Премини към съдържанието
Форумът в приложение

По-лесно сърфиране. Научи повече.
Kaldata.com - Форуми

Приложение на форума на цял екран с push известия, значки и други.

За да инсталирате това приложение на iOS и iPadOS
  1. Докоснете Иконата за споделяне в Safari
  2. Превъртете менюто и докоснете Добавяне към началния екран.
  3. Докоснете Добавяне в горния десен ъгъл.
За да инсталирате това приложение на Android
  1. Докоснете менюто с 3 точки (⋮) в горния десен ъгъл на браузъра.
  2. Докоснете Добавяне към началния екран или Инсталиране на приложение.
  3. Потвърдете, като докоснете Инсталиране.
Добави Kaldata.com в предпочитани източници в Google

Добре дошли!

Добре дошли в нашите форуми, пълни с полезна информация. Имате проблем с компютъра или телефона си? Публикувайте нова тема и ще намерите решение на всичките си проблеми. Общувайте свободно и открийте безброй нови приятели.

Моля, регистрирайте се за да публикувате тема и да получите пълен достъп до всички функции.

 

Заразен лаптоп

Kibik
в Премахване на зловреден софтуер

Featured Replies

Не знам с какво и от къде е заразен. ОС е Win7 Eternity, нямам диск. Забавяне не забелязвам, процесора от време на време работи безпричинно на 100%, паметта също.Тези неща виждам на CPU Usage Gadget. Имам и DU Meter- по него виждам отвреме на време безпричинен даулоуд от 50 до 600 KB/s и ъплоуд 5 до 50KB/s за минута две. Оказа се, че Restore Points са ми били изкллючени, което забелязах след проблема. Виждах някакви Backup Set файлове или имиджи(които май не ми вършат работа) с тразлични дати и това ме е заблудило, че са рестор поинтс...След това напрвих рестор поинт. Антивирусната е AVG Free. От време на време излизат 2 вида съобщения от нея, че е блокирала някакъв достъп и другото (по-често и без да работя нещо) от Resident Shield - Accessed file is infected и обикновено е някакъв dll файл в c:Windows\System32\....dll. Дадено е и името и ID на процеса, но мисля, че са най-различни. Аз кликвам на Move to Vault. За няколко дена там виждам един вирус и десетки Trojan Horse. Не виждам начин да ги покажа тука... Сканирал съм с AVG, CCleaner, Advanced SystemCare, Malwarebytes' Anti-Malware, Spybot - Search & Destroy, Spyware Doctor, TuneUp 1-Click Maintenance. Намирали са по нещо но резултата накрая е описания. Ето DDS.txt DDS (Ver_2011-09-30.01) - NTFS_x86 Internet Explorer: 9.0.8112.16421 Run by user at 20:12:34 on 2012-02-25 Microsoft® Windows 7 Eternity™ 2009 6.1.7600.0.1251.359.1033.18.1918.759 [GMT 0:00] . AV: AVG Anti-Virus *Enabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0} SP: AVG Anti-Virus *Enabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . ============== Running Processes ================ . C:\Windows\system32\wininit.exe C:\Program Files\AVG\AVG9\avgchsvx.exe C:\Program Files\AVG\AVG9\avgrsx.exe C:\Windows\system32\lsm.exe C:\Program Files\AVG\AVG9\avgcsrvx.exe C:\Program Files\USB Safely Remove\USBSRService.exe C:\Windows\system32\Ati2evxx.exe C:\Windows\System32\spoolsv.exe C:\Windows\system32\taskhost.exe C:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe C:\Program Files\AVG\AVG9\avgwdsvc.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\system32\Ati2evxx.exe C:\Program Files\DU Meter\DUMeterSvc.exe C:\ProgramData\EPSON\EPW!3 SSRP\E_S40ST7.EXE C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RP7.EXE C:\Program Files\O2Micro Flash Memory Card Driver\o2flash.exe C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\Program Files\CONEXANT\cAudioFilterAgent\cAudioFilterAgent.exe C:\Program Files\AVG\AVG9\avgtray.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Toshiba\Power Saver\TPwrMain.exe C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe C:\Program Files\AVG\AVG9\avgemc.exe C:\Program Files\Synaptics\SynTP\SynTPHelper.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Program Files\AVG\AVG9\avgam.exe C:\Program Files\AVG\AVG9\avgnsx.exe C:\Program Files\DU Meter\DUMeter.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\StickyPad\StickyPad.exe C:\Program Files\AVG\AVG9\avgcsrvx.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe C:\Windows\system32\SearchIndexer.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe C:\Program Files\AVG\AVG9\avgcsrvx.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\plugin-container.exe C:\Windows\system32\conhost.exe C:\Windows\system32\conhost.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k RPCSS C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Windows\system32\svchost.exe -k imgsvc C:\Windows\System32\svchost.exe -k LocalServicePeerNet C:\Windows\system32\svchost.exe -k WindowsMobile C:\Windows\system32\svchost.exe -k SDRSVC . ============== Pseudo HJT Report =============== . uStart Page = hxxp://www.google.co.uk/ BHO: Octh Class: {000123B4-9B42-4900-B3F7-F4B073EFC214} - c:\program files\orbitdownloader\orbitcth.dll BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: AVG Safe Search: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - c:\program files\avg\avg9\avgssie.dll BHO: Search Helper: {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: DealPly: {A6174F27-1FFF-E1D6-A93F-BA48AD5DD448} - c:\program files\dealply\DealPlyIE.dll BHO: Bing Bar BHO: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files\msn toolbar\platform\5.0.1423.0\npwinext.dll TB: Grab Pro: {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - c:\program files\orbitdownloader\GrabPro.dll TB: Grab Pro: {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - c:\program files\orbitdownloader\GrabPro.dll TB: @c:\program files\msn toolbar\platform\5.0.1423.0\npwinext.dll,-100: {8dcb7100-df86-4384-8842-8fa844297b3f} - c:\program files\msn toolbar\platform\5.0.1423.0\npwinext.dll uRun: [sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun uRun: [Welcome Center] c:\windows\system32\rundll32.exe c:\windows\system32\OobeFldr.dll,ShowWelcomeCenter LaunchedBy_StartMenuShortcut uRun: [DU Meter] c:\program files\du meter\DUMeter.exe uRun: [skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized uRun: [sticky Pad] c:\program files\stickypad\StickyPad.exe mRun: [startCCC] "c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe" MSRun mRun: [cAudioFilterAgent] c:\program files\conexant\caudiofilteragent\cAudioFilterAgent.exe mRun: [AVG9_TRAY] c:\progra~1\avg\avg9\avgtray.exe mRun: [synTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe mRun: [TPwrMain] c:\program files\toshiba\power saver\TPwrMain.EXE mRun: [HSON] c:\program files\toshiba\tbs\HSON.exe dRun: [Welcome Center] c:\windows\system32\rundll32.exe c:\windows\system32\OobeFldr.dll,ShowWelcomeCenter LaunchedBy_StartMenuShortcut dRun: [sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun dRunOnce: [FlashPlayerUpdate] c:\windows\system32\macromed\flash\FlashUtil10b.exe uPolicies-Explorer: NoResolveTrack = dword:1 uPolicies-Explorer: NoDriveTypeAutoRun = dword:145 uPolicies-Explorer: NoSMBalloonTip = dword:1 mPolicies-System: ConsentPromptBehaviorAdmin = dword:0 mPolicies-System: ConsentPromptBehaviorUser = dword:0 mPolicies-System: EnableLUA = dword:0 mPolicies-System: EnableUIADesktopToggle = dword:0 mPolicies-System: PromptOnSecureDesktop = dword:0 mPolicies-Explorer: NoResolveTrack = dword:1 mPolicies-Explorer: NoDriveTypeAutoRun = dword:145 mPolicies-Explorer: NoSMBalloonTip = dword:1 IE: &Download by Orbit - c:\program files\orbitdownloader\orbitmxt.dll/201 IE: &Grab video by Orbit - c:\program files\orbitdownloader\orbitmxt.dll/204 IE: Do&wnload selected by Orbit - c:\program files\orbitdownloader\orbitmxt.dll/203 IE: Down&load all by Orbit - c:\program files\orbitdownloader\orbitmxt.dll/202 IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000 IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office12\ONBttnIE.dll IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\windows\windowsmobile\INetRepl.dll IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\windows\windowsmobile\INetRepl.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} LSP: mswsock.dll . INFO: HKCU has more than 50 listed domains. If you wish to scan all of them, select the 'Force scan all domains' option. . TCP: NameServer = 192.168.1.254 TCP: Interfaces\{0E274011-6A2A-45A3-9209-228241F04437} : DHCPNameServer = 192.168.1.254 TCP: Interfaces\{B589127D-B22B-48FA-A96B-752382F8290D} : DHCPNameServer = 192.168.1.254 Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg9\avgpp.dll Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\program files\common files\skype\Skype4COM.dll SSODL: WebCheck - <orphaned> SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll LSA: Security Packages = kerberos msv1_0 schannel wdigest tspkg pku2u livessp . ================= FIREFOX =================== . FF - ProfilePath - c:\users\user\appdata\roaming\mozilla\firefox\profiles\2zame245.default\ FF - prefs.js: browser.search.defaulturl - hxxp://www.bing.com/search?FORM=DCF3DF&PC=DCF3&q= FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - www.google.co.uk FF - prefs.js: keyword.URL - hxxp://www.bing.com/search?FORM=DCF3DF&PC=DCF3&q= FF - prefs.js: network.proxy.http - 84.22.23.6 FF - prefs.js: network.proxy.http_port - 8080 FF - prefs.js: network.proxy.type - 0 FF - component: c:\program files\avg\avg9\firefox\components\avgssff.dll FF - component: c:\program files\mozilla firefox\extensions\{82af8dca-6de9-405d-bd5e-43525bdad38a}\components\SkypeFfComponent.dll FF - plugin: c:\program files\adobe\reader 9.0\reader\air\nppdf32.dll FF - plugin: c:\program files\google\update\1.3.21.99\npGoogleUpdate3.dll FF - plugin: c:\program files\k-lite codec pack\real\browser\plugins\nppl3260.dll FF - plugin: c:\program files\k-lite codec pack\real\browser\plugins\nprpjplug.dll FF - plugin: c:\program files\microsoft silverlight\4.1.10111.0\npctrlui.dll FF - plugin: c:\program files\msn toolbar\platform\5.0.1423.0\npwinext.dll . ============= SERVICES / DRIVERS =============== . R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [2010-10-4 52872] R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2010-10-4 216400] R1 AvgMfx86;AVG On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2010-10-4 29712] R1 AvgTdiX;AVG Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2010-10-4 243152] R1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\drivers\vwififlt.sys [2009-7-13 48128] R2 avg9emc;AVG E-mail Scanner;c:\program files\avg\avg9\avgemc.exe [2010-10-6 921952] R2 avg9wd;AVG WatchDog;c:\program files\avg\avg9\avgwdsvc.exe [2010-10-6 308136] R2 DUMeterSvc;DU Meter Service;c:\program files\du meter\DUMeterSvc.exe [2011-10-30 1382672] R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files\tuneup utilities 2010\TuneUpUtilitiesService32.exe [2010-2-25 1047880] R2 USBSafelyRemoveService;USB Safely Remove Assistant;c:\program files\usb safely remove\USBSRService.exe [2011-2-9 261456] R3 CnxtHdmiAudService;Conexant UAA HDMI Function Driver for High Definition Audio Service;c:\windows\system32\drivers\CHDMI32.sys [2009-6-23 487936] R3 O2MDRDR;O2MDRDR;c:\windows\system32\drivers\o2media.sys [2008-3-4 48600] R3 QIOMem;Generic IO & Memory Access;c:\windows\system32\drivers\QIOMem.sys [2007-4-9 8192] R3 RTL8187B;Realtek RTL8187B Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\drivers\RTL8187B.sys [2010-3-31 379904] R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\drivers\VSTAZL3.SYS [2009-7-13 207360] R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\drivers\VSTDPV3.SYS [2009-7-13 980992] R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\drivers\VSTCNXT3.SYS [2009-7-13 661504] R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\tuneup utilities 2010\TuneUpUtilitiesDriver32.sys [2010-2-25 10064] R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\drivers\yk62x86.sys [2009-7-13 311296] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 DMUSBUSBDCam;Btwrchid;c:\windows\system32\svchost.exe -k netsvcs [2009-7-13 20992] S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-10-6 136176] S2 LMIRfsClientNP;Tifm21;c:\windows\system32\svchost.exe -k netsvcs [2009-7-13 20992] S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888] S3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys [2012-2-4 14216] S3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys [2012-2-4 8456] S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-10-6 136176] S3 IKFileSec;File Security Driver;c:\windows\system32\drivers\ikfilesec.sys [2011-2-13 42376] S3 IKSysFlt;System Filter Driver;c:\windows\system32\drivers\iksysflt.sys [2011-2-13 66952] S3 IKSysSec;System Security Driver;c:\windows\system32\drivers\iksyssec.sys [2011-2-13 81288] S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\mcafee security scan\2.0.181\McCHSvc.exe [2010-1-15 227232] S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [2011-8-17 137472] S3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [2011-8-17 8576] S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\spyware doctor\pctsAuxs.exe [2011-2-13 356920] S3 sdCoreService;PC Tools Security Service;c:\program files\spyware doctor\pctsSvc.exe [2011-2-13 1072008] S3 WatAdminSvc;WatAdminSvc;c:\windows\system32\wat\WatAdminSvc.exe [2011-11-2 1343400] . =============== Created Last 30 ================ . 2012-02-22 23:01:11 -------- d-----w- c:\users\user\appdata\roaming\AVG9 2012-02-21 00:14:09 -------- d-----w- c:\program files\LopeSoft 2012-02-21 00:03:24 -------- d-----w- c:\program files\PC Magazine Utilities 2012-02-20 23:10:19 -------- d-----w- c:\program files\NirSoft 2012-02-18 23:32:40 -------- d-----w- c:\program files\WinPcap 2012-02-18 23:17:39 0 --sha-w- c:\windows\system32\dds_trash_log.cmd 2012-02-15 17:41:43 -------- d-----w- C:\e64a0c4b528f8264dfe36f93064430 2012-02-15 17:35:13 690688 ----a-w- c:\windows\system32\msvcrt.dll 2012-02-15 17:34:58 2340864 ----a-w- c:\windows\system32\win32k.sys 2012-02-10 00:10:27 -------- d-----w- c:\program files\Fortop Digital 2012-02-10 00:07:56 -------- d-----w- c:\program files\DealPly 2012-02-04 12:56:47 86408 ----a-w- c:\windows\system32\setupempdrv03.exe 2012-02-04 12:56:47 8456 ----a-w- c:\windows\system32\EuGdiDrv.sys 2012-02-04 12:56:47 2469760 ----a-w- c:\windows\system32\BootMan.exe 2012-02-04 12:56:47 19840 ----a-w- c:\windows\system32\EuEpmGdi.dll 2012-02-04 12:56:47 14216 ----a-w- c:\windows\system32\epmntdrv.sys 2012-02-04 12:56:41 -------- d-----w- c:\program files\EASEUS . ==================== Find3M ==================== . 2012-01-06 17:42:12 20480 ----a-w- c:\windows\system32\EclipseUpdateSpawn.exe . ============= FINISH: 20:13:43.90 =============== Ето и attach.txt: . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2011-09-30.01) . Microsoft® Windows 7 Eternity™ 2009 Boot Device: \Device\HarddiskVolume1 Install Date: 04/10/2010 11:42:47 System Uptime: 25/02/2012 19:27:13 (1 hours ago) . Motherboard: TOSHIBA | | EQUIUM A300D Processor: AMD Turion™ 64 X2 Mobile Technology TL-60 | Socket M2/S1G1 | 2000/200mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 39 GiB total, 14.311 GiB free. D: is FIXED (NTFS) - 147 GiB total, 36.833 GiB free. E: is CDROM () . ==== Disabled Device Manager Items ============= . ==== System Restore Points =================== . RP168: 22/02/2012 20:05:21 - Point of wednesday . ==== Installed Programs ====================== . Update for Microsoft Office 2007 (KB2508958) µTorrent 7-Zip 4.65 Adobe AIR Adobe Flash Player 10 ActiveX Adobe Flash Player 11 Plugin Adobe Reader 9.5.0 Advanced SystemCare 3 ATI Catalyst Install Manager AVG 9.0 Bigasoft Total Video Converter 1.7.10.3689 Bing Bar Bing Bar Platform Camera Assistant Software for Toshiba Catalyst Control Center - Branding Catalyst Control Center Core Implementation Catalyst Control Center Graphics Full Existing Catalyst Control Center Graphics Full New Catalyst Control Center Graphics Light Catalyst Control Center Graphics Previews Vista Catalyst Control Center InstallProxy Catalyst Control Center Localization All ccc-core-static ccc-utility CCC Help Chinese Standard CCC Help Chinese Traditional CCC Help Czech CCC Help Danish CCC Help Dutch CCC Help English CCC Help Finnish CCC Help French CCC Help German CCC Help Greek CCC Help Hungarian CCC Help Italian CCC Help Japanese CCC Help Korean CCC Help Norwegian CCC Help Polish CCC Help Portuguese CCC Help Russian CCC Help Spanish CCC Help Swedish CCC Help Thai CCC Help Turkish CCleaner 2.13.720 Conexant Audio Driver For AMD HDMI Codec Conexant HD Audio ContextEdit (PC Magazine) DealPly Digimax V DU Meter EASEUS Partition Master 9.1.0 Home Edition EPSON Scan EPSON SX100 Series Printer Uninstall FileMenu Tools Google Chrome Google Update Helper ImgBurn K-Lite Mega Codec Pack 4.1.4 Malwarebytes' Anti-Malware McAfee Security Scan Plus Media Player Classic - Home Cinema v1.5.2.3456 Microsoft .NET Framework 4 Client Profile Microsoft Default Manager Microsoft Office Access MUI (English) 2007 Microsoft Office Access Setup Metadata MUI (English) 2007 Microsoft Office Enterprise 2007 Microsoft Office Excel MUI (English) 2007 Microsoft Office Groove MUI (English) 2007 Microsoft Office Groove Setup Metadata MUI (English) 2007 Microsoft Office IME (Chinese (Simplified)) 2007 Microsoft Office IME (Chinese (Traditional)) 2007 Microsoft Office IME (Japanese) 2007 Microsoft Office IME (Korean) 2007 Microsoft Office InfoPath MUI (English) 2007 Microsoft Office OneNote MUI (English) 2007 Microsoft Office Outlook MUI (English) 2007 Microsoft Office PowerPoint MUI (English) 2007 Microsoft Office Proof (Arabic) 2007 Microsoft Office Proof (Basque) 2007 Microsoft Office Proof (Bulgarian) 2007 Microsoft Office Proof (Catalan) 2007 Microsoft Office Proof (Chinese (Simplified)) 2007 Microsoft Office Proof (Chinese (Traditional)) 2007 Microsoft Office Proof (Croatian) 2007 Microsoft Office Proof (Czech) 2007 Microsoft Office Proof (Danish) 2007 Microsoft Office Proof (Dutch) 2007 Microsoft Office Proof (English) 2007 Microsoft Office Proof (Estonian) 2007 Microsoft Office Proof (Finnish) 2007 Microsoft Office Proof (French) 2007 Microsoft Office Proof (Galician) 2007 Microsoft Office Proof (German) 2007 Microsoft Office Proof (Greek) 2007 Microsoft Office Proof (Gujarati) 2007 Microsoft Office Proof (Hebrew) 2007 Microsoft Office Proof (Hindi) 2007 Microsoft Office Proof (Hungarian) 2007 Microsoft Office Proof (Italian) 2007 Microsoft Office Proof (Japanese) 2007 Microsoft Office Proof (Kannada) 2007 Microsoft Office Proof (Korean) 2007 Microsoft Office Proof (Latvian) 2007 Microsoft Office Proof (Lithuanian) 2007 Microsoft Office Proof (Marathi) 2007 Microsoft Office Proof (Norwegian (Bokmal)) 2007 Microsoft Office Proof (Norwegian (Nynorsk)) 2007 Microsoft Office Proof (Polish) 2007 Microsoft Office Proof (Portuguese (Brazil)) 2007 Microsoft Office Proof (Portuguese (Portugal)) 2007 Microsoft Office Proof (Punjabi) 2007 Microsoft Office Proof (Romanian) 2007 Microsoft Office Proof (Russian) 2007 Microsoft Office Proof (Serbian (Latin)) 2007 Microsoft Office Proof (Slovak) 2007 Microsoft Office Proof (Slovenian) 2007 Microsoft Office Proof (Spanish) 2007 Microsoft Office Proof (Swedish) 2007 Microsoft Office Proof (Tamil) 2007 Microsoft Office Proof (Telugu) 2007 Microsoft Office Proof (Thai) 2007 Microsoft Office Proof (Turkish) 2007 Microsoft Office Proof (Ukrainian) 2007 Microsoft Office Proof (Urdu) 2007 Microsoft Office Proofing (English) 2007 Microsoft Office Proofing Kit 2007 Microsoft Office Proofing Tools Kit 2007 Microsoft Office ProofMUI (English) 2007 Microsoft Office Publisher MUI (English) 2007 Microsoft Office Shared MUI (English) 2007 Microsoft Office Shared Setup Metadata MUI (English) 2007 Microsoft Office Word MUI (English) 2007 Microsoft Search Enhancement Pack Microsoft Silverlight Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 Microsoft_VC100_CRT_SP1_x86 Mozilla Firefox 10.0.2 (x86 en-US) MSVC80_x86 MSVC80_x86_v2 MSVC90_x86 MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) MSXML 4.0 SP3 Parser MSXML 4.0 SP3 Parser (KB973685) NirSoft ShellExView Nokia Connectivity Cable Driver Nokia Software Updater Nokia Suite Notepad++ O2Micro Flash Memory Card Reader Driver (x86) Orbit Downloader PC Connectivity Solution ScanMaster-ELM 2.1.104.771 ScanTool.net for Windows v1.13 Security Update for 2007 Microsoft Office System (KB951550) Security Update for 2007 Microsoft Office System (KB951944) Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708) Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663) Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636) Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078) Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351) Security Update for Microsoft Office OneNote 2007 (KB950130) Security Update for Microsoft Office Word 2007 (KB956358) Skins Skype™ 4.2 Spybot - Search & Destroy Spyware Doctor 6.0 StickyPad Synaptics Pointing Device Driver TOSHIBA Hardware Setup TOSHIBA Value Added Package TuneUp Utilities TuneUp Utilities Language Pack (en-GB) Unlocker 1.9.0 Update for 2007 Microsoft Office System (KB967642) Update for Microsoft Office 2007 suites (KB2597998) 32-Bit Edition Update for Office 2007 (KB932080) Update for Office 2007 (KB934393) USB Safely Remove 4.2 Win7 Shared Folder Icon 1.0 Windows Driver Package - Chicony (usbvideo) Image (05/12/2009 6.3.251.0512) Windows Driver Package - Nokia pccsmcfd (08/22/2008 7.0.0.0) Windows Live ID Sign-in Assistant Windows Mobile Device Center Windows Mobile Device Center Driver Update WinPcap 4.1.2 WinRAR archiver . ==== Event Viewer Messages From Past Week ======== . 25/02/2012 19:59:47, Error: Service Control Manager [7023] - The DellAMBrokerService service terminated with the following error: Access is denied. 25/02/2012 19:44:47, Error: Service Control Manager [7023] - The Eeyeevnt service terminated with the following error: Access is denied. 25/02/2012 19:29:47, Error: Service Control Manager [7023] - The Tavsvc service terminated with the following error: Access is denied. 25/02/2012 19:28:48, Error: Service Control Manager [7023] - The SNMP service terminated with the following error: Access is denied. 25/02/2012 19:28:13, Error: Service Control Manager [7024] - The HomeGroup Listener service terminated with service-specific error %%-2147023143. 25/02/2012 19:28:01, Error: Microsoft-Windows-WHEA-Logger [18] - A fatal hardware error has occurred. Reported by component: Processor Core Error Source: Machine Check Exception Error Type: Unknown Error Processor ID: 1 The details view of this entry contains further information. 25/02/2012 19:28:01, Error: Microsoft-Windows-WHEA-Logger [18] - A fatal hardware error has occurred. Reported by component: Processor Core Error Source: Machine Check Exception Error Type: Memory Controller Error Processor ID: 1 The details view of this entry contains further information. 25/02/2012 19:28:01, Error: Microsoft-Windows-WHEA-Logger [18] - A fatal hardware error has occurred. Reported by component: Processor Core Error Source: Machine Check Exception Error Type: Cache Hierarchy Error Processor ID: 1 The details view of this entry contains further information. 25/02/2012 19:27:53, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 25/02/2012 19:27:52, Error: Service Control Manager [7023] - The Vvoice service terminated with the following error: The specified module could not be found. 25/02/2012 19:27:52, Error: Service Control Manager [7023] - The PGPdisk service terminated with the following error: The specified module could not be found. 25/02/2012 19:27:52, Error: Service Control Manager [7023] - The PBADRV service terminated with the following error: The specified module could not be found. 25/02/2012 19:27:52, Error: Service Control Manager [7023] - The Nvatabus service terminated with the following error: The specified module could not be found. 25/02/2012 19:27:52, Error: Service Control Manager [7023] - The M2500 service terminated with the following error: The specified module could not be found. 25/02/2012 19:27:52, Error: Service Control Manager [7023] - The Iaimfp2 service terminated with the following error: The specified module could not be found. 25/02/2012 19:27:52, Error: Service Control Manager [7023] - The GV600_4 service terminated with the following error: The specified module could not be found. 25/02/2012 19:27:52, Error: Service Control Manager [7023] - The GT680x service terminated with the following error: The specified module could not be found. 25/02/2012 19:27:52, Error: Service Control Manager [7023] - The Cusrvc service terminated with the following error: The specified module could not be found. 25/02/2012 19:27:52, Error: Service Control Manager [7023] - The Apphostsvc service terminated with the following error: The specified module could not be found. 25/02/2012 19:27:51, Error: Service Control Manager [7023] - The Niorbk service terminated with the following error: The specified module could not be found. 25/02/2012 19:27:51, Error: Service Control Manager [7023] - The ESMCR service terminated with the following error: The specified module could not be found. 25/02/2012 19:27:51, Error: Service Control Manager [7023] - The Bocdrive service terminated with the following error: The specified module could not be found. 25/02/2012 19:27:51, Error: Service Control Manager [7023] - The Bh611 service terminated with the following error: The specified module could not be found. 25/02/2012 19:27:51, Error: Service Control Manager [7023] - The Atixsaudio service terminated with the following error: The specified module could not be found. 25/02/2012 19:27:51, Error: Service Control Manager [7023] - The Acrsch2svc service terminated with the following error: The specified module could not be found. 25/02/2012 19:27:49, Error: Service Control Manager [7023] - The WmBEnum service terminated with the following error: The specified module could not be found. 25/02/2012 19:27:49, Error: Service Control Manager [7023] - The Webrootadminconsole service terminated with the following error: The specified module could not be found. 25/02/2012 19:27:49, Error: Service Control Manager [7023] - The Vmnetdhcp service terminated with the following error: The specified module could not be found. 25/02/2012 19:27:49, Error: Service Control Manager [7023] - The Tifm21 service terminated with the following error: The specified module could not be found. 25/02/2012 19:27:49, Error: Service Control Manager [7023] - The ScsiPort service terminated with the following error: The specified module could not be found. 25/02/2012 19:27:49, Error: Service Control Manager [7023] - The Prevxagent service terminated with the following error: The specified module could not be found. 25/02/2012 19:27:49, Error: Service Control Manager [7023] - The NsTrcNT service terminated with the following error: The specified module could not be found. 25/02/2012 19:27:49, Error: Service Control Manager [7023] - The Ndiscm service terminated with the following error: The specified module could not be found. 25/02/2012 19:27:49, Error: Service Control Manager [7023] - The Mctaskmanager service terminated with the following error: The specified module could not be found. 25/02/2012 19:27:49, Error: Service Control Manager [7023] - The Mafwboot service terminated with the following error: The specified module could not be found. 25/02/2012 19:27:49, Error: Service Control Manager [7023] - The Lvtuner service terminated with the following error: The specified module could not be found. 25/02/2012 19:27:49, Error: Service Control Manager [7023] - The LHidKe service terminated with the following error: The specified module could not be found. 25/02/2012 19:27:49, Error: Service Control Manager [7023] - The K750bus service terminated with the following error: The specified module could not be found. 25/02/2012 19:27:49, Error: Service Control Manager [7023] - The JGOGO service terminated with the following error: The specified module could not be found. 25/02/2012 19:27:49, Error: Service Control Manager [7023] - The Iwebcal service terminated with the following error: The specified module could not be found. 25/02/2012 19:27:49, Error: Service Control Manager [7023] - The Iaimtv1 service terminated with the following error: The specified module could not be found. 25/02/2012 19:27:49, Error: Service Control Manager [7023] - The Fcprintservice service terminated with the following error: The specified module could not be found. 25/02/2012 19:27:49, Error: Service Control Manager [7023] - The Epiusb service terminated with the following error: The specified module could not be found. 25/02/2012 19:27:49, Error: Service Control Manager [7023] - The EMSCR service terminated with the following error: The specified module could not be found. 25/02/2012 19:27:49, Error: Service Control Manager [7023] - The Dxdebug service terminated with the following error: The specified module could not be found. 25/02/2012 19:27:49, Error: Service Control Manager [7023] - The DC21x4 service terminated with the following error: The specified module could not be found. 25/02/2012 19:27:49, Error: Service Control Manager [7023] - The Cyberpowerups service terminated with the following error: The specified module could not be found. 25/02/2012 19:27:49, Error: Service Control Manager [7023] - The Cxpt_service service terminated with the following error: The specified module could not be found. 25/02/2012 19:27:49, Error: Service Control Manager [7023] - The ClntMgmt.sys service terminated with the following error: The specified module could not be found. 25/02/2012 19:27:49, Error: Service Control Manager [7023] - The Cfsvcs service terminated with the following error: The specified module could not be found. 25/02/2012 19:27:49, Error: Service Control Manager [7023] - The Centennialiptransferagent service terminated with the following error: The specified module could not be found. 25/02/2012 19:27:49, Error: Service Control Manager [7023] - The Btwrchid service terminated with the following error: The specified module could not be found. 25/02/2012 19:27:49, Error: Service Control Manager [7023] - The Backupexecagentbrowser service terminated with the following error: The specified module could not be found. 25/02/2012 19:27:49, Error: Service Control Manager [7023] - The Allegro service terminated with the following error: The specified module could not be found. 25/02/2012 19:27:49, Error: Service Control Manager [7023] - The Akshasp service terminated with the following error: The specified module could not be found. 25/02/2012 19:27:49, Error: Service Control Manager [7023] - The 6to4 service terminated with the following error: The specified module could not be found. 25/02/2012 19:27:48, Error: Service Control Manager [7023] - The ZTEusbmdm6k service terminated with the following error: The specified module could not be found. 25/02/2012 19:27:48, Error: Service Control Manager [7023] - The Stltrk2k service terminated with the following error: The specified module could not be found. 25/02/2012 19:27:48, Error: Service Control Manager [7023] - The Srvdpi service terminated with the following error: The specified module could not be found. 25/02/2012 19:27:48, Error: Service Control Manager [7023] - The Sfhlp01 service terminated with the following error: The specified module could not be found. 25/02/2012 19:27:48, Error: Service Control Manager [7023] - The Senfilt service terminated with the following error: The specified module could not be found. 25/02/2012 19:27:48, Error: Service Control Manager [7023] - The S7otranx service terminated with the following error: The specified module could not be found. 25/02/2012 19:27:48, Error: Service Control Manager [7023] - The Rasirda service terminated with the following error: The specified module could not be found. 25/02/2012 19:27:48, Error: Service Control Manager [7023] - The Qcdonner service terminated with the following error: The specified module could not be found. 25/02/2012 19:27:48, Error: Service Control Manager [7023] - The Persfw service terminated with the following error: The specified module could not be found. 25/02/2012 19:27:48, Error: Service Control Manager [7023] - The Noipducservice service terminated with the following error: The specified module could not be found. 25/02/2012 19:27:48, Error: Service Control Manager [7023] - The Nipsvc service terminated with the following error: The specified module could not be found. 25/02/2012 19:27:48, Error: Service Control Manager [7023] - The Netmnt service terminated with the following error: The specified module could not be found. 25/02/2012 19:27:48, Error: Service Control Manager [7023] - The Mtlmnt5 service terminated with the following error: The specified module could not be found. 25/02/2012 19:27:48, Error: Service Control Manager [7023] - The MSICPL service terminated with the following error: The specified module could not be found. 25/02/2012 19:27:48, Error: Service Control Manager [7023] - The Kodakccs service terminated with the following error: The specified module could not be found. 25/02/2012 19:27:48, Error: Service Control Manager [7023] - The ISMBIOS service terminated with the following error: The specified module could not be found. 25/02/2012 19:27:48, Error: Service Control Manager [7023] - The HcwPVRP2 service terminated with the following error: The specified module could not be found. 25/02/2012 19:27:48, Error: Service Control Manager [7023] - The FETNDIS service terminated with the following error: The specified module could not be found. 25/02/2012 19:27:48, Error: Service Control Manager [7023] - The EpmPsd service terminated with the following error: The specified module could not be found. 25/02/2012 19:27:48, Error: Service Control Manager [7023] - The DsNcAdpt service terminated with the following error: The specified module could not be found. 25/02/2012 19:27:48, Error: Service Control Manager [7023] - The Ccdecode service terminated with the following error: Access is denied. 25/02/2012 19:27:48, Error: Service Control Manager [7023] - The ATIBTXBAR service terminated with the following error: The specified module could not be found. 25/02/2012 19:27:48, Error: Service Control Manager [7023] - The Ami0nt service terminated with the following error: The specified module could not be found. 25/02/2012 19:27:48, Error: Service Control Manager [7023] - The AEADIFilters service terminated with the following error: The specified module could not be found. 25/02/2012 19:27:41, Error: volmgr [46] - Crash dump initialization failed! 25/02/2012 15:44:23, Error: Service Control Manager [7023] - The ESMCR service terminated with the following error: Access is denied. 25/02/2012 15:14:55, Error: Service Control Manager [7023] - The S7otranx service terminated with the following error: Access is denied. 25/02/2012 14:59:55, Error: Service Control Manager [7023] - The EMSCR service terminated with the following error: Access is denied. 25/02/2012 14:44:55, Error: Service Control Manager [7023] - The Ami0nt service terminated with the following error: Access is denied. 25/02/2012 14:29:55, Error: Service Control Manager [7023] - The ClntMgmt.sys service terminated with the following error: Access is denied. 25/02/2012 14:16:07, Error: Microsoft-Windows-DistributedCOM [10001] - Unable to start a DCOM Server: {F87B28F1-DA9A-4F35-8EC0-800EFCF26B83} as /. The error: "5" Happened while starting this command: C:\Windows\System32\slui.exe -Embedding 25/02/2012 14:14:55, Error: Service Control Manager [7023] - The Fcprintservice service terminated with the following error: Access is denied. 25/02/2012 14:13:56, Error: Service Control Manager [7023] - The Qcdonner service terminated with the following error: Access is denied. 25/02/2012 10:58:40, Error: Service Control Manager [7023] - The Bocdrive service terminated with the following error: Access is denied. 25/02/2012 10:43:40, Error: Service Control Manager [7023] - The DC21x4 service terminated with the following error: Access is denied. 25/02/2012 10:28:41, Error: Service Control Manager [7023] - The Prevxagent service terminated with the following error: Access is denied. 25/02/2012 10:13:41, Error: Service Control Manager [7023] - The Iaimtv1 service terminated with the following error: Access is denied. 25/02/2012 10:12:41, Error: Service Control Manager [7023] - The ATIBTXBAR service terminated with the following error: Access is denied. 24/02/2012 23:21:38, Error: Service Control Manager [7023] - The Atixsaudio service terminated with the following error: Access is denied. 24/02/2012 23:06:38, Error: Service Control Manager [7023] - The MSICPL service terminated with the following error: Access is denied. 24/02/2012 22:51:37, Error: Service Control Manager [7023] - The Webrootadminconsole service terminated with the following error: Access is denied. 24/02/2012 22:36:38, Error: Service Control Manager [7023] - The Senfilt service terminated with the following error: Access is denied. 24/02/2012 22:21:37, Error: Service Control Manager [7023] - The Nipsvc service terminated with the following error: Access is denied. 24/02/2012 22:06:37, Error: Service Control Manager [7023] - The AEADIFilters service terminated with the following error: Access is denied. 24/02/2012 21:51:38, Error: Service Control Manager [7023] - The Cusrvc service terminated with the following error: Access is denied. 24/02/2012 21:36:38, Error: Service Control Manager [7023] - The ISMBIOS service terminated with the following error: Access is denied. 24/02/2012 21:21:37, Error: Service Control Manager [7023] - The K750bus service terminated with the following error: Access is denied. 24/02/2012 21:06:38, Error: Service Control Manager [7023] - The GV600_4 service terminated with the following error: Access is denied. 24/02/2012 20:51:38, Error: Service Control Manager [7023] - The Mafwboot service terminated with the following error: Access is denied. 24/02/2012 20:36:38, Error: Service Control Manager [7023] - The Cyberpowerups service terminated with the following error: Access is denied. 24/02/2012 20:21:38, Error: Service Control Manager [7023] - The PGPdisk service terminated with the following error: Access is denied. 24/02/2012 20:06:38, Error: Service Control Manager [7023] - The WmBEnum service terminated with the following error: Access is denied. 24/02/2012 20:05:38, Error: Service Control Manager [7023] - The Niorbk service terminated with the following error: Access is denied. 24/02/2012 18:28:29, Error: Schannel [36888] - The following fatal alert was generated: 10. The internal error state is 10. 24/02/2012 18:21:36, Error: Service Control Manager [7023] - The Ndiscm service terminated with the following error: Access is denied. 24/02/2012 18:06:36, Error: Service Control Manager [7023] - The Noipducservice service terminated with the following error: Access is denied. 24/02/2012 17:51:36, Error: Service Control Manager [7023] - The Rasirda service terminated with the following error: Access is denied. 24/02/2012 17:36:36, Error: Service Control Manager [7023] - The Acrsch2svc service terminated with the following error: Access is denied. 24/02/2012 17:35:37, Error: Service Control Manager [7023] - The Vvoice service terminated with the following error: Access is denied. 23/02/2012 23:51:50, Error: Service Control Manager [7023] - The Iaimfp2 service terminated with the following error: Access is denied. 23/02/2012 23:39:03, Error: Service Control Manager [7023] - The SPP Notification Service service terminated with the following error: Access is denied. 23/02/2012 23:36:50, Error: Service Control Manager [7023] - The Iwebcal service terminated with the following error: Access is denied. 23/02/2012 23:21:50, Error: Service Control Manager [7023] - The Netmnt service terminated with the following error: Access is denied. 23/02/2012 23:06:50, Error: Service Control Manager [7023] - The Backupexecagentbrowser service terminated with the following error: Access is denied. 23/02/2012 22:51:50, Error: Service Control Manager [7023] - The Akshasp service terminated with the following error: Access is denied. 23/02/2012 22:36:50, Error: Service Control Manager [7023] - The LHidKe service terminated with the following error: Access is denied. 23/02/2012 22:21:50, Error: Service Control Manager [7023] - The 6to4 service terminated with the following error: Access is denied. 23/02/2012 22:06:50, Error: Service Control Manager [7023] - The Btwrchid service terminated with the following error: Access is denied. 23/02/2012 21:51:50, Error: Service Control Manager [7023] - The Centennialiptransferagent service terminated with the following error: Access is denied. 23/02/2012 21:36:50, Error: Service Control Manager [7023] - The Vmnetdhcp service terminated with the following error: Access is denied. 23/02/2012 21:21:50, Error: Service Control Manager [7023] - The Lvtuner service terminated with the following error: Access is denied. 23/02/2012 21:06:50, Error: Service Control Manager [7023] - The DsNcAdpt service terminated with the following error: Access is denied. 23/02/2012 20:51:50, Error: Service Control Manager [7023] - The Kodakccs service terminated with the following error: Access is denied. 23/02/2012 20:36:50, Error: Service Control Manager [7023] - The Stltrk2k service terminated with the following error: Access is denied. 23/02/2012 20:21:50, Error: Service Control Manager [7023] - The Mtlmnt5 service terminated with the following error: Access is denied. 23/02/2012 20:06:51, Error: Service Control Manager [7023] - The HcwPVRP2 service terminated with the following error: Access is denied. 23/02/2012 19:51:50, Error: Service Control Manager [7023] - The Nvatabus service terminated with the following error: Access is denied. 23/02/2012 19:50:21, Error: Service Control Manager [7034] - The TuneUp Utilities Service service terminated unexpectedly. It has done this 1 time(s). 23/02/2012 19:36:50, Error: Service Control Manager [7023] - The GT680x service terminated with the following error: Access is denied. 23/02/2012 19:21:50, Error: Service Control Manager [7023] - The ScsiPort service terminated with the following error: Access is denied. 23/02/2012 19:06:50, Error: Service Control Manager [7023] - The Srvdpi service terminated with the following error: Access is denied. 23/02/2012 18:51:50, Error: Service Control Manager [7023] - The Allegro service terminated with the following error: Access is denied. 23/02/2012 18:36:50, Error: Service Control Manager [7023] - The NsTrcNT service terminated with the following error: Access is denied. 23/02/2012 18:21:50, Error: Service Control Manager [7023] - The Bh611 service terminated with the following error: Access is denied. 23/02/2012 18:06:50, Error: Service Control Manager [7023] - The Cxpt_service service terminated with the following error: Access is denied. 23/02/2012 18:05:51, Error: Service Control Manager [7023] - The Apphostsvc service terminated with the following error: Access is denied. 22/02/2012 23:22:11, Error: Service Control Manager [7023] - The PBADRV service terminated with the following error: Access is denied. 22/02/2012 23:07:11, Error: Service Control Manager [7023] - The EpmPsd service terminated with the following error: Access is denied. 22/02/2012 22:52:11, Error: Service Control Manager [7023] - The Dxdebug service terminated with the following error: Access is denied. 22/02/2012 22:37:11, Error: Service Control Manager [7023] - The Sfhlp01 service terminated with the following error: Access is denied. 22/02/2012 22:22:11, Error: Service Control Manager [7023] - The ZTEusbmdm6k service terminated with the following error: Access is denied. 22/02/2012 22:07:11, Error: Service Control Manager [7023] - The Mctaskmanager service terminated with the following error: Access is denied. 22/02/2012 21:52:11, Error: Service Control Manager [7023] - The FETNDIS service terminated with the following error: Access is denied. 22/02/2012 21:37:11, Error: Service Control Manager [7023] - The Epiusb service terminated with the following error: Access is denied. 22/02/2012 21:22:11, Error: Service Control Manager [7023] - The JGOGO service terminated with the following error: Access is denied. 22/02/2012 21:07:11, Error: Service Control Manager [7023] - The Persfw service terminated with the following error: Access is denied. 22/02/2012 20:52:11, Error: Service Control Manager [7023] - The Cfsvcs service terminated with the following error: Access is denied. 22/02/2012 20:37:11, Error: Service Control Manager [7023] - The Tifm21 service terminated with the following error: Access is denied. 22/02/2012 20:36:13, Error: Service Control Manager [7023] - The M2500 service terminated with the following error: Access is denied. 22/02/2012 01:38:48, Error: Service Control Manager [7034] - The PC Tools Security Service service terminated unexpectedly. It has done this 1 time(s). 20/02/2012 18:20:06, Error: Service Control Manager [7034] - The AMService service terminated unexpectedly. It has done this 1 time(s). 19/02/2012 14:22:51, Error: Service Control Manager [7030] - The AMService service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly. . ==== End Of File ===========================

Редактирано от Kibik (преглед на промените)

  • Отговори 69
  • Прегледи 11,1k
  • Създадено
  • Последен отговор

Здравейте! Това, което предоставяте като информация е доста обезпокоително, затова бих искал да видя какво точно открива AVG. Моля, следвайте тези инструкции: http://forums.avg.com/ww-en/avg-forums?sec=thread&act=show&id=86493

  • Автор

Здравейте!

Това, което предоставяте като информация е доста обезпокоително, затова бих искал да видя какво точно открива AVG. Моля, следвайте тези инструкции:

http://forums.avg.co...t=show&id=86493

Сканирах с AVG отново с днешна дата и имам резултатите в 3 Excel файла (Scan, Resident Shield,Online Shield)

Как да Ви ги пратя, прикачени ли?

Файловете с кии генове и подобни (от дял D:), които са пратени във Vault след всеки скан си ги връщам по местата. Тях ги имам от край време и не са проблемни.

  • Автор

Вижте от вече създадените лог файлове, интересуват ме тези .dll файлове, които споменахте.

Не разбирам...

dll файловете са многобройни...около стотина до сега, които са в лог файловете. Непрекъснато през 15-20мин AVG изкарва нов, който аз пращам във Vault...

Трите лог файла ,които AVG създаде са в Excel формат, пак питам- как да ги пратя, прикачени ли, защото някъде прочетох да не се прикачват файлове, а да се пействат в поста ?

OFF

BTW тикнал съм абонамента за темата и имам "Вие вече сте абонирани да получавате email, когато има нови мнения в темата" , но не получавам известия на имейла си... Каква ли е причината?

Редактирано от Kibik (преглед на промените)

  • Автор

Правилата въжът и за бъдещите лог файлове. Публикувайте ги директно във вашия коментар.

Ето ги:

1.От Scan на AVG

Scan "Scan whole computer" completed. Infections;"6";"6";"0" Spyware;"2";"0";"2" Folders selected for scanning:;"Scan whole computer" Scan started:;"25 February 2012, 21:54:15" Scan finished:;"25 February 2012, 22:13:46 (19 minute(s) 31 second(s))" Total object scanned:;"376634" User who launched the scan:;"user" Infections File;"Infection";"Result" D:\My Exe Files\PC-Wind-Test- Maintenance\Windows Doctor Pro v2.0\Patch\WD20_CRK.exe;"Trojan horse Agent3.BHEM";"Moved to Virus Vault" D:\My Exe Files\Cars\Diagnostic Programs\ELM Compatible\ScanMaster 2.1\ScanMaster.ELM.v2.1.104.771\KeyGen\Kg.exe;"Trojan horse PSW.Generic8.BFIK";"Moved to Virus Vault" C:\Windows\Temp\gfewrs\setup.exe;"Trojan horse Dropper.Generic5.AMNY";"Moved to Virus Vault" C:\Windows\System32\s125bus.dll;"Trojan horse Crypt.AQLW";"Moved to Virus Vault" C:\Windows\System32\s117mgmt.dll;"Trojan horse Crypt.AQLW";"Moved to Virus Vault" C:\Windows\System32\RDID1007.dll;"Trojan horse Crypt.AQLW";"Moved to Virus Vault" Spyware File;"Infection";"Result" D:\My Exe Files\Validation key(XP)and (7)\Win 7\WActivators&Remove WAT\WA3\w7lxe.exe:\w7lxe.exe;"Potentially harmful program Crack.CO";"Potentially dangerous object"

D:\My Exe Files\Validation key(XP)and (7)\Win 7\WActivators&Remove WAT\WA3\w7lxe.exe;"Potentially harmful program Crack.CO.dropper";"Potentially dangerous object"

2.От Resident Shield.

Resident Shield detection Infection;"Object";"Result";"Detection time";"Object Type";"Process" Trojan horse Crypt.AQLW;"c:\Windows\System32\sis162u.dll";"Moved to Virus Vault";"25/02/2012, 22:29:47";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\nvstor32.dll";"Moved to Virus Vault";"25/02/2012, 22:14:48";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\agrsrvce.dll";"Moved to Virus Vault";"25/02/2012, 21:59:47";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\s125bus.dll";"Infected";"25/02/2012, 21:44:47";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\RDID1007.dll";"Infected";"25/02/2012, 21:29:47";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\NxNetMon.dll";"Moved to Virus Vault";"25/02/2012, 21:14:47";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\tcpip.dll";"Moved to Virus Vault";"25/02/2012, 20:59:47";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\InterBaseServer.dll";"Moved to Virus Vault";"25/02/2012, 20:44:47";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\TMBUS.dll";"Moved to Virus Vault";"25/02/2012, 20:29:47";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\pmshellsrv.dll";"Moved to Virus Vault";"25/02/2012, 20:14:47";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\fontcache3.0.0.0.dll";"Moved to Virus Vault";"25/02/2012, 19:59:47";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\foldersize.dll";"Moved to Virus Vault";"25/02/2012, 19:44:47";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\U2SP.dll";"Moved to Virus Vault";"25/02/2012, 19:29:47";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\EMCFILT.dll";"Moved to Virus Vault";"25/02/2012, 19:28:48";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\s117mgmt.dll";"Infected";"25/02/2012, 19:27:54";"file";"C:\Windows\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\npkcsvc.dll";"Moved to Virus Vault";"25/02/2012, 15:44:23";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\lxbs_device.dll";"Moved to Virus Vault";"25/02/2012, 15:14:55";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\amdagp.dll";"Moved to Virus Vault";"25/02/2012, 14:59:55";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\useraccess.dll";"Moved to Virus Vault";"25/02/2012, 14:44:55";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\VICESYS.dll";"Moved to Virus Vault";"25/02/2012, 14:29:55";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\lgsnd_filter.dll";"Moved to Virus Vault";"25/02/2012, 14:14:55";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\npkcusb.dll";"Moved to Virus Vault";"25/02/2012, 14:13:56";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\s117mgmt.dll";"Infected";"25/02/2012, 14:13:05";"file";"C:\Windows\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\CnxTrUsb.dll";"Moved to Virus Vault";"25/02/2012, 10:58:40";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\networkx.dll";"Moved to Virus Vault";"25/02/2012, 10:43:40";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\osaio.dll";"Moved to Virus Vault";"25/02/2012, 10:28:41";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\svcwrsssdk.dll";"Moved to Virus Vault";"25/02/2012, 10:13:41";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\PAC7302.dll";"Moved to Virus Vault";"25/02/2012, 10:12:41";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\s117mgmt.dll";"Infected";"25/02/2012, 10:11:51";"file";"C:\Windows\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\ALABULK.dll";"Moved to Virus Vault";"24/02/2012, 23:21:38";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\a016bus.dll";"Moved to Virus Vault";"24/02/2012, 23:06:37";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\ws2ifsl.dll";"Moved to Virus Vault";"24/02/2012, 22:51:37";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\s616nd5.dll";"Moved to Virus Vault";"24/02/2012, 22:36:38";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\generichidservice.dll";"Moved to Virus Vault";"24/02/2012, 22:21:37";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\HSX_DP.dll";"Moved to Virus Vault";"24/02/2012, 22:06:37";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\TMBUS.dll";"Moved to Virus Vault";"24/02/2012, 21:51:38";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\VSP1284D.dll";"Moved to Virus Vault";"24/02/2012, 21:36:38";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\rtl8185.dll";"Moved to Virus Vault";"24/02/2012, 21:21:37";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\pdlnemap.dll";"Moved to Virus Vault";"24/02/2012, 21:06:38";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\bdrsdrv.dll";"Moved to Virus Vault";"24/02/2012, 20:51:38";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\Intel_MIPMNMP.dll";"Moved to Virus Vault";"24/02/2012, 20:36:38";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\nmwcdc.dll";"Moved to Virus Vault";"24/02/2012, 20:21:37";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\pgsql-8.0.dll";"Moved to Virus Vault";"24/02/2012, 20:06:38";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\FiltUSBEMPIA.dll";"Moved to Virus Vault";"24/02/2012, 20:05:38";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\tappsrv.dll";"Moved to Virus Vault";"24/02/2012, 18:21:36";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\quickbooksdb.dll";"Moved to Virus Vault";"24/02/2012, 18:06:36";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\se44bus.dll";"Moved to Virus Vault";"24/02/2012, 17:51:36";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\omniusb.dll";"Moved to Virus Vault";"24/02/2012, 17:36:36";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\cachemgr.dll";"Moved to Virus Vault";"24/02/2012, 17:35:37";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\s117mgmt.dll";"Infected";"24/02/2012, 17:34:43";"file";"C:\Windows\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\OVT511Plus.dll";"Moved to Virus Vault";"23/02/2012, 23:51:50";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\AVRec.dll";"Moved to Virus Vault";"23/02/2012, 23:36:50";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\interactivelogon.dll";"Moved to Virus Vault";"23/02/2012, 23:21:50";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\ATKGFNEXSrv.dll";"Moved to Virus Vault";"23/02/2012, 23:06:50";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\gv3.dll";"Moved to Virus Vault";"23/02/2012, 22:51:50";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\timounter.dll";"Moved to Virus Vault";"23/02/2012, 22:36:50";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\usbbus.dll";"Moved to Virus Vault";"23/02/2012, 22:21:50";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\ATMsg.dll";"Moved to Virus Vault";"23/02/2012, 22:06:50";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\E1000.dll";"Moved to Virus Vault";"23/02/2012, 21:51:50";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\usbsermptxp.dll";"Moved to Virus Vault";"23/02/2012, 21:36:50";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\Hardlock.dll";"Moved to Virus Vault";"23/02/2012, 21:21:50";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\vclone.dll";"Moved to Virus Vault";"23/02/2012, 21:06:50";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\W700obex.dll";"Moved to Virus Vault";"23/02/2012, 20:51:50";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\se44obex.dll";"Moved to Virus Vault";"23/02/2012, 20:36:50";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\ssdiagn.dll";"Moved to Virus Vault";"23/02/2012, 20:21:50";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\WmXlCore.dll";"Moved to Virus Vault";"23/02/2012, 20:06:51";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\SE2Cmdfl.dll";"Moved to Virus Vault";"23/02/2012, 19:51:50";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\db2remotecmd.dll";"Moved to Virus Vault";"23/02/2012, 19:36:50";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\rampartsvc.dll";"Moved to Virus Vault";"23/02/2012, 19:21:50";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\eventsystem.dll";"Moved to Virus Vault";"23/02/2012, 19:06:50";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\ndasscsi.dll";"Moved to Virus Vault";"23/02/2012, 18:51:50";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\btaudio.dll";"Moved to Virus Vault";"23/02/2012, 18:36:50";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\wuolservice.dll";"Moved to Virus Vault";"23/02/2012, 18:21:50";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\SiS7018.dll";"Moved to Virus Vault";"23/02/2012, 18:06:50";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\3dkeybd.dll";"Moved to Virus Vault";"23/02/2012, 18:05:51";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\s117mgmt.dll";"Infected";"23/02/2012, 18:04:58";"file";"C:\Windows\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\s616mdm.dll";"Moved to Virus Vault";"22/02/2012, 23:22:11";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\eskerlicensecontrol.dll";"Moved to Virus Vault";"22/02/2012, 23:07:11";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\pimsgss.dll";"Moved to Virus Vault";"22/02/2012, 22:52:11";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\ATIBTCAP.dll";"Moved to Virus Vault";"22/02/2012, 22:37:11";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\lxda_device.dll";"Moved to Virus Vault";"22/02/2012, 22:22:11";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\lvpr2mon.dll";"Moved to Virus Vault";"22/02/2012, 22:07:11";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\BrSerIf.dll";"Moved to Virus Vault";"22/02/2012, 21:52:11";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Dropper.Generic5.AMNY;"c:\Windows\Temp\gfewrs\setup.exe";"Infected";"22/02/2012, 21:44:43";"file";"C:\Program Files\CCleaner\CCleaner.exe" Trojan horse Dropper.Generic5.AMNY;"c:\Windows\Temp\gfewrs\setup.exe";"Infected";"22/02/2012, 21:42:48";"file";"C:\Program Files\CCleaner\CCleaner.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\oracleorahomemanagementserver.dll";"Moved to Virus Vault";"22/02/2012, 21:37:11";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\dpti2o.dll";"Moved to Virus Vault";"22/02/2012, 21:22:11";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\ssisvr32.dll";"Moved to Virus Vault";"22/02/2012, 21:07:11";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\s117mgmt.dll";"Infected";"22/02/2012, 21:01:49";"file";"C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\s117mgmt.dll";"Infected";"22/02/2012, 20:59:54";"file";"C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\s117mgmt.dll";"Infected";"22/02/2012, 20:56:01";"file";"C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\AsusACPI.dll";"Moved to Virus Vault";"22/02/2012, 20:52:11";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\cfosspeed.dll";"Moved to Virus Vault";"22/02/2012, 20:37:11";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\WmHidLo.dll";"Moved to Virus Vault";"22/02/2012, 20:36:13";"file";"\\.\globalroot\SystemRoot\system32\svchost.exe" Trojan horse Crypt.AQLW;"c:\Windows\System32\s117mgmt.dll";"Infected";"22/02/2012, 20:35:23";"file";"C:\Windows\system32\svchost.exe" Potentially harmful program Crack.CO.dropper;"d:\My Exe Files\Validation key(XP)and (7)\Win 7\WActivators&Remove WAT\WA3\w7lxe.exe";"Potentially dangerous object";"22/02/2012, 01:22:06";"file";"C:\Program Files\Spyware Doctor\pctsSvc.exe" Trojan horse Agent3.BHEM;"d:\My Exe Files\PC-Wind-Test- Maintenance\Windows Doctor Pro v2.0\Patch\WD20_CRK.exe";"Infected";"22/02/2012, 01:21:39";"file";"C:\Program Files\Spyware Doctor\pctsSvc.exe" Trojan horse PSW.Generic8.BFIK;"d:\My Exe Files\Cars\Diagnostic Programs\ELM Compatible\ScanMaster 2.1\ScanMaster.ELM.v2.1.104.771\KeyGen\Kg.exe";"Infected";"22/02/2012, 01:15:19";"file";"C:\Program Files\Spyware Doctor\pctsSvc.exe" Virus found PSW.SpyEye;"c:\Recycle.Bin\474058F88645F9A";"Object is inaccessible.";"21/02/2012, 17:53:06";"file";"C:\Recycle.Bin\B6232F3A077.exe" Virus found PSW.SpyEye;"c:\Recycle.Bin\474058F88645F9A";"Object is inaccessible.";"21/02/2012, 17:52:21";"file";"C:\Recycle.Bin\B6232F3A077.exe" Virus found PSW.SpyEye;"c:\Recycle.Bin\474058F88645F9A";"Object is inaccessible.";"21/02/2012, 17:52:15";"file";"C:\Recycle.Bin\B6232F3A077.exe" Virus found PSW.SpyEye;"c:\Recycle.Bin\474058F88645F9A";"Object is inaccessible.";"21/02/2012, 17:52:11";"file";"C:\Recycle.Bin\B6232F3A077.exe" Virus found PSW.SpyEye;"c:\Recycle.Bin\474058F88645F9A";"Object is inaccessible.";"21/02/2012, 17:52:03";"file";"C:\Recycle.Bin\B6232F3A077.exe" Virus found PSW.SpyEye;"c:\Recycle.Bin\474058F88645F9A";"Object is inaccessible.";"21/02/2012, 17:52:01";"file";"C:\Recycle.Bin\B6232F3A077.exe" Virus found PSW.SpyEye;"c:\Recycle.Bin\474058F88645F9A";"Object is inaccessible.";"21/02/2012, 17:51:46";"file";"C:\Recycle.Bin\B6232F3A077.exe" Virus found PSW.SpyEye;"c:\Recycle.Bin\474058F88645F9A";"Object is inaccessible.";"21/02/2012, 17:51:35";"file";"C:\Recycle.Bin\B6232F3A077.exe" Virus found PSW.SpyEye;"c:\Recycle.Bin\474058F88645F9A";"Object is inaccessible.";"21/02/2012, 17:51:29";"file";"C:\Recycle.Bin\B6232F3A077.exe" Virus found PSW.SpyEye;"c:\Recycle.Bin\474058F88645F9A";"Object is inaccessible.";"21/02/2012, 17:51:22";"file";"C:\Recycle.Bin\B6232F3A077.exe" Virus found PSW.SpyEye;"c:\Recycle.Bin\474058F88645F9A";"Object is inaccessible.";"21/02/2012, 17:51:22";"file";"C:\Recycle.Bin\B6232F3A077.exe" Virus found PSW.SpyEye;"c:\Recycle.Bin\474058F88645F9A";"Object is inaccessible.";"21/02/2012, 17:51:02";"file";"C:\Recycle.Bin\B6232F3A077.exe" Virus found PSW.SpyEye;"c:\Recycle.Bin\474058F88645F9A";"Object is inaccessible.";"21/02/2012, 17:50:46";"file";"C:\Recycle.Bin\B6232F3A077.exe" Virus found PSW.SpyEye;"c:\Recycle.Bin\474058F88645F9A";"Moved to Virus Vault";"21/02/2012, 17:50:19";"file";"C:\Recycle.Bin\B6232F3A077.exe" Virus found PSW.SpyEye;"c:\Recycle.Bin\474058F88645F9A";"Object is inaccessible.";"21/02/2012, 17:50:14";"file";"C:\Recycle.Bin\B6232F3A077.exe" Virus found PSW.SpyEye;"c:\Recycle.Bin\474058F88645F9A";"Object is inaccessible.";"21/02/2012, 17:50:12";"file";"C:\Recycle.Bin\B6232F3A077.exe" Virus found PSW.SpyEye;"c:\Recycle.Bin\474058F88645F9A";"Object is inaccessible.";"21/02/2012, 17:50:05";"file";"C:\Recycle.Bin\B6232F3A077.exe" Virus found PSW.SpyEye;"c:\Recycle.Bin\474058F88645F9A";"Object is inaccessible.";"21/02/2012, 17:49:42";"file";"C:\Recycle.Bin\B6232F3A077.exe" Virus found PSW.SpyEye;"c:\Recycle.Bin\474058F88645F9A";"Object is inaccessible.";"21/02/2012, 17:49:36";"file";"C:\Recycle.Bin\B6232F3A077.exe" Virus found PSW.SpyEye;"c:\Recycle.Bin\474058F88645F9A";"Object is inaccessible.";"21/02/2012, 17:49:21";"file";"C:\Recycle.Bin\B6232F3A077.exe" Virus found PSW.SpyEye;"c:\Recycle.Bin\474058F88645F9A";"Object is inaccessible.";"21/02/2012, 17:49:11";"file";"C:\Recycle.Bin\B6232F3A077.exe" Virus found PSW.SpyEye;"c:\Recycle.Bin\474058F88645F9A";"Object is inaccessible.";"21/02/2012, 17:49:07";"file";"C:\Recycle.Bin\B6232F3A077.exe" Virus found PSW.SpyEye;"c:\Recycle.Bin\474058F88645F9A";"Object is inaccessible.";"21/02/2012, 17:49:03";"file";"C:\Recycle.Bin\B6232F3A077.exe" Virus found PSW.SpyEye;"c:\Recycle.Bin\474058F88645F9A";"Object is inaccessible.";"21/02/2012, 17:48:57";"file";"C:\Recycle.Bin\B6232F3A077.exe" Virus found PSW.SpyEye;"c:\Recycle.Bin\474058F88645F9A";"Object is inaccessible.";"21/02/2012, 17:47:10";"file";"C:\Recycle.Bin\B6232F3A077.exe" Trojan horse Generic27.QKM;"c:\Windows\Temp\llwmxk\setup.exe";"Moved to Virus Vault";"20/02/2012, 23:37:16";"file";"C:\Windows\explorer.exe" Trojan horse Generic27.QKM;"c:\Windows\Temp\llwmxk\setup.exe";"Infected";"20/02/2012, 23:22:02";"file";"C:\Windows\TEMP\llwmxk\setup.exe" Trojan horse Generic27.QKM;"c:\Windows\Temp\llwmxk\setup.exe";"Infected";"20/02/2012, 23:22:01";"file";"C:\Windows\explorer.exe" Trojan horse Generic27.QKM;"c:\Windows\Temp\llwmxk\setup.exe";"Moved to Virus Vault";"20/02/2012, 23:21:31";"file";"C:\Windows\TEMP\llwmxk\setup.exe" Trojan horse Generic27.QKM;"c:\Windows\Temp\llwmxk\setup.exe";"Moved to Virus Vault";"20/02/2012, 23:21:02";"file";"C:\Windows\explorer.exe" Trojan horse Generic27.QKM;"c:\Windows\Temp\llwmxk\setup.exe";"Moved to Virus Vault";"20/02/2012, 23:20:59";"file";"C:\Windows\TEMP\llwmxk\setup.exe" Trojan horse Generic27.QKM;"c:\Windows\Temp\llwmxk\setup.exe";"Moved to Virus Vault";"20/02/2012, 23:20:28";"file";"C:\Windows\TEMP\llwmxk\setup.exe" Trojan horse PSW.Generic9.BMJT;"c:\Windows\System32\3BclS.com_";"Moved to Virus Vault";"19/02/2012, 14:26:01";"file";"C:\Windows\system32\taskeng.exe" Trojan horse PSW.Generic9.BMJT;"c:\Windows\System32\3BclS.com";"Moved to Virus Vault";"19/02/2012, 14:26:01";"file";"C:\Windows\system32\taskeng.exe" Trojan horse PSW.Generic8.BFIK;"f:\Emil's\My Exe Files\Cars\Diagnostic Programs\ELM Compatible\ScanMaster 2.1\ScanMaster.ELM.v2.1.104.771\KeyGen\Kg.exe";"Infected";"15/02/2012, 20:37:11";"file";"C:\Windows\Explorer.EXE" Trojan horse PSW.Generic8.BFIK;"f:\Emil's\My Exe Files\Cars\Diagnostic Programs\ELM Compatible\ScanMaster 2.1\ScanMaster.ELM.v2.1.104.771\KeyGen\Kg.exe";"Infected";"15/02/2012, 20:36:40";"file";"C:\Windows\Explorer.EXE" Trojan horse PSW.Generic8.BFIK;"f:\Emil's\My Exe Files\Cars\Diagnostic Programs\ELM Compatible\ScanMaster 2.1\ScanMaster.ELM.v2.1.104.771\KeyGen\Kg.exe";"Infected";"15/02/2012, 20:36:09";"file";"C:\Windows\Explorer.EXE" Trojan horse PSW.Generic8.BFIK;"f:\Emil's\My Exe Files\Cars\Diagnostic Programs\ELM Compatible\ScanMaster 2.1\ScanMaster.ELM.v2.1.104.771\KeyGen\Kg.exe";"Infected";"15/02/2012, 20:35:39";"file";"C:\Windows\Explorer.EXE" Trojan horse PSW.Generic8.BFIK;"f:\Emil's\My Exe Files\Cars\Diagnostic Programs\ELM Compatible\ScanMaster 2.1\ScanMaster.ELM.v2.1.104.771\KeyGen\Kg.exe";"Infected";"15/02/2012, 20:35:07";"file";"C:\Windows\Explorer.EXE" Potentially harmful program Crack.CO.dropper;"d:\My Exe Files\Validation key(XP)and (7)\Win 7\WActivators&Remove WAT\WA3\w7lxe.exe";"Potentially dangerous object";"09/02/2012, 23:05:53";"file";"C:\Windows\system32\SearchProtocolHost.exe" Potentially harmful program Crack.CO.dropper;"d:\My Exe Files\Validation key(XP)and (7)\Win 7\WActivators&Remove WAT\WA3\w7lxe.exe";"Potentially dangerous object";"09/02/2012, 22:33:15";"file";"C:\Windows\system32\SearchProtocolHost.exe" Potentially harmful program Crack.CO.dropper;"d:\My Exe Files\Validation key(XP)and (7)\Win 7\WActivators&Remove WAT\WA3\w7lxe.exe";"Potentially dangerous object";"09/02/2012, 22:31:06";"file";"C:\Windows\system32\SearchProtocolHost.exe" Potentially harmful program Crack.CO.dropper;"d:\My Exe Files\Validation key(XP)and (7)\Win 7\WActivators&Remove WAT\WA3\w7lxe.exe";"Potentially dangerous object";"09/02/2012, 22:28:44";"file";"C:\Windows\system32\SearchProtocolHost.exe" Potentially harmful program Crack.CO.dropper;"d:\My Exe Files\Validation key(XP)and (7)\Win 7\WActivators&Remove WAT\WA3\w7lxe.exe";"Potentially dangerous object";"09/02/2012, 22:27:15";"file";"C:\Windows\system32\SearchProtocolHost.exe" Potentially harmful program Crack.CO.dropper;"d:\My Exe Files\Validation key(XP)and (7)\Win 7\WActivators&Remove WAT\WA3\w7lxe.exe";"Potentially dangerous object";"09/02/2012, 22:19:21";"file";"C:\Windows\system32\SearchProtocolHost.exe" Potentially harmful program Crack.CO.dropper;"d:\My Exe Files\Validation key(XP)and (7)\Win 7\WActivators&Remove WAT\WA3\w7lxe.exe";"Potentially dangerous object";"04/02/2012, 21:07:54";"file";"C:\Windows\Explorer.EXE" Potentially harmful program Crack.CO.dropper;"d:\My Exe Files\Validation key(XP)and (7)\Win 7\WActivators&Remove WAT\WA3\w7lxe.exe";"Potentially dangerous object";"04/02/2012, 21:06:25";"file";"C:\Windows\Explorer.EXE" Virus identified Win32/Katusha.A;"c:\Program Files\AVG\AVG9\avgrsx.exe";"Object is inaccessible.";"27/10/2011, 17:35:08";"file";"C:\Windows\system32\rundll32.exe" Virus identified Win32/Katusha.A;"c:\ProgramData\EPSON\EPW!3 SSRP\E_S40RP7.EXE";"Object is inaccessible.";"27/10/2011, 17:28:48";"file";"System" Virus identified Win32/Katusha.A;"c:\Program Files\AVG\AVG9\avgrsx.exe";"Object is inaccessible.";"27/10/2011, 17:28:48";"file";"System" Trojan horse PSW.Generic8.BWCH;"c:\Program Files\Google\Update\GoogleUpdate.exe";"Object is inaccessible.";"27/10/2011, 17:13:50";"file";"C:\Program Files\Google\Update\GoogleUpdate.exe" Virus identified Win32/Katusha.A;"c:\Program Files\Google\Chrome\Application\14.0.835.202\Installer\setup.exe";"Moved to Virus Vault";"27/10/2011, 17:13:48";"file";"C:\Program Files\Google\Chrome\Application\14.0.835.202\Installer\setup.exe" Trojan horse PSW.Generic8.BWCH;"c:\Program Files\Google\Update\GoogleUpdate.exe";"Moved to Virus Vault";"27/10/2011, 17:13:48";"file";"System" Virus identified Win32/Katusha.A;"c:\ProgramData\EPSON\EPW!3 SSRP\E_S40RP7.EXE";"Object is inaccessible.";"27/10/2011, 17:13:48";"file";"System" Virus identified Win32/Katusha.A;"c:\Program Files\AVG\AVG9\avgrsx.exe";"Object is inaccessible.";"27/10/2011, 17:13:48";"file";"System" Virus identified Win32/Katusha.A;"c:\ProgramData\EPSON\EPW!3 SSRP\E_S40RP7.EXE";"Moved to Virus Vault";"27/10/2011, 16:58:48";"file";"System" Virus identified Win32/Katusha.A;"c:\Program Files\AVG\AVG9\avgrsx.exe";"Moved to Virus Vault";"27/10/2011, 16:58:48";"file";"System" Trojan horse Generic4_c.BFAA;"c:\Windows\2088337431:3900671619.exe";"Infected";"27/10/2011, 16:41:14";"file";"C:\Windows\system32\services.exe" Virus identified Win32/Katusha.A;"c:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE";"Object is inaccessible.";"26/10/2011, 22:19:28";"file";"System" Virus identified Win32/Katusha.A;"c:\Program Files\Toshiba\Power Saver\TosCoSrv.exe";"Object is inaccessible.";"26/10/2011, 22:19:28";"file";"System" Virus identified Win32/Katusha.A;"c:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe";"Object is inaccessible.";"26/10/2011, 22:19:28";"file";"System" Virus identified Win32/Katusha.A;"c:\Program Files\O2Micro Flash Memory Card Driver\o2flash.exe";"Object is inaccessible.";"26/10/2011, 22:19:28";"file";"System" Virus identified Win32/Katusha.A;"c:\ProgramData\EPSON\EPW!3 SSRP\E_S40ST7.EXE";"Object is inaccessible.";"26/10/2011, 22:19:28";"file";"System" Virus identified Win32/Katusha.A;"c:\Program Files\DU Meter\DUMeterSvc.exe";"Object is inaccessible.";"26/10/2011, 22:19:28";"file";"System" Virus identified Win32/Katusha.A;"c:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe";"Object is inaccessible.";"26/10/2011, 22:19:28";"file";"System" Virus identified Win32/Katusha.A;"c:\Program Files\USB Safely Remove\USBSRService.exe";"Object is inaccessible.";"26/10/2011, 22:19:28";"file";"System" Virus identified Win32/Katusha.A;"c:\Program Files\AVG\AVG9\avgchsvx.exe";"Object is inaccessible.";"26/10/2011, 22:19:28";"file";"System" Virus identified Win32/Katusha.A;"c:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE";"Moved to Virus Vault";"26/10/2011, 22:04:28";"file";"System" Virus identified Win32/Katusha.A;"c:\Program Files\Toshiba\Power Saver\TosCoSrv.exe";"Moved to Virus Vault";"26/10/2011, 22:04:28";"file";"System" Virus identified Win32/Katusha.A;"c:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe";"Moved to Virus Vault";"26/10/2011, 22:04:28";"file";"System" Virus identified Win32/Katusha.A;"c:\Program Files\O2Micro Flash Memory Card Driver\o2flash.exe";"Moved to Virus Vault";"26/10/2011, 22:04:28";"file";"System" Virus identified Win32/Katusha.A;"c:\ProgramData\EPSON\EPW!3 SSRP\E_S40ST7.EXE";"Moved to Virus Vault";"26/10/2011, 22:04:28";"file";"System" Virus identified Win32/Katusha.A;"c:\Program Files\DU Meter\DUMeterSvc.exe";"Moved to Virus Vault";"26/10/2011, 22:04:28";"file";"System" Virus identified Win32/Katusha.A;"c:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe";"Moved to Virus Vault";"26/10/2011, 22:04:28";"file";"System" Virus identified Win32/Katusha.A;"c:\Program Files\USB Safely Remove\USBSRService.exe";"Moved to Virus Vault";"26/10/2011, 22:04:28";"file";"System" Virus identified Win32/Katusha.A;"c:\Program Files\AVG\AVG9\avgchsvx.exe";"Moved to Virus Vault";"26/10/2011, 22:04:28";"file";"System" Virus identified Win32/Katusha.A;"c:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe";"Moved to Virus Vault";"26/10/2011, 22:00:01";"file";"C:\Program Files\TuneUp Utilities 2010\OneClickStarter.exe" Virus identified Win32/Katusha.A;"c:\Windows\System32\Ati2evxx.exe";"Object is inaccessible.";"26/10/2011, 21:49:39";"file";"C:\Windows\explorer.exe" Virus identified Win32/Katusha.A;"c:\Windows\System32\Ati2evxx.exe";"Moved to Virus Vault";"26/10/2011, 21:49:28";"file";"System" Trojan horse Generic4_c.BFAA;"c:\Windows\2088337431:3900671619.exe";"Infected";"26/10/2011, 21:46:03";"file";"C:\Windows\system32\services.exe" Adware Generic4.CERU;"c:\Users\user\Desktop\tk8_downloader.exe";"Object is inaccessible.";"25/10/2011, 20:38:58";"file";"C:\Windows\Explorer.EXE" Adware Generic4.CERU;"c:\Users\user\Desktop\tk8_downloader.exe";"Object is inaccessible.";"25/10/2011, 20:38:56";"file";"C:\Program Files\Mozilla Firefox\firefox.exe" Adware Generic4.CERU;"c:\Users\user\Desktop\tk8_downloader.exe";"Object is inaccessible.";"25/10/2011, 20:38:54";"file";"C:\Windows\system32\SearchProtocolHost.exe" Adware Generic4.CERU;"c:\Users\user\Desktop\tk8_downloader.exe";"Object is inaccessible.";"25/10/2011, 20:38:28";"file";"C:\Windows\Explorer.EXE" Adware Generic4.CERU;"c:\Users\user\Desktop\tk8_downloader.exe";"Object is inaccessible.";"25/10/2011, 20:38:26";"file";"C:\Program Files\Mozilla Firefox\firefox.exe" Adware Generic4.CERU;"c:\Users\user\Desktop\tk8_downloader.exe";"Moved to Virus Vault";"25/10/2011, 20:38:24";"file";"C:\Windows\system32\SearchProtocolHost.exe" Trojan horse Generic16.BRVZ;"f:\Emil's\My Exe Files\A&Video Converters\Bigasoft Total Video Converter 1.7.10.3689\keygen.exe";"Infected";"06/08/2011, 23:09:47";"file";"C:\Windows\Explorer.EXE" Trojan horse Generic16.BRVZ;"f:\Emil's\My Exe Files\A&Video Converters\Bigasoft Total Video Converter 1.7.10.3689\keygen.exe";"Infected";"06/08/2011, 23:08:00";"file";"C:\Windows\Explorer.EXE" Trojan horse Generic16.BRVZ;"f:\Emil's\My Exe Files\A&Video Converters\Bigasoft Total Video Converter 1.7.10.3689\keygen.exe";"Infected";"06/08/2011, 23:07:29";"file";"C:\Windows\Explorer.EXE" Trojan horse Generic16.BRVZ;"\\EVON610C\Exe Files(Programs)\A&Video Converters\Bigasoft Total Video Converter 1.7.10.3689\keygen.exe";"Infected";"06/08/2011, 23:05:09";"file";"C:\Windows\Explorer.EXE" Trojan horse Generic16.BRVZ;"\\EVON610C\Exe Files(Programs)\A&Video Converters\Bigasoft Total Video Converter 1.7.10.3689\keygen.exe";"Infected";"06/08/2011, 23:04:28";"file";"C:\Windows\Explorer.EXE" Trojan horse Generic16.BRVZ;"\\EVON610C\Exe Files(Programs)\A&Video Converters\Bigasoft Total Video Converter 1.7.10.3689\keygen.exe";"Infected";"06/08/2011, 23:03:50";"file";"C:\Windows\Explorer.EXE" Trojan horse Generic16.BRVZ;"\\EVON610C\Exe Files(Programs)\A&Video Converters\Bigasoft Total Video Converter 1.7.10.3689\keygen.exe";"Infected";"06/08/2011, 23:03:09";"file";"C:\Windows\Explorer.EXE" Trojan horse Generic16.BRVZ;"\\EVON610C\Exe Files(Programs)\A&Video Converters\Bigasoft Total Video Converter 1.7.10.3689\keygen.exe";"Infected";"06/08/2011, 23:02:39";"file";"C:\Windows\Explorer.EXE" Runtime packed upack;"f:\Emil's\My Exe Files\Cars\Diagnostic Programs\ELM Compatible\ScanMaster 2.1\ScanMaster.ELM.v2.1.104.771\KeyGen\Kg.exe";"";"19/02/2011, 22:52:47";"file";"C:\Windows\system32\svchost.exe" Runtime packed upack;"f:\Emil's\My Exe Files\Cars\Diagnostic Programs\ELM Compatible\ScanMaster 2.1\ScanMaster.ELM.v2.1.104.771\KeyGen\Kg.exe";"";"19/02/2011, 22:52:39";"file";"C:\Windows\Explorer.EXE" Runtime packed upack;"d:\My Exe Files\Cars\Diagnostic Programs\ELM Compatible\ScanMaster 2.1\ScanMaster.ELM.v2.1.104.771\KeyGen\Kg.exe";"";"19/02/2011, 22:52:25";"file";"C:\Windows\system32\svchost.exe" Runtime packed upack;"d:\My Exe Files\Cars\Diagnostic Programs\ELM Compatible\ScanMaster 2.1\ScanMaster.ELM.v2.1.104.771\KeyGen\Kg.exe";"";"19/02/2011, 22:52:17";"file";"C:\Windows\Explorer.EXE" Potentially harmful program HackTool.JMJ;"f:\Emil's\My Exe Files\Pasword viewer(IE)\iepv.exe";"Potentially dangerous object";"19/02/2011, 22:47:07";"file";"C:\Windows\Explorer.EXE" Potentially harmful program HackTool.JMJ;"f:\Emil's\My Exe Files\Pasword viewer(IE)\iepv.exe";"Potentially dangerous object";"19/02/2011, 22:44:58";"file";"C:\Windows\Explorer.EXE" Potentially harmful program HackTool.JMJ;"f:\Emil's\My Exe Files\Pasword viewer(IE)\iepv.exe";"Potentially dangerous object";"19/02/2011, 21:53:02";"file";"C:\Windows\Explorer.EXE" Potentially harmful program HackTool.JMJ;"f:\Emil's\My Exe Files\Pasword viewer(IE)\iepv.exe";"Potentially dangerous object";"19/02/2011, 21:51:12";"file";"C:\Windows\Explorer.EXE" Runtime packed upack;"d:\My Exe Files\Cars\Diagnostic Programs\ELM Compatible\ScanMaster 2.1\ScanMaster.ELM.v2.1.104.771\KeyGen\Kg.exe";"";"19/02/2011, 16:28:45";"file";"C:\Windows\Explorer.EXE" Runtime packed upack;"d:\My Exe Files\Cars\Diagnostic Programs\ScanMaster 2.1\ScanMaster.ELM.v2.1.104.771\KeyGen\Kg.exe";"";"19/02/2011, 13:50:44";"file";"C:\Windows\System32\svchost.exe" Runtime packed upack;"d:\My Exe Files\Cars\Diagnostic Programs\ScanMaster 2.1\ScanMaster.ELM.v2.1.104.771\KeyGen\Kg.exe";"";"19/02/2011, 13:50:27";"file";"C:\Windows\Explorer.EXE" Runtime packed upack;"d:\My Exe Files\Cars\Diagnostic Programs\ScanMaster 2.1\ScanMaster.ELM.v2.1.104.771\KeyGen\Kg.exe";"";"19/02/2011, 13:48:40";"file";"C:\Windows\Explorer.EXE" Runtime packed upack;"d:\My Exe Files\Cars\Diagnostic Programs\ScanMaster 2.1\ScanMaster.ELM.v2.1.104.771\KeyGen\Kg.exe";"";"19/02/2011, 13:47:24";"file";"C:\Windows\system32\svchost.exe" Runtime packed upack;"d:\My Exe Files\Cars\Diagnostic Programs\ScanMaster 2.1\ScanMaster.ELM.v2.1.104.771\KeyGen\Kg.exe";"";"19/02/2011, 13:47:15";"file";"C:\Windows\Explorer.EXE" Trojan horse Generic16.BRVZ;"f:\Emil's\My Exe Files\A&Video Converters\Bigasoft Total Video Converter 1.7.10.3689\keygen.exe";"Infected";"06/02/2011, 12:18:34";"file";"C:\Windows\Explorer.EXE" Virus found Fat-Obfuscated;"F:\Opera_963_int_Setup.exe";"Infected";"04/10/2010, 15:03:15";"file";"C:\Windows\explorer.exe" Virus found Fat-Obfuscated;"F:\Opera_963_int_Setup.exe";"Infected";"04/10/2010, 15:02:41";"file";"C:\Windows\explorer.exe"

Virus found Fat-Obfuscated;"F:\Opera_963_int_Setup.exe";"Infected";"04/10/2010, 14:57:26";"file";"C:\Windows\explorer.exe"

3.От Online Shield

Online Shield findings Infection;"Object";"Result";"Detection time";"Object Type";"Process" Exploit Blackhole Exploit Kit Detection (type 1889);"nerfalkaser.in/main.php?page=8583768162009568";"Object was blocked";"25/02/2012, 20:09:23";"file";"C:\Windows\System32\ping.exe" Virus found JS/Redir;"traff-datafilter.com/in.cgi?2";"Object was blocked";"24/02/2012, 23:28:36";"file";"C:\Windows\System32\ping.exe" Virus found JS/Redir;"traff-datafilter.com/in.cgi?2";"Object was blocked";"24/02/2012, 23:27:52";"file";"C:\Windows\System32\ping.exe" Exploit JavaScript Obfuscation (type 156);"64.120.163.73/xmlfeed.php?u=9&subid=&timeout=";"Object was blocked";"23/02/2012, 21:59:04";"file";"C:\Windows\System32\ping.exe" Exploit JavaScript Obfuscation (type 156);"64.120.163.73/xmlfeed.php?u=9&subid=&timeout=";"Object was blocked";"23/02/2012, 20:25:00";"file";"C:\Windows\System32\ping.exe" Exploit Blackhole Exploit Kit (type 2121);"freeze.foreignrental.com/index.php?page=9cff461c39b305d3";"Object was blocked";"22/02/2012, 22:42:29";"file";"C:\Windows\System32\ping.exe" Virus found JS/Redir;"traff-datafilter.com/in.cgi?2";"Object was blocked";"22/02/2012, 21:19:23";"file";"C:\Windows\System32\ping.exe" Virus found JS/Redir;"traff-datafilter.com/in.cgi?2";"Object was blocked";"22/02/2012, 21:18:53";"file";"C:\Windows\System32\ping.exe" Virus found JS/Redir;"traff-datafilter.com/in.cgi?2";"Object was blocked";"22/02/2012, 21:18:09";"file";"C:\Windows\System32\ping.exe" Virus found JS/Redir;"traff-datafilter.com/in.cgi?2";"Object was blocked";"22/02/2012, 18:55:00";"file";"C:\Windows\System32\ping.exe" Virus found JS/Redir;"traff-datafilter.com/in.cgi?2";"Object was blocked";"22/02/2012, 18:54:30";"file";"C:\Windows\System32\ping.exe" Virus found JS/Redir;"traff-datafilter.com/in.cgi?2";"Object was blocked";"22/02/2012, 18:52:54";"file";"C:\Windows\System32\ping.exe" Exploit Blackhole Exploit Kit (type 2115);"freetoysforall.info/promotions/";"Object was blocked";"22/02/2012, 18:40:48";"file";"C:\Windows\System32\ping.exe" Exploit Blackhole Exploit Kit (type 2115);"freetoysforall.info/promotions/";"Object was blocked";"22/02/2012, 18:39:56";"file";"C:\Windows\System32\ping.exe" Exploit JavaScript Obfuscation (type 156);"64.120.163.73/xmlfeed.php?u=9";"Object was blocked";"22/02/2012, 18:14:34";"file";"C:\Windows\System32\ping.exe" Exploit JavaScript Obfuscation (type 156);"64.120.163.73/xmlfeed.php?u=9";"Object was blocked";"22/02/2012, 18:13:29";"file";"C:\Windows\System32\ping.exe" Exploit Blackhole Exploit Kit (type 2115);"freetoysforall.info/promotions/";"Object was blocked";"21/02/2012, 23:40:11";"file";"C:\Windows\System32\ping.exe" Exploit Blackhole Exploit Kit (type 2115);"freetoysforall.info/promotions/";"Object was blocked";"21/02/2012, 23:39:38";"file";"C:\Windows\System32\ping.exe" Exploit Blackhole Exploit Kit (type 2105);"homerdoas.in/index.php?64c911daea0f8d368ed80d4ab23f344d";"Object was blocked";"20/02/2012, 18:50:53";"file";"C:\Windows\System32\ping.exe" Exploit Phoenix Exploit Kit (type 769);"prettyjjoanne70.aa.am/baskl/klaldedyaycavsad.php";"Object was blocked";"20/02/2012, 18:23:52";"file";"C:\Windows\System32\ping.exe" Exploit Blackhole Exploit Kit;"zasedfop.in/index.php?0c05789fb053bede2a73e32118997d54";"Object was blocked";"19/02/2012, 18:50:36";"file";"C:\Windows\System32\ping.exe" Exploit Blackhole Exploit Kit;"zasedfop.in/index.php?0c05789fb053bede2a73e32118997d54";"Object was blocked";"19/02/2012, 18:49:46";"file";"C:\Windows\System32\ping.exe" Exploit Blackhole Exploit Kit (type 1889);"w.cyclinges.in/main.php?page=1431e508c4a99c6f";"Object was blocked";"27/10/2011, 18:13:58";"file";"C:\Windows\system32\svchost.exe" Exploit Blackhole Exploit Kit (type 1889);"rymneta.com/main.php?page=e9792336ed0ef5ee";"Object was blocked";"27/10/2011, 16:47:28";"file";"C:\Windows\system32\svchost.exe" Adware Generic4.CERU;"download.tonsoffiles.com/get/file.php?q=tk8&cat=software&wmid=347";"Object was blocked";"25/10/2011, 20:41:20";"file";"C:\Program Files\Mozilla Firefox\firefox.exe" Adware Generic4.CERU;"download.tonsoffiles.com/get/file.php?q=tk8&cat=software&wmid=347";"Object was blocked";"25/10/2011, 20:38:21";"file";"C:\Program Files\Mozilla Firefox\firefox.exe" Virus identified JS/Downloader.Small.S;"www.batterychargerweb.com/goods.php?id=9170";"Object was blocked";"03/09/2011, 21:17:29";"file";"C:\Program Files\Mozilla Firefox\firefox.exe" Exploit Rogue Scanner (type 1922);"sexoruby.com/favicon.ico";"Object was blocked";"15/08/2011, 21:41:25";"file";"C:\Program Files\Mozilla Firefox\firefox.exe" Exploit Rogue Scanner (type 1922);"sexoruby.com/cargotek.php";"Object was blocked";"15/08/2011, 21:41:25";"file";"C:\Program Files\Mozilla Firefox\firefox.exe"

Работата е сериозна!

Стъпка 1

Моля изтеглете последната версия на TDSSKiller оттук и я запазете на вашия декстоп.

  • Стартирайте TDSSKiller.exe за да стартирате приложението. След това кликнете върху бутона Change parameters.

    Публикувано изображение

  • Сложете отметки пред Verify Driver Digital Signature и Detect TDLFS file system и натиснете ОК.

    Публикувано изображение

  • Натиснете бутона Start Scan.

    Публикувано изображение

  • Ако подозрителен обект бъде засечен, действието по подразбиране ще бъде Skip, кликнете върху Continue.

    Публикувано изображение

  • Ако зловредни обекти бъдат намерени, тогава от падащото меню ще имате три възможности.

    Бъдете сигурни, че избраното действие е Cure и натиснете върху Continue > Рестартирайте за да бъде завършена поправката.

    Публикувано изображение

    Забележка: Ако Cure бутона не е наличен от възможностите, тогава моля изберете Skip бутона, не избирайте Delete освен ако не сте инструктирани затова.

  • Лог файл ще бъде създаден в свободната директория на дял C: . Потърсете за лог с името "TDSSKiller.[Version]_[Date]_[Time]_log.txt" и копирайте съдържанието му в следващия си пост.

Стъпка 2

1. Изтеглете ComboFix от BleepingComputer

и го запазете (бутон Save -> Save as) ComboFix на вашия десктоп:

Публикувано изображение

След приключване на изтеглянето на ComboFix, иконката на програмата би трябвало да изглежда така:

Публикувано изображение

2. Затворете всички работещи приложения, отворени прозорци и програми работещи във фонов режим. Спрете временно защитата в реално време на антивирусната програма и на другите програми за сигурност, ако има такива.

3. Стартирайте с двоен клик Combofix.exe. Изберете YES, за да се съгласите с условията за използване на програмата. Важно: По време на работата на ComboFix не бива да се движи мишката и да се натискат клавиши от клавиатурата. Просто търпеливо оставете ComboFix да си свърши работата, без да използвате компютъра за други цели.

4. ComboFix ще провери дали Windows Recovery Console e инсталиранa.

*Ако Windows Recovery Console не е инсталирана, ще е необходимо да използвате YES за инсталация на Windows Recovery Console

*Ако Windows Recovery Console е инсталирана, ComboFix ще продължи работата си.

Публикувано изображение

Забележка: Необходимо е да сте свързани към Интернет за да може Windows Recovery Console да се изтегли.

След инсталация на Windows Recovery Console потвърдете с YES, за да продължите напред. Снимка:

Публикувано изображение

5. ComboFix ще спре временно Интернет връзката, но след като приключи работата на програмата тази връзка ще бъде възстановена автоматично. ComboFix ще сканира за проблеми и за заразени файлове, като това може да отнеме известно време. Моля да бъдете търпеливи. Ако има проблем с Интернет връзката след приключване на работата на Combofix, моля да прочетете това: Manually restoring the Internet connection section.

6. Когато работата на ComboFix приключи, ще се появи текстов документ (log) в Notepad:

Публикувано изображение

Копирайте с (Copy) и поставете с (Paste) съдържанието на лога в следващия си коментар.

В следващия си коментар, моля включете следните лог файлове

  • Лог файлът от TDSSKiller
  • Лог файлът от ComboFix
  • Автор

Не се получава очакваното и не мога да предоставя втория лог файл. TDS намери 5 threats, кликнах Continue и излезе прозорец, със заглавие, че threats не са намерени, но по-надолу показваше, че има 5... Това е лог файла: 23:14:11.0335 5712 TDSS rootkit removing tool 2.7.14.0 Feb 22 2012 16:54:49 23:14:11.0538 5712 ============================================================ 23:14:11.0538 5712 Current date / time: 2012/02/26 23:14:11.0538 23:14:11.0538 5712 SystemInfo: 23:14:11.0538 5712 23:14:11.0538 5712 OS Version: 6.1.7600 ServicePack: 0.0 23:14:11.0538 5712 Product type: Workstation 23:14:11.0538 5712 ComputerName: TOSHIBA-EQUIUM 23:14:11.0538 5712 UserName: user 23:14:11.0538 5712 Windows directory: C:\Windows 23:14:11.0538 5712 System windows directory: C:\Windows 23:14:11.0538 5712 Processor architecture: Intel x86 23:14:11.0538 5712 Number of processors: 2 23:14:11.0538 5712 Page size: 0x1000 23:14:11.0538 5712 Boot type: Normal boot 23:14:11.0538 5712 ============================================================ 23:14:13.0332 5712 Drive \Device\Harddisk0\DR0 - Size: 0x2E93E36000 (186.31 Gb), SectorSize: 0x200, Cylinders: 0x5F01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050 23:14:13.0332 5712 \Device\Harddisk0\DR0: 23:14:13.0332 5712 MBR used 23:14:13.0332 5712 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000 23:14:13.0332 5712 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x4ECFDE5 23:14:13.0332 5712 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x4F025E8, BlocksNum 0x1259C218 23:14:13.0394 5712 Initialize success 23:14:13.0394 5712 ============================================================ 23:14:54.0781 5892 ============================================================ 23:14:54.0781 5892 Scan started 23:14:54.0781 5892 Mode: Manual; SigCheck; TDLFS; 23:14:54.0781 5892 ============================================================ 23:14:57.0370 5892 1394ohci (6d2aca41739bfe8cb86ee8e85f29697d) C:\Windows\system32\DRIVERS\1394ohci.sys 23:14:57.0480 5892 1394ohci - ok 23:14:57.0589 5892 ACPI (f0e07d144c8685b8774bc32fc8da4df0) C:\Windows\system32\DRIVERS\ACPI.sys 23:14:57.0604 5892 ACPI - ok 23:14:57.0636 5892 AcpiPmi (98d81ca942d19f7d9153b095162ac013) C:\Windows\system32\DRIVERS\acpipmi.sys 23:14:57.0651 5892 AcpiPmi - ok 23:14:57.0807 5892 adp94xx (21e785ebd7dc90a06391141aac7892fb) C:\Windows\system32\DRIVERS\adp94xx.sys 23:14:57.0838 5892 adp94xx - ok 23:14:57.0870 5892 adpahci (0c676bc278d5b59ff5abd57bbe9123f2) C:\Windows\system32\DRIVERS\adpahci.sys 23:14:57.0885 5892 adpahci - ok 23:14:57.0932 5892 adpu320 (7c7b5ee4b7b822ec85321fe23a27db33) C:\Windows\system32\DRIVERS\adpu320.sys 23:14:57.0948 5892 adpu320 - ok 23:14:58.0104 5892 AFD (0db7a48388d54d154ebec120461a0fcd) C:\Windows\system32\drivers\afd.sys 23:14:58.0135 5892 AFD - ok 23:14:58.0182 5892 agp440 (507812c3054c21cef746b6ee3d04dd6e) C:\Windows\system32\DRIVERS\agp440.sys 23:14:58.0182 5892 agp440 - ok 23:14:58.0260 5892 aic78xx (8b30250d573a8f6b4bd23195160d8707) C:\Windows\system32\DRIVERS\djsvs.sys 23:14:58.0275 5892 aic78xx - ok 23:14:58.0322 5892 aliide (0d40bcf52ea90fc7df2aeab6503dea44) C:\Windows\system32\DRIVERS\aliide.sys 23:14:58.0338 5892 aliide - ok 23:14:58.0353 5892 amdagp (3c6600a0696e90a463771c7422e23ab5) C:\Windows\system32\DRIVERS\amdagp.sys 23:14:58.0384 5892 amdagp - ok 23:14:58.0509 5892 amdide (cd5914170297126b6266860198d1d4f0) C:\Windows\system32\DRIVERS\amdide.sys 23:14:58.0525 5892 amdide - ok 23:14:58.0587 5892 AmdK8 (00dda200d71bac534bf56a9db5dfd666) C:\Windows\system32\DRIVERS\amdk8.sys 23:14:58.0618 5892 AmdK8 - ok 23:14:58.0650 5892 AmdPPM (3cbf30f5370fda40dd3e87df38ea53b6) C:\Windows\system32\DRIVERS\amdppm.sys 23:14:58.0712 5892 AmdPPM - ok 23:14:58.0806 5892 amdsata (2101a86c25c154f8314b24ef49d7fbc2) C:\Windows\system32\DRIVERS\amdsata.sys 23:14:58.0821 5892 amdsata - ok 23:14:58.0868 5892 amdsbs (ea43af0c423ff267355f74e7a53bdaba) C:\Windows\system32\DRIVERS\amdsbs.sys 23:14:58.0884 5892 amdsbs - ok 23:14:58.0915 5892 amdxata (b81c2b5616f6420a9941ea093a92b150) C:\Windows\system32\DRIVERS\amdxata.sys 23:14:58.0915 5892 amdxata - ok 23:14:58.0993 5892 AppID (feb834c02ce1e84b6a38f953ca067706) C:\Windows\system32\drivers\appid.sys 23:14:59.0055 5892 AppID - ok 23:14:59.0133 5892 arc (2932004f49677bd84dbc72edb754ffb3) C:\Windows\system32\DRIVERS\arc.sys 23:14:59.0149 5892 arc - ok 23:14:59.0196 5892 arcsas (5d6f36c46fd283ae1b57bd2e9feb0bc7) C:\Windows\system32\DRIVERS\arcsas.sys 23:14:59.0211 5892 arcsas - ok 23:14:59.0258 5892 AsyncMac (add2ade1c2b285ab8378d2daaf991481) C:\Windows\system32\DRIVERS\asyncmac.sys 23:14:59.0305 5892 AsyncMac - ok 23:14:59.0367 5892 atapi (338c86357871c167a96ab976519bf59e) C:\Windows\system32\DRIVERS\atapi.sys 23:14:59.0367 5892 atapi - ok 23:14:59.0601 5892 atikmdag (eba9b1e2e62091b72c57c93211aa7fb2) C:\Windows\system32\DRIVERS\atikmdag.sys 23:14:59.0804 5892 atikmdag - ok 23:14:59.0991 5892 AvgLdx86 (b8c187439d27aba430dd69fdcf1fa657) C:\Windows\System32\Drivers\avgldx86.sys 23:15:00.0054 5892 AvgLdx86 - ok 23:15:00.0100 5892 AvgMfx86 (80ff2b1b7eeda966394f0baa895bbf4b) C:\Windows\System32\Drivers\avgmfx86.sys 23:15:00.0116 5892 AvgMfx86 - ok 23:15:00.0178 5892 AvgRkx86 (5bbcd8646074a3af4ee9b321d12c2b64) C:\Windows\system32\Drivers\avgrkx86.sys 23:15:00.0178 5892 AvgRkx86 - ok 23:15:00.0288 5892 AvgTdiX (9a7a93388f503a34e7339ae7f9997449) C:\Windows\System32\Drivers\avgtdix.sys 23:15:00.0303 5892 AvgTdiX - ok 23:15:00.0366 5892 b06bdrv (1a231abec60fd316ec54c66715543cec) C:\Windows\system32\DRIVERS\bxvbdx.sys 23:15:00.0428 5892 b06bdrv - ok 23:15:00.0522 5892 b57nd60x (bd8869eb9cde6bbe4508d869929869ee) C:\Windows\system32\DRIVERS\b57nd60x.sys 23:15:00.0584 5892 b57nd60x - ok 23:15:00.0787 5892 Beep (505506526a9d467307b3c393dedaf858) C:\Windows\system32\drivers\Beep.sys 23:15:00.0849 5892 Beep - ok 23:15:00.0880 5892 blbdrive (2287078ed48fcfc477b05b20cf38f36f) C:\Windows\system32\DRIVERS\blbdrive.sys 23:15:00.0912 5892 blbdrive - ok 23:15:01.0005 5892 bowser (9a5c671b7fbae4865149bb11f59b91b2) C:\Windows\system32\DRIVERS\bowser.sys 23:15:01.0021 5892 bowser - ok 23:15:01.0068 5892 BrFiltLo (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\DRIVERS\BrFiltLo.sys 23:15:01.0083 5892 BrFiltLo - ok 23:15:01.0177 5892 BrFiltUp (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\DRIVERS\BrFiltUp.sys 23:15:01.0192 5892 BrFiltUp - ok 23:15:01.0239 5892 BridgeMP (77361d72a04f18809d0efb6cceb74d4b) C:\Windows\system32\DRIVERS\bridge.sys 23:15:01.0286 5892 BridgeMP - ok 23:15:01.0395 5892 Brserid (845b8ce732e67f3b4133164868c666ea) C:\Windows\System32\Drivers\Brserid.sys 23:15:01.0442 5892 Brserid - ok 23:15:01.0458 5892 BrSerWdm (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\System32\Drivers\BrSerWdm.sys 23:15:01.0520 5892 BrSerWdm - ok 23:15:01.0598 5892 BrUsbMdm (bd456606156ba17e60a04e18016ae54b) C:\Windows\System32\Drivers\BrUsbMdm.sys 23:15:01.0614 5892 BrUsbMdm - ok 23:15:01.0629 5892 BrUsbSer (af72ed54503f717a43268b3cc5faec2e) C:\Windows\System32\Drivers\BrUsbSer.sys 23:15:01.0660 5892 BrUsbSer - ok 23:15:01.0692 5892 BTHMODEM (ed3df7c56ce0084eb2034432fc56565a) C:\Windows\system32\DRIVERS\bthmodem.sys 23:15:01.0738 5892 BTHMODEM - ok 23:15:01.0879 5892 catchme - ok 23:15:01.0988 5892 cdfs (77ea11b065e0a8ab902d78145ca51e10) C:\Windows\system32\DRIVERS\cdfs.sys 23:15:02.0050 5892 cdfs - ok 23:15:02.0082 5892 cdrom (ba6e70aa0e6091bc39de29477d866a77) C:\Windows\system32\DRIVERS\cdrom.sys 23:15:02.0128 5892 cdrom - ok 23:15:02.0238 5892 circlass (3fe3fe94a34df6fb06e6418d0f6a0060) C:\Windows\system32\DRIVERS\circlass.sys 23:15:02.0253 5892 circlass - ok 23:15:02.0300 5892 CLFS (635181e0e9bbf16871bf5380d71db02d) C:\Windows\system32\CLFS.sys 23:15:02.0316 5892 CLFS - ok 23:15:02.0862 5892 CmBatt (dea805815e587dad1dd2c502220b5616) C:\Windows\system32\DRIVERS\CmBatt.sys 23:15:02.0893 5892 CmBatt - ok 23:15:03.0314 5892 cmdide (c537b1db64d495b9b4717b4d6d9edbf2) C:\Windows\system32\DRIVERS\cmdide.sys 23:15:03.0330 5892 cmdide - ok 23:15:03.0501 5892 CNG (36c252e474b2ffa0f0fbbff20d92a640) C:\Windows\system32\Drivers\cng.sys 23:15:03.0532 5892 CNG - ok 23:15:03.0610 5892 CnxtHdAudService (2fbea8aaad105b93f1ef93f206664245) C:\Windows\system32\drivers\CHDRT32.sys 23:15:03.0642 5892 CnxtHdAudService - ok 23:15:03.0782 5892 CnxtHdmiAudService (2fbea8aaad105b93f1ef93f206664245) C:\Windows\system32\drivers\CHDMI32.sys 23:15:03.0813 5892 CnxtHdmiAudService - ok 23:15:03.0860 5892 Compbatt (a6023d3823c37043986713f118a89bee) C:\Windows\system32\DRIVERS\compbatt.sys 23:15:03.0876 5892 Compbatt - ok 23:15:03.0985 5892 CompositeBus (f1724ba27e97d627f808fb0ba77a28a6) C:\Windows\system32\DRIVERS\CompositeBus.sys 23:15:04.0016 5892 CompositeBus - ok 23:15:04.0063 5892 crcdisk (2c4ebcfc84a9b44f209dff6c6e6c61d1) C:\Windows\system32\DRIVERS\crcdisk.sys 23:15:04.0063 5892 crcdisk - ok 23:15:04.0172 5892 CSC (23bcf8f975216d783cd57b181b5ea863) C:\Windows\system32\drivers\csc.sys 23:15:04.0188 5892 CSC ( UnsignedFile.Multi.Generic ) - warning 23:15:04.0188 5892 CSC - detected UnsignedFile.Multi.Generic (1) 23:15:04.0312 5892 DfsC (83d1ecea8faae75604c0fa49ac7ad996) C:\Windows\system32\Drivers\dfsc.sys 23:15:04.0359 5892 DfsC - ok 23:15:04.0437 5892 discache (1a050b0274bfb3890703d490f330c0da) C:\Windows\system32\drivers\discache.sys 23:15:04.0484 5892 discache - ok 23:15:04.0578 5892 Disk (565003f326f99802e68ca78f2a68e9ff) C:\Windows\system32\DRIVERS\disk.sys 23:15:04.0593 5892 Disk - ok 23:15:04.0718 5892 drmkaud (b918e7c5f9bf77202f89e1a9539f2eb4) C:\Windows\system32\drivers\drmkaud.sys 23:15:04.0749 5892 drmkaud - ok 23:15:04.0905 5892 DXGKrnl (c94b6c3cc628179cb9b9061c19888b99) C:\Windows\System32\drivers\dxgkrnl.sys 23:15:04.0936 5892 DXGKrnl - ok 23:15:05.0092 5892 ebdrv (024e1b5cac09731e4d868e64dbfb4ab0) C:\Windows\system32\DRIVERS\evbdx.sys 23:15:05.0186 5892 ebdrv - ok 23:15:05.0326 5892 elxstor (0ed67910c8c326796faa00b2bf6d9d3c) C:\Windows\system32\DRIVERS\elxstor.sys 23:15:05.0373 5892 elxstor - ok 23:15:05.0436 5892 epmntdrv (539ca34fbc74ec366a0d751028c32a08) C:\Windows\system32\epmntdrv.sys 23:15:05.0451 5892 epmntdrv ( UnsignedFile.Multi.Generic ) - warning 23:15:05.0451 5892 epmntdrv - detected UnsignedFile.Multi.Generic (1) 23:15:05.0607 5892 ErrDev (8fc3208352dd3912c94367a206ab3f11) C:\Windows\system32\DRIVERS\errdev.sys 23:15:05.0638 5892 ErrDev - ok 23:15:05.0826 5892 EuGdiDrv (1f2f4ab15ce03ecc257feb2f6dc5a013) C:\Windows\system32\EuGdiDrv.sys 23:15:05.0857 5892 EuGdiDrv ( UnsignedFile.Multi.Generic ) - warning 23:15:05.0857 5892 EuGdiDrv - detected UnsignedFile.Multi.Generic (1) 23:15:05.0919 5892 exfat (2dc9108d74081149cc8b651d3a26207f) C:\Windows\system32\drivers\exfat.sys 23:15:05.0966 5892 exfat - ok 23:15:06.0091 5892 fastfat (7e0ab74553476622fb6ae36f73d97d35) C:\Windows\system32\drivers\fastfat.sys 23:15:06.0138 5892 fastfat - ok 23:15:06.0216 5892 fdc (e817a017f82df2a1f8cfdbda29388b29) C:\Windows\system32\DRIVERS\fdc.sys 23:15:06.0247 5892 fdc - ok 23:15:06.0325 5892 FileInfo (6cf00369c97f3cf563be99be983d13d8) C:\Windows\system32\drivers\fileinfo.sys 23:15:06.0340 5892 FileInfo - ok 23:15:06.0372 5892 Filetrace (42c51dc94c91da21cb9196eb64c45db9) C:\Windows\system32\drivers\filetrace.sys 23:15:06.0450 5892 Filetrace - ok 23:15:06.0512 5892 flpydisk (87907aa70cb3c56600f1c2fb8841579b) C:\Windows\system32\DRIVERS\flpydisk.sys 23:15:06.0528 5892 flpydisk - ok 23:15:06.0621 5892 FltMgr (7520ec808e0c35e0ee6f841294316653) C:\Windows\system32\drivers\fltmgr.sys 23:15:06.0637 5892 FltMgr - ok 23:15:06.0684 5892 FsDepends (1a16b57943853e598cff37fe2b8cbf1d) C:\Windows\system32\drivers\FsDepends.sys 23:15:06.0699 5892 FsDepends - ok 23:15:06.0730 5892 Fs_Rec (a574b4360e438977038aae4bf60d79a2) C:\Windows\system32\drivers\Fs_Rec.sys 23:15:06.0762 5892 Fs_Rec - ok 23:15:06.0871 5892 FTDIBUS (8142d5d886829b9876cb93af59475c09) C:\Windows\system32\drivers\ftdibus.sys 23:15:06.0886 5892 FTDIBUS - ok 23:15:06.0933 5892 FTSER2K (63d72a4cf9f163b59db0ceed940a7d76) C:\Windows\system32\drivers\ftser2k.sys 23:15:06.0933 5892 FTSER2K - ok 23:15:06.0980 5892 fvevol (dafbd9fe39197495aed6d51f3b85b5d2) C:\Windows\system32\DRIVERS\fvevol.sys 23:15:07.0011 5892 fvevol - ok 23:15:07.0120 5892 gagp30kx (65ee0c7a58b65e74ae05637418153938) C:\Windows\system32\DRIVERS\gagp30kx.sys 23:15:07.0136 5892 gagp30kx - ok 23:15:07.0323 5892 hcw85cir (c44e3c2bab6837db337ddee7544736db) C:\Windows\system32\drivers\hcw85cir.sys 23:15:07.0354 5892 hcw85cir - ok 23:15:07.0386 5892 HdAudAddService (3530cad25deba7dc7de8bb51632cbc5f) C:\Windows\system32\drivers\HdAudio.sys 23:15:07.0432 5892 HdAudAddService - ok 23:15:07.0620 5892 HDAudBus (717a2207fd6f13ad3e664c7d5a43c7bf) C:\Windows\system32\DRIVERS\HDAudBus.sys 23:15:07.0651 5892 HDAudBus - ok 23:15:07.0682 5892 HidBatt (1d58a7f3e11a9731d0eaaaa8405acc36) C:\Windows\system32\DRIVERS\HidBatt.sys 23:15:07.0713 5892 HidBatt - ok 23:15:07.0776 5892 HidBth (89448f40e6df260c206a193a4683ba78) C:\Windows\system32\DRIVERS\hidbth.sys 23:15:07.0807 5892 HidBth - ok 23:15:07.0838 5892 HidIr (cf50b4cf4a4f229b9f3c08351f99ca5e) C:\Windows\system32\DRIVERS\hidir.sys 23:15:07.0869 5892 HidIr - ok 23:15:07.0947 5892 HidUsb (25072fb35ac90b25f9e4e3bacf774102) C:\Windows\system32\DRIVERS\hidusb.sys 23:15:07.0978 5892 HidUsb - ok 23:15:08.0103 5892 HpSAMD (295fdc419039090eb8b49ffdbb374549) C:\Windows\system32\DRIVERS\HpSAMD.sys 23:15:08.0103 5892 HpSAMD - ok 23:15:08.0166 5892 HTTP (c531c7fd9e8b62021112787c4e2c5a5a) C:\Windows\system32\drivers\HTTP.sys 23:15:08.0228 5892 HTTP - ok 23:15:08.0337 5892 hwpolicy (8305f33cde89ad6c7a0763ed0b5a8d42) C:\Windows\system32\drivers\hwpolicy.sys 23:15:08.0353 5892 hwpolicy - ok 23:15:08.0602 5892 i8042prt (f151f0bdc47f4a28b1b20a0818ea36d6) C:\Windows\system32\DRIVERS\i8042prt.sys 23:15:08.0680 5892 i8042prt - ok 23:15:08.0774 5892 iaStorV (934af4d7c5f457b9f0743f4299b77b67) C:\Windows\system32\DRIVERS\iaStorV.sys 23:15:08.0790 5892 iaStorV - ok 23:15:08.0868 5892 iirsp (4173ff5708f3236cf25195fecd742915) C:\Windows\system32\DRIVERS\iirsp.sys 23:15:08.0868 5892 iirsp - ok 23:15:08.0946 5892 IKFileSec (bf1d66c139a4e9be079d47fcfa993578) C:\Windows\system32\drivers\ikfilesec.sys 23:15:08.0946 5892 IKFileSec - ok 23:15:09.0039 5892 IKSysFlt (a90856d3fc565a0d0165574e51a6d088) C:\Windows\system32\drivers\iksysflt.sys 23:15:09.0039 5892 IKSysFlt - ok 23:15:09.0070 5892 IKSysSec (6ebded50d6e19879bc3a86c36d3a0f9d) C:\Windows\system32\drivers\iksyssec.sys 23:15:09.0102 5892 IKSysSec - ok 23:15:09.0164 5892 intelide (a0f12f2c9ba6c72f3987ce780e77c130) C:\Windows\system32\DRIVERS\intelide.sys 23:15:09.0180 5892 intelide - ok 23:15:09.0211 5892 intelppm (3b514d27bfc4accb4037bc6685f766e0) C:\Windows\system32\DRIVERS\intelppm.sys 23:15:09.0258 5892 intelppm - ok 23:15:09.0351 5892 IpFilterDriver (709d1761d3b19a932ff0238ea6d50200) C:\Windows\system32\DRIVERS\ipfltdrv.sys 23:15:09.0429 5892 IpFilterDriver - ok 23:15:09.0523 5892 IPMIDRV (e4454b6c37d7ffd5649611f6496308a7) C:\Windows\system32\DRIVERS\IPMIDrv.sys 23:15:09.0601 5892 IPMIDRV - ok 23:15:09.0679 5892 IPNAT (a5fa468d67abcdaa36264e463a7bb0cd) C:\Windows\system32\drivers\ipnat.sys 23:15:09.0726 5892 IPNAT - ok 23:15:09.0850 5892 IRENUM (42996cff20a3084a56017b7902307e9f) C:\Windows\system32\drivers\irenum.sys 23:15:09.0928 5892 IRENUM - ok 23:15:10.0069 5892 isapnp (1f32bb6b38f62f7df1a7ab7292638a35) C:\Windows\system32\DRIVERS\isapnp.sys 23:15:10.0084 5892 isapnp - ok 23:15:10.0178 5892 iScsiPrt (ed46c223ae46c6866ab77cdc41c404b7) C:\Windows\system32\DRIVERS\msiscsi.sys 23:15:10.0194 5892 iScsiPrt - ok 23:15:10.0287 5892 kbdclass (adef52ca1aeae82b50df86b56413107e) C:\Windows\system32\DRIVERS\kbdclass.sys 23:15:10.0303 5892 kbdclass - ok 23:15:10.0334 5892 kbdhid (3d9f0ebf350edcfd6498057301455964) C:\Windows\system32\DRIVERS\kbdhid.sys 23:15:10.0365 5892 kbdhid - ok 23:15:10.0506 5892 KSecDD (0263364acb9c834ace52fb85c2c064ec) C:\Windows\system32\Drivers\ksecdd.sys 23:15:10.0521 5892 KSecDD - ok 23:15:10.0771 5892 KSecPkg (27391db553be2a4e2b0adeea2873b2af) C:\Windows\system32\Drivers\ksecpkg.sys 23:15:10.0786 5892 KSecPkg - ok 23:15:10.0880 5892 lltdio (f7611ec07349979da9b0ae1f18ccc7a6) C:\Windows\system32\DRIVERS\lltdio.sys 23:15:10.0989 5892 lltdio - ok 23:15:11.0130 5892 LSI_FC (eb119a53ccf2acc000ac71b065b78fef) C:\Windows\system32\DRIVERS\lsi_fc.sys 23:15:11.0130 5892 LSI_FC - ok 23:15:11.0161 5892 LSI_SAS (8ade1c877256a22e49b75d1cc9161f9c) C:\Windows\system32\DRIVERS\lsi_sas.sys 23:15:11.0176 5892 LSI_SAS - ok 23:15:11.0208 5892 LSI_SAS2 (dc9dc3d3daa0e276fd2ec262e38b11e9) C:\Windows\system32\DRIVERS\lsi_sas2.sys 23:15:11.0239 5892 LSI_SAS2 - ok 23:15:11.0254 5892 LSI_SCSI (0a036c7d7cab643a7f07135ac47e0524) C:\Windows\system32\DRIVERS\lsi_scsi.sys 23:15:11.0270 5892 LSI_SCSI - ok 23:15:11.0348 5892 luafv (6703e366cc18d3b6e534f5cf7df39cee) C:\Windows\system32\drivers\luafv.sys 23:15:11.0395 5892 luafv - ok 23:15:11.0488 5892 megasas (0fff5b045293002ab38eb1fd1fc2fb74) C:\Windows\system32\DRIVERS\megasas.sys 23:15:11.0504 5892 megasas - ok 23:15:11.0598 5892 MegaSR (dcbab2920c75f390caf1d29f675d03d6) C:\Windows\system32\DRIVERS\MegaSR.sys 23:15:11.0613 5892 MegaSR - ok 23:15:11.0676 5892 Modem (f001861e5700ee84e2d4e52c712f4964) C:\Windows\system32\drivers\modem.sys 23:15:11.0754 5892 Modem - ok 23:15:11.0847 5892 monitor (79d10964de86b292320e9dfe02282a23) C:\Windows\system32\DRIVERS\monitor.sys 23:15:11.0878 5892 monitor - ok 23:15:11.0941 5892 mouclass (fb18cc1d4c2e716b6b903b0ac0cc0609) C:\Windows\system32\DRIVERS\mouclass.sys 23:15:11.0956 5892 mouclass - ok 23:15:12.0050 5892 mouhid (2c388d2cd01c9042596cf3c8f3c7b24d) C:\Windows\system32\DRIVERS\mouhid.sys 23:15:12.0081 5892 mouhid - ok 23:15:12.0128 5892 mountmgr (921c18727c5920d6c0300736646931c2) C:\Windows\system32\drivers\mountmgr.sys 23:15:12.0144 5892 mountmgr - ok 23:15:12.0222 5892 mpio (2af5997438c55fb79d33d015c30e1974) C:\Windows\system32\DRIVERS\mpio.sys 23:15:12.0237 5892 mpio - ok 23:15:12.0300 5892 mpsdrv (ad2723a7b53dd1aacae6ad8c0bfbf4d0) C:\Windows\system32\drivers\mpsdrv.sys 23:15:12.0362 5892 mpsdrv - ok 23:15:12.0487 5892 MRxDAV (b1be47008d20e43da3adc37c24cdb89d) C:\Windows\system32\drivers\mrxdav.sys 23:15:12.0534 5892 MRxDAV - ok 23:15:12.0627 5892 mrxsmb (ca7570e42522e24324a12161db14ec02) C:\Windows\system32\DRIVERS\mrxsmb.sys 23:15:12.0674 5892 mrxsmb - ok 23:15:12.0783 5892 mrxsmb10 (f965c3ab2b2ae5c378f4562486e35051) C:\Windows\system32\DRIVERS\mrxsmb10.sys 23:15:12.0814 5892 mrxsmb10 - ok 23:15:12.0861 5892 mrxsmb20 (25c38264a3c72594dd21d355d70d7a5d) C:\Windows\system32\DRIVERS\mrxsmb20.sys 23:15:12.0908 5892 mrxsmb20 - ok 23:15:12.0986 5892 msahci (4326d168944123f38dd3b2d9c37a0b12) C:\Windows\system32\DRIVERS\msahci.sys 23:15:13.0002 5892 msahci - ok 23:15:13.0048 5892 msdsm (455029c7174a2dbb03dba8a0d8bddd9a) C:\Windows\system32\DRIVERS\msdsm.sys 23:15:13.0064 5892 msdsm - ok 23:15:13.0142 5892 Msfs (daefb28e3af5a76abcc2c3078c07327f) C:\Windows\system32\drivers\Msfs.sys 23:15:13.0173 5892 Msfs - ok 23:15:13.0282 5892 mshidkmdf (3e1e5767043c5af9367f0056295e9f84) C:\Windows\System32\drivers\mshidkmdf.sys 23:15:13.0392 5892 mshidkmdf - ok 23:15:13.0423 5892 msisadrv (0a4e5757ae09fa9622e3158cc1aef114) C:\Windows\system32\DRIVERS\msisadrv.sys 23:15:13.0438 5892 msisadrv - ok 23:15:13.0548 5892 MSKSSRV (8c0860d6366aaffb6c5bb9df9448e631) C:\Windows\system32\drivers\MSKSSRV.sys 23:15:13.0594 5892 MSKSSRV - ok 23:15:13.0719 5892 MSPCLOCK (3ea8b949f963562cedbb549eac0c11ce) C:\Windows\system32\drivers\MSPCLOCK.sys 23:15:13.0813 5892 MSPCLOCK - ok 23:15:13.0922 5892 MSPQM (f456e973590d663b1073e9c463b40932) C:\Windows\system32\drivers\MSPQM.sys 23:15:13.0969 5892 MSPQM - ok 23:15:14.0000 5892 MsRPC (0e008fc4819d238c51d7c93e7b41e560) C:\Windows\system32\drivers\MsRPC.sys 23:15:14.0031 5892 MsRPC - ok 23:15:14.0094 5892 mssmbios (fc6b9ff600cc585ea38b12589bd4e246) C:\Windows\system32\DRIVERS\mssmbios.sys 23:15:14.0109 5892 mssmbios - ok 23:15:14.0203 5892 MSTEE (b42c6b921f61a6e55159b8be6cd54a36) C:\Windows\system32\drivers\MSTEE.sys 23:15:14.0265 5892 MSTEE - ok 23:15:14.0312 5892 MTConfig (33599130f44e1f34631cea241de8ac84) C:\Windows\system32\DRIVERS\MTConfig.sys 23:15:14.0359 5892 MTConfig - ok 23:15:14.0530 5892 Mup (159fad02f64e6381758c990f753bcc80) C:\Windows\system32\Drivers\mup.sys 23:15:14.0530 5892 Mup - ok 23:15:14.0655 5892 NativeWifiP (26384429fcd85d83746f63e798ab1480) C:\Windows\system32\DRIVERS\nwifi.sys 23:15:14.0686 5892 NativeWifiP - ok 23:15:14.0796 5892 NDIS (23759d175a0a9baaf04d05047bc135a8) C:\Windows\system32\drivers\ndis.sys 23:15:14.0827 5892 NDIS - ok 23:15:14.0874 5892 NdisCap (0e1787aa6c9191d3d319e8bafe86f80c) C:\Windows\system32\DRIVERS\ndiscap.sys 23:15:14.0920 5892 NdisCap - ok 23:15:14.0952 5892 NdisTapi (e4a8aec125a2e43a9e32afeea7c9c888) C:\Windows\system32\DRIVERS\ndistapi.sys 23:15:14.0998 5892 NdisTapi - ok 23:15:15.0092 5892 Ndisuio (b30ae7f2b6d7e343b0df32e6c08fce75) C:\Windows\system32\DRIVERS\ndisuio.sys 23:15:15.0139 5892 Ndisuio - ok 23:15:15.0154 5892 NdisWan (267c415eadcbe53c9ca873dee39cf3a4) C:\Windows\system32\DRIVERS\ndiswan.sys 23:15:15.0201 5892 NdisWan - ok 23:15:15.0248 5892 NDProxy (af7e7c63dcef3f8772726f86039d6eb4) C:\Windows\system32\drivers\NDProxy.sys 23:15:15.0295 5892 NDProxy - ok 23:15:15.0357 5892 NetBIOS (80b275b1ce3b0e79909db7b39af74d51) C:\Windows\system32\DRIVERS\netbios.sys 23:15:15.0420 5892 NetBIOS - ok 23:15:15.0498 5892 NetBT (dd52a733bf4ca5af84562a5e2f963b91) C:\Windows\system32\DRIVERS\netbt.sys 23:15:15.0544 5892 NetBT - ok 23:15:15.0654 5892 nfrd960 (1d85c4b390b0ee09c7a46b91efb2c097) C:\Windows\system32\DRIVERS\nfrd960.sys 23:15:15.0669 5892 nfrd960 - ok 23:15:15.0747 5892 nmwcd (b0a67de1a128389aea4d42c5a56215fd) C:\Windows\system32\drivers\ccdcmb.sys 23:15:15.0841 5892 nmwcd - ok 23:15:15.0934 5892 nmwcdc (025c54f9f8c8bc1894ea38529c742c54) C:\Windows\system32\drivers\ccdcmbo.sys 23:15:15.0966 5892 nmwcdc - ok 23:15:16.0028 5892 nmwcdnsu (4f0de685a96dc843ccc8a861b3fac12d) C:\Windows\system32\drivers\nmwcdnsu.sys 23:15:16.0090 5892 nmwcdnsu - ok 23:15:16.0168 5892 nmwcdnsuc (578117c0c0cf10d99c8853e83c4bc63c) C:\Windows\system32\drivers\nmwcdnsuc.sys 23:15:16.0215 5892 nmwcdnsuc - ok 23:15:16.0262 5892 npf (b48dc6abcd3aeff8618350ccbdc6b09a) C:\Windows\system32\drivers\npf.sys 23:15:16.0278 5892 npf - ok 23:15:16.0309 5892 Npfs (1db262a9f8c087e8153d89bef3d2235f) C:\Windows\system32\drivers\Npfs.sys 23:15:16.0356 5892 Npfs - ok 23:15:16.0465 5892 nsiproxy (e9a0a4d07e53d8fea2bb8387a3293c58) C:\Windows\system32\drivers\nsiproxy.sys 23:15:16.0512 5892 nsiproxy - ok 23:15:16.0590 5892 Ntfs (3795dcd21f740ee799fb7223234215af) C:\Windows\system32\drivers\Ntfs.sys 23:15:16.0636 5892 Ntfs - ok 23:15:16.0730 5892 Null (f9756a98d69098dca8945d62858a812c) C:\Windows\system32\drivers\Null.sys 23:15:16.0777 5892 Null - ok 23:15:16.0824 5892 nvraid (3f3d04b1d08d43c16ea7963954ec768d) C:\Windows\system32\DRIVERS\nvraid.sys 23:15:16.0839 5892 nvraid - ok 23:15:16.0948 5892 nvstor (c99f251a5de63c6f129cf71933aced0f) C:\Windows\system32\DRIVERS\nvstor.sys 23:15:16.0964 5892 nvstor - ok 23:15:16.0995 5892 nv_agp (5a0983915f02bae73267cc2a041f717d) C:\Windows\system32\DRIVERS\nv_agp.sys 23:15:17.0011 5892 nv_agp - ok 23:15:17.0073 5892 O2MDRDR (3141d533be9f3386c8295e8375ecdb98) C:\Windows\system32\DRIVERS\o2media.sys 23:15:17.0089 5892 O2MDRDR - ok 23:15:17.0214 5892 ohci1394 (08a70a1f2cdde9bb49b885cb817a66eb) C:\Windows\system32\DRIVERS\ohci1394.sys 23:15:17.0245 5892 ohci1394 - ok 23:15:17.0323 5892 Parport (2ea877ed5dd9713c5ac74e8ea7348d14) C:\Windows\system32\DRIVERS\parport.sys 23:15:17.0370 5892 Parport - ok 23:15:17.0463 5892 partmgr (ff4218952b51de44fe910953a3e686b9) C:\Windows\system32\drivers\partmgr.sys 23:15:17.0479 5892 partmgr - ok 23:15:17.0510 5892 Parvdm (eb0a59f29c19b86479d36b35983daadc) C:\Windows\system32\DRIVERS\parvdm.sys 23:15:17.0526 5892 Parvdm - ok 23:15:17.0604 5892 pccsmcfd (fd2041e9ba03db7764b2248f02475079) C:\Windows\system32\DRIVERS\pccsmcfd.sys 23:15:17.0635 5892 pccsmcfd - ok 23:15:17.0744 5892 pci (c858cb77c577780ecc456a892e7e7d0f) C:\Windows\system32\DRIVERS\pci.sys 23:15:17.0760 5892 pci - ok 23:15:17.0806 5892 pciide (afe86f419014db4e5593f69ffe26ce0a) C:\Windows\system32\DRIVERS\pciide.sys 23:15:17.0806 5892 pciide - ok 23:15:17.0838 5892 pcmcia (f396431b31693e71e8a80687ef523506) C:\Windows\system32\DRIVERS\pcmcia.sys 23:15:17.0853 5892 pcmcia - ok 23:15:17.0884 5892 pcw (250f6b43d2b613172035c6747aeeb19f) C:\Windows\system32\drivers\pcw.sys 23:15:17.0916 5892 pcw - ok 23:15:18.0056 5892 PEAUTH (9e0104ba49f4e6973749a02bf41344ed) C:\Windows\system32\drivers\peauth.sys 23:15:18.0118 5892 PEAUTH - ok 23:15:18.0321 5892 PptpMiniport (631e3e205ad6d86f2aed6a4a8e69f2db) C:\Windows\system32\DRIVERS\raspptp.sys 23:15:18.0352 5892 PptpMiniport - ok 23:15:18.0415 5892 Processor (85b1e3a0c7585bc4aae6899ec6fcf011) C:\Windows\system32\DRIVERS\processr.sys 23:15:18.0446 5892 Processor - ok 23:15:18.0524 5892 Psched (6270ccae2a86de6d146529fe55b3246a) C:\Windows\system32\DRIVERS\pacer.sys 23:15:18.0571 5892 Psched - ok 23:15:18.0727 5892 QIOMem (674eba70a52c02696e503b0a57ae6372) C:\Windows\system32\DRIVERS\QIOMem.sys 23:15:18.0758 5892 QIOMem - ok 23:15:18.0836 5892 ql2300 (ab95ecf1f6659a60ddc166d8315b0751) C:\Windows\system32\DRIVERS\ql2300.sys 23:15:18.0883 5892 ql2300 - ok 23:15:19.0179 5892 ql40xx (b4dd51dd25182244b86737dc51af2270) C:\Windows\system32\DRIVERS\ql40xx.sys 23:15:19.0210 5892 ql40xx - ok 23:15:19.0257 5892 QWAVEdrv (584078ca1b95ca72df2a27c336f9719d) C:\Windows\system32\drivers\qwavedrv.sys 23:15:19.0273 5892 QWAVEdrv - ok 23:15:19.0335 5892 RasAcd (30a81b53c766d0133bb86d234e5556ab) C:\Windows\system32\DRIVERS\rasacd.sys 23:15:19.0366 5892 RasAcd - ok 23:15:19.0538 5892 RasAgileVpn (57ec4aef73660166074d8f7f31c0d4fd) C:\Windows\system32\DRIVERS\AgileVpn.sys 23:15:19.0585 5892 RasAgileVpn - ok 23:15:19.0647 5892 Rasl2tp (d9f91eafec2815365cbe6d167e4e332a) C:\Windows\system32\DRIVERS\rasl2tp.sys 23:15:19.0710 5892 Rasl2tp - ok 23:15:19.0834 5892 RasPppoe (0fe8b15916307a6ac12bfb6a63e45507) C:\Windows\system32\DRIVERS\raspppoe.sys 23:15:19.0881 5892 RasPppoe - ok 23:15:19.0928 5892 RasSstp (44101f495a83ea6401d886e7fd70096b) C:\Windows\system32\DRIVERS\rassstp.sys 23:15:19.0959 5892 RasSstp - ok 23:15:20.0022 5892 rdbss (835d7e81bf517a3b72384bdcc85e1ce6) C:\Windows\system32\DRIVERS\rdbss.sys 23:15:20.0115 5892 rdbss - ok 23:15:20.0193 5892 rdpbus (0d8f05481cb76e70e1da06ee9f0da9df) C:\Windows\system32\DRIVERS\rdpbus.sys 23:15:20.0224 5892 rdpbus - ok 23:15:20.0256 5892 RDPCDD (1e016846895b15a99f9a176a05029075) C:\Windows\system32\DRIVERS\RDPCDD.sys 23:15:20.0318 5892 RDPCDD - ok 23:15:20.0521 5892 RDPDR (c5ff95883ffef704d50c40d21cfb3ab5) C:\Windows\system32\drivers\rdpdr.sys 23:15:20.0583 5892 RDPDR - ok 23:15:20.0677 5892 RDPENCDD (5a53ca1598dd4156d44196d200c94b8a) C:\Windows\system32\drivers\rdpencdd.sys 23:15:20.0708 5892 RDPENCDD - ok 23:15:20.0817 5892 RDPREFMP (44b0a53cd4f27d50ed461dae0c0b4e1f) C:\Windows\system32\drivers\rdprefmp.sys 23:15:20.0864 5892 RDPREFMP - ok 23:15:20.0973 5892 RDPWD (801371ba9782282892d00aadb08ee367) C:\Windows\system32\drivers\RDPWD.sys 23:15:21.0051 5892 RDPWD - ok 23:15:21.0114 5892 rdyboost (4ea225bf1cf05e158853f30a99ca29a7) C:\Windows\system32\drivers\rdyboost.sys 23:15:21.0129 5892 rdyboost - ok 23:15:21.0270 5892 rspndr (032b0d36ad92b582d869879f5af5b928) C:\Windows\system32\DRIVERS\rspndr.sys 23:15:21.0301 5892 rspndr - ok 23:15:21.0379 5892 RTL8187B (949f74cb383a1d5da67aea9ccd4a8b87) C:\Windows\system32\DRIVERS\RTL8187B.sys 23:15:21.0426 5892 RTL8187B - ok 23:15:21.0535 5892 s3cap (5423d8437051e89dd34749f242c98648) C:\Windows\system32\DRIVERS\vms3cap.sys 23:15:21.0550 5892 s3cap - ok 23:15:21.0613 5892 sbp2port (34ee0c44b724e3e4ce2eff29126de5b5) C:\Windows\system32\DRIVERS\sbp2port.sys 23:15:21.0628 5892 sbp2port - ok 23:15:21.0784 5892 scfilter (a95c54b2ac3cc9c73fcdf9e51a1d6b51) C:\Windows\system32\DRIVERS\scfilter.sys 23:15:21.0831 5892 scfilter - ok 23:15:22.0003 5892 sdbus (aa826e35f6d28a8e5d1efeb337f24ba2) C:\Windows\system32\DRIVERS\sdbus.sys 23:15:22.0050 5892 sdbus - ok 23:15:22.0174 5892 secdrv (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys 23:15:22.0252 5892 secdrv - ok 23:15:22.0330 5892 Serenum (9ad8b8b515e3df6acd4212ef465de2d1) C:\Windows\system32\DRIVERS\serenum.sys 23:15:22.0362 5892 Serenum - ok 23:15:22.0580 5892 Serial (5fb7fcea0490d821f26f39cc5ea3d1e2) C:\Windows\system32\DRIVERS\serial.sys 23:15:22.0627 5892 Serial - ok 23:15:22.0674 5892 sermouse (79bffb520327ff916a582dfea17aa813) C:\Windows\system32\DRIVERS\sermouse.sys 23:15:22.0705 5892 sermouse - ok 23:15:22.0892 5892 sffdisk (9f976e1eb233df46fce808d9dea3eb9c) C:\Windows\system32\DRIVERS\sffdisk.sys 23:15:22.0939 5892 sffdisk - ok 23:15:22.0986 5892 sffp_mmc (932a68ee27833cfd57c1639d375f2731) C:\Windows\system32\DRIVERS\sffp_mmc.sys 23:15:23.0032 5892 sffp_mmc - ok 23:15:23.0064 5892 sffp_sd (a0708bbd07d245c06ff9de549ca47185) C:\Windows\system32\DRIVERS\sffp_sd.sys 23:15:23.0126 5892 sffp_sd - ok 23:15:23.0220 5892 sfloppy (db96666cc8312ebc45032f30b007a547) C:\Windows\system32\DRIVERS\sfloppy.sys 23:15:23.0235 5892 sfloppy - ok 23:15:23.0391 5892 sisagp (2565cac0dc9fe0371bdce60832582b2e) C:\Windows\system32\DRIVERS\sisagp.sys 23:15:23.0407 5892 sisagp - ok 23:15:23.0438 5892 SiSRaid2 (a9f0486851becb6dda1d89d381e71055) C:\Windows\system32\DRIVERS\SiSRaid2.sys 23:15:23.0454 5892 SiSRaid2 - ok 23:15:23.0469 5892 SiSRaid4 (3727097b55738e2f554972c3be5bc1aa) C:\Windows\system32\DRIVERS\sisraid4.sys 23:15:23.0485 5892 SiSRaid4 - ok 23:15:23.0516 5892 Smb (3e21c083b8a01cb70ba1f09303010fce) C:\Windows\system32\DRIVERS\smb.sys 23:15:23.0563 5892 Smb - ok 23:15:23.0703 5892 spldr (95cf1ae7527fb70f7816563cbc09d942) C:\Windows\system32\drivers\spldr.sys 23:15:23.0719 5892 spldr - ok 23:15:23.0812 5892 sptd (cdddec541bc3c96f91ecb48759673505) C:\Windows\system32\Drivers\sptd.sys 23:15:23.0812 5892 Suspicious file (NoAccess): C:\Windows\system32\Drivers\sptd.sys. md5: cdddec541bc3c96f91ecb48759673505 23:15:23.0844 5892 sptd ( LockedFile.Multi.Generic ) - warning 23:15:23.0844 5892 sptd - detected LockedFile.Multi.Generic (1) 23:15:24.0046 5892 srv (c4a027b8c0bd3fc0699f41fa5e9e0c87) C:\Windows\system32\DRIVERS\srv.sys 23:15:24.0078 5892 srv - ok 23:15:24.0140 5892 srv2 (414bb592cad8a79649d01f9d94318fb3) C:\Windows\system32\DRIVERS\srv2.sys 23:15:24.0187 5892 srv2 - ok 23:15:24.0343 5892 SrvHsfHDA (e00fdfaff025e94f9821153750c35a6d) C:\Windows\system32\DRIVERS\VSTAZL3.SYS 23:15:24.0358 5892 SrvHsfHDA - ok 23:15:24.0468 5892 SrvHsfV92 (ceb4e3b6890e1e42dca6694d9e59e1a0) C:\Windows\system32\DRIVERS\VSTDPV3.SYS 23:15:24.0530 5892 SrvHsfV92 - ok 23:15:24.0624 5892 SrvHsfWinac (bc0c7ea89194c299f051c24119000e17) C:\Windows\system32\DRIVERS\VSTCNXT3.SYS 23:15:24.0655 5892 SrvHsfWinac - ok 23:15:24.0717 5892 srvnet (ff207d67700aa18242aaf985d3e7d8f4) C:\Windows\system32\DRIVERS\srvnet.sys 23:15:24.0748 5892 srvnet - ok 23:15:24.0858 5892 stexstor (db32d325c192b801df274bfd12a7e72b) C:\Windows\system32\DRIVERS\stexstor.sys 23:15:24.0873 5892 stexstor - ok 23:15:24.0920 5892 storflt (957e346ca948668f2496a6ccf6ff82cc) C:\Windows\system32\DRIVERS\vmstorfl.sys 23:15:24.0920 5892 storflt - ok 23:15:25.0045 5892 storvsc (d5751969dc3e4b88bf482ac8ec9fe019) C:\Windows\system32\DRIVERS\storvsc.sys 23:15:25.0060 5892 storvsc - ok 23:15:25.0138 5892 swenum (e58c78a848add9610a4db6d214af5224) C:\Windows\system32\DRIVERS\swenum.sys 23:15:25.0154 5892 swenum - ok 23:15:25.0232 5892 SynTP (502986ad48c1169072cff1e087f45a2d) C:\Windows\system32\DRIVERS\SynTP.sys 23:15:25.0248 5892 SynTP - ok 23:15:25.0404 5892 Tcpip (56c198ac82efa622dd93e9e43575f79c) C:\Windows\system32\drivers\tcpip.sys 23:15:25.0450 5892 Tcpip - ok 23:15:25.0528 5892 TCPIP6 (56c198ac82efa622dd93e9e43575f79c) C:\Windows\system32\DRIVERS\tcpip.sys 23:15:25.0575 5892 TCPIP6 - ok 23:15:25.0653 5892 tcpipreg (e64444523add154f86567c469bc0b17f) C:\Windows\system32\drivers\tcpipreg.sys 23:15:25.0716 5892 tcpipreg - ok 23:15:25.0794 5892 TDPIPE (1875c1490d99e70e449e3afae9fcbadf) C:\Windows\system32\drivers\tdpipe.sys 23:15:25.0840 5892 TDPIPE - ok 23:15:25.0887 5892 TDTCP (7551e91ea999ee9a8e9c331d5a9c31f3) C:\Windows\system32\drivers\tdtcp.sys 23:15:25.0934 5892 TDTCP - ok 23:15:26.0012 5892 tdx (cb39e896a2a83702d1737bfd402b3542) C:\Windows\system32\DRIVERS\tdx.sys 23:15:26.0059 5892 tdx - ok 23:15:26.0121 5892 TermDD (c36f41ee20e6999dbf4b0425963268a5) C:\Windows\system32\DRIVERS\termdd.sys 23:15:26.0121 5892 TermDD - ok 23:15:26.0277 5892 tssecsrv (98ae6fa07d12cb4ec5cf4a9bfa5f4242) C:\Windows\system32\DRIVERS\tssecsrv.sys 23:15:26.0324 5892 tssecsrv - ok 23:15:26.0480 5892 TuneUpUtilitiesDrv (f2107c9d85ec0df116939ccce06ae697) C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys 23:15:26.0496 5892 TuneUpUtilitiesDrv - ok 23:15:26.0605 5892 tunnel (3e461d890a97f9d4c168f5fda36e1d00) C:\Windows\system32\DRIVERS\tunnel.sys 23:15:26.0652 5892 tunnel - ok 23:15:26.0714 5892 TVALZ (fc24015b4052600c324c43e3a79c0664) C:\Windows\system32\DRIVERS\TVALZ_O.SYS 23:15:26.0730 5892 TVALZ - ok 23:15:26.0761 5892 uagp35 (750fbcb269f4d7dd2e420c56b795db6d) C:\Windows\system32\DRIVERS\uagp35.sys 23:15:26.0776 5892 uagp35 - ok 23:15:26.0886 5892 udfs (09cc3e16f8e5ee7168e01cf8fcbe061a) C:\Windows\system32\DRIVERS\udfs.sys 23:15:26.0948 5892 udfs - ok 23:15:27.0026 5892 uliagpkx (44e8048ace47befbfdc2e9be4cbc8880) C:\Windows\system32\DRIVERS\uliagpkx.sys 23:15:27.0042 5892 uliagpkx - ok 23:15:27.0073 5892 umbus (049b3a50b3d646baeeee9eec9b0668dc) C:\Windows\system32\DRIVERS\umbus.sys 23:15:27.0135 5892 umbus - ok 23:15:27.0229 5892 UmPass (7550ad0c6998ba1cb4843e920ee0feac) C:\Windows\system32\DRIVERS\umpass.sys 23:15:27.0260 5892 UmPass - ok 23:15:27.0338 5892 UnlockerDriver5 (bb879dcfd22926efbeb3298129898cbb) C:\Program Files\Unlocker\UnlockerDriver5.sys 23:15:27.0338 5892 UnlockerDriver5 ( UnsignedFile.Multi.Generic ) - warning 23:15:27.0338 5892 UnlockerDriver5 - detected UnsignedFile.Multi.Generic (1) 23:15:27.0494 5892 upperdev (78b74af8727a28c128e164e9b53a5413) C:\Windows\system32\DRIVERS\usbser_lowerflt.sys 23:15:27.0525 5892 upperdev - ok 23:15:27.0572 5892 usbccgp (8455c4ed038efd09e99327f9d2d48ffa) C:\Windows\system32\DRIVERS\usbccgp.sys 23:15:27.0603 5892 usbccgp - ok 23:15:27.0634 5892 usbcir (04ec7cec62ec3b6d9354eee93327fc82) C:\Windows\system32\DRIVERS\usbcir.sys 23:15:27.0681 5892 usbcir - ok 23:15:27.0790 5892 usbehci (1c333bfd60f2fed2c7ad5daf533cb742) C:\Windows\system32\DRIVERS\usbehci.sys 23:15:27.0806 5892 usbehci - ok 23:15:27.0853 5892 usbhub (ee6ef93ccfa94fae8c6ab298273d8ae2) C:\Windows\system32\DRIVERS\usbhub.sys 23:15:27.0900 5892 usbhub - ok 23:15:28.0009 5892 usbohci (a6fb7957ea7afb1165991e54ce934b74) C:\Windows\system32\DRIVERS\usbohci.sys 23:15:28.0056 5892 usbohci - ok 23:15:28.0118 5892 usbprint (797d862fe0875e75c7cc4c1ad7b30252) C:\Windows\system32\DRIVERS\usbprint.sys 23:15:28.0149 5892 usbprint - ok 23:15:28.0290 5892 usbscan (576096ccbc07e7c4ea4f5e6686d6888f) C:\Windows\system32\DRIVERS\usbscan.sys 23:15:28.0321 5892 usbscan - ok 23:15:28.0430 5892 usbser (88701eca76145e2c011c0eeff0f7b70e) C:\Windows\system32\drivers\usbser.sys 23:15:28.0461 5892 usbser - ok 23:15:28.0555 5892 UsbserFilt (4f8fbc51a1c0a17310846b417a447f91) C:\Windows\system32\DRIVERS\usbser_lowerfltj.sys 23:15:28.0617 5892 UsbserFilt - ok 23:15:28.0648 5892 USBSTOR (d8889d56e0d27e57ed4591837fe71d27) C:\Windows\system32\DRIVERS\USBSTOR.SYS 23:15:28.0695 5892 USBSTOR - ok 23:15:28.0773 5892 usbuhci (78780c3ebce17405b1ccd07a3a8a7d72) C:\Windows\system32\DRIVERS\usbuhci.sys 23:15:28.0789 5892 usbuhci - ok 23:15:28.0867 5892 usbvideo (b5f6a992d996282b7fae7048e50af83a) C:\Windows\System32\Drivers\usbvideo.sys 23:15:28.0929 5892 usbvideo - ok 23:15:29.0085 5892 UVCFTR (237c444fbd1c697a2e3fa60f02c61f22) C:\Windows\system32\Drivers\UVCFTR_S.SYS 23:15:29.0101 5892 UVCFTR - ok 23:15:29.0179 5892 vdrvroot (a059c4c3edb09e07d21a8e5c0aabd3cb) C:\Windows\system32\DRIVERS\vdrvroot.sys 23:15:29.0194 5892 vdrvroot - ok 23:15:29.0241 5892 vga (17c408214ea61696cec9c66e388b14f3) C:\Windows\system32\DRIVERS\vgapnp.sys 23:15:29.0288 5892 vga - ok 23:15:29.0444 5892 VgaSave (8e38096ad5c8570a6f1570a61e251561) C:\Windows\System32\drivers\vga.sys 23:15:29.0475 5892 VgaSave - ok 23:15:29.0631 5892 vhdmp (3be6e1f3a4f1afec8cee0d7883f93583) C:\Windows\system32\DRIVERS\vhdmp.sys 23:15:29.0647 5892 vhdmp - ok 23:15:29.0834 5892 viaagp (c829317a37b4bea8f39735d4b076e923) C:\Windows\system32\DRIVERS\viaagp.sys 23:15:29.0850 5892 viaagp - ok 23:15:29.0881 5892 ViaC7 (e02f079a6aa107f06b16549c6e5c7b74) C:\Windows\system32\DRIVERS\viac7.sys 23:15:29.0912 5892 ViaC7 - ok 23:15:29.0990 5892 viaide (e43574f6a56a0ee11809b48c09e4fd3c) C:\Windows\system32\DRIVERS\viaide.sys 23:15:30.0006 5892 viaide - ok 23:15:30.0068 5892 vmbus (379b349f65f453d2a6e75ea6b7448e49) C:\Windows\system32\DRIVERS\vmbus.sys 23:15:30.0084 5892 vmbus - ok 23:15:30.0115 5892 VMBusHID (ec2bbab4b84d0738c6c83d2234dc36fe) C:\Windows\system32\DRIVERS\VMBusHID.sys 23:15:30.0130 5892 VMBusHID - ok 23:15:30.0193 5892 volmgr (384e5a2aa49934295171e499f86ba6f3) C:\Windows\system32\DRIVERS\volmgr.sys 23:15:30.0193 5892 volmgr - ok 23:15:30.0302 5892 volmgrx (b5bb72067ddddbbfb04b2f89ff8c3c87) C:\Windows\system32\drivers\volmgrx.sys 23:15:30.0318 5892 volmgrx - ok 23:15:30.0396 5892 volsnap (58df9d2481a56edde167e51b334d44fd) C:\Windows\system32\DRIVERS\volsnap.sys 23:15:30.0411 5892 volsnap - ok 23:15:30.0520 5892 vsmraid (9dfa0cc2f8855a04816729651175b631) C:\Windows\system32\DRIVERS\vsmraid.sys 23:15:30.0536 5892 vsmraid - ok 23:15:30.0614 5892 vwifibus (90567b1e658001e79d7c8bbd3dde5aa6) C:\Windows\System32\drivers\vwifibus.sys 23:15:30.0676 5892 vwifibus - ok 23:15:30.0801 5892 vwififlt (7090d3436eeb4e7da3373090a23448f7) C:\Windows\system32\DRIVERS\vwififlt.sys 23:15:30.0817 5892 vwififlt - ok 23:15:30.0973 5892 WacomPen (de3721e89c653aa281428c8a69745d90) C:\Windows\system32\DRIVERS\wacompen.sys 23:15:31.0020 5892 WacomPen - ok 23:15:31.0082 5892 WANARP (692a712062146e96d28ba0b7d75de31b) C:\Windows\system32\DRIVERS\wanarp.sys 23:15:31.0144 5892 WANARP - ok 23:15:31.0160 5892 Wanarpv6 (692a712062146e96d28ba0b7d75de31b) C:\Windows\system32\DRIVERS\wanarp.sys 23:15:31.0207 5892 Wanarpv6 - ok 23:15:31.0378 5892 Wd (1112a9badacb47b7c0bb0392e3158dff) C:\Windows\system32\DRIVERS\wd.sys 23:15:31.0394 5892 Wd - ok 23:15:31.0441 5892 Wdf01000 (9950e3d0f08141c7e89e64456ae7dc73) C:\Windows\system32\drivers\Wdf01000.sys 23:15:31.0456 5892 Wdf01000 - ok 23:15:31.0628 5892 WfpLwf (8b9a943f3b53861f2bfaf6c186168f79) C:\Windows\system32\DRIVERS\wfplwf.sys 23:15:31.0659 5892 WfpLwf - ok 23:15:31.0784 5892 WIMMount (5cf95b35e59e2a38023836fff31be64c) C:\Windows\system32\drivers\wimmount.sys 23:15:31.0800 5892 WIMMount - ok 23:15:31.0940 5892 WINUSB (30fc6e5448d0cbaaa95280eeef7fedae) C:\Windows\system32\DRIVERS\WinUSB.SYS 23:15:31.0956 5892 WINUSB - ok 23:15:32.0143 5892 WmiAcpi (0217679b8fca58714c3bf2726d2ca84e) C:\Windows\system32\DRIVERS\wmiacpi.sys 23:15:32.0158 5892 WmiAcpi - ok 23:15:32.0268 5892 ws2ifsl (6db3276587b853bf886b69528fdb048c) C:\Windows\system32\drivers\ws2ifsl.sys 23:15:32.0330 5892 ws2ifsl - ok 23:15:32.0642 5892 WudfPf (6f9b6c0c93232cff47d0f72d6db1d21e) C:\Windows\system32\drivers\WudfPf.sys 23:15:32.0689 5892 WudfPf - ok 23:15:32.0829 5892 WUDFRd (f91ff1e51fca30b3c3981db7d5924252) C:\Windows\system32\DRIVERS\WUDFRd.sys 23:15:32.0892 5892 WUDFRd - ok 23:15:33.0063 5892 yukonw7 (b07c5b7efdf936ff93d4f540938725be) C:\Windows\system32\DRIVERS\yk62x86.sys 23:15:33.0126 5892 yukonw7 - ok 23:15:33.0188 5892 MBR (0x1B8) (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0 23:15:33.0328 5892 \Device\Harddisk0\DR0 - ok 23:15:33.0328 5892 Boot (0x1200) (0a018b932d11ecba233fafbbe6fa1b76) \Device\Harddisk0\DR0\Partition0 23:15:33.0328 5892 \Device\Harddisk0\DR0\Partition0 - ok 23:15:33.0360 5892 Boot (0x1200) (14291f5be6122cf2d54a42a6d5d29ff9) \Device\Harddisk0\DR0\Partition1 23:15:33.0360 5892 \Device\Harddisk0\DR0\Partition1 - ok 23:15:33.0375 5892 Boot (0x1200) (52172242d95b77df025eaf91f81d8874) \Device\Harddisk0\DR0\Partition2 23:15:33.0375 5892 \Device\Harddisk0\DR0\Partition2 - ok 23:15:33.0375 5892 ============================================================ 23:15:33.0375 5892 Scan finished 23:15:33.0375 5892 ============================================================ 23:15:33.0406 3152 Detected object count: 5 23:15:33.0406 3152 Actual detected object count: 5 23:16:41.0922 3152 CSC ( UnsignedFile.Multi.Generic ) - skipped by user 23:16:41.0922 3152 CSC ( UnsignedFile.Multi.Generic ) - User select action: Skip 23:16:41.0922 3152 epmntdrv ( UnsignedFile.Multi.Generic ) - skipped by user 23:16:41.0922 3152 epmntdrv ( UnsignedFile.Multi.Generic ) - User select action: Skip 23:16:41.0937 3152 EuGdiDrv ( UnsignedFile.Multi.Generic ) - skipped by user 23:16:41.0937 3152 EuGdiDrv ( UnsignedFile.Multi.Generic ) - User select action: Skip 23:16:41.0937 3152 sptd ( LockedFile.Multi.Generic ) - skipped by user 23:16:41.0937 3152 sptd ( LockedFile.Multi.Generic ) - User select action: Skip 23:16:41.0937 3152 UnlockerDriver5 ( UnsignedFile.Multi.Generic ) - skipped by user 23:16:41.0937 3152 UnlockerDriver5 ( UnsignedFile.Multi.Generic ) - User select action: Skip 23:17:12.0467 5304 Deinitialize success Combofix започна работа, синия екран казваше, че ще отнеме 10 мин или двойно..., аз чаках над половин час и не свършва...През това време 2-3 пъти излизаше прозорец със съобщение: Freeware implementation of XCACLAS stopped working. и опция Close Program. Това се случи 3 пъти (кликвам на Close) и и така и не свършва с лог файл...

Изтрийте вашето копие на ComboFix, изтеглете ново на вашия десктор. След това, стартирайте Windows 7 в Safe Mode with Networking. http://windows.microsoft.com/bg-bg/windows7/Start-your-computer-in-safe-mode Накрая, опитайте да стартирате ComboFix от там.

  • Автор

Изтрийте вашето копие на ComboFix, изтеглете ново на вашия десктор. След това, стартирайте Windows 7 в Safe Mode with Networking.

http://windows.micro...er-in-safe-mode

Накрая, опитайте да стартирате ComboFix от там.

Направих го. По едно време даде съобщение:

ComboFix has detected the presence of rootkit activity end need to reboot.

Направи си Reboot и след около 40 мин и още някой и друг рибут и няколко съобщения

Reyicle bin is corupted, do you want to empty it?

Накрая започна да изписва

completed stage _1

-------------

така до стеидж 50, после започна делитинг на някакви файлове и накрая нищо, не намирам лог файл. Къде трябва да е ако го има?

В C: намирам папка ComboFix в която има 3 папки en-GB. en-US и N_ и много категории файлове ,като има и 6 текстови файла:

ComboFix.txt

ComboFix 12-02-27.02 - user 27/02/2012 21:57:23.2.2 - x86

Microsoft® Windows 7 Eternity™ 2009 6.1.7600.0.1251.359.1033.18.1918.1110 [GMT 0:00]

Running from: C:\Users\user\Desktop\ComboFix.exe

AV: AVG Anti-Virus *Disabled/Outdated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}

SP: AVG Anti-Virus *Disabled/Outdated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

Driverlist.txt

1394ohci C:\Windows\system32\DRIVERS\1394ohci.sys

ACPI C:\Windows\system32\DRIVERS\ACPI.sys

AcpiPmi C:\Windows\system32\DRIVERS\acpipmi.sys

adp94xx C:\Windows\system32\DRIVERS\adp94xx.sys

adpahci C:\Windows\system32\DRIVERS\adpahci.sys

adpu320 C:\Windows\system32\DRIVERS\adpu320.sys

AFD C:\Windows\system32\drivers\afd.sys

agp440 C:\Windows\system32\DRIVERS\agp440.sys

aic78xx C:\Windows\system32\DRIVERS\djsvs.sys

aliide C:\Windows\system32\DRIVERS\aliide.sys

amdagp C:\Windows\system32\DRIVERS\amdagp.sys

amdide C:\Windows\system32\DRIVERS\amdide.sys

AmdK8 C:\Windows\system32\DRIVERS\amdk8.sys

AmdPPM C:\Windows\system32\DRIVERS\amdppm.sys

amdsata C:\Windows\system32\DRIVERS\amdsata.sys

amdsbs C:\Windows\system32\DRIVERS\amdsbs.sys

amdxata C:\Windows\system32\DRIVERS\amdxata.sys

AppID C:\Windows\system32\drivers\appid.sys

arc C:\Windows\system32\DRIVERS\arc.sys

arcsas C:\Windows\system32\DRIVERS\arcsas.sys

AsyncMac C:\Windows\system32\DRIVERS\asyncmac.sys

atapi C:\Windows\system32\DRIVERS\atapi.sys

atikmdag C:\Windows\system32\DRIVERS\atikmdag.sys

AvgLdx86 C:\Windows\system32\Drivers\avgldx86.sys

AvgMfx86 C:\Windows\system32\Drivers\avgmfx86.sys

AvgRkx86 C:\Windows\system32\Drivers\avgrkx86.sys

AvgTdiX C:\Windows\system32\Drivers\avgtdix.sys

b06bdrv C:\Windows\system32\DRIVERS\bxvbdx.sys

b57nd60x C:\Windows\system32\DRIVERS\b57nd60x.sys

blbdrive C:\Windows\system32\DRIVERS\blbdrive.sys

bowser C:\Windows\system32\DRIVERS\bowser.sys

BrFiltLo C:\Windows\system32\DRIVERS\BrFiltLo.sys

BrFiltUp C:\Windows\system32\DRIVERS\BrFiltUp.sys

BridgeMP C:\Windows\system32\DRIVERS\bridge.sys

Brserid C:\Windows\system32\Drivers\Brserid.sys

BrSerWdm C:\Windows\system32\Drivers\BrSerWdm.sys

BrUsbMdm C:\Windows\system32\Drivers\BrUsbMdm.sys

BrUsbSer C:\Windows\system32\Drivers\BrUsbSer.sys

BTHMODEM C:\Windows\system32\DRIVERS\bthmodem.sys

cdfs C:\Windows\system32\DRIVERS\cdfs.sys

cdrom C:\Windows\system32\DRIVERS\cdrom.sys

circlass C:\Windows\system32\DRIVERS\circlass.sys

CmBatt C:\Windows\system32\DRIVERS\CmBatt.sys

cmdide C:\Windows\system32\DRIVERS\cmdide.sys

CNG C:\Windows\system32\Drivers\cng.sys

CnxtHdAudService C:\Windows\system32\drivers\CHDRT32.sys

CnxtHdmiAudService C:\Windows\system32\drivers\CHDMI32.sys

Compbatt C:\Windows\system32\DRIVERS\compbatt.sys

CompositeBus C:\Windows\system32\DRIVERS\CompositeBus.sys

crcdisk C:\Windows\system32\DRIVERS\crcdisk.sys

CSC C:\Windows\system32\drivers\csc.sys

DfsC C:\Windows\system32\Drivers\dfsc.sys

discache C:\Windows\system32\drivers\discache.sys

Disk C:\Windows\system32\DRIVERS\disk.sys

drmkaud C:\Windows\system32\drivers\drmkaud.sys

DXGKrnl C:\Windows\system32\drivers\dxgkrnl.sys

ebdrv C:\Windows\system32\DRIVERS\evbdx.sys

elxstor C:\Windows\system32\DRIVERS\elxstor.sys

ErrDev C:\Windows\system32\DRIVERS\errdev.sys

fdc C:\Windows\system32\DRIVERS\fdc.sys

FileInfo C:\Windows\system32\drivers\fileinfo.sys

Filetrace C:\Windows\system32\drivers\filetrace.sys

flpydisk C:\Windows\system32\DRIVERS\flpydisk.sys

FltMgr C:\Windows\system32\drivers\fltmgr.sys

FsDepends C:\Windows\system32\drivers\FsDepends.sys

FTDIBUS C:\Windows\system32\drivers\ftdibus.sys

FTSER2K C:\Windows\system32\drivers\ftser2k.sys

fvevol C:\Windows\system32\DRIVERS\fvevol.sys

gagp30kx C:\Windows\system32\DRIVERS\gagp30kx.sys

hcw85cir C:\Windows\system32\drivers\hcw85cir.sys

HdAudAddService C:\Windows\system32\drivers\HdAudio.sys

HDAudBus C:\Windows\system32\DRIVERS\HDAudBus.sys

HidBatt C:\Windows\system32\DRIVERS\HidBatt.sys

HidBth C:\Windows\system32\DRIVERS\hidbth.sys

HidIr C:\Windows\system32\DRIVERS\hidir.sys

HidUsb C:\Windows\system32\DRIVERS\hidusb.sys

HpSAMD C:\Windows\system32\DRIVERS\HpSAMD.sys

HTTP C:\Windows\system32\drivers\HTTP.sys

hwpolicy C:\Windows\system32\drivers\hwpolicy.sys

i8042prt C:\Windows\system32\DRIVERS\i8042prt.sys

iaStorV C:\Windows\system32\DRIVERS\iaStorV.sys

iirsp C:\Windows\system32\DRIVERS\iirsp.sys

IKFileSec C:\Windows\system32\drivers\ikfilesec.sys

IKSysFlt C:\Windows\system32\drivers\iksysflt.sys

IKSysSec C:\Windows\system32\drivers\iksyssec.sys

intelide C:\Windows\system32\DRIVERS\intelide.sys

intelppm C:\Windows\system32\DRIVERS\intelppm.sys

IpFilterDriver C:\Windows\system32\DRIVERS\ipfltdrv.sys

IPMIDRV C:\Windows\system32\DRIVERS\IPMIDrv.sys

IPNAT C:\Windows\system32\drivers\ipnat.sys

IRENUM C:\Windows\system32\drivers\irenum.sys

isapnp C:\Windows\system32\DRIVERS\isapnp.sys

iScsiPrt C:\Windows\system32\DRIVERS\msiscsi.sys

kbdclass C:\Windows\system32\DRIVERS\kbdclass.sys

kbdhid C:\Windows\system32\DRIVERS\kbdhid.sys

KSecDD C:\Windows\system32\Drivers\ksecdd.sys

KSecPkg C:\Windows\system32\Drivers\ksecpkg.sys

lltdio C:\Windows\system32\DRIVERS\lltdio.sys

LSI_FC C:\Windows\system32\DRIVERS\lsi_fc.sys

LSI_SAS C:\Windows\system32\DRIVERS\lsi_sas.sys

LSI_SAS2 C:\Windows\system32\DRIVERS\lsi_sas2.sys

LSI_SCSI C:\Windows\system32\DRIVERS\lsi_scsi.sys

luafv C:\Windows\system32\drivers\luafv.sys

megasas C:\Windows\system32\DRIVERS\megasas.sys

MegaSR C:\Windows\system32\DRIVERS\MegaSR.sys

Modem C:\Windows\system32\drivers\modem.sys

monitor C:\Windows\system32\DRIVERS\monitor.sys

mouclass C:\Windows\system32\DRIVERS\mouclass.sys

mouhid C:\Windows\system32\DRIVERS\mouhid.sys

mountmgr C:\Windows\system32\drivers\mountmgr.sys

mpio C:\Windows\system32\DRIVERS\mpio.sys

mpsdrv C:\Windows\system32\drivers\mpsdrv.sys

MRxDAV C:\Windows\system32\drivers\mrxdav.sys

mrxsmb C:\Windows\system32\DRIVERS\mrxsmb.sys

mrxsmb10 C:\Windows\system32\DRIVERS\mrxsmb10.sys

mrxsmb20 C:\Windows\system32\DRIVERS\mrxsmb20.sys

msahci C:\Windows\system32\DRIVERS\msahci.sys

msdsm C:\Windows\system32\DRIVERS\msdsm.sys

mshidkmdf C:\Windows\system32\drivers\mshidkmdf.sys

msisadrv C:\Windows\system32\DRIVERS\msisadrv.sys

MSKSSRV C:\Windows\system32\drivers\MSKSSRV.sys

MSPCLOCK C:\Windows\system32\drivers\MSPCLOCK.sys

MSPQM C:\Windows\system32\drivers\MSPQM.sys

mssmbios C:\Windows\system32\DRIVERS\mssmbios.sys

MSTEE C:\Windows\system32\drivers\MSTEE.sys

MTConfig C:\Windows\system32\DRIVERS\MTConfig.sys

Mup C:\Windows\system32\Drivers\mup.sys

NativeWifiP C:\Windows\system32\DRIVERS\nwifi.sys

NDIS C:\Windows\system32\drivers\ndis.sys

NdisCap C:\Windows\system32\DRIVERS\ndiscap.sys

NdisTapi C:\Windows\system32\DRIVERS\ndistapi.sys

Ndisuio C:\Windows\system32\DRIVERS\ndisuio.sys

NdisWan C:\Windows\system32\DRIVERS\ndiswan.sys

NetBIOS C:\Windows\system32\DRIVERS\netbios.sys

NetBT C:\Windows\system32\DRIVERS\netbt.sys

nfrd960 C:\Windows\system32\DRIVERS\nfrd960.sys

nmwcd C:\Windows\system32\drivers\ccdcmb.sys

nmwcdc C:\Windows\system32\drivers\ccdcmbo.sys

nmwcdnsu C:\Windows\system32\drivers\nmwcdnsu.sys

nmwcdnsuc C:\Windows\system32\drivers\nmwcdnsuc.sys

npf C:\Windows\system32\drivers\npf.sys

nsiproxy C:\Windows\system32\drivers\nsiproxy.sys

nvraid C:\Windows\system32\DRIVERS\nvraid.sys

nvstor C:\Windows\system32\DRIVERS\nvstor.sys

nv_agp C:\Windows\system32\DRIVERS\nv_agp.sys

O2MDRDR C:\Windows\system32\DRIVERS\o2media.sys

ohci1394 C:\Windows\system32\DRIVERS\ohci1394.sys

Parport C:\Windows\system32\DRIVERS\parport.sys

partmgr C:\Windows\system32\drivers\partmgr.sys

Parvdm C:\Windows\system32\DRIVERS\parvdm.sys

pccsmcfd C:\Windows\system32\DRIVERS\pccsmcfd.sys

pci C:\Windows\system32\DRIVERS\pci.sys

pciide C:\Windows\system32\DRIVERS\pciide.sys

pcmcia C:\Windows\system32\DRIVERS\pcmcia.sys

pcw C:\Windows\system32\drivers\pcw.sys

PEAUTH C:\Windows\system32\drivers\peauth.sys

PptpMiniport C:\Windows\system32\DRIVERS\raspptp.sys

Processor C:\Windows\system32\DRIVERS\processr.sys

Psched C:\Windows\system32\DRIVERS\pacer.sys

QIOMem C:\Windows\system32\DRIVERS\QIOMem.sys

ql2300 C:\Windows\system32\DRIVERS\ql2300.sys

ql40xx C:\Windows\system32\DRIVERS\ql40xx.sys

QWAVEdrv C:\Windows\system32\drivers\qwavedrv.sys

RasAcd C:\Windows\system32\DRIVERS\rasacd.sys

RasAgileVpn C:\Windows\system32\DRIVERS\AgileVpn.sys

Rasl2tp C:\Windows\system32\DRIVERS\rasl2tp.sys

RasPppoe C:\Windows\system32\DRIVERS\raspppoe.sys

RasSstp C:\Windows\system32\DRIVERS\rassstp.sys

rdbss C:\Windows\system32\DRIVERS\rdbss.sys

rdpbus C:\Windows\system32\DRIVERS\rdpbus.sys

RDPCDD C:\Windows\system32\DRIVERS\RDPCDD.sys

RDPDR C:\Windows\system32\drivers\rdpdr.sys

RDPENCDD C:\Windows\system32\drivers\rdpencdd.sys

RDPREFMP C:\Windows\system32\drivers\rdprefmp.sys

rdyboost C:\Windows\system32\drivers\rdyboost.sys

rspndr C:\Windows\system32\DRIVERS\rspndr.sys

RTL8187B C:\Windows\system32\DRIVERS\RTL8187B.sys

s3cap C:\Windows\system32\DRIVERS\vms3cap.sys

sbp2port C:\Windows\system32\DRIVERS\sbp2port.sys

scfilter C:\Windows\system32\DRIVERS\scfilter.sys

sdbus C:\Windows\system32\DRIVERS\sdbus.sys

Serenum C:\Windows\system32\DRIVERS\serenum.sys

Serial C:\Windows\system32\DRIVERS\serial.sys

sermouse C:\Windows\system32\DRIVERS\sermouse.sys

sffdisk C:\Windows\system32\DRIVERS\sffdisk.sys

sffp_mmc C:\Windows\system32\DRIVERS\sffp_mmc.sys

sffp_sd C:\Windows\system32\DRIVERS\sffp_sd.sys

sfloppy C:\Windows\system32\DRIVERS\sfloppy.sys

sisagp C:\Windows\system32\DRIVERS\sisagp.sys

SiSRaid2 C:\Windows\system32\DRIVERS\SiSRaid2.sys

SiSRaid4 C:\Windows\system32\DRIVERS\sisraid4.sys

Smb C:\Windows\system32\DRIVERS\smb.sys

sptd C:\Windows\system32\Drivers\sptd.sys

srv C:\Windows\system32\DRIVERS\srv.sys

srv2 C:\Windows\system32\DRIVERS\srv2.sys

SrvHsfHDA C:\Windows\system32\DRIVERS\VSTAZL3.SYS

SrvHsfV92 C:\Windows\system32\DRIVERS\VSTDPV3.SYS

SrvHsfWinac C:\Windows\system32\DRIVERS\VSTCNXT3.SYS

srvnet C:\Windows\system32\DRIVERS\srvnet.sys

stexstor C:\Windows\system32\DRIVERS\stexstor.sys

storflt C:\Windows\system32\DRIVERS\vmstorfl.sys

storvsc C:\Windows\system32\DRIVERS\storvsc.sys

swenum C:\Windows\system32\DRIVERS\swenum.sys

SynTP C:\Windows\system32\DRIVERS\SynTP.sys

Tcpip C:\Windows\system32\drivers\tcpip.sys

TCPIP6 C:\Windows\system32\DRIVERS\tcpip.sys

tcpipreg C:\Windows\system32\drivers\tcpipreg.sys

TDPIPE C:\Windows\system32\drivers\tdpipe.sys

TDTCP C:\Windows\system32\drivers\tdtcp.sys

tdx C:\Windows\system32\DRIVERS\tdx.sys

TermDD C:\Windows\system32\DRIVERS\termdd.sys

tssecsrv C:\Windows\system32\DRIVERS\tssecsrv.sys

tunnel C:\Windows\system32\DRIVERS\tunnel.sys

TVALZ C:\Windows\system32\DRIVERS\TVALZ_O.SYS

uagp35 C:\Windows\system32\DRIVERS\uagp35.sys

udfs C:\Windows\system32\DRIVERS\udfs.sys

uliagpkx C:\Windows\system32\DRIVERS\uliagpkx.sys

umbus C:\Windows\system32\DRIVERS\umbus.sys

UmPass C:\Windows\system32\DRIVERS\umpass.sys

upperdev C:\Windows\system32\DRIVERS\usbser_lowerflt.sys

usbccgp C:\Windows\system32\DRIVERS\usbccgp.sys

usbcir C:\Windows\system32\DRIVERS\usbcir.sys

usbehci C:\Windows\system32\DRIVERS\usbehci.sys

usbhub C:\Windows\system32\DRIVERS\usbhub.sys

usbohci C:\Windows\system32\DRIVERS\usbohci.sys

usbprint C:\Windows\system32\DRIVERS\usbprint.sys

usbscan C:\Windows\system32\DRIVERS\usbscan.sys

usbser C:\Windows\system32\drivers\usbser.sys

UsbserFilt C:\Windows\system32\DRIVERS\usbser_lowerfltj.sys

USBSTOR C:\Windows\system32\DRIVERS\USBSTOR.SYS

usbuhci C:\Windows\system32\DRIVERS\usbuhci.sys

usbvideo C:\Windows\system32\Drivers\usbvideo.sys

UVCFTR C:\Windows\system32\Drivers\UVCFTR_S.SYS

vdrvroot C:\Windows\system32\DRIVERS\vdrvroot.sys

vga C:\Windows\system32\DRIVERS\vgapnp.sys

VgaSave C:\Windows\system32\drivers\vga.sys

vhdmp C:\Windows\system32\DRIVERS\vhdmp.sys

viaagp C:\Windows\system32\DRIVERS\viaagp.sys

ViaC7 C:\Windows\system32\DRIVERS\viac7.sys

viaide C:\Windows\system32\DRIVERS\viaide.sys

vmbus C:\Windows\system32\DRIVERS\vmbus.sys

VMBusHID C:\Windows\system32\DRIVERS\VMBusHID.sys

volmgr C:\Windows\system32\DRIVERS\volmgr.sys

volmgrx C:\Windows\system32\drivers\volmgrx.sys

volsnap C:\Windows\system32\DRIVERS\volsnap.sys

vsmraid C:\Windows\system32\DRIVERS\vsmraid.sys

vwifibus C:\Windows\system32\drivers\vwifibus.sys

vwififlt C:\Windows\system32\DRIVERS\vwififlt.sys

WacomPen C:\Windows\system32\DRIVERS\wacompen.sys

WANARP C:\Windows\system32\DRIVERS\wanarp.sys

Wanarpv6 C:\Windows\system32\DRIVERS\wanarp.sys

Wd C:\Windows\system32\DRIVERS\wd.sys

Wdf01000 C:\Windows\system32\drivers\Wdf01000.sys

WfpLwf C:\Windows\system32\DRIVERS\wfplwf.sys

WIMMount C:\Windows\system32\drivers\wimmount.sys

WINUSB C:\Windows\system32\DRIVERS\WinUSB.SYS

WmiAcpi C:\Windows\system32\DRIVERS\wmiacpi.sys

ws2ifsl C:\Windows\system32\drivers\ws2ifsl.sys

WudfPf C:\Windows\system32\drivers\WudfPf.sys

WUDFRd C:\Windows\system32\DRIVERS\WUDFRd.sys

yukonw7 C:\Windows\system32\DRIVERS\yk62x86.sys

Osld.txt

Microsoft® Windows 7 Eternity™ 2009 6.1.7600.0.1251.359.1033.18.1918.1110 [GMT 0:00]

pend,txt

.:\\\(0!\|0\\0\)

C:\\Windows\\system32\\\(\\\|0!\|0\\0\)

C:\\Windows\\system32\\config\\\(\\\|0!\|0\\0\)

C:\\Windows\\system32\\csrss.exe\\\(0!\|0\\0\)

C:\\Windows\\system32\\Drivers\\\(\\\|0!\|0\\0\)

C:\\Windows\\system32\\hal.dll\\\(0!\|0\\0\)

C:\\Windows\\system32\\lsass.exe\\\(0!\|0\\0\)

C:\\Windows\\system32\\ntdll.dll\\\(0!\|0\\0\)

C:\\Windows\\system32\\services.exe\\\(0!\|0\\0\)

C:\\Windows\\system32\\smss.exe\\\(0!\|0\\0\)

C:\\Windows\\system32\\svchost.exe\\\(0!\|0\\0\)

C:\\Windows\\system32\\userinit.exe\\\(0!\|0\\0\)

C:\\Windows\\system32\\wbem\\\(\\\|0!\|0\\0\)

C:\\Windows\\system32\\winlogon.exe\\\(0!\|0\\0\)

C:\\boot.ini\\\(0!\|0\\0\)

C:\\ntdetect.com\\\(0!\|0\\0\)

C:\\ntldr\\\(0!\|0\\0\)

C:\\Windows\\\(\\\|0!\|0\\0\)

C:\\Windows\\explorer.exe\\\(0!\|0\\0\)

Resident.txt

AV: AVG Anti-Virus *Disabled/Outdated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}

SP: AVG Anti-Virus *Disabled/Outdated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

version.txt

12-02-02.01 4395504 M 11-05-29.09

Преди тези процедури спрях AVG доколкото може...

Всъщност до тук ясно ли е каква е заразата и какво вредно прави?

Редактирано от Kibik (преглед на промените)

Като цяло проблемите са много според лог файла от AVG, но най-опасното за момента е модифицирането на системните файлове. Изглежда, че това може да се окаже съвсем реална опастност. До голяма степен проблемите се дължат и на пиратския софтуер, който използвате. Моля, копирайте цялото съдържание на ComboFix.txt

  • Автор

Моля, копирайте цялото съдържание на ComboFix.txt

Аз го бях копирал в предния пост, но не знам дали за него става въпрос. Аз очаквах, че като свърши програмата ще създаде текстов файл на десктопа, а този трябваше да го търся в голямата навалица от създадени файлове в C:/ComboFix/Text Document

ComboFix 12-02-27.02 - user 27/02/2012 21:57:23.2.2 - x86

Microsoft® Windows 7 Eternity™ 2009 6.1.7600.0.1251.359.1033.18.1918.1110 [GMT 0:00]

Running from: C:\Users\user\Desktop\ComboFix.exe

AV: AVG Anti-Virus *Disabled/Outdated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}

SP: AVG Anti-Virus *Disabled/Outdated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

В такъв случай, нека опитаме с нещо друго:

Изтеглете OTL.exe и го запазете на десктопа.

  • Стартирайте OTL (ако е необходимо, потвърдете през UAC).
  • Направете следните настройки:
  • Сложете отметка пред Scan All Users Публикувано изображение
  • Под менюто File Age изберете 90 days
  • Под менюто Standard Registryпроменете на ALL
  • Сложете отметки пред LOP и Purity Check
Под Публикувано изображение с Copy/ Paste въведете изцяло следната текстова информация (само това, което е поставено в карето):

netsvcs
msconfig
safebootminimal
safebootnetwork
%SYSTEMDRIVE%*.*
%USERPROFILE%*.*
%USERPROFILE%AppDataLocal*.*
%USERPROFILE%AppDataRoaming*.*
%ProgramData%*.*
%CommonProgramFiles%*.*
%PROGRAMFILES%*.*
%systemroot%system32configsystemprofileAppDataLocal*.*
%windir%SysWOW64configsystemprofileAppDataLocal*.*
%windir%ServiceProfilesLocalServiceAppDataLocalTemp*.*
%windir%ServiceProfilesNetworkServiceAppDataLocalTemp*.*
%windir%temp*.*
%systemroot%system32*.dll /lockedfiles
%systemroot%syswow64*.dll /lockedfiles
%systemroot%Tasks*.job /lockedfiles
%systemroot%system32drivers*.sys /90
%systemroot%system32drivers*.sys /lockedfiles
%systemroot%syswow64drivers*.sys /90
%systemroot%syswow64drivers*.sys /lockedfiles
%systemroot%system32Spoolprtprocsw32x86*.dll
%systemroot%*. /mp /s
%systemroot%assemblytemp*.* /S /MD5
%systemroot%assemblytmp*.* /S /MD5
%systemroot%assemblyGAC_32*.* /S /MD5
%systemroot%assemblyGAC_64*.* /S /MD5
%SystemRoot%assemblyGAC_MSIL*.* /S /MD5
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSession ManagerSubSystems /s
/md5start
explorer.exe
lsass.exe
svchost.exe
wininit.exe
winlogon.exe
userinit.exe
atapi.sys
iaStor.sys
serial.sys
volsnap.sys
disk.sys
redbook.sys
i8042prt.sys
afd.sys
netbt.sys
tcpip.sys
hlp.dat
/md5stop
  • Натиснете маркираният в синьо бутон: Run Scan.
  • Като приключи проверката, ще се създадат два файла - OTL.Txt и Extras.Txt. Прикачете тези два файла в следващия си коментар (погледнете опцията Прикачени файлове, когато публикувате мнение).

Моля, деинсталирайте следните приложения: DealPly, McAfee Security Scan Plus и Spyware Doctor. Накрая рестартирайте компютъра си.

Стартирайте отново OTL, копирайте (Copy) и поставете (Paste) скриптовия текст от текстовото поле по-долу под колонката Custom Scans/Fixes, като не забравяте да копирате скрипта 1 към 1, както и двете точки преди първия ред на скрипта.

:OTL
[2012/02/10 00:13:52 | 000,000,000 | ---D | M] (DealPly) -- C:UsersuserAppDataRoamingMozillaFirefoxProfiles2zame245.defaultextensions{EB9394A3-4AD6-4918-9537-31A1FD8E8EDF}
CHR - Extension: DealPly = C:UsersuserAppDataLocalGoogleChromeUser DataDefaultExtensionsgaiilaahiahdejapggenmdmafpmbipje3.0.7.2_0
MsConfig - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^McAfee Security Scan Plus.lnk - C:Program FilesMcAfee Security Scan2.0.181SSScheduler.exe - (McAfee, Inc.)
[2012/02/18 23:17:39 | 000,000,000 | -HS- | C] () -- C:WindowsSystem32dds_trash_log.cmd
[2012/02/19 01:05:49 | 000,000,112 | ---- | M] () -- C:ProgramDatavKKekCSJ.dat

:commands
[emptytemp]
[clearallrestorepoints]
След като въведете скрипта от цитата по-горе натиснете бутона, маркиран в червено: Run Fix

Windows ще се рестартира и ще се създаде лог файл. Публикувайте съдържанието му с Copy/Paste в следващия си коментар.

Огледайте в папката на ComboFix за текстов файл с име ComboFix-quarantined files и ако има, публикувайте съдържанието му.

  • Автор

Деинсталирах трите програми,DealPly не знам как е попаднала при мен...

В папката на ComboFix не намирам файл ComboFix-quarantined files , преди бях постнал всичките 6 текстови файла там.

Ето лог файла:

All processes killed

========== OTL ==========

Folder C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2zame245.default\extensions\{EB9394A3-4AD6-4918-9537-31A1FD8E8EDF}\ not found.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\gaiilaahiahdejapggenmdmafpmbipje\3.0.7.2_0\images folder moved successfully.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\gaiilaahiahdejapggenmdmafpmbipje\3.0.7.2_0 folder moved successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\StartUpFolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^McAfee Security Scan Plus.lnk\ deleted successfully.

C:\Windows\pss\McAfee Security Scan Plus.lnk.CommonStartup moved successfully.

C:\Windows\System32\dds_trash_log.cmd moved successfully.

C:\ProgramData\vKKekCSJ.dat moved successfully.

========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

->Flash cache emptied: 56502 bytes

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

->Flash cache emptied: 0 bytes

User: Public

User: user

->Temp folder emptied: 15926343 bytes

->Temporary Internet Files folder emptied: 340264 bytes

->FireFox cache emptied: 57085159 bytes

->Google Chrome cache emptied: 16830258 bytes

->Flash cache emptied: 1242 bytes

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 181458457 bytes

%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes

RecycleBin emptied: 5602 bytes

Total Files Cleaned = 259.00 mb

OTL by OldTimer - Version 3.2.33.2 log created on 02282012_230245

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

  • Автор

Да разбирам ли, че повече няма какво да се направи? След всичките процедури (бях спрял AVG) пуснах AVG, но не работеше напълно, т.е. не можеха да се активират някои функции. Деинсталирах го и го инсталирах наново (някаква по-нова версия), ъпдейтна се... Поведението е подобно- от време на време пак се предлагат някакви dll да ги местя във vault... Някои от тях не може да ги премести, казва, че ги няма... Повече ме притеснява, че има постоянен равномерен даунлоуд 30-40 KB/s и ъплоуд 3-4 KB/s, понякога за малко даунлоуда се увеличава рязко на 300- 600 KB/s Процесора е на 100%, вентилатора върти.

Редактирано от Kibik (преглед на промените)

Вашата система е много сериозно инфектирана, но тъй като нямам достатъчно време, не мога да продължа работата си с вас. Някой, колега ще ви поеме съвсем скоро.

Здравейте,

Аз ще продължа случая ви.

Моля повторете сканирането с OTL, както е описано тук.

Публикувайте свежите лог файлове.

  • Автор

Здравейте,

Аз ще продължа случая ви.

Моля повторете сканирането с OTL, както е описано тук.

Публикувайте свежите лог файлове.

Благодаря

Не е казахте дали при скана да спра AVG и кои му компоненти и дали да спра връзката с нета.

Скана тръгна, след малко показа Not responding за около минута, но все пак прдължи свърши, но направи само OTL.txt, не знам защо няма Extras.

По време на скана 1-2 пъти AVG предложи (както прави обикновено , през 10 мин) 1-2 dll файла да партя във Vault, направих го.

P.S. Направих и втори скан- същата работа, няма Extras, има само OTL, прикачвам и него:(OTL3)

"BTW към кой модератор да се обърна да решим въпроса с известяването ми при нов отговор, защото въпреки, че съм абониран за темата, не ме известява и трябва постоянно ръчно да проверявам за нов отговор."

OTL.Txt

OTL3.Txt

Редактирано от Kibik (преглед на промените)

Моля проверете дали този файл е бил картиниран от AVG във Virus Vault.

C:\Windows\System32\ADSMService.dll (защото той е loader-a на рууткита, но вече не се вижда в логовете).

Това не означава, че всичко е наред...имаме още доста работа...

"BTW към кой модератор да се обърна да решим въпроса с известяването ми при нов отговор, защото въпреки, че съм абониран за темата, не ме известява и трябва постоянно ръчно да проверявам за нов отговор."

Попитах администратора на сайта.

  • Автор

Моля проверете дали този файл е бил картиниран от AVG във Virus Vault.

C:\Windows\System32\ADSMService.dll (защото той е loader-a на рууткита, но вече не се вижда в логовете).

Това не означава, че всичко е наред...имаме още доста работа...

Да карантиниран е на 29.02.12 -пише, че е Trojan horse Crypt. AQLW

Аз виждам, че не е наред, защото има постоянен даун/ъплоуд, процесора се товари често на 100% и през 10 мин AVG предлага по нещо за карантинитране...

Да, но поне loader-a е успешно изтрит.

Сега вече би трябвало да можем да подкараме Combofix:

1. Изтеглете ComboFix от BleepingComputer

и го запазете (бутон Save -> Save as) ComboFix на вашия десктоп:

Публикувано изображение

След приключване на изтеглянето на ComboFix, иконката на програмата би трябвало да изглежда така:

Публикувано изображение

2. Затворете всички работещи приложения, отворени прозорци и програми работещи във фонов режим. Спрете временно защитата в реално време на антивирусната програма и на другите програми за сигурност, ако има такива.

3. Стартирайте с двоен клик Combofix.exe. Изберете YES, за да се съгласите с условията за използване на програмата. Важно: По време на работата на ComboFix не бива да се движи мишката и да се натискат клавиши от клавиатурата. Просто търпеливо оставете ComboFix да си свърши работата, без да използвате компютъра за други цели.

4. Ако получите предупреждение от UAC, съгласете се.

5 ComboFix ще спре временно Интернет връзката, но след като приключи работата на програмата тази връзка ще бъде възстановена автоматично. ComboFix ще сканира за проблеми и за заразени файлове, като това може да отнеме известно време. Моля да бъдете търпеливи. Ако има проблем с Интернет връзката след приключване на работата на Combofix, моля да прочетете това: Manually restoring the Internet connection section.

6 Когато работата на ComboFix приключи, ще се появи текстов документ (log) в Notepad:

Публикувано изображение

Копирайте с (Copy) и поставете с (Paste) съдържанието на лога в следващия си коментар.

Забележка: Ако се появи следното съобщение при отварянето на различни програми след завършване на сканирането с Combofix - "illegal operation on a registry key that has been marked for deletion." просто рестартирайте компютъра още веднъж и то ще изчезне.

По време на сканирането не използвайте компютъра си !

  • Автор

2. Затворете всички работещи приложения, отворени прозорци и програми работещи във фонов режим. Спрете временно защитата в реално време на антивирусната програма и на другите програми за сигурност, ако има такива.

Вероятно има много програми работещи във фонов режим как да ги намеря и спра?

На AVG кое да спра- Anti Virus, Link Scanner,Identity Protection... или има място където с 1-2 кликвания може да се елиминира напълно цялотоAVG?

Архивирана тема

Темата е твърде стара и е архивирана. Не можете да добавяте нови отговори в нея, но винаги можете да публикувате нова тема, в която да продължи дискусията. Регистрирайте се или влезте във вашия профил за да публикувате нова тема.

Назад

Разглеждащи това в момента 0

  • Няма регистрирани потребители разглеждащи тази страница.

Дарение

  • Подкрепи съществуването на форума - направи дарение
    32%
    Дарени 315 € от нужните 1 000 €

Бюлетин

Получавайте известие, когато има важна промяна или новина свързана с форума.
Абонирайте се

Профил

Навигация

Търсене

Търсене

Конфигуриране на push известия в браузъра
Chrome (Android)
  1. Докоснете иконата на катинар до адресната лента.
  2. Докоснете Разрешения → Известия.
  3. Променете предпочитанията си.
Chrome (Desktop)
  1. Кликнете върху иконата на катинар в адресната лента.
  2. Изберете Настройки на сайта.
  3. Намерете Известия и коригирайте предпочитанията си.