Проблеми с Rootkit Zero Access [решен]

6 ноември 201114 г.

Здравейте , основният ми проблем е , че антивирусната ми се изключва и по никакъв начин не мога да я включа , смених вече 3 различни антивирусни , но и с трите е едно и също - инсталират се нормално , но стоят неактивни. Машината ми стана супер бавна и нестабилна , а натоварването на процесора е много голямо . Пробвах да се справя сам с Esset скенера , с TDSS Kliler , Malwarebytes Anti-Malware , но за съжаление без резултатно Не знам дали има някаква връзка с това , но от 3 седмици ми се появява за ъпдейт на уйндоуса един и същи ъпдейт , инсталирам го и пак се появява съобщение за инсталиране . Моля ви за помощ . Благодаря предварително . . DDS (Ver_2011-08-26.01) - NTFSx86 Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_29 Run by ACER 6930 at 17:49:28 on 2011-11-06 Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1251.359.1033.18.3066.1827 [GMT 2:00] . AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7} SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A} . ============== Running Processes =============== . C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\nvvsvc.exe C:\Windows\system32\svchost.exe -k rpcss C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k GPSvcGroup C:\Windows\system32\SLsvc.exe C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Windows\system32\rundll32.exe C:\Windows\system32\svchost.exe -k bthsvcs C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe C:\Program Files\Acer\Acer Bio Protection\BASVC.exe C:\Program Files\Common Files\SPBA\upeksvr.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Acer\Mobility Center\MobilityService.exe C:\Program Files\Acer\Acer Bio Protection\CompPtcVUI.exe C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe C:\Program Files\Common Files\PC Tools\sMonitor\StartManSvc.exe C:\Windows\system32\IoctlSvc.exe C:\Program Files\Acer\Acer VCM\RS_Service.exe C:\Windows\system32\svchost.exe -k imgsvc C:\Windows\System32\svchost.exe -k WerSvcGroup C:\Windows\system32\DRIVERS\xaudio.exe C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\system32\taskeng.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe C:\Windows\RtHDVCpl.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Acer\Empowering Technology\eAudio\eAudio.exe C:\Windows\PLFSetI.exe C:\Program Files\Launch Manager\QtZgAcer.EXE C:\Program Files\Common Files\PC Tools\sMonitor\SSDMonitor.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\Program Files\Avira\AntiVir Desktop\avgnt.exe C:\Windows\ehome\ehtray.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Windows\ehome\ehmsas.exe C:\Windows\system32\wbem\unsecapp.exe C:\Users\ACER69~1\AppData\Local\Temp\RtkBtMnt.exe C:\Windows\system32\taskeng.exe C:\Users\ACER 6930\AppData\Local\Google\Chrome\Application\chrome.exe C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe C:\Windows\system32\wuauclt.exe C:\Windows\system32\conime.exe C:\Users\ACER 6930\AppData\Local\Google\Chrome\Application\chrome.exe C:\Windows\system32\rundll32.exe C:\Users\ACER 6930\AppData\Local\Google\Chrome\Application\chrome.exe C:\Windows\system32\wbem\wmiprvse.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://www.ask.com?o=15187&l=dis mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0402&s=2&o=vp32&d=0109&m=aspire_6930g uInternet Settings,ProxyOverride = *.local BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll BHO: WormRadar.com IESiteBlocker.NavFilter: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - AVG Safe Search BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll BHO: ShowBarObj Class: {83a2f9b1-01a2-4aa5-87d1-45b6b8505e96} - c:\program files\acer\empowering technology\edatasecurity\x86\ActiveToolBand.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll TB: Acer eDataSecurity Management: {5cbe3b7c-1e47-477e-a7dd-396db0476e29} - c:\program files\acer\empowering technology\edatasecurity\x86\eDStoolbar.dll TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe uRun: [spybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe uRun: [Google Update] "c:\users\acer 6930\appdata\local\google\update\GoogleUpdate.exe" /c mRun: [iAAnotif] c:\program files\intel\intel matrix storage manager\iaanotif.exe mRun: [RtHDVCpl] RtHDVCpl.exe mRun: [synTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe mRun: [eAudio] "c:\program files\acer\empowering technology\eaudio\eAudio.exe" mRun: [WarReg_PopUp] c:\program files\acer\wr_popup\WarReg_PopUp.exe mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup mRun: [PLFSetI] c:\windows\PLFSetI.exe mRun: [LManager] c:\progra~1\launch~1\QtZgAcer.EXE mRun: [ePower_DMC] c:\program files\acer\empowering technology\epower\ePower_DMC.exe mRun: [Gnetmous] c:\program files\samsung\samsung optical wheel mouse\gnetmous.exe mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe" mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe" mRun: [sSDMonitor] c:\program files\common files\pc tools\smonitor\SSDMonitor.exe mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe" mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\totalm~1.lnk - c:\program files\arcsoft\totalmedia theatre 5\totalmedia server\TM Server.exe mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0) mPolicies-system: EnableLUA = 0 (0x0) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) mPolicies-system: DisableCAD = 1 (0x1) IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000 IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html IE: Send image to &Bluetooth Device... - c:\program files\widcomm\bluetooth software\btsendto_ie_ctx.htm IE: Send page to &Bluetooth Device... - c:\program files\widcomm\bluetooth software\btsendto_ie.htm IE: {10954C80-4F0F-11d3-B17C-00C0DFE39736} - c:\program files\acer\acer bio protection\PwdBank.exe IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\widcomm\bluetooth software\btsendto_ie.htm IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} - hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab TCP: DhcpNameServer = 192.168.1.1 TCP: Interfaces\{2B545F84-BE04-4219-A3DF-90A3E25BEC3B} : DhcpNameServer = 192.168.1.1 Notify: AWinNotifyVitaKey MC3000 - c:\program files\acer\acer bio protection\WinNotify.dll Notify: spba - c:\program files\common files\spba\homefus2.dll AppInit_DLLs: c:\windows\system32\avgrsstx.dll . ================= FIREFOX =================== . FF - ProfilePath - c:\users\acer 6930\appdata\roaming\mozilla\firefox\profiles\an794mxz.default\ FF - prefs.js: browser.search.selectedEngine - Yahoo FF - prefs.js: browser.startup.homepage - hxxp://www.mystart.com/?pr=vmn&id=pandasecuritytb&v=2_0 FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=panda&type=PCAFSI1208&p= . ---- FIREFOX POLICIES ---- FF - user.js: nglayout.initialpaint.delay - 600 FF - user.js: content.notify.interval - 600000 FF - user.js: content.max.tokenizing.time - 1800000 FF - user.js: content.switch.threshold - 600000 FF - user.js: network.http.max-persistent-connections-per-server - 4 . ============= SERVICES / DRIVERS =============== . R0 AlfaFF;AlfaFF File System mini-filter;c:\windows\system32\drivers\AlfaFF.sys [2009-1-14 42608] R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [2009-5-13 12552] R1 ArcSec;ArcSec;c:\windows\system32\drivers\ArcSec.sys [2010-9-21 192504] R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-5-13 335240] R1 AvgMfx86;AVG On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2009-5-13 27784] R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-5-13 108552] R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2011-11-4 61960] R2 BUNAgentSvc;NTI Backup Now 5 Agent Service;c:\program files\newtech infosystems\nti backup now 5\client\Agentsvc.exe [2008-3-3 16384] R2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-21 21504] R2 IGBASVC;iGroupTec Service;c:\program files\acer\acer bio protection\BASVC.exe [2009-1-14 3602432] R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2011-11-6 366152] R2 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\newtech infosystems\nti backup now 5\BackupSvc.exe [2008-4-26 45056] R2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;c:\program files\common files\pc tools\smonitor\StartManSvc.exe [2011-10-16 632792] R2 RS_Service;Raw Socket Service;c:\program files\acer\acer vcm\RS_Service.exe [2009-1-14 233472] R2 SBSDWSCService;SBSD Security Center Service;c:\program files\spybot - search & destroy\SDWinSec.exe [2011-11-5 1153368] R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-11-6 22216] R3 NETw5v32;Intel® Wireless WiFi Link Adapter Driver for Windows Vista 32 Bit ;c:\windows\system32\drivers\NETw5v32.sys [2008-7-22 3658752] R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32v.sys [2008-6-25 44064] R3 winbondcir;Winbond IR Transceiver;c:\windows\system32\drivers\winbondcir.sys [2007-3-28 43008] S2 AntiVirSchedulerService;Avira AntiVir Scheduler;"c:\program files\avira\antivir desktop\sched.exe" --> c:\program files\avira\antivir desktop\sched.exe [?] S2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2011-11-4 269480] S2 avg8wd;AVG8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe --> c:\progra~1\avg\avg8\avgwdsvc.exe [?] S2 ETService;Empowering Technology Service;c:\program files\acer\empowering technology\service\etservice.exe --> c:\program files\acer\empowering technology\service\ETService.exe [?] S2 gupdate;Услуга Google Update (gupdate);c:\program files\google\update\googleupdate.exe /svc --> c:\program files\google\update\GoogleUpdate.exe [?] S2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\newtech infosystems\nti backup now 5\schedulersvc.exe --> c:\program files\newtech infosystems\nti backup now 5\SchedulerSvc.exe [?] S3 gupdatem;Услуга на Google Актуализация (gupdatem);c:\program files\google\update\googleupdate.exe /medsvc --> c:\program files\google\update\GoogleUpdate.exe [?] S3 qcusbser;Modem Interface USB Device for Legacy Serial Communication;c:\windows\system32\drivers\qcusbser.sys [2010-4-20 103552] S3 Revoflt;Revoflt;c:\windows\system32\drivers\revoflt.sys [2011-10-19 27192] . =============== Created Last 30 ================ . 2011-11-06 15:07:48 -------- d-----w- c:\program files\ESET 2011-11-06 13:22:56 -------- d-----w- c:\users\acer 6930\appdata\roaming\Malwarebytes 2011-11-06 13:22:48 -------- d-----w- c:\programdata\Malwarebytes 2011-11-06 13:22:42 22216 ----a-w- c:\windows\system32\drivers\mbam.sys 2011-11-06 13:22:42 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2011-11-06 11:21:19 -------- d-sh--w- C:\$RECYCLE.BIN 2011-11-06 11:10:31 -------- d-----w- c:\users\acer 6930\appdata\local\temp 2011-11-06 10:43:11 98816 ----a-w- c:\windows\sed.exe 2011-11-06 10:43:11 518144 ----a-w- c:\windows\SWREG.exe 2011-11-06 10:43:11 256000 ----a-w- c:\windows\PEV.exe 2011-11-06 10:43:11 208896 ----a-w- c:\windows\MBR.exe 2011-11-06 10:42:58 -------- d-----w- C:\ComboFix 2011-11-05 12:58:55 -------- d-----w- c:\programdata\Spybot - Search & Destroy 2011-11-05 12:58:55 -------- d-----w- c:\program files\Spybot - Search & Destroy 2011-11-04 14:18:16 -------- d-----w- c:\users\acer 6930\appdata\roaming\Avira 2011-11-04 14:02:40 61960 ----a-w- c:\windows\system32\drivers\avgntflt.sys 2011-11-04 14:02:38 -------- d-----w- c:\programdata\Avira 2011-11-03 14:26:49 -------- d-----w- c:\programdata\Readon 2011-10-29 13:57:46 -------- d-sh--w- c:\windows\system32\%APPDATA% 2011-10-19 11:48:11 -------- d-----w- c:\users\acer 6930\appdata\roaming\Panda Security 2011-10-19 11:46:12 -------- d-----w- c:\programdata\Panda Security 2011-10-19 11:46:12 -------- d-----w- c:\program files\Panda Security 2011-10-19 11:45:41 -------- d-----w- C:\temp 2011-10-19 10:13:34 -------- d-----w- c:\programdata\AVAST Software 2011-10-19 10:13:34 -------- d-----w- c:\program files\AVAST Software 2011-10-19 09:54:34 386560 ----a-w- c:\windows\system32\drivers\XAudio.exe 2011-10-19 09:54:26 81920 ----a-w- c:\windows\system32\IoctlSvc.exe 2011-10-19 09:42:54 -------- d-----w- c:\program files\Avira 2011-10-19 09:07:05 -------- d-----w- c:\users\acer 6930\appdata\local\VS Revo Group 2011-10-19 09:06:53 27192 ----a-w- c:\windows\system32\drivers\revoflt.sys 2011-10-19 09:06:48 -------- d-----w- c:\program files\VS Revo Group 2011-10-16 14:35:39 -------- d-----w- c:\users\acer 6930\appdata\roaming\Registry Mechanic 2011-10-16 14:18:03 37336 ----a-w- c:\windows\system32\CleanMFT32.exe 2011-10-16 14:18:03 1101824 ----a-w- c:\windows\system32\UniBox210.ocx 2011-10-16 14:18:02 880640 ----a-w- c:\windows\system32\UniBox10.ocx 2011-10-16 14:18:02 506368 ----a-w- c:\windows\system32\msxml.dll 2011-10-16 14:18:02 212992 ----a-w- c:\windows\system32\UniBoxVB12.ocx 2011-10-16 14:17:52 -------- d-----w- c:\program files\common files\PC Tools 2011-10-13 17:03:04 69632 ----a-w- c:\windows\system32\Mpeg2Data.ax 2011-10-13 17:03:04 57856 ----a-w- c:\windows\system32\MSDvbNP.ax 2011-10-13 17:03:04 293376 ----a-w- c:\windows\system32\psisdecd.dll 2011-10-13 17:03:04 217088 ----a-w- c:\windows\system32\psisrndr.ax 2011-10-13 17:03:02 2043392 ----a-w- c:\windows\system32\win32k.sys 2011-10-13 17:02:46 555520 ----a-w- c:\windows\system32\UIAutomationCore.dll 2011-10-13 17:02:46 4096 ----a-w- c:\windows\system32\oleaccrc.dll 2011-10-13 17:02:46 238080 ----a-w- c:\windows\system32\oleacc.dll 2011-10-13 17:02:45 563712 ----a-w- c:\windows\system32\oleaut32.dll . ==================== Find3M ==================== . 2011-11-06 13:05:30 66560 ----a-w- c:\windows\system32\drivers\smb.sys 2011-10-19 11:48:28 196608 ----a-w- c:\windows\system32\nvvsvc.exe 2011-10-09 16:34:15 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2011-10-03 02:06:03 472808 ----a-w- c:\windows\system32\deployJava1.dll 2011-09-01 02:35:59 1798144 ----a-w- c:\windows\system32\jscript9.dll 2011-09-01 02:28:15 1126912 ----a-w- c:\windows\system32\wininet.dll 2011-09-01 02:22:54 2382848 ----a-w- c:\windows\system32\mshtml.tlb 2011-08-30 20:05:04 83816 ----a-w- c:\windows\system32\dns-sd.exe 2011-08-30 20:05:04 73064 ----a-w- c:\windows\system32\dnssd.dll 2011-08-30 20:05:04 50536 ----a-w- c:\windows\system32\jdns_sd.dll 2011-08-30 20:05:04 178536 ----a-w- c:\windows\system32\dnssdX.dll . ============= FINISH: 17:50:52,23 =============== .

Attach.txt

6 ноември 201114 г.

Привет, виждам, че сте използвали маса инструменти, включително ComboFix. Затова:

1. Изтрийте ComboFix и изтеглете ново копие от BleepingComputer

и го запазете (бутон Save -> Save as) ComboFix на вашия десктоп:

След приключване на изтеглянето на ComboFix, иконката на програмата би трябвало да изглежда така:

2. Затворете всички работещи приложения, отворени прозорци и програми работещи във фонов режим. Спрете временно защитата в реално време на антивирусната програма и на другите програми за сигурност, ако има такива.

3. Стартирайте с двоен клик Combofix.exe. Изберете YES, за да се съгласите с условията за използване на програмата. Важно: По време на работата на ComboFix не бива да се движи мишката и да се натискат клавиши от клавиатурата. Просто търпеливо оставете ComboFix да си свърши работата, без да използвате компютъра за други цели.

4. Ако получите предупреждение от UAC, съгласете се.

5 ComboFix ще спре временно Интернет връзката, но след като приключи работата на програмата тази връзка ще бъде възстановена автоматично. ComboFix ще сканира за проблеми и за заразени файлове, като това може да отнеме известно време. Моля да бъдете търпеливи. Ако има проблем с Интернет връзката след приключване на работата на Combofix, моля да прочетете това: Manually restoring the Internet connection section.

6 Когато работата на ComboFix приключи, ще се появи текстов документ (log) в Notepad:

Копирайте с (Copy) и поставете с (Paste) съдържанието на лога в следващия си коментар.

Забележка: Ако се появи следното съобщение при отварянето на различни програми след завършване на сканирането с Combofix - "illegal operation on a registry key that has been marked for deletion." просто рестартирайте компютъра още веднъж и то ще изчезне.

По време на сканирането не използвайте компютъра си !

6 ноември 201114 г.

Автор

Ето го и лог-а : ComboFix 11-11-06.02 - ACER 6930 11.2011 г. 18:57:15.2.2 - x86 Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1251.359.1033.18.3066.1811 [GMT 2:00] Running from: c:\users\ACER 6930\Desktop\ComboFix.exe AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7} SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A} . . ((((((((((((((((((((((((( Files Created from 2011-10-06 to 2011-11-06 ))))))))))))))))))))))))))))))) . . 2011-11-06 17:12 . 2011-11-06 17:12 -------- d-----w- c:\users\ACER 6930\AppData\Local\temp 2011-11-06 17:12 . 2011-11-06 17:12 -------- d-----w- c:\users\Default\AppData\Local\temp 2011-11-06 15:07 . 2011-11-06 15:07 -------- d-----w- c:\program files\ESET 2011-11-06 13:22 . 2011-11-06 13:22 -------- d-----w- c:\users\ACER 6930\AppData\Roaming\Malwarebytes 2011-11-06 13:22 . 2011-11-06 13:22 -------- d-----w- c:\programdata\Malwarebytes 2011-11-06 13:22 . 2011-11-06 14:40 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2011-11-06 13:22 . 2011-08-31 15:00 22216 ----a-w- c:\windows\system32\drivers\mbam.sys 2011-11-05 12:58 . 2011-11-05 14:00 -------- d-----w- c:\programdata\Spybot - Search & Destroy 2011-11-05 12:58 . 2011-11-05 12:59 -------- d-----w- c:\program files\Spybot - Search & Destroy 2011-11-04 14:18 . 2011-11-04 14:18 -------- d-----w- c:\users\ACER 6930\AppData\Roaming\Avira 2011-11-04 14:02 . 2011-07-20 09:30 61960 ----a-w- c:\windows\system32\drivers\avgntflt.sys 2011-11-04 14:02 . 2011-07-20 09:30 137656 ----a-w- c:\windows\system32\drivers\avipbb.sys 2011-11-04 14:02 . 2011-11-04 14:02 -------- d-----w- c:\programdata\Avira 2011-11-03 14:26 . 2011-11-03 14:26 -------- d-----w- c:\programdata\Readon 2011-10-29 13:57 . 2011-10-29 13:57 -------- d-sh--w- c:\windows\system32\%APPDATA% 2011-10-24 13:56 . 2011-10-24 13:56 -------- d-----w- c:\program files\Common Files\Java 2011-10-19 11:48 . 2011-10-19 11:48 -------- d-----w- c:\users\ACER 6930\AppData\Roaming\Panda Security 2011-10-19 11:46 . 2011-11-04 13:48 -------- d-----w- c:\program files\Panda Security 2011-10-19 11:46 . 2011-10-19 11:46 -------- d-----w- c:\programdata\Panda Security 2011-10-19 11:45 . 2011-10-19 11:46 -------- d-----w- C:\temp 2011-10-19 10:13 . 2011-10-19 11:38 -------- d-----w- c:\programdata\AVAST Software 2011-10-19 10:13 . 2011-10-19 10:13 -------- d-----w- c:\program files\AVAST Software 2011-10-19 09:54 . 2011-10-19 11:50 386560 ----a-w- c:\windows\system32\drivers\XAudio.exe 2011-10-19 09:54 . 2011-10-19 11:50 81920 ----a-w- c:\windows\system32\IoctlSvc.exe 2011-10-19 09:42 . 2011-10-19 09:42 -------- d-----w- c:\program files\Avira 2011-10-19 09:07 . 2011-10-19 09:07 -------- d-----w- c:\users\ACER 6930\AppData\Local\VS Revo Group 2011-10-19 09:06 . 2009-12-30 09:21 27192 ----a-w- c:\windows\system32\drivers\revoflt.sys 2011-10-19 09:06 . 2011-10-19 09:06 -------- d-----w- c:\program files\VS Revo Group 2011-10-16 14:35 . 2011-10-16 14:41 -------- d-----w- c:\users\ACER 6930\AppData\Roaming\Registry Mechanic 2011-10-16 14:18 . 2010-09-16 08:26 37336 ----a-w- c:\windows\system32\CleanMFT32.exe 2011-10-16 14:18 . 2008-04-02 12:54 1101824 ----a-w- c:\windows\system32\UniBox210.ocx 2011-10-16 14:18 . 2008-04-02 12:53 212992 ----a-w- c:\windows\system32\UniBoxVB12.ocx 2011-10-16 14:18 . 2008-04-02 12:53 880640 ----a-w- c:\windows\system32\UniBox10.ocx 2011-10-16 14:18 . 2004-08-04 04:00 506368 ----a-w- c:\windows\system32\msxml.dll 2011-10-16 14:17 . 2011-10-16 14:17 -------- d-----w- c:\program files\Common Files\PC Tools 2011-10-13 17:03 . 2011-07-29 16:01 293376 ----a-w- c:\windows\system32\psisdecd.dll 2011-10-13 17:03 . 2011-07-29 16:01 217088 ----a-w- c:\windows\system32\psisrndr.ax 2011-10-13 17:03 . 2011-07-29 16:00 57856 ----a-w- c:\windows\system32\MSDvbNP.ax 2011-10-13 17:03 . 2011-07-29 16:00 69632 ----a-w- c:\windows\system32\Mpeg2Data.ax 2011-10-13 17:03 . 2011-09-06 13:30 2043392 ----a-w- c:\windows\system32\win32k.sys 2011-10-13 17:02 . 2011-08-25 16:15 555520 ----a-w- c:\windows\system32\UIAutomationCore.dll 2011-10-13 17:02 . 2011-08-25 16:14 238080 ----a-w- c:\windows\system32\oleacc.dll 2011-10-13 17:02 . 2011-08-25 13:31 4096 ----a-w- c:\windows\system32\oleaccrc.dll 2011-10-13 17:02 . 2011-08-25 16:14 563712 ----a-w- c:\windows\system32\oleaut32.dll . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-11-06 13:05 . 2009-08-09 18:42 66560 ----a-w- c:\windows\system32\drivers\smb.sys 2011-10-19 11:48 . 2008-07-04 02:32 196608 ----a-w- c:\windows\system32\nvvsvc.exe 2011-10-09 16:34 . 2011-05-18 06:28 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2011-10-03 02:06 . 2010-06-23 17:01 472808 ----a-w- c:\windows\system32\deployJava1.dll 2011-08-30 20:05 . 2011-08-30 20:05 83816 ----a-w- c:\windows\system32\dns-sd.exe 2011-08-30 20:05 . 2011-08-30 20:05 73064 ----a-w- c:\windows\system32\dnssd.dll 2011-08-30 20:05 . 2011-08-30 20:05 50536 ----a-w- c:\windows\system32\jdns_sd.dll 2011-08-30 20:05 . 2011-08-30 20:05 178536 ----a-w- c:\windows\system32\dnssdX.dll 2011-09-20 16:38 . 2011-05-15 20:08 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll . . ------- Sigcheck ------- Note: Unsigned files aren't necessarily malware. . [7] 2011-05-17 . 904E13BA41AF2E353A32CF351CA53639 . 748336 . . [9.00.8112.16421] . . c:\windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.1.8112.16421_none_58a99749ebaa0de6\iexplore.exe [7] 2011-02-22 . 9CE5543464432CA73134F170FA2BF823 . 638232 . . [8.00.6001.23143] . . c:\windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.23143_none_12ac5bb64907479b\iexplore.exe [7] 2011-02-22 . C1D36A2CBE0CEC4DF593DB1288CF586E . 638232 . . [8.00.6001.19048] . . c:\windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.19048_none_1227c05d2fe52684\iexplore.exe [7] 2010-12-18 . 7852371DA9EFBC17B645558E23780EAC . 638232 . . [8.00.6001.23111] . . c:\windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.23111_none_12cacae648f0c11a\iexplore.exe [7] 2010-12-18 . B988D7F127B94BD5BF8356FE81B985C4 . 638232 . . [8.00.6001.19019] . . c:\windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.19019_none_1249306b2fcbec08\iexplore.exe [7] 2010-11-02 . 92A17B0A89D14815AACC62CD190B6CE3 . 638232 . . [8.00.6001.23091] . . c:\windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.23091_none_127449a04931a37b\iexplore.exe [7] 2010-11-02 . 5AB037B17F8A87D052F5A88E0D29A3C8 . 638232 . . [8.00.6001.18999] . . c:\windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.18999_none_11f2d8e9300c984e\iexplore.exe [7] 2010-09-08 . 4A719476A6393B1DCACFEB4F3AC6599C . 638232 . . [8.00.6001.23067] . . c:\windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.23067_none_129abb204913e7b2\iexplore.exe [7] 2010-09-08 . D5A730DFDEAE005373E62BC2A866E3BB . 638232 . . [8.00.6001.18975] . . c:\windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.18975_none_120477992ffffb10\iexplore.exe [7] 2010-06-26 . F05B3A2C6CB319DD1377AD566CF5ECE5 . 638232 . . [8.00.6001.23040] . . c:\windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.23040_none_12a958f24909fe6f\iexplore.exe [7] 2010-06-26 . 7420BE0E7D3D1320054F7ACA0594953D . 638232 . . [8.00.6001.18943] . . c:\windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.18943_none_1222e6c92fe9748f\iexplore.exe [7] 2010-05-04 . 48A6109E8DF0365195298CC527B7426A . 638232 . . [8.00.6001.23019] . . c:\windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.23019_none_12d2cb5048e98eab\iexplore.exe [7] 2010-05-04 . 5C9B1062EA7A44E8F6BFDE994B68C7AA . 638232 . . [8.00.6001.18928] . . c:\windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.18928_none_123d88132fd4bb60\iexplore.exe [7] 2010-02-23 . 25DB705A7DC85C208B3CF2D20F118AA7 . 638232 . . [8.00.6001.22995] . . c:\windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.22995_none_127872a6492dd595\iexplore.exe [7] 2010-02-23 . 9F52FBE99C749E3F32C75124F09F1B03 . 638232 . . [8.00.6001.18904] . . c:\windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.18904_none_124f26c32fc81e22\iexplore.exe [7] 2010-01-02 . 3D8DA00B028DEA9517066F1CECBFC4A2 . 638216 . . [8.00.6001.22973] . . c:\windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.22973_none_128c11ea491f6b05\iexplore.exe [7] 2010-01-02 . 88BD42DAE7CFFEB256CA7145A15E4843 . 638216 . . [8.00.6001.18882] . . c:\windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.18882_none_11f6a4e9300acdd5\iexplore.exe [7] 2009-11-21 . E7F8DF50E483D165BB01F367D3519AA7 . 638232 . . [8.00.6001.22956] . . c:\windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.22956_none_12a4b2a0490c7f28\iexplore.exe [7] 2009-11-21 . 1B6362BB14FCEB9E76BCF9A953B04788 . 638232 . . [8.00.6001.18865] . . c:\windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.18865_none_120f459f2ff7e1f8\iexplore.exe [7] 2009-08-27 . 7DD482E4A2E3CBB0A72F718C342F5B75 . 638216 . . [8.00.6001.22918] . . c:\windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.22918_none_12d1f2e448ea4212\iexplore.exe [7] 2009-08-27 . 2E48756F12C21F46895036AC089AAD97 . 638232 . . [8.00.6001.18828] . . c:\windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.18828_none_123d862d2fd4be39\iexplore.exe [7] 2009-07-22 . 4B5AEA50CE77FBA4C2D169622DC9B489 . 638232 . . [8.00.6001.22903] . . c:\windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.22903_none_12d7c15e48e6a76e\iexplore.exe [7] 2009-07-21 . C33BD196A0301F9B23D9A003D30ED8B0 . 638216 . . [8.00.6001.18813] . . c:\windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.18813_none_124354a72fd12395\iexplore.exe [7] 2009-04-11 . 2C5168C856455CC43C4B4E1CC1920001 . 636080 . . [7.00.6002.18005] . . c:\windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6002.18005_none_314d791517204c15\iexplore.exe [7] 2009-03-08 . B60DDDD2D63CE41CB8C487FCFBB6419E . 638816 . . [8.00.6001.18702] . . c:\windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.18702_none_124d22632fc9f126\iexplore.exe [7] 2009-03-03 . 9E6C1527D9A2C64BFD780AA23075380F . 636072 . . [7.00.6001.18226] . . c:\windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.18226_none_2f5265b91a094b03\iexplore.exe [7] 2009-03-03 . 8BA2B7A05F88BE0D45237A0994AD8366 . 636072 . . [7.00.6001.22389] . . c:\windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.22389_none_2f9e23da3354de78\iexplore.exe [7] 2009-03-03 . EA4BE33726155F89D89A3FE7142878E0 . 636072 . . [7.00.6000.16830] . . c:\windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.16830_none_2d5b556b1cf03df9\iexplore.exe [7] 2009-03-03 . 1DD66A2851DACDEC32EAE8F9A8865ABD . 636072 . . [7.00.6000.21023] . . c:\windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.21023_none_2df29b2236034119\iexplore.exe [7] 2009-01-15 . F0B1CA517977BA2FF6DA33F1B966C488 . 634024 . . [7.00.6000.20996] . . c:\windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.20996_none_2daa146a36391d73\iexplore.exe [7] 2009-01-15 . 0844F5B9CB3BB85A917D347EF1565B6C . 634024 . . [7.00.6000.16809] . . c:\windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.16809_none_2d84c7c91ccfce35\iexplore.exe [7] 2008-10-16 . D762642A109433EEDCD332B0A9511137 . 634024 . . [7.00.6000.16764] . . c:\windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.16764_none_2d3ee4e91d04fa01\iexplore.exe [7] 2008-10-16 . 4CBA2F58668F2D5F3259CBE73E227F25 . 634024 . . [7.00.6000.20937] . . c:\windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.20937_none_2debf43c36078f24\iexplore.exe [7] 2008-04-25 . 07ED775D6DB4BFA96D7CFB09EB228418 . 625664 . . [7.00.6000.16681] . . c:\windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.16681_none_2d26424d1d17e8b7\iexplore.exe [7] 2008-04-25 . 9F1427F203CA078005C9943800929640 . 625664 . . [7.00.6000.20823] . . c:\windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.20823_none_2df2c11a360310b0\iexplore.exe [7] 2008-02-22 . 182CAF7403705ACCB51211A761080B8F . 625664 . . [7.00.6000.20777] . . c:\windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.20777_none_2dc0b0c03628049a\iexplore.exe [7] 2008-02-21 . 9437CA21CD48C9B6BFD6F5AC0143D251 . 625664 . . [7.00.6000.16643] . . c:\windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.16643_none_2d5382911cf5aba1\iexplore.exe [7] 2008-01-21 . 5B92133D3E7FB2644677686305E29E81 . 625664 . . [7.00.6001.18000] . . c:\windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.18000_none_2f62000919fe80c9\iexplore.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP] @="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}" [HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}] 2008-05-15 00:05 121392 ----a-w- c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240] "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-07-20 182808] "RtHDVCpl"="RtHDVCpl.exe" [2008-05-07 6139904] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-04-25 1049896] "eAudio"="c:\program files\Acer\Empowering Technology\eAudio\eAudio.exe" [2008-05-30 544768] "WarReg_PopUp"="c:\program files\Acer\WR_PopUp\WarReg_PopUp.exe" [2008-01-29 303104] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-07-18 13543968] "PLFSetI"="c:\windows\PLFSetI.exe" [2007-10-23 200704] "LManager"="c:\progra~1\LAUNCH~1\QtZgAcer.EXE" [2008-06-04 817672] "ePower_DMC"="c:\program files\Acer\Empowering Technology\ePower\ePower_DMC.exe" [2008-08-01 405504] "Gnetmous"="c:\program files\Samsung\Samsung Optical Wheel Mouse\gnetmous.exe" [2002-08-02 153088] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2011-08-31 40368] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-29 937920] "SSDMonitor"="c:\program files\Common Files\PC Tools\sMonitor\SSDMonitor.exe" [2010-11-15 112600] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696] "avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-04-21 281768] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ TotalMedia Server.lnk - c:\program files\ArcSoft\TotalMedia Theatre 5\TotalMedia Server\TM Server.exe [2010-11-10 519744] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) "DisableCAD"= 1 (0x1) . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\AWinNotifyVitaKey MC3000] 2009-01-14 16:15 3197952 ----a-w- c:\program files\Acer\Acer Bio Protection\WinNotify.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\spba] 2008-03-25 13:24 567560 ----a-w- c:\program files\Common Files\SPBA\homefus2.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=c:\windows\System32\avgrsstx.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "aux"=wdmaud.drv . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" . [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-] "DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" -lang 1033 "WMPNSCFG"=c:\program files\Windows Media Player\WMPNSCFG.exe "ehTray.exe"=c:\windows\ehome\ehTray.exe "IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020 "Google Update"="c:\users\ACER 6930\AppData\Local\Google\Update\GoogleUpdate.exe" /c . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "BkupTray"="c:\program files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe" "NvMediaCenter"=RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit "Resume copy"=copyfstq.exe /startup "eDataSecurity Loader"=c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" "ZPdtWzdVitaKey MC3000"="c:\program files\Acer\Acer Bio Protection\PdtWzd.exe" show "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-615531898-3775969475-203111388-1000] "EnableNotificationsRef"=dword:00000001 . R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [x] R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [x] R2 ETService;Empowering Technology Service;c:\program files\Acer\Empowering Technology\Service\ETService.exe [x] R2 gupdate;Услуга Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [x] R2 IGBASVC;iGroupTec Service;c:\program files\Acer\Acer Bio Protection\BASVC.exe [2011-10-19 3602432] R2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [x] R3 gupdatem;Услуга на Google Актуализация (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [x] R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [x] R3 qcusbser;Modem Interface USB Device for Legacy Serial Communication;c:\windows\system32\DRIVERS\qcusbser.sys [2009-08-27 103552] R3 Revoflt;Revoflt;c:\windows\system32\DRIVERS\revoflt.sys [2009-12-30 27192] S0 AlfaFF;AlfaFF File System mini-filter;c:\windows\system32\Drivers\AlfaFF.sys [2009-01-14 42608] S0 AvgRkx86;avgrkx86.sys;c:\windows\System32\Drivers\avgrkx86.sys [2009-05-13 12552] S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2009-01-14 685816] S1 ArcSec;ArcSec;c:\windows\system32\drivers\ArcSec.sys [2010-09-21 192504] S1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\System32\Drivers\avgldx86.sys [2009-07-30 335240] S1 AvgTdiX;AVG8 Network Redirector;c:\windows\System32\Drivers\avgtdix.sys [2009-05-13 108552] S2 BUNAgentSvc;NTI Backup Now 5 Agent Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe [2011-10-19 16384] S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2011-08-31 366152] S2 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [2011-10-19 45056] S2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;c:\program files\Common Files\PC Tools\sMonitor\StartManSvc.exe [2011-10-19 632792] S2 RS_Service;Raw Socket Service;c:\program files\Acer\Acer VCM\RS_Service.exe [2011-10-19 233472] S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368] S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-08-31 22216] S3 NETw5v32;Intel® Wireless WiFi Link Adapter Driver for Windows Vista 32 Bit ;c:\windows\system32\DRIVERS\NETw5v32.sys [2008-05-05 3658752] S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32v.sys [2008-06-25 44064] S3 winbondcir;Winbond IR Transceiver;c:\windows\system32\DRIVERS\winbondcir.sys [2007-03-28 43008] . . --- Other Services/Drivers In Memory --- . *NewlyCreated* - 00618325 *NewlyCreated* - ECACHE *Deregistered* - 00618325 . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] bthsvcs REG_MULTI_SZ BthServ LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache . Contents of the 'Scheduled Tasks' folder . 2011-11-06 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-615531898-3775969475-203111388-1000Core.job - c:\users\ACER 6930\AppData\Local\Google\Update\GoogleUpdate.exe [2010-12-27 07:38] . 2011-11-06 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-615531898-3775969475-203111388-1000UA.job - c:\users\ACER 6930\AppData\Local\Google\Update\GoogleUpdate.exe [2010-12-27 07:38] . 2011-11-06 c:\windows\Tasks\RMSchedule.job - c:\program files\Registry Mechanic\RegMech.exe [2011-10-16 14:24] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.ask.com?o=15187&l=dis mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0402&s=2&o=vp32&d=0109&m=aspire_6930g uInternet Settings,ProxyOverride = *.local IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html IE: Send image to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm IE: Send page to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm TCP: DhcpNameServer = 192.168.1.1 FF - ProfilePath - c:\users\ACER 6930\AppData\Roaming\Mozilla\Firefox\Profiles\an794mxz.default\ FF - prefs.js: browser.search.selectedEngine - Yahoo FF - prefs.js: browser.startup.homepage - hxxp://www.mystart.com/?pr=vmn&id=pandasecuritytb&v=2_0 FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=panda&type=PCAFSI1208&p= FF - user.js: nglayout.initialpaint.delay - 600 FF - user.js: content.notify.interval - 600000 FF - user.js: content.max.tokenizing.time - 1800000 FF - user.js: content.switch.threshold - 600000 FF - user.js: network.http.max-persistent-connections-per-server - 4 . - - - - ORPHANS REMOVED - - - - . Toolbar-ITBar7Position - (no file) WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file) SafeBoot-07842833.sys . . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2011-11-06 19:12 Windows 6.0.6002 Service Pack 2 NTFS . scanning hidden processes ... . scanning hidden autostart entries ... . scanning hidden files ... . scan completed successfully hidden files: 0 . ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions] @Denied: (2) (LocalSystem) "{5CBE3B7C-1E47-477E-A7DD-396DB0476E29}"=hex:51,66,7a,6c,4c,1d,38,12,12,38,ad, 58,75,50,10,02,d8,cb,7a,2d,b5,19,2a,3d "{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}"=hex:51,66,7a,6c,4c,1d,38,12,f1,9d,97, 02,e5,86,37,08,c7,6b,3b,0b,78,35,a4,a7 "{53707962-6F74-2D53-2644-206D7942484F}"=hex:51,66,7a,6c,4c,1d,38,12,0c,7a,63, 57,46,21,3d,68,59,52,63,2d,7c,1c,0c,5b "{83A2F9B1-01A2-4AA5-87D1-45B6B8505E96}"=hex:51,66,7a,6c,4c,1d,38,12,df,fa,b1, 87,90,4f,cb,0f,f8,c7,06,f6,bd,0e,1a,82 "{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db, df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd "{FF059E31-CC5A-4E2E-BF3B-96E929D65503}"=hex:51,66,7a,6c,4c,1d,38,12,5f,9d,16, fb,68,82,40,0b,c0,2d,d5,a9,2c,88,11,17 "{BDEADE7F-C265-11D0-BCED-00A0C90AB50F}"=hex:51,66,7a,6c,4c,1d,38,12,11,dd,f9, b9,57,8c,be,54,c3,fb,43,e0,cc,54,f1,1b . [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration] @Denied: (2) (LocalSystem) "Timestamp"=hex:10,65,2f,3b,6a,9c,cc,01 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . --------------------- DLLs Loaded Under Running Processes --------------------- . - - - - - - - > 'Explorer.exe'(1404) c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll c:\program files\Acer\Empowering Technology\eDataSecurity\x86\sysenv.dll . Completion time: 2011-11-06 19:18:59 ComboFix-quarantined-files.txt 2011-11-06 17:18 . Pre-Run: 28 088 061 952 bytes free Post-Run: 27 830 218 752 bytes free . - - End Of File - - D726107DE27D22B17C65F30DFE6A059B

6 ноември 201114 г.

Сега изтеглете TDSSKiller от тук и я запазете на вашия декстоп.

Стартирайте TDSSKiller.exe за да стартирате приложението. След това кликнете върху бутона Change parameters.
Сложете отметки пред Verify Driver Digital Signature и Detect TDLFS file system и натиснете ОК.
Натиснете бутона Start Scan.
Ако подозрителен обект бъде засечен, действието по подразбиране ще бъде Skip, кликнете върху Continue.
Ако зловредни обекти бъдат намерени, тогава от падащото меню ще имате три възможности.

Бъдете сигурни, че избраното действие е Cure и натиснете върху Continue > Рестартирайте за да бъде завършена поправката.

Забележка: Ако Cure бутона не е наличен от възможностите, тогава моля изберете Skip бутона, не избирайте Delete освен ако не сте инструктирани затова.
Изберете skip за услугата sptd.
Лог файл ще бъде създаден в свободната директория на дял C:\ . Потърсете за лог с името "TDSSKiller.[Version]_[Date]_[Time]_log.txt" и копирайте съдържанието му в следващия си пост.

P.S. Не се притеснявайте, че правим толкова много сканирания. Това е нормално, стандартна процедура. След малко ще проверим за заключени файлове.

6 ноември 201114 г.

Автор

20:00:17.0375 3596 20:00:18.0043 3596 20:00:18.0043 3596 20:00:18.0043 3596 SystemInfo: 20:00:18.0043 3596 20:00:18.0044 3596 20:00:18.0044 3596 20:00:18.0044 3596 20:00:18.0044 3596 UserName: ACER 6930 20:00:18.0044 3596 20:00:18.0045 3596 20:00:18.0045 3596 20:00:18.0045 3596 20:00:18.0045 3596 Page size: 0x1000 20:00:18.0045 3596 20:00:18.0045 3596 20:00:18.0695 3596 Initialize success 20:00:29.0384 3488 20:00:29.0384 3488 Scan started 20:00:29.0384 3488 20:00:29.0384 3488 20:00:29.0983 3488 ACPI 20:00:30.0259 3488 ACPI - ok 20:00:30.0319 3488 adp94xx 20:00:30.0369 3488 adp94xx - ok 20:00:30.0421 3488 adpahci 20:00:30.0458 3488 adpahci - ok 20:00:30.0486 3488 adpu160m 20:00:30.0519 3488 adpu160m - ok 20:00:30.0547 3488 adpu320 20:00:30.0580 3488 adpu320 - ok 20:00:30.0640 3488 AFD 20:00:30.0736 3488 AFD - ok 20:00:30.0770 3488 agp440 20:00:30.0799 3488 agp440 - ok 20:00:30.0835 3488 aic78xx 20:00:30.0869 3488 aic78xx - ok 20:00:30.0915 3488 AlfaFF 20:00:30.0997 3488 AlfaFF - ok 20:00:31.0035 3488 aliide 20:00:31.0067 3488 aliide - ok 20:00:31.0097 3488 amdagp 20:00:31.0129 3488 amdagp - ok 20:00:31.0147 3488 amdide 20:00:31.0181 3488 amdide - ok 20:00:31.0207 3488 AmdK7 20:00:31.0352 3488 AmdK7 - ok 20:00:31.0393 3488 AmdK8 20:00:31.0477 3488 AmdK8 - ok 20:00:31.0580 3488 arc 20:00:31.0614 3488 arc - ok 20:00:31.0642 3488 arcsas 20:00:31.0678 3488 arcsas - ok 20:00:31.0750 3488 ArcSec 20:00:31.0779 3488 ArcSec - ok 20:00:31.0798 3488 ASPI32 - ok 20:00:31.0836 3488 AsyncMac 20:00:31.0932 3488 AsyncMac - ok 20:00:31.0970 3488 atapi 20:00:32.0010 3488 atapi - ok 20:00:32.0082 3488 athr 20:00:32.0178 3488 athr - ok 20:00:32.0284 3488 AvgLdx86 20:00:32.0320 3488 AvgLdx86 - ok 20:00:32.0362 3488 AvgMfx86 20:00:32.0385 3488 AvgMfx86 - ok 20:00:32.0437 3488 avgntflt 20:00:32.0462 3488 avgntflt - ok 20:00:32.0504 3488 AvgRkx86 20:00:32.0529 3488 AvgRkx86 - ok 20:00:32.0579 3488 AvgTdiX 20:00:32.0605 3488 AvgTdiX - ok 20:00:32.0679 3488 avipbb 20:00:32.0707 3488 avipbb - ok 20:00:32.0743 3488 Beep 20:00:32.0819 3488 Beep - ok 20:00:32.0868 3488 blbdrive 20:00:32.0955 3488 blbdrive - ok 20:00:33.0030 3488 bowser 20:00:33.0111 3488 bowser - ok 20:00:33.0142 3488 BrFiltLo 20:00:33.0224 3488 BrFiltLo - ok 20:00:33.0251 3488 BrFiltUp 20:00:33.0321 3488 BrFiltUp - ok 20:00:33.0371 3488 Brserid 20:00:33.0623 3488 Brserid - ok 20:00:33.0724 3488 BrSerWdm 20:00:33.0861 3488 BrSerWdm - ok 20:00:33.0905 3488 BrUsbMdm 20:00:34.0035 3488 BrUsbMdm - ok 20:00:34.0057 3488 BrUsbSer 20:00:34.0188 3488 BrUsbSer - ok 20:00:34.0243 3488 BthEnum 20:00:34.0309 3488 BthEnum - ok 20:00:34.0344 3488 BTHMODEM 20:00:34.0407 3488 BTHMODEM - ok 20:00:34.0446 3488 BthPan 20:00:34.0538 3488 BthPan - ok 20:00:34.0597 3488 BthPort 20:00:34.0687 3488 BthPort - ok 20:00:34.0755 3488 BTHUSB 20:00:34.0813 3488 BTHUSB - ok 20:00:34.0863 3488 btwaudio 20:00:34.0889 3488 btwaudio - ok 20:00:34.0925 3488 btwavdt 20:00:34.0951 3488 btwavdt - ok 20:00:34.0995 3488 btwrchid 20:00:35.0017 3488 btwrchid - ok 20:00:35.0126 3488 catchme - ok 20:00:35.0157 3488 cdfs 20:00:35.0248 3488 cdfs - ok 20:00:35.0298 3488 cdrom 20:00:35.0356 3488 cdrom - ok 20:00:35.0398 3488 circlass 20:00:35.0492 3488 circlass - ok 20:00:35.0557 3488 CLFS 20:00:35.0601 3488 CLFS - ok 20:00:35.0655 3488 CmBatt 20:00:35.0743 3488 CmBatt - ok 20:00:35.0772 3488 cmdide 20:00:35.0805 3488 cmdide - ok 20:00:35.0835 3488 Compbatt 20:00:35.0863 3488 Compbatt - ok 20:00:35.0900 3488 crcdisk 20:00:35.0929 3488 crcdisk - ok 20:00:35.0986 3488 Crusoe 20:00:36.0072 3488 Crusoe - ok 20:00:36.0149 3488 DfsC 20:00:36.0226 3488 DfsC - ok 20:00:36.0276 3488 disk 20:00:36.0313 3488 disk - ok 20:00:36.0354 3488 DKbFltr 20:00:36.0378 3488 DKbFltr - ok 20:00:36.0439 3488 drmkaud 20:00:36.0513 3488 drmkaud - ok 20:00:36.0583 3488 DXGKrnl 20:00:36.0643 3488 DXGKrnl - ok 20:00:36.0679 3488 E1G60 20:00:36.0767 3488 E1G60 - ok 20:00:36.0824 3488 Ecache 20:00:36.0861 3488 Ecache - ok 20:00:36.0954 3488 elxstor 20:00:36.0997 3488 elxstor - ok 20:00:37.0060 3488 ErrDev 20:00:37.0140 3488 ErrDev - ok 20:00:37.0222 3488 exfat 20:00:37.0288 3488 exfat - ok 20:00:37.0339 3488 fastfat 20:00:37.0414 3488 fastfat - ok 20:00:37.0452 3488 fdc 20:00:37.0529 3488 fdc - ok 20:00:37.0578 3488 FileInfo 20:00:37.0609 3488 FileInfo - ok 20:00:37.0639 3488 Filetrace 20:00:37.0737 3488 Filetrace - ok 20:00:37.0757 3488 flpydisk 20:00:37.0844 3488 flpydisk - ok 20:00:37.0892 3488 FltMgr 20:00:37.0932 3488 FltMgr - ok 20:00:38.0000 3488 Fs_Rec 20:00:38.0073 3488 Fs_Rec - ok 20:00:38.0112 3488 gagp30kx 20:00:38.0146 3488 gagp30kx - ok 20:00:38.0178 3488 genmcmn 20:00:38.0191 3488 20:00:38.0191 3488 20:00:38.0290 3488 20:00:38.0424 3488 HdAudAddService - ok 20:00:38.0485 3488 HDAudBus 20:00:38.0578 3488 HDAudBus - ok 20:00:38.0618 3488 HidBth 20:00:38.0753 3488 HidBth - ok 20:00:38.0777 3488 HidIr 20:00:38.0839 3488 HidIr - ok 20:00:38.0896 3488 HidUsb 20:00:38.0956 3488 HidUsb - ok 20:00:39.0009 3488 HpCISSs 20:00:39.0037 3488 HpCISSs - ok 20:00:39.0079 3488 HSFHWAZL 20:00:39.0168 3488 HSFHWAZL - ok 20:00:39.0234 3488 HSF_DPV 20:00:39.0367 3488 HSF_DPV - ok 20:00:39.0412 3488 HSXHWAZL 20:00:39.0462 3488 HSXHWAZL - ok 20:00:39.0511 3488 HTTP 20:00:39.0599 3488 HTTP - ok 20:00:39.0641 3488 i2omp 20:00:39.0669 3488 i2omp - ok 20:00:39.0701 3488 i8042prt 20:00:39.0770 3488 i8042prt - ok 20:00:39.0834 3488 iaStor 20:00:39.0871 3488 iaStor - ok 20:00:39.0916 3488 iaStorV 20:00:39.0953 3488 iaStorV - ok 20:00:40.0011 3488 iirsp 20:00:40.0038 3488 iirsp - ok 20:00:40.0101 3488 int15 20:00:40.0128 3488 20:00:40.0128 3488 20:00:40.0238 3488 20:00:40.0390 3488 20:00:40.0425 3488 intelide 20:00:40.0454 3488 intelide - ok 20:00:40.0482 3488 intelppm 20:00:40.0566 3488 intelppm - ok 20:00:40.0614 3488 IpFilterDriver 20:00:40.0698 3488 IpFilterDriver - ok 20:00:40.0728 3488 IpInIp - ok 20:00:40.0765 3488 IPMIDRV 20:00:40.0846 3488 IPMIDRV - ok 20:00:40.0879 3488 IPNAT 20:00:40.0955 3488 IPNAT - ok 20:00:40.0986 3488 IRENUM 20:00:41.0069 3488 IRENUM - ok 20:00:41.0112 3488 isapnp 20:00:41.0150 3488 isapnp - ok 20:00:41.0194 3488 iScsiPrt 20:00:41.0241 3488 iScsiPrt - ok 20:00:41.0266 3488 iteatapi 20:00:41.0294 3488 iteatapi - ok 20:00:41.0336 3488 iteraid 20:00:41.0363 3488 iteraid - ok 20:00:41.0405 3488 kbdclass 20:00:41.0441 3488 kbdclass - ok 20:00:41.0489 3488 kbdhid 20:00:41.0556 3488 kbdhid - ok 20:00:41.0625 3488 KSecDD 20:00:41.0699 3488 KSecDD - ok 20:00:41.0757 3488 L1E 20:00:41.0809 3488 L1E - ok 20:00:41.0879 3488 lltdio 20:00:41.0964 3488 lltdio - ok 20:00:42.0021 3488 LSI_FC 20:00:42.0053 3488 LSI_FC - ok 20:00:42.0096 3488 LSI_SAS 20:00:42.0129 3488 LSI_SAS - ok 20:00:42.0171 3488 LSI_SCSI 20:00:42.0204 3488 LSI_SCSI - ok 20:00:42.0236 3488 luafv 20:00:42.0323 3488 luafv - ok 20:00:42.0435 3488 MBAMProtector 20:00:42.0468 3488 MBAMProtector - ok 20:00:42.0517 3488 MBAMSwissArmy - ok 20:00:42.0575 3488 mdmxsdk 20:00:42.0609 3488 mdmxsdk - ok 20:00:42.0639 3488 megasas 20:00:42.0680 3488 megasas - ok 20:00:42.0725 3488 MegaSR 20:00:42.0772 3488 MegaSR - ok 20:00:42.0821 3488 Modem 20:00:42.0907 3488 Modem - ok 20:00:42.0948 3488 monitor 20:00:43.0025 3488 monitor - ok 20:00:43.0060 3488 mouclass 20:00:43.0092 3488 mouclass - ok 20:00:43.0123 3488 mouhid 20:00:43.0203 3488 mouhid - ok 20:00:43.0237 3488 MountMgr 20:00:43.0268 3488 MountMgr - ok 20:00:43.0322 3488 mpio 20:00:43.0353 3488 mpio - ok 20:00:43.0392 3488 mpsdrv 20:00:43.0487 3488 mpsdrv - ok 20:00:43.0534 3488 Mraid35x 20:00:43.0560 3488 Mraid35x - ok 20:00:43.0607 3488 MRxDAV 20:00:43.0678 3488 MRxDAV - ok 20:00:43.0728 3488 mrxsmb 20:00:43.0796 3488 mrxsmb - ok 20:00:43.0852 3488 mrxsmb10 20:00:43.0910 3488 mrxsmb10 - ok 20:00:43.0951 3488 mrxsmb20 20:00:44.0003 3488 mrxsmb20 - ok 20:00:44.0049 3488 msahci 20:00:44.0077 3488 msahci - ok 20:00:44.0111 3488 msdsm 20:00:44.0144 3488 msdsm - ok 20:00:44.0196 3488 Msfs 20:00:44.0281 3488 Msfs - ok 20:00:44.0324 3488 msisadrv 20:00:44.0353 3488 msisadrv - ok 20:00:44.0429 3488 MSKSSRV 20:00:44.0514 3488 MSKSSRV - ok 20:00:44.0540 3488 MSPCLOCK 20:00:44.0616 3488 MSPCLOCK - ok 20:00:44.0650 3488 MSPQM 20:00:44.0728 3488 MSPQM - ok 20:00:44.0773 3488 MsRPC 20:00:44.0812 3488 MsRPC - ok 20:00:44.0852 3488 mssmbios 20:00:44.0886 3488 mssmbios - ok 20:00:44.0908 3488 MSTEE 20:00:44.0996 3488 MSTEE - ok 20:00:45.0032 3488 Mup 20:00:45.0067 3488 Mup - ok 20:00:45.0127 3488 NativeWifiP 20:00:45.0210 3488 NativeWifiP - ok 20:00:45.0265 3488 NDIS 20:00:45.0335 3488 NDIS - ok 20:00:45.0404 3488 NdisTapi 20:00:45.0474 3488 NdisTapi - ok 20:00:45.0520 3488 Ndisuio 20:00:45.0593 3488 Ndisuio - ok 20:00:45.0657 3488 NdisWan 20:00:45.0736 3488 NdisWan - ok 20:00:45.0769 3488 NDProxy 20:00:45.0840 3488 NDProxy - ok 20:00:45.0881 3488 NetBIOS 20:00:45.0953 3488 NetBIOS - ok 20:00:46.0004 3488 netbt 20:00:46.0085 3488 netbt - ok 20:00:46.0285 3488 NETw5v32 20:00:46.0644 3488 NETw5v32 - ok 20:00:46.0698 3488 nfrd960 20:00:46.0745 3488 nfrd960 - ok 20:00:46.0850 3488 Npfs 20:00:46.0906 3488 Npfs - ok 20:00:46.0942 3488 nsiproxy 20:00:47.0025 3488 nsiproxy - ok 20:00:47.0124 3488 Ntfs 20:00:47.0217 3488 Ntfs - ok 20:00:47.0262 3488 NTIDrvr 20:00:47.0290 3488 NTIDrvr - ok 20:00:47.0336 3488 ntrigdigi 20:00:47.0458 3488 ntrigdigi - ok 20:00:47.0486 3488 Null 20:00:47.0563 3488 Null - ok 20:00:47.0610 3488 NVHDA 20:00:47.0634 3488 NVHDA - ok 20:00:47.0940 3488 nvlddmkm 20:00:48.0438 3488 nvlddmkm - ok 20:00:48.0498 3488 nvraid 20:00:48.0530 3488 nvraid - ok 20:00:48.0565 3488 nvstor 20:00:48.0596 3488 nvstor - ok 20:00:48.0639 3488 nv_agp 20:00:48.0679 3488 nv_agp - ok 20:00:48.0702 3488 NwlnkFlt - ok 20:00:48.0730 3488 NwlnkFwd - ok 20:00:48.0762 3488 ohci1394 20:00:48.0895 3488 ohci1394 - ok 20:00:48.0974 3488 Parport 20:00:49.0106 3488 Parport - ok 20:00:49.0159 3488 partmgr 20:00:49.0195 3488 partmgr - ok 20:00:49.0227 3488 Parvdm 20:00:49.0358 3488 Parvdm - ok 20:00:49.0419 3488 pci 20:00:49.0460 3488 pci - ok 20:00:49.0485 3488 pciide 20:00:49.0514 3488 pciide - ok 20:00:49.0549 3488 pcmcia 20:00:49.0585 3488 pcmcia - ok 20:00:49.0683 3488 PEAUTH 20:00:49.0848 3488 PEAUTH - ok 20:00:50.0017 3488 PptpMiniport 20:00:50.0102 3488 PptpMiniport - ok 20:00:50.0134 3488 Processor 20:00:50.0213 3488 Processor - ok 20:00:50.0268 3488 PSched 20:00:50.0343 3488 PSched - ok 20:00:50.0377 3488 PSDFilter 20:00:50.0403 3488 PSDFilter - ok 20:00:50.0437 3488 PSDNServ 20:00:50.0462 3488 PSDNServ - ok 20:00:50.0497 3488 psdvdisk 20:00:50.0520 3488 psdvdisk - ok 20:00:50.0561 3488 PxHelp20 20:00:50.0580 3488 20:00:50.0580 3488 20:00:50.0634 3488 qcusbser 20:00:50.0686 3488 qcusbser - ok 20:00:50.0748 3488 ql2300 20:00:50.0842 3488 ql2300 - ok 20:00:50.0880 3488 ql40xx 20:00:50.0913 3488 ql40xx - ok 20:00:50.0962 3488 QWAVEdrv 20:00:51.0018 3488 QWAVEdrv - ok 20:00:51.0047 3488 RasAcd 20:00:51.0128 3488 RasAcd - ok 20:00:51.0174 3488 Rasl2tp 20:00:51.0249 3488 Rasl2tp - ok 20:00:51.0322 3488 RasPppoe 20:00:51.0386 3488 RasPppoe - ok 20:00:51.0418 3488 RasSstp 20:00:51.0497 3488 RasSstp - ok 20:00:51.0555 3488 rdbss 20:00:51.0618 3488 rdbss - ok 20:00:51.0666 3488 RDPCDD 20:00:51.0749 3488 RDPCDD - ok 20:00:51.0801 3488 rdpdr 20:00:51.0879 3488 rdpdr - ok 20:00:51.0910 3488 RDPENCDD 20:00:51.0990 3488 RDPENCDD - ok 20:00:52.0039 3488 RDPWD 20:00:52.0105 3488 RDPWD - ok 20:00:52.0198 3488 Revoflt 20:00:52.0227 3488 Revoflt - ok 20:00:52.0282 3488 RFCOMM 20:00:52.0361 3488 RFCOMM - ok 20:00:52.0438 3488 rspndr 20:00:52.0512 3488 rspndr - ok 20:00:52.0571 3488 RTSTOR 20:00:52.0652 3488 RTSTOR - ok 20:00:52.0708 3488 sbp2port 20:00:52.0737 3488 sbp2port - ok 20:00:52.0816 3488 secdrv 20:00:52.0936 3488 secdrv - ok 20:00:53.0054 3488 Serenum 20:00:53.0186 3488 Serenum - ok 20:00:53.0222 3488 Serial 20:00:53.0352 3488 Serial - ok 20:00:53.0393 3488 sermouse 20:00:53.0473 3488 sermouse - ok 20:00:53.0551 3488 sffdisk 20:00:53.0609 3488 sffdisk - ok 20:00:53.0636 3488 sffp_mmc 20:00:53.0728 3488 sffp_mmc - ok 20:00:53.0750 3488 sffp_sd 20:00:53.0829 3488 sffp_sd - ok 20:00:53.0872 3488 sfloppy 20:00:54.0021 3488 sfloppy - ok 20:00:54.0092 3488 sisagp 20:00:54.0127 3488 sisagp - ok 20:00:54.0178 3488 SiSRaid2 20:00:54.0209 3488 SiSRaid2 - ok 20:00:54.0252 3488 SiSRaid4 20:00:54.0283 3488 SiSRaid4 - ok 20:00:54.0356 3488 Smb 20:00:54.0425 3488 Smb - ok 20:00:54.0488 3488 spldr 20:00:54.0520 3488 spldr - ok 20:00:54.0599 3488 sptd 20:00:54.0600 3488 20:00:54.0605 3488 20:00:54.0606 3488 20:00:54.0663 3488 srv 20:00:54.0727 3488 srv - ok 20:00:54.0783 3488 srv2 20:00:54.0852 3488 srv2 - ok 20:00:54.0905 3488 srvnet 20:00:54.0980 3488 srvnet - ok 20:00:55.0044 3488 ssmdrv 20:00:55.0076 3488 ssmdrv - ok 20:00:55.0138 3488 swenum 20:00:55.0167 3488 swenum - ok 20:00:55.0212 3488 Symc8xx 20:00:55.0244 3488 Symc8xx - ok 20:00:55.0289 3488 Sym_hi 20:00:55.0317 3488 Sym_hi - ok 20:00:55.0357 3488 Sym_u3 20:00:55.0385 3488 Sym_u3 - ok 20:00:55.0430 3488 SynTP 20:00:55.0462 3488 SynTP - ok 20:00:55.0615 3488 Tcpip 20:00:55.0689 3488 Tcpip - ok 20:00:55.0750 3488 Tcpip6 20:00:55.0881 3488 Tcpip6 - ok 20:00:55.0937 3488 tcpipreg 20:00:55.0994 3488 tcpipreg - ok 20:00:56.0042 3488 TcUsb 20:00:56.0069 3488 TcUsb - ok 20:00:56.0112 3488 TDPIPE 20:00:56.0196 3488 TDPIPE - ok 20:00:56.0218 3488 TDTCP 20:00:56.0297 3488 TDTCP - ok 20:00:56.0349 3488 tdx 20:00:56.0420 3488 tdx - ok 20:00:56.0475 3488 TermDD 20:00:56.0510 3488 TermDD - ok 20:00:56.0600 3488 tssecsrv 20:00:56.0692 3488 tssecsrv - ok 20:00:56.0725 3488 tunmp 20:00:56.0792 3488 tunmp - ok 20:00:56.0830 3488 tunnel 20:00:56.0907 3488 tunnel - ok 20:00:56.0936 3488 uagp35 20:00:56.0966 3488 uagp35 - ok 20:00:57.0012 3488 udfs 20:00:57.0079 3488 udfs - ok 20:00:57.0147 3488 uliagpkx 20:00:57.0179 3488 uliagpkx - ok 20:00:57.0213 3488 uliahci 20:00:57.0253 3488 uliahci - ok 20:00:57.0279 3488 UlSata 20:00:57.0317 3488 UlSata - ok 20:00:57.0349 3488 ulsata2 20:00:57.0383 3488 ulsata2 - ok 20:00:57.0421 3488 umbus 20:00:57.0494 3488 umbus - ok 20:00:57.0548 3488 usbccgp 20:00:57.0633 3488 usbccgp - ok 20:00:57.0694 3488 usbcir 20:00:57.0825 3488 usbcir - ok 20:00:57.0868 3488 usbehci 20:00:57.0933 3488 usbehci - ok 20:00:57.0978 3488 usbhub 20:00:58.0043 3488 usbhub - ok 20:00:58.0062 3488 usbohci 20:00:58.0198 3488 usbohci - ok 20:00:58.0233 3488 usbprint 20:00:58.0354 3488 usbprint - ok 20:00:58.0393 3488 USBSTOR 20:00:58.0450 3488 USBSTOR - ok 20:00:58.0483 3488 usbuhci 20:00:58.0541 3488 usbuhci - ok 20:00:58.0579 3488 usbvideo 20:00:58.0672 3488 usbvideo - ok 20:00:58.0744 3488 vga 20:00:58.0828 3488 vga - ok 20:00:58.0867 3488 VgaSave 20:00:58.0951 3488 VgaSave - ok 20:00:58.0987 3488 viaagp 20:00:59.0020 3488 viaagp - ok 20:00:59.0052 3488 ViaC7 20:00:59.0140 3488 ViaC7 - ok 20:00:59.0160 3488 viaide 20:00:59.0200 3488 viaide - ok 20:00:59.0237 3488 volmgr 20:00:59.0266 3488 volmgr - ok 20:00:59.0322 3488 volmgrx 20:00:59.0369 3488 volmgrx - ok 20:00:59.0417 3488 volsnap 20:00:59.0457 3488 volsnap - ok 20:00:59.0491 3488 vsmraid 20:00:59.0529 3488 vsmraid - ok 20:00:59.0603 3488 WacomPen 20:00:59.0747 3488 WacomPen - ok 20:00:59.0781 3488 Wanarp 20:00:59.0857 3488 Wanarp - ok 20:00:59.0874 3488 Wanarpv6 20:00:59.0941 3488 Wanarpv6 - ok 20:01:00.0001 3488 Wd 20:01:00.0061 3488 Wd - ok 20:01:00.0127 3488 Wdf01000 20:01:00.0202 3488 Wdf01000 - ok 20:01:00.0359 3488 winachsf 20:01:00.0503 3488 winachsf - ok 20:01:00.0558 3488 winbondcir 20:01:00.0615 3488 winbondcir - ok 20:01:00.0778 3488 WmiAcpi 20:01:00.0846 3488 WmiAcpi - ok 20:01:01.0058 3488 WpdUsb 20:01:01.0145 3488 WpdUsb - ok 20:01:01.0194 3488 ws2ifsl 20:01:01.0299 3488 ws2ifsl - ok 20:01:01.0422 3488 WUDFRd 20:01:01.0542 3488 WUDFRd - ok 20:01:01.0607 3488 XAudio 20:01:01.0674 3488 XAudio - ok 20:01:01.0833 3488 ZTEusbmdm6k 20:01:01.0893 3488 ZTEusbmdm6k - ok 20:01:01.0942 3488 ZTEusbnmea 20:01:02.0000 3488 ZTEusbnmea - ok 20:01:02.0086 3488 ZTEusbser6k 20:01:02.0139 3488 ZTEusbser6k - ok 20:01:02.0220 3488 MBR (0x1B8) 20:01:02.0850 3488 20:01:02.0897 3488 Boot (0x1200) 20:01:02.0902 3488 20:01:02.0944 3488 Boot (0x1200) 20:01:02.0952 3488 20:01:02.0953 3488 20:01:02.0953 3488 Scan finished 20:01:02.0953 3488 20:01:02.0979 1224 20:01:02.0979 1224 20:03:15.0921 1224 20:03:15.0921 1224 20:03:15.0922 1224 20:03:15.0923 1224 20:03:15.0923 1224 20:03:15.0923 1224 20:03:15.0924 1224 20:03:15.0924 1224 TDSS rootkit removing tool 2.6.15.0 Nov 3 2011 17:15:49 ============================================================ Current date / time: 2011/11/06 20:00:18.0043 OS Version: 6.0.6002 ServicePack: 2.0 Product type: Workstation ComputerName: ACER6930-PC Windows directory: C:\Windows System windows directory: C:\Windows Processor architecture: Intel x86 Number of processors: 2 Boot type: Normal boot ============================================================ ============================================================ Mode: Manual; SigCheck; TDLFS; ============================================================ (82b296ae1892fe3dbee00c9cf92f8ac7) C:\Windows\system32\drivers\acpi.sys (04f0fcac69c7c71a3ac4eb97fafc8303) C:\Windows\system32\drivers\adp94xx.sys (60505e0041f7751bdbb80f88bf45c2ce) C:\Windows\system32\drivers\adpahci.sys (8a42779b02aec986eab64ecfc98f8bd7) C:\Windows\system32\drivers\adpu160m.sys (241c9e37f8ce45ef51c3de27515ca4e5) C:\Windows\system32\drivers\adpu320.sys (3911b972b55fea0478476b2e777b29fa) C:\Windows\system32\drivers\afd.sys (13f9e33747e6b41a3ff305c37db0d360) C:\Windows\system32\drivers\agp440.sys (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys (4490b8bdf38750458eb9b24835fda8fe) C:\Windows\system32\Drivers\AlfaFF.sys (9eaef5fc9b8e351afa7e78a6fae91f91) C:\Windows\system32\drivers\aliide.sys (c47344bc706e5f0b9dce369516661578) C:\Windows\system32\drivers\amdagp.sys (9b78a39a4c173fdbc1321e0dd659b34c) C:\Windows\system32\drivers\amdide.sys (18f29b49ad23ecee3d2a826c725c8d48) C:\Windows\system32\drivers\amdk7.sys (93ae7f7dd54ab986a6f1a1b37be7442d) C:\Windows\system32\drivers\amdk8.sys (5d2888182fb46632511acee92fdad522) C:\Windows\system32\drivers\arc.sys (5e2a321bd7c8b3624e41fdec3e244945) C:\Windows\system32\drivers\arcsas.sys (bb67bfbc8476c5f8715654dbcaf7bf3b) C:\Windows\system32\drivers\ArcSec.sys (53b202abee6455406254444303e87be1) C:\Windows\system32\DRIVERS\asyncmac.sys (2d9c903dc76a66813d350a562de40ed9) C:\Windows\system32\drivers\atapi.sys (997e25f5b7d53c94c0ad2dc080f6868e) C:\Windows\system32\DRIVERS\athr.sys (bc12f2404bb6f2b6b2ff3c4c246cb752) C:\Windows\System32\Drivers\avgldx86.sys (5903d729d4f0c5bca74123c96a1b29e0) C:\Windows\System32\Drivers\avgmfx86.sys (47b879406246ffdced59e18d331a0e7d) C:\Windows\system32\DRIVERS\avgntflt.sys (94a16f829b1456237b7f929198ce2807) C:\Windows\system32\Drivers\avgrkx86.sys (92d8e1e8502e649b60e70074eb29c380) C:\Windows\System32\Drivers\avgtdix.sys (5fedef54757b34fb611b9ec8fb399364) C:\Windows\system32\DRIVERS\avipbb.sys (67e506b75bd5326a3ec7b70bd014dfb6) C:\Windows\system32\drivers\Beep.sys (d4df28447741fd3d953526e33a617397) C:\Windows\system32\drivers\blbdrive.sys (35f376253f687bde63976ccb3f2108ca) C:\Windows\system32\DRIVERS\bowser.sys (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys (6d39c954799b63ba866910234cf7d726) C:\Windows\system32\DRIVERS\BthEnum.sys (9a966a8e86d1771911ae34a20d11bff3) C:\Windows\system32\DRIVERS\bthmodem.sys (5904efa25f829bf84ea6fb045134a1d8) C:\Windows\system32\DRIVERS\bthpan.sys (611ff3f2f095c8d4a6d4cfd9dcc09793) C:\Windows\system32\Drivers\BTHport.sys (d330803eab2a15caec7f011f1d4cb30e) C:\Windows\system32\Drivers\BTHUSB.sys (3ea1a20dc0ca1ad23e7aa8c37a91bcd1) C:\Windows\system32\drivers\btwaudio.sys (195872e48a7fb01f8bc9b800f70f4054) C:\Windows\system32\drivers\btwavdt.sys (0724e7d6c9b6a289eddda33fa8176e80) C:\Windows\system32\DRIVERS\btwrchid.sys (7add03e75beb9e6dd102c3081d29840a) C:\Windows\system32\DRIVERS\cdfs.sys (6b4bffb9becd728097024276430db314) C:\Windows\system32\DRIVERS\cdrom.sys (e5d4133f37219dbcfe102bc61072589d) C:\Windows\system32\DRIVERS\circlass.sys (d7659d3b5b92c31e84e53c1431f35132) C:\Windows\system32\CLFS.sys (99afc3795b58cc478fbbbcdc658fcb56) C:\Windows\system32\DRIVERS\CmBatt.sys (0ca25e686a4928484e9fdabd168ab629) C:\Windows\system32\drivers\cmdide.sys (6afef0b60fa25de07c0968983ee4f60a) C:\Windows\system32\DRIVERS\compbatt.sys (741e9dff4f42d2d8477d0fc1dc0df871) C:\Windows\system32\drivers\crcdisk.sys (1f07becdca750766a96cda811ba86410) C:\Windows\system32\drivers\crusoe.sys (622c41a07ca7e6dd91770f50d532cb6c) C:\Windows\system32\Drivers\dfsc.sys (5d4aefc3386920236a548271f8f1af6a) C:\Windows\system32\drivers\disk.sys (73baf270d24fe726b9cd7f80bb17a23d) C:\Windows\system32\DRIVERS\DKbFltr.sys (97fef831ab90bee128c9af390e243f80) C:\Windows\system32\drivers\drmkaud.sys (c68ac676b0ef30cfbb1080adce49eb1f) C:\Windows\System32\drivers\dxgkrnl.sys (5425f74ac0c1dbd96a1e04f17d63f94c) C:\Windows\system32\DRIVERS\E1G60I32.sys (7f64ea048dcfac7acf8b4d7b4e6fe371) C:\Windows\system32\drivers\ecache.sys (23b62471681a124889978f6295b3f4c6) C:\Windows\system32\drivers\elxstor.sys (3db974f3935483555d7148663f726c61) C:\Windows\system32\drivers\errdev.sys (22b408651f9123527bcee54b4f6c5cae) C:\Windows\system32\drivers\exfat.sys (1e9b9a70d332103c52995e957dc09ef8) C:\Windows\system32\drivers\fastfat.sys (afe1e8b9782a0dd7fb46bbd88e43f89a) C:\Windows\system32\DRIVERS\fdc.sys (a8c0139a884861e3aae9cfe73b208a9f) C:\Windows\system32\drivers\fileinfo.sys (0ae429a696aecbc5970e3cf2c62635ae) C:\Windows\system32\drivers\filetrace.sys (85b7cf99d532820495d68d747fda9ebd) C:\Windows\system32\DRIVERS\flpydisk.sys (01334f9ea68e6877c4ef05d3ea8abb05) C:\Windows\system32\drivers\fltmgr.sys (65ea8b77b5851854f0c55c43fa51a198) C:\Windows\system32\drivers\Fs_Rec.sys (34582a6e6573d54a07ece5fe24a126b5) C:\Windows\system32\drivers\gagp30kx.sys (60292ca78c7bf16a527cb5e3c1e2c279) C:\Windows\system32\DRIVERS\gmfiltr.sys genmcmn ( UnsignedFile.Multi.Generic ) - warning genmcmn - detected UnsignedFile.Multi.Generic (1) HdAudAddService (cb04c744be0a61b1d648faed182c3b59) C:\Windows\system32\drivers\HdAudio.sys (062452b7ffd68c8c042a6261fe8dff4a) C:\Windows\system32\DRIVERS\HDAudBus.sys (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys (d8df3722d5e961baa1292aa2f12827e2) C:\Windows\system32\DRIVERS\hidir.sys (cca4b519b17e23a00b826c55716809cc) C:\Windows\system32\DRIVERS\hidusb.sys (16ee7b23a009e00d835cdb79574a91a6) C:\Windows\system32\drivers\hpcisss.sys (46d67209550973257601a533e2ac5785) C:\Windows\system32\DRIVERS\VSTAZL3.SYS (fadd7095163cb3cb4073793ebb50fe75) C:\Windows\system32\DRIVERS\HSX_DPV.sys (058783bedd17615d1fece09f77960436) C:\Windows\system32\DRIVERS\HSXHWAZL.sys (f870aa3e254628ebeafe754108d664de) C:\Windows\system32\drivers\HTTP.sys (c6b032d69650985468160fc9937cf5b4) C:\Windows\system32\drivers\i2omp.sys (22d56c8184586b7a1f6fa60be5f5a2bd) C:\Windows\system32\DRIVERS\i8042prt.sys (707c1692214b1c290271067197f075f6) C:\Windows\system32\DRIVERS\iaStor.sys (54155ea1b0df185878e0fc9ec3ac3a14) C:\Windows\system32\drivers\iastorv.sys (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys (4d8d5b1c895ea0f2a721b98a7ce198f1) C:\Windows\system32\drivers\int15.sys int15 ( UnsignedFile.Multi.Generic ) - warning int15 - detected UnsignedFile.Multi.Generic (1) IntcAzAudAddService (219ca9a36d6de2ec04f958c907673436) C:\Windows\system32\drivers\RTKVHDA.sys IntcAzAudAddService - ok (83aa759f3189e6370c30de5dc5590718) C:\Windows\system32\drivers\intelide.sys (224191001e78c89dfa78924c3ea595ff) C:\Windows\system32\DRIVERS\intelppm.sys (62c265c38769b864cb25b4bcf62df6c3) C:\Windows\system32\DRIVERS\ipfltdrv.sys (b25aaf203552b7b3491139d582b39ad1) C:\Windows\system32\drivers\ipmidrv.sys (8793643a67b42cec66490b2a0cf92d68) C:\Windows\system32\DRIVERS\ipnat.sys (109c0dfb82c3632fbd11949b73aeeac9) C:\Windows\system32\drivers\irenum.sys (6c70698a3e5c4376c6ab5c7c17fb0614) C:\Windows\system32\drivers\isapnp.sys (232fa340531d940aac623b121a595034) C:\Windows\system32\DRIVERS\msiscsi.sys (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys (37605e0a8cf00cbba538e753e4344c6e) C:\Windows\system32\DRIVERS\kbdclass.sys (ede59ec70e25c24581add1fbec7325f7) C:\Windows\system32\DRIVERS\kbdhid.sys (86165728af9bf72d6442a894fdfb4f8b) C:\Windows\system32\Drivers\ksecdd.sys (86d7f66ac2c0123ed81b2f3e835845c2) C:\Windows\system32\DRIVERS\L1E60x86.sys (d1c5883087a0c3f1344d9d55a44901f6) C:\Windows\system32\DRIVERS\lltdio.sys (c7e15e82879bf3235b559563d4185365) C:\Windows\system32\drivers\lsi_fc.sys (ee01ebae8c9bf0fa072e0ff68718920a) C:\Windows\system32\drivers\lsi_sas.sys (912a04696e9ca30146a62afa1463dd5c) C:\Windows\system32\drivers\lsi_scsi.sys (8f5c7426567798e62a3b3614965d62cc) C:\Windows\system32\drivers\luafv.sys (69a6268d7f81e53d568ab4e7e991caf3) C:\Windows\system32\drivers\mbam.sys (0cea2d0d3fa284b85ed5b68365114f76) C:\Windows\system32\DRIVERS\mdmxsdk.sys (0001ce609d66632fa17b84705f658879) C:\Windows\system32\drivers\megasas.sys (c252f32cd9a49dbfc25ecf26ebd51a99) C:\Windows\system32\drivers\megasr.sys (e13b5ea0f51ba5b1512ec671393d09ba) C:\Windows\system32\drivers\modem.sys (0a9bb33b56e294f686abb7c1e4e2d8a8) C:\Windows\system32\DRIVERS\monitor.sys (5bf6a1326a335c5298477754a506d263) C:\Windows\system32\DRIVERS\mouclass.sys (93b8d4869e12cfbe663915502900876f) C:\Windows\system32\DRIVERS\mouhid.sys (bdafc88aa6b92f7842416ea6a48e1600) C:\Windows\system32\drivers\mountmgr.sys (511d011289755dd9f9a7579fb0b064e6) C:\Windows\system32\drivers\mpio.sys (22241feba9b2defa669c8cb0a8dd7d2e) C:\Windows\system32\drivers\mpsdrv.sys (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys (82cea0395524aacfeb58ba1448e8325c) C:\Windows\system32\drivers\mrxdav.sys (1e94971c4b446ab2290deb71d01cf0c2) C:\Windows\system32\DRIVERS\mrxsmb.sys (4fccb34d793b116423209c0f8b7a3b03) C:\Windows\system32\DRIVERS\mrxsmb10.sys (c3cb1b40ad4a0124d617a1199b0b9d7c) C:\Windows\system32\DRIVERS\mrxsmb20.sys (28023e86f17001f7cd9b15a5bc9ae07d) C:\Windows\system32\drivers\msahci.sys (4468b0f385a86ecddaf8d3ca662ec0e7) C:\Windows\system32\drivers\msdsm.sys (a9927f4a46b816c92f461acb90cf8515) C:\Windows\system32\drivers\Msfs.sys (0f400e306f385c56317357d6dea56f62) C:\Windows\system32\drivers\msisadrv.sys (d8c63d34d9c9e56c059e24ec7185cc07) C:\Windows\system32\drivers\MSKSSRV.sys (1d373c90d62ddb641d50e55b9e78d65e) C:\Windows\system32\drivers\MSPCLOCK.sys (b572da05bf4e098d4bba3a4734fb505b) C:\Windows\system32\drivers\MSPQM.sys (b49456d70555de905c311bcda6ec6adb) C:\Windows\system32\drivers\MsRPC.sys (e384487cb84be41d09711c30ca79646c) C:\Windows\system32\DRIVERS\mssmbios.sys (7199c1eec1e4993caf96b8c0a26bd58a) C:\Windows\system32\drivers\MSTEE.sys (6a57b5733d4cb702c8ea4542e836b96c) C:\Windows\system32\Drivers\mup.sys (85c44fdff9cf7e72a40dcb7ec06a4416) C:\Windows\system32\DRIVERS\nwifi.sys (1357274d1883f68300aeadd15d7bbb42) C:\Windows\system32\drivers\ndis.sys (0e186e90404980569fb449ba7519ae61) C:\Windows\system32\DRIVERS\ndistapi.sys (d6973aa34c4d5d76c0430b181c3cd389) C:\Windows\system32\DRIVERS\ndisuio.sys (818f648618ae34f729fdb47ec68345c3) C:\Windows\system32\DRIVERS\ndiswan.sys (71dab552b41936358f3b541ae5997fb3) C:\Windows\system32\drivers\NDProxy.sys (bcd093a5a6777cf626434568dc7dba78) C:\Windows\system32\DRIVERS\netbios.sys (ecd64230a59cbd93c85f1cd1cab9f3f6) C:\Windows\system32\DRIVERS\netbt.sys (e559ea9138c77b5d1fda8c558764a25f) C:\Windows\system32\DRIVERS\NETw5v32.sys (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys (d36f239d7cce1931598e8fb90a0dbc26) C:\Windows\system32\drivers\Npfs.sys (609773e344a97410ce4ebf74a8914fcf) C:\Windows\system32\drivers\nsiproxy.sys (6a4a98cee84cf9e99564510dda4baa47) C:\Windows\system32\drivers\Ntfs.sys (2757d2ba59aee155209e24942ab127c9) C:\Windows\system32\DRIVERS\NTIDrvr.sys (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys (c5dbbcda07d780bda9b685df333bb41e) C:\Windows\system32\drivers\Null.sys (2c7ac27710e8d41c1eb7d1599187d237) C:\Windows\system32\drivers\nvhda32v.sys (cb0d6f8f65b8766ff2aaaa78881fd9f8) C:\Windows\system32\DRIVERS\nvlddmkm.sys (2edf9e7751554b42cbb60116de727101) C:\Windows\system32\drivers\nvraid.sys (abed0c09758d1d97db0042dbb2688177) C:\Windows\system32\drivers\nvstor.sys (18bbdf913916b71bd54575bdb6eeac0b) C:\Windows\system32\drivers\nv_agp.sys (be32da025a0be1878f0ee8d6d9386cd5) C:\Windows\system32\drivers\ohci1394.sys (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32\drivers\parport.sys (57389fa59a36d96b3eb09d0cb91e9cdc) C:\Windows\system32\drivers\partmgr.sys (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32\drivers\parvdm.sys (941dc1d19e7e8620f40bbc206981efdb) C:\Windows\system32\drivers\pci.sys (fc175f5ddab666d7f4d17449a547626f) C:\Windows\system32\drivers\pciide.sys (e6f3fb1b86aa519e7698ad05e58b04e5) C:\Windows\system32\drivers\pcmcia.sys (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys (ecfffaec0c1ecd8dbc77f39070ea1db1) C:\Windows\system32\DRIVERS\raspptp.sys (2027293619dd0f047c584cf2e7df4ffd) C:\Windows\system32\drivers\processr.sys (99514faa8df93d34b5589187db3aa0ba) C:\Windows\system32\DRIVERS\pacer.sys (1dcbb35090cc4b2bd3d661e6089523c6) C:\Windows\system32\DRIVERS\psdfilter.sys (e26e46d619469964ac3609620f443867) C:\Windows\system32\DRIVERS\PSDNServ.sys (3e1d134af2806867d06047c4cc33cc65) C:\Windows\system32\DRIVERS\PSDVdisk.sys (183ef96bcc2ec3d5294cb2c2c0ecbcd1) C:\Windows\system32\Drivers\PxHelp20.sys PxHelp20 ( UnsignedFile.Multi.Generic ) - warning PxHelp20 - detected UnsignedFile.Multi.Generic (1) (9ccf89372c5a04e97cd89b58ae697796) C:\Windows\system32\DRIVERS\qcusbser.sys (0a6db55afb7820c99aa1f3a1d270f4f6) C:\Windows\system32\drivers\ql2300.sys (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys (9f5e0e1926014d17486901c88eca2db7) C:\Windows\system32\drivers\qwavedrv.sys (147d7f9c556d259924351feb0de606c3) C:\Windows\system32\DRIVERS\rasacd.sys (a214adbaf4cb47dd2728859ef31f26b0) C:\Windows\system32\DRIVERS\rasl2tp.sys (509a98dd18af4375e1fc40bc175f1def) C:\Windows\system32\DRIVERS\raspppoe.sys (2005f4a1e05fa09389ac85840f0a9e4d) C:\Windows\system32\DRIVERS\rassstp.sys (b14c9d5b9add2f84f70570bbbfaa7935) C:\Windows\system32\DRIVERS\rdbss.sys (89e59be9a564262a3fb6c4f4f1cd9899) C:\Windows\system32\DRIVERS\RDPCDD.sys (fbc0bacd9c3d7f6956853f64a66e252d) C:\Windows\system32\drivers\rdpdr.sys (9d91fe5286f748862ecffa05f8a0710c) C:\Windows\system32\drivers\rdpencdd.sys (30bfbdfb7f95559ede971f9ddb9a00ba) C:\Windows\system32\drivers\RDPWD.sys (b9bb8e2093c1615ad6ea55ad96214354) C:\Windows\system32\DRIVERS\revoflt.sys (6482707f9f4da0ecbab43b2e0398a101) C:\Windows\system32\DRIVERS\rfcomm.sys (9c508f4074a39e8b4b31d27198146fad) C:\Windows\system32\DRIVERS\rspndr.sys (7a4f79df3793160b280cde152b61fe33) C:\Windows\system32\drivers\RTSTOR.SYS (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys (68e44e331d46f0fb38f0863a84cd1a31) C:\Windows\system32\drivers\serenum.sys (c70d69a918b178d3c3b06339b40c2e1b) C:\Windows\system32\drivers\serial.sys (8af3d28a879bf75db53a0ee7a4289624) C:\Windows\system32\drivers\sermouse.sys (3efa810bdca87f6ecc24f9832243fe86) C:\Windows\system32\drivers\sffdisk.sys (e95d451f7ea3e583aec75f3b3ee42dc5) C:\Windows\system32\drivers\sffp_mmc.sys (3d0ea348784b7ac9ea9bd9f317980979) C:\Windows\system32\drivers\sffp_sd.sys (46ed8e91793b2e6f848015445a0ac188) C:\Windows\system32\drivers\sfloppy.sys (1d76624a09a054f682d746b924e2dbc3) C:\Windows\system32\drivers\sisagp.sys (43cb7aa756c7db280d01da9b676cfde2) C:\Windows\system32\drivers\sisraid2.sys (a99c6c8b0baa970d8aa59ddc50b57f94) C:\Windows\system32\drivers\sisraid4.sys (7b75299a4d201d6a6533603d6914ab04) C:\Windows\system32\DRIVERS\smb.sys (7aebdeef071fe28b0eef2cdd69102bff) C:\Windows\system32\drivers\spldr.sys (d390675b8ce45e5fb359338e5e649329) C:\Windows\system32\Drivers\sptd.sys Suspicious file (NoAccess): C:\Windows\system32\Drivers\sptd.sys. md5: d390675b8ce45e5fb359338e5e649329 sptd ( LockedFile.Multi.Generic ) - warning sptd - detected LockedFile.Multi.Generic (1) (41987f9fc0e61adf54f581e15029ad91) C:\Windows\system32\DRIVERS\srv.sys (ff33aff99564b1aa534f58868cbe41ef) C:\Windows\system32\DRIVERS\srv2.sys (7605c0e1d01a08f3ecd743f38b834a44) C:\Windows\system32\DRIVERS\srvnet.sys (a36ee93698802cd899f98bfd553d8185) C:\Windows\system32\DRIVERS\ssmdrv.sys (7ba58ecf0c0a9a69d44b3dca62becf56) C:\Windows\system32\DRIVERS\swenum.sys (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys (4c9bb4b3b9eac26211484c30b914c6dc) C:\Windows\system32\DRIVERS\SynTP.sys (2756186e287139310997090797e0182b) C:\Windows\system32\drivers\tcpip.sys (2756186e287139310997090797e0182b) C:\Windows\system32\DRIVERS\tcpip.sys (608c345a255d82a6289c2d468eb41fd7) C:\Windows\system32\drivers\tcpipreg.sys (72b9e77565da5fa564581976e000d29b) C:\Windows\system32\Drivers\tcusb.sys (5dcf5e267be67a1ae926f2df77fbcc56) C:\Windows\system32\drivers\tdpipe.sys (389c63e32b3cefed425b61ed92d3f021) C:\Windows\system32\drivers\tdtcp.sys (76b06eb8a01fc8624d699e7045303e54) C:\Windows\system32\DRIVERS\tdx.sys (3cad38910468eab9a6479e2f01db43c7) C:\Windows\system32\DRIVERS\termdd.sys (dcf0f056a2e4f52287264f5ab29cf206) C:\Windows\system32\DRIVERS\tssecsrv.sys (caecc0120ac49e3d2f758b9169872d38) C:\Windows\system32\DRIVERS\tunmp.sys (300db877ac094feab0be7688c3454a9c) C:\Windows\system32\DRIVERS\tunnel.sys (7d33c4db2ce363c8518d2dfcf533941f) C:\Windows\system32\drivers\uagp35.sys (d9728af68c4c7693cb100b8441cbdec6) C:\Windows\system32\DRIVERS\udfs.sys (b0acfdc9e4af279e9116c03e014b2b27) C:\Windows\system32\drivers\uliagpkx.sys (9224bb254f591de4ca8d572a5f0d635c) C:\Windows\system32\drivers\uliahci.sys (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys (32cff9f809ae9aed85464492bf3e32d2) C:\Windows\system32\DRIVERS\umbus.sys (caf811ae4c147ffcd5b51750c7f09142) C:\Windows\system32\DRIVERS\usbccgp.sys (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys (79e96c23a97ce7b8f14d310da2db0c9b) C:\Windows\system32\DRIVERS\usbehci.sys (4673bbcb006af60e7abddbe7a130ba42) C:\Windows\system32\DRIVERS\usbhub.sys (38dbc7dd6cc5a72011f187425384388b) C:\Windows\system32\drivers\usbohci.sys (b51e52acf758be00ef3a58ea452fe360) C:\Windows\system32\drivers\usbprint.sys (be3da31c191bc222d9ad503c5224f2ad) C:\Windows\system32\DRIVERS\USBSTOR.SYS (814d653efc4d48be3b04a307eceff56f) C:\Windows\system32\DRIVERS\usbuhci.sys (e67998e8f14cb0627a769f6530bcb352) C:\Windows\system32\Drivers\usbvideo.sys (87b06e1f30b749a114f74622d013f8d4) C:\Windows\system32\DRIVERS\vgapnp.sys (2e93ac0a1d8c79d019db6c51f036636c) C:\Windows\System32\drivers\vga.sys (5d7159def58a800d5781ba3a879627bc) C:\Windows\system32\drivers\viaagp.sys (c4f3a691b5bad343e6249bd8c2d45dee) C:\Windows\system32\drivers\viac7.sys (aadf5587a4063f52c2c3fed7887426fc) C:\Windows\system32\drivers\viaide.sys (69503668ac66c77c6cd7af86fbdf8c43) C:\Windows\system32\drivers\volmgr.sys (23e41b834759917bfd6b9a0d625d0c28) C:\Windows\system32\drivers\volmgrx.sys (147281c01fcb1df9252de2a10d5e7093) C:\Windows\system32\drivers\volsnap.sys (587253e09325e6bf226b299774b728a9) C:\Windows\system32\drivers\vsmraid.sys (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys (78fe9542363f297b18c027b2d7e7c07f) C:\Windows\system32\drivers\wd.sys (b6f0a7ad6d4bd325fbcd8bac96cd8d96) C:\Windows\system32\drivers\Wdf01000.sys (bb9cbaf6ac20452b245c324f1f50ee81) C:\Windows\system32\DRIVERS\HSX_CNXT.sys (3fa87d56769838aac82fafc3e78fc732) C:\Windows\system32\DRIVERS\winbondcir.sys (2e7255d172df0b8283cdfb7b433b864e) C:\Windows\system32\DRIVERS\wmiacpi.sys (0cec23084b51b8288099eb710224e955) C:\Windows\system32\DRIVERS\wpdusb.sys (e3a3cb253c0ec2494d4a61f5e43a389c) C:\Windows\system32\drivers\ws2ifsl.sys (ac13cb789d93412106b0fb6c7eb2bcb6) C:\Windows\system32\DRIVERS\WUDFRd.sys (dab33cfa9dd24251aaa389ff36b64d4b) C:\Windows\system32\DRIVERS\xaudio.sys (3862318f85be7a91957ada5e814ed58c) C:\Windows\system32\DRIVERS\ZTEusbmdm6k.sys (3862318f85be7a91957ada5e814ed58c) C:\Windows\system32\DRIVERS\ZTEusbnmea.sys (3862318f85be7a91957ada5e814ed58c) C:\Windows\system32\DRIVERS\ZTEusbser6k.sys (bb9d3a6a13c5010348da7c900bb6af50) \Device\Harddisk0\DR0 \Device\Harddisk0\DR0 - ok (9a5a57fad32610a5b953213845978608) \Device\Harddisk0\DR0\Partition0 \Device\Harddisk0\DR0\Partition0 - ok (0c800e237c42d74891b4d5577ecf1d5f) \Device\Harddisk0\DR0\Partition1 \Device\Harddisk0\DR0\Partition1 - ok ============================================================ ============================================================ Detected object count: 4 Actual detected object count: 4 genmcmn ( UnsignedFile.Multi.Generic ) - skipped by user genmcmn ( UnsignedFile.Multi.Generic ) - User select action: Skip int15 ( UnsignedFile.Multi.Generic ) - skipped by user int15 ( UnsignedFile.Multi.Generic ) - User select action: Skip PxHelp20 ( UnsignedFile.Multi.Generic ) - skipped by user PxHelp20 ( UnsignedFile.Multi.Generic ) - User select action: Skip sptd ( LockedFile.Multi.Generic ) - skipped by user sptd ( LockedFile.Multi.Generic ) - User select action: Skip

6 ноември 201114 г.

Сега изтеглете Junction.zip и го запазете на вашия десктоп. Разархивирайте файла и го копирайте файла junction.exe в C:\Windows.
Изтеглете следния файл:
Разархивирайте fix.zip и стартирайте стартирайте файла fix.bat с десен бутон → Run as administrator
Изчакайте да завърши проверката и да се появи лог файла (този лог файл ще се намира на С:\ с име log.txt).
Копирайте съдържанието му в следващия си коментар.

6 ноември 201114 г.

Автор

Junction v1.06 - Windows junction creator and reparse point viewer Copyright © 2000-2010 Mark Russinovich Sysinternals - www.sysinternals.com \\?\c:\\Documents and Settings: JUNCTION Print Name : C:\Users Substitute Name: C:\Users Failed to open \\?\c:\\pagefile.sys: The process cannot access the file because it is being used by another process. ... ... Failed to open \\?\c:\\e06361e6b86b6f034c\ : Access is denied. ... ... ... ... ... ... ... ... Failed to open \\?\c:\\Program Files\AVG\AVG8\avgcsrvx.exe: Access is denied. Failed to open \\?\c:\\Program Files\Avira\AntiVir Desktop\avguard.exe: Access is denied. Failed to open \\?\c:\\Program Files\Avira\AntiVir Desktop\avscan.exe: Access is denied. ... ... ... ... ... ... ... ... ... ... Failed to open \\?\c:\\Program Files\Readon Technology\Readon TV Movie Radio Player 7.5.0.0\internettv.exe: Access is denied. ... ... .\\?\c:\\ProgramData\Application Data: JUNCTION Print Name : C:\ProgramData Substitute Name: C:\ProgramData \\?\c:\\ProgramData\Desktop: JUNCTION Print Name : C:\Users\Public\Desktop Substitute Name: C:\Users\Public\Desktop \\?\c:\\ProgramData\Documents: JUNCTION Print Name : C:\Users\Public\Documents Substitute Name: C:\Users\Public\Documents \\?\c:\\ProgramData\Favorites: JUNCTION Print Name : C:\Users\Public\Favorites Substitute Name: C:\Users\Public\Favorites \\?\c:\\ProgramData\Start Menu: JUNCTION Print Name : C:\ProgramData\Microsoft\Windows\Start Menu Substitute Name: C:\ProgramData\Microsoft\Windows\Start Menu \\?\c:\\ProgramData\Templates: JUNCTION Print Name : C:\ProgramData\Microsoft\Windows\Templates Substitute Name: C:\ProgramData\Microsoft\Windows\Templates Failed to open \\?\c:\\ProgramData\Microsoft\Crypto\RSA\MachineKeys\34fe7a91701a13060dd6b43a3c068a66_1d52cdc3-2f4c-48cf-87e5-10ea8ded7dca: Access is denied. Failed to open \\?\c:\\ProgramData\Microsoft\Crypto\RSA\MachineKeys\7639fb7f8f849aa5d765baa3823301ec_1d52cdc3-2f4c-48cf-87e5-10ea8ded7dca: Access is denied. Failed to open \\?\c:\\ProgramData\Microsoft\Crypto\RSA\MachineKeys\8859180949f4c2c2ba5291c2c3989550_1d52cdc3-2f4c-48cf-87e5-10ea8ded7dca: Access is denied. Failed to open \\?\c:\\ProgramData\Microsoft\Crypto\RSA\MachineKeys\92696cff5c491def455f8233e31da825_1d52cdc3-2f4c-48cf-87e5-10ea8ded7dca: Access is denied. Failed to open \\?\c:\\ProgramData\Microsoft\Crypto\RSA\MachineKeys\aeb94b155d4b9c58b3e3d565fb2707cc_1d52cdc3-2f4c-48cf-87e5-10ea8ded7dca: Access is denied. Failed to open \\?\c:\\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f87d22f451051ae2d0096aadba477402_1d52cdc3-2f4c-48cf-87e5-10ea8ded7dca: Access is denied. Failed to open \\?\c:\\ProgramData\Microsoft\Crypto\RSA\MachineKeys\fda14804e8cbf4d0963061c930dd0313_1d52cdc3-2f4c-48cf-87e5-10ea8ded7dca: Access is denied. .. .. Failed to open \\?\c:\\ProgramData\TuneUp Software\TuneUp Utilities 2010\TTUSvc.tt: Access is denied. Failed to open \\?\c:\\Qoobox\BackEnv: Access is denied. \\?\c:\\Qoobox\Quarantine\C\Windows\$NtUninstallKB17090$\2388241215.vir: SYMBOLIC LINK Print Name : c:\windows\system32\config Substitute Name: \systemroot\system32\config . Failed to open \\?\c:\\System Volume Information\{3808876b-c176-4e48-b7ae-04046e6cc752}: Access is denied. Failed to open \\?\c:\\System Volume Information\{c7cef979-06e6-11e1-bbfc-00238b0a8c8f}{3808876b-c176-4e48-b7ae-04046e6cc752}: Access is denied. Failed to open \\?\c:\\System Volume Information\{dd357790-06ea-11e1-910d-00238b0a8c8f}{3808876b-c176-4e48-b7ae-04046e6cc752}: Access is denied. Failed to open \\?\c:\\System Volume Information\{dd3577b1-06ea-11e1-910d-00238b0a8c8f}{3808876b-c176-4e48-b7ae-04046e6cc752}: Access is denied. Failed to open \\?\c:\\System Volume Information\{dd35787d-06ea-11e1-910d-00238b0a8c8f}{3808876b-c176-4e48-b7ae-04046e6cc752}: Access is denied. Failed to open \\?\c:\\System Volume Information\{dd357bf7-06ea-11e1-910d-00238b0a8c8f}{3808876b-c176-4e48-b7ae-04046e6cc752}: Access is denied. Failed to open \\?\c:\\System Volume Information\{dd357c6f-06ea-11e1-910d-00238b0a8c8f}{3808876b-c176-4e48-b7ae-04046e6cc752}: Access is denied. \\?\c:\\Users\All Users: SYMBOLIC LINK Print Name : C:\ProgramData Substitute Name: \??\C:\ProgramData \\?\c:\\Users\Default User: JUNCTION Print Name : C:\Users\Default Substitute Name: C:\Users\Default \\?\c:\\Users\ACER 6930\Application Data: JUNCTION Print Name : C:\Users\ACER 6930\AppData\Roaming Substitute Name: C:\Users\ACER 6930\AppData\Roaming \\?\c:\\Users\ACER 6930\Cookies: JUNCTION Print Name : C:\Users\ACER 6930\AppData\Roaming\Microsoft\Windows\Cookies Substitute Name: C:\Users\ACER 6930\AppData\Roaming\Microsoft\Windows\Cookies \\?\c:\\Users\ACER 6930\Local Settings: JUNCTION Print Name : C:\Users\ACER 6930\AppData\Local Substitute Name: C:\Users\ACER 6930\AppData\Local \\?\c:\\Users\ACER 6930\My Documents: JUNCTION Print Name : C:\Users\ACER 6930\Documents Substitute Name: C:\Users\ACER 6930\Documents \\?\c:\\Users\ACER 6930\NetHood: JUNCTION Print Name : C:\Users\ACER 6930\AppData\Roaming\Microsoft\Windows\Network Shortcuts Substitute Name: C:\Users\ACER 6930\AppData\Roaming\Microsoft\Windows\Network Shortcuts \\?\c:\\Users\ACER 6930\PrintHood: JUNCTION Print Name : C:\Users\ACER 6930\AppData\Roaming\Microsoft\Windows\Printer Shortcuts Substitute Name: C:\Users\ACER 6930\AppData\Roaming\Microsoft\Windows\Printer Shortcuts \\?\c:\\Users\ACER 6930\Recent: JUNCTION Print Name : C:\Users\ACER 6930\AppData\Roaming\Microsoft\Windows\Recent Substitute Name: C:\Users\ACER 6930\AppData\Roaming\Microsoft\Windows\Recent \\?\c:\\Users\ACER 6930\SendTo: JUNCTION Print Name : C:\Users\ACER 6930\AppData\Roaming\Microsoft\Windows\SendTo Substitute Name: C:\Users\ACER 6930\AppData\Roaming\Microsoft\Windows\SendTo \\?\c:\\Users\ACER 6930\Start Menu: JUNCTION Print Name : C:\Users\ACER 6930\AppData\Roaming\Microsoft\Windows\Start Menu Substitute Name: C:\Users\ACER 6930\AppData\Roaming\Microsoft\Windows\Start Menu \\?\c:\\Users\ACER 6930\Templates: JUNCTION Print Name : C:\Users\ACER 6930\AppData\Roaming\Microsoft\Windows\Templates Substitute Name: C:\Users\ACER 6930\AppData\Roaming\Microsoft\Windows\Templates \\?\c:\\Users\ACER 6930\AppData\Local\Application Data: JUNCTION Print Name : C:\Users\ACER 6930\AppData\Local Substitute Name: C:\Users\ACER 6930\AppData\Local \\?\c:\\Users\ACER 6930\AppData\Local\History: JUNCTION Print Name : C:\Users\ACER 6930\AppData\Local\Microsoft\Windows\History Substitute Name: C:\Users\ACER 6930\AppData\Local\Microsoft\Windows\History \\?\c:\\Users\ACER 6930\AppData\Local\Temporary Internet Files: JUNCTION Print Name : C:\Users\ACER 6930\AppData\Local\Microsoft\Windows\Temporary Internet Files Substitute Name: C:\Users\ACER 6930\AppData\Local\Microsoft\Windows\Temporary Internet Files ... ... ... ... ... \\?\c:\\Users\ACER 6930\Documents\My Music: JUNCTION Print Name : C:\Users\ACER 6930\Music Substitute Name: C:\Users\ACER 6930\Music \\?\c:\\Users\ACER 6930\Documents\My Pictures: JUNCTION Print Name : C:\Users\ACER 6930\Pictures Substitute Name: C:\Users\ACER 6930\Pictures \\?\c:\\Users\ACER 6930\Documents\My Videos: JUNCTION Print Name : C:\Users\ACER 6930\Videos Substitute Name: C:\Users\ACER 6930\Videos .\\?\c:\\Users\All Users\Application Data: JUNCTION Print Name : C:\ProgramData Substitute Name: C:\ProgramData \\?\c:\\Users\All Users\Desktop: JUNCTION Print Name : C:\Users\Public\Desktop Substitute Name: C:\Users\Public\Desktop \\?\c:\\Users\All Users\Documents: JUNCTION Print Name : C:\Users\Public\Documents Substitute Name: C:\Users\Public\Documents \\?\c:\\Users\All Users\Favorites: JUNCTION Print Name : C:\Users\Public\Favorites Substitute Name: C:\Users\Public\Favorites \\?\c:\\Users\All Users\Start Menu: JUNCTION Print Name : C:\ProgramData\Microsoft\Windows\Start Menu Substitute Name: C:\ProgramData\Microsoft\Windows\Start Menu \\?\c:\\Users\All Users\Templates: JUNCTION Print Name : C:\ProgramData\Microsoft\Windows\Templates Substitute Name: C:\ProgramData\Microsoft\Windows\Templates Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\34fe7a91701a13060dd6b43a3c068a66_1d52cdc3-2f4c-48cf-87e5-10ea8ded7dca: Access is denied. Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\7639fb7f8f849aa5d765baa3823301ec_1d52cdc3-2f4c-48cf-87e5-10ea8ded7dca: Access is denied. Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\8859180949f4c2c2ba5291c2c3989550_1d52cdc3-2f4c-48cf-87e5-10ea8ded7dca: Access is denied. Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\92696cff5c491def455f8233e31da825_1d52cdc3-2f4c-48cf-87e5-10ea8ded7dca: Access is denied. Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\aeb94b155d4b9c58b3e3d565fb2707cc_1d52cdc3-2f4c-48cf-87e5-10ea8ded7dca: Access is denied. Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\f87d22f451051ae2d0096aadba477402_1d52cdc3-2f4c-48cf-87e5-10ea8ded7dca: Access is denied. Failed to open \\?\c:\\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\fda14804e8cbf4d0963061c930dd0313_1d52cdc3-2f4c-48cf-87e5-10ea8ded7dca: Access is denied. .. .. Failed to open \\?\c:\\Users\All Users\TuneUp Software\TuneUp Utilities 2010\TTUSvc.tt: Access is denied. \\?\c:\\Users\Default\Application Data: JUNCTION Print Name : C:\Users\Default\AppData\Roaming Substitute Name: C:\Users\Default\AppData\Roaming \\?\c:\\Users\Default\Local Settings: JUNCTION Print Name : C:\Users\Default\AppData\Local Substitute Name: C:\Users\Default\AppData\Local \\?\c:\\Users\Default\My Documents: JUNCTION Print Name : C:\Users\Default\Documents Substitute Name: C:\Users\Default\Documents \\?\c:\\Users\Default\NetHood: JUNCTION Print Name : C:\Users\Default\AppData\Roaming\Microsoft\Windows\Network Shortcuts Substitute Name: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Network Shortcuts \\?\c:\\Users\Default\PrintHood: JUNCTION Print Name : C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts Substitute Name: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts \\?\c:\\Users\Default\Recent: JUNCTION Print Name : C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent Substitute Name: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent \\?\c:\\Users\Default\SendTo: JUNCTION Print Name : C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo Substitute Name: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo \\?\c:\\Users\Default\Start Menu: JUNCTION Print Name : C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu Substitute Name: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu \\?\c:\\Users\Default\Templates: JUNCTION Print Name : C:\Users\Default\AppData\Roaming\Microsoft\Windows\Templates Substitute Name: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Templates \\?\c:\\Users\Default\AppData\Local\Application Data: JUNCTION Print Name : C:\Users\Default\AppData\Local Substitute Name: C:\Users\Default\AppData\Local \\?\c:\\Users\Default\AppData\Local\History: JUNCTION Print Name : C:\Users\Default\AppData\Local\Microsoft\Windows\History Substitute Name: C:\Users\Default\AppData\Local\Microsoft\Windows\History \\?\c:\\Users\Default\AppData\Local\Temporary Internet Files: JUNCTION Print Name : C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files Substitute Name: C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files \\?\c:\\Users\Default\Documents\My Music: JUNCTION Print Name : C:\Users\Default\Music Substitute Name: C:\Users\Default\Music \\?\c:\\Users\Default\Documents\My Pictures: JUNCTION Print Name : C:\Users\Default\Pictures Substitute Name: C:\Users\Default\Pictures \\?\c:\\Users\Default\Documents\My Videos: JUNCTION Print Name : C:\Users\Default\Videos Substitute Name: C:\Users\Default\Videos \\?\c:\\Users\Public\Documents\My Music: JUNCTION Print Name : C:\Users\Public\Music Substitute Name: C:\Users\Public\Music \\?\c:\\Users\Public\Documents\My Pictures: JUNCTION Print Name : C:\Users\Public\Pictures Substitute Name: C:\Users\Public\Pictures \\?\c:\\Users\Public\Documents\My Videos: JUNCTION Print Name : C:\Users\Public\Videos Substitute Name: C:\Users\Public\Videos Failed to open \\?\c:\\Windows\bthservsdp.dat: Access is denied. . Failed to open \\?\c:\\Windows\assembly\GAC_MSIL\Desktop.ini: Access is denied. ... ... Failed to open \\?\c:\\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe: Access is denied. ... ... ... .. Failed to open \\?\c:\\Windows\System32\mrt.exe: Access is denied. . ... ... ... ... ... ... ... ... ... ... Failed to open \\?\c:\\Windows\System32\LogFiles\WMI\RtBackup: Access is denied. ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ..

6 ноември 201114 г.

Сега изтеглете GrantPerms.zip и го разархивирайте в папка по избор. Стартирайте GrantPerms.exe и въведете следната информация:

c:\Program Files\AVG\AVG8\avgcsrvx.exe
c:\Program Files\Avira\AntiVir Desktop\avguard.exe
c:\Program Files\Avira\AntiVir Desktop\avscan.exe
c:\Program Files\Readon Technology\Readon TV Movie Radio Player 7.5.0.0\internettv.exe
c:\Windows\bthservsdp.dat
c:\Windows\assembly\GAC_MSIL\Desktop.ini
c:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
c:\Windows\System32\mrt.exe
c:\Windows\System32\LogFiles\WMI\RtBackup

Натиснете Unlock и след това List Permissions. Публикувайте лог файла в следващия си пост.

6 ноември 201114 г.

Автор

GrantPerms by Farbar Ran by ACER 6930 at 2011-11-06 20:59:50 =============================================== \\?\c:\Program Files\AVG\AVG8\avgcsrvx.exe Owner: BUILTIN\Administrators DACL(P)(AI): BUILTIN\Administrators FULL ALLOW (NI) NT AUTHORITY\SYSTEM FULL ALLOW (NI) BUILTIN\Users READ/EXECUTE ALLOW (NI) \\?\c:\Program Files\Avira\AntiVir Desktop\avguard.exe Owner: BUILTIN\Administrators DACL(P)(AI): BUILTIN\Administrators FULL ALLOW (NI) NT AUTHORITY\SYSTEM FULL ALLOW (NI) BUILTIN\Users READ/EXECUTE ALLOW (NI) \\?\c:\Program Files\Avira\AntiVir Desktop\avscan.exe Owner: BUILTIN\Administrators DACL(P)(AI): BUILTIN\Administrators FULL ALLOW (NI) NT AUTHORITY\SYSTEM FULL ALLOW (NI) BUILTIN\Users READ/EXECUTE ALLOW (NI) \\?\c:\Program Files\Readon Technology\Readon TV Movie Radio Player 7.5.0.0\internettv.exe Owner: BUILTIN\Administrators DACL(P)(AI): BUILTIN\Administrators FULL ALLOW (NI) NT AUTHORITY\SYSTEM FULL ALLOW (NI) BUILTIN\Users READ/EXECUTE ALLOW (NI) \\?\c:\Windows\bthservsdp.dat Owner: BUILTIN\Administrators DACL(NP)(AI): BUILTIN\Administrators FULL ALLOW (I) NT AUTHORITY\SYSTEM FULL ALLOW (I) BUILTIN\Users READ/EXECUTE ALLOW (I) NT AUTHORITY\Authenticated Users change ALLOW (I) \\?\c:\Windows\assembly\GAC_MSIL\Desktop.ini Owner: BUILTIN\Administrators DACL(P)(AI): BUILTIN\Administrators FULL ALLOW (NI) NT AUTHORITY\SYSTEM FULL ALLOW (NI) BUILTIN\Users READ/EXECUTE ALLOW (NI) \\?\c:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe Owner: BUILTIN\Administrators DACL(P)(AI): BUILTIN\Administrators FULL ALLOW (NI) NT AUTHORITY\SYSTEM FULL ALLOW (NI) BUILTIN\Users READ/EXECUTE ALLOW (NI) \\?\c:\Windows\System32\mrt.exe Owner: BUILTIN\Administrators DACL(P)(AI): BUILTIN\Administrators FULL ALLOW (NI) NT AUTHORITY\SYSTEM FULL ALLOW (NI) BUILTIN\Users READ/EXECUTE ALLOW (NI) \\?\c:\Windows\System32\LogFiles\WMI\RtBackup Owner: BUILTIN\Administrators DACL(P)(AI): BUILTIN\Administrators FULL ALLOW (CI)(OI) NT AUTHORITY\SYSTEM FULL ALLOW (CI)(OI) BUILTIN\Users READ/EXECUTE ALLOW (CI)(OI)

6 ноември 201114 г.

Има остатъци от AVG, също така Avira вероятно е повредена. Опитайте да махнете остатъците от AVG с AppRemover. След това преинсталирайте Avira и пишете дали има проблем.

6 ноември 201114 г.

Автор

След изчистването на остатъците от AVG , Авирата стана активна и веднага откри 2 вируса, които " уж оправи" , но не мога да я ъпдейтна. Трябва ли да я преинсталирам или да я оставя ?!

6 ноември 201114 г.

Както написах, Avira е повредена. Да, преинсталирайте я. Преди малко отключихме маса файлове и не би трябвало да има проблем с преинсталацията на програмата.

6 ноември 201114 г.

Автор

Готово ! Преинсталирах Авирата и за сега си работи нормално , но ми се струва , че машината ми е все още доста бавна а и натоварването на процесора ми се струва доста ненормално( вж прикаченият файл)...трябва ли да деинсталирам някои от програмите , които инсталирахме ?

New Microsoft Word Document.doc

6 ноември 201114 г.

Хм, това не ми харесва. Ще помисля и ще се консултирам с колегите, защото като че ли има малко проблеми, които не сме изчистили. Следва:

1.Деинсталирайте ComboFix:

Start → Run → Копирайте (copy) и поставете (Paste) следния текст, маркиран в синьо:

Combofix /Uninstall

после OK

2.Изтеглете OTCleanIt , стартирайте го и натиснете CleanUp

Изтрийте програмите и логовете, които използвахме в темата, ако има останали.

6 ноември 201114 г.

Все пак опитайте sfc/ scannow за Vista, макар да няма видима причина за това. Понеже има сума ти промени по регистрите, няма как за час-два да кажа каква е причината за натоварването на процесора. Може би не съм отключил всичко, ще трябва да проверя.

6 ноември 201114 г.

Автор

ОК ! Благодаря ти много

6 ноември 201114 г.

Докато проверявам ще може ли да пуснете Disk Cleanup? Също така пуснете дефрагментиране.

7 ноември 201114 г.

Ще трябва да проверим все пак дали има някакви остатъци. Затова следва:

1) Изтеглете: ESET Online Scanner

2) Стартирайте esetsmartinstaller_enu.exe

3) Сложете отметка на YES, I accept the Terms of Use и изберете Start

4) Скенерът ще започне да изтегля компонентите, които са му необходими.

5) Уверете се, че има отметки на следните редове, включително и тези от менюто Advanced Settings:

Scan archives
Scan for potentially unwanted applications
Scan for potentially unsafe applications
Enable Anti-Stealth technology

И накрая изберете Start

6) Скенерът ще започне да изтегля последните дефиниции.

7) След, като сканирането завърши изберете Finish.

8) Отидете в:

C:\Program Files\ESET\ESET Online Scanner

Отворете файла log.txt , копирайте съдържанието му и го поставете в следващия си коментар.

P.S. Проверката продължава доста време, над час, Имайте търпение.

7 ноември 201114 г.

Автор

OK ! Пуснах го да сканира .

7 ноември 201114 г.

Добре, имаме още малко работа по регистрите. Трябваше ми малко време, за да проверя. Ще чакам резултата от EOS, след това ще продължим.

7 ноември 201114 г.

Автор

ESETSmartInstaller@High as downloader log: all ok # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6583 # api_version=3.0.2 # EOSSerial=10352b4dfb5041439e69e68ed6d501de # end=finished # remove_checked=true # archives_checked=true # unwanted_checked=true # unsafe_checked=true # antistealth_checked=true # utc_time=2011-11-07 11:39:28 # local_time=2011-11-08 01:39:28 (+0200, FLE Standard Time) # country="Bulgaria" # lang=1033 # osver=6.0.6002 NT Service Pack 2 # compatibility_mode=1792 16777215 100 0 1675065 1675065 0 0 # compatibility_mode=2560 16777215 100 0 0 0 0 0 # compatibility_mode=5892 16776574 100 95 70842200 158225167 0 0 # compatibility_mode=8192 67108863 100 0 4378 4378 0 0 # scanned=155012 # found=0 # cleaned=0 # scan_time=16729

8 ноември 201114 г.

Стъпка 1

Сега изтеглете отново GrantPerms.zip и го разархивирайте в папка по избор. Стартирайте GrantPerms.exe и въведете следната информация:

c:\e06361e6b86b6f034c
c:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\34fe7a91701a13060dd6b43a3c068a66_1d52cdc3-2f4c-48cf-87e5-10ea8ded7dca
c:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\7639fb7f8f849aa5d765baa3823301ec_1d52cdc3-2f4c-48cf-87e5-10ea8ded7dca
c:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\8859180949f4c2c2ba5291c2c3989550_1d52cdc3-2f4c-48cf-87e5-10ea8ded7dca
c:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\92696cff5c491def455f8233e31da825_1d52cdc3-2f4c-48cf-87e5-10ea8ded7dca
c:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\aeb94b155d4b9c58b3e3d565fb2707cc_1d52cdc3-2f4c-48cf-87e5-10ea8ded7dca
c:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f87d22f451051ae2d0096aadba477402_1d52cdc3-2f4c-48cf-87e5-10ea8ded7dca
c:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\fda14804e8cbf4d0963061c930dd0313_1d52cdc3-2f4c-48cf-87e5-10ea8ded7dca
c:\ProgramData\TuneUp Software\TuneUp Utilities 2010\TTUSvc.tt
c:\System Volume Information\{3808876b-c176-4e48-b7ae-04046e6cc752}
c:\System Volume Information\{c7cef979-06e6-11e1-bbfc-00238b0a8c8f}{3808876b-c176-4e48-b7ae-04046e6cc752}
c:\System Volume Information\{dd357790-06ea-11e1-910d-00238b0a8c8f}{3808876b-c176-4e48-b7ae-04046e6cc752}
c:\System Volume Information\{dd3577b1-06ea-11e1-910d-00238b0a8c8f}{3808876b-c176-4e48-b7ae-04046e6cc752}
c:\System Volume Information\{dd35787d-06ea-11e1-910d-00238b0a8c8f}{3808876b-c176-4e48-b7ae-04046e6cc752}
c:\System Volume Information\{dd357bf7-06ea-11e1-910d-00238b0a8c8f}{3808876b-c176-4e48-b7ae-04046e6cc752}
c:\System Volume Information\{dd357c6f-06ea-11e1-910d-00238b0a8c8f}{3808876b-c176-4e48-b7ae-04046e6cc752}

Натиснете Unlock и след това List Permissions. Публикувайте лог файла в следващия си коментар.

Стъпка 2

Изтеглете Win32kDiag от някой от следните линкове и го запазете на десктопа
Ето линкове: Линк 1, Линк 2 и Линк 3
Start (или клавиш Windows + R) и поставете с Copy/ Paste следния текст, маркиран в синьо:
"%userprofile%\desktop\win32kdiag.exe" -f -r
и щракнете на ОК
След като програмата завърши работата си, на десктопа ще се появи файл с име Win32kDiag.txt. Поставете цялото съдържание на лог файла в следващия коментар в тази тема.

8 ноември 201114 г.

Автор

GrantPerms by Farbar Ran by ACER 6930 at 2011-11-08 13:13:46 =============================================== \\?\c:\e06361e6b86b6f034c Owner: BUILTIN\Administrators DACL(NP)(AI): BUILTIN\Administrators FULL ALLOW (CI)(OI) NT AUTHORITY\SYSTEM FULL ALLOW (CI)(OI) BUILTIN\Administrators FULL ALLOW (I) BUILTIN\Administrators FULL ALLOW (CI)(OI)(IO)(I) NT AUTHORITY\SYSTEM FULL ALLOW (I) NT AUTHORITY\SYSTEM FULL ALLOW (CI)(OI)(IO)(I) BUILTIN\Users READ/EXECUTE ALLOW (CI)(OI)(I) NT AUTHORITY\Authenticated Users change ALLOW (I) NT AUTHORITY\Authenticated Users change ALLOW (CI)(OI)(IO)(I) \\?\c:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\34fe7a91701a13060dd6b43a3c068a66_1d52cdc3-2f4c-48cf-87e5-10ea8ded7dca Owner: BUILTIN\Administrators DACL(NP)(AI): BUILTIN\Administrators FULL ALLOW (NI) NT AUTHORITY\SYSTEM FULL ALLOW (NI) BUILTIN\Users READ/EXECUTE ALLOW (NI) \\?\c:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\7639fb7f8f849aa5d765baa3823301ec_1d52cdc3-2f4c-48cf-87e5-10ea8ded7dca Owner: BUILTIN\Administrators DACL(NP)(AI): BUILTIN\Administrators FULL ALLOW (NI) NT AUTHORITY\SYSTEM FULL ALLOW (NI) BUILTIN\Users READ/EXECUTE ALLOW (NI) \\?\c:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\8859180949f4c2c2ba5291c2c3989550_1d52cdc3-2f4c-48cf-87e5-10ea8ded7dca Owner: BUILTIN\Administrators DACL(NP)(AI): BUILTIN\Administrators FULL ALLOW (NI) NT AUTHORITY\SYSTEM FULL ALLOW (NI) BUILTIN\Users READ/EXECUTE ALLOW (NI) \\?\c:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\92696cff5c491def455f8233e31da825_1d52cdc3-2f4c-48cf-87e5-10ea8ded7dca Owner: BUILTIN\Administrators DACL(NP)(AI): BUILTIN\Administrators FULL ALLOW (NI) NT AUTHORITY\SYSTEM FULL ALLOW (NI) BUILTIN\Users READ/EXECUTE ALLOW (NI) \\?\c:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\aeb94b155d4b9c58b3e3d565fb2707cc_1d52cdc3-2f4c-48cf-87e5-10ea8ded7dca Owner: BUILTIN\Administrators DACL(NP)(AI): BUILTIN\Administrators FULL ALLOW (NI) NT AUTHORITY\SYSTEM FULL ALLOW (NI) BUILTIN\Users READ/EXECUTE ALLOW (NI) \\?\c:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f87d22f451051ae2d0096aadba477402_1d52cdc3-2f4c-48cf-87e5-10ea8ded7dca Owner: BUILTIN\Administrators DACL(NP)(AI): BUILTIN\Administrators FULL ALLOW (NI) NT AUTHORITY\SYSTEM FULL ALLOW (NI) BUILTIN\Users READ/EXECUTE ALLOW (NI) \\?\c:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\fda14804e8cbf4d0963061c930dd0313_1d52cdc3-2f4c-48cf-87e5-10ea8ded7dca Owner: BUILTIN\Administrators DACL(NP)(AI): BUILTIN\Administrators FULL ALLOW (NI) NT AUTHORITY\SYSTEM FULL ALLOW (NI) BUILTIN\Users READ/EXECUTE ALLOW (NI) \\?\c:\ProgramData\TuneUp Software\TuneUp Utilities 2010\TTUSvc.tt Owner: BUILTIN\Administrators DACL(NP)(AI): NT AUTHORITY\SYSTEM FULL ALLOW (I) BUILTIN\Administrators FULL ALLOW (I) BUILTIN\Users READ/EXECUTE ALLOW (I) ERROR: Parsing the SD of <\\?\c:\System Volume Information\{3808876b-c176-4e48-b7ae-04046e6cc752}> failed with: Access is denied. Operating system error message: Access is denied. ERROR: Parsing the SD of <\\?\c:\System Volume Information\{c7cef979-06e6-11e1-bbfc-00238b0a8c8f}{3808876b-c176-4e48-b7ae-04046e6cc752}> failed with: The system cannot find the file specified. Operating system error message: The system cannot find the file specified. ERROR: Parsing the SD of <\\?\c:\System Volume Information\{dd357790-06ea-11e1-910d-00238b0a8c8f}{3808876b-c176-4e48-b7ae-04046e6cc752}> failed with: The system cannot find the file specified. Operating system error message: The system cannot find the file specified. ERROR: Parsing the SD of <\\?\c:\System Volume Information\{dd3577b1-06ea-11e1-910d-00238b0a8c8f}{3808876b-c176-4e48-b7ae-04046e6cc752}> failed with: The system cannot find the file specified. Operating system error message: The system cannot find the file specified. ERROR: Parsing the SD of <\\?\c:\System Volume Information\{dd35787d-06ea-11e1-910d-00238b0a8c8f}{3808876b-c176-4e48-b7ae-04046e6cc752}> failed with: The system cannot find the file specified. Operating system error message: The system cannot find the file specified. ERROR: Parsing the SD of <\\?\c:\System Volume Information\{dd357bf7-06ea-11e1-910d-00238b0a8c8f}{3808876b-c176-4e48-b7ae-04046e6cc752}> failed with: The system cannot find the file specified. Operating system error message: The system cannot find the file specified. ERROR: Parsing the SD of <\\?\c:\System Volume Information\{dd357c6f-06ea-11e1-910d-00238b0a8c8f}{3808876b-c176-4e48-b7ae-04046e6cc752}> failed with: The system cannot find the file specified. Operating system error message: The system cannot find the file specified. Running from: C:\Users\ACER 6930\Desktop\win32kdiag.exe Log file at : C:\Users\ACER 6930\Desktop\Win32kDiag.txt Removing all found mount points. Attempting to reset file permissions. WARNING: Could not get backup privileges! Searching 'C:\Windows'... Cannot access: C:\Windows\Microsoft.NET\Framework\v2.0.50727\ Attempting to restore permissions of : C:\Windows\Microsoft.NET\Framework\v2.0.50727\ [1] 2009-03-30 06:42:14 66368 C:\Windows\Microsoft.NET\Framework\v2.0.50727\ ()

8 ноември 201114 г.

О.К.

Сега може да деинсталирате:

1. ESET Online Scanner

2. Registry Mechanic - крайно непрепоръчителна програма, която може да съсипе регистрите.

3. Spybot - Search & Destroy - крайно непрепоръчителна програма, в момента е повредена от рууткита.

4. Revo Uninstaller Pro 2.4.1 - това е платената версия на Revo Uninstaller. Не вярвам да сте си я купили, но винаги може да ползвате безплатната версия: справка

Обновете:

1. Java: справка

2. K-Lite Codec Pack: справка

3. Mozilla Firefox: справка

Преинсталирайте Readon TV Movie Radio Player, защото е вероятно е повреден. Изтрийте GrantPerms, Win32kDiag и логовете им.

Вижте в диспечера на устройствата (Device Manager) дали има някакви конфликти и проблеми. Пишете, след като приключите.

8 ноември 201114 г.

Автор

Деинсталирах програмите , които ми каза и си обнових кодеците, Мозилата и Джавата. В Device Manager всичко е ОК ! Не знам до колко е нормално , но ми се струва , че процесорът ми все още е доста натоварен ( вж.прикаченият файл) и то при положение , че не съм стартирал абсолютно нищо...

New Microsoft Word Document.doc

Добре дошли!

Проблеми с Rootkit Zero Access [решен]

Featured Replies

Архивирана тема

Разглеждащи това в момента 0

Дарение

Бюлетин

Профил

Навигация

Търсене

Конфигуриране на push известия в браузъра

Chrome (Android)

Chrome (Desktop)

Safari (iOS 16.4+)

Safari (macOS)

Edge (Android)

Edge (Desktop)

Firefox (Android)

Firefox (Desktop)