exe"

Update for Windows XP (KB955759)-->"C:\WINDOWS\$NtUninstallKB955759$\spuninst\spuninst.exe"

Update for Windows XP (KB967715)-->"C:\WINDOWS\$NtUninstallKB967715$\spuninst\spuninst.exe"

Update for Windows XP (KB968389)-->"C:\WINDOWS\$NtUninstallKB968389$\spuninst\spuninst.exe"

Update for Windows XP (KB971737)-->"C:\WINDOWS\$NtUninstallKB971737$\spuninst\spuninst.exe"

Update for Windows XP (KB973687)-->"C:\WINDOWS\$NtUninstallKB973687$\spuninst\spuninst.exe"

Update for Windows XP (KB973815)-->"C:\WINDOWS\$NtUninstallKB973815$\spuninst\spuninst.exe"

USB Virus Scan 2.3-->"C:\Program Files\USBScan\unins000.exe"

uTorrent Turbo Accelerator-->C:\Program Files\uTorrent Turbo Accelerator\uninstall.exe

VIO-->MsiExec.exe /I{F95C8C1F-25BB-44EC-A7E6-5C17ABC6BC71}

VLC media player 1.1.2-->C:\Program Files\VideoLAN\VLC\uninstall.exe

VSClassic-->MsiExec.exe /I{FB0B6DDD-DF3E-4CD6-927C-724AB854E322}

VSPro-->MsiExec.exe /I{F206FEC3-F5DD-43FD-A8CF-9C46B8A6A92C}

WebEx Support Manager for Internet Explorer-->MsiExec.exe /I{7FCC4EDC-6EE2-4309-ABD7-85F2667A7B90}

WebScout Toolbar-->C:\Program Files\WebScout Toolbar\UninstallToolbar.exe

Winamp-->"C:\Program Files\Winamp\UninstWA.exe"

Windows Internet Explorer 8-->"C:\WINDOWS\ie8\spuninst\spuninst.exe"

Windows Live OneCare safety scanner-->RunDll32.exe "C:\Program Files\Windows Live Safety Center\wlscCore.dll",UninstallFunction WLSC_SCANNER_PRODUCT

Windows Media Encoder 9 Series-->msiexec.exe /I {E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}

Windows Media Encoder 9 Series-->MsiExec.exe /I{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}

Windows Rights Management Client Backwards Compatibility SP2-->MsiExec.exe /X{EC905264-BCFE-423B-9C42-C3A106266790}

Windows Rights Management Client Backwards Compatibility SP2-->MsiExec.exe /X{EC905264-BCFE-423B-9C42-C3A106266790}

Windows Rights Management Client with Service Pack 2-->MsiExec.exe /X{BDCF27CA-BFC4-4F49-8D24-A925C9505AB8}

Windows Rights Management Client with Service Pack 2-->MsiExec.exe /X{BDCF27CA-BFC4-4F49-8D24-A925C9505AB8}

WinTools.net 10.7.1 Professional-->"C:\Program Files\WinTools Software\WinTools.net Professional\unins000.exe"

WinUtilities 9.8 Professional Edition-->"C:\Program Files\WinUtilities\unins000.exe"

WinXP Manager-->MsiExec.exe /I{B64EC0E5-8341-481D-BE23-6B02FC5A953C}

Your Uninstaller! 2010-->"C:\Program Files\Your Uninstaller 2010\unins000.exe"

YoWindow-->"C:\Program Files\YoWindow\uninstall.exe"

Архиватор WinRAR-->C:\Program Files\WinRAR\uninstall.exe

======Hosts File======

::1 localhost

======Security center information======

AV: avast! Antivirus (disabled)

======System event log======

Computer Name: GANGOSAN-9708CA

Event Code: 10000

Message: Unable to start a DCOM Server: {AC746233-E9D3-49CD-862F-068F7B7CCCA4}.

The error:

"%2"

Happened while starting this command:

C:\Program Files\Internet Download Manager\IDMan.exe -Embedding

Record Number: 18231

Source Name: DCOM

Time Written: 20100816152452.000000-420

Event Type: error

User: GANGOSAN-9708CA\Ghost

Computer Name: GANGOSAN-9708CA

Event Code: 4226

Message: TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.

Record Number: 18226

Source Name: Tcpip

Time Written: 20100816145607.000000-420

Event Type: warning

User:

Computer Name: GANGOSAN-9708CA

Event Code: 4226

Message: TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.

Record Number: 18225

Source Name: Tcpip

Time Written: 20100816135536.000000-420

Event Type: warning

User:

Computer Name: GANGOSAN-9708CA

Event Code: 4226

Message: TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.

Record Number: 18210

Source Name: Tcpip

Time Written: 20100816131338.000000-420

Event Type: warning

User:

Computer Name: GANGOSAN-9708CA

Event Code: 4226

Message: TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.

Record Number: 18201

Source Name: Tcpip

Time Written: 20100816125339.000000-420

Event Type: warning

User:

=====Application event log=====

Computer Name: GANGOSAN-9708CA

Event Code: 1023

Message:

Record Number: 2354

Source Name: MsiInstaller

Time Written: 20100727035208.000000-420

Event Type: error

User: NT AUTHORITY\SYSTEM

Computer Name: GANGOSAN-9708CA

Event Code: 1023

Message:

Record Number: 2348

Source Name: MsiInstaller

Time Written: 20100727033637.000000-420

Event Type: error

User: GANGOSAN-9708CA\Ghost

Computer Name: GANGOSAN-9708CA

Event Code: 1023

Message:

Record Number: 2342

Source Name: MsiInstaller

Time Written: 20100727033534.000000-420

Event Type: error

User: GANGOSAN-9708CA\Ghost

Computer Name: GANGOSAN-9708CA

Event Code: 1023

Message:

Record Number: 2336

Source Name: MsiInstaller

Time Written: 20100727030048.000000-420

Event Type: error

User: NT AUTHORITY\SYSTEM

Computer Name: GANGOSAN-9708CA

Event Code: 1000

Message: Faulting application speakingnotepad.exe, version 3.2.0.0, faulting module speakingnotepad.exe, version 3.2.0.0, fault address 0x000039b2.

Record Number: 2318

Source Name: Application Error

Time Written: 20100726212322.000000-420

Event Type: error

User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe

"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\system32\wbem;C:\Program Files\Common Files\ArcSoft\Bin;C:\Program Files\QuickTime\QTSystem;c:\Program Files\Common Files\Ulead Systems\MPEG

"windir"=%SystemRoot%

"FP_NO_HOST_CHECK"=NO

"OS"=Windows_NT

"PROCESSOR_ARCHITECTURE"=x86

"PROCESSOR_LEVEL"=6

"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 23 Stepping 10, GenuineIntel

"PROCESSOR_REVISION"=170a

"NUMBER_OF_PROCESSORS"=2

"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH

"TEMP"=%SystemRoot%\TEMP

"TMP"=%SystemRoot%\TEMP

"CLASSPATH"=.;C:\Program Files\QuickTime\QTSystem\QTJava.zip

"QTJAVA"=C:\Program Files\QuickTime\QTSystem\QTJava.zip

-----------------EOF-----------------

Logfile of random's system information tool 1.08 (written by random/random)

Run by Ghost at 2010-08-22 16:30:11

Microsoft Windows XP Professional Service Pack 3

System drive C: has 37 GB (67%) free of 55 GB

Total RAM: 1014 MB (41% free)

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 16:30:32, on 8/22/2010

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Alwil Software\Avast5\AvastSvc.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Program Files\Common Files\PC Tools\sMonitor\StartManSvc.exe

c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Uniblue\DiskRescue\UBDiskRescueSrv.exe

C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe

C:\WINDOWS\system32\igfxtray.exe

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\system32\igfxsrvc.exe

C:\WINDOWS\system32\igfxpers.exe

C:\Program Files\Unlocker\UnlockerAssistant.exe

C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe

C:\Program Files\USBScan\USBScan.exe

C:\WINDOWS\RTHDCPL.EXE

C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\Program Files\IM Magician\Vicamon.exe

C:\PROGRA~1\DESKTO~1\TLDL.EXE

C:\Program Files\Internet Download Manager\IDMan.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\Datecs\Flex2K.exe

C:\Program Files\Internet Download Manager\IEMonitor.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Skype\Phone\Skype.exe

C:\Program Files\uTorrent\uTorrent.exe

C:\WINDOWS\explorer.exe

C:\Program Files\Avant Browser\avant.exe

C:\Program Files\Avant Browser\ybrowser.exe

C:\Program Files\Common Files\Corel\Standby\Standby.exe

C:\Program Files\Avant Browser\ybrowser.exe

C:\WINDOWS\system32\wscntfy.exe

C:\Documents and Settings\Ghost\Desktop\RSIT.exe

C:\Program Files\trend micro\Ghost.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=

O1 - Hosts: яю127.0.0.1 localhost

O1 - Hosts: ::1 localhost

O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~4\Office14\GROOVEEX.DLL

O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~4\Office14\URLREDIR.DLL

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O2 - BHO: SMTTB2009 - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\Program Files\WebScout Toolbar\tbcore3.dll

O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe

O4 - HKLM\..\Run: [unlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"

O4 - HKLM\..\Run: [nmctxth] "C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe"

O4 - HKLM\..\Run: [uSBScan.exe] C:\Program Files\USBScan\USBScan.exe -Hide

O4 - HKLM\..\Run: [standby] "c:\Program Files\Common Files\Corel\Standby\Standby.exe" -START

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray

O4 - HKLM\..\Run: [avast5] C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [iMMON] "C:\Program Files\IM Magician\Vicamon.exe"

O4 - HKLM\..\Run: [Desktop Lock Loader] C:\PROGRA~1\DESKTO~1\TLDL.EXE /BOOT

O4 - HKCU\..\Run: [iDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE

O4 - Global Startup: FlexType 2K.lnk = ?

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office14\EXCEL.EXE/3000

O8 - Extra context menu item: Se&nd to OneNote - res://C:\PROGRA~1\MICROS~4\Office14\ONBttnIE.dll/105

O8 - Extra context menu item: Свали видео съдържанието на FLV с IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm

O8 - Extra context menu item: Свали всички линкове с IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm

O8 - Extra context menu item: Свали с IDM - C:\Program Files\Internet Download Manager\IEExt.htm

O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll

O9 - Extra button: (no name) - {53F6FCCD-9E22-4d71-86EA-6E43136192AB} - (no file)

O9 - Extra button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

O9 - Extra 'Tools' menuitem: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

O9 - Extra button: (no name) - {925DAB62-F9AC-4221-806A-057BFB1014AA} - (no file)

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra button: Unibet - {00000000-0000-0000-0000-000000000000} - C:\MicroGaming\Poker\unibetpokerMPP\MPPoker.exe (HKCU)

O9 - Extra button: CarbonPoker - {e4e8c758-34b4-44bb-8ef9-1f0786e81d2d} - C:\Documents and Settings\Ghost\Start Menu\Programs\CarbonPoker\CarbonPoker.lnk (HKCU)

O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll

O17 - HKLM\System\CCS\Services\Tcpip\..\{C343B301-54AB-4781-B657-1DE663E4555B}: NameServer = 217.79.67.30,217.79.79.79

O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL

O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll

O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll

O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe

O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe

O23 - Service: avast! Mail Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe

O23 - Service: avast! Web Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe

O23 - Service: E9770FBE - Unknown owner - C:\WINDOWS\system32\E9770FBE.exe

O23 - Service: Imapi Helper - Alex Feinman - C:\Program Files\Alex Feinman\ISO Recorder\ImapiHelper.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: KMService - Unknown owner - C:\WINDOWS\system32\srvany.exe

O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

O23 - Service: Pure Networks Platform Service (nmservice) - Cisco Systems, Inc. - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe

O23 - Service: PC Tools Startup and Shutdown Monitor service (PCToolsSSDMonitorSvc) - Unknown owner - C:\Program Files\Common Files\PC Tools\sMonitor\StartManSvc.exe

O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe

O23 - Service: Uniblue DiskRescue - Uniblue - C:\Program Files\Uniblue\DiskRescue\UBDiskRescueSrv.exe

--

End of file - 9052 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\4avdo.job

C:\WINDOWS\tasks\AppleSoftwareUpdate.job

C:\WINDOWS\tasks\Driver Robot.job

C:\WINDOWS\tasks\GlaryInitialize.job

C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-436374069-861567501-1801674531-1003Core.job

C:\WINDOWS\tasks\Uniblue DiskRescue 2009.job

C:\WINDOWS\tasks\User_Feed_Synchronization-{BD35BFC6-6354-4026-839A-A5D9FD413787}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}]

IDMIEHlprObj Class - C:\Program Files\Internet Download Manager\IDMIECC.dll [2010-07-26 193888]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]

Groove GFS Browser Helper - C:\PROGRA~1\MICROS~4\Office14\GROOVEEX.DLL [2010-01-21 4222864]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]

Office Document Cache Handler - C:\PROGRA~1\MICROS~4\Office14\URLREDIR.DLL [2010-01-16 561552]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]

Java Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-08-20 35840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]

JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2010-08-20 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}]

SMTTB2009 Class - C:\Program Files\WebScout Toolbar\tbcore3.dll [2010-02-16 2495488]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

"IgfxTray"=C:\WINDOWS\system32\igfxtray.exe [2010-01-13 134656]

"HotKeysCmds"=C:\WINDOWS\system32\hkcmd.exe [2010-01-13 166912]

"Persistence"=C:\WINDOWS\system32\igfxpers.exe [2010-01-13 135680]

"UnlockerAssistant"=C:\Program Files\Unlocker\UnlockerAssistant.exe [2010-07-04 17408]

"nmctxth"=C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe [2009-07-07 647216]

"USBScan.exe"=C:\Program Files\USBScan\USBScan.exe [2009-08-13 1358848]

"Standby"=c:\Program Files\Common Files\Corel\Standby\Standby.exe [2009-12-17 105632]

"QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2008-01-31 385024]

"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2010-07-06 19556968]

"Malwarebytes' Anti-Malware"=C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe [2010-04-29 437584]

"avast5"=C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe [2010-06-28 2837864]

"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2010-08-20 148888]

"IMMON"=C:\Program Files\IM Magician\Vicamon.exe [2009-05-07 143360]

"Desktop Lock Loader"=C:\PROGRA~1\DESKTO~1\TLDL.EXE [2006-11-29 66048]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

"IDMan"=C:\Program Files\Internet Download Manager\IDMan.exe [2010-06-10 3220912]

"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BeFaster]

C:\Program Files\BeFaster\befaster4.exe [2010-05-22 447488]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OfficeSyncProcess]

C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE [2010-01-16 717696]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\smp.exe]

C:\Program Files\Pure Networks\Speed Meter Pro\smp.exe [2010-07-13 442664]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]

C:\Program Files\Winamp\winampa.exe [2010-05-25 37888]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Ghost^Start Menu^Programs^Startup^MagicDisc.lnk]

C:\PROGRA~1\MAGICD~1\MAGICD~1.EXE [2009-02-23 576000]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Ghost^Start Menu^Programs^Startup^OneNote 2010 Screen Clipper and Launcher.lnk]

C:\PROGRA~1\MICROS~4\Office14\ONENOTEM.EXE [2010-01-21 226176]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Ghost^Start Menu^Programs^Startup^YoWindow.lnk]

C:\PROGRA~1\YoWindow\yowindow.exe [2010-03-18 713728]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup

FlexType 2K.lnk - C:\WINDOWS\Datecs\Flex2K.exe

C:\Documents and Settings\Ghost\Start Menu\Programs\Startup

ERUNT AutoBackup.lnk - C:\Program Files\ERUNT\AUTOBACK.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]

C:\WINDOWS\system32\igfxdev.dll [2010-01-13 205824]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]

C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 190464]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]

WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]

"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~4\Office14\GROOVEEX.DLL [2010-01-21 4222864]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]

"authentication packages"=msv1_0

nwprovau

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]

"dontdisplaylastusername"=0

"legalnoticecaption"=

"legalnoticetext"=

"shutdownwithoutlogon"=1

"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]

"NoStartMenuMFUprogramsList"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]

"HonorAutoRunSetting"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"

"C:\Program Files\EA GAMES\Need For Speed Underground\Speed.exe"="C:\Program Files\EA GAMES\Need For Speed Underground\Speed.exe:*:Enabled:Speed"

"C:\Program Files\B2BPOKER\24hPoker\jre\bin\javaw.exe"="C:\Program Files\B2BPOKER\24hPoker\jre\bin\javaw.exe:*:Enabled:Java 2 Platform Standard Edition binary"

"C:\Program Files\Opera\opera.exe"="C:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser"

"C:\WINDOWS\Installer\{1584854C-1513-40EA-96D4-493384D0A3C7}\_44F622AA395D57B9743A14.exe"="C:\WINDOWS\Installer\{1584854C-1513-40EA-96D4-493384D0A3C7}\_44F622AA395D57B9743A14.exe:*:Enabled:Readon TV Movie Radio Player"

"C:\Program Files\Readon Technology\Readon TV Movie Radio Player 7.2.0.0\internettv.exe"="C:\Program Files\Readon Technology\Readon TV Movie Radio Player 7.2.0.0\internettv.exe:*:Enabled:internettv"

"C:\Program Files\TeamViewer\Version5\TeamViewer.exe"="C:\Program Files\TeamViewer\Version5\TeamViewer.exe:*:Enabled:Teamviewer Remote Control Application"

"D:\\MIRC\MIRC.EXE"="D:\\MIRC\MIRC.EXE:*:ENABLED:MIRC"

"D:\\PROGRAMI\IGRI\COUNTER-STRIKE 1.6\COUNTER-STRIKE 1.6\HL.EXE"="D:\\PROGRAMI\IGRI\COUNTER-STRIKE 1.6\COUNTER-STRIKE 1.6\HL.EXE:*:ENABLED:HALF-LIFE LAUNCHER"

"D:\\PROGRAMI\IGRI\WORMS WORLD PARTY(XP OK!)\WWP\WWP.EXE"="D:\\PROGRAMI\IGRI\WORMS WORLD PARTY(XP OK!)\WWP\WWP.EXE:*:ENABLED:WORMS WORLD PARTY"

"D:\\PROGRAMI\MIRC.IRCII\MIRC.EXE"="D:\\PROGRAMI\MIRC.IRCII\MIRC.EXE:*:ENABLED:MIRC"

"C:\Program Files\Microsoft Office\Office14\GROOVE.EXE"="C:\Program Files\Microsoft Office\Office14\GROOVE.EXE:*:Enabled:Microsoft SharePoint Workspace"

"C:\Program Files\Microsoft Office\Office14\ONENOTE.EXE"="C:\Program Files\Microsoft Office\Office14\ONENOTE.EXE:*:Enabled:Microsoft OneNote"

"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"

"C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe"="C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe:LocalSubNet,0.0.0.0/255.255.255.255:Enabled:Pure Networks Platform Service"

"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

======File associations======

.txt - open - "C:\Program Files\Speaking Notepad\SpeakingNotepad.exe" "%1"

======List of files/folders created in the last 1 months======

2010-08-22 16:30:13 ----D---- C:\Program Files\trend micro

2010-08-22 16:30:11 ----D---- C:\rsit

2010-08-22 16:24:16 ----A---- C:\TDSSKiller.2.4.1.2_22.08.2010_16.24.16_log.txt

2010-08-22 16:21:26 ----D---- C:\Registry

2010-08-22 16:20:41 ----D---- C:\Program Files\ERUNT

2010-08-22 16:10:53 ----D---- C:\Program Files\Yamicsoft

2010-08-21 18:25:31 ----A---- C:\WINDOWS\system32\E9770FBE.exe

2010-08-21 15:44:23 ----D---- C:\Program Files\Desktop Lock

2010-08-21 13:11:00 ----D---- C:\Documents and Settings\Ghost\Application Data\Vimisoft Studio

2010-08-21 13:10:45 ----A---- C:\WINDOWS\system32\wmv8dmod.dll

2010-08-21 13:10:45 ----A---- C:\WINDOWS\system32\mpg4c32.dll

2010-08-21 13:10:34 ----A---- C:\WINDOWS\system32\vgf.dll

2010-08-21 13:10:34 ----A---- C:\WINDOWS\system32\newlistview2.dll

2010-08-21 13:10:28 ----D---- C:\Program Files\Common Files\Vimisoft Studio

2010-08-21 13:10:05 ----D---- C:\Program Files\Vimicro Corporation

2010-08-21 13:09:34 ----D---- C:\Program Files\IM Magician

2010-08-21 13:09:07 ----D---- C:\Documents and Settings\Ghost\Application Data\InstallShield

2010-08-21 12:58:55 ----A---- C:\WINDOWS\system32\drivers\USBAUDIO.sys

2010-08-21 07:40:11 ----A---- C:\WINDOWS\system32\079F11F3.exe

2010-08-21 07:13:10 ----SHD---- C:\RECYCLER

2010-08-20 04:29:08 ----A---- C:\WINDOWS\system32\javaws.exe

2010-08-20 04:29:08 ----A---- C:\WINDOWS\system32\javaw.exe

2010-08-20 04:29:08 ----A---- C:\WINDOWS\system32\java.exe

2010-08-20 04:29:08 ----A---- C:\WINDOWS\system32\deploytk.dll

2010-08-20 03:57:51 ----D---- C:\WINDOWS\temp

2010-08-20 02:26:25 ----D---- C:\Program Files\Common Files\EZB Systems

2010-08-20 01:44:36 ----D---- C:\Program Files\UltraISO

2010-08-20 00:00:41 ----A---- C:\WINDOWS\system32\tmp.txt

2010-08-19 13:03:12 ----D---- C:\WINDOWS\Minidump

2010-08-18 21:27:50 ----D---- C:\Casino

2010-08-18 20:02:09 ----D---- C:\Documents and Settings\Ghost\Application Data\######

2010-08-18 20:02:02 ----D---- C:\Program Files\######

2010-08-18 18:34:59 ----D---- C:\Documents and Settings\All Users\Application Data\Nero

2010-08-18 17:34:14 ----RA---- C:\WINDOWS\system32\imagxpr7.dll

2010-08-18 17:34:14 ----A---- C:\WINDOWS\system32\imagxra7.dll

2010-08-18 17:34:14 ----A---- C:\WINDOWS\system32\imagxr7.dll

2010-08-18 17:34:14 ----A---- C:\WINDOWS\system32\imagx7.dll

2010-08-18 17:32:22 ----D---- C:\WINDOWS\SxsCaPendDel

2010-08-18 02:29:56 ----D---- C:\Program Files\Symantec

2010-08-18 00:03:43 ----D---- C:\Program Files\SeaMonkey

2010-08-17 22:38:00 ----A---- C:\WINDOWS\system32\drivers\aswSP.sys

2010-08-17 22:38:00 ----A---- C:\WINDOWS\system32\drivers\aswFsBlk.sys

2010-08-17 22:37:59 ----A---- C:\WINDOWS\system32\drivers\aswRdr.sys

2010-08-17 22:37:57 ----A---- C:\WINDOWS\system32\drivers\aswTdi.sys

2010-08-17 22:37:55 ----A---- C:\WINDOWS\system32\drivers\aswmon2.sys

2010-08-17 22:37:55 ----A---- C:\WINDOWS\system32\drivers\aswmon.sys

2010-08-17 22:37:55 ----A---- C:\WINDOWS\system32\drivers\aavmker4.sys

2010-08-17 22:37:47 ----A---- C:\WINDOWS\system32\aswBoot.exe

2010-08-17 22:37:44 ----D---- C:\Program Files\Alwil Software

2010-08-17 22:37:44 ----D---- C:\Documents and Settings\All Users\Application Data\Alwil Software

2010-08-17 22:26:07 ----ASH---- C:\hiberfil.sys

2010-08-17 22:21:03 ----A---- C:\WINDOWS\ntbtlog.txt

2010-08-17 18:21:53 ----A---- C:\WINDOWS\system32\drivers\mbamswissarmy.sys

2010-08-17 18:21:52 ----A---- C:\WINDOWS\system32\drivers\mbam.sys

2010-08-17 18:21:51 ----D---- C:\Program Files\Malwarebytes' Anti-Malware

2010-08-16 17:07:25 ----A---- C:\WINDOWS\system32\drivers\extit.sys

2010-08-16 16:54:47 ----HDC---- C:\WINDOWS\$NtUninstallKB982214$

2010-08-16 16:54:32 ----HDC---- C:\WINDOWS\$NtUninstallKB2115168$

2010-08-16 16:54:20 ----HDC---- C:\WINDOWS\$NtUninstallKB981852$

2010-08-16 16:54:04 ----HDC---- C:\WINDOWS\$NtUninstallKB2079403$

2010-08-16 16:53:17 ----HDC---- C:\WINDOWS\$NtUninstallKB2160329$

2010-08-16 16:53:07 ----HDC---- C:\WINDOWS\$NtUninstallKB980436$

2010-08-16 16:52:40 ----HDC---- C:\WINDOWS\$NtUninstallKB981997$

2010-08-16 16:52:22 ----HDC---- C:\WINDOWS\$NtUninstallKB982665$

2010-08-16 12:59:57 ----A---- C:\WINDOWS\system32\DrvInstall.dll

2010-08-16 12:59:51 ----A---- C:\WINDOWS\system32\WebCam.sys

2010-08-12 18:15:40 ----A---- C:\WINDOWS\system32\drivers\MSTEE.sys

2010-08-12 18:15:33 ----A---- C:\WINDOWS\system32\drivers\NdisIP.sys

2010-08-12 18:15:32 ----A---- C:\WINDOWS\system32\drivers\StreamIP.sys

2010-08-12 18:15:30 ----A---- C:\WINDOWS\system32\drivers\SLIP.sys

2010-08-12 18:15:29 ----A---- C:\WINDOWS\system32\drivers\WSTCODEC.SYS

2010-08-12 18:15:27 ----A---- C:\WINDOWS\system32\drivers\NABTSFEC.sys

2010-08-12 18:15:25 ----A---- C:\WINDOWS\system32\drivers\CCDECODE.sys

2010-08-12 18:15:19 ----A---- C:\WINDOWS\system32\vfwwdm32.dll

2010-08-12 18:15:19 ----A---- C:\WINDOWS\system32\drivers\usbvideo.sys

2010-08-12 18:15:15 ----A---- C:\WINDOWS\system32\drivers\usbccgp.sys

2010-08-11 04:09:09 ----A---- C:\WINDOWS\system32\srvany.exe

2010-08-11 03:45:00 ----D---- C:\Program Files\Common Files\DESIGNER

2010-08-08 23:33:04 ----D---- C:\Program Files\Online TV Player 4

2010-08-08 01:25:53 ----D---- C:\Program Files\Mozilla Firefox

2010-08-07 18:26:44 ----D---- C:\Program Files\TeamViewer

2010-08-07 10:53:07 ----N---- C:\WINDOWS\system32\MpSigStub.exe

2010-08-06 15:52:33 ----A---- C:\Boot.bak

2010-08-06 15:52:29 ----RASHD---- C:\cmdcons

2010-08-06 15:48:29 ----A---- C:\WINDOWS\PEV.exe

2010-08-06 15:48:29 ----A---- C:\WINDOWS\MBR.exe

2010-08-06 15:48:17 ----D---- C:\WINDOWS\ERDNT

2010-08-06 03:45:37 ----D---- C:\Program Files\Alex Feinman

2010-08-05 00:37:54 ----D---- C:\Documents and Settings\Ghost\Application Data\Capture

2010-08-03 22:19:42 ----A---- C:\WINDOWS\imsins.BAK

2010-08-03 22:19:26 ----HDC---- C:\WINDOWS\$NtUninstallKB2286198$

2010-08-03 20:39:05 ----D---- C:\Program Files\xerox

2010-08-03 20:39:05 ----D---- C:\Program Files\microsoft frontpage

2010-08-03 04:30:23 ----D---- C:\Documents and Settings\Ghost\Application Data\ChessRally 2

2010-08-03 04:29:54 ----D---- C:\Documents and Settings\All Users\Application Data\ChessRally 2

2010-08-03 04:29:50 ----D---- C:\Program Files\Ingenuware

2010-08-03 04:29:50 ----A---- C:\WINDOWS\system32\ImpulseGlobals.dll

2010-08-03 04:29:50 ----A---- C:\WINDOWS\system32\ImpulseASM.dll

2010-08-03 04:28:03 ----D---- C:\WINDOWS\system32\URTTEMP

2010-08-03 01:57:41 ----D---- C:\Program Files\SopCast

2010-08-02 16:35:46 ----D---- C:\Documents and Settings\Ghost\Application Data\vlc

2010-08-02 16:35:13 ----D---- C:\Program Files\VideoLAN

2010-08-02 16:06:15 ----D---- C:\Documents and Settings\Ghost\Application Data\dvdcss

2010-08-02 15:43:31 ----D---- C:\Program Files\Readon Technology

2010-08-02 01:58:38 ----D---- C:\Program Files\Driver-Soft

2010-08-01 23:04:09 ----D---- C:\WINDOWS\Downloaded Program Files

2010-08-01 16:15:50 ----D---- C:\Program Files\Driver Cleaner Pro

2010-08-01 14:29:58 ----D---- C:\Documents and Settings\Ghost\Application Data\Malwarebytes

2010-08-01 14:29:50 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes

2010-08-01 05:01:29 ----D---- C:\Program Files\Daihinia

2010-07-26 22:02:22 ----A---- C:\WINDOWS\system32\RTNUninst32.dll

2010-07-26 22:02:22 ----A---- C:\WINDOWS\system32\RtNicProp32.dll

2010-07-26 21:12:08 ----D---- C:\Program Files\Wintoflash

2010-07-26 09:23:57 ----D---- C:\Documents and Settings\Ghost\Application Data\Publish Providers

2010-07-26 09:23:42 ----D---- C:\Documents and Settings\Ghost\Application Data\Sony

2010-07-26 09:04:37 ----D---- C:\Program Files\Vstplugins

2010-07-26 09:04:36 ----D---- C:\Documents and Settings\All Users\Application Data\Sony

2010-07-26 09:04:32 ----D---- C:\Program Files\Sony

2010-07-26 09:04:08 ----D---- C:\Program Files\Sony Setup

2010-07-26 03:15:52 ----D---- C:\Program Files\Lavalys

2010-07-26 02:48:11 ----A---- C:\WINDOWS\system32\drivers\DrvAgent32.sys

2010-07-25 17:32:37 ----D---- C:\Documents and Settings\Ghost\Application Data\MozillaControl

2010-07-25 17:31:43 ----D---- C:\WINDOWS\'Full Speed' Internet Booster + Performance Tests

2010-07-25 17:31:42 ----D---- C:\Program Files\'Full Speed' Internet Booster + Performance Tests

2010-07-25 17:31:18 ----A---- C:\WINDOWS\'Full Speed' Internet Booster + Performance Tests Setup Log.txt

2010-07-25 02:05:33 ----D---- C:\Program Files\SMS Free Sender

2010-07-24 14:28:29 ----A---- C:\WINDOWS\system32\WgaTray.exe

2010-07-24 14:28:29 ----A---- C:\WINDOWS\system32\WgaLogon.dll

2010-07-23 05:33:10 ----D---- C:\WINDOWS\system32\RTCOM

2010-07-23 05:32:56 ----A---- C:\WINDOWS\vncutil.exe

2010-07-23 05:32:56 ----A---- C:\WINDOWS\SOUNDMAN.EXE

2010-07-23 05:32:56 ----A---- C:\WINDOWS\SkyTel.exe

2010-07-23 05:32:55 ----A---- C:\WINDOWS\RtlUpd.exe

2010-07-23 05:32:55 ----A---- C:\WINDOWS\RTLCPL.EXE

2010-07-23 05:32:54 ----A---- C:\WINDOWS\system32\drivers\RtkHDAud.sys

2010-07-23 05:32:54 ----A---- C:\WINDOWS\RtkAudioService.exe

2010-07-23 05:32:53 ----A---- C:\WINDOWS\system32\drivers\Monfilt.sys

2010-07-23 05:32:53 ----A---- C:\WINDOWS\RTHDCPL.EXE

2010-07-23 05:32:52 ----A---- C:\WINDOWS\MicCal.exe

2010-07-23 05:32:49 ----A---- C:\WINDOWS\system32\drivers\Ambfilt.sys

2010-07-23 05:32:49 ----A---- C:\WINDOWS\ALCWZRD.EXE

2010-07-23 05:32:49 ----A---- C:\WINDOWS\ALCMTR.EXE

2010-07-23 05:32:44 ----A---- C:\WINDOWS\RtlExUpd.dll

======List of files/folders modified in the last 1 months======

2010-08-22 16:30:16 ----D---- C:\WINDOWS\Prefetch

2010-08-22 16:30:13 ----RD---- C:\Program Files

2010-08-22 16:30:07 ----D---- C:\Documents and Settings\Ghost\Application Data\uTorrent

2010-08-22 16:29:57 ----D---- C:\Documents and Settings\Ghost\Application Data\Skype

2010-08-22 16:24:16 ----D---- C:\WINDOWS\system32\drivers

2010-08-22 16:18:12 ----SHD---- C:\WINDOWS\Installer

2010-08-22 16:17:54 ----D---- C:\WINDOWS

2010-08-22 16:17:53 ----D---- C:\Program Files\WinRAR

2010-08-22 16:11:18 ----D---- C:\Config.Msi

2010-08-22 16:06:07 ----D---- C:\WINDOWS\system32\CatRoot2

2010-08-22 15:58:32 ----D---- C:\Program Files\Action Poker

2010-08-22 15:56:00 ----D---- C:\Program Files\PokerStars

2010-08-22 15:30:02 ----D---- C:\Documents and Settings\Ghost\Application Data\DMCache

2010-08-22 15:27:09 ----A---- C:\WINDOWS\SchedLgU.Txt

2010-08-22 12:53:43 ----HD---- C:\WINDOWS\inf

2010-08-22 12:53:27 ----D---- C:\WINDOWS\system32\CatRoot

2010-08-21 21:57:15 ----D---- C:\Program Files\CarbonPoker

2010-08-21 21:52:54 ----D---- C:\Documents and Settings\Ghost\Application Data\Microgaming

2010-08-21 18:25:31 ----D---- C:\WINDOWS\system32

2010-08-21 16:46:15 ----D---- C:\Program Files\Absolute Poker

2010-08-21 16:33:17 ----D---- C:\WINDOWS\Network Diagnostic

2010-08-21 13:39:02 ----D---- C:\Documents and Settings\All Users\Application Data\Microsoft Help

2010-08-21 13:24:55 ----A---- C:\WINDOWS\win.ini

2010-08-21 13:17:26 ----HD---- C:\Program Files\InstallShield Installation Information

2010-08-21 13:10:28 ----D---- C:\Program Files\Common Files

2010-08-21 13:10:22 ----D---- C:\WINDOWS\WinSxS

2010-08-21 13:10:18 ----D---- C:\Program Files\Common Files\Microsoft Shared

2010-08-21 13:03:08 ----D---- C:\Program Files\Driver Magician

2010-08-21 12:59:03 ----RSHDC---- C:\WINDOWS\system32\dllcache

2010-08-21 12:53:29 ----AD---- C:\Documents and Settings\All Users\Application Data\TEMP

2010-08-21 07:12:37 ----D---- C:\WINDOWS\system32\drivers\etc

2010-08-21 05:00:12 ----D---- C:\Program Files\Internet Download Manager

2010-08-20 03:48:53 ----A---- C:\WINDOWS\system.ini

2010-08-20 03:45:39 ----D---- C:\WINDOWS\system32\config

2010-08-20 03:41:57 ----D---- C:\WINDOWS\AppPatch

2010-08-20 03:08:03 ----D---- C:\WINDOWS\Microsoft.NET

2010-08-19 23:13:30 ----D---- C:\Documents and Settings\Ghost\Application Data\Bc

2010-08-19 21:38:47 ----SD---- C:\WINDOWS\Tasks

2010-08-18 20:53:15 ----SD---- C:\Documents and Settings\All Users\Application Data\Microsoft

2010-08-18 20:48:55 ----D---- C:\Program Files\Common Files\Nero

2010-08-18 18:30:47 ----D---- C:\Documents and Settings\Ghost\Application Data\Nero

2010-08-18 17:34:00 ----D---- C:\Program Files\Nero

2010-08-18 17:07:19 ----D---- C:\Documents and Settings\Ghost\Application Data\TeamViewer

2010-08-18 13:12:56 ----D---- C:\Program Files\Avant Browser

2010-08-18 02:33:46 ----D---- C:\Program Files\Glary Utilities

2010-08-18 02:33:46 ----A---- C:\Documents and Settings\Ghost\Application Data\SETTINGS.INI

2010-08-17 23:10:09 ----RSD---- C:\WINDOWS\assembly

2010-08-17 22:33:14 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI

2010-08-17 18:55:36 ----RASH---- C:\boot.ini

2010-08-16 17:07:26 ----D---- C:\Program Files\Exterminate It!

2010-08-16 16:54:45 ----HD---- C:\WINDOWS\$hf_mig$

2010-08-16 16:53:46 ----D---- C:\Program Files\Internet Explorer

2010-08-16 16:53:36 ----D---- C:\WINDOWS\ie8updates

2010-08-16 16:52:43 ----D---- C:\Program Files\Movie Maker

2010-08-16 15:35:08 ----D---- C:\Program Files\uTorrent

2010-08-16 13:47:56 ----A---- C:\WINDOWS\NeroDigital.ini

2010-08-16 12:54:35 ----D---- C:\Documents and Settings\Ghost\Application Data\IDM

2010-08-15 02:32:55 ----D---- C:\WINDOWS\Help

2010-08-11 03:46:02 ----RSD---- C:\WINDOWS\Fonts

2010-08-11 03:45:28 ----D---- C:\WINDOWS\system32\wbem

2010-08-11 03:44:36 ----D---- C:\Program Files\MSBuild

2010-08-11 03:41:42 ----D---- C:\WINDOWS\SHELLNEW

2010-08-11 03:34:33 ----D---- C:\Program Files\Common Files\System

2010-08-11 03:23:47 ----D---- C:\Program Files\Microsoft Office

2010-08-08 01:12:58 ----D---- C:\Documents and Settings\All Users\Application Data\RealHideIP

2010-08-07 11:00:55 ----RD---- C:\WINDOWS\Web

2010-08-06 21:27:57 ----SHD---- C:\System Volume Information

2010-08-06 21:27:57 ----D---- C:\WINDOWS\system32\Restore

2010-08-06 01:59:16 ----D---- C:\WINDOWS\system32\NtmsData

2010-08-06 01:32:27 ----D---- C:\Program Files\Common Files\InstallShield

2010-08-05 11:19:02 ----HDC---- C:\WINDOWS\$NtUninstallKB975025$

2010-08-05 10:12:34 ----D---- C:\Program Files\Common Files\Java

2010-08-03 22:19:01 ----D---- C:\WINDOWS\Registration

2010-08-03 11:09:32 ----A---- C:\WINDOWS\system32\MRT.exe

2010-08-03 00:58:43 ----D---- C:\Documents and Settings\All Users\Application Data\NOS

2010-08-03 00:52:56 ----D---- C:\DriveKey

2010-08-02 19:46:37 ----D---- C:\WINDOWS\lhsp

2010-08-02 15:16:00 ----D---- C:\Documents and Settings\All Users\Application Data\Apple Computer

2010-08-02 15:12:44 ----D---- C:\Program Files\Winamp

2010-08-02 03:07:54 ----D---- C:\Program Files\Songbird

2010-08-02 02:41:27 ----D---- C:\WINDOWS\system32\ReinstallBackups

2010-08-02 02:41:19 ----DC---- C:\WINDOWS\system32\DRVSTORE

2010-08-01 15:30:09 ----HDC---- C:\WINDOWS\$NtUninstallKB974392$

2010-07-28 15:13:08 ----D---- C:\Program Files\Common Files\PC Tools

2010-07-27 19:14:20 ----D---- C:\Program Files\WinUtilities

2010-07-27 18:49:25 ----D---- C:\WinSetupFromUSB

2010-07-27 18:25:06 ----D---- C:\Documents and Settings\Ghost\Application Data\GoodSync

2010-07-26 23:28:54 ----A---- C:\WINDOWS\system32\shell32.dll

2010-07-26 22:02:22 ----D---- C:\Program Files\Realtek

2010-07-25 17:08:22 ----D---- C:\Program Files\BeFaster

2010-07-25 02:59:52 ----D---- C:\Program Files\Speaking Notepad

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 PxHelp20;PxHelp20; C:\WINDOWS\System32\Drivers\PxHelp20.sys [2009-04-28 44944]

R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2010-06-28 28880]

R1 aswSP;aswSP; C:\WINDOWS\system32\drivers\aswSP.sys [2010-06-28 165456]

R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2010-06-28 46672]

R1 DeskLock;DeskLock; C:\WINDOWS\system32\drivers\DeskLock.sys [2010-08-22 18030]

R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 36352]

R1 ISODrive;ISO DVD/CD-ROM Device Driver; \??\C:\Program Files\UltraISO\drivers\ISODrive.sys []

R1 PQNTDrv;PQNTDrv; C:\WINDOWS\system32\drivers\PQNTDrv.sys [2004-05-05 4228]

R1 WS2IFSL;Windows Socket 2.0 Non-IFS Service Provider Support Environment; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2008-04-14 12032]

R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\drivers\aswFsBlk.sys [2010-06-28 17744]

R2 aswMon2;avast! Standard Shield Support; C:\WINDOWS\system32\drivers\aswMon2.sys [2010-06-28 100176]

R2 NwlnkIpx;NWLink IPX/SPX/NetBIOS Compatible Transport Protocol; C:\WINDOWS\system32\DRIVERS\nwlnkipx.sys [2008-04-14 88320]

R2 NwlnkNb;NWLink NetBIOS; C:\WINDOWS\system32\DRIVERS\nwlnknb.sys [2008-04-14 63232]

R2 NwlnkSpx;NWLink SPX/SPXII Protocol; C:\WINDOWS\system32\DRIVERS\nwlnkspx.sys [2008-04-14 55936]

R2 pnarp;Pure Networks Device Discovery Driver; C:\WINDOWS\system32\DRIVERS\pnarp.sys [2009-07-07 25392]

R2 pnpcap;Pure Networks Packet Capture Driver; C:\WINDOWS\system32\DRIVERS\pnpcap.sys [2008-12-14 23344]

R2 purendis;Pure Networks Wireless Driver; C:\WINDOWS\system32\DRIVERS\purendis.sys [2009-07-07 26672]

R2 rspndr;Link-Layer Topology Discovery Responder; C:\WINDOWS\system32\DRIVERS\rspndr.sys [2008-05-29 62848]

R3 Afc;PPdus ASPI Shell; C:\WINDOWS\system32\drivers\Afc.sys [2006-11-10 18688]

R3 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2010-06-28 23376]

R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys [2010-06-08 15664]

R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-14 144384]

R3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\igxpmp32.sys [2010-01-13 1730272]

R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2010-07-06 6088296]

R3 MBAMProtector;MBAMProtector; \??\C:\WINDOWS\system32\drivers\mbam.sys []

R3 mcdbus;Driver for MagicISO SCSI Host Controller; C:\WINDOWS\system32\DRIVERS\mcdbus.sys [2009-02-24 116736]

R3 MTsensor;ATK0110 ACPI UTILITY; C:\WINDOWS\system32\DRIVERS\ASACPI.sys [2006-02-26 5810]

R3 NWRDR;NetWare Rdr; C:\WINDOWS\system32\DRIVERS\nwrdr.sys [2008-04-14 163584]

R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys [2010-07-06 234392]

R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-14 20608]

S3 Ambfilt;Ambfilt; C:\WINDOWS\system32\drivers\Ambfilt.sys [2009-11-18 1691480]

S3 CCDECODE;Closed Caption Decoder; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-14 17024]

S3 DrvAgent32;DrvAgent32; \??\C:\WINDOWS\system32\Drivers\DrvAgent32.sys []

S3 ExterminateIt;ExterminateIt; \??\C:\WINDOWS\system32\drivers\extit.sys []

S3 m4301a;Linksys Wireless-B USB Network Adapter v4.0 Driver; C:\WINDOWS\system32\DRIVERS\m4301A.sys [2004-12-21 141990]

S3 Monfilt;Monfilt; C:\WINDOWS\system32\drivers\Monfilt.sys [2009-11-18 1395800]

S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-14 5504]

S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-14 85248]

S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-14 10880]

S3 Normandy;Normandy SR2; C:\WINDOWS\system32\drivers\Normandy.sys []

S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-14 11136]

S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-14 15232]

S3 usbaudio;USB Audio Driver (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2008-04-14 60032]

S3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-22 32384]

S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]

S3 usbvideo;USB Video Device (WDM); C:\WINDOWS\System32\Drivers\usbvideo.sys [2008-04-14 121984]

S3 WSTCODEC;World Standard Teletext Codec; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-14 19200]

S4 sptd;sptd; C:\WINDOWS\System32\Drivers\sptd.sys [2010-06-16 697328]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 ACDaemon;ArcSoft Connect Daemon; C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [2008-01-16 104960]

R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-06-28 40384]

R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2010-08-20 152984]

R2 MBAMService;MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [2010-04-29 304464]

R2 nmservice;Pure Networks Platform Service; C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe [2009-07-07 647216]

R2 NWCWorkstation;Client Service for NetWare; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]

R2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service; C:\Program Files\Common Files\PC Tools\sMonitor\StartManSvc.exe [2010-04-08 632792]

R2 PSI_SVC_2;Protexis Licensing V2; c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe [2007-07-24 185632]

R2 Uniblue DiskRescue;Uniblue DiskRescue; C:\Program Files\Uniblue\DiskRescue\UBDiskRescueSrv.exe [2008-09-10 229648]

S2 KMService;KMService; C:\WINDOWS\system32\srvany.exe [2010-08-11 8192]

S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]

S3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-06-28 40384]

S3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-06-28 40384]

S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]

S3 E9770FBE;E9770FBE; C:\WINDOWS\system32\E9770FBE.exe [2010-08-21 6656]

S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]

S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]

S3 Imapi Helper;Imapi Helper; C:\Program Files\Alex Feinman\ISO Recorder\ImapiHelper.exe [2006-01-05 163840]

S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service; C:\Program Files\Microsoft Office\Office14\GROOVE.EXE [2010-01-21 30963576]

S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 149352]

S3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000]

S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-10-18 913408]

S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]

S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

Стартирайте пак OTL.exe и с Copy/ Paste под колонката Custom Scans/Fixes въведете скриптовия текст от цитата по-долу, като не забравяте да копирате скрипта 1 към 1, както и двете точки преди първия ред на скрипта!

:OTL

SRV - [2010/08/21 18:25:31 | 000,006,656 | ---- | M] () [On_Demand | Stopped] -- C:\WINDOWS\system32\E9770FBE.exe -- (E9770FBE)

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=

FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT919167&SearchSource=3&q={searchTerms}"

O4 - Startup: C:\Documents and Settings\Ghost\Start Menu\Programs\Startup\######.lnk = C:\Program Files\######\FiestaBar\######.exe File not found

[2010/08/05 22:06:16 | 000,000,923 | ---- | M] () -- C:\Documents and Settings\Ghost\Application Data\Mozilla\Firefox\Profiles\6xslnlzt.default\searchplugins\conduit.xml

[2010/08/21 07:40:11 | 000,006,656 | ---- | M] () -- C:\WINDOWS\System32\079F11F3.exe

[2010/07/03 22:59:46 | 000,061,952 | ---- | M] () -- C:\Documents and Settings\Ghost\Application Data\Swhst\svhst.exe

[2010/07/09 10:57:00 | 000,699,392 | ---- | M] () -- C:\Documents and Settings\Ghost\Application Data\Swhst\swhst.exe


:Files

recycler /alldrives

ipconfig /flushdns


:Commands

[purity]

[emptytemp]

[Reboot]

След като въведете скрипта от цитата по-горе натиснете бутона, маркиран в червено:

Ще се създаде лог файл. Копирайте и поставете този файл в следващия си коментар.

Ето лога

All processes killed

========== OTL ==========

Service E9770FBE stopped successfully!

Service E9770FBE deleted successfully!

C:\WINDOWS\system32\E9770FBE.exe moved successfully.

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully!

Prefs.js: "http://search.conduit.com/ResultsExt.aspx?ctid=CT919167&SearchSource=3&q={searchTerms}" removed from browser.search.defaulturl

File move failed. C:\Documents and Settings\Ghost\Start Menu\Programs\Startup\######.lnk scheduled to be moved on reboot.

C:\Documents and Settings\Ghost\Application Data\Mozilla\Firefox\Profiles\6xslnlzt.default\searchplugins\conduit.xml moved successfully.

C:\WINDOWS\system32\079F11F3.exe moved successfully.

C:\Documents and Settings\Ghost\Application Data\Swhst\svhst.exe moved successfully.

C:\Documents and Settings\Ghost\Application Data\Swhst\swhst.exe moved successfully.

========== FILES ==========

C:\RECYCLER\S-1-5-21-436374069-861567501-1801674531-1003 folder moved successfully.

C:\RECYCLER folder moved successfully.

D:\RECYCLER\S-1-5-21-436374069-861567501-1801674531-1003 folder moved successfully.

D:\RECYCLER folder moved successfully.

Invalid Switch: flushdns

========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

User: Ghos

->Temporary Internet Files folder emptied: 0 bytes

User: Ghost

->Temp folder emptied: 3466 bytes

->Temporary Internet Files folder emptied: 31633985 bytes

->Java cache emptied: 0 bytes

->FireFox cache emptied: 5832620 bytes

->Google Chrome cache emptied: 0 bytes

->Opera cache emptied: 0 bytes

->Flash cache emptied: 2969 bytes

User: LocalService

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

User: NetworkService

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

->Flash cache emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32\dllcache .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 255 bytes

%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes

%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes

RecycleBin emptied: 0 bytes

Total Files Cleaned = 36,00 mb

OTL by OldTimer - Version 3.2.10.0 log created on 08222010_180649

Files\Folders moved on Reboot...

File\Folder C:\Documents and Settings\Ghost\Start Menu\Programs\Startup\######.lnk not found!

Registry entries deleted on Reboot...

Сега имате ли проблеми ? Някакво подобрение ?

За съжаление не благодаря за всичко все пак какво да правя сега ще трябва да преинсталвам ли

Пробвайте следната програма Winsock XP Fix.

ок

Пак е така толкова много неща правихме явно е нещо упорито имам ли вирус в момента или го махнахме ако няма вирус да се примирим и да си ползвам само авант браузера аз отивам на гости и няма да мога да пиша сега благодаря за отделеното време доста се позанимавахме

Можете да пробвате Bootkit Remover като за последно. Ако той не помогне е хубаво да направите чиста инсталация на Windows. (Метод 1)

Изтеглете Bootkit Remover от следния линк:

http://www.esagelab.com/files/bootkit_remover.rar

• 
  
  
• Разархивирайте Remover.exe на вашият десктоп.
  
• Стартирайте Remover.exe
  
• Ще се покаже черен екран на който има данни.
  
• С десен клик на прозореца изберете -> Select All
  
• Натиснете Control+C, за да копирате данните.
  
• Отворете Notepad и натиснете Control+V, за да поставите данните в документа.
  
• Публикувайте резултатите в следващият си пост
  

Добър ден ето лога

Bootkit Remover

© 2009 eSage Lab

www.esagelab.com

Program version: 1.1.0.0

OS Version: Microsoft Windows XP Professional Service Pack 3 (build 2600)

System volume is \\.\C:

\\.\C: -> \\.\PhysicalDrive0 at offset 0x00000000`00007e00

Boot sector MD5 is: 0db59e7c2f8146e78ae00783affdf194

Size Device Name MBR Status

--------------------------------------------

153 GB \\.\PhysicalDrive0 Unknown boot code

Unknown boot code has been found on some of your physical disks.

To inspect the boot code manually, dump the master boot sector:

remover.exe dump <device_name> [output_file]

To disinfect the master boot sector, use the following command:

remover.exe fix <device_name>

Done;

Press any key to quit...

Направете следното:

Start -> Run и с Copy/Paste въведете следната команда:

"%userprofile%\Desktop\remover.exe" fix \\.\PhysicalDrive0

Ето това ми показва снимка може би защото снощи сложих Спиваре доктор и като сканирах премахна доста неща но уви пак ми е бавен компа и все по зле става ще дефрагментирам на цяло и ще почистя колкото мога

Пуснете пак Bootkit Remover.

Ето това е

Bootkit Remover

© 2009 eSage Lab

www.esagelab.com

Program version: 1.1.0.0

OS Version: Microsoft Windows XP Professional Service Pack 3 (build 2600)

System volume is \\.\C:

\\.\C: -> \\.\PhysicalDrive0 at offset 0x00000000`00007e00

Boot sector MD5 is: 0db59e7c2f8146e78ae00783affdf194

Size Device Name MBR Status

--------------------------------------------

153 GB \\.\PhysicalDrive0 Unknown boot code

Unknown boot code has been found on some of your physical disks.

To inspect the boot code manually, dump the master boot sector:

remover.exe dump <device_name> [output_file]

To disinfect the master boot sector, use the following command:

remover.exe fix <device_name>

Done;

Press any key to quit...

Препоръчвам ви да направите чиста инсталация на Windows. Ето малко повече информация: http://support.microsoft.com/kb/316941/bg

Успех!

Разархивирах го дадох десен бутон и рун ас и го стартирах с администратор Снимка

и лога

.\debug.cpp(238) : Debug log started at 23.08.2010 - 23:39:40

.\boot_cleaner.cpp(675) : Bootkit Remover

.\boot_cleaner.cpp(676) : © 2009 eSage Lab

.\boot_cleaner.cpp(677) : www.esagelab.com

.\boot_cleaner.cpp(681) : Program version: 1.1.0.0

.\boot_cleaner.cpp(688) : OS Version: Microsoft Windows XP Professional Service Pack 3 (build 2600)

.\debug.cpp(248) : **********************************************

.\debug.cpp(249) : *** [ LOADED MODULES INFORMATION ] ***********

.\debug.cpp(250) : **********************************************

.\debug.cpp(256) : 0x804d7000 0x0020d000 "\WINDOWS\system32\ntkrnlpa.exe"

.\debug.cpp(256) : 0x806e4000 0x00020d80 "\WINDOWS\system32\hal.dll"

.\debug.cpp(256) : 0xf7abe000 0x00002000 "\WINDOWS\system32\KDCOM.DLL"

.\debug.cpp(256) : 0xf79ce000 0x00003000 "\WINDOWS\system32\BOOTVID.dll"

.\debug.cpp(256) : 0xf748f000 0x0002e000 "ACPI.sys"

.\debug.cpp(256) : 0xf7ac0000 0x00002000 "\WINDOWS\system32\DRIVERS\WMILIB.SYS"

.\debug.cpp(256) : 0xf747e000 0x00011000 "pci.sys"

.\debug.cpp(256) : 0xf745e000 0x00020000 "fltMgr.sys"

.\debug.cpp(256) : 0xf75be000 0x0000a000 "isapnp.sys"

.\debug.cpp(256) : 0xf7b86000 0x00001000 "pciide.sys"

.\debug.cpp(256) : 0xf783e000 0x00007000 "\WINDOWS\system32\DRIVERS\PCIIDEX.SYS"

.\debug.cpp(256) : 0xf75ce000 0x0000b000 "MountMgr.sys"

.\debug.cpp(256) : 0xf743f000 0x0001f000 "ftdisk.sys"

.\debug.cpp(256) : 0xf7ac2000 0x00002000 "dmload.sys"

.\debug.cpp(256) : 0xf7419000 0x00026000 "dmio.sys"

.\debug.cpp(256) : 0xf7846000 0x00005000 "PartMgr.sys"

.\debug.cpp(256) : 0xf75de000 0x0000d000 "VolSnap.sys"

.\debug.cpp(256) : 0xf7401000 0x00018000 "atapi.sys"

.\debug.cpp(256) : 0xf75ee000 0x00009000 "disk.sys"

.\debug.cpp(256) : 0xf75fe000 0x0000d000 "\WINDOWS\system32\DRIVERS\CLASSPNP.SYS"

.\debug.cpp(256) : 0xf73ef000 0x00012000 "sr.sys"

.\debug.cpp(256) : 0xf73b6000 0x00039000 "PCTCore.sys"

.\debug.cpp(256) : 0xf73a5000 0x00011000 "TfSysMon.sys"

.\debug.cpp(256) : 0xf7394000 0x00011000 "TfFsMon.sys"

.\debug.cpp(256) : 0xf760e000 0x0000a000 "PxHelp20.sys"

.\debug.cpp(256) : 0xf737d000 0x00017000 "KSecDD.sys"

.\debug.cpp(256) : 0xf72f0000 0x0008d000 "Ntfs.sys"

.\debug.cpp(256) : 0xf72c3000 0x0002d000 "NDIS.sys"

.\debug.cpp(256) : 0xf72a9000 0x0001a000 "Mup.sys"

.\debug.cpp(256) : 0xf77fe000 0x00009000 "\SystemRoot\system32\DRIVERS\intelppm.sys"

.\debug.cpp(256) : 0xf664b000 0x001a7000 "\SystemRoot\system32\DRIVERS\igxpmp32.sys"

.\debug.cpp(256) : 0xf6637000 0x00014000 "\SystemRoot\system32\DRIVERS\VIDEOPRT.SYS"

.\debug.cpp(256) : 0xf660f000 0x00028000 "\SystemRoot\system32\DRIVERS\HDAudBus.sys"

.\debug.cpp(256) : 0xf65d8000 0x00037000 "\SystemRoot\system32\DRIVERS\Rtenicxp.sys"

.\debug.cpp(256) : 0xf78ce000 0x00006000 "\SystemRoot\system32\DRIVERS\usbuhci.sys"

.\debug.cpp(256) : 0xf65b4000 0x00024000 "\SystemRoot\system32\DRIVERS\USBPORT.SYS"

.\debug.cpp(256) : 0xf78d6000 0x00008000 "\SystemRoot\system32\DRIVERS\usbehci.sys"

.\debug.cpp(256) : 0xf7b06000 0x00002000 "\SystemRoot\system32\DRIVERS\ASACPI.sys"

.\debug.cpp(256) : 0xf780e000 0x0000d000 "\SystemRoot\system32\DRIVERS\i8042prt.sys"

.\debug.cpp(256) : 0xf78de000 0x00006000 "\SystemRoot\system32\DRIVERS\kbdclass.sys"

.\debug.cpp(256) : 0xf78e6000 0x00006000 "\SystemRoot\system32\DRIVERS\mouclass.sys"

.\debug.cpp(256) : 0xf781e000 0x00010000 "\SystemRoot\system32\DRIVERS\serial.sys"

.\debug.cpp(256) : 0xf726d000 0x00004000 "\SystemRoot\system32\DRIVERS\serenum.sys"

.\debug.cpp(256) : 0xf782e000 0x0000b000 "\SystemRoot\system32\DRIVERS\imapi.sys"

.\debug.cpp(256) : 0xf78ee000 0x00008000 "\SystemRoot\system32\drivers\Afc.sys"

.\debug.cpp(256) : 0xf766e000 0x00010000 "\SystemRoot\system32\DRIVERS\cdrom.sys"

.\debug.cpp(256) : 0xf767e000 0x0000f000 "\SystemRoot\system32\DRIVERS\redbook.sys"

.\debug.cpp(256) : 0xf6591000 0x00023000 "\SystemRoot\system32\DRIVERS\ks.sys"

.\debug.cpp(256) : 0xf78f6000 0x00007000 "\SystemRoot\System32\Drivers\GEARAspiWDM.sys"

.\debug.cpp(256) : 0xf7bcd000 0x00001000 "\SystemRoot\system32\DRIVERS\audstub.sys"

.\debug.cpp(256) : 0xf768e000 0x0000d000 "\SystemRoot\system32\DRIVERS\rasl2tp.sys"

.\debug.cpp(256) : 0xf7265000 0x00003000 "\SystemRoot\system32\DRIVERS\ndistapi.sys"

.\debug.cpp(256) : 0xf657a000 0x00017000 "\SystemRoot\system32\DRIVERS\ndiswan.sys"

.\debug.cpp(256) : 0xf769e000 0x0000b000 "\SystemRoot\system32\DRIVERS\raspppoe.sys"

.\debug.cpp(256) : 0xf76ae000 0x0000c000 "\SystemRoot\system32\DRIVERS\raspptp.sys"

.\debug.cpp(256) : 0xf78fe000 0x00005000 "\SystemRoot\system32\DRIVERS\TDI.SYS"

.\debug.cpp(256) : 0xf6569000 0x00011000 "\SystemRoot\system32\DRIVERS\psched.sys"

.\debug.cpp(256) : 0xf76be000 0x00009000 "\SystemRoot\system32\DRIVERS\msgpc.sys"

.\debug.cpp(256) : 0xf7906000 0x00005000 "\SystemRoot\system32\DRIVERS\ptilink.sys"

.\debug.cpp(256) : 0xf790e000 0x00005000 "\SystemRoot\system32\DRIVERS\raspti.sys"

.\debug.cpp(256) : 0xf6499000 0x00030000 "\SystemRoot\system32\DRIVERS\rdpdr.sys"

.\debug.cpp(256) : 0xf76ce000 0x0000a000 "\SystemRoot\system32\DRIVERS\termdd.sys"

.\debug.cpp(256) : 0xf647c000 0x0001d000 "\SystemRoot\system32\DRIVERS\mcdbus.sys"

.\debug.cpp(256) : 0xf6464000 0x00018000 "\SystemRoot\system32\DRIVERS\SCSIPORT.SYS"

.\debug.cpp(256) : 0xf7b08000 0x00002000 "\SystemRoot\system32\DRIVERS\swenum.sys"

.\debug.cpp(256) : 0xf6406000 0x0005e000 "\SystemRoot\system32\DRIVERS\update.sys"

.\debug.cpp(256) : 0xf680e000 0x00004000 "\SystemRoot\system32\DRIVERS\mssmbios.sys"

.\debug.cpp(256) : 0xf771e000 0x0000a000 "\SystemRoot\System32\Drivers\NDProxy.SYS"

.\debug.cpp(256) : 0xeb3d1000 0x0060c000 "\SystemRoot\system32\drivers\RtkHDAud.sys"

.\debug.cpp(256) : 0xeb3ad000 0x00024000 "\SystemRoot\system32\drivers\portcls.sys"

.\debug.cpp(256) : 0xf773e000 0x0000f000 "\SystemRoot\system32\drivers\drmk.sys"

.\debug.cpp(256) : 0xeb2cb000 0x0000f000 "\SystemRoot\system32\DRIVERS\usbhub.sys"

.\debug.cpp(256) : 0xf7b5a000 0x00002000 "\SystemRoot\system32\DRIVERS\USBD.SYS"

.\debug.cpp(256) : 0xf7b5c000 0x00002000 "\SystemRoot\System32\Drivers\Fs_Rec.SYS"

.\debug.cpp(256) : 0xf7c64000 0x00001000 "\SystemRoot\System32\Drivers\Null.SYS"

.\debug.cpp(256) : 0xf7b5e000 0x00002000 "\SystemRoot\System32\Drivers\Beep.SYS"

.\debug.cpp(256) : 0xf794e000 0x00006000 "\SystemRoot\System32\drivers\vga.sys"

.\debug.cpp(256) : 0xf7b60000 0x00002000 "\SystemRoot\System32\Drivers\mnmdd.SYS"

.\debug.cpp(256) : 0xf7b62000 0x00002000 "\SystemRoot\System32\DRIVERS\RDPCDD.sys"

.\debug.cpp(256) : 0xf7956000 0x00005000 "\SystemRoot\System32\Drivers\Msfs.SYS"

.\debug.cpp(256) : 0xf795e000 0x00008000 "\SystemRoot\System32\Drivers\Npfs.SYS"

.\debug.cpp(256) : 0xeb37c000 0x00003000 "\SystemRoot\system32\DRIVERS\rasacd.sys"

.\debug.cpp(256) : 0xeb278000 0x00013000 "\SystemRoot\system32\DRIVERS\ipsec.sys"

.\debug.cpp(256) : 0xeb21f000 0x00059000 "\SystemRoot\system32\DRIVERS\tcpip.sys"

.\debug.cpp(256) : 0xeb1e8000 0x00037000 "\??\C:\WINDOWS\system32\drivers\pctgntdi.sys"

.\debug.cpp(256) : 0xeb1c2000 0x00026000 "\SystemRoot\system32\DRIVERS\ipnat.sys"

.\debug.cpp(256) : 0xeb2bb000 0x00009000 "\SystemRoot\system32\DRIVERS\wanarp.sys"

.\debug.cpp(256) : 0xeb2ab000 0x0000a000 "\SystemRoot\System32\Drivers\aswTdi.SYS"

.\debug.cpp(256) : 0xeb19a000 0x00028000 "\SystemRoot\system32\DRIVERS\netbt.sys"

.\debug.cpp(256) : 0xf727d000 0x00003000 "\SystemRoot\System32\drivers\ws2ifsl.sys"

.\debug.cpp(256) : 0xeb178000 0x00022000 "\SystemRoot\System32\drivers\afd.sys"

.\debug.cpp(256) : 0xf76fe000 0x00009000 "\SystemRoot\system32\DRIVERS\netbios.sys"

.\debug.cpp(256) : 0xeb14d000 0x0002b000 "\SystemRoot\system32\DRIVERS\rdbss.sys"

.\debug.cpp(256) : 0xf7c7c000 0x00001000 "\SystemRoot\System32\Drivers\PQNTDrv.SYS"

.\debug.cpp(256) : 0xeb0dd000 0x00070000 "\SystemRoot\system32\DRIVERS\mrxsmb.sys"

.\debug.cpp(256) : 0xeb0c6000 0x00017000 "\??\C:\Program Files\UltraISO\drivers\ISODrive.sys"

.\debug.cpp(256) : 0xf770e000 0x0000b000 "\SystemRoot\System32\Drivers\Fips.SYS"

.\debug.cpp(256) : 0xf7856000 0x00005000 "\SystemRoot\system32\drivers\DeskLock.sys"

.\debug.cpp(256) : 0xeb09f000 0x00027000 "\SystemRoot\System32\Drivers\aswSP.SYS"

.\debug.cpp(256) : 0xf791e000 0x00006000 "\SystemRoot\System32\Drivers\Aavmker4.SYS"

.\debug.cpp(256) : 0xf776e000 0x00010000 "\SystemRoot\System32\Drivers\Cdfs.SYS"

.\debug.cpp(256) : 0xeb087000 0x00018000 "\SystemRoot\System32\Drivers\dump_atapi.sys"

.\debug.cpp(256) : 0xf7b72000 0x00002000 "\SystemRoot\System32\Drivers\dump_WMILIB.SYS"

.\debug.cpp(256) : 0xbf800000 0x001c7000 "\SystemRoot\System32\win32k.sys"

.\debug.cpp(256) : 0xf5ae9000 0x00003000 "\SystemRoot\System32\drivers\Dxapi.sys"

.\debug.cpp(256) : 0xf7926000 0x00005000 "\SystemRoot\System32\watchdog.sys"

.\debug.cpp(256) : 0xbf000000 0x00012000 "\SystemRoot\System32\drivers\dxg.sys"

.\debug.cpp(256) : 0xf7c36000 0x00001000 "\SystemRoot\System32\drivers\dxgthk.sys"

.\debug.cpp(256) : 0xbf024000 0x00035000 "\SystemRoot\System32\igxpgd32.dll"

.\debug.cpp(256) : 0xbf012000 0x00012000 "\SystemRoot\System32\igxprd32.dll"

.\debug.cpp(256) : 0xbf059000 0x00290000 "\SystemRoot\System32\igxpdv32.DLL"

.\debug.cpp(256) : 0xbf2e9000 0x003a9000 "\SystemRoot\System32\igxpdx32.DLL"

.\debug.cpp(256) : 0xbffa0000 0x00046000 "\SystemRoot\System32\ATMFD.DLL"

.\debug.cpp(256) : 0xeb023000 0x00004000 "\??\C:\WINDOWS\system32\drivers\mbam.sys"

.\debug.cpp(256) : 0xeb047000 0x00003000 "\SystemRoot\System32\Drivers\aswFsBlk.SYS"

.\debug.cpp(256) : 0xf5ff4000 0x00016000 "\SystemRoot\system32\DRIVERS\nwlnkipx.sys"

.\debug.cpp(256) : 0xf64e9000 0x00010000 "\SystemRoot\system32\DRIVERS\nwlnknb.sys"

.\debug.cpp(256) : 0xf79e2000 0x00004000 "\SystemRoot\system32\DRIVERS\ndisuio.sys"

.\debug.cpp(256) : 0xf79a6000 0x00005000 "\SystemRoot\system32\DRIVERS\pnarp.sys"

.\debug.cpp(256) : 0xf79b6000 0x00005000 "\SystemRoot\system32\DRIVERS\pnpcap.sys"

.\debug.cpp(256) : 0xf79be000 0x00005000 "\SystemRoot\system32\DRIVERS\purendis.sys"

.\debug.cpp(256) : 0xf64d9000 0x00010000 "\SystemRoot\system32\DRIVERS\rspndr.sys"

.\debug.cpp(256) : 0xf5ec5000 0x00017000 "\SystemRoot\System32\Drivers\aswMon2.SYS"

.\debug.cpp(256) : 0xf5d35000 0x00028000 "\SystemRoot\system32\DRIVERS\nwrdr.sys"

.\debug.cpp(256) : 0xf5c30000 0x00015000 "\SystemRoot\system32\drivers\wdmaud.sys"

.\debug.cpp(256) : 0xf5d7d000 0x0000f000 "\SystemRoot\system32\drivers\sysaudio.sys"

.\debug.cpp(256) : 0xf5bb6000 0x00057000 "\SystemRoot\system32\DRIVERS\srv.sys"

.\debug.cpp(256) : 0xf5d9d000 0x0000e000 "\SystemRoot\system32\DRIVERS\nwlnkspx.sys"

.\debug.cpp(256) : 0xf61ee000 0x00007000 "\??\C:\Program Files\Spyware Doctor\PCTSDInj32.sys"

.\debug.cpp(256) : 0xf7170000 0x00010000 "\??\C:\WINDOWS\system32\drivers\pctplsg.sys"

.\debug.cpp(256) : 0xf6adc000 0x00041000 "\SystemRoot\System32\Drivers\HTTP.sys"

.\debug.cpp(256) : 0xf70a9000 0x0000c000 "\??\C:\WINDOWS\system32\drivers\TfNetMon.sys"

.\debug.cpp(256) : 0xf7cbb000 0x0002b000 "\SystemRoot\system32\drivers\kmixer.sys"

.\debug.cpp(256) : 0x7c900000 0x000b2000 "\WINDOWS\system32\ntdll.dll"

.\debug.cpp(263) : **********************************************

.\debug.cpp(307) : *** [ DEVICE OBJECTS INFORMATION ] ***********

.\debug.cpp(308) : **********************************************

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\D:"

.\debug.cpp(400) : Destination="\Device\HarddiskVolume2"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\NDIS"

.\debug.cpp(400) : Destination="\Device\Ndis"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\DISPLAY1"

.\debug.cpp(400) : Destination="\Device\Video0"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Scsi3:"

.\debug.cpp(400) : Destination="\Device\Ide\IdePort1"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{ffbb6e3f-ccfe-4d84-90d9-421418b03a8e}"

.\debug.cpp(400) : Destination="\Device\00000049"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\ASWSP"

.\debug.cpp(400) : Destination="\Device\aswSP"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\DISPLAY2"

.\debug.cpp(400) : Destination="\Device\Video1"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{71985f4a-1ca1-11d3-9cc8-00c04f7971e0}"

.\debug.cpp(400) : Destination="\Device\00000049"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_PPPOEMINIPORT#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}"

.\debug.cpp(400) : Destination="\Device\0000003f"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#GenuineIntel_-_x86_Family_6_Model_23#_1#{97fadb10-4e33-40ae-359c-8bef029dbdd0}"

.\debug.cpp(400) : Destination="\Device\0000004f"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\DmIoDaemon"

.\debug.cpp(400) : Destination="\Device\DmControl\DmIoDaemon"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\aswSP_Pot2"

.\debug.cpp(400) : Destination="\Device\aswSP_Pot2"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\DISPLAY3"

.\debug.cpp(400) : Destination="\Device\Video2"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Ip"

.\debug.cpp(400) : Destination="\Device\Ip"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\E:"

.\debug.cpp(400) : Destination="\Device\CdRom0"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\IPSECDev"

.\debug.cpp(400) : Destination="\Device\IPSEC"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\DISPLAY4"

.\debug.cpp(400) : Destination="\Device\Video3"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_8086&DEV_27C9&SUBSYS_81791043&REV_01#3&11583659&0&E9#{3abf6f2d-71c4-462a-8a92-1e6861e6af27}"

.\debug.cpp(400) : Destination="\Device\NTPNP_PCI0006"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_NDISWANIP#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}"

.\debug.cpp(400) : Destination="\Device\0000003d"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\ATKACPI"

.\debug.cpp(400) : Destination="\Device\ATKACPI"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\STORAGE#Volume#1&30a96598&0&SignatureE7440842Offset7E00LengthD60FD1600#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}"

.\debug.cpp(400) : Destination="\Device\HarddiskVolume1"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\NDPROXY"

.\debug.cpp(400) : Destination="\Device\NDProxy"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\ASWMON"

.\debug.cpp(400) : Destination="\Device\aswMon"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{9aa4a2cc-81e0-4cfd-802f-0f74526d2bd3}"

.\debug.cpp(400) : Destination="\Device\00000049"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Scsi4:"

.\debug.cpp(400) : Destination="\Device\mcdbus"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\CDR4_XP"

.\debug.cpp(400) : Destination="\Device\PxHelperDevice0"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{3c0d501a-140b-11d1-b40f-00a0c9223196}"

.\debug.cpp(400) : Destination="\Device\00000049"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{fd0a5af4-b41d-11d2-9c95-00c04f7971e0}"

.\debug.cpp(400) : Destination="\Device\00000049"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\RdpDrDvMgr"

.\debug.cpp(400) : Destination="\Device\RdpDrDvMgr"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\STORAGE#Volume#1&30a96598&0&SignatureE7440842OffsetD60FE1200LengthDDB108800#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}"

.\debug.cpp(400) : Destination="\Device\HarddiskVolume2"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\HDAUDIO#FUNC_01&VEN_10EC&DEV_0662&SUBSYS_1043837F&REV_1001#4&3b61a816&0&0001#{65e8773d-8f56-11d0-a3b9-00a0c9223196}"

.\debug.cpp(400) : Destination="\Device\0000007b"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\COM1"

.\debug.cpp(400) : Destination="\Device\Serial0"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\WMIDataDevice"

.\debug.cpp(400) : Destination="\Device\WMIDataDevice"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\{EB0F7A36-1463-482F-9054-67B6EF0300A5}"

.\debug.cpp(400) : Destination="\Device\{EB0F7A36-1463-482F-9054-67B6EF0300A5}"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\purendis"

.\debug.cpp(400) : Destination="\Device\purendis"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{dff220f3-f70f-11d0-b917-00a0c9223196}"

.\debug.cpp(400) : Destination="\Device\00000049"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_8086&DEV_29C2&SUBSYS_82B01043&REV_10#3&11583659&0&10#{5b45201d-f2f2-4f3b-85bb-30ff1f953599}"

.\debug.cpp(400) : Destination="\Device\NTPNP_PCI0001"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#GenuineIntel_-_x86_Family_6_Model_23#_0#{97fadb10-4e33-40ae-359c-8bef029dbdd0}"

.\debug.cpp(400) : Destination="\Device\0000004e"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PIPE"

.\debug.cpp(400) : Destination="\Device\NamedPipe"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\TfNetMon"

.\debug.cpp(400) : Destination="\Device\TfNetMon"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\IDE#CdRomATAPI_CD-RW_52X32_______________________M.GD____#5&20f2915f&0&0.1.0#{1186654d-47b8-48b9-beb9-7df113ae3c67}"

.\debug.cpp(400) : Destination="\Device\Ide\IdeDeviceP0T1L0-c"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\SW#{a7c7a5b0-5af3-11d1-9ced-00a024bf0407}#{9B365890-165F-11D0-A195-0020AFD156E4}#{d6c5066e-72c1-11d2-9755-0000f8004788}"

.\debug.cpp(400) : Destination="\Device\KSENUM#00000002"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{2eb07ea0-7e70-11d0-a5d6-28db04c10000}"

.\debug.cpp(400) : Destination="\Device\00000049"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#PNP0303#4&2c575acb&0#{884b96c3-56ef-11d1-bc8c-00a0c91405dd}"

.\debug.cpp(400) : Destination="\Device\00000070"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\G:"

.\debug.cpp(400) : Destination="\Device\IsoCdRom0"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PnArp"

.\debug.cpp(400) : Destination="\Device\PnArp"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PSched"

.\debug.cpp(400) : Destination="\Device\PSched"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\IPNAT"

.\debug.cpp(400) : Destination="\Device\IPNAT"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\HDAUDIO#FUNC_01&VEN_10EC&DEV_0662&SUBSYS_1043837F&REV_1001#4&3b61a816&0&0001#{86841137-ed8e-4d97-9975-f2ed56b4430e}"

.\debug.cpp(400) : Destination="\Device\0000007b"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{0a4252a0-7e70-11d0-a5d6-28db04c10000}"

.\debug.cpp(400) : Destination="\Device\00000049"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\GEARAspiWDMDevice"

.\debug.cpp(400) : Destination="\Device\GEARAspiWDMDevice"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\UNC"

.\debug.cpp(400) : Destination="\Device\Mup"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\{64DB2E3C-0459-4E9D-9713-3996F01E1BD0}"

.\debug.cpp(400) : Destination="\Device\{64DB2E3C-0459-4E9D-9713-3996F01E1BD0}"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{6994ad04-93ef-11d0-a3cc-00a0c9223196}"

.\debug.cpp(400) : Destination="\Device\00000049"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\HCD0"

.\debug.cpp(400) : Destination="\Device\USBFDO-0"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\ASWTDI"

.\debug.cpp(400) : Destination="\Device\ASWTDI"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Tcp"

.\debug.cpp(400) : Destination="\Device\Tcp"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\FltMgrMsg"

.\debug.cpp(400) : Destination="\FileSystem\Filters\FltMgrMsg"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#ROOT_HUB#4&765d3eb&0#{f18a0e88-c30c-11d0-8815-00a0c906bed8}"

.\debug.cpp(400) : Destination="\Device\USBPDO-1"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\HCD1"

.\debug.cpp(400) : Destination="\Device\USBFDO-1"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_8086&DEV_27C8&SUBSYS_81791043&REV_01#3&11583659&0&E8#{3abf6f2d-71c4-462a-8a92-1e6861e6af27}"

.\debug.cpp(400) : Destination="\Device\NTPNP_PCI0005"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\LCD"

.\debug.cpp(400) : Destination="\Device\VideoPdo0"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_PTIMINIPORT#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}"

.\debug.cpp(400) : Destination="\Device\00000044"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\NDISWANIPX"

.\debug.cpp(400) : Destination="\Device\NdisWanIpx"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PRN"

.\debug.cpp(400) : Destination="\DosDevices\LPT1"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\HCD2"

.\debug.cpp(400) : Destination="\Device\USBFDO-2"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{cf1dda2c-9743-11d0-a3ee-00a0c9223196}"

.\debug.cpp(400) : Destination="\Device\00000049"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{53172480-4791-11d0-a5d6-28db04c10000}"

.\debug.cpp(400) : Destination="\Device\00000049"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_PSCHEDMP#0001#{ad498944-762f-11d0-8dcb-00c04fc3358c}"

.\debug.cpp(400) : Destination="\Device\00000042"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PhysicalDrive0"

.\debug.cpp(400) : Destination="\Device\Harddisk0\DR0"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\sysaudio"

.\debug.cpp(400) : Destination="\Device\sysaudio"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\IDE#CdRomATAPI_CD-RW_52X32_______________________M.GD____#5&20f2915f&0&0.1.0#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}"

.\debug.cpp(400) : Destination="\Device\Ide\IdeDeviceP0T1L0-c"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\fsWrap"

.\debug.cpp(400) : Destination="\Device\FsWrap"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\HCD3"

.\debug.cpp(400) : Destination="\Device\USBFDO-3"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_PSCHEDMP#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}"

.\debug.cpp(400) : Destination="\Device\00000041"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{97ebaacb-95bd-11d0-a3ea-00a0c9223196}"

.\debug.cpp(400) : Destination="\Device\00000049"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\CdRom0"

.\debug.cpp(400) : Destination="\Device\CdRom0"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\{A50D75E0-63AE-4B06-B780-B11C77B91A25}"

.\debug.cpp(400) : Destination="\Device\{A50D75E0-63AE-4B06-B780-B11C77B91A25}"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\IsoCdRom"

.\debug.cpp(400) : Destination="\Device\IsoCdRom"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\HCD4"

.\debug.cpp(400) : Destination="\Device\USBFDO-4"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\{8903CECB-95B7-41AB-9A6A-FABC3CFFE844}"

.\debug.cpp(400) : Destination="\Device\{8903CECB-95B7-41AB-9A6A-FABC3CFFE844}"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCTSDInjDriver32"

.\debug.cpp(400) : Destination="\Device\PCTSDInjDriver32"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#ROOT_HUB#4&e097488&0#{f18a0e88-c30c-11d0-8815-00a0c906bed8}"

.\debug.cpp(400) : Destination="\Device\USBPDO-0"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#FixedButton#2&daba3ff&0#{4afa3d53-74a7-11d0-be5e-00a0c9062857}"

.\debug.cpp(400) : Destination="\Device\00000053"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#PNP0C0C#aa#{4afa3d53-74a7-11d0-be5e-00a0c9062857}"

.\debug.cpp(400) : Destination="\Device\00000052"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Global"

.\debug.cpp(400) : Destination="\GLOBAL??"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Volume{45189afc-6f4b-11df-ac8b-806d6172696f}"

.\debug.cpp(400) : Destination="\Device\HarddiskVolume1"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\DeskLock"

.\debug.cpp(400) : Destination="\Device\DeskLock"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#PNP0501#1#{86e0d1e0-8089-11d0-9ce4-08003e301f73}"

.\debug.cpp(400) : Destination="\Device\00000072"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PxHelperDevice0"

.\debug.cpp(400) : Destination="\Device\PxHelperDevice0"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\SW#{a7c7a5b0-5af3-11d1-9ced-00a024bf0407}#{9B365890-165F-11D0-A195-0020AFD156E4}#{d6c50671-72c1-11d2-9755-0000f8004788}"

.\debug.cpp(400) : Destination="\Device\KSENUM#00000002"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{ad809c00-7b88-11d0-a5d6-28db04c10000}"

.\debug.cpp(400) : Destination="\Device\00000049"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{9ea331fa-b91b-45f8-9285-bd2bc77afcde}"

.\debug.cpp(400) : Destination="\Device\00000049"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_8086&DEV_27CA&SUBSYS_81791043&REV_01#3&11583659&0&EA#{3abf6f2d-71c4-462a-8a92-1e6861e6af27}"

.\debug.cpp(400) : Destination="\Device\NTPNP_PCI0007"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{3e227e76-690d-11d2-8161-0000f8775bf1}"

.\debug.cpp(400) : Destination="\Device\00000049"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#ROOT_HUB#4&34aece3e&0#{f18a0e88-c30c-11d0-8815-00a0c906bed8}"

.\debug.cpp(400) : Destination="\Device\USBPDO-2"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{07dad660-22f1-11d1-a9f4-00c04fbbde8f}"

.\debug.cpp(400) : Destination="\Device\00000049"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#PNP0501#1#{4d36e978-e325-11ce-bfc1-08002be10318}"

.\debug.cpp(400) : Destination="\Device\00000072"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Volume{45189afa-6f4b-11df-ac8b-806d6172696f}"

.\debug.cpp(400) : Destination="\Device\HarddiskVolume2"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\pctgntdi"

.\debug.cpp(400) : Destination="\Device\pctgntdi"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\SW#{a7c7a5b0-5af3-11d1-9ced-00a024bf0407}#{9B365890-165F-11D0-A195-0020AFD156E4}#{d6c50674-72c1-11d2-9755-0000f8004788}"

.\debug.cpp(400) : Destination="\Device\KSENUM#00000002"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\AAVMKER4"

.\debug.cpp(400) : Destination="\Device\AavmKer4"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\IDE#DiskHDT722516DLAT80_________________________V43OA70A#5&20f2915f&0&0.0.0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}"

.\debug.cpp(400) : Destination="\Device\Ide\IdeDeviceP0T0L0-4"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#ROOT_HUB20#4&353844c7&0#{f18a0e88-c30c-11d0-8815-00a0c906bed8}"

.\debug.cpp(400) : Destination="\Device\USBPDO-4"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_NDISWANIPX#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}"

.\debug.cpp(400) : Destination="\Device\0000003e"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_L2TPMINIPORT#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}"

.\debug.cpp(400) : Destination="\Device\0000003c"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\MbDlDp32"

.\debug.cpp(400) : Destination="\Device\PxHelperDevice0"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\DmConfig"

.\debug.cpp(400) : Destination="\Device\DmControl\DmConfig"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\MountPointManager"

.\debug.cpp(400) : Destination="\Device\MountPointManager"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\WanArp"

.\debug.cpp(400) : Destination="\Device\WANARP"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#PNP0F03#4&2c575acb&0#{378de44c-56ef-11d1-bc8c-00a0c91405dd}"

.\debug.cpp(400) : Destination="\Device\00000071"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_8086&DEV_27CC&SUBSYS_81791043&REV_01#3&11583659&0&EF#{3abf6f2d-71c4-462a-8a92-1e6861e6af27}"

.\debug.cpp(400) : Destination="\Device\NTPNP_PCI0009"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\mcdbus"

.\debug.cpp(400) : Destination="\Device\mcdbus"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\RealTekCard"

.\debug.cpp(400) : Destination="\Device\RealTekCard"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#ftdisk#0000#{53f5630e-b6bf-11d0-94f2-00a0c91efb8b}"

.\debug.cpp(400) : Destination="\Device\00000003"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\{62720A2C-AAC2-4229-AB7B-5E3B8CFBAB04}"

.\debug.cpp(400) : Destination="\Device\{62720A2C-AAC2-4229-AB7B-5E3B8CFBAB04}"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\{C343B301-54AB-4781-B657-1DE663E4555B}"

.\debug.cpp(400) : Destination="\Device\{C343B301-54AB-4781-B657-1DE663E4555B}"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\USNTracker"

.\debug.cpp(400) : Destination="\Device\USNTracker"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#ROOT_HUB#4&1c5b443c&0#{f18a0e88-c30c-11d0-8815-00a0c906bed8}"

.\debug.cpp(400) : Destination="\Device\USBPDO-3"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\DmTrace"

.\debug.cpp(400) : Destination="\Device\DmControl\DmTrace"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\{499AB27C-8215-4B20-A3B2-FB6A19F6D360}"

.\debug.cpp(400) : Destination="\Device\{499AB27C-8215-4B20-A3B2-FB6A19F6D360}"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}"

.\debug.cpp(400) : Destination="\Device\00000049"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\NDISWANIP"

.\debug.cpp(400) : Destination="\Device\NdisWanIp"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#dmio#0000#{53f5630e-b6bf-11d0-94f2-00a0c91efb8b}"

.\debug.cpp(400) : Destination="\Device\00000002"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\HDAUDIO#FUNC_01&VEN_10EC&DEV_0662&SUBSYS_1043837F&REV_1001#4&3b61a816&0&0001#{6994ad04-93ef-11d0-a3cc-00a0c9223196}"

.\debug.cpp(400) : Destination="\Device\0000007b"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Scsi0:"

.\debug.cpp(400) : Destination="\Device\Ide\IdePort0"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{bf963d80-c559-11d0-8a2b-00a0c9255ac1}"

.\debug.cpp(400) : Destination="\Device\00000049"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\HDAUDIO#FUNC_01&VEN_10EC&DEV_0662&SUBSYS_1043837F&REV_1001#4&3b61a816&0&0001#{dda54a40-1e4c-11d1-a050-405705c10000}"

.\debug.cpp(400) : Destination="\Device\0000007b"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\SW#{a7c7a5b0-5af3-11d1-9ced-00a024bf0407}#{9B365890-165F-11D0-A195-0020AFD156E4}#{fbf6f530-07b9-11d2-a71e-0000f8004788}"

.\debug.cpp(400) : Destination="\Device\KSENUM#00000002"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_10EC&DEV_8136&SUBSYS_83471043&REV_02#4&38d2602c&0&00E1#{ad498944-762f-11d0-8dcb-00c04fc3358c}"

.\debug.cpp(400) : Destination="\Device\NTPNP_PCI0015"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_8086&DEV_29C2&SUBSYS_82B01043&REV_10#3&11583659&0&10#{e6dfdc31-31d0-46ac-86af-da1eb05fc599}"

.\debug.cpp(400) : Destination="\Device\NTPNP_PCI0001"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{4747b320-62ce-11cf-a5d6-28db04c10000}"

.\debug.cpp(400) : Destination="\Device\00000049"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_PPTPMINIPORT#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}"

.\debug.cpp(400) : Destination="\Device\00000040"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PTILINK1"

.\debug.cpp(400) : Destination="\Device\ParTechInc0"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Volume{45189af8-6f4b-11df-ac8b-806d6172696f}"

.\debug.cpp(400) : Destination="\Device\CdRom0"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\NDISTAPI"

.\debug.cpp(400) : Destination="\Device\NdisTapi"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\NdisWan"

.\debug.cpp(400) : Destination="\Device\NdisWan"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\IPMULTICAST"

.\debug.cpp(400) : Destination="\Device\IPMULTICAST"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Scsi1:"

.\debug.cpp(400) : Destination="\Device\Ide\IdePort2"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PTILINK2"

.\debug.cpp(400) : Destination="\Device\ParTechInc1"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\DmLoader"

.\debug.cpp(400) : Destination="\Device\DmLoader"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\IDE#CdRomATAPI_CD-RW_52X32_______________________M.GD____#5&20f2915f&0&0.1.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}"

.\debug.cpp(400) : Destination="\Device\Ide\IdeDeviceP0T1L0-c"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{a7c7a5b1-5af3-11d1-9ced-00a024bf0407}"

.\debug.cpp(400) : Destination="\Device\00000049"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\HDAUDIO#FUNC_01&VEN_10EC&DEV_0662&SUBSYS_1043837F&REV_1001#4&3b61a816&0&0001#{65e8773e-8f56-11d0-a3b9-00a0c9223196}"

.\debug.cpp(400) : Destination="\Device\0000007b"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PTILINK3"

.\debug.cpp(400) : Destination="\Device\ParTechInc2"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Shadow"

.\debug.cpp(400) : Destination="\Device\LanmanRedirector"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\FtControl"

.\debug.cpp(400) : Destination="\Device\FtControl"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\FltMgr"

.\debug.cpp(400) : Destination="\FileSystem\Filters\FltMgr"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\C:"

.\debug.cpp(400) : Destination="\Device\HarddiskVolume1"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\TfSysMon"

.\debug.cpp(400) : Destination="\Device\TfSysMon"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\MAILSLOT"

.\debug.cpp(400) : Destination="\Device\MailSlot"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\aswSP_Avar"

.\debug.cpp(400) : Destination="\Device\aswSP_Avar"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCTCoreDriver"

.\debug.cpp(400) : Destination="\Device\PCTCoreDevice"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\MBAMProtector"

.\debug.cpp(400) : Destination="\Device\MBAMProtector"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\AUX"

.\debug.cpp(400) : Destination="\DosDevices\COM1"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PQNTDRV"

.\debug.cpp(400) : Destination="\Device\PQNTDRV"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\NUL"

.\debug.cpp(400) : Destination="\Device\Null"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\GLOBALROOT"

.\debug.cpp(400) : Destination=""

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Ndisuio"

.\debug.cpp(400) : Destination="\Device\Ndisuio"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#RDP_MOU#0000#{378de44c-56ef-11d1-bc8c-00a0c91405dd}"

.\debug.cpp(400) : Destination="\Device\00000047"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_8086&DEV_27CB&SUBSYS_81791043&REV_01#3&11583659&0&EB#{3abf6f2d-71c4-462a-8a92-1e6861e6af27}"

.\debug.cpp(400) : Destination="\Device\NTPNP_PCI0008"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Scsi2:"

.\debug.cpp(400) : Destination="\Device\Ide\IdePort3"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Aaspi0"

.\debug.cpp(400) : Destination="\Device\Aaspi0"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\TfFsMon"

.\debug.cpp(400) : Destination="\FileSystem\Filters\TfFsMon"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#RDP_KBD#0000#{884b96c3-56ef-11d1-bc8c-00a0c91405dd}"

.\debug.cpp(400) : Destination="\Device\00000046"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PnPcap"

.\debug.cpp(400) : Destination="\Device\PnPcap"

.\debug.cpp(369) : SymbolicLink "\GLOBAL??\DmInfo"

.\debug.cpp(400) : Destination="\Device\DmControl\DmInfo"

.\debug.cpp(451) : **********************************************

.\boot_cleaner.cpp(1077) : System volume is \\.\C:

.\boot_cleaner.cpp(1113) : \\.\C: -> \\.\PhysicalDrive0 at offset 0x00000000`00007e00

.\boot_cleaner.cpp(424) : Boot sector MD5 is: 0db59e7c2f8146e78ae00783affdf194

.\boot_cleaner.cpp(1151) :

.\boot_cleaner.cpp(1152) : Size Device Name MBR Status

.\boot_cleaner.cpp(1153) : --------------------------------------------

.\boot_cleaner.cpp(1197) : 153 GB \\.\PhysicalDrive0 Unknown boot code

.\boot_cleaner.cpp(1203) :

.\boot_cleaner.cpp(1209) : Unknown boot code has been found on some of your physical disks.

.\boot_cleaner.cpp(1211) : To inspect the boot code manually, dump the master boot sector:

.\boot_cleaner.cpp(1212) : remover.exe dump <device_name> [output_file]

.\boot_cleaner.cpp(1216) : To disinfect the master boot sector, use the following command:

.\boot_cleaner.cpp(1217) : remover.exe fix <device_name>

.\boot_cleaner.cpp(1220) :

.\boot_cleaner.cpp(1242) : Done;

Прочетох тази статия http://tutorial.downloadatoz.com/refresh-the-mbr-boot-code-diskpatch.html

и истеглих това http://download.cnet.com/DiskPatch/3000-2086_4-10063613.html но не знам какво да правя нямам сд май трябва да си взема сиди ето снимка от програмата

Използвах tdss_remover_latest.rar и ми показа това

####################################################################

#

# TDSS Remover detected objects log

# Copyright © 2009-2010 eSage Lab

#

# http://www.esagelab.com/

# [email protected]

#

# Program Version: 1.7.5.1

# OS Version: Microsoft Windows XP Professional Service Pack 3 (build 2600)

#

# Computer Name: GANGOSAN-9708CA

#

# Log File Date/Time: 23.08.2010/18:27:25

#

##########################################################################

Alert Type: Hidden Object

Object Type: Registry Key

Original Name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC

Alert Type: Hidden Object

Object Type: Registry Key

Original Name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC

Alert Type: No Access

Object Type: File

Original Name: C:\WINDOWS\system32\aswBoot.exe

Alert Type: No Access

Object Type: File

Original Name: C:\WINDOWS\system32\drivers\aavmker4.sys

Alert Type: No Access

Object Type: File

Original Name: C:\WINDOWS\system32\drivers\aswFsBlk.sys

Alert Type: No Access

Object Type: File

Original Name: C:\WINDOWS\system32\drivers\aswmon.sys

Alert Type: No Access

Object Type: File

Original Name: C:\WINDOWS\system32\drivers\aswmon2.sys

Alert Type: No Access

Object Type: File

Original Name: C:\WINDOWS\system32\drivers\aswRdr.sys

Alert Type: No Access

Object Type: File

Original Name: C:\WINDOWS\system32\drivers\aswSP.sys

Alert Type: No Access

Object Type: File

Original Name: C:\WINDOWS\system32\drivers\aswTdi.sys

Привет отново, Gangosa.

Прави ми изключително лошо впечатление, че почвате да правите каквото си искате. Досега колегата asdfag не ви е дал никаква инструкция за използване на TDSS Remover на eSage.

Запознайте се с правилата на този раздел и по-точно с ето това:

Само членовете на HJT Team са отговорни за даване на инструкции за работа със специализирани инструменти за отстраняване на зловреден код, както и за работа с логовете, създадени от тези инструменти.

Прочее скритите процеси, открити от TDSS Remover на eSage са свързани само с:

1. sptd.sys на Daemon Tools

2. Със avast.

Друго няма.

След като не спазвате правилата на този раздел, аз съм принуден да затворя темата.

Приятна вечер и успех!