утре смятам сериозно да се ограмотя що е то redbook и има ли почва у нас

Мисля че вече знаем що е то "червена книга" : http://www.file.net/process/redbook.sys.html

Очаквам инструкции за по-нататъчна работа, че дане изпреварвам пак събитията

Още веднъж се извинявам, че след като се обърнах за помощ продължих да "почиствам" на своя глава.

Няма проблеми, просто съм на бачкане и се забавих.

Да направим няколко финални проверки:

СТЪПКА 1

Моля, изтеглете aswMBR и го запазете на вашия десктоп.

• Кликнете с двоен клин на мишката върху файла aswMBR.exe за да го стартирате.
• Изчакайте да изтегли дефинициите на avast!
• От падащото меню посочете дял C:\ както е на снимката:

• Изберете Scan бутона, за да започне проверката.
• Когато проверката завърши, натиснете бутона save log, запазете съдържанието на лог файла на десктопа и публикувайте съдържанието му в следващия си коментар.

СТЪПКА 2

• Изтеглете maxlook.exe и го запазете на вашия десктоп.
• Стартирайте файла само веднъж.
• Рестартирайте компютъра в Recovery Console (Combofix трябва да е добавил тази опция при рестарт) и въведете командата batch look.bat

  

• Напишете EXIT и рестартирайте в Normal Mode
• Сега отворете Start => Run => и въведете командата => maxlook -sig и натиснете Enter
• Ще се появи текстов файл на десктопа с името looklog.txt
• Копирайте съдържанието му в следващия си пост

СТЪПКА 3

Направете една проверка с antizeroaccess и публикувайте лог файла.

СТЪПКА 4

• Изтеглете OTL.exe и го запазете на десктопа.
• Стартирайте файла с двукратен клик на мишката.
• Сложете отметка пред Scan All Users
• Под менюто File Age => изберете 90 days
• Под менюто Standard Registry => променете на ALL
• Сложете отметки пред LOP и Purity Check

• Под с Copy/ Paste въведете следната текстова информация:

 
 
 
netsvcs
msconfig
safebootminimal
safebootnetwork
%SYSTEMDRIVE%\*.*
%USERPROFILE%\*.*
%USERPROFILE%\Application Data\*.*
%USERPROFILE%\Local Settings\Application Data\*.*
%AllUsersProfile%\*.*
%AllUsersProfile%\Application Data\*.*
%USERPROFILE%\My Documents\*.*
%CommonProgramFiles%\*.*
%PROGRAMFILES%\*.*
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\system32\drivers\*.sys /90
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\system32\Spool\prtprocs\w32x86\*.dll
%systemroot%\*. /mp /s
/md5start
mswsock.dll
/md5stop

• Натиснете маркираният в синьо бутон: .
• Като приключи проверката, ще се създадат два файла - OTL.Txt и Extras.Txt.
• Публикувайте съдържанието на лог файловете в следващия си коментар.

ето първия лог:

aswMBR version 0.9.8.977 Copyright© 2011 AVAST Software

Run date: 2011-09-20 21:21:28

-----------------------------

21:21:28.937 OS Version: Windows 5.1.2600 Service Pack 3

21:21:28.937 Number of processors: 2 586 0x170A

21:21:28.937 ComputerName: ORGANIZA-9A7154 UserName: user

21:21:29.265 Initialize success

21:23:15.953 AVAST engine defs: 11092000

21:23:30.046 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3

21:23:30.062 Disk 0 Vendor: ST9250315AS 0002SDM1 Size: 238475MB BusType: 3

21:23:30.062 Disk 0 MBR read successfully

21:23:30.062 Disk 0 MBR scan

21:23:30.109 Disk 0 Windows XP default MBR code

21:23:30.109 Disk 0 scanning sectors +488376000

21:23:30.187 Disk 0 scanning C:\WINDOWS\system32\drivers

21:23:44.296 Service scanning

21:23:44.515 Service ASUSProcObsrv E:\I386\AsProcOb.sys **LOCKED** 21

21:23:44.625 Service sptd C:\WINDOWS\System32\Drivers\sptd.sys **LOCKED** 32

21:23:45.156 Modules scanning

21:23:49.203 Disk 0 trace - called modules:

21:23:49.218 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys spku.sys >>UNKNOWN [0x8a4c1938]<<

21:23:49.218 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8a41cab8]

21:23:49.218 3 CLASSPNP.SYS[ba0e8fd7] -> nt!IofCallDriver -> \Device\00000071[0x8a4373b8]

21:23:49.218 5 ACPI.sys[b9e74620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x8a41ed98]

21:23:49.515 AVAST engine scan C:\

22:09:30.562 Scan finished successfully

22:13:28.234 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\user\Desktop\Нова папка\MBR.dat"

22:13:28.234 The log file has been saved successfully to "C:\Documents and Settings\user\Desktop\Нова папка\aswMBR.txt"

продължаваме нататък

следващия:

Run from C:\Documents and Settings\user\Desktop\maxlook.exe on 20.09.2011 Ј. at 22:20:34,50
--------- maxlook unsigned files ---------
c:\windows\maxdrive\imagedrv.sys:
 Verified: Unsigned
 File date: 11:03 01.9.2005 ?.
 Publisher: Ahead Software AG
 Description: NERO IMAGEDRIVE SCSI miniport
 Product: Nero ImageDrive
 Version: 2.29.0.0
 File version: 2.29.0.0 built by: WinDDK
c:\windows\maxdrive\imagesrv.sys:
 Verified: Unsigned
 File date: 11:03 01.9.2005 ?.
 Publisher: Ahead Software AG
 Description: Nero Image Server
 Product: Nero ImageDrive
 Version: 2.29.0.0
 File version: 2.29.0.0 built by: WinDDK
c:\windows\maxdrive\PxHelp20.sys:
 Verified: Unsigned
 File date: 00:28 12.3.2005 ?.
 Publisher: Sonic Solutions
 Description: Px Engine Device Driver for Windows 2000/XP
 Product: PxHelp20
 Version: n/a
 File version: 2.03.28a
--------- system32\drivers unsigned files ---------
c:\windows\system32\drivers\imagedrv.sys:
 Verified: Unsigned
 File date: 11:03 01.9.2005 ?.
 Publisher: Ahead Software AG
 Description: NERO IMAGEDRIVE SCSI miniport
 Product: Nero ImageDrive
 Version: 2.29.0.0
 File version: 2.29.0.0 built by: WinDDK
c:\windows\system32\drivers\imagesrv.sys:
 Verified: Unsigned
 File date: 11:03 01.9.2005 ?.
 Publisher: Ahead Software AG
 Description: Nero Image Server
 Product: Nero ImageDrive
 Version: 2.29.0.0
 File version: 2.29.0.0 built by: WinDDK
c:\windows\system32\drivers\PxHelp20.sys:
 Verified: Unsigned
 File date: 00:28 12.3.2005 ?.
 Publisher: Sonic Solutions
 Description: Px Engine Device Driver for Windows 2000/XP
 Product: PxHelp20
 Version: n/a
 File version: 2.03.28a
c:\windows\system32\drivers\sptd.sys:
 Verified: Error accessing file
 Publisher: n/a
 Description: n/a
 Product: n/a
 Version: n/a
 File version: n/a

третия:

Webroot AntiZeroAccess 0.8 Log File

Execution time: 20/09/2011 - 22:25

Host operation System: Windows Xp X86 version 5.1.2600 Service Pack 3

22:25:18 - CheckSystem - Begin to check system...

22:25:18 - OpenRootDrive - Opening system root volume and physical drive....

22:25:18 - C Root Drive: Disk number: 0 Start sector: 0x0000003F Partition Size: 0x04E3A533 sectors.

22:25:18 - PrevX Main driver extracted in "C:\WINDOWS\system32\drivers\ZeroAccess.sys".

22:25:19 - InstallAndStartDriver - Main driver was installed and now is running.

22:25:19 - CheckSystem - Disk class driver state is OK.

22:25:21 - CheckFile - Unable to read "sptd.sys" file. CreateFile last eror: 0x00000020.

22:25:22 - StopAndRemoveDriver - AntiZeroAccess Driver is stopped and removed.

22:25:22 - StopAndRemoveDriver - File "ZeroAccess.sys" was deleted!

22:25:22 - Execution Ended!

и последните:

OTL logfile created on: 20.9.2011 г. 22:28:52 - Run 1

OTL by OldTimer - Version 3.2.29.1 Folder = C:\Documents and Settings\user\Desktop

Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale: 00000402 | Country: Bulgaria | Language: BGR | Date Format: dd.M.yyyy 'г.'

2,97 Gb Total Physical Memory | 2,41 Gb Available Physical Memory | 81,20% Memory free

4,81 Gb Paging File | 4,40 Gb Available in Paging File | 91,63% Paging File free

Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 39,11 Gb Total Space | 24,42 Gb Free Space | 62,44% Space Free | Partition Type: NTFS

Drive D: | 193,76 Gb Total Space | 91,31 Gb Free Space | 47,12% Space Free | Partition Type: NTFS

Computer Name: ORGANIZA-9A7154 | User Name: user | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 90 Days

========== Processes (SafeList) ==========

PRC - [2011.09.20 22:27:39 | 000,582,656 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\user\Desktop\OTL.exe

PRC - [2011.09.17 00:13:26 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe

PRC - [2011.04.21 07:54:05 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

PRC - [2011.04.21 07:53:48 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe

PRC - [2011.04.21 07:53:33 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

PRC - [2009.08.17 09:58:46 | 006,859,392 | ---- | M] (ASUS) -- C:\Program Files\ASUS\ATKOSD2\ATKOSD2.exe

PRC - [2009.08.12 14:20:46 | 000,178,816 | ---- | M] (ASUS) -- C:\Program Files\ASUS\ATK Hotkey\HControl.exe

PRC - [2009.07.23 10:30:06 | 000,544,768 | ---- | M] (ATK) -- C:\Program Files\ASUS\Splendid\ACMON.exe

PRC - [2009.06.19 10:29:42 | 000,105,016 | ---- | M] (ASUS) -- C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe

PRC - [2009.06.19 10:29:26 | 002,488,888 | ---- | M] (ASUS) -- C:\Program Files\ASUS\ATK Hotkey\ATKOSD.exe

PRC - [2008.12.22 17:15:34 | 000,174,648 | ---- | M] (ASUS) -- C:\Program Files\ASUS\ATK Hotkey\WDC.exe

PRC - [2008.04.14 05:42:20 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe

PRC - [2006.07.26 18:01:06 | 000,090,112 | ---- | M] (ASUSTeK Computer Inc.) -- C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe

PRC - [2005.07.06 15:43:42 | 000,155,648 | ---- | M] (ASUSTeK) -- C:\WINDOWS\system32\ACEngSvr.exe

========== Modules (No Company Name) ==========

MOD - [2011.07.20 16:40:24 | 000,355,688 | ---- | M] () -- C:\Program Files\Avira\AntiVir Desktop\sqlite3.dll

MOD - [2009.06.19 10:29:24 | 000,170,552 | ---- | M] () -- C:\Program Files\ASUS\ATK Hotkey\ASUSNet.dll

MOD - [2008.09.30 23:02:44 | 000,009,216 | ---- | M] () -- C:\Program Files\ASUS\Splendid\GLCDdll.dll

========== Win32 Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] -- -- (HidServ)

SRV - [2011.09.17 00:13:26 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2011.04.21 07:53:48 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

========== Driver Services (SafeList) ==========

DRV - [2011.09.17 00:13:27 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)

DRV - [2011.09.17 00:13:27 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)

DRV - [2010.06.17 15:27:22 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)

DRV - [2010.06.17 15:27:12 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Program Files\Avira\AntiVir Desktop\avgio.sys -- (avgio)

DRV - [2010.01.23 13:58:40 | 000,691,696 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd)

DRV - [2010.01.23 13:15:29 | 000,007,680 | ---- | M] (ATK0100) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ATKACPI.sys -- (MTsensor)

DRV - [2009.08.21 14:48:12 | 000,027,136 | ---- | M] (Alcor Micro, Corp.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\AmUStor.sys -- (AmUStor)

DRV - [2009.06.05 18:14:40 | 001,766,592 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\snp2uvc.sys -- (SNP2UVC) USB2.0 PC Camera (SNP2UVC)

DRV - [2009.03.20 14:21:28 | 001,057,280 | ---- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\viahduaa.sys -- (VIAHdAudAddService)

DRV - [2009.02.13 18:00:02 | 001,503,840 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\athw.sys -- (AR5416)

DRV - [2008.12.16 14:12:48 | 000,038,400 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\l1e51x86.sys -- (L1e)

DRV - [2008.02.14 14:12:00 | 001,389,056 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\monfilt.sys -- (monfilt)

DRV - [2004.05.27 18:13:04 | 000,016,269 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Running] -- C:\Program Files\ASUS\ATK Hotkey\ASNDIS5.SYS -- (ASNDIS5)

========== Standard Registry (All) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm

IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank

IE - HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank

IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-484763869-1450960922-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm

IE - HKU\S-1-5-21-484763869-1450960922-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1

IE - HKU\S-1-5-21-484763869-1450960922-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

IE - HKU\S-1-5-21-484763869-1450960922-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.bg/

IE - HKU\S-1-5-21-484763869-1450960922-839522115-1003\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\WINDOWS\system32\ieframe.dll (Microsoft Corporation)

IE - HKU\S-1-5-21-484763869-1450960922-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\Software\MozillaPlugins\@bittorrent.com/BitTorrentDNA: C:\Program Files\DNA\plugins\npbtdna.dll (BitTorrent, Inc.)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=12.0.1.647: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)

FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=12.0.1.647: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)

FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=12.0.1.647: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)

FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=12.0.1.647: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)

FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=12.0.1.647: C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)

FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found

FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Documents and Settings\user\Local Settings\Application Data\Google\Update\1.3.21.69\npGoogleUpdate3.dll (Google Inc.)

FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Documents and Settings\user\Local Settings\Application Data\Google\Update\1.3.21.69\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{20a82645-c095-46ed-80e3-08825760534b}: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [2010.01.25 01:06:12 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011.05.03 21:24:47 | 000,000,000 | ---D | M]

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)

CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}sourceid=chrome&ie={inputEncoding}&q={searchTerms}

CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms}

CHR - Extension: RealPlayer HTML5Video Downloader Extension = C:\Documents and Settings\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk\1.4_0\

O1 HOSTS File: ([2011.09.20 00:02:07 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1 localhost

O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)

O2 - BHO: (BitComet Helper) - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.4.1.10.dll (BitComet)

O2 - BHO: (no name) - AutorunsDisabled - No CLSID value found.

O3 - HKLM\..\Toolbar: (&Google) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)

O3 - HKU\S-1-5-21-484763869-1450960922-839522115-1003\..\Toolbar\ShellBrowser: (&Address) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)

O3 - HKU\S-1-5-21-484763869-1450960922-839522115-1003\..\Toolbar\WebBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)

O3 - HKU\S-1-5-21-484763869-1450960922-839522115-1003\..\Toolbar\WebBrowser: (Live TV Toolbar) - {B69A9DB4-D0A1-4722-B56B-F20757A29CDF} - C:\Program Files\Live_TV\tbLive.dll File not found

O3 - HKU\S-1-5-21-484763869-1450960922-839522115-1003\..\Toolbar\WebBrowser: (&Links) - {F2CF5485-4E02-4F68-819C-B92DE9277049} - C:\WINDOWS\system32\ieframe.dll (Microsoft Corporation)

O4 - HKLM..\Run: [ACMON] C:\Program Files\ASUS\Splendid\ACMON.exe (ATK)

O4 - HKLM..\Run: [ATKHOTKEY] C:\Program Files\ASUS\ATK Hotkey\HControl.exe (ASUS)

O4 - HKLM..\Run: [ATKOSD2] C:\Program Files\ASUS\ATKOSD2\ATKOSD2.exe (ASUS)

O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

O4 - HKLM..\Run: [HControlUser] C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe (ASUS)

O4 - HKLM..\Run: [HDAudDeck] C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe (VIA Technologies, Inc.)

O4 - HKLM..\Run: [Power_Gear] C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe (ASUSTeK Computer Inc.)

O4 - HKU\S-1-5-21-484763869-1450960922-839522115-1003..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (Microsoft Corporation)

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0

O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-21-484763869-1450960922-839522115-1003\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-21-484763869-1450960922-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O7 - HKU\S-1-5-21-484763869-1450960922-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O7 - HKU\S-1-5-21-484763869-1450960922-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)

O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [] - C:\WINDOWS\system32\winrnr.dll (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [] - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{153192EE-C0B7-4CB3-9276-56CEB781F1F8}: DhcpNameServer = 192.168.100.1

O18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)

O18 - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\WINDOWS\system32\msvidctl.dll (Microsoft Corporation)

O18 - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\gopher {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\ipp - No CLSID value found

O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll (Microsoft Corporation)

O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)

O18 - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)

O18 - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\WINDOWS\system32\inetcomm.dll (Microsoft Corporation)

O18 - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp - No CLSID value found

O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll (Microsoft Corporation)

O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)

O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)

O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)

O18 - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)

O18 - Protocol\Handler\sysimage {76E67A63-06E9-11D2-A840-006008059382} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)

O18 - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\WINDOWS\system32\msvidctl.dll (Microsoft Corporation)

O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)

O18 - Protocol\Handler\wia {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINDOWS\system32\wiascr.dll (Microsoft Corporation)

O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\System32\mscoree.dll (Microsoft Corporation)

O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\System32\mscoree.dll (Microsoft Corporation)

O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\System32\mscoree.dll (Microsoft Corporation)

O18 - Protocol\Filter\Class Install Handler {32B533BB-EDAE-11d0-BD5A-00AA00B92AF1} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Filter\deflate {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Filter\gzip {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Filter\lzdhtml {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Filter\text/webviewhtml {733AC4CB-F1A4-11d0-B951-00A0C90312E1} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)

O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UIHost - (logonui.exe) -C:\WINDOWS\System32\logonui.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (rundll32 shell32) -C:\WINDOWS\System32\shell32.dll (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (Control_RunDLL "sysdm.cpl") -C:\WINDOWS\System32\sysdm.cpl (Microsoft Corporation)

O20 - Winlogon\Notify\crypt32chain: DllName - (crypt32.dll) - C:\WINDOWS\System32\crypt32.dll (Microsoft Corporation)

O20 - Winlogon\Notify\cryptnet: DllName - (cryptnet.dll) - C:\WINDOWS\System32\cryptnet.dll (Microsoft Corporation)

O20 - Winlogon\Notify\cscdll: DllName - (cscdll.dll) - C:\WINDOWS\System32\cscdll.dll (Microsoft Corporation)

O20 - Winlogon\Notify\dimsntfy: DllName - (%SystemRoot%\System32\dimsntfy.dll) - C:\WINDOWS\system32\dimsntfy.dll (Microsoft Corporation)

O20 - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)

O20 - Winlogon\Notify\ScCertProp: DllName - (wlnotify.dll) - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)

O20 - Winlogon\Notify\Schedule: DllName - (wlnotify.dll) - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)

O20 - Winlogon\Notify\sclgntfy: DllName - (sclgntfy.dll) - C:\WINDOWS\System32\sclgntfy.dll (Microsoft Corporation)

O20 - Winlogon\Notify\SensLogn: DllName - (WlNotify.dll) - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)

O20 - Winlogon\Notify\termsrv: DllName - (wlnotify.dll) - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)

O20 - Winlogon\Notify\wlballoon: DllName - (wlnotify.dll) - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)

O21 - SSODL: CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)

O21 - SSODL: PostBootReminder - {7849596a-48ea-486e-8937-a2a3009f31a9} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)

O21 - SSODL: SysTray - {35CEC8A3-2BE6-11D2-8773-92E220524153} - C:\WINDOWS\system32\stobject.dll (Microsoft Corporation)

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\WINDOWS\system32\webcheck.dll (Microsoft Corporation)

O22 - SharedTaskScheduler: {438755C2-A8BA-11D1-B96B-00A0C90312E1} - Browseui preloader - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)

O22 - SharedTaskScheduler: {8C7461EF-2B13-11d2-BE35-3078302C2030} - Component Categories cache daemon - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)

O24 - Desktop Components:0 (My Current Home Page) - About:Home

O24 - Desktop WallPaper: C:\Documents and Settings\user\Local Settings\Application Data\Microsoft\Wallpaper1.bmp

O24 - Desktop BackupWallPaper: C:\Documents and Settings\user\Local Settings\Application Data\Microsoft\Wallpaper1.bmp

O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - C:\WINDOWS\System32\shell32.dll (Microsoft Corporation)

O29 - HKLM SecurityProviders - (msapsspc.dll) -C:\WINDOWS\System32\msapsspc.dll (Microsoft Corporation)

O29 - HKLM SecurityProviders - (schannel.dll) -C:\WINDOWS\System32\schannel.dll (Microsoft Corporation)

O29 - HKLM SecurityProviders - (digest.dll) -C:\WINDOWS\System32\digest.dll (Microsoft Corporation)

O29 - HKLM SecurityProviders - (msnsspc.dll) -C:\WINDOWS\System32\msnsspc.dll (Microsoft Corporation)

O30 - LSA: Authentication Packages - (msv1_0) -C:\WINDOWS\System32\msv1_0.dll (Microsoft Corporation)

O30 - LSA: Security Packages - (kerberos) -C:\WINDOWS\System32\kerberos.dll (Microsoft Corporation)

O30 - LSA: Security Packages - (msv1_0) -C:\WINDOWS\System32\msv1_0.dll (Microsoft Corporation)

O30 - LSA: Security Packages - (schannel) -C:\WINDOWS\System32\schannel.dll (Microsoft Corporation)

O30 - LSA: Security Packages - (wdigest) -C:\WINDOWS\System32\wdigest.dll (Microsoft Corporation)

O31 - SafeBoot: AlternateShell - cmd.exe

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2010.01.23 01:49:04 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = ComFile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found

NetSvcs: HidServ - File not found

NetSvcs: Ias - File not found

NetSvcs: Iprip - File not found

NetSvcs: Irmon - File not found

NetSvcs: NWCWorkstation - File not found

NetSvcs: Nwsapagent - File not found

NetSvcs: WmdmPmSp - File not found

MsConfig - Services: "rpcnet"

MsConfig - Services: "ose"

MsConfig - Services: "MDM"

MsConfig - Services: "idsvc"

MsConfig - StartUpReg: AmIcoSinglun - hkey= - key= - C:\Program Files\AmIcoSingLun\AmIcoSinglun.exe (AlcorMicro Co., Ltd.)

MsConfig - StartUpReg: avgnt - hkey= - key= - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

MsConfig - StartUpReg: ctfmon.exe - hkey= - key= - File not found

MsConfig - StartUpReg: Google Update - hkey= - key= - C:\Documents and Settings\user\Local Settings\Application Data\Google\Update\GoogleUpdate.exe (Google Inc.)

MsConfig - StartUpReg: HotKeysCmds - hkey= - key= - File not found

MsConfig - StartUpReg: KernelFaultCheck - hkey= - key= - File not found

MsConfig - StartUpReg: MSMSGS - hkey= - key= - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)

MsConfig - StartUpReg: NeroFilterCheck - hkey= - key= - File not found

MsConfig - StartUpReg: TkBellExe - hkey= - key= - C:\Program Files\Real\RealPlayer\update\realsched.exe (RealNetworks, Inc.)

MsConfig - State: "system.ini" - 0

MsConfig - State: "win.ini" - 0

MsConfig - State: "bootini" - 0

MsConfig - State: "services" - 2

MsConfig - State: "startup" - 2

SafeBootMin: Base - Driver Group

SafeBootMin: Boot Bus Extender - Driver Group

SafeBootMin: Boot file system - Driver Group

SafeBootMin: File system - Driver Group

SafeBootMin: Filter - Driver Group

SafeBootMin: PCI Configuration - Driver Group

SafeBootMin: PNP Filter - Driver Group

SafeBootMin: Primary disk - Driver Group

SafeBootMin: SCSI Class - Driver Group

SafeBootMin: sermouse.sys - Driver

SafeBootMin: System Bus Extender - Driver Group

SafeBootMin: vds - Service

SafeBootMin: vga.sys - Driver

SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: Base - Driver Group

SafeBootNet: Boot Bus Extender - Driver Group

SafeBootNet: Boot file system - Driver Group

SafeBootNet: File system - Driver Group

SafeBootNet: Filter - Driver Group

SafeBootNet: NDIS Wrapper - Driver Group

SafeBootNet: NetBIOSGroup - Driver Group

SafeBootNet: NetDDEGroup - Driver Group

SafeBootNet: Network - Driver Group

SafeBootNet: NetworkProvider - Driver Group

SafeBootNet: PCI Configuration - Driver Group

SafeBootNet: PNP Filter - Driver Group

SafeBootNet: PNP_TDI - Driver Group

SafeBootNet: Primary disk - Driver Group

SafeBootNet: SCSI Class - Driver Group

SafeBootNet: sermouse.sys - Driver

SafeBootNet: Streams Drivers - Driver Group

SafeBootNet: System Bus Extender - Driver Group

SafeBootNet: TDI - Driver Group

SafeBootNet: vga.sys - Driver

SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

========== Files/Folders - Created Within 90 Days ==========

[2011.09.20 22:27:14 | 000,582,656 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\user\Desktop\OTL.exe

[2011.09.20 22:25:06 | 000,167,864 | ---- | C] (Webroot) -- C:\Documents and Settings\user\Desktop\antizeroaccess.exe

[2011.09.20 22:20:34 | 000,220,024 | ---- | C] (Sysinternals - www.sysinternals.com) -- C:\WINDOWS\sigcheck.exe

[2011.09.20 22:16:41 | 000,000,000 | ---D | C] -- C:\WINDOWS\maxdrive

[2011.09.20 21:17:50 | 000,000,000 | -HSD | C] -- C:\RECYCLER

[2011.09.20 00:27:11 | 000,150,392 | ---- | C] (Sysinternals - www.sysinternals.com) -- C:\WINDOWS\junction.exe

[2011.09.20 00:26:07 | 000,150,392 | ---- | C] (Sysinternals - www.sysinternals.com) -- C:\Documents and Settings\user\Desktop\junction.exe

[2011.09.20 00:05:14 | 000,000,000 | ---D | C] -- C:\WINDOWS\temp

[2011.09.19 23:57:03 | 000,000,000 | ---D | C] -- C:\ComboFix

[2011.09.19 23:24:51 | 000,000,000 | RHSD | C] -- C:\cmdcons

[2011.09.19 23:23:04 | 000,518,144 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe

[2011.09.19 23:23:04 | 000,406,528 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe

[2011.09.19 23:23:04 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe

[2011.09.19 23:23:04 | 000,060,416 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe

[2011.09.19 23:22:55 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT

[2011.09.19 23:22:49 | 000,000,000 | ---D | C] -- C:\Qoobox

[2011.09.19 23:21:54 | 004,218,334 | R--- | C] (Swearware) -- C:\Documents and Settings\user\Desktop\ComboFix.exe

[2011.09.19 21:24:22 | 000,000,000 | ---D | C] -- C:\Program Files\ESET

[2011.09.19 19:43:01 | 000,000,000 | R--D | C] -- C:\Documents and Settings\user\Start Menu\Programs\Administrative Tools

[2011.09.19 19:42:56 | 000,607,260 | R--- | C] (Swearware) -- C:\Documents and Settings\user\Desktop\dds.scr

[2011.09.18 17:16:10 | 000,404,640 | ---- | C] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl

[2011.09.16 21:02:26 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\NtmsData

[2011.09.16 20:44:18 | 000,000,000 | ---D | C] -- C:\Documents and Settings\user\Desktop\Нова папка

[2011.09.16 20:37:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\user\Application Data\Avira

[2011.09.16 20:23:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Avira

[2011.09.16 20:22:53 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\ssmdrv.sys

[2011.09.16 20:22:51 | 000,138,192 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avipbb.sys

[2011.09.16 20:22:51 | 000,066,616 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntflt.sys

[2011.09.16 20:22:51 | 000,045,416 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntdd.sys

[2011.09.16 20:22:51 | 000,022,360 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntmgr.sys

[2011.09.16 20:22:49 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Avira

[2011.09.16 08:09:26 | 000,022,216 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys

[2011.09.16 07:49:11 | 000,000,000 | -HSD | C] -- C:\System Volume Information

[2011.09.15 22:26:43 | 000,000,000 | ---D | C] -- C:\!KillBox

[2011.09.15 20:11:58 | 000,000,000 | -H-D | C] -- C:\WINDOWS\PIF

[2011.09.14 20:20:58 | 000,000,000 | ---D | C] -- C:\Documents and Settings\user\Application Data\Malwarebytes

[2011.09.14 20:20:53 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware

[2011.09.14 20:20:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes

[2011.09.14 20:20:49 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware

[2011.09.14 20:06:54 | 000,000,000 | -HSD | C] -- C:\WINDOWS\CSC

[2011.09.03 12:17:37 | 000,599,040 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\crypt32.dll

[2011.09.01 17:56:22 | 000,000,000 | ---D | C] -- C:\Documents and Settings\user\Start Menu\Programs\Google Chrome

[2011.08.31 20:38:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\user\Desktop\snimki

[2011.08.26 19:22:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Skype

[2011.08.14 21:50:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\user\Application Data\Bandoo

[2011.08.14 21:50:30 | 000,000,000 | ---D | C] -- C:\Documents and Settings\user\Local Settings\Application Data\Ilivid Player

[2011.08.14 15:42:45 | 000,000,000 | ---D | C] -- C:\Program Files\FoxTabFLVPlayer

[2011.08.10 21:06:45 | 000,000,000 | ---D | C] -- C:\Documents and Settings\user\Application Data\BabylonToolbar

[2011.08.10 21:06:33 | 000,000,000 | ---D | C] -- C:\Documents and Settings\user\Local Settings\Application Data\Babylon

[2011.08.10 21:06:32 | 000,000,000 | ---D | C] -- C:\Documents and Settings\user\Start Menu\Programs\FoxTab FLV Player

[2011.08.10 21:06:32 | 000,000,000 | ---D | C] -- C:\Documents and Settings\user\Application Data\Babylon

[2011.08.10 21:06:32 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Babylon

[2011.08.10 21:00:22 | 000,000,000 | ---D | C] -- C:\Documents and Settings\user\AppData

[2011.08.10 21:00:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\user\Application Data\searchquband

[2011.08.10 20:55:29 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\boost_interprocess

[2011.08.10 20:54:47 | 000,000,000 | ---D | C] -- C:\Documents and Settings\user\Local Settings\Application Data\PackageAware

[2011.08.10 17:20:40 | 000,139,656 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\rdpwd.sys

[2011.08.10 17:19:14 | 000,010,496 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ndistapi.sys

[2011.07.26 19:23:58 | 000,105,472 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mup.sys

[2011.06.28 01:02:33 | 000,000,000 | ---D | C] -- C:\WINDOWS\Minidump

[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 90 Days ==========

[2011.09.20 22:27:39 | 000,582,656 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\user\Desktop\OTL.exe

[2011.09.20 22:25:28 | 000,498,166 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat

[2011.09.20 22:25:28 | 000,086,442 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat

[2011.09.20 22:25:12 | 000,167,864 | ---- | M] (Webroot) -- C:\Documents and Settings\user\Desktop\antizeroaccess.exe

[2011.09.20 22:21:33 | 000,000,276 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-484763869-1450960922-839522115-1003.job

[2011.09.20 22:21:28 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-484763869-1450960922-839522115-1003.job

[2011.09.20 22:19:52 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2011.09.20 22:16:46 | 000,011,820 | ---- | M] () -- C:\WINDOWS\look.bat

[2011.09.20 22:16:39 | 001,139,184 | ---- | M] () -- C:\Documents and Settings\user\Desktop\maxlook.exe

[2011.09.20 00:35:20 | 000,879,225 | ---- | M] () -- C:\Documents and Settings\user\Desktop\SecurityCheck.exe

[2011.09.20 00:26:02 | 000,079,623 | ---- | M] () -- C:\Documents and Settings\user\Desktop\Junction.zip

[2011.09.20 00:24:50 | 000,047,616 | ---- | M] () -- C:\Documents and Settings\user\Desktop\Win32kDiag.exe

[2011.09.20 00:02:07 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts

[2011.09.19 23:24:55 | 000,000,327 | RHS- | M] () -- C:\boot.ini

[2011.09.19 23:22:22 | 004,218,334 | R--- | M] (Swearware) -- C:\Documents and Settings\user\Desktop\ComboFix.exe

[2011.09.19 20:37:42 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl

[2011.09.19 19:43:01 | 000,607,260 | R--- | M] (Swearware) -- C:\Documents and Settings\user\Desktop\dds.scr

[2011.09.18 17:16:10 | 000,404,640 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl

[2011.09.18 17:04:58 | 000,000,849 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\HD ADeck.lnk

[2011.09.18 17:01:36 | 000,000,155 | ---- | M] () -- C:\WINDOWS\winamp.ini

[2011.09.18 16:57:09 | 000,000,211 | ---- | M] () -- C:\Boot.bak

[2011.09.18 10:32:08 | 000,002,265 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Skype.lnk

[2011.09.18 00:00:11 | 000,000,116 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini

[2011.09.17 00:13:27 | 000,138,192 | ---- | M] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avipbb.sys

[2011.09.17 00:13:27 | 000,066,616 | ---- | M] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntflt.sys

[2011.09.16 20:07:24 | 000,001,008 | -HS- | M] () -- C:\WINDOWS\setup_9.0.0.722_03.06.2011_10-50drv.spi

[2011.09.14 19:35:44 | 000,001,639 | ---- | M] () -- C:\Documents and Settings\user\Desktop\Avira AntiVir Personal Profile Local Drives.LNK

[2011.09.14 18:11:09 | 000,000,000 | -HS- | M] () -- C:\WINDOWS\{2521BB91-29B1-4d7e-9137-AC9875D77735}

[2011.09.13 20:27:27 | 000,149,504 | ---- | M] () -- C:\Documents and Settings\user\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2011.09.09 11:12:13 | 000,599,040 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\crypt32.dll

[2011.09.04 09:48:55 | 000,002,277 | ---- | M] () -- C:\Documents and Settings\user\Desktop\Google Chrome.lnk

[2011.09.04 09:48:55 | 000,002,255 | ---- | M] () -- C:\Documents and Settings\user\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk

[2011.08.31 17:00:50 | 000,022,216 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys

[2011.08.26 18:48:40 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK

[2011.08.14 15:42:45 | 000,000,738 | ---- | M] () -- C:\Documents and Settings\user\Desktop\FoxTab FLV Player.lnk

[2011.07.30 14:09:37 | 000,246,312 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT

[2011.07.25 17:17:44 | 005,969,920 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mshtml.dll

[2011.07.15 15:29:31 | 000,456,320 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mrxsmb.sys

[2011.07.08 16:02:00 | 000,010,496 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ndistapi.sys

[2011.06.26 08:45:56 | 000,256,000 | ---- | M] () -- C:\WINDOWS\PEV.exe

[2011.06.24 16:10:36 | 000,139,656 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\rdpwd.sys

[2011.06.23 20:36:30 | 001,991,680 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\iertutil.dll

[2011.06.23 20:36:30 | 001,469,440 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\inetcpl.cpl

[2011.06.23 20:36:30 | 001,469,440 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\inetcpl.cpl

[2011.06.23 20:36:30 | 001,212,416 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\urlmon.dll

[2011.06.23 20:36:30 | 000,916,480 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wininet.dll

[2011.06.23 20:36:30 | 000,611,840 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\mstime.dll

[2011.06.23 20:36:30 | 000,611,840 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mstime.dll

[2011.06.23 20:36:30 | 000,602,112 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\msfeeds.dll

[2011.06.23 20:36:30 | 000,602,112 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msfeeds.dll

[2011.06.23 20:36:30 | 000,206,848 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\occache.dll

[2011.06.23 20:36:30 | 000,184,320 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\iepeers.dll

[2011.06.23 20:36:30 | 000,184,320 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\iepeers.dll

[2011.06.23 20:36:30 | 000,105,984 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\url.dll

[2011.06.23 20:36:30 | 000,105,984 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\url.dll

[2011.06.23 20:36:30 | 000,066,560 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mshtmled.dll

[2011.06.23 20:36:30 | 000,055,296 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\msfeedsbs.dll

[2011.06.23 20:36:30 | 000,055,296 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msfeedsbs.dll

[2011.06.23 20:36:30 | 000,043,520 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\licmgr10.dll

[2011.06.23 20:36:30 | 000,043,520 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\licmgr10.dll

[2011.06.23 20:36:30 | 000,025,600 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\jsproxy.dll

[2011.06.23 20:36:30 | 000,025,600 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\jsproxy.dll

[2011.06.23 20:36:29 | 011,081,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ieframe.dll

[2011.06.23 20:36:29 | 000,743,424 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\iedvtool.dll

[2011.06.23 20:36:29 | 000,387,584 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\iedkcs32.dll

[2011.06.23 20:36:29 | 000,387,584 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\iedkcs32.dll

[2011.06.23 14:05:37 | 000,173,568 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\ie4uinit.exe

[2011.06.23 14:05:37 | 000,173,568 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ie4uinit.exe

[2011.06.23 14:05:13 | 000,385,024 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\html.iec

[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011.09.20 22:16:45 | 000,011,820 | ---- | C] () -- C:\WINDOWS\look.bat

[2011.09.20 22:16:25 | 001,139,184 | ---- | C] () -- C:\Documents and Settings\user\Desktop\maxlook.exe

[2011.09.20 00:35:03 | 000,879,225 | ---- | C] () -- C:\Documents and Settings\user\Desktop\SecurityCheck.exe

[2011.09.20 00:25:59 | 000,079,623 | ---- | C] () -- C:\Documents and Settings\user\Desktop\Junction.zip

[2011.09.20 00:24:42 | 000,047,616 | ---- | C] () -- C:\Documents and Settings\user\Desktop\Win32kDiag.exe

[2011.09.19 23:24:55 | 000,000,211 | ---- | C] () -- C:\Boot.bak

[2011.09.19 23:24:52 | 000,260,272 | RHS- | C] () -- C:\cmldr

[2011.09.19 23:23:04 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe

[2011.09.19 23:23:04 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe

[2011.09.19 23:23:04 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe

[2011.09.19 23:23:04 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe

[2011.09.19 23:23:04 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe

[2011.09.17 22:57:14 | 000,000,276 | ---- | C] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-484763869-1450960922-839522115-1003.job

[2011.09.17 22:57:13 | 000,000,284 | ---- | C] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-484763869-1450960922-839522115-1003.job

[2011.09.16 19:59:15 | 000,001,008 | -HS- | C] () -- C:\WINDOWS\setup_9.0.0.722_03.06.2011_10-50drv.spi

[2011.09.14 19:35:44 | 000,001,639 | ---- | C] () -- C:\Documents and Settings\user\Desktop\Avira AntiVir Personal Profile Local Drives.LNK

[2011.09.14 18:11:09 | 000,000,000 | -HS- | C] () -- C:\WINDOWS\{2521BB91-29B1-4d7e-9137-AC9875D77735}

[2011.09.01 17:56:24 | 000,002,277 | ---- | C] () -- C:\Documents and Settings\user\Desktop\Google Chrome.lnk

[2011.09.01 17:56:24 | 000,002,255 | ---- | C] () -- C:\Documents and Settings\user\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk

[2011.08.14 15:42:45 | 000,000,738 | ---- | C] () -- C:\Documents and Settings\user\Desktop\FoxTab FLV Player.lnk

[2010.01.23 19:08:59 | 000,149,504 | ---- | C] () -- C:\Documents and Settings\user\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2010.01.23 19:08:58 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini

[2010.01.23 13:43:49 | 000,000,000 | ---- | C] () -- C:\WINDOWS\PROTOCOL.INI

[2010.01.23 13:43:05 | 000,000,155 | ---- | C] () -- C:\WINDOWS\winamp.ini

[2010.01.23 13:41:22 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI

[2010.01.23 13:37:54 | 000,262,884 | ---- | C] () -- C:\WINDOWS\IPUI_DivXG400.exe

[2010.01.23 13:37:49 | 000,055,949 | ---- | C] () -- C:\WINDOWS\System32\x264-uninstall.exe

[2010.01.23 13:35:53 | 001,766,592 | ---- | C] () -- C:\WINDOWS\System32\drivers\snp2uvc.sys

[2010.01.23 13:35:53 | 000,035,264 | ---- | C] () -- C:\WINDOWS\System32\drivers\sncduvc.sys

[2010.01.23 13:08:21 | 000,982,196 | ---- | C] () -- C:\WINDOWS\System32\igkrng500.bin

[2010.01.23 13:08:20 | 000,417,344 | ---- | C] () -- C:\WINDOWS\System32\igcompkrng500.bin

[2010.01.23 07:40:17 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\diagdll.dll

[2010.01.23 03:40:56 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI

[2010.01.23 03:39:35 | 000,246,312 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT

[2010.01.23 01:51:40 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat

[2010.01.23 01:46:02 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat

[2005.08.17 16:10:56 | 000,542,208 | ---- | C] () -- C:\WINDOWS\System32\x264vfw.dll

[2005.08.10 00:13:59 | 000,524,288 | ---- | C] () -- C:\WINDOWS\System32\DivXsm.exe

[2005.08.10 00:13:31 | 000,831,488 | ---- | C] () -- C:\WINDOWS\System32\libeay32.dll

[2005.08.10 00:13:31 | 000,159,744 | ---- | C] () -- C:\WINDOWS\System32\ssleay32.dll

[2005.08.10 00:12:28 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll

[2005.02.06 00:33:37 | 000,000,075 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini

[2004.08.04 03:07:22 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin

[2004.08.04 02:56:44 | 000,755,200 | ---- | C] () -- C:\WINDOWS\System32\ir50_32.dll

[2004.08.04 02:56:44 | 000,338,432 | ---- | C] () -- C:\WINDOWS\System32\ir41_qcx.dll

[2004.08.04 02:56:44 | 000,200,192 | ---- | C] () -- C:\WINDOWS\System32\ir50_qc.dll

[2004.08.04 02:56:44 | 000,183,808 | ---- | C] () -- C:\WINDOWS\System32\ir50_qcx.dll

[2004.08.04 02:56:44 | 000,120,320 | ---- | C] () -- C:\WINDOWS\System32\ir41_qc.dll

[2004.08.02 16:20:40 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat

[2003.03.31 17:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin

[2003.03.31 17:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat

[2003.03.31 17:00:00 | 000,498,166 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat

[2003.03.31 17:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat

[2003.03.31 17:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat

[2003.03.31 17:00:00 | 000,086,442 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat

[2003.03.31 17:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin

[2003.03.31 17:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat

[2003.03.31 17:00:00 | 000,004,463 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat

[2003.03.31 17:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat

[2003.01.07 15:05:08 | 000,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI

========== LOP Check ==========

[2010.01.23 13:27:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AmUStor

[2011.08.10 21:06:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Babylon

[2011.08.14 21:49:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\boost_interprocess

[2010.01.23 13:58:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\DAEMON Tools Lite

[2011.08.10 21:06:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Application Data\Babylon

[2011.08.10 21:06:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Application Data\BabylonToolbar

[2011.08.14 21:50:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Application Data\Bandoo

[2011.09.16 20:49:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Application Data\BitComet

[2011.03.08 00:57:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Application Data\BSplayer

[2010.01.23 19:13:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Application Data\BSplayer Pro

[2010.01.23 14:01:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Application Data\DAEMON Tools Lite

[2011.01.08 23:39:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Application Data\DC++

[2011.09.14 20:38:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Application Data\DNA

[2011.04.06 23:51:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Application Data\Radmin

[2011.08.10 21:00:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Application Data\searchquband

[2010.05.08 12:16:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Application Data\TeamViewer

========== Purity Check ==========

========== Custom Scans ==========

< >

< >

< >

< %SYSTEMDRIVE%\*.* >

[2010.01.23 01:49:04 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT

[2011.09.18 16:57:09 | 000,000,211 | ---- | M] () -- C:\Boot.bak

[2011.09.19 23:24:55 | 000,000,327 | RHS- | M] () -- C:\boot.ini

[2004.08.03 23:00:00 | 000,260,272 | RHS- | M] () -- C:\cmldr

[2011.09.20 00:05:12 | 000,010,258 | ---- | M] () -- C:\ComboFix.txt

[2010.01.23 01:49:04 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS

[2010.01.23 01:49:04 | 000,000,000 | RHS- | M] () -- C:\IO.SYS

[2011.09.20 22:22:40 | 000,001,855 | ---- | M] () -- C:\looklog.txt

[2010.01.23 01:49:04 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS

[2004.08.04 00:38:34 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM

[2010.01.23 10:35:35 | 000,250,048 | RHS- | M] () -- C:\ntldr

[2011.09.20 22:19:50 | 2145,386,496 | -HS- | M] () -- C:\pagefile.sys

[2011.09.16 20:49:53 | 000,040,222 | ---- | M] () -- C:\TDSSKiller.2.5.22.0_16.09.2011_20.47.06_log.txt

[2011.09.16 20:44:51 | 000,000,412 | ---- | M] () -- C:\TDSSKiller.2.5.3.0_16.09.2011_20.44.45_log.txt

< %USERPROFILE%\*.* >

[2011.09.20 22:17:18 | 007,340,032 | -H-- | M] () -- C:\Documents and Settings\user\NTUSER.DAT

[2011.09.20 22:30:18 | 000,001,024 | -H-- | M] () -- C:\Documents and Settings\user\ntuser.dat.LOG

[2011.09.20 22:17:18 | 000,000,278 | -HS- | M] () -- C:\Documents and Settings\user\ntuser.ini

< %USERPROFILE%\Application Data\*.* >

[2010.01.23 03:40:24 | 000,000,062 | -HS- | M] () -- C:\Documents and Settings\user\Application Data\desktop.ini

< %USERPROFILE%\Local Settings\Application Data\*.* >

[2011.09.13 20:27:27 | 000,149,504 | ---- | M] () -- C:\Documents and Settings\user\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2010.01.28 00:46:34 | 000,064,808 | ---- | M] () -- C:\Documents and Settings\user\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

[2011.09.16 20:49:54 | 004,836,498 | -H-- | M] () -- C:\Documents and Settings\user\Local Settings\Application Data\IconCache.db

< %AllUsersProfile%\*.* >

< %AllUsersProfile%\Application Data\*.* >

[2010.01.23 03:40:24 | 000,000,062 | -HS- | M] () -- C:\Documents and Settings\All Users\Application Data\desktop.ini

< %USERPROFILE%\My Documents\*.* >

[2010.10.13 19:13:10 | 000,000,075 | -HS- | M] () -- C:\Documents and Settings\user\My Documents\desktop.ini

< %CommonProgramFiles%\*.* >

< %PROGRAMFILES%\*.* >

< %systemroot%\system32\*.dll /lockedfiles >

[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /90 >

[2011.09.17 00:13:27 | 000,066,616 | ---- | M] (Avira GmbH) -- C:\WINDOWS\system32\drivers\avgntflt.sys

[2011.09.17 00:13:27 | 000,138,192 | ---- | M] (Avira GmbH) -- C:\WINDOWS\system32\drivers\avipbb.sys

[2011.09.16 20:50:37 | 000,036,352 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\drivers\intelppm.sys

[2011.08.31 17:00:50 | 000,022,216 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\system32\drivers\mbam.sys

[2011.07.15 15:29:31 | 000,456,320 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\drivers\mrxsmb.sys

[2011.07.08 16:02:00 | 000,010,496 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\drivers\ndistapi.sys

[2011.06.24 16:10:36 | 000,139,656 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\drivers\rdpwd.sys

[2011.09.16 20:50:37 | 000,057,600 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\drivers\redbook.sys

< %systemroot%\system32\drivers\*.sys /lockedfiles >

[2010.01.23 13:58:40 | 000,691,696 | ---- | M] () Unable to obtain MD5 -- C:\WINDOWS\system32\drivers\sptd.sys

< %systemroot%\system32\Spool\prtprocs\w32x86\*.dll >

[2008.07.06 14:06:10 | 000,089,088 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\Spool\prtprocs\w32x86\filterpipelineprintproc.dll

[2007.04.09 13:23:54 | 000,028,552 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\Spool\prtprocs\w32x86\mdippr.dll

< %systemroot%\*. /mp /s >

< MD5 for: MSWSOCK.DLL >

[2004.08.04 02:56:46 | 000,245,248 | ---- | M] (Microsoft Corporation) MD5=4E74AF063C3271FBEA20DD940CFD1184 -- C:\WINDOWS\$NtServicePackUninstall$\mswsock.dll

[2008.06.20 19:46:57 | 000,245,248 | ---- | M] (Microsoft Corporation) MD5=832E4DD8964AB7ACC880B2837CB1ED20 -- C:\WINDOWS\$NtUninstallKB2509553$\mswsock.dll

[2008.06.20 18:02:47 | 000,245,248 | ---- | M] (Microsoft Corporation) MD5=943337D786A56729263071623BBB9DE5 -- C:\WINDOWS\ERDNT\cache\mswsock.dll

[2008.06.20 18:02:47 | 000,245,248 | ---- | M] (Microsoft Corporation) MD5=943337D786A56729263071623BBB9DE5 -- C:\WINDOWS\system32\dllcache\mswsock.dll

[2008.06.20 18:02:47 | 000,245,248 | ---- | M] (Microsoft Corporation) MD5=943337D786A56729263071623BBB9DE5 -- C:\WINDOWS\system32\mswsock.dll

[2008.04.14 05:42:02 | 000,245,248 | ---- | M] (Microsoft Corporation) MD5=B4138E99236F0F57D4CF49BAE98A0746 -- C:\WINDOWS\$NtUninstallKB951748$\mswsock.dll

[2008.04.14 05:42:02 | 000,245,248 | ---- | M] (Microsoft Corporation) MD5=B4138E99236F0F57D4CF49BAE98A0746 -- C:\WINDOWS\ServicePackFiles\i386\mswsock.dll

[2008.06.20 19:43:05 | 000,245,248 | ---- | M] (Microsoft Corporation) MD5=FCEE5FCB99F7C724593365C706D28388 -- C:\WINDOWS\$hf_mig$\KB2509553\SP3QFE\mswsock.dll

[2008.06.20 19:43:05 | 000,245,248 | ---- | M] (Microsoft Corporation) MD5=FCEE5FCB99F7C724593365C706D28388 -- C:\WINDOWS\$hf_mig$\KB951748\SP3QFE\mswsock.dll

< End of report >

OTL Extras logfile created on: 20.9.2011 г. 22:28:52 - Run 1

OTL by OldTimer - Version 3.2.29.1 Folder = C:\Documents and Settings\user\Desktop

Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale: 00000402 | Country: Bulgaria | Language: BGR | Date Format: dd.M.yyyy 'г.'

2,97 Gb Total Physical Memory | 2,41 Gb Available Physical Memory | 81,20% Memory free

4,81 Gb Paging File | 4,40 Gb Available in Paging File | 91,63% Paging File free

Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 39,11 Gb Total Space | 24,42 Gb Free Space | 62,44% Space Free | Partition Type: NTFS

Drive D: | 193,76 Gb Total Space | 91,31 Gb Free Space | 47,12% Space Free | Partition Type: NTFS

Computer Name: ORGANIZA-9A7154 | User Name: user | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 90 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*

[HKEY_USERS\S-1-5-21-484763869-1450960922-839522115-1003\SOFTWARE\Classes\<extension>]

.html [@ = htmlfile] -- Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*

exefile [open] -- "%1" %*

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Directory [Winamp.Bookmark] -- "C:\Program Files\Winamp\Winamp.exe" /BOOKMARK "%1" (Nullsoft)

Directory [Winamp.Enqueue] -- "C:\Program Files\Winamp\Winamp.exe" /ADD "%1" (Nullsoft)

Directory [Winamp.Play] -- "C:\Program Files\Winamp\Winamp.exe" "%1" (Nullsoft)

Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)

Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"FirstRunDisabled" = 1

"AntiVirusDisableNotify" = 0

"FirewallDisableNotify" = 0

"UpdatesDisableNotify" = 0

"AntiVirusOverride" = 0

"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]

"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]

"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]

"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

"24306:TCP" = 24306:TCP:*:Enabled:BitComet 24306 TCP

"24306:UDP" = 24306:UDP:*:Enabled:BitComet 24306 UDP

"5985:TCP" = 5985:TCP:*:Disabled:Windows Remote Management

"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007

"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)

"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)

"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)

"C:\Program Files\DNA\btdna.exe" = C:\Program Files\DNA\btdna.exe:*:Enabled:DNA -- (BitTorrent, Inc.)

"C:\Program Files\BitComet\BitComet.exe" = C:\Program Files\BitComet\BitComet.exe:*:Enabled:BitComet.exe -- (www.BitComet.com)

"C:\WINDOWS\system32\dpvsetup.exe" = C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test -- (Microsoft Corporation)

"C:\Program Files\SopCast\adv\SopAdver.exe" = C:\Program Files\SopCast\adv\SopAdver.exe:*:Enabled:SopCast Adver -- (www.sopcast.com)

"C:\Program Files\SopCast\SopCast.exe" = C:\Program Files\SopCast\SopCast.exe:*:Enabled:SopCast Main Application -- (www.sopcast.com)

"C:\Program Files\Skype\Phone\Skype.exe" = C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype -- (Skype Technologies S.A.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148

"{0969AF05-4FF6-4C00-9406-43599238DE0D}" = ASUS Splendid Video Enhancement Technology

"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended

"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate

"{1DBD1F12-ED93-49C0-A7CC-56CBDE488158}" = LifeFrame2

"{20D4A895-748C-4D88-871C-FDB1695B0169}" = Platform

"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer

"{2517B7EA-6C03-4D86-A1B1-F3FE1C3BC03B}" = Radmin Viewer 3.4

"{28006915-2739-4EBE-B5E8-49B25D32EB33}" = Atheros Client Installation Program

"{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}" = RealUpgrade 1.1

"{3108C217-BE83-42E4-AE9E-A56A2A92E549}" = Atheros Communications Inc.® AR81Family Gigabit/Fast Ethernet Driver

"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP

"{3B05F2FB-745B-4012-ADF2-439F36B2E70B}" = ATKOSD2

"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile

"{4462AD13-F2AA-4CBD-9F95-293C38EED870}" = Power4 Gear

"{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}" = RealNetworks - Microsoft Visual C++ 2008 Runtime

"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX

"{7C05592D-424B-46CB-B505-E0013E8E75C9}" = ATK Hotkey

"{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003

"{901E0402-6000-11D3-8CFE-0150048383C9}" = Microsoft Office 2003 Bulgarian User Interface Pack

"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2

"{AA59DDE4-B672-4621-A016-4C248204957A}" = Skype™ 5.5

"{AC76BA86-7AD7-1033-7B44-A92000000001}" = Adobe Reader 9.2 Lite

"{AC9A0778-63E2-438C-A401-6CC07F5D0E63}" = Bulgarian (Phonetic) - Todor Komplex OOD

"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2

"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1

"{F4BF5F6B-F695-4762-AEB2-D095A4C34D89}" = Alcor Micro USB Card Reader

"7-Zip" = 7-Zip 4.65

"AC3Filter" = AC3Filter (remove only)

"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX

"AvantBrowser" = Avant Browser (remove only)

"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus

"BitComet" = BitComet 1.18

"BSPlayerf" = BS.Player FREE

"DC++" = DC++ 0.761

"DivXG400" = DivXG400

"ESET Online Scanner" = ESET Online Scanner v3

"HDMI" = Intel® Graphics Media Accelerator Driver

"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs

"ie7" = Windows Internet Explorer 7

"IE7-MUI" = Windows Internet Explorer 7 Multilingual User Interface (MUI)

"ie8" = Windows Internet Explorer 8

"InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}" = VIA Platform Device Manager

"InstallShield_{F4BF5F6B-F695-4762-AEB2-D095A4C34D89}" = Alcor Micro USB Card Reader

"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware, версия 1.51.2.1300

"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1

"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile

"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended

"Nero - Burning Rom!UninstallKey" = Nero 6 Ultra Edition

"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs

"RealPlayer 12.0" = RealPlayer

"SA Dictionary 2004 Datacenter" = SA Dictionary 2004 Datacenter

"SopCast" = SopCast 3.2.9

"The KMPlayer" = The KMPlayer (remove only)

"USB 2.0 1.3M UVC WebCam" = USB 2.0 1.3M UVC WebCam

"Winamp" = Winamp (remove only)

"Windows XP Service Pack" = Windows XP Service Pack 3

"X264 H.264/AVC Video Codec" = X264 H.264/AVC Video Codec (remove only)

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-484763869-1450960922-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"BitTorrent DNA" = DNA

"Google Chrome" = Google Chrome

========== Last 10 Event Log Errors ==========

[ Application Events ]

Error - 09.4.2011 г. 10:34:38 | Computer Name = ORGANIZA-9A7154 | Source = Application Hang | ID = 1002

Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module

hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 11.4.2011 г. 08:20:52 | Computer Name = ORGANIZA-9A7154 | Source = Application Hang | ID = 1002

Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module

hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 14.4.2011 г. 03:49:08 | Computer Name = ORGANIZA-9A7154 | Source = .NET Runtime Optimization Service | ID = 1103

Description = .NET Runtime Optimization Service (clr_optimization_v2.0.50727_32)

- Tried to start a service that wasn't the latest version of CLR Optimization service.

Will shutdown

Error - 16.4.2011 г. 10:50:00 | Computer Name = ORGANIZA-9A7154 | Source = Application Hang | ID = 1002

Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module

hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 20.4.2011 г. 02:32:23 | Computer Name = ORGANIZA-9A7154 | Source = Application Hang | ID = 1002

Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module

hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 28.4.2011 г. 05:17:40 | Computer Name = ORGANIZA-9A7154 | Source = Application Hang | ID = 1002

Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module

hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 03.5.2011 г. 14:43:34 | Computer Name = ORGANIZA-9A7154 | Source = Application Hang | ID = 1002

Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module

hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 12.5.2011 г. 04:26:30 | Computer Name = ORGANIZA-9A7154 | Source = Application Hang | ID = 1002

Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module

hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 17.5.2011 г. 07:20:08 | Computer Name = ORGANIZA-9A7154 | Source = Application Hang | ID = 1002

Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module

hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 18.5.2011 г. 03:56:21 | Computer Name = ORGANIZA-9A7154 | Source = Application Hang | ID = 1002

Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module

hungapp, version 0.0.0.0, hang address 0x00000000.

[ System Events ]

Error - 19.9.2011 г. 14:40:02 | Computer Name = ORGANIZA-9A7154 | Source = W32Time | ID = 39452689

Description = Time Provider NtpClient: An error occurred during DNS lookup of the

manually configured peer 'ntp.comnet.bg,0x1'. NtpClient will try the DNS lookup

again in 15 minutes. The error was: A socket operation was attempted to an unreachable

host. (0x80072751)

Error - 19.9.2011 г. 14:40:02 | Computer Name = ORGANIZA-9A7154 | Source = W32Time | ID = 39452701

Description = The time provider NtpClient is configured to acquire time from one

or more time sources, however none of the sources are currently accessible. No attempt

to contact a source will be made for 14 minutes. NtpClient has no source of accurate

time.

Error - 19.9.2011 г. 17:57:45 | Computer Name = ORGANIZA-9A7154 | Source = Service Control Manager | ID = 7034

Description = The Print Spooler service terminated unexpectedly. It has done this

1 time(s).

Error - 19.9.2011 г. 17:57:45 | Computer Name = ORGANIZA-9A7154 | Source = Service Control Manager | ID = 7034

Description = The Application Layer Gateway Service service terminated unexpectedly.

It has done this 1 time(s).

Error - 20.9.2011 г. 15:10:39 | Computer Name = ORGANIZA-9A7154 | Source = Server | ID = 2505

Description = The server could not bind to the transport \Device\NetBT_Tcpip_{C9CCB9A6-6375-4ADC-9D71-38BD4EE40718}

because another computer on the network has the same name. The server could not

start.

Error - 20.9.2011 г. 15:13:15 | Computer Name = ORGANIZA-9A7154 | Source = Server | ID = 2505

Description = The server could not bind to the transport \Device\NetBT_Tcpip_{C9CCB9A6-6375-4ADC-9D71-38BD4EE40718}

because another computer on the network has the same name. The server could not

start.

Error - 20.9.2011 г. 15:24:07 | Computer Name = ORGANIZA-9A7154 | Source = Server | ID = 2505

Description = The server could not bind to the transport \Device\NetBT_Tcpip_{C9CCB9A6-6375-4ADC-9D71-38BD4EE40718}

because another computer on the network has the same name. The server could not

start.

Error - 20.9.2011 г. 15:27:14 | Computer Name = ORGANIZA-9A7154 | Source = atapi | ID = 262153

Description = The device, \Device\Ide\IdePort0, did not respond within the timeout

period.

Error - 20.9.2011 г. 15:27:28 | Computer Name = ORGANIZA-9A7154 | Source = atapi | ID = 262153

Description = The device, \Device\Ide\IdePort0, did not respond within the timeout

period.

Error - 20.9.2011 г. 15:58:23 | Computer Name = ORGANIZA-9A7154 | Source = Dhcp | ID = 1001

Description = Your computer was not assigned an address from the network (by the

DHCP Server) for the Network Card with network address 0025D36186B6. The following

error occurred: %%121. Your computer will continue to try and obtain an address on

its own from the network address (DHCP) server.

< End of report >

Всички логове са чисти вече.

Поздравления.

Стартирайте OTL още веднъж и натиснете бутона CleanUp.

Ако бъдете подканени да рестартирате, се съгласете.

Изтеглете ToolsCleaner и го стартирайте.

Натиснете бутона Recherche и изчакайте да се извърши проверката.

Може временно да ви изпише "Not responding", но програмата не е забила.

След края на проверката натиснете бутона Suppression и за финал Quitter.

Публикувайте доклада от лог файла C:\TCleaner.txt в следващия си пост.

Изтрийте всички инструменти и логове на инструментите които сме използвали (и не са се изтрили след изпълнените досега процедури).

Вече можете да обновите AVIRA и да направите пълна проверка на системата си.

Ако намери вирусчета, публикувайте резултата.

Как е сега положението ? Има ли някакви остатъчни проблеми ?

проблеми няма от вчера след като поправихме "червената книга" остава само да почистя инструментите

Ами супер. Тогава маркирам случая като решен. Приятна вечер и благодаря за точното спазване на указанията.

И аз благодаря за помощта, както и за новите научени неща.

Имам само още едно въпросче към екипа: все още не мога да си направя скан с DDS или ComboFix на моя компютър, някакви идеи какво да правя? Ето темата: http://www.kaldata.com/forums/index.php?showtopic=182451&hl=&fromsearch=1

Изтеглете ToolsCleaner и го стартирайте.

Натиснете бутона Recherche и изчакайте да се извърши проверката.

Може временно да ви изпише "Not responding", но програмата не е забила.

След края на проверката натиснете бутона Suppression и за финал Quitter.

Публикувайте доклада от лог файла C:\TCleaner.txt в следващия си пост.

току що приключи сканирането, но лог-а е почти празен - само три реда, които указват програмата и какво е правила

[ Rapport ToolsCleaner version 2.3.11 (par A.Rothstein & dj QUIOU) ]
--> Recherche:

---------------------------------
--> Suppression:

Редактирано 20 септември 201114 г. от Bily-79 (преглед на промените)

Ами другата тема е започната от колегата...

Аз ще помисля и ще пиша в другата тема, но сега, че ми се спи.

Но не вярвам проблема да е в TCP/IP протокола (който може да се преинсталира и самостоятелно).

Защо не вявам проблема да е там ли...ами защото Combofix изключва интернет-а докато сканира така или иначе.

Все пак можеш да пробваш временно да разкараш торент клиента и Daemon Tools-a и наличната антивирусна и да пробваш ново сканиране (с последните им версии).

На мен ми намирисва на проблем с RAM-a или хардиска.

Пусни една диагностика на РАМ-а и една проверка с инструмент от сайта на производителя за проверка на хардиска за всеки случай.

Възможно е и MBR да е замесен там...и двата инструмента го проверяват.

Пробвай да направиш проверка с Combofix без сканиране на MBR:

Постави Combofix на десктопа и след това изпълни командата:

Start => run => "%userprofile%\desktop\combofix.exe" /nombr

Поздрави и лека !

RAM-a е нов, но диска е стария, така че напълно е възможно да е от MBR. Ще пробвам новата идея и ще пиша. Още веднъж благодаря за отделеното време. Лека и от мен!