Заразен лаптоп

3 март 201214 г.

По-принцип AVG, дори и спряна пречи на работата на Combofix и често се налага деинсталация, по-времето на почистващия процес, но все пак пробвайте да я спрете оттук:

4 март 201214 г.

Автор

Не се отваря картинката, едно кръгче се върти безкрайно...

4 март 201214 г.

А сега:

5 март 201214 г.

Автор

Направих го,но се оплескаха нещата окончателно... Докато правеше скан, излезе съобщение "Combofix has find presence of rootkit and need to\ reboot mashine" След reboot излезе "The Recycle bin on C: corrupted.Do you want to empty.." След всички тези неща програмата блокира когато изтриваше темпорари папките си.Изключих го принудително и след старта не мога да подкарам интернета и на кабел и безжично...Преди това бях прочел какво се прави в този случай, но обяснението за XP, а тук е 7.То е подобно, но след разни troubleshot...стигам до: "Wireless Network doesn't have valid IP" и не знам какво да правя... Извадих стария лаптоп(WinXP), който не ползвам често, но за беда е бил включен когато заразих първия, та сега и той е заразен по същия начин и има подобно поведение, поне има нет. Тук имам доста Restore points, но изглежда вируса ги е съсипал и не мога да се върна към предна точка... Стария ще го преинсталирам, но как да подкарам нета на първия?

5 март 201214 г.

Ако не правите каквотo си знаете има оправия, no ако не следвате инструкциите ми няма да мога да ви помогна. Този рууткит е добре известен с това че, омазва доста регистри и интернет услугите. Има оправия в повечето случаи, но се изисква търпение, последователност в действията и запазване на спокойствие.

5 март 201214 г.

Автор

Ако не правите каквото си знаете има оправия, но ако не следвате инструкциите ми няма да мога да ви помогна.
Този рууткит е добре известен с това че, омазва доста регистри и интернет услугите.
Има оправия в повечето случаи, но се изисква търпение, последователност в действията и запазване на спокойствие.

Не съм правил нищо различно от инструкциите, описах какво се случи...Сега нямам нет, как да оправя това на първо време?

5 март 201214 г.

Все пак появи ли се лог файл от последната проверка на Combofix. Трябва да е разположен в C:\Combofix.txt.

5 март 201214 г.

Автор

Все пак появи ли се лог файл от последната проверка на Combofix. Трябва да е разположен в C:\Combofix.txt.

Няма такъв файл, все пак ComboFix не можа да завърши работата си, блокира и принудително спрях лаптопа след което нямам нет.

Има обаче нещо много странно:

Във C: има папка ComboFix създадена вчера. Обема и е 37.7 MB, но като я отворя вътре има същото съсдържание 1:1 като на Computer, т.е. там са двата дяла C: (39.4MB) и D:(146МB)...

5 март 201214 г.

Това е така, защото сте спряли принудително Combofix (което по-принцп е доста непрепоръчително). Направете повторната проверка и тази папка трябва да изчезне и вече трябва да се появи лог файл. На всички съобщение от Combofix отговаряйте с да. После ще оправим и интернета.

5 март 201214 г.

Автор

Това е така, защото сте спряли принудително Combofix (което по-принцп е доста непрепоръчително).

Спрях лаптопа, защото блокира...

Сега го пуснах пак, по едно време пак каза, че има руткит и трябва да се рестартира, след което продължи с Completed ...Stage1 до 50. После започна да прави Remove на файлове (само 1), след това Remove на папки (само 1) и там остана повече от час, като имаше слаба активност на светодиода на HDD. По едно време екрана изгасна (махнал съм скриинсейвъра), пак има слаба активност на HDD .

Вероятно се включило Hibernate.Натиснах бутона старт и се съживи на същото положение, но не мога да махна Hibernate...и така го оставям през нощта, утре ще видя какво е станало...

Не знам дали ще завърши с текстов файл, има ли случаи да работи толкова дълго? В началото пишеше, че нормално е 10мин и лесно може да се удвои, но 1.5ч до сега...

Редактирано 5 март 201214 г. от Kibik (преглед на промените)

6 март 201214 г.

Добре, ще използваме нов инструмент...който ще оправи работата (макар и да не е автоматичен).

Имате ли инсталационен диск или поне при рестартиране на компютъра и натискане на F8 излиза ли ви следното меню:

Ако да...супер. Ще ни е необходима и една празна USB флашка и след това ще продължим.

Ще оправим мизериите...няма да се притеснявате.

6 март 201214 г.

Автор

От снощи резултата е същия- спря там където описах, не завърши и папката CmboFix си е пак в C:... Лаптопа съм купил от eBay, така, че уиндоуса си беше инсталиран и няма инсталационен диск. С F8 излиза посочената картинка. Когато го купих, правих някакъв бекъп или имидж, не знам какво точно, с инструментите на Win7, но не помня как, на какво... В дяла D: забелязах, че имам 2 папки с еднакъв размер, които не знам кога и как са създадени. 1. Toshiba Equium- 25.5GB 2.WindowsimageBackup- 25.5GB В първата има 6 папки Backup Set за всеки месец назад..Във всяка има папка с BackupFiles... Във втората има папка с името на първата+Catalog+ SPPMetadataCache Намерих и 4 DVD диска, които очевидно съм записал, когато съм правил бекъп.На първите 3 съм записал BackUp 1. 2, 3. На четвъртия съм записал System Repair Disk и, че може да се буутва от него и е направен с "Create Image backup"... До сега не бях много ентусиазиран да използвам бекъпа, защото не помня дали е съхранен само C: или и D: и дали е станало преди да си инсталирам основните програми или преди това...

6 март 201214 г.

Само не споменахте имате ли флашка ?

Ще ви е необходима USB флашка (за предпочитане - празна)...

Моля изтеглете Farbar Recovery Scan Tool и го запазете на вашата флашка.
Сложете вашата флашка в заразения компютър.
Рестартирайте компютъра натискайки F8 и изберете Repair Your Computer.
Изберете английски език и натиснете Next.
Изберете потребителския си акаунт и въведете администраторската си парола ако имате такава и натиснете ОK.
Изберете Command Prompt категорията.
Когато се появи графата за команди въведете командата notepad и натиснете Enter
В notepad от менютo File => изберете Open => посочете My Computer => и намерете буквата на вашата флашка и затворете notepad-a.
От менюто за команди напишете e:\frst.exe (заменете буквата на e:\ с тази на вашата флашка).
Програмата ще се стартира. Натиснете YES за да се съгласите с лицензионното споразумение.
Натиснете бутона SCAN
Ще се създаде лог файл с името - FRST.txt на флашката.
От друга машина копирайте текста в следващия си пост.

6 март 201214 г.

Автор

Ето лог файла. Не знам защо в партишънс буквите на дяловете не са верни- Втория ми дял не е е:, a e d: и флашката не е g:, а беше f:

Scan result of Farbar Recovery Scan Tool (FRST written by farbar) Version: 06-03-2012 01

Ran by SYSTEM at 06-03-2012 23:24:05

Running from G:\

Windows Seven Black Edition (X86) OS Language: English(US)

The current controlset is ControlSet001

========================== Registry (Whitelisted) =============

HKLM\...\Run: [startCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun [61440 2009-05-21] (Advanced Micro Devices, Inc.)

HKLM\...\Run: [cAudioFilterAgent] C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent.exe [484920 2009-07-20] (Conexant Systems, Inc.)

HKLM\...\Run: [synTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [1533224 2009-06-12] (Synaptics Incorporated)

HKLM\...\Run: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE [476512 2009-08-21] (TOSHIBA Corporation)

HKLM\...\Run: [HSON] %ProgramFiles%\TOSHIBA\TBS\HSON.exe [55160 2009-03-09] (TOSHIBA Corporation)

HKLM\...\Run: [AVG_TRAY] "C:\Program Files\AVG\AVG2012\avgtray.exe" [2416480 2012-01-24] (AVG Technologies CZ, s.r.o.)

HKU\user\...\Run: [Welcome Center] C:\Windows\system32\rundll32.exe C:\Windows\system32\OobeFldr.dll,ShowWelcomeCenter LaunchedBy_StartMenuShortcut [859648 2009-09-11] (Microsoft Corporation)

HKU\user\...\Run: [DU Meter] C:\Program Files\DU Meter\DUMeter.exe [2582288 2007-10-15] (Hagel Technologies Ltd)

HKU\user\...\Run: [skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized [13351304 2010-09-02] (Skype Technologies S.A.)

HKU\user\...\Run: [sticky Pad] C:\Program Files\StickyPad\StickyPad.exe [520249 2012-01-05] (Green Eclipse)

HKU\user\...\Policies\system: [disableregistrytools] 0

HKU\user\...\Run: [Welcome Center] C:\Windows\system32\rundll32.exe C:\Windows\system32\OobeFldr.dll,ShowWelcomeCenter LaunchedBy_StartMenuShortcut [859648 2009-09-11] (Microsoft Corporation)

HKU\user\...\Run: [DU Meter] C:\Program Files\DU Meter\DUMeter.exe [2582288 2007-10-15] (Hagel Technologies Ltd)

HKU\user\...\Run: [skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized [13351304 2010-09-02] (Skype Technologies S.A.)

HKU\user\...\Run: [sticky Pad] C:\Program Files\StickyPad\StickyPad.exe [520249 2012-01-05] (Green Eclipse)

HKU\user\...\Policies\system: [disableregistrytools] 0

HKLM\...\Runonce: [AvgUninstallURL] cmd.exe /c start http://www.avg.com/ww.special-uninstallation-feedback-app?lic=OABNAEUASAAtAFIAQgBHADYASAAtADkAQwBDAFEAVwAtAEcANAA5ADkAQQAtAEwAWQBWAFUATgAtADgARQBNAEIAUgA"&"inst=NwA2AC0AOAAwADAAMAAxADYAOAAxADQALQBYAE8AMwA2ACsAMQAtAE4AMQBEACsAMQAtAFAATAArADkALQBEADMAOAAxAEwAKwA1AC0ARABEAFQAKwAzADEANgAxADEALQBJADkAMAArADEALQBEAEQAOQAwACsAMQAtAFMAVAA5ADAAQQBQAFAAKwAxAC0ARgBVAEkAKwAyAA"&"prod=2"&"ver=9.0.894 [x]

================================ Services (Whitelisted) ==================

2 Ati External Event Utility; C:\Windows\System32\Ati2evxx.exe [733184 2009-05-21] (ATI Technologies Inc.)

2 Autodata Limited License Service; "C:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe" [72704 2011-02-19] (Autodata Limited)

2 AVGIDSAgent; "C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe" [4433248 2011-10-11] (AVG Technologies CZ, s.r.o.)

2 avgwd; "C:\Program Files\AVG\AVG2012\avgwdsvc.exe" [192776 2011-08-01] (AVG Technologies CZ, s.r.o.)

2 DUMeterSvc; C:\Program Files\DU Meter\DUMeterSvc.exe /startedbyscm:E1F6D4BE-40E33354-DUMeterService [1382672 2007-10-15] (Hagel Technologies Ltd)

2 EPSON_EB_RPCV4_01; C:\ProgramData\EPSON\EPW!3 SSRP\E_S40ST7.EXE [143872 2009-07-29] (SEIKO EPSON CORPORATION)

2 EPSON_PM_RPCV4_01; C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RP7.EXE [113664 2009-07-29] (SEIKO EPSON CORPORATION)

2 gupdate; "C:\Program Files\Google\Update\GoogleUpdate.exe" /svc [136176 2010-10-06] (Google Inc.)

3 gupdatem; "C:\Program Files\Google\Update\GoogleUpdate.exe" /medsvc [136176 2010-10-06] (Google Inc.)

2 O2FLASH; "C:\Program Files\O2Micro Flash Memory Card Driver\o2flash.exe" [65536 2007-02-12] (O2Micro International)

2 RapiMgr; C:\Windows\WindowsMobile\rapimgr.dll [183688 2007-05-31] (Microsoft Corporation)

2 TosCoSrv; "C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe" [464224 2009-08-21] (TOSHIBA Corporation)

3 TuneUp.Defrag; C:\Program Files\TuneUp Utilities 2010\TuneUpDefragService.exe [435016 2011-02-09] (TuneUp Software)

2 TuneUp.UtilitiesSvc; "C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe" [1047880 2010-02-25] (TuneUp Software)

2 USBSafelyRemoveService; C:\Program Files\USB Safely Remove\USBSRService.exe [261456 2009-11-26] ()

2 UxTuneUp; C:\Windows\System32\uxtuneup.dll [30024 2010-02-25] (TuneUp Software)

3 WatAdminSvc; C:\Windows\System32\Wat\WatAdminSvc.exe [1343400 2011-11-02] ()

2 WcesComm; C:\Windows\WindowsMobile\wcescomm.dll [379784 2007-05-31] (Microsoft Corporation)

2 2wirepcp; C:\Windows\System32\se59bus.dll [x]

2 3comtftp; C:\Windows\System32\CdaD10BA.dll [x]

2 acrotray; C:\Windows\System32\PAC7302.dll [x]

2 adsexpb; C:\Windows\System32\eskerlicensecontrol.dll [x]

2 advservice; C:\Windows\System32\blueservice.dll [x]

2 aec; C:\Windows\System32\HSX_DP.dll [x]

2 AffinegyService; C:\Windows\System32\gbpoll.dll [x]

2 alertmanager; C:\Windows\System32\interactivelogon.dll [x]

2 AmdLLD; C:\Windows\System32\Freedom.dll [x]

2 amusbprt; C:\Windows\System32\sonicstagemonitoring.dll [x]

2 antivirscheduler; C:\Windows\System32\FreeTdi.dll [x]

2 APLMp50; C:\Windows\System32\lxda_device.dll [x]

2 AppnApi; C:\Windows\System32\ATIBTCAP.dll [x]

2 appnnode; C:\Windows\System32\iSMBIOS.dll [x]

2 arcltsrv; C:\Windows\System32\trioservice.dll [x]

2 ASInsHelp; C:\Windows\System32\a016bus.dll [x]

2 ASNDIS5; C:\Windows\System32\se44obex.dll [x]

2 aspnet_state; C:\Windows\System32\lp6nds35.dll [x]

2 ati2mtaa; C:\Windows\System32\ScanUSBEMPIA.dll [x]

2 atimpab; C:\Windows\System32\useraccess.dll [x]

2 ATWPKT2; C:\Windows\System32\VSP1284D.dll [x]

2 avc; C:\Windows\System32\msgsrvservice.dll [x]

2 axskbus; C:\Windows\System32\quickbooksdb.dll [x]

2 backupexecagentbrowser; C:\Windows\System32\kbstuff.dll [x]

2 basfipm; C:\Windows\System32\eventsystem.dll [x]

2 BCMTPM; C:\Windows\System32\mssql$microsoftsmlbiz.dll [x]

2 bc_filter; C:\Windows\System32\generichidservice.dll [x]

2 bc_pat_f; C:\Windows\System32\s117mgmt.dll [x]

2 bdselfpr; C:\Windows\System32\ssisvr32.dll [x]

2 beatjammusicstreamingserver; C:\Windows\System32\cdrom.dll [x]

2 beatjamupnpmusicserver; C:\Windows\System32\BrSerIf.dll [x]

2 btnetfilter; C:\Windows\System32\ipodsrv.dll [x]

2 btwdins; C:\Windows\System32\lxbs_device.dll [x]

2 buslogic; C:\Windows\System32\W700obex.dll [x]

2 bwsvc; C:\Windows\System32\se44bus.dll [x]

2 CamAv; C:\Windows\System32\bdpredir.dll [x]

2 camdrl; C:\Windows\System32\sis162u.dll [x]

2 carboniteservice; C:\Windows\System32\WmXlCore.dll [x]

2 CdaC15BA; C:\Windows\System32\fontcache3.0.0.0.dll [x]

2 cdrbsvsd; C:\Windows\System32\se44unic.dll [x]

2 CDRPDACC; C:\Windows\System32\mfehidk.dll [x]

2 cfosspeed; C:\Windows\System32\TNaviSrv.dll [x]

2 cfsvcs; C:\Windows\System32\sqlagent$pinnaclesys.dll [x]

2 changer; C:\Windows\System32\ZDPNDIS5.dll [x]

2 com4qlb; C:\Windows\System32\SiS7018.dll [x]

2 cportclm; C:\Windows\System32\rt2500.dll [x]

2 cpqarray; C:\Windows\System32\agrsrvce.dll [x]

2 cqcpu; C:\Windows\System32\ssdiagn.dll [x]

2 csctl50; C:\Windows\System32\npkcusb.dll [x]

2 CTEDSPFX.DLL; C:\Windows\System32\wps.dll [x]

2 ctsfm2k; C:\Windows\System32\vclone.dll [x]

2 cwafrmiregistry; C:\Windows\System32\s616nd5.dll [x]

2 cwcspud; C:\Windows\System32\AsusACPI.dll [x]

2 cypresslink; C:\Windows\System32\govsrv.dll [x]

2 DCFS2K; C:\Windows\System32\rimmptsk.dll [x]

2 digirefresh; C:\Windows\System32\lxda_device.dll [x]

2 dladresn; C:\Windows\System32\afs2k.dll [x]

2 dlapoolm; C:\Windows\System32\pdlnacom.dll [x]

2 dmio; C:\Windows\System32\oracleorahomemanagementserver.dll [x]

2 DMUSBUSBDCam; C:\Windows\System32\ATMsg.dll [x]

2 dnetc; C:\Windows\System32\ipsraidn.dll [x]

2 EIO_XP; C:\Windows\System32\MMRTKRNL.dll [x]

2 Epfwndis; C:\Windows\System32\timounter.dll [x]

2 epson_pm_rpcv2_01; C:\Windows\System32\VICESYS.dll [x]

2 eskerlicensecontrol; C:\Windows\System32\mnsframework.dll [x]

2 etoksrv; C:\Windows\System32\tcpip.dll [x]

2 GameConsoleService; C:\Windows\System32\Gernuwa.dll [x]

2 ggsemc; C:\Windows\System32\ndasscsi.dll [x]

2 GTSCSER; C:\Windows\System32\btaudio.dll [x]

2 GV600_4; C:\Windows\System32\tpkmpsvc.dll [x]

2 hddsvc; C:\Windows\System32\vstor2-ws60.dll [x]

2 hpqwmi; C:\Windows\System32\TdmService.dll [x]

2 hpt3xx; C:\Windows\System32\W700mgmt.dll [x]

2 HSFHWALI; C:\Windows\System32\s117mdfl.dll [x]

2 incdrec; C:\Windows\System32\ATKGFNEXSrv.dll [x]

2 inspect; C:\Windows\System32\amdagp.dll [x]

2 IOSLINK; C:\Windows\System32\acmservice.dll [x]

2 iSMBIOS; C:\Windows\System32\mks_scan.dll [x]

2 issuser; C:\Windows\System32\TMBUS.dll [x]

2 JiaoIO; C:\Windows\System32\pgsql-8.0.dll [x]

2 Jukebox; C:\Windows\System32\msvsmon90.dll [x]

2 kpf4; C:\Windows\System32\InterBaseServer.dll [x]

2 ksthunk; C:\Windows\System32\lvpr2mon.dll [x]

2 L1e; C:\Windows\System32\MSFWHLPR.dll [x]

2 lemsgt; C:\Windows\System32\usbbus.dll [x]

2 LMIRfsClientNP; C:\Windows\System32\cfosspeed.dll [x]

2 lvsrvlauncher; C:\Windows\System32\prevxagent.dll [x]

2 lxcf_device; C:\Windows\System32\ftpqueue.dll [x]

2 M2500; C:\Windows\System32\steamdvr.dll [x]

2 mail2ec; C:\Windows\System32\WaveFDE.dll [x]

2 mcontrol; C:\Windows\System32\fasttx2k.dll [x]

2 mctskshd.exe; C:\Windows\System32\entech.dll [x]

2 mdvrmng; C:\Windows\System32\rtl8185.dll [x]

2 meraksmtp; C:\Windows\System32\savrtpel.dll [x]

2 mferkdk; C:\Windows\System32\sym_u3.dll [x]

2 mgabg; C:\Windows\System32\E1000.dll [x]

2 mi-raysat_3dsmax9_32; C:\Windows\System32\db2licd.dll [x]

2 mldserv; C:\Windows\System32\SiS7018.dll [x]

2 moufiltr; C:\Windows\System32\AVRec.dll [x]

2 mozybackup; C:\Windows\System32\bantext.dll [x]

2 mps9; C:\Windows\System32\networkx.dll [x]

2 MRESP50a64; C:\Windows\System32\NxNetMon.dll [x]

2 msftesql; C:\Windows\System32\Intel_MIPMNMP.dll [x]

2 MSFWHLPR; C:\Windows\System32\rampartsvc.dll [x]

2 MSIRCOMM; C:\Windows\System32\pimsgss.dll [x]

2 mvserver; C:\Windows\System32\bdrsdrv.dll [x]

2 nimcdlbk; C:\Windows\System32\pcmcia.dll [x]

2 NITaggerService; C:\Windows\System32\KS0108.dll [x]

2 NSSvcMgr; C:\Windows\System32\Angel2.dll [x]

2 ntcharge; C:\Windows\System32\Xyz777b.dll [x]

2 nuvaud2; C:\Windows\System32\SRTSP.dll [x]

2 nuvvid2; C:\Windows\System32\ws2ifsl.dll [x]

2 nvlddmkm; C:\Windows\System32\U2SP.dll [x]

2 nvrd32; C:\Windows\System32\RAPIProtocol.dll [x]

2 NVXBAR; C:\Windows\System32\usbsermptxp.dll [x]

2 olcamsrv; C:\Windows\System32\ibmcicstransactiongateway.dll [x]

2 oraclesnmppeerencapsulator; C:\Windows\System32\osaio.dll [x]

2 oracle_load_balancer_60_server-forms6ip9; C:\Windows\System32\ctxcpuusync.dll [x]

2 ovmsmaccessmanager; C:\Windows\System32\lgsnd_filter.dll [x]

2 P16X; C:\Windows\System32\service.dll [x]

2 paamsrv; C:\Windows\System32\itmrtsvc.dll [x]

2 pavagente; C:\Windows\System32\MTsensor.dll [x]

2 pdlncbas; C:\Windows\System32\gv3.dll [x]

2 PID_08A0; C:\Windows\System32\foldersize.dll [x]

2 pmounter; C:\Windows\System32\Hardlock.dll [x]

2 ppmoucls; C:\Windows\System32\gusvc.dll [x]

2 PPPoEWin; C:\Windows\System32\pmshellsrv.dll [x]

2 PQNTDrv; C:\Windows\System32\GT680x.dll [x]

2 prevxagent; C:\Windows\System32\netbt.dll [x]

2 prodrv06; C:\Windows\System32\Udfreadr_xp.dll [x]

2 PTDCVsp; C:\Windows\System32\wandrv.dll [x]

2 ql12160; C:\Windows\System32\rtl8185.dll [x]

2 rapapp; C:\Windows\System32\KMWDFilter.dll [x]

2 rbfilter; C:\Windows\System32\NdisFilt.dll [x]

2 remotelyanywhere; C:\Windows\System32\ZuneBusEnum.dll [x]

2 RimSerPort; C:\Windows\System32\DELL_A02.dll [x]

2 rimvserport; C:\Windows\System32\ds1.dll [x]

2 rollbackclientservice; C:\Windows\System32\ACDaemon.dll [x]

2 roxupnprenderer; C:\Windows\System32\zpnodecollector.dll [x]

2 rtl8185; C:\Windows\System32\svcwrsssdk.dll [x]

2 s116mdm; C:\Windows\System32\adihdaudaddservice.dll [x]

2 s217nd5; C:\Windows\System32\tappsrv.dll [x]

2 s3ssavage; C:\Windows\System32\U81xmdfl.dll [x]

2 s616mdm; C:\Windows\System32\AsusACPI.dll [x]

2 s716obex; C:\Windows\System32\mcrdsvc.dll [x]

2 sddmi2; C:\Windows\System32\amdppm.dll [x]

2 se44obex; C:\Windows\System32\sbp2port.dll [x]

2 se58mdfl; C:\Windows\System32\zpmysql.dll [x]

2 se58unic; C:\Windows\System32\windrvNT.dll [x]

2 se59obex; C:\Windows\System32\dpti2o.dll [x]

2 server; C:\Windows\System32\penrendezvous.dll [x]

2 service1; C:\Windows\System32\nvstor32.dll [x]

2 sfdrv01; C:\Windows\System32\clientservice.dll [x]

2 sfrem01; C:\Windows\System32\s217bus.dll [x]

2 SI3112; C:\Windows\System32\ALABULK.dll [x]

2 SiS300i; C:\Windows\System32\npkcsvc.dll [x]

2 SNP2STD; C:\Windows\System32\MREMP50.dll [x]

2 SNP2UVC; C:\Windows\System32\dphost.dll [x]

2 sprtsvc_ddoctorv2; C:\Windows\System32\RDID1007.dll [x]

2 ssm_bus; C:\Windows\System32\wuolservice.dll [x]

2 statusagent4; C:\Windows\System32\lvpopflt.dll [x]

2 SunkFilt39; C:\Windows\System32\ABVPN2K.dll [x]

2 superproserver; C:\Windows\System32\umxfwhlp.dll [x]

2 SWNC8U51; C:\Windows\System32\KLOGNT.dll [x]

2 symantecantibotshim; C:\Windows\System32\pinnaclesys.mediaserver.dll [x]

2 symlcbrd; C:\Windows\System32\CnxTrUsb.dll [x]

2 symredrv; C:\Windows\System32\omniusb.dll [x]

2 symsnap; C:\Windows\System32\isamsmt.dll [x]

2 sysplant; C:\Windows\System32\infrastructure.dll [x]

2 tabletservice; C:\Windows\System32\s716mdm.dll [x]

2 tm_cfw; C:\Windows\System32\vaiomediaplatform-videoserver-appserver.dll [x]

2 tpkmpsvc; C:\Windows\System32\ntrtscan.dll [x]

2 TPwSav; C:\Windows\System32\akshasp.dll [x]

2 truecrypt; C:\Windows\System32\FiltUSBEMPIA.dll [x]

2 Udfreadr_xp; C:\Windows\System32\amdk8.dll [x]

2 UimBus; C:\Windows\System32\bthpan.dll [x]

2 uphclean; C:\Windows\System32\EMCFILT.dll [x]

2 usrbridg; C:\Windows\System32\zumbus.dll [x]

2 V0080Dev; C:\Windows\System32\OVT511Plus.dll [x]

2 vaiomediaplatform-integratedserver-http; C:\Windows\System32\TMBUS.dll [x]

2 VC4CB104; C:\Windows\System32\Xponaut_WBD.dll [x]

2 vet-rec; C:\Windows\System32\ELkbd.dll [x]

2 vmkbd2; C:\Windows\System32\pdlnemap.dll [x]

2 vmsprog; C:\Windows\System32\3dkeybd.dll [x]

2 vvoice; C:\Windows\System32\nmwcdc.dll [x]

2 w200obex; C:\Windows\System32\dns4meclient.dll [x]

2 W2acehid; C:\Windows\System32\s616mdm.dll [x]

2 W700mgmt; C:\Windows\System32\s125bus.dll [x]

2 w810obex; C:\Windows\System32\cvintdrv.dll [x]

2 wandrv; C:\Windows\System32\HFACSVC.dll [x]

2 wanminiportservice; C:\Windows\System32\VAIOMediaPlatform-MusicServer-UPnP.dll [x]

2 wanusb; C:\Windows\System32\CnxTrUsb.dll [x]

2 wceusbsh; C:\Windows\System32\stllssvr.dll [x]

2 webfilter; C:\Windows\System32\cachemgr.dll [x]

2 websenseclientdeployservice; C:\Windows\System32\SE2Cmdfl.dll [x]

2 websenseusagemonitor; C:\Windows\System32\nwlnkfwd.dll [x]

2 wg6n; C:\Windows\System32\gdihook5.dll [x]

2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [x]

2 winproxy; C:\Windows\System32\db2remotecmd.dll [x]

2 wintrust; C:\Windows\System32\sshrmd.dll [x]

2 WinVd32; C:\Windows\System32\rt2500usb.dll [x]

2 WmBEnum; C:\Windows\System32\incdpass.dll [x]

2 Wuser32; C:\Windows\System32\avpnnic.dll [x]

2 Xponaut_WBD; C:\Windows\System32\ADSMService.dll [x]

2 XUIF; C:\Windows\System32\a8djusb.dll [x]

2 z800obex; C:\Windows\System32\WmHidLo.dll [x]

2 ZSMC301b; C:\Windows\System32\c34nb4c5.dll [x]

2 {e2b953a6-195a-44f9-9ba3-3d5f4e32bb55}; C:\Windows\System32\P16X.dll [x]

========================== Drivers (Whitelisted) =============

1 AFD; C:\Windows\System32\drivers\afd.sys [338944 2011-04-24] ()

3 atikmdag; C:\Windows\System32\DRIVERS\atikmdag.sys [4450816 2009-05-21] (ATI Technologies Inc.)

3 AVGIDSDriver; C:\Windows\System32\DRIVERS\AVGIDSDriver.Sys [134736 2011-07-10] (AVG Technologies CZ, s.r.o. )

0 AVGIDSEH; C:\Windows\System32\DRIVERS\AVGIDSEH.Sys [23120 2011-07-10] (AVG Technologies CZ, s.r.o. )

3 AVGIDSFilter; C:\Windows\System32\DRIVERS\AVGIDSFilter.Sys [24272 2011-07-10] (AVG Technologies CZ, s.r.o. )

3 AVGIDSShim; C:\Windows\System32\DRIVERS\AVGIDSShim.Sys [16720 2011-10-03] (AVG Technologies CZ, s.r.o. )

1 Avgldx86; C:\Windows\System32\DRIVERS\avgldx86.sys [230608 2011-10-06] (AVG Technologies CZ, s.r.o.)

1 Avgmfx86; C:\Windows\System32\DRIVERS\avgmfx86.sys [40016 2011-08-07] (AVG Technologies CZ, s.r.o.)

0 Avgrkx86; C:\Windows\System32\DRIVERS\avgrkx86.sys [32592 2011-09-12] (AVG Technologies CZ, s.r.o.)

1 Avgtdix; C:\Windows\System32\DRIVERS\avgtdix.sys [295248 2011-07-10] (AVG Technologies CZ, s.r.o.)

3 BridgeMP; C:\Windows\System32\DRIVERS\bridge.sys [78336 2009-07-13] (Microsoft Corporation)

3 CnxtHdmiAudService; C:\Windows\System32\drivers\CHDMI32.sys [487936 2009-06-23] (Conexant Systems Inc.)

3 epmntdrv; \??\C:\Windows\system32\epmntdrv.sys [14216 2011-07-29] ()

3 EuGdiDrv; \??\C:\Windows\system32\EuGdiDrv.sys [8456 2011-07-29] ()

3 FTDIBUS; C:\Windows\System32\drivers\ftdibus.sys [60104 2010-07-12] (FTDI Ltd.)

3 FTSER2K; C:\Windows\System32\drivers\ftser2k.sys [73032 2010-07-12] (FTDI Ltd.)

3 nmwcdnsu; C:\Windows\System32\drivers\nmwcdnsu.sys [137472 2011-08-17] (Nokia)

3 nmwcdnsuc; C:\Windows\System32\drivers\nmwcdnsuc.sys [8576 2011-08-17] (Nokia)

2 npf; C:\Windows\System32\drivers\npf.sys [35088 2011-02-11] (CACE Technologies, Inc.)

3 O2MDRDR; C:\Windows\System32\DRIVERS\o2media.sys [48600 2008-03-04] (O2Micro )

3 pccsmcfd; C:\Windows\System32\DRIVERS\pccsmcfd.sys [18816 2008-08-26] (Nokia)

3 QIOMem; C:\Windows\System32\DRIVERS\QIOMem.sys [8192 2007-04-09] (TOSHIBA)

3 RTL8187B; C:\Windows\System32\DRIVERS\RTL8187B.sys [379904 2010-03-30] (Realtek Semiconductor Corporation )

0 sptd; C:\Windows\System32\Drivers\sptd.sys [691696 2011-02-07] (Duplex Secure Ltd.)

3 SrvHsfHDA; C:\Windows\System32\DRIVERS\VSTAZL3.SYS [207360 2009-07-13] (Conexant Systems, Inc.)

3 SrvHsfV92; C:\Windows\System32\DRIVERS\VSTDPV3.SYS [980992 2009-07-13] (Conexant Systems, Inc.)

3 SrvHsfWinac; C:\Windows\System32\DRIVERS\VSTCNXT3.SYS [661504 2009-07-13] (Conexant Systems, Inc.)

3 TuneUpUtilitiesDrv; \??\C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys [10064 2010-02-25] (TuneUp Software)

0 TVALZ; C:\Windows\System32\DRIVERS\TVALZ_O.SYS [23512 2009-07-14] (TOSHIBA Corporation)

3 UsbserFilt; C:\Windows\System32\DRIVERS\usbser_lowerfltj.sys [8192 2011-08-17] (Nokia)

3 UVCFTR; C:\Windows\System32\Drivers\UVCFTR_S.SYS [17960 2009-04-10] (Chicony Electronics Co., Ltd.)

3 yukonw7; C:\Windows\System32\DRIVERS\yk62x86.sys [311296 2009-07-13] (Marvell)

3 catchme; \??\C:\Users\user\AppData\Local\Temp\catchme.sys [x]

1 NetBT; C:\Windows\System32\DRIVERS\netbt.sys [x]

========================== NetSvcs (Whitelisted) ===========

NETSVC: UxTuneUp

NETSVC: z800obex

NETSVC: cwcspud

NETSVC: se59obex

NETSVC: beatjamupnpmusicserver

NETSVC: APLMp50

NETSVC: MSIRCOMM

NETSVC: W2acehid

NETSVC: mldserv

NETSVC: GTSCSER

NETSVC: basfipm

NETSVC: winproxy

NETSVC: carboniteservice

NETSVC: ASNDIS5

NETSVC: ctsfm2k

NETSVC: NVXBAR

NETSVC: DMUSBUSBDCam

NETSVC: Epfwndis

NETSVC: incdrec

NETSVC: moufiltr

NETSVC: webfilter

NETSVC: bwsvc

NETSVC: s217nd5

NETSVC: JiaoIO

NETSVC: msftesql

NETSVC: vmkbd2

NETSVC: ATWPKT2

NETSVC: aec

NETSVC: cwafrmiregistry

NETSVC: ASInsHelp

NETSVC: acrotray

NETSVC: oraclesnmppeerencapsulator

NETSVC: symlcbrd

NETSVC: ovmsmaccessmanager

NETSVC: atimpab

NETSVC: btwdins

NETSVC: uphclean

NETSVC: PID_08A0

NETSVC: PPPoEWin

NETSVC: kpf4

NETSVC: MRESP50a64

NETSVC: W700mgmt

NETSVC: service1

NETSVC: ati2mtaa

NETSVC: backupexecagentbrowser

NETSVC: changer

NETSVC: mi-raysat_3dsmax9_32

NETSVC: digirefresh

NETSVC: PQNTDrv

NETSVC: VC4CB104

NETSVC: s616mdm

NETSVC: GV600_4

NETSVC: GameConsoleService

NETSVC: SunkFilt39

NETSVC: rollbackclientservice

NETSVC: EIO_XP

NETSVC: Xponaut_WBD

NETSVC: DCFS2K

NETSVC: hpt3xx

NETSVC: WmBEnum

NETSVC: nuvaud2

NETSVC: symsnap

NETSVC: sfdrv01

NETSVC: remotelyanywhere

NETSVC: PTDCVsp

NETSVC: hddsvc

NETSVC: ZSMC301b

NETSVC: sddmi2

NETSVC: sfrem01

NETSVC: wintrust

NETSVC: rbfilter

NETSVC: UimBus

NETSVC: arcltsrv

NETSVC: AmdLLD

NETSVC: roxupnprenderer

NETSVC: paamsrv

NETSVC: roxwatch9

NETSVC: wceusbsh

NETSVC: superproserver

NETSVC: server

NETSVC: w200obex

NETSVC: nvrd32

NETSVC: SWNC8U51

NETSVC: appnnode

NETSVC: aspnet_state

NETSVC: prevxagent

NETSVC: tpkmpsvc

NETSVC: avc

NETSVC: Jukebox

NETSVC: BCMTPM

NETSVC: iSMBIOS

NETSVC: mcontrol

NETSVC: cfosspeed

NETSVC: advservice

NETSVC: SNP2UVC

NETSVC: oracle_load_balancer_60_server-forms6ip9

NETSVC: com4qlb

NETSVC: {e2b953a6-195a-44f9-9ba3-3d5f4e32bb55}

NETSVC: cfsvcs

NETSVC: mferkdk

NETSVC: hpqwmi

NETSVC: wanusb

NETSVC: wanminiportservice

NETSVC: tm_cfw

NETSVC: CamAv

NETSVC: L1e

NETSVC: btnetfilter

NETSVC: Wuser32

NETSVC: lvsrvlauncher

NETSVC: symantecantibotshim

NETSVC: pavagente

NETSVC: CDRPDACC

NETSVC: cportclm

NETSVC: se44obex

NETSVC: lxcf_device

NETSVC: ppmoucls

NETSVC: eskerlicensecontrol

NETSVC: s3ssavage

NETSVC: NITaggerService

NETSVC: se58unic

NETSVC: mail2ec

NETSVC: wandrv

NETSVC: 3comtftp

NETSVC: vet-rec

NETSVC: beatjammusicstreamingserver

NETSVC: tabletservice

NETSVC: SNP2STD

NETSVC: cypresslink

NETSVC: as32svc

NETSVC: ql12160

NETSVC: IOSLINK

NETSVC: s116mdm

NETSVC: statusagent4

NETSVC: NSSvcMgr

NETSVC: TPwSav

NETSVC: olcamsrv

NETSVC: HSFHWALI

NETSVC: dnetc

NETSVC: dladresn

NETSVC: wg6n

NETSVC: WinVd32

NETSVC: s716obex

NETSVC: meraksmtp

NETSVC: rimvserport

NETSVC: sysplant

NETSVC: amusbprt

NETSVC: CTEDSPFX.DLL

NETSVC: rapapp

NETSVC: ntcharge

NETSVC: mozybackup

NETSVC: antivirscheduler

NETSVC: cdrbsvsd

NETSVC: 2wirepcp

NETSVC: se58mdfl

NETSVC: NEOFLTR_600_13319

NETSVC: nimcdlbk

NETSVC: XUIF

NETSVC: dlapoolm

NETSVC: websenseusagemonitor

NETSVC: prodrv06

NETSVC: Udfreadr_xp

NETSVC: w810obex

NETSVC: M2500

NETSVC: usrbridg

NETSVC: mctskshd.exe

NETSVC: RimSerPort

NETSVC: AffinegyService

NETSVC: P16X

NETSVC: camdrl

NETSVC: cpqarray

NETSVC: sprtsvc_ddoctorv2

NETSVC: etoksrv

NETSVC: issuser

NETSVC: CdaC15BA

NETSVC: nvlddmkm

NETSVC: SiS300i

NETSVC: inspect

NETSVC: epson_pm_rpcv2_01

NETSVC: csctl50

NETSVC: mps9

NETSVC: rtl8185

NETSVC: SI3112

NETSVC: nuvvid2

NETSVC: bc_filter

NETSVC: vaiomediaplatform-integratedserver-http

NETSVC: mdvrmng

NETSVC: mvserver

NETSVC: vvoice

NETSVC: truecrypt

NETSVC: axskbus

NETSVC: symredrv

NETSVC: V0080Dev

NETSVC: alertmanager

NETSVC: pdlncbas

NETSVC: lemsgt

NETSVC: mgabg

NETSVC: pmounter

NETSVC: buslogic

NETSVC: cqcpu

NETSVC: websenseclientdeployservice

NETSVC: MSFWHLPR

NETSVC: ggsemc

NETSVC: ssm_bus

NETSVC: vmsprog

NETSVC: adsexpb

NETSVC: AppnApi

NETSVC: ksthunk

NETSVC: dmio

NETSVC: bdselfpr

NETSVC: LMIRfsClientNP

NETSVC: bc_pat_f

============ One Month Created Files and Folders ==============

2012-03-06 23:23 - 2012-03-06 23:24 - 0000000 ____D C:\FRST

2012-03-05 14:17 - 2012-03-05 14:57 - 0000000 ___SD C:\ComboFix

2012-03-04 05:57 - 2012-03-04 05:57 - 0131072 ____N C:\Windows\Minidump\030412-53789-01.dmp

2012-03-04 04:52 - 2011-04-24 19:24 - 0338944 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\afd.svs

2012-03-04 03:59 - 2011-06-25 22:45 - 0256000 ____A C:\Windows\PEV.exe

2012-03-04 03:59 - 2010-11-07 09:20 - 0208896 ____A C:\Windows\MBR.exe

2012-03-04 03:59 - 2009-04-19 20:56 - 0060416 ____A (NirSoft) C:\Windows\NIRCMD.exe

2012-03-04 03:59 - 2000-08-30 16:00 - 0518144 ____A (SteelWerX) C:\Windows\SWREG.exe

2012-03-04 03:59 - 2000-08-30 16:00 - 0406528 ____A (SteelWerX) C:\Windows\SWSC.exe

2012-03-04 03:59 - 2000-08-30 16:00 - 0098816 ____A C:\Windows\sed.exe

2012-03-04 03:59 - 2000-08-30 16:00 - 0080412 ____A C:\Windows\grep.exe

2012-03-04 03:59 - 2000-08-30 16:00 - 0068096 ____A C:\Windows\zip.exe

2012-03-04 03:57 - 2012-03-04 03:58 - 4425722 ____R (Swearware) C:\Users\user\Desktop\ComboFix.exe

2012-03-04 03:57 - 2012-03-04 03:58 - 4425722 ____R (Swearware) C:\Documents and Settings\user\Desktop\ComboFix.exe

2012-02-29 10:38 - 2012-02-29 10:38 - 0000000 ____D C:\Users\user\AppData\Roaming\AVG2012

2012-02-29 10:38 - 2012-02-29 10:38 - 0000000 ____D C:\Documents and Settings\user\AppData\Roaming\AVG2012

2012-02-29 10:37 - 2012-03-04 02:49 - 0000000 ____D C:\Windows\System32\Drivers\AVG

2012-02-29 10:37 - 2012-03-01 09:40 - 0000000 ____D C:\Users\All Users\AVG2012

2012-02-29 10:37 - 2012-03-01 09:40 - 0000000 ____D C:\Users\All Users\Application Data\AVG2012

2012-02-29 10:37 - 2012-03-01 09:40 - 0000000 ____D C:\ProgramData\AVG2012

2012-02-29 10:37 - 2012-03-01 09:40 - 0000000 ____D C:\Documents and Settings\All Users\AVG2012

2012-02-29 10:37 - 2012-03-01 09:40 - 0000000 ____D C:\Documents and Settings\All Users\Application Data\AVG2012

2012-02-29 10:32 - 2012-03-04 02:49 - 0000000 ____D C:\Users\All Users\MFAData

2012-02-29 10:32 - 2012-03-04 02:49 - 0000000 ____D C:\Users\All Users\Application Data\MFAData

2012-02-29 10:32 - 2012-03-04 02:49 - 0000000 ____D C:\ProgramData\MFAData

2012-02-29 10:32 - 2012-03-04 02:49 - 0000000 ____D C:\Documents and Settings\All Users\MFAData

2012-02-29 10:32 - 2012-03-04 02:49 - 0000000 ____D C:\Documents and Settings\All Users\Application Data\MFAData

2012-02-28 15:05 - 2012-03-04 02:43 - 0000000 __ASH C:\Windows\System32\dds_trash_log.cmd

2012-02-28 15:02 - 2012-02-28 15:02 - 0000000 ____D C:\_OTL

2012-02-28 10:47 - 2012-02-28 10:47 - 0000017 ____A C:\Users\user\AppData\Local\resmon.resmoncfg

2012-02-28 10:47 - 2012-02-28 10:47 - 0000017 ____A C:\Documents and Settings\user\AppData\Local\resmon.resmoncfg

2012-02-27 13:40 - 2009-07-13 15:15 - 0387584 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\csc.sys

2012-02-27 12:24 - 2012-03-04 04:57 - 0000000 ____D C:\$RECYCLE.BIN

2012-02-27 12:22 - 2012-02-27 14:08 - 0000027 ____A C:\Windows\System32\Drivers\etc\hosts

2012-02-27 12:08 - 2012-02-27 12:08 - 0000000 __ASH C:\Windows\System32\config\SYSTEM.tmp.LOG2

2012-02-27 12:08 - 2012-02-27 12:08 - 0000000 __ASH C:\Windows\System32\config\SYSTEM.tmp.LOG1

2012-02-27 12:08 - 2012-02-27 12:08 - 0000000 __ASH C:\Windows\System32\config\SOFTWARE.tmp.LOG2

2012-02-27 12:08 - 2012-02-27 12:08 - 0000000 __ASH C:\Windows\System32\config\SOFTWARE.tmp.LOG1

2012-02-27 12:08 - 2012-02-27 12:08 - 0000000 __ASH C:\Windows\System32\config\SECURITY.tmp.LOG2

2012-02-27 12:08 - 2012-02-27 12:08 - 0000000 __ASH C:\Windows\System32\config\SECURITY.tmp.LOG1

2012-02-27 12:08 - 2012-02-27 12:08 - 0000000 __ASH C:\Windows\System32\config\SAM.tmp.LOG2

2012-02-27 12:08 - 2012-02-27 12:08 - 0000000 __ASH C:\Windows\System32\config\SAM.tmp.LOG1

2012-02-27 12:08 - 2012-02-27 12:08 - 0000000 __ASH C:\Windows\System32\config\DEFAULT.tmp.LOG2

2012-02-27 12:08 - 2012-02-27 12:08 - 0000000 __ASH C:\Windows\System32\config\DEFAULT.tmp.LOG1

2012-02-27 11:28 - 2012-02-27 12:08 - 0082812 ____A C:\Windows\ntbtlog.txt

2012-02-26 15:14 - 2012-02-26 15:17 - 0088508 ____A C:\TDSSKiller.2.7.14.0_26.02.2012_23.14.11_log.txt

2012-02-26 14:42 - 2012-02-26 14:42 - 0131072 ____N C:\Windows\Minidump\022612-34445-01.dmp

2012-02-26 14:36 - 2012-03-06 11:24 - 0007652 ____A C:\Windows\PFRO.log

2012-02-26 13:54 - 2012-03-04 04:53 - 0000000 ____D C:\Windows\ERDNT

2012-02-26 13:49 - 2012-02-26 13:54 - 0000000 ____D C:\Qoobox

2012-02-26 13:35 - 2012-02-26 13:41 - 0088154 ____A C:\TDSSKiller.2.7.14.0_26.02.2012_21.35.07_log.txt

2012-02-26 13:33 - 2012-02-26 13:33 - 0000082 ____A C:\Users\user\Desktop\??????? ?????? - kaldata.com - ??????.URL

2012-02-26 13:33 - 2012-02-26 13:33 - 0000082 ____A C:\Documents and Settings\user\Desktop\??????? ?????? - kaldata.com - ??????.URL

2012-02-25 13:02 - 2012-03-04 03:58 - 0000000 ____D C:\Users\user\Desktop\DDS

2012-02-25 13:02 - 2012-03-04 03:58 - 0000000 ____D C:\Documents and Settings\user\Desktop\DDS

2012-02-23 10:04 - 2012-03-06 15:08 - 0003416 ____A C:\Windows\setupact.log

2012-02-23 10:04 - 2012-02-23 10:04 - 0000000 ____A C:\Windows\setuperr.log

2012-02-21 11:45 - 2012-02-21 11:47 - 0000964 ___AH C:\Windows\EPMBatch.ept

2012-02-20 16:14 - 2012-02-20 16:14 - 0000000 ____D C:\Program Files\LopeSoft

2012-02-20 16:03 - 2012-02-20 16:03 - 0000000 ____D C:\Program Files\PC Magazine Utilities

2012-02-20 15:10 - 2012-02-20 15:10 - 0000000 ____D C:\Program Files\NirSoft

2012-02-20 14:58 - 2012-02-20 16:12 - 0000000 ____D C:\Users\user\Desktop\Context Menu Edit

2012-02-20 14:58 - 2012-02-20 16:12 - 0000000 ____D C:\Documents and Settings\user\Desktop\Context Menu Edit

2012-02-18 15:32 - 2012-02-18 15:32 - 0000000 ____D C:\Program Files\WinPcap

2012-02-15 09:41 - 2012-02-15 09:52 - 0000000 ____D C:\e64a0c4b528f8264dfe36f93064430

2012-02-15 09:35 - 2011-12-15 23:59 - 0690688 ____A (Microsoft Corporation) C:\Windows\System32\msvcrt.dll

2012-02-15 09:34 - 2012-01-13 19:48 - 2340864 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys

2012-02-14 15:00 - 2012-02-14 15:00 - 0000050 ____A C:\Users\user\Desktop\Google.URL

2012-02-14 15:00 - 2012-02-14 15:00 - 0000050 ____A C:\Documents and Settings\user\Desktop\Google.URL

2012-02-10 11:49 - 2012-02-10 11:50 - 0000000 ____D C:\Users\user\Desktop\Anonimous Surfing&Proxy

2012-02-10 11:49 - 2012-02-10 11:50 - 0000000 ____D C:\Documents and Settings\user\Desktop\Anonimous Surfing&Proxy

2012-02-09 16:10 - 2012-02-09 16:10 - 0000000 ____D C:\Program Files\Fortop Digital

2012-02-09 16:07 - 2012-02-09 16:07 - 0766184 ____A C:\Users\user\Downloads\ftwin7sharedfoldericon.zip

2012-02-09 16:07 - 2012-02-09 16:07 - 0766184 ____A C:\Documents and Settings\user\Downloads\ftwin7sharedfoldericon.zip

2012-02-09 16:02 - 2012-02-10 10:17 - 0000000 ____D C:\Users\user\Desktop\W7 Shared Folders

2012-02-09 16:02 - 2012-02-10 10:17 - 0000000 ____D C:\Documents and Settings\user\Desktop\W7 Shared Folders

2012-02-05 11:49 - 2012-02-05 11:49 - 0000068 ____A C:\Users\user\Desktop\Facebook.URL

2012-02-05 11:49 - 2012-02-05 11:49 - 0000068 ____A C:\Documents and Settings\user\Desktop\Facebook.URL

============ 3 Months Modified Files and Folders ===============

2012-03-06 23:24 - 2012-03-06 23:23 - 0000000 ____D C:\FRST

2012-03-06 15:08 - 2012-02-23 10:04 - 0003416 ____A C:\Windows\setupact.log

2012-03-06 15:08 - 2010-10-04 02:34 - 1508712448 __ASH C:\hiberfil.sys

2012-03-06 15:08 - 2009-07-13 20:53 - 0032606 ____A C:\Windows\Tasks\SCHEDLGU.TXT

2012-03-06 15:08 - 2009-07-13 20:53 - 0000006 ___AH C:\Windows\Tasks\SA.DAT

2012-03-06 15:06 - 2010-10-06 10:07 - 1255100 ____A C:\Windows\WindowsUpdate.log

2012-03-06 15:05 - 2010-10-06 09:47 - 0000000 ____D C:\Users\user\AppData\Roaming\Skype

2012-03-06 15:05 - 2010-10-06 09:47 - 0000000 ____D C:\Documents and Settings\user\AppData\Roaming\Skype

2012-03-06 11:24 - 2012-02-26 14:36 - 0007652 ____A C:\Windows\PFRO.log

2012-03-05 14:57 - 2012-03-05 14:17 - 0000000 ___SD C:\ComboFix

2012-03-04 07:32 - 2009-07-13 18:37 - 0000000 ____D C:\Windows\System32\NDF

2012-03-04 07:31 - 2010-10-04 02:47 - 0730320 ____A C:\Windows\System32\PerfStringBackup.INI

2012-03-04 06:56 - 2010-10-04 02:42 - 0000000 ____D C:\users\user

2012-03-04 06:56 - 2009-07-13 18:37 - 0000000 ____D C:\Windows\System32\wfp

2012-03-04 06:56 - 2009-07-13 18:37 - 0000000 ____D C:\Windows\System32\config\TxR

2012-03-04 06:54 - 2009-07-13 23:48 - 0000000 ___RD C:\Users\Public\Recorded TV

2012-03-04 06:54 - 2009-07-13 23:48 - 0000000 ___RD C:\Documents and Settings\Public\Recorded TV

2012-03-04 06:54 - 2009-07-13 18:37 - 0000000 ____D C:\Windows\System32\DriverStore

2012-03-04 06:54 - 2009-07-13 18:37 - 0000000 ____D C:\Windows\registration

2012-03-04 06:21 - 2010-10-06 09:16 - 0000000 ____D C:\Users\user\AppData\Local\ElevatedDiagnostics

2012-03-04 06:21 - 2010-10-06 09:16 - 0000000 ____D C:\Documents and Settings\user\AppData\Local\ElevatedDiagnostics

2012-03-04 05:58 - 2011-09-17 11:06 - 0000000 ____D C:\Windows\Minidump

2012-03-04 05:57 - 2012-03-04 05:57 - 0131072 ____N C:\Windows\Minidump\030412-53789-01.dmp

2012-03-04 04:57 - 2012-02-27 12:24 - 0000000 ____D C:\$RECYCLE.BIN

2012-03-04 04:54 - 2009-09-18 00:53 - 19136512 ____A C:\Windows\System32\config\SYSTEM.bak

2012-03-04 04:54 - 2009-09-18 00:53 - 0491520 ____A C:\Windows\System32\config\DEFAULT.bak

2012-03-04 04:54 - 2009-09-18 00:52 - 47710208 ____A C:\Windows\System32\config\SOFTWARE.bak

2012-03-04 04:54 - 2009-07-13 18:03 - 0065536 ____A C:\Windows\System32\config\SAM.bak

2012-03-04 04:54 - 2009-07-13 18:03 - 0024576 ____A C:\Windows\System32\config\SECURITY.bak

2012-03-04 04:53 - 2012-02-26 13:54 - 0000000 ____D C:\Windows\ERDNT

2012-03-04 04:51 - 2009-07-13 18:37 - 0000000 ___DC C:\Windows\$NtUninstallKB28412$

2012-03-04 04:17 - 2010-10-06 09:47 - 0000882 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2012-03-04 03:58 - 2012-03-04 03:57 - 4425722 ____R (Swearware) C:\Users\user\Desktop\ComboFix.exe

2012-03-04 03:58 - 2012-03-04 03:57 - 4425722 ____R (Swearware) C:\Documents and Settings\user\Desktop\ComboFix.exe

2012-03-04 03:58 - 2012-02-25 13:02 - 0000000 ____D C:\Users\user\Desktop\DDS

2012-03-04 03:58 - 2012-02-25 13:02 - 0000000 ____D C:\Documents and Settings\user\Desktop\DDS

2012-03-04 02:49 - 2012-02-29 10:37 - 0000000 ____D C:\Windows\System32\Drivers\AVG

2012-03-04 02:49 - 2012-02-29 10:32 - 0000000 ____D C:\Users\All Users\MFAData

2012-03-04 02:49 - 2012-02-29 10:32 - 0000000 ____D C:\Users\All Users\Application Data\MFAData

2012-03-04 02:49 - 2012-02-29 10:32 - 0000000 ____D C:\ProgramData\MFAData

2012-03-04 02:49 - 2012-02-29 10:32 - 0000000 ____D C:\Documents and Settings\All Users\MFAData

2012-03-04 02:49 - 2012-02-29 10:32 - 0000000 ____D C:\Documents and Settings\All Users\Application Data\MFAData

2012-03-04 02:43 - 2012-02-28 15:05 - 0000000 __ASH C:\Windows\System32\dds_trash_log.cmd

2012-03-04 02:43 - 2010-10-06 09:47 - 0000878 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2012-03-03 01:50 - 2011-07-29 10:34 - 0000000 ___RD C:\Users\user\Desktop\Pict.For sell

2012-03-03 01:50 - 2011-07-29 10:34 - 0000000 ___RD C:\Documents and Settings\user\Desktop\Pict.For sell

2012-03-01 13:41 - 2011-07-29 14:20 - 0000000 ____D C:\Users\user\Desktop\Boilers

2012-03-01 13:41 - 2011-07-29 14:20 - 0000000 ____D C:\Documents and Settings\user\Desktop\Boilers

2012-03-01 09:40 - 2012-02-29 10:37 - 0000000 ____D C:\Users\All Users\AVG2012

2012-03-01 09:40 - 2012-02-29 10:37 - 0000000 ____D C:\Users\All Users\Application Data\AVG2012

2012-03-01 09:40 - 2012-02-29 10:37 - 0000000 ____D C:\ProgramData\AVG2012

2012-03-01 09:40 - 2012-02-29 10:37 - 0000000 ____D C:\Documents and Settings\All Users\AVG2012

2012-03-01 09:40 - 2012-02-29 10:37 - 0000000 ____D C:\Documents and Settings\All Users\Application Data\AVG2012

2012-02-29 10:38 - 2012-02-29 10:38 - 0000000 ____D C:\Users\user\AppData\Roaming\AVG2012

2012-02-29 10:38 - 2012-02-29 10:38 - 0000000 ____D C:\Documents and Settings\user\AppData\Roaming\AVG2012

2012-02-29 10:36 - 2010-10-04 06:51 - 0000000 ____D C:\Program Files\AVG

2012-02-28 15:02 - 2012-02-28 15:02 - 0000000 ____D C:\_OTL

2012-02-28 15:02 - 2010-10-06 10:26 - 0000000 ____D C:\Windows\pss

2012-02-28 14:49 - 2010-10-31 10:11 - 0000000 ___RD C:\Users\user\Desktop\Antivirus & Maintenance

2012-02-28 14:49 - 2010-10-31 10:11 - 0000000 ___RD C:\Documents and Settings\user\Desktop\Antivirus & Maintenance

2012-02-28 14:45 - 2011-02-13 05:50 - 0000000 ____D C:\Program Files\Spyware Doctor

2012-02-28 11:02 - 2009-07-13 20:34 - 0014224 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2012-02-28 11:02 - 2009-07-13 20:34 - 0014224 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2012-02-28 10:47 - 2012-02-28 10:47 - 0000017 ____A C:\Users\user\AppData\Local\resmon.resmoncfg

2012-02-28 10:47 - 2012-02-28 10:47 - 0000017 ____A C:\Documents and Settings\user\AppData\Local\resmon.resmoncfg

2012-02-27 14:08 - 2012-02-27 12:22 - 0000027 ____A C:\Windows\System32\Drivers\etc\hosts

2012-02-27 12:24 - 2009-07-13 18:04 - 0000215 ____A C:\Windows\system.ini

2012-02-27 12:21 - 2011-10-26 13:45 - 0000000 __SHD C:\Users\user\AppData\Local\1780797c

2012-02-27 12:21 - 2011-10-26 13:45 - 0000000 __SHD C:\Documents and Settings\user\AppData\Local\1780797c