стартирах ДДС, отваря прозорец в който твърди, че е създала два тхт файла, но самите файлве ги няма. ДДС програмата е записана на десктопа.

Да така е ....създава ги (директно ги отваря)..Копирате съдържанието им в следващия си пост..!А всъщност с каква цел искате да използвате DDS..?

Причината да я стартирам е, че наскоро помогнахте на мой колега да си излекува компа, след което и значително се подобри скоростта му на работа. Аз не знам дали имам вируси, но определено имам нужда подобрение на скоростта...

Предполагам вие ги търсите запомнени на десктопа....не не е така:

За целта:

Натиснете клавиш Windows + "R" и копирайте и поставете в полето Run и натиснете ОК следната информация:

%temp%\dds.txt

Трябва да се отвори текстов файл . Запишете на вашия работен плот, след това копирайте съдържанието на файла в следващия си отговор.

Същото направете и за другия файл:

%temp%\attach.txt

Application not found. Това ми изписва. Или по-точно: c:\user\kamen\AppData\local\Temp\dds.txt Application not found

Добреее....!Изтрийте вашото копие на DDS и изтеглете това dds.exe и го запазете на вашия десктоп.

Стартирайте програмата.Ще се появи следния прозорец:

Сложете отметки на dds.txt и attach.txt., и сатртирайте...След като програмата завърши на десктопа ще се запомнят двата файла.Копирайте съдържанието им в следващия си пост.

DDS (Ver_2011-09-30.01) - NTFS_x86 Internet Explorer: 8.0.6001.19048 BrowserJavaVersion: 1.6.0_26 Run by kamen at 22:48:15 on 2011-11-07 Microsoft® Windows Vista™ Business 6.0.6002.2.1251.359.1033.18.2039.739 [GMT 2:00] . AV: AntiVir Desktop *Enabled/Outdated* {090F9C29-64CE-6C6F-379C-5901B49A85B7} SP: AntiVir Desktop *Enabled/Outdated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A} . ============== Running Processes ================ . C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\SLsvc.exe C:\Windows\system32\Hpservice.exe C:\Windows\System32\spoolsv.exe C:\Program Files\Avira\AntiVir Desktop\sched.exe C:\Windows\system32\AEADISRV.EXE C:\Windows\system32\agrsmsvc.exe C:\Program Files\Avira\AntiVir Desktop\avguard.exe C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\PDF Complete\pdfsvc.exe C:\Program Files\Avira\AntiVir Desktop\avshadow.exe c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe C:\Windows\system32\SearchIndexer.exe C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\system32\taskeng.exe C:\WINDOWS\SMINST\scheduler.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Program Files\PDF Complete\pdfsty.exe C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\pthosttr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\WINDOWS\System32\igfxtray.exe C:\WINDOWS\System32\hkcmd.exe C:\WINDOWS\System32\igfxpers.exe C:\WINDOWS\PixArt\Pac207\Monitor.exe C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\Program Files\Avira\AntiVir Desktop\avgnt.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Siemens\Card API\bin\siecacst.exe C:\Windows\system32\taskeng.exe C:\Windows\system32\igfxsrvc.exe C:\Program Files\Synaptics\SynTP\SynTPHelper.exe C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe C:\Windows\System32\alg.exe C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe C:\Windows\system32\wuauclt.exe C:\Program Files\Common Files\Java\Java Update\jucheck.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Windows\system32\conime.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Windows\system32\prevhost.exe C:\Windows\system32\prevhost.exe C:\Program Files\SolidWorks\SLDWORKS.exe C:\Windows\system32\taskeng.exe C:\Program Files\FlashGet\flashget.exe C:\Windows\system32\SearchProtocolHost.exe C:\Windows\system32\SearchFilterHost.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\System32\svchost.exe -k Cognizance C:\Windows\system32\svchost.exe -k rpcss C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k GPSvcGroup C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Windows\system32\svchost.exe -k bthsvcs C:\Windows\system32\svchost.exe -k hpdevmgmt C:\Windows\System32\svchost.exe -k HPZ12 C:\Windows\System32\svchost.exe -k HPZ12 C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Windows\system32\svchost.exe -k imgsvc C:\Windows\System32\svchost.exe -k WerSvcGroup C:\Windows\system32\svchost.exe -k HPService C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation . ============== Pseudo HJT Report =============== . uStart Page = about:blank uSearch Bar = hxxp://google.icq.com/search/search_frame.php uURLSearchHooks: <No Name>: - LocalServer32 - <no file> uURLSearchHooks: {414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3} - <orphaned> BHO: Adobe PDF Reader Link Helper: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll BHO: FGCatchUrl: {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - c:\program files\flashget\jccatch.dll BHO: BitComet Helper: {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - c:\program files\bitcomet\tools\BitCometBHO_1.1.9.24.dll BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll BHO: Adobe PDF Conversion Toolbar Helper: {AE7CD045-E861-484f-8273-0445EE161910} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll BHO: Google Toolbar Notifier BHO: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - c:\program files\google\googletoolbarnotifier\5.6.5612.1312\swg.dll BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: Credential Manager for HP ProtectTools: {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - c:\program files\hewlett-packard\iam\bin\ItIEAddIn.dll BHO: FlashGet GetFlash Class: {F156768E-81EF-470C-9057-481BA8380DBA} - c:\program files\flashget\getflash.dll TB: Google Toolbar: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\program files\google\google toolbar\GoogleToolbar_32.dll TB: Adobe PDF: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll TB: Adobe PDF: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\google toolbar\GoogleToolbar_32.dll EB: &Research: {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\program files\microsoft office\office11\REFIEBAR.DLL EB: Adobe PDF: {182EC0BE-5110-49C8-A062-BEB1D02A220B} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll uRun: [LightScribe Control Panel] c:\program files\common files\lightscribe\LightScribeControlPanel.exe -hidden uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe" uRun: [indxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "c:\program files\common files\nero\lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020 uRun: [DAEMON Tools Lite] "c:\program files\daemon tools lite\DTLite.exe" -autorun mRun: [Windows Defender] c:\program files\windows defender\MSASCui.exe -hide mRun: [PDF Complete] "c:\program files\pdf complete\pdfsty.exe" mRun: [PTHOSTTR] c:\program files\hewlett-packard\hp protecttools security manager\PTHOSTTR.EXE /Start mRun: [synTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe mRun: [hpWirelessAssistant] c:\program files\hewlett-packard\hp wireless assistant\HPWAMain.exe mRun: [WAWifiMessage] c:\program files\hewlett-packard\hp wireless assistant\WiFiMsg.exe mRun: [HP Health Check Scheduler] c:\program files\hewlett-packard\hp health check\HPHC_Scheduler.exe mRun: [QlbCtrl] c:\program files\hewlett-packard\hp quick launch buttons\QlbCtrl.exe /Start mRun: [CognizanceTS] rundll32.exe c:\progra~1\hewlet~1\iam\bin\ASTSVCC.dll,RegisterModule mRun: [HP Software Update] c:\program files\hewlett-packard\hp software update\HPWuSchd2.exe mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe" mRun: [WatchDog] c:\program files\intervideo\dvd check\DVDCheck.exe mRun: [igfxTray] c:\windows\system32\igfxtray.exe mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe mRun: [Persistence] c:\windows\system32\igfxpers.exe mRun: [synTPStart] c:\program files\synaptics\syntp\SynTPStart.exe mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe" mRun: [NBKeyScan] "c:\program files\nero\nero8\nero backitup\NBKeyScan.exe" mRun: [Monitor] c:\windows\pixart\pac207\Monitor.exe mRun: [soundMAXPnP] c:\program files\analog devices\core\smax4pnp.exe mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe" mRun: [NokiaMServer] c:\program files\common files\nokia\mplatform\NokiaMServer /watchfiles startup mRunOnce: [sT Recovery Launcher] c:\windows\sminst\launcher.exe StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\hipath~1.lnk - c:\program files\siemens\card api\bin\siecacst.exe mPolicies-Explorer: BindDirectlyToPropertySetStorage = dword:0 mPolicies-System: EnableLUA = dword:0 mPolicies-System: EnableUIADesktopToggle = dword:0 IE: &D&ownload &with BitComet - c:\program files\bitcomet\BitComet.exe/AddLink.htm IE: &D&ownload all video with BitComet - c:\program files\bitcomet\BitComet.exe/AddVideo.htm IE: &D&ownload all with BitComet - c:\program files\bitcomet\BitComet.exe/AddAllLink.htm IE: &Download All with FlashGet - c:\program files\flashget\jc_all.htm IE: &Download with FlashGet - c:\program files\flashget\jc_link.htm IE: Append to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert link target to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convert link target to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert selected links to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html IE: Convert selected links to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html IE: Convert selection to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convert selection to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: E&xport to Microsoft Excel - c:\progra~1\micros~1\office12\EXCEL.EXE/3000 IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office12\ONBttnIE.dll IE: {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - {E7A829CC-671F-4C3D-B590-8C0AEA72E6B2} IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} IE: {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - c:\program files\flashget\FlashGet.exe IE: {E59EB121-F339-4851-A3BA-FE49C35617C2} - c:\program files\icq6.5\ICQ.exe DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab TCP: NameServer = 212.39.90.42 212.39.90.43 TCP: Interfaces\{3BBF0D1C-C84A-4C76-900D-40F11DC9E0A4} : DHCPNameServer = 192.168.1.1 TCP: Interfaces\{55FF9C82-D159-4F27-8E2F-355A8D3DD630} : NameServer = 208.67.220.220 TCP: Interfaces\{FA8A5F8B-CE2A-4CDC-864B-D64D8BB40B6B} : DHCPNameServer = 212.39.90.42 212.39.90.43 Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll Notify: igfxcui - igfxdev.dll SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll LSA: Notification Packages = scecli ASWLNPkg LSA: Security Packages = kerberos msv1_0 schannel wdigest tspkg mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "c:\program files\common files\lightscribe\LSRunOnce.exe" . ================= FIREFOX =================== . FF - ProfilePath - c:\users\kamen\appdata\roaming\mozilla\firefox\profiles\og3888sg.default\ FF - prefs.js: browser.search.defaulturl - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.3.3&q= FF - prefs.js: browser.search.selectedEngine - ICQ Search FF - prefs.js: browser.startup.homepage - hxxp://start.icq.com/ FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.3.3&q= FF - component: c:\program files\nokia\nokia ovi suite\connectors\bookmarks connector\firefoxextension\components\FirefoxExtension.dll FF - component: c:\program files\nokia\nokia pc suite 7\bkmrksync\components\BkMrkExt.dll FF - component: c:\programdata\real\realplayer\browserrecordplugin\firefox\ext\components\nprpffbrowserrecordext.dll FF - component: c:\users\kamen\appdata\roaming\mozilla\firefox\profiles\og3888sg.default\extensions\{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}\components\FFExternalAlert.dll FF - component: c:\users\kamen\appdata\roaming\mozilla\firefox\profiles\og3888sg.default\extensions\{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}\components\RadioWMPCore.dll FF - component: c:\users\kamen\appdata\roaming\mozilla\firefox\profiles\og3888sg.default\extensions\[email protected]\components\RadioWMPCoreGecko19.dll FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll FF - plugin: c:\program files\google\update\1.3.21.79\npGoogleUpdate3.dll FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll FF - plugin: c:\program files\microsoft silverlight\4.0.60310.0\npctrlui.dll FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll FF - plugin: c:\program files\veetle\player\npvlc.dll FF - plugin: c:\program files\veetle\plugins\npVeetle.dll . ============= SERVICES / DRIVERS =============== . R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2009-1-11 28552] R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2009-11-24 11608] R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\drivers\dtsoftbus01.sys [2011-8-8 232512] R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2009-11-24 136360] R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2009-11-24 269480] R2 ASBroker;Logon Session Broker;c:\windows\system32\svchost.exe -k Cognizance [2008-9-30 21504] R2 ASChannel;Local Communication Channel;c:\windows\system32\svchost.exe -k Cognizance [2008-9-30 21504] R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2009-11-24 66616] R2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-9-30 21504] R2 hpsrv;HP Service;c:\windows\system32\hpservice.exe [2008-8-7 24880] R2 pdfcDispatcher;PDF Document Manager;c:\program files\pdf complete\pdfsvc.exe [2007-7-12 540448] R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2007-7-12 179712] R3 NETw5v32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\drivers\NETw5v32.sys [2008-11-17 3668480] S2 ccosm;Contrl Center of Storm Media;c:\program files\stormii\stormliv.exe /asservice --> c:\program files\stormii\stormliv.exe [?] S2 gupdate;Услуга Google Update (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-6-28 136176] S3 cpuz134;cpuz134;c:\program files\cpuid\pc wizard 2010\pcwiz_x32.sys [2011-10-30 20328] S3 gupdatem;Услуга на Google Актуализация (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-6-28 136176] S3 PAC207;SoC PC-Camera;c:\windows\system32\drivers\PFC027.SYS [2006-12-5 507136] . =============== File Associations =============== . FileExt: .scr: AutoCADScriptFile="c:\windows\system32\notepad.exe" "%1" FileExt: .txt: txtfile="c:\program files\jgsoft\editpadpro6\EditPadPro.exe" "%1" ShellExec: DVDXPlayer.exe: open=c:\program files\dvd x studios\dvd x player 4.1 professional\DVDXPlayer.exe" "%1 . =============== Created Last 30 ================ . 2011-11-06 08:49:28 -------- d-----w- c:\program files\ESET 2011-11-04 09:57:50 29272 ----a-r- c:\windows\system32\AdobePDF.dll 2011-10-30 05:52:52 114176 ----a-w- c:\windows\system32\PCWizard.cpl 2011-10-30 05:52:52 -------- d-----w- c:\windows\Java 2011-10-30 05:52:47 -------- d-----w- c:\program files\CPUID . ==================== Find3M ==================== . 2011-10-26 20:20:25 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl . ============= FINISH: 22:48:57.08 =============== . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2011-09-30.01) . Microsoft® Windows Vista™ Business Boot Device: \Device\HarddiskVolume1 Install Date: 30.08.2007 г. 09:41:27 System Uptime: 07.11.2011 г. 20:27:53 (2 hours ago) . Motherboard: Hewlett-Packard | | 30C0 Processor: Intel® Core2 Duo CPU T7500 @ 2.20GHz | U10 | 800/200mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 140 GiB total, 53.637 GiB free. D: is CDROM () E: is FIXED (NTFS) - 9 GiB total, 1.094 GiB free. F: is CDROM () G: is CDROM () . ==== Disabled Device Manager Items ============= . Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318} Description: Microsoft ISATAP Adapter Device ID: ROOT\*ISATAP\0014 Manufacturer: Microsoft Name: Microsoft ISATAP Adapter #3 PNP Device ID: ROOT\*ISATAP\0014 Service: tunnel . Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318} Description: Microsoft ISATAP Adapter Device ID: ROOT\*ISATAP\0036 Manufacturer: Microsoft Name: Microsoft ISATAP Adapter #14 PNP Device ID: ROOT\*ISATAP\0036 Service: tunnel . Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318} Description: Microsoft ISATAP Adapter Device ID: ROOT\*ISATAP\0090 Manufacturer: Microsoft Name: Microsoft ISATAP Adapter #42 PNP Device ID: ROOT\*ISATAP\0090 Service: tunnel . Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318} Description: Microsoft ISATAP Adapter Device ID: ROOT\*ISATAP\0097 Manufacturer: Microsoft Name: Microsoft ISATAP Adapter #48 PNP Device ID: ROOT\*ISATAP\0097 Service: tunnel . Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318} Description: Microsoft ISATAP Adapter Device ID: ROOT\*ISATAP\0099 Manufacturer: Microsoft Name: Microsoft ISATAP Adapter #46 PNP Device ID: ROOT\*ISATAP\0099 Service: tunnel . Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318} Description: Microsoft ISATAP Adapter Device ID: ROOT\*ISATAP\0106 Manufacturer: Microsoft Name: Microsoft ISATAP Adapter #43 PNP Device ID: ROOT\*ISATAP\0106 Service: tunnel . Class GUID: {4d36e971-e325-11ce-bfc1-08002be10318} Description: HP LaserJet M2727nf MFP Device ID: ROOT\MULTIFUNCTION\0000 Manufacturer: Hewlett-Packard Name: HP LaserJet M2727nf MFP PNP Device ID: ROOT\MULTIFUNCTION\0000 Service: . Class GUID: {4d36e971-e325-11ce-bfc1-08002be10318} Description: Deskjet 6940 series Device ID: ROOT\MULTIFUNCTION\0001 Manufacturer: HP Name: Deskjet 6940 series PNP Device ID: ROOT\MULTIFUNCTION\0001 Service: . Class GUID: {4d36e971-e325-11ce-bfc1-08002be10318} Description: Deskjet 6940 series Device ID: ROOT\MULTIFUNCTION\0002 Manufacturer: HP Name: Deskjet 6940 series PNP Device ID: ROOT\MULTIFUNCTION\0002 Service: . ==== System Restore Points =================== . RP1528: 29.10.2011 г. 13:36:09 - Scheduled Checkpoint RP1529: 31.10.2011 г. 12:50:37 - Scheduled Checkpoint RP1530: 01.11.2011 г. 06:42:35 - Scheduled Checkpoint RP1531: 02.11.2011 г. 12:50:02 - Scheduled Checkpoint RP1532: 04.11.2011 г. 10:23:58 - Scheduled Checkpoint RP1533: 05.11.2011 г. 14:17:42 - Scheduled Checkpoint RP1534: 06.11.2011 г. 16:19:43 - Scheduled Checkpoint RP1535: 07.11.2011 г. 20:59:04 - Scheduled Checkpoint . ==== Installed Programs ====================== . Update for Microsoft Office 2007 (KB2508958) 32 Bit HP CIO Components Installer 4500_G510gm_Help_Web 4500G510gm_Software_Min 4500G510gm_web 5700_Help AC3Filter (remove only) ACE Mega CoDecS Pack Activation Assistant for the 2007 Microsoft Office suites Adobe Acrobat 8 Professional - English, Franзais, Deutsch Adobe Acrobat 8.1.2 Professional Adobe Flash Player 11 ActiveX Adobe Flash Player 11 Plugin Adobe Reader 8.1.2 Agere Systems HDA Modem Application Installer 4.00.B14 AutoCAD 2008 - English Autodesk Design Review 2008 Autodesk Express Viewer Avira AntiVir Personal - Free Antivirus B-Trust Renew Application BitComet 0.94 BPD_Scan BPDSoftware BPDSoftware_Ini BS.Player PRO BufferChm Business Contact Manager for Outlook 2007 SP2 Credential Manager for HP ProtectTools CutePDF Writer 2.7 DAEMON Tools Lite eDrawings 2007 eDrawings 2008 ESET Online Scanner v3 ESU for Microsoft Vista Eta-17 FARO LS 1.1.406.58 Fax ffdshow ffdshow [rev 1201] [2007-05-26] FlashGet 1.9.2.1028 FLV Player 2.0 (build 25) GearDrvs Google Земя Google Chrome Google Toolbar for Internet Explorer Google Update Helper Haali Media Splitter Hewlett-Packard Active Check Hewlett-Packard Asset Agent HiPath SIcurity Card API Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595) Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484) HP 3D DriveGuard HP Active Support Library HP Active Support Library 32 bit components HP Backup & Recovery Manager Installer HP BIOS Configuration for ProtectTools HP Customer Experience Enhancements HP Doc Viewer HP Easy Setup - Core HP Easy Setup - Frontend HP Help and Support HP Notebook Accessories Product Tour HP Officejet 4500 G510g-m HP Officejet All-In-One Series HP Photosmart Essential HP ProtectTools Security Manager HP Quick Launch Buttons 6.20 F2 HP Update HP User Guides 0064 HP Wireless Assistant HPSSupply ICQ6.5 ImagXpress Intel® Graphics Media Accelerator Driver J5700 Java Auto Updater Java 6 Update 26 Java SE Runtime Environment 6 LightScribe 1.6.43.1 LiveUpdate 3.2 (Symantec Corporation) LiveUpdate Notice (Symantec Corporation) Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Security Update (KB2416447) Microsoft .NET Framework 3.5 SP1 Microsoft Office 2003 Web Components Microsoft Office 2007 Primary Interop Assemblies Microsoft Office 2007 Service Pack 2 (SP2) Microsoft Office Access MUI (English) 2007 Microsoft Office Access Setup Metadata MUI (English) 2007 Microsoft Office Enterprise 2007 Microsoft Office Excel MUI (English) 2007 Microsoft Office FrontPage 2003 Microsoft Office Groove MUI (English) 2007 Microsoft Office Groove Setup Metadata MUI (English) 2007 Microsoft Office InfoPath MUI (English) 2007 Microsoft Office OneNote MUI (English) 2007 Microsoft Office Outlook MUI (English) 2007 Microsoft Office PowerPoint MUI (English) 2007 Microsoft Office Proof (English) 2007 Microsoft Office Proof (French) 2007 Microsoft Office Proof (Spanish) 2007 Microsoft Office Proofing (English) 2007 Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) Microsoft Office Publisher MUI (English) 2007 Microsoft Office Shared MUI (English) 2007 Microsoft Office Shared Setup Metadata MUI (English) 2007 Microsoft Office Small Business Connectivity Components Microsoft Office Word MUI (English) 2007 Microsoft Silverlight Microsoft SQL Server 2005 Microsoft SQL Server 2005 Express Edition (MSSMLBIZ) Microsoft SQL Server Native Client Microsoft SQL Server Setup Support Files (English) Microsoft SQL Server VSS Writer Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Mozilla Firefox 7.0.1 (x86 en-US) MSCU for Microsoft Vista MSVC80_x86_v2 MSVC90_x86 MSXML 4.0 SP2 (KB936181) MSXML 4.0 SP2 (KB941833) MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) neroxml Network Nokia Connectivity Cable Driver Nokia Ovi Suite Nokia Ovi Suite Software Updater Nokia PC Suite OpenOffice.org Installer 1.0 Ovi Desktop Sync Engine OviMPlatform Panda ActiveScan 2.0 PC Connectivity Solution PC Wizard 2010.1.96 PDF Complete PL-2303 Vista Driver Installer ProductContext SA Dictionary 2004 Datacenter SA Dictionary 2005 T2 Scan Security Update for 2007 Microsoft Office System (KB2288621) Security Update for 2007 Microsoft Office System (KB2288931) Security Update for 2007 Microsoft Office System (KB2345043) Security Update for 2007 Microsoft Office System (KB2466156) Security Update for 2007 Microsoft Office System (KB2509488) Security Update for 2007 Microsoft Office System (KB969559) Security Update for 2007 Microsoft Office System (KB976321) Security Update for CAPICOM (KB931906) Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473) Security Update for Microsoft Office Access 2007 (KB979440) Security Update for Microsoft Office Excel 2007 (KB2464583) Security Update for Microsoft Office Groove 2007 (KB2494047) Security Update for Microsoft Office InfoPath 2007 (KB979441) Security Update for Microsoft Office PowerPoint 2007 (KB2535818) Security Update for Microsoft Office PowerPoint Viewer 2007 (KB2464623) Security Update for Microsoft Office Publisher 2007 (KB2284697) Security Update for Microsoft Office system 2007 (972581) Security Update for Microsoft Office system 2007 (KB974234) Security Update for Microsoft Office Visio Viewer 2007 (KB973709) Security Update for Microsoft Office Word 2007 (KB2344993) Skype™ 5.5 SolidWorks 2004 SP0 Sonic Activation Module SoundMAX Stahlschluessel 2004 Synaptics Pointing Device Driver Toolbox UltraISO Premium V9.36 Update for 2007 Microsoft Office System (KB967642) Update for Microsoft .NET Framework 3.5 SP1 (KB963707) Update for Microsoft Office 2007 Help for Common Features (KB963673) Update for Microsoft Office Access 2007 Help (KB963663) Update for Microsoft Office Excel 2007 Help (KB963678) Update for Microsoft Office Infopath 2007 Help (KB963662) Update for Microsoft Office OneNote 2007 (KB980729) Update for Microsoft Office OneNote 2007 Help (KB963670) Update for Microsoft Office Outlook 2007 (KB2509470) Update for Microsoft Office Outlook 2007 Help (KB963677) Update for Microsoft Office Powerpoint 2007 Help (KB963669) Update for Microsoft Office Publisher 2007 Help (KB963667) Update for Microsoft Office Script Editor Help (KB963671) Update for Microsoft Office Word 2007 Help (KB963665) Update for Outlook 2007 Junk Email Filter (KB2536413) VBA (2627.01) Veetle TV 0.9.18 Vista Default Settings VobSub v2.23 (Remove Only) WearCalc WebReg Winamp (remove only) Windows Driver Package - Nokia Modem (02/15/2007 3.1) Windows Driver Package - Nokia pccsmcfd (08/22/2008 7.0.0.0) Windows Media Player Firefox Plugin WinRAR archiver . ==== End Of File ===========================

Изтеглете OTL.exe и го запазете на десктопа.

• Стартирайте OTL (ако е необходимо, потвърдете през UAC).
• Направете следните настройки:
• Сложете отметка пред Scan All Users
• Под менюто File Age => изберете 90 days
• Под менюто Standard Registry => променете на ALL
• Сложете отметки пред LOP и Purity Check

Под с Copy/ Paste въведете изцяло следната текстова информация (само това, което е поставено в карето):

netsvcs
%SYSTEMDRIVE%\*.*
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\Fonts\*.exe
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.jpg
%systemroot%\*.png
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\System32\config\*.sav
%PROGRAMFILES%\bak. /s
%systemroot%\system32\bak. /s
%ALLUSERSPROFILE%\Start Menu\*.lîk /x
%systemroot%\system32\config\systemprofile\*.dat /x
%systemroot%\*.config
%systemroot%\system32\*.db
%PROGRAMFILES%\Internet Explorer\*.dat
%APPDATA%\Mikzosoft\Internet Explorer\Quick Launch\*.lnk /x
%USERPROFILE%\Deskuop\*.exe
%PROGRAMFILES%\Common Files\*.*
%systemroot%\*.src
%systemroot%\install\*.*
%systemroot%\system32\DLL\*.*
%systemroot%\system32\HelpFiles\*.*
%systemroot%\system32\rundll\*.*
%systemroot%\winn32\*.*
%systemroot%\Java\*.*
%systemroot%\system32\test\*.*
%systemroot%\system32\Rundll32\*.*
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs
%USERPROFILE%\..|smtmp;true;true;true /FP
/md5start
iexplore.*
explorer.*
winlogon.*
dll
zx.dll
hlp.dat
consrv.dll
/md5stop

• Натиснете маркираният в синьо бутон: Run Scan.
• Като приключи проверката, ще се създадат два файла - OTL.Txt и Extras.Txt. Прикачете тези два файла в следващия си коментар (погледнете опцията "прикачени файлове", когато публикувате мнение).

OTL.Txt Extras.Txt

Стартирайте отново OTL, копирайте (Copy) и поставете (Paste) скриптовия текст от текстовото поле по-долу под колонката Custom Scans/Fixes, като не забравяте да копирате скрипта 1 към 1, както и двете точки преди първия ред на скрипта.

:OTL
SRV - File not found [On_Demand | Stopped] --  -- (stllssvr)
SRV - File not found [Auto | Stopped] --  -- (ccosm)
DRV - [2009.06.30 08:37:16 | 000,028,552 | ---- | M] (Panda Security, S.L.) [File_System | Boot | Running] -- C:\Windows\system32\drivers\pavboot.sys -- (pavboot)
IE - HKU\S-1-5-21-3226023306-4098431153-593267344-1006\..\URLSearchHook:  - No CLSID value found
IE - HKU\S-1-5-21-3226023306-4098431153-593267344-1006\..\URLSearchHook: {414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3} - No CLSID value found
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" File not found
O4 - HKLM..\Run: [WatchDog] C:\Program Files\InterVideo\DVD Check\DVDCheck.exe File not found
O4 - HKU\S-1-5-21-3226023306-4098431153-593267344-1006..\Run: []  File not found
O4 - HKU\S-1-5-21-3226023306-4098431153-593267344-1006..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020 File not found
O33 - MountPoints2\{0cc1983b-30c0-11df-b37c-8ade84e9dba4}\Shell\AutoRun - "" = Autorun
O33 - MountPoints2\{0cc1983b-30c0-11df-b37c-8ade84e9dba4}\Shell\AutoRun\command - "" = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL G:\m.exe /s
O33 - MountPoints2\{2d9d408e-fc37-11dd-b2e9-001a6bb7af87}\Shell\AutoRun\command - "" = F:\mrljtc.exe
O33 - MountPoints2\{2d9d408e-fc37-11dd-b2e9-001a6bb7af87}\Shell\explore\Command - "" = F:\mrljtc.exe
O33 - MountPoints2\{2d9d408e-fc37-11dd-b2e9-001a6bb7af87}\Shell\open\Command - "" = F:\mrljtc.exe
O33 - MountPoints2\{6756c479-50d1-11de-89d7-be2bcd0788ab}\Shell\Auto\command - "" = F:\autorun.exe
O33 - MountPoints2\{6756c479-50d1-11de-89d7-be2bcd0788ab}\Shell\AutoRun\command - "" = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL F:\autorun.exe
O33 - MountPoints2\{a29fadc1-4924-11df-9f03-910e9fda5fd8}\Shell\AutoRun\command - "" = F:\nemoj\\meni.exe
O33 - MountPoints2\{a29fadc1-4924-11df-9f03-910e9fda5fd8}\Shell\explore\command - "" = F:\nemoj\\\meni.exe
O33 - MountPoints2\{a29fadc1-4924-11df-9f03-910e9fda5fd8}\Shell\open\command - "" = F:\nemoj\\\meni.exe
@Alternate Data Stream - 176 bytes -> C:\Users\kamen\Documents\kirov_platforma.JPG:3or4kl4x13tuuug3Byamue2s4b
@Alternate Data Stream - 176 bytes -> C:\Users\kamen\Documents\dhl_inv_52404.JPG:3or4kl4x13tuuug3Byamue2s4b
@Alternate Data Stream - 176 bytes -> C:\Users\kamen\Documents\DHL_ tr  order_2010_10_25.JPG:3or4kl4x13tuuug3Byamue2s4b
@Alternate Data Stream - 176 bytes -> C:\Users\kamen\Desktop\unicred_cor.JPG:3or4kl4x13tuuug3Byamue2s4b
@Alternate Data Stream - 164 bytes -> C:\Users\kamen\Documents\pro_44_euromarket.JPG:3or4kl4x13tuuug3Byamue2s4b
@Alternate Data Stream - 164 bytes -> C:\Users\kamen\Documents\price_bucket_retail.JPG:3or4kl4x13tuuug3Byamue2s4b
@Alternate Data Stream - 164 bytes -> C:\Users\kamen\Documents\inv_128_inovex_serv_A.JPG:3or4kl4x13tuuug3Byamue2s4b
@Alternate Data Stream - 164 bytes -> C:\Users\kamen\Documents\dhl_inv_5500kg.JPG:3or4kl4x13tuuug3Byamue2s4b

:Reg

:files

autorun.inf /alldrives
autorun.exe /alldrives
recycler /alldrives
ipconfig /flushdns /c

:Commands
[purity]
[emptytemp]
[resethosts]
[clearallrestorepoints]
[emptyflash]
[Reboot]

След като въведете скрипта от цитата по-горе натиснете бутона, маркиран в червено: Run Fix

Windows ще се рестартира и ще се създаде лог файл. Публикувайте съдържанието му с Copy/Paste в следващия си коментар.

Да оставя стандартните настройки, или да ги променя както в по-предният Ви пост?

Нищо не променяте по настройките..!

Уиндос не успя да се рестартира, зависва по някое време като изписва, че ОТЛ не отговаря. След рестарт /традиционен - ръчно/ в Нотпад се отваря следното: Files\Folders moved on Reboot... C:\Users\kamen\AppData\Local\Temp\~DF8A3D.tmp moved successfully. C:\Users\kamen\AppData\Local\Temp\~DF8A4B.tmp moved successfully. C:\Users\kamen\AppData\Local\Temp\~DF8AA3.tmp moved successfully. C:\Users\kamen\AppData\Local\Temp\~DF8AB2.tmp moved successfully. C:\Users\kamen\AppData\Local\Temp\~DF8AFA.tmp moved successfully. C:\Users\kamen\AppData\Local\Temp\~DF8B06.tmp moved successfully. C:\Users\kamen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LY5LH7F0\ads[1].htm moved successfully. C:\Users\kamen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LY5LH7F0\fastbutton[1].htm moved successfully. C:\Users\kamen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LY5LH7F0\index[1].htm moved successfully. C:\Users\kamen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LY5LH7F0\like[1].htm moved successfully. C:\Users\kamen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LY5LH7F0\login_status[1].htm moved successfully. C:\Users\kamen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K99AZ50W\kaldata_com[2].htm moved successfully. C:\Users\kamen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K99AZ50W\recommendations[2].htm moved successfully. C:\Users\kamen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\A2Y4NY41\fb_iframe[1].html moved successfully. C:\Users\kamen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9NS45LWX\fastbuttonCA7V9C6B.htm moved successfully. C:\Users\kamen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9NS45LWX\likebox[7].htm moved successfully. C:\Users\kamen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9NS45LWX\login_status[2].htm moved successfully. C:\Users\kamen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\63MR0SCR\login_status[4].htm moved successfully. C:\Users\kamen\AppData\Local\Microsoft\Windows\Temporary Internet Files\AntiPhishing\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat moved successfully. Registry entries deleted on Reboot...

За съжаление при вас май нищо не тръгва нормално....

Проверете в С:\_OTL,

Трябва да има един лог файл с име - дата и час на създаване, който пасват с това време когато сте стартирали OTL.Този файл копирайте (съдържанието му) в следващия си пост...!

Изтеглете Malwarebytes' Anti-Malware или от тук

* Кликнете два пъти върху mbam-setup.exe, за да инсталирате програмата.

* Уверете се, че са поставени отметки на Update Malwarebytes' Anti-Malware и Launch Malwarebytes' Anti-Malware. След това кликнете на Finish.

* Ако има намерени обновявания, тя ще ги изтегли и инсталира.

* Стартирайте програмата и изберете "Perform Full Scan", след това кликнете на Scan.

* Сканирането ще отнеме малко време, затова моля да бъдете търпеливи.

* Когато сканирането завърши, кликнете на OK, след това Show Results, за да видите резултата.

* Уверете се, че на всички редове има отметки, и кликнете на Remove Selected.

* Когато всичко бъде премахнато, в Notepad ще бъде отворен лог. Копирайте този лог и го публикувайте в следващия си коментар по темата.

Забележка: Ако MalwareBytes' Anti-Malware се затрудни в премахването на откритите вируси/заплахи, той ще поиска да рестартира компютъра Ви и по време на рестартирането да премахне проблемните вируси/заплахи. Ако бъдете попитани, потвърдете че желаете вашия компютър да бъде рестартиран.

има два лог файла - стартирал съм го два пъти, като и двата пъти е свършило с хард ресет: Files\Folders moved on Reboot... File move failed. E:\Autorun.inf scheduled to be moved on reboot. File\Folder C:\Users\kamen\AppData\Local\Temp\~DF242C.tmp not found! File\Folder C:\Users\kamen\AppData\Local\Temp\~DF243A.tmp not found! File\Folder C:\Users\kamen\AppData\Local\Temp\~DF249A.tmp not found! File\Folder C:\Users\kamen\AppData\Local\Temp\~DF24D2.tmp not found! File\Folder C:\Users\kamen\AppData\Local\Temp\~DF2529.tmp not found! File\Folder C:\Users\kamen\AppData\Local\Temp\~DF253B.tmp not found! C:\Users\kamen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K99AZ50W\index[4].htm moved successfully. Registry entries deleted on Reboot... Files\Folders moved on Reboot... C:\Users\kamen\AppData\Local\Temp\~DF8A3D.tmp moved successfully. C:\Users\kamen\AppData\Local\Temp\~DF8A4B.tmp moved successfully. C:\Users\kamen\AppData\Local\Temp\~DF8AA3.tmp moved successfully. C:\Users\kamen\AppData\Local\Temp\~DF8AB2.tmp moved successfully. C:\Users\kamen\AppData\Local\Temp\~DF8AFA.tmp moved successfully. C:\Users\kamen\AppData\Local\Temp\~DF8B06.tmp moved successfully. C:\Users\kamen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LY5LH7F0\ads[1].htm moved successfully. C:\Users\kamen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LY5LH7F0\fastbutton[1].htm moved successfully. C:\Users\kamen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LY5LH7F0\index[1].htm moved successfully. C:\Users\kamen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LY5LH7F0\like[1].htm moved successfully. C:\Users\kamen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LY5LH7F0\login_status[1].htm moved successfully. C:\Users\kamen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K99AZ50W\kaldata_com[2].htm moved successfully. C:\Users\kamen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K99AZ50W\recommendations[2].htm moved successfully. C:\Users\kamen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\A2Y4NY41\fb_iframe[1].html moved successfully. C:\Users\kamen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9NS45LWX\fastbuttonCA7V9C6B.htm moved successfully. C:\Users\kamen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9NS45LWX\likebox[7].htm moved successfully. C:\Users\kamen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9NS45LWX\login_status[2].htm moved successfully. C:\Users\kamen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\63MR0SCR\login_status[4].htm moved successfully. C:\Users\kamen\AppData\Local\Microsoft\Windows\Temporary Internet Files\AntiPhishing\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat moved successfully. Registry entries deleted on Reboot...

Редактирано 8 ноември 201114 г. от kamkal (преглед на промените)

Malwarebytes' Anti-Malware 1.51.2.1300

www.malwarebytes.org

Database version: 8113

Windows 6.0.6002 Service Pack 2

Internet Explorer 8.0.6001.19048

08.11.2011 г. 16:23:41

mbam-log-2011-11-08 (16-23-41).txt

Scan type: Quick scan

Objects scanned: 176484

Time elapsed: 10 minute(s), 32 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

• Изтеглете и го запазете на вашия десктоп.
• Стартирайте програмата и изберете 2. Натиснете Enter
• Ще се появи лог файл с името RKreport[1].txt на вашия десктоп.
• Копирайте съдържанието му в следващия си пост.

• Изтеглете GooredFix, миръри: тук и тук. Запазете го на десктопа.
• Затворете всички браузъри и стартирайте GooredFix.exe (десен клик Run As Administrator). Потвърдете с Yes, за да започне сканирането.
• GooredFix ще провери за инфекции и след това ще се появи лог (GooredFix.txt). Копирайте (Copy) и поставете (Paste) резултатите от сканирането в следващия си коментар.

Стартирайте отново OTL и направете сканиране със същите настройки ...Този път обаче вместо Run Fix натиснете бутона ...Ще се създаде лог файл. Публикувайте съдържанието му с Copy/Paste в следващия си коментар.

RogueKiller V6.1.7 [11/05/2011] by Tigzy

mail: tigzyRK<at>gmail<dot>com

Feedback: http://www.geekstogo.com/forum/files/file/413-roguekiller/

Blog: http://tigzyrk.blogspot.com

Operating System: Windows Vista (6.0.6002 Service Pack 2) 32 bits version

Started in : Normal mode

User: kamen [Admin rights]

Mode: Remove -- Date : 11/08/2011 17:07:25

¤¤¤ Bad processes: 0 ¤¤¤

¤¤¤ Registry Entries: 3 ¤¤¤

[HJ] HKLM\[...]\System : EnableLUA (0) -> REPLACED ()

[HJ] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REPLACED ()

[HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED ()

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver: [LOADED] ¤¤¤

¤¤¤ Infection : ¤¤¤

¤¤¤ HOSTS File: ¤¤¤

127.0.0.1 localhost

::1 localhost

Finished : << RKreport[1].txt >>

RKreport[1].txt

Хубаво....!Очаквам дневници от другите две програмки....!

GooredFix by jpshortstuff (03.07.10.1)

Log created at 17:16 on 08/11/2011 (kamen)

Firefox version 7.0.1 (en-US)

========== GooredScan ==========

========== GooredLog ==========

C:\Program Files\Mozilla Firefox\extensions\

{800b5000-a755-47e1-992b-48a1c1357f07} [19:48 08/07/2009]

{972ce4c6-7e08-4474-a285-3208198ce6fd} [19:23 24/07/2008]

{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA} [06:09 24/11/2008]

{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} [08:32 19/03/2009]

{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} [07:35 21/02/2011]

{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} [08:14 12/03/2011]

{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} [07:14 11/06/2011]

C:\Users\kamen\Application Data\Mozilla\Firefox\Profiles\og3888sg.default\extensions\

[email protected] [18:11 10/05/2011]

[email protected] [18:11 10/05/2011]

{20a82645-c095-46ed-80e3-08825760534b} [04:50 17/05/2010]

{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3} [18:49 28/09/2011]

{800b5000-a755-47e1-992b-48a1c1357f07} [18:50 28/09/2011]

{987311C6-B504-4aa2-90BF-60CC49808D42} [13:18 24/01/2010]

{9A752782-D706-479b-98F8-3F66BF921692} [08:17 19/10/2011]

[HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions]

"{20a82645-c095-46ed-80e3-08825760534b}"="c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\" [14:21 26/02/2009]

"{A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}"="C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\" [19:04 24/07/2011]

-=E.O.F=-

Супер..!Сега и OTL ,да видим аджеба какво сме направили и какво е останало и защо не показа един читав дневник..!

OTL logfile created on: 08.11.2011 г. 17:19:07 - Run 2

OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\kamen\Desktop

Windows Vista Business Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.19048)

Locale: 00000402 | Country: Bulgaria | Language: BGR | Date Format: dd.MM.yyyy 'г.'

1.99 Gb Total Physical Memory | 0.93 Gb Available Physical Memory | 46.91% Memory free

4.22 Gb Paging File | 2.79 Gb Available in Paging File | 66.26% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 140.26 Gb Total Space | 55.98 Gb Free Space | 39.91% Space Free | Partition Type: NTFS

Drive E: | 8.79 Gb Total Space | 1.09 Gb Free Space | 12.46% Space Free | Partition Type: NTFS

Computer Name: KAMEN-PC | User Name: kamen | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011.11.07 23:04:14 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\kamen\Desktop\OTL.exe

PRC - [2011.08.02 09:33:30 | 004,910,912 | ---- | M] (DT Soft Ltd) -- C:\Program Files\DAEMON Tools Lite\DTLite.exe

PRC - [2011.07.19 04:47:56 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe

PRC - [2011.06.14 16:42:26 | 001,540,096 | ---- | M] (Nokia) -- C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe

PRC - [2011.05.05 08:01:57 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe

PRC - [2011.04.08 11:59:52 | 000,507,624 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Common Files\Java\Java Update\jucheck.exe

PRC - [2011.03.16 22:12:10 | 001,045,256 | ---- | M] (Acresso Software Inc.) -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

PRC - [2010.08.02 16:09:56 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

PRC - [2010.01.14 22:11:02 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

PRC - [2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe

PRC - [2009.04.11 08:27:28 | 000,069,120 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\conime.exe

PRC - [2008.03.18 15:27:12 | 000,013,312 | ---- | M] (Agere Systems) -- C:\WINDOWS\System32\agrsmsvc.exe

PRC - [2008.01.11 19:54:31 | 000,623,992 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe

PRC - [2008.01.11 17:50:16 | 000,030,312 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe

PRC - [2007.09.15 02:29:10 | 000,102,400 | ---- | M] (Synaptics, Inc.) -- C:\Program Files\Synaptics\SynTP\SynTPStart.exe

PRC - [2007.07.23 09:14:16 | 001,994,800 | ---- | M] (FlashGet.com) -- C:\Program Files\FlashGet\flashget.exe

PRC - [2007.05.08 17:38:46 | 000,540,448 | ---- | M] (PDF Complete Inc) -- C:\Program Files\PDF Complete\pdfsvc.exe

PRC - [2007.05.08 17:38:44 | 000,331,552 | ---- | M] (PDF Complete Inc) -- C:\Program Files\PDF Complete\pdfsty.exe

PRC - [2007.03.10 01:24:12 | 000,715,912 | ---- | M] () -- C:\WINDOWS\SMINST\Scheduler.exe

PRC - [2007.02.07 03:30:00 | 000,065,536 | R--- | M] (Cognizance Corporation) -- C:\Program Files\Hewlett-Packard\IAM\Bin\asghost.exe

PRC - [2007.02.06 10:44:24 | 000,069,632 | ---- | M] (Andrea Electronics Corporation) -- C:\WINDOWS\System32\AEADISRV.EXE

PRC - [2007.01.10 00:52:36 | 000,145,184 | ---- | M] (Hewlett-Packard Development Company, L.P.) -- C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\pthosttr.exe

PRC - [2006.11.03 11:01:16 | 000,319,488 | ---- | M] (PixArt Imaging Incorporation) -- C:\WINDOWS\PixArt\Pac207\Monitor.exe

PRC - [2006.01.05 12:34:56 | 000,061,440 | ---- | M] (Siemens AG) -- C:\Program Files\Siemens\Card API\bin\siecacst.exe

========== Modules (No Company Name) ==========

MOD - [2007.09.13 22:11:18 | 000,249,856 | ---- | M] () -- C:\WINDOWS\System32\igfxTMM.dll

MOD - [2007.06.15 08:35:38 | 000,626,688 | ---- | M] () -- C:\Program Files\FlashGet\FGBTCORE.dll

MOD - [2007.06.14 12:52:06 | 001,327,184 | ---- | M] () -- C:\Program Files\FlashGet\FGEMCORE.dll

MOD - [2007.05.22 09:59:22 | 000,128,512 | ---- | M] () -- C:\Program Files\WinRAR\RarExt.dll

MOD - [2007.03.10 01:24:12 | 000,715,912 | ---- | M] () -- C:\WINDOWS\SMINST\Scheduler.exe

MOD - [2007.02.17 02:40:42 | 005,521,408 | ---- | M] () -- C:\Program Files\Common Files\LightScribe\QtGui4.dll

MOD - [2007.02.17 02:40:40 | 001,466,368 | ---- | M] () -- C:\Program Files\Common Files\LightScribe\QtCore4.dll

MOD - [2007.02.16 00:37:00 | 000,446,464 | ---- | M] () -- C:\WINDOWS\SMINST\naspp.dll

========== Win32 Services (SafeList) ==========

SRV - [2011.07.19 04:47:56 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2011.06.08 12:02:00 | 000,633,856 | ---- | M] (Nokia) [On_Demand | Stopped] -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)

SRV - [2011.05.05 08:01:57 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2011.03.16 22:12:10 | 001,045,256 | ---- | M] (Acresso Software Inc.) [On_Demand | Running] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)

SRV - [2008.10.16 19:12:28 | 000,217,088 | ---- | M] (Hewlett-Packard Co.) [On_Demand | Running] -- C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqcxs08.dll -- (hpqcxs08)

SRV - [2008.03.25 20:27:36 | 000,135,168 | ---- | M] (Hewlett-Packard Co.) [Auto | Running] -- C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqddsvc.dll -- (hpqddsvc)

SRV - [2008.03.18 15:27:12 | 000,013,312 | ---- | M] (Agere Systems) [Auto | Running] -- C:\WINDOWS\System32\agrsmsvc.exe -- (AgereModemAudio)

SRV - [2008.01.19 09:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)

SRV - [2008.01.11 17:50:16 | 000,030,312 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe -- (BcmSqlStartupSvc)

SRV - [2008.01.05 11:01:39 | 000,079,360 | ---- | M] (SolidWorks) [On_Demand | Stopped] -- C:\Program Files\Common Files\SolidWorks Shared\Service\SolidWorksLicensing.exe -- (SolidWorks Licensing Service)

SRV - [2007.09.03 19:00:29 | 000,085,096 | ---- | M] (Autodesk) [On_Demand | Stopped] -- C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe -- (Autodesk Licensing Service)

SRV - [2007.05.08 17:38:46 | 000,540,448 | ---- | M] (PDF Complete Inc) [Auto | Running] -- C:\Program Files\PDF Complete\pdfsvc.exe -- (pdfcDispatcher)

SRV - [2007.03.05 19:30:06 | 000,110,592 | ---- | M] (Hewlett-Packard Development Company, L.P.) [On_Demand | Stopped] -- C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe -- (Com4Qlb)

SRV - [2007.02.07 03:30:00 | 000,074,240 | R--- | M] (Cognizance Corporation) [Auto | Running] -- C:\Program Files\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll -- (ASBroker)

SRV - [2007.02.06 10:44:24 | 000,069,632 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\WINDOWS\System32\AEADISRV.EXE -- (AEADIFilters)

SRV - [2006.06.22 07:14:00 | 000,131,584 | R--- | M] (Cognizance Corporation) [Auto | Running] -- C:\Program Files\Hewlett-Packard\IAM\Bin\ASChnl.dll -- (ASChannel)

========== Driver Services (SafeList) ==========

DRV - [2011.11.08 17:09:40 | 000,111,872 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\TrueSight.sys -- (TrueSight)

DRV - [2011.08.08 15:38:27 | 000,232,512 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\dtsoftbus01.sys -- (dtsoftbus01)

DRV - [2011.07.19 04:47:58 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\avipbb.sys -- (avipbb)

DRV - [2011.07.19 04:47:58 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\avgntflt.sys -- (avgntflt)

DRV - [2011.05.18 09:12:38 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\usbser_lowerfltj.sys -- (UsbserFilt)

DRV - [2011.05.18 09:12:36 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\usbser_lowerflt.sys -- (upperdev)

DRV - [2011.05.18 09:12:32 | 000,023,168 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\ccdcmbo.sys -- (nmwcdc)

DRV - [2011.05.18 09:12:28 | 000,018,176 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\ccdcmb.sys -- (nmwcd)

DRV - [2010.09.17 23:34:35 | 000,639,224 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\Drivers\sptd.sys -- (sptd)

DRV - [2010.07.09 12:18:56 | 000,020,328 | ---- | M] (Windows ® Win 7 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Program Files\CPUID\PC Wizard 2010\pcwiz_x32.sys -- (cpuz134)

DRV - [2010.06.17 15:27:24 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\ssmdrv.sys -- (ssmdrv)

DRV - [2010.01.29 11:40:04 | 000,082,320 | ---- | M] (EZB Systems, Inc.) [File_System | System | Running] -- C:\Program Files\UltraISO\drivers\ISODrive.sys -- (ISODrive)

DRV - [2009.04.11 06:38:59 | 000,030,208 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\usbccid.sys -- (USBCCID)

DRV - [2009.02.13 12:35:05 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Program Files\Avira\AntiVir Desktop\avgio.sys -- (avgio)

DRV - [2008.11.17 15:40:22 | 003,668,480 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\NETw5v32.sys -- (NETw5v32) Intel®

DRV - [2008.08.26 09:26:12 | 000,018,816 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\pccsmcfd.sys -- (pccsmcfd)

DRV - [2008.08.07 13:42:12 | 000,025,392 | ---- | M] (Hewlett-Packard Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\hpdskflt.sys -- (hpdskflt)

DRV - [2008.08.07 13:31:52 | 000,034,608 | ---- | M] (Hewlett-Packard Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\Accelerometer.sys -- (Accelerometer)

DRV - [2008.03.21 15:13:00 | 001,203,776 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\AGRSM.sys -- (AgereSoftModem)

DRV - [2008.01.19 09:42:12 | 000,045,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\tpm.sys -- (TPM)

DRV - [2007.10.31 18:36:32 | 002,252,800 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\NETw4v32.sys -- (NETw4v32) Intel®

DRV - [2007.07.31 17:45:50 | 000,076,800 | ---- | M] (Prolific Technology Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\ser2pl.sys -- (Ser2pl)

DRV - [2007.04.11 00:55:28 | 000,140,808 | ---- | M] (AuthenTec, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\atswpdrv.sys -- (ATSWPDRV) (****DEBUG****) AuthenTec TruePrint USB Driver (SwipeSensor)

DRV - [2006.12.05 11:34:42 | 000,507,136 | ---- | M] (PixArt Imaging Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\PFC027.SYS -- (PAC207)

DRV - [2006.11.30 20:24:58 | 000,008,192 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\eabfiltr.sys -- (eabfiltr)

DRV - [2006.11.02 10:50:52 | 000,128,104 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\WimFltr.sys -- (WimFltr)

DRV - [2006.11.02 09:36:43 | 002,028,032 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\atikmdag.sys -- (R300)

DRV - [2006.11.02 09:30:54 | 001,781,760 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\NETw3v32.sys -- (NETw3v32) Intel®

DRV - [2006.11.02 09:30:53 | 000,045,056 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\bcm4sbxp.sys -- (bcm4sbxp)

DRV - [2006.06.28 19:54:00 | 000,009,472 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\CPQBttn.sys -- (HBtnKey)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://google.icq.com/search/search_frame.php

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "ICQ Search"

FF - prefs.js..browser.search.defaulturl: "http://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.3.3&q="

FF - prefs.js..browser.search.selectedEngine: "ICQ Search"

FF - prefs.js..browser.search.useDBForOrder: true

FF - prefs.js..browser.startup.homepage: "http://start.icq.com/"

FF - prefs.js..extensions.enabledItems: {987311C6-B504-4aa2-90BF-60CC49808D42}:2.2

FF - prefs.js..extensions.enabledItems: [email protected]:2.23b2

FF - prefs.js..extensions.enabledItems: [email protected]:2.2.7.5

FF - prefs.js..extensions.enabledItems: {9A752782-D706-479b-98F8-3F66BF921692}:7.0.1

FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:1.1.7

FF - prefs.js..extensions.enabledItems: [email protected]:1.0.0.736

FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.1.4

FF - prefs.js..extensions.enabledItems: {A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}:7.3.3.42

FF - prefs.js..extensions.enabledItems: [email protected]:3.2.5.2

FF - prefs.js..extensions.enabledItems: {414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}:2.7.2.0

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24

FF - prefs.js..keyword.URL: "http://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.3.3&q="

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60310.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@pandasecurity.com/activescan: C:\Program Files\Panda Security\ActiveScan 2.0\npwrapper.dll (Panda Security)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@veetle.com/vbp;version=0.9.17: C:\Program Files\Veetle\VLCBroadcast\npvbp.dll File not found

FF - HKLM\Software\MozillaPlugins\@veetle.com/veetleCorePlugin,version=0.9.18: C:\Program Files\Veetle\plugins\npVeetle.dll (Veetle Inc)

FF - HKLM\Software\MozillaPlugins\@veetle.com/veetlePlayerPlugin,version=0.9.18: C:\Program Files\Veetle\Player\npvlc.dll (Veetle Inc)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}: C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\ [2011.07.24 21:04:39 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 7.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.10.06 22:13:33 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 7.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.11.04 11:57:05 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\{CCB7D94B-CA92-4E3F-B79D-ADE0F07ADC74}: C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\ [2011.07.24 21:04:39 | 000,000,000 | ---D | M]

[2008.07.24 21:24:07 | 000,000,000 | ---D | M] (No name found) -- C:\Users\kamen\AppData\Roaming\Mozilla\Extensions

[2011.10.19 10:17:03 | 000,000,000 | ---D | M] (No name found) -- C:\Users\kamen\AppData\Roaming\Mozilla\Firefox\Profiles\og3888sg.default\extensions

[2010.05.17 06:50:27 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\kamen\AppData\Roaming\Mozilla\Firefox\Profiles\og3888sg.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}

[2011.09.28 20:50:04 | 000,000,000 | ---D | M] (Softonic-Eng7 Community Toolbar) -- C:\Users\kamen\AppData\Roaming\Mozilla\Firefox\Profiles\og3888sg.default\extensions\{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}

[2011.09.28 20:50:26 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Users\kamen\AppData\Roaming\Mozilla\Firefox\Profiles\og3888sg.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}

[2010.01.24 15:18:49 | 000,000,000 | ---D | M] (BugMeNot) -- C:\Users\kamen\AppData\Roaming\Mozilla\Firefox\Profiles\og3888sg.default\extensions\{987311C6-B504-4aa2-90BF-60CC49808D42}

[2011.10.19 10:17:03 | 000,000,000 | ---D | M] (Liquid Information) -- C:\Users\kamen\AppData\Roaming\Mozilla\Firefox\Profiles\og3888sg.default\extensions\{9A752782-D706-479b-98F8-3F66BF921692}

[2011.05.10 20:11:47 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Users\kamen\AppData\Roaming\Mozilla\Firefox\Profiles\og3888sg.default\extensions\[email protected]

[2011.05.10 20:11:59 | 000,000,000 | ---D | M] (Fast Dial) -- C:\Users\kamen\AppData\Roaming\Mozilla\Firefox\Profiles\og3888sg.default\extensions\[email protected]

[2010.01.24 15:18:59 | 000,004,440 | ---- | M] () -- C:\Users\kamen\AppData\Roaming\Mozilla\Firefox\Profiles\og3888sg.default\searchplugins\hyperwords.xml

[2011.11.04 16:12:10 | 000,000,950 | ---- | M] () -- C:\Users\kamen\AppData\Roaming\Mozilla\Firefox\Profiles\og3888sg.default\searchplugins\icqplugin-1.xml

[2010.03.25 08:55:20 | 000,000,950 | ---- | M] () -- C:\Users\kamen\AppData\Roaming\Mozilla\Firefox\Profiles\og3888sg.default\searchplugins\icqplugin-10.xml

[2010.04.04 14:59:34 | 000,000,950 | ---- | M] () -- C:\Users\kamen\AppData\Roaming\Mozilla\Firefox\Profiles\og3888sg.default\searchplugins\icqplugin-11.xml

[2010.07.18 22:13:40 | 000,000,950 | ---- | M] () -- C:\Users\kamen\AppData\Roaming\Mozilla\Firefox\Profiles\og3888sg.default\searchplugins\icqplugin-12.xml

[2010.08.14 05:04:03 | 000,000,950 | ---- | M] () -- C:\Users\kamen\AppData\Roaming\Mozilla\Firefox\Profiles\og3888sg.default\searchplugins\icqplugin-13.xml

[2010.09.20 21:47:28 | 000,000,950 | ---- | M] () -- C:\Users\kamen\AppData\Roaming\Mozilla\Firefox\Profiles\og3888sg.default\searchplugins\icqplugin-14.xml

[2010.10.22 21:57:21 | 000,000,950 | ---- | M] () -- C:\Users\kamen\AppData\Roaming\Mozilla\Firefox\Profiles\og3888sg.default\searchplugins\icqplugin-15.xml

[2010.11.03 22:29:32 | 000,000,950 | ---- | M] () -- C:\Users\kamen\AppData\Roaming\Mozilla\Firefox\Profiles\og3888sg.default\searchplugins\icqplugin-16.xml

[2010.12.16 21:54:32 | 000,000,950 | ---- | M] () -- C:\Users\kamen\AppData\Roaming\Mozilla\Firefox\Profiles\og3888sg.default\searchplugins\icqplugin-17.xml

[2011.03.07 00:05:30 | 000,000,950 | ---- | M] () -- C:\Users\kamen\AppData\Roaming\Mozilla\Firefox\Profiles\og3888sg.default\searchplugins\icqplugin-18.xml

[2011.03.27 21:20:10 | 000,000,950 | ---- | M] () -- C:\Users\kamen\AppData\Roaming\Mozilla\Firefox\Profiles\og3888sg.default\searchplugins\icqplugin-19.xml

[2009.08.30 13:38:50 | 000,000,950 | ---- | M] () -- C:\Users\kamen\AppData\Roaming\Mozilla\Firefox\Profiles\og3888sg.default\searchplugins\icqplugin-2.xml

[2011.05.01 20:49:50 | 000,000,950 | ---- | M] () -- C:\Users\kamen\AppData\Roaming\Mozilla\Firefox\Profiles\og3888sg.default\searchplugins\icqplugin-20.xml

[2011.05.08 12:03:21 | 000,000,950 | ---- | M] () -- C:\Users\kamen\AppData\Roaming\Mozilla\Firefox\Profiles\og3888sg.default\searchplugins\icqplugin-21.xml

[2011.09.29 19:19:31 | 000,000,950 | ---- | M] () -- C:\Users\kamen\AppData\Roaming\Mozilla\Firefox\Profiles\og3888sg.default\searchplugins\icqplugin-22.xml

[2011.10.06 22:14:34 | 000,000,950 | ---- | M] () -- C:\Users\kamen\AppData\Roaming\Mozilla\Firefox\Profiles\og3888sg.default\searchplugins\icqplugin-23.xml

[2009.09.10 00:17:43 | 000,000,950 | ---- | M] () -- C:\Users\kamen\AppData\Roaming\Mozilla\Firefox\Profiles\og3888sg.default\searchplugins\icqplugin-3.xml

[2009.10.30 12:05:22 | 000,000,950 | ---- | M] () -- C:\Users\kamen\AppData\Roaming\Mozilla\Firefox\Profiles\og3888sg.default\searchplugins\icqplugin-4.xml

[2009.11.28 18:42:58 | 000,000,950 | ---- | M] () -- C:\Users\kamen\AppData\Roaming\Mozilla\Firefox\Profiles\og3888sg.default\searchplugins\icqplugin-5.xml

[2010.01.24 15:06:10 | 000,000,950 | ---- | M] () -- C:\Users\kamen\AppData\Roaming\Mozilla\Firefox\Profiles\og3888sg.default\searchplugins\icqplugin-6.xml

[2010.01.29 20:05:48 | 000,000,961 | ---- | M] () -- C:\Users\kamen\AppData\Roaming\Mozilla\Firefox\Profiles\og3888sg.default\searchplugins\icqplugin-7.xml

[2010.02.21 14:23:34 | 000,000,961 | ---- | M] () -- C:\Users\kamen\AppData\Roaming\Mozilla\Firefox\Profiles\og3888sg.default\searchplugins\icqplugin-8.xml

[2010.03.12 17:04:26 | 000,000,950 | ---- | M] () -- C:\Users\kamen\AppData\Roaming\Mozilla\Firefox\Profiles\og3888sg.default\searchplugins\icqplugin-9.xml

[2011.09.25 16:27:46 | 000,000,168 | ---- | M] () -- C:\Users\kamen\AppData\Roaming\Mozilla\Firefox\Profiles\og3888sg.default\searchplugins\icqplugin.gif

[2011.09.25 16:27:46 | 000,000,618 | ---- | M] () -- C:\Users\kamen\AppData\Roaming\Mozilla\Firefox\Profiles\og3888sg.default\searchplugins\icqplugin.src

[2009.07.25 17:56:37 | 000,000,944 | ---- | M] () -- C:\Users\kamen\AppData\Roaming\Mozilla\Firefox\Profiles\og3888sg.default\searchplugins\icqplugin.xml

[2011.06.11 09:14:28 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions

[2009.07.08 21:48:43 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Program Files\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}

[2011.02.21 09:35:22 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}

[2011.03.12 10:14:08 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}

[2011.06.11 09:14:28 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}

() (No name found) -- C:\USERS\KAMEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\OG3888SG.DEFAULT\EXTENSIONS\[email protected]

[2011.10.06 22:13:33 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll

[2011.05.04 03:52:23 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll

[2011.09.29 19:09:00 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)

CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}sourceid=chrome&ie={inputEncoding}&q={searchTerms}

CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms}

CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\google\chrome\application\11.0.696.60\pdf.dll

CHR - plugin: Google Gears 0.5.33.0 (Enabled) = C:\Program Files\google\chrome\application\11.0.696.60\gears.dll

CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\google\chrome\application\11.0.696.60\gcswf32.dll

CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 8.0\Reader\Browser\nppdf32.dll

CHR - plugin: Java Platform SE 6 U13 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll

CHR - plugin: Java Platform SE 6 U13 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npdeploytk.dll

CHR - plugin: Microsoft Office 2003 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\NPOFFICE.DLL

CHR - plugin: RealPlayer G2 LiveConnect-Enabled Plug-In (32-bit) (Enabled) = C:\Program Files\Mozilla Firefox\plugins\nppl3260.dll

CHR - plugin: RealJukebox NS Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\nprjplug.dll

CHR - plugin: RealPlayer Version Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\nprpjplug.dll

CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.2.183.39\npGoogleOneClick8.dll

CHR - plugin: Panda ActiveScan 2.0 (Enabled) = C:\Program Files\Panda Security\ActiveScan 2.0\npwrapper.dll

CHR - plugin: Veetle TV Player (Enabled) = C:\Program Files\Veetle\Player\npvlc.dll

CHR - plugin: Veetle Broadcaster Plugin (Enabled) = C:\Program Files\Veetle\VLCBroadcast\npvbp.dll

CHR - plugin: Veetle TV Core (Enabled) = C:\Program Files\Veetle\plugins\npVeetle.dll

CHR - plugin: RealPlayer HTML5VideoShim Plug-In (32-bit) (Enabled) = C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll

CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll

CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\3.0.50106.0\npctrl.dll

CHR - plugin: Windows Presentation Foundation (Enabled) = c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll

CHR - plugin: Default Plug-in (Enabled) = default_plugin

CHR - Extension: Entanglement = C:\Users\kamen\AppData\Local\Google\Chrome\User Data\Default\Extensions\aciahcmjmecflokailenpkdchphgkefd\2.1.1_0\

CHR - Extension: RealPlayer HTML5Video Downloader Extension = C:\Users\kamen\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk\1.1\

CHR - Extension: Poppit = C:\Users\kamen\AppData\Local\Google\Chrome\User Data\Default\Extensions\mcbkbpnkkkipelfledbfocopglifcfmi\2.2_0\

O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\WINDOWS\System32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1 localhost

O1 - Hosts: ::1 localhost

O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)

O2 - BHO: (FGCatchUrl) - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll (www.flashget.com)

O2 - BHO: (BitComet Helper) - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dll (BitComet)

O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O2 - BHO: (Credential Manager for HP ProtectTools) - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - C:\Program Files\Hewlett-Packard\IAM\Bin\ItIEAddIn.dll (Bioscrypt Inc.)

O2 - BHO: (FlashGet GetFlash Class) - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll (www.flashget.com)

O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {30F9B915-B755-4826-820B-08FBA6BD249D} - No CLSID value found.

O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {414B6D9D-4A95-4E8D-B5B1-149DD2D93BB3} - No CLSID value found.

O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

O4 - HKLM..\Run: [CognizanceTS] C:\Program Files\Hewlett-Packard\IAM\Bin\ASTSVCC.dll (Cognizance Corporation)

O4 - HKLM..\Run: [HP Health Check Scheduler] C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe (Hewlett-Packard)

O4 - HKLM..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe File not found

O4 - HKLM..\Run: [Monitor] C:\WINDOWS\PixArt\Pac207\Monitor.exe (PixArt Imaging Incorporation)

O4 - HKLM..\Run: [NokiaMServer] C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe (Nokia)

O4 - HKLM..\Run: [PDF Complete] C:\Program Files\PDF Complete\pdfsty.exe (PDF Complete Inc)

O4 - HKLM..\Run: [PTHOSTTR] C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE (Hewlett-Packard Development Company, L.P.)

O4 - HKLM..\Run: [synTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe (Synaptics, Inc.)

O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)

O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)

O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)

O4 - HKLM..\RunOnce: [sT Recovery Launcher] C:\WINDOWS\SMINST\Launcher.exe (soft thinks)

O8 - Extra context menu item: &D&ownload &with BitComet - C:\Program Files\BitComet\BitComet.exe (www.BitComet.com)

O8 - Extra context menu item: &D&ownload all video with BitComet - C:\Program Files\BitComet\BitComet.exe (www.BitComet.com)

O8 - Extra context menu item: &D&ownload all with BitComet - C:\Program Files\BitComet\BitComet.exe (www.BitComet.com)

O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\JC_ALL.HTM ()

O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\JC_LINK.HTM ()

O8 - Extra context menu item: Append to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Convert link target to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Convert link target to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Convert selected links to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Convert selected links to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Convert selection to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Convert selection to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Convert to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Google Sidewiki... - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll (Google Inc.)

O9 - Extra Button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dll (BitComet)

O9 - Extra Button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\flashget.exe (FlashGet.com)

O9 - Extra 'Tools' menuitem : FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\flashget.exe (FlashGet.com)

O9 - Extra Button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe (ICQ, LLC.)

O9 - Extra 'Tools' menuitem : ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe (ICQ, LLC.)

O13 - gopher Prefix: missing

O15 - HKCU\..Trusted Domains: bulbank.bg ([online] https in Trusted sites)

O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)

O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{3BBF0D1C-C84A-4C76-900D-40F11DC9E0A4}: DhcpNameServer = 192.168.1.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{55FF9C82-D159-4F27-8E2F-355A8D3DD630}: NameServer = 208.67.220.220

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FA8A5F8B-CE2A-4CDC-864B-D64D8BB40B6B}: DhcpNameServer = 192.168.1.1

O20 - AppInit_DLLs: (APSHook.dll) -C:\Windows\System32\APSHook.dll (Bioscrypt Inc.)

O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\WINDOWS\System32\userinit.exe (Microsoft Corporation)

O24 - Desktop WallPaper: C:\util\wallpapers\wallpaper_michael_wc.jpg

O24 - Desktop BackupWallPaper: C:\util\wallpapers\wallpaper_michael_wc.jpg

O32 - HKLM CDRom: AutoRun - 1

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011.11.08 17:16:04 | 000,000,000 | ---D | C] -- C:\Users\kamen\Desktop\GooredFix Backups

[2011.11.08 17:12:32 | 000,071,398 | ---- | C] (jpshortstuff) -- C:\Users\kamen\Desktop\GooredFix.exe

[2011.11.08 17:06:56 | 000,000,000 | ---D | C] -- C:\Users\kamen\Desktop\RK_Quarantine

[2011.11.08 16:12:09 | 000,000,000 | ---D | C] -- C:\Users\kamen\AppData\Roaming\Malwarebytes

[2011.11.08 16:11:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2011.11.08 16:11:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2011.11.08 16:11:50 | 000,022,216 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys

[2011.11.08 16:11:50 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware

[2011.11.08 16:10:25 | 009,851,496 | ---- | C] (Malwarebytes Corporation ) -- C:\Users\kamen\Desktop\mbam-setup.exe

[2011.11.08 12:51:15 | 000,000,000 | ---D | C] -- C:\_OTL

[2011.11.07 23:04:14 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\kamen\Desktop\OTL.exe

[2011.11.07 22:47:14 | 000,492,146 | R--- | C] (Swearware) -- C:\Users\kamen\Desktop\dds.exe

[2011.11.07 11:51:35 | 000,000,000 | ---D | C] -- C:\Users\kamen\Desktop\svetlio

[2011.11.06 10:49:28 | 000,000,000 | ---D | C] -- C:\Program Files\ESET

[2011.10.30 07:52:52 | 000,114,176 | ---- | C] (CPUID) -- C:\Windows\System32\PCWizard.cpl

[2011.10.30 07:52:52 | 000,000,000 | ---D | C] -- C:\Windows\Java

[2011.10.30 07:52:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CPUID

[2011.10.30 07:52:47 | 000,000,000 | ---D | C] -- C:\Program Files\CPUID

[2011.10.27 09:48:23 | 000,000,000 | ---D | C] -- C:\Users\kamen\Desktop\dan_dekl

[2011.10.23 17:04:14 | 000,000,000 | ---D | C] -- C:\Users\kamen\Desktop\cbg

========== Files - Modified Within 30 Days ==========

[2011.11.08 17:12:32 | 000,071,398 | ---- | M] (jpshortstuff) -- C:\Users\kamen\Desktop\GooredFix.exe

[2011.11.08 17:09:40 | 000,111,872 | ---- | M] () -- C:\Windows\System32\drivers\TrueSight.sys

[2011.11.08 17:05:44 | 000,744,448 | ---- | M] () -- C:\Users\kamen\Desktop\RogueKiller.exe

[2011.11.08 16:54:03 | 000,000,984 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2011.11.08 16:12:09 | 000,003,296 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

[2011.11.08 16:12:09 | 000,003,296 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

[2011.11.08 16:11:58 | 000,000,906 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk

[2011.11.08 16:10:25 | 009,851,496 | ---- | M] (Malwarebytes Corporation ) -- C:\Users\kamen\Desktop\mbam-setup.exe

[2011.11.08 15:59:38 | 000,145,688 | ---- | M] () -- C:\Users\kamen\Desktop\BOGNER_2011_11_08.pdf

[2011.11.08 15:18:23 | 000,178,438 | ---- | M] () -- C:\Users\kamen\Desktop\BSE_2011_11_08.pdf

[2011.11.08 14:12:39 | 000,000,980 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2011.11.08 14:12:18 | 000,065,536 | ---- | M] () -- C:\Windows\System32\Ikeext.etl

[2011.11.08 14:12:02 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2011.11.08 12:05:55 | 002,377,403 | ---- | M] () -- C:\Users\kamen\Desktop\P1000469.JPG

[2011.11.08 10:30:34 | 000,002,377 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk

[2011.11.08 10:30:27 | 000,067,382 | ---- | M] () -- C:\Users\kamen\Desktop\htl35_1800_zaxis330.pdf

[2011.11.08 10:09:41 | 000,002,633 | ---- | M] () -- C:\Users\kamen\Desktop\Microsoft Office Outlook 2007.lnk

[2011.11.08 10:06:31 | 000,029,231 | ---- | M] () -- C:\Users\kamen\Documents\pro_173_agritrade.pdf

[2011.11.08 10:04:20 | 000,000,041 | ---- | M] () -- C:\Windows\crw.ini

[2011.11.08 08:51:51 | 000,002,331 | ---- | M] () -- C:\Users\Public\Desktop\SolidWorks 2004.lnk

[2011.11.08 08:50:04 | 000,029,104 | ---- | M] () -- C:\Users\kamen\Documents\inv_825_kirovSMO.pdf

[2011.11.08 07:30:31 | 000,003,204 | ---- | M] () -- C:\Windows\bthservsdp.dat

[2011.11.08 07:29:05 | 000,075,754 | ---- | M] () -- C:\Program Files\SolidWorksswxJRNL.BAK

[2011.11.07 23:04:14 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\kamen\Desktop\OTL.exe

[2011.11.07 22:47:14 | 000,492,146 | R--- | M] (Swearware) -- C:\Users\kamen\Desktop\dds.exe

[2011.11.07 12:26:37 | 000,645,944 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2011.11.07 12:26:36 | 000,124,132 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[2011.11.06 18:00:40 | 000,000,680 | ---- | M] () -- C:\Users\kamen\AppData\Local\d3d9caps.dat

[2011.11.04 12:57:12 | 000,402,229 | ---- | M] () -- C:\Users\kamen\Desktop\unicred_cor.JPG

[2011.11.04 10:45:41 | 000,002,585 | ---- | M] () -- C:\Users\kamen\Desktop\Microsoft Office Excel 2007.lnk

[2011.11.03 06:10:34 | 000,028,953 | ---- | M] () -- C:\Users\kamen\Documents\pro_172_kirovSMO.pdf

[2011.11.02 16:36:08 | 000,028,152 | ---- | M] () -- C:\Users\kamen\Documents\inv_824_prosol.pdf

[2011.11.02 10:49:03 | 000,028,412 | ---- | M] () -- C:\Users\kamen\Documents\inv_823_fiamma.pdf

[2011.11.02 06:18:43 | 000,029,005 | ---- | M] () -- C:\Users\kamen\Documents\inv_820_KBG.pdf

[2011.11.01 12:18:14 | 000,029,378 | ---- | M] () -- C:\Users\kamen\Documents\inv_822_kirovSMO.pdf

[2011.11.01 11:01:34 | 000,028,647 | ---- | M] () -- C:\Users\kamen\Documents\pro_171_euromarket.pdf

[2011.11.01 10:22:53 | 000,028,494 | ---- | M] () -- C:\Users\kamen\Documents\inv_821_fiamma.pdf

[2011.10.30 07:52:53 | 000,000,877 | ---- | M] () -- C:\Users\kamen\Desktop\PC Wizard 2010.lnk

[2011.10.30 07:51:50 | 000,176,640 | ---- | M] () -- C:\Users\kamen\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2011.10.29 12:07:12 | 000,002,627 | ---- | M] () -- C:\Users\kamen\Desktop\Microsoft Office Word 2007.lnk

[2011.10.27 13:48:47 | 000,030,149 | ---- | M] () -- C:\Users\kamen\Documents\inv_819_atlasSERBIA.pdf

[2011.10.27 08:50:33 | 000,029,122 | ---- | M] () -- C:\Users\kamen\Documents\inv_818_euromarket.pdf

[2011.10.26 10:18:49 | 000,029,097 | ---- | M] () -- C:\Users\kamen\Documents\inv_817_promstroi.pdf

[2011.10.26 05:20:29 | 201,703,008 | ---- | M] () -- C:\Windows\MEMORY.DMP

[2011.10.25 17:35:41 | 000,029,097 | ---- | M] () -- C:\Users\kamen\Documents\inv_815_euromarket.pdf

[2011.10.21 14:59:46 | 000,029,061 | ---- | M] () -- C:\Users\kamen\Documents\inv_813_euromarket.pdf

[2011.10.21 14:48:36 | 000,028,766 | ---- | M] () -- C:\Users\kamen\Documents\inv_812_euromarket.pdf

[2011.10.21 14:08:45 | 000,028,937 | ---- | M] () -- C:\Users\kamen\Documents\inv_811_Boianov.pdf

[2011.10.20 11:16:11 | 000,028,738 | ---- | M] () -- C:\Users\kamen\Documents\inv_809_kbg.pdf

[2011.10.20 11:09:49 | 000,028,551 | ---- | M] () -- C:\Users\kamen\Documents\inv_808_Nortrak.pdf

[2011.10.20 10:01:49 | 000,029,060 | ---- | M] () -- C:\Users\kamen\Documents\inv_807_vodstroi.pdf

[2011.10.19 14:50:37 | 000,028,026 | ---- | M] () -- C:\Users\kamen\Documents\inv_806_prosol.pdf

[2011.10.19 07:35:52 | 000,028,145 | ---- | M] () -- C:\Users\kamen\Documents\inv_804_prosol.pdf

[2011.10.18 13:51:41 | 000,028,808 | ---- | M] () -- C:\Users\kamen\Documents\inv_803_euromarket.pdf

[2011.10.17 09:05:10 | 000,028,809 | ---- | M] () -- C:\Users\kamen\Documents\inv_802_emveco.pdf

[2011.10.17 09:01:53 | 000,029,056 | ---- | M] () -- C:\Users\kamen\Documents\inv_801_kirovSMO.pdf

[2011.10.17 08:31:34 | 000,028,273 | ---- | M] () -- C:\Users\kamen\Documents\inv_800_prosol.pdf

[2011.10.16 08:18:41 | 000,029,071 | ---- | M] () -- C:\Users\kamen\Documents\inv_799_promstroi.pdf

[2011.10.13 16:07:25 | 000,028,571 | ---- | M] () -- C:\Users\kamen\Documents\pro_168_emveco.pdf

[2011.10.13 14:34:48 | 000,028,126 | ---- | M] () -- C:\Users\kamen\Documents\pro_167_prosol.pdf

========== Files Created - No Company Name ==========

[2011.11.08 17:07:01 | 000,111,872 | ---- | C] () -- C:\Windows\System32\drivers\TrueSight.sys

[2011.11.08 17:05:44 | 000,744,448 | ---- | C] () -- C:\Users\kamen\Desktop\RogueKiller.exe

[2011.11.08 16:11:58 | 000,000,906 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk

[2011.11.08 15:59:38 | 000,145,688 | ---- | C] () -- C:\Users\kamen\Desktop\BOGNER_2011_11_08.pdf

[2011.11.08 15:18:23 | 000,178,438 | ---- | C] () -- C:\Users\kamen\Desktop\BSE_2011_11_08.pdf

[2011.11.08 12:05:42 | 002,377,403 | ---- | C] () -- C:\Users\kamen\Desktop\P1000469.JPG

[2011.11.08 10:30:27 | 000,067,382 | ---- | C] () -- C:\Users\kamen\Desktop\htl35_1800_zaxis330.pdf

[2011.11.08 10:06:45 | 000,029,231 | ---- | C] () -- C:\Users\kamen\Documents\pro_173_agritrade.pdf

[2011.11.08 08:50:21 | 000,029,104 | ---- | C] () -- C:\Users\kamen\Documents\inv_825_kirovSMO.pdf

[2011.11.04 12:56:47 | 000,402,229 | ---- | C] () -- C:\Users\kamen\Desktop\unicred_cor.JPG

[2011.11.03 06:10:50 | 000,028,953 | ---- | C] () -- C:\Users\kamen\Documents\pro_172_kirovSMO.pdf

[2011.11.02 16:36:25 | 000,028,152 | ---- | C] () -- C:\Users\kamen\Documents\inv_824_prosol.pdf

[2011.11.02 10:49:15 | 000,028,412 | ---- | C] () -- C:\Users\kamen\Documents\inv_823_fiamma.pdf

[2011.11.02 06:18:57 | 000,029,005 | ---- | C] () -- C:\Users\kamen\Documents\inv_820_KBG.pdf

[2011.11.01 12:19:01 | 000,029,378 | ---- | C] () -- C:\Users\kamen\Documents\inv_822_kirovSMO.pdf

[2011.11.01 11:02:20 | 000,028,647 | ---- | C] () -- C:\Users\kamen\Documents\pro_171_euromarket.pdf

[2011.11.01 10:25:12 | 000,028,494 | ---- | C] () -- C:\Users\kamen\Documents\inv_821_fiamma.pdf

[2011.10.30 07:52:53 | 000,000,877 | ---- | C] () -- C:\Users\kamen\Desktop\PC Wizard 2010.lnk

[2011.10.27 13:49:12 | 000,030,149 | ---- | C] () -- C:\Users\kamen\Documents\inv_819_atlasSERBIA.pdf

[2011.10.27 08:50:53 | 000,029,122 | ---- | C] () -- C:\Users\kamen\Documents\inv_818_euromarket.pdf

[2011.10.26 10:19:07 | 000,029,097 | ---- | C] () -- C:\Users\kamen\Documents\inv_817_promstroi.pdf

[2011.10.26 05:20:29 | 201,703,008 | ---- | C] () -- C:\Windows\MEMORY.DMP

[2011.10.25 17:54:31 | 000,029,097 | ---- | C] () -- C:\Users\kamen\Documents\inv_815_euromarket.pdf

[2011.10.21 15:00:05 | 000,029,061 | ---- | C] () -- C:\Users\kamen\Documents\inv_813_euromarket.pdf

[2011.10.21 14:49:09 | 000,028,766 | ---- | C] () -- C:\Users\kamen\Documents\inv_812_euromarket.pdf

[2011.10.21 14:09:25 | 000,028,937 | ---- | C] () -- C:\Users\kamen\Documents\inv_811_Boianov.pdf

[2011.10.20 11:16:25 | 000,028,738 | ---- | C] () -- C:\Users\kamen\Documents\inv_809_kbg.pdf

[2011.10.20 11:10:28 | 000,028,551 | ---- | C] () -- C:\Users\kamen\Documents\inv_808_Nortrak.pdf

[2011.10.20 10:02:05 | 000,029,060 | ---- | C] () -- C:\Users\kamen\Documents\inv_807_vodstroi.pdf

[2011.10.19 14:50:54 | 000,028,026 | ---- | C] () -- C:\Users\kamen\Documents\inv_806_prosol.pdf

[2011.10.19 07:36:05 | 000,028,145 | ---- | C] () -- C:\Users\kamen\Documents\inv_804_prosol.pdf

[2011.10.18 13:51:54 | 000,028,808 | ---- | C] () -- C:\Users\kamen\Documents\inv_803_euromarket.pdf

[2011.10.17 09:05:23 | 000,028,809 | ---- | C] () -- C:\Users\kamen\Documents\inv_802_emveco.pdf

[2011.10.17 09:02:07 | 000,029,056 | ---- | C] () -- C:\Users\kamen\Documents\inv_801_kirovSMO.pdf

[2011.10.17 08:31:50 | 000,028,273 | ---- | C] () -- C:\Users\kamen\Documents\inv_800_prosol.pdf

[2011.10.14 08:22:55 | 000,029,071 | ---- | C] () -- C:\Users\kamen\Documents\inv_799_promstroi.pdf

[2011.10.13 16:07:39 | 000,028,571 | ---- | C] () -- C:\Users\kamen\Documents\pro_168_emveco.pdf

[2011.10.13 14:35:18 | 000,028,126 | ---- | C] () -- C:\Users\kamen\Documents\pro_167_prosol.pdf

[2011.03.20 10:31:39 | 000,017,920 | ---- | C] () -- C:\Windows\System32\implode.dll

[2010.10.12 09:04:27 | 000,142,402 | ---- | C] () -- C:\Windows\hpwins26.dat

[2010.10.12 09:04:27 | 000,000,370 | ---- | C] () -- C:\Windows\hpwmdl26.dat

[2010.10.12 08:44:09 | 000,116,893 | ---- | C] () -- C:\Windows\hpqins00.dat

[2010.10.12 08:22:54 | 000,010,709 | ---- | C] () -- C:\Windows\hpwscr19.dat

[2010.07.02 13:25:32 | 000,000,680 | ---- | C] () -- C:\Users\kamen\AppData\Local\d3d9caps.dat

[2010.03.10 20:34:39 | 000,000,418 | RHS- | C] () -- C:\ProgramData\ntuser.pol

[2009.11.24 13:37:45 | 000,007,445 | ---- | C] () -- C:\ProgramData\N360BUOptions.ini

[2009.10.14 12:09:43 | 000,004,096 | -H-- | C] () -- C:\Users\kamen\AppData\Local\keyfile3.drm

[2009.09.18 07:56:55 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin

[2009.09.18 07:54:00 | 000,062,976 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe

[2009.09.18 07:50:23 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll

[2009.07.22 12:11:17 | 000,000,376 | ---- | C] () -- C:\Windows\ODBC.INI

[2009.05.19 09:02:17 | 000,087,552 | ---- | C] () -- C:\Windows\System32\cpwmon2k.dll

[2009.02.12 23:48:11 | 000,000,141 | ---- | C] () -- C:\Users\kamen\AppData\Roaming\default.rss

[2009.02.12 23:47:47 | 000,000,069 | ---- | C] () -- C:\Windows\NeroDigital.ini

[2008.12.31 11:27:03 | 000,000,056 | -H-- | C] () -- C:\Windows\System32\ezsidmv.dat

[2008.10.16 19:10:33 | 000,000,014 | ---- | C] () -- C:\Windows\System32\SystemInfo32.sys

[2008.10.16 07:25:56 | 000,000,059 | ---- | C] () -- C:\Users\kamen\AppData\Roaming\AVSDVDPlayer.m3u

[2008.10.01 07:41:16 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin

[2008.08.14 21:17:17 | 000,000,039 | ---- | C] () -- C:\Windows\Irremote.ini

[2008.07.25 07:50:31 | 000,028,672 | ---- | C] () -- C:\Windows\System32\siecacsp.dll

[2008.07.24 21:24:09 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat

[2008.06.07 20:38:39 | 000,000,509 | ---- | C] () -- C:\Windows\eReg.dat

[2008.05.09 11:20:23 | 000,000,000 | -H-- | C] () -- C:\Windows\00104run.ini

[2008.04.20 09:03:58 | 000,000,032 | ---- | C] () -- C:\ProgramData\ezsid.dat

[2008.04.11 13:47:20 | 000,003,329 | ---- | C] () -- C:\Users\kamen\AppData\Roaming\contacts_outlook.csv.12148078.xml

[2008.04.11 13:47:19 | 000,000,536 | ---- | C] () -- C:\Users\kamen\AppData\Roaming\BCMMappings.xml

[2007.12.04 10:40:38 | 000,075,754 | ---- | C] () -- C:\Program Files\SolidWorksswxJRNL.BAK

[2007.10.21 18:50:24 | 000,135,553 | ---- | C] () -- C:\Windows\hpwins10.dat

[2007.10.21 18:50:06 | 000,010,399 | ---- | C] () -- C:\Windows\hpwscr10.dat

[2007.10.21 18:50:06 | 000,001,042 | ---- | C] () -- C:\Windows\hpwmdl10.dat

[2007.09.14 23:16:17 | 000,000,041 | ---- | C] () -- C:\Windows\crw.ini

[2007.09.13 22:31:06 | 000,147,456 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1329.dll

[2007.09.13 22:22:46 | 001,238,832 | ---- | C] () -- C:\Windows\System32\igmedkrn.dll

[2007.09.13 22:22:46 | 000,104,636 | ---- | C] () -- C:\Windows\System32\igmedcompkrn.dll

[2007.09.12 17:18:24 | 000,000,000 | ---- | C] () -- C:\Windows\eDrawingOfficeAutomator.INI

[2007.09.09 10:39:17 | 000,000,761 | ---- | C] () -- C:\Windows\m3jp2k.ini

[2007.09.09 10:39:17 | 000,000,714 | ---- | C] () -- C:\Windows\m3jpeg.ini

[2007.09.09 10:39:17 | 000,000,702 | ---- | C] () -- C:\Windows\mmtvmj.ini

[2007.09.09 10:39:15 | 000,019,968 | ---- | C] () -- C:\Windows\System32\cpuinf32.dll

[2007.09.02 11:30:26 | 000,000,000 | ---- | C] () -- C:\Windows\PROTOCOL.INI

[2007.08.31 23:01:57 | 000,639,052 | ---- | C] () -- C:\Windows\System32\BBPDFPortMon.dll

[2007.08.31 17:39:05 | 000,176,640 | ---- | C] () -- C:\Users\kamen\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2007.05.08 12:17:18 | 000,204,800 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1272.dll

[2007.05.08 11:06:38 | 000,249,856 | ---- | C] () -- C:\Windows\System32\igfxTMM.dll

[2006.11.09 23:07:03 | 000,003,204 | ---- | C] () -- C:\Windows\bthservsdp.dat

[2006.11.09 23:06:34 | 000,000,000 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat

[2006.11.02 14:56:48 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat

[2006.11.02 14:47:43 | 000,481,216 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT

[2006.11.02 12:33:01 | 000,645,944 | ---- | C] () -- C:\Windows\System32\perfh009.dat

[2006.11.02 12:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat

[2006.11.02 12:33:01 | 000,124,132 | ---- | C] () -- C:\Windows\System32\perfc009.dat

[2006.11.02 12:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat

[2006.11.02 12:25:44 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll

[2006.11.02 12:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat

[2006.11.02 10:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin

[2006.11.02 10:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT

[2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini

[2006.11.02 09:27:46 | 000,000,518 | ---- | C] () -- C:\Windows\System32\SP207.INI

[2006.11.02 09:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat

[2006.11.01 08:54:30 | 000,139,264 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll

[2006.11.01 08:52:38 | 000,524,288 | ---- | C] () -- C:\Windows\System32\xvidcore.dll

[2006.05.26 15:29:14 | 000,005,120 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll

[2006.03.09 12:58:00 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll

[2004.06.18 10:22:26 | 000,618,496 | ---- | C] () -- C:\Windows\System32\stlpmt45.dll

[2004.06.18 10:22:18 | 000,577,635 | ---- | C] () -- C:\Windows\System32\InstallPrinter.dll

[2004.06.18 10:22:16 | 003,907,655 | ---- | C] () -- C:\Windows\System32\Bbgspdf.dll

[2003.10.12 13:59:56 | 000,070,050 | ---- | C] () -- C:\Windows\System32\Promt.dll

[2003.05.15 08:39:50 | 000,155,136 | ---- | C] () -- C:\Windows\System32\unrar.dll

[2002.05.15 06:58:38 | 000,122,880 | ---- | C] () -- C:\Windows\System32\v2k2_dec.dll

[1998.05.07 04:10:00 | 000,069,632 | R--- | C] () -- C:\Windows\System32\ODMA32.dll

========== LOP Check ==========

[2011.03.16 22:36:53 | 000,000,000 | ---D | M] -- C:\Users\kamen\AppData\Roaming\Autodesk

[2010.05.15 23:02:46 | 000,000,000 | ---D | M] -- C:\Users\kamen\AppData\Roaming\BSplayer PRO

[2011.03.15 23:13:44 | 000,000,000 | ---D | M] -- C:\Users\kamen\AppData\Roaming\DAEMON Tools Lite

[2011.08.08 15:26:51 | 000,000,000 | ---D | M] -- C:\Users\kamen\AppData\Roaming\DAEMON Tools Pro

[2008.01.26 11:40:14 | 000,000,000 | ---D | M] -- C:\Users\kamen\AppData\Roaming\DassaultSystemes

[2007.09.02 12:47:36 | 000,000,000 | ---D | M] -- C:\Users\kamen\AppData\Roaming\Downloaded Installations

[2007.08.31 21:52:36 | 000,000,000 | ---D | M] -- C:\Users\kamen\AppData\Roaming\FlashGet

[2011.08.26 16:48:33 | 000,000,000 | ---D | M] -- C:\Users\kamen\AppData\Roaming\go

[2011.06.07 18:54:58 | 000,000,000 | ---D | M] -- C:\Users\kamen\AppData\Roaming\ICQ

[2007.09.09 10:13:15 | 000,000,000 | ---D | M] -- C:\Users\kamen\AppData\Roaming\ICQ Toolbar

[2011.04.27 22:57:24 | 000,000,000 | ---D | M] -- C:\Users\kamen\AppData\Roaming\Image Zone Express

[2008.05.02 22:57:56 | 000,000,000 | ---D | M] -- C:\Users\kamen\AppData\Roaming\InterVideo

[2008.01.15 10:08:41 | 000,000,000 | ---D | M] -- C:\Users\kamen\AppData\Roaming\JGsoft

[2007.10.16 13:14:10 | 000,000,000 | ---D | M] -- C:\Users\kamen\AppData\Roaming\Leadertech

[2011.05.07 16:24:10 | 000,000,000 | ---D | M] -- C:\Users\kamen\AppData\Roaming\Nokia

[2011.08.08 15:41:48 | 000,000,000 | ---D | M] -- C:\Users\kamen\AppData\Roaming\OpenCandy

[2011.11.07 11:50:06 | 000,000,000 | ---D | M] -- C:\Users\kamen\AppData\Roaming\PC Suite

[2007.12.03 20:07:21 | 000,000,000 | ---D | M] -- C:\Users\kamen\AppData\Roaming\Printer Info Cache

[2007.08.31 21:44:11 | 000,000,000 | ---D | M] -- C:\Users\kamen\AppData\Roaming\SampleView

[2007.12.26 18:55:20 | 000,000,000 | ---D | M] -- C:\Users\kamen\AppData\Roaming\WinBatch

[2011.11.08 07:30:29 | 000,032,652 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

[2011.06.01 19:41:28 | 000,000,418 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{830B9961-44B2-4981-A42C-96C770E6E643}.job

========== Purity Check ==========

< End of report >

Стартирайте отново OTL, копирайте (Copy) и поставете (Paste) скриптовия текст от текстовото поле по-долу под колонката Custom Scans/Fixes, като не забравяте да копирате скрипта 1 към 1, както и двете точки преди първия ред на скрипта.

:OTL
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {30F9B915-B755-4826-820B-08FBA6BD249D} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {414B6D9D-4A95-4E8D-B5B1-149DD2D93BB3} - No CLSID value found.

:Reg

:files

autorun.inf /alldrives
autorun.exe /alldrives
recycler /alldrives
ipconfig /flushdns /c

:Commands
[purity]
[emptytemp]
[resethosts]
[clearallrestorepoints]
[emptyflash]
[Reboot]

След като въведете скрипта от цитата по-горе натиснете бутона, маркиран в червено: Run Fix

Windows ще се рестартира и ще се създаде лог файл. Публикувайте съдържанието му с Copy/Paste в следващия си коментар.

All processes killed

========== OTL ==========

Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{30F9B915-B755-4826-820B-08FBA6BD249D} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{30F9B915-B755-4826-820B-08FBA6BD249D}\ not found.

Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{414B6D9D-4A95-4E8D-B5B1-149DD2D93BB3} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{414B6D9D-4A95-4E8D-B5B1-149DD2D93BB3}\ not found.

========== REGISTRY ==========

========== FILES ==========

autorun.inf not found in C:\

autorun.inf not found in E:\

autorun.exe not found in C:\

autorun.exe not found in E:\

recycler not found in C:\

recycler not found in E:\

< ipconfig /flushdns /c >

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

C:\Users\kamen\Desktop\cmd.bat deleted successfully.

C:\Users\kamen\Desktop\cmd.txt deleted successfully.

========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

User: Default User

User: kamen

->Temp folder emptied: 1199485 bytes

->Temporary Internet Files folder emptied: 20638902 bytes

->Java cache emptied: 0 bytes

->FireFox cache emptied: 0 bytes

->Google Chrome cache emptied: 0 bytes

->Flash cache emptied: 689 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 8178 bytes

RecycleBin emptied: 170284086 bytes

Total Files Cleaned = 183.00 mb

C:\Windows\System32\drivers\etc\Hosts moved successfully.

HOSTS file reset successfully

[EMPTYFLASH]

User: All Users

User: Default

User: Default User

User: kamen

->Flash cache emptied: 0 bytes

User: Public

Total Flash Files Cleaned = 0.00 mb

OTL by OldTimer - Version 3.2.31.0 log created on 11082011_175837

Files\Folders moved on Reboot...

C:\Users\kamen\AppData\Local\Temp\[email protected] moved successfully.

File\Folder C:\Users\kamen\AppData\Local\Temp\~DF6AC1.tmp not found!

File\Folder C:\Users\kamen\AppData\Local\Temp\~DF6ACD.tmp not found!

File\Folder C:\Users\kamen\AppData\Local\Temp\~DF6B21.tmp not found!

File\Folder C:\Users\kamen\AppData\Local\Temp\~DF6B2D.tmp not found!

File\Folder C:\Users\kamen\AppData\Local\Temp\~DF6B6F.tmp not found!

File\Folder C:\Users\kamen\AppData\Local\Temp\~DF6B7B.tmp not found!

C:\Users\kamen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CZSCBMZ5\fb_iframe[1].html moved successfully.

C:\Users\kamen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CZSCBMZ5\login_status[10].htm moved successfully.

C:\Users\kamen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CZSCBMZ5\login_status[9].htm moved successfully.

C:\Users\kamen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\C8GDIGFL\fastbutton[1].htm moved successfully.

C:\Users\kamen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\C8GDIGFL\index[5].php moved successfully.

C:\Users\kamen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\C8GDIGFL\like[2].htm moved successfully.

C:\Users\kamen\AppData\Local\Microsoft\Windows\Temporary Internet Files\AntiPhishing\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat moved successfully.

Registry entries deleted on Reboot...

Перфектно..!Активни зарази не се виждат...!Какво е положението по системата ви след изпълнението на всички процедури...?