Заразен лаптоп [РЕШЕН]

21 април 201214 г.

WinXP,SP3. AVG Free от време на време открива по нещо без да сканирам... Нямам бекъп, Restore Points не работят... Пуснах DDS, но не знам защо не направи и Attach.txt, а само DDS.txt DDS (Ver_2011-09-30.01) - NTFS_x86 Internet Explorer: 8.0.6001.18702 Run by Clever Boy at 11:33:11 on 2012-04-21 Microsoft Windows XP Professional 5.1.2600.3.1251.359.1033.18.990.423 [GMT -7:00] . . ============== Running Processes ================ . C:\Program Files\IObit\Advanced SystemCare 5\ASCService.exe C:\Program Files\USB Safely Remove\USBSRService.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe C:\Program Files\AVG\AVG2012\avgwdsvc.exe C:\Program Files\Spyware Doctor\BDT\BDTUpdateService.exe C:\Program Files\DU Meter\DUMeterSvc.exe C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\system32\igfxtray.exe C:\WINDOWS\system32\hkcmd.exe C:\Program Files\AVG\AVG2012\avgtray.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\StickyPad\StickyPad.exe C:\Program Files\Skype\Phone\Skype.exe C:\PROGRA~1\DUMETE~1\DUMeter.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\AVG\AVG2012\avgui.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\WINDOWS\System32\svchost.exe -k netsvcs C:\WINDOWS\system32\svchost.exe -k NetworkService C:\WINDOWS\system32\svchost.exe -k LocalService C:\WINDOWS\system32\svchost.exe -k LocalService C:\WINDOWS\system32\svchost.exe -k imgsvc . ============== Pseudo HJT Report =============== . uStart Page = hxxp://www.google.co.uk/ uURLSearchHooks: uTorrentControl2 Toolbar: {687578b9-7132-4a7a-80e4-30ee31099e03} - c:\program files\utorrentcontrol2\prxtbuTor.dll uURLSearchHooks: PC Tools Browser Guard: {472734EA-242A-422b-ADF8-83D1E48CC825} - c:\program files\spyware doctor\bdt\PCTBrowserDefender.dll BHO: PC Tools Browser Guard BHO: {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - c:\program files\spyware doctor\bdt\PCTBrowserDefender.dll BHO: AVG Safe Search: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - c:\program files\avg\avg2012\avgssie.dll BHO: uTorrentControl2 Toolbar: {687578b9-7132-4a7a-80e4-30ee31099e03} - c:\program files\utorrentcontrol2\prxtbuTor.dll BHO: Ask Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - c:\program files\ask.com\GenericAskToolbar.dll TB: uTorrentControl2 Toolbar: {687578b9-7132-4a7a-80e4-30ee31099e03} - c:\program files\utorrentcontrol2\prxtbuTor.dll TB: Ask Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - c:\program files\ask.com\GenericAskToolbar.dll TB: PC Tools Browser Guard: {472734EA-242A-422B-ADF8-83D1E48CC825} - c:\program files\spyware doctor\bdt\PCTBrowserDefender.dll uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uRun: [DU Meter] c:\program files\du meter\DUMeter.exe uRun: [sticky Pad] c:\program files\stickypad\StickyPad.exe uRun: [skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized mRun: [igfxTray] c:\windows\system32\igfxtray.exe mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe mRun: [AVG_TRAY] "c:\program files\avg\avg2012\avgtray.exe" dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE uPolicies-Explorer: NoDriveTypeAutoRun = dword:145 mPolicies-Explorer: NoDriveTypeAutoRun = dword:145 IE: Download with &Media Finder - c:\program files\media finder\hook.html IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000 IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe LSP: c:\program files\common files\pc tools\lsp\PCTLsp.dll LSP: mswsock.dll DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab TCP: NameServer = 192.168.1.254 TCP: Interfaces\{624AF753-8146-490A-8F47-43F7E836DB35} : DHCPNameServer = 192.168.1.254 Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg2012\avgpp.dll Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\program files\common files\skype\Skype4COM.dll Notify: igfxcui - igfxsrvc.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll . ================= FIREFOX =================== . FF - ProfilePath - c:\documents and settings\clever boy\application data\mozilla\firefox\profiles\j9m7wxoa.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.google.co.uk/ FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3072253&SearchSource=2&q= FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_2_202_228.dll . ============= SERVICES / DRIVERS =============== . R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [2011-7-11 23120] R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [2011-9-13 32592] R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2012-2-8 263888] R0 pctDS;PC Tools Data Store;c:\windows\system32\drivers\pctDS.sys [2012-2-8 338880] R0 pctEFA;PC Tools Extended File Attributes;c:\windows\system32\drivers\pctEFA.sys [2012-2-8 656320] R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [2011-10-7 230608] R1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\drivers\avgmfx86.sys [2011-8-8 40016] R1 PCTSD;PC Tools Spyware Doctor Driver;c:\windows\system32\drivers\PCTSD.sys [2012-2-8 233976] R2 AdvancedSystemCareService5;Advanced SystemCare Service 5;c:\program files\iobit\advanced systemcare 5\ASCService.exe [2012-2-8 913752] R2 avgwd;AVG WatchDog;c:\program files\avg\avg2012\avgwdsvc.exe [2011-8-2 192776] R2 Browser Defender Update Service;Browser Defender Update Service;c:\program files\spyware doctor\bdt\BDTUpdateService.exe [2012-2-8 337872] R2 DUMeterSvc;DU Meter Service;c:\program files\du meter\DUMeterSvc.exe [2012-2-9 513536] R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files\tuneup utilities 2010\TuneUpUtilitiesService32.exe [2011-11-15 1052480] R2 USBSafelyRemoveService;USB Safely Remove Assistant;c:\program files\usb safely remove\USBSRService.exe [2012-2-7 261456] R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [2011-7-11 134608] R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [2011-7-11 24272] R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [2011-10-4 16720] R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\tuneup utilities 2010\TuneUpUtilitiesDriver32.sys [2010-2-25 10064] S2 AVGIDSAgent;AVGIDSAgent;c:\program files\avg\avg2012\AVGIDSAgent.exe [2011-10-12 4433248] S2 lpx;Pav_service;c:\windows\system32\svchost.exe -k netsvcs [2008-4-14 14336] S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\macromed\flash\FlashPlayerUpdateService.exe [2012-3-29 253600] S3 DUMeterDrv;Hagel Technologies DU Meter traffic accounting driver;c:\program files\du meter\DUM_XP32.sys [2012-2-9 16744] S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\spyware doctor\pctsAuxs.exe [2012-2-8 371472] S3 sdCoreService;PC Tools Security Service;c:\program files\spyware doctor\pctsSvc.exe [2012-2-8 1117144] . =============== Created Last 30 ================ . 2012-04-21 18:18:26 55296 ----a-w- c:\windows\system32\SET20.tmp 2012-04-21 18:18:24 105984 ----a-w- c:\windows\system32\SET1B.tmp 2012-04-21 18:18:16 916992 ----a-w- c:\windows\system32\SET19.tmp 2012-04-21 18:18:16 602112 ----a-w- c:\windows\system32\SET21.tmp 2012-04-21 18:18:13 2000384 ----a-w- c:\windows\system32\SET25.tmp 2012-04-21 18:18:12 1212416 ----a-w- c:\windows\system32\SET1A.tmp 2012-04-21 18:18:09 5978624 ----a-w- c:\windows\system32\SET1F.tmp 2012-03-30 01:54:28 592824 ----a-w- c:\program files\mozilla firefox\gkmedias.dll 2012-03-30 01:54:28 44472 ----a-w- c:\program files\mozilla firefox\mozglue.dll 2012-03-29 18:53:36 418464 ----a-w- c:\windows\system32\FlashPlayerApp.exe . ==================== Find3M ==================== . 2012-03-29 18:53:35 70304 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2012-03-05 04:26:30 0 --sha-w- c:\windows\system32\dds_trash_log.cmd 2012-03-02 13:01:32 11082752 ----a-w- c:\windows\system32\SET27.tmp 2012-03-01 11:01:32 43520 ------w- c:\windows\system32\licmgr10.dll 2012-03-01 11:01:32 1469440 ------w- c:\windows\system32\inetcpl.cpl 2012-02-29 14:10:16 177664 ----a-w- c:\windows\system32\SET13.tmp 2012-02-29 14:10:16 148480 ----a-w- c:\windows\system32\imagehlp.dll 2012-02-29 12:17:40 385024 ------w- c:\windows\system32\html.iec 2012-02-19 05:00:22 249856 ------w- c:\windows\Setup1.exe 2012-02-19 05:00:21 73216 ----a-w- c:\windows\temp.000 2012-02-19 04:30:13 73216 ------w- c:\windows\ST6UNST.EXE 2012-02-07 08:04:56 691696 ----a-w- c:\windows\system32\drivers\sptd.sys 2012-02-06 18:00:00 79360 ----a-w- c:\windows\system32\ff_vfw.dll 2012-02-03 09:22:18 1860096 ----a-w- c:\windows\system32\win32k.sys . ============= FINISH: 11:33:41.09 ===============

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

22 април 201214 г.

Здравейте..!

Изтеглете ComboFix от тук или тук и го запазете на десктопа си.

Изключете вашата антивирусна и антишпионска програма, обикновено това става чрез натискане на десния бутон на мишката върху иконата на програма в системния трей.

Бележка: Ако не можете я спрете или не сте сигурни коя програма да изключите, моля прегледайте информацията от този линк: How to Disable your Security Programs

Стартирайте Combo-Fix.com и следвайте инструкциите.

Бележка: ComboFix ще се стартира без инсталирана Recovery Console.

Като част от неговата работа, ComboFix ще провери дали Microsoft Windows Recovery Console е инсталирана. Предвид бързо развиващия се зловреден софтуер е силно препоръчително да бъде инсталирана преди премахването на зловредния софтуер. Това ще Ви позволи да влезете в специален recovery/repair режим, който ще ни позволи по-лесно да решите проблем, който би могъл да възникне при премахване на зловредния софтуер.

Следвайте инструкциите, за да позволите на ComboFix да изтегли и инсталира Microsoft Windows Recovery Console. В един момент ще бъдете попитани дали сте съгласни с лицензното споразумение. Необходимо е да потвърдите, че сте съгласни, за да инсталирате Microsoft Windows Recovery Console.

** Забележете: Ако Microsoft Windows Recovery Console е вече инсталирана, ComboFix ще продължи към процеса по премахване на зловредния софтуер.

След като Microsoft Windows Recovery Console е инсталирана, използвайки ComboFix, Вие ще видите следното съобщение:

Изберете Yes, за да продължи сканирането за зловреден софтуер.

Когато процесът приключи успешно, инструментът ще създаде лог файл. Моля, включете съдържанието на C:ComboFix.txt в следващия Ви коментар в тази тема.

Бележка:

Моля, не движете мишката, докато ComboFix работи. Това може да наруши процеса на работа.
ComboFix ще нулира всички настройки на Microsoft Internet Explorer, включително да направи IE браузър по подразбиране.
ComboFix ще изключи autorun функцията на ВСИЧКИ CD, Floppy и USB устройства, за да помогне при премахването на зловредния софтуер и Ви защити от бъдещи вируси/заплахи, които поразяват чрез autorun. Ако това е проблем за вас - моля, уведомете ме.
ComboFix ще изключи вашата интернет връзка. Интернет връзката ще се възстанови автоматично, преди ComboFix да завърши процеса на работа. При проблем, той ще прекрати интернет връзката. За да възстановите интернет връзката си, рестартирайте компютъра си.
В случай на проблем с ComboFix, той може да създаде лог файл. Моля, включете съдържанието на C:BUG.txt в следващия Ви коментар в тази тема.

Моля, не прикачвайте лог файла/овете от програмата, а го/ги копирайте и поставете в следващия Ви коментар в тази тема.

22 април 201214 г.

Автор

По време на скана намери някои работи, рестартира се 2-3 пъти, но няма Bug.txt. Резултата от ComboFix: ComboFix 12-04-22.01 - Clever Boy 22/04/2012 12:28:52.1.1 - x86 Microsoft Windows XP Professional 5.1.2600.3.1251.359.1033.18.990.606 [GMT -7:00] Running from: c:documents and settingsClever BoyDesktopComboFix.exe . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:documents and settingsAll UsersApplication DataTEMP c:windows$NtUninstallKB60371$ c:windows$NtUninstallKB60371$3323604425@ c:windows$NtUninstallKB60371$3323604425cfg.ini c:windows$NtUninstallKB60371$3323604425Desktop.ini c:windows$NtUninstallKB60371$3323604425Lvbndqlnv c:windows$NtUninstallKB60371$3323604425oemid c:windows$NtUninstallKB60371$3323604425U00000001.@ c:windows$NtUninstallKB60371$3323604425U00000002.@ c:windows$NtUninstallKB60371$3323604425U00000004.@ c:windows$NtUninstallKB60371$3323604425U80000000.@ c:windows$NtUninstallKB60371$3323604425U80000004.@ c:windows$NtUninstallKB60371$3323604425U80000032.@ c:windows$NtUninstallKB60371$3323604425version c:windows$NtUninstallKB60371$488767881 c:windowssystem32dds_trash_log.cmd c:windowssystem32SET39.tmp c:windowssystem32SET3E.tmp . . ((((((((((((((((((((((((( Files Created from 2012-03-22 to 2012-04-22 ))))))))))))))))))))))))))))))) . . 2012-04-22 19:46 . 2012-04-22 19:46 -------- d---a-w- c:documents and settingsAll UsersApplication DataTEMP 2012-03-30 01:54 . 2012-03-30 01:54 592824 ----a-w- c:program filesMozilla Firefoxgkmedias.dll 2012-03-30 01:54 . 2012-03-30 01:54 44472 ----a-w- c:program filesMozilla Firefoxmozglue.dll 2012-03-29 18:53 . 2012-03-29 18:53 418464 ----a-w- c:windowssystem32FlashPlayerApp.exe . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-03-29 18:53 . 2012-02-04 23:58 70304 ----a-w- c:windowssystem32FlashPlayerCPLApp.cpl 2012-03-01 11:01 . 2008-04-14 12:00 916992 ----a-w- c:windowssystem32wininet.dll 2012-03-01 11:01 . 2008-04-14 12:00 43520 ------w- c:windowssystem32licmgr10.dll 2012-03-01 11:01 . 2008-04-14 12:00 1469440 ------w- c:windowssystem32inetcpl.cpl 2012-02-29 14:10 . 2008-04-14 12:00 177664 ----a-w- c:windowssystem32wintrust.dll 2012-02-29 14:10 . 2008-04-14 12:00 148480 ----a-w- c:windowssystem32imagehlp.dll 2012-02-29 12:17 . 2008-04-14 12:00 385024 ------w- c:windowssystem32html.iec 2012-02-22 12:25 . 2012-02-22 12:25 299472 ----a-w- c:windowssystem32driversavgtdix.sys 2012-02-22 12:25 . 2011-10-07 14:23 235216 ----a-w- c:windowssystem32driversavgldx86.sys 2012-02-19 05:00 . 2012-02-19 04:30 249856 ------w- c:windowsSetup1.exe 2012-02-19 05:00 . 2012-02-19 05:00 73216 ----a-w- c:windowstemp.000 2012-02-19 04:30 . 2012-02-19 04:30 73216 ------w- c:windowsST6UNST.EXE 2012-02-07 08:04 . 2012-02-07 08:04 691696 ----a-w- c:windowssystem32driverssptd.sys 2012-02-06 18:00 . 2012-02-09 07:40 79360 ----a-w- c:windowssystem32ff_vfw.dll 2012-02-03 09:22 . 2008-04-14 12:00 1860096 ----a-w- c:windowssystem32win32k.sys 2012-01-31 11:46 . 2011-09-13 14:30 31952 ----a-w- c:windowssystem32driversavgrkx86.sys 2012-03-30 01:54 . 2012-03-07 01:52 97208 ----a-w- c:program filesmozilla firefoxcomponentsbrowsercomps.dll . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerURLSearchHooks] "{687578b9-7132-4a7a-80e4-30ee31099e03}"= "c:program filesuTorrentControl2prxtbuTor.dll" [2011-05-09 176936] . [HKEY_CLASSES_ROOTclsid{687578b9-7132-4a7a-80e4-30ee31099e03}] . [HKEY_LOCAL_MACHINE~Browser Helper Objects{687578b9-7132-4a7a-80e4-30ee31099e03}] 2011-05-09 08:49 176936 ----a-w- c:program filesuTorrentControl2prxtbuTor.dll . [HKEY_LOCAL_MACHINE~Browser Helper Objects{D4027C7F-154A-4066-A1AD-4243D8127440}] 2012-01-04 00:31 1514152 ----a-w- c:program filesAsk.comGenericAskToolbar.dll . [HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar] "{687578b9-7132-4a7a-80e4-30ee31099e03}"= "c:program filesuTorrentControl2prxtbuTor.dll" [2011-05-09 176936] "{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:program filesAsk.comGenericAskToolbar.dll" [2012-01-04 1514152] . [HKEY_CLASSES_ROOTclsid{687578b9-7132-4a7a-80e4-30ee31099e03}] . [HKEY_CLASSES_ROOTclsid{d4027c7f-154a-4066-a1ad-4243d8127440}] [HKEY_CLASSES_ROOTGenericAskToolbar.ToolbarWnd.1] [HKEY_CLASSES_ROOTTypeLib{2996F0E7-292B-4CAE-893F-47B8B1C05B56}] [HKEY_CLASSES_ROOTGenericAskToolbar.ToolbarWnd] . [HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun] "DU Meter"="c:program filesDU MeterDUMeter.exe" [2011-10-28 1118720] "Sticky Pad"="c:program filesStickyPadStickyPad.exe" [2012-01-05 520249] "Skype"="c:program filesSkypePhoneSkype.exe" [2010-09-02 13351304] . [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun] "IgfxTray"="c:windowssystem32igfxtray.exe" [2003-05-30 155648] "HotKeysCmds"="c:windowssystem32hkcmd.exe" [2003-05-30 114688] "AVG_TRAY"="c:program filesAVGAVG2012avgtray.exe" [2012-02-16 2575712] . [HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun] "CTFMON.EXE"="c:windowssystem32CTFMON.EXE" [2008-04-14 15360] . [HKEY_LOCAL_MACHINEsystemcurrentcontrolsetcontrolsession manager] BootExecute REG_MULTI_SZ autocheck autochk *0c:progra~1AVGAVG2012avgrsx.exe /sync /restart . [HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootMinimalsdauxservice] @="" . [HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootMinimalsdcoreservice] @="" . [HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregAdvanced SystemCare 5] 2012-03-07 01:39 574296 ----a-w- c:program filesIObitAdvanced SystemCare 5ASCTray.exe . [HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregApnUpdater] 2012-01-04 00:31 1391272 ----a-w- c:program filesAsk.comUpdaterUpdater.exe . [HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregEPSON SX100 Series] 2009-07-29 17:12 188928 ----a-w- c:windowssystem32spooldriversw32x863E_FATIEDE.EXE . [HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregISTray] 2011-07-07 19:39 1600984 ----a-w- c:program filesSpyware DoctorpctsGui.exe . [HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregPCTools FGuard] 2011-07-01 23:36 247760 ----a-w- c:program filesSpyware DoctorBDTFGuard.exe . [HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity center] "AntiVirusOverride"=dword:00000001 . [HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList] "%windir%Network Diagnosticxpnetdiag.exe"= "%windir%system32sessmgr.exe"= "c:Program FilesSkypePlugin ManagerskypePM.exe"= "c:Program FilesuTorrentuTorrent.exe"= "c:Program FilesAVGAVG2012avgnsx.exe"= "c:Program FilesAVGAVG2012avgdiagex.exe"= "c:Program FilesAVGAVG2012avgmfapx.exe"= "c:Program FilesAVGAVG2012avgemcx.exe"= "c:Program FilesSkypePhoneSkype.exe"= . R0 AVGIDSEH;AVGIDSEH;c:windowssystem32driversavgidsehx.sys [23/12/2011 13:32 22992] R0 Avgrkx86;AVG Anti-Rootkit Driver;c:windowssystem32driversavgrkx86.sys [13/09/2011 07:30 31952] R0 PCTCore;PCTools KDS;c:windowssystem32driversPCTCore.sys [08/02/2012 23:18 263888] R0 pctDS;PC Tools Data Store;c:windowssystem32driverspctDS.sys [08/02/2012 23:18 338880] R0 pctEFA;PC Tools Extended File Attributes;c:windowssystem32driverspctEFA.sys [08/02/2012 23:18 656320] R0 sptd;sptd;c:windowssystem32driverssptd.sys [07/02/2012 01:04 691696] R1 Avgldx86;AVG AVI Loader Driver;c:windowssystem32driversavgldx86.sys [07/10/2011 07:23 235216] R1 Avgtdix;AVG TDI Driver;c:windowssystem32driversavgtdix.sys [22/02/2012 05:25 299472] R1 PCTSD;PC Tools Spyware Doctor Driver;c:windowssystem32driversPCTSD.sys [08/02/2012 23:18 233976] R2 AdvancedSystemCareService5;Advanced SystemCare Service 5;c:program filesIObitAdvanced SystemCare 5ASCService.exe [08/02/2012 21:57 913752] R2 AVGIDSAgent;AVGIDSAgent;c:program filesAVGAVG2012avgidsagent.exe [14/02/2012 04:52 5104992] R2 avgwd;AVG WatchDog;c:program filesAVGAVG2012avgwdsvc.exe [14/02/2012 04:53 193288] R2 Browser Defender Update Service;Browser Defender Update Service;c:program filesSpyware DoctorBDTBDTUpdateService.exe [08/02/2012 23:22 337872] R2 DUMeterSvc;DU Meter Service;c:program filesDU MeterDUMeterSvc.exe [09/02/2012 00:51 513536] R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:program filesTuneUp Utilities 2010TuneUpUtilitiesService32.exe [15/11/2011 02:55 1052480] R2 USBSafelyRemoveService;USB Safely Remove Assistant;c:program filesUSB Safely RemoveUSBSRService.exe [07/02/2012 00:39 261456] R3 AVGIDSDriver;AVGIDSDriver;c:windowssystem32driversavgidsdriverx.sys [23/12/2011 13:32 139856] R3 AVGIDSFilter;AVGIDSFilter;c:windowssystem32driversavgidsfilterx.sys [23/12/2011 13:32 24144] R3 AVGIDSShim;AVGIDSShim;c:windowssystem32driversavgidsshimx.sys [23/12/2011 13:32 17232] R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:program filesTuneUp Utilities 2010TuneUpUtilitiesDriver32.sys [25/02/2010 11:18 10064] S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:windowssystem32MacromedFlashFlashPlayerUpdateService.exe [29/03/2012 11:53 253600] S3 DUMeterDrv;Hagel Technologies DU Meter traffic accounting driver;c:program filesDU MeterDUM_XP32.sys [09/02/2012 00:51 16744] S3 sdAuxService;PC Tools Auxiliary Service;c:program filesSpyware DoctorpctsAuxs.exe [08/02/2012 22:59 371472] . HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionSvchost - NetSvcs DSI_SiUSBXp_3_1 lpx Accelerometer tifm21 w810mdm mstee sgeclient pnrouter PAR1284 ipodservice racsvc sbpci GENERICDRV UxTuneUp . Contents of the 'Scheduled Tasks' folder . 2012-04-22 c:windowsTasksAdobe Flash Player Updater.job - c:windowssystem32MacromedFlashFlashPlayerUpdateService.exe [2012-03-29 18:53] . 2012-04-22 c:windowsTasksScheduled Update for Ask Toolbar.job - c:program filesAsk.comUpdateTask.exe [2012-01-04 00:31] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.google.co.uk/ IE: Download with &Media Finder - c:program filesMedia Finderhook.html IE: E&xport to Microsoft Excel - c:progra~1MICROS~2OFFICE11EXCEL.EXE/3000 LSP: c:program filesCommon FilesPC ToolsLspPCTLsp.dll TCP: DhcpNameServer = 192.168.1.254 FF - ProfilePath - c:documents and settingsClever BoyApplication DataMozillaFirefoxProfilesj9m7wxoa.default FF - prefs.js: browser.startup.homepage - hxxp://www.google.co.uk/ FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3072253&SearchSource=2&q= . - - - - ORPHANS REMOVED - - - - . MSConfigStartUp-Media Finder - c:program filesMedia FinderMF.exe . . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2012-04-22 12:47 Windows 5.1.2600 Service Pack 3 NTFS . scanning hidden processes ... . scanning hidden autostart entries ... . scanning hidden files ... . scan completed successfully hidden files: 0 . ************************************************************************** . [HKEY_LOCAL_MACHINESystemControlSet001ServicesDUMeterSvc] "ImagePath"="c:program filesDU MeterDUMeterSvc.exe /startedbyscm:E1F6D4BE-40E33354-DUMeterService" . --------------------- DLLs Loaded Under Running Processes --------------------- . - - - - - - - > 'lsass.exe'(1056) c:program filesCommon FilesPC ToolsLspPCTLsp.dll . - - - - - - - > 'explorer.exe'(2168) c:windowssystem32WININET.dll c:windowssystem32ieframe.dll c:windowssystem32webcheck.dll c:windowssystem32WPDShServiceObj.dll c:windowssystem32PortableDeviceTypes.dll c:windowssystem32PortableDeviceApi.dll . ------------------------ Other Running Processes ------------------------ . c:progra~1AVGAVG2012avgrsx.exe c:program filesAVGAVG2012avgcsrvx.exe c:program filesCommon FilesAutodata Limited SharedServiceADCDLicSvc.exe c:documents and settingsAll UsersApplication DataEPSONEPW!3 SSRPE_S40ST7.EXE c:program filesAVGAVG2012avgnsx.exe c:program filesAVGAVG2012avgemcx.exe c:documents and settingsAll UsersApplication DataEPSONEPW!3 SSRPE_S40RP7.EXE c:progra~1DUMETE~1DUMeter.exe c:program filesTuneUp Utilities 2010TuneUpUtilitiesApp32.exe . ************************************************************************** . Completion time: 2012-04-22 12:54:31 - machine was rebooted ComboFix-quarantined-files.txt 2012-04-22 19:54 . Pre-Run: 2,758,569,984 bytes free Post-Run: 3,056,115,712 bytes free . WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)WINDOWS [operating systems] c:cmdconsBOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons UnsupportedDebug="do not select this" /debug multi(0)disk(0)rdisk(0)partition(1)WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect . - - End Of File - - 45DAEF747F296363C587DC0149F7439B

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

23 април 201214 г.

СТЪПКА 1

Направете бекъп на регистрите.Изтеглете програмата ERUNT,инсталирате и стартирате програмата,избирате папка за съхранение,в секцията Backup options,трябва да бъдат маркирани "System registry" , "Current user registry" и "Other open user registries",натискате "Ok" и потвърждавате създаването на папка.

Описание с картинки на ERUNT: тук

СТЪПКА 2

Отворете notepad и с copy/paste въведете следната информация:

REGEDIT4

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionSvcHost]
"netsvcs"=hex(7):36,74,6f,34,00,41,70,70,4d,67,6d,74,00,41,75,64,69,6f,53,72,
  76,00,42,72,6f,77,73,65,72,00,43,72,79,70,74,53,76,63,00,44,4d,53,65,72,76,
  65,72,00,44,48,43,50,00,45,52,53,76,63,00,45,76,65,6e,74,53,79,73,74,65,6d,
  00,46,61,73,74,55,73,65,72,53,77,69,74,63,68,69,6e,67,43,6f,6d,70,61,74,69,
  62,69,6c,69,74,79,00,48,69,64,53,65,72,76,00,49,61,73,00,49,70,72,69,70,00,
  49,72,6d,6f,6e,00,4c,61,6e,6d,61,6e,53,65,72,76,65,72,00,4c,61,6e,6d,61,6e,
  57,6f,72,6b,73,74,61,74,69,6f,6e,00,4d,65,73,73,65,6e,67,65,72,00,4e,65,74,
  6d,61,6e,00,4e,6c,61,00,4e,74,6d,73,73,76,63,00,4e,57,43,57,6f,72,6b,73,74,
  61,74,69,6f,6e,00,4e,77,73,61,70,61,67,65,6e,74,00,52,61,73,61,75,74,6f,00,
  52,61,73,6d,61,6e,00,52,65,6d,6f,74,65,61,63,63,65,73,73,00,53,63,68,65,64,
  75,6c,65,00,53,65,63,6c,6f,67,6f,6e,00,53,45,4e,53,00,53,68,61,72,65,64,61,
  63,63,65,73,73,00,53,52,53,65,72,76,69,63,65,00,54,61,70,69,73,72,76,00,54,
  68,65,6d,65,73,00,54,72,6b,57,6b,73,00,57,33,32,54,69,6d,65,00,57,5a,43,53,
  56,43,00,57,6d,69,00,57,6d,64,6d,50,6d,53,70,00,77,69,6e,6d,67,6d,74,00,77,
  73,63,73,76,63,00,78,6d,6c,70,72,6f,76,00,6e,61,70,61,67,65,6e,74,00,68,6b,
  6d,73,76,63,00,42,49,54,53,00,77,75,61,75,73,65,72,76,00,53,68,65,6c,6c,48,
  57,44,65,74,65,63,74,69,6f,6e,00,68,65,6c,70,73,76,63,00,00

Запазете файла с името fix.reg.
Файла трябва да изглежда така -
Стартирайте го и изберете YES на диалоговия прозорец.
Рестартирайте компютъра си.

СТЪПКА 3

Изтрийте вашето копие на Комбофикс (като изтриете иконата от вашия десктоп)...изтеглете ново свежо копие от тук или тук и го запазете на десктопа си.Направете нова проверка по инструкцията в пост 2.

СТЪПКА 4

Моля,изтрийте изтрийте вашата версия на TDSSKiller , изтеглете последната версия на TDSSKiller - оттук и я запазете на вашия декстоп.

Стартирайте TDSSKiller.exe за да стартирате приложението. След това кликнете върху бутона Change parameters.
Сложете отметки пред Verify Driver Digital Signature и Detect TDLFS file system и натиснете ОК.
Натиснете бутона Start Scan.
Ако подозрителен обект бъде засечен, действието по подразбиране ще бъде Skip, кликнете върху Continue.
Ако зловредни обекти бъдат намерени, тогава от падащото меню ще имате три възможности.
Бъдете сигурни, че избраното действие е Cure и натиснете върху Continue > Рестартирайте за да бъде завършена поправката.

Забележка: Ако Cure бутона не е наличен от възможностите, тогава моля изберете Skip бутона, не избирайте Delete освен ако не сте инструктирани затова.
Лог файл ще бъде създаден в свободната директория на дял C: . Потърсете за лог с името "TDSSKiller.[Version]_[Date]_[Time]_log.txt" и копирайте съдържанието му в следващия си пост.

23 април 201214 г.

Автор

Ето от ComboFix: ComboFix Microsoft Running from: AV: AVG Anti-Virus . . (((((((((((((((((( . . c:documents c:documents . . ((((((((((((((((((((((((( . . 2012-04-23 2012-04-22 2012-03-30 2012-03-30 2012-03-29 . . . (((((((((((((((((( . 2012-04-23 2012-03-01 2012-03-01 2012-03-01 2012-02-29 2012-02-29 2012-02-29 2012-02-22 2012-02-22 2012-02-19 2012-02-19 2012-02-19 2012-02-07 2012-02-06 2012-02-03 2012-01-31 2012-03-30 . . ((((((((((((((((((((((((((((( . + 2012-04-23 + 2012-04-23 + 2012-04-23 + 2012-04-23 + 2012-04-23 + 2012-03-29 + 2012-04-23 + 2012-04-23 + 2012-04-23 + 2012-04-23 + 2012-04-23 + 2012-04-23 + 2012-04-23 . (((((((((((((((((( . . *Note* empty REGEDIT4 . [HKEY_CURRENT_USER "{687578b9-7132-4a . [HKEY_CLASSES_ROOT . [HKEY_LOCAL_MACHINE~Browser 2011-05-09 08:49 . [HKEY_LOCAL_MACHINE~Browser 2012-01-04 00:31 . [HKEY_LOCAL_MACHIN "{687578b9-7132-4a "{D4027C7F-154A-40 . [HKEY_CLASSES_ROOT . [HKEY_CLASSES_ROOT [HKEY_CLASSES_ROOT [HKEY_CLASSES_ROOT [HKEY_CLASSES_ROOT . [HKEY_CURRENT_USER "{687578B9-7132-4A "{D4027C7F-154A-40 . [HKEY_CLASSES_ROOT . [HKEY_CLASSES_ROOT [HKEY_CLASSES_ROOT [HKEY_CLASSES_ROOT [HKEY_CLASSES_ROOT . [HKEY_CURRENT_USER "DU Meter"="c:program "Sticky Pad"="c:program "Skype"="c:program . [HKEY_LOCAL_MACHIN "IgfxTray"="c:wind "HotKeysCmds"="c:w "AVG_TRAY"="c:program . [HKEY_USERS.DEFAUL "CTFMON.EXE"="c:wi . c:documents ERUNT AutoBackup.lnk . [HKEY_LOCAL_MACHIN BootExecute REG_MULTI_SZ . [HKEY_LOCAL_MACHIN @="" . [HKEY_LOCAL_MACHIN @="" . [HKEY_LOCAL_MACHIN 2012-03-07 01:39 . [HKEY_LOCAL_MACHIN 2012-01-04 00:31 . [HKEY_LOCAL_MACHIN 2009-07-29 17:12 . [HKEY_LOCAL_MACHIN 2011-07-07 19:39 . [HKEY_LOCAL_MACHIN 2011-07-01 23:36 . [HKEY_LOCAL_MACHIN "AntiVirusOverride"=dword:00000001 . [HKLM~servicesshar "%windir%Network "%windir%system32sessmgr.exe"= "c:Program "c:Program FilesuTorrentuTorrent.exe"= "c:Program FilesAVGAVG2012avgnsx.exe"= "c:Program "c:Program "c:Program FilesAVGAVG2012avgemcx.exe"= "c:Program FilesSkypePhoneSkype.exe"= . R0 AVGIDSEH;AVGIDS R0 Avgrkx86;AVG R0 PCTCore;PCTools R0 pctDS;PC R0 pctEFA;PC R0 sptd;sptd;c:win R1 Avgldx86;AVG R1 Avgtdix;AVG R1 PCTSD;PC R2 AdvancedSystemC R2 avgwd;AVG R2 Browser R2 DUMeterSvc;DU R2 TuneUp.UtilitiesSvc;TuneUp R2 USBSafelyRemoveService;USB R3 AVGIDSDriver;AV R3 AVGIDSFilter;AV R3 AVGIDSShim;AVGI R3 TuneUpUtilities S2 AVGIDSAgent;AVG S3 AdobeFlashPlaye S3 DUMeterDrv;Hagel S3 sdAuxService;PC . Contents . 2012-04-23 - c:windowssystem3 . 2012-04-23 - c:program . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.google.co.uk/ IE: Download IE: E&xport LSP: c:program TCP: DhcpNameServer = 192.168.1.254 FF - ProfilePath FF - prefs.js: FF - prefs.js: . . ****************** . catchme 0.3.1398 Rootkit scan 2012-04-23 11:06 Windows 5.1.2600 Service Pack 3 NTFS . scanning hidden processes ... . scanning hidden autostart entries ... . scanning hidden files ... . scan completed successfully hidden files: 0 . ****************** . [HKEY_LOCAL_MACHIN "ImagePath"="c:program . --------------------- . - - - - - - - > 'lsass.exe'(1048) c:program . - - - - - - - > 'explorer.exe'(2404) c:windowssystem32WININET.dll c:windowssystem32ieframe.dll c:windowssystem32webcheck.dll c:windowssystem32WPDShServiceObj.dll c:windowssystem32P c:windowssystem32PortableDeviceApi.dll . Completion time: 2012-04-23 11:08:54 ComboFix-quarantined-files.txt ComboFix2.txt 2012-04-22 19:54 . Pre-Run: 3,532,918,784 bytes free Post-Run: 3,527,249,920 bytes free . - - End Of Наведнъж Ето от 11:18:30.0718 2428 11:18:31.0203 2428 11:18:31.0203 2428 11:18:31.0203 2428 SystemInfo: 11:18:31.0203 2428 11:18:31.0203 2428 11:18:31.0203 2428 11:18:31.0203 2428 11:18:31.0203 2428 11:18:31.0203 2428 11:18:31.0203 2428 11:18:31.0203 2428 11:18:31.0203 2428 11:18:31.0203 2428 Page size: 0x1000 11:18:31.0203 2428 11:18:31.0203 2428 11:18:34.0828 2428 11:18:34.0828 2428 11:18:34.0828 2428 MBR partitions: 11:18:34.0828 2428 11:18:34.0875 2428 11:18:34.0984 2428 11:18:35.0046 2428 11:18:35.0062 2428 11:18:35.0062 2428 11:21:10.0328 2428 11:21:10.0328 2428 Scan started 11:21:10.0328 2428 11:21:10.0328 2428 11:21:10.0859 2428 Abiosdsk - ok 11:21:10.0875 2428 abp480n5 - ok 11:21:10.0890 2428 11:21:10.0953 2428 11:21:11.0562 2428 ACPI - ok 11:21:11.0671 2428 11:21:11.0828 2428 ACPIEC - ok 11:21:12.0015 2428 11:21:12.0031 2428 11:21:12.0109 2428 adpu160m - ok 11:21:12.0250 2428 11:21:12.0343 2428 11:21:12.0437 2428 11:21:12.0703 2428 aec - ok 11:21:12.0984 2428 11:21:13.0062 2428 AFD - ok 11:21:13.0140 2428 Aha154x - ok 11:21:13.0156 2428 aic78u2 - ok 11:21:13.0171 2428 aic78xx - ok 11:21:13.0265 2428 11:21:13.0390 2428 ALCXWDM - ok 11:21:13.0484 2428 11:21:13.0750 2428 Alerter - ok 11:21:13.0859 2428 11:21:13.0968 2428 ALG - ok 11:21:14.0093 2428 AliIde - ok 11:21:14.0109 2428 amsint - ok 11:21:14.0187 2428 11:21:14.0281 2428 AppMgmt - ok 11:21:14.0468 2428 11:21:14.0609 2428 AR5416 - ok 11:21:14.0718 2428 11:21:14.0984 2428 Arp1394 - ok 11:21:15.0078 2428 asc - ok 11:21:15.0109 2428 asc3350p - ok 11:21:15.0125 2428 asc3550 - ok 11:21:15.0171 2428 11:21:15.0375 2428 AsyncMac - ok 11:21:15.0484 2428 11:21:15.0671 2428 atapi - ok 11:21:15.0734 2428 Atdisk - ok 11:21:15.0781 2428 11:21:15.0968 2428 Atmarpc - ok 11:21:16.0109 2428 11:21:16.0312 2428 AudioSrv - ok 11:21:16.0421 2428 11:21:16.0625 2428 audstub - ok 11:21:16.0687 2428 11:21:16.0718 2428 11:21:16.0718 2428 11:21:17.0062 2428 11:21:17.0421 2428 AVGIDSAgent - ok 11:21:17.0531 2428 11:21:17.0609 2428 AVGIDSDriver - ok 11:21:17.0718 2428 11:21:17.0734 2428 AVGIDSEH - ok 11:21:17.0843 2428 11:21:17.0859 2428 AVGIDSFilter - ok 11:21:17.0953 2428 11:21:17.0984 2428 AVGIDSShim - ok 11:21:18.0093 2428 11:21:18.0125 2428 Avgldx86 - ok 11:21:18.0312 2428 11:21:18.0343 2428 Avgmfx86 - ok 11:21:18.0421 2428 11:21:18.0437 2428 Avgrkx86 - ok 11:21:18.0500 2428 11:21:18.0531 2428 Avgtdix - ok 11:21:18.0640 2428 11:21:18.0671 2428 avgwd - ok 11:21:18.0781 2428 11:21:19.0046 2428 Beep - ok 11:21:19.0156 2428 11:21:19.0390 2428 BITS - ok 11:21:19.0484 2428 11:21:19.0687 2428 Browser - ok 11:21:19.0812 2428 11:21:19.0843 2428 11:21:19.0937 2428 catchme - ok 11:21:20.0046 2428 11:21:20.0250 2428 cbidf2k - ok 11:21:20.0312 2428 cd20xrnt - ok 11:21:20.0359 2428 11:21:20.0546 2428 Cdaudio - ok 11:21:20.0656 2428 11:21:20.0843 2428 Cdfs - ok 11:21:20.0937 2428 11:21:21.0140 2428 Cdrom - ok 11:21:21.0203 2428 Changer - ok 11:21:21.0250 2428 11:21:21.0453 2428 CiSvc - ok 11:21:21.0562 2428 11:21:21.0765 2428 ClipSrv - ok 11:21:21.0875 2428 11:21:22.0062 2428 CmBatt - ok 11:21:22.0125 2428 CmdIde - ok 11:21:22.0171 2428 11:21:22.0375 2428 Compbatt - ok 11:21:22.0437 2428 COMSysApp - ok 11:21:22.0468 2428 Cpqarray - ok 11:21:22.0515 2428 11:21:22.0718 2428 CryptSvc - ok 11:21:22.0812 2428 dac2w2k - ok 11:21:22.0859 2428 dac960nt - ok 11:21:22.0984 2428 11:21:23.0109 2428 DcomLaunch - ok 11:21:23.0375 2428 11:21:23.0578 2428 Dhcp - ok 11:21:23.0687 2428 11:21:23.0937 2428 Disk - ok 11:21:24.0140 2428 dmadmin - ok 11:21:24.0265 2428 11:21:24.0531 2428 dmboot - ok 11:21:24.0640 2428 11:21:24.0828 2428 dmio - ok 11:21:24.0937 2428 11:21:25.0125 2428 dmload - ok 11:21:25.0218 2428 11:21:25.0406 2428 dmserver - ok 11:21:25.0500 2428 11:21:25.0687 2428 DMusic - ok 11:21:25.0796 2428 11:21:25.0828 2428 Dnscache - ok 11:21:25.0937 2428 11:21:26.0109 2428 Dot3svc - ok 11:21:26.0187 2428 dpti2o - ok 11:21:26.0234 2428 11:21:26.0406 2428 drmkaud - ok 11:21:26.0468 2428 11:21:26.0546 2428 11:21:26.0562 2428 DUMeterDrv - ok 11:21:26.0578 2428 DUMeterSvc - ok 11:21:26.0671 2428 11:21:26.0859 2428 EapHost - ok 11:21:27.0031 2428 11:21:27.0046 2428 11:21:27.0046 2428 11:21:27.0171 2428 11:21:27.0203 2428 11:21:27.0203 2428 11:21:27.0296 2428 11:21:27.0515 2428 ERSvc - ok 11:21:27.0609 2428 11:21:27.0640 2428 Eventlog - ok 11:21:27.0750 2428 11:21:27.0781 2428 EventSystem - ok 11:21:27.0875 2428 11:21:28.0078 2428 Fastfat - ok 11:21:28.0187 2428 11:21:28.0234 2428 11:21:28.0328 2428 11:21:28.0531 2428 Fdc - ok 11:21:28.0640 2428 11:21:28.0828 2428 Fips - ok 11:21:28.0921 2428 11:21:29.0125 2428 Flpydisk - ok 11:21:29.0234 2428 11:21:29.0437 2428 FltMgr - ok 11:21:29.0546 2428 11:21:29.0734 2428 Fs_Rec - ok 11:21:29.0828 2428 11:21:29.0843 2428 11:21:29.0843 2428 11:21:29.0953 2428 11:21:30.0171 2428 Ftdisk - ok 11:21:30.0281 2428 11:21:30.0312 2428 11:21:30.0312 2428 11:21:30.0375 2428 GENERICDRV - ok 11:21:30.0437 2428 11:21:30.0625 2428 Gpc - ok 11:21:30.0718 2428 11:21:30.0890 2428 helpsvc - ok 11:21:30.0953 2428 HidServ - ok 11:21:31.0078 2428 11:21:31.0281 2428 hkmsvc - ok 11:21:31.0343 2428 hpn - ok 11:21:31.0437 2428 11:21:31.0484 2428 HTTP - ok 11:21:31.0578 2428 11:21:31.0781 2428 HTTPFilter - ok 11:21:32.0046 2428 i2omgmt - ok 11:21:32.0203 2428 i2omp - ok 11:21:32.0265 2428 11:21:32.0453 2428 i8042prt - ok 11:21:32.0562 2428 11:21:32.0734 2428 ialm - ok 11:21:32.0843 2428 11:21:33.0031 2428 Imapi - ok 11:21:33.0125 2428 11:21:33.0328 2428 ImapiService - ok 11:21:33.0406 2428 ini910u - ok 11:21:33.0453 2428 11:21:33.0640 2428 IntelIde - ok 11:21:33.0718 2428 11:21:33.0921 2428 intelppm - ok 11:21:34.0062 2428 11:21:34.0250 2428 Ip6Fw - ok 11:21:34.0343 2428 11:21:34.0531 2428 11:21:34.0625 2428 11:21:34.0812 2428 IpInIp - ok 11:21:34.0906 2428 11:21:35.0109 2428 IpNat - ok 11:21:35.0171 2428 ipodservice - ok 11:21:35.0218 2428 11:21:35.0406 2428 IPSec - ok 11:21:35.0515 2428 11:21:35.0593 2428 irda - ok 11:21:35.0703 2428 11:21:35.0781 2428 IRENUM - ok 11:21:35.0890 2428 11:21:35.0968 2428 Irmon - ok 11:21:36.0109 2428 11:21:36.0281 2428 isapnp - ok 11:21:36.0375 2428 11:21:36.0578 2428 Kbdclass - ok 11:21:36.0687 2428 11:21:36.0875 2428 kmixer - ok 11:21:36.0968 2428 11:21:37.0062 2428 KSecDD - ok 11:21:37.0171 2428 11:21:37.0218 2428 LanmanServer - ok 11:21:37.0328 2428 11:21:37.0375 2428 11:21:37.0453 2428 lbrtfdc - ok 11:21:37.0515 2428 11:21:37.0781 2428 LmHosts - ok 11:21:37.0843 2428 lpx - ok 11:21:37.0906 2428 11:21:38.0093 2428 Messenger - ok 11:21:38.0187 2428 11:21:38.0375 2428 mnmdd - ok 11:21:38.0468 2428 11:21:38.0656 2428 mnmsrvc - ok 11:21:38.0765 2428 11:21:38.0968 2428 Modem - ok 11:21:39.0109 2428 11:21:39.0281 2428 Mouclass - ok 11:21:39.0375 2428 11:21:39.0562 2428 MountMgr - ok 11:21:39.0625 2428 mraid35x - ok 11:21:39.0687 2428 11:21:39.0875 2428 MRxDAV - ok 11:21:40.0031 2428 11:21:40.0140 2428 MRxSmb - ok 11:21:40.0250 2428 11:21:40.0437 2428 MSDTC - ok 11:21:40.0531 2428 11:21:40.0718 2428 Msfs - ok 11:21:40.0796 2428 MSIServer - ok 11:21:40.0859 2428 11:21:41.0031 2428 MSKSSRV - ok 11:21:41.0140 2428 11:21:41.0328 2428 MSPCLOCK - ok 11:21:41.0421 2428 11:21:41.0609 2428 MSPQM - ok 11:21:41.0703 2428 11:21:41.0906 2428 mssmbios - ok 11:21:42.0046 2428 mstee - ok 11:21:42.0109 2428 11:21:42.0156 2428 Mup - ok 11:21:42.0265 2428 11:21:42.0468 2428 napagent - ok 11:21:42.0562 2428 11:21:42.0765 2428 NDIS - ok 11:21:42.0859 2428 11:21:42.0921 2428 NdisTapi - ok 11:21:43.0062 2428 11:21:43.0234 2428 Ndisuio - ok 11:21:43.0343 2428 11:21:43.0531 2428 NdisWan - ok 11:21:43.0640 2428 11:21:43.0687 2428 NDProxy - ok 11:21:43.0781 2428 11:21:43.0968 2428 NetBIOS - ok 11:21:44.0187 2428 11:21:44.0390 2428 NetBT - ok 11:21:44.0484 2428 11:21:44.0656 2428 NetDDE - ok 11:21:44.0671 2428 11:21:44.0859 2428 NetDDEdsdm - ok 11:21:44.0953 2428 11:21:45.0171 2428 Netlogon - ok 11:21:45.0250 2428 11:21:45.0437 2428 Netman - ok 11:21:45.0546 2428 11:21:45.0750 2428 NIC1394 - ok 11:21:45.0859 2428 11:21:45.0906 2428 Nla - ok 11:21:46.0046 2428 11:21:46.0234 2428 Npfs - ok 11:21:46.0343 2428 11:21:46.0578 2428 Ntfs - ok 11:21:46.0687 2428 11:21:46.0843 2428 NtLmSsp - ok 11:21:47.0000 2428 11:21:47.0203 2428 NtmsSvc - ok 11:21:47.0281 2428 11:21:47.0468 2428 Null - ok 11:21:47.0562 2428 11:21:47.0765 2428 NwlnkFlt - ok 11:21:47.0875 2428 11:21:48.0062 2428 NwlnkFwd - ok 11:21:48.0156 2428 11:21:48.0343 2428 ohci1394 - ok 11:21:48.0421 2428 11:21:48.0437 2428 ose - ok 11:21:48.0515 2428 PAR1284 - ok 11:21:48.0562 2428 11:21:48.0750 2428 Parport - ok 11:21:48.0859 2428 11:21:49.0046 2428 PartMgr - ok 11:21:49.0140 2428 11:21:49.0328 2428 ParVdm - ok 11:21:49.0421 2428 11:21:49.0609 2428 PCI - ok 11:21:49.0687 2428 PCIDump - ok 11:21:49.0718 2428 11:21:49.0890 2428 PCIIde - ok 11:21:50.0078 2428 11:21:50.0281 2428 Pcmcia - ok 11:21:50.0390 2428 11:21:50.0406 2428 PCTCore - ok 11:21:50.0531 2428 11:21:50.0562 2428 pctDS - ok 11:21:50.0703 2428 11:21:50.0734 2428 pctEFA - ok 11:21:50.0859 2428 11:21:50.0875 2428 PCTSD - ok 11:21:50.0953 2428 PDCOMP - ok 11:21:50.0968 2428 PDFRAME - ok 11:21:51.0000 2428 PDRELI - ok 11:21:51.0015 2428 PDRFRAME - ok 11:21:51.0046 2428 perc2 - ok 11:21:51.0062 2428 perc2hib - ok 11:21:51.0140 2428 11:21:51.0171 2428 PlugPlay - ok 11:21:51.0250 2428 pnrouter - ok 11:21:51.0296 2428 11:21:51.0546 2428 PolicyAgent - ok 11:21:51.0656 2428 11:21:51.0828 2428 PptpMiniport - ok 11:21:51.0921 2428 11:21:52.0093 2428 11:21:52.0140 2428 11:21:52.0328 2428 PSched - ok 11:21:52.0437 2428 11:21:52.0625 2428 Ptilink - ok 11:21:52.0687 2428 ql1080 - ok 11:21:52.0703 2428 Ql10wnt - ok 11:21:52.0718 2428 ql12160 - ok 11:21:52.0750 2428 ql1240 - ok 11:21:52.0765 2428 ql1280 - ok 11:21:52.0781 2428 racsvc - ok 11:21:52.0828 2428 11:21:53.0000 2428 RasAcd - ok 11:21:53.0109 2428 11:21:53.0312 2428 RasAuto - ok 11:21:53.0406 2428 11:21:53.0484 2428 Rasirda - ok 11:21:53.0578 2428 11:21:53.0765 2428 Rasl2tp - ok 11:21:53.0875 2428 11:21:54.0046 2428 RasMan - ok 11:21:54.0156 2428 11:21:54.0343 2428 RasPppoe - ok 11:21:54.0437 2428 11:21:54.0609 2428 Raspti - ok 11:21:54.0718 2428 11:21:54.0906 2428 Rdbss - ok 11:21:55.0140 2428 11:21:55.0312 2428 RDPCDD - ok 11:21:55.0390 2428 11:21:55.0562 2428 rdpdr - ok 11:21:55.0687 2428 11:21:55.0734 2428 RDPWD - ok 11:21:55.0828 2428 11:21:56.0015 2428 RDSessMgr - ok 11:21:56.0125 2428 11:21:56.0296 2428 redbook - ok 11:21:56.0421 2428 11:21:56.0609 2428 RemoteAccess - ok 11:21:56.0703 2428 11:21:56.0875 2428 11:21:57.0000 2428 11:21:57.0187 2428 RpcLocator - ok 11:21:57.0328 2428 11:21:57.0359 2428 RpcSs - ok 11:21:57.0468 2428 11:21:57.0671 2428 RSVP - ok 11:21:57.0765 2428 11:21:57.0968 2428 rtl8139 - ok 11:21:58.0109 2428 11:21:58.0281 2428 SamSs - ok 11:21:58.0359 2428 sbpci - ok 11:21:58.0421 2428 11:21:58.0609 2428 SCardSvr - ok 11:21:58.0718 2428 11:21:58.0921 2428 Schedule - ok 11:21:59.0046 2428 11:21:59.0078 2428 sdAuxService - ok 11:21:59.0296 2428 11:21:59.0359 2428 11:21:59.0468 2428 11:21:59.0578 2428 Secdrv - ok 11:21:59.0671 2428 11:21:59.0906 2428 seclogon - ok 11:22:00.0140 2428 11:22:00.0328 2428 SENS - ok 11:22:00.0437 2428 11:22:00.0609 2428 Serenum - ok 11:22:00.0718 2428 11:22:00.0906 2428 Serial - ok 11:22:01.0015 2428 11:22:01.0203 2428 Sfloppy - ok 11:22:01.0265 2428 sgeclient - ok 11:22:01.0328 2428 11:22:01.0531 2428 SharedAccess - ok 11:22:01.0656 2428 11:22:01.0687 2428 11:22:01.0921 2428 Simbad - ok 11:22:02.0031 2428 11:22:02.0093 2428 SMCIRDA - ok 11:22:02.0171 2428 Sparrow - ok 11:22:02.0218 2428 11:22:02.0437 2428 splitter - ok 11:22:02.0546 2428 11:22:02.0593 2428 Spooler - ok 11:22:02.0734 2428 11:22:02.0734 2428 11:22:02.0734 2428 11:22:02.0734 2428 11:22:02.0828 2428 11:22:02.0937 2428 sr - ok 11:22:03.0093 2428 11:22:03.0171 2428 srservice - ok 11:22:03.0312 2428 11:22:03.0390 2428 Srv - ok 11:22:03.0515 2428 11:22:03.0656 2428 SSDPSRV - ok 11:22:03.0765 2428 11:22:04.0000 2428 stisvc - ok 11:22:04.0171 2428 11:22:04.0343 2428 swenum - ok 11:22:04.0453 2428 11:22:04.0640 2428 swmidi - ok 11:22:04.0718 2428 SwPrv - ok 11:22:04.0734 2428 symc810 - ok 11:22:04.0750 2428 symc8xx - ok 11:22:04.0781 2428 sym_hi - ok 11:22:04.0796 2428 sym_u3 - ok 11:22:04.0859 2428 11:22:05.0031 2428 sysaudio - ok 11:22:05.0171 2428 11:22:05.0328 2428 SysmonLog - ok 11:22:05.0437 2428 11:22:05.0609 2428 TapiSrv - ok 11:22:05.0718 2428 11:22:05.0781 2428 Tcpip - ok 11:22:05.0875 2428 11:22:06.0062 2428 TDPIPE - ok 11:22:06.0140 2428 11:22:06.0328 2428 TDTCP - ok 11:22:06.0437 2428 11:22:06.0625 2428 TermDD - ok 11:22:06.0734 2428 11:22:06.0937 2428 TermService - ok 11:22:07.0140 2428 11:22:07.0156 2428 Themes - ok 11:22:07.0218 2428 tifm21 - ok 11:22:07.0281 2428 11:22:07.0375 2428 TlntSvr - ok 11:22:07.0515 2428 11:22:07.0609 2428 11:22:07.0687 2428 TosIde - ok 11:22:07.0734 2428 11:22:08.0015 2428 TrkWks - ok 11:22:08.0156 2428 11:22:08.0187 2428 11:22:08.0312 2428 11:22:08.0359 2428 11:22:08.0453 2428 11:22:08.0468 2428 11:22:08.0578 2428 11:22:08.0828 2428 Udfs - ok 11:22:08.0906 2428 ultra - ok 11:22:09.0000 2428 11:22:09.0218 2428 Update - ok 11:22:09.0343 2428 11:22:09.0437 2428 upnphost - ok 11:22:09.0546 2428 11:22:09.0750 2428 UPS - ok 11:22:09.0859 2428 11:22:10.0078 2428 usbccgp - ok 11:22:10.0359 2428 11:22:10.0531 2428 usbehci - ok 11:22:10.0625 2428 11:22:10.0828 2428 usbhub - ok 11:22:10.0937 2428 11:22:11.0109 2428 usbprint - ok 11:22:11.0218 2428 11:22:11.0250 2428 11:22:11.0343 2428 11:22:11.0515 2428 usbscan - ok 11:22:11.0609 2428 11:22:11.0796 2428 USBSTOR - ok 11:22:11.0890 2428 11:22:12.0062 2428 usbuhci - ok 11:22:12.0171 2428 11:22:12.0187 2428 UxTuneUp - ok 11:22:12.0281 2428 11:22:12.0453 2428 VgaSave - ok 11:22:12.0531 2428 ViaIde - ok 11:22:12.0578 2428 11:22:12.0750 2428 VolSnap - ok 11:22:12.0859 2428 11:22:12.0953 2428 VSS - ok 11:22:13.0078 2428 11:22:13.0265 2428 W32Time - ok 11:22:13.0343 2428 w810mdm - ok 11:22:13.0375 2428 11:22:13.0546 2428 Wanarp - ok 11:22:13.0625 2428 WDICA - ok 11:22:13.0671 2428 11:22:13.0843 2428 wdmaud - ok 11:22:13.0953 2428 11:22:14.0140 2428 WebClient - ok 11:22:14.0265 2428 11:22:14.0421 2428 winmgmt - ok 11:22:14.0531 2428 11:22:14.0562 2428 WmdmPmSN - ok 11:22:14.0703 2428 11:22:14.0765 2428 Wmi - ok 11:22:14.0890 2428 11:22:15.0078 2428 WmiApSrv - ok 11:22:15.0187 2428 11:22:15.0281 2428 11:22:15.0390 2428 11:22:15.0562 2428 WS2IFSL - ok 11:22:15.0656 2428 11:22:15.0843 2428 wscsvc - ok 11:22:15.0953 2428 11:22:15.0984 2428 WSIMD - ok 11:22:16.0078 2428 11:22:16.0281 2428 wuauserv - ok 11:22:16.0343 2428 11:22:16.0406 2428 WudfPf - ok 11:22:16.0500 2428 11:22:16.0546 2428 WudfRd - ok 11:22:16.0656 2428 11:22:16.0687 2428 WudfSvc - ok 11:22:16.0828 2428 11:22:17.0062 2428 WZCSVC - ok 11:22:17.0156 2428 11:22:17.0390 2428 xmlprov - ok 11:22:17.0515 2428 11:22:17.0562 2428 11:22:17.0671 2428 11:22:17.0718 2428 11:22:17.0843 2428 11:22:17.0890 2428 11:22:17.0906 2428 11:22:18.0343 2428 11:22:18.0343 2428 11:22:18.0343 2428 11:22:18.0390 2428 11:22:18.0390 2428 11:22:18.0390 2428 11:22:18.0390 2428 Scan finished 11:22:18.0390 2428 11:22:18.0531 3560 11:22:18.0531 3560 11:22:50.0531 3560 11:22:50.0531 3560 11:22:50.0546 3560 11:22:50.0546 3560 11:22:50.0546 3560 11:22:50.0546 3560 11:22:50.0546 3560 11:22:50.0546 3560 11:22:50.0546 3560 11:22:50.0546 3560 11:22:50.0546 3560 11:22:50.0546 3560 11:23:50.0125 2488 11:23:50.0125 2488 Scan started 11:23:50.0125 2488 11:23:50.0125 2488 11:23:50.0468 2488 Abiosdsk - ok 11:23:50.0484 2488 abp480n5 - ok 11:23:50.0500 2488 11:23:50.0578 2488 11:23:50.0843 2488 ACPI - ok 11:23:50.0953 2488 11:23:51.0156 2488 ACPIEC - ok 11:23:51.0296 2488 11:23:51.0312 2488 11:23:51.0390 2488 adpu160m - ok 11:23:51.0531 2488 11:23:51.0593 2488 11:23:51.0687 2488 11:23:51.0937 2488 aec - ok 11:23:52.0078 2488 11:23:52.0109 2488 AFD - ok 11:23:52.0187 2488 Aha154x - ok 11:23:52.0203 2488 aic78u2 - ok 11:23:52.0234 2488 aic78xx - ok 11:23:52.0312 2488 11:23:52.0406 2488 ALCXWDM - ok 11:23:52.0515 2488 11:23:52.0796 2488 Alerter - ok 11:23:52.0906 2488 11:23:53.0000 2488 ALG - ok 11:23:53.0093 2488 AliIde - ok 11:23:53.0109 2488 amsint - ok 11:23:53.0171 2488 11:23:53.0265 2488 AppMgmt - ok 11:23:53.0437 2488 11:23:53.0562 2488 AR5416 - ok 11:23:53.0671 2488 11:23:53.0953 2488 Arp1394 - ok 11:23:54.0046 2488 asc - ok 11:23:54.0062 2488 asc3350p - ok 11:23:54.0078 2488 asc3550 - ok 11:23:54.0125 2488 11:23:54.0312 2488 AsyncMac - ok 11:23:54.0421 2488 11:23:54.0578 2488 atapi - ok 11:23:54.0656 2488 Atdisk - ok 11:23:54.0703 2488 11:23:54.0906 2488 Atmarpc - ok 11:23:55.0031 2488 11:23:55.0218 2488 AudioSrv - ok 11:23:55.0328 2488 11:23:55.0515 2488 audstub - ok 11:23:55.0593 2488 11:23:55.0609 2488 11:23:55.0609 2488 11:23:55.0921 2488 11:23:56.0296 2488 AVGIDSAgent - ok 11:23:56.0390 2488 11:23:56.0421 2488 AVGIDSDriver - ok 11:23:56.0531 2488 11:23:56.0546 2488 AVGIDSEH - ok 11:23:56.0640 2488 11:23:56.0671 2488 AVGIDSFilter - ok 11:23:56.0765 2488 11:23:56.0781 2488 AVGIDSShim - ok 11:23:56.0890 2488 11:23:56.0921 2488 Avgldx86 - ok 11:23:57.0078 2488 11:23:57.0109 2488 Avgmfx86 - ok 11:23:57.0187 2488 11:23:57.0203 2488 Avgrkx86 - ok 11:23:57.0250 2488 11:23:57.0281 2488 Avgtdix - ok 11:23:57.0390 2488 11:23:57.0421 2488 avgwd - ok 11:23:57.0515 2488 11:23:57.0765 2488 Beep - ok 11:23:57.0875 2488 11:23:58.0078 2488 BITS - ok 11:23:58.0171 2488 11:23:58.0390 2488 Browser - ok 11:23:58.0515 2488 11:23:58.0546 2488 11:23:58.0640 2488 catchme - ok 11:23:58.0734 2488 11:23:58.0921 2488 cbidf2k - ok 11:23:59.0015 2488 cd20xrnt - ok 11:23:59.0062 2488 11:23:59.0250 2488 Cdaudio - ok 11:23:59.0375 2488 11:23:59.0562 2488 Cdfs - ok 11:23:59.0671 2488 11:23:59.0859 2488 Cdrom - ok 11:23:59.0921 2488 Changer - ok 11:23:59.0968 2488 11:24:00.0171 2488 CiSvc - ok 11:24:00.0281 2488 11:24:00.0437 2488 ClipSrv - ok 11:24:00.0531 2488 11:24:00.0703 2488 CmBatt - ok 11:24:00.0765 2488 CmdIde - ok 11:24:00.0812 2488 11:24:01.0000 2488 Compbatt - ok 11:24:01.0078 2488 COMSysApp - ok 11:24:01.0109 2488 Cpqarray - ok 11:24:01.0156 2488 11:24:01.0343 2488 CryptSvc - ok 11:24:01.0406 2488 dac2w2k - ok 11:24:01.0437 2488 dac960nt - ok 11:24:01.0515 2488 11:24:01.0546 2488 DcomLaunch - ok 11:24:01.0640 2488 11:24:01.0875 2488 Dhcp - ok 11:24:01.0968 2488 11:24:02.0203 2488 Disk - ok 11:24:02.0265 2488 dmadmin - ok 11:24:02.0359 2488 11:24:02.0546 2488 dmboot - ok 11:24:02.0656 2488 11:24:02.0859 2488 dmio - ok 11:24:02.0953 2488 11:24:03.0125 2488 dmload - ok 11:24:03.0218 2488 11:24:03.0406 2488 dmserver - ok 11:24:03.0515 2488 11:24:03.0687 2488 DMusic - ok 11:24:03.0796 2488 11:24:03.0828 2488 Dnscache - ok 11:24:03.0921 2488 11:24:04.0109 2488 Dot3svc - ok 11:24:04.0171 2488 dpti2o - ok 11:24:04.0218 2488 11:24:04.0375 2488 drmkaud - ok 11:24:04.0437 2488 11:24:04.0500 2488 11:24:04.0515 2488 DUMeterDrv - ok 11:24:04.0515 2488 DUMeterSvc - ok 11:24:04.0609 2488 11:24:04.0796 2488 EapHost - ok 11:24:04.0890 2488 11:24:04.0921 2488 11:24:04.0921 2488 11:24:05.0046 2488 11:24:05.0093 2488 11:24:05.0093 2488 11:24:05.0171 2488 11:24:05.0359 2488 ERSvc - ok 11:24:05.0468 2488 11:24:05.0484 2488 Eventlog - ok 11:24:05.0593 2488 11:24:05.0625 2488 EventSystem - ok 11:24:05.0718 2488 11:24:05.0890 2488 Fastfat - ok 11:24:06.0015 2488 11:24:06.0031 2488 11:24:06.0140 2488 11:24:06.0359 2488 Fdc - ok 11:24:06.0468 2488 11:24:06.0625 2488 Fips - ok 11:24:06.0703 2488 11:24:06.0890 2488 Flpydisk - ok 11:24:07.0015 2488 11:24:07.0187 2488 FltMgr - ok 11:24:07.0296 2488 11:24:07.0453 2488 Fs_Rec - ok 11:24:07.0562 2488 11:24:07.0578 2488 11:24:07.0578 2488 11:24:07.0687 2488 11:24:07.0859 2488 Ftdisk - ok 11:24:07.0953 2488 11:24:08.0000 2488 11:24:08.0000 2488 11:24:08.0062 2488 GENERICDRV - ok 11:24:08.0125 2488 11:24:08.0296 2488 Gpc - ok 11:24:08.0390 2488 11:24:08.0593 2488 helpsvc - ok 11:24:08.0625 2488 HidServ - ok 11:24:08.0703 2488 11:24:08.0875 2488 hkmsvc - ok 11:24:08.0953 2488 hpn - ok 11:24:09.0093 2488 11:24:09.0109 2488 HTTP - ok 11:24:09.0265 2488 11:24:09.0453 2488 HTTPFilter - ok 11:24:09.0484 2488 i2omgmt - ok 11:24:09.0515 2488 i2omp - ok 11:24:09.0578 2488 11:24:09.0750 2488 i8042prt - ok 11:24:09.0875 2488 11:24:09.0921 2488 ialm - ok 11:24:10.0156 2488 11:24:10.0343 2488 Imapi - ok 11:24:10.0421 2488 11:24:10.0609 2488 ImapiService - ok 11:24:10.0687 2488 ini910u - ok 11:24:10.0734 2488 11:24:10.0906 2488 IntelIde - ok 11:24:11.0000 2488 11:24:11.0187 2488 intelppm - ok 11:24:11.0234 2488 11:24:11.0421 2488 Ip6Fw - ok 11:24:11.0515 2488 11:24:11.0671 2488 11:24:11.0765 2488 11:24:11.0953 2488 IpInIp - ok 11:24:12.0062 2488 11:24:12.0250 2488 IpNat - ok 11:24:12.0328 2488 ipodservice - ok 11:24:12.0375 2488 11:24:12.0546 2488 IPSec - ok 11:24:12.0656 2488 11:24:12.0750 2488 irda - ok 11:24:12.0843 2488 11:24:12.0921 2488 IRENUM - ok 11:24:13.0062 2488 11:24:13.0140 2488 Irmon - ok 11:24:13.0234 2488 11:24:13.0375 2488 isapnp - ok 11:24:13.0468 2488 11:24:13.0656 2488 Kbdclass - ok 11:24:13.0765 2488 11:24:13.0921 2488 kmixer - ok 11:24:14.0046 2488 11:24:14.0093 2488 KSecDD - ok 11:24:14.0187 2488 11:24:14.0218 2488 LanmanServer - ok 11:24:14.0359 2488 11:24:14.0406 2488 11:24:14.0468 2488 lbrtfdc - ok 11:24:14.0515 2488 11:24:14.0765 2488 LmHosts - ok 11:24:14.0828 2488 lpx - ok 11:24:14.0890 2488 11:24:15.0078 2488 Messenger - ok 11:24:15.0171 2488 11:24:15.0343 2488 mnmdd - ok 11:24:15.0437 2488 11:24:15.0609 2488 mnmsrvc - ok 11:24:15.0718 2488 11:24:15.0906 2488 Modem - ok 11:24:16.0046 2488 11:24:16.0218 2488 Mouclass - ok 11:24:16.0312 2488 11:24:16.0484 2488 MountMgr - ok 11:24:16.0562 2488 mraid35x - ok 11:24:16.0609 2488 11:24:16.0781 2488 MRxDAV - ok 11:24:16.0890 2488 11:24:16.0953 2488 MRxSmb - ok 11:24:17.0093 2488 11:24:17.0265 2488 MSDTC - ok 11:24:17.0375 2488 11:24:17.0562 2488 Msfs - ok 11:24:17.0640 2488 MSIServer - ok 11:24:17.0703 2488 11:24:17.0859 2488 MSKSSRV - ok 11:24:17.0953 2488 11:24:18.0125 2488 MSPCLOCK - ok 11:24:18.0203 2488 11:24:18.0390 2488 MSPQM - ok 11:24:18.0484 2488 11:24:18.0640 2488 mssmbios - ok 11:24:18.0671 2488 mstee - ok 11:24:18.0765 2488 11:24:18.0781 2488 Mup - ok 11:24:18.0906 2488 11:24:19.0078 2488 napagent - ok 11:24:19.0187 2488 11:24:19.0390 2488 NDIS - ok 11:24:19.0484 2488 11:24:19.0515 2488 NdisTapi - ok 11:24:19.0593 2488 11:24:19.0781 2488 Ndisuio - ok 11:24:19.0890 2488 11:24:20.0062 2488 NdisWan - ok 11:24:20.0156 2488 11:24:20.0187 2488 NDProxy - ok 11:24:20.0281 2488 11:24:20.0468 2488 NetBIOS - ok 11:24:20.0578 2488 11:24:20.0734 2488 NetBT - ok 11:24:20.0843 2488 11:24:21.0015 2488 NetDDE - ok 11:24:21.0031 2488 11:24:21.0203 2488 NetDDEdsdm - ok 11:24:21.0296 2488 11:24:21.0468 2488 Netlogon - ok 11:24:21.0562 2488 11:24:21.0750 2488 Netman - ok 11:24:21.0859 2488 11:24:22.0031 2488 NIC1394 - ok 11:24:22.0156 2488 11:24:22.0187 2488 Nla - ok 11:24:22.0296 2488 11:24:22.0468 2488 Npfs - ok 11:24:22.0593 2488 11:24:22.0796 2488 Ntfs - ok 11:24:22.0906 2488 11:24:23.0078 2488 NtLmSsp - ok 11:24:23.0203 2488 11:24:23.0375 2488 NtmsSvc - ok 11:24:23.0453 2488 11:24:23.0640 2488 Null - ok 11:24:23.0734 2488 11:24:23.0906 2488 NwlnkFlt - ok 11:24:24.0046 2488 11:24:24.0234 2488 NwlnkFwd - ok 11:24:24.0359 2488 11:24:24.0515 2488 ohci1394 - ok 11:24:24.0593 2488 11:24:24.0625 2488 ose - ok 11:24:24.0703 2488 PAR1284 - ok 11:24:24.0750 2488 11:24:24.0906 2488 Parport - ok 11:24:25.0046 2488 11:24:25.0218 2488 PartMgr - ok 11:24:25.0328 2488 11:24:25.0515 2488 ParVdm - ok 11:24:25.0609 2488 11:24:25.0781 2488 PCI - ok 11:24:25.0859 2488 PCIDump - ok 11:24:25.0890 2488 11:24:26.0046 2488 PCIIde - ok 11:24:26.0156 2488 11:24:26.0328 2488 Pcmcia - ok 11:24:26.0437 2488 11:24:26.0453 2488 PCTCore - ok 11:24:26.0562 2488 11:24:26.0593 2488 pctDS - ok 11:24:26.0734 2488 11:24:26.0781 2488 pctEFA - ok 11:24:26.0890 2488 11:24:26.0906 2488 PCTSD - ok 11:24:27.0015 2488 PDCOMP - ok 11:24:27.0031 2488 PDFRAME - ok 11:24:27.0046 2488 PDRELI - ok 11:24:27.0062 2488 PDRFRAME - ok 11:24:27.0093 2488 perc2 - ok 11:24:27.0109 2488 perc2hib - ok 11:24:27.0187 2488 11:24:27.0234 2488 PlugPlay - ok 11:24:27.0296 2488 pnrouter - ok 11:24:27.0343 2488 11:24:27.0578 2488 PolicyAgent - ok 11:24:27.0687 2488 11:24:27.0859 2488 PptpMiniport - ok 11:24:27.0968 2488 11:24:28.0140 2488 11:24:28.0250 2488 11:24:28.0437 2488 PSched - ok 11:24:28.0546 2488 11:24:28.0718 2488 Ptilink - ok 11:24:28.0781 2488 ql1080 - ok 11:24:28.0812 2488 Ql10wnt - ok 11:24:28.0828 2488 ql12160 - ok 11:24:28.0843 2488 ql1240 - ok 11:24:28.0875 2488 ql1280 - ok 11:24:28.0890 2488 racsvc - ok 11:24:28.0937 2488 11:24:29.0093 2488 RasAcd - ok 11:24:29.0203 2488 11:24:29.0390 2488 RasAuto - ok 11:24:29.0500 2488 11:24:29.0578 2488 Rasirda - ok 11:24:29.0671 2488 11:24:29.0843 2488 Rasl2tp - ok 11:24:29.0953 2488 11:24:30.0109 2488 RasMan - ok 11:24:30.0218 2488 11:24:30.0390 2488 RasPppoe - ok 11:24:30.0468 2488 11:24:30.0656 2488 Raspti - ok 11:24:30.0750 2488 11:24:30.0921 2488 Rdbss - ok 11:24:31.0062 2488 11:24:31.0218 2488 RDPCDD - ok 11:24:31.0296 2488 11:24:31.0453 2488 rdpdr - ok 11:24:31.0562 2488 11:24:31.0609 2488 RDPWD - ok 11:24:31.0890 2488 11:24:32.0078 2488 RDSessMgr - ok 11:24:32.0171 2488 11:24:32.0359 2488 redbook - ok 11:24:32.0453 2488 11:24:32.0640 2488 RemoteAccess - ok 11:24:32.0750 2488 11:24:32.0921 2488 11:24:33.0171 2488 11:24:33.0343 2488 RpcLocator - ok 11:24:33.0406 2488 11:24:33.0437 2488 RpcSs - ok 11:24:33.0562 2488 11:24:33.0734 2488 RSVP - ok 11:24:33.0843 2488 11:24:34.0015 2488 rtl8139 - ok 11:24:34.0140 2488 11:24:34.0296 2488 SamSs - ok 11:24:34.0375 2488 sbpci - ok 11:24:34.0437 2488 11:24:34.0625 2488 SCardSvr - ok 11:24:34.0734 2488 11:24:34.0875 2488 Schedule - ok 11:24:35.0015 2488 11:24:35.0031 2488 sdAuxService - ok 11:24:35.0281 2488 11:24:35.0343 2488 11:24:35.0437 2488 11:24:35.0531 2488 Secdrv - ok 11:24:35.0625 2488 11:24:35.0812 2488 seclogon - ok 11:24:35.0890 2488 11:24:36.0078 2488 SENS - ok 11:24:36.0203 2488 11:24:36.0359 2488 Serenum - ok 11:24:36.0453 2488 11:24:36.0640 2488 Serial - ok 11:24:36.0734 2488 11:24:36.0906 2488 Sfloppy - ok 11:24:36.0984 2488 sgeclient - ok 11:24:37.0046 2488 11:24:37.0234 2488 SharedAccess - ok 11:24:37.0343 2488 11:24:37.0359 2488 11:24:37.0421 2488 Simbad - ok 11:24:37.0468 2488 11:24:37.0546 2488 SMCIRDA - ok 11:24:37.0609 2488 Sparrow - ok 11:24:37.0640 2488 11:24:37.0828 2488 splitter - ok 11:24:37.0921 2488 11:24:37.0953 2488 Spooler - ok 11:24:38.0109 2488 11:24:38.0109 2488 11:24:38.0109 2488 11:24:38.0109 2488 11:24:38.0203 2488 11:24:38.0296 2488 sr - ok 11:24:38.0406 2488 11:24:38.0484 2488 srservice - ok 11:24:38.0625 2488 11:24:38.0687 2488 Srv - ok 11:24:38.0796 2488 11:24:38.0859 2488 SSDPSRV - ok 11:24:39.0000 2488 11:24:39.0171 2488 stisvc - ok 11:24:39.0265 2488 11:24:39.0468 2488 swenum - ok 11:24:39.0562 2488 11:24:39.0750 2488 swmidi - ok 11:24:39.0828 2488 SwPrv - ok 11:24:39.0843 2488 symc810 - ok 11:24:39.0859 2488 symc8xx - ok 11:24:39.0890 2488 sym_hi - ok 11:24:39.0906 2488 sym_u3 - ok 11:24:39.0968 2488 11:24:40.0187 2488 sysaudio - ok 11:24:40.0296 2488 11:24:40.0437 2488 SysmonLog - ok 11:24:40.0546 2488 11:24:40.0703 2488 TapiSrv - ok 11:24:40.0812 2488 11:24:40.0875 2488 Tcpip - ok 11:24:40.0968 2488 11:24:41.0156 2488 TDPIPE - ok 11:24:41.0265 2488 11:24:41.0437 2488 TDTCP - ok 11:24:41.0546 2488 11:24:41.0718 2488 TermDD - ok 11:24:41.0828 2488 11:24:42.0000 2488 TermService - ok 11:24:42.0125 2488 11:24:42.0156 2488 Themes - ok 11:24:42.0234 2488 tifm21 - ok 11:24:42.0281 2488 11:24:42.0375 2488 TlntSvr - ok 11:24:42.0515 2488 11:24:42.0593 2488 11:24:42.0671 2488 TosIde - ok 11:24:42.0734 2488 11:24:42.0984 2488 TrkWks - ok 11:24:43.0140 2488 11:24:43.0156 2488 11:24:43.0296 2488 11:24:43.0359 2488 11:24:43.0453 2488 11:24:43.0468 2488 11:24:43.0562 2488 11:24:43.0734 2488 Udfs - ok 11:24:43.0812 2488 ultra - ok 11:24:43.0875 2488 11:24:44.0078 2488 Update - ok 11:24:44.0171 2488 11:24:44.0250 2488 upnphost - ok 11:24:44.0375 2488 11:24:44.0531 2488 UPS - ok 11:24:44.0656 2488 11:24:44.0828 2488 usbccgp - ok 11:24:44.0921 2488 11:24:45.0093 2488 usbehci - ok 11:24:45.0171 2488 11:24:45.0359 2488 usbhub - ok 11:24:45.0468 2488 11:24:45.0625 2488 usbprint - ok 11:24:45.0750 2488 11:24:45.0765 2488 11:24:45.0859 2488 11:24:46.0015 2488 usbscan - ok 11:24:46.0125 2488 11:24:46.0281 2488 USBSTOR - ok 11:24:46.0343 2488 11:24:46.0484 2488 usbuhci - ok 11:24:46.0546 2488 11:24:46.0562 2488 UxTuneUp - ok 11:24:46.0671 2488 11:24:46.0812 2488 VgaSave - ok 11:24:46.0875 2488 ViaIde - ok 11:24:46.0921 2488 11:24:47.0062 2488 VolSnap - ok 11:24:47.0203 2488 11:24:47.0265 2488 VSS - ok 11:24:47.0375 2488 11:24:47.0546 2488 W32Time - ok 11:24:47.0625 2488 w810mdm - ok 11:24:47.0656 2488 11:24:47.0812 2488 Wanarp - ok 11:24:47.0890 2488 WDICA - ok 11:24:47.0937 2488 11:24:48.0078 2488 wdmaud - ok 11:24:48.0187 2488 11:24:48.0359 2488 WebClient - ok 11:24:48.0437 2488 11:24:48.0578 2488 winmgmt - ok 11:24:48.0703 2488 11:24:48.0718 2488 WmdmPmSN - ok 11:24:48.0781 2488 11:24:48.0828 2488 Wmi - ok 11:24:48.0968 2488 11:24:49.0109 2488 WmiApSrv - ok 11:24:49.0234 2488 11:24:49.0296 2488 11:24:49.0406 2488 11:24:49.0562 2488 WS2IFSL - ok 11:24:49.0656 2488 11:24:49.0812 2488 wscsvc - ok 11:24:49.0906 2488 11:24:49.0937 2488 WSIMD - ok 11:24:50.0046 2488 11:24:50.0203 2488 wuauserv - ok 11:24:50.0250 2488 11:24:50.0281 2488 WudfPf - ok 11:24:50.0390 2488 11:24:50.0406 2488 WudfRd - ok 11:24:50.0484 2488 11:24:50.0500 2488 WudfSvc - ok 11:24:50.0625 2488 11:24:50.0781 2488 WZCSVC - ok 11:24:50.0875 2488 11:24:51.0031 2488 xmlprov - ok 11:24:51.0140 2488 11:24:51.0171 2488 11:24:51.0296 2488 11:24:51.0328 2488 11:24:51.0453 2488 11:24:51.0484 2488 11:24:51.0500 2488 11:24:51.0812 2488 11:24:51.0859 2488 11:24:51.0859 2488 11:24:51.0890 2488 11:24:51.0890 2488 11:24:51.0906 2488 11:24:51.0906 2488 Scan finished 11:24:51.0906 2488 11:24:51.0921 2780 11:24:51.0921 2780 11:27:01.0609 2780 11:27:01.0609 2780 11:27:01.0609 2780 11:27:01.0609 2780 11:27:01.0640 2780 11:27:01.0640 2780 11:27:01.0640 2780 11:27:01.0640 2780 11:27:01.0640 2780 11:27:01.0640 2780 11:27:01.0640 2780 11:27:01.0640 2780 11:27:22.0843 2976 12-04-23.02 - Clever Boy 23/04/2012 11:00:28.2.1 - x86 Windows XP Professional 5.1.2600.3.1251.359.1033.18.990.673 [GMT -7:00] c:documents and settingsClever BoyDesktopComboFix.exe Free Edition 2012 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF} ((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) and settingsAll UsersApplication DataTEMP and settingsClever BoyApplication DataMozillaFirefoxProfilesj9m7wxoa.defaultweavetoFetch Files Created from 2012-03-23 to 2012-04-23 ))))))))))))))))))))))))))))))) 17:41 . 2012-04-23 17:41 -------- d-----w- c:program filesERUNT 19:57 . 2012-04-22 19:57 -------- d-----w- c:documents and settingsClever BoyLocal SettingsApplication DataThreat Expert 01:54 . 2012-03-30 01:54 592824 ----a-w- c:program filesMozilla Firefoxgkmedias.dll 01:54 . 2012-03-30 01:54 44472 ----a-w- c:program filesMozilla Firefoxmozglue.dll 18:53 . 2012-04-23 17:23 418464 ----a-w- c:windowssystem32FlashPlayerApp.exe (((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 17:23 . 2012-02-04 23:58 70304 ----a-w- c:windowssystem32FlashPlayerCPLApp.cpl 11:01 . 2008-04-14 12:00 916992 ----a-w- c:windowssystem32wininet.dll 11:01 . 2008-04-14 12:00 43520 ------w- c:windowssystem32licmgr10.dll 11:01 . 2008-04-14 12:00 1469440 ------w- c:windowssystem32inetcpl.cpl 14:10 . 2008-04-14 12:00 177664 ----a-w- c:windowssystem32wintrust.dll 14:10 . 2008-04-14 12:00 148480 ----a-w- c:windowssystem32imagehlp.dll 12:17 . 2008-04-14 12:00 385024 ------w- c:windowssystem32html.iec 12:25 . 2012-02-22 12:25 299472 ----a-w- c:windowssystem32driversavgtdix.sys 12:25 . 2011-10-07 14:23 235216 ----a-w- c:windowssystem32driversavgldx86.sys 05:00 . 2012-02-19 04:30 249856 ------w- c:windowsSetup1.exe 05:00 . 2012-02-19 05:00 73216 ----a-w- c:windowstemp.000 04:30 . 2012-02-19 04:30 73216 ------w- c:windowsST6UNST.EXE 08:04 . 2012-02-07 08:04 691696 ----a-w- c:windowssystem32driverssptd.sys 18:00 . 2012-02-09 07:40 79360 ----a-w- c:windowssystem32ff_vfw.dll 09:22 . 2008-04-14 12:00 1860096 ----a-w- c:windowssystem32win32k.sys 11:46 . 2011-09-13 14:30 31952 ----a-w- c:windowssystem32driversavgrkx86.sys 01:54 . 2012-03-07 01:52 97208 ----a-w- c:program filesmozilla firefoxcomponentsbrowsercomps.dll SnapShot@2012-04-22_19.46.52 ))))))))))))))))))))))))))))))))))))))))) 17:50 . 2012-04-23 17:50 45056 c:windowsERDNTAutoBackup23-04-2012Users00000002UsrClass.dat 17:43 . 2012-04-23 17:43 45056 c:windowsERDNT23-04-2012Users00000004UsrClass.dat 17:43 . 2012-04-23 17:43 8192 c:windowsERDNT23-04-2012Users00000006UsrClass.dat 17:43 . 2012-04-23 17:43 8192 c:windowsERDNT23-04-2012Users00000002UsrClass.dat 17:23 . 2012-04-23 17:23 353440 c:windowssystem32MacromedFlashFlashUtil32_11_2_202_233_Plugin.exe 18:53 . 2012-04-23 17:23 253088 c:windowssystem32MacromedFlashFlashPlayerUpdateService.exe 17:50 . 2005-10-20 19:02 163328 c:windowsERDNTAutoBackup23-04-2012ERDNT.EXE 17:43 . 2012-04-23 17:43 253952 c:windowsERDNT23-04-2012Users00000005NTUSER.DAT 17:43 . 2012-04-23 17:43 249856 c:windowsERDNT23-04-2012Users00000001NTUSER.DAT 17:43 . 2005-10-20 19:02 163328 c:windowsERDNT23-04-2012ERDNT.EXE 17:23 . 2012-04-23 17:23 8797344 c:windowssystem32MacromedFlashNPSWF32_11_2_202_233.dll 17:50 . 2012-04-23 17:50 1888256 c:windowsERDNTAutoBackup23-04-2012Users00000001NTUSER.DAT 17:43 . 2012-04-23 17:43 1888256 c:windowsERDNT23-04-2012Users00000003NTUSER.DAT ((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) entries & legit default entries are not shown SoftwareMicrosoftInternet ExplorerURLSearchHooks] 7a-80e4-30ee31099e03}"= "c:program filesuTorrentControl2prxtbuTor.dll" [2011-05-09 176936] clsid{687578b9-7132-4a7a-80e4-30ee31099e03}] Helper Objects{687578b9-7132-4a7a-80e4-30ee31099e03}] 176936 ----a-w- c:program filesuTorrentControl2prxtbuTor.dll Helper Objects{D4027C7F-154A-4066-A1AD-4243D8127440}] 1514152 ----a-w- c:program filesAsk.comGenericAskToolbar.dll ESOFTWAREMicrosoftInternet ExplorerToolbar] 7a-80e4-30ee31099e03}"= "c:program filesuTorrentControl2prxtbuTor.dll" [2011-05-09 176936] 66-A1AD-4243D8127440}"= "c:program filesAsk.comGenericAskToolbar.dll" [2012-01-04 1514152] clsid{687578b9-7132-4a7a-80e4-30ee31099e03}] clsid{d4027c7f-154a-4066-a1ad-4243d8127440}] GenericAskToolbar.ToolbarWnd.1] TypeLib{2996F0E7-292B-4CAE-893F-47B8B1C05B56}] GenericAskToolbar.ToolbarWnd] SoftwareMicrosoftInternet ExplorerToolbarWebbrowser] 7A-80E4-30EE31099E03}"= "c:program filesuTorrentControl2prxtbuTor.dll" [2011-05-09 176936] 66-A1AD-4243D8127440}"= "c:program filesAsk.comGenericAskToolbar.dll" [2012-01-04 1514152] clsid{687578b9-7132-4a7a-80e4-30ee31099e03}] clsid{d4027c7f-154a-4066-a1ad-4243d8127440}] GenericAskToolbar.ToolbarWnd.1] TypeLib{2996F0E7-292B-4CAE-893F-47B8B1C05B56}] GenericAskToolbar.ToolbarWnd] SOFTWAREMicrosoftWindowsCurrentVersionRun] filesDU MeterDUMeter.exe" [2011-10-28 1118720] filesStickyPadStickyPad.exe" [2012-01-05 520249] filesSkypePhoneSkype.exe" [2010-09-02 13351304] ESOFTWAREMicrosoftWindowsCurrentVersionRun] owssystem32igfxtray.exe" [2003-05-30 155648] indowssystem32hkcmd.exe" [2003-05-30 114688] filesAVGAVG2012avgtray.exe" [2012-02-16 2575712] TSoftwareMicrosoftWindowsCurrentVersionRun] ndowssystem32CTFMON.EXE" [2008-04-14 15360] and settingsClever BoyStart MenuProgramsStartup - c:program filesERUNTAUTOBACK.EXE [2005-10-20 38912] Esystemcurrentcontrolsetcontrolsession manager] autocheck autochk *0c:progra~1AVGAVG2012avgrsx.exe /sync /restart ESYSTEMCurrentControlSetControlSafeBootMinimalsdauxservice] ESYSTEMCurrentControlSetControlSafeBootMinimalsdcoreservice] Esoftwaremicrosoftshared toolsmsconfigstartupregAdvanced SystemCare 5] 574296 ----a-w- c:program filesIObitAdvanced SystemCare 5ASCTray.exe Esoftwaremicrosoftshared toolsmsconfigstartupregApnUpdater] 1391272 ----a-w- c:program filesAsk.comUpdaterUpdater.exe Esoftwaremicrosoftshared toolsmsconfigstartupregEPSON SX100 Series] 188928 ----a-w- c:windowssystem32spooldriversw32x863E_FATIEDE.EXE Esoftwaremicrosoftshared toolsmsconfigstartupregISTray] 1600984 ----a-w- c:program filesSpyware DoctorpctsGui.exe Esoftwaremicrosoftshared toolsmsconfigstartupregPCTools FGuard] 247760 ----a-w- c:program filesSpyware DoctorBDTFGuard.exe Esoftwaremicrosoftsecurity center] edaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList] Diagnosticxpnetdiag.exe"= FilesSkypePlugin ManagerskypePM.exe"= FilesAVGAVG2012avgdiagex.exe"= FilesAVGAVG2012avgmfapx.exe"= EH;c:windowssystem32driversavgidsehx.sys [23/12/2011 13:32 22992] Anti-Rootkit Driver;c:windowssystem32driversavgrkx86.sys [13/09/2011 07:30 31952] KDS;c:windowssystem32driversPCTCore.sys [08/02/2012 23:18 263888] Tools Data Store;c:windowssystem32driverspctDS.sys [08/02/2012 23:18 338880] Tools Extended File Attributes;c:windowssystem32driverspctEFA.sys [08/02/2012 23:18 656320] dowssystem32driverssptd.sys [07/02/2012 01:04 691696] AVI Loader Driver;c:windowssystem32driversavgldx86.sys [07/10/2011 07:23 235216] TDI Driver;c:windowssystem32driversavgtdix.sys [22/02/2012 05:25 299472] Tools Spyware Doctor Driver;c:windowssystem32driversPCTSD.sys [08/02/2012 23:18 233976] areService5;Advanced SystemCare Service 5;c:program filesIObitAdvanced SystemCare 5ASCService.exe [08/02/2012 21:57 913752] WatchDog;c:program filesAVGAVG2012avgwdsvc.exe [14/02/2012 04:53 193288] Defender Update Service;Browser Defender Update Service;c:program filesSpyware DoctorBDTBDTUpdateService.exe [08/02/2012 23:22 337872] Meter Service;c:program filesDU MeterDUMeterSvc.exe [09/02/2012 00:51 513536] Utilities Service;c:program filesTuneUp Utilities 2010TuneUpUtilitiesService32.exe [15/11/2011 02:55 1052480] Safely Remove Assistant;c:program filesUSB Safely RemoveUSBSRService.exe [07/02/2012 00:39 261456] GIDSDriver;c:windowssystem32driversavgidsdriverx.sys [23/12/2011 13:32 139856] GIDSFilter;c:windowssystem32driversavgidsfilterx.sys [23/12/2011 13:32 24144] DSShim;c:windowssystem32driversavgidsshimx.sys [23/12/2011 13:32 17232] Drv;TuneUpUtilitiesDrv;c:program filesTuneUp Utilities 2010TuneUpUtilitiesDriver32.sys [25/02/2010 11:18 10064] IDSAgent;c:program filesAVGAVG2012avgidsagent.exe [14/02/2012 04:52 5104992] rUpdateSvc;Adobe Flash Player Update Service;c:windowssystem32MacromedFlashFlashPlayerUpdateService.exe [29/03/2012 11:53 253088] Technologies DU Meter traffic accounting driver;c:program filesDU MeterDUM_XP32.sys [09/02/2012 00:51 16744] Tools Auxiliary Service;c:program filesSpyware DoctorpctsAuxs.exe [08/02/2012 22:59 371472] of the 'Scheduled Tasks' folder c:windowsTasksAdobe Flash Player Updater.job 2MacromedFlashFlashPlayerUpdateService.exe [2012-03-29 17:23] c:windowsTasksScheduled Update for Ask Toolbar.job filesAsk.comUpdateTask.exe [2012-01-04 00:31] with &Media Finder - c:program filesMedia Finderhook.html to Microsoft Excel - c:progra~1MICROS~2OFFICE11EXCEL.EXE/3000 filesCommon FilesPC ToolsLspPCTLsp.dll - c:documents and settingsClever BoyApplication DataMozillaFirefoxProfilesj9m7wxoa.default browser.startup.homepage - hxxp://www.google.co.uk/ keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3072253&SearchSource=2&q= ******************************************************** W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net ******************************************************** ESystemControlSet001ServicesDUMeterSvc] filesDU MeterDUMeterSvc.exe /startedbyscm:E1F6D4BE-40E33354-DUMeterService" DLLs Loaded Under Running Processes --------------------- filesCommon FilesPC ToolsLspPCTLsp.dll ortableDeviceTypes.dll 2012-04-23 18:08 File - - 6E0961288DE942A63AD551553D5019C5 не мога да пусна и двата лога, казва, че е прекалено дълго... TDSS: (освен подозрителните не намери нищо за чистене, не съм рестартирал) TDSS rootkit removing tool 2.7.31.0 Apr 20 2012 19:49:47 ============================================================ Current date / time: 2012/04/23 11:18:31.0203 OS Version: 5.1.2600 ServicePack: 3.0 Product type: Workstation ComputerName: HOME-LAPTOPA30 UserName: Clever Boy Windows directory: C:WINDOWS System windows directory: C:WINDOWS Processor architecture: Intel x86 Number of processors: 1 Boot type: Normal boot ============================================================ Drive DeviceHarddisk0DR0 - Size: 0x6FC7C8000 (27.95 Gb), SectorSize: 0x200, Cylinders: 0xE40, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054 DeviceHarddisk0DR0: DeviceHarddisk0DR0Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x1388139 DeviceHarddisk0DR0Partition1: MBR, Type 0x7, StartLBA 0x13881B7, BlocksNum 0x2457DC8 C: <-> DeviceHarddisk0DR0Partition0 D: <-> DeviceHarddisk0DR0Partition1 Initialize success ============================================================ ============================================================ Mode: Manual; SigCheck; TDLFS; ============================================================ Accelerometer - ok ACPI (8fd99680a539792a30e97944fdaecf17) C:WINDOWSsystem32DRIVERSACPI.sys ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:WINDOWSsystem32DRIVERSACPIEC.sys AdobeFlashPlayerUpdateSvc (459ac130c6ab892b1cd5d7544626efc5) C:WINDOWSsystem32MacromedFlashFlashPlayerUpdateService.exe AdobeFlashPlayerUpdateSvc - ok AdvancedSystemCareService5 (b11c71b29fa69e4586f9b65560e6604d) C:Program FilesIObitAdvanced SystemCare 5ASCService.exe AdvancedSystemCareService5 - ok aec (8bed39e3c35d6a489438b8141717a557) C:WINDOWSsystem32driversaec.sys AFD (1e44bc1e83d8fd2305f8d452db109cf9) C:WINDOWSSystem32driversafd.sys ALCXWDM (ea8d01e733fda92147de62aa04d154a6) C:WINDOWSsystem32driversALCXWDM.SYS Alerter (a9a3daa780ca6c9671a19d52456705b4) C:WINDOWSsystem32alrsvc.dll ALG (8c515081584a38aa007909cd02020b3d) C:WINDOWSSystem32alg.exe AppMgmt (d8849f77c0b66226335a59d26cb4edc6) C:WINDOWSSystem32appmgmts.dll AR5416 (864a4047208c02e5b3b2d907c920597d) C:WINDOWSsystem32DRIVERSathw.sys Arp1394 (b5b8a80875c1dededa8b02765642c32f) C:WINDOWSsystem32DRIVERSarp1394.sys AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:WINDOWSsystem32DRIVERSasyncmac.sys atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:WINDOWSsystem32DRIVERSatapi.sys Atmarpc (9916c1225104ba14794209cfa8012159) C:WINDOWSsystem32DRIVERSatmarpc.sys AudioSrv (def7a7882bec100fe0b2ce2549188f9d) C:WINDOWSSystem32audiosrv.dll audstub (d9f724aa26c010a217c97606b160ed68) C:WINDOWSsystem32DRIVERSaudstub.sys Autodata Limited License Service (0d52aa08491a827fba10de8de0e2885f) C:Program FilesCommon FilesAutodata Limited SharedServiceADCDLicSvc.exe Autodata Limited License Service ( UnsignedFile.Multi.Generic ) - warning Autodata Limited License Service - detected UnsignedFile.Multi.Generic (1) AVGIDSAgent (f5689fba4360be50839999882e0a9d99) C:Program FilesAVGAVG2012AVGIDSAgent.exe AVGIDSDriver (1074f787080068c71303b61fae7e7ca4) C:WINDOWSsystem32DRIVERSavgidsdriverx.sys AVGIDSEH (f4050c31e6a83cf1e4cdc80d165f7f08) C:WINDOWSsystem32DRIVERSavgidsehx.sys AVGIDSFilter (61a7e0b02f82cff3db2445bbe50b3589) C:WINDOWSsystem32DRIVERSavgidsfilterx.sys AVGIDSShim (baf975b72062f53d327788e99d64197e) C:WINDOWSsystem32DRIVERSavgidsshimx.sys Avgldx86 (dda6a2a18841e4c9172bb85958b8d948) C:WINDOWSsystem32DRIVERSavgldx86.sys Avgmfx86 (ccdd61545aaea265977e4b1efdc74e8c) C:WINDOWSsystem32DRIVERSavgmfx86.sys Avgrkx86 (1fd90b28d2c3100bf4500199c8ad6358) C:WINDOWSsystem32DRIVERSavgrkx86.sys Avgtdix (b2fc9d4de6a2e57a4dfb5a11440c5b85) C:WINDOWSsystem32DRIVERSavgtdix.sys avgwd (ea1145debcd508fd25bd1e95c4346929) C:Program FilesAVGAVG2012avgwdsvc.exe Beep (da1f27d85e0d1525f6621372e7b685e9) C:WINDOWSsystem32driversBeep.sys BITS (574738f61fca2935f5265dc4e5691314) C:WINDOWSsystem32qmgr.dll Browser (a06ce3399d16db864f55faeb1f1927a9) C:WINDOWSSystem32browser.dll Browser Defender Update Service (e3c4cb3cc0bee58ff323c46debcd0251) C:Program FilesSpyware DoctorBDTBDTUpdateService.exe Browser Defender Update Service - ok cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:WINDOWSsystem32driverscbidf2k.sys Cdaudio (c1b486a7658353d33a10cc15211a873b) C:WINDOWSsystem32driversCdaudio.sys Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:WINDOWSsystem32driversCdfs.sys Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:WINDOWSsystem32DRIVERScdrom.sys CiSvc (1cfe720eb8d93a7158a4ebc3ab178bde) C:WINDOWSsystem32cisvc.exe ClipSrv (34cbe729f38138217f9c80212a2a0c82) C:WINDOWSsystem32clipsrv.exe CmBatt (0f6c187d38d98f8df904589a5f94d411) C:WINDOWSsystem32DRIVERSCmBatt.sys Compbatt (6e4c9f21f0fae8940661144f41b13203) C:WINDOWSsystem32DRIVERScompbatt.sys CryptSvc (3d4e199942e29207970e04315d02ad3b) C:WINDOWSSystem32cryptsvc.dll DcomLaunch (6b27a5c03dfb94b4245739065431322c) C:WINDOWSsystem32rpcss.dll Dhcp (5e38d7684a49cacfb752b046357e0589) C:WINDOWSSystem32dhcpcsvc.dll Disk (044452051f3e02e7963599fc8f4f3e25) C:WINDOWSsystem32DRIVERSdisk.sys dmboot (d992fe1274bde0f84ad826acae022a41) C:WINDOWSsystem32driversdmboot.sys dmio (7c824cf7bbde77d95c08005717a95f6f) C:WINDOWSsystem32driversdmio.sys dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:WINDOWSsystem32driversdmload.sys dmserver (57edec2e5f59f0335e92f35184bc8631) C:WINDOWSSystem32dmserver.dll DMusic (8a208dfcf89792a484e76c40e5f50b45) C:WINDOWSsystem32driversDMusic.sys Dnscache (5f7e24fa9eab896051ffb87f840730d2) C:WINDOWSSystem32dnsrslvr.dll Dot3svc (0f0f6e687e5e15579ef4da8dd6945814) C:WINDOWSSystem32dot3svc.dll drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:WINDOWSsystem32driversdrmkaud.sys DSI_SiUSBXp_3_1 - ok DUMeterDrv (1e4a06b7abbc4cb75ff56e44c9e5da51) C:Program FilesDU MeterDUM_XP32.SYS EapHost (2187855a7703adef0cef9ee4285182cc) C:WINDOWSSystem32eapsvc.dll EPSON_EB_RPCV4_01 (ec6a73cd8413f68655e5e0b99c415a21) C:Documents and SettingsAll UsersApplication DataEPSONEPW!3 SSRPE_S40ST7.EXE EPSON_EB_RPCV4_01 ( UnsignedFile.Multi.Generic ) - warning EPSON_EB_RPCV4_01 - detected UnsignedFile.Multi.Generic (1) EPSON_PM_RPCV4_01 (8fe6ab59cab8f2c038fea9522a5eeba7) C:Documents and SettingsAll UsersApplication DataEPSONEPW!3 SSRPE_S40RP7.EXE EPSON_PM_RPCV4_01 ( UnsignedFile.Multi.Generic ) - warning EPSON_PM_RPCV4_01 - detected UnsignedFile.Multi.Generic (1) ERSvc (bc93b4a066477954555966d77fec9ecb) C:WINDOWSSystem32ersvc.dll Eventlog (65df52f5b8b6e9bbd183505225c37315) C:WINDOWSsystem32services.exe EventSystem (d4991d98f2db73c60d042f1aef79efae) C:WINDOWSsystem32es.dll Fastfat (38d332a6d56af32635675f132548343e) C:WINDOWSsystem32driversFastfat.sys FastUserSwitchingCompatibility (99bc0b50f511924348be19c7c7313bbf) C:WINDOWSSystem32shsvcs.dll FastUserSwitchingCompatibility - ok Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:WINDOWSsystem32driversFdc.sys Fips (d45926117eb9fa946a6af572fbe1caa3) C:WINDOWSsystem32driversFips.sys Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:WINDOWSsystem32driversFlpydisk.sys FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:WINDOWSsystem32DRIVERSfltMgr.sys Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:WINDOWSsystem32driversFs_Rec.sys FTDIBUS (75bf2dd123971095574505e2d78f65ca) C:WINDOWSsystem32driversftdibus.sys FTDIBUS ( UnsignedFile.Multi.Generic ) - warning FTDIBUS - detected UnsignedFile.Multi.Generic (1) Ftdisk (6ac26732762483366c3969c9e4d2259d) C:WINDOWSsystem32DRIVERSftdisk.sys FTSER2K (1baea6f4a629abcbd87267c2c732c982) C:WINDOWSsystem32driversftser2k.sys FTSER2K ( UnsignedFile.Multi.Generic ) - warning FTSER2K - detected UnsignedFile.Multi.Generic (1) Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:WINDOWSsystem32DRIVERSmsgpc.sys helpsvc (4fcca060dfe0c51a09dd5c3843888bcd) C:WINDOWSPCHealthHelpCtrBinariespchsvc.dll hkmsvc (8878bd685e490239777bfe51320b88e9) C:WINDOWSSystem32kmsvc.dll HTTP (f80a415ef82cd06ffaf0d971528ead38) C:WINDOWSsystem32DriversHTTP.sys HTTPFilter (6100a808600f44d999cebdef8841c7a3) C:WINDOWSSystem32w3ssl.dll i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:WINDOWSsystem32DRIVERSi8042prt.sys ialm (1b49ec451363cbbf8d0549d4fd78072c) C:WINDOWSsystem32DRIVERSialmnt5.sys Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:WINDOWSsystem32DRIVERSimapi.sys ImapiService (30deaf54a9755bb8546168cfe8a6b5e1) C:WINDOWSsystem32imapi.exe IntelIde (b5466a9250342a7aa0cd1fba13420678) C:WINDOWSsystem32DRIVERSintelide.sys intelppm (8c953733d8f36eb2133f5bb58808b66b) C:WINDOWSsystem32DRIVERSintelppm.sys Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:WINDOWSsystem32DRIVERSIp6Fw.sys IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:WINDOWSsystem32DRIVERSipfltdrv.sys IpFilterDriver - ok IpInIp (b87ab476dcf76e72010632b5550955f5) C:WINDOWSsystem32DRIVERSipinip.sys IpNat (cc748ea12c6effde940ee98098bf96bb) C:WINDOWSsystem32DRIVERSipnat.sys IPSec (23c74d75e36e7158768dd63d92789a91) C:WINDOWSsystem32DRIVERSipsec.sys irda (aca5e7b54409f9cb5eed97ed0c81120e) C:WINDOWSsystem32DRIVERSirda.sys IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:WINDOWSsystem32DRIVERSirenum.sys Irmon (49cc4533ce897cb2e93c1e84a818fde5) C:WINDOWSSystem32irmon.dll isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:WINDOWSsystem32DRIVERSisapnp.sys Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:WINDOWSsystem32DRIVERSkbdclass.sys kmixer (692bcf44383d056aed41b045a323d378) C:WINDOWSsystem32driverskmixer.sys KSecDD (b467646c54cc746128904e1654c750c1) C:WINDOWSsystem32driversKSecDD.sys LanmanServer (3a7c3cbe5d96b8ae96ce81f0b22fb527) C:WINDOWSSystem32srvsvc.dll lanmanworkstation (a8888a5327621856c0cec4e385f69309) C:WINDOWSSystem32wkssvc.dll lanmanworkstation - ok LmHosts (a7db739ae99a796d91580147e919cc59) C:WINDOWSSystem32lmhsvc.dll Messenger (986b1ff5814366d71e0ac5755c88f2d3) C:WINDOWSSystem32msgsvc.dll mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:WINDOWSsystem32driversmnmdd.sys mnmsrvc (d18f1f0c101d06a1c1adf26eed16fcdd) C:WINDOWSsystem32mnmsrvc.exe Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:WINDOWSsystem32driversModem.sys Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:WINDOWSsystem32DRIVERSmouclass.sys MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:WINDOWSsystem32driversMountMgr.sys MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:WINDOWSsystem32DRIVERSmrxdav.sys MRxSmb (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:WINDOWSsystem32DRIVERSmrxsmb.sys MSDTC (a137f1470499a205abbb9aafb3b6f2b1) C:WINDOWSsystem32msdtc.exe Msfs (c941ea2454ba8350021d774daf0f1027) C:WINDOWSsystem32driversMsfs.sys MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:WINDOWSsystem32driversMSKSSRV.sys MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:WINDOWSsystem32driversMSPCLOCK.sys MSPQM (bad59648ba099da4a17680b39730cb3d) C:WINDOWSsystem32driversMSPQM.sys mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:WINDOWSsystem32DRIVERSmssmbios.sys Mup (de6a75f5c270e756c5508d94b6cf68f5) C:WINDOWSsystem32driversMup.sys napagent (0102140028fad045756796e1c685d695) C:WINDOWSSystem32qagentrt.dll NDIS (1df7f42665c94b825322fae71721130d) C:WINDOWSsystem32driversNDIS.sys NdisTapi (0109c4f3850dfbab279542515386ae22) C:WINDOWSsystem32DRIVERSndistapi.sys Ndisuio (f927a4434c5028758a842943ef1a3849) C:WINDOWSsystem32DRIVERSndisuio.sys NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:WINDOWSsystem32DRIVERSndiswan.sys NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:WINDOWSsystem32driversNDProxy.sys NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:WINDOWSsystem32DRIVERSnetbios.sys NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:WINDOWSsystem32DRIVERSnetbt.sys NetDDE (b857ba82860d7ff85ae29b095645563b) C:WINDOWSsystem32netdde.exe NetDDEdsdm (b857ba82860d7ff85ae29b095645563b) C:WINDOWSsystem32netdde.exe Netlogon (bf2466b3e18e970d8a976fb95fc1ca85) C:WINDOWSsystem32lsass.exe Netman (13e67b55b3abd7bf3fe7aae5a0f9a9de) C:WINDOWSSystem32netman.dll NIC1394 (e9e47cfb2d461fa0fc75b7a74c6383ea) C:WINDOWSsystem32DRIVERSnic1394.sys Nla (943337d786a56729263071623bbb9de5) C:WINDOWSSystem32mswsock.dll Npfs (3182d64ae053d6fb034f44b6def8034a) C:WINDOWSsystem32driversNpfs.sys Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:WINDOWSsystem32driversNtfs.sys NtLmSsp (bf2466b3e18e970d8a976fb95fc1ca85) C:WINDOWSsystem32lsass.exe NtmsSvc (156f64a3345bd23c600655fb4d10bc08) C:WINDOWSsystem32ntmssvc.dll Null (73c1e1f395918bc2c6dd67af7591a3ad) C:WINDOWSsystem32driversNull.sys NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:WINDOWSsystem32DRIVERSnwlnkflt.sys NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:WINDOWSsystem32DRIVERSnwlnkfwd.sys ohci1394 (ca33832df41afb202ee7aeb05145922f) C:WINDOWSsystem32DRIVERSohci1394.sys ose (7a56cf3e3f12e8af599963b16f50fb6a) C:Program FilesCommon FilesMicrosoft SharedSource EngineOSE.EXE Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:WINDOWSsystem32DRIVERSparport.sys PartMgr (beb3ba25197665d82ec7065b724171c6) C:WINDOWSsystem32driversPartMgr.sys ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:WINDOWSsystem32driversParVdm.sys PCI (a219903ccf74233761d92bef471a07b1) C:WINDOWSsystem32DRIVERSpci.sys PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:WINDOWSsystem32driversPCIIde.sys Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:WINDOWSsystem32DRIVERSpcmcia.sys PCTCore (ccbbf4ddf14e779c2a63a1ca140663b3) C:WINDOWSsystem32driversPCTCore.sys pctDS (f820b4c61d1e591325b679d479d4eea4) C:WINDOWSsystem32driverspctDS.sys pctEFA (acc8c15f3d59f17c5d903ff1de3b43d3) C:WINDOWSsystem32driverspctEFA.sys PCTSD (83ddd552f7f1043f764e8cc88ff41232) C:WINDOWSsystem32DriversPCTSD.sys PlugPlay (65df52f5b8b6e9bbd183505225c37315) C:WINDOWSsystem32services.exe PolicyAgent (bf2466b3e18e970d8a976fb95fc1ca85) C:WINDOWSsystem32lsass.exe PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:WINDOWSsystem32DRIVERSraspptp.sys ProtectedStorage (bf2466b3e18e970d8a976fb95fc1ca85) C:WINDOWSsystem32lsass.exe ProtectedStorage - ok PSched (09298ec810b07e5d582cb3a3f9255424) C:WINDOWSsystem32DRIVERSpsched.sys Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:WINDOWSsystem32DRIVERSptilink.sys RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:WINDOWSsystem32DRIVERSrasacd.sys RasAuto (ad188be7bdf94e8df4ca0a55c00a5073) C:WINDOWSSystem32rasauto.dll Rasirda (0207d26ddf796a193ccd9f83047bb5fc) C:WINDOWSsystem32DRIVERSrasirda.sys Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:WINDOWSsystem32DRIVERSrasl2tp.sys RasMan (76a9a3cbeadd68cc57cda5e1d7448235) C:WINDOWSSystem32rasmans.dll RasPppoe (5bc962f2654137c9909c3d4603587dee) C:WINDOWSsystem32DRIVERSraspppoe.sys Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:WINDOWSsystem32DRIVERSraspti.sys Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:WINDOWSsystem32DRIVERSrdbss.sys RDPCDD (4912d5b403614ce99c28420f75353332) C:WINDOWSsystem32DRIVERSRDPCDD.sys rdpdr (15cabd0f7c00c47c70124907916af3f1) C:WINDOWSsystem32DRIVERSrdpdr.sys RDPWD (5b3055daa788bd688594d2f5981f2a83) C:WINDOWSsystem32driversRDPWD.sys RDSessMgr (3c37bf86641bda977c3bf8a840f3b7fa) C:WINDOWSsystem32sessmgr.exe redbook (f828dd7e1419b6653894a8f97a0094c5) C:WINDOWSsystem32DRIVERSredbook.sys RemoteAccess (7e699ff5f59b5d9de5390e3c34c67cf5) C:WINDOWSSystem32mprdim.dll RemoteRegistry (5b19b557b0c188210a56a6b699d90b8f) C:WINDOWSsystem32regsvc.dll RemoteRegistry - ok RpcLocator (aaed593f84afa419bbae8572af87cf6a) C:WINDOWSsystem32locator.exe RpcSs (6b27a5c03dfb94b4245739065431322c) C:WINDOWSSystem32rpcss.dll RSVP (471b3f9741d762abe75e9deea4787e47) C:WINDOWSsystem32rsvp.exe rtl8139 (d507c1400284176573224903819ffda3) C:WINDOWSsystem32DRIVERSRTL8139.SYS SamSs (bf2466b3e18e970d8a976fb95fc1ca85) C:WINDOWSsystem32lsass.exe SCardSvr (86d007e7a654b9a71d1d7d856b104353) C:WINDOWSSystem32SCardSvr.exe Schedule (0a9a7365a1ca4319aa7c1d6cd8e4eafa) C:WINDOWSsystem32schedsvc.dll sdAuxService (cadc6d185d8560a1ec266b0a97c4f153) C:Program FilesSpyware DoctorpctsAuxs.exe sdCoreService (1b556ab08795428e2f3dafcfcb54c782) C:Program FilesSpyware DoctorpctsSvc.exe sdCoreService - ok Secdrv (90a3935d05b494a5a39d37e71f09a677) C:WINDOWSsystem32DRIVERSsecdrv.sys seclogon (cbe612e2bb6a10e3563336191eda1250) C:WINDOWSSystem32seclogon.dll SENS (7fdd5d0684eca8c1f68b4d99d124dcd0) C:WINDOWSsystem32sens.dll Serenum (0f29512ccd6bead730039fb4bd2c85ce) C:WINDOWSsystem32DRIVERSserenum.sys Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:WINDOWSsystem32driversSerial.sys Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:WINDOWSsystem32driversSfloppy.sys SharedAccess (83f41d0d89645d7235c051ab1d9523ac) C:WINDOWSSystem32ipnathlp.dll ShellHWDetection (99bc0b50f511924348be19c7c7313bbf) C:WINDOWSSystem32shsvcs.dll ShellHWDetection - ok SMCIRDA (707647a1aa0edb6cbef61b0c75c28ed3) C:WINDOWSsystem32DRIVERSsmcirda.sys splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:WINDOWSsystem32driverssplitter.sys Spooler (60784f891563fb1b767f70117fc2428f) C:WINDOWSsystem32spoolsv.exe sptd (cdddec541bc3c96f91ecb48759673505) C:WINDOWSsystem32Driverssptd.sys Suspicious file (NoAccess): C:WINDOWSsystem32Driverssptd.sys. md5: cdddec541bc3c96f91ecb48759673505 sptd ( LockedFile.Multi.Generic ) - warning sptd - detected LockedFile.Multi.Generic (1) sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:WINDOWSsystem32DRIVERSsr.sys srservice (3805df0ac4296a34ba4bf93b346cc378) C:WINDOWSsystem32srsvc.dll Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:WINDOWSsystem32DRIVERSsrv.sys SSDPSRV (0a5679b3714edab99e357057ee88fca6) C:WINDOWSSystem32ssdpsrv.dll stisvc (8bad69cbac032d4bbacfce0306174c30) C:WINDOWSsystem32wiaservc.dll swenum (3941d127aef12e93addf6fe6ee027e0f) C:WINDOWSsystem32DRIVERSswenum.sys swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:WINDOWSsystem32driversswmidi.sys sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:WINDOWSsystem32driverssysaudio.sys SysmonLog (c7abbc59b43274b1109df6b24d617051) C:WINDOWSsystem32smlogsvc.exe TapiSrv (3cb78c17bb664637787c9a1c98f79c38) C:WINDOWSSystem32tapisrv.dll Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:WINDOWSsystem32DRIVERStcpip.sys TDPIPE (6471a66807f5e104e4885f5b67349397) C:WINDOWSsystem32driversTDPIPE.sys TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:WINDOWSsystem32driversTDTCP.sys TermDD (88155247177638048422893737429d9e) C:WINDOWSsystem32DRIVERStermdd.sys TermService (ff3477c03be7201c294c35f684b3479f) C:WINDOWSSystem32termsrv.dll Themes (99bc0b50f511924348be19c7c7313bbf) C:WINDOWSSystem32shsvcs.dll TlntSvr (db7205804759ff62c34e3efd8a4cc76a) C:WINDOWSsystem32tlntsvr.exe TOSHIBASoftModem (bdf9ed967f81145ed058601b1c4d8fb7) C:WINDOWSsystem32DRIVERSLTSM.sys TOSHIBASoftModem - ok TrkWks (55bca12f7f523d35ca3cb833c725f54e) C:WINDOWSsystem32trkwks.dll TuneUp.Defrag (b39f12748c9421080824e0717045fd4a) C:Program FilesTuneUp Utilities 2010TuneUpDefragService.exe TuneUp.Defrag - ok TuneUp.UtilitiesSvc (4bd2504c3d8f43dc952552a6e76e7ae8) C:Program FilesTuneUp Utilities 2010TuneUpUtilitiesService32.exe TuneUp.UtilitiesSvc - ok TuneUpUtilitiesDrv (f2107c9d85ec0df116939ccce06ae697) C:Program FilesTuneUp Utilities 2010TuneUpUtilitiesDriver32.sys TuneUpUtilitiesDrv - ok Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:WINDOWSsystem32driversUdfs.sys Update (402ddc88356b1bac0ee3dd1580c76a31) C:WINDOWSsystem32DRIVERSupdate.sys upnphost (1ebafeb9a3fbdc41b8d9c7f0f687ad91) C:WINDOWSSystem32upnphost.dll UPS (05365fb38fca1e98f7a566aaaf5d1815) C:WINDOWSSystem32ups.exe usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:WINDOWSsystem32DRIVERSusbccgp.sys usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:WINDOWSsystem32DRIVERSusbehci.sys usbhub (1ab3cdde553b6e064d2e754efe20285c) C:WINDOWSsystem32DRIVERSusbhub.sys usbprint (a717c8721046828520c9edf31288fc00) C:WINDOWSsystem32DRIVERSusbprint.sys USBSafelyRemoveService (24c992a579d0e8d03077a36b70e47ba6) C:Program FilesUSB Safely RemoveUSBSRService.exe USBSafelyRemoveService - ok usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:WINDOWSsystem32DRIVERSusbscan.sys USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:WINDOWSsystem32DRIVERSUSBSTOR.SYS usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:WINDOWSsystem32DRIVERSusbuhci.sys UxTuneUp (799a1a104fbaf8597eccdb2da2238c89) C:WINDOWSSystem32uxtuneup.dll VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:WINDOWSSystem32driversvga.sys VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:WINDOWSsystem32driversVolSnap.sys VSS (7a9db3a67c333bf0bd42e42b8596854b) C:WINDOWSSystem32vssvc.exe W32Time (54af4b1d5459500ef0937f6d33b1914f) C:WINDOWSsystem32w32time.dll Wanarp (e20b95baedb550f32dd489265c1da1f6) C:WINDOWSsystem32DRIVERSwanarp.sys wdmaud (6768acf64b18196494413695f0c3a00f) C:WINDOWSsystem32driverswdmaud.sys WebClient (77a354e28153ad2d5e120a5a8687bc06) C:WINDOWSSystem32webclnt.dll winmgmt (2d0e4ed081963804ccc196a0929275b5) C:WINDOWSsystem32wbemWMIsvc.dll WmdmPmSN (c51b4a5c05a5475708e3c81c7765b71d) C:WINDOWSsystem32MsPMSNSv.dll Wmi (e76f8807070ed04e7408a86d6d3a6137) C:WINDOWSSystem32advapi32.dll WmiApSrv (e0673f1106e62a68d2257e376079f821) C:WINDOWSsystem32wbemwmiapsrv.exe WMPNetworkSvc (f74e3d9a7fa9556c3bbb14d4e5e63d3b) C:Program FilesWindows Media PlayerWMPNetwk.exe WMPNetworkSvc - ok WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8) C:WINDOWSSystem32driversws2ifsl.sys wscsvc (7c278e6408d1dce642230c0585a854d5) C:WINDOWSsystem32wscsvc.dll WSIMD (0091d78c5f8fde0cdf2b214823de6e48) C:WINDOWSsystem32DRIVERSwsimd.sys wuauserv (35321fb577cdc98ce3eb3a3eb9e4610a) C:WINDOWSsystem32wuauserv.dll WudfPf (f15feafffbb3644ccc80c5da584e6311) C:WINDOWSsystem32DRIVERSWudfPf.sys WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:WINDOWSsystem32DRIVERSwudfrd.sys WudfSvc (05231c04253c5bc30b26cbaae680ed89) C:WINDOWSSystem32WUDFSvc.dll WZCSVC (81dc3f549f44b1c1fff022dec9ecf30b) C:WINDOWSSystem32wzcsvc.dll xmlprov (295d21f14c335b53cb8154e5b1f892b9) C:WINDOWSSystem32xmlprov.dll {6080A529-897E-4629-A488-ABA0C29B635E} (a7ab6e6fcb5d9276160d9998593638e3) C:WINDOWSsystem32driversialmsbw.sys {6080A529-897E-4629-A488-ABA0C29B635E} - ok {D31A0762-0CEB-444e-ACFF-B049A1F6FE91} (d9c1c60a4e414052e30dbb2800f0893a) C:WINDOWSsystem32driversialmkchw.sys {D31A0762-0CEB-444e-ACFF-B049A1F6FE91} - ok {E2B953A6-195A-44F9-9BA3-3D5F4E32BB55} (100b40ed254ed42ec179e24d890c973e) C:WINDOWSsystem32driverswA301a.sys {E2B953A6-195A-44F9-9BA3-3D5F4E32BB55} - ok MBR (0x1B8) (8f558eb6672622401da993e1e865c861) DeviceHarddisk0DR0 DeviceHarddisk0DR0 - ok Boot (0x1200) (f0bf5aeb7dbc15026c5c6a028ccf4cce) DeviceHarddisk0DR0Partition0 DeviceHarddisk0DR0Partition0 - ok Boot (0x1200) (6e372783dd4a0983baf7a028146755af) DeviceHarddisk0DR0Partition1 DeviceHarddisk0DR0Partition1 - ok ============================================================ ============================================================ Detected object count: 6 Actual detected object count: 6 Autodata Limited License Service ( UnsignedFile.Multi.Generic ) - skipped by user Autodata Limited License Service ( UnsignedFile.Multi.Generic ) - User select action: Skip EPSON_EB_RPCV4_01 ( UnsignedFile.Multi.Generic ) - skipped by user EPSON_EB_RPCV4_01 ( UnsignedFile.Multi.Generic ) - User select action: Skip EPSON_PM_RPCV4_01 ( UnsignedFile.Multi.Generic ) - skipped by user EPSON_PM_RPCV4_01 ( UnsignedFile.Multi.Generic ) - User select action: Skip FTDIBUS ( UnsignedFile.Multi.Generic ) - skipped by user FTDIBUS ( UnsignedFile.Multi.Generic ) - User select action: Skip FTSER2K ( UnsignedFile.Multi.Generic ) - skipped by user FTSER2K ( UnsignedFile.Multi.Generic ) - User select action: Skip sptd ( LockedFile.Multi.Generic ) - skipped by user sptd ( LockedFile.Multi.Generic ) - User select action: Skip ============================================================ Mode: Manual; SigCheck; TDLFS; ============================================================ Accelerometer - ok ACPI (8fd99680a539792a30e97944fdaecf17) C:WINDOWSsystem32DRIVERSACPI.sys ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:WINDOWSsystem32DRIVERSACPIEC.sys AdobeFlashPlayerUpdateSvc (459ac130c6ab892b1cd5d7544626efc5) C:WINDOWSsystem32MacromedFlashFlashPlayerUpdateService.exe AdobeFlashPlayerUpdateSvc - ok AdvancedSystemCareService5 (b11c71b29fa69e4586f9b65560e6604d) C:Program FilesIObitAdvanced SystemCare 5ASCService.exe AdvancedSystemCareService5 - ok aec (8bed39e3c35d6a489438b8141717a557) C:WINDOWSsystem32driversaec.sys AFD (1e44bc1e83d8fd2305f8d452db109cf9) C:WINDOWSSystem32driversafd.sys ALCXWDM (ea8d01e733fda92147de62aa04d154a6) C:WINDOWSsystem32driversALCXWDM.SYS Alerter (a9a3daa780ca6c9671a19d52456705b4) C:WINDOWSsystem32alrsvc.dll ALG (8c515081584a38aa007909cd02020b3d) C:WINDOWSSystem32alg.exe AppMgmt (d8849f77c0b66226335a59d26cb4edc6) C:WINDOWSSystem32appmgmts.dll AR5416 (864a4047208c02e5b3b2d907c920597d) C:WINDOWSsystem32DRIVERSathw.sys Arp1394 (b5b8a80875c1dededa8b02765642c32f) C:WINDOWSsystem32DRIVERSarp1394.sys AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:WINDOWSsystem32DRIVERSasyncmac.sys atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:WINDOWSsystem32DRIVERSatapi.sys Atmarpc (9916c1225104ba14794209cfa8012159) C:WINDOWSsystem32DRIVERSatmarpc.sys AudioSrv (def7a7882bec100fe0b2ce2549188f9d) C:WINDOWSSystem32audiosrv.dll audstub (d9f724aa26c010a217c97606b160ed68) C:WINDOWSsystem32DRIVERSaudstub.sys Autodata Limited License Service (0d52aa08491a827fba10de8de0e2885f) C:Program FilesCommon FilesAutodata Limited SharedServiceADCDLicSvc.exe Autodata Limited License Service ( UnsignedFile.Multi.Generic ) - warning Autodata Limited License Service - detected UnsignedFile.Multi.Generic (1) AVGIDSAgent (f5689fba4360be50839999882e0a9d99) C:Program FilesAVGAVG2012AVGIDSAgent.exe AVGIDSDriver (1074f787080068c71303b61fae7e7ca4) C:WINDOWSsystem32DRIVERSavgidsdriverx.sys AVGIDSEH (f4050c31e6a83cf1e4cdc80d165f7f08) C:WINDOWSsystem32DRIVERSavgidsehx.sys AVGIDSFilter (61a7e0b02f82cff3db2445bbe50b3589) C:WINDOWSsystem32DRIVERSavgidsfilterx.sys AVGIDSShim (baf975b72062f53d327788e99d64197e) C:WINDOWSsystem32DRIVERSavgidsshimx.sys Avgldx86 (dda6a2a18841e4c9172bb85958b8d948) C:WINDOWSsystem32DRIVERSavgldx86.sys Avgmfx86 (ccdd61545aaea265977e4b1efdc74e8c) C:WINDOWSsystem32DRIVERSavgmfx86.sys Avgrkx86 (1fd90b28d2c3100bf4500199c8ad6358) C:WINDOWSsystem32DRIVERSavgrkx86.sys Avgtdix (b2fc9d4de6a2e57a4dfb5a11440c5b85) C:WINDOWSsystem32DRIVERSavgtdix.sys avgwd (ea1145debcd508fd25bd1e95c4346929) C:Program FilesAVGAVG2012avgwdsvc.exe Beep (da1f27d85e0d1525f6621372e7b685e9) C:WINDOWSsystem32driversBeep.sys BITS (574738f61fca2935f5265dc4e5691314) C:WINDOWSsystem32qmgr.dll Browser (a06ce3399d16db864f55faeb1f1927a9) C:WINDOWSSystem32browser.dll Browser Defender Update Service (e3c4cb3cc0bee58ff323c46debcd0251) C:Program FilesSpyware DoctorBDTBDTUpdateService.exe Browser Defender Update Service - ok cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:WINDOWSsystem32driverscbidf2k.sys Cdaudio (c1b486a7658353d33a10cc15211a873b) C:WINDOWSsystem32driversCdaudio.sys Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:WINDOWSsystem32driversCdfs.sys Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:WINDOWSsystem32DRIVERScdrom.sys CiSvc (1cfe720eb8d93a7158a4ebc3ab178bde) C:WINDOWSsystem32cisvc.exe ClipSrv (34cbe729f38138217f9c80212a2a0c82) C:WINDOWSsystem32clipsrv.exe CmBatt (0f6c187d38d98f8df904589a5f94d411) C:WINDOWSsystem32DRIVERSCmBatt.sys Compbatt (6e4c9f21f0fae8940661144f41b13203) C:WINDOWSsystem32DRIVERScompbatt.sys CryptSvc (3d4e199942e29207970e04315d02ad3b) C:WINDOWSSystem32cryptsvc.dll DcomLaunch (6b27a5c03dfb94b4245739065431322c) C:WINDOWSsystem32rpcss.dll Dhcp (5e38d7684a49cacfb752b046357e0589) C:WINDOWSSystem32dhcpcsvc.dll Disk (044452051f3e02e7963599fc8f4f3e25) C:WINDOWSsystem32DRIVERSdisk.sys dmboot (d992fe1274bde0f84ad826acae022a41) C:WINDOWSsystem32driversdmboot.sys dmio (7c824cf7bbde77d95c08005717a95f6f) C:WINDOWSsystem32driversdmio.sys dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:WINDOWSsystem32driversdmload.sys dmserver (57edec2e5f59f0335e92f35184bc8631) C:WINDOWSSystem32dmserver.dll DMusic (8a208dfcf89792a484e76c40e5f50b45) C:WINDOWSsystem32driversDMusic.sys Dnscache (5f7e24fa9eab896051ffb87f840730d2) C:WINDOWSSystem32dnsrslvr.dll Dot3svc (0f0f6e687e5e15579ef4da8dd6945814) C:WINDOWSSystem32dot3svc.dll drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:WINDOWSsystem32driversdrmkaud.sys DSI_SiUSBXp_3_1 - ok DUMeterDrv (1e4a06b7abbc4cb75ff56e44c9e5da51) C:Program FilesDU MeterDUM_XP32.SYS EapHost (2187855a7703adef0cef9ee4285182cc) C:WINDOWSSystem32eapsvc.dll EPSON_EB_RPCV4_01 (ec6a73cd8413f68655e5e0b99c415a21) C:Documents and SettingsAll UsersApplication DataEPSONEPW!3 SSRPE_S40ST7.EXE EPSON_EB_RPCV4_01 ( UnsignedFile.Multi.Generic ) - warning EPSON_EB_RPCV4_01 - detected UnsignedFile.Multi.Generic (1) EPSON_PM_RPCV4_01 (8fe6ab59cab8f2c038fea9522a5eeba7) C:Documents and SettingsAll UsersApplication DataEPSONEPW!3 SSRPE_S40RP7.EXE EPSON_PM_RPCV4_01 ( UnsignedFile.Multi.Generic ) - warning EPSON_PM_RPCV4_01 - detected UnsignedFile.Multi.Generic (1) ERSvc (bc93b4a066477954555966d77fec9ecb) C:WINDOWSSystem32ersvc.dll Eventlog (65df52f5b8b6e9bbd183505225c37315) C:WINDOWSsystem32services.exe EventSystem (d4991d98f2db73c60d042f1aef79efae) C:WINDOWSsystem32es.dll Fastfat (38d332a6d56af32635675f132548343e) C:WINDOWSsystem32driversFastfat.sys FastUserSwitchingCompatibility (99bc0b50f511924348be19c7c7313bbf) C:WINDOWSSystem32shsvcs.dll FastUserSwitchingCompatibility - ok Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:WINDOWSsystem32driversFdc.sys Fips (d45926117eb9fa946a6af572fbe1caa3) C:WINDOWSsystem32driversFips.sys Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:WINDOWSsystem32driversFlpydisk.sys FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:WINDOWSsystem32DRIVERSfltMgr.sys Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:WINDOWSsystem32driversFs_Rec.sys FTDIBUS (75bf2dd123971095574505e2d78f65ca) C:WINDOWSsystem32driversftdibus.sys FTDIBUS ( UnsignedFile.Multi.Generic ) - warning FTDIBUS - detected UnsignedFile.Multi.Generic (1) Ftdisk (6ac26732762483366c3969c9e4d2259d) C:WINDOWSsystem32DRIVERSftdisk.sys FTSER2K (1baea6f4a629abcbd87267c2c732c982) C:WINDOWSsystem32driversftser2k.sys FTSER2K ( UnsignedFile.Multi.Generic ) - warning FTSER2K - detected UnsignedFile.Multi.Generic (1) Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:WINDOWSsystem32DRIVERSmsgpc.sys helpsvc (4fcca060dfe0c51a09dd5c3843888bcd) C:WINDOWSPCHealthHelpCtrBinariespchsvc.dll hkmsvc (8878bd685e490239777bfe51320b88e9) C:WINDOWSSystem32kmsvc.dll HTTP (f80a415ef82cd06ffaf0d971528ead38) C:WINDOWSsystem32DriversHTTP.sys HTTPFilter (6100a808600f44d999cebdef8841c7a3) C:WINDOWSSystem32w3ssl.dll i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:WINDOWSsystem32DRIVERSi8042prt.sys ialm (1b49ec451363cbbf8d0549d4fd78072c) C:WINDOWSsystem32DRIVERSialmnt5.sys Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:WINDOWSsystem32DRIVERSimapi.sys ImapiService (30deaf54a9755bb8546168cfe8a6b5e1) C:WINDOWSsystem32imapi.exe IntelIde (b5466a9250342a7aa0cd1fba13420678) C:WINDOWSsystem32DRIVERSintelide.sys intelppm (8c953733d8f36eb2133f5bb58808b66b) C:WINDOWSsystem32DRIVERSintelppm.sys Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:WINDOWSsystem32DRIVERSIp6Fw.sys IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:WINDOWSsystem32DRIVERSipfltdrv.sys IpFilterDriver - ok IpInIp (b87ab476dcf76e72010632b5550955f5) C:WINDOWSsystem32DRIVERSipinip.sys IpNat (cc748ea12c6effde940ee98098bf96bb) C:WINDOWSsystem32DRIVERSipnat.sys IPSec (23c74d75e36e7158768dd63d92789a91) C:WINDOWSsystem32DRIVERSipsec.sys irda (aca5e7b54409f9cb5eed97ed0c81120e) C:WINDOWSsystem32DRIVERSirda.sys IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:WINDOWSsystem32DRIVERSirenum.sys Irmon (49cc4533ce897cb2e93c1e84a818fde5) C:WINDOWSSystem32irmon.dll isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:WINDOWSsystem32DRIVERSisapnp.sys Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:WINDOWSsystem32DRIVERSkbdclass.sys kmixer (692bcf44383d056aed41b045a323d378) C:WINDOWSsystem32driverskmixer.sys KSecDD (b467646c54cc746128904e1654c750c1) C:WINDOWSsystem32driversKSecDD.sys LanmanServer (3a7c3cbe5d96b8ae96ce81f0b22fb527) C:WINDOWSSystem32srvsvc.dll lanmanworkstation (a8888a5327621856c0cec4e385f69309) C:WINDOWSSystem32wkssvc.dll lanmanworkstation - ok LmHosts (a7db739ae99a796d91580147e919cc59) C:WINDOWSSystem32lmhsvc.dll Messenger (986b1ff5814366d71e0ac5755c88f2d3) C:WINDOWSSystem32msgsvc.dll mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:WINDOWSsystem32driversmnmdd.sys mnmsrvc (d18f1f0c101d06a1c1adf26eed16fcdd) C:WINDOWSsystem32mnmsrvc.exe Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:WINDOWSsystem32driversModem.sys Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:WINDOWSsystem32DRIVERSmouclass.sys MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:WINDOWSsystem32driversMountMgr.sys MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:WINDOWSsystem32DRIVERSmrxdav.sys MRxSmb (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:WINDOWSsystem32DRIVERSmrxsmb.sys MSDTC (a137f1470499a205abbb9aafb3b6f2b1) C:WINDOWSsystem32msdtc.exe Msfs (c941ea2454ba8350021d774daf0f1027) C:WINDOWSsystem32driversMsfs.sys MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:WINDOWSsystem32driversMSKSSRV.sys MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:WINDOWSsystem32driversMSPCLOCK.sys MSPQM (bad59648ba099da4a17680b39730cb3d) C:WINDOWSsystem32driversMSPQM.sys mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:WINDOWSsystem32DRIVERSmssmbios.sys Mup (de6a75f5c270e756c5508d94b6cf68f5) C:WINDOWSsystem32driversMup.sys napagent (0102140028fad045756796e1c685d695) C:WINDOWSSystem32qagentrt.dll NDIS (1df7f42665c94b825322fae71721130d) C:WINDOWSsystem32driversNDIS.sys NdisTapi (0109c4f3850dfbab279542515386ae22) C:WINDOWSsystem32DRIVERSndistapi.sys Ndisuio (f927a4434c5028758a842943ef1a3849) C:WINDOWSsystem32DRIVERSndisuio.sys NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:WINDOWSsystem32DRIVERSndiswan.sys NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:WINDOWSsystem32driversNDProxy.sys NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:WINDOWSsystem32DRIVERSnetbios.sys NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:WINDOWSsystem32DRIVERSnetbt.sys NetDDE (b857ba82860d7ff85ae29b095645563b) C:WINDOWSsystem32netdde.exe NetDDEdsdm (b857ba82860d7ff85ae29b095645563b) C:WINDOWSsystem32netdde.exe Netlogon (bf2466b3e18e970d8a976fb95fc1ca85) C:WINDOWSsystem32lsass.exe Netman (13e67b55b3abd7bf3fe7aae5a0f9a9de) C:WINDOWSSystem32netman.dll NIC1394 (e9e47cfb2d461fa0fc75b7a74c6383ea) C:WINDOWSsystem32DRIVERSnic1394.sys Nla (943337d786a56729263071623bbb9de5) C:WINDOWSSystem32mswsock.dll Npfs (3182d64ae053d6fb034f44b6def8034a) C:WINDOWSsystem32driversNpfs.sys Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:WINDOWSsystem32driversNtfs.sys NtLmSsp (bf2466b3e18e970d8a976fb95fc1ca85) C:WINDOWSsystem32lsass.exe NtmsSvc (156f64a3345bd23c600655fb4d10bc08) C:WINDOWSsystem32ntmssvc.dll Null (73c1e1f395918bc2c6dd67af7591a3ad) C:WINDOWSsystem32driversNull.sys NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:WINDOWSsystem32DRIVERSnwlnkflt.sys NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:WINDOWSsystem32DRIVERSnwlnkfwd.sys ohci1394 (ca33832df41afb202ee7aeb05145922f) C:WINDOWSsystem32DRIVERSohci1394.sys ose (7a56cf3e3f12e8af599963b16f50fb6a) C:Program FilesCommon FilesMicrosoft SharedSource EngineOSE.EXE Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:WINDOWSsystem32DRIVERSparport.sys PartMgr (beb3ba25197665d82ec7065b724171c6) C:WINDOWSsystem32driversPartMgr.sys ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:WINDOWSsystem32driversParVdm.sys PCI (a219903ccf74233761d92bef471a07b1) C:WINDOWSsystem32DRIVERSpci.sys PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:WINDOWSsystem32driversPCIIde.sys Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:WINDOWSsystem32DRIVERSpcmcia.sys PCTCore (ccbbf4ddf14e779c2a63a1ca140663b3) C:WINDOWSsystem32driversPCTCore.sys pctDS (f820b4c61d1e591325b679d479d4eea4) C:WINDOWSsystem32driverspctDS.sys pctEFA (acc8c15f3d59f17c5d903ff1de3b43d3) C:WINDOWSsystem32driverspctEFA.sys PCTSD (83ddd552f7f1043f764e8cc88ff41232) C:WINDOWSsystem32DriversPCTSD.sys PlugPlay (65df52f5b8b6e9bbd183505225c37315) C:WINDOWSsystem32services.exe PolicyAgent (bf2466b3e18e970d8a976fb95fc1ca85) C:WINDOWSsystem32lsass.exe PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:WINDOWSsystem32DRIVERSraspptp.sys ProtectedStorage (bf2466b3e18e970d8a976fb95fc1ca85) C:WINDOWSsystem32lsass.exe ProtectedStorage - ok PSched (09298ec810b07e5d582cb3a3f9255424) C:WINDOWSsystem32DRIVERSpsched.sys Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:WINDOWSsystem32DRIVERSptilink.sys RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:WINDOWSsystem32DRIVERSrasacd.sys RasAuto (ad188be7bdf94e8df4ca0a55c00a5073) C:WINDOWSSystem32rasauto.dll Rasirda (0207d26ddf796a193ccd9f83047bb5fc) C:WINDOWSsystem32DRIVERSrasirda.sys Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:WINDOWSsystem32DRIVERSrasl2tp.sys RasMan (76a9a3cbeadd68cc57cda5e1d7448235) C:WINDOWSSystem32rasmans.dll RasPppoe (5bc962f2654137c9909c3d4603587dee) C:WINDOWSsystem32DRIVERSraspppoe.sys Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:WINDOWSsystem32DRIVERSraspti.sys Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:WINDOWSsystem32DRIVERSrdbss.sys RDPCDD (4912d5b403614ce99c28420f75353332) C:WINDOWSsystem32DRIVERSRDPCDD.sys rdpdr (15cabd0f7c00c47c70124907916af3f1) C:WINDOWSsystem32DRIVERSrdpdr.sys RDPWD (5b3055daa788bd688594d2f5981f2a83) C:WINDOWSsystem32driversRDPWD.sys RDSessMgr (3c37bf86641bda977c3bf8a840f3b7fa) C:WINDOWSsystem32sessmgr.exe redbook (f828dd7e1419b6653894a8f97a0094c5) C:WINDOWSsystem32DRIVERSredbook.sys RemoteAccess (7e699ff5f59b5d9de5390e3c34c67cf5) C:WINDOWSSystem32mprdim.dll RemoteRegistry (5b19b557b0c188210a56a6b699d90b8f) C:WINDOWSsystem32regsvc.dll RemoteRegistry - ok RpcLocator (aaed593f84afa419bbae8572af87cf6a) C:WINDOWSsystem32locator.exe RpcSs (6b27a5c03dfb94b4245739065431322c) C:WINDOWSSystem32rpcss.dll RSVP (471b3f9741d762abe75e9deea4787e47) C:WINDOWSsystem32rsvp.exe rtl8139 (d507c1400284176573224903819ffda3) C:WINDOWSsystem32DRIVERSRTL8139.SYS SamSs (bf2466b3e18e970d8a976fb95fc1ca85) C:WINDOWSsystem32lsass.exe SCardSvr (86d007e7a654b9a71d1d7d856b104353) C:WINDOWSSystem32SCardSvr.exe Schedule (0a9a7365a1ca4319aa7c1d6cd8e4eafa) C:WINDOWSsystem32schedsvc.dll sdAuxService (cadc6d185d8560a1ec266b0a97c4f153) C:Program FilesSpyware DoctorpctsAuxs.exe sdCoreService (1b556ab08795428e2f3dafcfcb54c782) C:Program FilesSpyware DoctorpctsSvc.exe sdCoreService - ok Secdrv (90a3935d05b494a5a39d37e71f09a677) C:WINDOWSsystem32DRIVERSsecdrv.sys seclogon (cbe612e2bb6a10e3563336191eda1250) C:WINDOWSSystem32seclogon.dll SENS (7fdd5d0684eca8c1f68b4d99d124dcd0) C:WINDOWSsystem32sens.dll Serenum (0f29512ccd6bead730039fb4bd2c85ce) C:WINDOWSsystem32DRIVERSserenum.sys Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:WINDOWSsystem32driversSerial.sys Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:WINDOWSsystem32driversSfloppy.sys SharedAccess (83f41d0d89645d7235c051ab1d9523ac) C:WINDOWSSystem32ipnathlp.dll ShellHWDetection (99bc0b50f511924348be19c7c7313bbf) C:WINDOWSSystem32shsvcs.dll ShellHWDetection - ok SMCIRDA (707647a1aa0edb6cbef61b0c75c28ed3) C:WINDOWSsystem32DRIVERSsmcirda.sys splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:WINDOWSsystem32driverssplitter.sys Spooler (60784f891563fb1b767f70117fc2428f) C:WINDOWSsystem32spoolsv.exe sptd (cdddec541bc3c96f91ecb48759673505) C:WINDOWSsystem32Driverssptd.sys Suspicious file (NoAccess): C:WINDOWSsystem32Driverssptd.sys. md5: cdddec541bc3c96f91ecb48759673505 sptd ( LockedFile.Multi.Generic ) - warning sptd - detected LockedFile.Multi.Generic (1) sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:WINDOWSsystem32DRIVERSsr.sys srservice (3805df0ac4296a34ba4bf93b346cc378) C:WINDOWSsystem32srsvc.dll Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:WINDOWSsystem32DRIVERSsrv.sys SSDPSRV (0a5679b3714edab99e357057ee88fca6) C:WINDOWSSystem32ssdpsrv.dll stisvc (8bad69cbac032d4bbacfce0306174c30) C:WINDOWSsystem32wiaservc.dll swenum (3941d127aef12e93addf6fe6ee027e0f) C:WINDOWSsystem32DRIVERSswenum.sys swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:WINDOWSsystem32driversswmidi.sys sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:WINDOWSsystem32driverssysaudio.sys SysmonLog (c7abbc59b43274b1109df6b24d617051) C:WINDOWSsystem32smlogsvc.exe TapiSrv (3cb78c17bb664637787c9a1c98f79c38) C:WINDOWSSystem32tapisrv.dll Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:WINDOWSsystem32DRIVERStcpip.sys TDPIPE (6471a66807f5e104e4885f5b67349397) C:WINDOWSsystem32driversTDPIPE.sys TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:WINDOWSsystem32driversTDTCP.sys TermDD (88155247177638048422893737429d9e) C:WINDOWSsystem32DRIVERStermdd.sys TermService (ff3477c03be7201c294c35f684b3479f) C:WINDOWSSystem32termsrv.dll Themes (99bc0b50f511924348be19c7c7313bbf) C:WINDOWSSystem32shsvcs.dll TlntSvr (db7205804759ff62c34e3efd8a4cc76a) C:WINDOWSsystem32tlntsvr.exe TOSHIBASoftModem (bdf9ed967f81145ed058601b1c4d8fb7) C:WINDOWSsystem32DRIVERSLTSM.sys TOSHIBASoftModem - ok TrkWks (55bca12f7f523d35ca3cb833c725f54e) C:WINDOWSsystem32trkwks.dll TuneUp.Defrag (b39f12748c9421080824e0717045fd4a) C:Program FilesTuneUp Utilities 2010TuneUpDefragService.exe TuneUp.Defrag - ok TuneUp.UtilitiesSvc (4bd2504c3d8f43dc952552a6e76e7ae8) C:Program FilesTuneUp Utilities 2010TuneUpUtilitiesService32.exe TuneUp.UtilitiesSvc - ok TuneUpUtilitiesDrv (f2107c9d85ec0df116939ccce06ae697) C:Program FilesTuneUp Utilities 2010TuneUpUtilitiesDriver32.sys TuneUpUtilitiesDrv - ok Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:WINDOWSsystem32driversUdfs.sys Update (402ddc88356b1bac0ee3dd1580c76a31) C:WINDOWSsystem32DRIVERSupdate.sys upnphost (1ebafeb9a3fbdc41b8d9c7f0f687ad91) C:WINDOWSSystem32upnphost.dll UPS (05365fb38fca1e98f7a566aaaf5d1815) C:WINDOWSSystem32ups.exe usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:WINDOWSsystem32DRIVERSusbccgp.sys usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:WINDOWSsystem32DRIVERSusbehci.sys usbhub (1ab3cdde553b6e064d2e754efe20285c) C:WINDOWSsystem32DRIVERSusbhub.sys usbprint (a717c8721046828520c9edf31288fc00) C:WINDOWSsystem32DRIVERSusbprint.sys USBSafelyRemoveService (24c992a579d0e8d03077a36b70e47ba6) C:Program FilesUSB Safely RemoveUSBSRService.exe USBSafelyRemoveService - ok usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:WINDOWSsystem32DRIVERSusbscan.sys USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:WINDOWSsystem32DRIVERSUSBSTOR.SYS usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:WINDOWSsystem32DRIVERSusbuhci.sys UxTuneUp (799a1a104fbaf8597eccdb2da2238c89) C:WINDOWSSystem32uxtuneup.dll VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:WINDOWSSystem32driversvga.sys VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:WINDOWSsystem32driversVolSnap.sys VSS (7a9db3a67c333bf0bd42e42b8596854b) C:WINDOWSSystem32vssvc.exe W32Time (54af4b1d5459500ef0937f6d33b1914f) C:WINDOWSsystem32w32time.dll Wanarp (e20b95baedb550f32dd489265c1da1f6) C:WINDOWSsystem32DRIVERSwanarp.sys wdmaud (6768acf64b18196494413695f0c3a00f) C:WINDOWSsystem32driverswdmaud.sys WebClient (77a354e28153ad2d5e120a5a8687bc06) C:WINDOWSSystem32webclnt.dll winmgmt (2d0e4ed081963804ccc196a0929275b5) C:WINDOWSsystem32wbemWMIsvc.dll WmdmPmSN (c51b4a5c05a5475708e3c81c7765b71d) C:WINDOWSsystem32MsPMSNSv.dll Wmi (e76f8807070ed04e7408a86d6d3a6137) C:WINDOWSSystem32advapi32.dll WmiApSrv (e0673f1106e62a68d2257e376079f821) C:WINDOWSsystem32wbemwmiapsrv.exe WMPNetworkSvc (f74e3d9a7fa9556c3bbb14d4e5e63d3b) C:Program FilesWindows Media PlayerWMPNetwk.exe WMPNetworkSvc - ok WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8) C:WINDOWSSystem32driversws2ifsl.sys wscsvc (7c278e6408d1dce642230c0585a854d5) C:WINDOWSsystem32wscsvc.dll WSIMD (0091d78c5f8fde0cdf2b214823de6e48) C:WINDOWSsystem32DRIVERSwsimd.sys wuauserv (35321fb577cdc98ce3eb3a3eb9e4610a) C:WINDOWSsystem32wuauserv.dll WudfPf (f15feafffbb3644ccc80c5da584e6311) C:WINDOWSsystem32DRIVERSWudfPf.sys WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:WINDOWSsystem32DRIVERSwudfrd.sys WudfSvc (05231c04253c5bc30b26cbaae680ed89) C:WINDOWSSystem32WUDFSvc.dll WZCSVC (81dc3f549f44b1c1fff022dec9ecf30b) C:WINDOWSSystem32wzcsvc.dll xmlprov (295d21f14c335b53cb8154e5b1f892b9) C:WINDOWSSystem32xmlprov.dll {6080A529-897E-4629-A488-ABA0C29B635E} (a7ab6e6fcb5d9276160d9998593638e3) C:WINDOWSsystem32driversialmsbw.sys {6080A529-897E-4629-A488-ABA0C29B635E} - ok {D31A0762-0CEB-444e-ACFF-B049A1F6FE91} (d9c1c60a4e414052e30dbb2800f0893a) C:WINDOWSsystem32driversialmkchw.sys {D31A0762-0CEB-444e-ACFF-B049A1F6FE91} - ok {E2B953A6-195A-44F9-9BA3-3D5F4E32BB55} (100b40ed254ed42ec179e24d890c973e) C:WINDOWSsystem32driverswA301a.sys {E2B953A6-195A-44F9-9BA3-3D5F4E32BB55} - ok MBR (0x1B8) (8f558eb6672622401da993e1e865c861) DeviceHarddisk0DR0 DeviceHarddisk0DR0 - ok Boot (0x1200) (f0bf5aeb7dbc15026c5c6a028ccf4cce) DeviceHarddisk0DR0Partition0 DeviceHarddisk0DR0Partition0 - ok Boot (0x1200) (6e372783dd4a0983baf7a028146755af) DeviceHarddisk0DR0Partition1 DeviceHarddisk0DR0Partition1 - ok ============================================================ ============================================================ Detected object count: 6 Actual detected object count: 6 Autodata Limited License Service ( UnsignedFile.Multi.Generic ) - skipped by user Autodata Limited License Service ( UnsignedFile.Multi.Generic ) - User select action: Skip EPSON_EB_RPCV4_01 ( UnsignedFile.Multi.Generic ) - skipped by user EPSON_EB_RPCV4_01 ( UnsignedFile.Multi.Generic ) - User select action: Skip EPSON_PM_RPCV4_01 ( UnsignedFile.Multi.Generic ) - skipped by user EPSON_PM_RPCV4_01 ( UnsignedFile.Multi.Generic ) - User select action: Skip FTDIBUS ( UnsignedFile.Multi.Generic ) - skipped by user FTDIBUS ( UnsignedFile.Multi.Generic ) - User select action: Skip FTSER2K ( UnsignedFile.Multi.Generic ) - skipped by user FTSER2K ( UnsignedFile.Multi.Generic ) - User select action: Skip sptd ( LockedFile.Multi.Generic ) - skipped by user sptd ( LockedFile.Multi.Generic ) - User select action: Skip Deinitialize success

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

23 април 201214 г.

Идеално..! Как е положението със системата ви до момента..?

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

23 април 201214 г.

Понеже питам и отговор няма и да не си говоря като глупак ...да продължим...!

Изтеглете Security Check (автор: screen317) от тук или от тук и го запишете на десктопа.

Кликнете два пъти върху SecurityCheck.exe и следвайте инструкциите.
Когато програмата завърши работата си, ще се отвори един текстов документ: checkup.txt.
Копирайте съдържанието на checkup.txt с Копирай (Copy) и с Постави (Paste) го поставете в следващия си коментар.

Изтеглете Malwarebytes' Anti-Malware или от тук

* Кликнете два пъти върху mbam-setup.exe, за да инсталирате програмата.

* Уверете се, че са поставени отметки на Update Malwarebytes' Anti-Malware и Launch Malwarebytes' Anti-Malware. След това кликнете на Finish.

* Ако има намерени обновявания, тя ще ги изтегли и инсталира.

* Стартирайте програмата и изберете "Perform Full Scan", след това кликнете на Scan.

* Сканирането ще отнеме малко време, затова моля да бъдете търпеливи.

* Когато сканирането завърши, кликнете на OK, след това Show Results, за да видите резултата.

* Уверете се, че на всички редове има отметки, и кликнете на Remove Selected.

* Когато всичко бъде премахнато, в Notepad ще бъде отворен лог. Копирайте този лог и го публикувайте в следващия си коментар по темата.

Забележка: Ако MalwareBytes' Anti-Malware се затрудни в премахването на откритите вируси/заплахи, той ще поиска да рестартира компютъра Ви и по време на рестартирането да премахне проблемните вируси/заплахи. Ако бъдете попитани, потвърдете че желаете вашия компютър да бъде рестартиран.

23 април 201214 г.

Автор

Идеално..!

Как е положението със системата ви до момента..?

Забавих се, защото след процедурите се опитвам да възстановя Language Bar-a. Езиците се превключват, но изчезнаха EN/BG до часовника ... Четох из нета за проблема, но нищо не помага.

PS. Оправих се...

Редактирано 23 април 201214 г. от Kibik (преглед на промените)

23 април 201214 г.

Автор

Results of screen317's Security Check version 0.99.32

Windows XP Service Pack 3 x86

Internet Explorer 8

``````````````````````````````

Antivirus/Firewall Check:

Windows Firewall Enabled!

AVG 2012

Antivirus up to date!

```````````````````````````````

Anti-malware/Other Utilities Check:

Spyware Doctor 8.0

OBD2Spy V2.05

Spybot - Search & Destroy

TuneUp Utilities

TuneUp Utilities Language Pack (en-GB)

TuneUp Utilities

CCleaner (remove only)

Adobe Flash Player 11.2.202.233

Mozilla Firefox (11.0.)

````````````````````````````````

Process Check:

objlist.exe by Laurent

AVG avgwdsvc.exe

AVG avgtray.exe

AVG avgrsx.exe

AVG avgnsx.exe

AVG avgemc.exe

``````````End of Log````````````

23 април 201214 г.

Автор

Намерените в D: са киигенове и подобни, за които знам и не ги махнах. В C: намери един и го махнах. Malwarebytes Anti-Malware 1.61.0.1400 www.malwarebytes.org Database version: v2012.04.23.07 Windows XP Service Pack 3 x86 NTFS Internet Explorer 8.0.6001.18702 Clever Boy :: HOME-LAPTOPA30 [administrator] 24/04/2012 23:20:15 mbam-log-2012-04-24 (23-20-15).txt Scan type: Full scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 275453 Time elapsed: 59 minute(s), 49 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 11 D:My Exe FilesA&Video ConvertersAudio ConverterAudioConverter.EXE (Backdoor.Agent) -> No action taken. D:My Exe FilesCarsDiagnostic ProgramsELM CompatibleScanMaster 2.1ScanMaster.ELM.v2.1.104.771KeyGenKg.exe (Malware.Packer.Gen) -> No action taken. D:My Exe FilesPC-Wind-Test- MaintenanceUnlockerUnlocker setupunlocker1.8.7.exe (Adware.Clicker) -> No action taken. D:My Exe FilesValidation key(XP)and (7)Win 7WActivators&Remove WATRemoveWAT.2.2.5.Hazar.carter67RemoveWAT.exe (HackTool.Wpakill) -> No action taken. D:My Exe FilesValidation key(XP)and (7)Win 7WActivators&Remove WATWA1Windows 7 LoaderWindows 7 Loader.exe (RiskWare.Tool.CK) -> No action taken. D:My Exe FilesValidation key(XP)and (7)Win XPCrack ValidationCDRoller_7.70.99.1PatchCDRoller.v7.70.99.1-RES-patch.exe (PUP.Hacktool.Patcher) -> No action taken. D:My Exe FilesValidation key(XP)and (7)Win XPCrack_WinXP-SP2-SP3Crypt.dll (Hacktool) -> No action taken. D:My Exe FilesValidation key(XP)and (7)Win XPKey valid check & change(XP)keyfinder.exe (RiskWare.Tool.CK) -> No action taken. D:My Exe FilesValidation key(XP)and (7)Win XPMake Your Copy of Windows GenuineMake Your Copy of Windows 100% Genuinekeyfinder.exe (RiskWare.Tool.CK) -> No action taken. D:My Exe FilesValidation key(XP)and (7)Win XPRemove WGAremovewga.exe (PUP.RemoveWGA) -> No action taken. C:Program FilesUnlockereBay_shortcuts_1016.exe (Adware.Clicker) -> Quarantined and deleted successfully. (end)

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

24 април 201214 г.

Забавих се, защото след процедурите се опитвам да възстановя Language Bar-a. Езиците се превключват, но изчезнаха EN/BG до часовника ... Четох из нета за проблема, но нищо не помага.

PS. Оправих се...

Аха..трябваше да ми кажеш ...аз имам фикс за тази цел и щях да ти спестя ровенето в интернет...Хубаво е че сте решили проблема..!

Имате и много защитен софтуер на машината..възможен е конфликт....!

AVG Free от време на време открива по нещо без да сканирам...

Нямам бекъп, Restore Points не работят...

Тези първоначални проблеми има ли ги все още..?

Иначе системата ви беше заразена с рууткит ZeroAccess...!

24 април 201214 г.

Автор

Имате и много защитен софтуер на машината..възможен е конфликт....!

Аз го имам, но не е стартиран постоянно.Понякога ги пускам едно след друго.Само Tune Up Utility не виждам как да го спра от стартиране, иконата си стои на таск бара(няма опция за Exit). По-старите версии май не бяха така...

Тези първоначални проблеми има ли ги все още..?

Иначе системата ви беше заразена с рууткит ZeroAccess...!

Те проблемите не бяха толкова явни и упорити и още не мога да преценя, защото това не ми е основния лаптоп и по-често използвам другия.

Да считам ли, че е чист за да направя една принудителна Restore Point и един имидж с Акронис?

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

24 април 201214 г.

Не не бързай....!

AdvancedSystemCareService5 + TuneUp - две еднородни програми...избери си само една от двете..!Моето мнение че Spyware Doctor 8.0 и Spybot - Search & Destroy нямат място на компютъра ви...!

Изтеглете OTL.exe и го запазете на десктопа.

Стартирайте OTL (ако е необходимо, потвърдете през UAC).
Направете следните настройки:
Сложете отметка пред Scan All Users
Под менюто File Age => изберете 90 days
Под менюто Standard Registry => променете на ALL
Сложете отметки пред LOP и Purity Check

Под

с Copy/ Paste въведете изцяло следната текстова информация (само това, което е поставено в карето):

netsvcs
msconfig
safebootminimal
safebootnetwork
"%WinDir%$NtUninstallKB*$." /30
C:Program FilesCommon FilesComObjects*.* /s
%SYSTEMDRIVE%*.*
%USERPROFILE%*.*
%USERPROFILE%Application Data*.*
%USERPROFILE%Local SettingsApplication Data*.*
%AllUsersProfile%*.*
%AllUsersProfile%Application Data*.*
%USERPROFILE%My Documents*.*
%CommonProgramFiles%*.*
%PROGRAMFILES%*.*
%systemroot%system32configsystemprofile*.*
%windir%ServiceProfilesLocalServiceAppDataLocalTemp*.*
%windir%ServiceProfilesNetworkServiceAppDataLocalTemp*.*
%windir%temp*.*
%windir%system32*.
%Temp%smtmp1*.*
%Temp%smtmp2*.*
%Temp%smtmp3*.*
%Temp%smtmp4*.*
%systemroot%system32DBBK*.* /s
%systemroot%system32*.dll /lockedfiles
%systemroot%Tasks*.job /lockedfiles
%systemroot%system32drivers*.sys /90
%systemroot%system32drivers*.sys /lockedfiles
%systemroot%system32Spoolprtprocsw32x86*.dll
%systemroot%*. /rp /s
%systemroot%assemblytmp*.* /S /MD5
%systemroot%assemblytemp*.* /S /MD5
%systemroot%assemblyGAC_32*.* /S /MD5
%systemroot%assemblyGAC_MSIL*.* /S /MD5
>C:commands.txt echo list vol /raw /hide /c
/wait
>C:DiskReport.txt diskpart /s C:commands.txt /raw /hide /c
/wait
type c:diskreport.txt /c
/wait
erase c:commands.txt /hide /c
/wait
erase c:diskreport.txt /hide /c
/md5start
smss.exe
winlogon.exe
services.exe
lsass.exe
svchost.exe
explorer.exe
userinit.exe
atapi.sys
iaStor.sys
serial.sys
disk.sys
volsnap.sys
redbook.sys
i8042prt.sys
afd.sys
netbt.sys
tcpip.sys
ipsec.sys
hlp.dat
/md5stop

Натиснете маркираният в синьо бутон: Run Scan.
Като приключи проверката, ще се създадат два файла - OTL.Txt и Extras.Txt. Прикачете тези два файла в следващия си коментар (погледнете опцията "прикачени файлове", когато публикувате мнение).

Само Tune Up Utility не виждам как да го спра от стартиране, иконата си стои на таск бара(няма опция за Exit).

Има много начини...Виждам че имате програмата CCleaner ..Старт на програмата ==> Инструменти ==> Стартиране ==> ..и отам изключвате Tune Up Utility..!

24 април 201214 г.

Автор

Има много начини...Виждам че имате програмата CCleaner ..Старт на програмата ==> Инструменти ==> Стартиране ==> ..и отам изключвате Tune Up Utility..!

CCleaner показва същото като и msconfig/startup и старнноTune Up я няма там:

No HKCU:Run ASCTray "C:Program FilesIObitAdvanced SystemCare 5ASCTray.exe" /AutoStart

Yes HKCU:Run ctfmon.exe C:WINDOWSsystem32ctfmon.exe

Yes HKCU:Run DU Meter C:Program FilesDU MeterDUMeter.exe

No HKCU:Run E_S257 C:WINDOWSSystem32spoolDRIVERSW32X863E_FATIEDE.EXE /FU "C:WINDOWSTEMPE_S257.tmp" /EF "HKCU"

Yes HKCU:Run Skype "C:Program FilesSkypePhoneSkype.exe" /nosplash /minimized

Yes HKCU:Run Sticky Pad C:Program FilesStickyPadStickyPad.exe

Yes HKLM:Run AVG_TRAY "C:Program FilesAVGAVG2012avgtray.exe"

No HKLM:Run FGuard C:Program FilesSpyware DoctorBDTFGuard.exe

Yes HKLM:Run HotKeysCmds C:WINDOWSsystem32hkcmd.exe

Yes HKLM:Run IgfxTray C:WINDOWSsystem32igfxtray.exe

No HKLM:Run pctsGui "C:Program FilesSpyware DoctorpctsGui.exe" /hideGUI

No HKLM:Run Updater "C:Program FilesAsk.comUpdaterUpdater.exe"

No Startup User ERUNT AutoBackup.lnk C:PROGRA~1ERUNTAUTOBACK.EXE %SystemRoot%ERDNTAutoBackup#Date# /noconfirmdelete /noprogresswindow

AdvancedSystemCareService5 + TuneUp - две еднородни програми...избери си само една от двете..!

Освен да деинсталирам Tune Up като не може да се спре и да остане ASCService?

Моето мнение че Spyware Doctor 8.0 и Spybot - Search & Destroy нямат място на компютъра ви...!

Защото не вършат работа или могат да навредят?

Otl.txt не може да се прикачи, казва, че е прекалено голям...492KB

Опитах да го разделя на части, но пак не става, дори 130КB казва,че е голям...

Extras.Txt

Редактирано 25 април 201214 г. от Kibik (преглед на промените)

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

25 април 201214 г.

Otl.txt не може да се прикачи, казва, че е прекалено голям...492KB

Опитах да го разделя на части, но пак не става, дори 130MB казва,че е голям...

Ясно..а точно той ми е най -необходим......ами архивирайте го и го качете някъде ...Публикувайте линк за да го изтегля..!

Освен да деинсталирам Tune Up като не може да се спре и да остане ASCService?

Аз мога да го разкарам със OTL....само кажи...!

25 април 201214 г.

Автор

Ясно..а точно той ми е най -необходим......ами архивирайте го и го качете някъде ...Публикувайте линк за да го изтегля..!

Не се сетих да го компресирам...Сега го прикачих.

Аз мога да го разкарам със OTL....само кажи...!

Разкарването значи спиране ли? Ако да, то когато го пусна, пак ще остане там...

А ако значи премахване, аз ще си го деинсталирам...

OTL.zip

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

26 април 201214 г.

Стартирайте отново OTL, копирайте (Copy) и поставете (Paste) скриптовия текст от текстовото поле по-долу под колонката Custom Scans/Fixes, като не забравяте да копирате скрипта 1 към 1, както и двете точки преди първия ред на скрипта.

:OTL
SRV - File not found [Auto | Stopped] -- %systemroot%system32crystaloutputfileserver.dll -- (w810mdm)
SRV - File not found [Auto | Stopped] -- %systemroot%system32roxliveshare.dll -- (tifm21)
SRV - File not found [Auto | Stopped] -- %systemroot%system32vnxservice.dll -- (racsvc)
SRV - File not found [Auto | Stopped] -- %systemroot%system32nalntservice.dll -- (pnrouter)
SRV - File not found [Auto | Stopped] -- %systemroot%system32lp6nds35.dll -- (PAR1284)
SRV - File not found [Auto | Stopped] -- %systemroot%system32diskeeper.dll -- (ipodservice)
DRV - File not found [Kernel | On_Demand | Unknown] --  -- (a8ietr2y)
[2012/02/19 08:51:47 | 000,000,000 | ---- | C] () -- C:Documents and SettingsAll UsersApplication DataVQaHYP556.dat
@Alternate Data Stream - 170 bytes -> C:Documents and SettingsAll UsersApplication DataTEMP:DFC5A2B2
@Alternate Data Stream - 127 bytes -> C:Documents and SettingsAll UsersApplication DataTEMP:430C6D84

:Reg

:files

autorun.inf /alldrives
autorun.exe /alldrives
recycler /alldrives
ipconfig /flushdns /c

:Commands
[purity]
[emptytemp]
[resethosts]
[clearallrestorepoints]
[emptyflash]
[Reboot]

След като въведете скрипта от цитата по-горе натиснете бутона, маркиран в червено: Run Fix

Windows ще се рестартира и ще се създаде лог файл. Публикувайте съдържанието му с Copy/Paste в следващия си коментар.

26 април 201214 г.

Автор

All processes killed

========== OTL ==========

Service w810mdm stopped successfully!

Service w810mdm deleted successfully!

File %systemroot%system32crystaloutputfileserver.dll not found.

Service tifm21 stopped successfully!

Service tifm21 deleted successfully!

File %systemroot%system32roxliveshare.dll not found.

Service racsvc stopped successfully!

Service racsvc deleted successfully!

File %systemroot%system32vnxservice.dll not found.

Service pnrouter stopped successfully!

Service pnrouter deleted successfully!

File %systemroot%system32nalntservice.dll not found.

Service PAR1284 stopped successfully!

Service PAR1284 deleted successfully!

File %systemroot%system32lp6nds35.dll not found.

Service ipodservice stopped successfully!

Service ipodservice deleted successfully!

File %systemroot%system32diskeeper.dll not found.

Error: No service named a8ietr2y was found to stop!

ServiceDriver key a8ietr2y not found.

C:Documents and SettingsAll UsersApplication DataVQaHYP556.dat moved successfully.

ADS C:Documents and SettingsAll UsersApplication DataTEMP:DFC5A2B2 deleted successfully.

ADS C:Documents and SettingsAll UsersApplication DataTEMP:430C6D84 deleted successfully.

========== REGISTRY ==========

========== FILES ==========

autorun.inf not found in C:

autorun.inf not found in D:

autorun.exe not found in C:

autorun.exe not found in D:

C:RECYCLERS-1-5-21-73586283-1637723038-1177238915-1003 folder moved successfully.

C:RECYCLER folder moved successfully.

D:RECYCLERS-1-5-21-73586283-1637723038-1177238915-1003 folder moved successfully.

D:RECYCLER folder moved successfully.

< ipconfig /flushdns /c >

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

C:Documents and SettingsClever BoyDesktopcmd.bat deleted successfully.

C:Documents and SettingsClever BoyDesktopcmd.txt deleted successfully.

========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 67 bytes

User: All Users

User: Clever Boy

->Temp folder emptied: 2501483 bytes

->Temporary Internet Files folder emptied: 5226371 bytes

->FireFox cache emptied: 101768162 bytes

->Flash cache emptied: 3315 bytes

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

User: LocalService

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 32902 bytes

User: NetworkService

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 32902 bytes

->Flash cache emptied: 8443 bytes

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 2402044 bytes

%systemroot%System32 .tmp files removed: 2577 bytes

%systemroot%System32dllcache .tmp files removed: 0 bytes

%systemroot%System32drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 152 bytes

%systemroot%system32configsystemprofileLocal SettingsTemp folder emptied: 0 bytes

%systemroot%system32configsystemprofileLocal SettingsTemporary Internet Files folder emptied: 33170 bytes

RecycleBin emptied: 0 bytes

Total Files Cleaned = 107.00 mb

C:WINDOWSSystem32driversetcHosts moved successfully.

HOSTS file reset successfully

Restore point Set: OTL Restore Point

[EMPTYFLASH]

User: Administrator

User: All Users

User: Clever Boy

->Flash cache emptied: 0 bytes

User: Default User

User: LocalService

User: NetworkService

->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb

OTL by OldTimer - Version 3.2.41.0 log created on 04262012_195114

FilesFolders moved on Reboot...

Registry entries deleted on Reboot...

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

26 април 201214 г.

Перфектно...!Ами ако нямате други проблеми да се ориантираме към финал.....???

26 април 201214 г.

Автор

Перфектно...!Ами ако нямате други проблеми да се ориантираме към финал.....???

Току що забелязах, че сега OTLе създал Restore point и в същата минута е създадена още една (System Check Point).

Това добре, но всички предишни точки липсват, изчезнали са. Не знам колко бяха, но на 24 апр. дори правих една ръчна... Не знам и дали преди това или след OTL са изчезнали.

Настройката ми е да прави RP само на C: .Оставил съм го на 7% (700MB). Може ли да се предположи приблизително една RP колко MB заема, или е % от размера на дяла?

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

27 април 201214 г.

Деинсталирайте OTL така:

Стартирайте OTL още веднъж и натиснете бутона CleanUp.

Ще последва рестарт на компютъра ви..!

Деинсталирайте задължително Комбофикс така:

1.Натиснете Start ==> Run ==> въведете командата Combofix /Uninstall ==> OK

2.Изтеглете OTCleanIt или от тук,стартирайте и натиснете

Деинсталирай/изтрий всички програмки и логове които използвахме в темата (които са останали след горните процедури).Желателно е да направите контролни сканирания с:

Изтеглете програмата: ESET Online Scanner

Стартирайте esetsmartinstaller_enu.exe
Сложете отметка на YES, I accept the Terms of Use и изберете Start:
Скенерът ще започне да изтегля компонентите, които са му необходими:
Уверете се, че има отметки на следните редове:

Накрая изберете Start
Скенерът ще започне да изтегля последните дефиниции.
След, като сканирането завърши изберете Finish.
Отидете в: C:Program FilesESET ESET Online Scanner
Отворете файла log.txt , копирайте съдържанието му и го поставете в следващия си коментар.

27 април 201214 г.

Автор

Изпълних всичко, направих скана. Карантинирани са 14 файла, за този в C: мисля, че има вредител, може и от него да е станала белята. Другите в D: мисля, че повечето са кийгенове и подобни и ги имам отдавна. Предишните Restore Points отново ги няма, има от днес, но не знам дали това е ситуацията преди или след манипулациите... ESETSmartInstaller@High as downloader log: all ok # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6583 # api_version=3.0.2 # EOSSerial=1ee16d26857ac247b9150ec935757da5 # end=finished # remove_checked=true # archives_checked=true # unwanted_checked=true # unsafe_checked=true # antistealth_checked=true # utc_time=2012-04-27 10:46:24 # local_time=2012-04-27 11:46:24 (+0000, GMT Daylight Time) # country="United Kingdom" # lang=1033 # osver=5.1.2600 NT Service Pack 3 # compatibility_mode=1024 16777191 100 0 7083097 7083097 0 0 # compatibility_mode=2560 16777215 100 0 0 0 0 0 # compatibility_mode=8192 67108863 100 0 351 351 0 0 # scanned=86542 # found=14 # cleaned=14 # scan_time=7112 C:Documents and SettingsClever BoyDesktopDownloads uTorrentPCMSCAN.v2.4.5.824.Cracked-iMST.rar a variant of Win32/HackTool.Patcher.A application (deleted - quarantined) 00000000000000000000000000000000 C D:My Exe FilesA&Video ConvertersFree RIPfreeripmp3-setup.exe Win32/Toolbar.Zugo application (deleted - quarantined) 00000000000000000000000000000000 C D:My Exe FilesAct.Sinc & W.Mobile Device CentreWindows Mobile Device CentreSoftonicDownloader_for_windows-mobile-device-center.exe a variant of Win32/SoftonicDownloader.A application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C D:My Exe FilesCarsDiagnostic ProgramsELM CompatibleScanMaster 2.1ScanMaster.ELM.v2.1.104.771KeyGenKg.exe probably a variant of Win32/Spy.Agent.EKAKGWH trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C D:My Exe FilesPC-Wind-Test- MaintenanceAdvanced System Carev 2010asc-setup.exe a variant of Win32/Toolbar.Widgi application (deleted - quarantined) 00000000000000000000000000000000 C D:My Exe FilesPC-Wind-Test- MaintenanceUnlockerUnlockerUnlocker1%5B1%5D.9.0.exe Win32/Adware.ADON application (deleted - quarantined) 00000000000000000000000000000000 C D:My Exe FilesPC-Wind-Test- MaintenanceUnlockerUnlocker setupunlocker1.8.7.exe Win32/Adware.ADON application (deleted - quarantined) 00000000000000000000000000000000 C D:My Exe FilesPDF ProgramsAdobe.Acrobat.v9.Pro.ExtendedAdobe.Acrobat.v9.PRO.Extended.iso probably a variant of Win32/Agent.DQPHVKD trojan (deleted - quarantined) 00000000000000000000000000000000 C D:My Exe FilesValidation key(XP)and (7)Win 7WActivators&Remove WATWA2ac-wmvvv.rar a variant of MSIL/TrojanDropper.Agent.AX trojan (deleted - quarantined) 00000000000000000000000000000000 C D:My Exe FilesValidation key(XP)and (7)Win 7WActivators&Remove WATWA3w7lxe.exe a variant of Win32/HackKMS.A application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C D:My Exe FilesValidation key(XP)and (7)Win XPCrack ValidationCDRoller_7.70.99.1PatchCDRoller.v7.70.99.1-RES-patch.exe a variant of Win32/HackTool.Patcher.A application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C D:My Exe FilesValidation key(XP)and (7)Win XPKey valid check & change(XP)keyfinder.exe Win32/PSWTool.RAS.A application (deleted - quarantined) 00000000000000000000000000000000 C D:My Exe FilesValidation key(XP)and (7)Win XPMake Your Copy of Windows GenuineMake Your Copy of Windows 100% Genuinekeyfinder.exe Win32/PSWTool.RAS.A application (deleted - quarantined) 00000000000000000000000000000000 C D:My Exe FilesVirtual Flash Drive v.3.30Keygenkeygen.exe a variant of Win32/Keygen.CX application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

28 април 201214 г.

Преди да приключим:

Деинсталирайте ESET Online Scanner...!

Предишните Restore Points отново ги няма....

Напълно нормално....инстумента OTL премахва всички стари точки и създава нова .....защо..?

Ами задавате ли си въпроса ако има заразена такава и решите да възстановите какво ще се случи..?Така не съжалявайте за старите Restore Points...!

Толкова от мен...Лек ден и безопасен интернет..!

28 април 201214 г.

Автор

Преди да приключим:

Деинсталирайте ESET Online Scanner...!
Предишните Restore Points отново ги няма....
Напълно нормално....инстумента OTL премахва всички стари точки и създава нова .....защо..?

Ами задавате ли си въпроса ако има заразена такава и решите да възстановите какво ще се случи..?Така не съжалявайте за старите Restore Points...!

Толкова от мен...Лек ден и безопасен интернет..!

Деинсталирах го.Преди това опитах да намеря как да върна файловете от карантината, не намерих и те изчезнаха.

Ще ги възстановя от външен хард и ще правя имодж.

Все пак последен въпрос- каква е разликата ако сканирам с AVG Free и с онлайн скенера ESET?

Благодаря за съдействието

Добре дошли!

Заразен лаптоп [РЕШЕН]

Featured Replies

Архивирана тема

Разглеждащи това в момента 0

Дарение

Бюлетин

Профил

Навигация

Търсене

Конфигуриране на push известия в браузъра

Chrome (Android)

Chrome (Desktop)

Safari (iOS 16.4+)

Safari (macOS)

Edge (Android)

Edge (Desktop)

Firefox (Android)

Firefox (Desktop)