Trojan horse generic 27.PN [РЕШЕН]

15 март 201214 г.

Автор

Готово:

OTL logfile created on: 15.3.2012 г. 09:45:15 - Run 2

OTL by OldTimer - Version 3.2.37.0 Folder = C:\Users\Martin\Desktop

Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000402 | Country: Bulgaria | Language: BGR | Date Format: d.M.yyyy 'г.'

1,99 Gb Total Physical Memory | 1,08 Gb Available Physical Memory | 54,25% Memory free

3,98 Gb Paging File | 3,06 Gb Available in Paging File | 76,93% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 58,50 Gb Total Space | 31,91 Gb Free Space | 54,55% Space Free | Partition Type: NTFS

Drive D: | 195,31 Gb Total Space | 21,65 Gb Free Space | 11,08% Space Free | Partition Type: NTFS

Drive E: | 211,85 Gb Total Space | 10,59 Gb Free Space | 5,00% Space Free | Partition Type: NTFS

Computer Name: MY-COMPTUER | User Name: Martin | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012.03.14 20:16:07 | 000,594,432 | ---- | M] (OldTimer Tools) -- C:\Users\Martin\Desktop\OTL.exe

PRC - [2012.03.14 09:11:59 | 000,924,600 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe

PRC - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe

PRC - [2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe

PRC - [2010.11.20 14:17:47 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe

PRC - [2010.07.26 15:15:26 | 000,217,088 | ---- | M] (Teruten) -- C:\Windows\System32\FsUsbExService.Exe

PRC - [2010.07.12 18:32:48 | 000,074,752 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files\Winamp\winampa.exe

PRC - [2010.04.01 11:16:20 | 000,357,696 | ---- | M] (DT Soft Ltd) -- C:\Program Files\DAEMON Tools Lite\DTLite.exe

PRC - [2009.04.17 13:33:36 | 000,095,536 | ---- | M] (OLYMPUS IMAGING CORP.) -- C:\Program Files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe

PRC - [2002.05.19 08:24:00 | 000,095,232 | ---- | M] () -- C:\Program Files\Datecs\FlexType 2K\FType2K.exe

========== Modules (No Company Name) ==========

MOD - [2012.03.14 09:11:59 | 001,969,080 | ---- | M] () -- C:\Program Files\Mozilla Firefox\mozjs.dll

MOD - [2012.03.13 12:12:42 | 008,527,520 | ---- | M] () -- C:\Windows\System32\Macromed\Flash\NPSWF32.dll

MOD - [2010.07.30 11:42:31 | 000,043,520 | ---- | M] () -- C:\Windows\System32\CmdLineExt03.dll

MOD - [2010.03.15 10:28:22 | 000,141,824 | ---- | M] () -- C:\Program Files\WinRAR\RarExt.dll

MOD - [2002.05.19 08:24:00 | 000,095,232 | ---- | M] () -- C:\Program Files\Datecs\FlexType 2K\FType2K.exe

MOD - [2002.04.22 23:17:06 | 000,045,056 | ---- | M] () -- C:\Windows\System32\newdll.dll

========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] -- C:\Windows\System32\WcsPlugInService.dll1 -- (WcsPlugInService)

SRV - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)

SRV - [2011.06.02 09:50:38 | 000,403,240 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Steam\SteamService.exe -- (Steam Client Service)

SRV - [2011.01.13 18:23:02 | 000,129,440 | ---- | M] (Futuremark Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Futuremark Shared\Futuremark SystemInfo\FMSISvc.exe -- (Futuremark SystemInfo Service)

SRV - [2010.07.27 15:20:14 | 001,343,400 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc)

SRV - [2010.07.26 15:15:26 | 000,217,088 | ---- | M] (Teruten) [Auto | Running] -- C:\Windows\System32\FsUsbExService.Exe -- (FsUsbExService)

SRV - [2010.03.29 07:53:22 | 000,068,000 | ---- | M] (NOS Microsystems Ltd.) [On_Demand | Stopped] -- C:\Program Files\NOS\bin\getPlus_Helper.dll -- (getPlusHelper)

SRV - [2009.07.14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)

SRV - [2009.07.14 03:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)

SRV - [2009.07.14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WINDEFEND)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- System32\drivers\rdvgkmd.sys -- (VGPU)

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\drivers\tsusbhub.sys -- (tsusbhub)

DRV - File not found [Kernel | On_Demand | Stopped] -- System32\drivers\synth3dvsc.sys -- (Synth3dVsc)

DRV - File not found [Kernel | On_Demand | Unknown] -- -- (a0i0vq3b)

DRV - [2010.11.20 14:30:15 | 000,175,360 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmbus.sys -- (vmbus)

DRV - [2010.11.20 14:30:15 | 000,040,704 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmstorfl.sys -- (storflt)

DRV - [2010.11.20 14:30:15 | 000,028,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\storvsc.sys -- (storvsc)

DRV - [2010.11.20 12:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)

DRV - [2010.11.20 12:21:14 | 000,015,872 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)

DRV - [2010.11.20 11:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)

DRV - [2010.11.20 11:14:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VMBusHID.sys -- (VMBusHID)

DRV - [2010.11.20 11:14:41 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vms3cap.sys -- (s3cap)

DRV - [2010.08.07 17:07:50 | 000,165,376 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\atksgt.sys -- (atksgt)

DRV - [2010.08.07 17:07:41 | 000,018,048 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\lirsgt.sys -- (lirsgt)

DRV - [2010.07.27 15:18:46 | 000,691,696 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\drivers\sptd.sys -- (sptd)

DRV - [2010.07.26 15:15:26 | 000,036,640 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\FsUsbExDisk.Sys -- (FsUsbExDisk)

DRV - [2010.04.27 04:25:20 | 000,123,648 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\sscemdm.sys -- (sscemdm)

DRV - [2010.04.27 04:25:20 | 000,100,352 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssceserd.sys -- (ssceserd) SAMSUNG Mobile Modem Diagnostic Serial Port V2 (WDM)

DRV - [2010.04.27 04:25:20 | 000,098,560 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\sscebus.sys -- (sscebus) SAMSUNG USB Composite Device V2 driver (WDM)

DRV - [2010.04.27 04:25:20 | 000,014,848 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\sscemdfl.sys -- (sscemdfl)

DRV - [2010.03.09 15:36:18 | 000,080,680 | ---- | M] (Fuzhou Rockchip Electronics Co,Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\rockusb.sys -- (rockusb)

DRV - [2009.08.13 10:45:56 | 000,091,264 | ---- | M] () [Kernel | System | Running] -- C:\Windows\System32\drivers\ArcHlp.sys -- (archlp)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...ms}&FORM=IE8SRC

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.condui...&ctid=CT1750559

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = bg

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = C7 2D 8D 9A 2C DC CB 01 [binary data]

IE - HKCU\..\SearchScopes,DefaultScope = {95B7759C-8C7F-4BF1-B163-73684A933233}

IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...Box&FORM=IE8SRC

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: ""

FF - prefs.js..browser.startup.homepage: "www.google.bg"

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF - HKLM\Software\MozillaPlugins\@inhatch.com,version=0.7.61: C:\Program Files\InhatchTeam\Inhatch\npinhatch.dll (Inhatch)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\Martin\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG10\Firefox4\

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.03.14 09:11:59 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.01.22 20:52:05 | 000,000,000 | ---D | M]

[2011.07.16 20:02:43 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Martin\AppData\Roaming\Mozilla\Extensions

[2012.02.28 23:05:43 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Martin\AppData\Roaming\Mozilla\Firefox\Profiles\e72k9gu4.default\extensions

[2012.02.13 20:21:29 | 000,000,000 | ---D | M] (Flagfox) -- C:\Users\Martin\AppData\Roaming\Mozilla\Firefox\Profiles\e72k9gu4.default\extensions\{1018e4d6-728f-4b20-ad56-37578a4de76b}

[2011.12.24 16:50:18 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Martin\AppData\Roaming\Mozilla\Firefox\Profiles\e72k9gu4.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}

[2010.07.27 15:19:04 | 000,002,059 | ---- | M] () -- C:\Users\Martin\AppData\Roaming\Mozilla\Firefox\Profiles\e72k9gu4.default\searchplugins\daemon-search.xml

[2011.12.21 11:11:33 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions

[2011.11.01 18:11:19 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}

() (No name found) -- C:\USERS\MARTIN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\E72K9GU4.DEFAULT\EXTENSIONS\{C4D362EC-1CFF-4CA0-9031-99A8FAD7995A}.XPI

() (No name found) -- C:\USERS\MARTIN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\E72K9GU4.DEFAULT\EXTENSIONS\[email protected]

[2012.03.14 09:11:59 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll

[2011.10.03 05:06:04 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll

[2012.02.12 00:07:21 | 000,001,083 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\911bg.xml

[2012.02.12 00:07:21 | 000,002,442 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\diribg.xml

[2012.02.12 00:07:21 | 000,001,515 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\pe-bg.xml

[2012.02.12 00:07:21 | 000,001,857 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\portalbgdict.xml

[2012.02.12 00:07:21 | 000,001,220 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-bg.xml

========== Chrome ==========

CHR - default_search_provider: AVG Secure Search (Enabled)

CHR - default_search_provider: search_url = http://isearch.avg.c...pa&d=2011-12-07 09:05:44&v=10.0.0.7&sap=dsp&q={searchTerms}

CHR - default_search_provider: suggest_url = http://clients5.goog...outputEncoding}

CHR - plugin: Shockwave Flash (Disabled) = C:\Users\Martin\AppData\Local\Google\Chrome\User Data\PepperFlash\11.1.31.203\pepflashplayer.dll

CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\17.0.963.79\gcswf32.dll

CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll

CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer

CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\17.0.963.79\ppGoogleNaClPluginChrome.dll

CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\17.0.963.79\pdf.dll

CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll

CHR - plugin: Java Deployment Toolkit 6.0.290.11 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll

CHR - plugin: Java™ Platform SE 6 U29 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll

CHR - plugin: Microsoft\u00AE Windows Media Player Firefox Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll

CHR - plugin: Microsoft Office 2003 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\NPOFFICE.DLL

CHR - plugin: getPlusPlus for Adobe 16263 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\np_gp.dll

CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll

CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll

CHR - plugin: Inhatch Plug-in (Enabled) = C:\Program Files\InhatchTeam\Inhatch\npinhatch.dll

CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll

CHR - plugin: Unity Player (Enabled) = C:\Users\Martin\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll

CHR - plugin: Default Plug-in (Enabled) = default_plugin

CHR - Extension: YouTube = C:\Users\Martin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\

CHR - Extension: Google \u0422\u044A\u0440\u0441\u0435\u043D\u0435 = C:\Users\Martin\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.17_0\

CHR - Extension: Skype Click to Call = C:\Users\Martin\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.6.0.8442_0\

CHR - Extension: Gmail = C:\Users\Martin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

O1 HOSTS File: ([2012.03.12 10:02:44 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1 localhost

O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O4 - HKLM..\Run: [KiesTrayAgent] C:\Program Files\Samsung\Kies\KiesTrayAgent.exe File not found

O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)

O4 - HKLM..\Run: [OM2_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master 2\FirstStart.exe (OLYMPUS IMAGING CORP.)

O4 - HKLM..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe (Nullsoft, Inc.)

O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)

O4 - HKCU..\Run: [KiesPDLR] C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe File not found

O4 - HKCU..\Run: [OM2_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe (OLYMPUS IMAGING CORP.)

O4 - Startup: C:\Users\Martin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE ()

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O9 - Extra Button: Преведи - {60237576-b24c-4ba9-9740-c9f3ec9db557} - C:\Program Files\SkyCode\WebTrance30\wt2ie.dll ()

O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_29)

O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_29)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_29)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 85.217.128.241 87.121.223.9

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{2E8012C2-2100-42BB-B437-96D2A480657D}: DhcpNameServer = 85.217.128.241 87.121.223.9

O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = ComFile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2012.03.15 09:39:35 | 000,286,720 | ---- | C] (SteelWerX) -- C:\swreg.exe

[2012.03.15 09:39:19 | 000,286,720 | ---- | C] (SteelWerX) -- C:\Users\Martin\Desktop\swreg.exe

[2012.03.15 09:39:11 | 000,381,816 | ---- | C] (Sysinternals - www.sysinternals.com) -- C:\PsExec.exe

[2012.03.15 09:38:16 | 000,000,000 | ---D | C] -- C:\Users\Martin\Desktop\PsTools

[2012.03.14 20:16:06 | 000,594,432 | ---- | C] (OldTimer Tools) -- C:\Users\Martin\Desktop\OTL.exe

[2012.03.14 12:07:23 | 003,968,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe

[2012.03.14 12:07:22 | 003,913,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe

[2012.03.14 09:00:15 | 002,343,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys

[2012.03.14 09:00:15 | 001,077,248 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\DWrite.dll

[2012.03.14 08:59:53 | 000,919,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdpcorets.dll

[2012.03.14 08:59:53 | 000,826,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdpcore.dll

[2012.03.14 08:59:52 | 000,129,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdpcorekmts.dll

[2012.03.14 08:59:52 | 000,058,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdpwsx.dll

[2012.03.14 08:59:52 | 000,008,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdrmemptylst.exe

[2012.03.13 16:11:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BS.Player

[2012.03.13 16:10:51 | 000,000,000 | ---D | C] -- C:\Program Files\Webteh

[2012.03.12 15:42:37 | 000,000,000 | ---D | C] -- C:\Users\Martin\Desktop\Autoruns

[2012.03.12 12:56:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2012.03.12 12:56:36 | 000,020,464 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys

[2012.03.12 12:11:07 | 004,730,880 | ---- | C] (AVAST Software) -- C:\Users\Martin\Desktop\aswMBR.exe

[2012.03.12 10:05:25 | 000,000,000 | ---D | C] -- C:\Windows\temp

[2012.03.12 10:05:03 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN

[2012.03.12 09:47:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ERUNT

[2012.03.12 09:47:35 | 000,000,000 | ---D | C] -- C:\Program Files\ERUNT

[2012.03.12 09:44:23 | 000,791,393 | ---- | C] (Lars Hederer ) -- C:\Users\Martin\Desktop\erunt-setup.exe

[2012.03.12 03:01:13 | 000,000,000 | ---D | C] -- C:\Users\Martin\AppData\Local\temp

[2012.03.12 02:47:12 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT

[2012.03.12 00:05:19 | 000,000,000 | -HSD | C] -- C:\Windows\System32\%APPDATA%

[2012.03.10 17:15:07 | 000,000,000 | ---D | C] -- C:\Users\Martin\Documents\Sega

[2012.03.10 17:03:41 | 000,251,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine2_5.dll

[2012.03.10 17:03:40 | 000,440,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10.dll

[2012.03.10 17:03:37 | 003,426,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_32.dll

[2012.03.10 17:03:35 | 000,237,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine2_4.dll

[2012.03.10 17:03:30 | 002,414,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_31.dll

[2012.03.10 17:03:29 | 000,236,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine2_3.dll

[2012.03.10 17:03:27 | 000,062,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xinput1_2.dll

[2012.02.23 21:27:28 | 000,000,000 | ---D | C] -- C:\Users\Martin\Documents\NFS Carbon

[2012.02.23 21:21:15 | 000,230,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine2_2.dll

[2012.02.16 23:40:29 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb

[2012.02.16 23:40:28 | 001,798,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll

[2012.02.16 23:40:28 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll

[2012.02.16 23:40:27 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll

[2012.02.16 23:40:27 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll

[2012.02.16 23:40:25 | 001,427,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl

[2012.02.16 19:04:33 | 000,478,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\timedate.cpl

========== Files - Modified Within 30 Days ==========

[2012.03.15 09:44:00 | 000,000,886 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2012.03.15 09:40:09 | 000,014,224 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2012.03.15 09:40:09 | 000,014,224 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2012.03.15 09:39:19 | 000,286,720 | ---- | M] (SteelWerX) -- C:\Users\Martin\Desktop\swreg.exe

[2012.03.15 09:39:19 | 000,286,720 | ---- | M] (SteelWerX) -- C:\swreg.exe

[2012.03.15 09:33:05 | 000,000,882 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2012.03.15 09:32:57 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2012.03.15 09:32:53 | 1602,985,984 | -HS- | M] () -- C:\hiberfil.sys

[2012.03.15 01:26:24 | 000,001,036 | ---- | M] () -- C:\Users\Martin\Desktop\Synth3dVsc.reg

[2012.03.15 01:26:14 | 000,001,236 | ---- | M] () -- C:\Users\Martin\Desktop\tsusbhub.reg

[2012.03.15 01:26:04 | 000,000,808 | ---- | M] () -- C:\Users\Martin\Desktop\VGPU.reg

[2012.03.15 01:25:38 | 000,004,284 | ---- | M] () -- C:\Users\Martin\Desktop\Audiosrv.reg

[2012.03.15 01:25:30 | 000,003,132 | ---- | M] () -- C:\Users\Martin\Desktop\EventSystem.reg

[2012.03.15 01:25:22 | 000,004,526 | ---- | M] () -- C:\Users\Martin\Desktop\MMCSS.reg

[2012.03.15 01:25:12 | 000,005,312 | ---- | M] () -- C:\Users\Martin\Desktop\PNRPsvc.reg

[2012.03.15 01:25:04 | 000,035,780 | ---- | M] () -- C:\Users\Martin\Desktop\RemoteAccess.reg

[2012.03.15 01:24:58 | 000,004,516 | ---- | M] () -- C:\Users\Martin\Desktop\SysMain.reg

[2012.03.15 01:24:50 | 000,007,522 | ---- | M] () -- C:\Users\Martin\Desktop\WbioSrvc.reg

[2012.03.15 01:24:44 | 000,003,658 | ---- | M] () -- C:\Users\Martin\Desktop\Wecsvc.reg

[2012.03.15 01:24:36 | 000,002,634 | ---- | M] () -- C:\Users\Martin\Desktop\Winmgmt.reg

[2012.03.15 01:24:22 | 000,006,740 | ---- | M] () -- C:\Users\Martin\Desktop\Wlansvc.reg

[2012.03.15 01:24:14 | 000,006,358 | ---- | M] () -- C:\Users\Martin\Desktop\WPDBusEnum.reg

[2012.03.14 20:16:07 | 000,594,432 | ---- | M] (OldTimer Tools) -- C:\Users\Martin\Desktop\OTL.exe

[2012.03.14 15:59:19 | 000,419,072 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT

[2012.03.13 16:11:09 | 000,001,104 | ---- | M] () -- C:\Users\Martin\Application Data\Microsoft\Internet Explorer\Quick Launch\BS.Player FREE.lnk

[2012.03.13 16:11:09 | 000,001,080 | ---- | M] () -- C:\Users\Public\Desktop\BS.Player FREE.lnk

[2012.03.13 15:34:18 | 000,104,319 | ---- | M] () -- C:\Users\Martin\Desktop\2673_vul4an_petko_print.jpg

[2012.03.13 14:20:38 | 000,624,578 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2012.03.13 14:20:38 | 000,110,216 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[2012.03.13 13:45:10 | 000,002,286 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk

[2012.03.13 12:12:42 | 000,414,368 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl

[2012.03.13 08:37:04 | 001,943,503 | ---- | M] () -- C:\Users\Martin\Desktop\Снимки0367.jpg

[2012.03.12 13:03:12 | 000,337,137 | ---- | M] () -- C:\Users\Martin\Desktop\FSS.exe

[2012.03.12 12:56:37 | 000,001,067 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012.03.12 12:54:39 | 000,000,512 | ---- | M] () -- C:\Users\Martin\Desktop\MBR.dat

[2012.03.12 12:11:19 | 004,730,880 | ---- | M] (AVAST Software) -- C:\Users\Martin\Desktop\aswMBR.exe

[2012.03.12 10:02:44 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts

[2012.03.12 09:50:12 | 000,002,964 | ---- | M] () -- C:\Users\Martin\Desktop\fix.reg

[2012.03.12 09:47:42 | 000,001,074 | ---- | M] () -- C:\Users\Martin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk

[2012.03.12 09:47:35 | 000,000,894 | ---- | M] () -- C:\Users\Martin\Desktop\NTREGOPT.lnk

[2012.03.12 09:47:35 | 000,000,875 | ---- | M] () -- C:\Users\Martin\Desktop\ERUNT.lnk

[2012.03.12 09:44:25 | 000,791,393 | ---- | M] (Lars Hederer ) -- C:\Users\Martin\Desktop\erunt-setup.exe

[2012.03.11 21:48:22 | 000,183,170 | ---- | M] () -- C:\Users\Martin\Desktop\telefona-dimitrova.jpg

[2012.03.09 15:28:17 | 000,056,456 | ---- | M] () -- C:\Users\Martin\Desktop\09_games_1a.jpg

[2012.03.07 08:21:06 | 001,687,979 | ---- | M] () -- C:\Users\Martin\Desktop\аз.jpg

[2012.03.05 20:15:44 | 000,070,597 | ---- | M] () -- C:\Users\Martin\Desktop\430603_3032262163039_1157442833_32363838_1230399428_n.jpg

[2012.03.01 16:01:08 | 000,042,870 | ---- | M] () -- C:\Users\Martin\Desktop\kiss_of_the_dragon_2001(subsunacs.net).rar

[2012.02.22 13:57:26 | 001,790,761 | ---- | M] () -- C:\Users\Martin\Desktop\Снимки0365.jpg

[2012.02.22 13:57:23 | 001,730,079 | ---- | M] () -- C:\Users\Martin\Desktop\Снимки0366.jpg

[2012.02.22 13:57:21 | 001,569,094 | ---- | M] () -- C:\Users\Martin\Desktop\Снимки0364.jpg

[2012.02.22 13:57:20 | 001,805,399 | ---- | M] () -- C:\Users\Martin\Desktop\Снимки0363.jpg

[2012.02.17 07:34:22 | 000,919,040 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\rdpcorets.dll

[2012.02.17 07:34:22 | 000,826,880 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\rdpcore.dll

========== Files Created - No Company Name ==========

[2012.03.15 09:42:52 | 000,035,780 | ---- | C] () -- C:\Users\Martin\Desktop\RemoteAccess.reg

[2012.03.15 09:42:52 | 000,007,522 | ---- | C] () -- C:\Users\Martin\Desktop\WbioSrvc.reg

[2012.03.15 09:42:52 | 000,006,740 | ---- | C] () -- C:\Users\Martin\Desktop\Wlansvc.reg

[2012.03.15 09:42:52 | 000,006,358 | ---- | C] () -- C:\Users\Martin\Desktop\WPDBusEnum.reg

[2012.03.15 09:42:52 | 000,005,312 | ---- | C] () -- C:\Users\Martin\Desktop\PNRPsvc.reg

[2012.03.15 09:42:52 | 000,004,526 | ---- | C] () -- C:\Users\Martin\Desktop\MMCSS.reg

[2012.03.15 09:42:52 | 000,004,516 | ---- | C] () -- C:\Users\Martin\Desktop\SysMain.reg

[2012.03.15 09:42:52 | 000,004,284 | ---- | C] () -- C:\Users\Martin\Desktop\Audiosrv.reg

[2012.03.15 09:42:52 | 000,003,658 | ---- | C] () -- C:\Users\Martin\Desktop\Wecsvc.reg

[2012.03.15 09:42:52 | 000,003,132 | ---- | C] () -- C:\Users\Martin\Desktop\EventSystem.reg

[2012.03.15 09:42:52 | 000,002,634 | ---- | C] () -- C:\Users\Martin\Desktop\Winmgmt.reg

[2012.03.15 09:42:52 | 000,001,236 | ---- | C] () -- C:\Users\Martin\Desktop\tsusbhub.reg

[2012.03.15 09:42:52 | 000,001,036 | ---- | C] () -- C:\Users\Martin\Desktop\Synth3dVsc.reg

[2012.03.15 09:42:52 | 000,000,808 | ---- | C] () -- C:\Users\Martin\Desktop\VGPU.reg

[2012.03.13 16:11:09 | 000,001,104 | ---- | C] () -- C:\Users\Martin\Application Data\Microsoft\Internet Explorer\Quick Launch\BS.Player FREE.lnk

[2012.03.13 16:11:09 | 000,001,080 | ---- | C] () -- C:\Users\Public\Desktop\BS.Player FREE.lnk

[2012.03.12 13:03:11 | 000,337,137 | ---- | C] () -- C:\Users\Martin\Desktop\FSS.exe

[2012.03.12 12:56:37 | 000,001,067 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012.03.12 12:54:39 | 000,000,512 | ---- | C] () -- C:\Users\Martin\Desktop\MBR.dat

[2012.03.12 09:50:12 | 000,002,964 | ---- | C] () -- C:\Users\Martin\Desktop\fix.reg

[2012.03.12 09:47:42 | 000,001,074 | ---- | C] () -- C:\Users\Martin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk

[2012.03.12 09:47:35 | 000,000,894 | ---- | C] () -- C:\Users\Martin\Desktop\NTREGOPT.lnk

[2012.03.12 09:47:35 | 000,000,875 | ---- | C] () -- C:\Users\Martin\Desktop\ERUNT.lnk

[2012.03.11 21:48:21 | 000,183,170 | ---- | C] () -- C:\Users\Martin\Desktop\telefona-dimitrova.jpg

[2012.03.09 15:28:12 | 000,056,456 | ---- | C] () -- C:\Users\Martin\Desktop\09_games_1a.jpg

[2012.03.07 21:02:20 | 001,687,979 | ---- | C] () -- C:\Users\Martin\Desktop\аз.jpg

[2012.03.05 20:15:36 | 000,070,597 | ---- | C] () -- C:\Users\Martin\Desktop\430603_3032262163039_1157442833_32363838_1230399428_n.jpg

[2012.02.22 13:56:02 | 001,569,094 | ---- | C] () -- C:\Users\Martin\Desktop\Снимки0364.jpg

[2012.02.22 13:56:01 | 001,805,399 | ---- | C] () -- C:\Users\Martin\Desktop\Снимки0363.jpg

[2012.02.22 13:56:01 | 001,730,079 | ---- | C] () -- C:\Users\Martin\Desktop\Снимки0366.jpg

[2012.02.22 13:56:00 | 001,943,503 | ---- | C] () -- C:\Users\Martin\Desktop\Снимки0367.jpg

[2012.02.22 13:55:58 | 001,790,761 | ---- | C] () -- C:\Users\Martin\Desktop\Снимки0365.jpg

[2011.12.29 21:05:39 | 000,000,619 | ---- | C] () -- C:\Windows\eReg.dat

[2011.12.11 05:53:30 | 000,000,000 | ---- | C] () -- C:\Users\Martin\AppData\Local\{0269DC9D-1C04-49BD-BBDC-8B0EA28DCBBD}

[2011.10.26 16:39:06 | 000,000,000 | ---- | C] () -- C:\Users\Martin\AppData\Local\{229D19BD-14B2-401F-90BE-407E06C38DD6}

[2011.10.15 06:52:11 | 000,000,000 | ---- | C] () -- C:\Users\Martin\AppData\Local\{55B8A775-5661-479B-8A65-FFEB16523B3A}

[2011.05.30 22:09:59 | 000,003,584 | ---- | C] () -- C:\Users\Martin\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2011.05.18 19:20:19 | 000,000,376 | ---- | C] () -- C:\Windows\ODBC.INI

[2011.05.15 17:06:29 | 000,000,148 | ---- | C] () -- C:\Windows\QIII.INI

[2011.04.10 20:03:48 | 000,000,014 | ---- | C] () -- C:\Windows\System32\SystemInfo32.sys

[2011.04.09 17:55:28 | 000,179,261 | ---- | C] () -- C:\Windows\System32\xlive.dll.cat

[2011.03.18 18:04:48 | 000,000,990 | -HS- | C] () -- C:\Users\Martin\AppData\Roaming\systemfl.$dk

[2011.03.11 18:28:29 | 000,011,264 | ---- | C] () -- C:\Windows\System32\rockusbCoInstaller.dll

[2011.03.09 19:39:42 | 000,080,896 | ---- | C] () -- C:\Windows\System32\RDVGHelper.exe

[2011.03.09 19:38:34 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe

[2011.01.29 17:00:22 | 000,974,848 | ---- | C] () -- C:\Windows\System32\cis-2.4.dll

[2011.01.29 17:00:22 | 000,081,920 | ---- | C] () -- C:\Windows\System32\issacapi_bs-2.3.dll

[2011.01.29 17:00:22 | 000,065,536 | ---- | C] () -- C:\Windows\System32\issacapi_pe-2.3.dll

[2011.01.29 17:00:22 | 000,057,344 | ---- | C] () -- C:\Windows\System32\issacapi_se-2.3.dll

[2011.01.22 20:48:15 | 000,000,000 | ---- | C] () -- C:\Windows\PowerReg.dat

[2010.09.15 20:25:36 | 000,002,560 | ---- | C] () -- C:\Windows\_MSRSTRT.EXE

[2010.08.22 17:20:40 | 000,110,592 | ---- | C] () -- C:\Windows\System32\FsUsbExDevice.Dll

[2010.08.22 17:20:40 | 000,036,640 | ---- | C] () -- C:\Windows\System32\FsUsbExDisk.Sys

[2010.08.14 14:36:00 | 000,140,288 | ---- | C] () -- C:\Windows\System32\igfxtvcx.dll

[2010.08.07 17:07:50 | 000,165,376 | ---- | C] () -- C:\Windows\System32\drivers\atksgt.sys

[2010.08.07 17:07:41 | 000,018,048 | ---- | C] () -- C:\Windows\System32\drivers\lirsgt.sys

[2010.07.27 20:02:57 | 000,043,520 | ---- | C] () -- C:\Windows\System32\CmdLineExt03.dll

[2010.07.27 16:18:30 | 000,007,605 | ---- | C] () -- C:\Users\Martin\AppData\Local\Resmon.ResmonCfg

[2010.07.27 15:10:10 | 000,165,376 | ---- | C] () -- C:\Windows\System32\unrar.dll

[2010.07.27 15:10:09 | 000,000,038 | ---- | C] () -- C:\Windows\avisplitter.ini

[2010.07.27 15:10:08 | 000,790,528 | ---- | C] () -- C:\Windows\System32\xvidcore.dll

[2010.07.27 15:10:08 | 000,134,144 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll

[2010.07.27 15:10:08 | 000,108,032 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll

[2010.07.27 14:08:54 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat

[2010.07.27 13:49:54 | 000,045,056 | ---- | C] () -- C:\Windows\System32\newdll.dll

[2010.07.27 12:28:59 | 000,000,000 | ---- | C] () -- C:\Windows\PROTOCOL.INI

< End of report >

15 март 201214 г.

Отворете notepad и с copy/paste въведете следната информация:

@echo off
reg query "HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicesWcsPlugInService" /v imagepath > result.txt
start result.txt
del %0

Запазете файла с името query.bat.
Файла трябва да изглежда така -
Стартирайте го и публикувайте резултатите от лог файла в следващия си пост.

15 март 201214 г.

Автор

HKEY_LOCAL_MACHINE\system\currentcontrolset\services\WcsPlugInService imagepath REG_EXPAND_SZ %SystemRoot%\system32\svchost.exe -k wcssvc

15 март 201214 г.

Почти сме готови...просто имаше много изтрити легитимни услуги от рууткита.

Изтеглете този файл и го запазете на десктопа - WcsPlugInService.reg

Стартирайте го и изберете YES на диалоговия прозоред.

Рестартирайте машината.

След това очаквам нов лог от OTL.

15 март 201214 г.

Автор

OTL logfile created on: 15.3.2012 г. 17:58:39 - Run 3

OTL by OldTimer - Version 3.2.37.0 Folder = C:\Users\Martin\Desktop

Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000402 | Country: Bulgaria | Language: BGR | Date Format: d.M.yyyy 'г.'

1,99 Gb Total Physical Memory | 1,05 Gb Available Physical Memory | 52,68% Memory free

3,98 Gb Paging File | 3,03 Gb Available in Paging File | 76,07% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 58,50 Gb Total Space | 31,79 Gb Free Space | 54,35% Space Free | Partition Type: NTFS

Drive D: | 195,31 Gb Total Space | 14,66 Gb Free Space | 7,51% Space Free | Partition Type: NTFS