Не съм спирал програмата. Излезе ми съобщението , че се изисква специална процедура по дезинфекция. И аз тогава дадох Yes. Сега пак ще сваля програмата. Предполагам пак същите опции да задам.

Да, свалете я отново и направете същите настройки.

След края на проверката обаче, преди да рестартирате сложете отмекта пред Neutralize all бутона и след това сложете отметка пред Apply to all И изберете Disinfect.

Чак тогава се съгласете с това да рестартирате.

Значи нещо не ми става ясно. Пуснах програмката да сканира отново. Пак ми излезе същото съобщение. Изисква да избера една от двете опции , Yes perform и No, do not perform за тази специална процедура по дезинфекция, която изисква reboot. Сканирането спира докато не избера едно от двете. Избрах No и сега продължи да сканира, но се появат бързи съобщения, че нещо не е дезинфектирано. Към момента още сканира...

Значи нещо не ми става ясно. Пуснах програмката да сканира отново. Пак ми излезе същото съобщение. Изисква да избера една от двете опции , Yes perform и No, do not perform за тази специална процедура по дезинфекция, която изисква reboot. Сканирането спира докато не избера едно от двете. Избрах No и сега продължи да сканира, но се появат бързи съобщения, че нещо не е дезинфектирано. Към момента още сканира...

Да точно така, изчакайте да завърши цялата проверка и после натиснете Neutralize all както на първата снимка от предишния ми пост.

След това изберете Apply to all => Desinfect както е при втората снимка.

PS: Ако Desinfect менюто е неактивно, не натискайте Delete бутона...ами ще пробваме нещо друго.

Ето как изглежда програмата след края на сканирането. Не виждам бутона Neutralize all.

Интересно...явно са променили версията на програмата. Както и да е. Успяла е поне да почисти паметта. Пробвайте сега да стартирате TDSSKiller-a и вижте дали ще успеем да я излъжем.

Отново не става.

Отново не става.

Ок, пробвайте следното => отворете C:\Windows\system32\drivers => изберете с десен бутон файла volsnap.sys => Properties => Security => Advanced => Owner => Edit => Изберете Вашия Админ акаунт => И потвърдете с OK.

След това се върнете в отдела Security => Изберете акаунта си => Edit => И сложете отметка пред Full Control.

Сега вече пробвайте да изтриете файла и след това копирайте чистия файл от папката C:\Windows\System32\DriverStore\FileRepository\volume.inf_x86_neutral_29364d30156a24ca\volsnap.sys

и го копирайте на мястото на изтрития файл в C:\Windows\system32\drivers

Как мога да разбера кой е моя Админ акаунт, тъй като ми излазт следните два: Administrator (WIN-7O14P6VM5QV\Administrator) Administrators (WIN-7O14P6VM5QV\Administrators)

Как мога да разбера кой е моя Админ акаунт, тъй като ми излазт следните два: Administrator (WIN-7O14P6VM5QV\Administrator)

Administrators (WIN-7O14P6VM5QV\Administrators)

Написали сте ми два едни и същи...ами...пробвайте с един от двата да видим какво ще стане.

Дава съобщение, че файлът не може да бъде изтрит, защото е отворен в системата...

B-boy[styLe] извинявай че се намесвам, всъщност цитираното от Мордехай е администраторския акаунт и групата администратори

Ето колко е кофти като няма инсталационен диск наблизо.

Ок нов опит:

Моля копирайте файла C:\Windows\System32\DriverStore\FileRepository\volume.inf_x86_neutral_29364d30156a24ca\volsnap.sys в свободната директория на дял C:\

• Сега изтеглете BlitzBlank от emsisoft и го запазете на вашия десктоп.

• Стартирайте Blitzblank.exe.

• Натиснете OK на предупредителното съобщение

• Натиснете Script и с копи/пейст въведете следната информация.

  DeleteFile:
  C:\Windows\system32\drivers\volsnap.sys
  MoveFile:
  C:\volsnap.sys C:\Windows\system32\drivers\volsnap.sys
  

• (Уверете се, че файла C:\volsnap.sys съществува преди да продължите) !!!

• Натиснете Execute Now. Компютъра ще се рестартира в опит за заместването на файловете. Ако успеем ще е супер...ако нещо се обърка ще имаме небуутваща система и ще се наложи да използваме друг LiveCD (спасителен диск).

• Когато процедурата завърши ще се създаде лог файл в C:\ => Публикувайте го в следващия си коментар.

BlitzBlank 1.0.0.32 File/Registry Modification Engine native application MoveFileOnReboot: sourceFile = "\??\c:\windows\system32\drivers\volsnap.sys", destinationFile = "(null)", replaceWithDummy = 0 MoveFileOnReboot: sourceFile = "\??\c:\volsnap.sys", destinationFile = "\??\c:\windows\system32\drivers\volsnap.sys", replaceWithDummy = 0

Пробвайте сега отново да стартирате TDSSKiller-a...голяма борба падна с вашия компютър...досега на всяка друга система поне половината методи трябваше да са проработили...

За жалост не се стартира, два пъти пробвах. ДАли да не я махна и пак да я кача?

За жалост не се стартира, два пъти пробвах. ДАли да не я махна и пак да я кача?

Пробвайте да изпълните процедурите от този пост - искам да видя какво е положението с файла.

Мерси !

OTL logfile created on: 6/2/2011 21:29:16 - Run 5

OTL by OldTimer - Version 3.2.23.0 Folder = C:\Users\Public\Desktop

Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.7600.16385)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1023.55 Mb Total Physical Memory | 527.97 Mb Available Physical Memory | 51.58% Memory free

2.00 Gb Paging File | 1.25 Gb Available in Paging File | 62.50% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 126.94 Gb Total Space | 87.00 Gb Free Space | 68.54% Space Free | Partition Type: NTFS

Drive D: | 171.05 Gb Total Space | 163.57 Gb Free Space | 95.62% Space Free | Partition Type: NTFS

Computer Name: WIN-7O14P6VM5QV | User Name: Administrator | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 90 Days

========== Processes (SafeList) ==========

PRC - [2011/05/31 22:20:04 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Users\Public\Desktop\OTL.exe

PRC - [2011/05/21 21:41:28 | 000,307,376 | ---- | M] (Google Inc.) -- C:\Program Files\Google\Google Toolbar\GoogleToolbarUser_32.exe

PRC - [2011/04/29 09:04:10 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe

PRC - [2011/04/16 09:56:20 | 000,399,736 | ---- | M] (BitTorrent, Inc.) -- C:\Program Files\uTorrent\uTorrent.exe

PRC - [2011/03/19 23:38:43 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

PRC - [2011/03/19 23:38:43 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe

PRC - [2010/01/15 08:11:00 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

PRC - [2009/10/31 08:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe

PRC - [2009/09/24 02:45:50 | 001,287,176 | ---- | M] (Panda Security) -- C:\Program Files\Panda USB Vaccine\USBVaccine.exe

PRC - [2009/07/14 04:14:42 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe

PRC - [2009/07/14 04:14:15 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe

PRC - [2009/04/23 16:51:38 | 000,691,656 | ---- | M] (DT Soft Ltd) -- C:\Program Files\DAEMON Tools Lite\daemon.exe

PRC - [2009/04/14 15:43:42 | 000,604,704 | ---- | M] (Realtek Semiconductor Corp.) -- C:\Windows\SOUNDMAN.EXE

PRC - [2009/04/05 09:38:10 | 000,602,624 | ---- | M] () -- C:\Program Files\Everything\Everything.exe

========== Modules (SafeList) ==========

MOD - [2011/05/31 22:20:04 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Users\Public\Desktop\OTL.exe

MOD - [2010/08/21 08:21:32 | 001,680,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll

========== Win32 Services (SafeList) ==========

SRV - File not found [Auto | Stopped] -- -- (wscsvc)

SRV - [2011/04/29 09:04:10 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2011/03/19 23:38:43 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2011/03/17 11:44:22 | 000,008,192 | ---- | M] () [Auto | Stopped] -- C:\Windows\System32\srvany.exe -- (KMService)

SRV - [2010/03/25 20:25:22 | 030,969,208 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Microsoft Office\Office14\GROOVE.EXE -- (Microsoft SharePoint Workspace Audit Service)

========== Driver Services (SafeList) ==========

DRV - [2020/02/02 03:02:02 | 000,048,256 | ---- | M] (JMicron Technology Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\jraid.sys -- (JRAID)

DRV - [2011/05/29 09:11:30 | 000,039,984 | ---- | M] (Malwarebytes Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\mbamswissarmy.sys -- (MBAMSwissArmy)

DRV - [2011/03/19 23:38:43 | 000,137,656 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)

DRV - [2011/03/19 23:38:43 | 000,061,960 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)

DRV - [2011/03/17 11:23:29 | 000,721,904 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\Drivers\sptd.sys -- (sptd)

DRV - [2009/09/27 16:12:22 | 009,509,832 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)

DRV - [2009/07/14 04:19:10 | 000,175,824 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\vmbus.sys -- (vmbus)

DRV - [2009/07/14 04:19:10 | 000,040,896 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\vmstorfl.sys -- (storflt)

DRV - [2009/07/14 04:19:10 | 000,028,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\storvsc.sys -- (storvsc)

DRV - [2009/07/14 02:28:47 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\vms3cap.sys -- (s3cap)

DRV - [2009/07/14 02:28:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\VMBusHID.sys -- (VMBusHID)

DRV - [2009/07/14 01:02:52 | 000,347,264 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvm62x32.sys -- (NVENETFD)

DRV - [2009/06/19 03:45:02 | 004,172,832 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\RTKVAC.SYS -- (ALCXWDM) Service for Realtek AC97 Audio (WDM)

DRV - [2009/05/11 20:12:49 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)

DRV - [2009/02/24 19:42:14 | 000,116,736 | ---- | M] (MagicISO, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\mcdbus.sys -- (mcdbus)

DRV - [2009/02/02 22:47:00 | 000,229,400 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\iaNvStor.sys -- (iaNvStor)

DRV - [2008/05/07 02:06:00 | 000,011,520 | ---- | M] (Western Digital Technologies) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\wdcsam.sys -- (WDC_SAM)

DRV - [2006/04/01 17:31:40 | 000,010,240 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvmpu401.sys -- (nvmpu401) Service for NVIDIA® nForce

DRV - [2004/08/13 19:56:20 | 000,005,810 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ASACPI.sys -- (MTsensor)

DRV - [2003/06/10 14:25:30 | 000,156,672 | ---- | M] (Promise Technology, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\fasttx2k.sys -- (fasttx2k)

========== Standard Registry (All) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\System32\blank.htm

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm

IE - HKLM\..\URLSearchHook: {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - C:\Program Files\BS_Player\prxtbBS_0.dll (Conduit Ltd.)

IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\Windows\System32\ieframe.dll (Microsoft Corporation)

IE - HKU\S-1-5-20\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\Windows\System32\ieframe.dll (Microsoft Corporation)

IE - HKU\S-1-5-21-1570415891-337810980-1812106167-500\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\system32\blank.htm

IE - HKU\S-1-5-21-1570415891-337810980-1812106167-500\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1

IE - HKU\S-1-5-21-1570415891-337810980-1812106167-500\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

IE - HKU\S-1-5-21-1570415891-337810980-1812106167-500\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.bg/

IE - HKU\S-1-5-21-1570415891-337810980-1812106167-500\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\Windows\System32\ieframe.dll (Microsoft Corporation)

IE - HKU\S-1-5-21-1570415891-337810980-1812106167-500\..\URLSearchHook: {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - C:\Program Files\BS_Player\prxtbBS_0.dll (Conduit Ltd.)

IE - HKU\S-1-5-21-1570415891-337810980-1812106167-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

O1 HOSTS File: ([2011/06/02 11:18:52 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1 localhost

O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)

O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll (Google Inc.)

O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)

O2 - BHO: (BS Player Toolbar) - {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - C:\Program Files\BS_Player\prxtbBS_0.dll (Conduit Ltd.)

O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

O3 - HKLM\..\Toolbar: (BS Player Toolbar) - {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - C:\Program Files\BS_Player\prxtbBS_0.dll (Conduit Ltd.)

O3 - HKU\S-1-5-21-1570415891-337810980-1812106167-500\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

O3 - HKU\S-1-5-21-1570415891-337810980-1812106167-500\..\Toolbar\WebBrowser: (BS Player Toolbar) - {FED66DC5-1B74-4A04-8F5C-15C5ACE2B9A5} - C:\Program Files\BS_Player\prxtbBS_0.dll (Conduit Ltd.)

O4 - HKLM..\Run: [Adobe ARM] C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)

O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)

O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

O4 - HKLM..\Run: [bCSSync] C:\Program Files\Microsoft Office\Office14\BCSSync.exe (Microsoft Corporation)

O4 - HKLM..\Run: [Everything] C:\Program Files\Everything\Everything.exe ()

O4 - HKLM..\Run: [HPUsageTracking] C:\Program Files\HP\HP UT\bin\hppusg.exe ()

O4 - HKLM..\Run: [Ptipbmf] C:\Windows\System32\ptipbmf.dll ()

O4 - HKLM..\Run: [soundMan] C:\Windows\SOUNDMAN.EXE (Realtek Semiconductor Corp.)

O4 - HKU\S-1-5-21-1570415891-337810980-1812106167-500..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\daemon.exe (DT Soft Ltd)

O4 - HKU\S-1-5-21-1570415891-337810980-1812106167-500..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)

O4 - HKU\S-1-5-21-1570415891-337810980-1812106167-500..\Run: [uTorrent] C:\Program Files\uTorrent\uTorrent.exe (BitTorrent, Inc.)

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: Start_ShowMyMusic = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableInstallerDetection = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableSecureUIAPaths = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableUIADesktopToggle = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableVirtualization = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ValidateAdminCodeSignatures = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: scforceoption = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: FilterAdministratorToken = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoInternetOpenWith = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: verbosestatus = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_TEXT = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_BITMAP = 2

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_OEMTEXT = 7

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIB = 8

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_PALETTE = 9

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_UNICODETEXT = 13

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIBV5 = 17

O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Recovery present

O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Recovery present

O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Recovery present

O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Recovery present

O7 - HKU\S-1-5-21-1570415891-337810980-1812106167-500\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-21-1570415891-337810980-1812106167-500\Software\Policies\Microsoft\Internet Explorer\Recovery present

O7 - HKU\S-1-5-21-1570415891-337810980-1812106167-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-21-1570415891-337810980-1812106167-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveTrack = 1

O7 - HKU\S-1-5-21-1570415891-337810980-1812106167-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O7 - HKU\S-1-5-21-1570415891-337810980-1812106167-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: disableregistrytools = 0

O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)

O8 - Extra context menu item: Google Sidewiki... - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll (Google Inc.)

O8 - Extra context menu item: Se&nd to OneNote - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra Button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)

O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\Windows\System32\nlaapi.dll (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [] - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [] - C:\Windows\System32\winrnr.dll (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Windows\System32\NapiNSP.dll (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Windows\System32\pnrpnsp.dll (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000006 [] - C:\Windows\System32\pnrpnsp.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.39 192.168.30.1

O18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)

O18 - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\Windows\System32\MSVidCtl.dll (Microsoft Corporation)

O18 - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\gopher {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\System32\itss.dll (Microsoft Corporation)

O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)

O18 - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)

O18 - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\Windows\System32\inetcomm.dll (Microsoft Corporation)

O18 - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)

O18 - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\System32\itss.dll (Microsoft Corporation)

O18 - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)

O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O18 - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\Windows\System32\MSVidCtl.dll (Microsoft Corporation)

O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)

O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\System32\mscoree.dll (Microsoft Corporation)

O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\System32\mscoree.dll (Microsoft Corporation)

O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\System32\mscoree.dll (Microsoft Corporation)

O18 - Protocol\Filter\deflate {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Filter\gzip {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\Windows\System32\webcheck.dll (Microsoft Corporation)

O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)

O29 - HKLM SecurityProviders - (credssp.dll) - C:\Windows\System32\credssp.dll (Microsoft Corporation)

O30 - LSA: Authentication Packages - (msv1_0) - C:\Windows\System32\msv1_0.dll (Microsoft Corporation)

O30 - LSA: Security Packages - (kerberos) - C:\Windows\System32\kerberos.dll (Microsoft Corporation)

O30 - LSA: Security Packages - (msv1_0) - C:\Windows\System32\msv1_0.dll (Microsoft Corporation)

O30 - LSA: Security Packages - (schannel) - C:\Windows\System32\schannel.dll (Microsoft Corporation)

O30 - LSA: Security Packages - (wdigest) - C:\Windows\System32\wdigest.dll (Microsoft Corporation)

O30 - LSA: Security Packages - (tspkg) - C:\Windows\System32\tspkg.dll (Microsoft Corporation)

O30 - LSA: Security Packages - (pku2u) - C:\Windows\System32\pku2u.dll (Microsoft Corporation)

O31 - SafeBoot: AlternateShell - cmd.exe

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2009/06/11 00:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *) - File not found

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 90 Days ==========

[2011/06/02 21:01:29 | 001,153,912 | ---- | C] (Emsi Software GmbH) -- C:\Users\Administrator\Desktop\BlitzBlank.exe

[2011/06/02 13:04:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Kaspersky Lab

[2011/06/02 13:01:01 | 121,956,248 | ---- | C] ( ) -- C:\Users\Administrator\Desktop\setup_9.0.0.722_02.06.2011_12-43.exe

[2011/06/02 11:21:30 | 000,000,000 | ---D | C] -- C:\Windows\temp

[2011/06/02 11:19:00 | 000,000,000 | ---D | C] -- C:\$RECYCLE.BIN

[2011/06/02 01:00:18 | 004,406,784 | ---- | C] (Geza Kovacs) -- C:\Users\Administrator\Desktop\unetbootin-xpud-windows-387.exe

[2011/06/01 23:34:32 | 006,495,040 | ---- | C] (SurfRight B.V.) -- C:\Users\Administrator\Desktop\HitmanPro35beta.exe

[2011/06/01 23:20:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hitman Pro 3.5

[2011/06/01 23:20:21 | 000,000,000 | ---D | C] -- C:\Program Files\Hitman Pro 3.5

[2011/06/01 23:19:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Hitman Pro

[2011/06/01 23:19:10 | 006,470,464 | ---- | C] (SurfRight B.V.) -- C:\Users\Administrator\Desktop\HitmanPro35.exe

[2011/06/01 09:47:18 | 000,000,000 | ---D | C] -- C:\Users\Administrator\Desktop\Security Center_fix

[2011/05/31 23:17:20 | 000,000,000 | ---D | C] -- C:\_OTL

[2011/05/31 22:20:20 | 000,580,096 | ---- | C] (OldTimer Tools) -- C:\Users\Public\Desktop\OTL.exe

[2011/05/31 10:09:16 | 001,431,344 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\Public\Desktop\TDSSKiller.exe

[2011/05/31 00:04:10 | 000,606,738 | R--- | C] (Swearware) -- C:\dds.scr

[2011/05/01 22:29:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YUPLAY

[2011/05/01 22:29:03 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Local\WOP

[2011/05/01 22:29:03 | 000,000,000 | ---D | C] -- C:\ProgramData\WOP

[2011/05/01 22:27:11 | 000,515,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_5.dll

[2011/05/01 22:27:10 | 005,501,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dcsx_42.dll

[2011/05/01 22:27:10 | 001,974,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_42.dll

[2011/05/01 22:27:10 | 000,517,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_4.dll

[2011/05/01 22:27:10 | 000,238,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_5.dll

[2011/05/01 22:27:10 | 000,069,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAPOFX1_3.dll

[2011/05/01 22:27:09 | 000,514,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_3.dll

[2011/05/01 22:27:09 | 000,509,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_2.dll

[2011/05/01 22:27:09 | 000,507,400 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_1.dll

[2011/05/01 22:27:09 | 000,238,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_2.dll

[2011/05/01 22:27:09 | 000,235,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_3.dll

[2011/05/01 22:27:09 | 000,235,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_4.dll

[2011/05/01 22:27:09 | 000,070,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAPOFX1_2.dll

[2011/05/01 22:27:09 | 000,068,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAPOFX1_1.dll

[2011/05/01 22:27:09 | 000,065,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAPOFX1_0.dll

[2011/05/01 22:27:09 | 000,023,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\X3DAudio1_5.dll

[2011/05/01 22:27:09 | 000,022,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\X3DAudio1_6.dll

[2011/05/01 22:27:08 | 000,479,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_0.dll

[2011/05/01 22:27:08 | 000,267,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine2_10.dll

[2011/05/01 22:27:08 | 000,267,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine2_9.dll

[2011/05/01 22:27:08 | 000,266,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine2_8.dll

[2011/05/01 22:27:08 | 000,238,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_1.dll

[2011/05/01 22:27:08 | 000,238,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_0.dll

[2011/05/01 22:27:08 | 000,081,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xinput1_3.dll

[2011/05/01 22:27:08 | 000,025,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\X3DAudio1_4.dll

[2011/05/01 22:27:08 | 000,025,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\X3DAudio1_3.dll

[2011/05/01 22:27:08 | 000,017,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\X3DAudio1_2.dll

[2011/05/01 22:27:07 | 000,261,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine2_7.dll

[2011/05/01 22:27:07 | 000,255,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine2_6.dll

[2011/05/01 22:27:07 | 000,251,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine2_5.dll

[2011/05/01 22:27:07 | 000,237,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine2_4.dll

[2011/05/01 22:27:07 | 000,236,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine2_3.dll

[2011/05/01 22:27:07 | 000,062,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xinput1_2.dll

[2011/05/01 22:27:07 | 000,015,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\x3daudio1_1.dll

[2011/05/01 22:27:06 | 000,230,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine2_2.dll

[2011/05/01 22:27:06 | 000,229,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine2_1.dll

[2011/05/01 22:27:06 | 000,062,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xinput1_1.dll

[2011/05/01 22:27:04 | 000,230,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine2_0.dll

[2011/05/01 22:27:04 | 000,014,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\x3daudio1_0.dll

[2011/05/01 22:26:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wings of Prey

[2011/05/01 22:00:58 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Local\Wings of Prey

[2011/05/01 22:00:58 | 000,000,000 | ---D | C] -- C:\Users\Administrator\Documents\My Games

[2011/04/28 15:11:02 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\Google

[2011/04/28 14:52:00 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Local\Google

[2011/04/28 14:51:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Google

[2011/04/28 14:51:52 | 000,000,000 | ---D | C] -- C:\Program Files\Google

[2011/04/28 14:49:50 | 000,000,000 | ---D | C] -- C:\Windows\System32\Adobe

[2011/04/13 14:00:18 | 000,000,000 | ---D | C] -- C:\ProgramData\121D4

[2011/04/13 14:00:08 | 000,000,000 | ---D | C] -- C:\Users\Administrator\Documents\My Received Files

[2011/04/13 14:00:08 | 000,000,000 | ---D | C] -- C:\Users\Administrator\Documents\BearShare

[2011/04/13 14:00:08 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Local\BearShare

[2011/04/13 13:58:36 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Local\PackageAware

[2011/04/03 17:19:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Hewlett-Packard

[2011/04/03 16:50:36 | 001,035,408 | ---- | C] (The OpenSSL Project) -- C:\Windows\System32\ltcry15u.dll

[2011/04/03 16:50:36 | 000,105,616 | ---- | C] (LEAD Technologies, Inc.) -- C:\Windows\System32\ltpnt15u.dll

[2011/04/03 16:50:36 | 000,068,752 | ---- | C] (LEAD Technologies, Inc.) -- C:\Windows\System32\ltpdg15u.dll

[2011/04/03 16:50:36 | 000,024,720 | ---- | C] (LEAD Technologies, Inc.) -- C:\Windows\System32\Lfbmp15u.dll

[2011/04/03 16:50:35 | 002,219,152 | ---- | C] (LEAD Technologies, Inc.) -- C:\Windows\System32\Ltwvc15u.dll

[2011/04/03 16:50:35 | 001,711,248 | ---- | C] (LEAD Technologies, Inc.) -- C:\Windows\System32\ltclr15u.dll

[2011/04/03 16:50:35 | 000,482,448 | ---- | C] (LEAD Technologies, Inc.) -- C:\Windows\System32\ltkrn15u.dll

[2011/04/03 16:50:35 | 000,445,584 | ---- | C] (LEAD Technologies, Inc.) -- C:\Windows\System32\ltimgsfx15u.dll

[2011/04/03 16:50:35 | 000,302,224 | ---- | C] (LEAD Technologies, Inc.) -- C:\Windows\System32\ltimgcor15u.dll

[2011/04/03 16:50:35 | 000,261,264 | ---- | C] (LEAD Technologies, Inc.) -- C:\Windows\System32\LTDIS15u.dll

[2011/04/03 16:50:35 | 000,257,168 | ---- | C] (LEAD Technologies, Inc.) -- C:\Windows\System32\ltefx15u.dll

[2011/04/03 16:50:35 | 000,216,208 | ---- | C] (LEAD Technologies, Inc.) -- C:\Windows\System32\ltimgefx15u.dll

[2011/04/03 16:50:35 | 000,212,112 | ---- | C] (LEAD Technologies, Inc.) -- C:\Windows\System32\ltimgclr15u.dll

[2011/04/03 16:50:35 | 000,150,672 | ---- | C] (LEAD Technologies, Inc.) -- C:\Windows\System32\ltfil15u.dll

[2011/04/03 16:50:35 | 000,117,904 | ---- | C] (LEAD Technologies, Inc.) -- C:\Windows\System32\Ltimgutl15u.dll

[2011/04/03 16:50:35 | 000,064,656 | ---- | C] (LEAD Technologies, Inc.) -- C:\Windows\System32\LTCON15u.dll

[2011/04/03 16:50:35 | 000,038,032 | ---- | C] (LEAD Technologies, Inc.) -- C:\Windows\System32\ltimgopt15u.dll

[2011/04/03 16:50:34 | 000,172,032 | ---- | C] (Marvell) -- C:\Windows\System32\agmcrdrv.dll

[2011/04/03 16:50:30 | 000,053,248 | ---- | C] (Zenographics, Inc.) -- C:\Windows\System32\ZTAG.dll

[2011/04/03 16:50:29 | 000,135,168 | ---- | C] (Zenographics, Inc.) -- C:\Windows\System32\ZLM1120.dll

[2011/04/03 16:50:29 | 000,106,496 | ---- | C] (Zenographics, Inc.) -- C:\Windows\System32\ZSPOOL.dll

[2011/04/03 16:50:29 | 000,061,440 | ---- | C] (Zenographics, Inc.) -- C:\Windows\System32\ZIMF.DLL

[2011/04/03 16:50:28 | 000,114,688 | ---- | C] (Marvell) -- C:\Windows\System32\HPMCoSetup.dll

[2011/04/03 16:34:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP

[2011/04/03 16:33:41 | 000,221,184 | ---- | C] (TODO: <Company name>) -- C:\Windows\brprs.exe

[2011/04/03 16:33:40 | 000,000,000 | ---D | C] -- C:\ProgramData\HP

[2011/04/03 16:33:40 | 000,000,000 | ---D | C] -- C:\Program Files\HP

[2011/04/03 16:05:39 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\HP

[2011/04/03 16:04:59 | 000,000,000 | ---D | C] -- C:\hp_LJ_M1120_Full_Solution

[2011/04/03 13:05:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype

[2011/04/03 13:05:24 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype

[2011/04/03 13:05:23 | 000,000,000 | R--D | C] -- C:\Program Files\Skype

[2011/03/30 12:31:05 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\skypePM

[2011/03/27 00:09:36 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BS.Player

[2011/03/27 00:08:41 | 000,000,000 | ---D | C] -- C:\Program Files\BS_Player

[2011/03/27 00:08:36 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\BSplayer Pro

[2011/03/27 00:08:36 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\BSplayer

[2011/03/27 00:08:35 | 000,000,000 | ---D | C] -- C:\Program Files\Webteh

[2011/03/22 00:48:31 | 000,000,000 | ---D | C] -- C:\Program Files\ESET

[2011/03/22 00:04:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner

[2011/03/22 00:04:55 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner

[2011/03/21 00:51:41 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Local\temp

[2011/03/20 23:45:56 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT

[2011/03/20 20:15:02 | 000,000,000 | ---D | C] -- C:\Users\Administrator\Desktop\subtitri

[2011/03/20 12:48:05 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\Media Player Classic

[2011/03/20 12:34:19 | 000,000,000 | ---D | C] -- C:\extensions

[2011/03/20 12:34:12 | 000,000,000 | ---D | C] -- C:\Program Files\uTorrent

[2011/03/20 12:33:29 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\uTorrent

[2011/03/20 00:25:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Panda Security

[2011/03/20 00:24:55 | 000,000,000 | ---D | C] -- C:\Program Files\Panda USB Vaccine

[2011/03/20 00:24:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda Security

[2011/03/20 00:18:03 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\Malwarebytes

[2011/03/20 00:17:54 | 000,039,984 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys

[2011/03/20 00:17:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2011/03/20 00:17:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2011/03/20 00:17:50 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware

[2011/03/20 00:02:24 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\Macromedia

[2011/03/17 19:16:56 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Local\Adobe

[2011/03/17 19:16:16 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe

[2011/03/17 19:16:16 | 000,000,000 | ---D | C] -- C:\Program Files\Adobe

[2011/03/17 19:15:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Adobe

[2011/03/17 14:21:34 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\Avira

[2011/03/17 14:17:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira

[2011/03/17 14:17:50 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\ssmdrv.sys

[2011/03/17 14:17:49 | 000,137,656 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys

[2011/03/17 14:17:49 | 000,061,960 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avgntflt.sys

[2011/03/17 14:17:49 | 000,051,992 | ---- | C] (AVIRA GmbH) -- C:\Windows\System32\drivers\avgntdd.sys

[2011/03/17 14:17:49 | 000,017,016 | ---- | C] (AVIRA GmbH) -- C:\Windows\System32\drivers\avgntmgr.sys

[2011/03/17 14:17:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira

[2011/03/17 14:17:49 | 000,000,000 | ---D | C] -- C:\Program Files\Avira

[2011/03/17 13:07:07 | 000,190,976 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\ks.sys

[2011/03/17 13:04:06 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Local\Western Digital

[2011/03/17 11:56:35 | 000,442,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XpsPrint.dll

[2011/03/17 11:56:35 | 000,288,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XpsGdiConverter.dll

[2011/03/17 11:56:35 | 000,026,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\Diskdump.sys

[2011/03/17 11:56:27 | 000,284,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\usbport.sys

[2011/03/17 11:56:27 | 000,005,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\usbd.sys

[2011/03/17 11:56:09 | 000,369,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\secproc.dll

[2011/03/17 11:56:09 | 000,365,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\secproc_isv.dll

[2011/03/17 11:56:09 | 000,324,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RMActivate_isv.exe

[2011/03/17 11:56:09 | 000,320,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RMActivate.exe

[2011/03/17 11:56:09 | 000,280,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RMActivate_ssp.exe

[2011/03/17 11:56:09 | 000,277,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RMActivate_ssp_isv.exe

[2011/03/17 11:56:09 | 000,085,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\secproc_ssp_isv.dll

[2011/03/17 11:56:09 | 000,085,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\secproc_ssp.dll

[2011/03/17 11:30:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SharePoint

[2011/03/17 11:30:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office

[2011/03/17 11:29:58 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Synchronization Services

[2011/03/17 11:29:58 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\DESIGNER

[2011/03/17 11:29:40 | 000,000,000 | ---D | C] -- C:\Windows\PCHEALTH

[2011/03/17 11:29:40 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft.NET

[2011/03/17 11:29:40 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Sync Framework

[2011/03/17 11:29:40 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft SQL Server Compact Edition

[2011/03/17 11:28:59 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Visual Studio 8

[2011/03/17 11:28:30 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Analysis Services

[2011/03/17 11:28:14 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Local\Microsoft Help

[2011/03/17 11:28:12 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Office

[2011/03/17 11:28:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft Help

[2011/03/17 11:28:04 | 000,000,000 | RH-D | C] -- C:\MSOCache

[2011/03/17 11:25:42 | 000,000,000 | ---D | C] -- C:\ProgramData\DAEMON Tools Lite

[2011/03/17 11:25:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DAEMON Tools Lite

[2011/03/17 11:25:37 | 000,000,000 | ---D | C] -- C:\Program Files\DAEMON Tools Lite

[2011/03/17 11:23:29 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\DAEMON Tools Lite

[2011/03/17 11:12:26 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\Skype

[2011/03/17 05:11:34 | 000,000,000 | ---D | C] -- C:\Windows\Panther

[2011/03/17 04:25:00 | 000,965,664 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\System32\RtkPgExt.dll

[2011/03/17 04:25:00 | 000,604,704 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SOUNDMAN.EXE

[2011/03/17 04:25:00 | 000,223,776 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\Alcrmv.exe

[2011/03/17 04:25:00 | 000,141,856 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\System32\RtkCfg.dll

[2011/03/17 04:24:59 | 019,036,704 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\System32\ALSNDMGR.CPL

[2011/03/17 04:24:59 | 010,975,264 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\System32\RTLCPL.EXE

[2011/03/17 04:24:59 | 004,172,832 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\System32\drivers\RTKVAC.SYS

[2011/03/17 04:24:55 | 002,510,368 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\System32\RtkAPO.dll

[2011/03/17 04:23:26 | 000,000,000 | -HSD | C] -- C:\Windows\Installer

[2011/03/17 04:23:21 | 000,490,088 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvuninst.exe

[2011/03/17 04:23:17 | 000,490,088 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvudisp.exe

[2011/03/17 04:20:01 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR

[2011/03/17 04:20:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR

[2011/03/17 04:20:01 | 000,000,000 | ---D | C] -- C:\Program Files\WinRAR

[2011/03/17 04:20:00 | 000,000,000 | ---D | C] -- C:\Program Files\HashTab Shell Extension

[2011/03/17 04:19:58 | 000,000,000 | ---D | C] -- C:\Program Files\Foxit Software

[2011/03/17 04:19:57 | 000,000,000 | ---D | C] -- C:\Windows\System32\Macromed

[2011/03/17 04:19:56 | 000,000,000 | ---D | C] -- C:\Program Files\Everything

[2011/03/17 04:19:55 | 004,379,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_40.dll

[2011/03/17 04:19:55 | 004,178,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_41.dll

[2011/03/17 04:19:55 | 003,851,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_39.dll

[2011/03/17 04:19:55 | 003,850,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_38.dll

[2011/03/17 04:19:55 | 003,786,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_37.dll

[2011/03/17 04:19:55 | 003,734,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_36.dll

[2011/03/17 04:19:55 | 003,727,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_35.dll

[2011/03/17 04:19:55 | 003,497,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_34.dll

[2011/03/17 04:19:55 | 003,495,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_33.dll

[2011/03/17 04:19:55 | 003,426,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_32.dll

[2011/03/17 04:19:55 | 002,414,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_31.dll

[2011/03/17 04:19:55 | 002,388,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_30.dll

[2011/03/17 04:19:55 | 002,337,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_25.dll

[2011/03/17 04:19:55 | 002,332,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_29.dll

[2011/03/17 04:19:55 | 002,323,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_28.dll

[2011/03/17 04:19:55 | 002,319,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_27.dll

[2011/03/17 04:19:55 | 002,297,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_26.dll

[2011/03/17 04:19:55 | 002,222,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_24.dll

[2011/03/17 04:19:54 | 000,467,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_39.dll

[2011/03/17 04:19:54 | 000,467,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_38.dll

[2011/03/17 04:19:54 | 000,462,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_37.dll

[2011/03/17 04:19:54 | 000,453,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_41.dll

[2011/03/17 04:19:54 | 000,452,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_40.dll

[2011/03/17 04:19:54 | 000,444,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_36.dll

[2011/03/17 04:19:54 | 000,444,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_35.dll

[2011/03/17 04:19:54 | 000,443,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_34.dll

[2011/03/17 04:19:54 | 000,443,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_33.dll

[2011/03/17 04:19:54 | 000,440,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10.dll

[2011/03/17 04:17:34 | 000,000,000 | R--D | C] -- C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

[2011/03/17 04:17:34 | 000,000,000 | R--D | C] -- C:\Users\Administrator\Searches

[2011/03/17 04:17:34 | 000,000,000 | R--D | C] -- C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools

[2011/03/17 04:17:34 | 000,000,000 | ---D | C] -- C:\Users\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\User Pinned

[2011/03/17 04:17:22 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\Identities

[2011/03/17 04:17:19 | 000,000,000 | R--D | C] -- C:\Users\Administrator\Contacts

[2011/03/17 04:17:06 | 000,000,000 | --SD | C] -- C:\Users\Administrator\AppData\Roaming\Microsoft

[2011/03/17 04:17:06 | 000,000,000 | R--D | C] -- C:\Users\Administrator\Videos

[2011/03/17 04:17:06 | 000,000,000 | R--D | C] -- C:\Users\Administrator\Saved Games

[2011/03/17 04:17:06 | 000,000,000 | R--D | C] -- C:\Users\Administrator\Pictures

[2011/03/17 04:17:06 | 000,000,000 | R--D | C] -- C:\Users\Administrator\Music

[2011/03/17 04:17:06 | 000,000,000 | R--D | C] -- C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance

[2011/03/17 04:17:06 | 000,000,000 | R--D | C] -- C:\Users\Administrator\Links

[2011/03/17 04:17:06 | 000,000,000 | R--D | C] -- C:\Users\Administrator\Favorites

[2011/03/17 04:17:06 | 000,000,000 | R--D | C] -- C:\Users\Administrator\Downloads

[2011/03/17 04:17:06 | 000,000,000 | R--D | C] -- C:\Users\Administrator\My Documents

[2011/03/17 04:17:06 | 000,000,000 | R--D | C] -- C:\Users\Administrator\Desktop

[2011/03/17 04:17:06 | 000,000,000 | R--D | C] -- C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories

[2011/03/17 04:17:06 | 000,000,000 | -HSD | C] -- C:\Users\Administrator\AppData\Local\Temporary Internet Files

[2011/03/17 04:17:06 | 000,000,000 | -HSD | C] -- C:\Users\Administrator\Templates

[2011/03/17 04:17:06 | 000,000,000 | -HSD | C] -- C:\Users\Administrator\Start Menu

[2011/03/17 04:17:06 | 000,000,000 | -HSD | C] -- C:\Users\Administrator\SendTo

[2011/03/17 04:17:06 | 000,000,000 | -HSD | C] -- C:\Users\Administrator\Recent

[2011/03/17 04:17:06 | 000,000,000 | -HSD | C] -- C:\Users\Administrator\PrintHood

[2011/03/17 04:17:06 | 000,000,000 | -HSD | C] -- C:\Users\Administrator\NetHood

[2011/03/17 04:17:06 | 000,000,000 | -HSD | C] -- C:\Users\Administrator\Documents\My Videos

[2011/03/17 04:17:06 | 000,000,000 | -HSD | C] -- C:\Users\Administrator\Documents\My Pictures

[2011/03/17 04:17:06 | 000,000,000 | -HSD | C] -- C:\Users\Administrator\Documents\My Music

[2011/03/17 04:17:06 | 000,000,000 | -HSD | C] -- C:\Users\Administrator\My Documents

[2011/03/17 04:17:06 | 000,000,000 | -HSD | C] -- C:\Users\Administrator\Local Settings

[2011/03/17 04:17:06 | 000,000,000 | -HSD | C] -- C:\Users\Administrator\AppData\Local\History

[2011/03/17 04:17:06 | 000,000,000 | -HSD | C] -- C:\Users\Administrator\Cookies

[2011/03/17 04:17:06 | 000,000,000 | -HSD | C] -- C:\Users\Administrator\Application Data

[2011/03/17 04:17:06 | 000,000,000 | -HSD | C] -- C:\Users\Administrator\AppData\Local\Application Data

[2011/03/17 04:17:06 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Local\Microsoft

[2011/03/17 04:17:06 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData

[2011/03/17 04:14:49 | 000,000,000 | ---D | C] -- C:\Windows\SoftwareDistribution

[2011/03/17 04:12:26 | 000,000,000 | ---D | C] -- C:\Windows\Prefetch

[2011/03/17 04:12:13 | 000,000,000 | -HSD | C] -- C:\System Volume Information

[2011/03/16 20:11:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Skype

[2011/03/16 20:08:07 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\Adobe

[2011/03/16 20:08:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\K-Lite Codec Pack

[2011/03/16 20:08:02 | 000,839,680 | ---- | C] (http://www.mp3dev.org/) -- C:\Windows\System32\lameACM.acm

[2011/03/16 20:08:02 | 000,217,088 | ---- | C] (www.helixcommunity.org) -- C:\Windows\System32\yv12vfw.dll

[2011/03/16 20:08:02 | 000,118,784 | ---- | C] (fccHandler) -- C:\Windows\System32\ac3acm.acm

[2011/03/16 20:08:00 | 000,000,000 | ---D | C] -- C:\Program Files\K-Lite Codec Pack

[2011/03/16 20:07:29 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\Nero

[2011/03/16 20:06:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nero

[2011/03/16 20:06:20 | 000,802,816 | ---- | C] (Pegasus Imaging Corp.) -- C:\Windows\System32\imagXRA7.dll

[2011/03/16 20:06:20 | 000,497,296 | ---- | C] (Pegasus Imaging Corp.) -- C:\Windows\System32\imagXpr7.dll

[2011/03/16 20:06:20 | 000,368,640 | ---- | C] (Pegasus Imaging Corporation) -- C:\Windows\System32\TwnLib4.dll

[2011/03/16 20:06:20 | 000,258,048 | ---- | C] (Pegasus Imaging Corp.) -- C:\Windows\System32\imagXR7.dll

[2011/03/16 20:06:19 | 001,757,184 | ---- | C] (Pegasus Imaging Corp.) -- C:\Windows\System32\imagX7.dll

[2011/03/16 20:06:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Nero

[2011/03/16 20:06:19 | 000,000,000 | ---D | C] -- C:\Program Files\Nero

[2011/03/16 20:06:19 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Nero

[2011/03/16 20:01:32 | 000,000,000 | ---D | C] -- C:\Program Files\SA Dictionary 2008 Beta 4

[2011/03/16 20:01:25 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Local\Downloaded Installations

[2011/03/16 19:34:56 | 000,000,000 | ---D | C] -- C:\ProgramData\NVIDIA

[2011/03/16 19:31:25 | 000,293,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\browserchoice.exe

[2011/03/16 19:31:06 | 002,329,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys

[2011/03/16 19:31:05 | 003,957,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe

[2011/03/16 19:31:05 | 003,901,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe

[2011/03/16 19:31:03 | 002,614,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\explorer.exe

[2011/03/16 19:31:01 | 000,573,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\odbc32.dll

[2011/03/16 19:30:57 | 000,716,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript.dll

[2011/03/16 19:30:57 | 000,428,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\vbscript.dll

[2011/03/16 19:30:57 | 000,187,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\FWPKCLNT.SYS

[2011/03/16 19:30:56 | 000,954,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfc40.dll

[2011/03/16 19:30:56 | 000,954,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfc40u.dll

[2011/03/16 19:30:54 | 000,314,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\webio.dll

[2011/03/16 19:30:53 | 000,197,632 | ---- | C] (Intel® Corporation) -- C:\Windows\System32\ir32_32.dll

[2011/03/16 19:30:53 | 000,082,944 | ---- | C] (Radius Inc.) -- C:\Windows\System32\iccvid.dll

[2011/03/16 19:30:53 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tzres.dll

[2011/03/16 19:30:51 | 000,067,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\asycfilt.dll

[2011/03/16 19:30:50 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\t2embed.dll

[2011/03/16 19:30:48 | 000,037,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rtutils.dll

[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]

========== Files - Modified Within 90 Days ==========

[2020/02/02 03:02:02 | 000,048,256 | ---- | M] (JMicron Technology Corp.) -- C:\Windows\System32\drivers\jraid.sys

[2011/06/02 21:11:49 | 000,014,016 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2011/06/02 21:11:49 | 000,014,016 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2011/06/02 21:11:18 | 000,618,026 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2011/06/02 21:11:18 | 000,104,340 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[2011/06/02 21:06:45 | 000,000,896 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2011/06/02 21:06:17 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2011/06/02 21:02:00 | 000,000,900 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2011/06/02 21:01:43 | 001,153,912 | ---- | M] (Emsi Software GmbH) -- C:\Users\Administrator\Desktop\BlitzBlank.exe

[2011/06/02 14:38:26 | 000,420,592 | ---- | M] () -- C:\Users\Administrator\Desktop\!.png

[2011/06/02 13:01:01 | 121,956,248 | ---- | M] ( ) -- C:\Users\Administrator\Desktop\setup_9.0.0.722_02.06.2011_12-43.exe

[2011/06/02 11:18:52 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts

[2011/06/02 01:13:47 | 067,108,864 | ---- | M] () -- C:\Users\Administrator\Desktop\xpud-0.9.2.iso

[2011/06/02 01:00:16 | 004,406,784 | ---- | M] (Geza Kovacs) -- C:\Users\Administrator\Desktop\unetbootin-xpud-windows-387.exe

[2011/06/01 23:37:42 | 000,000,518 | ---- | M] () -- C:\Users\Administrator\Desktop\log1.zip

[2011/06/01 23:37:32 | 000,001,680 | ---- | M] () -- C:\Users\Administrator\Desktop\log1.xml

[2011/06/01 23:35:22 | 000,020,552 | ---- | M] () -- C:\Windows\System32\drivers\hitmanpro35.sys

[2011/06/01 23:34:32 | 006,495,040 | ---- | M] (SurfRight B.V.) -- C:\Users\Administrator\Desktop\HitmanPro35beta.exe

[2011/06/01 23:26:56 | 000,001,374 | ---- | M] () -- C:\Users\Administrator\Desktop\log.zip

[2011/06/01 23:23:47 | 000,001,291 | ---- | M] () -- C:\Users\Administrator\Desktop\log.rar

[2011/06/01 23:23:32 | 000,025,876 | ---- | M] () -- C:\Users\Administrator\Desktop\log.xml

[2011/06/01 23:20:21 | 000,001,946 | ---- | M] () -- C:\Users\Public\Desktop\Hitman Pro 3.5.lnk

[2011/06/01 23:19:10 | 006,470,464 | ---- | M] (SurfRight B.V.) -- C:\Users\Administrator\Desktop\HitmanPro35.exe

[2011/06/01 09:47:04 | 000,001,162 | ---- | M] () -- C:\Users\Administrator\Desktop\Security Center_fix.zip

[2011/06/01 00:02:50 | 000,001,067 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk

[2011/05/31 23:58:55 | 000,606,105 | ---- | M] () -- C:\Users\Public\Desktop\unhide.exe

[2011/05/31 23:47:03 | 008,286,479 | ---- | M] () -- C:\_OTL.rar

[2011/05/31 22:20:04 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Users\Public\Desktop\OTL.exe

[2011/05/31 22:03:06 | 000,206,473 | ---- | M] () -- C:\Users\Public\Desktop\desktop.png

[2011/05/31 21:54:47 | 000,342,528 | ---- | M] () -- C:\Users\Public\Desktop\New Microsoft Publisher Document.pub

[2011/05/31 09:17:54 | 001,301,452 | ---- | M] () -- C:\Users\Public\Desktop\tdsskiller.zip

[2011/05/31 01:00:22 | 000,075,264 | ---- | M] () -- C:\Users\Public\Desktop\SystemLook.exe

[2011/05/31 00:00:03 | 000,606,738 | R--- | M] (Swearware) -- C:\dds.scr

[2011/05/29 09:11:30 | 000,039,984 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys

[2011/05/25 07:10:16 | 001,431,344 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\Public\Desktop\TDSSKiller.exe

[2011/05/23 14:36:06 | 000,000,069 | ---- | M] () -- C:\Windows\NeroDigital.ini

[2011/05/21 21:33:31 | 000,526,153 | -H-- | M] () -- C:\Windows\MEMORY.DMP

[2011/05/01 22:26:54 | 000,000,727 | ---- | M] () -- C:\Users\Public\Desktop\Wings of Prey.lnk

[2011/04/16 22:05:50 | 000,028,262 | ---- | M] () -- C:\Users\Administrator\Desktop\santi-themechanic.r5.xvid-bul.sub

[2011/04/04 01:41:02 | 000,001,886 | ---- | M] () -- C:\Users\Administrator\Desktop\HP LaserJet M1120 MFP - Shortcut.lnk

[2011/04/03 19:16:59 | 000,001,680 | ---- | M] () -- C:\Users\Administrator\Desktop\OnlineScannerApp - Shortcut.lnk

[2011/04/03 13:05:24 | 000,002,503 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk

[2011/03/30 12:31:06 | 000,000,056 | ---- | M] () -- C:\Windows\System32\ezsidmv.dat

[2011/03/27 00:09:36 | 000,001,104 | ---- | M] () -- C:\Users\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\BS.Player FREE.lnk

[2011/03/27 00:09:36 | 000,001,080 | ---- | M] () -- C:\Users\Administrator\Desktop\BS.Player FREE.lnk

[2011/03/22 00:04:56 | 000,000,965 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk

[2011/03/20 12:34:12 | 000,000,937 | ---- | M] () -- C:\Users\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\µTorrent.lnk

[2011/03/20 12:34:12 | 000,000,913 | ---- | M] () -- C:\Users\Public\Desktop\µTorrent.lnk

[2011/03/20 00:01:46 | 000,001,413 | ---- | M] () -- C:\Users\Administrator\Desktop\Internet Explorer.lnk

[2011/03/19 23:38:43 | 000,137,656 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys

[2011/03/19 23:38:43 | 000,061,960 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avgntflt.sys

[2011/03/17 19:16:32 | 000,001,989 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk

[2011/03/17 14:17:56 | 000,002,012 | ---- | M] () -- C:\Users\Public\Desktop\Avira AntiVir Control Center.lnk

[2011/03/17 11:46:23 | 000,368,096 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT

[2011/03/17 11:44:22 | 000,008,192 | ---- | M] () -- C:\Windows\System32\srvany.exe

[2011/03/17 04:15:41 | 000,042,045 | ---- | M] () -- C:\Windows\System32\license.rtf

[2011/03/16 20:08:06 | 000,001,407 | ---- | M] () -- C:\Users\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk

[2011/03/16 20:07:11 | 000,001,036 | ---- | M] () -- C:\Users\Administrator\Desktop\Nero Burning ROM.lnk

[2011/03/16 20:01:33 | 000,002,797 | ---- | M] () -- C:\Users\Public\Desktop\SA Dictionary 2008 Beta 4.lnk

[2011/03/16 19:59:08 | 000,000,000 | ---- | M] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_09_00.Wdf

[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/06/02 14:38:26 | 000,420,592 | ---- | C] () -- C:\Users\Administrator\Desktop\!.png

[2011/06/02 01:13:48 | 067,108,864 | ---- | C] () -- C:\Users\Administrator\Desktop\xpud-0.9.2.iso

[2011/06/01 23:37:42 | 000,000,518 | ---- | C] () -- C:\Users\Administrator\Desktop\log1.zip

[2011/06/01 23:37:32 | 000,001,680 | ---- | C] () -- C:\Users\Administrator\Desktop\log1.xml

[2011/06/01 23:26:56 | 000,001,374 | ---- | C] () -- C:\Users\Administrator\Desktop\log.zip

[2011/06/01 23:23:47 | 000,001,291 | ---- | C] () -- C:\Users\Administrator\Desktop\log.rar

[2011/06/01 23:23:32 | 000,025,876 | ---- | C] () -- C:\Users\Administrator\Desktop\log.xml

[2011/06/01 23:20:21 | 000,020,552 | ---- | C] () -- C:\Windows\System32\drivers\hitmanpro35.sys

[2011/06/01 23:20:21 | 000,001,946 | ---- | C] () -- C:\Users\Public\Desktop\Hitman Pro 3.5.lnk

[2011/06/01 22:50:50 | 000,002,803 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SA Dictionary 2008 Beta 4.lnk

[2011/06/01 22:50:50 | 000,002,441 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk

[2011/06/01 22:50:50 | 000,001,993 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Snipping Tool.lnk

[2011/06/01 22:50:50 | 000,001,515 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk

[2011/06/01 22:50:50 | 000,001,330 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sidebar.lnk

[2011/06/01 22:50:50 | 000,001,246 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XPS Viewer.lnk

[2011/06/01 22:50:50 | 000,001,210 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Fax and Scan.lnk

[2011/06/01 09:47:10 | 000,001,162 | ---- | C] () -- C:\Users\Administrator\Desktop\Security Center_fix.zip

[2011/05/31 23:59:35 | 001,301,452 | ---- | C] () -- C:\Users\Public\Desktop\tdsskiller.zip

[2011/05/31 23:59:35 | 000,292,297 | ---- | C] () -- C:\Users\Public\Desktop\Enable Quick Launch.exe

[2011/05/31 23:59:35 | 000,075,264 | ---- | C] () -- C:\Users\Public\Desktop\SystemLook.exe

[2011/05/31 23:59:35 | 000,002,797 | ---- | C] () -- C:\Users\Public\Desktop\SA Dictionary 2008 Beta 4.lnk

[2011/05/31 23:59:35 | 000,002,503 | ---- | C] () -- C:\Users\Public\Desktop\Skype.lnk

[2011/05/31 23:59:35 | 000,002,012 | ---- | C] () -- C:\Users\Public\Desktop\Avira AntiVir Control Center.lnk

[2011/05/31 23:59:35 | 000,001,989 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk

[2011/05/31 23:59:35 | 000,001,067 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk

[2011/05/31 23:59:35 | 000,000,965 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk

[2011/05/31 23:59:35 | 000,000,913 | ---- | C] () -- C:\Users\Public\Desktop\µTorrent.lnk

[2011/05/31 23:59:35 | 000,000,727 | ---- | C] () -- C:\Users\Public\Desktop\Wings of Prey.lnk

[2011/05/31 23:58:55 | 000,606,105 | ---- | C] () -- C:\Users\Public\Desktop\unhide.exe

[2011/05/31 23:46:54 | 008,286,479 | ---- | C] () -- C:\_OTL.rar

[2011/05/31 22:03:06 | 000,206,473 | ---- | C] () -- C:\Users\Public\Desktop\desktop.png

[2011/05/31 21:54:20 | 000,342,528 | ---- | C] () -- C:\Users\Public\Desktop\New Microsoft Publisher Document.pub

[2011/05/13 21:49:15 | 000,526,153 | -H-- | C] () -- C:\Windows\MEMORY.DMP

[2011/04/28 14:52:06 | 000,000,900 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2011/04/28 14:52:05 | 000,000,896 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2011/04/16 22:05:50 | 000,028,262 | ---- | C] () -- C:\Users\Administrator\Desktop\santi-themechanic.r5.xvid-bul.sub

[2011/04/04 01:41:02 | 000,001,886 | ---- | C] () -- C:\Users\Administrator\Desktop\HP LaserJet M1120 MFP - Shortcut.lnk

[2011/04/03 19:16:59 | 000,001,680 | ---- | C] () -- C:\Users\Administrator\Desktop\OnlineScannerApp - Shortcut.lnk

[2011/04/03 16:50:30 | 000,413,696 | ---- | C] () -- C:\Windows\System32\ZSM1120.exe

[2011/04/03 16:50:30 | 000,004,373 | ---- | C] () -- C:\Windows\M1120OS.htm

[2011/04/03 16:50:28 | 000,167,936 | ---- | C] () -- C:\Windows\System32\hpsfs.dll

[2011/04/03 16:50:28 | 000,024,772 | ---- | C] () -- C:\Windows\M1120DEF.css

[2011/04/03 16:50:28 | 000,009,731 | ---- | C] () -- C:\Windows\M1120BTN.js

[2011/04/03 16:50:28 | 000,008,085 | ---- | C] () -- C:\Windows\M1120GLB.js

[2011/04/03 16:50:28 | 000,002,944 | ---- | C] () -- C:\Windows\M1120SIG.gif

[2011/03/30 12:31:06 | 000,000,056 | ---- | C] () -- C:\Windows\System32\ezsidmv.dat

[2011/03/27 00:09:36 | 000,001,104 | ---- | C] () -- C:\Users\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\BS.Player FREE.lnk

[2011/03/27 00:09:36 | 000,001,080 | ---- | C] () -- C:\Users\Administrator\Desktop\BS.Player FREE.lnk

[2011/03/21 21:08:38 | 000,000,069 | ---- | C] () -- C:\Windows\NeroDigital.ini

[2011/03/20 12:34:12 | 000,000,937 | ---- | C] () -- C:\Users\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\µTorrent.lnk

[2011/03/20 00:01:46 | 000,001,413 | ---- | C] () -- C:\Users\Administrator\Desktop\Internet Explorer.lnk

[2011/03/17 11:44:43 | 000,008,192 | ---- | C] () -- C:\Windows\System32\srvany.exe

[2011/03/17 04:25:00 | 000,154,144 | ---- | C] () -- C:\Windows\System32\RTLCPAPI.dll

[2011/03/17 04:25:00 | 000,141,016 | ---- | C] () -- C:\Windows\System32\ALSNDMGR.WAV

[2011/03/17 04:23:17 | 000,014,646 | ---- | C] () -- C:\Windows\System32\nvdisp.nvu

[2011/03/17 04:17:40 | 000,001,407 | ---- | C] () -- C:\Users\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk

[2011/03/17 04:17:35 | 000,001,413 | ---- | C] () -- C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

[2011/03/17 04:17:06 | 000,000,290 | ---- | C] () -- C:\Users\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\#Shows Desktop.lnk

[2011/03/17 04:17:06 | 000,000,272 | ---- | C] () -- C:\Users\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\#Window Switcher.lnk

[2011/03/17 04:12:19 | 000,368,096 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT

[2011/03/16 20:08:03 | 000,178,176 | ---- | C] () -- C:\Windows\System32\unrar.dll

[2011/03/16 20:08:03 | 000,000,038 | ---- | C] () -- C:\Windows\avisplitter.ini

[2011/03/16 20:08:02 | 000,881,664 | ---- | C] () -- C:\Windows\System32\xvidcore.dll

[2011/03/16 20:08:02 | 000,205,824 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll

[2011/03/16 20:08:02 | 000,000,414 | ---- | C] () -- C:\Windows\System32\lame_acm.xml

[2011/03/16 20:08:01 | 000,085,504 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll

[2011/03/16 20:07:11 | 000,001,036 | ---- | C] () -- C:\Users\Administrator\Desktop\Nero Burning ROM.lnk

[2011/03/16 19:59:08 | 000,000,000 | ---- | C] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_09_00.Wdf

[2009/08/30 19:24:41 | 000,118,784 | ---- | C] () -- C:\Windows\System32\ptipbmf.dll

[2009/08/30 09:44:00 | 000,172,032 | ---- | C] () -- C:\Windows\System32\nvccoin.dll

[2009/08/30 05:17:52 | 000,155,648 | ---- | C] () -- C:\Windows\System32\CDR.exe

[2009/08/30 05:17:52 | 000,110,085 | ---- | C] () -- C:\Windows\System32\CDIMAGE.EXE

[2009/08/30 05:17:52 | 000,094,208 | ---- | C] () -- C:\Windows\System32\pskill.exe

[2009/08/29 05:44:05 | 000,005,810 | ---- | C] () -- C:\Windows\System32\drivers\ASACPI.sys

[2009/07/14 07:57:37 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat

[2009/07/14 05:05:48 | 000,618,026 | ---- | C] () -- C:\Windows\System32\perfh009.dat

[2009/07/14 05:05:48 | 000,291,294 | ---- | C] () -- C:\Windows\System32\perfi009.dat

[2009/07/14 05:05:48 | 000,104,340 | ---- | C] () -- C:\Windows\System32\perfc009.dat

[2009/07/14 05:05:48 | 000,031,548 | ---- | C] () -- C:\Windows\System32\perfd009.dat

[2009/07/14 05:05:05 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT

[2009/07/14 05:04:11 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat

[2009/07/14 03:19:49 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe

[2009/07/14 02:55:01 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin

[2009/07/14 02:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll

[2009/07/14 02:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll

[2009/06/11 00:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat

[2008/02/07 10:05:18 | 000,163,840 | ---- | C] () -- C:\Windows\System32\hppatusg01.dll

========== LOP Check ==========

[2011/03/27 00:13:40 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\BSplayer

[2011/03/27 00:08:36 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\BSplayer Pro

[2011/03/17 11:27:41 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\DAEMON Tools Lite

[2011/06/02 21:30:38 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\uTorrent

[2011/05/25 10:24:34 | 000,032,616 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

========== Custom Scans ==========

< MD5 for: VOLSNAP.SYS >

[2009/07/14 04:19:10 | 000,245,328 | ---- | M] (Microsoft Corporation) MD5=58DF9D2481A56EDDE167E51B334D44FD -- C:\Windows\System32\DriverStore\FileRepository\volume.inf_x86_neutral_29364d30156a24ca\volsnap.sys

[2011/06/02 21:05:44 | 000,245,328 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\drivers\volsnap.sys

< End of report >

Отново ядец....останаха ми 3 възможности само....Надявам се не ви е писнало, но надежда все още има...

Да ги почваме: (ще ни трябва още един празен диск)

Следвайте инструкцията за работа с OTLPEStd:

• Изтеглете OTLPEStd.exe от линка по-долу и го запазете на десктопа на компютър с нормално функционираща операционна система.

  Изтегляне: OTLPEStd.exe (93.5 MB)

• Поставете празно CD в CD-ROM устройството и стартирайте OTLPEStd.exe. Така ще се запише CD с OTLPEStd.

• Направете така, че заразеният компютър да има CD за първо стартиращо устройство. Това става с настройки за реда на стартиране в BIOS. Ето как става: справка
• Поставете записаното CD с OTLPEStd в CD-ROM устройството на заразения компютър и рестартирайте
• Изчакайте този "Windows" да се зареди (REATOGO десктоп)
• Стартирайте OTLPE с двукратен клик на мишката върху иконата
• На въпроса: Do you wish to load the remote registry изберете Yes
• На въпроса: Do you wish to load the user profile(s) for scanning изберете Yes
• Маркирайте: Automatically Load All Remaining Users и натиснете ОК
• Ще се стартира OTL
• С Copy/ Paste под колонката Custom Scans/Fixes въведете скриптовия текст от текстовото поле по-долу, като не забравяте да копирате скрипта 1 към 1, както и двете точки преди първия ред на скрипта!

  :files
  C:\WINDOWS\system32\drivers\volsnap.sys|C:\Windows\System32\DriverStore\FileRepository\volume.inf_x86_neutral_29364d30156a24ca\volsnap.sys /Replace
  :commands
  [reboot]
  

• След като въведете скрипта от цитата по-горе натиснете бутона, маркиран в червено:
• Като приключи проверката, ще се създаде файл OTL.txt
• Пренесете файла OTL.txt на чист компютър (с USB флашка) и го прикачете в следващия си коментар (погледнете опцията "прикачени файлове", когато публикувате мнение)

Определено не мога да разбера как да влезна в това BIOS. Рестартирах компютъра преди малко, докато се стартираше не можах да видя какъв клавиш трябва да се натисне, може би защото не знам и къде да гледам. Предния път пробвах описаните в предишния линк клавиши и не стана. Освен това не разбрах и кога се натискат. При вече стартиран компютър,с курсор някъде из десктопа или докато се стартира... Да добавя, че компютъра е от 2006, дали въобще няма такава опция?

Редактирано 2 юни 201115 г. от Мордехай (преглед на промените)

Определено не мога да разбера как да влезна в това BIOS. Рестартирах компютъра преди малко, докато се стартираше не можах да видя какъв клавиш трябва да се натисне, може би защото не знам и къде да гледам. Предния път пробвах описаните в предишния линк клавиши и не стана. Освен това не разбрах и кога се натискат. При вече стартиран компютър,с курсор някъде из десктопа или докато се стартира...

Да добавя, че компютъра е от 2006, дали въобще няма такава опция?

Здравейте...всеки компютър има БИОС чип. Би трябвало да е нещо с F1, F2, F10, DEL, ESC...някои от тези клавиши трябва да припомпвате по време на рестарта на компютъра малко след пост скрийна:

Примерен POST SCREEN:

(обикновено на самия POST SCREEN е отбелязано с кой клавиш се влиза в БИОС менюто)...например в този случай (от снимката) се влиза с бутона DEL

Ако пак не се получи пробвайте директно да влезнете в BOOT менюто - с F8 или F12 и изберете да се стартира от CD.

Само едно уточнение. Този OTL файл, който ще се формира ще го кача на флашка, обаче не искам да използвам другия си компютър. При това положение какво трябва да направя, да рестартирам заразения компютър ли, за да мога пак да влезна в нета и да пиша?

Само едно уточнение. Този OTL файл, който ще се формира ще го кача на флашка, обаче не искам да използвам другия си компютър. При това положение какво трябва да направя, да рестартирам заразения компютър ли, за да мога пак да влезна в нета и да пиша?

Разбира се, че може (забравил съм да го уточня). Дано да сме се справили.

След рестарта публикувайте лог файла от OTL и пробвайте отново да стартирате TDSSKiller-a.

Ето резултата от опита с новата версия... 2011/06/17 13:53:51.0346 3588 TDSS rootkit removing tool 2.5.5.0 Jun 16 2011 15:25:15 2011/06/17 13:53:51.0534 3588 ================================================================================ 2011/06/17 13:53:51.0534 3588 SystemInfo: 2011/06/17 13:53:51.0534 3588 2011/06/17 13:53:51.0534 3588 OS Version: 6.1.7600 ServicePack: 0.0 2011/06/17 13:53:51.0534 3588 Product type: Workstation 2011/06/17 13:53:51.0534 3588 ComputerName: WIN-7O14P6VM5QV 2011/06/17 13:53:51.0534 3588 UserName: Administrator 2011/06/17 13:53:51.0534 3588 Windows directory: C:\Windows 2011/06/17 13:53:51.0534 3588 System windows directory: C:\Windows 2011/06/17 13:53:51.0534 3588 Processor architecture: Intel x86 2011/06/17 13:53:51.0534 3588 Number of processors: 1 2011/06/17 13:53:51.0534 3588 Page size: 0x1000 2011/06/17 13:53:51.0534 3588 Boot type: Normal boot 2011/06/17 13:53:51.0534 3588 ================================================================================ 2011/06/17 13:53:52.0268 3588 Initialize success 2011/06/17 13:54:08.0190 3592 ================================================================================ 2011/06/17 13:54:08.0190 3592 Scan started 2011/06/17 13:54:08.0190 3592 Mode: Manual; 2011/06/17 13:54:08.0190 3592 ================================================================================ 2011/06/17 13:54:09.0190 3592 1394ohci (6d2aca41739bfe8cb86ee8e85f29697d) C:\Windows\system32\DRIVERS\1394ohci.sys 2011/06/17 13:54:09.0284 3592 ACPI (f0e07d144c8685b8774bc32fc8da4df0) C:\Windows\system32\DRIVERS\ACPI.sys 2011/06/17 13:54:09.0346 3592 AcpiPmi (98d81ca942d19f7d9153b095162ac013) C:\Windows\system32\DRIVERS\acpipmi.sys 2011/06/17 13:54:09.0424 3592 adp94xx (21e785ebd7dc90a06391141aac7892fb) C:\Windows\system32\DRIVERS\adp94xx.sys 2011/06/17 13:54:09.0518 3592 adpahci (0c676bc278d5b59ff5abd57bbe9123f2) C:\Windows\system32\DRIVERS\adpahci.sys 2011/06/17 13:54:09.0596 3592 adpu320 (7c7b5ee4b7b822ec85321fe23a27db33) C:\Windows\system32\DRIVERS\adpu320.sys 2011/06/17 13:54:09.0690 3592 AFD (ddc040fdb01ef1712a6b13e52afb104c) C:\Windows\system32\drivers\afd.sys 2011/06/17 13:54:09.0768 3592 agp440 (507812c3054c21cef746b6ee3d04dd6e) C:\Windows\system32\DRIVERS\agp440.sys 2011/06/17 13:54:09.0846 3592 aic78xx (8b30250d573a8f6b4bd23195160d8707) C:\Windows\system32\DRIVERS\djsvs.sys 2011/06/17 13:54:10.0002 3592 ALCXWDM (7997b6f02cbda0e31fa18cc85871b938) C:\Windows\system32\drivers\RTKVAC.SYS 2011/06/17 13:54:10.0237 3592 aliide (0d40bcf52ea90fc7df2aeab6503dea44) C:\Windows\system32\DRIVERS\aliide.sys 2011/06/17 13:54:10.0315 3592 amdagp (3c6600a0696e90a463771c7422e23ab5) C:\Windows\system32\DRIVERS\amdagp.sys 2011/06/17 13:54:10.0377 3592 amdide (cd5914170297126b6266860198d1d4f0) C:\Windows\system32\DRIVERS\amdide.sys 2011/06/17 13:54:10.0471 3592 AmdK8 (00dda200d71bac534bf56a9db5dfd666) C:\Windows\system32\DRIVERS\amdk8.sys 2011/06/17 13:54:10.0534 3592 AmdPPM (3cbf30f5370fda40dd3e87df38ea53b6) C:\Windows\system32\DRIVERS\amdppm.sys 2011/06/17 13:54:10.0596 3592 amdsata (2101a86c25c154f8314b24ef49d7fbc2) C:\Windows\system32\DRIVERS\amdsata.sys 2011/06/17 13:54:10.0659 3592 amdsbs (ea43af0c423ff267355f74e7a53bdaba) C:\Windows\system32\DRIVERS\amdsbs.sys 2011/06/17 13:54:10.0737 3592 amdxata (b81c2b5616f6420a9941ea093a92b150) C:\Windows\system32\DRIVERS\amdxata.sys 2011/06/17 13:54:10.0799 3592 AppID (feb834c02ce1e84b6a38f953ca067706) C:\Windows\system32\drivers\appid.sys 2011/06/17 13:54:10.0893 3592 arc (2932004f49677bd84dbc72edb754ffb3) C:\Windows\system32\DRIVERS\arc.sys 2011/06/17 13:54:10.0956 3592 arcsas (5d6f36c46fd283ae1b57bd2e9feb0bc7) C:\Windows\system32\DRIVERS\arcsas.sys 2011/06/17 13:54:11.0018 3592 AsyncMac (add2ade1c2b285ab8378d2daaf991481) C:\Windows\system32\DRIVERS\asyncmac.sys 2011/06/17 13:54:11.0049 3592 atapi (338c86357871c167a96ab976519bf59e) C:\Windows\system32\DRIVERS\atapi.sys 2011/06/17 13:54:11.0143 3592 avgntflt (47b879406246ffdced59e18d331a0e7d) C:\Windows\system32\DRIVERS\avgntflt.sys 2011/06/17 13:54:11.0221 3592 avipbb (5fedef54757b34fb611b9ec8fb399364) C:\Windows\system32\DRIVERS\avipbb.sys 2011/06/17 13:54:11.0299 3592 b06bdrv (1a231abec60fd316ec54c66715543cec) C:\Windows\system32\DRIVERS\bxvbdx.sys 2011/06/17 13:54:11.0377 3592 b57nd60x (bd8869eb9cde6bbe4508d869929869ee) C:\Windows\system32\DRIVERS\b57nd60x.sys 2011/06/17 13:54:11.0471 3592 Beep (505506526a9d467307b3c393dedaf858) C:\Windows\system32\drivers\Beep.sys 2011/06/17 13:54:11.0549 3592 blbdrive (2287078ed48fcfc477b05b20cf38f36f) C:\Windows\system32\DRIVERS\blbdrive.sys 2011/06/17 13:54:11.0627 3592 bowser (fcafaef6798d7b51ff029f99a9898961) C:\Windows\system32\DRIVERS\bowser.sys 2011/06/17 13:54:11.0674 3592 BrFiltLo (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\DRIVERS\BrFiltLo.sys 2011/06/17 13:54:11.0737 3592 BrFiltUp (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\DRIVERS\BrFiltUp.sys 2011/06/17 13:54:11.0799 3592 Brserid (845b8ce732e67f3b4133164868c666ea) C:\Windows\System32\Drivers\Brserid.sys 2011/06/17 13:54:11.0877 3592 BrSerWdm (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\System32\Drivers\BrSerWdm.sys 2011/06/17 13:54:11.0924 3592 BrUsbMdm (bd456606156ba17e60a04e18016ae54b) C:\Windows\System32\Drivers\BrUsbMdm.sys 2011/06/17 13:54:11.0987 3592 BrUsbSer (af72ed54503f717a43268b3cc5faec2e) C:\Windows\System32\Drivers\BrUsbSer.sys 2011/06/17 13:54:12.0049 3592 BTHMODEM (ed3df7c56ce0084eb2034432fc56565a) C:\Windows\system32\DRIVERS\bthmodem.sys 2011/06/17 13:54:12.0284 3592 cdfs (77ea11b065e0a8ab902d78145ca51e10) C:\Windows\system32\DRIVERS\cdfs.sys 2011/06/17 13:54:12.0377 3592 cdrom (656d1ec977e3c5316a62dbbe52cb9663) C:\Windows\system32\DRIVERS\cdrom.sys 2011/06/17 13:54:12.0440 3592 circlass (3fe3fe94a34df6fb06e6418d0f6a0060) C:\Windows\system32\DRIVERS\circlass.sys 2011/06/17 13:54:12.0534 3592 CLFS (635181e0e9bbf16871bf5380d71db02d) C:\Windows\system32\CLFS.sys 2011/06/17 13:54:12.0581 3592 CmBatt (dea805815e587dad1dd2c502220b5616) C:\Windows\system32\DRIVERS\CmBatt.sys 2011/06/17 13:54:12.0659 3592 cmdide (c537b1db64d495b9b4717b4d6d9edbf2) C:\Windows\system32\DRIVERS\cmdide.sys 2011/06/17 13:54:12.0737 3592 CNG (1b675691ed940766149c93e8f4488d68) C:\Windows\system32\Drivers\cng.sys 2011/06/17 13:54:12.0784 3592 Compbatt (a6023d3823c37043986713f118a89bee) C:\Windows\system32\DRIVERS\compbatt.sys 2011/06/17 13:54:12.0862 3592 CompositeBus (f1724ba27e97d627f808fb0ba77a28a6) C:\Windows\system32\DRIVERS\CompositeBus.sys 2011/06/17 13:54:12.0940 3592 crcdisk (2c4ebcfc84a9b44f209dff6c6e6c61d1) C:\Windows\system32\DRIVERS\crcdisk.sys 2011/06/17 13:54:13.0049 3592 CSC (27c9490bdd0ae48911ab8cf1932591ed) C:\Windows\system32\drivers\csc.sys 2011/06/17 13:54:13.0174 3592 DfsC (8e09e52ee2e3ceb199ef3dd99cf9e3fb) C:\Windows\system32\Drivers\dfsc.sys 2011/06/17 13:54:13.0237 3592 discache (1a050b0274bfb3890703d490f330c0da) C:\Windows\system32\drivers\discache.sys 2011/06/17 13:54:13.0299 3592 Disk (565003f326f99802e68ca78f2a68e9ff) C:\Windows\system32\DRIVERS\disk.sys 2011/06/17 13:54:13.0409 3592 drmkaud (b918e7c5f9bf77202f89e1a9539f2eb4) C:\Windows\system32\drivers\drmkaud.sys 2011/06/17 13:54:13.0502 3592 DXGKrnl (00825c07d5df96af2280d1c4f94c7d57) C:\Windows\System32\drivers\dxgkrnl.sys 2011/06/17 13:54:13.0659 3592 ebdrv (024e1b5cac09731e4d868e64dbfb4ab0) C:\Windows\system32\DRIVERS\evbdx.sys 2011/06/17 13:54:13.0846 3592 elxstor (0ed67910c8c326796faa00b2bf6d9d3c) C:\Windows\system32\DRIVERS\elxstor.sys 2011/06/17 13:54:13.0956 3592 ErrDev (8fc3208352dd3912c94367a206ab3f11) C:\Windows\system32\DRIVERS\errdev.sys 2011/06/17 13:54:14.0049 3592 exfat (2dc9108d74081149cc8b651d3a26207f) C:\Windows\system32\drivers\exfat.sys 2011/06/17 13:54:14.0143 3592 fastfat (7e0ab74553476622fb6ae36f73d97d35) C:\Windows\system32\drivers\fastfat.sys 2011/06/17 13:54:14.0206 3592 fasttx2k (8958fc7f2df3c4f0a363a8644583485c) C:\Windows\system32\DRIVERS\fasttx2k.sys 2011/06/17 13:54:14.0284 3592 fdc (e817a017f82df2a1f8cfdbda29388b29) C:\Windows\system32\DRIVERS\fdc.sys 2011/06/17 13:54:14.0362 3592 FileInfo (6cf00369c97f3cf563be99be983d13d8) C:\Windows\system32\drivers\fileinfo.sys 2011/06/17 13:54:14.0424 3592 Filetrace (42c51dc94c91da21cb9196eb64c45db9) C:\Windows\system32\drivers\filetrace.sys 2011/06/17 13:54:14.0471 3592 flpydisk (87907aa70cb3c56600f1c2fb8841579b) C:\Windows\system32\DRIVERS\flpydisk.sys 2011/06/17 13:54:14.0534 3592 FltMgr (7520ec808e0c35e0ee6f841294316653) C:\Windows\system32\drivers\fltmgr.sys 2011/06/17 13:54:14.0612 3592 FsDepends (1a16b57943853e598cff37fe2b8cbf1d) C:\Windows\system32\drivers\FsDepends.sys 2011/06/17 13:54:14.0690 3592 Fs_Rec (a574b4360e438977038aae4bf60d79a2) C:\Windows\system32\drivers\Fs_Rec.sys 2011/06/17 13:54:14.0752 3592 gagp30kx (65ee0c7a58b65e74ae05637418153938) C:\Windows\system32\DRIVERS\gagp30kx.sys 2011/06/17 13:54:14.0893 3592 hcw85cir (c44e3c2bab6837db337ddee7544736db) C:\Windows\system32\drivers\hcw85cir.sys 2011/06/17 13:54:14.0987 3592 HDAudBus (717a2207fd6f13ad3e664c7d5a43c7bf) C:\Windows\system32\DRIVERS\HDAudBus.sys 2011/06/17 13:54:15.0049 3592 HidBatt (1d58a7f3e11a9731d0eaaaa8405acc36) C:\Windows\system32\DRIVERS\HidBatt.sys 2011/06/17 13:54:15.0112 3592 HidBth (89448f40e6df260c206a193a4683ba78) C:\Windows\system32\DRIVERS\hidbth.sys 2011/06/17 13:54:15.0174 3592 HidIr (cf50b4cf4a4f229b9f3c08351f99ca5e) C:\Windows\system32\DRIVERS\hidir.sys 2011/06/17 13:54:15.0252 3592 HidUsb (25072fb35ac90b25f9e4e3bacf774102) C:\Windows\system32\DRIVERS\hidusb.sys 2011/06/17 13:54:15.0315 3592 HpSAMD (295fdc419039090eb8b49ffdbb374549) C:\Windows\system32\DRIVERS\HpSAMD.sys 2011/06/17 13:54:15.0409 3592 HTTP (c531c7fd9e8b62021112787c4e2c5a5a) C:\Windows\system32\drivers\HTTP.sys 2011/06/17 13:54:15.0518 3592 hwpolicy (8305f33cde89ad6c7a0763ed0b5a8d42) C:\Windows\system32\drivers\hwpolicy.sys 2011/06/17 13:54:15.0565 3592 i8042prt (f151f0bdc47f4a28b1b20a0818ea36d6) C:\Windows\system32\DRIVERS\i8042prt.sys 2011/06/17 13:54:15.0627 3592 iaNvStor (89a5bf70f2f23f502f4b87aa38b7eb74) C:\Windows\system32\DRIVERS\iaNvStor.sys 2011/06/17 13:54:15.0690 3592 iaStor (71ecc07bc7c5e24c3dd01d8a29a24054) C:\Windows\system32\DRIVERS\iaStor.sys 2011/06/17 13:54:15.0768 3592 iaStorV (934af4d7c5f457b9f0743f4299b77b67) C:\Windows\system32\DRIVERS\iaStorV.sys 2011/06/17 13:54:15.0831 3592 iirsp (4173ff5708f3236cf25195fecd742915) C:\Windows\system32\DRIVERS\iirsp.sys 2011/06/17 13:54:15.0924 3592 intelide (a0f12f2c9ba6c72f3987ce780e77c130) C:\Windows\system32\DRIVERS\intelide.sys 2011/06/17 13:54:15.0987 3592 intelppm (3b514d27bfc4accb4037bc6685f766e0) C:\Windows\system32\DRIVERS\intelppm.sys 2011/06/17 13:54:16.0096 3592 IPMIDRV (e4454b6c37d7ffd5649611f6496308a7) C:\Windows\system32\DRIVERS\IPMIDrv.sys 2011/06/17 13:54:16.0174 3592 IPNAT (a5fa468d67abcdaa36264e463a7bb0cd) C:\Windows\system32\drivers\ipnat.sys 2011/06/17 13:54:16.0252 3592 IRENUM (42996cff20a3084a56017b7902307e9f) C:\Windows\system32\drivers\irenum.sys 2011/06/17 13:54:16.0331 3592 isapnp (1f32bb6b38f62f7df1a7ab7292638a35) C:\Windows\system32\DRIVERS\isapnp.sys 2011/06/17 13:54:16.0393 3592 iScsiPrt (ed46c223ae46c6866ab77cdc41c404b7) C:\Windows\system32\DRIVERS\msiscsi.sys 2011/06/17 13:54:16.0471 3592 JRAID (c1632fe31d1824a43dea29725312e3fa) C:\Windows\system32\DRIVERS\jraid.sys 2011/06/17 13:54:16.0534 3592 kbdclass (adef52ca1aeae82b50df86b56413107e) C:\Windows\system32\DRIVERS\kbdclass.sys 2011/06/17 13:54:16.0596 3592 kbdhid (3d9f0ebf350edcfd6498057301455964) C:\Windows\system32\DRIVERS\kbdhid.sys 2011/06/17 13:54:16.0690 3592 KSecDD (e36a061ec11b373826905b21be10948f) C:\Windows\system32\Drivers\ksecdd.sys 2011/06/17 13:54:16.0752 3592 KSecPkg (26c046977e85b95036453d7b88ba1820) C:\Windows\system32\Drivers\ksecpkg.sys 2011/06/17 13:54:16.0846 3592 lltdio (f7611ec07349979da9b0ae1f18ccc7a6) C:\Windows\system32\DRIVERS\lltdio.sys 2011/06/17 13:54:16.0940 3592 LSI_FC (eb119a53ccf2acc000ac71b065b78fef) C:\Windows\system32\DRIVERS\lsi_fc.sys 2011/06/17 13:54:17.0002 3592 LSI_SAS (8ade1c877256a22e49b75d1cc9161f9c) C:\Windows\system32\DRIVERS\lsi_sas.sys 2011/06/17 13:54:17.0065 3592 LSI_SAS2 (dc9dc3d3daa0e276fd2ec262e38b11e9) C:\Windows\system32\DRIVERS\lsi_sas2.sys 2011/06/17 13:54:17.0127 3592 LSI_SCSI (0a036c7d7cab643a7f07135ac47e0524) C:\Windows\system32\DRIVERS\lsi_scsi.sys 2011/06/17 13:54:17.0174 3592 luafv (6703e366cc18d3b6e534f5cf7df39cee) C:\Windows\system32\drivers\luafv.sys 2011/06/17 13:54:17.0237 3592 MBAMSwissArmy (b309912717c29fc67e1ba4730a82b6dd) C:\Windows\system32\drivers\mbamswissarmy.sys 2011/06/17 13:54:17.0299 3592 mcdbus (8fd868e32459ece2a1bb0169f513d31e) C:\Windows\system32\DRIVERS\mcdbus.sys 2011/06/17 13:54:17.0393 3592 megasas (0fff5b045293002ab38eb1fd1fc2fb74) C:\Windows\system32\DRIVERS\megasas.sys 2011/06/17 13:54:17.0471 3592 MegaSR (dcbab2920c75f390caf1d29f675d03d6) C:\Windows\system32\DRIVERS\MegaSR.sys 2011/06/17 13:54:17.0565 3592 Modem (f001861e5700ee84e2d4e52c712f4964) C:\Windows\system32\drivers\modem.sys 2011/06/17 13:54:17.0627 3592 monitor (79d10964de86b292320e9dfe02282a23) C:\Windows\system32\DRIVERS\monitor.sys 2011/06/17 13:54:17.0674 3592 mouclass (fb18cc1d4c2e716b6b903b0ac0cc0609) C:\Windows\system32\DRIVERS\mouclass.sys 2011/06/17 13:54:17.0737 3592 mouhid (2c388d2cd01c9042596cf3c8f3c7b24d) C:\Windows\system32\DRIVERS\mouhid.sys 2011/06/17 13:54:17.0799 3592 mountmgr (921c18727c5920d6c0300736646931c2) C:\Windows\system32\drivers\mountmgr.sys 2011/06/17 13:54:17.0846 3592 mpio (2af5997438c55fb79d33d015c30e1974) C:\Windows\system32\DRIVERS\mpio.sys 2011/06/17 13:54:17.0909 3592 mpsdrv (ad2723a7b53dd1aacae6ad8c0bfbf4d0) C:\Windows\system32\drivers\mpsdrv.sys 2011/06/17 13:54:18.0002 3592 MRxDAV (b1be47008d20e43da3adc37c24cdb89d) C:\Windows\system32\drivers\mrxdav.sys 2011/06/17 13:54:18.0081 3592 mrxsmb (f1b6aa08497ea86ca6ef6f7a08b0bfb8) C:\Windows\system32\DRIVERS\mrxsmb.sys 2011/06/17 13:54:18.0143 3592 mrxsmb10 (5613358b4050f46f5a9832da8050d6e4) C:\Windows\system32\DRIVERS\mrxsmb10.sys 2011/06/17 13:54:18.0190 3592 mrxsmb20 (25c9792778d80feb4c8201e62281bfdf) C:\Windows\system32\DRIVERS\mrxsmb20.sys 2011/06/17 13:54:18.0237 3592 msahci (4326d168944123f38dd3b2d9c37a0b12) C:\Windows\system32\DRIVERS\msahci.sys 2011/06/17 13:54:18.0315 3592 msdsm (455029c7174a2dbb03dba8a0d8bddd9a) C:\Windows\system32\DRIVERS\msdsm.sys 2011/06/17 13:54:18.0377 3592 Msfs (daefb28e3af5a76abcc2c3078c07327f) C:\Windows\system32\drivers\Msfs.sys 2011/06/17 13:54:18.0440 3592 mshidkmdf (3e1e5767043c5af9367f0056295e9f84) C:\Windows\System32\drivers\mshidkmdf.sys 2011/06/17 13:54:18.0487 3592 msisadrv (0a4e5757ae09fa9622e3158cc1aef114) C:\Windows\system32\DRIVERS\msisadrv.sys 2011/06/17 13:54:18.0565 3592 MSKSSRV (8c0860d6366aaffb6c5bb9df9448e631) C:\Windows\system32\drivers\MSKSSRV.sys 2011/06/17 13:54:18.0627 3592 MSPCLOCK (3ea8b949f963562cedbb549eac0c11ce) C:\Windows\system32\drivers\MSPCLOCK.sys 2011/06/17 13:54:18.0690 3592 MSPQM (f456e973590d663b1073e9c463b40932) C:\Windows\system32\drivers\MSPQM.sys 2011/06/17 13:54:18.0752 3592 MsRPC (0e008fc4819d238c51d7c93e7b41e560) C:\Windows\system32\drivers\MsRPC.sys 2011/06/17 13:54:18.0815 3592 mssmbios (fc6b9ff600cc585ea38b12589bd4e246) C:\Windows\system32\DRIVERS\mssmbios.sys 2011/06/17 13:54:18.0862 3592 MSTEE (b42c6b921f61a6e55159b8be6cd54a36) C:\Windows\system32\drivers\MSTEE.sys 2011/06/17 13:54:18.0940 3592 MTConfig (33599130f44e1f34631cea241de8ac84) C:\Windows\system32\DRIVERS\MTConfig.sys 2011/06/17 13:54:19.0002 3592 MTsensor (d48659bb24c48345d926ecb45c1ebdf5) C:\Windows\system32\DRIVERS\ASACPI.sys 2011/06/17 13:54:19.0096 3592 Mup (159fad02f64e6381758c990f753bcc80) C:\Windows\system32\Drivers\mup.sys 2011/06/17 13:54:19.0190 3592 NativeWifiP (26384429fcd85d83746f63e798ab1480) C:\Windows\system32\DRIVERS\nwifi.sys 2011/06/17 13:54:19.0284 3592 NDIS (779e9149d3662ed6beb58a67e3c775f4) C:\Windows\system32\drivers\ndis.sys 2011/06/17 13:54:19.0377 3592 NdisCap (0e1787aa6c9191d3d319e8bafe86f80c) C:\Windows\system32\DRIVERS\ndiscap.sys 2011/06/17 13:54:19.0424 3592 NdisTapi (e4a8aec125a2e43a9e32afeea7c9c888) C:\Windows\system32\DRIVERS\ndistapi.sys 2011/06/17 13:54:19.0487 3592 Ndisuio (b30ae7f2b6d7e343b0df32e6c08fce75) C:\Windows\system32\DRIVERS\ndisuio.sys 2011/06/17 13:54:19.0518 3592 NdisWan (267c415eadcbe53c9ca873dee39cf3a4) C:\Windows\system32\DRIVERS\ndiswan.sys 2011/06/17 13:54:19.0596 3592 NDProxy (af7e7c63dcef3f8772726f86039d6eb4) C:\Windows\system32\drivers\NDProxy.sys 2011/06/17 13:54:19.0674 3592 NetBIOS (80b275b1ce3b0e79909db7b39af74d51) C:\Windows\system32\DRIVERS\netbios.sys 2011/06/17 13:54:19.0706 3592 NetBT (dd52a733bf4ca5af84562a5e2f963b91) C:\Windows\system32\DRIVERS\netbt.sys 2011/06/17 13:54:19.0784 3592 nfrd960 (1d85c4b390b0ee09c7a46b91efb2c097) C:\Windows\system32\DRIVERS\nfrd960.sys 2011/06/17 13:54:19.0862 3592 Npfs (1db262a9f8c087e8153d89bef3d2235f) C:\Windows\system32\drivers\Npfs.sys 2011/06/17 13:54:19.0924 3592 nsiproxy (e9a0a4d07e53d8fea2bb8387a3293c58) C:\Windows\system32\drivers\nsiproxy.sys 2011/06/17 13:54:20.0018 3592 Ntfs (3795dcd21f740ee799fb7223234215af) C:\Windows\system32\drivers\Ntfs.sys 2011/06/17 13:54:20.0112 3592 Null (f9756a98d69098dca8945d62858a812c) C:\Windows\system32\drivers\Null.sys 2011/06/17 13:54:20.0190 3592 NVENETFD (b5e37e31c053bc9950455a257526514b) C:\Windows\system32\DRIVERS\nvm62x32.sys 2011/06/17 13:54:20.0471 3592 nvlddmkm (8b75f652726a2ba3197860f300514e3f) C:\Windows\system32\DRIVERS\nvlddmkm.sys 2011/06/17 13:54:20.0815 3592 nvmpu401 (14f4170aed9e5ff012d8731d7b32ecdb) C:\Windows\system32\drivers\nvmpu401.sys 2011/06/17 13:54:20.0893 3592 nvraid (3f3d04b1d08d43c16ea7963954ec768d) C:\Windows\system32\DRIVERS\nvraid.sys 2011/06/17 13:54:20.0971 3592 nvstor (c99f251a5de63c6f129cf71933aced0f) C:\Windows\system32\DRIVERS\nvstor.sys 2011/06/17 13:54:21.0049 3592 nv_agp (5a0983915f02bae73267cc2a041f717d) C:\Windows\system32\DRIVERS\nv_agp.sys 2011/06/17 13:54:21.0127 3592 ohci1394 (08a70a1f2cdde9bb49b885cb817a66eb) C:\Windows\system32\DRIVERS\ohci1394.sys 2011/06/17 13:54:21.0237 3592 Parport (2ea877ed5dd9713c5ac74e8ea7348d14) C:\Windows\system32\DRIVERS\parport.sys 2011/06/17 13:54:21.0299 3592 partmgr (ff4218952b51de44fe910953a3e686b9) C:\Windows\system32\drivers\partmgr.sys 2011/06/17 13:54:21.0377 3592 Parvdm (eb0a59f29c19b86479d36b35983daadc) C:\Windows\system32\DRIVERS\parvdm.sys 2011/06/17 13:54:21.0456 3592 pci (c858cb77c577780ecc456a892e7e7d0f) C:\Windows\system32\DRIVERS\pci.sys 2011/06/17 13:54:21.0518 3592 pciide (afe86f419014db4e5593f69ffe26ce0a) C:\Windows\system32\DRIVERS\pciide.sys 2011/06/17 13:54:21.0581 3592 pcmcia (f396431b31693e71e8a80687ef523506) C:\Windows\system32\DRIVERS\pcmcia.sys 2011/06/17 13:54:21.0643 3592 pcw (250f6b43d2b613172035c6747aeeb19f) C:\Windows\system32\drivers\pcw.sys 2011/06/17 13:54:21.0706 3592 PEAUTH (9e0104ba49f4e6973749a02bf41344ed) C:\Windows\system32\drivers\peauth.sys 2011/06/17 13:54:21.0909 3592 PptpMiniport (631e3e205ad6d86f2aed6a4a8e69f2db) C:\Windows\system32\DRIVERS\raspptp.sys 2011/06/17 13:54:22.0002 3592 Processor (85b1e3a0c7585bc4aae6899ec6fcf011) C:\Windows\system32\DRIVERS\processr.sys 2011/06/17 13:54:22.0127 3592 Psched (6270ccae2a86de6d146529fe55b3246a) C:\Windows\system32\DRIVERS\pacer.sys 2011/06/17 13:54:22.0221 3592 ql2300 (ab95ecf1f6659a60ddc166d8315b0751) C:\Windows\system32\DRIVERS\ql2300.sys 2011/06/17 13:54:22.0377 3592 ql40xx (b4dd51dd25182244b86737dc51af2270) C:\Windows\system32\DRIVERS\ql40xx.sys 2011/06/17 13:54:22.0456 3592 QWAVEdrv (584078ca1b95ca72df2a27c336f9719d) C:\Windows\system32\drivers\qwavedrv.sys 2011/06/17 13:54:22.0502 3592 RasAcd (30a81b53c766d0133bb86d234e5556ab) C:\Windows\system32\DRIVERS\rasacd.sys 2011/06/17 13:54:22.0581 3592 RasAgileVpn (57ec4aef73660166074d8f7f31c0d4fd) C:\Windows\system32\DRIVERS\AgileVpn.sys 2011/06/17 13:54:22.0674 3592 Rasl2tp (d9f91eafec2815365cbe6d167e4e332a) C:\Windows\system32\DRIVERS\rasl2tp.sys 2011/06/17 13:54:22.0752 3592 RasPppoe (0fe8b15916307a6ac12bfb6a63e45507) C:\Windows\system32\DRIVERS\raspppoe.sys 2011/06/17 13:54:22.0831 3592 RasSstp (44101f495a83ea6401d886e7fd70096b) C:\Windows\system32\DRIVERS\rassstp.sys 2011/06/17 13:54:22.0924 3592 rdbss (835d7e81bf517a3b72384bdcc85e1ce6) C:\Windows\system32\DRIVERS\rdbss.sys 2011/06/17 13:54:22.0971 3592 rdpbus (0d8f05481cb76e70e1da06ee9f0da9df) C:\Windows\system32\DRIVERS\rdpbus.sys 2011/06/17 13:54:23.0065 3592 RDPCDD (1e016846895b15a99f9a176a05029075) C:\Windows\system32\DRIVERS\RDPCDD.sys 2011/06/17 13:54:23.0159 3592 RDPENCDD (5a53ca1598dd4156d44196d200c94b8a) C:\Windows\system32\drivers\rdpencdd.sys 2011/06/17 13:54:23.0206 3592 RDPREFMP (44b0a53cd4f27d50ed461dae0c0b4e1f) C:\Windows\system32\drivers\rdprefmp.sys 2011/06/17 13:54:23.0268 3592 RDPWD (801371ba9782282892d00aadb08ee367) C:\Windows\system32\drivers\RDPWD.sys 2011/06/17 13:54:23.0346 3592 rdyboost (4ea225bf1cf05e158853f30a99ca29a7) C:\Windows\system32\drivers\rdyboost.sys 2011/06/17 13:54:23.0456 3592 rspndr (032b0d36ad92b582d869879f5af5b928) C:\Windows\system32\DRIVERS\rspndr.sys 2011/06/17 13:54:23.0534 3592 s3cap (5423d8437051e89dd34749f242c98648) C:\Windows\system32\DRIVERS\vms3cap.sys 2011/06/17 13:54:23.0627 3592 sbp2port (34ee0c44b724e3e4ce2eff29126de5b5) C:\Windows\system32\DRIVERS\sbp2port.sys 2011/06/17 13:54:23.0721 3592 scfilter (a95c54b2ac3cc9c73fcdf9e51a1d6b51) C:\Windows\system32\DRIVERS\scfilter.sys 2011/06/17 13:54:23.0831 3592 secdrv (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys 2011/06/17 13:54:23.0924 3592 Serenum (9ad8b8b515e3df6acd4212ef465de2d1) C:\Windows\system32\DRIVERS\serenum.sys 2011/06/17 13:54:24.0002 3592 Serial (5fb7fcea0490d821f26f39cc5ea3d1e2) C:\Windows\system32\DRIVERS\serial.sys 2011/06/17 13:54:24.0081 3592 sermouse (79bffb520327ff916a582dfea17aa813) C:\Windows\system32\DRIVERS\sermouse.sys 2011/06/17 13:54:24.0174 3592 sffdisk (9f976e1eb233df46fce808d9dea3eb9c) C:\Windows\system32\DRIVERS\sffdisk.sys 2011/06/17 13:54:24.0252 3592 sffp_mmc (932a68ee27833cfd57c1639d375f2731) C:\Windows\system32\DRIVERS\sffp_mmc.sys 2011/06/17 13:54:24.0331 3592 sffp_sd (4f1e5b0fe7c8050668dbfade8999aefb) C:\Windows\system32\DRIVERS\sffp_sd.sys 2011/06/17 13:54:24.0377 3592 sfloppy (db96666cc8312ebc45032f30b007a547) C:\Windows\system32\DRIVERS\sfloppy.sys 2011/06/17 13:54:24.0471 3592 sisagp (2565cac0dc9fe0371bdce60832582b2e) C:\Windows\system32\DRIVERS\sisagp.sys 2011/06/17 13:54:24.0565 3592 SiSRaid2 (a9f0486851becb6dda1d89d381e71055) C:\Windows\system32\DRIVERS\SiSRaid2.sys 2011/06/17 13:54:24.0643 3592 SiSRaid4 (3727097b55738e2f554972c3be5bc1aa) C:\Windows\system32\DRIVERS\sisraid4.sys 2011/06/17 13:54:24.0721 3592 Smb (3e21c083b8a01cb70ba1f09303010fce) C:\Windows\system32\DRIVERS\smb.sys 2011/06/17 13:54:24.0799 3592 spldr (95cf1ae7527fb70f7816563cbc09d942) C:\Windows\system32\drivers\spldr.sys 2011/06/17 13:54:24.0924 3592 sptd (d15da1ba189770d93eea2d7e18f95af9) C:\Windows\system32\Drivers\sptd.sys 2011/06/17 13:54:24.0924 3592 Suspicious file (NoAccess): C:\Windows\system32\Drivers\sptd.sys. md5: d15da1ba189770d93eea2d7e18f95af9 2011/06/17 13:54:24.0940 3592 sptd - detected LockedFile.Multi.Generic (1) 2011/06/17 13:54:25.0002 3592 srv (dd0dd124d95390fdffa7fb6283923ed4) C:\Windows\system32\DRIVERS\srv.sys 2011/06/17 13:54:25.0096 3592 srv2 (59ef6d9c690e89d51b0692ccb13a06fc) C:\Windows\system32\DRIVERS\srv2.sys 2011/06/17 13:54:25.0159 3592 srvnet (08f28676802b58138e48a2b40caf6204) C:\Windows\system32\DRIVERS\srvnet.sys 2011/06/17 13:54:25.0252 3592 ssmdrv (a36ee93698802cd899f98bfd553d8185) C:\Windows\system32\DRIVERS\ssmdrv.sys 2011/06/17 13:54:25.0331 3592 stexstor (db32d325c192b801df274bfd12a7e72b) C:\Windows\system32\DRIVERS\stexstor.sys 2011/06/17 13:54:25.0393 3592 storflt (957e346ca948668f2496a6ccf6ff82cc) C:\Windows\system32\DRIVERS\vmstorfl.sys 2011/06/17 13:54:25.0456 3592 storvsc (d5751969dc3e4b88bf482ac8ec9fe019) C:\Windows\system32\DRIVERS\storvsc.sys 2011/06/17 13:54:25.0502 3592 swenum (e58c78a848add9610a4db6d214af5224) C:\Windows\system32\DRIVERS\swenum.sys 2011/06/17 13:54:25.0643 3592 Tcpip (bb7f39c31c4a4417fd318e7cd184e225) C:\Windows\system32\drivers\tcpip.sys 2011/06/17 13:54:25.0768 3592 TCPIP6 (bb7f39c31c4a4417fd318e7cd184e225) C:\Windows\system32\DRIVERS\tcpip.sys 2011/06/17 13:54:25.0846 3592 tcpipreg (e64444523add154f86567c469bc0b17f) C:\Windows\system32\drivers\tcpipreg.sys 2011/06/17 13:54:25.0909 3592 TDPIPE (1875c1490d99e70e449e3afae9fcbadf) C:\Windows\system32\drivers\tdpipe.sys 2011/06/17 13:54:25.0971 3592 TDTCP (7551e91ea999ee9a8e9c331d5a9c31f3) C:\Windows\system32\drivers\tdtcp.sys 2011/06/17 13:54:26.0034 3592 tdx (cb39e896a2a83702d1737bfd402b3542) C:\Windows\system32\DRIVERS\tdx.sys 2011/06/17 13:54:26.0112 3592 TermDD (c36f41ee20e6999dbf4b0425963268a5) C:\Windows\system32\DRIVERS\termdd.sys 2011/06/17 13:54:26.0252 3592 tssecsrv (98ae6fa07d12cb4ec5cf4a9bfa5f4242) C:\Windows\system32\DRIVERS\tssecsrv.sys 2011/06/17 13:54:26.0362 3592 tunnel (3e461d890a97f9d4c168f5fda36e1d00) C:\Windows\system32\DRIVERS\tunnel.sys 2011/06/17 13:54:26.0440 3592 uagp35 (750fbcb269f4d7dd2e420c56b795db6d) C:\Windows\system32\DRIVERS\uagp35.sys 2011/06/17 13:54:26.0502 3592 udfs (09cc3e16f8e5ee7168e01cf8fcbe061a) C:\Windows\system32\DRIVERS\udfs.sys 2011/06/17 13:54:26.0596 3592 uliagpkx (44e8048ace47befbfdc2e9be4cbc8880) C:\Windows\system32\DRIVERS\uliagpkx.sys 2011/06/17 13:54:26.0659 3592 umbus (71bbf3e8078d585abf27411a8986eb95) C:\Windows\system32\DRIVERS\umbus.sys 2011/06/17 13:54:26.0737 3592 UmPass (7550ad0c6998ba1cb4843e920ee0feac) C:\Windows\system32\DRIVERS\umpass.sys 2011/06/17 13:54:26.0815 3592 usbccgp (8455c4ed038efd09e99327f9d2d48ffa) C:\Windows\system32\DRIVERS\usbccgp.sys 2011/06/17 13:54:26.0877 3592 usbehci (ff32d4f3ec3c68b2ca61782c7964f54e) C:\Windows\system32\drivers\usbehci.sys 2011/06/17 13:54:26.0940 3592 usbhub (b0dfc7b484e0ca0c27bda5433b82d94a) C:\Windows\system32\drivers\usbhub.sys 2011/06/17 13:54:27.0018 3592 usbohci (a6fb7957ea7afb1165991e54ce934b74) C:\Windows\system32\drivers\usbohci.sys 2011/06/17 13:54:27.0065 3592 usbprint (797d862fe0875e75c7cc4c1ad7b30252) C:\Windows\system32\DRIVERS\usbprint.sys 2011/06/17 13:54:27.0143 3592 usbscan (576096ccbc07e7c4ea4f5e6686d6888f) C:\Windows\system32\DRIVERS\usbscan.sys 2011/06/17 13:54:27.0190 3592 USBSTOR (d8889d56e0d27e57ed4591837fe71d27) C:\Windows\system32\DRIVERS\USBSTOR.SYS 2011/06/17 13:54:27.0268 3592 usbuhci (78780c3ebce17405b1ccd07a3a8a7d72) C:\Windows\system32\drivers\usbuhci.sys 2011/06/17 13:54:27.0362 3592 vdrvroot (a059c4c3edb09e07d21a8e5c0aabd3cb) C:\Windows\system32\DRIVERS\vdrvroot.sys 2011/06/17 13:54:27.0424 3592 vga (17c408214ea61696cec9c66e388b14f3) C:\Windows\system32\DRIVERS\vgapnp.sys 2011/06/17 13:54:27.0518 3592 VgaSave (8e38096ad5c8570a6f1570a61e251561) C:\Windows\System32\drivers\vga.sys 2011/06/17 13:54:27.0581 3592 vhdmp (3be6e1f3a4f1afec8cee0d7883f93583) C:\Windows\system32\DRIVERS\vhdmp.sys 2011/06/17 13:54:27.0674 3592 viaagp (c829317a37b4bea8f39735d4b076e923) C:\Windows\system32\DRIVERS\viaagp.sys 2011/06/17 13:54:27.0737 3592 ViaC7 (e02f079a6aa107f06b16549c6e5c7b74) C:\Windows\system32\DRIVERS\viac7.sys 2011/06/17 13:54:27.0815 3592 viaide (e43574f6a56a0ee11809b48c09e4fd3c) C:\Windows\system32\DRIVERS\viaide.sys 2011/06/17 13:54:27.0893 3592 vmbus (379b349f65f453d2a6e75ea6b7448e49) C:\Windows\system32\DRIVERS\vmbus.sys 2011/06/17 13:54:27.0956 3592 VMBusHID (ec2bbab4b84d0738c6c83d2234dc36fe) C:\Windows\system32\DRIVERS\VMBusHID.sys 2011/06/17 13:54:28.0034 3592 volmgr (384e5a2aa49934295171e499f86ba6f3) C:\Windows\system32\DRIVERS\volmgr.sys 2011/06/17 13:54:28.0112 3592 volmgrx (b5bb72067ddddbbfb04b2f89ff8c3c87) C:\Windows\system32\drivers\volmgrx.sys 2011/06/17 13:54:28.0190 3592 volsnap (7c28b63e4c9e5c3be7ffe53789593619) C:\Windows\system32\DRIVERS\volsnap.sys 2011/06/17 13:54:28.0206 3592 Suspicious file (Forged): C:\Windows\system32\DRIVERS\volsnap.sys. Real md5: 7c28b63e4c9e5c3be7ffe53789593619, Fake md5: 58df9d2481a56edde167e51b334d44fd 2011/06/17 13:54:28.0221 3592 volsnap - detected Rootkit.Win32.TDSS.tdl3 (0) 2011/06/17 13:54:28.0284 3592 vsmraid (9dfa0cc2f8855a04816729651175b631) C:\Windows\system32\DRIVERS\vsmraid.sys 2011/06/17 13:54:28.0362 3592 vwifibus (90567b1e658001e79d7c8bbd3dde5aa6) C:\Windows\System32\drivers\vwifibus.sys 2011/06/17 13:54:28.0440 3592 WacomPen (de3721e89c653aa281428c8a69745d90) C:\Windows\system32\DRIVERS\wacompen.sys 2011/06/17 13:54:28.0518 3592 WANARP (692a712062146e96d28ba0b7d75de31b) C:\Windows\system32\DRIVERS\wanarp.sys 2011/06/17 13:54:28.0565 3592 Wanarpv6 (692a712062146e96d28ba0b7d75de31b) C:\Windows\system32\DRIVERS\wanarp.sys 2011/06/17 13:54:28.0659 3592 Wd (1112a9badacb47b7c0bb0392e3158dff) C:\Windows\system32\DRIVERS\wd.sys 2011/06/17 13:54:28.0721 3592 WDC_SAM (d6efaf429fd30c5df613d220e344cce7) C:\Windows\system32\DRIVERS\wdcsam.sys 2011/06/17 13:54:28.0784 3592 Wdf01000 (9950e3d0f08141c7e89e64456ae7dc73) C:\Windows\system32\drivers\Wdf01000.sys 2011/06/17 13:54:28.0924 3592 WfpLwf (8b9a943f3b53861f2bfaf6c186168f79) C:\Windows\system32\DRIVERS\wfplwf.sys 2011/06/17 13:54:28.0987 3592 WIMMount (5cf95b35e59e2a38023836fff31be64c) C:\Windows\system32\drivers\wimmount.sys 2011/06/17 13:54:29.0112 3592 WmiAcpi (0217679b8fca58714c3bf2726d2ca84e) C:\Windows\system32\DRIVERS\wmiacpi.sys 2011/06/17 13:54:29.0221 3592 ws2ifsl (6db3276587b853bf886b69528fdb048c) C:\Windows\system32\drivers\ws2ifsl.sys 2011/06/17 13:54:29.0331 3592 WudfPf (6f9b6c0c93232cff47d0f72d6db1d21e) C:\Windows\system32\drivers\WudfPf.sys 2011/06/17 13:54:29.0424 3592 WUDFRd (f91ff1e51fca30b3c3981db7d5924252) C:\Windows\system32\DRIVERS\WUDFRd.sys 2011/06/17 13:54:29.0502 3592 MBR (0x1B8) (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0 2011/06/17 13:54:29.0534 3592 ================================================================================ 2011/06/17 13:54:29.0534 3592 Scan finished 2011/06/17 13:54:29.0534 3592 ================================================================================ 2011/06/17 13:54:29.0565 0584 Detected object count: 2 2011/06/17 13:54:29.0565 0584 Actual detected object count: 2 2011/06/17 13:57:30.0456 0584 LockedFile.Multi.Generic(sptd) - User select action: Skip 2011/06/17 13:57:30.0549 0584 volsnap (7c28b63e4c9e5c3be7ffe53789593619) C:\Windows\system32\DRIVERS\volsnap.sys 2011/06/17 13:57:30.0549 0584 Suspicious file (Forged): C:\Windows\system32\DRIVERS\volsnap.sys. Real md5: 7c28b63e4c9e5c3be7ffe53789593619, Fake md5: 58df9d2481a56edde167e51b334d44fd 2011/06/17 13:57:30.0877 0584 Backup copy found, using it.. 2011/06/17 13:57:30.0909 0584 C:\Windows\system32\DRIVERS\volsnap.sys - will be cured after reboot 2011/06/17 13:57:30.0909 0584 Rootkit.Win32.TDSS.tdl3(volsnap) - User select action: Cure 2011/06/17 13:57:49.0409 3228 Deinitialize success

Разгеле...имате късмет, че нещата се улесниха доста за вас...новата версия на TDSSKiller се справи и вече не е необходимо да използваме LiveCD за да заместим файла.

1) Изтеглете: ESET Online Scanner

2) Стартирайте esetsmartinstaller_enu.exe

3) Сложете отметка на YES, I accept the Terms of Use и изберете Start

4) Скенерът ще започне да изтегля компонентите, които са му необходими.

5) Уверете се, че има отметки на следните редове, включително и тези от менюто Advanced Settings:

• Scan archives

Scan for potentially unwanted applicationsScan for potentially unsafe applicationsEnable Anti-Stealth technology

Забележка: Не слагайте отметка пред Remove found threats

И накрая изберете Start

6) Скенерът ще започне да изтегля последните дефиниции.

7) След, като сканирането завърши изберете Finish.

8) Отидете в:

C:\Program Files\ESET\ESET Online Scanner

Отворете файла log.txt , копирайте съдържанието му и го поставете в следващия си пост тук.

След това ще реша дали сме готови за [РЕШЕН]

Май има време до решението, но поне няма да се мъча с CD-та.. ESETSmartInstaller@High as downloader log: all ok # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6425 # api_version=3.0.2 # EOSSerial=756d088f17b19245854151d5e1dcd854 # end=finished # remove_checked=true # archives_checked=true # unwanted_checked=true # unsafe_checked=true # antistealth_checked=true # utc_time=2011-03-21 10:27:26 # local_time=2011-03-22 12:27:26 (+0200, GTB Standard Time) # country="United States" # lang=1033 # osver=6.1.7600 NT # compatibility_mode=1797 16775165 100 94 180751 37248462 169925 0 # compatibility_mode=8192 67108863 100 0 3763 3763 0 0 # scanned=31416 # found=0 # cleaned=0 # scan_time=2186 # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6425 # api_version=3.0.2 # EOSSerial=756d088f17b19245854151d5e1dcd854 # end=finished # remove_checked=true # archives_checked=true # unwanted_checked=true # unsafe_checked=true # antistealth_checked=true # utc_time=2011-03-22 02:17:52 # local_time=2011-03-22 04:17:52 (+0200, GTB Standard Time) # country="United States" # lang=1033 # osver=6.1.7600 NT # compatibility_mode=1797 16775165 100 94 238273 37305984 227447 0 # compatibility_mode=8192 67108863 100 0 61285 61285 0 0 # scanned=31003 # found=0 # cleaned=0 # scan_time=1680 # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6425 # api_version=3.0.2 # EOSSerial=756d088f17b19245854151d5e1dcd854 # end=finished # remove_checked=true # archives_checked=true # unwanted_checked=true # unsafe_checked=true # antistealth_checked=true # utc_time=2011-04-03 04:59:42 # local_time=2011-04-03 07:59:42 (+0200, GTB Daylight Time) # country="United States" # lang=1033 # osver=6.1.7600 NT # compatibility_mode=1797 16775165 100 94 0 38351651 456987 0 # compatibility_mode=8192 67108863 100 0 1106952 1106952 0 0 # scanned=38042 # found=0 # cleaned=0 # scan_time=2525 # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6425 # api_version=3.0.2 # EOSSerial=756d088f17b19245854151d5e1dcd854 # end=finished # remove_checked=true # archives_checked=true # unwanted_checked=true # unsafe_checked=true # antistealth_checked=true # utc_time=2011-05-23 01:56:48 # local_time=2011-05-23 04:56:48 (+0200, GTB Daylight Time) # country="United States" # lang=1033 # osver=6.1.7600 NT # compatibility_mode=1797 16775165 100 94 454796 42661934 474658 0 # compatibility_mode=8192 67108863 100 0 5417235 5417235 0 0 # scanned=36435 # found=0 # cleaned=0 # scan_time=1267 # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6425 # api_version=3.0.2 # EOSSerial=756d088f17b19245854151d5e1dcd854 # end=finished # remove_checked=false # archives_checked=true # unwanted_checked=true # unsafe_checked=true # antistealth_checked=true # utc_time=2011-06-17 12:19:40 # local_time=2011-06-17 03:19:40 (+0200, GTB Daylight Time) # country="United States" # lang=1033 # osver=6.1.7600 NT # compatibility_mode=1797 16775165 100 94 1655975 44813460 1514739 0 # compatibility_mode=8192 67108863 100 0 7568761 7568761 0 0 # scanned=38245 # found=1 # cleaned=0 # scan_time=3910 C:\_OTL.rar multiple threats (unable to clean) 00000000000000000000000000000000 I