facebook virus [РЕШЕН]

3 ноември 201114 г.

Добре...да опитаме с друг инструмент.

Изтеглете Threat Killer.exe и го запазете на вашия десктоп.

Инсталирайте приложението, сложете отметка пред Create a desktop icon и го стартирайте.

Изтеглете прикачения файл. fix.txt

Кликнете на бутона с трите точки и посочете файла fix.txt

Натиснете бутона Execute.

Публикувайте лог файла в следващия си пост.

3 ноември 201114 г.

Автор

Свалих всичко пуснах го и ми изписа The file is not a valid script. Махнах всичко свалих го наново и повторих и пак същото.

3 ноември 201114 г.

Да така е. Опитайте с този.

script_example.txt

4 ноември 201114 г.

Автор

Threat Killer - Scriptable Malware Remover 1.7.3.0 http://www.novirusthanks.org Log started on 11/4/2011 at 11:37:21 AM Windows 7 Home Premium 6.1 64-bit OS [+] Script Executer Log: (stop drivers) C:\Windows\SysNative\drivers\epfwwfpr.sys -> Error: Driver does not exist (stop drivers) C:\Windows\SysNative\drivers\ehdrv.sys -> Error: Driver does not exist (stop drivers) C:\Windows\SysNative\drivers\eamon.sys -> Error: Driver does not exist (unload drivers) C:\Windows\SysNative\drivers\epfwwfpr.sys -> Error: Driver does not exist (unload drivers) C:\Windows\SysNative\drivers\ehdrv.sys -> Error: Driver does not exist (unload drivers) C:\Windows\SysNative\drivers\eamon.sys -> Error: Driver does not exist Backup of C:\Windows\SysNative\drivers\epfwwfpr.sys completed. -> epfwwfpr.sys_11-4-2011_11_37_21 AM_ada75e19e22386608da20c174f3e978a (delete drivers) C:\Windows\SysNative\drivers\epfwwfpr.sys -> Deleted (Need Reboot) Backup of C:\Windows\SysNative\drivers\ehdrv.sys completed. -> ehdrv.sys_11-4-2011_11_37_21 AM_15e6b6f1b574eed0511498d0c2cb168d (delete drivers) C:\Windows\SysNative\drivers\ehdrv.sys -> Deleted (Need Reboot) Backup of C:\Windows\SysNative\drivers\eamon.sys completed. -> eamon.sys_11-4-2011_11_37_21 AM_0abccfbef6b3d1068f48c9d98bc0e3a4 (delete drivers) C:\Windows\SysNative\drivers\eamon.sys -> Deleted (Need Reboot) (delete folders) C:\Program Files (x86)\AVG\ -> Error: Folder does not exists (delete folders) C:\Program Files (x86)\Kaspersky Lab\ -> Error: Folder does not exists (delete folders) C:\Program Files\ESET\ -> Error: Folder does not exists Backup of C:\Program Files (x86)\NoVirusThanks\Threat Killer\Temp\2012\ completed. -> folder_1.zip (delete folders) C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky Anti-Virus 2012\ -> Backup of file Backup of C:\Program Files (x86)\NoVirusThanks\Threat Killer\Temp\Systweak\ completed. -> folder_2.zip (delete folders) C:\ProgramData\Systweak\ -> Backup of file Backup of C:\Program Files (x86)\NoVirusThanks\Threat Killer\Temp\Systweak\ completed. -> folder_3.zip (delete folders) C:\Users\el\AppData\Roaming\Systweak\ -> Backup of file Backup of C:\Program Files (x86)\NoVirusThanks\Threat Killer\Temp\Fighters\ completed. -> folder_4.zip (delete folders) C:\Users\el\AppData\Roaming\Fighters\ -> Error: The directory is not empty Backup of C:\Program Files (x86)\NoVirusThanks\Threat Killer\Temp\Fighters\ completed. -> folder_5.zip (delete folders) C:\ProgramData\Fighters\ -> Error: The directory is not empty Backup of C:\Program Files (x86)\NoVirusThanks\Threat Killer\Temp\Mechanic\ completed. -> folder_6.zip (delete folders) C:\Users\el\AppData\Roaming\Registry Mechanic\ -> Backup of file Backup of C:\Program Files (x86)\NoVirusThanks\Threat Killer\Temp\Software\ completed. -> folder_7.zip (delete folders) C:\Users\el\AppData\Roaming\TuneUp Software\ -> Error: The directory is not empty Backup of C:\Program Files (x86)\NoVirusThanks\Threat Killer\Temp\2011\ completed. -> folder_8.zip (delete folders) C:\Program Files (x86)\TuneUp Utilities 2011\ -> Error: The directory is not empty Backup of C:\Program Files (x86)\NoVirusThanks\Threat Killer\Temp\Software\ completed. -> folder_9.zip (delete folders) C:\ProgramData\TuneUp Software\ -> Error: The directory is not empty Backup of C:\Program Files (x86)\NoVirusThanks\Threat Killer\Temp\AVG2012\ completed. -> folder_10.zip (delete folders) C:\Users\el\AppData\Roaming\AVG2012\ -> Error: The directory is not empty Backup of C:\Program Files (x86)\NoVirusThanks\Threat Killer\Temp\MFAData\ completed. -> folder_11.zip (delete folders) C:\ProgramData\MFAData\ -> Error: The directory is not empty Backup of C:\Program Files (x86)\NoVirusThanks\Threat Killer\Temp\Destroy\ completed. -> folder_12.zip (delete folders) C:\ProgramData\Spybot - Search & Destroy\ -> Error: The directory is not empty Backup of C:\Users\el\AppData\Local\Google\Chrome\User Data\Default\Extensions\jmfkcklnlgedgbglfkkgedjfmejoahla\12.0.0.1804_0\plugins/avgnpss.dll failed. (delete files) C:\Users\el\AppData\Local\Google\Chrome\User Data\Default\Extensions\jmfkcklnlgedgbglfkkgedjfmejoahla\12.0.0.1804_0\plugins/avgnpss.dll -> Error: The system cannot find the path specified Backup of C:\Windows\WSYS049.SYS completed. -> WSYS049.SYS_11-4-2011_11_37_21 AM_1b34d2d3a0240bfe4e6628d0e37db0b2 (delete files) C:\Windows\WSYS049.SYS -> Deleted Backup of C:\Windows\AutoKMS.ini completed. -> AutoKMS.ini_11-4-2011_11_37_21 AM_48a77273e8c545dcb70eee3866cd2123 (delete files) C:\Windows\AutoKMS.ini -> Deleted End.

4 ноември 201114 г.

Така...да видим какво остава:

Стартирайте отново OTL и натиснете бутона Quick Scan без да копирате скриптове под . Прикачете в следващия си коментар (погледнете опцията "прикачени файлове", когато публикувате мнение) логa - OTL.Txt.

4 ноември 201114 г.

Автор

Готово

OTL.Txt

4 ноември 201114 г.

Този път са по-малко боклуците и дано да се получи.

Стартирайте OTL и под копирайте следната информация:

:OTL

FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files (x86)\AVG\AVG2012\Firefox4\

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2012\FFExt\[email protected]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2012\FFExt\[email protected]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\[email protected]: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird

File not found (No name found) -- C:\USERS\EL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\TK8UNRHI.DEFAULT\EXTENSIONS\AVG@TOOLBAR

CHR - plugin: AVG Internet Security (Enabled) = C:\Users\el\AppData\Local\Google\Chrome\User Data\Default\Extensions\jmfkcklnlgedgbglfkkgedjfmejoahla\12.0.0.1804_0\plugins/avgnpss.dll

O2:64bit: - BHO: (no name) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - No CLSID value found.

O2:64bit: - BHO: (no name) - {E33CF602-D945-461A-83F0-819F76A199F8} - No CLSID value found.

O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_15)

O34 - HKLM BootExecute: (c:\progra~2\avg\avg2012\avgrsa.exe /sync /restart)

[2011/10/28 16:53:56 | 000,000,000 | ---D | C] -- C:\Users\el\AppData\Roaming\Fighters

[2011/10/28 16:53:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Fighters

[2011/09/08 19:31:20 | 000,000,000 | ---D | M] -- C:\Users\el\AppData\Roaming\AVG2012

[2011/10/30 14:02:08 | 000,000,000 | ---D | M] -- C:\Users\el\AppData\Roaming\TuneUp Software

[2010/03/24 18:23:31 | 000,000,020 | ---- | M] ()(C:\Windows\?o„) -- C:\Windows\œõ„

[2010/03/24 18:23:30 | 000,000,020 | ---- | C] ()(C:\Windows\?o„) -- C:\Windows\œõ„

@Alternate Data Stream - 112 bytes -> C:\ProgramData\Temp:D1B5B4F1

:commands

[reboot]

Натиснете Run Fix и публикувайте лог файла след рестарта.

След това мисля да приключваме.

4 ноември 201114 г.

Автор

Да само,че продължава да ми дава Not Responding. А друго нещо? Антивирусна програма може ли да ми препоръчате която да сваля.

4 ноември 201114 г.

Така става като качвате по 5 антивирусни...

Да махнем поне най-важните остатъци:

Изтеглете Autoruns.

Отидете до секцията Boot Execute и изтрийте реда свързан с AVG.

Изтрийте ръчно следните папки:

C:\Users\el\AppData\Roaming\Fighters

C:\ProgramData\Fighters

C:\Users\el\AppData\Roaming\AVG2012

C:\Users\el\AppData\Roaming\TuneUp Software

Ако видите следните папки:

C:\Program Files\ESET

C:\Program Files (x86)\Kaspersky Lab

C:\Program Files (x86)\AVG

Изтрийте и тях. След това ще опитаме отново с OTL да махнем и последните истатъци.

За антивирусна изберете си само една от следните - AVG, Avira, avast!, MSE или целия пакет на COMODO Internet Security.

Има и други комбинации, но повечко материали има в основния форум за раздел сигурност.

4 ноември 201114 г.

Автор

Няма нищо във Autorun напълно празно е. Имам предвид отидох на Boot Execute и няма нищо Имам предвид отидох на Boot Execute и няма нищо. Колкото до папките намерих само тази директория и другите ги няма. C:\ProgramData\Fighters

4 ноември 201114 г.

Ок...направете нова бърза проверка с OTL - QuickScan и публикувайте резултата.

4 ноември 201114 г.

Автор

OTL logfile created on: 11/4/2011 3:19:49 PM - Run 6

OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\el\Desktop

64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 8.0.7601.17514)

Locale: 00000409 | Country: Bulgaria | Language: BGR | Date Format: d.M.yyyy 'г.'

3.93 Gb Total Physical Memory | 2.57 Gb Available Physical Memory | 65.49% Memory free

7.86 Gb Paging File | 6.38 Gb Available in Paging File | 81.20% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 446.07 Gb Total Space | 313.45 Gb Free Space | 70.27% Space Free | Partition Type: NTFS

Drive D: | 19.39 Gb Total Space | 3.12 Gb Free Space | 16.11% Space Free | Partition Type: NTFS

Drive E: | 99.02 Mb Total Space | 95.10 Mb Free Space | 96.04% Space Free | Partition Type: FAT32

Computer Name: PENCHO | User Name: el | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/11/03 00:39:47 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\el\Desktop\OTL.exe

PRC - [2011/06/06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

PRC - [2011/03/28 16:07:50 | 000,094,264 | ---- | M] (Hewlett-Packard Company) -- C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe

PRC - [2010/03/10 23:22:04 | 000,599,408 | ---- | M] (Citrix Systems, Inc.) -- C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe

PRC - [2010/03/10 23:21:16 | 000,300,400 | ---- | M] (Citrix Systems, Inc.) -- C:\Program Files (x86)\Citrix\ICA Client\concentr.exe

PRC - [2009/12/01 12:37:48 | 000,322,624 | ---- | M] (DigitalPersona, Inc.) -- C:\Program Files (x86)\DigitalPersona\Bin\DpHostW.exe

PRC - [2009/12/01 12:37:46 | 000,842,816 | ---- | M] (DigitalPersona, Inc.) -- C:\Program Files (x86)\DigitalPersona\Bin\DpAgent.exe

PRC - [2009/10/06 08:08:42 | 000,210,216 | ---- | M] (CyberLink) -- c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe

========== Modules (No Company Name) ==========

MOD - [2011/03/16 23:11:16 | 004,297,568 | ---- | M] () -- C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF

MOD - [2010/10/20 14:45:26 | 008,801,120 | ---- | M] () -- C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveIntlResource.dll

MOD - [2009/10/06 08:08:38 | 000,931,112 | ---- | M] () -- c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMediaLibrary.dll

MOD - [2009/08/20 21:35:48 | 007,745,536 | ---- | M] () -- C:\Program Files (x86)\Common Files\LightScribe\QtGui4.dll

MOD - [2009/08/20 21:35:46 | 002,121,728 | ---- | M] () -- C:\Program Files (x86)\Common Files\LightScribe\QtCore4.dll

MOD - [2009/08/20 21:35:46 | 000,135,168 | ---- | M] () -- C:\Program Files (x86)\Common Files\LightScribe\plugins\imageformats\qjpeg4.dll

========== Win32 Services (SafeList) ==========

SRV:64bit: - [2011/01/12 15:57:54 | 001,430,800 | ---- | M] (Intel® Corporation) [Auto | Running] -- C:\Program Files\Intel\WiFi\bin\EvtEng.exe -- (EvtEng)

SRV:64bit: - [2011/01/12 15:38:18 | 000,340,240 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe -- (MyWiFiDHCPDNS)

SRV:64bit: - [2011/01/12 15:36:22 | 000,840,976 | ---- | M] (Intel® Corporation) [Auto | Running] -- C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe -- (RegSrvc)

SRV:64bit: - [2010/11/11 00:47:57 | 000,247,808 | ---- | M] (IDT, Inc.) [Auto | Running] -- C:\Windows\SysNative\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_70dacb64382a61a7\stacsv64.exe -- (STacSV)

SRV:64bit: - [2010/11/11 00:47:56 | 000,089,600 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Windows\SysNative\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_70dacb64382a61a7\AESTSr64.exe -- (AESTFilters)

SRV:64bit: - [2010/09/22 17:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)

SRV:64bit: - [2009/09/04 22:35:12 | 000,873,248 | ---- | M] (Broadcom Corporation.) [Auto | Running] -- C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe -- (btwdins)

SRV:64bit: - [2009/07/14 02:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)

SRV:64bit: - [2009/07/13 07:18:24 | 001,924,400 | ---- | M] (Validity Sensors, Inc.) [Auto | Running] -- C:\Windows\SysNative\vcsFPService.exe -- (vcsFPService)

SRV:64bit: - [2009/07/08 22:49:02 | 000,030,520 | ---- | M] (Hewlett-Packard) [Auto | Running] -- C:\Windows\SysNative\hpservice.exe -- (hpsrv)

SRV - [2011/06/21 14:57:34 | 000,085,560 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe -- (HP Support Assistant Service)

SRV - [2011/06/06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)

SRV - [2011/03/28 16:07:50 | 000,094,264 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe -- (HPDrvMntSvc.exe)

SRV - [2011/03/27 09:32:25 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)

SRV - [2010/03/18 12:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)

SRV - [2009/12/01 12:37:48 | 000,322,624 | ---- | M] (DigitalPersona, Inc.) [Auto | Running] -- C:\Program Files (x86)\DigitalPersona\Bin\DpHostW.exe -- (DpHost)

SRV - [2009/07/13 07:04:26 | 001,656,112 | ---- | M] (Validity Sensors, Inc.) [Auto | Running] -- C:\Windows\SysWOW64\vcsFPService.exe -- (vcsFPService)

SRV - [2009/06/10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)

SRV - [2009/02/22 12:00:00 | 000,129,584 | ---- | M] (EasyBits Sofware AS) [Auto | Running] -- C:\Windows\SysWOW64\ezsvc7.dll -- (ezSharedSvc)

========== Driver Services (SafeList) ==========

DRV:64bit: - [2011/09/09 22:56:40 | 000,270,912 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\dtsoftbus01.sys -- (dtsoftbus01)

DRV:64bit: - [2011/09/09 15:54:32 | 000,526,392 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\sptd.sys -- (sptd)

DRV:64bit: - [2011/05/08 12:42:52 | 000,311,968 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysNative\drivers\atksgt.sys -- (atksgt)

DRV:64bit: - [2011/05/08 12:42:37 | 000,043,168 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\lirsgt.sys -- (lirsgt)

DRV:64bit: - [2011/03/11 07:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)

DRV:64bit: - [2011/03/11 07:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)

DRV:64bit: - [2011/01/19 11:28:55 | 008,080,384 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NETwNs64.sys -- (NETwNs64) ___ Intel®

DRV:64bit: - [2010/12/07 13:23:02 | 000,034,304 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lgandmodem64.sys -- (ANDModem)

DRV:64bit: - [2010/12/07 13:23:00 | 000,027,648 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lganddiag64.sys -- (AndDiag)

DRV:64bit: - [2010/12/07 13:23:00 | 000,027,136 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lgandgps64.sys -- (AndGps)

DRV:64bit: - [2010/12/07 13:22:58 | 000,019,456 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lgandbus64.sys -- (Andbus)

DRV:64bit: - [2010/11/20 14:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)

DRV:64bit: - [2010/11/20 12:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)

DRV:64bit: - [2010/11/20 10:37:42 | 000,109,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sdbus.sys -- (sdbus)

DRV:64bit: - [2010/11/11 00:50:04 | 000,291,328 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)

DRV:64bit: - [2010/11/11 00:47:57 | 000,505,344 | ---- | M] (IDT, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\stwrt64.sys -- (STHDA)

DRV:64bit: - [2010/09/22 23:36:48 | 000,048,488 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\fssfltr.sys -- (fssfltr)

DRV:64bit: - [2009/10/13 10:16:40 | 000,409,624 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)

DRV:64bit: - [2009/10/05 09:08:44 | 000,087,600 | ---- | M] (Citrix Systems, Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\ctxusbm.sys -- (ctxusbm)

DRV:64bit: - [2009/09/29 07:15:02 | 000,016,384 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\lgbtpt64.sys -- (LgBttPort)

DRV:64bit: - [2009/09/29 07:15:00 | 000,017,408 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\lgvmdm64.sys -- (LGVMODEM)

DRV:64bit: - [2009/09/29 07:15:00 | 000,014,848 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\lgbtbs64.sys -- (lgbusenum)

DRV:64bit: - [2009/09/17 21:56:24 | 000,021,160 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwrchid.sys -- (btwrchid)

DRV:64bit: - [2009/09/17 21:56:16 | 000,035,104 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwl2cap.sys -- (btwl2cap)

DRV:64bit: - [2009/09/17 21:56:14 | 000,132,648 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwavdt.sys -- (btwavdt)

DRV:64bit: - [2009/09/17 21:56:10 | 000,098,344 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwaudio.sys -- (btwaudio)

DRV:64bit: - [2009/08/21 17:54:04 | 000,084,512 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA)

DRV:64bit: - [2009/08/15 07:54:54 | 000,286,768 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)

DRV:64bit: - [2009/07/21 04:39:22 | 000,140,712 | ---- | M] (JMicron Technology Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\jmcr.sys -- (JMCR)

DRV:64bit: - [2009/07/14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)

DRV:64bit: - [2009/07/14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)

DRV:64bit: - [2009/07/14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)

DRV:64bit: - [2009/07/08 22:49:08 | 000,030,008 | ---- | M] (Hewlett-Packard) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\hpdskflt.sys -- (hpdskflt)

DRV:64bit: - [2009/07/08 22:48:50 | 000,041,272 | ---- | M] (Hewlett-Packard) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Accelerometer.sys -- (Accelerometer)

DRV:64bit: - [2009/06/29 19:17:00 | 000,070,656 | ---- | M] (ENE TECHNOLOGY INC.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\enecir.sys -- (enecir)

DRV:64bit: - [2009/06/10 22:01:11 | 001,485,312 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VSTDPV6.SYS -- (SrvHsfV92)

DRV:64bit: - [2009/06/10 22:01:11 | 000,740,864 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VSTCNXT6.SYS -- (SrvHsfWinac)

DRV:64bit: - [2009/06/10 22:01:11 | 000,292,864 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VSTAZL6.SYS -- (SrvHsfHDA)

DRV:64bit: - [2009/06/10 21:37:05 | 006,108,416 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)

DRV:64bit: - [2009/06/10 21:35:33 | 000,389,120 | ---- | M] (Marvell) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\yk62x64.sys -- (yukonw7)

DRV:64bit: - [2009/06/10 21:35:28 | 005,434,368 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\netw5v64.sys -- (netw5v64) Intel®

DRV:64bit: - [2009/06/10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)

DRV:64bit: - [2009/06/10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)

DRV:64bit: - [2009/06/10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)

DRV:64bit: - [2009/06/10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)

DRV:64bit: - [2009/04/29 08:48:32 | 000,018,432 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HpqKbFiltr.sys -- (HpqKbFiltr)

DRV - [2009/10/17 05:47:06 | 000,146,928 | ---- | M] (CyberLink Corp.) [2010/02/06 02:29:18] [Kernel | Auto | Running] -- c:\Program Files (x86)\Hewlett-Packard\Media\DVD\000.fcl -- ({55662437-DA8C-40c0-AADA-2C816A897A49})

DRV - [2009/07/14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.bing.com

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com

IE - HKLM\..\URLSearchHook: {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - C:\Program Files (x86)\BS_Player\prxtbBS_0.dll (Conduit Ltd.)

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-4151207390-2366049724-2330981530-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie

IE - HKU\S-1-5-21-4151207390-2366049724-2330981530-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =

IE - HKU\S-1-5-21-4151207390-2366049724-2330981530-1001\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie

IE - HKU\S-1-5-21-4151207390-2366049724-2330981530-1001\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie

IE - HKU\S-1-5-21-4151207390-2366049724-2330981530-1001\..\URLSearchHook: {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - C:\Program Files (x86)\BS_Player\prxtbBS_0.dll (Conduit Ltd.)

IE - HKU\S-1-5-21-4151207390-2366049724-2330981530-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-4151207390-2366049724-2330981530-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..network.proxy.no_proxies_on: "*.local"

FF - prefs.js..network.proxy.type: 0

FF:64bit: - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)

FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll (Oracle Corporation)

FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Users\el\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)

FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\el\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)

FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\el\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)

FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files (x86)\DigitalPersona\Bin\FirefoxExt\ [2010/11/23 11:36:16 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files (x86)\AVG\AVG2012\Firefox4\

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2011/10/30 05:03:17 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2012\FFExt\[email protected]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\[email protected]: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird

FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files (x86)\DigitalPersona\Bin\firefoxext [2010/11/23 11:36:16 | 000,000,000 | ---D | M]

[2011/10/22 19:20:14 | 000,000,000 | ---D | M] (No name found) -- C:\Users\el\AppData\Roaming\Mozilla\Extensions

[2011/11/03 14:39:34 | 000,000,000 | ---D | M] (No name found) -- C:\Users\el\AppData\Roaming\Mozilla\Firefox\Profiles\tk8unrhi.default\extensions

[2011/10/22 19:30:22 | 000,000,000 | ---D | M] (ReminderFox) -- C:\Users\el\AppData\Roaming\Mozilla\Firefox\Profiles\tk8unrhi.default\extensions\{ada4b710-8346-4b82-8199-5de2b400a6ae}

File not found (No name found) -- C:\USERS\EL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\TK8UNRHI.DEFAULT\EXTENSIONS\AVG@TOOLBAR

[2010/12/27 11:03:10 | 000,002,036 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\fcmdSrchw7th.xml

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)

CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}

CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}

CHR - plugin: Shockwave Flash (Enabled) = C:\Users\el\AppData\Local\Google\Chrome\Application\15.0.874.106\gcswf32.dll

CHR - plugin: QuickTime Plug-in 7.1.3 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll

CHR - plugin: QuickTime Plug-in 7.1.3 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll

CHR - plugin: QuickTime Plug-in 7.1.3 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll

CHR - plugin: QuickTime Plug-in 7.1.3 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll

CHR - plugin: QuickTime Plug-in 7.1.3 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll

CHR - plugin: QuickTime Plug-in 7.1.3 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll

CHR - plugin: QuickTime Plug-in 7.1.3 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll

CHR - plugin: Java Deployment Toolkit 6.0.260.3 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll

CHR - plugin: Java Platform SE 6 U26 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll

CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\4.0.60531.0\npctrl.dll

CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw.dll

CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL

CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL

CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer

CHR - plugin: Native Client (Enabled) = C:\Users\el\AppData\Local\Google\Chrome\Application\15.0.874.106\ppGoogleNaClPluginChrome.dll

CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\el\AppData\Local\Google\Chrome\Application\15.0.874.106\pdf.dll

CHR - plugin: Babylon Chrome Plugin (Enabled) = C:\Users\el\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhkplhfnhceodhffomolpfigojocbpcb\1.0_0\BabylonChromePI.dll

CHR - plugin: AVG Internet Security (Enabled) = C:\Users\el\AppData\Local\Google\Chrome\User Data\Default\Extensions\jmfkcklnlgedgbglfkkgedjfmejoahla\12.0.0.1804_0\plugins/avgnpss.dll

CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll

CHR - plugin: Pando Web Plugin (Enabled) = C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll

CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

CHR - plugin: Google Update (Enabled) = C:\Users\el\AppData\Local\Google\Update\1.3.21.69\npGoogleUpdate3.dll

CHR - plugin: mflowBrowserPlugin (Enabled) = C:\Users\el\AppData\Roaming\Digital Distribution Networks Ltd\mflowBrowserPlugin\npmflowBrowserPlugin.dll

CHR - plugin: Default Plug-in (Enabled) = default_plugin

CHR - Extension: 3D Bowling = C:\Users\el\AppData\Local\Google\Chrome\User Data\Default\Extensions\gemohgpikgjbgmdfbfjdailocichgbjm\1.9_0\

O1 HOSTS File: ([2011/10/31 21:50:41 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts

O1 - Hosts: 127.0.0.1 localhost

O2:64bit: - BHO: (DigitalPersona Personal Extension) - {395610AE-C624-4f58-B89E-23733EA00F9A} - C:\Program Files\DigitalPersona\Bin\DpOtsPluginIe8.dll (DigitalPersona, Inc.)

O2:64bit: - BHO: (Java Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

O2 - BHO: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)

O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)

O2 - BHO: (DigitalPersona Personal Extension) - {395610AE-C624-4f58-B89E-23733EA00F9A} - C:\Program Files (x86)\DigitalPersona\Bin\DpOtsPluginIe8.dll (DigitalPersona, Inc.)

O2 - BHO: (BS Player Toolbar) - {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - C:\Program Files (x86)\BS_Player\prxtbBS_0.dll (Conduit Ltd.)

O3 - HKLM\..\Toolbar: (BS Player Toolbar) - {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - C:\Program Files (x86)\BS_Player\prxtbBS_0.dll (Conduit Ltd.)

O3 - HKU\S-1-5-21-4151207390-2366049724-2330981530-1001\..\Toolbar\WebBrowser: (BS Player Toolbar) - {FED66DC5-1B74-4A04-8F5C-15C5ACE2B9A5} - C:\Program Files (x86)\BS_Player\prxtbBS_0.dll (Conduit Ltd.)

O4:64bit: - HKLM..\Run: [intelWireless] C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe (Intel® Corporation)

O4:64bit: - HKLM..\Run: [NvCplDaemon] C:\Windows\SysNative\NvCpl.dll (NVIDIA Corporation)

O4:64bit: - HKLM..\Run: [sysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe (IDT, Inc.)

O4 - HKLM..\Run: [ConnectionCenter] C:\Program Files (x86)\Citrix\ICA Client\concentr.exe (Citrix Systems, Inc.)

O4 - HKLM..\Run: [DpAgent] C:\Program Files (x86)\DigitalPersona\Bin\DpAgent.exe (DigitalPersona, Inc.)

O4 - HKLM..\Run: [Easybits Recovery] C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe (EasyBits Software AS)

O4 - Startup: C:\Users\el\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\el\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableSecureUIAPaths = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideFastUserSwitching = 0

O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-21-4151207390-2366049724-2330981530-1001\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-21-4151207390-2366049724-2330981530-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O7 - HKU\S-1-5-21-4151207390-2366049724-2330981530-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableLockWorkstation = 0

O7 - HKU\S-1-5-21-4151207390-2366049724-2330981530-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableChangePassword = 0

O8:64bit: - Extra context menu item: Send image to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()

O8:64bit: - Extra context menu item: Send page to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()

O8 - Extra context menu item: Send image to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()

O8 - Extra context menu item: Send page to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()

O9:64bit: - Extra Button: @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()

O9:64bit: - Extra 'Tools' menuitem : @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()

O9 - Extra Button: Send To Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()

O9 - Extra 'Tools' menuitem : Send to &Bluetooth Device... - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()

O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab (Java Plug-in 10.1.0)

O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15)

O16 - DPF: {CAFEEFAC-0017-0000-0001-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab (Java Plug-in 1.7.0_01)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab (Java Plug-in 1.7.0_01)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 212.54.35.25 212.54.40.25

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{5A4ED891-3A4D-46AE-BA8B-53BA52FE00D8}: DhcpNameServer = 212.54.35.25 212.54.40.25

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{6DDBE2F7-D6BE-4F6B-B432-7A85E83F0626}: DhcpNameServer = 212.54.35.25 212.54.40.25

O18:64bit: - Protocol\Handler\ms-help - No CLSID value found

O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found

O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found

O18:64bit: - Protocol\Handler\wlpg - No CLSID value found

O18:64bit: - Protocol\Filter\application/x-ica - No CLSID value found

O18:64bit: - Protocol\Filter\ica - No CLSID value found

O18 - Protocol\Filter\application/x-ica {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

O18 - Protocol\Filter\ica {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found

O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found

O28 - HKLM ShellExecuteHooks: {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook.dll (EasyBits Software Corp.)

O32 - HKLM CDRom: AutoRun - 1

O34 - HKLM BootExecute: (autocheck autochk *)

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = ComFile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/11/04 14:45:59 | 000,738,080 | ---- | C] (Sysinternals - www.sysinternals.com) -- C:\Users\el\Desktop\autoruns.exe

[2011/11/04 00:22:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NoVirusThanks

[2011/11/04 00:22:01 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\NoVirusThanks

[2011/11/03 17:31:52 | 000,000,000 | ---D | C] -- C:\Users\el\Documents\Eidos

[2011/11/03 17:17:45 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Eidos

[2011/11/03 00:39:46 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\el\Desktop\OTL.exe

[2011/11/03 00:12:45 | 000,000,000 | ---D | C] -- C:\Users\el\AppData\Roaming\Intel

[2011/11/03 00:12:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel PROSet Wireless

[2011/11/03 00:11:44 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Intel

[2011/11/03 00:11:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Intel

[2011/11/03 00:11:42 | 000,000,000 | ---D | C] -- C:\Program Files\Intel

[2011/11/03 00:11:42 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Cisco

[2011/11/01 21:39:00 | 000,000,000 | ---D | C] -- C:\_OTL

[2011/10/31 21:50:51 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN

[2011/10/31 21:31:55 | 000,000,000 | ---D | C] -- C:\ComboFix

[2011/10/31 03:28:52 | 000,000,000 | ---D | C] -- C:\Users\el\AppData\Local\DDMSettings

[2011/10/31 03:01:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Games for Windows Marketplace

[2011/10/30 23:50:10 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware

[2011/10/30 23:24:48 | 000,000,000 | ---D | C] -- C:\Windows\temp

[2011/10/30 23:15:41 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe

[2011/10/30 22:00:29 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe

[2011/10/30 22:00:29 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe

[2011/10/30 22:00:23 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT

[2011/10/30 22:00:20 | 000,000,000 | ---D | C] -- C:\Qoobox

[2011/10/30 17:42:07 | 000,000,000 | ---D | C] -- C:\Users\el\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome

[2011/10/30 14:00:29 | 000,000,000 | -HSD | C] -- C:\ProgramData\{32364CEA-7855-4A3C-B674-53D8E9B97936}

[2011/10/30 05:02:43 | 000,000,000 | ---D | C] -- C:\Users\el\AppData\Roaming\DivX

[2011/10/30 05:02:07 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\PX Storage Engine

[2011/10/30 05:01:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DivX Plus

[2011/10/30 05:01:08 | 000,000,000 | ---D | C] -- C:\Program Files\DivX

[2011/10/30 05:00:45 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\DivX Shared

[2011/10/29 18:03:26 | 000,000,000 | ---D | C] -- C:\Windows\Sun

[2011/10/28 18:28:19 | 000,000,000 | ---D | C] -- C:\Users\el\AppData\Roaming\albumart

[2011/10/28 18:28:09 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Album Cover Art Downloader

[2011/10/28 16:54:04 | 000,000,000 | ---D | C] -- C:\ProgramData\clp

[2011/10/28 16:53:56 | 000,000,000 | ---D | C] -- C:\Users\el\AppData\Roaming\Fighters

[2011/10/28 16:52:52 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ConduitEngine

[2011/10/28 16:41:02 | 000,000,000 | ---D | C] -- C:\found.000

[2011/10/28 16:18:09 | 000,000,000 | ---D | C] -- C:\Users\el\AppData\Local\Solid State Networks

[2011/10/28 00:53:19 | 000,000,000 | ---D | C] -- C:\Users\el\AppData\Local\Apple Computer

[2011/10/28 00:51:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple Computer

[2011/10/28 00:51:36 | 000,000,000 | ---D | C] -- C:\ProgramData\{93E26451-CD9A-43A5-A2FA-C42392EA4001}

[2011/10/28 00:50:46 | 000,000,000 | ---D | C] -- C:\Users\el\AppData\Local\Apple

[2011/10/28 00:50:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple

[2011/10/25 00:36:38 | 000,000,000 | ---D | C] -- C:\Users\el\Desktop\New folder (2)

[2011/10/24 16:59:56 | 000,000,000 | ---D | C] -- C:\Users\el\Desktop\100MSDCF

[2011/10/24 15:48:56 | 000,000,000 | ---D | C] -- C:\Users\el\AppData\Local\Facebook

[2011/10/22 19:40:30 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\Macromed

[2011/10/22 19:19:59 | 000,000,000 | ---D | C] -- C:\Users\el\AppData\Local\Mozilla

[2011/10/22 02:00:29 | 000,000,000 | ---D | C] -- C:\a34cb2e6bc9630b39b0f3c54

[2011/10/21 13:40:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SharePoint

[2011/10/21 13:39:39 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Synchronization Services

[2011/10/21 13:39:38 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\DESIGNER

[2011/10/21 13:39:16 | 000,000,000 | ---D | C] -- C:\Windows\PCHEALTH

[2011/10/21 13:39:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Sync Framework

[2011/10/21 13:37:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Visual Studio 8

[2011/10/21 13:37:20 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Analysis Services

[2011/10/21 13:37:11 | 000,000,000 | ---D | C] -- C:\Windows\SHELLNEW

[2011/10/21 13:36:40 | 000,000,000 | RH-D | C] -- C:\MSOCache

[2011/10/18 21:25:59 | 000,000,000 | ---D | C] -- C:\Users\el\Desktop\Me

[2011/10/17 02:23:41 | 000,000,000 | ---D | C] -- C:\Users\el\AppData\Local\Graboid_Inc

[2011/10/17 02:23:41 | 000,000,000 | ---D | C] -- C:\Users\el\AppData\Local\Graboid

[2011/10/17 02:23:39 | 000,000,000 | ---D | C] -- C:\Users\el\AppData\Local\Geckofx

[2011/10/17 02:23:38 | 000,000,000 | ---D | C] -- C:\Users\el\AppData\Roaming\Mozilla

[2011/10/16 10:42:22 | 000,000,000 | ---D | C] -- C:\PFiles

[2011/10/13 02:41:16 | 000,000,000 | ---D | C] -- C:\Users\el\AppData\Roaming\Google

[2011/10/13 02:40:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Google

[2011/10/12 08:39:27 | 000,000,000 | ---D | C] -- C:\2dce9bf6ba70895a26ef460c84d5

[2011/10/11 10:11:13 | 000,000,000 | ---D | C] -- C:\Users\el\Desktop\New folder

[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/11/04 15:07:00 | 000,000,996 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-4151207390-2366049724-2330981530-1001UA.job

[2011/11/04 15:07:00 | 000,000,990 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2011/11/04 14:46:04 | 000,738,080 | ---- | M] (Sysinternals - www.sysinternals.com) -- C:\Users\el\Desktop\autoruns.exe

[2011/11/04 13:54:00 | 000,000,916 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-4151207390-2366049724-2330981530-1001UA.job

[2011/11/04 13:07:00 | 000,000,986 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2011/11/04 11:47:46 | 000,023,248 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2011/11/04 11:47:46 | 000,023,248 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2011/11/04 11:45:46 | 001,391,496 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat

[2011/11/04 11:45:46 | 000,845,604 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat

[2011/11/04 11:45:46 | 000,005,332 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI

[2011/11/04 11:40:31 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2011/11/03 20:33:41 | 000,000,944 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-4151207390-2366049724-2330981530-1001Core.job

[2011/11/03 16:54:00 | 000,000,894 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-4151207390-2366049724-2330981530-1001Core.job

[2011/11/03 16:36:09 | 000,218,744 | -H-- | M] () -- C:\Windows\SysWow64\mlfcache.dat

[2011/11/03 00:39:47 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\el\Desktop\OTL.exe

[2011/11/02 23:57:36 | 000,001,979 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk

[2011/10/31 21:50:41 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts

[2011/10/30 20:50:35 | 000,017,408 | ---- | M] () -- C:\Users\el\AppData\Local\WebpageIcons.db

[2011/10/30 17:42:39 | 000,002,299 | ---- | M] () -- C:\Users\el\Desktop\Google Chrome.lnk

[2011/10/30 14:44:18 | 000,000,320 | ---- | M] () -- C:\Windows\tasks\HPCeeScheduleForel.job

[2011/10/30 05:03:26 | 000,002,080 | ---- | M] () -- C:\Users\Public\Desktop\DivX Plus Converter.lnk

[2011/10/30 05:03:26 | 000,001,608 | ---- | M] () -- C:\Users\el\Desktop\DivX Movies.lnk

[2011/10/30 05:02:31 | 000,001,076 | ---- | M] () -- C:\Users\Public\Desktop\DivX Plus Player.lnk

[2011/10/28 16:21:19 | 000,000,000 | ---- | M] () -- C:\Users\el\AppData\Local\{783D7694-C6B7-4CD6-B241-2F93D7AD0268}

[2011/10/22 19:23:56 | 000,001,852 | ---- | M] () -- C:\Users\el\Documents\Firefox Sync Key.html

[2011/10/22 02:02:07 | 005,268,912 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT

[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/11/03 16:36:09 | 000,218,744 | -H-- | C] () -- C:\Windows\SysWow64\mlfcache.dat

[2011/11/02 23:57:36 | 000,002,441 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk

[2011/11/02 23:57:36 | 000,001,979 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk

[2011/10/30 22:00:29 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe

[2011/10/30 22:00:29 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe

[2011/10/30 22:00:29 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe

[2011/10/30 22:00:29 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe

[2011/10/30 22:00:29 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe

[2011/10/30 20:50:35 | 000,017,408 | ---- | C] () -- C:\Users\el\AppData\Local\WebpageIcons.db

[2011/10/30 17:42:09 | 000,002,299 | ---- | C] () -- C:\Users\el\Desktop\Google Chrome.lnk

[2011/10/30 05:03:26 | 000,001,608 | ---- | C] () -- C:\Users\el\Desktop\DivX Movies.lnk

[2011/10/30 05:02:31 | 000,001,076 | ---- | C] () -- C:\Users\Public\Desktop\DivX Plus Player.lnk

[2011/10/30 05:01:29 | 000,002,080 | ---- | C] () -- C:\Users\Public\Desktop\DivX Plus Converter.lnk

[2011/10/28 16:21:19 | 000,000,000 | ---- | C] () -- C:\Users\el\AppData\Local\{783D7694-C6B7-4CD6-B241-2F93D7AD0268}

[2011/10/24 15:49:01 | 000,000,916 | ---- | C] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-4151207390-2366049724-2330981530-1001UA.job

[2011/10/24 15:49:01 | 000,000,894 | ---- | C] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-4151207390-2366049724-2330981530-1001Core.job

[2011/10/22 19:23:35 | 000,001,852 | ---- | C] () -- C:\Users\el\Documents\Firefox Sync Key.html

[2011/10/16 11:37:20 | 000,000,320 | ---- | C] () -- C:\Windows\tasks\HPCeeScheduleForel.job

[2011/10/13 02:51:53 | 000,000,990 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2011/10/13 02:51:52 | 000,000,986 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2011/09/28 17:38:16 | 000,000,248 | ---- | C] () -- C:\Users\el\AppData\Roaming\wklnhst.dat

[2011/09/08 18:33:49 | 000,005,831 | ---- | C] () -- C:\Windows\wininit.ini

[2011/09/04 15:03:19 | 000,000,376 | ---- | C] () -- C:\Windows\ODBC.INI

[2011/08/20 20:45:14 | 000,000,848 | -HS- | C] () -- C:\ProgramData\KGyGaAvL.sys

[2011/06/24 18:55:31 | 000,007,597 | ---- | C] () -- C:\Users\el\AppData\Local\Resmon.ResmonCfg

[2011/06/11 15:22:39 | 000,735,230 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI

[2011/06/04 14:11:04 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\Access.dat

[2011/04/09 16:55:28 | 000,179,261 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat

[2011/02/01 21:19:40 | 000,000,148 | ---- | C] () -- C:\Windows\QIII.INI

[2010/12/22 20:42:43 | 000,010,752 | ---- | C] () -- C:\Users\el\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2010/10/05 00:59:32 | 000,005,632 | ---- | C] () -- C:\Windows\SysWow64\StarOpen.sys

[2010/05/23 15:53:13 | 000,000,056 | -H-- | C] () -- C:\Windows\SysWow64\ezsidmv.dat

[2010/02/06 11:41:57 | 000,209,040 | ---- | C] () -- C:\Windows\SysWow64\IVIresizeW7.dll

[2010/02/06 11:41:57 | 000,204,944 | ---- | C] () -- C:\Windows\SysWow64\IVIresizeA6.dll

[2010/02/06 11:41:57 | 000,196,752 | ---- | C] () -- C:\Windows\SysWow64\IVIresizeP6.dll

[2010/02/06 11:41:57 | 000,196,752 | ---- | C] () -- C:\Windows\SysWow64\IVIresizeM6.dll

[2010/02/06 11:41:57 | 000,192,656 | ---- | C] () -- C:\Windows\SysWow64\IVIresizePX.dll

[2010/02/06 11:41:57 | 000,024,720 | ---- | C] () -- C:\Windows\SysWow64\IVIresize.dll

[2010/02/06 11:16:53 | 000,000,283 | ---- | C] () -- C:\Windows\SysWow64\RStoneLog2.ini

[2010/02/06 11:16:53 | 000,000,224 | ---- | C] () -- C:\Windows\SysWow64\RStoneLog.ini

[2009/12/11 21:27:11 | 000,009,868 | ---- | C] () -- C:\Windows\SysWow64\ezdigsgn.dat

[2009/07/14 06:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat

[2009/07/14 03:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT

[2009/07/14 03:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat

[2009/07/14 01:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin

[2009/07/14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll

[2009/07/13 22:59:36 | 001,498,564 | ---- | C] () -- C:\Windows\SysWow64\igkrng400.bin

[2009/07/13 22:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll

[2009/06/10 22:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat

[1913/08/01 15:18:54 | 000,056,832 | ---- | C] () -- C:\Windows\SysWow64\iyvu9_32.dll

========== LOP Check ==========

[2011/09/08 12:34:41 | 000,000,000 | ---D | M] -- C:\Users\el\AppData\Roaming\Agug

[2011/10/28 18:35:20 | 000,000,000 | ---D | M] -- C:\Users\el\AppData\Roaming\albumart

[2011/09/08 19:31:20 | 000,000,000 | ---D | M] -- C:\Users\el\AppData\Roaming\AVG2012

[2010/11/21 01:32:16 | 000,000,000 | ---D | M] -- C:\Users\el\AppData\Roaming\BSplayer

[2010/11/12 22:42:22 | 000,000,000 | ---D | M] -- C:\Users\el\AppData\Roaming\BSplayer Pro

[2011/09/08 20:08:05 | 000,000,000 | ---D | M] -- C:\Users\el\AppData\Roaming\Cour

[2010/10/26 22:19:56 | 000,000,000 | ---D | M] -- C:\Users\el\AppData\Roaming\DAEMON Tools Lite

[2011/09/09 16:09:14 | 000,000,000 | ---D | M] -- C:\Users\el\AppData\Roaming\DAEMON Tools Pro

[2010/05/15 21:16:36 | 000,000,000 | ---D | M] -- C:\Users\el\AppData\Roaming\DigitalPersona

[2011/11/04 11:40:57 | 000,000,000 | ---D | M] -- C:\Users\el\AppData\Roaming\Dropbox

[2011/11/01 19:49:24 | 000,000,000 | ---D | M] -- C:\Users\el\AppData\Roaming\Fighters

[2011/08/27 23:53:49 | 000,000,000 | ---D | M] -- C:\Users\el\AppData\Roaming\FrmMain

[2011/05/01 13:14:23 | 000,000,000 | ---D | M] -- C:\Users\el\AppData\Roaming\GameRanger

[2011/08/27 23:34:28 | 000,000,000 | ---D | M] -- C:\Users\el\AppData\Roaming\GetRightToGo

[2011/10/12 13:38:09 | 000,000,000 | ---D | M] -- C:\Users\el\AppData\Roaming\ICAClient

[2010/11/06 23:05:23 | 000,000,000 | ---D | M] -- C:\Users\el\AppData\Roaming\LolClient

[2011/04/08 14:32:22 | 000,000,000 | ---D | M] -- C:\Users\el\AppData\Roaming\Mobiltel EAD

[2011/09/04 17:02:32 | 000,000,000 | ---D | M] -- C:\Users\el\AppData\Roaming\Need for Speed World

[2011/09/18 00:25:42 | 000,000,000 | ---D | M] -- C:\Users\el\AppData\Roaming\PunkBuster

[2011/01/26 00:39:44 | 000,000,000 | ---D | M] -- C:\Users\el\AppData\Roaming\runic games

[2011/04/08 14:32:23 | 000,000,000 | ---D | M] -- C:\Users\el\AppData\Roaming\Skinux

[2010/12/28 22:50:48 | 000,000,000 | ---D | M] -- C:\Users\el\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1

[2010/10/27 19:43:34 | 000,000,000 | ---D | M] -- C:\Users\el\AppData\Roaming\SystemRequirementsLab

[2011/09/29 20:19:05 | 000,000,000 | ---D | M] -- C:\Users\el\AppData\Roaming\Template

[2011/05/16 12:05:54 | 000,000,000 | ---D | M] -- C:\Users\el\AppData\Roaming\The Creative Assembly

[2011/01/01 10:45:02 | 000,000,000 | ---D | M] -- C:\Users\el\AppData\Roaming\Tific

[2011/10/30 14:02:08 | 000,000,000 | ---D | M] -- C:\Users\el\AppData\Roaming\TuneUp Software

[2011/05/13 00:12:27 | 000,000,000 | ---D | M] -- C:\Users\el\AppData\Roaming\Tunngle

[2010/11/02 20:45:20 | 000,000,000 | ---D | M] -- C:\Users\el\AppData\Roaming\Ubisoft

[2011/11/03 17:35:57 | 000,000,000 | ---D | M] -- C:\Users\el\AppData\Roaming\uTorrent

[2011/06/25 16:05:29 | 000,000,000 | ---D | M] -- C:\Users\el\AppData\Roaming\Windows Live Writer

[2011/01/01 17:29:59 | 000,000,000 | ---D | M] -- C:\Users\el\AppData\Roaming\_MDLogs

[2011/11/03 16:54:00 | 000,000,894 | ---- | M] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-4151207390-2366049724-2330981530-1001Core.job

[2011/11/04 13:54:00 | 000,000,916 | ---- | M] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-4151207390-2366049724-2330981530-1001UA.job

[2009/07/14 06:08:49 | 000,023,838 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU(71).TXT

[2011/09/29 00:52:32 | 000,032,572 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

[2011/09/08 19:27:07 | 000,000,212 | ---- | M] () -- C:\Windows\Tasks\SidebarExecute.job

========== Purity Check ==========

========== Files - Unicode (All) ==========

[2010/03/24 18:23:31 | 000,000,020 | ---- | M] ()(C:\Windows\?o„) -- C:\Windows\œõ„

[2010/03/24 18:23:30 | 000,000,020 | ---- | C] ()(C:\Windows\?o„) -- C:\Windows\œõ„

========== Alternate Data Streams ==========

@Alternate Data Stream - 112 bytes -> C:\ProgramData\Temp:D1B5B4F1

< End of report >

4 ноември 201114 г.

Така...останаха още малко...използвайте този скрипт и въведете Run Fix.

Преди да го стартирате затворете всички браузъри и всички активни приложения...

:OTL
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2012\FFExt\[email protected]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2012\FFExt\[email protected]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\[email protected]: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird
File not found (No name found) -- C:\USERS\EL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\TK8UNRHI.DEFAULT\EXTENSIONS\AVG@TOOLBAR
CHR - plugin: AVG Internet Security (Enabled) = C:\Users\el\AppData\Local\Google\Chrome\User Data\Default\Extensions\jmfkcklnlgedgbglfkkgedjfmejoahla\12.0.0.1804_0\plugins/avgnpss.dll
[2011/09/08 19:31:20 | 000,000,000 | ---D | M] -- C:\Users\el\AppData\Roaming\AVG2012
[2011/11/01 19:49:24 | 000,000,000 | ---D | M] -- C:\Users\el\AppData\Roaming\Fighters
[2011/10/30 14:02:08 | 000,000,000 | ---D | M] -- C:\Users\el\AppData\Roaming\TuneUp Software
@Alternate Data Stream - 112 bytes -> C:\ProgramData\Temp:D1B5B4F1
[2010/03/24 18:23:31 | 000,000,020 | ---- | M] ()(C:\Windows\?o„) -- C:\Windows\œõ„
[2010/03/24 18:23:30 | 000,000,020 | ---- | C] ()(C:\Windows\?o„) -- C:\Windows\œõ„
:commands
[reboot]

4 ноември 201114 г.

Автор

Готово почистено е.Само че не ми излезе лог.

4 ноември 201114 г.

Би трябвало да има в C:\_OTL\MovedFiles. Отвори този с последна дата и го публикувай...после финални препоръки и сме готови.

4 ноември 201114 г.

Автор

========== OTL ========== File HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2012\FFExt\[email protected] not found. File HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2012\FFExt\[email protected] not found. File HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\[email protected]: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird not found. File C:\Users\el\AppData\Local\Google\Chrome\User Data\Default\Extensions\jmfkcklnlgedgbglfkkgedjfmejoahla\12.0.0.1804_0\plugins/avgnpss.dll not found. C:\Users\el\AppData\Roaming\AVG2012\cfgall folder moved successfully. C:\Users\el\AppData\Roaming\AVG2012 folder moved successfully. C:\Users\el\AppData\Roaming\Fighters\SPYWAREfighter\Logs folder moved successfully. C:\Users\el\AppData\Roaming\Fighters\SPYWAREfighter folder moved successfully. C:\Users\el\AppData\Roaming\Fighters folder moved successfully. C:\Users\el\AppData\Roaming\TuneUp Software\TU2012\TuningIndex folder moved successfully. C:\Users\el\AppData\Roaming\TuneUp Software\TU2012\StartUp Manager folder moved successfully. C:\Users\el\AppData\Roaming\TuneUp Software\TU2012\Speed Optimizer folder moved successfully. C:\Users\el\AppData\Roaming\TuneUp Software\TU2012\Disk Space Explorer folder moved successfully. C:\Users\el\AppData\Roaming\TuneUp Software\TU2012\Dashboard folder moved successfully. C:\Users\el\AppData\Roaming\TuneUp Software\TU2012\Backups folder moved successfully. C:\Users\el\AppData\Roaming\TuneUp Software\TU2012 folder moved successfully. C:\Users\el\AppData\Roaming\TuneUp Software\TU2011\TuningIndex folder moved successfully. C:\Users\el\AppData\Roaming\TuneUp Software\TU2011\StartUp Manager folder moved successfully. C:\Users\el\AppData\Roaming\TuneUp Software\TU2011\Speed Optimizer folder moved successfully. C:\Users\el\AppData\Roaming\TuneUp Software\TU2011\Disk Space Explorer folder moved successfully. C:\Users\el\AppData\Roaming\TuneUp Software\TU2011\Dashboard folder moved successfully. C:\Users\el\AppData\Roaming\TuneUp Software\TU2011\Backups folder moved successfully. C:\Users\el\AppData\Roaming\TuneUp Software\TU2011 folder moved successfully. C:\Users\el\AppData\Roaming\TuneUp Software folder moved successfully. ADS C:\ProgramData\Temp:D1B5B4F1 deleted successfully. C:\Windows\œõ„ moved successfully. File C:\Windows\œõ„ not found. ========== COMMANDS ========== OTL by OldTimer - Version 3.2.31.0 log created on 11042011_194043

4 ноември 201114 г.

Разгеле...бая се бяха вкоренили тези антивирусни. Да почистим: Деинсталирайте Combofix => Натиснете бутона Windows + R (за да се покаже run менюто) => след това въведете командата => Combofix /Uninstall Деинсталирайте OTL => Стартирайте приложението и натиснете бутона CleanUp! Деинсталирайте Eset Online Scanner и Threat Killer от Control Panel-a. Изтрийте всички инструменти, които сме използвали + техните папки и логове и не са се изтрили при споменатите процедури - TDSSKiller, autoruns, system look, dds Направете проверка на системните файлове => в Start менюто въведете CMD.exe => кликнете с десен бутон на мишката върху файла и изберете Run as administrator. Напишете командата sfc /scannow => натиснете Enter. Ако се наложи рестартирайте. За финал направете един Disk Cleanup + Disk Defragmenter + CheckDisk за подобряване на производителността. http://windows.microsoft.com/bg-BG/windows7/Ways-to-improve-your-computers-performance http://windows.microsoft.com/bg-bg/windows7/improve-performance-by-defragmenting-your-hard-disk http://windows.microsoft.com/bg-BG/windows7/Check-a-drive-for-errors http://windows.microsoft.com/bg-BG/windows7/Delete-files-using-Disk-Cleanup Ако няма повече въпроси ще маркирам случая като [РЕШЕН]. Приятна вечер !

4 ноември 201114 г.

Автор

Аз обаче нещо не мога да си намеря антивирусна , може ли един линк за някоя антивирусна?

4 ноември 201114 г.

http://www.kaldata.com/modules.php?modid=1&action=cat&id=41 Препоръчвам - AVG, Avira, avast!, MSE, Panda Cloud или Comodo Internet Security (но само една от тях). !

4 ноември 201114 г.

Автор

Ехаааа супер е всичко на 6 ... Ще кажа само едно голямо OMG, защото наистина е О Боже мой ! Ако не беше този форум нямаше да ми върви толкова добре и да ми е оправено всичко.Искрени благодарности към вас и към целия отбор, че ви има. Поздрави от Амстердам. Винаги е хубаво като има българи, на които можеш да разчиташ.

Добре дошли!

facebook virus [РЕШЕН]

Featured Replies

Архивирана тема

Разглеждащи това в момента 0

Дарение

Бюлетин

Профил

Навигация

Търсене

Конфигуриране на push известия в браузъра

Chrome (Android)

Chrome (Desktop)

Safari (iOS 16.4+)

Safari (macOS)

Edge (Android)

Edge (Desktop)

Firefox (Android)

Firefox (Desktop)