URL:Mal [решен]

13 април 201115 г.

От 1-2 дни имам проблеми с компютъра.

Онзи ден Avast ми засече вирус HTM:Script.inf. Сканирах с Avast, Malwarebytes и Spyware Doctor. Реших да пусна да се сканира във Safe mode, но стана нещо странно. Когато натиснах F8 и трябваше да ми се появят опциите за safe mode, излезе нещо друго с други опции. Избрах това, което изглежда най-подобно на такава функция, изведнъж на черен екран с бели букви се появи някакво съобщение на avast и започна да сканира файлове, а от опциите аз избрах да трие. После като стартирах нормално компютъра отворих карантината на Avast, дадох да изтрие всичко и уж нещата бяха ОК.

Вчера обаче се появи ново съобщение за зарата URL:Mal.

Сканирах с Malwarebytes и откри две зарази. Дадох му да ги изтрие, не можа. При рестарт и след това нов скан се беше справил с едната, но не и с другата. Същото действие скан - рестарт - трие - неуспех го повторих няколко пъти.

Междувременно отварям логовете на Avast - на няколко пъти ми открива 7016 заплахи. Нещо не успях да се ориентирам както трябва в папката за логове на Avast,но все пак съм прикачила два скрийншота на това, което ми показва програмата.

Със зелено успешно изтрити са тези от предната зараза. Отдолу има още купища файлове, които не иска да изтрие и ми показва Грешка: There are no more files.

Malwarebytes' Anti-Malware 1.50.1.1100

www.malwarebytes.org

Версия на базата от данни: 6346

Windows 6.1.7600

Internet Explorer 8.0.7600.16385

13.4.2011 г. 15:30:05

mbam-log-2011-04-13 (15-30-05).txt

Тип сканиране: Бързо сканиране

Сканирани обекти: 149385

Изминало време: 4 минута(и), 43 секунда(и)

Заразени процеси в паметта: 0

Заразени модули в паметта: 0

Заразени ключове в регистратурата: 0

Заразени стойности в регистратурата: 0

Заразени информационни обекти в регистратурата: 0

Заразени папки: 0

Заразени файлове: 1

Заразени процеси в паметта:

(Не бяха открити зловредни обекти)

Заразени модули в паметта:

(Не бяха открити зловредни обекти)

Заразени ключове в регистратурата:

(Не бяха открити зловредни обекти)

Заразени стойности в регистратурата:

(Не бяха открити зловредни обекти)

Заразени информационни обекти в регистратурата:

(Не бяха открити зловредни обекти)

Заразени папки:

(Не бяха открити зловредни обекти)

Заразени файлове:

c:\Windows\System32\drivers\str.sys (Rootkit.Agent) -> Delete on reboot.

---------------------------------

Attach

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_11-03-05.01)

.

Microsoft Windows 7 Ultimate

Boot Device: \Device\HarddiskVolume1

Install Date: 21.4.2010 г. 23:21:31

System Uptime: 13.4.2011 г. 15:23:22 (0 hours ago)

.

Motherboard: ASRock | | G31M-VS

Processor: Intel® Celeron® CPU E3300 @ 2.50GHz | CPUSocket | 2493/200mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 100 GiB total, 62,972 GiB free.

D: is FIXED (NTFS) - 366 GiB total, 248,203 GiB free.

E: is CDROM ()

F: is CDROM ()

G: is CDROM ()

H: is CDROM ()

I: is CDROM ()

.

==== Disabled Device Manager Items =============

.

==== System Restore Points ===================

.

RP196: 7.4.2011 г. 02:07:29 - Installed Serif PagePlus Starter Edition

RP197: 7.4.2011 г. 02:13:58 - Removed Google Book Downloader

RP198: 8.4.2011 г. 03:00:11 - Windows Update

RP199: 9.4.2011 г. 00:10:41 - Windows Update

RP200: 13.4.2011 г. 04:10:23 - Windows Update

.

==== Installed Programs ======================

.

Фотогалерия на Windows Live

µTorrent

Adobe Acrobat 9 Pro - English, Franзais, Deutsch

Adobe Acrobat 9.4.3 - CPSID_83708

Adobe After Effects CS4

Adobe After Effects CS4 Presets

Adobe After Effects CS4 Third Party Content

Adobe AIR

Adobe Anchor Service CS4

Adobe Bridge CS4

Adobe CMaps CS4

Adobe Color - Photoshop Specific CS4

Adobe Color EU Extra Settings CS4

Adobe Color JA Extra Settings CS4

Adobe Color NA Recommended Settings CS4

Adobe Color Video Profiles AE CS4

Adobe Color Video Profiles CS CS4

Adobe Creative Suite 4 Master Collection

Adobe CSI CS4

Adobe Default Language CS4

Adobe Dreamweaver CS4

Adobe Dynamiclink Support

Adobe Encore CS4 Codecs

Adobe ExtendScript Toolkit CS4

Adobe Flash Player 10 ActiveX

Adobe Flash Player 10 Plugin

Adobe Fonts All

Adobe Linguistics CS4

Adobe Media Encoder CS4 Exporter

Adobe Media Encoder CS4 Importer

Adobe Media Player

Adobe MotionPicture Color Files CS4

Adobe Output Module

Adobe PDF Library Files CS4

Adobe Photoshop CS4

Adobe Photoshop CS4 Support

Adobe Premiere Pro CS4 Third Party Content

Adobe Search for Help

Adobe Service Manager Extension

Adobe Setup

Adobe Soundbooth CS4 Codecs

Adobe Type Support CS4

Adobe Update Manager CS4

Adobe WinSoft Linguistics Plugin

Adobe XMP Panels CS4

AdobeColorCommonSetCMYK

AdobeColorCommonSetRGB

Apple Application Support

Apple Software Update

Assassin's Creed II

avast! Free Antivirus

Canon MP Navigator EX 1.0

Canon MP210 series

Canon My Printer

CANYON CN-WCAM23 PC-Camera

CCleaner

Collectorz.com Book Collector

Connect

D3DX10

ffdshow v1.1.3516 [2010-07-25]

File List Generator

FileZilla Client 3.4.0

Google Chrome

Google Updater

ImTOO Video Converter Ultimate

Java Auto Updater

Java 6 Update 23

kuler

Last.fm 1.5.4.27091

Malwarebytes' Anti-Malware

Microsoft .NET Framework 4 Client Profile

Microsoft Application Error Reporting

Microsoft Office 2007 Service Pack 2 (SP2)

Microsoft Office Access MUI (English) 2007

Microsoft Office Access Setup Metadata MUI (English) 2007

Microsoft Office Excel MUI (English) 2007

Microsoft Office InfoPath MUI (English) 2007

Microsoft Office Outlook MUI (English) 2007

Microsoft Office PowerPoint MUI (English) 2007

Microsoft Office Professional Plus 2007

Microsoft Office Proof (English) 2007

Microsoft Office Proof (French) 2007

Microsoft Office Proof (Spanish) 2007

Microsoft Office Proofing (English) 2007

Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)

Microsoft Office Publisher MUI (English) 2007

Microsoft Office Shared MUI (English) 2007

Microsoft Office Shared Setup Metadata MUI (English) 2007

Microsoft Office Word MUI (English) 2007

Microsoft SQL Server 2005 Compact Edition [ENU]

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

Microsoft WSE 3.0 Runtime

Mozilla Firefox (3.6.16)

Mozilla Thunderbird (3.1.7)

MSVCRT

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

NVIDIA Display Control Panel

NVIDIA Drivers

NVIDIA Stereoscopic 3D Driver

PDF Settings CS4

Photoshop Camera Raw

POLYGLOT 7

PowerISO

QuickTime

Realtek Ethernet Controller Driver

Realtek High Definition Audio Driver

Security Update for 2007 Microsoft Office System (KB2288621)

Security Update for 2007 Microsoft Office System (KB2288931)

Security Update for 2007 Microsoft Office System (KB2289158)

Security Update for 2007 Microsoft Office System (KB2344875)

Security Update for 2007 Microsoft Office System (KB2345043)

Security Update for 2007 Microsoft Office System (KB969559)

Security Update for 2007 Microsoft Office System (KB976321)

Security Update for Microsoft Office Access 2007 (KB979440)

Security Update for Microsoft Office Excel 2007 (KB2345035)

Security Update for Microsoft Office InfoPath 2007 (KB979441)

Security Update for Microsoft Office PowerPoint 2007 (KB982158)

Security Update for Microsoft Office PowerPoint Viewer (KB2413381)

Security Update for Microsoft Office Publisher 2007 (KB2284697)

Security Update for Microsoft Office system 2007 (972581)

Security Update for Microsoft Office system 2007 (KB974234)

Security Update for Microsoft Office Visio Viewer 2007 (KB973709)

Security Update for Microsoft Office Word 2007 (KB2344993)

Serif PagePlus Starter Edition

Skype™ 5.3

Smilebox

Spyware Doctor 7.0

StrongDC++ 2.41

Suite Shared Configuration CS4

TeamViewer 6

Ubisoft Game Launcher

Update for 2007 Microsoft Office System (KB967642)

Update for Microsoft Office 2007 Help for Common Features (KB963673)

Update for Microsoft Office Access 2007 Help (KB963663)

Update for Microsoft Office Excel 2007 Help (KB963678)

Update for Microsoft Office Infopath 2007 Help (KB963662)

Update for Microsoft Office Outlook 2007 (KB2412171)

Update for Microsoft Office Outlook 2007 Help (KB963677)

Update for Microsoft Office Powerpoint 2007 Help (KB963669)

Update for Microsoft Office Publisher 2007 Help (KB963667)

Update for Microsoft Office Script Editor Help (KB963671)

Update for Microsoft Office Word 2007 Help (KB963665)

Update for Outlook 2007 Junk Email Filter (KB2508979)

VirtualDub 1.6.15 MPEG2

VLC media player 1.0.5

Winamp

Winamp Detector Plug-in

Windows Live Communications Platform

Windows Live Essentials

Windows Live ID Sign-in Assistant

Windows Live Installer

Windows Live Movie Maker

Windows Live Photo Common

Windows Live Photo Gallery

Windows Live PIMT Platform

Windows Live SOXE

Windows Live SOXE Definitions

Windows Live UX Platform

Windows Live UX Platform Language Pack

Windows Live Writer

Windows Live Writer Resources

WinRAR archiver

Xvid 1.2.2 final uninstall

.

==== Event Viewer Messages From Past Week ========

.

9.4.2011 г. 12:33:49, Error: Microsoft-Windows-Kernel-Processor-Power [6] - Some processor performance power management features have been disabled due to a known firmware problem. Check with the computer manufacturer for updated firmware.

7.4.2011 г. 11:13:50, Error: Microsoft-Windows-Kernel-Processor-Power [6] - Some processor performance power management features have been disabled due to a known firmware problem. Check with the computer manufacturer for updated firmware.

7.4.2011 г. 02:09:51, Error: Microsoft-Windows-Kernel-Processor-Power [6] - Some processor performance power management features have been disabled due to a known firmware problem. Check with the computer manufacturer for updated firmware.

6.4.2011 г. 22:43:25, Error: Microsoft-Windows-Kernel-Processor-Power [6] - Some processor performance power management features have been disabled due to a known firmware problem. Check with the computer manufacturer for updated firmware.

6.4.2011 г. 11:21:43, Error: Microsoft-Windows-Kernel-Processor-Power [6] - Some processor performance power management features have been disabled due to a known firmware problem. Check with the computer manufacturer for updated firmware.

13.4.2011 г. 15:23:59, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the jczcwznnznibzz service to connect.

13.4.2011 г. 15:23:29, Error: Microsoft-Windows-Kernel-Processor-Power [6] - Some processor performance power management features have been disabled due to a known firmware problem. Check with the computer manufacturer for updated firmware.

13.4.2011 г. 14:54:08, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the jczcwznnznibzz service to connect.

13.4.2011 г. 14:53:32, Error: Microsoft-Windows-Kernel-Processor-Power [6] - Some processor performance power management features have been disabled due to a known firmware problem. Check with the computer manufacturer for updated firmware.

13.4.2011 г. 09:45:37, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the jczcwznnznibzz service to connect.

13.4.2011 г. 09:44:59, Error: Microsoft-Windows-Kernel-Processor-Power [6] - Some processor performance power management features have been disabled due to a known firmware problem. Check with the computer manufacturer for updated firmware.

13.4.2011 г. 02:14:06, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the jczcwznnznibzz service to connect.

13.4.2011 г. 02:13:20, Error: Microsoft-Windows-Kernel-Processor-Power [6] - Some processor performance power management features have been disabled due to a known firmware problem. Check with the computer manufacturer for updated firmware.

13.4.2011 г. 01:59:14, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the jczcwznnznibzz service to connect.

13.4.2011 г. 01:58:39, Error: Microsoft-Windows-Kernel-Processor-Power [6] - Some processor performance power management features have been disabled due to a known firmware problem. Check with the computer manufacturer for updated firmware.

13.4.2011 г. 01:39:34, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the jczcwznnznibzz service to connect.

13.4.2011 г. 01:38:37, Error: Microsoft-Windows-Kernel-Processor-Power [6] - Some processor performance power management features have been disabled due to a known firmware problem. Check with the computer manufacturer for updated firmware.

11.4.2011 г. 23:26:12, Error: Microsoft-Windows-Kernel-Processor-Power [6] - Some processor performance power management features have been disabled due to a known firmware problem. Check with the computer manufacturer for updated firmware.

11.4.2011 г. 14:13:19, Error: Microsoft-Windows-Kernel-Processor-Power [6] - Some processor performance power management features have been disabled due to a known firmware problem. Check with the computer manufacturer for updated firmware.

10.4.2011 г. 12:07:03, Error: Microsoft-Windows-Kernel-Processor-Power [6] - Some processor performance power management features have been disabled due to a known firmware problem. Check with the computer manufacturer for updated firmware.

.

==== End Of File ===========================

------------------------------------------------

DDS

.

DDS (Ver_11-03-05.01) - NTFSx86

Run by bonbonenata at 15:27:57,12 on ба 13.04.2011 Ј.

Internet Explorer: 8.0.7600.16385 BrowserJavaVersion: 1.6.0_23

Microsoft Windows 7 Ultimate 6.1.7600.0.1251.359.1033.18.3071.1945 [GMT 3:00]

.

AV: avast! Antivirus *Enabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}

AV: Spyware Doctor with AntiVirus *Enabled/Updated* {2F668A56-D5E0-2DF1-A0AE-CB1284F42AB2}

SP: avast! Antivirus *Enabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: Spyware Doctor *Enabled/Updated* {94076BB2-F3DA-227F-9A1E-F060FF73600F}

.

============== Running Processes ===============

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\nvvsvc.exe

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\nvvsvc.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Program Files\Alwil Software\Avast5\AvastSvc.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe

C:\Program Files\PowerISO\PWRISOVM.EXE

C:\Windows\Vm_sti.exe

C:\Program Files\Adobe\Acrobat 9.0\Acrobat\acrotray.exe

C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE

C:\Program Files\Alwil Software\Avast5\AvastUI.exe

C:\Program Files\Spyware Doctor\pctsTray.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\uTorrent\uTorrent.exe

C:\Users\bonbonenata\AppData\Local\Google\Update\GoogleUpdate.exe

C:\Users\bonbonenata\AppData\Roaming\Smilebox\SmileboxTray.exe

C:\Program Files\Skype\Phone\Skype.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\taskhost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Users\BONBON~1\AppData\Local\Temp\DAT7166.tmp.exe

C:\Program Files\Spyware Doctor\pctsAuxs.exe

C:\Program Files\Spyware Doctor\pctsSvc.exe

C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

C:\Windows\system32\svchost.exe -k imgsvc

C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\system32\SearchProtocolHost.exe

C:\Program Files\Mozilla Firefox\plugin-container.exe

C:\Windows\system32\sppsvc.exe

C:\Windows\System32\svchost.exe -k secsvcs

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Users\bonbonenata\Downloads\dds.scr

C:\Windows\system32\conhost.exe

C:\Windows\system32\wbem\wmiprvse.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = about:blank

uURLSearchHooks: H - No File

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program files\alwil software\avast5\aswWebRepIE.dll

BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll

BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll

BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.2.4204.1700\swg.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: SmartSelect Class: {f4971ee7-daa0-4053-9964-665d8ee6a077} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll

TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll

TB: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program files\alwil software\avast5\aswWebRepIE.dll

TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File

uRun: [uTorrent] "c:\program files\utorrent\uTorrent.exe"

uRun: [AdobeBridge]

uRun: [Google Update] "c:\users\bonbonenata\appdata\local\google\update\GoogleUpdate.exe" /c

uRun: [smileboxTray] "c:\users\bonbonenata\appdata\roaming\smilebox\SmileboxTray.exe"

uRun: [skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized

mRun: [RtHDVCpl] c:\program files\realtek\audio\hda\RtHDVCpl.exe -s

mRun: [PWRISOVM.EXE] c:\program files\poweriso\PWRISOVM.EXE

mRun: [bigDogPath] c:\windows\VM_STI.EXE CANYON CN-WCAM23 PC-Camera

mRun: [AdobeCS4ServiceManager] "c:\program files\common files\adobe\cs4servicemanager\CS4ServiceManager.exe" -launchedbylogin

mRun: [Adobe Acrobat Speed Launcher] "c:\program files\adobe\acrobat 9.0\acrobat\Acrobat_sl.exe"

mRun: [<NO NAME>]

mRun: [Acrobat Assistant 8.0] "c:\program files\adobe\acrobat 9.0\acrobat\Acrotray.exe"

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

mRun: [CanonMyPrinter] c:\program files\canon\myprinter\BJMyPrt.exe /logon

mRun: [avast5] "c:\program files\alwil software\avast5\avastUI.exe" /nogui

mRun: [iSTray] "c:\program files\spyware doctor\pctsTray.exe"

mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime

mRun: [Malwarebytes Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript

mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)

mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)

mPolicies-system: EnableLUA = 0 (0x0)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

mPolicies-system: PromptOnSecureDesktop = 0 (0x0)

IE: Append Link Target to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

IE: Append to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convert Link Target to Adobe PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

IE: Convert link target to existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

IE: Convert to Adobe PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECapture.html

IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

TCP: {4EECD1C4-A6B8-4BD4-A323-F8F309DD4163} = 78.90.25.1

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL

Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - c:\program files\windows live\photo gallery\AlbumDownloadProtocolHandler.dll

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\users\bonbon~1\appdata\roaming\mozilla\firefox\profiles\zaqc5uey.default\

FF - plugin: c:\program files\google\google updater\2.4.1970.7372\npCIDetect14.dll

FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npwachk.dll

FF - plugin: c:\program files\nvidia corporation\3d vision\npnv3dv.dll

FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll

FF - plugin: c:\users\bonbonenata\appdata\local\google\update\1.2.183.39\npGoogleOneClick8.dll

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}

FF - Ext: Last tab close button: [email protected] - %profile%\extensions\[email protected]

FF - Ext: Delicious Bookmarks: {2fa4ed95-0317-4c6a-a74c-5f3e3912c1f9} - %profile%\extensions\{2fa4ed95-0317-4c6a-a74c-5f3e3912c1f9}

FF - Ext: Greasemonkey: {e4a8a97b-f2ed-450b-b12d-ee082ba24781} - %profile%\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}

FF - Ext: avast! WebRep: [email protected] - c:\program files\alwil software\avast5\webrep\FF

.

============= SERVICES / DRIVERS ===============

.

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2010-11-16 218592]

R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2011-4-13 371544]

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2010-11-15 301528]

R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2010-11-15 19544]

R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2010-11-15 53592]

R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast5\AvastSvc.exe [2011-4-13 42184]

R2 sdAuxService;PC Tools Auxiliary Service;c:\program files\spyware doctor\pctsAuxs.exe [2010-11-16 366840]

R2 sdCoreService;PC Tools Security Service;c:\program files\spyware doctor\pctsSvc.exe [2010-11-16 1142224]

R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\nvidia corporation\3d vision\nvSCPAPISvr.exe [2010-1-11 240232]

R2 TeamViewer6;TeamViewer 6;c:\program files\teamviewer\version6\TeamViewer_Service.exe [2011-4-11 2271608]

R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32v.sys [2010-4-21 66664]

R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\drivers\Rt86win7.sys [2010-4-21 187392]

R4 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2010-5-1 38224]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 jczcwznnznibzz;jczcwznnznibzz;c:\users\bonbon~1\appdata\local\temp\DAT7166.tmp.exe [2011-4-13 72704]

S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-14 229888]

S3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\wat\WatAdminSvc.exe [2010-6-2 1343400]

.

=============== Created Last 30 ================

.

2011-04-13 12:23:59 0 ------w- c:\windows\system32\drivers\str.sys

2011-04-13 01:10:48 6792528 ----a-w- c:\progra~2\microsoft\windows defender\definition updates\{9d80e07d-1ae0-46e0-af82-44d1b6f3889c}\mpengine.dll

2011-04-12 22:57:45 371544 ----a-w- c:\windows\system32\drivers\aswSnx.sys

2011-04-10 21:31:07 -------- d-----w- c:\users\bonbon~1\appdata\roaming\TeamViewer

2011-04-10 21:19:11 -------- d-----w- c:\program files\TeamViewer

2011-04-09 09:42:36 -------- d-----w- c:\progra~2\Skype Extras

2011-04-08 00:00:45 -------- d-----w- c:\program files\MSXML 4.0

2011-04-06 23:35:19 -------- d-----w- c:\users\bonbon~1\appdata\local\Collectorz.com

2011-04-06 23:35:06 -------- d-----w- c:\program files\Collectorz.com

2011-04-06 23:14:33 -------- d-----w- c:\users\bonbon~1\appdata\roaming\Serif

2011-04-06 23:08:14 -------- d-----w- c:\program files\common files\MSSoap

2011-04-06 23:07:51 -------- d-----w- c:\program files\Serif

2011-04-06 21:57:27 -------- d-----w- c:\users\bonbon~1\appdata\local\Smilebox

2011-04-06 21:56:44 -------- d-----w- c:\users\bonbon~1\appdata\roaming\Smilebox

2011-04-03 20:43:06 -------- d-----w- c:\users\bonbon~1\appdata\local\{F857C53A-35B2-44E2-B650-8481A6AB34D3}

2011-03-25 14:40:22 22872 ----a-r- c:\windows\system32\AdobePDFUI.dll

2011-03-17 18:29:25 115016 ----a-w- c:\windows\system32\MSINET.ocx

2011-03-17 18:29:25 -------- d-----w- c:\program files\StickyNotes

2011-03-17 18:29:25 -------- d-----w- c:\progra~2\Sticky Notes TB Hider

.

==================== Find3M ====================

.

2011-02-23 14:04:21 40648 ----a-w- c:\windows\avastSS.scr

2011-02-19 05:33:11 802304 ----a-w- c:\windows\system32\FntCache.dll

2011-02-19 05:32:48 1074176 ----a-w- c:\windows\system32\DWrite.dll

2011-02-19 05:32:35 739840 ----a-w- c:\windows\system32\d2d1.dll

2011-02-02 16:11:20 222080 ------w- c:\windows\system32\MpSigStub.exe

.

============= FINISH: 15:31:08,24 ===============

----------------------------------

OTS

OTS logfile created on: 13.4.2011 г. 15:05:06 - Run 1
OTS by OldTimer - Version 3.1.42.0     Folder = C:\Users\bonbonenata\Desktop
 Ultimate Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000402 | Country: България | Language: BGR | Date Format: d.M.yyyy 'г.'
 
3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 75,00% Memory free
6,00 Gb Paging File | 5,00 Gb Available in Paging File | 84,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 100,00 Gb Total Space | 63,00 Gb Free Space | 63,00% Space Free | Partition Type: NTFS
Drive D: | 365,76 Gb Total Space | 248,20 Gb Free Space | 67,86% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: BONBONENATA-PC
Current User Name: bonbonenata
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
 
[Processes - Safe List]
ots.exe -> C:\Users\bonbonenata\Desktop\OTS.exe -> [2011.04.13 01:53:43 | 000,645,632 | ---- | M] (OldTimer Tools)
dat7166.tmp.exe -> C:\Users\bonbonenata\AppData\Local\Temp\DAT7166.tmp.exe -> [2011.04.13 01:29:36 | 000,072,704 | ---- | M] ()
teamviewer_service.exe -> C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe -> [2011.04.01 11:31:39 | 002,271,608 | ---- | M] (TeamViewer GmbH)
avastui.exe -> C:\Program Files\Alwil Software\Avast5\AvastUI.exe -> [2011.02.23 17:04:20 | 003,451,496 | ---- | M] (AVAST Software)
avastsvc.exe -> C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -> [2011.02.23 17:04:19 | 000,042,184 | ---- | M] (AVAST Software)
acrotray.exe -> C:\Program Files\Adobe\Acrobat 9.0\Acrobat\acrotray.exe -> [2010.09.22 18:11:26 | 000,640,440 | ---- | M] (Adobe Systems Inc.)
jucheck.exe -> C:\Program Files\Common Files\Java\Java Update\jucheck.exe -> [2010.05.14 12:44:46 | 000,501,480 | ---- | M] (Sun Microsystems, Inc.)
pctstray.exe -> C:\Program Files\Spyware Doctor\pctsTray.exe -> [2010.05.11 12:51:52 | 001,287,120 | ---- | M] (PC Tools)
explorer.exe -> C:\Windows\explorer.exe -> [2010.04.16 15:55:37 | 002,614,272 | ---- | M] (Microsoft Corporation)
bjmyprt.exe -> C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE -> [2010.03.25 11:50:00 | 002,516,296 | ---- | M] (CANON INC.)
pctssvc.exe -> C:\Program Files\Spyware Doctor\pctsSvc.exe -> [2010.03.15 12:50:36 | 001,142,224 | ---- | M] (PC Tools)
pctsauxs.exe -> C:\Program Files\Spyware Doctor\pctsAuxs.exe -> [2010.03.11 12:09:22 | 000,366,840 | ---- | M] (PC Tools)
nvscpapisvr.exe -> C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -> [2010.01.11 21:00:00 | 000,240,232 | ---- | M] (NVIDIA Corporation)
taskhost.exe -> C:\Windows\System32\taskhost.exe -> [2009.07.14 04:14:42 | 000,049,152 | ---- | M] (Microsoft Corporation)
vm_sti.exe -> C:\Windows\Vm_sti.exe -> [2004.08.20 15:51:44 | 000,040,960 | ---- | M] (VM.)
 
[Modules - Safe List]
ots.exe -> C:\Users\bonbonenata\Desktop\OTS.exe -> [2011.04.13 01:53:43 | 000,645,632 | ---- | M] (OldTimer Tools)
snxhk.dll -> C:\Program Files\Alwil Software\Avast5\snxhk.dll -> [2011.02.23 17:04:17 | 000,197,208 | ---- | M] (AVAST Software)
comctl32.dll -> C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll -> [2010.08.21 08:21:32 | 001,680,896 | ---- | M] (Microsoft Corporation)
sspicli.dll -> C:\Windows\System32\sspicli.dll -> [2009.07.14 04:16:15 | 000,099,840 | ---- | M] (Microsoft Corporation)
sechost.dll -> C:\Windows\System32\sechost.dll -> [2009.07.14 04:16:13 | 000,092,160 | ---- | M] (Microsoft Corporation)
samcli.dll -> C:\Windows\System32\samcli.dll -> [2009.07.14 04:16:13 | 000,050,688 | ---- | M] (Microsoft Corporation)
profapi.dll -> C:\Windows\System32\profapi.dll -> [2009.07.14 04:16:12 | 000,031,744 | ---- | M] (Microsoft Corporation)
netutils.dll -> C:\Windows\System32\netutils.dll -> [2009.07.14 04:16:03 | 000,022,016 | ---- | M] (Microsoft Corporation)
kernelbase.dll -> C:\Windows\System32\KernelBase.dll -> [2009.07.14 04:15:35 | 000,288,256 | ---- | M] (Microsoft Corporation)
dwmapi.dll -> C:\Windows\System32\dwmapi.dll -> [2009.07.14 04:15:13 | 000,067,072 | ---- | M] (Microsoft Corporation)
devobj.dll -> C:\Windows\System32\devobj.dll -> [2009.07.14 04:15:11 | 000,064,512 | ---- | M] (Microsoft Corporation)
cryptbase.dll -> C:\Windows\System32\cryptbase.dll -> [2009.07.14 04:15:07 | 000,036,864 | ---- | M] (Microsoft Corporation)
cfgmgr32.dll -> C:\Windows\System32\cfgmgr32.dll -> [2009.07.14 04:15:02 | 000,145,920 | ---- | M] (Microsoft Corporation)
 
[Win32 Services - Safe List]
(jczcwznnznibzz) jczcwznnznibzz [Auto | Stopped] -> C:\Users\bonbonenata\AppData\Local\Temp\DAT7166.tmp -> [2011.04.13 01:29:36 | 000,000,000 | ---- | M] ()
(TeamViewer6) TeamViewer 6 [Auto | Running] -> C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe -> [2011.04.01 11:31:39 | 002,271,608 | ---- | M] (TeamViewer GmbH)
(avast! Antivirus) avast! Antivirus [Auto | Running] -> C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -> [2011.02.23 17:04:19 | 000,042,184 | ---- | M] (AVAST Software)
(FontCache) Windows Font Cache Service [Auto | Running] -> C:\Windows\System32\FntCache.dll -> [2011.02.19 08:33:11 | 000,802,304 | ---- | M] (Microsoft Corporation)
(WatAdminSvc) Windows Activation Technologies Service [Unknown | Stopped] -> C:\Windows\System32\Wat\WatAdminSvc.exe -> [2010.06.02 00:10:27 | 001,343,400 | ---- | M] (Microsoft Corporation)
(FLEXnet Licensing Service) FLEXnet Licensing Service [On_Demand | Stopped] -> C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -> [2010.04.28 19:14:16 | 000,655,624 | ---- | M] (Acresso Software Inc.)
(sdCoreService) PC Tools Security Service [Auto | Running] -> C:\Program Files\Spyware Doctor\pctsSvc.exe -> [2010.03.15 12:50:36 | 001,142,224 | ---- | M] (PC Tools)
(sdAuxService) PC Tools Auxiliary Service [Auto | Running] -> C:\Program Files\Spyware Doctor\pctsAuxs.exe -> [2010.03.11 12:09:22 | 000,366,840 | ---- | M] (PC Tools)
(Stereo Service) NVIDIA Stereoscopic 3D Driver Service [Auto | Running] -> C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -> [2010.01.11 21:00:00 | 000,240,232 | ---- | M] (NVIDIA Corporation)
(WwanSvc) WWAN AutoConfig [On_Demand | Stopped] -> C:\Windows\System32\wwansvc.dll -> [2009.07.14 04:16:21 | 000,185,856 | ---- | M] (Microsoft Corporation)
(WbioSrvc) Windows Biometric Service [On_Demand | Stopped] -> C:\Windows\System32\wbiosrvc.dll -> [2009.07.14 04:16:17 | 000,151,552 | ---- | M] (Microsoft Corporation)
(Power) Power [Auto | Running] -> C:\Windows\System32\umpo.dll -> [2009.07.14 04:16:17 | 000,119,808 | ---- | M] (Microsoft Corporation)
(Themes) Themes [Auto | Running] -> C:\Windows\System32\themeservice.dll -> [2009.07.14 04:16:16 | 000,037,376 | ---- | M] (Microsoft Corporation)
(sppuinotify) SPP Notification Service [On_Demand | Stopped] -> C:\Windows\System32\sppuinotify.dll -> [2009.07.14 04:16:15 | 000,053,760 | ---- | M] (Microsoft Corporation)
(RpcEptMapper) RPC Endpoint Mapper [Unknown | Running] -> C:\Windows\System32\RpcEpMap.dll -> [2009.07.14 04:16:13 | 000,043,520 | ---- | M] (Microsoft Corporation)
(SensrSvc) Adaptive Brightness [On_Demand | Stopped] -> C:\Windows\System32\sensrsvc.dll -> [2009.07.14 04:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation)
(PeerDistSvc) BranchCache [On_Demand | Stopped] -> C:\Windows\System32\PeerDistSvc.dll -> [2009.07.14 04:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation)
(PNRPsvc) Peer Name Resolution Protocol [On_Demand | Stopped] -> C:\Windows\System32\pnrpsvc.dll -> [2009.07.14 04:16:12 | 000,269,824 | ---- | M] (Microsoft Corporation)
(p2pimsvc) Peer Networking Identity Manager [On_Demand | Stopped] -> C:\Windows\System32\pnrpsvc.dll -> [2009.07.14 04:16:12 | 000,269,824 | ---- | M] (Microsoft Corporation)
(HomeGroupProvider) HomeGroup Provider [On_Demand | Stopped] -> C:\Windows\System32\provsvc.dll -> [2009.07.14 04:16:12 | 000,165,376 | ---- | M] (Microsoft Corporation)
(PNRPAutoReg) PNRP Machine Name Publication Service [On_Demand | Stopped] -> C:\Windows\System32\pnrpauto.dll -> [2009.07.14 04:16:12 | 000,020,480 | ---- | M] (Microsoft Corporation)
(WinDefend) Windows Defender [Auto | Running] -> C:\Program Files\Windows Defender\MpSvc.dll -> [2009.07.14 04:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation)
(HomeGroupListener) HomeGroup Listener [On_Demand | Stopped] -> C:\Windows\System32\ListSvc.dll -> [2009.07.14 04:15:36 | 000,194,560 | ---- | M] (Microsoft Corporation)
(Dhcp) DHCP Client [Auto | Running] -> C:\Windows\System32\dhcpcore.dll -> [2009.07.14 04:15:11 | 000,253,440 | ---- | M] (Microsoft Corporation)
(defragsvc) Disk Defragmenter [On_Demand | Stopped] -> C:\Windows\System32\defragsvc.dll -> [2009.07.14 04:15:10 | 000,218,624 | ---- | M] (Microsoft Corporation)
(BDESVC) BitLocker Drive Encryption Service [Unknown | Stopped] -> C:\Windows\System32\bdesvc.dll -> [2009.07.14 04:14:59 | 000,076,800 | ---- | M] (Microsoft Corporation)
(AxInstSV) ActiveX Installer (AxInstSV) [On_Demand | Stopped] -> C:\Windows\System32\AxInstSv.dll -> [2009.07.14 04:14:58 | 000,088,064 | ---- | M] (Microsoft Corporation)
(AppIDSvc) Application Identity [On_Demand | Stopped] -> C:\Windows\System32\appidsvc.dll -> [2009.07.14 04:14:53 | 000,027,648 | ---- | M] (Microsoft Corporation)
(sppsvc) Software Protection [Auto | Stopped] -> C:\Windows\System32\sppsvc.exe -> [2009.07.14 04:14:29 | 003,179,520 | ---- | M] (Microsoft Corporation)
 
[Driver Services - Safe List]
(aswSnx) aswSnx [File_System | System | Running] -> C:\Windows\System32\drivers\aswSnx.sys -> [2011.02.23 16:56:55 | 000,371,544 | ---- | M] (AVAST Software)
(aswSP) aswSP [Kernel | System | Running] -> C:\Windows\System32\drivers\aswSP.sys -> [2011.02.23 16:56:45 | 000,301,528 | ---- | M] (AVAST Software)
(aswTdi) avast! Network Shield Support [Kernel | System | Running] -> C:\Windows\System32\drivers\aswTdi.sys -> [2011.02.23 16:55:49 | 000,049,240 | ---- | M] (AVAST Software)
(aswRdr) aswRdr [Kernel | System | Running] -> C:\Windows\System32\drivers\aswRdr.sys -> [2011.02.23 16:55:10 | 000,025,432 | ---- | M] (AVAST Software)
(aswMonFlt) aswMonFlt [File_System | Auto | Running] -> C:\Windows\System32\drivers\aswMonFlt.sys -> [2011.02.23 16:55:03 | 000,053,592 | ---- | M] (AVAST Software)
(aswFsBlk) aswFsBlk [File_System | Auto | Running] -> C:\Windows\System32\drivers\aswFsBlk.sys -> [2011.02.23 16:54:55 | 000,019,544 | ---- | M] (AVAST Software)
(PCTCore) PCTools KDS [Kernel | Boot | Running] -> C:\Windows\system32\drivers\PCTCore.sys -> [2010.03.29 11:06:14 | 000,218,592 | ---- | M] (PC Tools)
(nvlddmkm) nvlddmkm [Kernel | On_Demand | Running] -> C:\Windows\System32\drivers\nvlddmkm.sys -> [2010.01.12 07:03:33 | 011,586,280 | ---- | M] (NVIDIA Corporation)
(KSecPkg) KSecPkg [Kernel | Boot | Running] -> C:\Windows\System32\Drivers\ksecpkg.sys -> [2009.12.11 10:44:02 | 000,133,720 | ---- | M] (Microsoft Corporation)
(NVHDA) Service for NVIDIA High Definition Audio Driver [Kernel | On_Demand | Running] -> C:\Windows\System32\drivers\nvhda32v.sys -> [2009.11.12 07:14:28 | 000,066,664 | ---- | M] (NVIDIA Corporation)
(SCDEmu) SCDEmu [Kernel | System | Running] -> C:\Windows\System32\drivers\scdemu.sys -> [2009.07.27 05:43:18 | 000,058,908 | ---- | M] (PowerISO Computing, Inc.)
(hwpolicy) Hardware Policy Driver [Kernel | Boot | Running] -> C:\Windows\System32\drivers\hwpolicy.sys -> [2009.07.14 04:20:36 | 000,013,904 | ---- | M] (Microsoft Corporation)
(FsDepends) File System Dependency Minifilter [File_System | On_Demand | Stopped] -> C:\Windows\System32\drivers\fsdepends.sys -> [2009.07.14 04:20:28 | 000,046,160 | ---- | M] (Microsoft Corporation)
(vmbus) Virtual Machine Bus [Kernel | On_Demand | Stopped] -> C:\Windows\system32\DRIVERS\vmbus.sys -> [2009.07.14 04:19:10 | 000,175,824 | ---- | M] (Microsoft Corporation)
(vhdmp) vhdmp [Kernel | On_Demand | Stopped] -> C:\Windows\system32\DRIVERS\vhdmp.sys -> [2009.07.14 04:19:10 | 000,159,824 | ---- | M] (Microsoft Corporation)
(storflt) Disk Virtual Machine Bus Acceleration Filter Driver [Kernel | Boot | Running] -> C:\Windows\system32\DRIVERS\vmstorfl.sys -> [2009.07.14 04:19:10 | 000,040,896 | ---- | M] (Microsoft Corporation)
(vdrvroot) Microsoft Virtual Drive Enumerator Driver [Kernel | Boot | Running] -> C:\Windows\system32\DRIVERS\vdrvroot.sys -> [2009.07.14 04:19:10 | 000,032,832 | ---- | M] (Microsoft Corporation)
(storvsc) storvsc [Kernel | On_Demand | Stopped] -> C:\Windows\system32\DRIVERS\storvsc.sys -> [2009.07.14 04:19:10 | 000,028,224 | ---- | M] (Microsoft Corporation)
(WIMMount) WIMMount [File_System | On_Demand | Stopped] -> C:\Windows\System32\drivers\wimmount.sys -> [2009.07.14 04:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation)
(rdyboost) ReadyBoost [Kernel | Boot | Running] -> C:\Windows\System32\drivers\rdyboost.sys -> [2009.07.14 04:19:04 | 000,173,648 | ---- | M] (Microsoft Corporation)
(pcw) Performance Counters for Windows Driver [Kernel | Boot | Running] -> C:\Windows\System32\drivers\pcw.sys -> [2009.07.14 04:19:04 | 000,043,088 | ---- | M] (Microsoft Corporation)
(CNG) CNG [Kernel | Boot | Running] -> C:\Windows\System32\Drivers\cng.sys -> [2009.07.14 04:17:54 | 000,369,568 | ---- | M] (Microsoft Corporation)
(rdpbus) Remote Desktop Device Redirector Bus Driver [Kernel | On_Demand | Running] -> C:\Windows\System32\drivers\rdpbus.sys -> [2009.07.14 03:02:41 | 000,018,944 | ---- | M] (Microsoft Corporation)
(RDPREFMP) Reflector Display Driver used to gain access to graphics data [Kernel | System | Running] -> C:\Windows\System32\drivers\RDPREFMP.sys -> [2009.07.14 03:01:41 | 000,007,168 | ---- | M] (Microsoft Corporation)
(RasAgileVpn) WAN Miniport (IKEv2) [Kernel | On_Demand | Running] -> C:\Windows\System32\drivers\agilevpn.sys -> [2009.07.14 02:55:00 | 000,049,152 | ---- | M] (Microsoft Corporation)
(WfpLwf) WFP Lightweight Filter [Kernel | System | Running] -> C:\Windows\System32\drivers\wfplwf.sys -> [2009.07.14 02:53:51 | 000,009,728 | ---- | M] (Microsoft Corporation)
(NdisCap) NDIS Capture LightWeight Filter [Kernel | On_Demand | Stopped] -> C:\Windows\System32\drivers\ndiscap.sys -> [2009.07.14 02:52:44 | 000,027,136 | ---- | M] (Microsoft Corporation)
(vwifibus) Virtual WiFi Bus Driver [Kernel | On_Demand | Stopped] -> C:\Windows\System32\drivers\vwifibus.sys -> [2009.07.14 02:52:02 | 000,019,968 | ---- | M] (Microsoft Corporation)
(1394ohci) 1394 OHCI Compliant Host Controller [Kernel | On_Demand | Stopped] -> C:\Windows\system32\DRIVERS\1394ohci.sys -> [2009.07.14 02:52:00 | 000,163,328 | ---- | M] (Microsoft Corporation)
(UmPass) Microsoft UMPass Driver [Kernel | On_Demand | Stopped] -> C:\Windows\system32\DRIVERS\umpass.sys -> [2009.07.14 02:51:35 | 000,008,192 | ---- | M] (Microsoft Corporation)
(WinUsb) WinUsb [Kernel | On_Demand | Stopped] -> C:\Windows\System32\drivers\winusb.sys -> [2009.07.14 02:51:11 | 000,034,944 | ---- | M] (Microsoft Corporation)
(mshidkmdf) Pass-through HID to KMDF Filter Driver [Kernel | On_Demand | Stopped] -> C:\Windows\System32\drivers\mshidkmdf.sys -> [2009.07.14 02:51:08 | 000,004,096 | ---- | M] (Microsoft Corporation)
(MTConfig) Microsoft Input Configuration Driver [Kernel | On_Demand | Stopped] -> C:\Windows\system32\DRIVERS\MTConfig.sys -> [2009.07.14 02:46:55 | 000,012,288 | ---- | M] (Microsoft Corporation)
(CompositeBus) Composite Bus Enumerator Driver [Kernel | On_Demand | Running] -> C:\Windows\System32\drivers\CompositeBus.sys -> [2009.07.14 02:45:26 | 000,031,232 | ---- | M] (Microsoft Corporation)
(scfilter) Smart card PnP Class Filter Driver [Kernel | Unknown | Stopped] -> C:\Windows\System32\drivers\scfilter.sys -> [2009.07.14 02:33:50 | 000,026,624 | ---- | M] (Microsoft Corporation)
(s3cap) s3cap [Kernel | On_Demand | Stopped] -> C:\Windows\system32\DRIVERS\vms3cap.sys -> [2009.07.14 02:28:47 | 000,005,632 | ---- | M] (Microsoft Corporation)
(VMBusHID) VMBusHID [Kernel | On_Demand | Stopped] -> C:\Windows\system32\DRIVERS\VMBusHID.sys -> [2009.07.14 02:28:45 | 000,017,920 | ---- | M] (Microsoft Corporation)
(discache) System Attribute Cache [Kernel | System | Running] -> C:\Windows\System32\drivers\discache.sys -> [2009.07.14 02:24:05 | 000,032,256 | ---- | M] (Microsoft Corporation)
(AcpiPmi) ACPI Power Meter Driver [Kernel | On_Demand | Stopped] -> C:\Windows\system32\DRIVERS\acpipmi.sys -> [2009.07.14 02:16:36 | 000,009,728 | ---- | M] (Microsoft Corporation)
(AmdPPM) AMD Processor Driver [Kernel | On_Demand | Stopped] -> C:\Windows\system32\DRIVERS\amdppm.sys -> [2009.07.14 02:11:04 | 000,052,736 | ---- | M] (Microsoft Corporation)
(s616unic) Sony Ericsson Device 616 USB Ethernet Emulation SEMC616 (WDM) [Kernel | On_Demand | Stopped] -> C:\Windows\System32\drivers\s616unic.sys -> [2007.04.03 13:59:42 | 000,099,080 | ---- | M] (MCCI Corporation)
(s616obex) Sony Ericsson Device 616 USB WMC OBEX Interface [Kernel | On_Demand | Stopped] -> C:\Windows\System32\drivers\s616obex.sys -> [2007.04.03 13:59:42 | 000,098,568 | ---- | M] (MCCI Corporation)
(s616nd5) Sony Ericsson Device 616 USB Ethernet Emulation SEMC616 (NDIS) [Kernel | On_Demand | Stopped] -> C:\Windows\System32\drivers\s616nd5.sys -> [2007.04.03 13:59:42 | 000,023,176 | ---- | M] (MCCI Corporation)
(s616mgmt) Sony Ericsson Device 616 USB WMC Device Management Drivers (WDM) [Kernel | On_Demand | Stopped] -> C:\Windows\System32\drivers\s616mgmt.sys -> [2007.04.03 13:59:40 | 000,100,360 | ---- | M] (MCCI Corporation)
(s616mdm) Sony Ericsson Device 616 USB WMC Modem Driver [Kernel | On_Demand | Stopped] -> C:\Windows\System32\drivers\s616mdm.sys -> [2007.04.03 13:59:38 | 000,108,680 | ---- | M] (MCCI Corporation)
(s616mdfl) Sony Ericsson Device 616 USB WMC Modem Filter [Kernel | On_Demand | Stopped] -> C:\Windows\System32\drivers\s616mdfl.sys -> [2007.04.03 13:59:36 | 000,015,112 | ---- | M] (MCCI Corporation)
(s616bus) Sony Ericsson Device 616 driver (WDM) [Kernel | On_Demand | Stopped] -> C:\Windows\System32\drivers\s616bus.sys -> [2007.04.03 13:59:30 | 000,083,208 | ---- | M] (MCCI Corporation)
(ZSMC301b) CANYON CN-WCAM23 PC-Camera [Kernel | On_Demand | Stopped] -> C:\Windows\System32\drivers\usbVM31b.sys -> [2004.08.20 15:51:40 | 000,090,532 | ---- | M] (VM)
 
[Registry - Safe List]
< Internet Explorer Settings [HKEY_LOCAL_MACHINE\] > -> -> 
< Internet Explorer Settings [HKEY_USERS\.DEFAULT\] > -> -> 
HKEY_USERS\.DEFAULT\: "ProxyEnable" -> 0 -> 
< Internet Explorer Settings [HKEY_USERS\S-1-5-18\] > -> -> 
HKEY_USERS\S-1-5-18\: "ProxyEnable" -> 0 -> 
< Internet Explorer Settings [HKEY_USERS\S-1-5-19\] > -> -> 
< Internet Explorer Settings [HKEY_USERS\S-1-5-20\] > -> -> 
< Internet Explorer Settings [HKEY_USERS\S-1-5-21-1981947668-4224288995-4032495909-1000\] > -> -> 
HKEY_USERS\S-1-5-21-1981947668-4224288995-4032495909-1000\: Main\\"Start Page" -> about:blank -> 
HKEY_USERS\S-1-5-21-1981947668-4224288995-4032495909-1000\: Main\\"Start Page Redirect Cache" -> http://www.msn.com/ -> 
HKEY_USERS\S-1-5-21-1981947668-4224288995-4032495909-1000\: Main\\"Start Page Redirect Cache AcceptLangs" -> bg -> 
HKEY_USERS\S-1-5-21-1981947668-4224288995-4032495909-1000\: Main\\"Start Page Redirect Cache_TIMESTAMP" -> 34 CF CB 5F 63 E2 CA 01  [binary data] -> 
HKEY_USERS\S-1-5-21-1981947668-4224288995-4032495909-1000\: URLSearchHooks\\"{472734EA-242A-422b-ADF8-83D1E48CC825}" [HKLM] -> Reg Error: Key error. [Reg Error: Key error.] -> File not found
HKEY_USERS\S-1-5-21-1981947668-4224288995-4032495909-1000\: "ProxyEnable" -> 0 -> 
< FireFox Settings [Prefs.js] > -> C:\Users\bonbonenata\AppData\Roaming\Mozilla\FireFox\Profiles\zaqc5uey.default\prefs.js -> 
extensions.enabledItems -> [email protected]:0.3.3 ->
extensions.enabledItems -> {2fa4ed95-0317-4c6a-a74c-5f3e3912c1f9}:2.1.106 ->
extensions.enabledItems -> {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23 ->
extensions.enabledItems -> {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.9.1 ->
extensions.enabledItems -> [email protected]:20110101 ->
< FireFox Extensions [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla
HKLM\software\mozilla\Firefox\Extensions ->  -> 
HKLM\software\mozilla\Firefox\Extensions\\[email protected] -> C:\Program Files\Alwil Software\Avast5\WebRep\FF [C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST5\WEBREP\FF] -> [2011.04.13 01:57:45 | 000,000,000 | ---D | M]
HKLM\software\mozilla\Mozilla Firefox 3.6.16\extensions ->  -> 
HKLM\software\mozilla\Mozilla Firefox 3.6.16\extensions\\Components -> C:\Program Files\Mozilla Firefox\components [C:\PROGRAM FILES\MOZILLA FIREFOX\COMPONENTS] -> [2011.04.10 04:42:10 | 000,000,000 | ---D | M]
HKLM\software\mozilla\Mozilla Firefox 3.6.16\extensions\\Plugins -> C:\Program Files\Mozilla Firefox\plugins [C:\PROGRAM FILES\MOZILLA FIREFOX\PLUGINS] -> [2011.03.25 17:39:48 | 000,000,000 | ---D | M]
HKLM\software\mozilla\Mozilla Thunderbird 3.1.7\extensions ->  -> 
HKLM\software\mozilla\Mozilla Thunderbird 3.1.7\extensions\\Components -> C:\Program Files\Mozilla Thunderbird\components [C:\PROGRAM FILES\MOZILLA THUNDERBIRD\COMPONENTS] -> [2011.02.23 01:19:04 | 000,000,000 | ---D | M]
HKLM\software\mozilla\Mozilla Thunderbird 3.1.7\extensions\\Plugins -> C:\PROGRAM FILES\MOZILLA THUNDERBIRD\PLUGINS -> 
HKLM\software\mozilla\Thunderbird\Extensions ->  -> 
< FireFox Extensions [User Folders] > -> 
  -> C:\Users\bonbonenata\AppData\Roaming\Mozilla\Extensions -> [2010.12.07 18:54:07 | 000,000,000 | ---D | M]
No name found   -> C:\Users\bonbonenata\AppData\Roaming\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6} -> [2010.12.07 18:54:07 | 000,000,000 | ---D | M]
  -> C:\Users\bonbonenata\AppData\Roaming\Mozilla\Firefox\Profiles\zaqc5uey.default\extensions -> [2011.04.13 02:00:22 | 000,000,000 | ---D | M]
"Delicious Bookmarks"   -> C:\Users\bonbonenata\AppData\Roaming\Mozilla\Firefox\Profiles\zaqc5uey.default\extensions\{2fa4ed95-0317-4c6a-a74c-5f3e3912c1f9} -> [2010.09.01 13:54:32 | 000,000,000 | ---D | M]
Greasemonkey   -> C:\Users\bonbonenata\AppData\Roaming\Mozilla\Firefox\Profiles\zaqc5uey.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781} -> [2011.02.17 03:23:03 | 000,000,000 | ---D | M]
  -> C:\Users\bonbonenata\AppData\Roaming\Mozilla\Firefox\Profiles\zaqc5uey.default\extensions\[email protected] -> [2010.08.25 00:18:00 | 000,000,000 | ---D | M]
< FireFox Extensions [Program Folders] > -> 
  -> C:\Program Files\Mozilla Firefox\extensions -> [2011.04.13 02:00:22 | 000,000,000 | ---D | M]
No name found   -> C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1} -> [2010.04.24 17:29:22 | 000,000,000 | ---D | M]
Java Console   -> C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} -> [2010.12.24 02:44:15 | 000,000,000 | ---D | M]
avast! WebRep -> C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST5\WEBREP\FF -> [2011.04.13 01:57:45 | 000,000,000 | ---D | M]
Last tab close button -> C:\USERS\BONBONENATA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZAQC5UEY.DEFAULT\EXTENSIONS\[email protected] -> [2010.08.25 00:18:00 | 000,000,000 | ---D | M]
< HOSTS File > ([2010.04.23 23:42:38 | 000,000,902 | R--- | M] - 28 lines) -> C:\Windows\System32\drivers\etc\hosts -> 
First 25 entries...
Reset Hosts
< BHO's [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ -> 
{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} [HKLM] -> C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll [avast! WebRep] -> [2011.02.23 17:04:16 | 000,814,160 | ---- | M] ()
{AE7CD045-E861-484f-8273-0445EE161910} [HKLM] -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [Adobe PDF Conversion Toolbar Helper] -> [2010.09.22 18:09:18 | 000,349,640 | ---- | M] (Adobe Systems Incorporated)
{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} [HKLM] -> C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll [Google Toolbar Notifier BHO] -> [2010.11.16 01:27:41 | 000,761,840 | ---- | M] (Google Inc.)
{F4971EE7-DAA0-4053-9964-665D8EE6A077} [HKLM] -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [SmartSelect Class] -> [2010.09.22 18:09:18 | 000,349,640 | ---- | M] (Adobe Systems Incorporated)
< Internet Explorer ToolBars [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar -> 
"{47833539-D0C5-4125-9FA8-0819E2EAAC93}" [HKLM] -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [Adobe PDF] -> [2010.09.22 18:09:18 | 000,349,640 | ---- | M] (Adobe Systems Incorporated)
"{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}" [HKLM] -> C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll [avast! WebRep] -> [2011.02.23 17:04:16 | 000,814,160 | ---- | M] ()
< Internet Explorer ToolBars [HKEY_USERS\S-1-5-21-1981947668-4224288995-4032495909-1000\] > -> HKEY_USERS\S-1-5-21-1981947668-4224288995-4032495909-1000\Software\Microsoft\Internet Explorer\Toolbar\ -> 
WebBrowser\\"{47833539-D0C5-4125-9FA8-0819E2EAAC93}" [HKLM] -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [Adobe PDF] -> [2010.09.22 18:09:18 | 000,349,640 | ---- | M] (Adobe Systems Incorporated)
WebBrowser\\"{D4027C7F-154A-4066-A1AD-4243D8127440}" [HKLM] -> Reg Error: Key error. [Reg Error: Key error.] -> File not found
< Run [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> 
"" ->  [] -> File not found
"Acrobat Assistant 8.0" -> C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe ["C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe"] -> [2010.09.22 18:11:26 | 000,640,440 | ---- | M] (Adobe Systems Inc.)
"Adobe Acrobat Speed Launcher" -> C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe ["C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe"] -> [2011.01.31 01:36:36 | 000,038,840 | ---- | M] (Adobe Systems Incorporated)
"AdobeCS4ServiceManager" -> C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe ["C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin] -> [2008.08.14 07:58:34 | 000,611,712 | ---- | M] (Adobe Systems Incorporated)
"avast5" -> C:\Program Files\Alwil Software\Avast5\avastUI.exe ["C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui] -> [2011.02.23 17:04:20 | 003,451,496 | ---- | M] (AVAST Software)
"BigDogPath" -> C:\Windows\VM_STI.EXE [C:\Windows\VM_STI.EXE CANYON CN-WCAM23 PC-Camera] -> [2004.08.20 15:51:44 | 000,040,960 | ---- | M] (VM.)
"CanonMyPrinter" -> C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon] -> [2010.03.25 11:50:00 | 002,516,296 | ---- | M] (CANON INC.)
"ISTray" -> C:\Program Files\Spyware Doctor\pctsTray.exe ["C:\Program Files\Spyware Doctor\pctsTray.exe"] -> [2010.05.11 12:51:52 | 001,287,120 | ---- | M] (PC Tools)
"Malwarebytes Anti-Malware (reboot)" -> C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe ["C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript] -> [2010.12.20 18:08:46 | 000,963,976 | ---- | M] (Malwarebytes Corporation)
"PWRISOVM.EXE" -> C:\Program Files\PowerISO\PWRISOVM.EXE [C:\Program Files\PowerISO\PWRISOVM.EXE] -> [2009.07.27 05:37:50 | 000,180,224 | ---- | M] (PowerISO Computing, Inc.)
< RunOnce [HKEY_USERS\S-1-5-19\] > -> HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce -> 
"mctadmin" -> C:\Windows\System32\mctadmin.exe [C:\Windows\System32\mctadmin.exe] -> [2009.07.14 04:14:23 | 000,093,696 | ---- | M] (Microsoft Corporation)
< RunOnce [HKEY_USERS\S-1-5-20\] > -> HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce -> 
"mctadmin" -> C:\Windows\System32\mctadmin.exe [C:\Windows\System32\mctadmin.exe] -> [2009.07.14 04:14:23 | 000,093,696 | ---- | M] (Microsoft Corporation)
< Run [HKEY_USERS\S-1-5-21-1981947668-4224288995-4032495909-1000\] > -> HKEY_USERS\S-1-5-21-1981947668-4224288995-4032495909-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> 
"AdobeBridge" ->  [] -> File not found
"SmileboxTray" -> C:\Users\bonbonenata\AppData\Roaming\Smilebox\SmileboxTray.exe ["C:\Users\bonbonenata\AppData\Roaming\Smilebox\SmileboxTray.exe"] -> [2011.03.25 03:16:06 | 000,313,160 | ---- | M] (Smilebox, Inc.)
"uTorrent" -> C:\Program Files\uTorrent\uTorrent.exe ["C:\Program Files\uTorrent\uTorrent.exe"] -> [2010.12.24 18:32:17 | 000,395,640 | ---- | M] (BitTorrent, Inc.)
< CurrentVersion Policy Settings - System [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System
\\"ConsentPromptBehaviorAdmin" ->  [0] -> File not found
\\"ConsentPromptBehaviorUser" ->  [3] -> File not found
\\"EnableLUA" ->  [0] -> File not found
\\"PromptOnSecureDesktop" ->  [0] -> File not found
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats
< Internet Explorer Menu Extensions [HKEY_USERS\S-1-5-21-1981947668-4224288995-4032495909-1000\] > -> HKEY_USERS\S-1-5-21-1981947668-4224288995-4032495909-1000\Software\Microsoft\Internet Explorer\MenuExt\ -> 
Append Link Target to Existing PDF -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html] -> [2010.09.22 18:09:18 | 000,349,640 | ---- | M] (Adobe Systems Incorporated)
Append to Existing PDF -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html] -> [2010.09.22 18:09:18 | 000,349,640 | ---- | M] (Adobe Systems Incorporated)
Convert Link Target to Adobe PDF -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html] -> [2010.09.22 18:09:18 | 000,349,640 | ---- | M] (Adobe Systems Incorporated)
Convert link target to existing PDF -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html] -> [2010.09.22 18:09:18 | 000,349,640 | ---- | M] (Adobe Systems Incorporated)
Convert to Adobe PDF -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html] -> [2010.09.22 18:09:18 | 000,349,640 | ---- | M] (Adobe Systems Incorporated)
< Internet Explorer Plugins [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Plugins\ -> 
< Default Prefix > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix
"" -> http://
< Trusted Sites Domains [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 0 domain(s) found. -> 
< Trusted Sites Ranges [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. -> 
< Trusted Sites Domains [HKEY_USERS\.DEFAULT\] > -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> 
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 0 domain(s) found. -> 
< Trusted Sites Ranges [HKEY_USERS\.DEFAULT\] > -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> 
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. -> 
< Trusted Sites Domains [HKEY_USERS\S-1-5-18\] > -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> 
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 0 domain(s) found. -> 
< Trusted Sites Ranges [HKEY_USERS\S-1-5-18\] > -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> 
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. -> 
< Trusted Sites Domains [HKEY_USERS\S-1-5-19\] > -> HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> 
HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 0 domain(s) found. -> 
< Trusted Sites Ranges [HKEY_USERS\S-1-5-19\] > -> HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> 
HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. -> 
< Trusted Sites Domains [HKEY_USERS\S-1-5-20\] > -> HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> 
HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 0 domain(s) found. -> 
< Trusted Sites Ranges [HKEY_USERS\S-1-5-20\] > -> HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> 
HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. -> 
< Trusted Sites Domains [HKEY_USERS\S-1-5-21-1981947668-4224288995-4032495909-1000\] > -> HKEY_USERS\S-1-5-21-1981947668-4224288995-4032495909-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> 
HKEY_USERS\S-1-5-21-1981947668-4224288995-4032495909-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 0 domain(s) found. -> 
< Trusted Sites Ranges [HKEY_USERS\S-1-5-21-1981947668-4224288995-4032495909-1000\] > -> HKEY_USERS\S-1-5-21-1981947668-4224288995-4032495909-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> 
HKEY_USERS\S-1-5-21-1981947668-4224288995-4032495909-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. -> 
< Downloaded Program Files > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\ -> 
{8AD9C840-044E-11D1-B3E9-00805F499D93} [HKLM] -> http://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab [Java Plug-in 1.6.0_23] -> 
{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} [HKLM] -> http://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab [Java Plug-in 1.6.0_23] -> 
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} [HKLM] -> http://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab [Java Plug-in 1.6.0_23] -> 
{D27CDB6E-AE6D-11CF-96B8-444553540000} [HKLM] -> http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab [Shockwave Flash Object] -> 
< Name Servers [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Adapters\ -> 
{4EECD1C4-A6B8-4BD4-A323-F8F309DD4163}\\NameServer -> 78.90.25.1   (Realtek PCIe FE Family Controller) -> 
< Winlogon settings [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon -> 
*Shell* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell -> 
explorer.exe -> C:\Windows\explorer.exe -> [2010.04.16 15:55:37 | 002,614,272 | ---- | M] (Microsoft Corporation)
*MultiFile Done* -> -> 
*VMApplet* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet -> 
SystemPropertiesPerformance.exe -> C:\Windows\System32\SystemPropertiesPerformance.exe -> [2009.07.14 04:14:42 | 000,081,920 | ---- | M] (Microsoft Corporation)
/pagefile ->  -> File not found
*MultiFile Done* -> -> 
< SSODL [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad -> 
"{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" [HKLM] -> Reg Error: Key error. [WebCheck] -> File not found
< LSA Security Packages [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\\Security Packages -> 
*LSA Security Packages* -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\\Security Packages -> 
pku2u -> C:\Windows\System32\pku2u.dll -> [2009.07.14 04:16:12 | 000,186,880 | ---- | M] (Microsoft Corporation)
livessp -> C:\Windows\System32\livessp.dll -> [2010.09.21 15:03:14 | 000,208,768 | ---- | M] (Microsoft Corp.)
*MultiFile Done* -> -> 
< SafeBoot AlternateShell [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot -> 
< CDROM Autorun Setting [HKEY_LOCAL_MACHINE]> -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom ->
"AutoRun" -> 1 -> 
"DisplayName" -> CD-ROM Driver -> 
"ImagePath" ->  [system32\DRIVERS\cdrom.sys] -> File not found
< Drives with AutoRun files > ->  -> 
C:\autoexec.bat [REM Dummy file for NTVDM | ] -> C:\autoexec.bat [ NTFS ] -> [2009.06.11 00:42:20 | 000,000,024 | ---- | M] ()
< MountPoints2 [HKEY_CURRENT_USER] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2 -> 
\F
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F\shell
\F\shell\\"" ->  [AutoRun] -> File not found
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F\shell\AutoRun\command
\F\shell\AutoRun\command\\"" ->  [F:\Setup.exe] -> File not found
\G
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\G\shell
\G\shell\\"" ->  [AutoRun] -> File not found
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\G\shell\AutoRun\command
\G\shell\AutoRun\command\\"" ->  [G:\Autorun.exe] -> File not found
\H
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\H\shell
\H\shell\\"" ->  [AutoRun] -> File not found
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\H\shell\AutoRun\command
\H\shell\AutoRun\command\\"" ->  [H:\RunGame.exe] -> File not found
\I
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\I\shell
\I\shell\\"" ->  [AutoRun] -> File not found
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\I\shell\AutoRun\command
\I\shell\AutoRun\command\\"" ->  [I:\RunGame.exe] -> File not found
\J
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\J\shell
\J\shell\\"" ->  [AutoRun] -> File not found
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\J\shell\AutoRun\command
\J\shell\AutoRun\command\\"" ->  [J:\RunGame.exe] -> File not found
< Registry Shell Spawning - Select to Repair > -> HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command -> 
comfile [open] -> "%1" %* -> 
exefile [open] -> "%1" %* -> 
< File Associations - Select to Repair > -> HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>\ -> 
.com [@ = comfile] -> "%1" %* -> 
.exe [@ = exefile] -> "%1" %* -> 
 
 
[Files/Folders - Created Within 30 Days]
 aswSnx.sys -> C:\Windows\System32\drivers\aswSnx.sys -> [2011.04.13 01:57:45 | 000,371,544 | ---- | C] (AVAST Software)
 OTS.exe -> C:\Users\bonbonenata\Desktop\OTS.exe -> [2011.04.13 01:53:38 | 000,645,632 | ---- | C] (OldTimer Tools)
 TeamViewer -> C:\Users\bonbonenata\AppData\Roaming\TeamViewer -> [2011.04.11 00:31:07 | 000,000,000 | ---D | C]
 TeamViewer -> C:\Program Files\TeamViewer -> [2011.04.11 00:19:11 | 000,000,000 | ---D | C]
 Skype Extras -> C:\ProgramData\Skype Extras -> [2011.04.09 12:42:36 | 000,000,000 | ---D | C]
 Skype -> C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype -> [2011.04.09 12:39:01 | 000,000,000 | ---D | C]
 Skype -> C:\Program Files\Common Files\Skype -> [2011.04.09 12:39:01 | 000,000,000 | ---D | C]
 MSXML 4.0 -> C:\Program Files\MSXML 4.0 -> [2011.04.08 03:00:45 | 000,000,000 | ---D | C]
 Collectorz.com -> C:\Users\bonbonenata\AppData\Local\Collectorz.com -> [2011.04.07 02:35:19 | 000,000,000 | ---D | C]
 Collectorz.com -> C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Collectorz.com -> [2011.04.07 02:35:11 | 000,000,000 | ---D | C]
 Book Collector -> C:\Users\bonbonenata\Documents\Book Collector -> [2011.04.07 02:35:08 | 000,000,000 | ---D | C]
 Collectorz.com -> C:\Program Files\Collectorz.com -> [2011.04.07 02:35:06 | 000,000,000 | ---D | C]
 Serif -> C:\Users\bonbonenata\AppData\Roaming\Serif -> [2011.04.07 02:14:33 | 000,000,000 | ---D | C]
 MSSoap -> C:\Program Files\Common Files\MSSoap -> [2011.04.07 02:08:14 | 000,000,000 | ---D | C]
 Serif Applications -> C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Serif Applications -> [2011.04.07 02:08:07 | 000,000,000 | ---D | C]
 Serif -> C:\Program Files\Serif -> [2011.04.07 02:07:51 | 000,000,000 | ---D | C]
 Smilebox -> C:\Users\bonbonenata\AppData\Local\Smilebox -> [2011.04.07 00:57:27 | 000,000,000 | ---D | C]
 My Smilebox Creations -> C:\Users\bonbonenata\Documents\My Smilebox Creations -> [2011.04.07 00:57:22 | 000,000,000 | ---D | C]
 Smilebox -> C:\Users\bonbonenata\AppData\Roaming\Smilebox -> [2011.04.07 00:56:44 | 000,000,000 | ---D | C]
 {F857C53A-35B2-44E2-B650-8481A6AB34D3} -> C:\Users\bonbonenata\AppData\Local\{F857C53A-35B2-44E2-B650-8481A6AB34D3} -> [2011.04.03 23:43:06 | 000,000,000 | ---D | C]
 easter-ideas -> C:\Users\bonbonenata\Desktop\easter-ideas -> [2011.03.31 02:26:19 | 000,000,000 | ---D | C]
 AdobePDFUI.dll -> C:\Windows\System32\AdobePDFUI.dll -> [2011.03.25 17:40:22 | 000,022,872 | R--- | C] (Adobe Systems Inc.)
 MSINET.ocx -> C:\Windows\System32\MSINET.ocx -> [2011.03.17 21:29:25 | 000,115,016 | ---- | C] (Microsoft Corporation)
 StickyNotes -> C:\Program Files\StickyNotes -> [2011.03.17 21:29:25 | 000,000,000 | ---D | C]
 Sticky Notes TB Hider -> C:\ProgramData\Sticky Notes TB Hider -> [2011.03.17 21:29:25 | 000,000,000 | ---D | C]
 
[Files/Folders - Modified Within 30 Days]
 avast-url-mal.jpg -> C:\Users\bonbonenata\Desktop\avast-url-mal.jpg -> [2011.04.13 15:04:05 | 000,054,445 | ---- | M] ()
 7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 -> C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 -> [2011.04.13 15:01:27 | 000,014,416 | -H-- | M] ()
 7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 -> C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 -> [2011.04.13 15:01:27 | 000,014,416 | -H-- | M] ()
 Google Software Updater.job -> C:\Windows\tasks\Google Software Updater.job -> [2011.04.13 14:56:35 | 000,000,868 | ---- | M] ()
 bootstat.dat -> C:\Windows\bootstat.dat -> [2011.04.13 14:53:39 | 000,067,584 | --S- | M] ()
 hiberfil.sys -> C:\hiberfil.sys -> [2011.04.13 14:53:34 | 2415,370,240 | -HS- | M] ()
 str.sys -> C:\Windows\System32\drivers\str.sys -> [2011.04.13 09:45:37 | 000,000,000 | ---- | M] ()
 GoogleUpdateTaskUserS-1-5-21-1981947668-4224288995-4032495909-1000UA.job -> C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1981947668-4224288995-4032495909-1000UA.job -> [2011.04.13 09:23:00 | 000,001,090 | ---- | M] ()
 config.nt -> C:\Windows\System32\config.nt -> [2011.04.13 01:57:45 | 000,002,577 | ---- | M] ()
 OTS.exe -> C:\Users\bonbonenata\Desktop\OTS.exe -> [2011.04.13 01:53:43 | 000,645,632 | ---- | M] (OldTimer Tools)
 GoogleUpdateTaskUserS-1-5-21-1981947668-4224288995-4032495909-1000Core.job -> C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1981947668-4224288995-4032495909-1000Core.job -> [2011.04.12 12:23:00 | 000,001,038 | ---- | M] ()
 TeamViewer 6.lnk -> C:\Users\Public\Desktop\TeamViewer 6.lnk -> [2011.04.11 00:19:17 | 000,001,139 | ---- | M] ()
 perfh009.dat -> C:\Windows\System32\perfh009.dat -> [2011.04.10 18:10:53 | 000,615,810 | ---- | M] ()
 perfc009.dat -> C:\Windows\System32\perfc009.dat -> [2011.04.10 18:10:53 | 000,106,190 | ---- | M] ()
 Skype.lnk -> C:\Users\Public\Desktop\Skype.lnk -> [2011.04.09 12:39:01 | 000,002,503 | ---- | M] ()
 FNTCACHE.DAT -> C:\Windows\System32\FNTCACHE.DAT -> [2011.04.07 11:14:15 | 002,361,872 | ---- | M] ()
 Smilebox.lnk -> C:\Users\bonbonenata\Desktop\Smilebox.lnk -> [2011.04.07 00:56:44 | 000,001,873 | ---- | M] ()
 Smilebox.lnk -> C:\Users\bonbonenata\Application Data\Microsoft\Internet Explorer\Quick Launch\Smilebox.lnk -> [2011.04.07 00:56:44 | 000,001,853 | ---- | M] ()
 SmileboxInstaller.exe -> C:\Users\bonbonenata\Desktop\SmileboxInstaller.exe -> [2011.04.07 00:56:24 | 000,580,840 | ---- | M] ()
 every-day-of-the-month.jpg -> C:\Users\bonbonenata\Desktop\every-day-of-the-month.jpg -> [2011.04.07 00:05:35 | 000,060,344 | ---- | M] ()
 22 C:\Users\bonbonenata\AppData\Local\Temp\*.tmp files -> C:\Users\bonbonenata\AppData\Local\Temp\*.tmp -> 
 
[Files - No Company Name]
 avast-url-mal.jpg -> C:\Users\bonbonenata\Desktop\avast-url-mal.jpg -> [2011.04.13 15:04:05 | 000,054,445 | ---- | C] ()
 str.sys -> C:\Windows\System32\drivers\str.sys -> [2011.04.13 09:45:37 | 000,000,000 | ---- | C] ()
 TeamViewer 6.lnk -> C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 6.lnk -> [2011.04.11 00:19:17 | 000,001,151 | ---- | C] ()
 TeamViewer 6.lnk -> C:\Users\Public\Desktop\TeamViewer 6.lnk -> [2011.04.11 00:19:17 | 000,001,139 | ---- | C] ()
 Skype.lnk -> C:\Users\Public\Desktop\Skype.lnk -> [2011.04.09 12:39:01 | 000,002,503 | ---- | C] ()
 Serif PagePlus Starter Edition.lnk -> C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Serif PagePlus Starter Edition.lnk -> [2011.04.07 02:08:17 | 000,002,499 | ---- | C] ()
 Smilebox.lnk -> C:\Users\bonbonenata\Desktop\Smilebox.lnk -> [2011.04.07 00:56:44 | 000,001,873 | ---- | C] ()
 Smilebox.lnk -> C:\Users\bonbonenata\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Smilebox.lnk -> [2011.04.07 00:56:44 | 000,001,859 | ---- | C] ()
 Smilebox.lnk -> C:\Users\bonbonenata\Application Data\Microsoft\Internet Explorer\Quick Launch\Smilebox.lnk -> [2011.04.07 00:56:44 | 000,001,853 | ---- | C] ()
 SmileboxInstaller.exe -> C:\Users\bonbonenata\Desktop\SmileboxInstaller.exe -> [2011.04.07 00:56:23 | 000,580,840 | ---- | C] ()
 every-day-of-the-month.jpg -> C:\Users\bonbonenata\Desktop\every-day-of-the-month.jpg -> [2011.04.07 00:05:34 | 000,060,344 | ---- | C] ()
 ODBC.INI -> C:\Windows\ODBC.INI -> [2011.03.04 13:24:15 | 000,000,028 | ---- | C] ()
 nsreg.dat -> C:\Windows\nsreg.dat -> [2010.12.07 18:54:07 | 000,000,000 | ---- | C] ()
 ezsidmv.dat -> C:\Windows\System32\ezsidmv.dat -> [2010.09.06 13:01:27 | 000,000,056 | -H-- | C] ()
 ff_vfw.dll -> C:\Windows\System32\ff_vfw.dll -> [2010.08.01 03:08:50 | 000,108,032 | ---- | C] ()
 xvidcore.dll -> C:\Windows\System32\xvidcore.dll -> [2010.08.01 03:02:36 | 000,819,200 | ---- | C] ()
 xvidvfw.dll -> C:\Windows\System32\xvidvfw.dll -> [2010.08.01 03:02:35 | 000,180,224 | ---- | C] ()
 MS Office 2007 Pro Plus & Expression Web.INI -> C:\Windows\MS Office 2007 Pro Plus & Expression Web.INI -> [2010.04.24 15:28:52 | 000,000,032 | ---- | C] ()
 RtNicProp32.dll -> C:\Windows\System32\RtNicProp32.dll -> [2010.04.21 23:26:58 | 000,073,728 | ---- | C] ()
 APOMngr.DLL -> C:\Windows\System32\APOMngr.DLL -> [2010.04.21 23:26:34 | 000,146,432 | ---- | C] ()
 CmdRtr.DLL -> C:\Windows\System32\CmdRtr.DLL -> [2010.04.21 23:26:34 | 000,072,704 | ---- | C] ()
 bootstat.dat -> C:\Windows\bootstat.dat -> [2009.07.14 07:57:37 | 000,067,584 | --S- | C] ()
 FNTCACHE.DAT -> C:\Windows\System32\FNTCACHE.DAT -> [2009.07.14 07:33:53 | 002,361,872 | ---- | C] ()
 perfh009.dat -> C:\Windows\System32\perfh009.dat -> [2009.07.14 05:05:48 | 000,615,810 | ---- | C] ()
 perfi009.dat -> C:\Windows\System32\perfi009.dat -> [2009.07.14 05:05:48 | 000,291,294 | ---- | C] ()
 perfc009.dat -> C:\Windows\System32\perfc009.dat -> [2009.07.14 05:05:48 | 000,106,190 | ---- | C] ()
 perfd009.dat -> C:\Windows\System32\perfd009.dat -> [2009.07.14 05:05:48 | 000,031,548 | ---- | C] ()
 NOISE.DAT -> C:\Windows\System32\NOISE.DAT -> [2009.07.14 05:05:05 | 000,000,741 | ---- | C] ()
 dssec.dat -> C:\Windows\System32\dssec.dat -> [2009.07.14 05:04:11 | 000,215,943 | ---- | C] ()
 PrintBrmUi.exe -> C:\Windows\System32\PrintBrmUi.exe -> [2009.07.14 03:19:49 | 000,066,048 | ---- | C] ()
 mib.bin -> C:\Windows\mib.bin -> [2009.07.14 02:55:01 | 000,043,131 | ---- | C] ()
 BthpanContextHandler.dll -> C:\Windows\System32\BthpanContextHandler.dll -> [2009.07.14 02:51:43 | 000,073,728 | ---- | C] ()
 BWContextHandler.dll -> C:\Windows\System32\BWContextHandler.dll -> [2009.07.14 02:42:10 | 000,064,000 | ---- | C] ()
 mlang.dat -> C:\Windows\System32\mlang.dat -> [2009.06.11 00:26:10 | 000,673,088 | ---- | C] ()
 amcap.exe -> C:\Windows\amcap.exe -> [2004.08.20 15:51:40 | 000,049,152 | ---- | C] ()
[Custom Scans]
< netsvcs >
< drivers32 >
< %SYSTEMDRIVE%\*.* >
 autoexec.bat -> C:\autoexec.bat -> [2009.06.11 00:42:20 | 000,000,024 | ---- | M] ()
 bootmgr -> C:\bootmgr -> [2009.07.14 04:38:58 | 000,383,562 | RHS- | M] ()
 BOOTSECT.BAK -> C:\BOOTSECT.BAK -> [2010.04.22 10:08:01 | 000,008,192 | RHS- | M] ()
 config.sys -> C:\config.sys -> [2009.06.11 00:42:20 | 000,000,010 | ---- | M] ()
 grldr -> C:\grldr -> [2010.04.21 23:48:41 | 000,203,372 | RHS- | M] ()
 hiberfil.sys -> C:\hiberfil.sys -> [2011.04.13 14:53:34 | 2415,370,240 | -HS- | M] ()
 pagefile.sys -> C:\pagefile.sys -> [2011.04.13 14:53:36 | 3220,496,384 | -HS- | M] ()
 Paradise City (D) - Shortcut.lnk -> C:\Paradise City (D) - Shortcut.lnk -> [2010.12.19 20:54:14 | 000,000,479 | ---- | M] ()
 win7.ld -> C:\win7.ld -> [2010.04.21 23:48:42 | 000,000,012 | RHS- | M] ()
< %systemroot%\*. /mp /s >
< %systemroot%\system32\*.dll /lockedfiles >
< %systemroot%\Tasks\*.job /lockedfiles >
< %systemroot%\System32\config\*.sav >
< %systemroot%\system32\drivers\*.sys /180 >
 aswFsBlk.sys -> C:\Windows\System32\drivers\aswFsBlk.sys -> [2011.02.23 16:54:55 | 000,019,544 | ---- | M] (AVAST Software)
 aswMonFlt.sys -> C:\Windows\System32\drivers\aswMonFlt.sys -> [2011.02.23 16:55:03 | 000,053,592 | ---- | M] (AVAST Software)
 aswRdr.sys -> C:\Windows\System32\drivers\aswRdr.sys -> [2011.02.23 16:55:10 | 000,025,432 | ---- | M] (AVAST Software)
 aswSnx.sys -> C:\Windows\System32\drivers\aswSnx.sys -> [2011.02.23 16:56:55 | 000,371,544 | ---- | M] (AVAST Software)
 aswSP.sys -> C:\Windows\System32\drivers\aswSP.sys -> [2011.02.23 16:56:45 | 000,301,528 | ---- | M] (AVAST Software)
 aswTdi.sys -> C:\Windows\System32\drivers\aswTdi.sys -> [2011.02.23 16:55:49 | 000,049,240 | ---- | M] (AVAST Software)
 dxgkrnl.sys -> C:\Windows\System32\drivers\dxgkrnl.sys -> [2010.11.02 07:46:34 | 000,728,448 | ---- | M] (Microsoft Corporation)
 dxgmms1.sys -> C:\Windows\System32\drivers\dxgmms1.sys -> [2011.02.03 08:45:07 | 000,219,008 | ---- | M] (Microsoft Corporation)
 mbam.sys -> C:\Windows\System32\drivers\mbam.sys -> [2010.12.20 18:08:40 | 000,020,952 | ---- | M] (Malwarebytes Corporation)
 mbamswissarmy.sys -> C:\Windows\System32\drivers\mbamswissarmy.sys -> [2010.12.20 18:09:00 | 000,038,224 | ---- | M] (Malwarebytes Corporation)
 str.sys -> C:\Windows\System32\drivers\str.sys -> [2011.04.13 09:45:37 | 000,000,000 | ---- | M] ()
 
[Alternate Data Streams]
@Alternate Data Stream - 169 bytes -> C:\ProgramData\TEMP:DFC5A2B2
< End of report >

Между другото използвам FTP програма, за да се свързвам за два сайта. Сканирах и тях - няма зарази (с AVG Online Virus Scanner и Virus Total).

Използвам:

Windows 7

Avasr 6 - обновено е всичко

Malwarebytes - 1.50.1.1100

Редактирано 23 април 201115 г. от nologo (преглед на промените)

13 април 201115 г.

На 11.04.2011 имаше проблеми с avast. Те бяха отстранени със следващия ъпдейт, необходимо е ръчно обновяване. По принцип нямам нищо против OTS, но ще е добре да не предприемате самостоятелно каквито и да е опити за самолечение.

Сега ще може ли малко логове, както следва:

Стъпка 1

Следвайте следната инструкция за работа с Security Check:

Изтеглете Security Check (автор: screen317) от тук или от тук и го запишете на десктопа.
Кликнете два пъти върху SecurityCheck.exe и следвайте инструкциите.
Когато програмата завърши работата си, ще се отвори един текстов документ: checkup.txt.
Копирайте съдържанието с Копирай (Copy) на checkup.txt и с Постави (Paste) го поставете в следващия си коментар.

Стъпка 1

Следвайте инструкцията за работа с OTL:

Изтеглете OTL.exe или OTL.scr го запазете на десктопа.
Стартирайте файла с двукратен клик на мишката.
Направете следните настройки:

Под с Copy/ Paste въведете изцяло следната текстова информация (само това, което е поставено в карето):

netsvcs
drivers32 /all
%SYSTEMDRIVE%\*.*
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\*.scr
%systemroot%\*._sy
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.wt
%systemroot%\system32\*.ruy
%systemroot%\system32\*.jpg
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%APPDATA%\Update\*.*
%APPDATA%\Microsoft\*.*
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%PROGRAMFILES%\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\user32.dll /md5
%systemroot%\system32\ws2_32.dll /md5
%systemroot%\system32\ws2help.dll /md5
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs

Натиснете маркираният в синьо бутон: .
Като приключи проверката, ще се създадат два файла - OTL.Txt и Extras.Txt. Прикачете тези два файла в следващия си коментар (погледнете опцията "прикачени файлове", когато публикувате мнение).

13 април 201115 г.

Автор

Обновила съм Avast, казва ми, че няма нужда от обновяване.

Results of screen317's Security Check version 0.99.10
Windows 7 (UAC is disabled!)
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
avast! Free Antivirus
WMI entry may not exist for antivirus; attempting automatic update.
```````````````````````````````
Anti-malware/Other Utilities Check:
Malwarebytes' Anti-Malware
CCleaner
Java 6 Update 23
Out of date Java installed!
Adobe Flash Player 10.2.153.1
Mozilla Firefox (3.6.16) Firefox Out of Date!
Mozilla Thunderbird (3.1.7) Thunderbird Out of Date!
````````````````````````````````
Process Check:
objlist.exe by Laurent
Alwil Software Avast5 AvastSvc.exe
Alwil Software Avast5 AvastUI.exe
``````````End of Log````````````

OTL.Txt

Extras.Txt

13 април 201115 г.

Стартирайте пак OTL и с Copy/ Paste под колонката Custom Scans/Fixes въведете скриптовия текст от текстовото поле по-долу, като не забравяте да копирате скрипта 1 към 1, както и двете точки преди първия ред на скрипта!

:otl
PRC - C:\Users\bonbonenata\AppData\Local\Temp\DAT7166.tmp.exe ()
SRV - (jczcwznnznibzz) -- C:\Users\bonbonenata\AppData\Local\Temp\DAT7166.tmp ()
IE - HKU\S-1-5-21-1981947668-4224288995-4032495909-1000\..\URLSearchHook: {472734EA-242A-422b-ADF8-83D1E48CC825} - Reg Error: Key error. File not found
O4 - HKLM..\Run: [] File not found
O4 - HKU\S-1-5-21-1981947668-4224288995-4032495909-1000..\Run: [AdobeBridge] File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\Setup.exe
O33 - MountPoints2\G\Shell - "" = AutoRun
O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\Autorun.exe
O33 - MountPoints2\H\Shell - "" = AutoRun
O33 - MountPoints2\H\Shell\AutoRun\command - "" = H:\RunGame.exe
O33 - MountPoints2\I\Shell - "" = AutoRun
O33 - MountPoints2\I\Shell\AutoRun\command - "" = I:\RunGame.exe
O33 - MountPoints2\J\Shell - "" = AutoRun
O33 - MountPoints2\J\Shell\AutoRun\command - "" = J:\RunGame.exe
@Alternate Data Stream - 170 bytes -> C:\ProgramData\TEMP:DFC5A2B2

:files
C:\Users\bonbonenata\AppData\Local\Temp\DAT7166.tmp.exe 
C:\Users\bonbonenata\AppData\Local\Temp\DAT7166.tmp
C:\Windows\System32\drivers\str.sys
C:\Windows\System32\drivers\ulgmkm.sys
autorun.inf /alldrives
autorun.exe /alldrives
recycler /alldrives
ipconfig /flushdns /c

:commands
[purity]
[resethosts]
[Reboot]

След като въведете скрипта от цитата по-горе натиснете бутона, маркиран в червено: Run Fix

Ще се създаде лог файл. Публикувайте съдържанието му с Copy/Paste в следващия си коментар.

14 април 201115 г.

Автор

Днес като стартирах компютъра Avast ми даде друго съобщение, според което има друга заплаха. Премахна го и ми предложи да рестартира. При рестарт се появи същия онзи черен екран и започна да сканира, дадох да изтрие всичко. Като се заради всичко отворих Avast - не откри никаква заплаха, видях само че в логовете има записан файл със зараза Win32:Downloader-GNF [Trj] и е успешно изтрит, a в карантината е DAT7166.tmp.exe. Пуснал и Malwarebytes - нищо не намира. Изглежда сякаш всичко е наред. Все пак направих това, което е написал nologo, компютърът се рестартира, но не намерих някъде записан нов лог файл?

Редактирано 14 април 201115 г. от Bonbonenata (преглед на промените)

14 април 201115 г.

Това с лог файла не е проблем. Стартирайте отново OTL и не правете никакви настройки:

Под с Copy/ Paste въведете изцяло следната текстова информация (само това, което е поставено в карето):

netsvcs
drivers32 /all
%SYSTEMDRIVE%\*.*
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\system32\proquota.exe /md5

Натиснете маркираният в синьо бутон: .
Като приключи проверката, ще се създадат два файла - OTL.Txt и Extras.Txt. Прикачете тези два файла в следващия си коментар (погледнете опцията "прикачени файлове", когато публикувате мнение).

16 април 201115 г.

Автор

Благодаря много, но мисля, че вече всичко е ок. Никакво съобщение не е излизало от два дни :nono: За всеки случай обаче прикачвам OTL.txt, a Еxtras изобщо няма.

OTL.Txt

Редактирано 16 април 201115 г. от Bonbonenata (преглед на промените)

16 април 201115 г.

Много добре.

А сега ще може ли да направите ZIP файл за следната папка:

C:\_OTL\MovedFiles

След като направите ZIP архива, пишете колко мегабайта е.

21 април 201115 г.

Автор

Отговарям сега, защото не мислех, че ще има други отговори. Ок. 3-4 KB е папката.

22 април 201115 г.

Никъде не съм написал, че сме приключили. Щеше да е добре да видите какво пише в тази тема:

Следвате инструкциите на HJT Тeam, докато не ви бъде съобщено, че системата е чиста. Това, че симптомите са изчезнали не означава, че проблемът е решен.

Следва:

Стъпка 1

Сега качете ZIP файла, който направихте за следната папка: C:\_OTL\MovedFiles

на skatafka.com. Просто го посочете (Разглеждане) и натиснете бутона Качи. След това дайте линк към файла в следващия си коментар.

Стъпка 2

Следвайте следната инструкция за работа с RootRepeal:

Изтеглете ZIP архив на RootRepeal, ето два миръра:geekstogo или psikotick
Разархивирайте RootRepeal.zip на вашия десктоп, стартирайте RootRepeal.exe и направете следните настройки:
Кликнете на таба Report в долната част на прозореца.
Кликнете на бутона Scan
Сложете отметки пред следното:

Drivers

FilesProcessesSSDTStealth ObjectsHidden ServicesShadow SSDT

Кликнете на бутона OK
На следващия диалогов прозорец, сложете отметки преди всички дялове (C:\ , D:\ ....)
Кликнете на OK, за да започне процеса на сканиране

Забележка: Процеса на сканиране може да отнеме време. Моля, не стартирайте никакви програми, докато програмата сканира.

Когато сканирането завърши успешно ще се появи бутона Save Report
Кликнете върху Save Report и запишете лог файла на вашия десктоп, с име RootRepeal.txt
Отворете File, след което Exit, за да затворите програмата.
Копирайте и поставете съдържанието на RootRepeal.txt в следващия си коментар.

23 април 201115 г.

Автор

Когато отворя сайта skatafka.com Avast го блокира. А на вторто като го стартриам ми излиза: 14:24:23: FOPS - DeviceIoControl Error! Error Code = 0xc0000024 Extended Info (0x000000e4) 14:24:23: DeviceIoControl Error! Error Code = 0x1e7 14:24:23: FOPS - DeviceIoControl Error! Error Code = 0xc0000024 Extended Info (0x000000e4) Дори да го пренабрегна и да го пусна да сканира, ми излиза съобщение Could not initialize driver!

23 април 201115 г.

Това не е проблем. Сега следва почистване:

Стартирайте OTL още веднъж и натиснете бутона CleanUp.

Публикувано изображение

При дeинсталацията на OTL ще бъдат почистени инструменти и файлове, които използвахме в темата (може да оставите Malwarebytes' Anti-Malware Free за периодично сканиране). Програмата не пречи на другите приложения за сигурност. Ще последва рестарт на Windows.

Аз не виждам повече активни зарази, затова считам проблемът за решен. Пожелавам ви весели празници и успех!

1 септември 201412 г.

Когато си пусна Google chrome ми изписва зараза:Url:Mal с няква буболечка картинка и пише , че процесът е C:/program files(86)....../chrome.exe някой може ли да ми помогне да го махна

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

1 септември 201412 г.

Когато си пусна Google chrome ми изписва зараза:Url:Mal с няква буболечка картинка и пише , че процесът е C:/program files(86)....../chrome.exe някой може ли да ми помогне да го махна

Здравейте..! Създайте си нова тема в подраздела и следвайте стъпките на Системата ми е инфектирана - Какво да правя сега?

Поздрави..!

Добре дошли!

URL:Mal [решен]

Featured Replies

Архивирана тема

Разглеждащи това в момента 0

Дарение

Бюлетин

Профил

Навигация

Търсене

Конфигуриране на push известия в браузъра

Chrome (Android)

Chrome (Desktop)

Safari (iOS 16.4+)

Safari (macOS)

Edge (Android)

Edge (Desktop)

Firefox (Android)

Firefox (Desktop)