Стартирайте отново OTL, копирайте (Copy) и поставете (Paste) скриптовия текст от текстовото поле по-долу под колонката Custom Scans/Fixes, като не забравяте да копирате скрипта 1 към 1, както и двете точки преди първия ред на скрипта.

:Processes
killallprocesses
 
:OTL
PRC - File not found -- C:\WINDOWS\970284104:3080923846.exe
SRV - File not found [Disabled | Stopped] -- -- (HidServ)
SRV - File not found [Auto | Stopped] -- -- (AntiVirService)
SRV - File not found [Auto | Stopped] -- -- (AntiVirSchedulerService)
SRV - File not found [Auto | Stopped] -- -- (AcrSch2Svc)
SRV - File not found [Auto | Stopped] -- -- (AcronisAgent)
O2 - BHO: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\Program Files\Windows Searchqu Toolbar\ToolBar\searchqudtx.dll ()
O2 - BHO: (no name) - {f92a9fe4-2850-4198-b9d5-279880e49b16} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\Program Files\Windows Searchqu Toolbar\ToolBar\searchqudtx.dll ()
O3 - HKLM\..\Toolbar: (no name) - {f92a9fe4-2850-4198-b9d5-279880e49b16} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Acronis Scheduler2 Service] File not found
O4 - HKLM..\Run: [avgnt] File not found
O4 - HKLM..\Run: [tray_ico] File not found
O4 - HKLM..\Run: [tray_ico1] File not found
O4 - HKLM..\Run: [tray_ico2] File not found
O4 - HKLM..\Run: [tray_ico3] File not found
O4 - HKLM..\Run: [tray_ico4] File not found
O4 - HKLM..\Run: [wxpdrv] File not found
O4 - HKU\.DEFAULT..\RunOnce: [nltide_2] File not found
O4 - HKU\S-1-5-18..\RunOnce: [nltide_2] File not found
O4 - HKU\S-1-5-19..\RunOnce: [nltide_2] File not found
O4 - HKU\S-1-5-20..\RunOnce: [nltide_2] File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - File not found
O31 - SafeBoot: AlternateShell - services32.exe
O33 - MountPoints2\{9fc37982-e3f2-11de-9486-00197d5c5c28}\Shell\AutoRun\command - "" = H:\hbcd\wintools\autorun.exe
O33 - MountPoints2\{9fc37982-e3f2-11de-9486-00197d5c5c28}\Shell\Option1\Command - "" = H:\hbcd\wintools\autorun.exe
MsConfig - StartUpReg: KernelFaultCheck - hkey= - key= - File not found
[2011.08.20 11:28:22 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.2
[2011.08.19 09:34:31 | 000,000,000 | ---D | C] -- C:\WINDOWS\av_ico
[2011.08.19 09:32:52 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.tray-8-0-lnk
[2011.08.19 09:32:52 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.tray-8-0
[2011.08.19 09:35:21 | 000,000,000 | ---- | C] () -- C:\WINDOWS\loader2.exe_ok
[2011.08.19 09:38:30 | 000,000,000 | ---- | C] () -- C:\WINDOWS\970284104
[2011.08.19 10:10:00 | 000,000,464 | ---- | M] () -- C:\WINDOWS\Tasks\At1.job
[2011.08.20 20:40:00 | 000,000,464 | ---- | M] () -- C:\WINDOWS\Tasks\At2.job
[2011.08.19 10:00:00 | 000,000,464 | ---- | M] () -- C:\WINDOWS\Tasks\At3.job
[2011.08.21 14:00:00 | 000,000,464 | ---- | M] () -- C:\WINDOWS\Tasks\At4.job
@Alternate Data Stream - 816 bytes -> C:\WINDOWS\970284104:3080923846.exe
@Alternate Data Stream - 171 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2
@Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:CB0AACC9
 
:Reg
 
:files
C:\WINDOWS\970284104:3080923846.exe
 
autorun.inf /alldrives
autorun.exe /alldrives
recycler /alldrives
netsh winsock reset catalog /c
ipconfig /flushdns /c
 
:Commands
[purity]
[emptytemp]
[resethosts]
[clearallrestorepoints]
[emptyflash]
[Reboot]

След като въведете скрипта от цитата по-горе натиснете бутона, маркиран в червено: Run Fix

Windows ще се рестартира и ще се създаде лог файл. Публикувайте съдържанието му с Copy/Paste в следващия си коментар.

Замисли се и вече 10-12 минути не се рестартира, стои само прозореце на ОТЛ но нищо не се случва. Най-долу показва, че работи върху първата команда от скрипта, но това така от самото начало....

Добре...ще изчакаме..!

Няма промяна, екрана е замръзнал, мога да местя мишката, но нищо друго. Няма икони, нищо по десктопа, изглежда всякаш ще се изключи всеки момент, но уви така от 35 мин вече....Процесора не реагира по никакъв начин.... Аз пиша от друго PC.

Хм добре рестартирай си компютъра ...ще опитаме по друг начин...напараво се изпълних с твоя проблем....!!!

Сори! Рестартирах го, чакам инструкции?

Сега изтеглете The Avenger и го разархивирайте на десктопа. Стартирайте avenger.exe, копирайте следния текст и го поставете в текстовото поле на програмата:

Files to delete:
C:\WINDOWS\loader2.exe_ok
C:\WINDOWS\update.2
C:\WINDOWS\update.tray-8-0-lnk
C:\WINDOWS\update.tray-8-0
C:\WINDOWS\Tasks\At1.job
C:\WINDOWS\Tasks\At2.job
C:\WINDOWS\Tasks\At3.job
C:\WINDOWS\Tasks\At4.job
 
Folders to delete:
C:\WINDOWS\av_ico
C:\WINDOWS\970284104

Уверете се, че Scan for rootkits и Automatically disable any rootkits found имат отметки.

След това изберете Execute и при въпрос от страна на програмата, кликнете върху Yes, при което компютъра ще се рестартира. След рестартта копирайте и поставете съдържанието на лог файла от програмата, намиращ се в C:\avenger.txt в следващия си коментар в тази тема.

Logfile of The Avenger Version 2.0, © by Swandog46 http://swandog46.geekstogo.com Platform: Windows XP ******************* Script file opened successfully. Script file read successfully. Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: Rootkit scan active. No rootkits found! File "C:\WINDOWS\loader2.exe_ok" deleted successfully. File "C:\WINDOWS\Tasks\At1.job" deleted successfully. File "C:\WINDOWS\Tasks\At2.job" deleted successfully. File "C:\WINDOWS\Tasks\At3.job" deleted successfully. File "C:\WINDOWS\Tasks\At4.job" deleted successfully. Folder "C:\WINDOWS\update.2" deleted successfully. Folder "C:\WINDOWS\av_ico" deleted successfully. Folder "C:\WINDOWS\update.tray-8-0-lnk" deleted successfully. Folder "C:\WINDOWS\update.tray-8-0" deleted successfully. Error: "C:\WINDOWS\970284104" is not a folder! It may instead be a file. Deletion of folder "C:\WINDOWS\970284104" failed! Status: 0xc0000103 (STATUS_NOT_A_DIRECTORY) --> use "Files to delete:" instead of "Folders to delete:" to delete an ordinary file Completed script processing. ******************* Finished! Terminate.

Хубаво!

Пак стартирайте The Avenger,но този път изпълнете следния скрипт:

Files to delete:
C:\WINDOWS\970284104

Има светлина в тунела, май Logfile of The Avenger Version 2.0, © by Swandog46 http://swandog46.geekstogo.com Platform: Windows XP ******************* Script file opened successfully. Script file read successfully. Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: Rootkit scan active. No rootkits found! File "C:\WINDOWS\970284104" deleted successfully. Completed script processing. ******************* Finished! Terminate.

Мисля че успяхме...!

Обаче имаме още доста работа...а наблюдавате ли първоначалните проблеми..?

Изтеглете StreamArmor и я разархивирайте в собствена папка на десктопа.

Стартирайте файла StreamArmor.exe от папка Portable.

Натиснете бутона SCAN.

След приключване на проверката натиснете бутона Export.

Ще се появи файл на десктопа с името StreamScanResult.html

Архивирайте го и ги прикачете към поста си в следващия коментар.

Забележка: По време на сканирането, програмата много товари и компютъра е практически неизползваем. Това ще се оправи веднага след приключване на проверката.

Ами avira enhanced mode, изчезна отдавна. Аз друго реално не съм наблюдавал, не съм се и опитвам да влизам в фейсбук. Hitman сканира автоматично след рестарт и намира все същите вируси от принтскрийна. Не се бави компа.. Пак същият проблем.... започна да сканира и я спря. При опит да я пусна, казва че нямам достъп.. това направо вече....

Ок ...!Всичко ще е наред....антивирусната ви казах че ще трябва да се преинсталира ,но най-накрая..!Сега да продължим по инструкциите..!

Не, имах впредвид, че не можа да се случи скана на Steamarmour - пак същият проблем както с Malwarebytes... Просто спира скана и убива програмата...

Пак същият проблем.... започна да сканира и я спря. При опит да я пусна, казва че нямам достъп.. това направо вече....

За коя програма се отнася това..?

Разбрах...!

Streamarmor

Стартирайте отново OTL и направете сканиране със същите настройки ...Този път обаче вместо Run Fix натиснете бутона ...Ще се създаде лог файл. Публикувайте съдържанието му с Copy/Paste в следващия си коментар.

Прави се.., незнам защо обаче като дам 90 дни и пусна бързият скан го променя автоматично на 30 дни? Така ли трябва да е?

Да споко..!

OTL logfile created on: 21.8.2011 г. 18:25:02 - Run 2

OTL by OldTimer - Version 3.2.26.5 Folder = C:\Documents and Settings\iva\Desktop

Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 7.0.5730.13)

Locale: 00000402 | Country: Bulgaria | Language: BGR | Date Format: dd.M.yyyy 'г.'

1014,11 Mb Total Physical Memory | 501,64 Mb Available Physical Memory | 49,47% Memory free

2,38 Gb Paging File | 1,96 Gb Available in Paging File | 82,06% Paging File free

Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 25,16 Gb Total Space | 3,53 Gb Free Space | 14,04% Space Free | Partition Type: NTFS

Drive D: | 77,32 Gb Total Space | 13,67 Gb Free Space | 17,69% Space Free | Partition Type: NTFS

Computer Name: IVAPC | User Name: iva | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - File not found -- C:\WINDOWS\970284104:3080923846.exe

PRC - [2011.08.21 15:28:53 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\iva\Desktop\OTL.exe

PRC - [2011.08.06 03:21:27 | 001,017,912 | ---- | M] (Google Inc.) -- C:\Documents and Settings\iva\Local Settings\Application Data\Google\Chrome\Application\chrome.exe

PRC - [2011.03.25 13:34:04 | 000,689,464 | ---- | M] (Radialpoint Inc.) -- C:\Program Files\Virgin Media\Service Manager\ServicepointService.exe

PRC - [2011.03.23 14:12:58 | 001,406,264 | ---- | M] (Virgin Media) -- C:\Program Files\Virgin Media\Digital Home Support\HsdService.exe

PRC - [2011.03.23 14:12:54 | 002,032,952 | ---- | M] (Virgin Media) -- C:\Program Files\Virgin Media\Digital Home Support\DHSClient.exe

PRC - [2011.03.02 15:15:13 | 001,115,536 | ---- | M] (Discordia, LTD) -- C:\Program Files\Windows Searchqu Toolbar\Datamngr\datamngrUI.exe

PRC - [2008.04.14 09:00:00 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe

PRC - [2007.05.03 15:38:26 | 000,036,864 | ---- | M] ( ) -- C:\Program Files\HP\HP UT\bin\hppusg.exe

PRC - [2007.03.26 10:30:12 | 000,053,248 | ---- | M] (HP) -- C:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe

PRC - [2006.08.10 11:47:16 | 000,217,088 | ---- | M] (Sony Corporation) -- C:\Program Files\Sony\VAIO Power Management\SPMgr.exe

PRC - [2006.06.20 12:41:00 | 000,178,176 | ---- | M] (Sony Corporation) -- C:\Program Files\Sony\VAIO Event Service\VESMgr.exe

========== Modules (No Company Name) ==========

MOD - [2011.08.06 03:21:25 | 000,400,440 | ---- | M] () -- C:\Documents and Settings\iva\Local Settings\Application Data\Google\Chrome\Application\13.0.782.112\ppgooglenaclpluginchrome.dll

MOD - [2011.08.06 03:21:24 | 004,118,072 | ---- | M] () -- C:\Documents and Settings\iva\Local Settings\Application Data\Google\Chrome\Application\13.0.782.112\pdf.dll

MOD - [2011.08.06 03:20:12 | 000,373,816 | ---- | M] () -- C:\Documents and Settings\iva\Local Settings\Application Data\Google\Chrome\Application\13.0.782.112\Locales\bg.dll

MOD - [2011.08.06 03:19:58 | 000,104,520 | ---- | M] () -- C:\Documents and Settings\iva\Local Settings\Application Data\Google\Chrome\Application\13.0.782.112\avutil-50.dll

MOD - [2011.08.06 03:19:56 | 000,203,848 | ---- | M] () -- C:\Documents and Settings\iva\Local Settings\Application Data\Google\Chrome\Application\13.0.782.112\avformat-52.dll

MOD - [2011.08.06 03:19:55 | 001,846,344 | ---- | M] () -- C:\Documents and Settings\iva\Local Settings\Application Data\Google\Chrome\Application\13.0.782.112\avcodec-52.dll

MOD - [2011.08.06 01:29:30 | 006,338,720 | ---- | M] () -- C:\Documents and Settings\iva\Local Settings\Application Data\Google\Chrome\Application\13.0.782.112\gcswf32.dll

MOD - [2011.05.26 13:42:00 | 000,067,872 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll

MOD - [2010.10.04 23:48:38 | 003,391,488 | ---- | M] () -- c:\windows\assembly\nativeimages1_v1.1.4322\mscorlib\1.0.5000.0__b77a5c561934e089_96e10485\mscorlib.dll

MOD - [2010.10.04 23:48:36 | 000,835,584 | ---- | M] () -- c:\windows\assembly\nativeimages1_v1.1.4322\system.drawing\1.0.5000.0__b03f5f7f11d50a3a_faeb1523\system.drawing.dll

MOD - [2010.10.04 23:48:31 | 002,088,960 | ---- | M] () -- c:\windows\assembly\nativeimages1_v1.1.4322\system.xml\1.0.5000.0__b77a5c561934e089_820f5c45\system.xml.dll

MOD - [2010.10.04 23:48:28 | 003,018,752 | ---- | M] () -- c:\windows\assembly\nativeimages1_v1.1.4322\system.windows.forms\1.0.5000.0__b77a5c561934e089_7a742879\system.windows.forms.dll

MOD - [2010.10.04 23:48:20 | 001,966,080 | ---- | M] () -- c:\windows\assembly\nativeimages1_v1.1.4322\system\1.0.5000.0__b77a5c561934e089_434bf002\system.dll

MOD - [2010.10.04 23:48:11 | 001,232,896 | ---- | M] () -- c:\windows\assembly\gac\system\1.0.5000.0__b77a5c561934e089\system.dll

MOD - [2009.12.11 22:57:53 | 001,339,392 | ---- | M] () -- c:\windows\assembly\gac\system.xml\1.0.5000.0__b77a5c561934e089\system.xml.dll

MOD - [2009.12.11 22:57:52 | 000,323,584 | ---- | M] () -- c:\windows\assembly\gac\system.runtime.remoting\1.0.5000.0__b77a5c561934e089\system.runtime.remoting.dll

MOD - [2009.12.11 22:57:51 | 000,466,944 | ---- | M] () -- c:\windows\assembly\gac\system.drawing\1.0.5000.0__b03f5f7f11d50a3a\system.drawing.dll

MOD - [2009.12.11 22:57:49 | 002,052,096 | ---- | M] () -- c:\windows\assembly\gac\system.windows.forms\1.0.5000.0__b77a5c561934e089\system.windows.forms.dll

MOD - [2009.12.11 22:57:48 | 000,131,072 | ---- | M] () -- c:\windows\assembly\gac\system.runtime.serialization.formatters.soap\1.0.5000.0__b03f5f7f11d50a3a\system.runtime.serialization.formatters.soap.dll

MOD - [2009.12.09 12:04:34 | 000,010,752 | ---- | M] () -- c:\windows\assembly\gac\interop.hpqusg\3.0.0.0__a53cf5803f4c3827\interop.hpqusg.dll

MOD - [2008.07.12 20:09:43 | 000,245,248 | ---- | M] () -- \\?\globalroot\systemroot\system32\mswsock.dll

MOD - [2007.05.05 08:10:34 | 000,128,512 | ---- | M] () -- C:\Program Files\WinRar\RarExt.dll

MOD - [2007.03.26 10:29:32 | 000,053,248 | ---- | M] () -- C:\Program Files\HP\ToolBoxFX\bin\NativeUtils.dll

MOD - [2006.06.20 12:41:00 | 000,010,752 | ---- | M] () -- C:\Program Files\Sony\VAIO Event Service\VESBasePS.dll

========== Win32 Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] -- -- (HidServ)

SRV - File not found [Auto | Stopped] -- -- (AntiVirService)

SRV - File not found [Auto | Stopped] -- -- (AntiVirSchedulerService)

SRV - File not found [Auto | Stopped] -- -- (AcrSch2Svc)

SRV - File not found [Auto | Stopped] -- -- (AcronisAgent)

SRV - [2011.03.25 13:34:04 | 000,689,464 | ---- | M] (Radialpoint Inc.) [Auto | Running] -- C:\Program Files\Virgin Media\Service Manager\ServicepointService.exe -- (ServicepointService)

SRV - [2011.03.23 14:12:58 | 001,406,264 | ---- | M] (Virgin Media) [Auto | Running] -- C:\Program Files\Virgin Media\Digital Home Support\HsdService.exe -- (HsdService)

SRV - [2010.11.19 06:57:14 | 001,150,936 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\PC Tools Security\pctsSvc.exe -- (sdCoreService)

SRV - [2010.03.15 14:02:36 | 000,366,840 | ---- | M] (PC Tools) [On_Demand | Stopped] -- C:\Program Files\PC Tools Security\pctsAuxs.exe -- (sdAuxService)

SRV - [2008.11.26 18:10:31 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)

SRV - [2006.09.02 13:06:33 | 002,528,960 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Program Files\Symantec\LiveUpdate\LuComServer_3_1.EXE -- (LiveUpdate)

SRV - [2006.06.20 12:41:00 | 000,178,176 | ---- | M] (Sony Corporation) [Auto | Running] -- C:\Program Files\Sony\VAIO Event Service\VESMgr.exe -- (VAIO Event Service)

========== Driver Services (SafeList) ==========

DRV - [2010.12.10 13:24:12 | 000,239,168 | ---- | M] (PC Tools) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\PCTCore.sys -- (PCTCore)

DRV - [2010.07.16 14:59:54 | 000,338,880 | ---- | M] (PC Tools) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\pctDS.sys -- (pctDS)

DRV - [2009.12.09 13:12:24 | 000,056,816 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)

DRV - [2009.06.15 09:10:00 | 000,297,728 | ---- | M] (Marvell) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\yk51x86.sys -- (yukonwxp)

DRV - [2009.05.11 09:12:24 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)

DRV - [2009.03.30 09:33:07 | 000,096,104 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)

DRV - [2008.11.26 20:44:17 | 000,132,352 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\snapman.sys -- (snapman)

DRV - [2007.09.11 15:23:22 | 004,614,656 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)

DRV - [2007.06.21 03:30:00 | 000,547,072 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ar5211.sys -- (AR5211)

DRV - [2006.11.07 08:21:50 | 000,506,368 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ExpasAG.sys -- (LEX_AS_NIC_SERVICE_YNOS)

DRV - [2006.11.06 12:56:04 | 000,227,328 | ---- | M] (Texas Instruments) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ti21sony.sys -- (ti21sony)

DRV - [2006.08.04 09:39:10 | 000,008,192 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\XAudio.sys -- (XAudio)

DRV - [2006.07.24 16:08:20 | 000,990,592 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_DPV.sys -- (HSF_DPV)

DRV - [2006.07.24 16:08:20 | 000,727,808 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys -- (winachsf)

DRV - [2006.07.24 16:08:20 | 000,208,256 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSFHWAZL.sys -- (HSFHWAZL)

DRV - [2002.04.11 14:13:44 | 000,016,194 | ---- | M] (AMBIT Microsystems Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\AWINDIS5.SYS -- (AWINDIS5)

DRV - [2001.08.17 17:51:20 | 000,020,752 | ---- | M] (Sony Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\SonyNC.sys -- (SNC)

DRV - [2000.12.05 12:48:02 | 000,003,952 | ---- | M] (Sony Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\DMICall.sys -- (DMICall)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-220523388-1682526488-1417001333-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource=10&ctid=CT1320680

IE - HKU\S-1-5-21-220523388-1682526488-1417001333-1003\..\URLSearchHook: {472734EA-242A-422b-ADF8-83D1E48CC825} - Reg Error: Key error. File not found

IE - HKU\S-1-5-21-220523388-1682526488-1417001333-1003\..\URLSearchHook: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files\uTorrentBar\tbuTor.dll (Conduit Ltd.)

IE - HKU\S-1-5-21-220523388-1682526488-1417001333-1003\..\URLSearchHook: {f92a9fe4-2850-4198-b9d5-279880e49b16} - Reg Error: Key error. File not found

IE - HKU\S-1-5-21-220523388-1682526488-1417001333-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-220523388-1682526488-1417001333-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Bing"

FF - prefs.js..browser.search.defaultthis.engineName: "Free Ride Games Customized Web Search"

FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT1320680&SearchSource=3&q={searchTerms}"

FF - prefs.js..browser.search.order.1: "Web Search"

FF - prefs.js..browser.search.selectedEngine: "Free Ride Games Customized Web Search"

FF - prefs.js..browser.search.useDBForOrder: true

FF - prefs.js..browser.startup.homepage: "http://www.searchqu.com/"

FF - prefs.js..extensions.enabledItems: [email protected]:3.3.3.2

FF - prefs.js..extensions.enabledItems: {1FD91A9C-410C-4090-BBCC-55D3450EF433}:1.0

FF - prefs.js..extensions.enabledItems: [email protected]:1.3.4

FF - prefs.js..extensions.enabledItems: {f92a9fe4-2850-4198-b9d5-279880e49b16}:3.3.3.2

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}:6.0.26

FF - prefs.js..extensions.enabledItems: [email protected]:1.0

FF - prefs.js..extensions.enabledItems: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}:3.3.3.2

FF - prefs.js..keyword.URL: "http://www.searchqu.com/web?src=ffb&systemid=101&q="

FF - prefs.js..network.proxy.http: "zulus.mnet.bg"

FF - prefs.js..network.proxy.http_port: 9999

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\3.0.40818.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@radialpoint.com/SPA,version=1: C:\Program Files\Virgin Media\Service Manager\nprpspa.dll (Virgin Media)

FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Documents and Settings\iva\Local Settings\Application Data\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)

FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Documents and Settings\iva\Local Settings\Application Data\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.0.6\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.03.13 11:01:00 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.0.6\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.07.18 20:49:39 | 000,000,000 | ---D | M]

[2011.04.10 19:56:21 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\iva\Application Data\Mozilla\Extensions

[2011.08.21 11:40:55 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\iva\Application Data\Mozilla\Firefox\Profiles\ztksu59m.default\extensions

[2010.10.05 23:10:07 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\iva\Application Data\Mozilla\Firefox\Profiles\ztksu59m.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}

[2011.04.10 19:56:12 | 000,000,000 | ---D | M] (Searchqu Toolbar) -- C:\Documents and Settings\iva\Application Data\Mozilla\Firefox\Profiles\ztksu59m.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}

[2011.05.09 21:53:46 | 000,000,000 | ---D | M] (uTorrentBar Community Toolbar) -- C:\Documents and Settings\iva\Application Data\Mozilla\Firefox\Profiles\ztksu59m.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}

[2011.04.10 21:56:54 | 000,000,000 | ---D | M] (Free Ride Games Community Toolbar) -- C:\Documents and Settings\iva\Application Data\Mozilla\Firefox\Profiles\ztksu59m.default\extensions\{f92a9fe4-2850-4198-b9d5-279880e49b16}

[2011.05.09 21:53:47 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Documents and Settings\iva\Application Data\Mozilla\Firefox\Profiles\ztksu59m.default\extensions\[email protected]

[2011.07.05 22:22:58 | 000,000,572 | ---- | M] () -- C:\Documents and Settings\iva\Application Data\Mozilla\Firefox\Profiles\ztksu59m.default\searchplugins\bing.xml

[2011.04.06 10:58:38 | 000,000,933 | ---- | M] () -- C:\Documents and Settings\iva\Application Data\Mozilla\Firefox\Profiles\ztksu59m.default\searchplugins\conduit.xml

[2010.09.02 09:09:41 | 000,005,529 | ---- | M] () -- C:\Documents and Settings\iva\Application Data\Mozilla\Firefox\Profiles\ztksu59m.default\searchplugins\SearchquWebSearch.xml

[2011.08.21 11:40:55 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions

[2010.12.23 00:03:03 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}

[2011.03.14 09:58:19 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}

[2011.07.30 18:16:09 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}

[2009.10.06 21:03:35 | 000,000,000 | ---D | M] (Free Download Manager plugin) -- C:\PROGRAM FILES\FREE DOWNLOAD MANAGER\FIREFOX\EXTENSION

[2009.12.17 20:24:59 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF

[2011.04.10 19:56:21 | 000,000,000 | ---D | M] (DataMngr) -- C:\PROGRAM FILES\WINDOWS SEARCHQU TOOLBAR\DATAMNGR\FIREFOXEXTENSION

[2009.11.06 17:37:19 | 000,091,552 | ---- | M] (Coupons, Inc.) -- C:\Program Files\mozilla firefox\plugins\npCouponPrinter.dll

[2011.05.04 04:52:23 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll

[2009.11.06 17:37:20 | 000,091,552 | ---- | M] (Coupons, Inc.) -- C:\Program Files\mozilla firefox\plugins\npMozCouponPrinter.dll

[2010.09.02 09:09:41 | 000,005,529 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\SearchquWebSearch.xml

O1 HOSTS File: ([2011.08.21 14:07:47 | 000,000,726 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1 localhost

O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)

O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)

O2 - BHO: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\Program Files\Windows Searchqu Toolbar\ToolBar\searchqudtx.dll ()

O2 - BHO: (UrlHelper Class) - {A40DC6C5-79D0-4ca8-A185-8FF989AF1115} - C:\Program Files\Windows Searchqu Toolbar\Datamngr\IEBHO.dll (Discordia, LTD)

O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O2 - BHO: (uTorrentBar Toolbar) - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files\uTorrentBar\tbuTor.dll (Conduit Ltd.)

O2 - BHO: (FDMIECookiesBHO Class) - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll ()

O2 - BHO: (no name) - {f92a9fe4-2850-4198-b9d5-279880e49b16} - No CLSID value found.

O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)

O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O3 - HKLM\..\Toolbar: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\Program Files\Windows Searchqu Toolbar\ToolBar\searchqudtx.dll ()

O3 - HKLM\..\Toolbar: (uTorrentBar Toolbar) - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files\uTorrentBar\tbuTor.dll (Conduit Ltd.)

O3 - HKLM\..\Toolbar: (no name) - {f92a9fe4-2850-4198-b9d5-279880e49b16} - No CLSID value found.

O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.

O3 - HKU\S-1-5-21-220523388-1682526488-1417001333-1003\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O3 - HKU\S-1-5-21-220523388-1682526488-1417001333-1003\..\Toolbar\WebBrowser: (uTorrentBar Toolbar) - {BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} - C:\Program Files\uTorrentBar\tbuTor.dll (Conduit Ltd.)

O4 - HKLM..\Run: [] File not found

O4 - HKLM..\Run: [Acronis Scheduler2 Service] File not found

O4 - HKLM..\Run: [avgnt] File not found

O4 - HKLM..\Run: [DATAMNGR] C:\Program Files\Windows Searchqu Toolbar\Datamngr\datamngrUI.exe (Discordia, LTD)

O4 - HKLM..\Run: [DHSClient.exe] C:\Program Files\Virgin Media\Digital Home Support\DHSClient.exe (Virgin Media)

O4 - HKLM..\Run: [HitmanPro35] C:\Program Files\Hitman Pro 3.5\HitmanPro35.exe (SurfRight B.V.)

O4 - HKLM..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe (HP)

O4 - HKLM..\Run: [HPUsageTracking] c:\Program Files\HP\HP UT\bin\hppusg.exe ( )

O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime Alternative\QTTask.exe (Apple Inc.)

O4 - HKLM..\Run: [serviceManager.exe] C:\Program Files\Virgin Media\Service Manager\ServiceManager.exe (Virgin Media)

O4 - HKLM..\Run: [sonyPowerCfg] C:\Program Files\Sony\VAIO Power Management\SPMgr.exe (Sony Corporation)

O4 - HKLM..\Run: [ToolBoxFX] c:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe (HP)

O4 - HKLM..\Run: [tray_ico] File not found

O4 - HKLM..\Run: [tray_ico1] File not found

O4 - HKLM..\Run: [tray_ico2] File not found

O4 - HKLM..\Run: [tray_ico3] File not found

O4 - HKLM..\Run: [tray_ico4] File not found

O4 - HKLM..\Run: [wxpdrv] File not found

O4 - HKU\.DEFAULT..\RunOnce: [nltide_2] File not found

O4 - HKU\S-1-5-18..\RunOnce: [nltide_2] File not found

O4 - HKU\S-1-5-19..\RunOnce: [nltide_2] File not found

O4 - HKU\S-1-5-20..\RunOnce: [nltide_2] File not found

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableSecureUIAPaths = 0

O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-21-220523388-1682526488-1417001333-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O8 - Extra context menu item: Append to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Convert link target to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Convert link target to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Convert selected links to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Convert selected links to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Convert selection to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Convert selection to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Convert to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Свали видеото с Free Download Manager - C:\Program Files\Free Download Manager\dlfvideo.htm ()

O8 - Extra context menu item: Свали всички с Free Download Manager - C:\Program Files\Free Download Manager\dlall.htm ()

O8 - Extra context menu item: Свали избраните с Free Download Manager - C:\Program Files\Free Download Manager\dlselected.htm ()

O8 - Extra context menu item: Свали с Free Download Manager - C:\Program Files\Free Download Manager\dllink.htm ()

O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\Install\Office12\REFIEBAR.DLL (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)

O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - File not found

O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - File not found

O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - File not found

O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - File not found

O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - File not found

O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - File not found

O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - File not found

O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - File not found

O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - File not found

O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - File not found

O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - File not found

O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - File not found

O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - File not found

O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - File not found

O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - File not found

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)

O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 194.168.4.100 194.168.8.100

O20 - AppInit_DLLs: (c:\progra~1\wi9130~1\datamngr\datamngr.dll) - c:\Program Files\Windows Searchqu Toolbar\Datamngr\datamngr.dll (Discordia, LTD)

O20 - AppInit_DLLs: (c:\progra~1\wi9130~1\datamngr\iebho.dll) - c:\Program Files\Windows Searchqu Toolbar\Datamngr\IEBHO.dll (Discordia, LTD)

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)

O20 - Winlogon\Notify\VESWinlogon: DllName - VESWinlogon.dll - C:\WINDOWS\System32\VESWinlogon.dll (Sony Corporation)

O24 - Desktop WallPaper: C:\Documents and Settings\iva\Local Settings\Application Data\Microsoft\Wallpaper1.bmp

O24 - Desktop BackupWallPaper: C:\Documents and Settings\iva\Local Settings\Application Data\Microsoft\Wallpaper1.bmp

O30 - LSA: Authentication Packages - (relog_ap) - C:\WINDOWS\System32\relog_ap.dll (Acronis)

O31 - SafeBoot: AlternateShell - services32.exe

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2008.11.24 16:45:12 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

O33 - MountPoints2\{9fc37982-e3f2-11de-9486-00197d5c5c28}\Shell\AutoRun\command - "" = H:\hbcd\wintools\autorun.exe

O33 - MountPoints2\{9fc37982-e3f2-11de-9486-00197d5c5c28}\Shell\Option1\Command - "" = H:\hbcd\wintools\autorun.exe

O34 - HKLM BootExecute: (autocheck autochk *) - File not found

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found

NetSvcs: HidServ - File not found

NetSvcs: Ias - File not found

NetSvcs: Iprip - File not found

NetSvcs: Irmon - File not found

NetSvcs: NWCWorkstation - File not found

NetSvcs: Nwsapagent - File not found

NetSvcs: WmdmPmSp - File not found

MsConfig - Services: "XAudioService"

MsConfig - Services: "WMPNetworkSvc"

MsConfig - Services: "odserv"

MsConfig - Services: "MDM"

MsConfig - StartUpReg: Acrobat Assistant 8.0 - hkey= - key= - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe (Adobe Systems Inc.)

MsConfig - StartUpReg: Alcmtr - hkey= - key= - C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.)

MsConfig - StartUpReg: KernelFaultCheck - hkey= - key= - File not found

MsConfig - StartUpReg: RemoteControl - hkey= - key= - C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe (Cyberlink Corp.)

MsConfig - StartUpReg: Switcher.exe - hkey= - key= - C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe (Sony Corporation)

MsConfig - StartUpReg: WinampAgent - hkey= - key= - File not found

MsConfig - State: "system.ini" - 0

MsConfig - State: "win.ini" - 0

MsConfig - State: "bootini" - 0

MsConfig - State: "services" - 2

MsConfig - State: "startup" - 2

========== Files/Folders - Created Within 30 Days ==========

[2011.08.21 18:14:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\iva\Desktop\StreamArmor

[2011.08.21 17:40:49 | 000,000,000 | ---D | C] -- C:\Avenger

[2011.08.21 16:36:03 | 000,000,000 | ---D | C] -- C:\_OTL

[2011.08.21 15:28:53 | 000,580,096 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\iva\Desktop\OTL.exe

[2011.08.21 14:13:52 | 009,466,208 | ---- | C] (Malwarebytes Corporation ) -- C:\Documents and Settings\iva\Desktop\mbam-setup-1.51.1.1800 (1).exe

[2011.08.21 14:03:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\iva\Desktop\RK_Quarantine

[2011.08.21 13:53:33 | 000,000,000 | --SD | C] -- C:\32788R22FWJFW

[2011.08.21 13:17:17 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\LogFiles

[2011.08.21 11:53:09 | 000,000,000 | R--D | C] -- C:\Documents and Settings\iva\My Documents\My Videos

[2011.08.21 11:53:08 | 000,000,000 | R--D | C] -- C:\Documents and Settings\iva\Start Menu\Programs\Administrative Tools

[2011.08.20 11:35:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\iva\Application Data\TeamViewer

[2011.08.19 23:17:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\GridinSoft

[2011.08.19 23:17:43 | 000,000,000 | ---D | C] -- C:\Program Files\GridinSoft Trojan Killer

[2011.08.19 22:11:37 | 000,656,320 | ---- | C] (PC Tools) -- C:\WINDOWS\System32\drivers\pctEFA.sys

[2011.08.19 22:11:37 | 000,338,880 | ---- | C] (PC Tools) -- C:\WINDOWS\System32\drivers\pctDS.sys

[2011.08.19 22:11:37 | 000,251,560 | ---- | C] (PC Tools) -- C:\WINDOWS\System32\drivers\pctgntdi.sys

[2011.08.19 22:11:32 | 000,239,168 | ---- | C] (PC Tools) -- C:\WINDOWS\System32\drivers\PCTCore.sys

[2011.08.19 22:11:32 | 000,160,448 | ---- | C] (PC Tools) -- C:\WINDOWS\System32\drivers\PCTAppEvent.sys

[2011.08.19 22:11:31 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\PC Tools Security

[2011.08.19 22:11:27 | 000,070,536 | ---- | C] (PC Tools) -- C:\WINDOWS\System32\drivers\pctplsg.sys

[2011.08.19 22:11:11 | 000,000,000 | ---D | C] -- C:\Program Files\PC Tools Security

[2011.08.19 22:11:11 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\PC Tools

[2011.08.19 22:11:11 | 000,000,000 | ---D | C] -- C:\Documents and Settings\iva\Application Data\PC Tools

[2011.08.19 21:59:56 | 000,000,000 | -HSD | C] -- C:\WINDOWS\CSC

[2011.08.19 21:45:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\PC Tools

[2011.08.19 21:38:08 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Hitman Pro 3.5

[2011.08.19 21:38:06 | 000,000,000 | ---D | C] -- C:\Program Files\Hitman Pro 3.5

[2011.08.19 21:37:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Hitman Pro

[2011.08.19 09:41:56 | 000,000,000 | ---D | C] -- C:\WINDOWS\rpcminer

[2011.08.19 09:36:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\WinRAR

[2011.08.13 18:49:07 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Skype

[2011.08.12 08:53:47 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\iva\Recent

[2011.08.06 14:29:27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\iva\My Documents\ACDSee Photo Editor

[2011.07.30 18:16:34 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java

[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011.08.21 18:11:12 | 003,207,927 | ---- | M] () -- C:\Documents and Settings\iva\Desktop\StreamArmor.zip

[2011.08.21 18:06:00 | 000,001,070 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-220523388-1682526488-1417001333-1003UA.job

[2011.08.21 18:04:05 | 000,023,624 | ---- | M] () -- C:\WINDOWS\System32\drivers\hitmanpro35.sys

[2011.08.21 18:02:50 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl

[2011.08.21 18:02:13 | 000,000,000 | ---- | M] () -- C:\WINDOWS\970284104

[2011.08.21 18:02:12 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2011.08.21 18:02:10 | 1063,440,384 | -HS- | M] () -- C:\hiberfil.sys

[2011.08.21 17:06:00 | 000,001,018 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-220523388-1682526488-1417001333-1003Core.job

[2011.08.21 15:28:53 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\iva\Desktop\OTL.exe

[2011.08.21 15:11:46 | 000,036,260 | ---- | M] () -- C:\Documents and Settings\iva\Desktop\Hitman log1.GIF

[2011.08.21 15:11:05 | 000,037,708 | ---- | M] () -- C:\Documents and Settings\iva\Desktop\Hitman log.GIF

[2011.08.21 15:04:08 | 004,179,400 | R--- | M] () -- C:\Documents and Settings\iva\Desktop\ComboFix.exe

[2011.08.21 14:57:19 | 000,327,504 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT

[2011.08.21 14:14:00 | 009,466,208 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\iva\Desktop\mbam-setup-1.51.1.1800 (1).exe

[2011.08.21 14:07:47 | 000,000,726 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts

[2011.08.21 13:17:00 | 000,000,235 | ---- | M] () -- C:\Documents and Settings\iva\Desktop\Document.rtf

[2011.08.19 23:17:48 | 000,000,814 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Trojan Killer.lnk

[2011.08.19 22:11:31 | 000,001,666 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Spyware Doctor.lnk

[2011.08.19 22:07:25 | 000,512,992 | ---- | M] () -- C:\Documents and Settings\iva\Desktop\sdsetup_revwire207.exe

[2011.08.19 21:44:30 | 000,513,008 | ---- | M] () -- C:\Documents and Settings\iva\Desktop\avinstall.exe

[2011.08.19 21:38:08 | 000,001,665 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Hitman Pro 3.5.lnk

[2011.08.19 11:24:32 | 000,000,734 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hоsts

[2011.08.19 09:47:28 | 000,000,215 | ---- | M] () -- C:\boot.ini

[2011.08.18 22:17:35 | 000,073,728 | ---- | M] () -- C:\Documents and Settings\iva\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2011.08.18 19:47:44 | 000,031,967 | ---- | M] () -- C:\Documents and Settings\iva\Desktop\Mosses for the Hare Hill.rtf

[2011.08.18 14:23:09 | 000,000,515 | ---- | M] () -- C:\Documents and Settings\iva\Application Data\Microsoft\Internet Explorer\Quick Launch\Shortcut to Show Desktop.lnk

[2011.08.13 23:21:33 | 000,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini

[2011.08.13 21:14:28 | 000,125,552 | ---- | M] () -- C:\Documents and Settings\iva\Desktop\Banner + ring.JPG

[2011.08.13 21:00:04 | 000,084,126 | ---- | M] () -- C:\Documents and Settings\iva\Desktop\Banner1.JPG

[2011.08.13 20:57:45 | 000,040,755 | ---- | M] () -- C:\Documents and Settings\iva\Desktop\banner stand.JPG

[2011.08.13 20:46:50 | 000,107,728 | ---- | M] () -- C:\Documents and Settings\iva\Desktop\Banner ENTRANCE.JPG

[2011.08.13 20:25:15 | 000,077,616 | ---- | M] () -- C:\Documents and Settings\iva\Desktop\Banner2.JPG

[2011.08.13 18:49:07 | 000,001,878 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Skype.lnk

[2011.08.12 17:02:02 | 000,409,461 | ---- | M] () -- C:\Documents and Settings\iva\Desktop\Air 2.jpg

[2011.08.12 16:54:12 | 000,531,196 | ---- | M] () -- C:\Documents and Settings\iva\Desktop\Oblivion.jpg

[2011.08.12 16:51:43 | 001,060,314 | ---- | M] () -- C:\Documents and Settings\iva\Desktop\13.jpg

[2011.08.12 16:46:53 | 000,339,532 | ---- | M] () -- C:\Documents and Settings\iva\Desktop\Air.jpg

[2011.08.12 08:53:19 | 001,046,357 | ---- | M] () -- C:\Documents and Settings\iva\Desktop\booklets_Substrate.pdf

[2011.08.12 08:52:56 | 000,000,682 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\CCleaner.lnk

[2011.08.11 09:00:19 | 000,444,344 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat

[2011.08.11 09:00:19 | 000,072,602 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat

[2011.08.06 14:29:02 | 000,001,940 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\ACDSee Photo Editor 2008.lnk

[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011.08.21 18:10:48 | 003,207,927 | ---- | C] () -- C:\Documents and Settings\iva\Desktop\StreamArmor.zip

[2011.08.21 18:02:13 | 000,000,000 | ---- | C] () -- C:\WINDOWS\970284104

[2011.08.21 17:38:48 | 000,731,136 | ---- | C] () -- C:\Documents and Settings\iva\Desktop\avenger.exe

[2011.08.21 15:11:42 | 000,036,260 | ---- | C] () -- C:\Documents and Settings\iva\Desktop\Hitman log1.GIF

[2011.08.21 15:11:03 | 000,037,708 | ---- | C] () -- C:\Documents and Settings\iva\Desktop\Hitman log.GIF

[2011.08.21 15:04:07 | 004,179,400 | R--- | C] () -- C:\Documents and Settings\iva\Desktop\ComboFix.exe

[2011.08.21 13:17:00 | 000,000,235 | ---- | C] () -- C:\Documents and Settings\iva\Desktop\Document.rtf

[2011.08.20 11:29:45 | 000,023,624 | ---- | C] () -- C:\WINDOWS\System32\drivers\hitmanpro35.sys

[2011.08.20 11:27:44 | 1063,440,384 | -HS- | C] () -- C:\hiberfil.sys

[2011.08.19 23:17:48 | 000,000,814 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Trojan Killer.lnk

[2011.08.19 22:11:31 | 000,001,666 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Spyware Doctor.lnk

[2011.08.19 22:07:48 | 000,512,992 | ---- | C] () -- C:\Documents and Settings\iva\Desktop\sdsetup_revwire207.exe

[2011.08.19 21:45:02 | 000,513,008 | ---- | C] () -- C:\Documents and Settings\iva\Desktop\avinstall.exe

[2011.08.19 21:38:08 | 000,001,665 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Hitman Pro 3.5.lnk

[2011.08.18 14:23:09 | 000,000,515 | ---- | C] () -- C:\Documents and Settings\iva\Application Data\Microsoft\Internet Explorer\Quick Launch\Shortcut to Show Desktop.lnk

[2011.08.17 20:43:49 | 000,031,967 | ---- | C] () -- C:\Documents and Settings\iva\Desktop\Mosses for the Hare Hill.rtf

[2011.08.13 21:14:28 | 000,125,552 | ---- | C] () -- C:\Documents and Settings\iva\Desktop\Banner + ring.JPG

[2011.08.13 20:57:45 | 000,040,755 | ---- | C] () -- C:\Documents and Settings\iva\Desktop\banner stand.JPG

[2011.08.13 20:28:55 | 000,107,728 | ---- | C] () -- C:\Documents and Settings\iva\Desktop\Banner ENTRANCE.JPG

[2011.08.13 20:00:18 | 000,077,616 | ---- | C] () -- C:\Documents and Settings\iva\Desktop\Banner2.JPG

[2011.08.13 19:25:13 | 000,084,126 | ---- | C] () -- C:\Documents and Settings\iva\Desktop\Banner1.JPG

[2011.08.12 17:02:01 | 000,409,461 | ---- | C] () -- C:\Documents and Settings\iva\Desktop\Air 2.jpg

[2011.08.12 16:54:12 | 000,531,196 | ---- | C] () -- C:\Documents and Settings\iva\Desktop\Oblivion.jpg

[2011.08.12 16:50:27 | 001,060,314 | ---- | C] () -- C:\Documents and Settings\iva\Desktop\13.jpg

[2011.08.12 16:46:53 | 000,339,532 | ---- | C] () -- C:\Documents and Settings\iva\Desktop\Air.jpg

[2011.08.12 08:53:18 | 001,046,357 | ---- | C] () -- C:\Documents and Settings\iva\Desktop\booklets_Substrate.pdf

[2011.08.06 14:29:02 | 000,001,940 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\ACDSee Photo Editor 2008.lnk

[2011.04.10 21:55:55 | 000,000,064 | ---- | C] () -- C:\WINDOWS\GPlrLanc.dat

[2010.01.29 07:31:46 | 000,011,705 | ---- | C] () -- C:\WINDOWS\hpdj6122.ini

[2009.12.09 12:06:31 | 000,000,126 | ---- | C] () -- C:\Documents and Settings\iva\Local Settings\Application Data\fusioncache.dat

[2009.12.09 11:59:22 | 000,000,131 | ---- | C] () -- C:\WINDOWS\System32\AddPort.ini

[2009.12.09 11:56:58 | 000,128,786 | ---- | C] () -- C:\WINDOWS\hppins02.dat

[2009.12.09 11:56:58 | 000,001,883 | ---- | C] () -- C:\WINDOWS\hppmdl02.dat

[2008.12.20 11:09:38 | 000,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini

[2008.12.10 09:21:52 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat

[2008.11.26 23:21:17 | 000,000,000 | ---- | C] () -- C:\WINDOWS\vpc32.INI

[2008.11.26 18:46:18 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat

[2008.11.26 18:39:09 | 000,073,728 | ---- | C] () -- C:\Documents and Settings\iva\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2008.11.26 17:25:10 | 000,164,352 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll

[2008.11.26 17:25:09 | 000,000,038 | ---- | C] () -- C:\WINDOWS\avisplitter.ini

[2008.11.26 17:25:07 | 000,755,027 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll

[2008.11.26 17:25:07 | 000,159,839 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll

[2008.11.26 17:25:06 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll

[2008.11.26 17:25:05 | 000,007,680 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll

[2008.11.26 13:50:51 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI

[2008.11.26 13:49:22 | 000,327,504 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT

[2008.11.26 13:19:34 | 000,000,000 | ---- | C] () -- C:\WINDOWS\PROTOCOL.INI

[2008.11.26 13:07:04 | 000,000,510 | ---- | C] () -- C:\WINDOWS\ODBC.INI

[2008.11.26 12:53:44 | 000,163,840 | ---- | C] () -- C:\WINDOWS\System32\WLANDLL.DLL

[2008.11.26 12:49:08 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\ChCfg.exe

[2008.11.26 12:31:26 | 000,200,704 | ---- | C] () -- C:\WINDOWS\System32\igfxCoIn_v4704.dll

[2008.11.26 12:06:40 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat

[2008.11.26 11:58:45 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat

[2008.04.14 09:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin

[2008.04.14 09:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat

[2008.04.14 09:00:00 | 000,444,344 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat

[2008.04.14 09:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat

[2008.04.14 09:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat

[2008.04.14 09:00:00 | 000,072,602 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat

[2008.04.14 09:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin

[2008.04.14 09:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat

[2008.04.14 09:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat

[2008.04.14 09:00:00 | 000,004,463 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat

[2008.04.14 09:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin

[2008.04.14 09:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat

[2007.03.21 17:54:10 | 000,229,376 | ---- | C] () -- C:\WINDOWS\System32\HPPCPR01.DLL

[2007.03.15 12:45:18 | 000,000,630 | ---- | C] () -- C:\WINDOWS\System32\HPPCPR01.DAT

[2001.07.07 03:00:00 | 000,003,399 | ---- | C] () -- C:\WINDOWS\System32\hptcpmon.ini

[2001.03.28 11:37:14 | 000,000,033 | ---- | C] () -- C:\WINDOWS\hppcap.ini

========== LOP Check ==========

[2011.08.06 14:28:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ACD Systems

[2008.11.26 20:45:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Acronis

[2009.03.31 15:39:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ESET

[2009.10.06 21:03:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\FreeDownloadManager.ORG

[2011.08.19 22:34:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Hitman Pro

[2010.10.07 13:52:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\IsolatedStorage

[2009.12.09 12:07:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MSScanAppDataDir

[2010.10.07 14:31:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PAS

[2011.08.05 20:30:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Radialpoint

[2011.08.21 13:22:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP

[2011.05.08 22:57:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Virgin Media

[2011.07.18 20:52:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}

[2011.08.06 14:29:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\iva\Application Data\ACD Systems

[2010.10.07 13:52:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\iva\Application Data\bppenu11

[2011.08.19 23:18:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\iva\Application Data\Free Download Manager

[2010.10.07 14:34:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\iva\Application Data\Palo Alto Software

[2011.07.16 16:53:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\iva\Application Data\PriceGong

[2011.03.16 09:38:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\iva\Application Data\Radialpoint

[2011.04.15 13:17:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\iva\Application Data\searchquband

[2011.04.19 14:50:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\iva\Application Data\searchqutoolbar

[2011.08.20 11:35:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\iva\Application Data\TeamViewer

[2008.11.26 12:47:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\iva\Application Data\TMP

[2011.08.19 09:28:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\iva\Application Data\uTorrent

[2011.03.19 11:31:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\iva\Application Data\Virgin Media

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >

[2008.11.24 16:45:12 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT

[2011.08.21 18:01:45 | 000,000,988 | ---- | M] () -- C:\avenger.txt

[2011.04.05 00:31:16 | 000,000,680 | ---- | M] () -- C:\bar.emf

[2011.08.19 09:47:28 | 000,000,215 | ---- | M] () -- C:\boot.ini

[2008.11.24 16:45:12 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS

[2011.08.21 18:02:10 | 1063,440,384 | -HS- | M] () -- C:\hiberfil.sys

[2008.11.24 16:45:12 | 000,000,000 | RHS- | M] () -- C:\IO.SYS

[2008.11.24 16:45:12 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS

[2008.04.14 09:00:00 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM

[2008.04.14 09:00:00 | 000,250,048 | RHS- | M] () -- C:\ntldr

[2011.08.21 18:02:08 | 1598,029,824 | -HS- | M] () -- C:\pagefile.sys

< %USERPROFILE%\*.* >

[2011.08.21 18:14:30 | 008,650,752 | -H-- | M] () -- C:\Documents and Settings\iva\NTUSER.DAT

[2011.08.21 18:24:12 | 000,001,024 | -H-- | M] () -- C:\Documents and Settings\iva\ntuser.dat.LOG

[2011.08.21 18:01:19 | 000,000,278 | -HS- | M] () -- C:\Documents and Settings\iva\ntuser.ini

< %USERPROFILE%\Application Data\*.* >

[2010.10.07 14:45:03 | 008,332,900 | ---- | M] () -- C:\Documents and Settings\iva\Application Data\bppenu11.log

[2008.11.26 13:50:12 | 000,000,062 | -HS- | M] () -- C:\Documents and Settings\iva\Application Data\desktop.ini

< %USERPROFILE%\Local Settings\Application Data\*.* >

[2011.08.18 22:17:35 | 000,073,728 | ---- | M] () -- C:\Documents and Settings\iva\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2009.12.09 12:06:31 | 000,000,126 | ---- | M] () -- C:\Documents and Settings\iva\Local Settings\Application Data\fusioncache.dat

[2009.12.23 11:30:21 | 000,083,440 | ---- | M] () -- C:\Documents and Settings\iva\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

[2008.11.26 18:25:11 | 006,411,466 | -H-- | M] () -- C:\Documents and Settings\iva\Local Settings\Application Data\IconCache.db

< %AllUsersProfile%\*.* >

< %AllUsersProfile%\Application Data\*.* >

[2008.11.26 13:50:12 | 000,000,062 | -HS- | M] () -- C:\Documents and Settings\All Users\Application Data\desktop.ini

[2009.12.09 12:07:19 | 000,000,699 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\hpzinstall.log

< %USERPROFILE%\My Documents\*.* >

[2008.11.26 12:17:22 | 000,000,074 | -HS- | M] () -- C:\Documents and Settings\iva\My Documents\desktop.ini

[2011.08.12 17:02:04 | 000,042,496 | -HS- | M] () -- C:\Documents and Settings\iva\My Documents\Thumbs.db

< %CommonProgramFiles%\*.* >

< %PROGRAMFILES%\*.* >

< %systemroot%\system32\*.dll /lockedfiles >

[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /90 >

[2011.08.21 18:04:05 | 000,023,624 | ---- | M] () -- C:\WINDOWS\system32\drivers\hitmanpro35.sys

[2011.07.15 14:29:31 | 000,456,320 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\drivers\mrxsmb.sys

[2011.07.08 15:02:00 | 000,010,496 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\drivers\ndistapi.sys

[2011.06.24 15:10:36 | 000,139,656 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\drivers\rdpwd.sys

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\system32\Spool\prtprocs\w32x86\*.dll >

[2008.07.06 13:06:10 | 000,089,088 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\Spool\prtprocs\w32x86\filterpipelineprintproc.dll

[2007.01.25 12:24:04 | 000,286,208 | ---- | M] (Hewlett-Packard Corporation) -- C:\WINDOWS\system32\Spool\prtprocs\w32x86\hpzpp4wm.DLL

[2003.06.18 14:01:48 | 000,018,944 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\Spool\prtprocs\w32x86\mdippr.dll

[2006.10.26 18:56:12 | 000,033,104 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\Spool\prtprocs\w32x86\msonpppr.dll

< MD5 for: EXPLORER.EXE >

[2008.04.14 09:00:00 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS\explorer.exe

[2008.04.14 09:00:00 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS\system32\dllcache\explorer.exe

< MD5 for: USERINIT.EXE >

[2008.04.14 09:00:00 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 -- C:\WINDOWS\system32\dllcache\userinit.exe

[2008.04.14 09:00:00 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 -- C:\WINDOWS\system32\userinit.exe

< MD5 for: VOLSNAP.SYS >

[2008.04.14 09:00:00 | 000,052,352 | ---- | M] (Microsoft Corporation) MD5=4C8FCB5CC53AAB716D810740FE59D025 -- C:\WINDOWS\system32\dllcache\volsnap.sys

[2008.04.14 09:00:00 | 000,052,352 | ---- | M] (Microsoft Corporation) MD5=4C8FCB5CC53AAB716D810740FE59D025 -- C:\WINDOWS\system32\drivers\volsnap.sys

< MD5 for: WINLOGON.EXE >

[2008.04.14 09:00:00 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E -- C:\WINDOWS\system32\dllcache\winlogon.exe

[2008.04.14 09:00:00 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E -- C:\WINDOWS\system32\winlogon.exe

========== Alternate Data Streams ==========

@Alternate Data Stream - 816 bytes -> C:\WINDOWS\970284104:3080923846.exe

@Alternate Data Stream - 171 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2

@Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:CB0AACC9

< End of report >

Стартирайте отново OTL, копирайте (Copy) и поставете (Paste) скриптовия текст от текстовото поле по-долу под колонката Custom Scans/Fixes, като не забравяте да копирате скрипта 1 към 1, както и двете точки преди първия ред на скрипта.

:OTL
SRV - File not found [Disabled | Stopped] -- -- (HidServ)
SRV - File not found [Auto | Stopped] -- -- (AntiVirService)
SRV - File not found [Auto | Stopped] -- -- (AntiVirSchedulerService)
SRV - File not found [Auto | Stopped] -- -- (AcrSch2Svc)
SRV - File not found [Auto | Stopped] -- -- (AcronisAgent)
O2 - BHO: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\Program Files\Windows Searchqu Toolbar\ToolBar\searchqudtx.dll ()
O2 - BHO: (no name) - {f92a9fe4-2850-4198-b9d5-279880e49b16} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\Program Files\Windows Searchqu Toolbar\ToolBar\searchqudtx.dll ()
O3 - HKLM\..\Toolbar: (no name) - {f92a9fe4-2850-4198-b9d5-279880e49b16} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Acronis Scheduler2 Service] File not found
O4 - HKLM..\Run: [avgnt] File not found
O4 - HKLM..\Run: [tray_ico] File not found
O4 - HKLM..\Run: [tray_ico1] File not found
O4 - HKLM..\Run: [tray_ico2] File not found
O4 - HKLM..\Run: [tray_ico3] File not found
O4 - HKLM..\Run: [tray_ico4] File not found
O4 - HKLM..\Run: [wxpdrv] File not found
O4 - HKU\.DEFAULT..\RunOnce: [nltide_2] File not found
O4 - HKU\S-1-5-18..\RunOnce: [nltide_2] File not found
O4 - HKU\S-1-5-19..\RunOnce: [nltide_2] File not found
O4 - HKU\S-1-5-20..\RunOnce: [nltide_2] File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - File not found
O31 - SafeBoot: AlternateShell - services32.exe
O33 - MountPoints2\{9fc37982-e3f2-11de-9486-00197d5c5c28}\Shell\AutoRun\command - "" = H:\hbcd\wintools\autorun.exe
O33 - MountPoints2\{9fc37982-e3f2-11de-9486-00197d5c5c28}\Shell\Option1\Command - "" = H:\hbcd\wintools\autorun.exe
MsConfig - StartUpReg: KernelFaultCheck - hkey= - key= - File not found
[2011.08.21 18:02:13 | 000,000,000 | ---- | C] () -- C:\WINDOWS\970284104
@Alternate Data Stream - 816 bytes -> C:\WINDOWS\970284104:3080923846.exe
@Alternate Data Stream - 171 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2
@Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:CB0AACC9
:Reg

:files

autorun.inf /alldrives
autorun.exe /alldrives
recycler /alldrives
netsh winsock reset catalog /c
ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
[resethosts]
[clearallrestorepoints]
[emptyflash]
[Reboot]

След като въведете скрипта от цитата по-горе натиснете бутона, маркиран в червено: Run Fix

Windows ще се рестартира и ще се създаде лог файл. Публикувайте съдържанието му с Copy/Paste в следващия си коментар.

Пак не иска да се рестартира. Този път прозореца на програмата изчезна, като че си свърши работата, но вече 7-8 минути само картинката на десктопа ми се вижда и нищо не се случва. Изкарах task manager-a чрез клавишната комбинация... няма активни програми. Процесора е на 1%

Рестартирай компютъра и търсете дневник в C:\_OTL\MovedFiles..!

При рестарта ми се появи съобщение: svchost exe - aplication error "the instruction at 0x7d4caa9b" referenced memory at 0x00000010. the memory could not be "read". Click on ok to terminate the program or cancel to debug the program" Какво да направя?

Редактирано 21 август 201115 г. от ADimitrov (преглед на промените)

Маркирай с ОК..!