Сега изтеглете тези четири файла и ги запазете на десктопа:

SharedAccess.reg

LEGACY_SHAREDACCESS.reg

wuauserv.reg

LEGACY_WUAUSERV.reg

Стартирайте всеки един от тях (един по един) и изберете YES на диалоговия прозорец.

Рестартирайте компютъра.

След това направете следното:

Изтеглете този инструмент - Windows Repair All in one

Инсталирайте приложението и го стартирайте.

От стъпка 2 => стартирайте Check Disk

От стъпка 3 => стартирайте SFC

от Start Repairs натиснете Start и оттук вече сложете всички отметки показани на снимката:

Сложете отметка пред restart system when finished и натиснете Start.

Пишете направете нова проверка с Farbar Service Scanner и публикувайте резултатите.

LEGACY_SHAREDACCESS.reg не иска да се добавя. А LEGACY_WUAUSERV.reg не добавя всичко в регистъра, някой ключове (буквален превод) са отворени от системата или други процеси. Ей сега рескам и пуска програмата.

Стъпка 3 не мога да я изпълня, защото ми иска диска на уиндоус. Аз я прекъснах. Имаше предупреждения, че после може да се наложи да слагам диска...

Редактирано 7 юни 201214 г. от Fr3aK98 (преглед на промените)

Здравейте,

Пропуснете импортването на Legacy услугите. Би трябвало след импортването на основните услуги, Legacy услугите да се създадат автоматично след рестарт на компютъра.Ако не се получи ще се наложи да вземем временно права над ключовете в регистрите и да ги импортнем наново.

Колкото до програмата, да командата SFC изисква наличието на инсталационен диск за да възстанови прецаканитете библиотеки (ако има такива) с тези от диска. Командата не е задължителна, но е препоръчителна преди да се премине към възстановяването на правата на файловете (втората опция оттук):

Както и да е...пропуснете тези неща и направо направете поправките от последната снимка. След това рестартирайте компютъра и направете нова проверка с Farbar Service Scanner.

Всичко е готово. Ето и лога от FSS: Farbar Service Scanner Version: 05-06-2012 Ran by PC (administrator) on 07-06-2012 at 16:10:33 Running from "C:Documents and SettingsPCDesktop" Microsoft Windows XP Professional Service Pack 3 (X86) Boot Mode: Normal **************************************************************** Internet Services: ============ Connection Status: ============== Localhost is accessible. WAN connected Google IP is accessible. Google.com is accessible. Yahoo IP is accessible. Yahoo.com is accessible. Windows Firewall: ============= Firewall Disabled Policy: ================== System Restore: ============ System Restore Disabled Policy: ======================== Security Center: ============ Windows Update: ============ Windows Autoupdate Disabled Policy: ============================ File Check: ======== C:WINDOWSsystem32dhcpcsvc.dll => MD5 is legit C:WINDOWSsystem32Driversafd.sys => MD5 is legit C:WINDOWSsystem32Driversnetbt.sys => MD5 is legit C:WINDOWSsystem32Drivers cpip.sys => MD5 is legit C:WINDOWSsystem32Driversipsec.sys => MD5 is legit C:WINDOWSsystem32dnsrslvr.dll => MD5 is legit C:WINDOWSsystem32ipnathlp.dll => MD5 is legit C:WINDOWSsystem32netman.dll => MD5 is legit C:WINDOWSsystem32wbemWMIsvc.dll => MD5 is legit C:WINDOWSsystem32srsvc.dll => MD5 is legit C:WINDOWSsystem32Driverssr.sys => MD5 is legit C:WINDOWSsystem32wscsvc.dll => MD5 is legit C:WINDOWSsystem32wbemWMIsvc.dll => MD5 is legit C:WINDOWSsystem32wuauserv.dll => MD5 is legit C:WINDOWSsystem32qmgr.dll => MD5 is legit C:WINDOWSsystem32es.dll => MD5 is legit C:WINDOWSsystem32cryptsvc.dll => MD5 is legit C:WINDOWSsystem32svchost.exe => MD5 is legit C:WINDOWSsystem32rpcss.dll => MD5 is legit C:WINDOWSsystem32services.exe => MD5 is legit **** End of log ****

Лог файла вече изглежда наред.

Обновете следните програми: (давам линкове към най-новите им СТАБИЛНИ версии)

Adobe Flash Player 11.2.202.235 Final за (Internet Explorer) x86 | BG Mirror (1.87 MB)

Adobe Flash Player 11.2.202.235 Final за (Firefox, Safari, Opera) x86 | BG Mirror (1.84 MB)

Adobe Reader 10.1.3 | BG Mirror (50.9 MB)

Java™ 6 Update 32 (тук изберете download JRE)

Mozilla Firefox 13.0 Final за Windows на български | BG Mirror (13.40 MB)

K-Lite Mega Codec Pack 8.8.0 Final (20.71 MB)

И да направим една последна проверка:

• Стартирайте OTL (ако е необходимо, потвърдете през UAC).
• Направете следните настройки:
• Сложете отметка пред Scan All Users
• Под менюто File Age изберете 90 days
• Под менюто Standard Registry променете на ALL
• Сложете отметки пред LOP и Purity Check

Под с Copy/ Paste въведете изцяло следната текстова информация (само това, което е поставено в карето):

HKEY_CLASSES_ROOTCLSID{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1} /s
HKEY_CURRENT_USERSoftwareClassesCLSID{42aedc87-2188-41fd-b9a3-0c966feabec1} /s
HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1} /s
:files
dir /s /a "C:Documents and SettingsPCLocal SettingsApplication Data{3d36cb74-97c2-0a74-b3a9-7de17aa5820c}" /c
dir /s /a "C:WindowsInstaller{3d36cb74-97c2-0a74-b3a9-7de17aa5820c}" /c

• Натиснете маркираният в синьо бутон: Run Scan.
• Като приключи проверката, ще се създадат два файла - OTL.Txt и Extras.Txt. Прикачете тези два файла в следващия си коментар (погледнете опцията Прикачени файлове, когато публикувате мнение).

Ето го. Друг файл не получих... Сега ще инсталирам и всички ъпдейти за Уиндоуса.

OTL.Txt

Да почистим остатъците:

• Отворете notepad и с copy/paste въведете следната информация:

  Folder::
  C:Documents and SettingsPCLocal SettingsApplication Data{3d36cb74-97c2-0a74-b3a9-7de17aa5820c}
  C:WindowsInstaller{3d36cb74-97c2-0a74-b3a9-7de17aa5820c}
  

• Запазете файла с име CFScript и го провлачете и пуснете в Combofix (както е показано на картинката отдолу).

  

• По време на сканиране от страна на ComboFix не стартирайте никакви други приложения, не натискайте клавиши от клавиатурата и не местете мишката !
• Публикувайте лог файла, който ще се създаде след рестарта на компютъра в следващия си пост.

След това направете нова проверка с OTL с настройките от предишния ми коментар. И после приключваме.

Пише ми, че комбофикс е изтекъл и днешната дата. Да или Не да дам? Да е за намалени функции.

Изтрийте вашето копие и изтеглете ново оттук.

След това повторете процедурата от предишния ми коментар.

Извинете за закъснението. Съвсем забравих, а и бях много зает. Ето от комбото: ComboFix 12-06-16.02 - PC 06/19/2012 11:17:57.3.1 - x86 Microsoft Windows XP Professional 5.1.2600.3.1251.1.1033.18.958.510 [GMT 3:00] Running from: c:documents and settingsPCDesktopComboFix.exe Command switches used :: c:documents and settingsPCDesktopCFScript.txt AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:documents and settingsPCApplication DataToolbar4 c:documents and settingsPCLocal SettingsApplication Data{3d36cb74-97c2-0a74-b3a9-7de17aa5820c} c:documents and settingsPCLocal SettingsApplication Data{3d36cb74-97c2-0a74-b3a9-7de17aa5820c}@ C:Install.exe c:windowsInstaller{3d36cb74-97c2-0a74-b3a9-7de17aa5820c} c:windowsInstaller{3d36cb74-97c2-0a74-b3a9-7de17aa5820c}@ . . ((((((((((((((((((((((((( Files Created from 2012-05-19 to 2012-06-19 ))))))))))))))))))))))))))))))) . . 2012-06-17 17:15 . 2012-06-17 16:28 258352 ----a-w- c:windowssystem32unicows.dll 2012-06-17 15:08 . 2012-06-17 15:31 -------- d-----w- c:documents and settingsPCAspire-CCNA 2012-06-17 15:06 . 2012-06-17 15:06 -------- d-----w- c:documents and settingsPCApplication DataCisco 2012-06-17 15:06 . 2012-06-17 15:06 -------- d-----w- c:documents and settingsAll UsersApplication DataCisco 2012-06-14 10:39 . 2012-06-14 10:39 -------- d-----w- c:documents and settingsPCApplication DataSoldat 2012-06-08 04:07 . 2012-06-08 04:06 73728 ----a-w- c:windowssystem32javacpl.cpl 2012-06-08 04:07 . 2012-06-08 04:06 476960 ----a-w- c:windowssystem32npdeployJava1.dll 2012-06-08 03:58 . 2008-09-24 18:41 839680 ----a-w- c:windowssystem32lameACM.acm 2012-06-08 03:58 . 2011-06-24 14:44 243200 ----a-w- c:windowssystem32xvidvfw.dll 2012-06-08 03:58 . 2011-06-24 14:28 650752 ----a-w- c:windowssystem32xvidcore.dll 2012-06-08 03:57 . 2011-12-21 17:14 151552 ----a-w- c:windowssystem32ac3acm.acm 2012-06-08 03:57 . 2012-05-15 18:00 79872 ----a-w- c:windowssystem32ff_vfw.dll 2012-06-08 03:49 . 2012-06-08 03:49 770384 ----a-w- c:program filesMozilla Firefoxmsvcr100.dll 2012-06-08 03:49 . 2012-06-08 03:49 421200 ----a-w- c:program filesMozilla Firefoxmsvcp100.dll 2012-06-07 12:41 . 2004-06-11 23:33 290304 ----a-w- C:subinacl.exe 2012-06-07 12:41 . 2012-06-07 12:41 -------- d-----w- C:Reg_Backup 2012-06-07 11:18 . 2012-06-07 13:03 181064 ----a-w- c:windowsPSEXESVC.EXE 2012-06-07 11:16 . 2012-06-07 13:03 -------- d-----w- C:Tweaking.com_Windows_Repair_Logs 2012-06-07 11:16 . 2012-06-07 11:16 -------- d-----w- c:program filesTweaking.com 2012-06-05 18:28 . 2012-06-05 18:28 -------- d-----w- c:program filesHitmanPro 2012-06-05 13:31 . 2012-06-05 13:31 -------- d-----w- c:program filesESET 2012-06-04 17:17 . 2012-06-04 17:18 -------- d-----w- c:documents and settingsAll UsersApplication DataHitmanPro 2012-05-24 04:54 . 2012-05-24 04:54 -------- d-----w- c:documents and settingsPCApplication DataLolClient2 . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-06-08 04:06 . 2010-11-05 08:07 472864 ----a-w- c:windowssystem32deployJava1.dll 2012-06-08 04:02 . 2012-04-17 10:17 419488 ----a-w- c:windowssystem32FlashPlayerApp.exe 2012-06-08 04:02 . 2011-09-18 17:59 70304 ----a-w- c:windowssystem32FlashPlayerCPLApp.cpl 2012-05-02 12:37 . 2010-11-09 13:46 836496 ----a-w- c:windowssystem32driversESLWireACD.sys 2012-04-04 12:56 . 2012-05-12 11:00 22344 ----a-w- c:windowssystem32driversmbam.sys 2012-03-26 21:45 . 2012-03-26 21:45 32768 ----a-w- c:windowssystem32driverstaphss.sys 2012-06-17 17:53 . 2011-08-30 06:13 85472 ----a-w- c:program filesmozilla firefoxcomponentsbrowsercomps.dll . . ((((((((((((((((((((((((((((( SnapShot@2012-06-06_17.35.34 ))))))))))))))))))))))))))))))))))))))))) . + 2007-11-06 22:19 . 2007-11-06 22:19 46592 c:windowsWinSxSx86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_11f3ea3amfc90kor.dll + 2007-11-06 22:19 . 2007-11-06 22:19 47104 c:windowsWinSxSx86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_11f3ea3amfc90jpn.dll + 2007-11-06 22:19 . 2007-11-06 22:19 59392 c:windowsWinSxSx86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_11f3ea3amfc90ita.dll + 2007-11-06 22:19 . 2007-11-06 22:19 60416 c:windowsWinSxSx86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_11f3ea3amfc90fra.dll + 2007-11-06 22:19 . 2007-11-06 22:19 59392 c:windowsWinSxSx86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_11f3ea3amfc90esp.dll + 2007-11-06 22:19 . 2007-11-06 22:19 59392 c:windowsWinSxSx86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_11f3ea3amfc90esn.dll + 2007-11-06 22:19 . 2007-11-06 22:19 54272 c:windowsWinSxSx86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_11f3ea3amfc90enu.dll + 2007-11-06 22:19 . 2007-11-06 22:19 60928 c:windowsWinSxSx86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_11f3ea3amfc90deu.dll + 2007-11-06 22:19 . 2007-11-06 22:19 41984 c:windowsWinSxSx86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_11f3ea3amfc90cht.dll + 2007-11-06 22:19 . 2007-11-06 22:19 41472 c:windowsWinSxSx86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_11f3ea3amfc90chs.dll + 2007-11-06 19:51 . 2007-11-06 19:51 59904 c:windowsWinSxSx86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_a173767amfcm90u.dll + 2007-11-06 19:51 . 2007-11-06 19:51 59904 c:windowsWinSxSx86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_a173767amfcm90.dll - 2008-04-14 09:00 . 2012-03-25 05:27 89038 c:windowssystem32perfc009.dat + 2008-04-14 09:00 . 2012-06-07 12:56 89038 c:windowssystem32perfc009.dat + 2011-03-16 09:46 . 2011-12-15 16:29 26624 c:windowssystem32driverstap0901.sys + 2007-11-06 22:19 . 2007-11-06 22:19 161784 c:windowsWinSxSx86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_312cf0e9atl90.dll + 2010-10-28 11:08 . 2011-03-02 10:43 175616 c:windowssystem32unrar.dll + 2008-04-14 09:00 . 2012-06-07 12:56 507726 c:windowssystem32perfh009.dat - 2008-04-14 09:00 . 2012-03-25 05:27 507726 c:windowssystem32perfh009.dat + 2012-06-08 04:02 . 2012-06-08 04:02 351904 c:windowssystem32MacromedFlashFlashUtil32_11_2_202_235_Plugin.exe + 2012-04-17 10:17 . 2012-06-08 04:02 257696 c:windowssystem32MacromedFlashFlashPlayerUpdateService.exe - 2012-02-25 18:34 . 2012-02-25 18:34 157472 c:windowssystem32javaws.exe + 2012-06-08 04:07 . 2012-06-08 04:06 157472 c:windowssystem32javaws.exe + 2012-06-08 04:07 . 2012-06-08 04:06 149280 c:windowssystem32javaw.exe - 2012-02-25 18:34 . 2012-02-25 18:34 149280 c:windowssystem32javaw.exe - 2012-02-25 18:34 . 2012-02-25 18:34 149280 c:windowssystem32java.exe + 2012-06-08 04:07 . 2012-06-08 04:06 149280 c:windowssystem32java.exe + 2010-10-28 12:25 . 2012-06-15 03:31 200144 c:windowssystem32FNTCACHE.DAT + 2012-06-13 09:16 . 2012-06-13 09:16 228352 c:windowsInstaller3b1016.msi + 2012-06-08 04:06 . 2012-06-08 04:06 900096 c:windowsInstaller274f23.msi - 2012-05-30 15:27 . 2012-05-30 15:27 371272 c:windowsInstaller{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}SkypeIcon.exe + 2012-06-07 17:21 . 2012-06-07 17:21 371272 c:windowsInstaller{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}SkypeIcon.exe + 2007-11-06 22:19 . 2007-11-06 22:19 1162744 c:windowsWinSxSx86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_a173767amfc90u.dll + 2007-11-06 22:19 . 2007-11-06 22:19 1156600 c:windowsWinSxSx86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_a173767amfc90.dll + 2012-06-08 04:02 . 2012-06-08 04:02 8797856 c:windowssystem32MacromedFlashNPSWF32_11_2_202_235.dll + 2012-06-07 17:21 . 2012-06-07 17:21 1648128 c:windowsInstallerea6da2.msi . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionexplorershelliconoverlayidentifiers00avast] @="{472083B0-C522-11CF-8763-00608CC02F24}" [HKEY_CLASSES_ROOTCLSID{472083B0-C522-11CF-8763-00608CC02F24}] 2012-03-06 23:15 123536 ----a-w- c:program filesAVAST SoftwareAvastashShell.dll . [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun] "RTHDCPL"="RTHDCPL.EXE" [2010-09-03 19573352] "Adobe ARM"="c:program filesCommon FilesAdobeARM1.0AdobeARM.exe" [2010-09-21 932288] "TkBellExe"="c:program filesRealRealPlayerupdaterealsched.exe" [2011-03-06 273544] "avast"="c:program filesAVAST SoftwareAvastavastUI.exe" [2012-03-06 4241512] "Malwarebytes' Anti-Malware"="c:program filesMalwarebytes' Anti-Malwarembamgui.exe" [2012-04-04 462408] "SunJavaUpdateSched"="c:program filesCommon FilesJavaJava Updatejusched.exe" [2012-01-18 254696] . [HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun] "CTFMON.EXE"="c:windowssystem32CTFMON.EXE" [2008-04-14 15360] . [HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRunOnce] "RunNarrator"="Narrator.exe" [2008-04-14 53760] . [HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionpoliciessystem] "DisableClock"= 0 (0x0) "WRP"= 0 (0x0) . [HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregTkBellExe] 2011-03-06 08:10 273544 ----a-w- c:program filesRealRealPlayerUpdaterealsched.exe . [HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigservices] "WMPNetworkSvc"=3 (0x3) "wlidsvc"=2 (0x2) "WireHelpSvc"=2 (0x2) "Steam Client Service"=3 (0x3) "ScsiAccess"=2 (0x2) "SbieSvc"=2 (0x2) "PnkBstrB"=2 (0x2) "PnkBstrA"=2 (0x2) "ose"=3 (0x3) "npggsvc"=3 (0x3) "metasploitThin"=2 (0x2) "metasploitProSvc"=2 (0x2) "metasploitPostgreSQL"=2 (0x2) "lxdu_device"=2 (0x2) "JavaQuickStarterService"=2 (0x2) "idsvc"=3 (0x3) "gupdatem"=3 (0x3) "gupdate"=2 (0x2) "avast! Antivirus"=2 (0x2) "AcuWVSSchedulerv7"=2 (0x2) "vToolbarUpdater"=2 (0x2) . [HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionrun-] "Akamai NetSession Interface"="c:documents and settingsPCLocal SettingsApplication DataAkamainetsession_win.exe" "DAEMON Tools Lite"="c:program filesDAEMON Tools LiteDTLite.exe" -autorun "HKCU"=c:windowssystem32installserver.exe . [HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionrun-] "Adobe Reader Speed Launcher"="c:program filesAdobeReader 9.0ReaderReader_sl.exe" "FixCamera"=c:windowsFixCamera.exe "0wl"=e:program filesWinLockProwinlock.exe . [HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList] "%windir%system32sessmgr.exe"= "c:Program FilesuTorrentuTorrent.exe"= "c:Program FilesSkypePhoneSkype.exe"= "c:Program FilesPando NetworksMedia BoosterPMB.exe"= "c:Program FilesWinampwinamp.exe"= "e:Counter-Strike 1.6 V43 [steam]hl.exe"= "e:soldat163Soldat.exe"= "c:Documents and SettingsAll UsersApplication DataNexonEUNGMNGM.exe"= "e:Aspire-CCNAbinaspire.exe"= "e:SteamsteamappscommonValveTestApp206500AirMech.exe"= "e:ArcticCombatSystemBattery.exe"= . R0 sptd;sptd;SystemRootSystemRootSystem32Driverssptd.sys --> SystemRootSystemRootSystem32Driverssptd.sys [?] R1 aswSnx;aswSnx;c:windowssystem32driversaswSnx.sys [4/27/2012 9:30 PM 612184] R1 aswSP;aswSP;c:windowssystem32driversaswSP.sys [4/27/2012 9:30 PM 337880] R2 aswFsBlk;aswFsBlk;c:windowssystem32driversaswFsBlk.sys [4/27/2012 9:30 PM 20696] R2 ESLWireAC;ESLWireAC;c:windowssystem32driversESLWireACD.sys [11/9/2010 4:46 PM 836496] R2 MBAMService;MBAMService;c:program filesMalwarebytes' Anti-Malwarembamservice.exe [5/12/2012 2:00 PM 654408] R2 npf;NetGroup Packet Filter Driver;c:windowssystem32driversnpf.sys [2/12/2011 12:23 AM 35088] R3 MBAMProtector;MBAMProtector;c:windowssystem32driversmbam.sys [5/12/2012 2:00 PM 22344] R3 RMSPPPOE;WAN Miniport (PPP over Ethernet Protocol);c:windowssystem32driversRMSPPPOE.SYS [9/3/2011 2:15 PM 31424] R3 tenCapture;tenCapture;c:windowssystem32driverstenCapture.sys [4/21/2007 5:15 PM 9344] R3 VCSVADHWSer;Avnex Virtual Audio Device (WDM);c:windowssystem32driversvcsvad.sys [3/28/2011 10:48 AM 17792] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:windowsMicrosoft.NETFrameworkv4.0.30319mscorsvw.exe [3/18/2010 1:16 PM 130384] S2 HiPatchService;Hi-Rez Studios Authenticate and Update Service;e:hi-rez studiosHiPatchService.exe [6/18/2012 10:18 PM 8704] S2 SkypeUpdate;Skype Updater;c:program filesSkypeUpdaterUpdater.exe [6/5/2012 3:17 PM 160944] S2 vToolbarUpdater10.2.0;vToolbarUpdater10.2.0;c:program filesCommon FilesAVG Secure SearchvToolbarUpdater10.2.0ToolbarUpdater.exe [3/13/2012 10:36 AM 918880] S3 1394hub;1394 Enabled Hub;c:windowssystem32svchost.exe -k netsvcs [4/14/2008 12:00 PM 14336] S3 Ambfilt;Ambfilt;c:windowssystem32driversAmbfilt.sys [10/28/2010 12:59 PM 1691480] S3 dgderdrv;dgderdrv;c:windowssystem32driversdgderdrv.sys --> c:windowssystem32driversdgderdrv.sys [?] S3 DIRECTIO;DIRECTIO;??c:program filesBurnInTestDirectIo.sys --> c:program filesBurnInTestDirectIo.sys [?] S3 dump_wmimmc;dump_wmimmc;??e:aeriagamesRepulseRepulseGameGuarddump_wmimmc.sys --> e:aeriagamesRepulseRepulseGameGuarddump_wmimmc.sys [?] S3 EagleXNt;EagleXNt;??c:windowssystem32driversEagleXNt.sys --> c:windowssystem32driversEagleXNt.sys [?] S3 ESLvnic1;ESLvnic Virtual Network 32 Bit;c:windowssystem32driversESLvnic.sys [11/9/2010 4:46 PM 24504] S3 FsUsbExDisk;FsUsbExDisk;c:windowssystem32FsUsbExDisk.Sys [2/18/2012 7:21 PM 36608] S3 GGSAFERDriver;GGSAFER Driver;??e:garena classicsafedrv.sys --> e:garena classicsafedrv.sys [?] S3 MozillaMaintenance;Mozilla Maintenance Service;c:program filesMozilla Maintenance Servicemaintenanceservice.exe [4/27/2012 4:23 PM 113120] S3 PSEXESVC;PsExec;c:windowsPSEXESVC.EXE [6/7/2012 2:18 PM 181064] S3 SCREAMINGBDRIVER;Screaming Bee Audio;c:windowssystem32driversScreamingBAudio.sys [12/1/2009 4:49 PM 34384] S3 teamviewervpn;TeamViewer VPN Adapter;c:windowssystem32driversteamviewervpn.sys [3/30/2011 2:05 PM 25088] S3 VBoxNetFlt;VBoxNetFlt Service;c:windowssystem32DRIVERSVBoxNetFlt.sys --> c:windowssystem32DRIVERSVBoxNetFlt.sys [?] S3 vproiah;vproiah;c:windowssystem32DRIVERSvproiah.sys --> c:windowssystem32DRIVERSvproiah.sys [?] S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:windowsMicrosoft.NETFrameworkv4.0.30319WPFWPFFontCache_v0400.exe [3/18/2010 1:16 PM 753504] S3 XDva346;XDva346;??c:windowssystem32XDva346.sys --> c:windowssystem32XDva346.sys [?] S3 XDva375;XDva375;??c:windowssystem32XDva375.sys --> c:windowssystem32XDva375.sys [?] S3 XDva390;XDva390;??c:windowssystem32XDva390.sys --> c:windowssystem32XDva390.sys [?] S3 XDva391;XDva391;??c:windowssystem32XDva391.sys --> c:windowssystem32XDva391.sys [?] S3 XDva392;XDva392;??c:windowssystem32XDva392.sys --> c:windowssystem32XDva392.sys [?] S3 XDva393;XDva393;??c:windowssystem32XDva393.sys --> c:windowssystem32XDva393.sys [?] S3 XDva394;XDva394;??c:windowssystem32XDva394.sys --> c:windowssystem32XDva394.sys [?] S3 XDva396;XDva396;??c:windowssystem32XDva396.sys --> c:windowssystem32XDva396.sys [?] S3 XDva397;XDva397;??c:windowssystem32XDva397.sys --> c:windowssystem32XDva397.sys [?] S4 AcuWVSSchedulerv7;Acunetix WVS Scheduler v7;e:acunetixWeb Vulnerability Scanner 7WVSScheduler7.exe [10/5/2011 12:12 PM 675976] S4 gupdate;Google Update Service (gupdate);c:program filesGoogleUpdateGoogleUpdate.exe [11/7/2010 10:05 PM 136176] S4 gupdatem;Google Update Service (gupdatem);c:program filesGoogleUpdateGoogleUpdate.exe [11/7/2010 10:05 PM 136176] S4 lxdu_device;lxdu_device;c:windowssystem32lxducoms.exe -service --> c:windowssystem32lxducoms.exe -service [?] S4 metasploitPostgreSQL;metasploitPostgreSQL;E:/METASP~1/POSTGR~1/bin/pg_ctl.exe runservice -N "metasploitPostgreSQL" -D "E:/METASP~1/POSTGR~1/data" --> E:/METASP~1/POSTGR~1/bin/pg_ctl.exe runservice -N metasploitPostgreSQL [?] S4 metasploitProSvc;Metasploit Pro Service;e:metasp~1rubybinrubyw.exe -C "e:metasp~1appsproengine" prosvc_service.rb -E production --> e:metasp~1rubybinrubyw.exe -C e:metasp~1appsproengine [?] S4 metasploitThin;Metasploit Thin Service;e:metasp~1rubybinrubyw.exe -C "e:metasp~1appsproui" thin_service.rb --> e:metasp~1rubybinrubyw.exe -C e:metasp~1appsproui [?] S4 npggsvc;nProtect GameGuard Service;c:windowssystem32GameMon.des -service --> c:windowssystem32GameMon.des -service [?] . Contents of the 'Scheduled Tasks' folder . 2012-06-19 c:windowsTasksGoogleUpdateTaskMachineCore.job - c:program filesGoogleUpdateGoogleUpdate.exe [2010-11-07 19:04] . 2012-06-19 c:windowsTasksGoogleUpdateTaskMachineUA.job - c:program filesGoogleUpdateGoogleUpdate.exe [2010-11-07 19:04] . 2012-06-18 c:windowsTasksGoogleUpdateTaskUserS-1-5-21-1220945662-1454471165-1417001333-1003Core.job - c:documents and settingsPCLocal SettingsApplication DataGoogleUpdateGoogleUpdate.exe [2011-06-23 06:23] . 2012-06-19 c:windowsTasksGoogleUpdateTaskUserS-1-5-21-1220945662-1454471165-1417001333-1003UA.job - c:documents and settingsPCLocal SettingsApplication DataGoogleUpdateGoogleUpdate.exe [2011-06-23 06:23] . 2012-06-19 c:windowsTasksRealUpgradeLogonTaskS-1-5-21-1220945662-1454471165-1417001333-1003.job - c:program filesRealRealUpgraderealupgrade.exe [2011-01-24 12:25] . 2012-06-14 c:windowsTasksRealUpgradeScheduledTaskS-1-5-21-1220945662-1454471165-1417001333-1003.job - c:program filesRealRealUpgraderealupgrade.exe [2011-01-24 12:25] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.google.bg/ IE: E&xport to Microsoft Excel - c:progra~1MICROS~2OFFICE11EXCEL.EXE/3000 IE: Search the Web - c:program filesSweetIMToolbarsInternet Explorerresourcesmenuext.html IE: {{c95fe080-8f5d-11d2-a20b-00aa003c157a} IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949} - c:documents and settingsPCStart MenuProgramsIMVURun IMVU.lnk Trusted Zone: clonewarsadventures.com Trusted Zone: freerealms.com Trusted Zone: soe.com Trusted Zone: sony.com Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:program filesCommon FilesAVG Secure SearchViProtocolInstaller10.2.0ViProtocol.dll FF - ProfilePath - c:documents and settingsPCApplication DataMozillaFirefoxProfileshmgv6f5i.default FF - prefs.js: keyword.URL - hxxp://isearch.avg.com/search?cid=%7B9c274838-28d4-4447-bd5b-3dba4d035b44%7D&mid=1be0d3cc5d5347d1a73fd1a9145f6c01-06050e277f64d1ccca6d2151ed49f9cb1323dc9e&ds=AVG&v=10.0.0.7&lang=en&pr=fr&d=2012-03-11%2010%3A04%3A25&sap=ku&q= . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2012-06-19 11:29 Windows 5.1.2600 Service Pack 3 NTFS . scanning hidden processes ... . scanning hidden autostart entries ... . scanning hidden files ... . scan completed successfully hidden files: 0 . ************************************************************************** . [HKEY_LOCAL_MACHINESystemControlSet001ServicesmetasploitPostgreSQL] "ImagePath"="E:/METASP~1/POSTGR~1/bin/pg_ctl.exe runservice -N "metasploitPostgreSQL" -D "E:/METASP~1/POSTGR~1/data"" . [HKEY_LOCAL_MACHINESystemControlSet001ServicesmetasploitPostgreSQL] "ImagePath"="E:/METASP~1/POSTGR~1/bin/pg_ctl.exe runservice -N "metasploitPostgreSQL" -D "E:/METASP~1/POSTGR~1/data"" . [HKEY_LOCAL_MACHINESystemControlSet001Servicesnpggsvc] "ImagePath"="c:windowssystem32GameMon.des -service" . Completion time: 2012-06-19 11:32:51 ComboFix-quarantined-files.txt 2012-06-19 08:32 ComboFix2.txt 2012-06-07 10:02 ComboFix3.txt 2012-06-06 17:40 . Pre-Run: 3,353,800,704 bytes free Post-Run: 3,436,777,472 bytes free . - - End Of File - - 919C0095C11B5715B4E733A021BEEA6D

Здравейте,

Това са последните бацили. Скоро приключваме:

• Отворете notepad и с copy/paste въведете следната информация:

  File::
  c:windowssystem32installserver.exe
  Registry::
  [HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionrun-]
  "HKCU"=-
  DDS::
  IE: Search the Web - c:program filesSweetIMToolbarsInternet Explorerresourcesmenuext.html
  IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949} - c:documents and settingsPCStart MenuProgramsIMVURun IMVU.lnk
  

• Запазете файла с име CFScript и го провлачете и пуснете в Combofix (както е показано на картинката отдолу).

  

• По време на сканиране от страна на ComboFix не стартирайте никакви други приложения, не натискайте клавиши от клавиатурата и не местете мишката !
• Публикувайте лог файла, който ще се създаде след рестарта на компютъра в следващия си пост.

ComboFix 12-06-16.02 - PC 06/19/2012 14:12:56.4.1 - x86 Microsoft Windows XP Professional 5.1.2600.3.1251.1.1033.18.958.588 [GMT 3:00] Running from: c:documents and settingsPCDesktopComboFix.exe Command switches used :: c:documents and settingsPCDesktopCFScript.txt AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D} . FILE :: "c:windowssystem32installserver.exe" . . ((((((((((((((((((((((((( Files Created from 2012-05-19 to 2012-06-19 ))))))))))))))))))))))))))))))) . . 2012-06-17 17:15 . 2012-06-17 16:28 258352 ----a-w- c:windowssystem32unicows.dll 2012-06-17 15:08 . 2012-06-17 15:31 -------- d-----w- c:documents and settingsPCAspire-CCNA 2012-06-17 15:06 . 2012-06-17 15:06 -------- d-----w- c:documents and settingsPCApplication DataCisco 2012-06-17 15:06 . 2012-06-17 15:06 -------- d-----w- c:documents and settingsAll UsersApplication DataCisco 2012-06-14 10:39 . 2012-06-14 10:39 -------- d-----w- c:documents and settingsPCApplication DataSoldat 2012-06-08 04:07 . 2012-06-08 04:06 73728 ----a-w- c:windowssystem32javacpl.cpl 2012-06-08 04:07 . 2012-06-08 04:06 476960 ----a-w- c:windowssystem32npdeployJava1.dll 2012-06-08 03:58 . 2008-09-24 18:41 839680 ----a-w- c:windowssystem32lameACM.acm 2012-06-08 03:58 . 2011-06-24 14:44 243200 ----a-w- c:windowssystem32xvidvfw.dll 2012-06-08 03:58 . 2011-06-24 14:28 650752 ----a-w- c:windowssystem32xvidcore.dll 2012-06-08 03:57 . 2011-12-21 17:14 151552 ----a-w- c:windowssystem32ac3acm.acm 2012-06-08 03:57 . 2012-05-15 18:00 79872 ----a-w- c:windowssystem32ff_vfw.dll 2012-06-08 03:49 . 2012-06-08 03:49 770384 ----a-w- c:program filesMozilla Firefoxmsvcr100.dll 2012-06-08 03:49 . 2012-06-08 03:49 421200 ----a-w- c:program filesMozilla Firefoxmsvcp100.dll 2012-06-07 12:41 . 2004-06-11 23:33 290304 ----a-w- C:subinacl.exe 2012-06-07 12:41 . 2012-06-07 12:41 -------- d-----w- C:Reg_Backup 2012-06-07 11:18 . 2012-06-07 13:03 181064 ----a-w- c:windowsPSEXESVC.EXE 2012-06-07 11:16 . 2012-06-07 13:03 -------- d-----w- C:Tweaking.com_Windows_Repair_Logs 2012-06-07 11:16 . 2012-06-07 11:16 -------- d-----w- c:program filesTweaking.com 2012-06-05 18:28 . 2012-06-05 18:28 -------- d-----w- c:program filesHitmanPro 2012-06-05 13:31 . 2012-06-05 13:31 -------- d-----w- c:program filesESET 2012-06-04 17:17 . 2012-06-04 17:18 -------- d-----w- c:documents and settingsAll UsersApplication DataHitmanPro 2012-05-24 04:54 . 2012-05-24 04:54 -------- d-----w- c:documents and settingsPCApplication DataLolClient2 . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-06-08 04:06 . 2010-11-05 08:07 472864 ----a-w- c:windowssystem32deployJava1.dll 2012-06-08 04:02 . 2012-04-17 10:17 419488 ----a-w- c:windowssystem32FlashPlayerApp.exe 2012-06-08 04:02 . 2011-09-18 17:59 70304 ----a-w- c:windowssystem32FlashPlayerCPLApp.cpl 2012-05-02 12:37 . 2010-11-09 13:46 836496 ----a-w- c:windowssystem32driversESLWireACD.sys 2012-04-04 12:56 . 2012-05-12 11:00 22344 ----a-w- c:windowssystem32driversmbam.sys 2012-03-26 21:45 . 2012-03-26 21:45 32768 ----a-w- c:windowssystem32driverstaphss.sys 2012-06-17 17:53 . 2011-08-30 06:13 85472 ----a-w- c:program filesmozilla firefoxcomponentsbrowsercomps.dll . . ((((((((((((((((((((((((((((( SnapShot@2012-06-06_17.35.34 ))))))))))))))))))))))))))))))))))))))))) . + 2007-11-06 22:19 . 2007-11-06 22:19 46592 c:windowsWinSxSx86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_11f3ea3amfc90kor.dll + 2007-11-06 22:19 . 2007-11-06 22:19 47104 c:windowsWinSxSx86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_11f3ea3amfc90jpn.dll + 2007-11-06 22:19 . 2007-11-06 22:19 59392 c:windowsWinSxSx86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_11f3ea3amfc90ita.dll + 2007-11-06 22:19 . 2007-11-06 22:19 60416 c:windowsWinSxSx86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_11f3ea3amfc90fra.dll + 2007-11-06 22:19 . 2007-11-06 22:19 59392 c:windowsWinSxSx86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_11f3ea3amfc90esp.dll + 2007-11-06 22:19 . 2007-11-06 22:19 59392 c:windowsWinSxSx86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_11f3ea3amfc90esn.dll + 2007-11-06 22:19 . 2007-11-06 22:19 54272 c:windowsWinSxSx86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_11f3ea3amfc90enu.dll + 2007-11-06 22:19 . 2007-11-06 22:19 60928 c:windowsWinSxSx86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_11f3ea3amfc90deu.dll + 2007-11-06 22:19 . 2007-11-06 22:19 41984 c:windowsWinSxSx86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_11f3ea3amfc90cht.dll + 2007-11-06 22:19 . 2007-11-06 22:19 41472 c:windowsWinSxSx86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_11f3ea3amfc90chs.dll + 2007-11-06 19:51 . 2007-11-06 19:51 59904 c:windowsWinSxSx86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_a173767amfcm90u.dll + 2007-11-06 19:51 . 2007-11-06 19:51 59904 c:windowsWinSxSx86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_a173767amfcm90.dll - 2008-04-14 09:00 . 2012-03-25 05:27 89038 c:windowssystem32perfc009.dat + 2008-04-14 09:00 . 2012-06-07 12:56 89038 c:windowssystem32perfc009.dat + 2011-03-16 09:46 . 2011-12-15 16:29 26624 c:windowssystem32driverstap0901.sys + 2007-11-06 22:19 . 2007-11-06 22:19 161784 c:windowsWinSxSx86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_312cf0e9atl90.dll + 2010-10-28 11:08 . 2011-03-02 10:43 175616 c:windowssystem32unrar.dll + 2008-04-14 09:00 . 2012-06-07 12:56 507726 c:windowssystem32perfh009.dat - 2008-04-14 09:00 . 2012-03-25 05:27 507726 c:windowssystem32perfh009.dat + 2012-06-08 04:02 . 2012-06-08 04:02 351904 c:windowssystem32MacromedFlashFlashUtil32_11_2_202_235_Plugin.exe + 2012-04-17 10:17 . 2012-06-08 04:02 257696 c:windowssystem32MacromedFlashFlashPlayerUpdateService.exe - 2012-02-25 18:34 . 2012-02-25 18:34 157472 c:windowssystem32javaws.exe + 2012-06-08 04:07 . 2012-06-08 04:06 157472 c:windowssystem32javaws.exe - 2012-02-25 18:34 . 2012-02-25 18:34 149280 c:windowssystem32javaw.exe + 2012-06-08 04:07 . 2012-06-08 04:06 149280 c:windowssystem32javaw.exe - 2012-02-25 18:34 . 2012-02-25 18:34 149280 c:windowssystem32java.exe + 2012-06-08 04:07 . 2012-06-08 04:06 149280 c:windowssystem32java.exe + 2010-10-28 12:25 . 2012-06-15 03:31 200144 c:windowssystem32FNTCACHE.DAT + 2012-06-13 09:16 . 2012-06-13 09:16 228352 c:windowsInstaller3b1016.msi + 2012-06-08 04:06 . 2012-06-08 04:06 900096 c:windowsInstaller274f23.msi - 2012-05-30 15:27 . 2012-05-30 15:27 371272 c:windowsInstaller{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}SkypeIcon.exe + 2012-06-07 17:21 . 2012-06-07 17:21 371272 c:windowsInstaller{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}SkypeIcon.exe + 2007-11-06 22:19 . 2007-11-06 22:19 1162744 c:windowsWinSxSx86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_a173767amfc90u.dll + 2007-11-06 22:19 . 2007-11-06 22:19 1156600 c:windowsWinSxSx86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_a173767amfc90.dll + 2012-06-08 04:02 . 2012-06-08 04:02 8797856 c:windowssystem32MacromedFlashNPSWF32_11_2_202_235.dll + 2012-06-07 17:21 . 2012-06-07 17:21 1648128 c:windowsInstallerea6da2.msi + 2012-06-19 10:02 . 2012-06-19 10:02 23771136 c:windowsInstaller1445864.msp . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionexplorershelliconoverlayidentifiers00avast] @="{472083B0-C522-11CF-8763-00608CC02F24}" [HKEY_CLASSES_ROOTCLSID{472083B0-C522-11CF-8763-00608CC02F24}] 2012-03-06 23:15 123536 ----a-w- c:program filesAVAST SoftwareAvastashShell.dll . [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun] "RTHDCPL"="RTHDCPL.EXE" [2010-09-03 19573352] "Adobe ARM"="c:program filesCommon FilesAdobeARM1.0AdobeARM.exe" [2010-09-21 932288] "TkBellExe"="c:program filesRealRealPlayerupdaterealsched.exe" [2011-03-06 273544] "avast"="c:program filesAVAST SoftwareAvastavastUI.exe" [2012-03-06 4241512] "Malwarebytes' Anti-Malware"="c:program filesMalwarebytes' Anti-Malwarembamgui.exe" [2012-04-04 462408] "SunJavaUpdateSched"="c:program filesCommon FilesJavaJava Updatejusched.exe" [2012-01-18 254696] . [HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun] "CTFMON.EXE"="c:windowssystem32CTFMON.EXE" [2008-04-14 15360] . [HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRunOnce] "RunNarrator"="Narrator.exe" [2008-04-14 53760] . [HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionpoliciessystem] "DisableClock"= 0 (0x0) "WRP"= 0 (0x0) . [HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregTkBellExe] 2011-03-06 08:10 273544 ----a-w- c:program filesRealRealPlayerUpdaterealsched.exe . [HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigservices] "WMPNetworkSvc"=3 (0x3) "wlidsvc"=2 (0x2) "WireHelpSvc"=2 (0x2) "Steam Client Service"=3 (0x3) "ScsiAccess"=2 (0x2) "SbieSvc"=2 (0x2) "PnkBstrB"=2 (0x2) "PnkBstrA"=2 (0x2) "ose"=3 (0x3) "npggsvc"=3 (0x3) "metasploitThin"=2 (0x2) "metasploitProSvc"=2 (0x2) "metasploitPostgreSQL"=2 (0x2) "lxdu_device"=2 (0x2) "JavaQuickStarterService"=2 (0x2) "idsvc"=3 (0x3) "gupdatem"=3 (0x3) "gupdate"=2 (0x2) "avast! Antivirus"=2 (0x2) "AcuWVSSchedulerv7"=2 (0x2) "vToolbarUpdater"=2 (0x2) . [HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionrun-] "Akamai NetSession Interface"="c:documents and settingsPCLocal SettingsApplication DataAkamainetsession_win.exe" "DAEMON Tools Lite"="c:program filesDAEMON Tools LiteDTLite.exe" -autorun . [HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionrun-] "Adobe Reader Speed Launcher"="c:program filesAdobeReader 9.0ReaderReader_sl.exe" "FixCamera"=c:windowsFixCamera.exe "0wl"=e:program filesWinLockProwinlock.exe . [HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList] "%windir%system32sessmgr.exe"= "c:Program FilesuTorrentuTorrent.exe"= "c:Program FilesSkypePhoneSkype.exe"= "c:Program FilesPando NetworksMedia BoosterPMB.exe"= "c:Program FilesWinampwinamp.exe"= "e:Counter-Strike 1.6 V43 [steam]hl.exe"= "e:soldat163Soldat.exe"= "c:Documents and SettingsAll UsersApplication DataNexonEUNGMNGM.exe"= "e:Aspire-CCNAbinaspire.exe"= "e:SteamsteamappscommonValveTestApp206500AirMech.exe"= "e:ArcticCombatSystemBattery.exe"= . R0 sptd;sptd;SystemRootSystemRootSystem32Driverssptd.sys --> SystemRootSystemRootSystem32Driverssptd.sys [?] R1 aswSnx;aswSnx;c:windowssystem32driversaswSnx.sys [4/27/2012 9:30 PM 612184] R1 aswSP;aswSP;c:windowssystem32driversaswSP.sys [4/27/2012 9:30 PM 337880] R2 aswFsBlk;aswFsBlk;c:windowssystem32driversaswFsBlk.sys [4/27/2012 9:30 PM 20696] R2 ESLWireAC;ESLWireAC;c:windowssystem32driversESLWireACD.sys [11/9/2010 4:46 PM 836496] R2 MBAMService;MBAMService;c:program filesMalwarebytes' Anti-Malwarembamservice.exe [5/12/2012 2:00 PM 654408] R2 npf;NetGroup Packet Filter Driver;c:windowssystem32driversnpf.sys [2/12/2011 12:23 AM 35088] R3 MBAMProtector;MBAMProtector;c:windowssystem32driversmbam.sys [5/12/2012 2:00 PM 22344] R3 RMSPPPOE;WAN Miniport (PPP over Ethernet Protocol);c:windowssystem32driversRMSPPPOE.SYS [9/3/2011 2:15 PM 31424] R3 tenCapture;tenCapture;c:windowssystem32driverstenCapture.sys [4/21/2007 5:15 PM 9344] R3 VCSVADHWSer;Avnex Virtual Audio Device (WDM);c:windowssystem32driversvcsvad.sys [3/28/2011 10:48 AM 17792] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:windowsMicrosoft.NETFrameworkv4.0.30319mscorsvw.exe [3/18/2010 1:16 PM 130384] S2 HiPatchService;Hi-Rez Studios Authenticate and Update Service;e:hi-rez studiosHiPatchService.exe [6/18/2012 10:18 PM 8704] S2 SkypeUpdate;Skype Updater;c:program filesSkypeUpdaterUpdater.exe [6/5/2012 3:17 PM 160944] S2 vToolbarUpdater10.2.0;vToolbarUpdater10.2.0;c:program filesCommon FilesAVG Secure SearchvToolbarUpdater10.2.0ToolbarUpdater.exe [3/13/2012 10:36 AM 918880] S3 1394hub;1394 Enabled Hub;c:windowssystem32svchost.exe -k netsvcs [4/14/2008 12:00 PM 14336] S3 Ambfilt;Ambfilt;c:windowssystem32driversAmbfilt.sys [10/28/2010 12:59 PM 1691480] S3 dgderdrv;dgderdrv;c:windowssystem32driversdgderdrv.sys --> c:windowssystem32driversdgderdrv.sys [?] S3 DIRECTIO;DIRECTIO;??c:program filesBurnInTestDirectIo.sys --> c:program filesBurnInTestDirectIo.sys [?] S3 dump_wmimmc;dump_wmimmc;??e:aeriagamesRepulseRepulseGameGuarddump_wmimmc.sys --> e:aeriagamesRepulseRepulseGameGuarddump_wmimmc.sys [?] S3 EagleXNt;EagleXNt;??c:windowssystem32driversEagleXNt.sys --> c:windowssystem32driversEagleXNt.sys [?] S3 ESLvnic1;ESLvnic Virtual Network 32 Bit;c:windowssystem32driversESLvnic.sys [11/9/2010 4:46 PM 24504] S3 FsUsbExDisk;FsUsbExDisk;c:windowssystem32FsUsbExDisk.Sys [2/18/2012 7:21 PM 36608] S3 GGSAFERDriver;GGSAFER Driver;??e:garena classicsafedrv.sys --> e:garena classicsafedrv.sys [?] S3 MozillaMaintenance;Mozilla Maintenance Service;c:program filesMozilla Maintenance Servicemaintenanceservice.exe [4/27/2012 4:23 PM 113120] S3 PSEXESVC;PsExec;c:windowsPSEXESVC.EXE [6/7/2012 2:18 PM 181064] S3 SCREAMINGBDRIVER;Screaming Bee Audio;c:windowssystem32driversScreamingBAudio.sys [12/1/2009 4:49 PM 34384] S3 teamviewervpn;TeamViewer VPN Adapter;c:windowssystem32driversteamviewervpn.sys [3/30/2011 2:05 PM 25088] S3 VBoxNetFlt;VBoxNetFlt Service;c:windowssystem32DRIVERSVBoxNetFlt.sys --> c:windowssystem32DRIVERSVBoxNetFlt.sys [?] S3 vproiah;vproiah;c:windowssystem32DRIVERSvproiah.sys --> c:windowssystem32DRIVERSvproiah.sys [?] S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:windowsMicrosoft.NETFrameworkv4.0.30319WPFWPFFontCache_v0400.exe [3/18/2010 1:16 PM 753504] S3 XDva346;XDva346;??c:windowssystem32XDva346.sys --> c:windowssystem32XDva346.sys [?] S3 XDva375;XDva375;??c:windowssystem32XDva375.sys --> c:windowssystem32XDva375.sys [?] S3 XDva390;XDva390;??c:windowssystem32XDva390.sys --> c:windowssystem32XDva390.sys [?] S3 XDva391;XDva391;??c:windowssystem32XDva391.sys --> c:windowssystem32XDva391.sys [?] S3 XDva392;XDva392;??c:windowssystem32XDva392.sys --> c:windowssystem32XDva392.sys [?] S3 XDva393;XDva393;??c:windowssystem32XDva393.sys --> c:windowssystem32XDva393.sys [?] S3 XDva394;XDva394;??c:windowssystem32XDva394.sys --> c:windowssystem32XDva394.sys [?] S3 XDva396;XDva396;??c:windowssystem32XDva396.sys --> c:windowssystem32XDva396.sys [?] S3 XDva397;XDva397;??c:windowssystem32XDva397.sys --> c:windowssystem32XDva397.sys [?] S4 AcuWVSSchedulerv7;Acunetix WVS Scheduler v7;e:acunetixWeb Vulnerability Scanner 7WVSScheduler7.exe [10/5/2011 12:12 PM 675976] S4 gupdate;Google Update Service (gupdate);c:program filesGoogleUpdateGoogleUpdate.exe [11/7/2010 10:05 PM 136176] S4 gupdatem;Google Update Service (gupdatem);c:program filesGoogleUpdateGoogleUpdate.exe [11/7/2010 10:05 PM 136176] S4 lxdu_device;lxdu_device;c:windowssystem32lxducoms.exe -service --> c:windowssystem32lxducoms.exe -service [?] S4 metasploitPostgreSQL;metasploitPostgreSQL;E:/METASP~1/POSTGR~1/bin/pg_ctl.exe runservice -N "metasploitPostgreSQL" -D "E:/METASP~1/POSTGR~1/data" --> E:/METASP~1/POSTGR~1/bin/pg_ctl.exe runservice -N metasploitPostgreSQL [?] S4 metasploitProSvc;Metasploit Pro Service;e:metasp~1rubybinrubyw.exe -C "e:metasp~1appsproengine" prosvc_service.rb -E production --> e:metasp~1rubybinrubyw.exe -C e:metasp~1appsproengine [?] S4 metasploitThin;Metasploit Thin Service;e:metasp~1rubybinrubyw.exe -C "e:metasp~1appsproui" thin_service.rb --> e:metasp~1rubybinrubyw.exe -C e:metasp~1appsproui [?] S4 npggsvc;nProtect GameGuard Service;c:windowssystem32GameMon.des -service --> c:windowssystem32GameMon.des -service [?] . Contents of the 'Scheduled Tasks' folder . 2012-06-19 c:windowsTasksGoogleUpdateTaskMachineCore.job - c:program filesGoogleUpdateGoogleUpdate.exe [2010-11-07 19:04] . 2012-06-19 c:windowsTasksGoogleUpdateTaskMachineUA.job - c:program filesGoogleUpdateGoogleUpdate.exe [2010-11-07 19:04] . 2012-06-18 c:windowsTasksGoogleUpdateTaskUserS-1-5-21-1220945662-1454471165-1417001333-1003Core.job - c:documents and settingsPCLocal SettingsApplication DataGoogleUpdateGoogleUpdate.exe [2011-06-23 06:23] . 2012-06-19 c:windowsTasksGoogleUpdateTaskUserS-1-5-21-1220945662-1454471165-1417001333-1003UA.job - c:documents and settingsPCLocal SettingsApplication DataGoogleUpdateGoogleUpdate.exe [2011-06-23 06:23] . 2012-06-19 c:windowsTasksRealUpgradeLogonTaskS-1-5-21-1220945662-1454471165-1417001333-1003.job - c:program filesRealRealUpgraderealupgrade.exe [2011-01-24 12:25] . 2012-06-14 c:windowsTasksRealUpgradeScheduledTaskS-1-5-21-1220945662-1454471165-1417001333-1003.job - c:program filesRealRealUpgraderealupgrade.exe [2011-01-24 12:25] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.google.bg/ IE: E&xport to Microsoft Excel - c:progra~1MICROS~2OFFICE11EXCEL.EXE/3000 IE: {{c95fe080-8f5d-11d2-a20b-00aa003c157a} IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949} - c:documents and settingsPCStart MenuProgramsIMVURun IMVU.lnk Trusted Zone: clonewarsadventures.com Trusted Zone: freerealms.com Trusted Zone: soe.com Trusted Zone: sony.com Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:program filesCommon FilesAVG Secure SearchViProtocolInstaller10.2.0ViProtocol.dll FF - ProfilePath - c:documents and settingsPCApplication DataMozillaFirefoxProfileshmgv6f5i.default FF - prefs.js: keyword.URL - hxxp://isearch.avg.com/search?cid=%7B9c274838-28d4-4447-bd5b-3dba4d035b44%7D&mid=1be0d3cc5d5347d1a73fd1a9145f6c01-06050e277f64d1ccca6d2151ed49f9cb1323dc9e&ds=AVG&v=10.0.0.7&lang=en&pr=fr&d=2012-03-11%2010%3A04%3A25&sap=ku&q= . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2012-06-19 14:23 Windows 5.1.2600 Service Pack 3 NTFS . scanning hidden processes ... . scanning hidden autostart entries ... . scanning hidden files ... . scan completed successfully hidden files: 0 . ************************************************************************** . [HKEY_LOCAL_MACHINESystemControlSet001ServicesmetasploitPostgreSQL] "ImagePath"="E:/METASP~1/POSTGR~1/bin/pg_ctl.exe runservice -N "metasploitPostgreSQL" -D "E:/METASP~1/POSTGR~1/data"" . [HKEY_LOCAL_MACHINESystemControlSet001ServicesmetasploitPostgreSQL] "ImagePath"="E:/METASP~1/POSTGR~1/bin/pg_ctl.exe runservice -N "metasploitPostgreSQL" -D "E:/METASP~1/POSTGR~1/data"" . [HKEY_LOCAL_MACHINESystemControlSet001Servicesnpggsvc] "ImagePath"="c:windowssystem32GameMon.des -service" . --------------------- DLLs Loaded Under Running Processes --------------------- . - - - - - - - > 'explorer.exe'(3720) c:windowssystem32msi.dll c:windowssystem32ieframe.dll c:windowssystem32OneX.DLL c:windowssystem32eappprxy.dll c:windowssystem32wpdshserviceobj.dll c:windowssystem32portabledevicetypes.dll c:windowssystem32webcheck.dll c:windowssystem32portabledeviceapi.dll . Completion time: 2012-06-19 14:27:00 ComboFix-quarantined-files.txt 2012-06-19 11:26 ComboFix2.txt 2012-06-19 08:32 ComboFix3.txt 2012-06-07 10:02 ComboFix4.txt 2012-06-06 17:40 . Pre-Run: 3,358,883,840 bytes free Post-Run: 3,351,035,904 bytes free . - - End Of File - - 6E965735CD528F5B043D5C7451FBB1D7

Така, мисля че сме готови.

Изтеглете нова версия на Combofix.exe (изтрийте вашата първо) и я запазете на десктопа.

Деинсталирайте Combofix:

Натиснете Start => Run => въведете Combofix /Uninstall (има празно място между Combofix и /Uninstall) и натиснете Enter.

Стартирайте OTL още веднъж и натиснете бутона CleanUp.

Ако бъдете подканени да рестартирате, се съгласете.

Изтрийте ръчно всички инструменти и логове, които не са се изтрили при гореспоменатите процедури.

Деинсталирайте и Eset Online Scanner.

За всеки случай обновете антивирусната си и направете пълна проверка на системата си и сменете всички използвани пароли (защото може да са били компрометирани).

Поздрави и безопасно сърфиране!

DDS: DDS (Ver_2011-09-30.01) - NTFS_x86 Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_33 Run by PC at 6:57:11 on 2012-07-02 Microsoft Windows XP Professional 5.1.2600.3.1251.1.1033.18.958.163 [GMT 3:00] . AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D} . ============== Running Processes ================ . C:Program FilesAVAST SoftwareAvastAvastSvc.exe C:WINDOWSsystem32spoolsv.exe C:WINDOWSExplorer.EXE C:WINDOWSRTHDCPL.EXE C:Program FilesFirebirdFirebird_1_5binfbguard.exe C:Program FilesRealRealPlayerupdaterealsched.exe C:Program FilesAVAST SoftwareAvastavastUI.exe C:Program FilesCommon FilesJavaJava Updatejusched.exe C:WINDOWSsystem32ctfmon.exe C:Program FilesJavajre6binjqs.exe C:Program FilesMalwarebytes' Anti-Malwarembamservice.exe C:Program FilesCommon FilesWireHelpSvc.exe C:Program FilesFirebirdFirebird_1_5binfbserver.exe C:WINDOWSSystem32alg.exe C:WINDOWSsystem32taskmgr.exe C:Program FilesMozilla Firefoxfirefox.exe C:WINDOWSsystem32wuauclt.exe C:Program FilesMozilla Firefoxplugin-container.exe C:WINDOWSsystem32wscntfy.exe C:WINDOWSsystem32wbemwmiprvse.exe C:WINDOWSsystem32svchost.exe -k DcomLaunch C:WINDOWSsystem32svchost.exe -k rpcss C:WINDOWSSystem32svchost.exe -k netsvcs C:WINDOWSsystem32svchost.exe -k WudfServiceGroup C:WINDOWSsystem32svchost.exe -k NetworkService C:WINDOWSsystem32svchost.exe -k LocalService C:WINDOWSsystem32svchost.exe -k LocalService C:WINDOWSsystem32svchost.exe -k imgsvc . ============== Pseudo HJT Report =============== . uStart Page = hxxp://www.google.bg/ BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:program filescommon filesadobeacrobatactivexAcroIEHelperShim.dll BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:program filesjavajre6binssv.dll BHO: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - c:program filesavast softwareavastaswWebRepIE.dll BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:program filesjavajre6binjp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - c:program filesjavajre6libdeployjqsiejqs_plugin.dll BHO: SMTTB2009 Class: {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - c:program filesclip extractor db toolbartbcore3.dll TB: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - c:program filesavast softwareavastaswWebRepIE.dll uRun: [ctfmon.exe] c:windowssystem32ctfmon.exe mRun: [RTHDCPL] RTHDCPL.EXE mRun: [Adobe ARM] "c:program filescommon filesadobearm1.0AdobeARM.exe" mRun: [TkBellExe] "c:program filesrealrealplayerupdaterealsched.exe" -osboot mRun: [avast] "c:program filesavast softwareavastavastUI.exe" /nogui mRun: [Malwarebytes' Anti-Malware] "c:program filesmalwarebytes' anti-malwarembamgui.exe" /starttray mRun: [sunJavaUpdateSched] "c:program filescommon filesjavajava updatejusched.exe" dRun: [CTFMON.EXE] c:windowssystem32CTFMON.EXE dRunOnce: [RunNarrator] Narrator.exe uPolicies-Explorer: NoDriveTypeAutoRun = dword:323 uPolicies-Explorer: NoDesktopUpdate = dword:0 uPolicies-Explorer: NoDriveAutoRun = dword:67108863 uPolicies-System: DisableClock = dword:0 uPolicies-System: WRP = dword:0 mPolicies-Explorer: NoDriveAutoRun = dword:67108863 mPolicies-Explorer: NoDriveTypeAutoRun = dword:323 mPolicies-Explorer: NoDriveTypeAutoRun = dword:323 mPolicies-Explorer: NoDriveAutoRun = dword:67108863 IE: E&xport to Microsoft Excel - c:progra~1micros~2office11EXCEL.EXE/3000 IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} IE: {d9288080-1baa-4bc4-9cf8-a92d743db949} - c:documents and settingspcstart menuprogramsimvuRun IMVU.lnk IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%Network Diagnosticxpnetdiag.exe . INFO: HKCU has more than 50 listed domains. If you wish to scan all of them, select the 'Force scan all domains' option. . DPF: {33564D57-0000-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab TCP: Interfaces{900F7AB6-F869-467C-8A12-A606541E2FD8} : NameServer = 83.222.173.98 89.215.246.40 Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:program filescommon filesskypeSkype4COM.dll Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:program filescommon filesavg secure searchviprotocolinstaller10.2.0ViProtocol.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:windowssystem32wpdshserviceobj.dll . ================= FIREFOX =================== . FF - ProfilePath - c:documents and settingspcapplication datamozillafirefoxprofileshmgv6f5i.default FF - prefs.js: keyword.URL - hxxp://isearch.avg.com/search?cid=%7B9c274838-28d4-4447-bd5b-3dba4d035b44%7D&mid=1be0d3cc5d5347d1a73fd1a9145f6c01-06050e277f64d1ccca6d2151ed49f9cb1323dc9e&ds=AVG&v=10.0.0.7&lang=en&pr=fr&d=2012-03-11%2010%3A04%3A25&sap=ku&q= FF - plugin: c:docume~1pcapplic~1powerc~1nppowerloader.dll FF - plugin: c:documents and settingsall usersapplication datanexoneungmnpNxGameeu.dll FF - plugin: c:documents and settingsall usersapplication datarealrealplayerbrowserrecordpluginmozillapluginsnprphtml5videoshim.dll FF - plugin: c:documents and settingspcapplication datamozillafirefoxprofileshmgv6f5i.defaultextensionsbattlefieldheroespatcher@ea.compluginsnpBFHUpdater.dll FF - plugin: c:documents and settingspcapplication datamozillafirefoxprofileshmgv6f5i.defaultextensionsbattlefieldplay4free@ea.compluginsnpBP4FUpdater.dll FF - plugin: c:documents and settingspcapplication datamozillafirefoxprofileshmgv6f5i.defaultextensionsnpretoxlive@live.heroesandgenerals.compluginsnpretoxlive.dll FF - plugin: c:documents and settingspclocal settingsapplication datagoogleupdate1.3.21.111npGoogleUpdate3.dll FF - plugin: c:documents and settingspclocal settingsapplication dataunitywebplayerloadernpUnity3D32.dll FF - plugin: c:program filesgoogleupdate1.3.21.111npGoogleUpdate3.dll FF - plugin: c:program filesjavajre6binplugin2npjp2.dll FF - plugin: c:program filesmicrosoft silverlight5.1.10411.0npctrlui.dll FF - plugin: c:program filesmozilla firefoxpluginsnpBFPlugin.dll FF - plugin: c:program filesmozilla firefoxpluginsnpganymedenet.dll FF - plugin: c:program filesmozilla firefoxpluginsNPOFFICE.DLL FF - plugin: c:program filesmozilla firefoxpluginsnppdf32.dll FF - plugin: c:program filesmozilla firefoxpluginsnppl3260.dll FF - plugin: c:program filesmozilla firefoxpluginsnprjplug.dll FF - plugin: c:program filesmozilla firefoxpluginsnprpjplug.dll FF - plugin: c:program filespando networksmedia boosternpPandoWebPlugin.dll FF - plugin: c:program fileswebzenbrowserextensionNPWZCmnCtrl.dll FF - plugin: c:windowssystem32macromedflashNPSWF32_11_2_202_235.dll FF - plugin: c:windowssystem32npdeployJava1.dll FF - plugin: c:windowssystem32npOGPPlugin.dll FF - plugin: c:windowssystem32npptools.dll . ============= SERVICES / DRIVERS =============== . R1 aswSnx;aswSnx;c:windowssystem32driversaswSnx.sys [2012-4-27 721000] R1 aswSP;aswSP;c:windowssystem32driversaswSP.sys [2012-4-27 353688] R2 aswFsBlk;aswFsBlk;c:windowssystem32driversaswFsBlk.sys [2012-4-27 21256] R2 avast! Antivirus;avast! Antivirus;c:program filesavast softwareavastAvastSvc.exe [2012-4-27 44808] R2 ESLWireAC;ESLWireAC;c:windowssystem32driversESLWireACD.sys [2010-11-9 836496] R2 FirebirdGuardianDefaultInstance;Firebird Guardian - DefaultInstance;c:program filesfirebirdfirebird_1_5binfbguard.exe -s --> c:program filesfirebirdfirebird_1_5binfbguard.exe -s [?] R2 MBAMService;MBAMService;c:program filesmalwarebytes' anti-malwarembamservice.exe [2012-5-12 654408] R2 WireHelpSvc;WireHelpSvc;c:program filescommon filesWireHelpSvc.exe [2012-6-21 265120] R3 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance;c:program filesfirebirdfirebird_1_5binfbserver.exe -s --> c:program filesfirebirdfirebird_1_5binfbserver.exe -s [?] R3 MBAMProtector;MBAMProtector;c:windowssystem32driversmbam.sys [2012-5-12 22344] R3 RMSPPPOE;WAN Miniport (PPP over Ethernet Protocol);c:windowssystem32driversRMSPPPOE.SYS [2011-9-3 31424] R3 tenCapture;tenCapture;c:windowssystem32driverstenCapture.sys [2007-4-21 9344] R3 VCSVADHWSer;Avnex Virtual Audio Device (WDM);c:windowssystem32driversvcsvad.sys [2011-3-28 17792] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:windowsmicrosoft.netframeworkv4.0.30319mscorsvw.exe [2010-3-18 130384] S2 SkypeUpdate;Skype Updater;c:program filesskypeupdaterUpdater.exe [2012-6-7 160944] S2 vToolbarUpdater10.2.0;vToolbarUpdater10.2.0;c:program filescommon filesavg secure searchvtoolbarupdater10.2.0ToolbarUpdater.exe [2012-3-13 918880] S3 1394hub;1394 Enabled Hub;c:windowssystem32svchost.exe -k netsvcs [2008-4-14 14336] S3 Ambfilt;Ambfilt;c:windowssystem32driversAmbfilt.sys [2010-10-28 1691480] S3 dgderdrv;dgderdrv;c:windowssystem32driversdgderdrv.sys --> c:windowssystem32driversdgderdrv.sys [?] S3 DIRECTIO;DIRECTIO;??c:program filesburnintestdirectio.sys --> c:program filesburnintestDirectIo.sys [?] S3 dump_wmimmc;dump_wmimmc;??e:aeriagamesrepulserepulsegameguarddump_wmimmc.sys --> e:aeriagamesrepulserepulsegameguarddump_wmimmc.sys [?] S3 EagleXNt;EagleXNt;??c:windowssystem32driverseaglexnt.sys --> c:windowssystem32driversEagleXNt.sys [?] S3 ESLvnic1;ESLvnic Virtual Network 32 Bit;c:windowssystem32driversESLvnic.sys [2010-11-9 24504] S3 FsUsbExDisk;FsUsbExDisk;c:windowssystem32FsUsbExDisk.Sys [2012-2-18 36608] S3 GGSAFERDriver;GGSAFER Driver;??e:garena classicsafedrv.sys --> e:garena classicsafedrv.sys [?] S3 MozillaMaintenance;Mozilla Maintenance Service;c:program filesmozilla maintenance servicemaintenanceservice.exe [2012-4-27 113120] S3 NPF;NetGroup Packet Filter Driver;c:windowssystem32driversnpf.sys [2011-2-12 35088] S3 OverwolfUpdaterService;Overwolf Updater Service;c:program filesoverwolfOverwolfUpdater.exe [2012-6-21 18360] S3 SCREAMINGBDRIVER;Screaming Bee Audio;c:windowssystem32driversScreamingBAudio.sys [2009-12-1 34384] S3 teamviewervpn;TeamViewer VPN Adapter;c:windowssystem32driversteamviewervpn.sys [2011-3-30 25088] S3 VBoxNetFlt;VBoxNetFlt Service;c:windowssystem32driversvboxnetflt.sys --> c:windowssystem32driversVBoxNetFlt.sys [?] S3 vproiah;vproiah;c:windowssystem32driversvproiah.sys --> c:windowssystem32driversvproiah.sys [?] S3 vtany;vtany;??c:windowsvtany.sys --> c:windowsvtany.sys [?] S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:windowsmicrosoft.netframeworkv4.0.30319wpfWPFFontCache_v0400.exe [2010-3-18 753504] S3 XDva346;XDva346;??c:windowssystem32xdva346.sys --> c:windowssystem32XDva346.sys [?] S3 XDva375;XDva375;??c:windowssystem32xdva375.sys --> c:windowssystem32XDva375.sys [?] S3 XDva390;XDva390;??c:windowssystem32xdva390.sys --> c:windowssystem32XDva390.sys [?] S3 XDva391;XDva391;??c:windowssystem32xdva391.sys --> c:windowssystem32XDva391.sys [?] S3 XDva392;XDva392;??c:windowssystem32xdva392.sys --> c:windowssystem32XDva392.sys [?] S3 XDva393;XDva393;??c:windowssystem32xdva393.sys --> c:windowssystem32XDva393.sys [?] S3 XDva394;XDva394;??c:windowssystem32xdva394.sys --> c:windowssystem32XDva394.sys [?] S3 XDva396;XDva396;??c:windowssystem32xdva396.sys --> c:windowssystem32XDva396.sys [?] S3 XDva397;XDva397;??c:windowssystem32xdva397.sys --> c:windowssystem32XDva397.sys [?] S3 xhunter1;xhunter1;??c:windowsxhunter1.sys --> c:windowsxhunter1.sys [?] S3 xsherlock;xsherlock;c:windowssystem32xsherlock.xem [2012-6-21 670816] S4 AcuWVSSchedulerv7;Acunetix WVS Scheduler v7;e:acunetixweb vulnerability scanner 7WVSScheduler7.exe [2011-10-5 675976] S4 gupdate;Google Update Service (gupdate);c:program filesgoogleupdateGoogleUpdate.exe [2010-11-7 136176] S4 gupdatem;Google Update Service (gupdatem);c:program filesgoogleupdateGoogleUpdate.exe [2010-11-7 136176] S4 lxdu_device;lxdu_device;c:windowssystem32lxducoms.exe -service --> c:windowssystem32lxducoms.exe -service [?] S4 metasploitPostgreSQL;metasploitPostgreSQL;E:/METASP~1/POSTGR~1/bin/pg_ctl.exe runservice -N "metasploitPostgreSQL" -D "E:/METASP~1/POSTGR~1/data" --> E:/METASP~1/POSTGR~1/bin/pg_ctl.exe runservice -N metasploitPostgreSQL [?] S4 metasploitProSvc;Metasploit Pro Service;e:metasp~1rubybinrubyw.exe -c "e:metasp~1appsproengine" prosvc_service.rb -e production --> e:metasp~1rubybinrubyw.exe -c e:metasp~1appsproengine [?] S4 metasploitThin;Metasploit Thin Service;e:metasp~1rubybinrubyw.exe -c "e:metasp~1appsproui" thin_service.rb --> e:metasp~1rubybinrubyw.exe -c e:metasp~1appsproui [?] S4 npggsvc;nProtect GameGuard Service;c:windowssystem32gamemon.des -service --> c:windowssystem32GameMon.des -service [?] . =============== File Associations =============== . ShellExec: Seismovision3.exe: Open Seismovision="e:seismovision 3Seismovision3.exe" . =============== Created Last 30 ================ . 2012-06-28 08:04:50 -------- d-----w- c:documents and settingsall usersapplication dataOverwolf 2012-06-28 06:26:16 -------- d-----w- C:vcs5BGEffects 2012-06-26 13:19:26 -------- d-----w- c:documents and settingspclocal settingsapplication dataMixxx 2012-06-25 10:29:16 356437 ----a-w- c:windowssystem32GDS32.DLL 2012-06-25 10:00:01 -------- d-----w- c:documents and settingsall usersapplication datafirebird 2012-06-25 09:59:59 -------- d-----w- c:documents and settingspclocal settingsapplication dataSpacialAudio 2012-06-25 09:56:16 -------- d-----w- c:program filesFirebird 2012-06-23 10:59:17 -------- d-----w- c:documents and settingspcapplication dataToolbar4 2012-06-22 16:51:36 -------- d-----w- c:program filesgamigo 2012-06-22 07:19:32 73728 ----a-w- c:windowssystem32javacpl.cpl 2012-06-22 05:05:40 -------- d-----w- c:documents and settingspclocal settingsapplication dataVitalwerks 2012-06-22 05:05:17 -------- d-----w- c:program filesNo-IP 2012-06-21 16:23:31 670816 ----a-w- c:windowssystem32xsherlock.xem 2012-06-21 15:31:55 -------- d-----w- c:program filescommon filesOverwolf 2012-06-21 15:31:50 -------- d-----w- c:program filesOverwolf 2012-06-21 15:29:13 -------- d-----w- c:documents and settingspclocal settingsapplication dataOverwolf 2012-06-21 15:29:03 -------- d-----w- c:windowsDEA314C409294250BC9298E4C105F28D.TMP 2012-06-21 10:15:08 61493 ----a-w- c:windowssystem32MFCN42D.DLL 2012-06-21 10:15:08 434252 ----a-w- c:windowssystem32MSVCRTD.DLL 2012-06-21 10:15:07 962612 ----a-w- c:windowssystem32MFC42D.DLL 2012-06-21 10:15:02 77824 ----a-w- c:windowssystem32nmapwin.exe 2012-06-21 10:15:02 452096 ----a-w- c:windowssystem32nmap.exe 2012-06-21 10:15:02 290816 ----a-w- c:windowssystem32nmapserv.exe 2012-06-21 10:15:02 192 ----a-w- c:windowssystem32nmap_performance.reg 2012-06-21 06:12:29 265120 ----a-w- c:program filescommon filesWireHelpSvc.exe 2012-06-20 09:34:10 -------- d-----w- c:documents and settingspclocal settingsapplication dataHeroes and Generals 2012-06-17 17:15:47 258352 ----a-w- c:windowssystem32unicows.dll 2012-06-17 15:08:46 -------- d-----w- c:documents and settingspcAspire-CCNA 2012-06-17 15:06:59 -------- d-----w- c:documents and settingspcapplication dataCisco 2012-06-17 15:06:59 -------- d-----w- c:documents and settingsall usersapplication dataCisco 2012-06-14 10:39:21 -------- d-----w- c:documents and settingspcapplication dataSoldat 2012-06-11 09:59:06 768848 ----a-w- c:windowssystem32msvcr100.dll 2012-06-11 09:59:06 421200 ----a-w- c:windowssystem32msvcp100.dll 2012-06-08 04:07:01 476936 ----a-w- c:windowssystem32npdeployJava1.dll 2012-06-08 03:58:01 839680 ----a-w- c:windowssystem32lameACM.acm 2012-06-08 03:58:00 650752 ----a-w- c:windowssystem32xvidcore.dll 2012-06-08 03:58:00 243200 ----a-w- c:windowssystem32xvidvfw.dll 2012-06-08 03:57:50 151552 ----a-w- c:windowssystem32ac3acm.acm 2012-06-08 03:57:41 79872 ----a-w- c:windowssystem32ff_vfw.dll 2012-06-08 03:49:18 770384 ----a-w- c:program filesmozilla firefoxmsvcr100.dll 2012-06-08 03:49:18 421200 ----a-w- c:program filesmozilla firefoxmsvcp100.dll 2012-06-07 12:52:41 -------- d--h--w- c:program filesWindowsUpdate 2012-06-07 12:41:58 290304 ----a-w- C:subinacl.exe 2012-06-07 12:41:21 -------- d-----w- C:Reg_Backup 2012-06-07 11:16:35 -------- d-----w- C:Tweaking.com_Windows_Repair_Logs 2012-06-07 11:16:27 -------- d-----w- c:program filesTweaking.com 2012-06-06 17:18:34 -------- d-sha-r- C:cmdcons 2012-06-05 18:28:08 -------- d-----w- c:program filesHitmanPro 2012-06-04 17:17:43 -------- d-----w- c:documents and settingsall usersapplication dataHitmanPro . ==================== Find3M ==================== . 2012-06-28 12:52:37 721000 ----a-w- c:windowssystem32driversaswSnx.sys 2012-06-28 12:52:20 41224 ----a-w- c:windowsavastSS.scr 2012-06-08 04:02:20 70304 ----a-w- c:windowssystem32FlashPlayerCPLApp.cpl 2012-06-08 04:02:20 419488 ----a-w- c:windowssystem32FlashPlayerApp.exe 2012-06-02 12:19:44 22040 ----a-w- c:windowssystem32wucltui.dll.mui 2012-06-02 12:19:38 219160 ----a-w- c:windowssystem32wuaucpl.cpl 2012-06-02 12:19:38 15384 ----a-w- c:windowssystem32wuaucpl.cpl.mui 2012-06-02 12:19:34 15384 ----a-w- c:windowssystem32wuapi.dll.mui 2012-06-02 12:19:30 17944 ----a-w- c:windowssystem32wuaueng.dll.mui 2012-05-09 09:21:36 472840 ----a-w- c:windowssystem32deployJava1.dll 2012-05-02 12:37:56 836496 ----a-w- c:windowssystem32driversESLWireACD.sys 2012-04-04 12:56:40 22344 ----a-w- c:windowssystem32driversmbam.sys . ============= FINISH: 6:58:10.89 =============== Attach: . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2011-09-30.01) . Microsoft Windows XP Professional Boot Device: DeviceHarddiskVolume1 Install Date: 5/7/2005 6:24:05 PM System Uptime: 7/2/2012 6:49:13 AM (0 hours ago) . Motherboard: | | NF-MCP61 Processor: AMD Sempron Processor 3200+ | Socket M2 | 1808/201mhz . ==== Disk Partitions ========================= . A: is Removable C: is FIXED (NTFS) - 24 GiB total, 6.281 GiB free. D: is FIXED (NTFS) - 73 GiB total, 7.119 GiB free. E: is FIXED (NTFS) - 135 GiB total, 9.884 GiB free. F: is CDROM () G: is CDROM () . ==== Disabled Device Manager Items ============= . Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318} Description: RAS Async Adapter Device ID: ROOTSW&{EEAB7790-C514-11D1-B42B-00805FC1270E}0000 Manufacturer: Microsoft Name: RAS Async Adapter PNP Device ID: ROOTSW&{EEAB7790-C514-11D1-B42B-00805FC1270E}0000 Service: AsyncMac . ==== System Restore Points =================== . RP2: 7/1/2012 10:16:01 PM - Контролна точка на системата . ==== Installed Programs ====================== . ABBYY FineReader 6.0 Sprint Acunetix Web Vulnerability Scanner 7.0 Adobe After Effects 6.0 Adobe AIR Adobe Flash Player 10 ActiveX Adobe Flash Player 11 Plugin Adobe Reader 9.2 - Bulgarian Adobe Shockwave Player 11.6 AirMech Anno 1404 Arctic Combat_V12.0525 Army Rage version 1.0.199 Ashampoo Burning Studio 10.0.1 ASIO4ALL Aspire-CCNA AutoIt v3.3.8.1 AV Voice Changer Software DIAMOND 6.0 avast! Free Antivirus Bandisoft MPEG-1 Decoder Battlefield Heroes Battlefield Play4Free BattleForge™ BlackShot Brawl Busters Bulgarian Phonetic Carte 0.10.1 Cheat Engine 6.1 Clip Extractor 3.1.0.0 CoH Subscriber Beta Command & Conquer Generals Company of Heroes - FAKEMSI Company of Heroes - Opposing Fronts ConvertHelper 2.2 Counter-Strike 1.6 V42 [steam] Counter-Strike 1.6: New Era DAEMON Tools Lite Dungeons & Dragons Online ®: Eberron Unlimited ™ v01.17.01.801 Eligium ESL Wire 1.12.1 FIFA MANAGER 12 Firebird 1.5.2.4731 FL Studio 10 FormatFactory 2.50 GatesOfAndaron US 3.6.52 GOM Player Google Chrome Google Update Helper Hardcore Havij 1.15 Free Hospital Haste Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595) Hotfix for Windows Media Format 11 SDK (KB929399) Hotfix for Windows Media Player 11 (KB939683) Hotfix for Windows XP (KB2570791) Hotfix for Windows XP (KB942288-v3) Hotfix for Windows XP (KB954550-v5) Hotfix for Windows XP (KB970653-v3) Java Auto Updater Java 6 Update 33 K-Lite Mega Codec Pack 8.8.0 Knights Of Honor KVIrc League of Legends LG PC Suite II LG USB Modem driver Lineage II Lost Saga EU Malwarebytes Anti-Malware, Іµрсёя 1.61.0.1400 Metal Assault Microsoft .NET Framework 1.1 Microsoft .NET Framework 2.0 Service Pack 2 Microsoft .NET Framework 3.0 Service Pack 2 Microsoft .NET Framework 3.5 SP1 Microsoft .NET Framework 4 Client Profile Microsoft .NET Framework 4 Extended Microsoft Games for Windows - LIVE Redistributable Microsoft Games for Windows Marketplace Microsoft Office 2003 Bulgarian User Interface Pack Microsoft Office Professional Edition 2003 Microsoft Primary Interoperability Assemblies 2005 Microsoft Silverlight Microsoft Silverlight 5 Toolkit December 2011 Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 Microsoft WSE 3.0 Runtime Microsoft XNA Framework Redistributable 3.1 mIRC Mozilla Firefox 13.0.1 (x86 bg) Mozilla Firefox 4.0 (x86 bg) Mozilla Maintenance Service mpowerplayer MSI to redistribute MS VS2005 CRT libraries MSVCRT Redists MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) MSXML 6.0 Parser (KB925673) MSXML4 Parser NCsoft Launcher NetTools 5.0 Nexon Game Manager No-IP DUC NVIDIA Drivers NVIDIA PhysX OGPlanet Game Launcher OpenAL Overwolf Pando Media Booster PhotoScape PoiZone Power Challenge Game Plugin ProxySwitcher Pro 5.5.0 5935 PunkBuster Services Python 2.7.2 Realm Of The Titans RealNetworks - Microsoft Visual C++ 2008 Runtime RealPlayer Realtek High Definition Audio Driver RealUpgrade 1.1 RegSupreme Pro Republic Heroes Rulers Of Nations S4 League_EU SAM Broadcaster (remove only) SAMSUNG Intelli-studio Sawer Security Update for Windows Media Player (KB975558) Security Update for Windows Media Player 11 (KB954154) Security Update for Windows XP (KB2079403) Security Update for Windows XP (KB2115168) Security Update for Windows XP (KB2229593) Security Update for Windows XP (KB2296011) Security Update for Windows XP (KB2347290) Security Update for Windows XP (KB2360937) Security Update for Windows XP (KB2387149) Security Update for Windows XP (KB2393802) Security Update for Windows XP (KB2419632) Security Update for Windows XP (KB2440591) Security Update for Windows XP (KB2443105) Security Update for Windows XP (KB2476490) Security Update for Windows XP (KB2478960) Security Update for Windows XP (KB2478971) Security Update for Windows XP (KB2479943) Security Update for Windows XP (KB2481109) Security Update for Windows XP (KB2483185) Security Update for Windows XP (KB2485663) Security Update for Windows XP (KB2503665) Security Update for Windows XP (KB2506212) Security Update for Windows XP (KB2507618) Security Update for Windows XP (KB2507938) Security Update for Windows XP (KB2508272) Security Update for Windows XP (KB2509553) Security Update for Windows XP (KB2510581) Security Update for Windows XP (KB2535512) Security Update for Windows XP (KB2536276-v2) Security Update for Windows XP (KB2544893) Security Update for Windows XP (KB2559049) Security Update for Windows XP (KB2562937) Security Update for Windows XP (KB2566454) Security Update for Windows XP (KB2570222) Security Update for Windows XP (KB2570947) Security Update for Windows XP (KB923789) Security Update for Windows XP (KB938464) Security Update for Windows XP (KB941569) Security Update for Windows XP (KB969059) Security Update for Windows XP (KB972270) Security Update for Windows XP (KB973346) Security Update for Windows XP (KB973904) Security Update for Windows XP (KB974318) Security Update for Windows XP (KB974392) Security Update for Windows XP (KB974571) Security Update for Windows XP (KB975025) Security Update for Windows XP (KB975467) Security Update for Windows XP (KB975560) Security Update for Windows XP (KB975562) Security Update for Windows XP (KB975713) Security Update for Windows XP (KB977816) Security Update for Windows XP (KB977914) Security Update for Windows XP (KB978338) Security Update for Windows XP (KB978542) Security Update for Windows XP (KB978706) Security Update for Windows XP (KB979309) Security Update for Windows XP (KB979482) Security Update for Windows XP (KB979687) Security Update for Windows XP (KB981997) Security Update for Windows XP (KB982665) Shaiya Silent Hunter III Skype™ 5.10 Softonic-Eng7 Toolbar Soldat 1.6.3 Steam swMSM System Requirements Lab CYRI TeamSpeak 3 Client TeamViewer 7 The Lord of the Rings Online™ v03.06.00.8025 THE SETTLERS - Rise of an Empire The Settlers II - 10th Anniversary The Sims™ 3 The Witcher Enhanced Edition Toxic Biohazard Tweaking.com - Windows Repair (All in One) Ubisoft Game Launcher uGet, Іµрсёя 2.0.2 Ulead GIF Animator 5 TBYB Unity Web Player Update for Windows XP (KB2541763) Update for Windows XP (KB2616676-v2) Update for Windows XP (KB955759) Update for Windows XP (KB971029) Update for Windows XP (KB973687) Vegas Pro 10.0 Vegas Pro 9.0 VLC media player 2.0.1 WebFldrs XP WEBZEN Browser Extension Whoislive Winamp Windows Internet Explorer 8 Windows Presentation Foundation WinPcap 3.0 World in Conflict Worms Reloaded XML Paper Specification Shared Components Pack 1.0 Your Uninstaller! 7 YTD YouTube Downloader & Converter 3.6 ррхёІ°тѕр WinRAR µTorrent . ==== Event Viewer Messages From Past Week ======== . 7/1/2012 11:52:56 AM, error: W32Time [17] - Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup again in 15 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751) 7/1/2012 10:15:57 PM, error: sr [1] - The System Restore filter encountered the unexpected error '0xC000009A' while processing the file 'FAP107.tmp' on the volume 'HarddiskVolume1'. It has stopped monitoring the volume. 6/30/2012 5:22:18 PM, error: sr [1] - The System Restore filter encountered the unexpected error '0xC000009A' while processing the file 'etilqs_pgpRr44aNY6eHPg' on the volume 'HarddiskVolume1'. It has stopped monitoring the volume. 6/30/2012 10:01:56 AM, error: SideBySide [59] - Generate Activation Context failed for C:WINDOWSsystem32syncui.dll. Reference error message: The operation completed successfully. . 6/30/2012 10:01:52 AM, error: SideBySide [59] - Resolve Partial Assembly failed for Microsoft.Windows.Common-Controls. Reference error message: Insufficient system resources exist to complete the requested service. . 6/30/2012 10:01:52 AM, error: SideBySide [59] - Generate Activation Context failed for C:WINDOWSsystem32NOTEPAD.EXE. Reference error message: The operation completed successfully. . 6/28/2012 10:43:11 AM, error: Service Control Manager [7034] - The xsherlock service terminated unexpectedly. It has done this 1 time(s). 6/27/2012 8:36:08 AM, error: Service Control Manager [7034] - The WireHelpSvc service terminated unexpectedly. It has done this 1 time(s). 6/27/2012 7:21:14 AM, error: Service Control Manager [7034] - The Skype Updater service terminated unexpectedly. It has done this 1 time(s). 6/27/2012 7:21:11 AM, error: Service Control Manager [7034] - The vToolbarUpdater10.2.0 service terminated unexpectedly. It has done this 1 time(s). 6/27/2012 5:57:02 PM, error: DCOM [10005] - DCOM got error "%1058" attempting to start the service gupdate with arguments "/comsvc" in order to run the server: {4EB61BAC-A3B6-4760-9581-655041EF4D69} 6/27/2012 3:20:40 PM, error: Service Control Manager [7034] - The Java Quick Starter service terminated unexpectedly. It has done this 1 time(s). 6/27/2012 10:55:36 PM, error: RMSPPPOE [55] - Received a PPPoE Active Discovery packet indicating a Generic Error. 6/26/2012 4:28:00 PM, error: Service Control Manager [7034] - The Skype Updater service terminated unexpectedly. It has done this 2 time(s). . ==== End Of File ===========================

В момента съм на работа и го прегледах набързо. Изглежда си наред, но после ще направим още проверки.

Инсталирах няколко игри. Трябват ли нови логове?

Здравейте, Забравил съм да пиша, за което се извинявам, но не мисля че проблема се дължи повече на зловреден софтуер. Все пак има ли още проблеми и ако да, можете ли да ги опитеше по-подробно?

Вече се оправи.

Супер. Мерси, че ме известихте. Все пак за ваше успокоение е добре, че проверихме повторно за зловредна активност. Има боклуци като някои тулбари и програми за емулация и заобикаляне на защитата на някои игри, но като цяло положението е ОК. Лека вечер и се извинявам за закъснението. Просто бях доста зает последната седмица!