Здравейте. Проблемът ми е следния: компютърът ми замръзва през 15-20 сек за по 15-20 сек. Сканирах с AVAST Free и Malwarebytes' Anti-Malware но няма ефект. Когато възстановя системата от System restore нещата се оправят но само за 2-3 дена. Забелязах, че когато се появи проблема дори и BIOS-а зарежда бавно, флопито свети постоянно, а замръзването започва още със самия log on на windows-a когато избирам като какъв user да вляза. Windows XP Pro SP3 AMD Athlon ™ processor 2.60 GHz 1,75 GB of RAM . DDS (Ver_2011-08-26.01) - NTFSx86 Internet Explorer: 8.0.6001.18702 Run by Dido at 13:45:29 on 2011-12-02 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1791.1231 [GMT 2:00] . AV: avast! Antivirus *Enabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D} . ============== Running Processes =============== . C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe C:\WINDOWS\system32\Ati2evxx.exe svchost.exe C:\Program Files\AVAST Software\Avast\AvastSvc.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\rundll32.exe C:\Program Files\AVAST Software\Avast\avastUI.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\system32\RunDll32.exe C:\PROGRA~1\A4Tech\Keyboard\Ikeymain.exe C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe svchost.exe svchost.exe C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe C:\WINDOWS\System32\svchost.exe -k HPZ12 C:\WINDOWS\System32\svchost.exe -k HPZ12 C:\WINDOWS\system32\svchost.exe -k imgsvc C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\imapi.exe . ============== Pseudo HJT Report =============== . uStart Page = about:blank BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program files\avast software\avast\aswWebRepIE.dll BHO: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File TB: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program files\avast software\avast\aswWebRepIE.dll TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe mRun: [bluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent mRun: [avast] "c:\program files\avast software\avast\avastUI.exe" /nogui mRun: [startCCC] "c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe" MSRun mRun: [RTHDCPL] RTHDCPL.EXE mRun: [CmPCIaudio] RunDll32 CMICNFG3.cpl,CMICtrlWnd mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe" mRun: [iKeyWorks] c:\progra~1\a4tech\keyboard\Ikeymain.exe mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\Internet.lnk - IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000 IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL TCP: Interfaces\{314DD98E-3BBF-4B22-BB29-D0AA70D3DA4B} : NameServer = 87.120.0.1 87.120.0.10 Name-Space Handler: ftp\* - {419A0123-4312-1122-A0C0-434FDA6DA542} - c:\program files\coreftp\pftpns.dll Notify: AtiExtEvent - Ati2evxx.dll STS: FencesShlExt Class: {1984dd45-52cf-49cd-ab77-18f378fea264} - c:\program files\stardock\fences\FencesMenu.dll . ================= FIREFOX =================== . FF - ProfilePath - c:\documents and settings\dido\application data\mozilla\firefox\profiles\df3dimiy.default\ FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - chrome://speeddial/content/speeddial.xul FF - prefs.js: keyword.URL - chrome://browser-region/locale/region.properties FF - prefs.js: network.proxy.type - 0 FF - plugin: c:\documents and settings\dido\application data\mozilla\firefox\profiles\df3dimiy.default\extensions\{394dcba4-1f92-4f8e-8ec9-8d2cb90cb69b}\plugins\npLightshot.dll FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll . ---- FIREFOX POLICIES ---- FF - user.js: network.protocol-handler.warn-external.dnupdate - false FF - user.js: browser.sessionstore.resume_from_crash - false FF - user.js: network.protocol-handler.warn-external.dnupdate - false ============= SERVICES / DRIVERS =============== . R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2011-11-20 442200] R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2011-11-20 320856] R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2011-11-20 20568] R2 avast! Antivirus;avast! Antivirus;c:\program files\avast software\avast\AvastSvc.exe [2011-11-20 44768] R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2011-11-27 366152] R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-11-27 22216] S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [2011-11-21 1691480] S3 BTATHPROT;General Bluetooth Filter;c:\windows\system32\drivers\btathprot.sys --> c:\windows\system32\drivers\btathprot.sys [?] S3 BTATHUSB;General Bluetooth Device;c:\windows\system32\drivers\btathusb.sys --> c:\windows\system32\drivers\btathusb.sys [?] S3 btfilter;General Bluetooth Filter ss;c:\windows\system32\drivers\btfilter.sys --> c:\windows\system32\drivers\btfilter.sys [?] . =============== Created Last 30 ================ . 2011-12-02 10:42:29 77312 ----a-w- c:\windows\system32\ztvunace26.dll 2011-12-02 10:42:29 75264 ----a-w- c:\windows\system32\unacev2.dll 2011-12-02 10:42:29 69632 ----a-w- c:\windows\system32\ztvcabinet.dll 2011-12-02 10:42:29 162304 ----a-w- c:\windows\system32\ztvunrar36.dll 2011-12-02 10:42:29 153088 ----a-w- c:\windows\system32\UNRAR3.dll 2011-12-02 10:42:22 -------- d-----w- c:\documents and settings\all users\application data\Simply Super Software 2011-12-02 09:31:12 -------- d-----w- c:\documents and settings\dido\application data\Softplicity 2011-12-02 09:30:53 -------- d-----w- c:\program files\TotalAudioConverter 2011-12-02 09:24:57 -------- d-----w- c:\program files\Total Video Converter 2011-11-30 08:58:59 28552 ----a-w- c:\windows\system32\spool\prtprocs\w32x86\mdippr.dll 2011-11-30 08:58:58 28040 ----a-w- c:\windows\system32\mdimon.dll 2011-11-30 08:58:07 -------- d-----w- c:\program files\Microsoft ActiveSync 2011-11-30 08:57:23 -------- d-----w- c:\windows\SHELLNEW 2011-11-29 20:50:22 -------- d-----w- c:\windows\system32\wbem\repository\FS 2011-11-29 20:50:22 -------- d-----w- c:\windows\system32\wbem\Repository 2011-11-29 17:05:42 -------- d-----w- c:\documents and settings\dido\local settings\application data\Eraser 6 2011-11-29 09:15:57 -------- d-----w- c:\documents and settings\all users\application data\Spybot - Search & Destroy 2011-11-28 16:57:20 -------- d-----w- c:\program files\WYSIWYG Web Builder 8 2011-11-28 14:16:18 -------- d-----w- c:\documents and settings\dido\application data\MyPhoneExplorer 2011-11-28 14:16:12 -------- d-----w- c:\program files\MyPhoneExplorer 2011-11-28 13:41:54 -------- d-----w- c:\program files\PrivacyEraser Computing 2011-11-28 12:56:15 -------- d-----w- c:\windows\XSxS 2011-11-28 12:56:15 -------- d-----w- c:\program files\Xenocode 2011-11-28 11:05:00 -------- d-----w- c:\documents and settings\all users\application data\Canneverbe Limited 2011-11-28 11:04:59 -------- d-----w- c:\documents and settings\dido\application data\Canneverbe Limited 2011-11-28 11:04:27 -------- d-----w- c:\documents and settings\dido\application data\JAM Software 2011-11-28 11:04:21 -------- d-----w- c:\program files\JAM Software 2011-11-27 07:07:44 -------- d-----w- c:\documents and settings\dido\application data\Malwarebytes 2011-11-27 07:07:35 -------- d-----w- c:\documents and settings\all users\application data\Malwarebytes 2011-11-27 07:07:34 22216 ----a-w- c:\windows\system32\drivers\mbam.sys 2011-11-27 07:07:34 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2011-11-25 17:50:51 -------- d-----w- c:\program files\Windows Installer Clean Up 2011-11-25 17:50:33 -------- d-----w- c:\program files\MSECACHE 2011-11-25 17:50:13 -------- d-----w- c:\documents and settings\dido\application data\GetRightToGo 2011-11-25 17:16:25 -------- d-----w- c:\documents and settings\dido\local settings\application data\PCHealth 2011-11-25 14:11:22 -------- d-----w- c:\documents and settings\dido\application data\dBpoweramp 2011-11-25 14:05:36 -------- d-----w- c:\program files\Illustrate 2011-11-24 12:55:03 -------- d-----w- c:\documents and settings\dido\application data\MixMeister Technology 2011-11-24 12:54:25 -------- d-----w- c:\program files\MixMeister Pro 6 2011-11-24 12:26:18 -------- d-----w- c:\documents and settings\dido\local settings\application data\Xenocode 2011-11-24 09:42:49 -------- d-----w- c:\documents and settings\all users\application data\regid.1986-12.com.adobe 2011-11-23 15:57:18 -------- d-----w- c:\program files\Unlocker 2011-11-23 15:06:50 -------- d-----w- c:\documents and settings\dido\application data\Thinstall 2011-11-23 11:56:24 -------- d-----w- c:\program files\common files\VST3 2011-11-23 11:56:23 -------- d-----w- c:\program files\Brainworx Music 2011-11-22 12:40:09 -------- d-----w- c:\documents and settings\dido\local settings\application data\Identities 2011-11-22 12:36:13 -------- d-----w- c:\program files\A4Tech 2011-11-22 12:06:34 -------- d-----w- c:\documents and settings\dido\application data\Doblon 2011-11-22 12:00:20 -------- d-----w- c:\program files\Doblon 2011-11-22 11:42:22 -------- d-----w- c:\documents and settings\all users\application data\YoGen 2011-11-22 08:07:41 -------- d-----w- c:\documents and settings\dido\application data\foobar2000 2011-11-21 18:01:03 14592 -c--a-w- c:\windows\system32\dllcache\kbdhid.sys 2011-11-21 18:01:03 14592 ----a-w- c:\windows\system32\drivers\kbdhid.sys 2011-11-21 18:01:00 25600 -c--a-w- c:\windows\system32\dllcache\hidbth.sys 2011-11-21 18:01:00 25600 ----a-w- c:\windows\system32\drivers\hidbth.sys 2011-11-21 18:00:16 37888 -c--a-w- c:\windows\system32\dllcache\bthmodem.sys 2011-11-21 18:00:16 37888 ----a-w- c:\windows\system32\drivers\bthmodem.sys 2011-11-21 17:04:08 737280 ----a-w- c:\windows\iun6002.exe 2011-11-21 17:03:17 -------- d-----w- c:\program files\WYSIWYG Web Builder 7 UNICODE 2011-11-21 16:26:05 -------- d-----w- c:\documents and settings\dido\application data\CoreFTP 2011-11-21 16:25:38 -------- d-----w- c:\program files\CoreFTP 2011-11-21 15:19:09 -------- d-----w- c:\documents and settings\dido\application data\TeamViewer 2011-11-21 15:19:04 -------- d-----w- c:\program files\TeamViewer 2011-11-21 14:08:16 -------- d-----w- c:\windows\Nanny 911 2011-11-21 14:08:15 -------- d-----w- c:\program files\Nanny 911 2011-11-21 14:05:20 -------- d-----w- c:\documents and settings\all users\application data\rionix 2011-11-21 14:04:15 -------- d-----w- c:\windows\system32\XPSViewer 2011-11-21 14:03:54 89088 ----a-w- c:\windows\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll 2011-11-21 14:03:34 89088 -c----w- c:\windows\system32\dllcache\filterpipelineprintproc.dll 2011-11-21 14:03:34 597504 -c----w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe 2011-11-21 14:03:34 597504 ------w- c:\windows\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe 2011-11-21 14:03:34 575488 -c----w- c:\windows\system32\dllcache\xpsshhdr.dll 2011-11-21 14:03:34 575488 ------w- c:\windows\system32\xpsshhdr.dll 2011-11-21 14:03:34 1676288 -c----w- c:\windows\system32\dllcache\xpssvcs.dll 2011-11-21 14:03:34 1676288 ------w- c:\windows\system32\xpssvcs.dll 2011-11-21 14:03:34 117760 ------w- c:\windows\system32\prntvpt.dll 2011-11-21 14:03:33 -------- d-----w- C:\4613c57bf4cd83a0d9236bd284cfa5 2011-11-21 14:02:18 49152 ----a-w- c:\program files\mozilla firefox\plugins\np32dsw.dll 2011-11-21 14:00:02 -------- d-----w- c:\program files\LeeGT-Games 2011-11-21 13:53:07 -------- d-----w- c:\documents and settings\all users\application data\ConeXware 2011-11-21 13:52:38 -------- d-----w- c:\program files\PowerArchiver 2011-11-21 13:48:22 -------- d-----w- c:\program files\MSXML 4.0 2011-11-21 13:44:43 265728 -c----w- c:\windows\system32\dllcache\http.sys 2011-11-21 13:33:54 -------- d-----w- c:\program files\uTorrent 2011-11-21 13:33:14 -------- d-----w- c:\documents and settings\dido\local settings\application data\uTorrent 2011-11-21 13:33:14 -------- d-----w- c:\documents and settings\dido\application data\uTorrent 2011-11-21 12:03:43 -------- d-----w- c:\documents and settings\dido\application data\Waves Audio 2011-11-21 12:03:39 -------- d-----w- c:\program files\Steinberg 2011-11-21 12:03:39 -------- d-----w- c:\program files\common files\Digidesign 2011-11-21 12:02:28 -------- d-----w- c:\program files\Waves 2011-11-21 11:59:56 -------- d-----w- c:\windows\Downloaded Installations 2011-11-21 11:56:35 -------- d-----w- c:\documents and settings\dido\application data\Stardock 2011-11-21 11:56:33 -------- dc-h--w- c:\documents and settings\all users\application data\{A3A26C56-02C3-4F76-A033-12EE2FB52AE6} 2011-11-21 11:56:32 -------- d-----w- c:\program files\Stardock 2011-11-21 11:56:19 -------- d-----w- c:\documents and settings\dido\local settings\application data\PackageAware 2011-11-21 11:39:29 8992 ----a-w- c:\windows\system32\kbdbph.dll 2011-11-21 11:33:08 -------- d-----w- c:\program files\WhereIsIt 2011-11-21 11:26:06 -------- d-----w- c:\program files\GRETECH 2011-11-21 11:23:34 -------- d-----w- c:\program files\foobar2000 2011-11-21 10:58:36 -------- d-----w- c:\program files\StrongDC++ 2011-11-21 10:44:02 -------- d-----r- c:\program files\Skype 2011-11-21 10:03:59 -------- d-----w- c:\program files\CCleaner 2011-11-21 09:59:11 81920 ---ha-w- c:\windows\system32\v3shrtkgn.dll 2011-11-21 09:58:27 -------- d-----w- c:\documents and settings\dido\application data\URSoft 2011-11-21 09:58:22 -------- d-----w- c:\program files\Your Uninstaller! 7 2011-11-21 09:18:09 -------- d-----w- c:\documents and settings\dido\local settings\application data\Temp 2011-11-21 09:16:37 -------- d-----w- c:\documents and settings\dido\local settings\application data\Adobe 2011-11-21 08:58:38 -------- d-----w- c:\documents and settings\dido\local settings\application data\Thunderbird 2011-11-21 08:53:11 -------- d-----w- c:\program files\MozBackup 2011-11-21 08:14:59 -------- d-----w- c:\windows\system32\ReinstallBackups 2011-11-21 08:14:53 81936 ----a-w- c:\windows\system32\RtNicProp32.dll 2011-11-21 08:14:53 102416 ----a-w- c:\windows\system32\RTNUninst32.dll 2011-11-21 07:49:10 -------- d-----w- c:\windows\system32\Lang 2011-11-21 07:45:15 282624 ----a-w- c:\windows\system32\CMRMDRV3.exe 2011-11-21 07:44:51 307200 ----a-w- c:\windows\CmiPCIUninstall.exe 2011-11-21 07:44:41 36864 ----a-w- c:\windows\system32\cmudax3.DLL 2011-11-21 07:44:41 1486336 ----a-w- c:\windows\system32\drivers\cmudax3.sys 2011-11-21 07:44:41 -------- d-----w- c:\program files\C-Media PCI Audio Device 2011-11-21 07:44:31 729088 ----a-w- c:\program files\common files\installshield\professional\runtime\09\01\intel32\iKernel.dll 2011-11-21 07:44:31 69715 ----a-w- c:\program files\common files\installshield\professional\runtime\09\01\intel32\ctor.dll 2011-11-21 07:44:31 5632 ----a-w- c:\program files\common files\installshield\professional\runtime\09\01\intel32\DotNetInstaller.exe 2011-11-21 07:44:31 311428 ----a-w- c:\program files\common files\installshield\professional\runtime\09\01\intel32\setup.dll 2011-11-21 07:44:31 266240 ----a-w- c:\program files\common files\installshield\professional\runtime\09\01\intel32\iscript.dll 2011-11-21 07:44:31 192512 ----a-w- c:\program files\common files\installshield\professional\runtime\09\01\intel32\iuser.dll 2011-11-21 07:44:31 188548 ----a-w- c:\program files\common files\installshield\professional\runtime\09\01\intel32\iGdi.dll 2011-11-21 07:31:59 60160 -c--a-w- c:\windows\system32\dllcache\drmk.sys 2011-11-21 07:19:04 -------- d-----w- c:\program files\common files\HP 2011-11-21 07:18:43 16496 ----a-r- c:\windows\system32\drivers\HPZipr12.sys 2011-11-21 07:18:39 49920 ----a-r- c:\windows\system32\drivers\HPZid412.sys 2011-11-21 07:18:18 267864 ----a-r- c:\windows\system32\hpzids01.dll 2011-11-21 07:18:17 274944 ----a-w- c:\windows\system32\spool\prtprocs\w32x86\hpzpp5ha.dll 2011-11-21 07:18:16 118272 ----a-w- c:\windows\system32\hpz3l5ha.dll 2011-11-21 07:18:15 -------- d-----w- c:\program files\common files\Hewlett-Packard 2011-11-21 07:18:06 21568 ----a-r- c:\windows\system32\drivers\HPZius12.sys 2011-11-21 07:17:51 958464 ----a-r- c:\windows\system32\hpotiop4.dll 2011-11-21 07:17:51 675840 ----a-r- c:\windows\system32\hpowiax4.dll 2011-11-21 07:17:51 364544 ----a-r- c:\windows\system32\hppldcoi.dll 2011-11-21 07:17:51 309760 ----a-r- c:\windows\system32\difxapi.dll 2011-11-21 07:17:51 303104 ----a-r- c:\windows\system32\hpovst11.dll 2011-11-21 07:17:51 15104 -c--a-w- c:\windows\system32\dllcache\usbscan.sys 2011-11-21 07:17:51 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys 2011-11-21 07:17:19 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2011-11-21 07:15:37 -------- d-----w- c:\program files\HP 2011-11-21 07:15:34 26368 -c--a-w- c:\windows\system32\dllcache\usbstor.sys 2011-11-21 07:15:33 32128 -c--a-w- c:\windows\system32\dllcache\usbccgp.sys 2011-11-21 07:15:33 32128 ----a-w- c:\windows\system32\drivers\usbccgp.sys 2011-11-21 07:15:32 25856 -c--a-w- c:\windows\system32\dllcache\usbprint.sys 2011-11-21 07:15:32 25856 ----a-w- c:\windows\system32\drivers\usbprint.sys 2011-11-21 06:55:52 -------- d-----w- c:\windows\SxsCaPendDel . ==================== Find3M ==================== . 2011-11-30 12:53:06 20480 ----a-w- c:\windows\system32\mucltui.dll.mui 2011-11-21 07:40:04 323816 ----a-w- c:\windows\system32\drivers\Rtenicxp.sys 2011-11-20 18:08:28 0 ----a-w- c:\windows\ativpsrm.bin 2011-11-20 17:51:15 90112 ----a-w- c:\windows\DUMP4bbe.tmp 2011-10-28 08:00:00 74752 ----a-w- c:\windows\system32\ff_vfw.dll 2011-10-26 03:01:40 7412736 ----a-w- c:\windows\system32\drivers\ati2mtag.sys 2011-10-26 02:59:02 311296 ----a-w- c:\windows\system32\atiiiexx.dll 2011-10-26 02:30:50 57344 ----a-w- c:\windows\system32\aticalrt.dll 2011-10-26 02:30:40 53248 ----a-w- c:\windows\system32\aticalcl.dll 2011-10-26 02:27:26 5890048 ----a-w- c:\windows\system32\aticaldd.dll 2011-10-26 02:16:30 18968576 ----a-w- c:\windows\system32\atioglxx.dll 2011-10-26 02:06:02 466944 ----a-w- c:\windows\system32\ATIDEMGX.dll 2011-10-26 02:04:50 304128 ----a-w- c:\windows\system32\ati2dvag.dll 2011-10-26 02:04:46 4004864 ----a-w- c:\windows\system32\ati3duag.dll 2011-10-26 01:58:22 956160 ----a-w- c:\windows\system32\ativvamv.dll 2011-10-26 01:44:50 3286400 ----a-w- c:\windows\system32\ativvaxx.dll 2011-10-26 01:44:08 212992 ----a-w- c:\windows\system32\atipdlxx.dll 2011-10-26 01:43:54 155648 ----a-w- c:\windows\system32\Oemdspif.dll 2011-10-26 01:43:46 26112 ----a-w- c:\windows\system32\Ati2mdxx.exe 2011-10-26 01:43:38 43520 ----a-w- c:\windows\system32\ati2edxx.dll 2011-10-26 01:43:26 188416 ----a-w- c:\windows\system32\ati2evxx.dll 2011-10-26 01:42:08 643072 ----a-w- c:\windows\system32\ati2evxx.exe 2011-10-26 01:40:46 53248 ----a-w- c:\windows\system32\ATIDDC.DLL 2011-10-26 01:39:12 159744 ----a-w- c:\windows\system32\atiapfxx.exe 2011-10-26 01:35:00 806912 ----a-w- c:\windows\system32\atikvmag.dll 2011-10-26 01:34:14 499712 ----a-w- c:\windows\system32\atiok3x2.dll 2011-10-26 01:30:52 229376 ----a-w- c:\windows\system32\atiadlxx.dll 2011-10-26 01:30:28 17408 ----a-w- c:\windows\system32\atitvo32.dll 2011-10-26 01:25:38 65024 ----a-w- c:\windows\system32\atimpc32.dll 2011-10-26 01:25:38 65024 ----a-w- c:\windows\system32\amdpcom32.dll 2011-10-26 01:24:58 53248 ----a-w- c:\windows\system32\drivers\ati2erec.dll 2011-10-26 01:24:52 884736 ----a-w- c:\windows\system32\ati2cqag.dll 2011-10-25 19:21:48 56832 ----a-w- c:\windows\system32\OpenVideo.dll 2011-10-25 19:21:34 56832 ----a-w- c:\windows\system32\OVDecoder.dll 2011-10-25 19:20:42 13950464 ----a-w- c:\windows\system32\amdocl.dll 2011-10-25 19:19:50 44032 ----a-w- c:\windows\system32\OpenCL.dll 2011-10-18 17:53:14 6439528 ----a-w- c:\windows\system32\drivers\RtkHDAud.sys 2011-10-18 16:10:30 64616 ----a-w- c:\windows\system32\RtkCoInstXP.dll 2011-10-14 16:58:12 20064872 ----a-w- c:\windows\RTHDCPL.EXE 2011-10-10 14:22:41 692736 ----a-w- c:\windows\system32\inetcomm.dll 2011-09-28 07:06:50 599040 ----a-w- c:\windows\system32\crypt32.dll 2011-09-26 09:41:20 611328 ------w- c:\windows\system32\uiautomationcore.dll 2011-09-26 09:41:20 220160 ----a-w- c:\windows\system32\oleacc.dll 2011-09-26 09:41:14 20480 ----a-w- c:\windows\system32\oleaccrc.dll 2011-09-25 09:33:48 216064 ----a-w- c:\windows\system32\lagarith.dll 2011-09-06 21:45:29 41184 ----a-w- c:\windows\avastSS.scr 2011-09-06 21:38:05 442200 ----a-w- c:\windows\system32\drivers\aswSnx.sys 2011-09-06 13:25:11 1867904 ----a-w- c:\windows\system32\win32k.sys . ============= FINISH: 13:48:01,14 =============== . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2011-08-26.01) . . Motherboard: ASUSTeK Computer INC. | | M3A78-EMH HDMI Processor: AMD Athlon™ Processor LE-1640 | AM2 | 2600/200mhz . ==== Disk Partitions ========================= . A: is Removable C: is FIXED (NTFS) - 29 GiB total, 15,821 GiB free. D: is FIXED (NTFS) - 204 GiB total, 11,3 GiB free. E: is CDROM () . ==== Disabled Device Manager Items ============= . ==== System Restore Points =================== . . ==== Installed Programs ====================== . µTorrent 32 Bit HP CIO Components Installer A4Tech iKeyWorks 7.64 Adobe AIR Adobe Audition 1.5 Adobe Flash Player 10 ActiveX Adobe Flash Player 11 Plugin Adobe Reader X (10.1.1) Adobe Shockwave Player AIO_Scan AMD APP SDK Runtime AMD Catalyst Install Manager Ask Toolbar avast! Free Antivirus BufferChm Bulgarian (Phonetic) C-Media PCI Audio Device Catalyst Control Center Catalyst Control Center - Branding Catalyst Control Center Graphics Previews Common ccc-utility CCC Help English CCleaner Core FTP Pro 2.1 Driver Genius Professional Edition Fences foobar2000 v1.1.9 GOM Player Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595) Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484) Hotfix for Windows XP (KB2570791) Hotfix for Windows XP (KB954550-v5) Hotfix for Windows XP (KB961118) Hotfix for Windows XP (KB976002-v5) HP Photosmart All-In-One Software 9.0 K-Lite Mega Codec Pack 7.9.0 Malwarebytes' Anti-Malware version 1.51.2.1300 MarketingReg Microsoft .NET Framework 2.0 Service Pack 2 Microsoft .NET Framework 3.0 Service Pack 2 Microsoft .NET Framework 3.5 SP1 Microsoft Kernel-Mode Driver Framework Feature Pack 1.5 Microsoft Office Professional Edition 2003 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Mozilla Firefox 8.0 (x86 bg) Mozilla Thunderbird (8.0) MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) MyPhoneExplorer Nanny 911 PowerArchiver 2010 PS_AIO_Software PS_AIO_Software_min REALTEK GbE & FE Ethernet PCI-E NIC Driver Realtek High Definition Audio Driver Rescue Team 2 Scan Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473) Security Update for Microsoft Windows (KB2564958) Security Update for Windows Internet Explorer 8 (KB2510531) Security Update for Windows Internet Explorer 8 (KB2544521) Security Update for Windows Internet Explorer 8 (KB2586448) Security Update for Windows Internet Explorer 8 (KB982381) Security Update for Windows Media Player (KB2378111) Security Update for Windows Media Player (KB954155) Security Update for Windows Media Player (KB973540) Security Update for Windows Media Player (KB975558) Security Update for Windows Media Player (KB978695) Security Update for Windows XP (KB2079403) Security Update for Windows XP (KB2115168) Security Update for Windows XP (KB2229593) Security Update for Windows XP (KB2296011) Security Update for Windows XP (KB2347290) Security Update for Windows XP (KB2360937) Security Update for Windows XP (KB2387149) Security Update for Windows XP (KB2393802) Security Update for Windows XP (KB2412687) Security Update for Windows XP (KB2419632) Security Update for Windows XP (KB2423089) Security Update for Windows XP (KB2440591) Security Update for Windows XP (KB2443105) Security Update for Windows XP (KB2476490) Security Update for Windows XP (KB2478960) Security Update for Windows XP (KB2478971) Security Update for Windows XP (KB2479943) Security Update for Windows XP (KB2481109) Security Update for Windows XP (KB2483185) Security Update for Windows XP (KB2485663) Security Update for Windows XP (KB2506212) Security Update for Windows XP (KB2507618) Security Update for Windows XP (KB2507938) Security Update for Windows XP (KB2508272) Security Update for Windows XP (KB2508429) Security Update for Windows XP (KB2509553) Security Update for Windows XP (KB2535512) Security Update for Windows XP (KB2536276-v2) Security Update for Windows XP (KB2544893-v2) Security Update for Windows XP (KB2562937) Security Update for Windows XP (KB2566454) Security Update for Windows XP (KB2567053) Security Update for Windows XP (KB2567680) Security Update for Windows XP (KB2570222) Security Update for Windows XP (KB2570947) Security Update for Windows XP (KB2592799) Security Update for Windows XP (KB956744) Security Update for Windows XP (KB956844) Security Update for Windows XP (KB960859) Security Update for Windows XP (KB969059) Security Update for Windows XP (KB969898) Security Update for Windows XP (KB970430) Security Update for Windows XP (KB971657) Security Update for Windows XP (KB972270) Security Update for Windows XP (KB973507) Security Update for Windows XP (KB973869) Security Update for Windows XP (KB973904) Security Update for Windows XP (KB974112) Security Update for Windows XP (KB974318) Security Update for Windows XP (KB974392) Security Update for Windows XP (KB974571) Security Update for Windows XP (KB975025) Security Update for Windows XP (KB975467) Security Update for Windows XP (KB975560) Security Update for Windows XP (KB975562) Security Update for Windows XP (KB975713) Security Update for Windows XP (KB977816) Security Update for Windows XP (KB977914) Security Update for Windows XP (KB978338) Security Update for Windows XP (KB978542) Security Update for Windows XP (KB978601) Security Update for Windows XP (KB978706) Security Update for Windows XP (KB979309) Security Update for Windows XP (KB979482) Security Update for Windows XP (KB979687) Security Update for Windows XP (KB980436) Security Update for Windows XP (KB981322) Security Update for Windows XP (KB981997) Security Update for Windows XP (KB982132) Security Update for Windows XP (KB982665) Skype™ 5.5 StrongDC++ 2.41 TeamViewer 6 Toolbox TreeSize Free V2.6 UnloadSupport Update for Microsoft .NET Framework 3.5 SP1 (KB963707) Update for Windows Internet Explorer 8 (KB2598845) Update for Windows XP (KB2345886) Update for Windows XP (KB2467659) Update for Windows XP (KB2541763) Update for Windows XP (KB2641690) Update for Windows XP (KB955759) Update for Windows XP (KB955839) Update for Windows XP (KB968389) Update for Windows XP (KB971029) Update for Windows XP (KB971737) Update for Windows XP (KB973687) Update for Windows XP (KB973815) Waves Diamond Bundle v5.2 Waves L3 v5.2 Waves Vocal Bundle v1.1 Waves Znoise v1.0 WebFldrs XP WebReg Where Is It? 3.21 Windows Internet Explorer 8 WYSIWYG Web Builder 7 UNICODE WYSIWYG Web Builder 8 Your Uninstaller! 7 . ==== End Of File ===========================

Редактирано 2 декември 201114 г. от ddanailov (преглед на промените)

Изтеглете ComboFix от тук или тук и го запазете на десктопа си.

• Изключете вашата антивирусна и антишпионска програма, обикновено това става чрез натискане на десния бутон на мишката върху иконата на програма в системния трей.

Бележка: Ако не можете я спрете или не сте сигурни коя програма да изключите, моля прегледайте информацията от този линк: How to Disable your Security Programs

• Стартирайте Combo-Fix.com и следвайте инструкциите.

Бележка: ComboFix ще се стартира без инсталирана Recovery Console.

• Като част от неговата работа, ComboFix ще провери дали Microsoft Windows Recovery Console е инсталирана. Предвид бързо развиващия се зловреден софтуер е силно препоръчително да бъде инсталирана преди премахването на зловредния софтуер. Това ще Ви позволи да влезете в специален recovery/repair режим, който ще ни позволи по-лесно да решите проблем, който би могъл да възникне при премахване на зловредния софтуер.

• Следвайте инструкциите, за да позволите на ComboFix да изтегли и инсталира Microsoft Windows Recovery Console. В един момент ще бъдете попитани дали сте съгласни с лицензното споразумение. Необходимо е да потвърдите, че сте съгласни, за да инсталирате Microsoft Windows Recovery Console.

** Забележете: Ако Microsoft Windows Recovery Console е вече инсталирана, ComboFix ще продължи към процеса по премахване на зловредния софтуер.

След като Microsoft Windows Recovery Console е инсталирана, използвайки ComboFix, Вие ще видите следното съобщение:

Изберете Yes, за да продължи сканирането за зловреден софтуер.

Когато процесът приключи успешно, инструментът ще създаде лог файл. Моля, включете съдържанието на C:\ComboFix.txt в следващия Ви коментар в тази тема.

Бележка:

• Моля, не движете мишката, докато ComboFix работи. Това може да наруши процеса на работа.
• ComboFix ще нулира всички настройки на Microsoft Internet Explorer, включително да направи IE браузър по подразбиране.
• ComboFix ще изключи autorun функцията на ВСИЧКИ CD, Floppy и USB устройства, за да помогне при премахването на зловредния софтуер и Ви защити от бъдещи вируси/заплахи, които поразяват чрез autorun. Ако това е проблем за вас - моля, уведомете ме.
• ComboFix ще изключи вашата интернет връзка. Интернет връзката ще се възстанови автоматично, преди ComboFix да завърши процеса на работа. При проблем, той ще прекрати интернет връзката. За да възстановите интернет връзката си, рестартирайте компютъра си.
• В случай на проблем с ComboFix, той може да създаде лог файл. Моля, включете съдържанието на C:\BUG.txt в следващия Ви коментар в тази тема.

Моля, не прикачвайте лог файла/овете от програмата, а го/ги копирайте и поставете в следващия Ви коментар в тази тема.

Вече ми се прецака и Language bar-а (причината, поради която преинсталирах преди 2 седмици). Забелязах, че когато записвам ДВД и след това истрия записаната информация чрез шифт и дел, на хард диска не се освобождава място. ComboFix 11-12-02.01 - Dido 12.2011 ?. 16:45:20.1.1 - x86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1791.954 [GMT 2:00] Running from: d:\programs\ComboFix.exe AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\documents and settings\All Users\Application Data\TEMP c:\windows\iun6002.exe c:\windows\system32\AutoRun.inf c:\windows\XSxS . . ((((((((((((((((((((((((( Files Created from 2011-11-02 to 2011-12-02 ))))))))))))))))))))))))))))))) . . 2011-11-30 08:53 . 2011-11-30 08:53 -------- d-----r- C:\MSOCache 2011-11-21 14:03 . 2011-11-21 14:03 -------- d-----w- C:\4613c57bf4cd83a0d9236bd284cfa5 . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-10-25 19:21 . 2011-10-25 19:21 56832 ----a-w- c:\windows\system32\OpenVideo.dll 2011-10-25 19:21 . 2011-10-25 19:21 56832 ----a-w- c:\windows\system32\OVDecoder.dll 2011-10-25 19:20 . 2011-10-25 19:20 13950464 ----a-w- c:\windows\system32\amdocl.dll 2011-10-25 19:19 . 2011-10-25 19:19 44032 ----a-w- c:\windows\system32\OpenCL.dll 2011-09-28 07:06 . 2008-04-14 12:00 599040 ----a-w- c:\windows\system32\crypt32.dll 2011-09-26 09:41 . 2011-09-26 09:41 611328 ------w- c:\windows\system32\uiautomationcore.dll 2011-09-26 09:41 . 2008-04-14 12:00 220160 ----a-w- c:\windows\system32\oleacc.dll 2011-09-26 09:41 . 2008-04-14 12:00 20480 ----a-w- c:\windows\system32\oleaccrc.dll 2011-09-06 13:25 . 2009-06-09 18:12 1867904 ----a-w- c:\windows\system32\win32k.sys 2011-11-05 07:07 . 2011-11-21 10:09 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast] @="{472083B0-C522-11CF-8763-00608CC02F24}" [HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}] 2011-09-06 21:45 122512 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 110592] "avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-09-06 3722416] "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-10-25 98304] "RTHDCPL"="RTHDCPL.EXE" [2011-10-14 20064872] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920] "iKeyWorks"="c:\progra~1\A4Tech\Keyboard\Ikeymain.exe" [2004-08-31 61440] "Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-08-31 449608] "Eraser"="c:\progra~1\Eraser\Eraser.exe" [2011-11-05 980368] . [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] . c:\documents and settings\All Users\Start Menu\Programs\Startup\ Internet.lnk - [N/A] . [hkey_local_machine\software\microsoft\windows\currentversion\explorer\SharedTaskScheduler] "{1984DD45-52CF-49cd-AB77-18F378FEA264}"= "c:\program files\Stardock\Fences\FencesMenu.dll" [2010-06-22 202088] . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\Documents and Settings\\Gerry\\Local Settings\\Application Data\\Programs\\Opera\\opera.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\Program Files\\TeamViewer\\Version6\\TeamViewer.exe"= "c:\\Program Files\\TeamViewer\\Version6\\TeamViewer_Service.exe"= "c:\\Program Files\\StrongDC++\\StrongDC.exe"= . R3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [2009-11-18 1691480] R3 BTATHPROT;General Bluetooth Filter;c:\windows\system32\DRIVERS\btathprot.sys [x] R3 BTATHUSB;General Bluetooth Device;c:\windows\system32\DRIVERS\btathusb.sys [x] R3 btfilter;General Bluetooth Filter ss;c:\windows\system32\DRIVERS\btfilter.sys [x] S1 aswSnx;aswSnx; [x] S1 aswSP;aswSP; [x] S1 HWiNFO32;HWiNFO32/64 Kernel Driver;c:\program files\HWiNFO32\HWiNFO32.SYS [2011-09-22 21624] S2 aswFsBlk;aswFsBlk; [x] S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2011-08-31 366152] S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-08-31 22216] . . --- Other Services/Drivers In Memory --- . *NewlyCreated* - HWINFO32 . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 hpdevmgmt REG_MULTI_SZ hpqcxs08 . Contents of the 'Scheduled Tasks' folder . 2011-12-02 c:\windows\Tasks\User_Feed_Synchronization-{3D293D7B-8B2C-4B81-A559-82A6908E7C2F}.job - c:\windows\system32\msfeedssync.exe [2009-03-08 02:31] . 2011-12-02 c:\windows\Tasks\User_Feed_Synchronization-{E5E42C7E-2104-44D9-B2A8-11CC71813C4A}.job - c:\windows\system32\msfeedssync.exe [2009-03-08 02:31] . . ------- Supplementary Scan ------- . uStart Page = about:blank IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 FF - ProfilePath - c:\documents and settings\Dido\Application Data\Mozilla\Firefox\Profiles\df3dimiy.default\ FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - chrome://speeddial/content/speeddial.xul FF - prefs.js: keyword.URL - chrome://browser-region/locale/region.properties FF - prefs.js: network.proxy.type - 0 FF - user.js: network.protocol-handler.warn-external.dnupdate - false FF - user.js: browser.sessionstore.resume_from_crash - false FF - user.js: network.protocol-handler.warn-external.dnupdate - false . - - - - ORPHANS REMOVED - - - - . BHO-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file) Toolbar-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file) HKLM-Run-CmPCIaudio - CMICNFG3.cpl AddRemove-WYSIWYG_Web_Builder_7_UNICODE - c:\windows\iun6002.exe AddRemove-WYSIWYG_Web_Builder_8 - c:\windows\iun6002.exe . . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2011-12-02 16:52 Windows 5.1.2600 Service Pack 3 NTFS . scanning hidden processes ... . scanning hidden autostart entries ... . scanning hidden files ... . scan completed successfully hidden files: 0 . ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\Shell\B20@O=5 *=0 *C*C*l*e*a*n*e*r*& \command] @="c:\\Program Files\\CCleaner\\ccleaner.exe" . --------------------- DLLs Loaded Under Running Processes --------------------- . - - - - - - - > 'winlogon.exe'(804) c:\windows\system32\Ati2evxx.dll c:\windows\system32\atiadlxx.dll . Completion time: 2011-12-02 16:57:00 ComboFix-quarantined-files.txt 2011-12-02 14:56 . Pre-Run: 13 426 266 112 bytes free Post-Run: 13 804 085 248 bytes free . WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons UnsupportedDebug="do not select this" /debug multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect . - - End Of File - - 252A4E1C29023A2DECDA6E94A8F9AE68

Копирайте текста в карето на notepad и го запазвате с име CFScript.txt на десктопа си:

KILLALL::

ClearJavaCache::

Folder::
C:\4613c57bf4cd83a0d9236bd284cfa5

След съхранението преместете CFScript.txt на иконата на ComboFix.exe

Генерирания рапорт прикачете в следващия си пост..!

ComboFix 11-12-02.01 - Dido 12.2011 ?. 17:59:35.3.1 - x86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1791.1090 [GMT 2:00] Running from: c:\documents and settings\Dido\Desktop\ComboFix.exe Command switches used :: c:\documents and settings\Dido\Desktop\CFScript.txt.txt AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D} . . ((((((((((((((((((((((((( Files Created from 2011-11-02 to 2011-12-02 ))))))))))))))))))))))))))))))) . . 2011-11-30 08:53 . 2011-11-30 08:53 -------- d-----r- C:\MSOCache . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-10-25 19:21 . 2011-10-25 19:21 56832 ----a-w- c:\windows\system32\OpenVideo.dll 2011-10-25 19:21 . 2011-10-25 19:21 56832 ----a-w- c:\windows\system32\OVDecoder.dll 2011-10-25 19:20 . 2011-10-25 19:20 13950464 ----a-w- c:\windows\system32\amdocl.dll 2011-10-25 19:19 . 2011-10-25 19:19 44032 ----a-w- c:\windows\system32\OpenCL.dll 2011-09-28 07:06 . 2008-04-14 12:00 599040 ----a-w- c:\windows\system32\crypt32.dll 2011-09-26 09:41 . 2011-09-26 09:41 611328 ------w- c:\windows\system32\uiautomationcore.dll 2011-09-26 09:41 . 2008-04-14 12:00 220160 ----a-w- c:\windows\system32\oleacc.dll 2011-09-26 09:41 . 2008-04-14 12:00 20480 ----a-w- c:\windows\system32\oleaccrc.dll 2011-09-06 13:25 . 2009-06-09 18:12 1867904 ----a-w- c:\windows\system32\win32k.sys 2011-11-05 07:07 . 2011-11-21 10:09 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast] @="{472083B0-C522-11CF-8763-00608CC02F24}" [HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}] 2011-09-06 21:45 122512 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 110592] "avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-09-06 3722416] "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-10-25 98304] "RTHDCPL"="RTHDCPL.EXE" [2011-10-14 20064872] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920] "iKeyWorks"="c:\progra~1\A4Tech\Keyboard\Ikeymain.exe" [2004-08-31 61440] "Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-08-31 449608] "Eraser"="c:\progra~1\Eraser\Eraser.exe" [2011-11-05 980368] . [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] . c:\documents and settings\All Users\Start Menu\Programs\Startup\ Internet.lnk - [N/A] . [hkey_local_machine\software\microsoft\windows\currentversion\explorer\SharedTaskScheduler] "{1984DD45-52CF-49cd-AB77-18F378FEA264}"= "c:\program files\Stardock\Fences\FencesMenu.dll" [2010-06-22 202088] . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\Documents and Settings\\Gerry\\Local Settings\\Application Data\\Programs\\Opera\\opera.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\Program Files\\TeamViewer\\Version6\\TeamViewer.exe"= "c:\\Program Files\\TeamViewer\\Version6\\TeamViewer_Service.exe"= "c:\\Program Files\\StrongDC++\\StrongDC.exe"= . R3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [2009-11-18 1691480] R3 BTATHPROT;General Bluetooth Filter;c:\windows\system32\DRIVERS\btathprot.sys [x] R3 BTATHUSB;General Bluetooth Device;c:\windows\system32\DRIVERS\btathusb.sys [x] R3 btfilter;General Bluetooth Filter ss;c:\windows\system32\DRIVERS\btfilter.sys [x] S1 aswSnx;aswSnx; [x] S1 aswSP;aswSP; [x] S1 HWiNFO32;HWiNFO32/64 Kernel Driver;c:\program files\HWiNFO32\HWiNFO32.SYS [2011-09-22 21624] S2 aswFsBlk;aswFsBlk; [x] S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2011-08-31 366152] S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-08-31 22216] . . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 hpdevmgmt REG_MULTI_SZ hpqcxs08 . Contents of the 'Scheduled Tasks' folder . 2011-12-02 c:\windows\Tasks\User_Feed_Synchronization-{3D293D7B-8B2C-4B81-A559-82A6908E7C2F}.job - c:\windows\system32\msfeedssync.exe [2009-03-08 02:31] . 2011-12-02 c:\windows\Tasks\User_Feed_Synchronization-{E5E42C7E-2104-44D9-B2A8-11CC71813C4A}.job - c:\windows\system32\msfeedssync.exe [2009-03-08 02:31] . . ------- Supplementary Scan ------- . uStart Page = about:blank IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 FF - ProfilePath - c:\documents and settings\Dido\Application Data\Mozilla\Firefox\Profiles\df3dimiy.default\ FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - chrome://speeddial/content/speeddial.xul FF - prefs.js: keyword.URL - chrome://browser-region/locale/region.properties FF - prefs.js: network.proxy.type - 0 FF - user.js: network.protocol-handler.warn-external.dnupdate - false FF - user.js: browser.sessionstore.resume_from_crash - false FF - user.js: network.protocol-handler.warn-external.dnupdate - false . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2011-12-02 18:12 Windows 5.1.2600 Service Pack 3 NTFS . scanning hidden processes ... . scanning hidden autostart entries ... . scanning hidden files ... . scan completed successfully hidden files: 0 . ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\Shell\B20@O=5 *=0 *C*C*l*e*a*n*e*r*& \command] @="c:\\Program Files\\CCleaner\\ccleaner.exe" . --------------------- DLLs Loaded Under Running Processes --------------------- . - - - - - - - > 'winlogon.exe'(812) c:\windows\system32\Ati2evxx.dll c:\windows\system32\atiadlxx.dll . - - - - - - - > 'explorer.exe'(2708) c:\windows\system32\WININET.dll c:\windows\system32\ieframe.dll c:\windows\system32\webcheck.dll c:\program files\Stardock\Fences\FencesMenu.dll c:\program files\stardock\fences\DesktopDock.dll . ------------------------ Other Running Processes ------------------------ . c:\windows\system32\Ati2evxx.exe c:\windows\system32\Ati2evxx.exe c:\program files\AVAST Software\Avast\AvastSvc.exe c:\windows\system32\rundll32.exe c:\windows\RTHDCPL.EXE c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe c:\program files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe c:\windows\system32\wscntfy.exe . ************************************************************************** . Completion time: 2011-12-02 18:17:19 - machine was rebooted ComboFix-quarantined-files.txt 2011-12-02 16:17 ComboFix2.txt 2011-12-02 14:57 . Pre-Run: 13 869 232 128 bytes free Post-Run: 13 853 675 520 bytes free . - - End Of File - - D84B9147E1AF4AEFE9B349D3F178234E

Някъкви изменения по системата има ли..?Наблюдавате ли първоначалния проблем..?

Вече ми се прецака и Language bar-а (причината, поради която преинсталирах преди 2 седмици)

Изтеглете този архив lang.zip и го запазете на десктопа си.Разархивирате и стартирате с двоен клик * reg файла.Рестартирате компютъра си.

За съжаление проблемите не се оправиха. Повторих процедурата с CFScript.txt но отново няма ефект. Ето новия log: ComboFix 11-12-02.01 - Dido 12.2011 ?. 18:47:52.4.1 - x86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1791.1379 [GMT 2:00] Running from: c:\documents and settings\Dido\Desktop\ComboFix.exe Command switches used :: c:\documents and settings\Dido\Desktop\CFScript.txt . . ((((((((((((((((((((((((( Files Created from 2011-11-02 to 2011-12-02 ))))))))))))))))))))))))))))))) . . 2011-11-30 08:53 . 2011-11-30 08:53 -------- d-----r- C:\MSOCache . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-10-25 19:21 . 2011-10-25 19:21 56832 ----a-w- c:\windows\system32\OpenVideo.dll 2011-10-25 19:21 . 2011-10-25 19:21 56832 ----a-w- c:\windows\system32\OVDecoder.dll 2011-10-25 19:20 . 2011-10-25 19:20 13950464 ----a-w- c:\windows\system32\amdocl.dll 2011-10-25 19:19 . 2011-10-25 19:19 44032 ----a-w- c:\windows\system32\OpenCL.dll 2011-09-28 07:06 . 2008-04-14 12:00 599040 ----a-w- c:\windows\system32\crypt32.dll 2011-09-26 09:41 . 2011-09-26 09:41 611328 ------w- c:\windows\system32\uiautomationcore.dll 2011-09-26 09:41 . 2008-04-14 12:00 220160 ----a-w- c:\windows\system32\oleacc.dll 2011-09-26 09:41 . 2008-04-14 12:00 20480 ----a-w- c:\windows\system32\oleaccrc.dll 2011-09-06 13:25 . 2009-06-09 18:12 1867904 ----a-w- c:\windows\system32\win32k.sys 2011-11-05 07:07 . 2011-11-21 10:09 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast] @="{472083B0-C522-11CF-8763-00608CC02F24}" [HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}] 2011-09-06 21:45 122512 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-09-06 3722416] . [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] . [hkey_local_machine\software\microsoft\windows\currentversion\explorer\SharedTaskScheduler] "{1984DD45-52CF-49cd-AB77-18F378FEA264}"= "c:\program files\Stardock\Fences\FencesMenu.dll" [2010-06-22 202088] . [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Internet.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Internet.lnk backup=c:\windows\pss\Internet.lnkCommon Startup . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM] 2011-06-06 10:55 937920 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BluetoothAuthenticationAgent] 2008-04-14 12:00 110592 ----a-w- c:\windows\system32\bthprops.cpl . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iKeyWorks] 2004-08-31 11:33 61440 ----a-w- c:\progra~1\A4Tech\Keyboard\Ikeymain.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware] 2011-08-31 15:00 449608 ----a-w- c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL] 2011-10-14 16:58 20064872 ----a-w- c:\windows\RTHDCPL.EXE . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC] 2011-10-25 18:41 98304 ----a-w- c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\Documents and Settings\\Gerry\\Local Settings\\Application Data\\Programs\\Opera\\opera.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\Program Files\\TeamViewer\\Version6\\TeamViewer.exe"= "c:\\Program Files\\TeamViewer\\Version6\\TeamViewer_Service.exe"= "c:\\Program Files\\StrongDC++\\StrongDC.exe"= . R3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [2009-11-18 1691480] R3 BTATHPROT;General Bluetooth Filter;c:\windows\system32\DRIVERS\btathprot.sys [x] R3 BTATHUSB;General Bluetooth Device;c:\windows\system32\DRIVERS\btathusb.sys [x] R3 btfilter;General Bluetooth Filter ss;c:\windows\system32\DRIVERS\btfilter.sys [x] S1 aswSnx;aswSnx; [x] S1 aswSP;aswSP; [x] S1 HWiNFO32;HWiNFO32/64 Kernel Driver;c:\program files\HWiNFO32\HWiNFO32.SYS [2011-09-22 21624] S2 aswFsBlk;aswFsBlk; [x] S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2011-08-31 366152] S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-08-31 22216] . . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 hpdevmgmt REG_MULTI_SZ hpqcxs08 . Contents of the 'Scheduled Tasks' folder . 2011-12-02 c:\windows\Tasks\User_Feed_Synchronization-{3D293D7B-8B2C-4B81-A559-82A6908E7C2F}.job - c:\windows\system32\msfeedssync.exe [2009-03-08 02:31] . 2011-12-02 c:\windows\Tasks\User_Feed_Synchronization-{E5E42C7E-2104-44D9-B2A8-11CC71813C4A}.job - c:\windows\system32\msfeedssync.exe [2009-03-08 02:31] . . ------- Supplementary Scan ------- . uStart Page = about:blank IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 FF - ProfilePath - c:\documents and settings\Dido\Application Data\Mozilla\Firefox\Profiles\df3dimiy.default\ FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - chrome://speeddial/content/speeddial.xul FF - prefs.js: keyword.URL - chrome://browser-region/locale/region.properties FF - prefs.js: network.proxy.type - 0 FF - user.js: network.protocol-handler.warn-external.dnupdate - false FF - user.js: browser.sessionstore.resume_from_crash - false FF - user.js: network.protocol-handler.warn-external.dnupdate - false . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2011-12-02 18:58 Windows 5.1.2600 Service Pack 3 NTFS . scanning hidden processes ... . scanning hidden autostart entries ... . scanning hidden files ... . scan completed successfully hidden files: 0 . ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\Shell\B20@O=5 *=0 *C*C*l*e*a*n*e*r*& \command] @="c:\\Program Files\\CCleaner\\ccleaner.exe" . --------------------- DLLs Loaded Under Running Processes --------------------- . - - - - - - - > 'winlogon.exe'(800) c:\windows\system32\Ati2evxx.dll c:\windows\system32\atiadlxx.dll . - - - - - - - > 'explorer.exe'(3656) c:\windows\system32\WININET.dll c:\windows\system32\ieframe.dll c:\program files\Stardock\Fences\FencesMenu.dll c:\windows\system32\webcheck.dll c:\program files\stardock\fences\DesktopDock.dll . ------------------------ Other Running Processes ------------------------ . c:\windows\system32\Ati2evxx.exe c:\windows\system32\Ati2evxx.exe c:\program files\AVAST Software\Avast\AvastSvc.exe c:\windows\system32\wscntfy.exe . ************************************************************************** . Completion time: 2011-12-02 19:03:21 - machine was rebooted ComboFix-quarantined-files.txt 2011-12-02 17:03 ComboFix2.txt 2011-12-02 16:17 ComboFix3.txt 2011-12-02 14:57 . Pre-Run: 13 859 135 488 bytes free Post-Run: 13 846 097 920 bytes free . - - End Of File - - 17FF48C24B24526C42ACE9C861389977

Редактирано 2 декември 201114 г. от ddanailov (преглед на промените)

За съжаление проблемите не се оправиха. Повторих процедурата с CFScript.txt но отново няма ефект. Ето новия log:

А защо..?Това е недопустимо и груба грешка....!Аз не съм ви казвал да правите това..!Скрипта е изпълнен веднъж...това значи че аз съм прецинил какво да премахнем с този скрип ,който е индивидуален и се изпълнява веднъж...!В този раздел не се правят свободни съчинения...!

В последния лог нв се виждат зловредни неща....!

Защо си мислите че проблема ви се дължи на вируси..?

Моля, изтеглете последната версия на TDSSKiller - оттук и я запазете на вашия декстоп.

• Стартирайте TDSSKiller.exe за да стартирате приложението. След това кликнете върху бутона Change parameters.

  

• Сложете отметки пред Verify Driver Digital Signature и Detect TDLFS file system и натиснете ОК.

  

• Натиснете бутона Start Scan.

  

• Ако подозрителен обект бъде засечен, действието по подразбиране ще бъде Skip, кликнете върху Continue.

  

• Ако зловредни обекти бъдат намерени, тогава от падащото меню ще имате три възможности.

  Бъдете сигурни, че избраното действие е Cure и натиснете върху Continue > Рестартирайте за да бъде завършена поправката.

  

  Забележка: Ако Cure бутона не е наличен от възможностите, тогава моля изберете Skip бутона, не избирайте Delete освен ако не сте инструктирани затова.

• Лог файл ще бъде създаден в свободната директория на дял C:\ . Потърсете за лог с името "TDSSKiller.[Version]_[Date]_[Time]_log.txt" и копирайте съдържанието му в следващия си пост.

Изтеглете Gmer или от тук.

* Временно спрете Интернета си,всички работещи програми,както и антивирусната си програма.

* Стартирате програмата.

* След завършването на автомаичната експрес-проверка,махнете отметките от следните позиции:

- Sections

- IAT/EAT

- Show all

* От всички локални дискове маркирайте само системния дял (обикновенно това е C:\ )

* Изчакайте програмата да завърши сканирането,след което натиснете бутона Save и запишете (save as) резултатите на десктопа с име Gmer.log.

* Включете Интернета си и прикачете Gmer.log в следващия си коментар.

Забележка:

* Ако бъде открит Rootkit, ще последва въпрос дали желаете пълно сканиране на системата. Изберете NO.

* Не предприемайте никакви действия върху редовете маркирани с "<--- ROOТKIT" ,защото това може да доведе до грешки.

* В десния панел на програмата ще видите какво е ще се провери от програмата, не променяйте нищо. Убедете се, че на Show All няма отметка.

Внимание:

Ако имате проблем с използването на GMER по по-горе описания начин,моля изпълнете сканирането,като маркирате следните позиции:

Ето лог-а от TDSSKiller:

19:38:45.0062 2140 TDSS rootkit removing tool 2.6.21.0 Nov 24 2011 12:32:44

19:38:45.0375 2140 ============================================================

19:38:45.0375 2140 Current date / time: 2011/12/02 19:38:45.0375

19:38:45.0375 2140 SystemInfo:

19:38:45.0375 2140

19:38:45.0375 2140 OS Version: 5.1.2600 ServicePack: 3.0

19:38:45.0375 2140 Product type: Workstation

19:38:45.0375 2140 ComputerName: COMPUTER

19:38:45.0375 2140 UserName: Dido

19:38:45.0375 2140 Windows directory: C:\WINDOWS

19:38:45.0375 2140 System windows directory: C:\WINDOWS

19:38:45.0375 2140 Processor architecture: Intel x86

19:38:45.0375 2140 Number of processors: 1

19:38:45.0375 2140 Page size: 0x1000

19:38:45.0375 2140 Boot type: Normal boot

19:38:45.0375 2140 ============================================================

19:38:46.0375 2140 Initialize success

19:40:08.0453 3160 ============================================================

19:40:08.0453 3160 Scan started

19:40:08.0453 3160 Mode: Manual; SigCheck; TDLFS;

19:40:08.0453 3160 ============================================================

19:40:08.0671 3160 Aavmker4 (b6de0336f9f4b687b4ff57939f7b657a) C:\WINDOWS\system32\drivers\Aavmker4.sys

19:40:08.0781 3160 Aavmker4 - ok

19:40:08.0859 3160 Abiosdsk - ok

19:40:08.0890 3160 abp480n5 - ok

19:40:08.0937 3160 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys

19:40:09.0687 3160 ACPI - ok

19:40:09.0796 3160 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys

19:40:09.0906 3160 ACPIEC - ok

19:40:09.0921 3160 adpu160m - ok

19:40:09.0984 3160 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys

19:40:10.0093 3160 aec - ok

19:40:10.0203 3160 AFD (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys

19:40:10.0234 3160 AFD - ok

19:40:10.0265 3160 Aha154x - ok

19:40:10.0296 3160 aic78u2 - ok

19:40:10.0312 3160 aic78xx - ok

19:40:10.0359 3160 AliIde - ok

19:40:10.0468 3160 Ambfilt (267fc636801edc5ab28e14036349e3be) C:\WINDOWS\system32\drivers\Ambfilt.sys

19:40:10.0609 3160 Ambfilt - ok

19:40:10.0687 3160 amsint - ok

19:40:10.0718 3160 asc - ok

19:40:10.0750 3160 asc3350p - ok

19:40:10.0781 3160 asc3550 - ok

19:40:10.0843 3160 aswFsBlk (054df24c92b55427e0757cfff160e4f2) C:\WINDOWS\system32\drivers\aswFsBlk.sys

19:40:10.0843 3160 aswFsBlk - ok

19:40:10.0890 3160 aswMon2 (ef0e9ad83380724bd6fbbb51d2d0f5b8) C:\WINDOWS\system32\drivers\aswMon2.sys

19:40:10.0890 3160 aswMon2 - ok

19:40:10.0937 3160 aswRdr (352d5a48ebab35a7693b048679304831) C:\WINDOWS\system32\drivers\aswRdr.sys

19:40:10.0937 3160 aswRdr - ok

19:40:11.0062 3160 aswSnx (8d34d2b24297e27d93e847319abfdec4) C:\WINDOWS\system32\drivers\aswSnx.sys

19:40:11.0093 3160 aswSnx - ok

19:40:11.0125 3160 aswSP (010012597333da1f46c3243f33f8409e) C:\WINDOWS\system32\drivers\aswSP.sys

19:40:11.0140 3160 aswSP - ok

19:40:11.0234 3160 aswTdi (f9f84364416658e9786235904d448d37) C:\WINDOWS\system32\drivers\aswTdi.sys

19:40:11.0250 3160 aswTdi - ok

19:40:11.0296 3160 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys

19:40:11.0406 3160 AsyncMac - ok

19:40:11.0500 3160 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys

19:40:11.0609 3160 atapi - ok

19:40:11.0640 3160 Atdisk - ok

19:40:12.0000 3160 ati2mtag (f27a0b0d1373d36d866f29b434b7aa92) C:\WINDOWS\system32\DRIVERS\ati2mtag.sys

19:40:12.0343 3160 ati2mtag - ok

19:40:12.0453 3160 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys

19:40:12.0562 3160 Atmarpc - ok

19:40:12.0609 3160 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys

19:40:12.0718 3160 audstub - ok

19:40:12.0781 3160 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys

19:40:12.0890 3160 Beep - ok

19:40:12.0968 3160 BTATHPROT - ok

19:40:13.0015 3160 BTATHUSB - ok

19:40:13.0031 3160 btfilter - ok

19:40:13.0078 3160 BthEnum (b279426e3c0c344893ed78a613a73bde) C:\WINDOWS\system32\DRIVERS\BthEnum.sys

19:40:13.0203 3160 BthEnum - ok

19:40:13.0281 3160 BTHMODEM (fca6f069597b62d42495191ace3fc6c1) C:\WINDOWS\system32\DRIVERS\bthmodem.sys

19:40:13.0406 3160 BTHMODEM - ok

19:40:13.0437 3160 BthPan (80602b8746d3738f5886ce3d67ef06b6) C:\WINDOWS\system32\DRIVERS\bthpan.sys

19:40:13.0546 3160 BthPan - ok

19:40:13.0593 3160 BTHPORT (662bfd909447dd9cc15b1a1c366583b4) C:\WINDOWS\system32\Drivers\BTHport.sys

19:40:13.0609 3160 BTHPORT - ok

19:40:13.0765 3160 BTHUSB (61364cd71ef63b0f038b7e9df00f1efa) C:\WINDOWS\system32\Drivers\BTHUSB.sys

19:40:13.0875 3160 BTHUSB - ok

19:40:13.0890 3160 catchme - ok

19:40:13.0937 3160 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys

19:40:14.0046 3160 cbidf2k - ok

19:40:14.0109 3160 cd20xrnt - ok

19:40:14.0156 3160 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys

19:40:14.0265 3160 Cdaudio - ok

19:40:14.0328 3160 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys

19:40:14.0453 3160 Cdfs - ok

19:40:14.0546 3160 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys

19:40:14.0671 3160 Cdrom - ok

19:40:14.0703 3160 Changer - ok

19:40:14.0750 3160 CmdIde - ok

19:40:14.0843 3160 cmuda3 (adb3cb1a8fef6fe76de9f43be1bec39c) C:\WINDOWS\system32\drivers\cmudax3.sys

19:40:14.0921 3160 cmuda3 ( UnsignedFile.Multi.Generic ) - warning

19:40:14.0921 3160 cmuda3 - detected UnsignedFile.Multi.Generic (1)

19:40:15.0015 3160 Cpqarray - ok

19:40:15.0046 3160 dac2w2k - ok

19:40:15.0078 3160 dac960nt - ok

19:40:15.0140 3160 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys

19:40:15.0250 3160 Disk - ok

19:40:15.0328 3160 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys

19:40:15.0500 3160 dmboot - ok

19:40:15.0593 3160 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys

19:40:15.0703 3160 dmio - ok

19:40:15.0734 3160 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys

19:40:15.0859 3160 dmload - ok

19:40:15.0968 3160 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys

19:40:16.0078 3160 DMusic - ok

19:40:16.0125 3160 dpti2o - ok

19:40:16.0156 3160 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys

19:40:16.0250 3160 drmkaud - ok

19:40:16.0328 3160 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys

19:40:16.0437 3160 Fastfat - ok

19:40:16.0546 3160 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys

19:40:16.0656 3160 Fdc - ok

19:40:16.0703 3160 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys

19:40:16.0812 3160 Fips - ok

19:40:16.0906 3160 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys

19:40:17.0015 3160 Flpydisk - ok

19:40:17.0062 3160 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\DRIVERS\fltMgr.sys

19:40:17.0171 3160 FltMgr - ok

19:40:17.0218 3160 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys

19:40:17.0328 3160 Fs_Rec - ok

19:40:17.0437 3160 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys

19:40:17.0546 3160 Ftdisk - ok

19:40:17.0609 3160 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys

19:40:17.0718 3160 Gpc - ok

19:40:17.0812 3160 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys

19:40:17.0921 3160 HDAudBus - ok

19:40:17.0984 3160 HidBth (7bd2de4c85eb4241eed57672b16a7d8d) C:\WINDOWS\system32\DRIVERS\hidbth.sys

19:40:18.0078 3160 HidBth - ok

19:40:18.0140 3160 hidusb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys

19:40:18.0234 3160 hidusb - ok

19:40:18.0328 3160 hpn - ok

19:40:18.0390 3160 HPZid412 (d03d10f7ded688fecf50f8fbf1ea9b8a) C:\WINDOWS\system32\DRIVERS\HPZid412.sys

19:40:28.0687 3160 HPZid412 - ok

19:40:28.0734 3160 HPZipr12 (89f41658929393487b6b7d13c8528ce3) C:\WINDOWS\system32\DRIVERS\HPZipr12.sys

19:40:28.0750 3160 HPZipr12 - ok

19:40:28.0796 3160 HPZius12 (abcb05ccdbf03000354b9553820e39f8) C:\WINDOWS\system32\DRIVERS\HPZius12.sys

19:40:28.0812 3160 HPZius12 - ok

19:40:28.0906 3160 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys

19:40:28.0937 3160 HTTP - ok

19:40:29.0000 3160 HWiNFO32 (79b69cd1dfbdc48ccad4b8b6d4048786) C:\Program Files\HWiNFO32\HWiNFO32.SYS

19:40:29.0015 3160 HWiNFO32 - ok

19:40:29.0093 3160 i2omgmt - ok

19:40:29.0125 3160 i2omp - ok

19:40:29.0187 3160 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys

19:40:29.0281 3160 i8042prt - ok

19:40:29.0328 3160 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys

19:40:29.0453 3160 Imapi - ok

19:40:29.0531 3160 ini910u - ok

19:40:29.0859 3160 IntcAzAudAddService (58dabdef7a35f9e3ab1fabd2cbaf3d13) C:\WINDOWS\system32\drivers\RtkHDAud.sys

19:40:30.0171 3160 IntcAzAudAddService - ok

19:40:30.0265 3160 IntelIde - ok

19:40:30.0312 3160 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys

19:40:30.0421 3160 Ip6Fw - ok

19:40:30.0468 3160 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys

19:40:30.0593 3160 IpFilterDriver - ok

19:40:30.0734 3160 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys

19:40:30.0828 3160 IpInIp - ok

19:40:30.0875 3160 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys

19:40:30.0984 3160 IpNat - ok

19:40:31.0031 3160 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys

19:40:31.0140 3160 IPSec - ok

19:40:31.0250 3160 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys

19:40:31.0296 3160 IRENUM - ok

19:40:31.0343 3160 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys

19:40:31.0453 3160 isapnp - ok

19:40:31.0562 3160 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys

19:40:31.0671 3160 Kbdclass - ok

19:40:31.0718 3160 kbdhid (9ef487a186dea361aa06913a75b3fa99) C:\WINDOWS\system32\DRIVERS\kbdhid.sys

19:40:31.0812 3160 kbdhid - ok

19:40:31.0890 3160 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys

19:40:32.0015 3160 kmixer - ok

19:40:32.0093 3160 KSecDD (c6ebf1d6ad71df30db49b8d3287e1368) C:\WINDOWS\system32\drivers\KSecDD.sys

19:40:32.0109 3160 KSecDD - ok

19:40:32.0171 3160 lbrtfdc - ok

19:40:32.0234 3160 MBAMProtector (69a6268d7f81e53d568ab4e7e991caf3) C:\WINDOWS\system32\drivers\mbam.sys

19:40:32.0250 3160 MBAMProtector - ok

19:40:32.0296 3160 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys

19:40:32.0406 3160 mnmdd - ok

19:40:32.0484 3160 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys

19:40:32.0593 3160 Modem - ok

19:40:32.0734 3160 Monfilt (c7d9f9717916b34c1b00dd4834af485c) C:\WINDOWS\system32\drivers\Monfilt.sys

19:40:32.0843 3160 Monfilt - ok

19:40:32.0937 3160 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys

19:40:33.0046 3160 Mouclass - ok

19:40:33.0078 3160 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys

19:40:33.0203 3160 mouhid - ok

19:40:33.0250 3160 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys

19:40:33.0359 3160 MountMgr - ok

19:40:33.0421 3160 mraid35x - ok

19:40:33.0468 3160 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys

19:40:33.0593 3160 MRxDAV - ok

19:40:33.0656 3160 MRxSmb (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys

19:40:33.0687 3160 MRxSmb - ok

19:40:33.0781 3160 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys

19:40:33.0906 3160 Msfs - ok

19:40:33.0953 3160 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys

19:40:34.0078 3160 MSKSSRV - ok

19:40:34.0156 3160 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys

19:40:34.0281 3160 MSPCLOCK - ok

19:40:34.0328 3160 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys

19:40:34.0437 3160 MSPQM - ok

19:40:34.0515 3160 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys

19:40:34.0640 3160 mssmbios - ok

19:40:34.0687 3160 MTsensor (d48659bb24c48345d926ecb45c1ebdf5) C:\WINDOWS\system32\DRIVERS\ASACPI.sys

19:40:34.0703 3160 MTsensor - ok

19:40:34.0796 3160 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys

19:40:34.0812 3160 Mup - ok

19:40:34.0875 3160 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys

19:40:34.0984 3160 NDIS - ok

19:40:35.0062 3160 NdisTapi (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys

19:40:35.0078 3160 NdisTapi - ok

19:40:35.0140 3160 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys

19:40:35.0250 3160 Ndisuio - ok

19:40:35.0328 3160 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys

19:40:35.0437 3160 NdisWan - ok

19:40:35.0500 3160 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys

19:40:35.0515 3160 NDProxy - ok

19:40:35.0562 3160 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys

19:40:35.0687 3160 NetBIOS - ok

19:40:35.0765 3160 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys

19:40:35.0890 3160 NetBT - ok

19:40:35.0968 3160 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys

19:40:36.0093 3160 Npfs - ok

19:40:36.0187 3160 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys

19:40:36.0328 3160 Ntfs - ok

19:40:36.0421 3160 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys

19:40:36.0531 3160 Null - ok

19:40:36.0578 3160 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys

19:40:36.0703 3160 NwlnkFlt - ok

19:40:36.0750 3160 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys

19:40:36.0859 3160 NwlnkFwd - ok

19:40:36.0937 3160 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\DRIVERS\parport.sys

19:40:37.0062 3160 Parport - ok

19:40:37.0140 3160 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys

19:40:37.0234 3160 PartMgr - ok

19:40:37.0312 3160 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys

19:40:37.0406 3160 ParVdm - ok

19:40:37.0500 3160 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys

19:40:37.0625 3160 PCI - ok

19:40:37.0671 3160 PCIDump - ok

19:40:37.0703 3160 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys

19:40:37.0812 3160 PCIIde - ok

19:40:37.0890 3160 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys

19:40:38.0015 3160 Pcmcia - ok

19:40:38.0062 3160 PDCOMP - ok

19:40:38.0093 3160 PDFRAME - ok

19:40:38.0109 3160 PDRELI - ok

19:40:38.0140 3160 PDRFRAME - ok

19:40:38.0171 3160 perc2 - ok

19:40:38.0203 3160 perc2hib - ok

19:40:38.0265 3160 pfc (444f122e68db44c0589227781f3c8b3f) C:\WINDOWS\system32\drivers\pfc.sys

19:40:38.0265 3160 pfc ( UnsignedFile.Multi.Generic ) - warning

19:40:38.0265 3160 pfc - detected UnsignedFile.Multi.Generic (1)

19:40:38.0359 3160 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys

19:40:38.0468 3160 PptpMiniport - ok

19:40:38.0546 3160 Processor (a32bebaf723557681bfc6bd93e98bd26) C:\WINDOWS\system32\DRIVERS\processr.sys

19:40:38.0671 3160 Processor - ok

19:40:38.0750 3160 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys

19:40:38.0859 3160 PSched - ok

19:40:38.0921 3160 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys

19:40:39.0046 3160 Ptilink - ok

19:40:39.0109 3160 ql1080 - ok

19:40:39.0125 3160 Ql10wnt - ok

19:40:39.0156 3160 ql12160 - ok

19:40:39.0187 3160 ql1240 - ok

19:40:39.0218 3160 ql1280 - ok

19:40:39.0265 3160 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys

19:40:39.0375 3160 RasAcd - ok

19:40:39.0453 3160 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys

19:40:39.0562 3160 Rasl2tp - ok

19:40:39.0640 3160 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys

19:40:39.0750 3160 RasPppoe - ok

19:40:39.0781 3160 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys

19:40:39.0890 3160 Raspti - ok

19:40:39.0968 3160 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys

19:40:40.0093 3160 Rdbss - ok

19:40:40.0171 3160 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys

19:40:40.0265 3160 RDPCDD - ok

19:40:40.0343 3160 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys

19:40:40.0468 3160 rdpdr - ok

19:40:40.0546 3160 RDPWD (fc105dd312ed64eb66bff111e8ec6eac) C:\WINDOWS\system32\drivers\RDPWD.sys

19:40:40.0562 3160 RDPWD - ok

19:40:40.0640 3160 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys

19:40:40.0750 3160 redbook - ok

19:40:40.0828 3160 RFCOMM (851c30df2807fcfa21e4c681a7d6440e) C:\WINDOWS\system32\DRIVERS\rfcomm.sys

19:40:40.0953 3160 RFCOMM - ok

19:40:41.0046 3160 RTLE8023xp (d3578c3806ed545e5c36b2a20f5c0b5a) C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys

19:40:41.0078 3160 RTLE8023xp - ok

19:40:41.0171 3160 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys

19:40:41.0218 3160 Secdrv - ok

19:40:41.0281 3160 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys

19:40:41.0390 3160 serenum - ok

19:40:41.0468 3160 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\DRIVERS\serial.sys

19:40:41.0593 3160 Serial - ok

19:40:41.0656 3160 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys

19:40:52.0031 3160 Sfloppy - ok

19:40:52.0093 3160 Simbad - ok

19:40:52.0125 3160 Sparrow - ok

19:40:52.0171 3160 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys

19:40:52.0281 3160 splitter - ok

19:40:52.0359 3160 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys

19:40:52.0406 3160 sr - ok

19:40:52.0484 3160 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys

19:40:52.0500 3160 Srv - ok

19:40:52.0562 3160 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys

19:40:52.0656 3160 swenum - ok

19:40:52.0734 3160 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys

19:40:52.0875 3160 swmidi - ok

19:40:52.0937 3160 symc810 - ok

19:40:52.0968 3160 symc8xx - ok

19:40:53.0000 3160 sym_hi - ok

19:40:53.0015 3160 sym_u3 - ok

19:40:53.0046 3160 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys

19:40:53.0156 3160 sysaudio - ok

19:40:53.0218 3160 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys

19:40:53.0265 3160 Tcpip - ok

19:40:53.0343 3160 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys

19:40:53.0437 3160 TDPIPE - ok

19:40:53.0500 3160 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys

19:40:53.0625 3160 TDTCP - ok

19:40:53.0656 3160 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys

19:40:53.0781 3160 TermDD - ok

19:40:53.0843 3160 TosIde - ok

19:40:53.0906 3160 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys

19:40:54.0046 3160 Udfs - ok

19:40:54.0093 3160 ultra - ok

19:40:54.0140 3160 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys

19:40:54.0265 3160 Update - ok

19:40:54.0343 3160 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys

19:40:54.0468 3160 usbccgp - ok

19:40:54.0531 3160 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys

19:40:54.0625 3160 usbehci - ok

19:40:54.0718 3160 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys

19:40:54.0812 3160 usbhub - ok

19:40:54.0859 3160 usbohci (0daecce65366ea32b162f85f07c6753b) C:\WINDOWS\system32\DRIVERS\usbohci.sys

19:40:54.0968 3160 usbohci - ok

19:40:55.0031 3160 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys

19:40:55.0140 3160 usbprint - ok

19:40:55.0187 3160 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys

19:40:55.0296 3160 usbscan - ok

19:40:55.0328 3160 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS

19:40:55.0421 3160 USBSTOR - ok

19:40:55.0500 3160 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys

19:40:55.0609 3160 VgaSave - ok

19:40:55.0640 3160 ViaIde - ok

19:40:55.0687 3160 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys

19:40:55.0781 3160 VolSnap - ok

19:40:55.0859 3160 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys

19:40:55.0953 3160 Wanarp - ok

19:40:56.0046 3160 Wdf01000 (fd47474bd21794508af449d9d91af6e6) C:\WINDOWS\system32\DRIVERS\Wdf01000.sys

19:40:56.0078 3160 Wdf01000 - ok

19:40:56.0140 3160 WDICA - ok

19:40:56.0187 3160 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys

19:40:56.0296 3160 wdmaud - ok

19:40:56.0406 3160 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk0\DR0

19:40:56.0593 3160 \Device\Harddisk0\DR0 - ok

19:40:56.0609 3160 Boot (0x1200) (5e8c3465c07ad81bf01d9e784da4c939) \Device\Harddisk0\DR0\Partition0

19:40:56.0609 3160 \Device\Harddisk0\DR0\Partition0 - ok

19:40:56.0640 3160 Boot (0x1200) (c7d4372419c55d027a40851ea6be4288) \Device\Harddisk0\DR0\Partition1

19:40:56.0640 3160 \Device\Harddisk0\DR0\Partition1 - ok

19:40:56.0640 3160 ============================================================

19:40:56.0640 3160 Scan finished

19:40:56.0640 3160 ============================================================

19:40:56.0765 3196 Detected object count: 2

19:40:56.0765 3196 Actual detected object count: 2

19:41:44.0640 3196 cmuda3 ( UnsignedFile.Multi.Generic ) - skipped by user

19:41:44.0640 3196 cmuda3 ( UnsignedFile.Multi.Generic ) - User select action: Skip

19:41:44.0640 3196 pfc ( UnsignedFile.Multi.Generic ) - skipped by user

19:41:44.0640 3196 pfc ( UnsignedFile.Multi.Generic ) - User select action: Skip

Започвам процедурата с Gmer.

Ето и от Gmer: GMER 1.0.15.15641 - http://www.gmer.net Rootkit scan 2011-12-02 20:35:16 Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-12 HDT722525DLAT80 rev.V44OA96A Running: gmer.exe; Driver: C:\DOCUME~1\Dido\LOCALS~1\Temp\pgliqpoc.sys ---- System - GMER 1.0.15 ---- SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwAddBootEntry [0xAA796FC4] SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwAllocateVirtualMemory [0xAA823510] SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwClose [0xAA7BA6A9] SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateEvent [0xAA799456] SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateEventPair [0xAA7994AE] SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateIoCompletion [0xAA7995C4] SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateKey [0xAA7BA05D] SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateMutant [0xAA7993AC] SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateSection [0xAA7994FE] SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateSemaphore [0xAA799400] SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateTimer [0xAA799572] SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwDeleteBootEntry [0xAA796FE8] SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwDeleteKey [0xAA7BAD6F] SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwDeleteValueKey [0xAA7BB025] SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwDuplicateObject [0xAA799848] SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwEnumerateKey [0xAA7BABDA] SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwEnumerateValueKey [0xAA7BAA45] SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwFreeVirtualMemory [0xAA8235C0] SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwLoadDriver [0xAA796DB2] SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwModifyBootEntry [0xAA79700C] SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwNotifyChangeKey [0xAA7999BC] SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwNotifyChangeMultipleKeys [0xAA797AA4] SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenEvent [0xAA799486] SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenEventPair [0xAA7994D6] SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenIoCompletion [0xAA7995EE] SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenKey [0xAA7BA3B9] SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenMutant [0xAA7993D8] SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenProcess [0xAA799680] SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenSection [0xAA79953E] SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenSemaphore [0xAA79942E] SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenThread [0xAA799764] SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenTimer [0xAA79959C] SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwProtectVirtualMemory [0xAA823658] SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwQueryKey [0xAA7BA8C0] SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwQueryObject [0xAA79796A] SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwQueryValueKey [0xAA7BA712] SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwRenameKey [0xAA82B9E6] SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwRestoreKey [0xAA7B96D0] SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwSetBootEntryOrder [0xAA797030] SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwSetBootOptions [0xAA797054] SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwSetSystemInformation [0xAA796E0C] SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwSetSystemPowerState [0xAA796F48] SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwSetValueKey [0xAA7BAE76] SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwShutdownSystem [0xAA796F24] SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwSystemDebugControl [0xAA796F6C] SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwVdmControl [0xAA797078] Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwCreateProcessEx [0xAA8377A2] Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ObInsertObject Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ObMakeTemporaryObject ---- Devices - GMER 1.0.15 ---- Device \FileSystem\Ntfs \Ntfs aswSP.SYS (avast! self protection module/AVAST Software) AttachedDevice \FileSystem\Ntfs \Ntfs aswMon2.SYS (avast! File System Filter Driver for Windows XP/AVAST Software) AttachedDevice \Driver\Tcpip \Device\Ip aswTdi.SYS (avast! TDI Filter Driver/AVAST Software) AttachedDevice \Driver\Tcpip \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/AVAST Software) AttachedDevice \Driver\Tcpip \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/AVAST Software) AttachedDevice \Driver\Tcpip \Device\RawIp aswTdi.SYS (avast! TDI Filter Driver/AVAST Software) ---- Registry - GMER 1.0.15 ---- Reg HKLM\SYSTEM\ControlSet001\Services\BTHPORT\Parameters\Keys\00158315a310 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet001\Services\BTHPORT\Parameters\Keys\00158315a310@001d28dbb016 0xFA 0x97 0x9F 0x7A ... Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\00158315a310 Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\00158315a310@001d28dbb016 0xFA 0x97 0x9F 0x7A ... Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\00158315a310@001a75307162 0xF5 0xE1 0x29 0x32 ... Reg HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\00158315a310 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\00158315a310@001d28dbb016 0xFA 0x97 0x9F 0x7A ... Reg HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\00158315a310@001a75307162 0xF5 0xE1 0x29 0x32 ... ---- EOF - GMER 1.0.15 ----

И тези логове са чисти..!

Сега,деинсталирайте Комбофикс така:

1.Натиснете Start ==> Run ==> въведете командата Combofix /Uninstall ==> OK

2.Изтеглете OTCleanIt или от тук,стартирайте и натиснете

Последна проверка и приключваме:

Изтеглете Malwarebytes' Anti-Malware или от тук

* Кликнете два пъти върху mbam-setup.exe, за да инсталирате програмата.

* Уверете се, че са поставени отметки на Update Malwarebytes' Anti-Malware и Launch Malwarebytes' Anti-Malware. След това кликнете на Finish.

* Ако има намерени обновявания, тя ще ги изтегли и инсталира.

* Стартирайте програмата и изберете "Perform Full Scan", след това кликнете на Scan.

* Сканирането ще отнеме малко време, затова моля да бъдете търпеливи.

* Когато сканирането завърши, кликнете на OK, след това Show Results, за да видите резултата.

* Уверете се, че на всички редове има отметки, и кликнете на Remove Selected.

* Когато всичко бъде премахнато, в Notepad ще бъде отворен лог. Копирайте този лог и го публикувайте в следващия си коментар по темата.

Забележка: Ако MalwareBytes' Anti-Malware се затрудни в премахването на откритите вируси/заплахи, той ще поиска да рестартира компютъра Ви и по време на рестартирането да премахне проблемните вируси/заплахи. Ако бъдете попитани, потвърдете че желаете вашия компютър да бъде рестартиран.

Изтеглете програмата: ESET Online Scanner

• Стартирайте esetsmartinstaller_enu.exe
• Сложете отметка на YES, I accept the Terms of Use и изберете Start:

  

• Скенерът ще започне да изтегля компонентите, които са му необходими:

  

• Уверете се, че има отметки на следните редове:

  

  Накрая изберете Start

• Скенерът ще започне да изтегля последните дефиниции.
• След, като сканирането завърши изберете Finish.
• Отидете в: C:\Program Files\ESET\ESET Online Scanner
• Отворете файла log.txt , копирайте съдържанието му и го поставете в следващия си коментар.

За сега проблема със замръзването изчезна (веднага след процедурата с OTCleanIt и последващият рестарт). Благодаря Ви! Ето лог-а от Malwarebytes' Anti-Malware: Malwarebytes' Anti-Malware 1.51.2.1300 www.malwarebytes.org Database version: 8292 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 02.12.2011 ?. 22:47:32 mbam-log-2011-12-02 (22-47-32).txt Scan type: Full scan (C:\|) Objects scanned: 211101 Time elapsed: 15 minute(s), 11 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)

Радвам се..! Но ви препоръчвам да направите и другото сканиране...Поздрави..!