Премини към съдържанието
Форумът в приложение

По-лесно сърфиране. Научи повече.
Kaldata.com - Форуми

Приложение на форума на цял екран с push известия, значки и други.

За да инсталирате това приложение на iOS и iPadOS
  1. Докоснете Иконата за споделяне в Safari
  2. Превъртете менюто и докоснете Добавяне към началния екран.
  3. Докоснете Добавяне в горния десен ъгъл.
За да инсталирате това приложение на Android
  1. Докоснете менюто с 3 точки (⋮) в горния десен ъгъл на браузъра.
  2. Докоснете Добавяне към началния екран или Инсталиране на приложение.
  3. Потвърдете, като докоснете Инсталиране.
Добави Kaldata.com в предпочитани източници в Google

Добре дошли!

Добре дошли в нашите форуми, пълни с полезна информация. Имате проблем с компютъра или телефона си? Публикувайте нова тема и ще намерите решение на всичките си проблеми. Общувайте свободно и открийте безброй нови приятели.

Моля, регистрирайте се за да публикувате тема и да получите пълен достъп до всички функции.

 

Как да премахна System smart security ? [РЕШЕН]

Elkata
в Премахване на зловреден софтуер

Featured Replies

Здравейте! Мисля, че и аз имам подобен проблем с програма, която се представя като System smart security. По принцип съм с Avast, която не открива нищо, а тази квичи непрекъснато!

Редактирано от Elkata (преглед на промените)

  • Автор

Здравейте,

Следвайте инструкциите от тази тема:

Системата ми е инфектирана - Какво да правя сега?

Благодаря, ще изпълня всичко при първа възможност. Но не съм сигурна, че ще успея, защото нямам достъп до интернет. Незнам каква е причината, дали гадинката или нещо друго, но под предлог, че иска да предпази компютъра не ми отваря никоя страница, дори Google. В момента пиша от служебния компютър.

Благодаря, ще изпълня всичко при първа възможност. Но не съм сигурна, че ще успея, защото нямам достъп до интернет. Незнам каква е причината, дали гадинката или нещо друго, но под предлог, че иска да предпази компютъра не ми отваря никоя страница, дори Google. В момента пиша от служебния компютър.

Скоро махах тази напаст и да ви кажа тази е доста гадна,ако мога така да се изразя.

Вие имате инетрнет отваряте браузъра,но до там нищо не можете да направите,само една реклама излиза! Когато решите да инсталирате нещо,не ви позволява,та така..........

Ще ви обясна инструкциите по възможно най-разбираем начин!

Вземете един CD диск 700МБ и го сложете в служебния компютър от който пишете сега!

Запишете на този диск програмата Malwarebytes Anti-Malware

Пуснете диска в заразената машина и copy/paste програмата на дектопа !

След което,рестартирате и влизате в режим safe-mode ,инсталирате Malwarebytes-Anti-Malware (не се мъчете да обновявате програмата,няма да имате достъп)

Пуснете "бързо сканиране" изчакайте да завърши и каквото намери премахнете незабавно! Рестартирате машината и ще видите,че вече доста неща ще можете да правите и няма да ги има тези досадни съобщения,НО не сме свършили,сега вече обновявате Malwarebytes-Anti-Malware ,изпълнявате напътствието,пускате отново "бързо сканиране" и ще намери още зарази и каквото открие давате отново "премахни" ,най-вероятно ще поиска рестарт за да ги махне!

Та това е! Вие сте на ход! :)

P.s. Забравих да споемна,пуснете си после защитната стена,понеже и тя е била спряна!

  • Автор

Та това е! Вие сте на ход! :)

ОК,записах програмата на диск и довечера ще се боря с гадинката. Имам няколко въпроса обаче, не съм много наясно с нещата. Та каъв е този safe-mode режим и как се влиза в него? Преди да инсталирам програмата и да започне сканирането трябва ли да изключа Avast? Ако всичко завърши благополучно какво да правя с програмата, да си я запазя ли? Ще бъде ли възможно преди да започна, да запиша на дискове по-важната информация от компютъра за да не й се случи нещо или гадината няма да ми позволи, или още по-лошо ще се запише и тя?

Много благодаря за помоща, дано да стане, че без компютъра съм загинала - пиша дипломна работа.

Ето и отговорите както следва:

1.Режимът Safe Mode на операционната система Windows е мощен инструмент, с помощта на който ще можете да се справите, или поне да опитате, с множество проблеми, причинени от драйверите на дадено устройство или от заразяване на компютъра ви с вирус.За да влезете в Safe Mode, трябва да натиснете бутона F8 на вашата клавиатура по време на зареждане на операционната система.От появилия се черен екран избирате с помоща на клавиатурата със стрелките Safe Mode – зарежда се само абсолютният минимум от драйвери! Изчаквате да зареди екрана той ще е с ниска резолюция(да не се учудите) и иконите ще са големи!

2.Не!

3.Запазете я,можете да сканирате периодично системата с нея

4.Ние имаме работа на дяла където е инсталирана ОС! Ако информацията ви е на друг дял на харда (имам на в предвид щом не е заедно там където е инсталирана ОС) няма място за тревога,поне за сега не предприемайте нищо!

Тази заплаха не носи големи поражения,така че се надявам да е само тя там!

  • Автор

Греда! Снощи започнах стъпка по стъпка, копирах файлчето с програмата на десктопа, рестартирах, но F8 изобщо не реагира. Пробвах няколко пъти, на различен етап от зареждането, но нищо не се получи. Малко преди да се зареди операционната система излиза едно съобщение press ESK to startup menu. Влязох в това меню за да видя дали там е safe-mode и ето какви са опциите: F1 - System Information F2 - System Diagnostics F7 - HP Spare Key F9 DIOS Setup - Optical Disk Drive; Notebook Hard Drive; Notebook Ethernet F11 - HP Recovery F12 - Network Boot Може би трябваше да уточня, че машината е лаптоп HP с Windows Vista. Сега съм го взела с мен в офиса. А възможно ли е да инсталирам програмата и да започна сканирането без да съм в safe-mode?

А възможно ли е да инсталирам програмата и да започна сканирането без да съм в safe-mode?

Да,пробвайте и така,но ме съмнява дали ще ви даде изобщо да инсталирате нещо!
  • Автор

С помоща на един колига успях да вляза в safe-mode, сега инсталирам програмата :speak: И сканирам! Сканирането приключи,при това доста бързо - 70 зловредни обекта. Изтрих ги, рестартирах, сканирах отново - не откри нищо. Но продължавам да нямам достъп до интернет.

Редактирано от Elkata (преглед на промените)

  • Автор

Обнових прогромката, намери още седем гадинки. Но продължава да не отваря интернет.

Здравейте,

Следвайте инструкциите от тази тема:

Системата ми е инфектирана - Какво да правя сега?

Най добре ДОКТОРИТЕ да кажат изчистена ли е гадината и единствена ли е ?

Аз бих сканирал и с това Dr.Web CureIt!®

Най добре ДОКТОРИТЕ да кажат изчистена ли е гадината и единствена ли е ?

Аз бих сканирал и с това Dr.Web CureIt!®

:yanim: Не четете ли преди да пишете или ви сърбят пръстите, ако е така има и други занимания за ръцете!

Темата е в точния раздел и доктора преглежда!!!

Обнових прогромката, намери още седем гадинки. Но продължава да не отваря интернет.

Рестартирахте ли?

Кой браузър ползвате?

Направете същата манипулация и с тази програма цък !

Този път не би трябвало да се налага да влизате в safe mode ! Тази програма също има БГ интерфейс ,инсталирайте,обновете и направете бързо сканиране,каквото намери триете наред! Ако няма промяна,може браузъра ви да се е скапал,ще се опитаме да го надградим с последна версия или преинсталираме!

Ако пак няма промяна,ще се наложи да преминем към по тежката артилерия! Запасете се с още един два диска или флашка под ръка!

  • Автор

Рестартирахте ли?

Кой браузър ползвате?

Направете същата манипулация и с тази програма цък !

Този път не би трябвало да се налага да влизате в safe mode ! Тази програма също има БГ интерфейс ,инсталирайте,обновете и направете бързо сканиране,каквото намери триете наред! Ако няма промяна,може браузъра ви да се е скапал,ще се опитаме да го надградим с последна версия или преинсталираме!

Ако пак няма промяна,ще се наложи да преминем към по тежката артилерия! Запасете се с още един два диска или флашка под ръка!

Рестартирах, следвах точно инструкциите ви. Ще повторя и с другата програмка.

Браузърът е Internet Explfrer.

Благодаря! :scared:

Аммм.... нещо не мога да изтегля програмата, дава ми някаква грешка.

Сори, било е временно, изтеглих я.

Редактирано от Elkata (преглед на промените)

  • Автор

Така, инсталирах програмката, обнових, сканирах - 34 потенциално опасни обекта, направо лошо ми стана, от къде, да ги вземат дяволите, са ме налазили. Изчистих ги, рестартирах - интернет Йок! Вероятно наистина браузерът е заминал.

Така, инсталирах програмката, обнових, сканирах - 34 потенциално опасни обекта, направо лошо ми стана, от къде, да ги вземат дяволите, са ме налазили. Изчистих ги, рестартирах - интернет Йок!

Вероятно наистина браузерът е заминал.

Нищо не е заминало, изчакайте колегата за отговор.

Вероятно си има причина за липсата на интернет - я прокси, я модифициран hosts файл, я друго...

  • Автор

Може ли да помоля за помощ за липсващия интернет? Гадния smart security вече го няма, но без интернет не мога да работя.

Може ли да помоля за помощ за липсващия интернет? Гадния smart security вече го няма, но без интернет не мога да работя.

Оууу извиняваме се...колегата временно няма да е на линия и затова аз ще се опитам да ви помогна.

С каква Операционна Система сте и каква интернет връзка използвате - PPPoE (Lan), A/DSL, WiFi ?

СТЪПКА 1

Отворете notepad.exe (на болната машина) и копирайте следния текст вътре:

@echo off
(ipconfig /all
nslookup google.com
nslookup yahoo.com
ping -n 2 google.com
ping -n 2 yahoo.com
route print) >>Log1.txt
start notepad Log1.txt
del %0

Запазете файла с име check.bat

Иконата на файла трябва да изглежда така Публикувано изображение

Стартирайте файла и копирайте лог файла на USB флашка...

След това пренесете лог файла до машината на която имате интернет и публикувайте резултатите.

СТЪПКА 2

  • Изтеглете OTL.exe и го запазете на десктопа.
  • Копирайте инструмента на USB флашка и след това го пренесете на десктопа на "болната машина".
  • Стартирайте файла Публикувано изображение с двукратен клик на мишката.
  • Сложете отметка пред Scan All Users Публикувано изображение
  • Под менюто File Age => изберете 90 days
  • Под менюто Standard Registry => променете на ALL
  • Сложете отметки пред LOP и Purity Check

  • Под Публикувано изображение с Copy/ Paste въведете следната текстова информация:
netsvcs
msconfig
%SYSTEMDRIVE%\*.*
%USERPROFILE%\*.*
%USERPROFILE%\Application Data\*.*
%USERPROFILE%\Local Settings\Application Data\*.*
%AllUsersProfile%\*.*
%AllUsersProfile%\Application Data\*.*
%USERPROFILE%\My Documents\*.*
%CommonProgramFiles%\*.*
%PROGRAMFILES%\*.*
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\system32\drivers\*.sys /90
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\system32\Spool\prtprocs\w32x86\*.dll
/md5start
hlp.dat
winlogon.exe
wininit.exe
userinit.exe
explorer.exe
volsnap.sys
/md5stop
  • Натиснете маркираният в синьо бутон: Публикувано изображение.
  • Като приключи проверката, ще се създадат два файла - OTL.Txt и Extras.Txt.
  • Копирайте лог файловете на USB флашката и ги пренесете до машината на която имате интернет.
  • Публикувайте съдържанието на лог файловете в следващия си коментар.

Поздрави !

  • Автор

Здравейте, благодаря, че се отзовахте. С Windows Vista съм, За интернет връзката не съм сигурна, безжичен е, но... Изпълних стъпка едно и ето резултата: Windows IP Configuration Host Name . . . . . . . . . . . . : Eli4ka-PC Primary Dns Suffix . . . . . . . : Node Type . . . . . . . . . . . . : Peer-Peer IP Routing Enabled. . . . . . . . : No WINS Proxy Enabled. . . . . . . . : No DNS Suffix Search List. . . . . . : ddns.cablebg.net Ethernet adapter Local Area Connection: Media State . . . . . . . . . . . : Media disconnected Connection-specific DNS Suffix . : Description . . . . . . . . . . . : Marvell Yukon 88E8072 PCI-E Gigabit Ethernet Controller Physical Address. . . . . . . . . : 00-40-CA-D0-39-D0 DHCP Enabled. . . . . . . . . . . : Yes Autoconfiguration Enabled . . . . : Yes Wireless LAN adapter Wireless Network Connection: Connection-specific DNS Suffix . : ddns.cablebg.net Description . . . . . . . . . . . : Intel® WiFi Link 5100 AGN Physical Address. . . . . . . . . : 00-1E-65-03-AA-A2 DHCP Enabled. . . . . . . . . . . : Yes Autoconfiguration Enabled . . . . : Yes Link-local IPv6 Address . . . . . : fe80::50d7:9c51:5a1a:e750%13(Preferred) IPv4 Address. . . . . . . . . . . : 192.168.1.106(Preferred) Subnet Mask . . . . . . . . . . . : 255.255.255.0 Lease Obtained. . . . . . . . . . : 16 о­Ё 2011 Ј. 10:38 з. Lease Expires . . . . . . . . . . : 17 о­Ё 2011 Ј. 10:38 з. Default Gateway . . . . . . . . . : 192.168.1.1 DHCP Server . . . . . . . . . . . : 192.168.1.1 DHCPv6 IAID . . . . . . . . . . . : 167779941 DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-12-3A-C8-28-00-25-B3-61-E0-EE DNS Servers . . . . . . . . . . . : 192.168.1.1 217.9.239.90 217.9.239.94 NetBIOS over Tcpip. . . . . . . . : Enabled Ethernet adapter Bluetooth Network Connection: Media State . . . . . . . . . . . : Media disconnected Connection-specific DNS Suffix . : Description . . . . . . . . . . . : Bluetooth Device (Personal Area Network) Physical Address. . . . . . . . . : 00-24-7E-7B-90-06 DHCP Enabled. . . . . . . . . . . : Yes Autoconfiguration Enabled . . . . : Yes Tunnel adapter Local Area Connection* 6: Media State . . . . . . . . . . . : Media disconnected Connection-specific DNS Suffix . : Description . . . . . . . . . . . : isatap.{0A98EBB3-E3A2-4F24-B3AC-48EEA8DB3411} Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0 DHCP Enabled. . . . . . . . . . . : No Autoconfiguration Enabled . . . . : Yes Tunnel adapter Local Area Connection* 7: Media State . . . . . . . . . . . : Media disconnected Connection-specific DNS Suffix . : Description . . . . . . . . . . . : Microsoft ISATAP Adapter #2 Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0 DHCP Enabled. . . . . . . . . . . : No Autoconfiguration Enabled . . . . : Yes Tunnel adapter Local Area Connection* 11: Media State . . . . . . . . . . . : Media disconnected Connection-specific DNS Suffix . : Description . . . . . . . . . . . : isatap.ddns.cablebg.net Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0 DHCP Enabled. . . . . . . . . . . : No Autoconfiguration Enabled . . . . : Yes Tunnel adapter Local Area Connection* 14: Connection-specific DNS Suffix . : Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface Physical Address. . . . . . . . . : 02-00-54-55-4E-01 DHCP Enabled. . . . . . . . . . . : No Autoconfiguration Enabled . . . . : Yes IPv6 Address. . . . . . . . . . . : 2001:0:5ef5:79fb:2008:f9d:a628:782b(Preferred) Link-local IPv6 Address . . . . . : fe80::2008:f9d:a628:782b%15(Preferred) Default Gateway . . . . . . . . . : :: NetBIOS over Tcpip. . . . . . . . : Disabled Tunnel adapter Local Area Connection* 15: Media State . . . . . . . . . . . : Media disconnected Connection-specific DNS Suffix . : Description . . . . . . . . . . . : isatap.{081F6EC3-3F3A-483C-9875-213ADF4FD51D} Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0 DHCP Enabled. . . . . . . . . . . : No Autoconfiguration Enabled . . . . : Yes Tunnel adapter Local Area Connection* 16: Media State . . . . . . . . . . . : Media disconnected Connection-specific DNS Suffix . : ddns.cablebg.net Description . . . . . . . . . . . : Microsoft ISATAP Adapter #6 Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0 DHCP Enabled. . . . . . . . . . . : No Autoconfiguration Enabled . . . . : Yes Server: UnKnown Address: 192.168.1.1 Name: google.com Addresses: 74.125.77.99 74.125.77.104 74.125.77.147 Server: UnKnown Address: 192.168.1.1 Name: yahoo.com Addresses: 98.137.149.56 209.191.122.70 67.195.160.76 69.147.125.65 72.30.2.43 Pinging google.com [74.125.77.99] with 32 bytes of data: Reply from 74.125.77.99: bytes=32 time=67ms TTL=52 Reply from 74.125.77.99: bytes=32 time=94ms TTL=51 Ping statistics for 74.125.77.99: Packets: Sent = 2, Received = 2, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 67ms, Maximum = 94ms, Average = 80ms Pinging yahoo.com [98.137.149.56] with 32 bytes of data: Reply from 98.137.149.56: bytes=32 time=336ms TTL=51 Reply from 98.137.149.56: bytes=32 time=199ms TTL=51 Ping statistics for 98.137.149.56: Packets: Sent = 2, Received = 2, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 199ms, Maximum = 336ms, Average = 267ms =========================================================================== Interface List 14 ...00 40 ca d0 39 d0 ...... Marvell Yukon 88E8072 PCI-E Gigabit Ethernet Controller 13 ...00 1e 65 03 aa a2 ...... Intel® WiFi Link 5100 AGN 12 ...00 24 7e 7b 90 06 ...... Bluetooth Device (Personal Area Network) 1 ........................... Software Loopback Interface 1 18 ...00 00 00 00 00 00 00 e0 isatap.{0A98EBB3-E3A2-4F24-B3AC-48EEA8DB3411} 10 ...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2 16 ...00 00 00 00 00 00 00 e0 isatap.ddns.cablebg.net 15 ...02 00 54 55 4e 01 ...... Teredo Tunneling Pseudo-Interface 17 ...00 00 00 00 00 00 00 e0 isatap.{081F6EC3-3F3A-483C-9875-213ADF4FD51D} 26 ...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #6 =========================================================================== IPv4 Route Table =========================================================================== Active Routes: Network Destination Netmask Gateway Interface Metric 0.0.0.0 0.0.0.0 192.168.1.1 192.168.1.106 30 127.0.0.0 255.0.0.0 On-link 127.0.0.1 306 127.0.0.1 255.255.255.255 On-link 127.0.0.1 306 127.255.255.255 255.255.255.255 On-link 127.0.0.1 306 192.168.1.0 255.255.255.0 On-link 192.168.1.106 286 192.168.1.106 255.255.255.255 On-link 192.168.1.106 286 192.168.1.255 255.255.255.255 On-link 192.168.1.106 286 224.0.0.0 240.0.0.0 On-link 127.0.0.1 306 224.0.0.0 240.0.0.0 On-link 192.168.1.106 286 255.255.255.255 255.255.255.255 On-link 127.0.0.1 306 255.255.255.255 255.255.255.255 On-link 192.168.1.106 286 =========================================================================== Persistent Routes: None IPv6 Route Table =========================================================================== Active Routes: If Metric Network Destination Gateway 15 18 ::/0 On-link 1 306 ::1/128 On-link 15 18 2001::/32 On-link 15 266 2001:0:5ef5:79fb:2008:f9d:a628:782b/128 On-link 13 286 fe80::/64 On-link 15 266 fe80::/64 On-link 15 266 fe80::2008:f9d:a628:782b/128 On-link 13 286 fe80::50d7:9c51:5a1a:e750/128 On-link 1 306 ff00::/8 On-link 15 266 ff00::/8 On-link 13 286 ff00::/8 On-link =========================================================================== Persistent Routes: None Сега ще извърша и стъпка две

  • Автор

Резултатите от стъпка две:

OTL:

OTL logfile created on: 16.6.2011 г. 11:16:32 - Run 1

OTL by OldTimer - Version 3.2.24.0 Folder = C:\Users\Elitsa Danailova\Desktop

Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.19048)

Locale: 00000402 | Country: Bulgaria | Language: BGR | Date Format: d.M.yyyy 'г.'

2,99 Gb Total Physical Memory | 1,82 Gb Available Physical Memory | 60,73% Memory free

6,19 Gb Paging File | 4,75 Gb Available in Paging File | 76,78% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files

Drive C: | 454,76 Gb Total Space | 221,06 Gb Free Space | 48,61% Space Free | Partition Type: NTFS

Drive D: | 10,00 Gb Total Space | 1,35 Gb Free Space | 13,48% Space Free | Partition Type: NTFS

Drive F: | 1022,00 Mb Total Space | 997,02 Mb Free Space | 97,56% Space Free | Partition Type: FAT32

Drive I: | 973,63 Mb Total Space | 774,53 Mb Free Space | 79,55% Space Free | Partition Type: FAT

Computer Name: ELI4KA-PC | User Name: Elitsa Danailova | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 90 Days

========== Processes (SafeList) ==========

PRC - [2011.06.16 10:58:04 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\Elitsa Danailova\Desktop\OTL.exe

PRC - [2011.05.23 18:00:06 | 002,424,192 | ---- | M] (SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

PRC - [2011.05.10 15:10:58 | 003,459,712 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastUI.exe

PRC - [2011.05.10 15:10:57 | 000,042,184 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe

PRC - [2011.05.06 18:15:20 | 000,532,320 | ---- | M] (Spigot, Inc.) -- C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe

PRC - [2011.05.06 17:33:00 | 000,393,112 | ---- | M] (Spigot, Inc.) -- C:\Program Files\Application Updater\ApplicationUpdater.exe

PRC - [2010.02.04 23:47:34 | 000,093,376 | ---- | M] (OLYMPUS IMAGING CORP.) -- C:\Program Files\Olympus\ib\olycamdetect.exe

PRC - [2009.11.07 20:18:54 | 000,323,392 | ---- | M] (BitTorrent, Inc.) -- C:\Users\Elitsa Danailova\Program Files\DNA\btdna.exe

PRC - [2009.04.11 09:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe

PRC - [2009.04.11 09:27:28 | 000,069,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conime.exe

PRC - [2009.03.12 17:36:24 | 000,086,016 | ---- | M] () -- C:\Program Files\Autodesk\3ds Max 2010\mentalray\satellite\raysat_3dsmax2010_32server.exe

PRC - [2009.03.01 23:21:32 | 002,329,128 | ---- | M] (Broadcom Corporation.) -- C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe

PRC - [2009.03.01 23:21:32 | 000,789,032 | ---- | M] (Broadcom Corporation.) -- C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

PRC - [2009.03.01 23:21:32 | 000,567,848 | ---- | M] (Broadcom Corporation.) -- C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe

PRC - [2009.02.17 22:10:02 | 000,637,232 | ---- | M] (BitTorrent, Inc.) -- C:\Program Files\BitTorrent\bittorrent.exe

PRC - [2009.02.17 19:13:14 | 000,079,416 | ---- | M] ( Hewlett-Packard Development Company, L.P.) -- C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\VolCtrl.exe

PRC - [2009.02.12 09:13:34 | 000,355,896 | ---- | M] (Hewlett-Packard Development Company, L.P.) -- C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\pthosttr.exe

PRC - [2009.01.28 07:21:48 | 000,075,024 | ---- | M] (Bioscrypt Inc.) -- c:\Program Files\Hewlett-Packard\IAM\Bin\asghost.exe

PRC - [2009.01.15 00:01:48 | 000,077,824 | ---- | M] (Hewlett-Packard) -- C:\Program Files\Hewlett-Packard\File Sanitizer\HPFSService.exe

PRC - [2009.01.15 00:01:12 | 011,223,040 | ---- | M] (Hewlett-Packard) -- C:\Program Files\Hewlett-Packard\File Sanitizer\CoreShredder.exe

PRC - [2008.12.16 19:37:46 | 000,354,840 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe

PRC - [2008.12.16 19:37:36 | 000,186,904 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe

PRC - [2008.10.03 23:33:12 | 001,185,016 | ---- | M] (AuthenTec, Inc.) -- c:\Program Files\Fingerprint Sensor\AtService.exe

PRC - [2008.10.02 01:01:14 | 000,256,544 | ---- | M] (SafeBoot International) -- c:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe

PRC - [2008.08.08 17:47:02 | 000,777,240 | ---- | M] (PDF Complete Inc) -- C:\Program Files\PDF Complete\pdfsvc.exe

PRC - [2008.08.08 15:11:12 | 000,490,952 | ---- | M] (DT Soft Ltd) -- C:\Program Files\DAEMON Tools Lite\daemon.exe

PRC - [2008.07.15 15:09:52 | 000,090,112 | ---- | M] (Andrea Electronics Corporation) -- C:\Windows\System32\AEADISRV.EXE

PRC - [2008.04.22 17:37:56 | 001,572,864 | R--- | M] () -- C:\Program Files\UGS\UGSLicensing\ugslmd.exe

PRC - [2008.04.22 17:37:30 | 001,372,160 | R--- | M] (Macrovision Corporation) -- C:\Program Files\UGS\UGSLicensing\lmgrd.exe

PRC - [2008.01.21 05:23:32 | 001,008,184 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Defender\MSASCui.exe

PRC - [2008.01.20 10:05:37 | 000,217,088 | ---- | M] (PowerISO Computing, Inc.) -- C:\Program Files\PowerISO\PWRISOVM.EXE

PRC - [2007.11.28 03:42:14 | 000,185,896 | ---- | M] (ActivIdentity) -- c:\Program Files\ActivIdentity\ActivClient\accoca.exe

PRC - [2007.11.28 03:42:12 | 000,093,736 | ---- | M] (ActivIdentity) -- c:\Program Files\ActivIdentity\ActivClient\acevents.exe

PRC - [2007.11.28 03:40:42 | 000,298,536 | ---- | M] (ActivIdentity) -- C:\Program Files\ActivIdentity\ActivClient\accrdsub.exe

PRC - [2007.07.24 11:15:14 | 000,185,632 | ---- | M] (Protexis Inc.) -- c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe

PRC - [2007.01.11 15:26:56 | 000,063,112 | ---- | M] (CANON INC.) -- C:\Windows\System32\CNAB4RPK.EXE

========== Modules (SafeList) ==========

MOD - [2011.06.16 10:58:04 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\Elitsa Danailova\Desktop\OTL.exe

MOD - [2011.05.10 15:10:55 | 000,199,792 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\snxhk.dll

MOD - [2010.08.31 18:43:52 | 001,686,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll

MOD - [2009.01.28 07:15:04 | 000,076,560 | ---- | M] (Bioscrypt Inc.) -- C:\Windows\System32\APSHook.dll

========== Win32 Services (SafeList) ==========

SRV - [2011.05.10 15:10:57 | 000,042,184 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus)

SRV - [2011.05.06 17:33:00 | 000,393,112 | ---- | M] (Spigot, Inc.) [Auto | Running] -- C:\Program Files\Application Updater\ApplicationUpdater.exe -- (Application Updater)

SRV - [2009.10.27 10:26:36 | 000,657,408 | ---- | M] (Nokia) [On_Demand | Stopped] -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)

SRV - [2009.09.26 20:36:17 | 000,651,720 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)

SRV - [2009.03.12 17:36:24 | 000,086,016 | ---- | M] () [Auto | Running] -- C:\Program Files\Autodesk\3ds Max 2010\mentalray\satellite\raysat_3dsmax2010_32server.exe -- (mi-raysat_3dsmax2010_32)

SRV - [2009.03.01 23:21:32 | 000,567,848 | ---- | M] (Broadcom Corporation.) [Auto | Running] -- C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe -- (btwdins)

SRV - [2009.02.12 09:01:06 | 000,045,056 | ---- | M] (Hewlett-Packard Development Company, L.P) [On_Demand | Stopped] -- c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTChangeFilterService.exe -- (HP ProtectTools Service)

SRV - [2009.01.28 07:15:16 | 000,186,640 | ---- | M] (Bioscrypt Inc.) [Auto | Running] -- c:\Program Files\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll -- (ASBroker)

SRV - [2009.01.28 07:15:10 | 000,149,776 | ---- | M] (Bioscrypt Inc.) [Auto | Running] -- c:\Program Files\Hewlett-Packard\IAM\Bin\ASChnl.dll -- (ASChannel)

SRV - [2009.01.15 00:01:48 | 000,077,824 | ---- | M] (Hewlett-Packard) [Auto | Running] -- C:\Program Files\Hewlett-Packard\File Sanitizer\HPFSService.exe -- (HPFSService)

SRV - [2008.12.16 19:37:46 | 000,354,840 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel®

SRV - [2008.10.03 23:33:12 | 001,185,016 | ---- | M] (AuthenTec, Inc.) [Auto | Running] -- c:\Program Files\Fingerprint Sensor\AtService.exe -- (ATService)

SRV - [2008.10.02 01:01:14 | 000,256,544 | ---- | M] (SafeBoot International) [Auto | Running] -- c:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe -- (HpFkCryptService)

SRV - [2008.08.08 17:47:02 | 000,777,240 | ---- | M] (PDF Complete Inc) [Auto | Running] -- C:\Program Files\PDF Complete\pdfsvc.exe -- (pdfcDispatcher)

SRV - [2008.08.07 01:24:40 | 000,349,432 | ---- | M] (Hewlett-Packard Ltd) [On_Demand | Stopped] -- C:\Windows\System32\flcdlock.exe -- (FLCDLOCK)

SRV - [2008.07.15 15:09:52 | 000,090,112 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Windows\System32\AEADISRV.EXE -- (AEADIFilters)

SRV - [2008.04.22 17:37:30 | 001,372,160 | R--- | M] (Macrovision Corporation) [Auto | Running] -- C:\Program Files\UGS\UGSLicensing\lmgrd.exe -- (UGS License Server (ugslmd)) UGS License Server (ugslmd)

SRV - [2008.04.08 14:12:50 | 001,112,560 | ---- | M] (Sonic Solutions) [On_Demand | Stopped] -- c:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe -- (RoxMediaDB10)

SRV - [2008.01.21 05:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)

SRV - [2007.11.28 03:42:14 | 000,185,896 | ---- | M] (ActivIdentity) [Auto | Running] -- c:\Program Files\ActivIdentity\ActivClient\accoca.exe -- (accoca)

SRV - [2007.07.24 11:15:14 | 000,185,632 | ---- | M] (Protexis Inc.) [Auto | Running] -- c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe -- (PSI_SVC_2)

========== Driver Services (SafeList) ==========

DRV - [2011.05.10 15:03:54 | 000,441,176 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\windows\System32\drivers\aswSnx.sys -- (aswSnx)

DRV - [2011.05.10 15:03:44 | 000,307,928 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\windows\System32\drivers\aswSP.sys -- (aswSP)

DRV - [2011.05.10 15:02:37 | 000,049,240 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\windows\System32\drivers\aswTdi.sys -- (aswTdi)

DRV - [2011.05.10 14:59:56 | 000,025,432 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\windows\System32\drivers\aswRdr.sys -- (aswRdr)

DRV - [2011.05.10 14:59:44 | 000,053,592 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswMonFlt.sys -- (aswMonFlt)

DRV - [2011.05.10 14:59:35 | 000,019,544 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\windows\System32\drivers\aswFsBlk.sys -- (aswFsBlk)

DRV - [2010.05.10 21:41:30 | 000,067,656 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)

DRV - [2010.02.17 21:25:48 | 000,012,872 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)

DRV - [2009.09.26 17:09:23 | 000,717,296 | ---- | M] () [Kernel | Boot | Running] -- C:\windows\System32\Drivers\sptd.sys -- (sptd)

DRV - [2009.09.10 16:58:26 | 000,021,648 | ---- | M] (OLYMPUS IMAGING CORP.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\OlyCamComm.sys -- (OlyCamComm)

DRV - [2009.04.11 07:45:24 | 000,113,664 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rmcast.sys -- (RMCAST) RMCAST (Pgm)

DRV - [2009.03.31 12:26:00 | 004,232,704 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NETw5v32.sys -- (NETw5v32) Intel®

DRV - [2009.03.26 14:39:14 | 001,765,168 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\snp2uvc.sys -- (SNP2UVC) USB2.0 PC Camera (SNP2UVC)

DRV - [2009.03.23 09:02:15 | 000,043,136 | ---- | M] (Prolific Technology Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ser2pl.sys -- (Ser2pl)

DRV - [2009.02.19 14:17:00 | 000,095,760 | ---- | M] (ATI Research Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AtiHdmi.sys -- (AtiHdmiService)

DRV - [2009.02.03 16:29:00 | 004,303,360 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag)

DRV - [2008.10.29 18:43:44 | 001,204,128 | ---- | M] (Agere Systems) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem)

DRV - [2008.10.02 01:02:04 | 000,051,408 | ---- | M] (SafeBoot N.V.) [Kernel | Boot | Running] -- C:\windows\System32\drivers\SbAlg.sys -- (SbAlg)

DRV - [2008.10.02 01:02:02 | 000,012,960 | ---- | M] (SafeBoot International) [File_System | Boot | Running] -- C:\windows\System32\drivers\SbFsLock.sys -- (SbFsLock)

DRV - [2008.10.02 01:02:00 | 000,012,528 | ---- | M] (SafeBoot International) [Kernel | System | Running] -- C:\windows\System32\drivers\rsvlock.sys -- (RsvLock)

DRV - [2008.10.02 01:01:58 | 000,109,216 | ---- | M] () [Kernel | Boot | Running] -- C:\windows\System32\drivers\SafeBoot.sys -- (SafeBoot)

DRV - [2008.08.27 19:52:02 | 000,034,608 | ---- | M] (Hewlett-Packard Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Accelerometer.sys -- (Accelerometer)

DRV - [2008.08.27 19:52:02 | 000,025,392 | ---- | M] (Hewlett-Packard Corporation) [Kernel | Boot | Running] -- C:\windows\system32\DRIVERS\hpdskflt.sys -- (hpdskflt)

DRV - [2008.08.26 10:26:12 | 000,018,816 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\pccsmcfd.sys -- (pccsmcfd)

DRV - [2008.08.07 00:43:30 | 000,032,256 | ---- | M] (Hewlett-Packard Development Company L.P.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\DAMDrv.sys -- (DAMDrv)

DRV - [2008.01.20 10:07:58 | 000,033,292 | ---- | M] (PowerISO Computing, Inc.) [Kernel | System | Running] -- C:\windows\System32\drivers\scdemu.sys -- (SCDEmu)

DRV - [2007.06.19 02:12:04 | 000,016,768 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HpqKbFiltr.sys -- (HpqKbFiltr)

DRV - [2006.06.12 13:36:30 | 000,009,344 | ---- | M] (Hewlett Packard) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\hpfxbulk.sys -- (HPFXBULK)

DRV - [2004.11.05 12:08:06 | 000,670,208 | ---- | M] (Aladdin Knowledge Systems Ltd.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\hardlock.sys -- (Hardlock)

DRV - [2001.06.22 06:39:02 | 000,073,728 | ---- | M] (Rainbow Technologies, Inc.) [Kernel | Auto | Running] -- C:\windows\System32\Drivers\SENTINEL.SYS -- (Sentinel)

========== Standard Registry (All) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_bg&c=92&bd=all&pf=cmnb

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\Windows\System32\ieframe.dll (Microsoft Corporation)

IE - HKU\S-1-5-20\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\Windows\System32\ieframe.dll (Microsoft Corporation)

IE - HKU\S-1-5-21-188209174-3304326258-1817674253-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com

IE - HKU\S-1-5-21-188209174-3304326258-1817674253-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.bg/

IE - HKU\S-1-5-21-188209174-3304326258-1817674253-1004\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1

IE - HKU\S-1-5-21-188209174-3304326258-1817674253-1004\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\Windows\System32\ieframe.dll (Microsoft Corporation)

IE - HKU\S-1-5-21-188209174-3304326258-1817674253-1004\..\URLSearchHook: {F3FEE66E-E034-436a-86E4-9690573BEE8A} - C:\Program Files\YouTube Downloader Toolbar\IE\4.4\youtubedownloaderToolbarIE.dll (Spigot, Inc.)

IE - HKU\S-1-5-21-188209174-3304326258-1817674253-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1

IE - HKU\S-1-5-21-188209174-3304326258-1817674253-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

IE - HKU\S-1-5-21-188209174-3304326258-1817674253-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:25437

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Yahoo"

FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=966134"

FF - prefs.js..browser.search.selectedEngine: "Yahoo"

FF - prefs.js..browser.startup.homepage: "www.google.bg"

FF - prefs.js..extensions.enabledItems: {d5bc46d8-67c7-11dc-8c1d-0097498c2b7a}:1.0.0.1

FF - prefs.js..extensions.enabledItems: {20a82645-c095-46ed-80e3-08825760534b}:1.1

FF - prefs.js..extensions.enabledItems: {B13721C7-F507-4982-B2E5-502A71474FED}:3.3.0.3971

FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.5.3

FF - prefs.js..keyword.URL: "http://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&type=966134&p="

FF - HKLM\software\mozilla\Firefox\Extensions\\{20a82645-c095-46ed-80e3-08825760534b}: c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [2009.09.26 19:45:52 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 2.0.0.14\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.03.29 17:41:14 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 2.0.0.14\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.03.18 21:25:51 | 000,000,000 | ---D | M]

[2009.09.26 17:01:07 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Elitsa Danailova\AppData\Roaming\Mozilla\Extensions

[2009.09.26 17:01:07 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Elitsa Danailova\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}

[2010.08.31 17:45:03 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Elitsa Danailova\AppData\Roaming\Mozilla\Firefox\Profiles\uery3fak.default\extensions

[2009.09.26 20:20:04 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Elitsa Danailova\AppData\Roaming\Mozilla\Firefox\Profiles\uery3fak.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}

[2010.02.19 23:31:04 | 000,002,234 | ---- | M] () -- C:\Users\Elitsa Danailova\AppData\Roaming\Mozilla\Firefox\Profiles\uery3fak.default\searchplugins\askcom.xml

[2010.12.05 13:49:31 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions

[2009.10.17 19:54:35 | 000,000,000 | ---D | M] (Dealio Toolbar Plugin) -- C:\Program Files\Mozilla Firefox\extensions\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}

[2009.10.11 19:11:26 | 000,000,000 | ---D | M] (Firefox (default)) -- C:\Program Files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

[2011.03.03 17:51:20 | 000,000,000 | ---D | M] (Skype extension) -- C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}

[2009.10.11 19:11:27 | 000,000,000 | ---D | M] (Talkback) -- C:\Program Files\Mozilla Firefox\extensions\[email protected]

[2011.06.16 10:38:40 | 000,000,000 | ---D | M] (No name found) -- C:\USERS\ELITSA DANAILOVA\PROGRAM FILES\DNA

[2009.09.26 20:21:08 | 000,023,544 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\browserdirprovider.dll

[2009.09.26 20:21:08 | 000,137,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\brwsrcmp.dll

[2008.04.07 10:16:09 | 000,067,696 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\jar50.dll

[2008.04.07 10:16:09 | 000,054,376 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\jsd3250.dll

[2008.04.07 10:16:09 | 000,034,952 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\myspell.dll

[2008.04.07 10:16:09 | 000,046,720 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\spellchk.dll

[2008.04.07 10:16:09 | 000,172,144 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\xpinstal.dll

[2008.09.04 03:11:24 | 000,054,600 | ---- | M] (BitTorrent, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npbittorrent.dll

[2007.02.05 00:02:56 | 001,642,496 | ---- | M] (LizardTech) -- C:\Program Files\Mozilla Firefox\plugins\npdjvu.dll

[2008.04.07 10:16:10 | 000,022,664 | ---- | M] (mozilla.org) -- C:\Program Files\Mozilla Firefox\plugins\npnul32.dll

[2007.01.18 01:05:32 | 000,002,368 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\google.xml

[2006.09.14 08:32:05 | 000,001,040 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-bg.xml

[2011.03.21 18:46:28 | 000,000,846 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo.xml

O1 HOSTS File: ([2011.06.07 00:25:23 | 000,000,761 | RHS- | M]) - C:\Windows\System32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1 localhost

O1 - Hosts: ::1 localhost

O2 - BHO: (Dealio Toolbar) - {01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} - C:\Program Files\Dealio Toolbar\DealioToolbarIE.dll (Spigot, Inc.)

O2 - BHO: (BHO_Startup Class) - {3134413B-49B4-425C-98A5-893C1F195601} - C:\Program Files\Hewlett-Packard\File Sanitizer\IEBHO.dll (Hewlett-Packard)

O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)

O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5805.1910\swg.dll (Google Inc.)

O2 - BHO: (Credential Manager for HP ProtectTools) - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - c:\Program Files\Hewlett-Packard\IAM\Bin\ItIEAddIn.dll (Bioscrypt Inc.)

O2 - BHO: (YouTube Downloader Toolbar) - {F3FEE66E-E034-436a-86E4-9690573BEE8A} - C:\Program Files\YouTube Downloader Toolbar\IE\4.4\youtubedownloaderToolbarIE.dll (Spigot, Inc.)

O3 - HKLM\..\Toolbar: (Dealio Toolbar) - {01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} - C:\Program Files\Dealio Toolbar\DealioToolbarIE.dll (Spigot, Inc.)

O3 - HKLM\..\Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - No CLSID value found.

O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

O3 - HKLM\..\Toolbar: (YouTube Downloader Toolbar) - {F3FEE66E-E034-436a-86E4-9690573BEE8A} - C:\Program Files\YouTube Downloader Toolbar\IE\4.4\youtubedownloaderToolbarIE.dll (Spigot, Inc.)

O3 - HKU\S-1-5-21-188209174-3304326258-1817674253-1004\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

O4 - HKLM..\Run: [] File not found

O4 - HKLM..\Run: [accrdsub] c:\Program Files\ActivIdentity\ActivClient\accrdsub.exe (ActivIdentity)

O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\avastUI.exe (AVAST Software)

O4 - HKLM..\Run: [CognizanceTS] c:\Program Files\Hewlett-Packard\IAM\Bin\ASTSVCC.dll (Bioscrypt Inc.)

O4 - HKLM..\Run: [File Sanitizer] C:\Program Files\Hewlett-Packard\File Sanitizer\CoreShredder.exe (Hewlett-Packard)

O4 - HKLM..\Run: [GrooveMonitor] C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe (Microsoft Corporation)

O4 - HKLM..\Run: [HP Health Check Scheduler] c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe (Hewlett-Packard)

O4 - HKLM..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\hpwuSchd2.exe (Hewlett-Packard Co.)

O4 - HKLM..\Run: [HPCam_Menu] c:\Program Files\Hewlett-Packard\HP Webcam\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)

O4 - HKLM..\Run: [iAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)

O4 - HKLM..\Run: [iSUSScheduler] C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe (Macrovision Corporation)

O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)

O4 - HKLM..\Run: [MDS_Menu] C:\Program Files\Olympus\ib\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)

O4 - HKLM..\Run: [PDF Complete] C:\Program Files\PDF Complete\pdfsty.exe (PDF Complete Inc)

O4 - HKLM..\Run: [PTHOSTTR] c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE (Hewlett-Packard Development Company, L.P.)

O4 - HKLM..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE (PowerISO Computing, Inc.)

O4 - HKLM..\Run: [QlbCtrl.exe] C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe ( Hewlett-Packard Development Company, L.P.)

O4 - HKLM..\Run: [searchSettings] C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe (Spigot, Inc.)

O4 - HKLM..\Run: [soundMAX] C:\Program Files\Analog Devices\SoundMAX\soundmax.exe (Analog Devices, Inc.)

O4 - HKLM..\Run: [soundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe (Analog Devices, Inc.)

O4 - HKLM..\Run: [startCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)

O4 - HKLM..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics Incorporated)

O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)

O4 - HKLM..\Run: [WirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe (Hewlett-Packard)

O4 - HKU\S-1-5-19..\Run: [sidebar] C:\Program Files\Windows Sidebar\Sidebar.exe (Microsoft Corporation)

O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\windows\System32\oobefldr.dll (Microsoft Corporation)

O4 - HKU\S-1-5-20..\Run: [sidebar] C:\Program Files\Windows Sidebar\Sidebar.exe (Microsoft Corporation)

O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\windows\System32\oobefldr.dll (Microsoft Corporation)

O4 - HKU\S-1-5-21-188209174-3304326258-1817674253-1004..\Run: [bitTorrent] C:\Program Files\BitTorrent\bittorrent.exe (BitTorrent, Inc.)

O4 - HKU\S-1-5-21-188209174-3304326258-1817674253-1004..\Run: [bitTorrent DNA] C:\Users\Elitsa Danailova\Program Files\DNA\btdna.exe (BitTorrent, Inc.)

O4 - HKU\S-1-5-21-188209174-3304326258-1817674253-1004..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\daemon.exe (DT Soft Ltd)

O4 - HKU\S-1-5-21-188209174-3304326258-1817674253-1004..\Run: [ehTray.exe] C:\Windows\ehome\ehtray.exe (Microsoft Corporation)

O4 - HKU\S-1-5-21-188209174-3304326258-1817674253-1004..\Run: [iSUSPM Startup] C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe (Macrovision Corporation)

O4 - HKU\S-1-5-21-188209174-3304326258-1817674253-1004..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe (Hewlett-Packard Company)

O4 - HKU\S-1-5-21-188209174-3304326258-1817674253-1004..\Run: [Olympus ib] C:\Program Files\Olympus\ib\olycamdetect.exe (OLYMPUS IMAGING CORP.)

O4 - HKU\S-1-5-21-188209174-3304326258-1817674253-1004..\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe (Microsoft Corporation)

O4 - HKU\S-1-5-21-188209174-3304326258-1817674253-1004..\Run: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)

O4 - HKU\S-1-5-21-188209174-3304326258-1817674253-1004..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: BindDirectlyToPropertySetStorage = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 153

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 2

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 2

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableInstallerDetection = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableSecureUIAPaths = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableVirtualization = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ValidateAdminCodeSignatures = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: scforceoption = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: FilterAdministratorToken = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableUIADesktopToggle = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_TEXT = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_BITMAP = 2

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_OEMTEXT = 7

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIB = 8

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_PALETTE = 9

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_UNICODETEXT = 13

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIBV5 = 17

O7 - HKU\S-1-5-21-188209174-3304326258-1817674253-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 153

O8 - Extra context menu item: E&xport to Microsoft Excel - c:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)

O8 - Extra context menu item: Send image to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()

O8 - Extra context menu item: Send page to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()

O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)

O9 - Extra Button: @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()

O9 - Extra 'Tools' menuitem : @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()

O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\Windows\System32\nlaapi.dll (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [] - C:\Windows\System32\NapiNSP.dll (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [] - C:\Windows\System32\pnrpnsp.dll (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Windows\System32\pnrpnsp.dll (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Windows\System32\wshbth.dll (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000006 [] - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Windows\System32\winrnr.dll (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Computer, Inc.)

O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000020 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000021 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000022 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000023 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000024 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000025 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000026 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000027 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000028 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000029 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000030 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000031 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000032 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000033 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O13 - gopher Prefix: missing

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 217.9.239.90 217.9.239.94

O18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)

O18 - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\Windows\System32\MSVidCtl.dll (Microsoft Corporation)

O18 - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\gopher {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)

O18 - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\System32\itss.dll (Microsoft Corporation)

O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)

O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll (Microsoft Corporation)

O18 - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)

O18 - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\Windows\System32\inetcomm.dll (Microsoft Corporation)

O18 - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)

O18 - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\System32\itss.dll (Microsoft Corporation)

O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll (Microsoft Corporation)

O18 - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)

O18 - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\Windows\System32\MSVidCtl.dll (Microsoft Corporation)

O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)

O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\windows\System32\mscoree.dll (Microsoft Corporation)

O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\windows\System32\mscoree.dll (Microsoft Corporation)

O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\windows\System32\mscoree.dll (Microsoft Corporation)

O18 - Protocol\Filter\deflate {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Filter\gzip {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)

O20 - AppInit_DLLs: (APSHook.dll) - C:\windows\System32\APSHook.dll (Bioscrypt Inc.)

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (rundll32 shell32) - C:\windows\System32\shell32.dll (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (Control_RunDLL "sysdm.cpl") - C:\windows\System32\sysdm.cpl (Microsoft Corporation)

O20 - HKU\S-1-5-21-188209174-3304326258-1817674253-1004 Winlogon: Shell - (Explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)

O20 - Winlogon\Notify\DeviceNP: DllName - DeviceNP.dll - C:\windows\System32\DeviceNP.dll (Hewlett-Packard Limited)

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\Windows\System32\webcheck.dll (Microsoft Corporation)

O22 - SharedTaskScheduler: {8C7461EF-2B13-11d2-BE35-3078302C2030} - Component Categories cache daemon - C:\Windows\System32\browseui.dll (Microsoft Corporation)

O24 - Desktop WallPaper: C:\Users\Elitsa Danailova\Pictures\dogs\New Folder\2f37a4e650e663d464b736c1d3b35d30.jpg

O24 - Desktop BackupWallPaper: C:\Users\Elitsa Danailova\Pictures\dogs\New Folder\2f37a4e650e663d464b736c1d3b35d30.jpg

O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)

O29 - HKLM SecurityProviders - (credssp.dll) - C:\windows\System32\credssp.dll (Microsoft Corporation)

O30 - LSA: Authentication Packages - (msv1_0) - C:\windows\System32\msv1_0.dll (Microsoft Corporation)

O30 - LSA: Security Packages - (kerberos) - C:\windows\System32\kerberos.dll (Microsoft Corporation)

O30 - LSA: Security Packages - (msv1_0) - C:\windows\System32\msv1_0.dll (Microsoft Corporation)

O30 - LSA: Security Packages - (schannel) - C:\windows\System32\schannel.dll (Microsoft Corporation)

O30 - LSA: Security Packages - (wdigest) - C:\windows\System32\wdigest.dll (Microsoft Corporation)

O30 - LSA: Security Packages - (tspkg) - C:\windows\System32\tspkg.dll (Microsoft Corporation)

O31 - SafeBoot: AlternateShell - cmd.exe

O32 - HKLM CDRom: AutoRun - 1

O33 - MountPoints2\{8796ad3a-56a4-11df-bc61-00247e7b9006}\Shell\AutoRun\command - "" = I:\PERO\\\\\\\\\\\SPECIJALAC.exe

O33 - MountPoints2\{8796ad3a-56a4-11df-bc61-00247e7b9006}\Shell\explore\command - "" = I:\PERO\\\\\\\\\\\\SPECIJALAC.exe

O33 - MountPoints2\{8796ad3a-56a4-11df-bc61-00247e7b9006}\Shell\open\command - "" = I:\PERO\\\\\\\\\\\\SPECIJALAC.exe

O33 - MountPoints2\{b5ba89b8-5425-11df-b238-00247e7b9006}\Shell\AutoRun\command - "" = I:\JANOS\\\\\\\\\\\CARDAS.exe

O33 - MountPoints2\{b5ba89b8-5425-11df-b238-00247e7b9006}\Shell\explore\command - "" = I:\JANOS\\\\\\\\\\\\CARDAS.exe

O33 - MountPoints2\{b5ba89b8-5425-11df-b238-00247e7b9006}\Shell\open\command - "" = I:\JANOS\\\\\\\\\\\\CARDAS.exe

O33 - MountPoints2\G\Shell - "" = AutoRun

O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\DisneySplash.exe

O34 - HKLM BootExecute: (autocheck autochk *) - File not found

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found

NetSvcs: Ias - File not found

NetSvcs: Nla - File not found

NetSvcs: Ntmssvc - File not found

NetSvcs: NWCWorkstation - File not found

NetSvcs: Nwsapagent - File not found

NetSvcs: SRService - File not found

NetSvcs: WmdmPmSp - File not found

NetSvcs: LogonHours - File not found

NetSvcs: PCAudit - File not found

NetSvcs: helpsvc - File not found

NetSvcs: uploadmgr - File not found

========== Files/Folders - Created Within 90 Days ==========

[2011.06.16 10:59:00 | 000,580,608 | ---- | C] (OldTimer Tools) -- C:\Users\Elitsa Danailova\Desktop\OTL.exe

[2011.06.09 17:34:13 | 000,000,000 | ---D | C] -- C:\Users\Elitsa Danailova\AppData\Roaming\SUPERAntiSpyware.com

[2011.06.09 17:34:13 | 000,000,000 | ---D | C] -- C:\ProgramData\SUPERAntiSpyware.com

[2011.06.09 17:33:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware

[2011.06.09 17:33:54 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware

[2011.06.09 17:31:38 | 011,377,912 | ---- | C] (SUPERAntiSpyware.com) -- C:\Users\Elitsa Danailova\Desktop\SUPERAntiSpyware.exe

[2011.06.09 14:49:29 | 000,000,000 | ---D | C] -- C:\Users\Elitsa Danailova\AppData\Roaming\Malwarebytes

[2011.06.09 14:49:23 | 000,039,984 | ---- | C] (Malwarebytes Corporation) -- C:\windows\System32\drivers\mbamswissarmy.sys

[2011.06.09 14:49:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2011.06.09 14:49:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2011.06.09 14:49:20 | 000,022,712 | ---- | C] (Malwarebytes Corporation) -- C:\windows\System32\drivers\mbam.sys

[2011.06.09 14:49:20 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware

[2011.06.08 21:53:37 | 009,435,312 | ---- | C] (Malwarebytes Corporation ) -- C:\Users\Elitsa Danailova\Desktop\mbam-setup-1.51.0.1200.exe

[2011.06.06 23:30:50 | 000,000,000 | -HSD | C] -- C:\ProgramData\SSBYVJUWS

[2011.06.06 23:30:29 | 000,000,000 | -HSD | C] -- C:\ProgramData\26cf0d

[2011.06.04 18:48:16 | 000,000,000 | ---D | C] -- C:\Program Files\YouTube Downloader Toolbar

[2011.06.04 18:48:16 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Spigot

[2011.06.04 18:48:16 | 000,000,000 | ---D | C] -- C:\Program Files\Application Updater

[2011.05.15 16:27:37 | 000,000,000 | ---D | C] -- C:\Users\Elitsa Danailova\Desktop\depron

[2011.05.15 16:10:37 | 000,000,000 | ---D | C] -- C:\Users\Elitsa Danailova\Documents\SW Log Files

[2011.05.14 21:59:20 | 000,000,000 | ---D | C] -- C:\Users\Elitsa Danailova\Desktop\New Folder (3)

[2011.05.13 23:35:56 | 000,000,000 | ---D | C] -- C:\Users\Elitsa Danailova\Desktop\Avatar.2009.EXTENDED_CE.(subs.sab.bz)

[2011.05.04 22:15:08 | 000,000,000 | ---D | C] -- C:\Users\Elitsa Danailova\Desktop\stand

[2011.05.01 16:14:24 | 004,240,384 | ---- | C] (Microsoft) -- C:\windows\System32\GameUXLegacyGDFs.dll

[2011.05.01 16:14:24 | 000,028,672 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\Apphlpdm.dll

[2011.05.01 16:14:16 | 000,876,032 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\XpsPrint.dll

[2011.04.17 13:51:57 | 000,000,000 | ---D | C] -- C:\Users\Elitsa Danailova\Desktop\TEST

[2011.04.16 19:24:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Magic Audio Converter

[2011.04.16 19:24:54 | 000,000,000 | ---D | C] -- C:\Program Files\Magic Audio Converter

[2011.04.16 18:48:27 | 000,000,000 | ---D | C] -- C:\Users\Elitsa Danailova\Desktop\dox_20110416165614100

[2011.04.15 12:37:42 | 000,292,864 | ---- | C] (Adobe Systems Incorporated) -- C:\windows\System32\atmfd.dll

[2011.04.15 12:37:42 | 000,034,304 | ---- | C] (Adobe Systems) -- C:\windows\System32\atmlib.dll

[2011.04.15 12:37:33 | 001,469,440 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\inetcpl.cpl

[2011.04.15 12:37:33 | 000,611,840 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\mstime.dll

[2011.04.15 12:37:33 | 000,602,112 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\msfeeds.dll

[2011.04.15 12:37:33 | 000,387,584 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\iedkcs32.dll

[2011.04.15 12:37:33 | 000,385,024 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\html.iec

[2011.04.15 12:37:33 | 000,184,320 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\iepeers.dll

[2011.04.15 12:37:33 | 000,164,352 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\ieui.dll

[2011.04.15 12:37:33 | 000,133,632 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\ieUnatt.exe

[2011.04.15 12:37:33 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\iesysprep.dll

[2011.04.15 12:37:33 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\iesetup.dll

[2011.04.15 12:37:33 | 000,055,808 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\iernonce.dll

[2011.04.15 12:37:33 | 000,055,296 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\msfeedsbs.dll

[2011.04.15 12:37:33 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\licmgr10.dll

[2011.04.15 12:37:33 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\jsproxy.dll

[2011.04.15 12:37:31 | 001,638,912 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\mshtml.tlb

[2011.04.15 12:37:31 | 000,173,568 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\ie4uinit.exe

[2011.04.15 12:37:31 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\msfeedssync.exe

[2011.04.15 12:37:27 | 001,162,240 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\mfc42u.dll

[2011.04.15 12:37:27 | 001,136,640 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\mfc42.dll

[2011.04.15 12:37:25 | 000,025,088 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dnscacheugc.exe

[2011.04.15 12:37:24 | 002,041,856 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\win32k.sys

[2011.04.15 12:37:22 | 000,726,528 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\jscript.dll

[2011.04.15 12:37:21 | 000,420,864 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\vbscript.dll

[2011.03.31 20:44:49 | 000,000,000 | ---D | C] -- C:\Users\Elitsa Danailova\Desktop\New Folder

[2011.03.26 12:33:30 | 000,000,000 | ---D | C] -- C:\ProgramData\McAfee

[2011.03.22 20:25:12 | 001,068,544 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\DWrite.dll

[2011.03.22 20:25:12 | 000,288,768 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\XpsGdiConverter.dll

[2011.03.19 20:57:49 | 000,000,000 | ---D | C] -- C:\Users\Elitsa Danailova\AppData\Roaming\FriendsGamesNetwork

[2011.03.19 20:42:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Big Fish Games

[2011.03.19 20:41:19 | 000,000,000 | ---D | C] -- C:\BigFishGamesCache

[2011.03.19 19:46:47 | 000,000,000 | ---D | C] -- C:\Users\Elitsa Danailova\Desktop\amor real

[2009.09.10 10:05:48 | 000,256,560 | ---- | C] ( ) -- C:\windows\System32\rsnp2uvc.dll

[2009.09.10 10:05:46 | 000,203,312 | ---- | C] ( ) -- C:\windows\System32\csnp2uvc.dll

[1 C:\Users\Elitsa Danailova\Desktop\*.tmp files -> C:\Users\Elitsa Danailova\Desktop\*.tmp -> ]

========== Files - Modified Within 90 Days ==========

[2011.06.16 11:17:18 | 000,001,006 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineUA.job

[2011.06.16 11:17:06 | 000,001,971 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk

[2011.06.16 10:58:04 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\Elitsa Danailova\Desktop\OTL.exe

[2011.06.16 10:43:59 | 000,634,400 | ---- | M] () -- C:\windows\System32\perfh009.dat

[2011.06.16 10:43:59 | 000,119,964 | ---- | M] () -- C:\windows\System32\perfc009.dat

[2011.06.16 10:39:35 | 000,000,440 | -H-- | M] () -- C:\windows\tasks\User_Feed_Synchronization-{0236E6BD-F06D-454B-8F4A-5A25B47BE46E}.job

[2011.06.16 10:38:46 | 000,065,536 | ---- | M] () -- C:\windows\System32\Ikeext.etl

[2011.06.16 10:38:38 | 000,001,002 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineCore.job

[2011.06.16 10:38:28 | 000,003,216 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

[2011.06.16 10:38:28 | 000,003,216 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

[2011.06.16 10:38:22 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat

[2011.06.16 10:38:18 | 3215,212,544 | -HS- | M] () -- C:\hiberfil.sys

[2011.06.13 23:12:18 | 000,000,012 | ---- | M] () -- C:\windows\bthservsdp.dat

[2011.06.12 17:54:44 | 000,019,456 | ---- | M] () -- C:\Users\Elitsa Danailova\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2011.06.12 17:30:07 | 000,005,642 | -HS- | M] () -- C:\ProgramData\KGyGaAvL.sys

[2011.06.09 17:33:57 | 000,001,800 | ---- | M] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk

[2011.06.09 17:24:15 | 011,377,912 | ---- | M] (SUPERAntiSpyware.com) -- C:\Users\Elitsa Danailova\Desktop\SUPERAntiSpyware.exe

[2011.06.09 14:49:23 | 000,000,906 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk

[2011.06.08 17:35:39 | 009,435,312 | ---- | M] (Malwarebytes Corporation ) -- C:\Users\Elitsa Danailova\Desktop\mbam-setup-1.51.0.1200.exe

[2011.06.07 19:33:27 | 000,210,030 | ---- | M] () -- C:\Users\Elitsa Danailova\Desktop\2.jpg

[2011.06.07 19:29:52 | 000,002,255 | ---- | M] () -- C:\Users\Elitsa Danailova\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk

[2011.06.07 00:32:57 | 000,048,879 | ---- | M] () -- C:\Users\Elitsa Danailova\Desktop\1.jpg

[2011.06.07 00:25:23 | 000,000,761 | RHS- | M] () -- C:\windows\System32\drivers\etc\hosts

[2011.06.05 20:52:18 | 000,002,703 | ---- | M] () -- C:\Users\Elitsa Danailova\Application Data\Microsoft\Internet Explorer\Quick Launch\CorelDRAW X4.lnk

[2011.05.29 09:11:30 | 000,039,984 | ---- | M] (Malwarebytes Corporation) -- C:\windows\System32\drivers\mbamswissarmy.sys

[2011.05.29 09:11:20 | 000,022,712 | ---- | M] (Malwarebytes Corporation) -- C:\windows\System32\drivers\mbam.sys

[2011.05.21 22:54:15 | 045,349,888 | ---- | M] () -- C:\Users\Elitsa Danailova\Desktop\trenirovka galiadog.avi

[2011.05.17 20:17:18 | 000,002,577 | ---- | M] () -- C:\windows\System32\config.nt

[2011.05.15 16:12:09 | 000,002,485 | ---- | M] () -- C:\Users\Elitsa Danailova\Desktop\DWGeditor.lnk

[2011.05.14 22:01:00 | 061,145,246 | ---- | M] () -- C:\Users\Elitsa Danailova\Desktop\New Folder (3).rar

[2011.05.10 15:10:59 | 000,040,112 | ---- | M] (AVAST Software) -- C:\windows\avastSS.scr

[2011.05.10 15:10:55 | 000,199,304 | ---- | M] (AVAST Software) -- C:\windows\System32\aswBoot.exe

[2011.05.10 15:03:54 | 000,441,176 | ---- | M] (AVAST Software) -- C:\windows\System32\drivers\aswSnx.sys

[2011.05.10 15:03:44 | 000,307,928 | ---- | M] (AVAST Software) -- C:\windows\System32\drivers\aswSP.sys

[2011.05.10 15:02:37 | 000,049,240 | ---- | M] (AVAST Software) -- C:\windows\System32\drivers\aswTdi.sys

[2011.05.10 14:59:56 | 000,025,432 | ---- | M] (AVAST Software) -- C:\windows\System32\drivers\aswRdr.sys

[2011.05.10 14:59:44 | 000,053,592 | ---- | M] (AVAST Software) -- C:\windows\System32\drivers\aswMonFlt.sys

[2011.05.10 14:59:35 | 000,019,544 | ---- | M] (AVAST Software) -- C:\windows\System32\drivers\aswFsBlk.sys

[2011.05.05 06:45:13 | 002,367,771 | ---- | M] () -- C:\Users\Elitsa Danailova\Desktop\Dog Show.pdf

[2011.05.05 06:42:30 | 001,008,934 | ---- | M] () -- C:\Users\Elitsa Danailova\Desktop\labyrinth.pdf

[2011.05.05 02:28:32 | 000,043,977 | ---- | M] () -- C:\Users\Elitsa Danailova\Desktop\WindowsBroken0010_1_thumbhuge.jpg

[2011.05.04 23:48:26 | 000,085,356 | ---- | M] () -- C:\Users\Elitsa Danailova\Desktop\Assem1.pdf

[2011.05.04 23:44:30 | 000,089,271 | ---- | M] () -- C:\Users\Elitsa Danailova\Desktop\Assem2.pdf

[2011.05.04 00:54:54 | 000,524,229 | ---- | M] () -- C:\Users\Elitsa Danailova\Desktop\Backup_of_labyrinth.cdr

[2011.05.03 12:18:52 | 000,150,195 | ---- | M] () -- C:\Users\Elitsa Danailova\Desktop\group 3_Elitsa Danailova.cdr

[2011.05.03 10:11:36 | 000,030,532 | ---- | M] () -- C:\Users\Elitsa Danailova\Desktop\XM 1351.pdf

[2011.05.03 10:11:10 | 000,008,304 | ---- | M] () -- C:\Users\Elitsa Danailova\Desktop\M 1350.pdf

[2011.05.03 10:10:58 | 000,008,869 | ---- | M] () -- C:\Users\Elitsa Danailova\Desktop\M 1352.pdf

[2011.05.03 09:46:56 | 000,438,550 | ---- | M] () -- C:\Users\Elitsa Danailova\Desktop\octanorm1.bmp

[2011.05.02 22:53:50 | 000,026,754 | ---- | M] () -- C:\Users\Elitsa Danailova\Desktop\Backup_of_labyrinth logo.cdr

[2011.05.02 21:36:43 | 001,112,839 | ---- | M] () -- C:\Users\Elitsa Danailova\Desktop\P5020493.JPG

[2011.05.02 20:31:42 | 001,122,713 | ---- | M] () -- C:\Users\Elitsa Danailova\Desktop\P5020492.JPG

[2011.04.24 13:36:54 | 002,752,538 | ---- | M] () -- C:\Users\Elitsa Danailova\IMG_0376.jpg

[2011.04.24 13:36:54 | 002,707,585 | ---- | M] () -- C:\Users\Elitsa Danailova\IMG_0385.jpg

[2011.04.24 13:36:54 | 002,636,673 | ---- | M] () -- C:\Users\Elitsa Danailova\IMG_0380.jpg

[2011.04.24 13:36:54 | 002,607,450 | ---- | M] () -- C:\Users\Elitsa Danailova\IMG_0384.jpg

[2011.04.24 13:36:53 | 002,671,715 | ---- | M] () -- C:\Users\Elitsa Danailova\IMG_0383.jpg

[2011.04.24 13:36:53 | 002,634,351 | ---- | M] () -- C:\Users\Elitsa Danailova\IMG_0379.jpg

[2011.04.24 13:36:53 | 002,620,251 | ---- | M] () -- C:\Users\Elitsa Danailova\IMG_0386.jpg

[2011.04.24 12:26:46 | 001,006,012 | ---- | M] () -- C:\Users\Elitsa Danailova\Desktop\P4240491.JPG

[2011.04.24 12:26:22 | 001,000,442 | ---- | M] () -- C:\Users\Elitsa Danailova\Desktop\P4240490.JPG

[2011.04.24 12:25:10 | 000,988,498 | ---- | M] () -- C:\Users\Elitsa Danailova\Desktop\P4240489.JPG

[2011.04.16 19:24:55 | 000,000,781 | ---- | M] () -- C:\Users\Elitsa Danailova\Desktop\Magic Audio Converter.lnk

[2011.04.16 16:56:23 | 008,502,949 | ---- | M] () -- C:\Users\Elitsa Danailova\Desktop\dox_20110416165614100.zip

[2011.04.16 16:51:26 | 002,679,940 | ---- | M] () -- C:\Users\Elitsa Danailova\Desktop\ABV_attachment.zip

[2011.04.15 20:11:34 | 001,779,992 | ---- | M] () -- C:\windows\System32\FNTCACHE.DAT

[2011.04.14 20:08:21 | 000,580,632 | ---- | M] () -- C:\Users\Elitsa Danailova\Desktop\CCF11042011_00000.jpg

[2011.04.03 20:07:12 | 000,378,368 | ---- | M] () -- C:\Users\Elitsa Danailova\Desktop\shtand knigi.SLDPRT

[2011.04.02 16:41:06 | 098,965,975 | ---- | M] () -- C:\Users\Elitsa Danailova\Desktop\P4020366.MP4

[2011.04.02 16:37:08 | 170,397,583 | ---- | M] () -- C:\Users\Elitsa Danailova\Desktop\P4020365.MP4

[2011.04.02 14:51:54 | 018,197,211 | ---- | M] () -- C:\Users\Elitsa Danailova\Desktop\P4020364.MP4

[2011.03.27 22:22:48 | 000,002,651 | ---- | M] () -- C:\Users\Elitsa Danailova\Application Data\Microsoft\Internet Explorer\Quick Launch\Microsoft Office Word 2007.lnk

[2011.03.26 12:33:16 | 000,000,919 | ---- | M] () -- C:\Users\Public\Desktop\YouTube Downloader.lnk

[2011.03.20 19:27:30 | 000,241,786 | ---- | M] () -- C:\Users\Elitsa Danailova\Desktop\S_Labyrinth_Return2.jpg

[2011.03.20 19:25:17 | 000,001,894 | ---- | M] () -- C:\Users\Elitsa Danailova\Desktop\labyrinth.png

[2011.03.20 19:24:10 | 000,007,451 | ---- | M] () -- C:\Users\Elitsa Danailova\Desktop\imagesCAZSKHGK.jpg

[1 C:\Users\Elitsa Danailova\Desktop\*.tmp files -> C:\Users\Elitsa Danailova\Desktop\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011.06.09 17:33:57 | 000,001,800 | ---- | C] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk

[2011.06.09 14:55:41 | 3215,212,544 | -HS- | C] () -- C:\hiberfil.sys

[2011.06.09 14:49:23 | 000,000,906 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk

[2011.06.07 19:33:27 | 000,210,030 | ---- | C] () -- C:\Users\Elitsa Danailova\Desktop\2.jpg

[2011.06.07 00:32:56 | 000,048,879 | ---- | C] () -- C:\Users\Elitsa Danailova\Desktop\1.jpg

[2011.05.21 22:53:01 | 045,349,888 | ---- | C] () -- C:\Users\Elitsa Danailova\Desktop\trenirovka galiadog.avi

[2011.05.14 22:00:37 | 061,145,246 | ---- | C] () -- C:\Users\Elitsa Danailova\Desktop\New Folder (3).rar

[2011.05.05 06:45:01 | 002,367,771 | ---- | C] () -- C:\Users\Elitsa Danailova\Desktop\Dog Show.pdf

[2011.05.05 06:42:21 | 001,008,934 | ---- | C] () -- C:\Users\Elitsa Danailova\Desktop\labyrinth.pdf

[2011.05.05 02:28:50 | 000,043,977 | ---- | C] () -- C:\Users\Elitsa Danailova\Desktop\WindowsBroken0010_1_thumbhuge.jpg

[2011.05.04 23:48:19 | 000,085,356 | ---- | C] () -- C:\Users\Elitsa Danailova\Desktop\Assem1.pdf

[2011.05.04 23:44:26 | 000,089,271 | ---- | C] () -- C:\Users\Elitsa Danailova\Desktop\Assem2.pdf

[2011.05.03 12:18:52 | 000,150,195 | ---- | C] () -- C:\Users\Elitsa Danailova\Desktop\group 3_Elitsa Danailova.cdr

[2011.05.03 11:56:20 | 000,438,550 | ---- | C] () -- C:\Users\Elitsa Danailova\Desktop\octanorm1.bmp

[2011.05.03 11:56:20 | 000,030,532 | ---- | C] () -- C:\Users\Elitsa Danailova\Desktop\XM 1351.pdf

[2011.05.03 11:56:20 | 000,008,869 | ---- | C] () -- C:\Users\Elitsa Danailova\Desktop\M 1352.pdf

[2011.05.03 11:56:20 | 000,008,304 | ---- | C] () -- C:\Users\Elitsa Danailova\Desktop\M 1350.pdf

[2011.05.02 23:00:24 | 000,026,754 | ---- | C] () -- C:\Users\Elitsa Danailova\Desktop\Backup_of_labyrinth logo.cdr

[2011.05.02 21:36:04 | 001,122,713 | ---- | C] () -- C:\Users\Elitsa Danailova\Desktop\P5020492.JPG

[2011.05.02 21:36:04 | 001,112,839 | ---- | C] () -- C:\Users\Elitsa Danailova\Desktop\P5020493.JPG

[2011.04.24 13:36:44 | 002,752,538 | ---- | C] () -- C:\Users\Elitsa Danailova\IMG_0376.jpg

[2011.04.24 13:36:44 | 002,636,673 | ---- | C] () -- C:\Users\Elitsa Danailova\IMG_0380.jpg

[2011.04.24 13:36:44 | 002,634,351 | ---- | C] () -- C:\Users\Elitsa Danailova\IMG_0379.jpg

[2011.04.24 13:36:44 | 002,620,251 | ---- | C] () -- C:\Users\Elitsa Danailova\IMG_0386.jpg

[2011.04.24 13:36:43 | 002,707,585 | ---- | C] () -- C:\Users\Elitsa Danailova\IMG_0385.jpg

[2011.04.24 13:36:43 | 002,671,715 | ---- | C] () -- C:\Users\Elitsa Danailova\IMG_0383.jpg

[2011.04.24 13:36:43 | 002,607,450 | ---- | C] () -- C:\Users\Elitsa Danailova\IMG_0384.jpg

[2011.04.24 13:30:11 | 001,006,012 | ---- | C] () -- C:\Users\Elitsa Danailova\Desktop\P4240491.JPG

[2011.04.24 13:30:11 | 001,000,442 | ---- | C] () -- C:\Users\Elitsa Danailova\Desktop\P4240490.JPG

[2011.04.24 13:30:11 | 000,988,498 | ---- | C] () -- C:\Users\Elitsa Danailova\Desktop\P4240489.JPG

[2011.04.16 19:24:55 | 000,000,781 | ---- | C] () -- C:\Users\Elitsa Danailova\Desktop\Magic Audio Converter.lnk

[2011.04.16 16:56:16 | 008,502,949 | ---- | C] () -- C:\Users\Elitsa Danailova\Desktop\dox_20110416165614100.zip

[2011.04.16 16:51:24 | 002,679,940 | ---- | C] () -- C:\Users\Elitsa Danailova\Desktop\ABV_attachment.zip

[2011.04.14 20:08:19 | 000,580,632 | ---- | C] () -- C:\Users\Elitsa Danailova\Desktop\CCF11042011_00000.jpg

[2011.04.05 20:12:53 | 098,965,975 | ---- | C] () -- C:\Users\Elitsa Danailova\Desktop\P4020366.MP4

[2011.04.05 20:12:43 | 170,397,583 | ---- | C] () -- C:\Users\Elitsa Danailova\Desktop\P4020365.MP4

[2011.04.05 20:12:42 | 018,197,211 | ---- | C] () -- C:\Users\Elitsa Danailova\Desktop\P4020364.MP4

[2011.04.03 19:24:34 | 000,378,368 | ---- | C] () -- C:\Users\Elitsa Danailova\Desktop\shtand knigi.SLDPRT

[2011.03.20 20:48:16 | 000,524,229 | ---- | C] () -- C:\Users\Elitsa Danailova\Desktop\Backup_of_labyrinth.cdr

[2011.03.20 19:31:36 | 000,001,894 | ---- | C] () -- C:\Users\Elitsa Danailova\Desktop\labyrinth.png

[2011.03.20 19:27:50 | 000,241,786 | ---- | C] () -- C:\Users\Elitsa Danailova\Desktop\S_Labyrinth_Return2.jpg

[2011.03.20 19:24:54 | 000,007,451 | ---- | C] () -- C:\Users\Elitsa Danailova\Desktop\imagesCAZSKHGK.jpg

[2011.02.11 20:20:39 | 000,000,680 | ---- | C] () -- C:\Users\Elitsa Danailova\AppData\Local\d3d9caps.dat

[2011.02.10 21:02:28 | 000,000,127 | ---- | C] () -- C:\windows\System32\MRT.INI

[2010.06.06 17:20:02 | 000,065,344 | ---- | C] () -- C:\windows\System32\PDFreDirectMonNT.dll

[2010.06.05 10:50:11 | 000,114,816 | ---- | C] () -- C:\windows\hpgins21.dat.temp

[2010.06.05 10:50:11 | 000,000,282 | ---- | C] () -- C:\windows\hpgmdl21.dat.temp

[2010.02.18 19:58:54 | 000,132,284 | R--- | C] () -- C:\Program Files\nx6.lic

[2010.01.04 13:00:51 | 000,000,000 | ---- | C] () -- C:\windows\eDrawingOfficeAutomator.INI

[2009.12.13 13:32:32 | 000,115,320 | ---- | C] () -- C:\windows\hpgins21.dat

[2009.10.08 19:14:51 | 000,241,664 | ---- | C] () -- C:\windows\System32\hppapr04.DLL

[2009.10.08 19:14:51 | 000,000,526 | ---- | C] () -- C:\windows\System32\hppapr04.DAT

[2009.09.26 20:31:08 | 000,117,248 | ---- | C] () -- C:\windows\System32\EhStorAuthn.dll

[2009.09.26 20:31:08 | 000,107,612 | ---- | C] () -- C:\windows\System32\StructuredQuerySchema.bin

[2009.09.26 19:37:31 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat

[2009.09.26 16:59:55 | 000,168,448 | ---- | C] () -- C:\windows\System32\unrar.dll

[2009.09.26 16:59:55 | 000,000,038 | ---- | C] () -- C:\windows\avisplitter.ini

[2009.09.26 16:59:54 | 000,881,664 | ---- | C] () -- C:\windows\System32\xvidcore.dll

[2009.09.26 16:59:53 | 003,596,288 | ---- | C] () -- C:\windows\System32\qt-dx331.dll

[2009.09.26 16:59:53 | 000,205,824 | ---- | C] () -- C:\windows\System32\xvidvfw.dll

[2009.09.26 16:59:52 | 000,085,504 | ---- | C] () -- C:\windows\System32\ff_vfw.dll

[2009.09.10 17:41:52 | 000,000,000 | ---- | C] () -- C:\windows\ativpsrm.bin

[2009.09.10 17:41:11 | 000,000,012 | ---- | C] () -- C:\windows\bthservsdp.dat

[2009.09.10 10:41:36 | 000,019,456 | ---- | C] () -- C:\Users\Elitsa Danailova\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2009.09.10 10:32:51 | 000,005,642 | -HS- | C] () -- C:\ProgramData\KGyGaAvL.sys

[2009.09.10 10:32:51 | 000,000,008 | RHS- | C] () -- C:\ProgramData\E7EFFA150C.sys

[2009.09.10 10:05:47 | 001,765,168 | ---- | C] () -- C:\windows\System32\drivers\snp2uvc.sys

[2009.09.10 10:05:47 | 000,034,480 | ---- | C] () -- C:\windows\System32\drivers\sncduvc.sys

[2009.09.10 10:05:47 | 000,027,184 | ---- | C] () -- C:\windows\snuvcdsm.exe

[2009.09.10 10:05:47 | 000,015,497 | ---- | C] () -- C:\windows\snp2uvc.ini

[2009.06.24 08:33:42 | 000,018,904 | ---- | C] () -- C:\windows\System32\StructuredQuerySchemaTrivial.bin

[2009.02.03 14:00:00 | 000,159,744 | ---- | C] () -- C:\windows\System32\atitmmxx.dll

[2009.02.03 14:00:00 | 000,011,264 | ---- | C] () -- C:\windows\System32\atimuixx.dll

[2008.10.29 07:13:00 | 000,180,720 | ---- | C] () -- C:\windows\System32\atiicdxx.dat

[2008.10.21 02:40:00 | 000,081,920 | ---- | C] () -- C:\windows\System32\ATIODE.exe

[2008.10.21 02:40:00 | 000,045,056 | ---- | C] () -- C:\windows\System32\ATIODCLI.exe

[2008.10.02 01:01:58 | 000,109,216 | ---- | C] () -- C:\windows\System32\drivers\SafeBoot.sys

[2008.08.07 01:19:14 | 000,294,912 | ---- | C] () -- C:\windows\System32\flcdlmsg.dll

[2007.11.28 03:41:06 | 000,114,688 | ---- | C] () -- C:\windows\System32\aicext.dll

[2007.05.02 20:39:06 | 000,000,282 | ---- | C] () -- C:\windows\hpgmdl21.dat

[2006.11.02 15:57:28 | 000,067,584 | --S- | C] () -- C:\windows\bootstat.dat

[2006.11.02 15:47:37 | 001,779,992 | ---- | C] () -- C:\windows\System32\FNTCACHE.DAT

[2006.11.02 15:35:32 | 000,005,632 | ---- | C] () -- C:\windows\System32\sysprepMCE.dll

[2006.11.02 13:33:01 | 000,634,400 | ---- | C] () -- C:\windows\System32\perfh009.dat

[2006.11.02 13:33:01 | 000,287,440 | ---- | C] () -- C:\windows\System32\perfi009.dat

[2006.11.02 13:33:01 | 000,119,964 | ---- | C] () -- C:\windows\System32\perfc009.dat

[2006.11.02 13:33:01 | 000,030,674 | ---- | C] () -- C:\windows\System32\perfd009.dat

[2006.11.02 13:23:21 | 000,215,943 | ---- | C] () -- C:\windows\System32\dssec.dat

[2006.11.02 11:58:30 | 000,043,131 | ---- | C] () -- C:\windows\mib.bin

[2006.11.02 11:19:00 | 000,000,741 | ---- | C] () -- C:\windows\System32\NOISE.DAT

[2006.11.02 10:40:29 | 000,013,750 | ---- | C] () -- C:\windows\System32\pacerprf.ini

[2006.11.02 10:25:31 | 000,673,088 | ---- | C] () -- C:\windows\System32\mlang.dat

[2006.06.13 17:35:32 | 000,053,760 | ---- | C] () -- C:\windows\System32\zlib.dll

[2005.04.04 02:30:00 | 000,110,592 | ---- | C] () -- C:\windows\System32\scardsyn.dll

[2003.12.09 01:08:20 | 002,539,520 | ---- | C] () -- C:\windows\System32\Bbgspdf.dll

[2003.12.02 14:39:08 | 000,094,208 | ---- | C] () -- C:\windows\System32\InstallPrinter.dll

[2003.01.30 07:04:00 | 000,618,496 | ---- | C] () -- C:\windows\System32\stlpmt45.dll

[1998.05.07 07:10:00 | 000,069,632 | ---- | C] () -- C:\windows\System32\ODMA32.dll

========== LOP Check ==========

[2009.09.26 17:32:44 | 000,000,000 | ---D | M] -- C:\Users\Elitsa Danailova\AppData\Roaming\Ashampoo

[2009.09.26 20:42:07 | 000,000,000 | ---D | M] -- C:\Users\Elitsa Danailova\AppData\Roaming\Autodesk

[2011.06.16 11:20:32 | 000,000,000 | ---D | M] -- C:\Users\Elitsa Danailova\AppData\Roaming\BitTorrent

[2011.03.06 01:23:31 | 000,000,000 | ---D | M] -- C:\Users\Elitsa Danailova\AppData\Roaming\BSplayer PRO

[2009.09.26 17:09:08 | 000,000,000 | ---D | M] -- C:\Users\Elitsa Danailova\AppData\Roaming\DAEMON Tools

[2011.06.16 11:18:44 | 000,000,000 | ---D | M] -- C:\Users\Elitsa Danailova\AppData\Roaming\DNA

[2010.01.03 14:22:19 | 000,000,000 | ---D | M] -- C:\Users\Elitsa Danailova\AppData\Roaming\DWGeditor

[2011.03.19 20:57:49 | 000,000,000 | ---D | M] -- C:\Users\Elitsa Danailova\AppData\Roaming\FriendsGamesNetwork

[2011.05.15 14:31:37 | 000,000,000 | ---D | M] -- C:\Users\Elitsa Danailova\AppData\Roaming\Image Zone Express

[2009.09.10 10:32:54 | 000,000,000 | ---D | M] -- C:\Users\Elitsa Danailova\AppData\Roaming\InterVideo

[2009.12.16 01:46:36 | 000,000,000 | ---D | M] -- C:\Users\Elitsa Danailova\AppData\Roaming\Nokia

[2009.12.15 23:01:27 | 000,000,000 | ---D | M] -- C:\Users\Elitsa Danailova\AppData\Roaming\PC Suite

[2011.02.27 20:20:57 | 000,000,000 | ---D | M] -- C:\Users\Elitsa Danailova\AppData\Roaming\PDF reDirect

[2009.12.13 14:09:36 | 000,000,000 | ---D | M] -- C:\Users\Elitsa Danailova\AppData\Roaming\Printer Info Cache

[2011.06.13 23:12:18 | 000,032,542 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

[2011.06.16 10:39:35 | 000,000,440 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{0236E6BD-F06D-454B-8F4A-5A25B47BE46E}.job

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >

[2009.04.11 09:36:36 | 000,333,257 | RHS- | M] () -- C:\bootmgr

[2011.06.16 10:38:18 | 3215,212,544 | -HS- | M] () -- C:\hiberfil.sys

[2010.12.01 20:23:12 | 000,000,000 | RHS- | M] () -- C:\IO.SYS

[2010.12.01 20:23:12 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS

[2011.06.16 10:38:16 | 3528,933,376 | -HS- | M] () -- C:\pagefile.sys

< %USERPROFILE%\*.* >

[2010.05.06 12:32:30 | 000,004,096 | ---- | M] () -- C:\Users\Elitsa Danailova\00010004.ci

[2010.05.06 12:32:30 | 000,004,096 | ---- | M] () -- C:\Users\Elitsa Danailova\Contacts(0001)

[2010.05.06 12:32:30 | 000,004,096 | ---- | M] () -- C:\Users\Elitsa Danailova\Desktop(0001)

[2010.05.06 12:32:30 | 000,065,536 | ---- | M] () -- C:\Users\Elitsa Danailova\Desktop(0002)

[2011.04.24 13:36:54 | 002,752,538 | ---- | M] () -- C:\Users\Elitsa Danailova\IMG_0376.jpg

[2011.04.24 13:36:53 | 002,634,351 | ---- | M] () -- C:\Users\Elitsa Danailova\IMG_0379.jpg

[2011.04.24 13:36:54 | 002,636,673 | ---- | M] () -- C:\Users\Elitsa Danailova\IMG_0380.jpg

[2011.04.24 13:36:53 | 002,671,715 | ---- | M] () -- C:\Users\Elitsa Danailova\IMG_0383.jpg

[2011.04.24 13:36:54 | 002,607,450 | ---- | M] () -- C:\Users\Elitsa Danailova\IMG_0384.jpg

[2011.04.24 13:36:54 | 002,707,585 | ---- | M] () -- C:\Users\Elitsa Danailova\IMG_0385.jpg

[2011.04.24 13:36:53 | 002,620,251 | ---- | M] () -- C:\Users\Elitsa Danailova\IMG_0386.jpg

[2011.06.16 11:20:28 | 004,718,592 | -HS- | M] () -- C:\Users\Elitsa Danailova\ntuser.dat

[2011.06.16 11:20:28 | 000,262,144 | -H-- | M] () -- C:\Users\Elitsa Danailova\ntuser.dat.LOG1

[2009.09.10 10:00:10 | 000,000,000 | -H-- | M] () -- C:\Users\Elitsa Danailova\ntuser.dat.LOG2

[2011.03.07 17:59:15 | 000,065,536 | -HS- | M] () -- C:\Users\Elitsa Danailova\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf

[2011.03.07 17:59:15 | 000,524,288 | -HS- | M] () -- C:\Users\Elitsa Danailova\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms

[2009.09.10 10:57:50 | 000,524,288 | -HS- | M] () -- C:\Users\Elitsa Danailova\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000002.regtrans-ms

[2011.06.13 23:12:17 | 000,065,536 | -HS- | M] () -- C:\Users\Elitsa Danailova\ntuser.dat{ebf7a5af-4a3b-11e0-bfa2-00247e7b9006}.TM.blf

[2011.06.13 23:12:17 | 000,524,288 | -HS- | M] () -- C:\Users\Elitsa Danailova\ntuser.dat{ebf7a5af-4a3b-11e0-bfa2-00247e7b9006}.TMContainer00000000000000000001.regtrans-ms

[2011.03.09 14:03:01 | 000,524,288 | -HS- | M] () -- C:\Users\Elitsa Danailova\ntuser.dat{ebf7a5af-4a3b-11e0-bfa2-00247e7b9006}.TMContainer00000000000000000002.regtrans-ms

[2009.09.10 10:00:10 | 000,000,020 | -HS- | M] () -- C:\Users\Elitsa Danailova\ntuser.ini

< %USERPROFILE%\Application Data\*.* >

< %USERPROFILE%\Local Settings\Application Data\*.* >

< %AllUsersProfile%\*.* >

[2009.09.10 10:32:51 | 000,000,008 | RHS- | M] () -- C:\ProgramData\E7EFFA150C.sys

[2009.09.26 19:37:31 | 000,000,056 | -H-- | M] () -- C:\ProgramData\ezsidmv.dat

[2009.06.24 10:38:14 | 000,000,253 | ---- | M] () -- C:\ProgramData\HPWALog.txt

[2010.06.05 11:28:30 | 000,005,838 | ---- | M] () -- C:\ProgramData\hpzinstall.log

[2011.06.12 17:30:07 | 000,005,642 | -HS- | M] () -- C:\ProgramData\KGyGaAvL.sys

< %AllUsersProfile%\Application Data\*.* >

< %USERPROFILE%\My Documents\*.* >

< %CommonProgramFiles%\*.* >

< %PROGRAMFILES%\*.* >

[2008.01.21 05:43:21 | 000,000,174 | -HS- | M] () -- C:\Program Files\desktop.ini

[2008.07.03 22:50:05 | 000,132,284 | R--- | M] () -- C:\Program Files\nx6.lic

[2010.02.18 20:00:15 | 000,264,570 | ---- | M] () -- C:\Program Files\nx6.txt

< %systemroot%\system32\*.dll /lockedfiles >

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /90 >

[2011.05.10 14:59:35 | 000,019,544 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswFsBlk.sys

[2011.05.10 14:59:44 | 000,053,592 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswMonFlt.sys

[2011.05.10 14:59:56 | 000,025,432 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswRdr.sys

[2011.05.10 15:03:54 | 000,441,176 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswSnx.sys

[2011.05.10 15:03:44 | 000,307,928 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswSP.sys

[2011.05.10 15:02:37 | 000,049,240 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswTdi.sys

[2011.05.29 09:11:20 | 000,022,712 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys

[2011.05.29 09:11:30 | 000,039,984 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys

< %systemroot%\system32\drivers\*.sys /lockedfiles >

[2008.10.02 01:01:58 | 000,109,216 | ---- | M] () Unable to obtain MD5 -- C:\Windows\System32\drivers\SafeBoot.sys

[2009.09.26 17:09:23 | 000,717,296 | ---- | M] () Unable to obtain MD5 -- C:\Windows\System32\drivers\sptd.sys

< %systemroot%\system32\Spool\prtprocs\w32x86\*.dll >

[2006.04.25 06:07:24 | 000,069,120 | ---- | M] (Hewlett-Packard Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\hpzpp43e.dll

[2006.11.02 15:35:48 | 000,022,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\jnwppr.dll

[2006.10.26 19:56:12 | 000,033,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\msonpppr.dll

< MD5 for: EXPLORER.EXE >

[2009.06.24 08:54:52 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe

[2009.06.24 08:54:52 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe

[2009.06.24 08:54:51 | 002,927,616 | ---- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe

[2009.04.11 09:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\explorer.exe

[2009.04.11 09:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe

[2009.06.24 08:54:52 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe

[2008.01.21 05:24:24 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe

< MD5 for: USERINIT.EXE >

[2008.01.21 05:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe

[2008.01.21 05:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe

< MD5 for: VOLSNAP.SYS >

[2006.11.02 12:51:18 | 000,208,488 | ---- | M] (Microsoft Corporation) MD5=11EF6C1CAEF76B685233450A126125D6 -- C:\Windows\System32\DriverStore\FileRepository\volume.inf_9320b452\volsnap.sys

[2009.04.11 09:32:55 | 000,226,280 | ---- | M] (Microsoft Corporation) MD5=147281C01FCB1DF9252DE2A10D5E7093 -- C:\Windows\System32\drivers\volsnap.sys

[2009.04.11 09:32:55 | 000,226,280 | ---- | M] (Microsoft Corporation) MD5=147281C01FCB1DF9252DE2A10D5E7093 -- C:\Windows\System32\DriverStore\FileRepository\volume.inf_1e6030e4\volsnap.sys

[2009.04.11 09:32:55 | 000,226,280 | ---- | M] (Microsoft Corporation) MD5=147281C01FCB1DF9252DE2A10D5E7093 -- C:\Windows\winsxs\x86_volume.inf_31bf3856ad364e35_6.0.6002.18005_none_17a2308cf936c619\volsnap.sys

[2008.01.21 05:23:21 | 000,227,896 | ---- | M] (Microsoft Corporation) MD5=D8B4A53DD2769F226B3EB374374987C9 -- C:\Windows\System32\DriverStore\FileRepository\volume.inf_f53a1785\volsnap.sys

[2008.01.21 05:23:21 | 000,227,896 | ---- | M] (Microsoft Corporation) MD5=D8B4A53DD2769F226B3EB374374987C9 -- C:\Windows\winsxs\x86_volume.inf_31bf3856ad364e35_6.0.6001.18000_none_15b6b780fc14facd\volsnap.sys

< MD5 for: WININIT.EXE >

[2008.01.21 05:23:42 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\System32\wininit.exe

[2008.01.21 05:23:42 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe

< MD5 for: WINLOGON.EXE >

[2009.04.11 09:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe

[2009.04.11 09:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe

[2008.01.21 05:24:49 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe

========== Alternate Data Streams ==========

@Alternate Data Stream - 167 bytes -> C:\ProgramData\Temp:CB0FEE2B

@Alternate Data Stream - 131 bytes -> C:\ProgramData\Temp:512336B9

< End of report >

Extras:

OTL Extras logfile created on: 16.6.2011 г. 11:16:32 - Run 1

OTL by OldTimer - Version 3.2.24.0 Folder = C:\Users\Elitsa Danailova\Desktop

Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.19048)

Locale: 00000402 | Country: Bulgaria | Language: BGR | Date Format: d.M.yyyy 'г.'

2,99 Gb Total Physical Memory | 1,82 Gb Available Physical Memory | 60,73% Memory free

6,19 Gb Paging File | 4,75 Gb Available in Paging File | 76,78% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files

Drive C: | 454,76 Gb Total Space | 221,06 Gb Free Space | 48,61% Space Free | Partition Type: NTFS

Drive D: | 10,00 Gb Total Space | 1,35 Gb Free Space | 13,48% Space Free | Partition Type: NTFS

Drive F: | 1022,00 Mb Total Space | 997,02 Mb Free Space | 97,56% Space Free | Partition Type: FAT32

Drive I: | 973,63 Mb Total Space | 774,53 Mb Free Space | 79,55% Space Free | Partition Type: FAT

Computer Name: ELI4KA-PC | User Name: Elitsa Danailova | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 90 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- C:\windows\System32\control.exe (Microsoft Corporation)

.hlp [@ = hlpfile] -- C:\windows\winhlp32.exe (Microsoft Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)

Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"cval" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

"AntiVirusOverride" = 0

"AntiSpywareOverride" = 0

"FirewallOverride" = 0

"VistaSp1" = Reg Error: Unknown registry data type -- File not found

"VistaSp2" = Reg Error: Unknown registry data type -- File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

"C:\Program Files\BitTorrent\bittorrent.exe" = C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent -- (BitTorrent, Inc.)

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{0A225CC9-2D1B-48A4-949B-FC79AEEDB2DE}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |

"{E943CF6C-62F7-4510-BD3D-FD910ABE2D92}" = lport=2869 | protocol=6 | dir=in | app=system |

"{FE1FB262-4B3C-4D71-9C77-64086676730E}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{20251C0B-1A5D-4EBB-ABF9-DA52DC936EDE}" = protocol=6 | dir=in | app=c:\program files\autodesk\backburner\manager.exe |

"{261A14F4-D755-4E44-9A0D-BF5BFB09C044}" = protocol=6 | dir=in | app=c:\program files\autodesk\3ds max 2010\mentalray\satellite\raysat_3dsmax2010_32server.exe |

"{2905633B-12D8-4E75-8015-99685D888275}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |

"{31E0A5AB-D987-4015-B032-976FEFE94B90}" = dir=in | app=c:\program files\skype\phone\skype.exe |

"{3AFFF1C9-0D70-4260-B802-1DF8CF7C564F}" = protocol=17 | dir=in | app=c:\program files\autodesk\3ds max 2010\mentalray\satellite\raysat_3dsmax2010_32server.exe |

"{3FAAC468-FCA3-45C9-A3BF-0630AC0E4033}" = protocol=17 | dir=in | app=c:\program files\autodesk\backburner\monitor.exe |

"{45AF5972-9E00-4F44-A98D-47D8147B6011}" = protocol=6 | dir=in | app=c:\program files\autodesk\3ds max 2010\mentalray\satellite\raysat_3dsmax2010_32.exe |

"{46BF244D-BC34-47F4-8505-F78F81B805EF}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |

"{4A06C492-4C05-4826-9558-11F62F75E3C6}" = dir=in | app=c:\program files\msn messenger\msnmsgr.exe |

"{613BEC1C-AF65-437E-AAA3-04DC8F21C5D3}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |

"{68897193-DDE7-40BB-B07E-1A2196CA15C9}" = protocol=6 | dir=in | app=c:\program files\bittorrent\bittorrent.exe |

"{68EEBD7C-1DAB-474C-9372-9F698FD5D25F}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\groove.exe |

"{8B9CBEB1-9FC3-4B6D-8003-5385862D8C10}" = protocol=17 | dir=in | app=c:\program files\dna\btdna.exe |

"{929D4153-E516-4A8C-8424-9ADA39A18B08}" = protocol=6 | dir=in | app=c:\program files\autodesk\backburner\server.exe |

"{9C56E9B6-6C2C-4BB6-B608-68E2EF974BCF}" = protocol=17 | dir=in | app=c:\program files\autodesk\backburner\manager.exe |

"{A064A16C-2BF6-46C6-8D13-76F206A66A9B}" = protocol=17 | dir=in | app=c:\program files\bittorrent\bittorrent.exe |

"{A40F4E57-1C55-4CD0-A82F-6253E891F2D2}" = protocol=17 | dir=in | app=c:\program files\autodesk\3ds max 2010\3dsmax.exe |

"{AC7A0E31-4569-455B-8B68-251BF9A66BC2}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |

"{B2C79BEA-64BF-4D94-BCB9-AC06C8195719}" = dir=in | app=c:\program files\msn messenger\livecall.exe |

"{BFAD17C6-224B-4FAD-BE04-B9328360C3A4}" = protocol=6 | dir=in | app=c:\program files\autodesk\backburner\monitor.exe |

"{CB367E51-9E5C-4A48-A39D-1890E84C34A4}" = protocol=6 | dir=in | app=c:\program files\dna\btdna.exe |

"{D985EAD9-99FB-4C58-9EF5-C009DA2F4829}" = protocol=6 | dir=in | app=c:\program files\autodesk\3ds max 2010\3dsmax.exe |

"{DF924288-9027-4BEA-8AE4-E413C42248A0}" = protocol=17 | dir=in | app=c:\program files\autodesk\backburner\server.exe |

"{E2ADA451-D885-4BF9-BD84-3D5CF7667916}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\groove.exe |

"{EF0EAAF8-67F6-46E3-83B2-2F2FBA30D830}" = protocol=17 | dir=in | app=c:\program files\autodesk\3ds max 2010\mentalray\satellite\raysat_3dsmax2010_32.exe |

"TCP Query User{07483524-6DDC-4D15-887C-AB7F168538E3}C:\users\elitsa danailova\program files\dna\btdna.exe" = protocol=6 | dir=in | app=c:\users\elitsa danailova\program files\dna\btdna.exe |

"TCP Query User{171470B7-1662-4E64-AB89-922A1969499A}C:\program files\ugs\nx 6.0\ugii\ugraf.exe" = protocol=6 | dir=in | app=c:\program files\ugs\nx 6.0\ugii\ugraf.exe |

"TCP Query User{2FE6BF42-74BB-4F2F-9A76-A00A765DF283}C:\programdata\26cf0d\ss26c_2121.exe" = protocol=6 | dir=in | app=c:\programdata\26cf0d\ss26c_2121.exe |

"TCP Query User{9FE010D2-00A3-4F11-919D-B7B3D2DA2DA6}C:\program files\skype\phone\skype.exe" = protocol=6 | dir=in | app=c:\program files\skype\phone\skype.exe |

"TCP Query User{C6D0D132-4BA3-4CC5-9F8D-3BD6593C8DD8}C:\users\elitsa danailova\program files\dna\btdna.exe" = protocol=6 | dir=in | app=c:\users\elitsa danailova\program files\dna\btdna.exe |

"TCP Query User{CB3E9E15-1138-4A49-8C6A-6BE0DF7AD9FF}C:\program files\google\google earth\client\googleearth.exe" = protocol=6 | dir=in | app=c:\program files\google\google earth\client\googleearth.exe |

"UDP Query User{125EC277-6A51-4BD0-9649-4F1DAC0FCE23}C:\users\elitsa danailova\program files\dna\btdna.exe" = protocol=17 | dir=in | app=c:\users\elitsa danailova\program files\dna\btdna.exe |

"UDP Query User{2896BD0D-EAD1-47EB-9CA6-72CD58B844EF}C:\program files\ugs\nx 6.0\ugii\ugraf.exe" = protocol=17 | dir=in | app=c:\program files\ugs\nx 6.0\ugii\ugraf.exe |

"UDP Query User{5B7C1E77-5561-4A82-AA5F-7CAE79948D63}C:\users\elitsa danailova\program files\dna\btdna.exe" = protocol=17 | dir=in | app=c:\users\elitsa danailova\program files\dna\btdna.exe |

"UDP Query User{64C19AF3-BAD2-49AE-B48F-AB8B76893644}C:\programdata\26cf0d\ss26c_2121.exe" = protocol=17 | dir=in | app=c:\programdata\26cf0d\ss26c_2121.exe |

"UDP Query User{DC962A9A-1B79-4BF9-8F9A-A1A39DDFF612}C:\program files\skype\phone\skype.exe" = protocol=17 | dir=in | app=c:\program files\skype\phone\skype.exe |

"UDP Query User{F99F936F-3802-4BA9-840F-9A5F7601E199}C:\program files\google\google earth\client\googleearth.exe" = protocol=17 | dir=in | app=c:\program files\google\google earth\client\googleearth.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"_{7F05E704-30A6-421A-97A7-8EEB1C7FF010}" = CorelDRAW® Graphics Suite X4

"_{CE2DA11A-917F-4CF5-AB55-755EC115DD10}" = CorelDRAW® Graphics Suite X4 - Windows Shell Extension

"{001E7FB6-BB6B-4ED0-BEDC-B5404ED96D4E}" = DocProc

"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148

"{0046FA01-C5B9-4985-BACB-398DC480FC05}" = Adobe Photoshop CS3

"{0295F89F-F698-4101-9A7D-49F407EC2D82}" = HP Active Support Library

"{04818D16-E946-550C-CA5B-5FB3B25CC9D2}" = CCC Help Czech

"{04AF207D-9A77-465A-8B76-991F6AB66245}" = Adobe Help Viewer CS3

"{06D3BAA7-8C97-4FF6-9F7B-99705BAC2169}" = Credential Manager for HP ProtectTools

"{0845D004-320A-6B28-B8AD-BC147D50271E}" = CCC Help Korean

"{08B32819-6EEF-4057-AEDA-5AB681A36A23}" = Adobe Bridge Start Meeting

"{08E81ABD-79F7-49C2-881F-FD6CB0975693}" = Roxio Creator Data

"{0AE73E05-FD6F-417F-B828-82F13307AEEC}" = Catalyst Control Center - Branding

"{105CFC7C-6992-11D5-BD9D-000102C10FD8}" = Lizardtech DjVu Control

"{10EF53B4-44A3-1428-F051-4689307F27ED}" = CCC Help Russian

"{132F255E-FBE9-2E72-10A5-9DF35B45CEEF}" = ATI Catalyst Install Manager

"{1842532D-0AD3-4470-8E32-798BB63EF496}" = UGSLicensing

"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer

"{184CE391-7E0E-4C63-9935-D7A10EDFD3C6}" = Adobe WinSoft Linguistics Plugin

"{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}" = YouTube Downloader 2.7.1

"{1AB28342-A6C5-8B7A-2A92-BA2ED2A1E722}" = CCC Help Thai

"{1ACC4560-E7BE-2CCD-555B-C9C39F8940F8}" = CCC Help Dutch

"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

"{1F54DAFA-9261-4A62-B59D-6C9F26B48FE4}" = Roxio Creator Tools

"{212748BB-0DA5-46DE-82A1-403736DC9F27}" = MSVC80_x86

"{228C6B46-64E2-404E-898A-EF0830603EF4}" = HPNetworkAssistant

"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer

"{254C37AA-6B72-4300-84F6-98A82419187E}" = ActiveCheck component for HP Active Support Library

"{2928BCFA-AA18-C897-EF98-96DDB81B4CA5}" = CCC Help Polish

"{29E5EA97-5F74-4A57-B8B2-D4F169117183}" = Adobe Stock Photos CS3

"{29FA38B4-0AE4-4D0D-8A51-6165BB990BB0}" = WebReg

"{2BDB9DE0-6199-EEA2-81D1-93F1886DD3CB}" = CCC Help Hungarian

"{2CC3B536-0F86-1C4C-9C6E-4524252C343D}" = CCC Help Italian

"{2E2A8A44-39EE-5EE3-6A9D-EAF9BC20B44E}" = CCC Help Chinese Standard

"{2F28B3C9-2C89-4206-8B33-8ADC9577C49B}" = Scan

"{30A2A953-DEB1-466A-B660-F4399C7C6B9D}" = Roxio MyDVD

"{31030E4E-8532-4A22-B615-9F7A48F69C36}" = Catalyst Control Center - Branding

"{317AC0C7-FEBF-0409-87A3-4FC70D0ED900}" = Autodesk 3ds Max 2010 32-bit

"{3266D4DE-9CD0-48AC-9B2D-1D4879DB440F}" = Catalyst Control Center - Branding

"{342F5437-C87D-4BB5-89B9-B23E16C6A395}" = Microsoft VC80 Support DLLs

"{34D2AB40-150D-475D-AE32-BD23FB5EE355}" = HP Quick Launch Buttons

"{3685016F-4277-5680-1990-2521EF3D3801}" = Catalyst Control Center Graphics Full New

"{399C37FB-08AF-493B-BFED-20FBD85EDF7F}" = HP Webcam Driver

"{3A1C6EBF-B371-4BF2-9626-9792EFA46CBF}" = HP 3D DriveGuard

"{3A5C2134-6755-F59A-91EC-4A2EFEB2EAF4}" = Skins

"{3BA904CF-8B75-41AF-A5D2-F18A511536CA}" = LightScribe System Software

"{3BA9D546-B0E3-4549-BB2E-3F4FF65A1B81}" = YouTube Downloader Toolbar v4.4

"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile

"{3D347E6D-5A03-4342-B5BA-6A771885F379}" = Autodesk Backburner 2008.1

"{4286E640-B5FB-11DF-AC4B-005056C00008}" = Google Земя

"{43975334-1732-7072-DF06-008794BED1C4}" = CCC Help Japanese

"{44A27085-0616-4181-A0C3-81C7ECA17F73}" = CorelDRAW Graphics Suite X4

"{47F36D92-E58E-456D-B73C-3382737E4C42}" = HP Update

"{485D80AA-AFD9-4FF1-91D4-A44978B99F3D}" = AuthenTec Fingerprint System

"{4A961841-85E4-F441-8C99-17657E860243}" = Catalyst Control Center InstallProxy

"{51846830-E7B2-4218-8968-B77F0FF475B8}" = Adobe Color EU Extra Settings

"{537BF16E-7412-448C-95D8-846E85A1D817}" = Roxio Creator Business

"{54793AA1-5001-42F4-ABB6-C364617C6078}" = Adobe Linguistics CS3

"{554245D2-1EB4-4BA4-B74F-043972FAB66E}" = HP ProtectTools Security Manager

"{55B52830-024A-443E-AF61-61E1E71AFA1B}" = Device Access Manager for HP ProtectTools

"{571700F0-DB9D-4B3A-B03D-35A14BB5939F}" = Windows Live Messenger

"{5CFA95BC-52A5-6F32-05E4-0F9FCA83F9F0}" = CCC Help French

"{60A08432-00DD-0409-AC2C-143C75460878}" = Autodesk 3ds Max 2010 32-bit Components

"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler 3

"{669D4A35-146B-4314-89F1-1AC3D7B88367}" = HPAsset component for HP Active Support Library

"{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder

"{696A666D-7CB6-40f6-B394-BD3EEDAA2B99}" = HP Scanjet G3010 and 4370 9.0

"{6ABE0BEE-D572-4FE8-B434-9E72A289431B}" = Adobe Fonts All

"{6B21C4FD-B224-4599-A9BC-F565FDB90301}" = HP JavaCard for HP ProtectTools

"{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2

"{6E0352EE-6F0D-4FBC-B1B8-4FF032C78BE0}" = PC Connectivity Solution

"{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}" = Adobe Asset Services CS3

"{70CEFEBA-F757-4DBE-8A21-027C326137CE}" = HP Software Setup 5.00.A.9

"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable

"{730837D4-FF5E-48DB-BA49-33E732DFF0B3}" = PanoStandAlone

"{732A3F80-008B-4350-BD58-EC5AE98707B8}" = HP Common Access Service Library

"{73A4F29F-31AC-4EBD-AA1B-0CC5F18C8F83}" = Roxio Creator Audio

"{75D7BB3A-9AB7-4ad1-AD5E-0059B90C624B}" = HP ProtectTools Security Manager Suite

"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

"{7745E24A-84A9-4754-9FFD-8FBE12CA0200}" = SolidWorks 2006 SP0

"{789C97CE-9E17-4126-BDF4-11FF458BF705}" = File Sanitizer For HP ProtectTools

"{791CAF6C-90A3-11D4-8306-00D0B72E1DB9}" = sentinelsystemdriver

"{7C8B5E63-821A-4DFB-BDFA-19854D88EC5C}" = 3dsmax ancillary install

"{7F05E704-30A6-421A-97A7-8EEB1C7FF010}" = CorelDRAW Graphics SUite X4 - ICA

"{7F05E704-30A6-421A-97A7-8EEB1C7FF012}" = CorelDRAW Graphics Suite X4 - Capture

"{7F05E704-30A6-421A-97A7-8EEB1C7FF013}" = CorelDRAW Graphics Suite X4 - Draw

"{7F05E704-30A6-421A-97A7-8EEB1C7FF014}" = CorelDRAW Graphics Suite X4 - PP

"{7F05E704-30A6-421A-97A7-8EEB1C7FF016}" = CorelDRAW Graphics Suite X4 - Content

"{7F05E704-30A6-421A-97A7-8EEB1C7FF017}" = CorelDRAW Graphics Suite X4 - Filters

"{7F05E704-30A6-421A-97A7-8EEB1C7FF019}" = CorelDRAW Graphics Suite X4 - FontNav

"{7F05E704-30A6-421A-97A7-8EEB1C7FF100}" = CorelDRAW Graphics Suite X4 - Lang EN

"{802771A9-A856-4A41-ACF7-1450E523C923}" = Adobe XMP Panels CS3

"{83DBD41D-ADDF-7C18-98D8-B9232221CDE1}" = ccc-core-static

"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570

"{87E2B986-07E8-477a-93DC-AF0B6758B192}" = DocProcQFolder

"{88F09FD2-0C32-A0E0-02DA-66731126032E}" = ccc-utility

"{89A43E80-AC6C-4DA8-9800-F4B30ED577C0}" = OLYMPUS ib

"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight

"{8C47092F-B249-43CB-A780-40274329043D}" = eDrawings 2006

"{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}" = Adobe Device Central CS3

"{8D337F77-BE7F-41A2-A7CB-D5A63FD7049B}" = Sonic CinePlayer Decoder Pack

"{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}" = Adobe Type Support

"{90120000-0015-0402-0000-0000000FF1CE}" = Microsoft Office Access MUI (Bulgarian) 2007

"{90120000-0015-0402-0000-0000000FF1CE}_PROHYBRIDR_{B7F55896-AAF7-4FCA-B9A7-791825A8FAFB}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007

"{90120000-0015-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-0015-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-0015-0418-0000-0000000FF1CE}" = Microsoft Office Access MUI (Romanian) 2007

"{90120000-0015-0418-0000-0000000FF1CE}_PROHYBRIDR_{3DFBDBEE-B82A-47D9-8134-B86A98280A8E}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-0015-0426-0000-0000000FF1CE}" = Microsoft Office Access MUI (Latvian) 2007

"{90120000-0015-0426-0000-0000000FF1CE}_PROHYBRIDR_{9D5D0E09-9106-4BCC-BB96-5B561C6DD86B}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-0015-0427-0000-0000000FF1CE}" = Microsoft Office Access MUI (Lithuanian) 2007

"{90120000-0015-0427-0000-0000000FF1CE}_PROHYBRIDR_{4C80B737-0921-44A3-BD49-58B2B3951434}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-0016-0402-0000-0000000FF1CE}" = Microsoft Office Excel MUI (Bulgarian) 2007

"{90120000-0016-0402-0000-0000000FF1CE}_PROHYBRIDR_{B7F55896-AAF7-4FCA-B9A7-791825A8FAFB}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007

"{90120000-0016-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-0016-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-0016-0418-0000-0000000FF1CE}" = Microsoft Office Excel MUI (Romanian) 2007

"{90120000-0016-0418-0000-0000000FF1CE}_PROHYBRIDR_{3DFBDBEE-B82A-47D9-8134-B86A98280A8E}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-0016-0426-0000-0000000FF1CE}" = Microsoft Office Excel MUI (Latvian) 2007

"{90120000-0016-0426-0000-0000000FF1CE}_PROHYBRIDR_{9D5D0E09-9106-4BCC-BB96-5B561C6DD86B}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-0016-0427-0000-0000000FF1CE}" = Microsoft Office Excel MUI (Lithuanian) 2007

"{90120000-0016-0427-0000-0000000FF1CE}_PROHYBRIDR_{4C80B737-0921-44A3-BD49-58B2B3951434}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-0018-0402-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (Bulgarian) 2007

"{90120000-0018-0402-0000-0000000FF1CE}_PROHYBRIDR_{B7F55896-AAF7-4FCA-B9A7-791825A8FAFB}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007

"{90120000-0018-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-0018-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-0018-0418-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (Romanian) 2007

"{90120000-0018-0418-0000-0000000FF1CE}_PROHYBRIDR_{3DFBDBEE-B82A-47D9-8134-B86A98280A8E}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-0018-0426-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (Latvian) 2007

"{90120000-0018-0426-0000-0000000FF1CE}_PROHYBRIDR_{9D5D0E09-9106-4BCC-BB96-5B561C6DD86B}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-0018-0427-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (Lithuanian) 2007

"{90120000-0018-0427-0000-0000000FF1CE}_PROHYBRIDR_{4C80B737-0921-44A3-BD49-58B2B3951434}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-0019-0402-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (Bulgarian) 2007

"{90120000-0019-0402-0000-0000000FF1CE}_PROHYBRIDR_{B7F55896-AAF7-4FCA-B9A7-791825A8FAFB}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007

"{90120000-0019-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-0019-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-0019-0418-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (Romanian) 2007

"{90120000-0019-0418-0000-0000000FF1CE}_PROHYBRIDR_{3DFBDBEE-B82A-47D9-8134-B86A98280A8E}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-0019-0426-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (Latvian) 2007

"{90120000-0019-0426-0000-0000000FF1CE}_PROHYBRIDR_{9D5D0E09-9106-4BCC-BB96-5B561C6DD86B}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-0019-0427-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (Lithuanian) 2007

"{90120000-0019-0427-0000-0000000FF1CE}_PROHYBRIDR_{4C80B737-0921-44A3-BD49-58B2B3951434}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-001A-0402-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (Bulgarian) 2007

"{90120000-001A-0402-0000-0000000FF1CE}_PROHYBRIDR_{B7F55896-AAF7-4FCA-B9A7-791825A8FAFB}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007

"{90120000-001A-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-001A-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-001A-0418-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (Romanian) 2007

"{90120000-001A-0418-0000-0000000FF1CE}_PROHYBRIDR_{3DFBDBEE-B82A-47D9-8134-B86A98280A8E}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-001A-0426-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (Latvian) 2007

"{90120000-001A-0426-0000-0000000FF1CE}_PROHYBRIDR_{9D5D0E09-9106-4BCC-BB96-5B561C6DD86B}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-001A-0427-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (Lithuanian) 2007

"{90120000-001A-0427-0000-0000000FF1CE}_PROHYBRIDR_{4C80B737-0921-44A3-BD49-58B2B3951434}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-001B-0402-0000-0000000FF1CE}" = Microsoft Office Word MUI (Bulgarian) 2007

"{90120000-001B-0402-0000-0000000FF1CE}_PROHYBRIDR_{B7F55896-AAF7-4FCA-B9A7-791825A8FAFB}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007

"{90120000-001B-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-001B-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-001B-0418-0000-0000000FF1CE}" = Microsoft Office Word MUI (Romanian) 2007

"{90120000-001B-0418-0000-0000000FF1CE}_PROHYBRIDR_{3DFBDBEE-B82A-47D9-8134-B86A98280A8E}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-001B-0426-0000-0000000FF1CE}" = Microsoft Office Word MUI (Latvian) 2007

"{90120000-001B-0426-0000-0000000FF1CE}_PROHYBRIDR_{9D5D0E09-9106-4BCC-BB96-5B561C6DD86B}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-001B-0427-0000-0000000FF1CE}" = Microsoft Office Word MUI (Lithuanian) 2007

"{90120000-001B-0427-0000-0000000FF1CE}_PROHYBRIDR_{4C80B737-0921-44A3-BD49-58B2B3951434}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-001F-0402-0000-0000000FF1CE}" = Microsoft Office Proof (Bulgarian) 2007

"{90120000-001F-0402-0000-0000000FF1CE}_PROHYBRIDR_{FB4EE5BD-7C0B-4B5C-ACEC-D1F160BE9B47}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)

"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007

"{90120000-001F-0407-0000-0000000FF1CE}_PROHYBRIDR_{A0516415-ED61-419A-981D-93596DA74165}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)

"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007

"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)

"{90120000-001F-0409-0000-0000000FF1CE}_PROHYBRIDR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)

"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007

"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)

"{90120000-001F-040C-0000-0000000FF1CE}_PROHYBRIDR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)

"{90120000-001F-0415-0000-0000000FF1CE}" = Microsoft Office Proof (Polish) 2007

"{90120000-001F-0415-0000-0000000FF1CE}_PROHYBRIDR_{E9EA2604-8AC9-47D2-8F4B-6BF60787A357}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)

"{90120000-001F-0418-0000-0000000FF1CE}" = Microsoft Office Proof (Romanian) 2007

"{90120000-001F-0418-0000-0000000FF1CE}_PROHYBRIDR_{6E3398C5-9A81-4054-B474-8B23A60F5048}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)

"{90120000-001F-0419-0000-0000000FF1CE}" = Microsoft Office Proof (Russian) 2007

"{90120000-001F-0419-0000-0000000FF1CE}_PROHYBRIDR_{57A92C5E-E76A-49CC-9EC2-A7B6CE1255EA}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)

"{90120000-001F-0426-0000-0000000FF1CE}" = Microsoft Office Proof (Latvian) 2007

"{90120000-001F-0426-0000-0000000FF1CE}_PROHYBRIDR_{1B3EDDDA-158A-4AFB-A493-57446AC5964D}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)

"{90120000-001F-0427-0000-0000000FF1CE}" = Microsoft Office Proof (Lithuanian) 2007

"{90120000-001F-0427-0000-0000000FF1CE}_PROHYBRIDR_{15B60D1E-FBD2-4659-A159-ADB32FA4105D}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)

"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007

"{90120000-001F-0C0A-0000-0000000FF1CE}_ENTERPRISE_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)

"{90120000-001F-0C0A-0000-0000000FF1CE}_PROHYBRIDR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)

"{90120000-002C-0402-0000-0000000FF1CE}" = Microsoft Office Proofing (Bulgarian) 2007

"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007

"{90120000-002C-0418-0000-0000000FF1CE}" = Microsoft Office Proofing (Romanian) 2007

"{90120000-002C-0426-0000-0000000FF1CE}" = Microsoft Office Proofing (Latvian) 2007

"{90120000-002C-0427-0000-0000000FF1CE}" = Microsoft Office Proofing (Lithuanian) 2007

"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007

"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)

"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007

"{90120000-0044-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-006E-0402-0000-0000000FF1CE}" = Microsoft Office Shared MUI (Bulgarian) 2007

"{90120000-006E-0402-0000-0000000FF1CE}_PROHYBRIDR_{381C20B4-5DD3-41E1-A21F-82E9CEAEEA5D}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007

"{90120000-006E-0409-0000-0000000FF1CE}_ENTERPRISE_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-006E-0409-0000-0000000FF1CE}_PROHYBRIDR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-006E-0418-0000-0000000FF1CE}" = Microsoft Office Shared MUI (Romanian) 2007

"{90120000-006E-0418-0000-0000000FF1CE}_PROHYBRIDR_{CEDDCA72-ED57-4CE5-B55D-A50EE2CD3CCF}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-006E-0426-0000-0000000FF1CE}" = Microsoft Office Shared MUI (Latvian) 2007

"{90120000-006E-0426-0000-0000000FF1CE}_PROHYBRIDR_{754107CD-69CE-402F-A831-24F105F52E55}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-006E-0427-0000-0000000FF1CE}" = Microsoft Office Shared MUI (Lithuanian) 2007

"{90120000-006E-0427-0000-0000000FF1CE}_PROHYBRIDR_{B288171B-269A-4FD5-94D8-04372C873709}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007

"{90120000-00A1-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2007

"{90120000-00BA-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-0114-0409-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (English) 2007

"{90120000-0114-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007

"{90120000-0115-0409-0000-0000000FF1CE}_ENTERPRISE_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-0115-0409-0000-0000000FF1CE}_PROHYBRIDR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007

"{90120000-0117-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-0117-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90176341-0A8B-4CCC-A78D-F862228A6B95}" = Adobe Anchor Service CS3

"{902EC7BE-C623-11F3-0B20-A6A1D01A0F99}" = CCC Help Danish

"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager

"{91120000-0031-0000-0000-0000000FF1CE}" = Microsoft Office Professional Hybrid 2007

"{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)

"{94C3BB3A-56A1-43DE-A242-8B41F46E97EF}" = Dealio Toolbar v4.0.1

"{9505A2A4-2478-CAE8-3860-705A689A50E9}" = Catalyst Control Center Graphics Previews Vista

"{95655ED4-7CA5-46DF-907F-7144877A32E5}" = Adobe Color NA Recommended Settings

"{99B39D40-5EA1-440C-BA46-5DE3FA6E8388}" = Catalyst Control Center - Branding

"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

"{9A346205-EA92-4406-B1AB-50379DA3F057}" = Autodesk DWF Viewer 7

"{9C9824D9-9000-4373-A6A5-D0E5D4831394}" = Adobe Bridge CS3

"{9D0798D0-AF6C-4E62-94B1-AEBF1A43E00A}" = CorelDRAW Graphics Suite X4 - IPM

"{9E9D49A4-1DF4-4138-B7DB-5D87A893088E}" = HP Integrated Module with Bluetooth wireless technology

"{a0fe116e-9a8a-466f-aee0-625cb7c207e3}" = Microsoft Visual C++ 2005 Redistributable - KB2467175

"{A2B242BD-FF8D-4840-9DAA-9170EABEC59C}" = Adobe CMaps

"{A2D81E70-2A98-4A08-A628-94388B063C5E}" = Adobe Color - Photoshop Specific

"{A37D76E1-38C4-4A58-A597-BD7C765FB8CF}" = UGS NX 6.0

"{A70634D4-6C97-6F3D-B1D1-6CD01AAB15A2}" = CCC Help Chinese Traditional

"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper

"{AA8EC7A4-EA02-4A72-B14F-65DA485F74C8}" = ESU for Microsoft Vista SP1

"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder

"{AC0AA40D-8899-449C-A059-548C8AC5FB6D}" = HP User Guides 0136

"{AC194855-F7AC-4D04-B4C9-07BA46FCB697}" = ActivClient 6.1 x86

"{AC54964A-0886-FFBB-DA5A-21B47BEDD8D9}" = CCC Help Portuguese

"{AC5B0C19-D851-42F4-BDA0-410ECF7F70A5}" = PDF Settings

"{AC7190A0-EEA1-423C-A531-FCEB4E0EBBB1}" = DWGeditor

"{AE8B9EED-2083-3830-6BAF-D8FF87EFBD2B}" = Catalyst Control Center Localization All

"{AEA07F97-9088-497c-8821-0F36BD5DC251}" = HPProductAssistant

"{B1259862-9EBF-C8E2-2092-160135C71549}" = CCC Help Swedish

"{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}" = Adobe Camera Raw 4.0

"{B61D21B6-469D-4423-B161-62DB20B8A70E}" = Visual Basic for Applications ® Core - English

"{B6A26DE5-F2B5-4D58-9570-4FC760E00FCD}" = Roxio Creator Copy

"{B9272341-39C4-40D6-8B31-54D85409116F}" = hpg3010

"{B9B35331-B7E4-4E5C-BF4C-7BC87856124D}" = Adobe Default Language CS3

"{BA69296C-0910-D3B1-70C9-23BFF0C31D90}" = Catalyst Control Center Graphics Full Existing

"{BB662A7E-DFF6-47C9-BBD2-430079EA8E74}" = BIOS Configuration for HP ProtectTools

"{BCD6CD1A-0DBE-412E-9F25-3B500D1E6BA1}" = SolutionCenter

"{BF439B41-0252-48DE-8B8B-0430CB26A181}" = CorelDRAW Graphics Suite X4 - VBA

"{C012BF9F-79EA-4601-9778-BFE9B3CE83A1}" = hpg3010QFolder

"{C299012A-DB39-4E9D-B360-75F83A7D5252}" = Catalyst Control Center - Branding

"{C2D69781-F392-4118-A5A7-C7E9C38DBFC2}" = Adobe ExtendScript Toolkit 2

"{C4E73218-0B91-12D8-DB06-AE69B985EA55}" = CCC Help Finnish

"{C6FF0A11-1F6C-C902-2644-4FDE8BC45A91}" = CCC Help German

"{CA17EC26-F3D1-2084-D747-A33065D2257E}" = CCC Help Spanish

"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1

"{CB7B419E-7ED5-76E0-8437-DEEFA7D45602}" = CCC Help Turkish

"{CD95D125-2992-4858-B3EF-5F6FB52FBAD6}" = Skype Toolbars

"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware

"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1

"{CE2DA11A-917F-4CF5-AB55-755EC115DD10}" = CorelDRAW® Graphics Suite X4 - Windows Shell Extension

"{CEC0C2C2-921F-4EB8-8D7E-4F2F03ED02AA}" = ScannerCopy

"{D0DFF92A-492E-4C40-B862-A74A173C25C5}" = Adobe Version Cue CS3 Client

"{D0E39A1D-0CEE-4D85-B4A2-E3BE990D075E}" = Destination Component

"{D142866A-0DDB-A0D7-CEC3-B2F4D79345CA}" = CCC Help Norwegian

"{D1BB4446-AE9C-4256-9A7F-4D46604D2462}" = Adobe Setup

"{D2559B88-CC9D-4B48-81BB-F492BAA9C48C}" = Adobe PDF Library Files

"{D4E1CDA6-A176-B7BB-D0E6-206A2C3F0867}" = CCC Help English

"{D8A0E646-F4C7-7AF4-1768-A3090F85CDB1}" = CCC Help Greek

"{DA8D7893-2E3A-4E49-7F6B-60DB4E33528F}" = Catalyst Control Center Core Implementation

"{DADD7B8A-BCB0-44F5-967A-ECB6B4F2ECD9}" = Adobe Color Common Settings

"{DB81779E-7CC5-4630-BCFC-754004956444}" = Visual Basic for Applications ® Core

"{DD7DB3C5-6FA3-4FA3-8A71-C2F2940EB029}" = Adobe Color JA Extra Settings

"{E05EB9D2-8559-4821-98AC-3D5DA3242D5B}" = Vista Default Settings

"{E2662C24-B31E-4349-A084-32EB76E8B760}" = BufferChm

"{E40CE35C-27F5-4EBF-82F9-13238BCA3572}" = HP Wireless Assistant

"{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}" = Microsoft Office Suite Activation Assistant

"{E551D82D-4D56-4AF7-A2C9-8897D7A0CB00}" = Autodesk 3ds Max 2010 Tutorials Files

"{E6272A04-665C-4E7D-A6BA-EAF4C6C11B00}" = Drive Encryption for HP ProtectTools

"{E633D396-5188-4E9D-8F6B-BFB8BF3467E8}" = Skype™ 5.1

"{E69AE897-9E0B-485C-8552-7841F48D42D8}" = Adobe Update Manager CS3

"{EB21A812-671B-4D08-B974-2A347F0D8F70}" = HP Photosmart Essential

"{EC877639-07AB-495C-BFD1-D63AF9140810}" = Roxio Activation Module

"{ED439A64-F018-4DD4-8BA5-328D85AB09AB}" = Roxio Creator Business v10

"{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX

"{F173C2B3-296F-458C-98FF-1676A42EBA02}" = HP Wallpaper

"{F428D0FB-765D-40EB-BDD8-A1E7F5C597FA}" = Update Manager

"{F639E2A2-FE6B-4527-B8BE-C1C423B81844}" = HP Webcam

"{FB091F2E-3B92-1658-6303-9924097B58D6}" = Catalyst Control Center Graphics Light

"504244733D18C8F63FF584AEB290E3904E791693" = Windows Driver Package - Nokia pccsmcfd (08/22/2008 7.0.0.0)

"Acoustica MP3 Audio Mixer 2.13" = Acoustica MP3 Audio Mixer 2.13

"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX

"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin

"Adobe_2ac78060bc5856b0c1cf873bb919b58" = Adobe Photoshop CS3

"AEnglish Dictionary_is1" = AEnglish Dictionary XP 1.72

"Agere Systems Soft Modem" = Agere Systems HDA Modem

"Ashampoo Burning Studio 8_is1" = Ashampoo Burning Studio 8.04

"Audacity_is1" = Audacity 1.2.6

"Autodesk FBX Plugin 2009.4 - 3ds Max 2010" = Autodesk FBX Plugin 2009.4 - 3ds Max 2010

"avast" = avast! Free Antivirus

"BSPlayerp" = BS.Player PRO

"Canon LBP2900" = Canon LBP2900

"E77704EF5E71F4F18CADFBFA68595AFE036D5D97" = Windows Driver Package - OLYMPUS IMAGING CORP. Camera Communication Driver Package (09/09/2009 1.0.0.0)

"ENTERPRISE" = Microsoft Office Enterprise 2007

"Farm Frenzy 3 ." = Farm Frenzy 3 .

"Farm Frenzy 3 Russian Roulette 1.00" = Farm Frenzy 3 Russian Roulette 1.00

"Google Chrome" = Google Chrome

"HP Imaging Device Functions" = HP Imaging Device Functions 9.0

"HP QuickLook 2_is1" = HP QuickLook 2

"HP Solution Center & Imaging Support Tools" = HP Solution Center 9.0

"HPOCR" = HP OCR Software 9.0

"InstallShield_{89A43E80-AC6C-4DA8-9800-F4B30ED577C0}" = OLYMPUS ib

"InstallShield_{F639E2A2-FE6B-4527-B8BE-C1C423B81844}" = HP Webcam

"KLiteCodecPack_is1" = K-Lite Codec Pack 4.9.0 (Full)

"Magic Audio Converter_is1" = Magic Audio Converter v8.3.2

"Magic ISO Maker v5.5 (build 0265)" = Magic ISO Maker v5.5 (build 0265)

"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware, версия 1.51.0.1200

"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1

"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1

"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile

"Mozilla Firefox (2.0.0.14)" = Mozilla Firefox (2.0.0.14)

"PDF Complete" = PDF Complete

"PDF reDirect" = PDF reDirect (remove only)

"PowerISO" = PowerISO

"PROHYBRIDR" = 2007 Microsoft Office system

"SubtitleWorkshop" = Subtitle Workshop 2.51

"SynTPDeinstKey" = Synaptics Pointing Device Driver

"WinRAR archiver" = WinRAR archiver

"Wondershare Video Converter Platinum_is1" = Wondershare Video Converter Platinum(Build 4.4.4.0)

"Веселая ферма. Древний рим !" = Веселая ферма. Древний рим !

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-188209174-3304326258-1817674253-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"BitTorrent" = BitTorrent

"BitTorrent DNA" = DNA

========== Last 10 Event Log Errors ==========

[ Application Events ]

Error - 9.6.2011 г. 09:26:41 | Computer Name = Eli4ka-PC | Source = EventSystem | ID = 4621

Description =

Error - 9.6.2011 г. 10:31:16 | Computer Name = Eli4ka-PC | Source = WinMgmt | ID = 10

Description =

Error - 9.6.2011 г. 10:34:02 | Computer Name = Eli4ka-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083

Description =

Error - 9.6.2011 г. 10:34:02 | Computer Name = Eli4ka-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083

Description =

Error - 9.6.2011 г. 10:34:02 | Computer Name = Eli4ka-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083

Description =

Error - 9.6.2011 г. 11:05:20 | Computer Name = Eli4ka-PC | Source = WinMgmt | ID = 10

Description =

Error - 12.6.2011 г. 10:04:06 | Computer Name = Eli4ka-PC | Source = WinMgmt | ID = 10

Description =

Error - 13.6.2011 г. 15:49:06 | Computer Name = Eli4ka-PC | Source = WinMgmt | ID = 10

Description =

Error - 13.6.2011 г. 16:12:15 | Computer Name = Eli4ka-PC | Source = EventSystem | ID = 4621

Description =

Error - 16.6.2011 г. 03:38:57 | Computer Name = Eli4ka-PC | Source = WinMgmt | ID = 10

Description =

[ Credential Manager Events ]

Error - 6.10.2010 г. 15:00:06 | Computer Name = Eli4ka-PC | Source = AuthServer | ID = 100811779

Description = The system failed to authenticate the submitted user credentials. User:

Elitsa Danailova@ELI4KA-PC Client GUID: {Password} Error: 0xC516020B Client Host:

localhost Client Address: 127.0.0.1 Authority: HP Server Host: localhost Protocol: HTTP

Error - 6.10.2010 г. 15:00:06 | Computer Name = Eli4ka-PC | Source = AuthWiz | ID = 100796068

Description = The submitted credentials were rejected. User: Elitsa Danailova@ELI4KA-PC

Credentials:

Password Error: (0xC516020B) The system could not log you on. Verify your user

name and domain are correct and then type your password again. Letters in passwords

must be typed using the correct case. Verify that Caps Lock is off.

Error - 24.10.2010 г. 03:43:04 | Computer Name = Eli4ka-PC | Source = AuthWiz | ID = 100796068

Description = The submitted credentials were rejected. User: Elitsa Danailova@ELI4KA-PC

Credentials:

Password Error: (0xC516020B) The system could not log you on. Verify your user

name and domain are correct and then type your password again. Letters in passwords

must be typed using the correct case. Verify that Caps Lock is off.

Error - 24.10.2010 г. 03:43:04 | Computer Name = Eli4ka-PC | Source = AuthServer | ID = 100811779

Description = The system failed to authenticate the submitted user credentials. User:

Elitsa Danailova@ELI4KA-PC Client GUID: {Password} Error: 0xC516020B Client Host:

localhost Client Address: 127.0.0.1 Authority: HP Server Host: localhost Protocol: HTTP

[ OSession Events ]

Error - 29.1.2011 г. 10:40:51 | Computer Name = Eli4ka-PC | Source = Microsoft Office 12 Sessions | ID = 7001

Description = ID: 0, Application Name: Microsoft Office Word, Application Version:

12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 19994

seconds with 6420 seconds of active time. This session ended with a crash.

[ System Events ]

Error - 9.6.2011 г. 11:07:51 | Computer Name = Eli4ka-PC | Source = Microsoft-Windows-LanguagePackSetup | ID = 1001

Description =

Error - 12.6.2011 г. 10:04:07 | Computer Name = Eli4ka-PC | Source = Service Control Manager | ID = 7000

Description =

Error - 12.6.2011 г. 10:05:21 | Computer Name = Eli4ka-PC | Source = Microsoft-Windows-LanguagePackSetup | ID = 1001

Description =

Error - 12.6.2011 г. 10:30:32 | Computer Name = Eli4ka-PC | Source = DCOM | ID = 10000

Description =

Error - 12.6.2011 г. 13:13:56 | Computer Name = Eli4ka-PC | Source = iaStor | ID = 262153

Description = The device, \Device\Ide\iaStor0, did not respond within the timeout

period.

Error - 13.6.2011 г. 15:49:08 | Computer Name = Eli4ka-PC | Source = Service Control Manager | ID = 7000

Description =

Error - 13.6.2011 г. 15:51:11 | Computer Name = Eli4ka-PC | Source = Microsoft-Windows-LanguagePackSetup | ID = 1001

Description =

Error - 13.6.2011 г. 16:06:14 | Computer Name = Eli4ka-PC | Source = PlugPlayManager | ID = 12

Description = The device 'Intel® WiFi Link 5100 AGN' (PCI\VEN_8086&DEV_4237&SUBSYS_12118086&REV_00\FF03AAA200)

disappeared from the system without first being prepared for removal.

Error - 16.6.2011 г. 03:38:57 | Computer Name = Eli4ka-PC | Source = Service Control Manager | ID = 7000

Description =

Error - 16.6.2011 г. 03:40:36 | Computer Name = Eli4ka-PC | Source = Microsoft-Windows-LanguagePackSetup | ID = 1001

Description =

< End of report >

Имам един въпрос....проблема с интернета само в Internet Explorer ли е или и с Mozilla Firefox ?

Питам ви, защото имате зловредни проксита само върху Internet Explorer:

IE - HKU\S-1-5-21-188209174-3304326258-1817674253-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKU\S-1-5-21-188209174-3304326258-1817674253-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:25437

Ще продължим утре, защото ми се налага да излезна за няколко часа.

  • Автор

Ами, всъщност ползвам само internet explorer. Преди време ми инсталираха Мозила,но тя не работи и не съм се занимавала изобщо нито да я преинсталирам нито да я махам.

Ок,

Cтартирайте пак OTL и с Copy/ Paste под колонката Custom Scans/Fixes въведете скриптовия текст от текстовото поле по-долу, като не забравяте да копирате скрипта 1 към 1, както и двете точки преди първия ред на скрипта!

:OTL
IE - HKU\S-1-5-21-188209174-3304326258-1817674253-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKU\S-1-5-21-188209174-3304326258-1817674253-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
IE - HKU\S-1-5-21-188209174-3304326258-1817674253-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:25437
O3 - HKLM\..\Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - No CLSID value found.
O4 - HKLM..\Run: [] File not found
O33 - MountPoints2\{8796ad3a-56a4-11df-bc61-00247e7b9006}\Shell\AutoRun\command - "" = I:\PERO\\\\\\\\\\\SPECIJALAC.exe
O33 - MountPoints2\{8796ad3a-56a4-11df-bc61-00247e7b9006}\Shell\explore\command - "" = I:\PERO\\\\\\\\\\\\SPECIJALAC.exe
O33 - MountPoints2\{8796ad3a-56a4-11df-bc61-00247e7b9006}\Shell\open\command - "" = I:\PERO\\\\\\\\\\\\SPECIJALAC.exe
O33 - MountPoints2\{b5ba89b8-5425-11df-b238-00247e7b9006}\Shell\AutoRun\command - "" = I:\JANOS\\\\\\\\\\\CARDAS.exe
O33 - MountPoints2\{b5ba89b8-5425-11df-b238-00247e7b9006}\Shell\explore\command - "" = I:\JANOS\\\\\\\\\\\\CARDAS.exe
O33 - MountPoints2\{b5ba89b8-5425-11df-b238-00247e7b9006}\Shell\open\command - "" = I:\JANOS\\\\\\\\\\\\CARDAS.exe
O33 - MountPoints2\G\Shell - "" = AutoRun
O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\DisneySplash.exe
[2011.06.06 23:30:50 | 000,000,000 | -HSD | C] -- C:\ProgramData\SSBYVJUWS
[2011.06.06 23:30:29 | 000,000,000 | -HSD | C] -- C:\ProgramData\26cf0d
@Alternate Data Stream - 167 bytes -> C:\ProgramData\Temp:CB0FEE2B
@Alternate Data Stream - 131 bytes -> C:\ProgramData\Temp:512336B9
:files
ipconfig /flushdns /c
netsh winsock reset catalog /c
:reg
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"TCP Query User{2FE6BF42-74BB-4F2F-9A76-A00A765DF283}C:\programdata\26cf0d\ss26c_2121.exe" =-
"UDP Query User{64C19AF3-BAD2-49AE-B48F-AB8B76893644}C:\programdata\26cf0d\ss26c_2121.exe" =-
:commands
[resethosts]
[reboot]
След като въведете скрипта от цитата по-горе натиснете бутона, маркиран в червено: Публикувано изображение

Ще се създаде лог файл. Публикувайте съдържанието му с Copy/Paste в следващия си коментар.

PS: Ако не се появи лог файл, отворете папката C:\_OTL\MovedFiles отворете лог файла и публикувайте съдържанието му в следващия си пост.

  • Автор

Изпълнено!

Резултат:

========== OTL ==========

HKU\S-1-5-21-188209174-3304326258-1817674253-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!

HKU\S-1-5-21-188209174-3304326258-1817674253-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!

HKU\S-1-5-21-188209174-3304326258-1817674253-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully!

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{0BF43445-2F28-4351-9252-17FE6E806AA0} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0BF43445-2F28-4351-9252-17FE6E806AA0}\ not found.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8796ad3a-56a4-11df-bc61-00247e7b9006}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8796ad3a-56a4-11df-bc61-00247e7b9006}\ not found.

File I:\PERO\\\\\\\\\\\SPECIJALAC.exe not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8796ad3a-56a4-11df-bc61-00247e7b9006}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8796ad3a-56a4-11df-bc61-00247e7b9006}\ not found.

File I:\PERO\\\\\\\\\\\\SPECIJALAC.exe not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8796ad3a-56a4-11df-bc61-00247e7b9006}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8796ad3a-56a4-11df-bc61-00247e7b9006}\ not found.

File I:\PERO\\\\\\\\\\\\SPECIJALAC.exe not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b5ba89b8-5425-11df-b238-00247e7b9006}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b5ba89b8-5425-11df-b238-00247e7b9006}\ not found.

File I:\JANOS\\\\\\\\\\\CARDAS.exe not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b5ba89b8-5425-11df-b238-00247e7b9006}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b5ba89b8-5425-11df-b238-00247e7b9006}\ not found.

File I:\JANOS\\\\\\\\\\\\CARDAS.exe not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b5ba89b8-5425-11df-b238-00247e7b9006}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b5ba89b8-5425-11df-b238-00247e7b9006}\ not found.

File I:\JANOS\\\\\\\\\\\\CARDAS.exe not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\G\ deleted successfully.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\G\ not found.

File G:\DisneySplash.exe not found.

C:\ProgramData\SSBYVJUWS folder moved successfully.

C:\ProgramData\26cf0d\SSSSys folder moved successfully.

C:\ProgramData\26cf0d\Quarantine Items folder moved successfully.

C:\ProgramData\26cf0d\BackUp folder moved successfully.

C:\ProgramData\26cf0d folder moved successfully.

ADS C:\ProgramData\Temp:CB0FEE2B deleted successfully.

ADS C:\ProgramData\Temp:512336B9 deleted successfully.

========== FILES ==========

< ipconfig /flushdns /c >

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

C:\Users\Elitsa Danailova\Desktop\cmd.bat deleted successfully.

C:\Users\Elitsa Danailova\Desktop\cmd.txt deleted successfully.

< netsh winsock reset catalog /c >

Sucessfully reset the Winsock Catalog.

You must restart the computer in order to complete the reset.

C:\Users\Elitsa Danailova\Desktop\cmd.bat deleted successfully.

C:\Users\Elitsa Danailova\Desktop\cmd.txt deleted successfully.

========== REGISTRY ==========

Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\TCP Query User{2FE6BF42-74BB-4F2F-9A76-A00A765DF283}C:\programdata\26cf0d\ss26c_2121.exe deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\UDP Query User{64C19AF3-BAD2-49AE-B48F-AB8B76893644}C:\programdata\26cf0d\ss26c_2121.exe deleted successfully.

========== COMMANDS ==========

C:\windows\System32\drivers\etc\Hosts moved successfully.

HOSTS file reset successfully

OTL by OldTimer - Version 3.2.24.0 log created on 06172011_121411

Архивирана тема

Темата е твърде стара и е архивирана. Не можете да добавяте нови отговори в нея, но винаги можете да публикувате нова тема, в която да продължи дискусията. Регистрирайте се или влезте във вашия профил за да публикувате нова тема.

Назад

Разглеждащи това в момента 0

  • Няма регистрирани потребители разглеждащи тази страница.

Дарение

  • Подкрепи съществуването на форума - направи дарение
    32%
    Дарени 315 € от нужните 1 000 €

Бюлетин

Получавайте известие, когато има важна промяна или новина свързана с форума.
Абонирайте се

Профил

Навигация

Търсене

Търсене

Конфигуриране на push известия в браузъра
Chrome (Android)
  1. Докоснете иконата на катинар до адресната лента.
  2. Докоснете Разрешения → Известия.
  3. Променете предпочитанията си.
Chrome (Desktop)
  1. Кликнете върху иконата на катинар в адресната лента.
  2. Изберете Настройки на сайта.
  3. Намерете Известия и коригирайте предпочитанията си.