Дадохте ли и достатъчно време... ? Ами освен ще премахнем само инфекциите...а остатъците от програмите за сигурност ще пробваме да изтрием с някой по-универсален деинсталатор като AppRemover. Повторете процедурата с олекотения скрипт и публикувайте лог файла.

OTL.zip

All processes killed ========== OTL ========== C:\Windows\assembly\tmp\loader.tlb moved successfully. C:\Windows\assembly\tmp\{1B372133-BFFA-4dba-9CCF-5474BED6A9F6} moved successfully. C:\Windows\assembly\GAC_32\Desktop.ini moved successfully. C:\Windows\assembly\GAC_64\Desktop.ini moved successfully. ========== FILES ========== C:\Windows\assembly\tmp folder moved successfully. ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: AppData ->Temp folder emptied: 0 bytes User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 134 bytes User: Default User User: el ->Temp folder emptied: 48095123 bytes ->Temporary Internet Files folder emptied: 123864788 bytes ->Java cache emptied: 2723064 bytes ->FireFox cache emptied: 46796992 bytes ->Google Chrome cache emptied: 29985456 bytes ->Flash cache emptied: 35605 bytes User: Public ->Temp folder emptied: 0 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32 (64bit) .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 377201 bytes %systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 67563 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 240.00 mb OTL by OldTimer - Version 3.2.31.0 log created on 11012011_231409 Files\Folders moved on Reboot... C:\Users\el\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully. Registry entries deleted on Reboot...

Може ли да повторите проверката с Eset Online Scanner-a ?

Как е сега положението ?

Ще го направя утре защото трябва да лягам.Благодаря за помоща до сега и наистина се получава със компютъра.

ESETSmartInstaller@High as downloader log: all ok # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6583 # api_version=3.0.2 # EOSSerial=20ae5984b869e34da9acef1cebfc044d # end=finished # remove_checked=false # archives_checked=true # unwanted_checked=true # unsafe_checked=true # antistealth_checked=true # utc_time=2011-11-02 06:20:06 # local_time=2011-11-02 07:20:06 (+0100, W. Europe Standard Time) # country="Bulgaria" # lang=1033 # osver=6.1.7601 NT Service Pack 1 # compatibility_mode=512 16777215 100 0 0 0 0 0 # compatibility_mode=1024 16777215 100 0 0 0 0 0 # compatibility_mode=5893 16776574 100 94 0 71880661 0 0 # compatibility_mode=8192 67108863 100 0 15701 15701 0 0 # scanned=267168 # found=9 # cleaned=0 # scan_time=7194 C:\Program Files (x86)\RealArcade\Installer\bin\OCSetupHlp.dll Win32/OpenCandy application (unable to clean) 00000000000000000000000000000000 I C:\Qoobox\Quarantine\[4]-Submit_2011-10-31_21.34.29.zip Java/Exploit.Agent.NAO trojan (unable to clean) 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Users\el\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\33\2dafd721-3d05d367.vir Java/Exploit.Agent.NAO trojan (unable to clean) 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Users\el\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\50\62ea032-1cc8dabd.vir Java/Exploit.Agent.NAO trojan (unable to clean) 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Windows\System32\consrv.dll.vir Win64/Sirefef.D trojan (unable to clean) 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Windows\SysWOW64\config\systemprofile\AppData\Local\aa4a3ccd\X.vir Win64/Sirefef.A trojan (unable to clean) 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Windows\update.2\svchost.exe.vir probably a variant of Win32/TrojanDownloader.Delf.QPN trojan (unable to clean) 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Windows\update.5.0\svchost.exe.vir a variant of Win32/TrojanDownloader.Delf.QPN trojan (unable to clean) 00000000000000000000000000000000 I C:\_OTL\MovedFiles\11012011_231409\C_Windows\assembly\GAC_32\Desktop.ini a variant of Win32/Sirefef.CH trojan (unable to clean) 00000000000000000000000000000000 I

Как е сега положението ? Пуснете свеж лог от DDS ? Трябва да се премахнат остатъците от антивирусните програми и е добре да се деинсталират оптимизаторите. Ще мога да пиша след 24.00 защото съм на работа.

DDS не работи и не знам от къде да го сваля.Опитах се от темата,но не се получи.

Пробвайте от някои от следните линкове:

DDS.com

DDS.scr

DDS.pif

Какво се случва при опит за стартиране ?

При стартиране се отваря прозорец "about : blank ". И само това става иначе проработи сега от първия линк който ми даде. . DDS (Ver_2011-08-26.01) - NTFSAMD64 Internet Explorer: 8.0.7601.17514 Run by el at 23:01:08 on 2011-11-02 Microsoft Windows 7 Home Premium 6.1.7601.1.1251.359.1033.18.4023.2524 [GMT 1:00] . SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . ============== Running Processes =============== . C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\nvvsvc.exe C:\Windows\system32\svchost.exe -k RPCSS C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_70dacb64382a61a7\STacSV64.exe C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\Hpservice.exe C:\Windows\system32\vcsFPService.exe C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\system32\nvvsvc.exe C:\Windows\System32\spoolsv.exe C:\Program Files (x86)\DigitalPersona\Bin\DpHostW.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_70dacb64382a61a7\AESTSr64.exe C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe C:\Windows\SysWOW64\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe C:\Windows\system32\svchost.exe -k imgsvc C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe C:\Windows\system32\taskhost.exe C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesApp64.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\IDT\WDM\sttray64.exe C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Program Files\Synaptics\SynTP\SynTPHelper.exe C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QLBCtrl.exe C:\Program Files (x86)\DigitalPersona\Bin\DpAgent.exe C:\Program Files (x86)\Citrix\ICA Client\concentr.exe C:\Program Files\DigitalPersona\Bin\DPAgent.exe C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe C:\Windows\system32\taskeng.exe c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe C:\Windows\system32\svchost.exe -k SDRSVC C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe C:\Windows\system32\SearchFilterHost.exe C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\conhost.exe C:\Windows\SysWOW64\cscript.exe C:\Windows\system32\wbem\wmiprvse.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://www.searchqu.com//406 uDefault_Search_URL = hxxp://www.google.com/ie mStart Page = hxxp://home.sweetim.com uInternet Settings,ProxyOverride = *.local uSearchAssistant = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s uURLSearchHooks: BS Player Toolbar: {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - C:\Program Files (x86)\BS_Player\prxtbBS_0.dll mURLSearchHooks: BS Player Toolbar: {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - C:\Program Files (x86)\BS_Player\prxtbBS_0.dll BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO: Conduit Engine : {30f9b915-b755-4826-820b-08fba6bd249d} - C:\Program Files (x86)\ConduitEngine\prxConduitEngine.dll BHO: DivX Plus Web Player HTML5 <video>: {326e768d-4182-46fd-9c16-1449a49795f4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll BHO: DigitalPersona Personal Extension: {395610ae-c624-4f58-b89e-23733ea00f9a} - C:\Program Files (x86)\DigitalPersona\Bin\DpOtsPluginIe8.dll BHO: IEVkbdBHO Class: {59273ab4-e7d3-40f9-a1a8-6fa9cca1862c} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2012\ievkbd.dll BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll BHO: Windows Live Messenger Companion Helper: {9fdde16b-836f-4806-ab1f-1455cbeff289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll BHO: FilterBHO Class: {e33cf602-d945-461a-83f0-819f76a199f8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2012\klwtbbho.dll BHO: BS Player Toolbar: {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - C:\Program Files (x86)\BS_Player\prxtbBS_0.dll TB: BS Player Toolbar: {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - C:\Program Files (x86)\BS_Player\prxtbBS_0.dll TB: {AF3D7884-B142-414E-943D-75D8D54E1FFF} - No File TB: {95B7759C-8C7F-4BF1-B163-73684A933233} - No File TB: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File {e7df6bff-55a5-4eb7-a673-4ed3e9456d39} uRun: [LightScribe Control Panel] C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe -hidden uRun: [skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /nosplash /minimized mRun: [QlbCtrl.exe] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start mRun: [Easybits Recovery] C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe mRun: [WirelessAssistant] C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe mRun: [DpAgent] C:\Program Files (x86)\DigitalPersona\Bin\dpagent.exe mRun: [ConnectionCenter] "C:\Program Files (x86)\Citrix\ICA Client\concentr.exe" /startup mRun: [bCSSync] "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices mRunOnce: [AvgUninstallURL] cmd.exe /c start http://www.avg.com/ww.special-uninstallation-feedback-lsf?lic=TlVIRDQtWUg5UEUtTzNQNEUtUVJERUstR0RKWjctVk9YVUw"&"inst=NzctNzIyMzAzOTM5LVNUMTJGT0krMS1ERFQrMC1TVDEyQVBQKzEtRVVMQSsx"&"prod=55"&"ver=2012.0.1809"&"mid=4cd741f9cc5a47d1ad161943ef6512fd-0cedc4f5a80b84a2fb832b7803eeed5bf8f31a12 StartupFolder: C:\Users\el\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Dropbox.lnk - C:\Users\el\AppData\Roaming\Dropbox\bin\Dropbox.exe mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5) mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3) mPolicies-system: EnableLUA = 0 (0x0) mPolicies-system: EnableSecureUIAPaths = 0 (0x0) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) mPolicies-system: HideFastUserSwitching = 0 (0x0) IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\OFFICE11\EXCEL.EXE/3000 IE: Nach Microsoft E&xel exportieren - C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 IE: Se&nd to OneNote - C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 IE: Send image to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm IE: Send page to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm IE: {0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab TCP: DhcpNameServer = 212.54.35.25 212.54.40.25 TCP: Interfaces\{5A4ED891-3A4D-46AE-BA8B-53BA52FE00D8} : DhcpNameServer = 212.54.35.25 212.54.40.25 TCP: Interfaces\{60BA448C-B2D7-4280-A884-843E30E1591D}\0527563737 : DhcpNameServer = 10.11.11.10 10.11.11.11 TCP: Interfaces\{60BA448C-B2D7-4280-A884-843E30E1591D}\078686579637 : DhcpNameServer = 217.149.196.6 217.149.192.6 TCP: Interfaces\{60BA448C-B2D7-4280-A884-843E30E1591D}\1246F6D2E6F647D257375612 : DhcpNameServer = 145.18.40.50 145.18.39.16 145.18.68.50 TCP: Interfaces\{60BA448C-B2D7-4280-A884-843E30E1591D}\14050313D276163747 : DhcpNameServer = 192.168.33.1 TCP: Interfaces\{60BA448C-B2D7-4280-A884-843E30E1591D}\54E6A6F6975646F3023556E64602478616E6B637048616279616E65737E2E6C6 : DhcpNameServer = 10.0.1.1 TCP: Interfaces\{60BA448C-B2D7-4280-A884-843E30E1591D}\55671436F6E67627563737 : DhcpNameServer = 145.18.40.50 145.18.39.16 145.18.68.50 TCP: Interfaces\{60BA448C-B2D7-4280-A884-843E30E1591D}\E41696D2865726166702E65647 : DhcpNameServer = 82.146.20.1 TCP: Interfaces\{6DDBE2F7-D6BE-4F6B-B432-7A85E83F0626} : DhcpNameServer = 212.54.35.25 212.54.40.25 Filter: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll Filter: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll SEH: EasyBits ShellExecute Hook: {e54729e8-bb3d-4270-9d49-7389ea579090} - C:\Windows\SysWow64\EZUPBH~1.DLL SEH: UPB:{B5A7F190-DDA6-4420-B3BA-52453494E6CD} - No File SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Program Files (x86)\Common Files\LightScribe\LSRunOnce.exe" BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO-X64: AcroIEHelperStub - No File BHO-X64: Conduit Engine : {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\prxConduitEngine.dll BHO-X64: Conduit Engine - No File BHO-X64: DivX Plus Web Player HTML5 <video>: {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll BHO-X64: Increase performance and video formats for your HTML5 <video> - No File BHO-X64: DigitalPersona Personal Extension: {395610AE-C624-4f58-B89E-23733EA00F9A} - C:\Program Files (x86)\DigitalPersona\Bin\DpOtsPluginIe8.dll BHO-X64: DigitalPersona Personal Extension - No File BHO-X64: IEVkbdBHO Class: {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2012\ievkbd.dll BHO-X64: IEVkbdBHO - No File BHO-X64: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll BHO-X64: Windows Live Messenger Companion Helper: {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll BHO-X64: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL BHO-X64: URLRedirectionBHO - No File BHO-X64: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll BHO-X64: FilterBHO Class: {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2012\klwtbbho.dll BHO-X64: link filter bho - No File BHO-X64: BS Player Toolbar: {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - C:\Program Files (x86)\BS_Player\prxtbBS_0.dll BHO-X64: BS Player - No File TB-X64: BS Player Toolbar: {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - C:\Program Files (x86)\BS_Player\prxtbBS_0.dll TB-X64: {AF3D7884-B142-414E-943D-75D8D54E1FFF} - No File TB-X64: {95B7759C-8C7F-4BF1-B163-73684A933233} - No File TB-X64: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File TB-X64: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File mRun-x64: [QlbCtrl.exe] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start mRun-x64: [Easybits Recovery REG_SZ C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe ] mRun-x64: [WirelessAssistant REG_SZ C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe ] mRun-x64: [DpAgent] C:\Program Files (x86)\DigitalPersona\Bin\dpagent.exe mRun-x64: [ConnectionCenter] "C:\Program Files (x86)\Citrix\ICA Client\concentr.exe" /startup mRun-x64: [bCSSync REG_SZ "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices ] mRunOnce-x64: [AvgUninstallURL] cmd.exe /c start http://www.avg.com/ww.special-uninstallation-feedback-lsf?lic=TlVIRDQtWUg5UEUtTzNQNEUtUVJERUstR0RKWjctVk9YVUw"&"inst=NzctNzIyMzAzOTM5LVNUMTJGT0krMS1ERFQrMC1TVDEyQVBQKzEtRVVMQSsx"&"prod=55"&"ver=2012.0.1809"&"mid=4cd741f9cc5a47d1ad161943ef6512fd-0cedc4f5a80b84a2fb832b7803eeed5bf8f31a12 IE-X64: {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm SEH-X64: EasyBits ShellExecute Hook: {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWow64\EZUPBH~1.DLL SEH-X64: UPB:{B5A7F190-DDA6-4420-B3BA-52453494E6CD} - No File SEH-X64: Groove GFS Stub Execution Hook: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL . ============= SERVICES / DRIVERS =============== . R1 ctxusbm;Citrix USB Monitor Driver;C:\Windows\system32\DRIVERS\ctxusbm.sys --> C:\Windows\system32\DRIVERS\ctxusbm.sys [?] R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;C:\Windows\system32\DRIVERS\dtsoftbus01.sys --> C:\Windows\system32\DRIVERS\dtsoftbus01.sys [?] R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?] R2 {55662437-DA8C-40c0-AADA-2C816A897A49};Power Control [2010/02/06 02:29:18];C:\Program Files (x86)\Hewlett-Packard\Media\DVD\000.fcl [2010-2-6 146928] R2 AESTFilters;Andrea ST Filters Service;C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_70dacb64382a61a7\AESTSr64.exe [2010-11-11 89600] R2 epfwwfpr;epfwwfpr;C:\Windows\system32\DRIVERS\epfwwfpr.sys --> C:\Windows\system32\DRIVERS\epfwwfpr.sys [?] R2 ezSharedSvc;Easybits Shared Services for Windows;C:\Windows\system32\svchost.exe -k netsvcs [2009-7-14 20992] R2 hpsrv;HP Service;C:\Windows\system32\Hpservice.exe --> C:\Windows\system32\Hpservice.exe [?] R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe [2011-10-14 2072896] R2 vcsFPService;Validity VCS Fingerprint Service;C:\Windows\System32\vcsFPService.exe [2009-7-13 1656112] R3 Com4QLBEx;Com4QLBEx;C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2009-12-11 228408] R3 enecir;ENE CIR Receiver;C:\Windows\system32\DRIVERS\enecir.sys --> C:\Windows\system32\DRIVERS\enecir.sys [?] R3 JMCR;JMCR;C:\Windows\system32\DRIVERS\jmcr.sys --> C:\Windows\system32\DRIVERS\jmcr.sys [?] R3 LgBttPort;LGE Bluetooth TransPort;C:\Windows\system32\DRIVERS\lgbtpt64.sys --> C:\Windows\system32\DRIVERS\lgbtpt64.sys [?] R3 lgbusenum;LG Bluetooth Bus Enumerator;C:\Windows\system32\DRIVERS\lgbtbs64.sys --> C:\Windows\system32\DRIVERS\lgbtbs64.sys [?] R3 LGVMODEM;LGE Virtual Modem;C:\Windows\system32\DRIVERS\lgvmdm64.sys --> C:\Windows\system32\DRIVERS\lgvmdm64.sys [?] R3 NVHDA;Service for NVIDIA High Definition Audio Driver;C:\Windows\system32\drivers\nvhda64v.sys --> C:\Windows\system32\drivers\nvhda64v.sys [?] R3 osppsvc;Office Software Protection Platform;C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-1-9 4925184] R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys --> C:\Windows\system32\DRIVERS\Rt64win7.sys [?] R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesDriver64.sys [2011-10-13 11856] S2 AVGIDSAgent;AVGIDSAgent;"C:\Program Files (x86)\AVG\AVG2012\AVGIDSAgent.exe" --> C:\Program Files (x86)\AVG\AVG2012\AVGIDSAgent.exe [?] S2 avgwd;AVG WatchDog;"C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe" --> C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe [?] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576] S2 gupdate;Услуга на Google Актуализация (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-10-13 136176] S2 vToolbarUpdater;vToolbarUpdater;C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\8.0.1\ToolbarUpdater.exe --> C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\8.0.1\ToolbarUpdater.exe [?] S3 Andbus;LGE Android Platform Composite USB Device;C:\Windows\system32\DRIVERS\lgandbus64.sys --> C:\Windows\system32\DRIVERS\lgandbus64.sys [?] S3 AndDiag;LGE Android Platform USB Serial Port;C:\Windows\system32\DRIVERS\lganddiag64.sys --> C:\Windows\system32\DRIVERS\lganddiag64.sys [?] S3 AndGps;LGE Android Platform USB GPS NMEA Port;C:\Windows\system32\DRIVERS\lgandgps64.sys --> C:\Windows\system32\DRIVERS\lgandgps64.sys [?] S3 ANDModem;LGE Android Platform USB Modem;C:\Windows\system32\DRIVERS\lgandmodem64.sys --> C:\Windows\system32\DRIVERS\lgandmodem64.sys [?] S3 btwl2cap;Bluetooth L2CAP Service;C:\Windows\system32\DRIVERS\btwl2cap.sys --> C:\Windows\system32\DRIVERS\btwl2cap.sys [?] S3 fssfltr;fssfltr;C:\Windows\system32\DRIVERS\fssfltr.sys --> C:\Windows\system32\DRIVERS\fssfltr.sys [?] S3 fsssvc;Windows Live Family Safety Service;C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe [2011-5-13 1492840] S3 gupdatem;Услуга на Google Актуализация (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-10-13 136176] S3 klmouflt;Kaspersky Lab KLMOUFLT;C:\Windows\system32\DRIVERS\klmouflt.sys --> C:\Windows\system32\DRIVERS\klmouflt.sys [?] S3 NETw5s64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;C:\Windows\system32\DRIVERS\NETw5s64.sys --> C:\Windows\system32\DRIVERS\NETw5s64.sys [?] S3 netw5v64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;C:\Windows\system32\DRIVERS\netw5v64.sys --> C:\Windows\system32\DRIVERS\netw5v64.sys [?] S3 SrvHsfHDA;SrvHsfHDA;C:\Windows\system32\DRIVERS\VSTAZL6.SYS --> C:\Windows\system32\DRIVERS\VSTAZL6.SYS [?] S3 SrvHsfV92;SrvHsfV92;C:\Windows\system32\DRIVERS\VSTDPV6.SYS --> C:\Windows\system32\DRIVERS\VSTDPV6.SYS [?] S3 SrvHsfWinac;SrvHsfWinac;C:\Windows\system32\DRIVERS\VSTCNXT6.SYS --> C:\Windows\system32\DRIVERS\VSTCNXT6.SYS [?] S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?] S3 vwifimp;Microsoft Virtual WiFi Miniport Service;C:\Windows\system32\DRIVERS\vwifimp.sys --> C:\Windows\system32\DRIVERS\vwifimp.sys [?] S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?] S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\system32\DRIVERS\yk62x64.sys --> C:\Windows\system32\DRIVERS\yk62x64.sys [?] S4 HP Support Assistant Service;HP Support Assistant Service;C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe [2011-6-21 85560] S4 HPDrvMntSvc.exe;HP Quick Synchronization Service;C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2011-3-28 94264] S4 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE [2011-6-12 31125880] S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184] . =============== Created Last 30 ================ . 2011-11-02 12:58:30 -------- d-----w- C:\Program Files (x86)\ESET 2011-11-01 20:39:00 -------- d-----w- C:\_OTL 2011-10-31 20:50:51 -------- d-sh--w- C:\$RECYCLE.BIN 2011-10-31 20:31:55 -------- d-----w- C:\ComboFix 2011-10-31 02:28:52 -------- d-----w- C:\Users\el\AppData\Local\DDMSettings 2011-10-30 22:50:10 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware 2011-10-30 21:00:29 98816 ----a-w- C:\Windows\sed.exe 2011-10-30 21:00:29 518144 ----a-w- C:\Windows\SWREG.exe 2011-10-30 21:00:29 256000 ----a-w- C:\Windows\PEV.exe 2011-10-30 21:00:29 208896 ----a-w- C:\Windows\MBR.exe 2011-10-30 13:45:55 -------- d-----w- C:\ProgramData\Systweak 2011-10-30 13:02:26 34624 ----a-w- C:\Windows\System32\TURegOpt.exe 2011-10-30 13:02:24 25920 ----a-w- C:\Windows\System32\authuitu.dll 2011-10-30 13:02:23 21312 ------w- C:\Windows\SysWow64\authuitu.dll 2011-10-30 13:01:54 -------- d-----w- C:\Program Files (x86)\TuneUp Utilities 2012 2011-10-30 13:00:29 -------- d-sh--w- C:\ProgramData\{32364CEA-7855-4A3C-B674-53D8E9B97936} 2011-10-30 04:03:31 -------- d-----w- C:\Users\el\AppData\Roaming\Systweak 2011-10-30 04:02:07 -------- d-----w- C:\Program Files (x86)\Common Files\PX Storage Engine 2011-10-30 04:01:08 -------- d-----w- C:\Program Files\DivX 2011-10-30 04:00:45 -------- d-----w- C:\Program Files (x86)\Common Files\DivX Shared 2011-10-28 17:47:49 414368 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl 2011-10-28 17:28:19 -------- d-----w- C:\Users\el\AppData\Roaming\albumart 2011-10-28 17:28:09 -------- d-----w- C:\Program Files (x86)\Album Cover Art Downloader 2011-10-28 15:54:04 -------- d-----w- C:\ProgramData\clp 2011-10-28 15:53:56 -------- d-----w- C:\Users\el\AppData\Roaming\Fighters 2011-10-28 15:53:03 -------- d-----w- C:\ProgramData\Fighters 2011-10-28 15:52:52 -------- d-----w- C:\Program Files (x86)\ConduitEngine 2011-10-28 15:41:02 -------- d-----w- C:\found.000 2011-10-28 15:18:09 -------- d-----w- C:\Users\el\AppData\Local\Solid State Networks 2011-10-28 09:41:53 8570192 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{D52D8DD1-D46D-484D-B0A2-67A6DD03CADF}\mpengine.dll 2011-10-27 23:53:19 -------- d-----w- C:\Users\el\AppData\Local\Apple Computer 2011-10-27 23:51:36 -------- d-----w- C:\ProgramData\{93E26451-CD9A-43A5-A2FA-C42392EA4001} 2011-10-27 23:50:46 -------- d-----w- C:\Users\el\AppData\Local\Apple 2011-10-26 01:02:49 6144 ----a-w- C:\Program Files\Internet Explorer\iecompat.dll 2011-10-26 01:02:49 6144 ----a-w- C:\Program Files (x86)\Internet Explorer\iecompat.dll 2011-10-24 14:48:56 -------- d-----w- C:\Users\el\AppData\Local\Facebook 2011-10-22 18:19:59 -------- d-----w- C:\Users\el\AppData\Local\Mozilla 2011-10-22 01:00:29 -------- d-----w- C:\a34cb2e6bc9630b39b0f3c54 2011-10-21 12:39:39 -------- d-----w- C:\Program Files (x86)\Microsoft Synchronization Services 2011-10-21 12:39:16 -------- d-----w- C:\Windows\PCHEALTH 2011-10-21 12:37:56 -------- d-----w- C:\Program Files (x86)\Microsoft Visual Studio 8 2011-10-21 12:37:20 -------- d-----w- C:\Program Files (x86)\Microsoft Analysis Services 2011-10-21 12:37:11 -------- d-----w- C:\Windows\SHELLNEW 2011-10-17 01:23:41 -------- d-----w- C:\Users\el\AppData\Local\Graboid_Inc 2011-10-17 01:23:41 -------- d-----w- C:\Users\el\AppData\Local\Graboid 2011-10-17 01:23:39 -------- d-----w- C:\Users\el\AppData\Local\Geckofx 2011-10-16 09:42:22 -------- d-----w- C:\PFiles 2011-10-12 07:39:27 -------- d-----w- C:\2dce9bf6ba70895a26ef460c84d5 2011-10-12 06:49:15 75776 ----a-w- C:\Windows\SysWow64\psisrndr.ax 2011-10-12 06:49:15 613888 ----a-w- C:\Windows\System32\psisdecd.dll 2011-10-12 06:49:15 465408 ----a-w- C:\Windows\SysWow64\psisdecd.dll 2011-10-12 06:49:14 108032 ----a-w- C:\Windows\System32\psisrndr.ax 2011-10-05 11:46:29 -------- d-----w- C:\Users\el\AppData\Roaming\Registry Mechanic 2011-10-05 11:44:04 658432 ----a-w- C:\Windows\SysWow64\MSCOMCT2.OCX . ==================== Find3M ==================== . 2011-10-01 03:25:37 1638912 ----a-w- C:\Windows\System32\mshtml.tlb 2011-10-01 02:42:56 1638912 ----a-w- C:\Windows\SysWow64\mshtml.tlb 2011-09-09 21:56:40 270912 ----a-w- C:\Windows\System32\drivers\dtsoftbus01.sys 2011-09-06 03:03:17 3138048 ----a-w- C:\Windows\System32\win32k.sys 2011-08-31 16:00:50 25416 ----a-w- C:\Windows\System32\drivers\mbam.sys 2011-08-30 21:05:04 83816 ----a-w- C:\Windows\SysWow64\dns-sd.exe 2011-08-30 21:05:04 73064 ----a-w- C:\Windows\SysWow64\dnssd.dll 2011-08-27 05:37:49 861696 ----a-w- C:\Windows\System32\oleaut32.dll 2011-08-27 05:37:48 331776 ----a-w- C:\Windows\System32\oleacc.dll 2011-08-27 04:26:27 571904 ----a-w- C:\Windows\SysWow64\oleaut32.dll 2011-08-27 04:26:27 233472 ----a-w- C:\Windows\SysWow64\oleacc.dll 2011-08-20 19:46:16 848 --sha-w- C:\ProgramData\KGyGaAvL.sys 2011-08-20 05:37:58 1188864 ----a-w- C:\Windows\System32\wininet.dll 2011-08-20 04:31:05 981504 ----a-w- C:\Windows\SysWow64\wininet.dll 2011-08-07 18:08:03 424624 ----a-w- C:\Windows\System32\wrap_oal.dll 2011-08-07 18:08:03 418480 ----a-w- C:\Windows\SysWow64\wrap_oal.dll 2011-08-07 18:08:03 138472 ----a-w- C:\Windows\System32\OpenAL32.dll 2011-08-07 18:08:03 115432 ----a-w- C:\Windows\SysWow64\OpenAL32.dll . ============= FINISH: 23:01:44,28 =============== Заповядайте Знам,че сте на работа така,че ако нямате време да ги прегледате веднага имам време и след 12 часа. Плюс това имаме час разлика, така че даже за мен ще бъде 11 часа.

Attach2.txt

Здравейте отново...

Добрата новина е, че в лог файловете не се виждат зловредни обекти вече.

Лошата е, че имаме още работа по системата - извън обсега на зловредния софтуер.

Съветвам ви да деинсталираре следните приложения:

TuneUp Utilities 2012

Systweak Advanced System Optimizer 3

Registry Mechanic

ESET Online Scanner v3

Norton Online Backup

Norton Security Scan

Защо ? Прочетете в тази статия за ползата от оптимизиращите програми: (вижте първата статия)

http://www.google.bg...iw=1680&bih=861

Следните две приложения се нуждаят от обновяване...деинсталирайте и тях:

Adobe Reader 9.2 MUI

Java™ 6 Update 26

Обновете ги до последните версии:

jre-7u1-windows-x64.exe

Adobe Reader 10.1.1

Може да спрете услугата Indexing Service за да не ви товари излишно системата...

Това става от Start => напишете в полето за търсене services.msc => от списъка с услугите намерене Windows Search

Стартирайте я с двукратен клик на мишката и изберете Stop, а от падащото меню я сложете на Disabled.

В Device Manager-a има забранено устройство - драйвър за процесора...компютъра лаптоп ли е ? И ако да кой модел ?

Би трябвало този да е правилния драйвър за него:

http://support.dell....1&fileid=463918

Виждат се остатъци от AVG и Kaspersky.

Изтеглете и почистете със следните инструменти:

AVG Remover(64bit) 2012

(avg_remover_stf_x64_2012_1796.exe)

kavremover.exe

След това ще продължим.

Да да лаптоп е.HP Pavilion DV6 е модела.

Да да лаптоп е.HP Pavilion DV6 е модела.

Тогава това ще са правилните драйвъри за него:

http://downloadcenter.intel.com/Detail_Desc.aspx?DwnldID=19856

Записах драйверите,почистих AVG и Kaspersky,изключих Windows Search и деинсталирах приложенията без тези 2:Systweak Advanced System Optimizer 3 Registry Mechanic. Второто го деинсталирах вчера, за първото имам спомен,че го изтрих но не съм много сигурен. А да и забравих това: Направих ъпдейт на Adobe Reader и Java.

Ок...следвайте инструкциите от този пост и създайте нов лог от OTL да видим дали можем да махнем още малко остатъци и боклуци преди да приключим:

Само че този път въведете следния скрипт (за да не се генерира толкова голям лог файл)

netsvcs

msconfig

safebootminimal

safebootnetwork

%SYSTEMDRIVE%\*.*

%USERPROFILE%\*.*

%USERPROFILE%\AppData\Local\*.*

%USERPROFILE%\AppData\LocalLow\*.*

%USERPROFILE%\AppData\Roaming\*.*

%systemroot%\system32\config\systemprofile\AppData\Local\

%windir%\SysWOW64\config\systemprofile\AppData\Local\

%windir%\temp*.* /S /MD5

%ProgramData%\*.*

%CommonProgramFiles%\*.*

%PROGRAMFILES%\*.*

%systemroot%\assembly\tmp\*.* /S /MD5

%systemroot%\assembly\GAC_32\*.* /S /MD5

%systemroot%\assembly\GAC_64\*.* /S /MD5

%systemroot%\assembly\GAC_MSIL\*.* /S /MD5

%systemroot%\system32\*.dll /lockedfiles

%systemroot%\system64\*.dll /lockedfiles

%systemroot%\syswow64\*.dll /lockedfiles

%systemroot%\Tasks\*.job /lockedfiles

%systemroot%\system32\drivers\*.sys /90

%systemroot%\system32\drivers\*.sys /lockedfiles

%systemroot%\system64\drivers\*.sys /lockedfiles

%systemroot%\syswow64\drivers\*.sys /lockedfiles

%systemroot%\system32\Spool\prtprocs\w32x86\*.dll

%systemroot%\*. /mp /s

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems /s

/md5start

userinit.exe

/md5stop

Публикувайте резултатите и ще се ориентираме лъм приключване

Опитах се да го кача на два пъти, обаче пак е много дълъг http://file.bg/c128963DaMNK за това качих тука файла.

Готово...написах още един скрипт за да изтрием всички остатъци от боклуците. Просто го активирайте както предните фикосве...дано да не даде пак Not Responding...

OTL.zip

Пуснах го както трябва да са настройките от предния пост и го пуснах през Run Scan, обаче не съм сигурен не трябва ли да бъде през Run Fix.Нямам си и на понятие казахте както предните логове и го пускам като предните логове със сканирането.

OTL.Txt

Трябва да бъде през Run Fix този път...както при тези инструкции.

Само че в карето копирате съдържанието на файла от прикачения ми коментар тук.

Пуснах го със настройките и със скрипта и от 1 час седи на Not Responding.

ComboFix 11-11-03.01 - aaa 11.2011 г. 21:45:00.1.2 - x86 NETWORK Microsoft Windows 7 Ultimate 6.1.7600.0.1251.359.1026.18.2047.1487 [GMT 2:00] Running from: c:\users\aaa\Downloads\ComboFix.exe AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160} SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} * Created a new restore point . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\program files\Mozilla Firefox\extensions\{C8431CD2-C25A-45F3-BEA9-A9103C31409A} c:\program files\Mozilla Firefox\extensions\{C8431CD2-C25A-45F3-BEA9-A9103C31409A}\chrome.manifest c:\program files\Mozilla Firefox\extensions\{C8431CD2-C25A-45F3-BEA9-A9103C31409A}\chrome\resulturl.jar c:\program files\Mozilla Firefox\extensions\{C8431CD2-C25A-45F3-BEA9-A9103C31409A}\defaults\preferences\prefs.js c:\program files\Mozilla Firefox\extensions\{C8431CD2-C25A-45F3-BEA9-A9103C31409A}\install.rdf c:\program files\StartNow Toolbar c:\program files\StartNow Toolbar\Resources\images\engine_images.png c:\program files\StartNow Toolbar\Resources\images\engine_maps.png c:\program files\StartNow Toolbar\Resources\images\engine_news.png c:\program files\StartNow Toolbar\Resources\images\engine_videos.png c:\program files\StartNow Toolbar\Resources\images\engine_web.png c:\program files\StartNow Toolbar\Resources\images\icon_amazon.png c:\program files\StartNow Toolbar\Resources\images\icon_ebay.png c:\program files\StartNow Toolbar\Resources\images\icon_facebook.png c:\program files\StartNow Toolbar\Resources\images\icon_games.png c:\program files\StartNow Toolbar\Resources\images\icon_msn.png c:\program files\StartNow Toolbar\Resources\images\icon_shopping.png c:\program files\StartNow Toolbar\Resources\images\icon_travel.png c:\program files\StartNow Toolbar\Resources\images\icon_twitter.png c:\program files\StartNow Toolbar\Resources\images\startnow_logo.png c:\program files\StartNow Toolbar\Resources\installer.xml c:\program files\StartNow Toolbar\Resources\protect\index.html c:\program files\StartNow Toolbar\Resources\protect\NotIE6.css c:\program files\StartNow Toolbar\Resources\protect\OnlyIE6.css c:\program files\StartNow Toolbar\Resources\protect\SearchProtectIcon.png c:\program files\StartNow Toolbar\Resources\protect\window.css c:\program files\StartNow Toolbar\Resources\protect\window.js c:\program files\StartNow Toolbar\Resources\reactivate\index.html c:\program files\StartNow Toolbar\Resources\reactivate\LeftImage.png c:\program files\StartNow Toolbar\Resources\reactivate\NotIE6.css c:\program files\StartNow Toolbar\Resources\reactivate\OnlyIE6.css c:\program files\StartNow Toolbar\Resources\reactivate\window.css c:\program files\StartNow Toolbar\Resources\reactivate\window.js c:\program files\StartNow Toolbar\Resources\skin\chevron_button.png c:\program files\StartNow Toolbar\Resources\skin\searchbox_button_hover.png c:\program files\StartNow Toolbar\Resources\skin\searchbox_button_normal.png c:\program files\StartNow Toolbar\Resources\skin\searchbox_dropdown_button_normal.png c:\program files\StartNow Toolbar\Resources\skin\searchbox_input_background.png c:\program files\StartNow Toolbar\Resources\skin\searchbox_input_left.png c:\program files\StartNow Toolbar\Resources\skin\searchbox_input_middle.png c:\program files\StartNow Toolbar\Resources\skin\separator.png c:\program files\StartNow Toolbar\Resources\skin\splitter.png c:\program files\StartNow Toolbar\Resources\skin\toolbarbutton_ff_hover_c.png c:\program files\StartNow Toolbar\Resources\skin\toolbarbutton_ie_hover_c.png c:\program files\StartNow Toolbar\Resources\skin\toolbarbutton_ie_hover_l.png c:\program files\StartNow Toolbar\Resources\skin\toolbarbutton_ie_hover_r.png c:\program files\StartNow Toolbar\Resources\skin\toolbarbutton_ie_normal_c.png c:\program files\StartNow Toolbar\Resources\skin\toolbarbutton_ie_normal_l.png c:\program files\StartNow Toolbar\Resources\skin\toolbarbutton_ie_normal_r.png c:\program files\StartNow Toolbar\Resources\toolbar.xml c:\program files\StartNow Toolbar\StartNowToolbarUninstall.exe c:\program files\StartNow Toolbar\Toolbar32.dll c:\program files\StartNow Toolbar\ToolbarUpdaterService.exe c:\program files\StartNow Toolbar\uninstall.dat c:\programdata\ResultUrl . . ((((((((((((((((((((((((( Files Created from 2011-10-01 to 2011-11-01 ))))))))))))))))))))))))))))))) . . 2011-11-01 19:01 . 2011-11-01 19:34 56200 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{2845506A-CBB0-4238-A7BF-FC741ED92949}\offreg.dll 2011-10-30 05:57 . 2011-10-30 05:57 -------- d-----w- c:\users\aaa\AppData\Local\Solid State Networks 2011-10-30 04:31 . 2011-10-17 23:28 6668624 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{2845506A-CBB0-4238-A7BF-FC741ED92949}\mpengine.dll 2011-10-26 11:07 . 2011-08-15 04:25 6144 ----a-w- c:\program files\Internet Explorer\iecompat.dll 2011-10-24 20:13 . 2011-10-24 20:13 -------- d-----w- c:\users\aaa\AppData\Roaming\freshgames 2011-10-24 15:25 . 2011-10-24 15:33 -------- d-----w- C:\Zylom Games 2011-10-23 11:50 . 2011-10-17 23:28 6668624 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll 2011-10-22 17:34 . 2011-10-22 17:34 -------- d-----w- c:\program files\SummerRush_at 2011-10-22 11:28 . 2011-10-04 14:22 703824 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll 2011-10-22 11:28 . 2011-10-04 14:22 703824 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{C08A6243-700C-47DA-8EC9-BFC6735ADE46}\gapaengine.dll 2011-10-21 19:14 . 2011-10-07 03:48 6668624 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{A1A35898-6E44-4A10-BB8F-00087BA59C02}\mpengine.dll 2011-10-12 10:44 . 2011-08-17 04:26 465408 ----a-w- c:\windows\system32\psisdecd.dll 2011-10-12 10:44 . 2011-08-17 04:22 75776 ----a-w- c:\windows\system32\psisrndr.ax 2011-10-12 10:44 . 2011-08-17 04:22 72704 ----a-w- c:\windows\system32\Mpeg2Data.ax 2011-10-12 10:44 . 2011-08-17 04:22 59904 ----a-w- c:\windows\system32\MSDvbNP.ax 2011-10-12 10:44 . 2011-08-17 04:22 204288 ----a-w- c:\windows\system32\MSNP.ax 2011-10-12 10:44 . 2011-08-27 04:43 571904 ----a-w- c:\windows\system32\oleaut32.dll 2011-10-12 10:44 . 2011-08-27 04:43 233472 ----a-w- c:\windows\system32\oleacc.dll 2011-10-12 10:44 . 2011-09-06 02:38 2332672 ----a-w- c:\windows\system32\win32k.sys 2011-10-11 20:53 . 2011-10-11 20:53 -------- d-----w- c:\users\aaa\AppData\Roaming\funkitron 2011-10-10 20:28 . 2011-10-11 19:07 -------- d-----w- c:\users\aaa\AppData\Roaming\Nitro PDF 2011-10-10 19:06 . 2011-10-10 19:06 -------- d-----w- c:\program files\MyFarmLife2_at 2011-10-04 18:48 . 2011-10-04 18:49 -------- d-----w- c:\program files\Application Updater 2011-10-04 18:48 . 2011-10-04 18:48 -------- d-----w- c:\program files\YouTube Downloader Toolbar 2011-10-04 18:48 . 2011-10-04 18:48 -------- d-----w- c:\program files\Common Files\Spigot . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-09-08 19:05 . 2011-09-08 19:05 40960 ----a-r- c:\users\aaa\AppData\Roaming\Microsoft\Installer\{336DD6B4-B100-4048-B2B7-FBA7059FD959}\NewShortcut3_42519298BFF84444A0D4589027E45BA4.exe 2011-09-08 19:05 . 2011-09-08 19:05 40960 ----a-r- c:\users\aaa\AppData\Roaming\Microsoft\Installer\{336DD6B4-B100-4048-B2B7-FBA7059FD959}\NewShortcut1_42519298BFF84444A0D4589027E45BA4.exe 2011-09-08 19:05 . 2011-09-08 19:05 45056 ----a-r- c:\users\aaa\AppData\Roaming\Microsoft\Installer\{336DD6B4-B100-4048-B2B7-FBA7059FD959}\NewShortcut2_42519298BFF84444A0D4589027E45BA4.exe 2011-08-21 23:49 . 2011-08-21 23:49 444952 ----a-w- c:\windows\system32\wrap_oal.dll 2011-08-21 23:49 . 2011-08-21 23:49 109080 ----a-w- c:\windows\system32\OpenAL32.dll . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}] 2010-09-28 20:44 1400712 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-09-28 1400712] . [HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1] [HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd] . [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] "{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-09-28 1400712] . [HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1] [HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2010-03-26 8546848] "Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2010-05-10 439568] "MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 997920] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "mixer1"=wdmaud.drv . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc] @="Service" . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaMServer] c:\program files\Common Files\Nokia\MPlatform\NokiaMServer [X] . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] 2008-06-11 23:38 34672 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] 2001-07-09 08:50 155648 ----a-w- c:\windows\System32\NeroCheck.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SearchSettings] 2011-09-27 18:34 894304 ----a-w- c:\program files\Common Files\Spigot\Search Settings\SearchSettings.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] 2010-05-14 08:44 248552 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe . R0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-07-28 691696] R1 MpKsl005b71c9;MpKsl005b71c9;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{75777DA6-A01C-4A9D-813C-DBDAA18FA4B4}\MpKsl005b71c9.sys [x] R1 MpKsl041c5650;MpKsl041c5650;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{3DA82EEB-F3F3-459D-93A8-856D7645996E}\MpKsl041c5650.sys [x] R1 MpKsl0838e4a2;MpKsl0838e4a2;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{C52E28A1-D26D-478A-9CC5-F4BEE80AA300}\MpKsl0838e4a2.sys [x] R1 MpKsl095649c1;MpKsl095649c1;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{5154469F-4276-4CA0-96BB-FE0CCB8F65DF}\MpKsl095649c1.sys [x] R1 MpKsl09edc328;MpKsl09edc328;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{8A05F90D-D858-4F2C-BDA4-F4248732CD1E}\MpKsl09edc328.sys [x] R1 MpKsl0a1759be;MpKsl0a1759be;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{C1949665-6441-4243-80DA-A899D41A5356}\MpKsl0a1759be.sys [x] R1 MpKsl0a4d9c9e;MpKsl0a4d9c9e;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{2BEEC0A3-3148-4E6C-A7EF-6C394EDFA141}\MpKsl0a4d9c9e.sys [x] R1 MpKsl0a696dc4;MpKsl0a696dc4;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{6804EB1F-D589-4643-B73D-89B36E3ADDC6}\MpKsl0a696dc4.sys [x] R1 MpKsl0cfffb92;MpKsl0cfffb92;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{7111EA28-0BE7-44B7-9EA3-91C221CC94A1}\MpKsl0cfffb92.sys [x] R1 MpKsl137be284;MpKsl137be284;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{861611C4-4771-46F5-AD93-95AE67A6941E}\MpKsl137be284.sys [x] R1 MpKsl13dce3c4;MpKsl13dce3c4;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{3C2CE6BB-A900-429B-93D6-31B21F828C45}\MpKsl13dce3c4.sys [x] R1 MpKsl1799fd10;MpKsl1799fd10;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{D17A8882-1D6A-4BC5-BD34-41456BAA5BC8}\MpKsl1799fd10.sys [x] R1 MpKsl1bba94a8;MpKsl1bba94a8;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{6741695E-782D-4380-9B2C-6CD4DE6A7253}\MpKsl1bba94a8.sys [x] R1 MpKsl1c57dfa9;MpKsl1c57dfa9;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{34C91D54-65B6-43DF-AB6E-573C4EB3A0CC}\MpKsl1c57dfa9.sys [x] R1 MpKsl1e381103;MpKsl1e381103;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{CAFFFB1F-8E13-4C03-A3A2-20A2D6BD92DF}\MpKsl1e381103.sys [x] R1 MpKsl243b1882;MpKsl243b1882;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{331D99C2-E568-4E2A-9EA3-9DEFCC3B6F2A}\MpKsl243b1882.sys [x] R1 MpKsl24b993fc;MpKsl24b993fc;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{45B4801F-A7F9-4A90-B617-09AED76CA6D8}\MpKsl24b993fc.sys [x] R1 MpKsl262a035a;MpKsl262a035a;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{C4EFA169-ED51-4879-86D1-2D35CFEBD411}\MpKsl262a035a.sys [x] R1 MpKsl2667c1f1;MpKsl2667c1f1;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{75777DA6-A01C-4A9D-813C-DBDAA18FA4B4}\MpKsl2667c1f1.sys [x] R1 MpKsl27507a10;MpKsl27507a10;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{6FA10AFB-9FD9-47B0-B7FE-49EF91D04074}\MpKsl27507a10.sys [x] R1 MpKsl2c7a5e91;MpKsl2c7a5e91;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{D5D7B84F-5A70-4888-B8F0-B9E6148442BD}\MpKsl2c7a5e91.sys [x] R1 MpKsl2ebe87b6;MpKsl2ebe87b6;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{375DD422-1622-4C36-8BA4-77FEA5C1C2BF}\MpKsl2ebe87b6.sys [x] R1 MpKsl349c5d66;MpKsl349c5d66;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{7111EA28-0BE7-44B7-9EA3-91C221CC94A1}\MpKsl349c5d66.sys [x] R1 MpKsl3519028e;MpKsl3519028e;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{60F80059-2841-4C31-845B-BA512E9A0ED9}\MpKsl3519028e.sys [x] R1 MpKsl3693902f;MpKsl3693902f;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{8A05F90D-D858-4F2C-BDA4-F4248732CD1E}\MpKsl3693902f.sys [x] R1 MpKsl3c6f73d6;MpKsl3c6f73d6;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{6FA10AFB-9FD9-47B0-B7FE-49EF91D04074}\MpKsl3c6f73d6.sys [x] R1 MpKsl3d7cd432;MpKsl3d7cd432;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{D5D7B84F-5A70-4888-B8F0-B9E6148442BD}\MpKsl3d7cd432.sys [x] R1 MpKsl3e4e4cb5;MpKsl3e4e4cb5;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{99BD3FCD-E082-4EC0-9613-341540786966}\MpKsl3e4e4cb5.sys [x] R1 MpKsl3e6862dd;MpKsl3e6862dd;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{005FD130-F377-471A-872A-5E1E13757172}\MpKsl3e6862dd.sys [x] R1 MpKsl3eb274cb;MpKsl3eb274cb;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{887F764A-9DB4-4CFD-AA8A-EC97C9887C59}\MpKsl3eb274cb.sys [x] R1 MpKsl43c6ce84;MpKsl43c6ce84;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{65AA18CD-D086-4520-AA4D-55E59FDAC456}\MpKsl43c6ce84.sys [x] R1 MpKsl4523b0d3;MpKsl4523b0d3;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{BCC34721-A9A7-4802-945F-F8A7C22DA3A8}\MpKsl4523b0d3.sys [x] R1 MpKsl45a3035a;MpKsl45a3035a;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{20F946CC-9A6C-4B3F-ABB5-1B2EFE2C2170}\MpKsl45a3035a.sys [x] R1 MpKsl48653cd9;MpKsl48653cd9;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{344E084D-11E6-4BB8-8905-B4F8E530BB52}\MpKsl48653cd9.sys [x] R1 MpKsl4924ce6e;MpKsl4924ce6e;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{0D880922-86B6-4FD4-B66B-530CDF9C68FF}\MpKsl4924ce6e.sys [x] R1 MpKsl4d68bd1e;MpKsl4d68bd1e;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{331D99C2-E568-4E2A-9EA3-9DEFCC3B6F2A}\MpKsl4d68bd1e.sys [x] R1 MpKsl4db75bbf;MpKsl4db75bbf;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{F03DA80B-65D6-4B23-A0D9-B5D98D609DE6}\MpKsl4db75bbf.sys [x] R1 MpKsl52a8750f;MpKsl52a8750f;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{5120813B-AB75-47F9-BEC5-EF89B420157A}\MpKsl52a8750f.sys [x] R1 MpKsl57cfd116;MpKsl57cfd116;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{2BE077FE-6036-4A9C-B694-42454AC387CE}\MpKsl57cfd116.sys [x] R1 MpKsl59025af4;MpKsl59025af4;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{400FF558-F0D6-46E8-9A8B-74F97067043A}\MpKsl59025af4.sys [x] R1 MpKsl5dfe36e2;MpKsl5dfe36e2;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{7111EA28-0BE7-44B7-9EA3-91C221CC94A1}\MpKsl5dfe36e2.sys [x] R1 MpKsl5f0a000f;MpKsl5f0a000f;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{C9551ACE-171C-4D25-815A-7E06773F055B}\MpKsl5f0a000f.sys [x] R1 MpKsl5f65267c;MpKsl5f65267c;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{1A3B333D-7DD6-4D95-AC31-C956ECDB9C6C}\MpKsl5f65267c.sys [x] R1 MpKsl60a16731;MpKsl60a16731;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{E418CFCC-67F5-4332-A85D-2702B8E6AB17}\MpKsl60a16731.sys [x] R1 MpKsl61470183;MpKsl61470183;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{D17A8882-1D6A-4BC5-BD34-41456BAA5BC8}\MpKsl61470183.sys [x] R1 MpKsl64031e4d;MpKsl64031e4d;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{1791F6C0-6613-4A02-9FB0-C6A854858FF0}\MpKsl64031e4d.sys [x] R1 MpKsl6893ddd3;MpKsl6893ddd3;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{75777DA6-A01C-4A9D-813C-DBDAA18FA4B4}\MpKsl6893ddd3.sys [x] R1 MpKsl693af4ec;MpKsl693af4ec;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{531039AE-E769-4CE1-A6CA-2A8FFBE9E47E}\MpKsl693af4ec.sys [x] R1 MpKsl6ab61519;MpKsl6ab61519;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{8A05F90D-D858-4F2C-BDA4-F4248732CD1E}\MpKsl6ab61519.sys [x] R1 MpKsl6c60bc52;MpKsl6c60bc52;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{AB085327-6823-4879-80EF-7E5E89A42E86}\MpKsl6c60bc52.sys [x] R1 MpKsl6c9f9b1a;MpKsl6c9f9b1a;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{7111EA28-0BE7-44B7-9EA3-91C221CC94A1}\MpKsl6c9f9b1a.sys [x] R1 MpKsl6d1e4481;MpKsl6d1e4481;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{95A7F7DF-33FC-4376-BA38-B2610CAB9E1F}\MpKsl6d1e4481.sys [x] R1 MpKsl6da00c1c;MpKsl6da00c1c;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{CE9BF083-0B22-4C27-A090-A66281A62774}\MpKsl6da00c1c.sys [x] R1 MpKsl70791b08;MpKsl70791b08;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{5B96C034-2E42-44AE-B72A-8FF68DC1B55E}\MpKsl70791b08.sys [x] R1 MpKsl70a993d5;MpKsl70a993d5;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{C4C2B77C-E103-4FE5-8EA7-40B91D90CA0F}\MpKsl70a993d5.sys [x] R1 MpKsl729f7c5b;MpKsl729f7c5b;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{93F79CA4-EFBB-41B0-AEDB-219F6DFEE922}\MpKsl729f7c5b.sys [x] R1 MpKsl7392b5e7;MpKsl7392b5e7;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{4C739FF2-3237-4EDE-9654-F05F9028AFC8}\MpKsl7392b5e7.sys [x] R1 MpKsl75b68bde;MpKsl75b68bde;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{C12F5BA2-5005-435B-99C5-1B19205814B1}\MpKsl75b68bde.sys [x] R1 MpKsl75f359bb;MpKsl75f359bb;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{4E007D89-C6FC-43D2-A165-45C2878340B8}\MpKsl75f359bb.sys [x] R1 MpKsl776dca5b;MpKsl776dca5b;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{6FC7F3DA-65EB-45DF-9ABC-A8F3434F626B}\MpKsl776dca5b.sys [x] R1 MpKsl792f8562;MpKsl792f8562;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{8A05F90D-D858-4F2C-BDA4-F4248732CD1E}\MpKsl792f8562.sys [x] R1 MpKsl7cd2a442;MpKsl7cd2a442;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{E82FEE1F-747B-4C16-A957-44237E3B59F9}\MpKsl7cd2a442.sys [x] R1 MpKsl7e5a6748;MpKsl7e5a6748;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{589687FB-A534-4A35-B8A2-3C51002FD950}\MpKsl7e5a6748.sys [x] R1 MpKsl7f6cf8b1;MpKsl7f6cf8b1;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{0D880922-86B6-4FD4-B66B-530CDF9C68FF}\MpKsl7f6cf8b1.sys [x] R1 MpKsl828b6afd;MpKsl828b6afd;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{4E19CF24-9AC3-42A1-B097-095236E5F437}\MpKsl828b6afd.sys [x] R1 MpKsl8453ae84;MpKsl8453ae84;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{EE2F59BE-6236-44EC-ADA3-87590CE6B6BB}\MpKsl8453ae84.sys [x] R1 MpKsl8515816e;MpKsl8515816e;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{549BCE30-6CC1-4CB5-BD5A-BF4AE63EF252}\MpKsl8515816e.sys [x] R1 MpKsl8635badf;MpKsl8635badf;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{7C6A720A-C6CD-456C-9271-EE30393F614D}\MpKsl8635badf.sys [x] R1 MpKsl86d0d4b9;MpKsl86d0d4b9;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{4E19CF24-9AC3-42A1-B097-095236E5F437}\MpKsl86d0d4b9.sys [x] R1 MpKsl86e66439;MpKsl86e66439;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{45B4801F-A7F9-4A90-B617-09AED76CA6D8}\MpKsl86e66439.sys [x] R1 MpKsl8c8a90e2;MpKsl8c8a90e2;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{9C3F943A-E82F-4CA6-8677-3F6CE65F9328}\MpKsl8c8a90e2.sys [x] R1 MpKsl8d11a5fa;MpKsl8d11a5fa;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{F03DA80B-65D6-4B23-A0D9-B5D98D609DE6}\MpKsl8d11a5fa.sys [x] R1 MpKsl8e5b2e1f;MpKsl8e5b2e1f;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{B6951454-A5D4-4496-9589-35DD744C6D85}\MpKsl8e5b2e1f.sys [x] R1 MpKsl8feb96d1;MpKsl8feb96d1;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{DE572B10-40CC-43CE-977A-D93DB73040EB}\MpKsl8feb96d1.sys [x] R1 MpKsl904a48d8;MpKsl904a48d8;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{F027574C-E0CB-4C09-A2AE-80568B7F324C}\MpKsl904a48d8.sys [x] R1 MpKsl915dbf34;MpKsl915dbf34;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{5154469F-4276-4CA0-96BB-FE0CCB8F65DF}\MpKsl915dbf34.sys [x] R1 MpKsl937d58b4;MpKsl937d58b4;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{441AABAE-955F-4758-B7EC-C9D6D998E041}\MpKsl937d58b4.sys [x] R1 MpKsl9d20d2e6;MpKsl9d20d2e6;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{4E007D89-C6FC-43D2-A165-45C2878340B8}\MpKsl9d20d2e6.sys [x] R1 MpKsla0081b4a;MpKsla0081b4a;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{B239952E-82C7-4945-95D0-3775360C0D7A}\MpKsla0081b4a.sys [x] R1 MpKsla17aae2a;MpKsla17aae2a;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{787A6628-5F98-4F2B-9917-61373708F70B}\MpKsla17aae2a.sys [x] R1 MpKsla3e258c3;MpKsla3e258c3;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{AE7EB91B-5E2F-442A-BA99-468B509C7D45}\MpKsla3e258c3.sys [x] R1 MpKsla5e3a7dd;MpKsla5e3a7dd;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{C9551ACE-171C-4D25-815A-7E06773F055B}\MpKsla5e3a7dd.sys [x] R1 MpKsla6d1dab9;MpKsla6d1dab9;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{2BE077FE-6036-4A9C-B694-42454AC387CE}\MpKsla6d1dab9.sys [x] R1 MpKsla8a47d6a;MpKsla8a47d6a;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{2F32A5F4-514E-49A5-9A61-4BF9BFEB1CFF}\MpKsla8a47d6a.sys [x] R1 MpKslafa4be2c;MpKslafa4be2c;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{17939E1E-7451-404D-A773-DDC76A768DD8}\MpKslafa4be2c.sys [x] R1 MpKslb04bb174;MpKslb04bb174;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{DE572B10-40CC-43CE-977A-D93DB73040EB}\MpKslb04bb174.sys [x] R1 MpKslb0bfb2c6;MpKslb0bfb2c6;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{0CBF552F-02A2-4AB1-B8AA-BA3F6C0ECD2C}\MpKslb0bfb2c6.sys [x] R1 MpKslb1d8bce7;MpKslb1d8bce7;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{CE9BF083-0B22-4C27-A090-A66281A62774}\MpKslb1d8bce7.sys [x] R1 MpKslb4ec2df1;MpKslb4ec2df1;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{6D853D4F-0101-4A80-B4A5-CCDD3F7F760D}\MpKslb4ec2df1.sys [x] R1 MpKslbcb4a941;MpKslbcb4a941;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{1D0138D2-59C0-40A2-8645-0B8C5DED57BE}\MpKslbcb4a941.sys [x] R1 MpKslc13c7409;MpKslc13c7409;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{400FF558-F0D6-46E8-9A8B-74F97067043A}\MpKslc13c7409.sys [x] R1 MpKslc38fdc83;MpKslc38fdc83;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{84FBBBEF-E7E8-4380-AFAB-21C16C65649B}\MpKslc38fdc83.sys [x] R1 MpKslc53eeee7;MpKslc53eeee7;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{B2443DD9-8536-4FAC-B089-A88212D749B7}\MpKslc53eeee7.sys [x] R1 MpKslc75b2af4;MpKslc75b2af4;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{93F79CA4-EFBB-41B0-AEDB-219F6DFEE922}\MpKslc75b2af4.sys [x] R1 MpKslc9208b22;MpKslc9208b22;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{9F353154-FC6C-4939-AB65-8AEE398E17C7}\MpKslc9208b22.sys [x] R1 MpKslcdb0ba85;MpKslcdb0ba85;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{17939E1E-7451-404D-A773-DDC76A768DD8}\MpKslcdb0ba85.sys [x] R1 MpKslce0b0624;MpKslce0b0624;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{AA52A4A7-36A7-40B2-8A47-5323926B5455}\MpKslce0b0624.sys [x] R1 MpKslcf2f1405;MpKslcf2f1405;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{C4EFA169-ED51-4879-86D1-2D35CFEBD411}\MpKslcf2f1405.sys [x] R1 MpKslcf57a0f1;MpKslcf57a0f1;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{3675BB2B-0D8F-4A4E-8358-4987BE2D2502}\MpKslcf57a0f1.sys [x] R1 MpKsld2487035;MpKsld2487035;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{450BFCC0-1183-4599-9EF7-2939511EF1A1}\MpKsld2487035.sys [x] R1 MpKsld29f8621;MpKsld29f8621;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{A431F712-236A-4B31-BB12-E7E05E7549E4}\MpKsld29f8621.sys [x] R1 MpKsld74f4932;MpKsld74f4932;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{CB3D47BA-4CCC-469D-A0D2-D1328194C3E7}\MpKsld74f4932.sys [x] R1 MpKsld9bb2836;MpKsld9bb2836;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{DAC94B87-E0EB-4F5E-A123-940D2DD7C669}\MpKsld9bb2836.sys [x] R1 MpKslda41ebb8;MpKslda41ebb8;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{C12F5BA2-5005-435B-99C5-1B19205814B1}\MpKslda41ebb8.sys [x] R1 MpKsldafe0eb8;MpKsldafe0eb8;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{0ABDB6C8-1D49-4D29-B076-1DCC723C42DC}\MpKsldafe0eb8.sys [x] R1 MpKsle0c5a6a0;MpKsle0c5a6a0;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{89894B31-38E4-4B9F-A6B3-EAFD6F281638}\MpKsle0c5a6a0.sys [x] R1 MpKsle2bfd994;MpKsle2bfd994;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{ADEBCD9C-2E44-46A3-8A62-A189AFBA9099}\MpKsle2bfd994.sys [x] R1 MpKsle36d1cc1;MpKsle36d1cc1;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{46A2755D-5172-4442-A4B8-9B55388C260B}\MpKsle36d1cc1.sys [x] R1 MpKsle5e788e2;MpKsle5e788e2;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{DD29D510-3171-4439-9AF2-87425183D146}\MpKsle5e788e2.sys [x] R1 MpKsle6126920;MpKsle6126920;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{861611C4-4771-46F5-AD93-95AE67A6941E}\MpKsle6126920.sys [x] R1 MpKsle724100e;MpKsle724100e;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{4E007D89-C6FC-43D2-A165-45C2878340B8}\MpKsle724100e.sys [x] R1 MpKsle7c0eb89;MpKsle7c0eb89;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{AA52A4A7-36A7-40B2-8A47-5323926B5455}\MpKsle7c0eb89.sys [x] R1 MpKsle91d3a2f;MpKsle91d3a2f;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{C1DA8789-9055-4DE3-8172-9A1DC720E758}\MpKsle91d3a2f.sys [x] R1 MpKslec72e07c;MpKslec72e07c;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{1791F6C0-6613-4A02-9FB0-C6A854858FF0}\MpKslec72e07c.sys [x] R1 MpKslef2f3580;MpKslef2f3580;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{344E084D-11E6-4BB8-8905-B4F8E530BB52}\MpKslef2f3580.sys [x] R1 MpKslf2c79a31;MpKslf2c79a31;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{F476747C-601B-4878-8EAE-E427F1A4575F}\MpKslf2c79a31.sys [x] R1 MpKslf37bf894;MpKslf37bf894;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{344E084D-11E6-4BB8-8905-B4F8E530BB52}\MpKslf37bf894.sys [x] R1 MpKslf468fa72;MpKslf468fa72;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{FE397A6B-D32E-4663-98A3-9D721145FDB3}\MpKslf468fa72.sys [x] R1 MpKslf5b32479;MpKslf5b32479;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{93F79CA4-EFBB-41B0-AEDB-219F6DFEE922}\MpKslf5b32479.sys [x] R1 MpKslf693490a;MpKslf693490a;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{6D853D4F-0101-4A80-B4A5-CCDD3F7F760D}\MpKslf693490a.sys [x] R1 MpKslf8ccc075;MpKslf8ccc075;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{60F80059-2841-4C31-845B-BA512E9A0ED9}\MpKslf8ccc075.sys [x] R1 MpKslf9685d17;MpKslf9685d17;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{68D1046D-6AC9-4B96-8FEC-9DEA1D7E2182}\MpKslf9685d17.sys [x] R1 MpKslfb3deecd;MpKslfb3deecd;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{E82FEE1F-747B-4C16-A957-44237E3B59F9}\MpKslfb3deecd.sys [x] R1 MpKslfc06698f;MpKslfc06698f;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{C4CC16B1-9E45-4BF1-A5E2-413469CB4950}\MpKslfc06698f.sys [x] R2 Application Updater;Application Updater;c:\program files\Application Updater\ApplicationUpdater.exe [2011-09-27 745880] R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 gupdate;Услуга Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-12-03 136176] R2 NitroReaderDriverReadSpool2;NitroPDFReaderDriverCreatorReadSpool2;c:\program files\Nitro PDF\Reader 2\NitroPDFReaderDriverService2.exe [2011-06-21 196912] R2 ProgDVBService;ProgDVB Scheduler Service;d:\progdvb\ProgDVBService.exe [x] R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2010-07-09 248936] R3 DfSdkS;Defragmentation-Service;d:\program files\Optimaze\Ashampoo WinOptimizer 7\Dfsdks.exe [x] R3 gupdatem;Услуга на Google Актуализация (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-12-03 136176] R3 maconfservice;Ma-Config Service;D:\maconfservice.exe [x] R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [2011-04-18 43392] R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2011-04-27 65024] R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-04-27 208944] R3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [2011-05-18 137600] R3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [2011-05-18 8576] R3 SRS_HDAL_Service;HD Audio Lab;c:\windows\system32\drivers\SRS_HDAL_i386.sys [2010-07-02 384752] . . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalServiceAndNoImpersonation REG_MULTI_SZ SSDPSRV upnphost SCardSvr TBS FontCache fdrespub AppIDSvc QWAVE wcncsvc SensrSvc . HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs UxTuneUp . Contents of the 'Scheduled Tasks' folder . 2011-10-29 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-12-03 20:10] . 2011-10-29 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-12-03 20:10] . 2011-10-29 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2009730399-2077631254-3856565585-1003Core.job - c:\users\aaa\AppData\Local\Google\Update\GoogleUpdate.exe [2011-06-24 20:21] . 2011-10-29 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2009730399-2077631254-3856565585-1003UA.job - c:\users\aaa\AppData\Local\Google\Update\GoogleUpdate.exe [2011-06-24 20:21] . . ------- Supplementary Scan ------- . uLocal Page = hxxp://jookz.toolbaroptions.com/?tmp=toolbar_results_jookz_v2_homepage&prt=jkwbtb04ie&v=15 uStart Page = hxxp://start.casualgames.com/?o=shp mLocal Page = hxxp://jookz.toolbaroptions.com/?tmp=toolbar_results_jookz_v2_homepage&prt=jkwbtb04ie&v=15 uInternet Settings,ProxyOverride = *.local IE: &С&валяне &с BitComet - d:\bitcomet\BitComet.exe/AddLink.htm IE: &С&валяне на всички видео файлове с BitComet - d:\bitcomet\BitComet.exe/AddVideo.htm IE: &С&валяне на всички с BitComet - d:\bitcomet\BitComet.exe/AddAllLink.htm IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html TCP: DhcpNameServer = 217.10.240.2 217.10.240.242 . - - - - ORPHANS REMOVED - - - - . URLSearchHooks-{3a750e59-9048-456b-a7f9-4d22dcb583f3} - (no file) URLSearchHooks-{7757CBCC-0975-4b79-A519-90B142CA3A23} - (no file) BHO-{D496B221-52BB-4DA7-B5E7-4442022F207D} - (no file) Toolbar-{648ADDE1-369B-4868-A419-0B67EBFD8F73} - (no file) WebBrowser-{30F9B915-B755-4826-820B-08FBA6BD249D} - (no file) WebBrowser-{648ADDE1-369B-4868-A419-0B67EBFD8F73} - (no file) MSConfigStartUp-NSU_agent - c:\program files\Nokia\Nokia Software Updater\nsu3ui_agent.exe AddRemove-BFG-Aztec Tribe - New Land - c:\program files\Aztec Tribe - New Land\Uninstall.exe AddRemove-BFG-Youda Survivor 2 - c:\program files\Youda Survivor 2\Uninstall.exe AddRemove-CCleaner - d:\my programs\CCleaner\uninst.exe AddRemove-Chloes Dream Resort Free Trial_is1 - c:\program files\ChloesDreamResort_at\unins000.exe AddRemove-Dream Inn Free Trial_is1 - c:\program files\DreamInn_at\unins000.exe AddRemove-Farm Craft Free Trial_is1 - c:\program files\FarmCraft_at\unins000.exe AddRemove-Fate of the Pharaoh Free Trial_is1 - c:\program files\FateofthePharaoh_at\unins000.exe AddRemove-My Kingdom for the Princess 3 Free Trial_is1 - c:\program files\MyKingdomforthePrincess3_at\unins000.exe AddRemove-PhotoScape - d:\my programs\PhotoScape\uninstall.exe AddRemove-Roads of Rome 3 Free Trial_is1 - c:\program files\RoadsofRome3_at\unins000.exe AddRemove-SopCast - d:\my programs\SopCast\uninst.exe AddRemove-SpeedFan - d:\speedfan\uninstall.exe AddRemove-StartNow Toolbar - c:\program files\StartNow Toolbar\StartNowToolbarUninstall.exe AddRemove-The KMPlayer - d:\my programs\The KMPlayer\uninstall.exe AddRemove-Veetle TV - d:\my programs\Veetle\UninstallVeetleTV.exe AddRemove-Virtual Farm 2 Free Trial_is1 - c:\program files\VirtualFarm2_at\unins000.exe AddRemove-VLC media player - d:\my programs\VLC\uninstall.exe AddRemove-{08234a0d-cf39-4dca-99f0-0c5cb496da81} - c:\program files\Bing Bar Installer\InstallManager.exe AddRemove-{1a413f37-ed88-4fec-9666-5c48dc4b7bb7} - d:\youtube downloader\uninstall.exe AddRemove-Тридевятая ферма - c:\program files\Alawar.ru\Тридевятая ферма\Uninstall.exe AddRemove-Counter-Strike 1.6: New Era - D:\uninst.exe AddRemove-{C1080852-065E-4991-9260-F3756E3CC182} - c:\users\aaa\AppData\Local\{E568B6A0-8E02-46C8-8954-00ECD7CD3554}\CursorFX_setup.exe . . . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_USERS\S-1-5-21-2009730399-2077631254-3856565585-1003\Software\SecuROM\License information*] "datasecu"=hex:94,83,3f,d4,84,28,b7,04,dc,04,98,2f,01,5e,04,22,6b,21,56,09,02, c1,34,e4,2a,e1,a8,8e,6b,4c,04,51,f0,8c,e6,fc,e9,5a,a4,22,93,4c,a0,ae,97,c6,\ "rkeysecu"=hex:29,23,be,84,e1,6c,d6,ae,52,90,49,f1,f1,bb,e9,eb . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Completion time: 2011-11-01 21:59:48 ComboFix-quarantined-files.txt 2011-11-01 19:59 . Pre-Run: 1 404 121 088 bytes free Post-Run: 1 222 160 384 bytes free . - - End Of File - - 4A267D426C0BE9CF8B2E02C9B63724EE

Пуснах го със настройките и със скрипта и от 1 час седи на Not Responding.

Ок...ще чистим запис по запис...само че в момента отново съм работа.

Ще е пак към 23.00 часа.

@DOBREWSKI7 не стартирайте толкова мощни програми без да ви е казано да го направите!

Ако сте заразен, прочетете тази тема - Системата ми е инфектирана - Какво да правя сега? и си отворете собствена тема, не пишете в чужди!

Да разбира се няма проблем. Лек работен ден до по-късно.

yoleks

Желателно е да смените аватара си !!!

Извинявам се,поне така може ли ?

За предпочитане е нещо без полови органи. Тук е сериозен форум...