Премини към съдържанието
Форумът в приложение

По-лесно сърфиране. Научи повече.
Kaldata.com - Форуми

Приложение на форума на цял екран с push известия, значки и други.

За да инсталирате това приложение на iOS и iPadOS
  1. Докоснете Иконата за споделяне в Safari
  2. Превъртете менюто и докоснете Добавяне към началния екран.
  3. Докоснете Добавяне в горния десен ъгъл.
За да инсталирате това приложение на Android
  1. Докоснете менюто с 3 точки (⋮) в горния десен ъгъл на браузъра.
  2. Докоснете Добавяне към началния екран или Инсталиране на приложение.
  3. Потвърдете, като докоснете Инсталиране.
Добави Kaldata.com в предпочитани източници в Google

Добре дошли!

Добре дошли в нашите форуми, пълни с полезна информация. Имате проблем с компютъра или телефона си? Публикувайте нова тема и ще намерите решение на всичките си проблеми. Общувайте свободно и открийте безброй нови приятели.

Моля, регистрирайте се за да публикувате тема и да получите пълен достъп до всички функции.

 

Заразен - Live security protection

Chavdar Mutafov
в Премахване на зловреден софтуер

Featured Replies

Здравейте. Онзи ден както си пишех курсовата работа за университета и ми излезе тоя fake antivirus. В normal mode немога да правя нищо, затова сега съм в safe mode. Пуснах DDS, но ми излезе само attach.txt(да не е заради safe mode?). Eто го и него: DDS (Ver_2011-09-30.01) . Microsoft® Windows Vista™ Home Premium Boot Device: \Device\HarddiskVolume2 Install Date: 23.9.2008 г. 13:41:11 System Uptime: 11.6.2012 г. 09:49:20 (1 hours ago) . Motherboard: TOSHIBA | | Satellite A300 Processor: Intel® Core™2 Duo CPU T5550 @ 1.83GHz | U2E1 | 1828/166mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 118 GiB total, 37,468 GiB free. D: is CDROM () E: is FIXED (NTFS) - 114 GiB total, 26,64 GiB free. F: is CDROM () . ==== Disabled Device Manager Items ============= . ==== System Restore Points =================== . RP741: 31.5.2012 г. 09:41:54 - Scheduled Checkpoint RP742: 1.6.2012 г. 00:53:36 - Scheduled Checkpoint RP743: 1.6.2012 г. 11:46:26 - Windows Update RP744: 5.6.2012 г. 09:01:20 - Windows Update RP745: 5.6.2012 г. 15:37:36 - Windows Update RP746: 6.6.2012 г. 09:33:03 - Scheduled Checkpoint RP747: 7.6.2012 г. 00:00:05 - Scheduled Checkpoint RP748: 9.6.2012 г. 09:02:23 - Windows Update . ==== Installed Programs ====================== . Update for Microsoft Office 2007 (KB2508958) Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742) Adobe AIR Adobe Flash Player 10 ActiveX Adobe Flash Player 10 Plugin Adobe Reader 8.1.2 Adobe Reader 8.1.2 Security Update 1 (KB403742) Apple Application Support Apple Mobile Device Support Apple Software Update Ask Toolbar Avidemux 2.5 (32-bit) Avira AntiVir Personal - Free Antivirus Bluetooth Stack for Windows by Toshiba Bonjour Camera Assistant Software for Toshiba CD/DVD Drive Acoustic Silencer Cisco Network Magic Conexant HD Audio Desktop SMS Diablo II DVD MovieFactory for TOSHIBA DX-Ball 1.09 DX-Ball 2 FIFA 10 v1.0 R-E FIFA 11 FlexType 2K Google Chrome Google Desktop Google Earth Google Toolbar for Internet Explorer Google Update Helper HDAUDIO Soft Data Fax Modem with SmartCP Holdem Manager Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595) Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484) Intel® Graphics Media Accelerator Driver Intel® Matrix Storage Manager iPhone Configuration Utility iTunes Java Auto Updater Java™ 6 Update 19 Java™ 6 Update 3 K-Lite Codec Pack 5.7.0 (Full) Live Security Platinum LogMeIn Hamachi LuckyAcePoker.com M-Tel NETAGENT Marvell Miniport Driver Medal of Honor Allied Assault Breakthrough Microfit for Windows Microsoft .NET Framework 3.5 SP1 Microsoft Office 2007 Service Pack 3 (SP3) Microsoft Office Access MUI (English) 2007 Microsoft Office Access Setup Metadata MUI (English) 2007 Microsoft Office Enterprise 2007 Microsoft Office Excel MUI (English) 2007 Microsoft Office Groove MUI (English) 2007 Microsoft Office Groove Setup Metadata MUI (English) 2007 Microsoft Office InfoPath MUI (English) 2007 Microsoft Office OneNote MUI (English) 2007 Microsoft Office Outlook MUI (English) 2007 Microsoft Office PowerPoint MUI (English) 2007 Microsoft Office Proof (English) 2007 Microsoft Office Proof (French) 2007 Microsoft Office Proof (Spanish) 2007 Microsoft Office Proofing (English) 2007 Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) Microsoft Office Publisher MUI (English) 2007 Microsoft Office Shared MUI (English) 2007 Microsoft Office Shared Setup Metadata MUI (English) 2007 Microsoft Office Word MUI (English) 2007 Microsoft Silverlight Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft XML Parser Mozilla Firefox 13.0 (x86 bg) Mozilla Maintenance Service MP3 To Ringtone Gold 3.18 MSXML 4.0 SP2 (KB941833) MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) MSXML4 Parser myphotobook 3.5 NetWaiting Network Magic Nokia Connectivity Cable Driver Nokia Multimedia Common Components 2.4 Nokia Music Nokia Ovi Application Installer Nokia Ovi Application Installer 6.85.3011 Nokia Ovi Content Copier Nokia Ovi Content Copier 6.85.3011 Nokia Ovi One Touch Access Nokia Ovi One Touch Access 6.85.3019 Nokia Ovi Suite Nokia Ovi System Utilities Nokia Ovi System Utilities 6.85.3018 Nokia Photos Nokia Software Updater O2Micro Flash Memory Card Reader Driver (x86) PC Connectivity Solution Picasa 3 PokerStars PostgreSQL 8.3 PostgreSQL 8.4 PPStream Pure Networks Platform QuickTime SaveVid Plug-in Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111) Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424) Security Update for Microsoft Office 2007 suites (KB2596672) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596792) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596880) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2597162) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2597969) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2598041) 32-Bit Edition Security Update for Microsoft Office Excel 2007 (KB2597161) 32-Bit Edition Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition Security Update for Microsoft Office Publisher 2007 (KB2596705) 32-Bit Edition Security Update for Microsoft Office Word 2007 (KB2596917) 32-Bit Edition Security Update for Windows Media Encoder (KB2447961) Security Update for Windows Media Encoder (KB954156) Security Update for Windows Media Encoder (KB979332) SEGA Mega Drive Classic Collection: Gold Edition Skype™ 5.8 SopCast 3.2.9 SUPERAntiSpyware Free Edition Synaptics Pointing Device Driver TOSHIBA Assist TOSHIBA ConfigFree TOSHIBA Disc Creator TOSHIBA DVD PLAYER TOSHIBA Extended Tiles for Windows Mobility Center TOSHIBA Face Recognition TOSHIBA Hardware Setup TOSHIBA Manuals Toshiba Online Product Information TOSHIBA Recovery Disc Creator TOSHIBA SD Memory Utilities TOSHIBA Supervisor Password TOSHIBA Value Added Package TRDCReminder TRORDCLauncher Update for 2007 Microsoft Office System (KB967642) Update for Microsoft .NET Framework 3.5 SP1 (KB963707) Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2598290) 32-Bit Edition VLC media player 1.1.8 WebEx Support Manager for Internet Explorer Winamp Windows Driver Package - Nokia pccsmcfd (08/22/2008 7.0.0.0) Windows Media Encoder 9 Series Windows Media Player Firefox Plugin Windows Savevid Toolbar WinRAR archiver YouTube Downloader Toolbar v5.8 YTD YouTube Downloader & Converter 3.6 µTorrent . ==== End Of File =========================== Cега сйм на ликвидациq заради тоq вирус. Благодарq предъарително.

Изтеглете OTL.exe и го запазете на десктопа.

  • Стартирайте OTL (ако е необходимо, потвърдете през UAC).
  • Направете следните настройки:
  • Сложете отметка пред Scan All Users Публикувано изображение
  • Под менюто File Age изберете 90 days
  • Под менюто Standard Registry променете на ALL
  • Сложете отметки пред LOP и Purity Check
Под Публикувано изображение с Copy/ Paste въведете изцяло следната текстова информация (само това, което е поставено в карето):

netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
"%WinDir%$NtUninstallKB*$." /90
C:Program FilesCommon FilesComObjects*.* /s
%SYSTEMDRIVE%*.*
%USERPROFILE%*.*
%USERPROFILE%AppDataLocal*.*
%USERPROFILE%AppDataRoaming*.*
%ProgramData%*.*
%CommonProgramFiles%*.*
%PROGRAMFILES%*.*
%windir%installer*.* /S
%systemroot%system32configsystemprofileAppDataLocal*.*
%windir%ServiceProfilesLocalServiceAppDataLocalTemp*.*
%windir%ServiceProfilesNetworkServiceAppDataLocalTemp*.*
%windir%temp*.*
%windir%system32*.
%windir%sysnative*.
%Temp%smtmp1*.*
%Temp%smtmp2*.*
%Temp%smtmp3*.*
%Temp%smtmp4*.*
%systemroot%system32DBBK*.* /s
%systemroot%system32*.dll /lockedfiles
%systemroot%Tasks*.job /lockedfiles
%systemroot%system32drivers*.sys /90
%systemroot%system32drivers*.sys /lockedfiles
%systemroot%system32Spoolprtprocsw32x86*.dll
%systemroot%*. /rp /s
%systemroot%assemblytmp*.* /S /MD5
%systemroot%assemblytemp*.* /S /MD5
%systemroot%assemblyGAC*.* /S /MD5
%systemroot%assemblyGAC_32*.* /S /MD5
%SystemRoot%assemblyGAC_MSIL*.* /S /MD5
HKEY_CLASSES_ROOTCLSID{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1} /s
HKEY_CURRENT_USERSoftwareClassesCLSID{42aedc87-2188-41fd-b9a3-0c966feabec1} /s
HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1} /s
HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{42aedc87-2188-41fd-b9a3-0c966feabec1} /s
>C:commands.txt echo list vol /raw /hide /c
/wait
>C:DiskReport.txt diskpart /s C:commands.txt /raw /hide /c
/wait
type c:diskreport.txt /c
/wait
erase c:commands.txt /hide /c
/wait
erase c:diskreport.txt /hide /c
/md5start
consrv.dll
services.exe
explorer.exe
lsass.exe
svchost.exe
wininit.exe
winlogon.exe
userinit.exe
atapi.sys
iaStor.sys
serial.sys
volsnap.sys
disk.sys
redbook.sys
i8042prt.sys
afd.sys
netbt.sys
csc.sys
tcpip.sys
dfsc.sys
hlp.dat
/md5stop
  • Натиснете маркираният в синьо бутон: Run Scan.
  • Като приключи проверката, ще се създадат два файла - OTL.Txt и Extras.Txt. Прикачете тези два файла в следващия си коментар (погледнете опцията Прикачени файлове, когато публикувате мнение).
  • Автор

Здравежте. В normal mode не ми дава да го пусна, а в safe mode ми дава ето тази грешка: Problem signature: Problem Event Name: APPCRASH Application Name: OTL.exe Application Version: 3.2.48.0 Application Timestamp: 2a425e19 Fault Module Name: kernel32.dll Fault Module Version: 6.0.6002.18005 Fault Module Timestamp: 49e037dd Exception Code: 0eedfade Exception Offset: 0003fbae OS Version: 6.0.6002.2.2.0.768.3 Locale ID: 1026 Additional Information 1: f9cf Additional Information 2: fcb676c9496aeae0307a61e6936c12ca Additional Information 3: 2f9d Additional Information 4: 99a97bb4191fc8136a74d91604d8ab36

Намирисва ми на новия ZeroAccess...

Изтеглете прикачения файл и го разархивирайте на десктопа. expand.zip

Стартирайте файла expand.bat.

Ще се отворят 4-тири файла (или поне би трябвало) с текстово съдържание.

Копирайте съдържанието на тези 4-тири файла в следващия си коментар.

(Ако се появи съобщение за грешка при изъпнението на файла просто натиснете OK).

  • Автор

Ето ги: пйрвиq: Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOTCLSID{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}] @="Microsoft WBEM New Event Subsystem" [HKEY_CLASSES_ROOTCLSID{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}InprocServer32] @=hex(2):25,00,73,00,79,00,73,00,74,00,65,00,6d,00,72,00,6f,00,6f,00,74,00,25, 00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,77,00,62,00, 65,00,6d,00,5c,00,77,00,62,00,65,00,6d,00,65,00,73,00,73,00,2e,00,64,00,6c, 00,6c,00,00,00 "ThreadingModel"="Both" вториq: Windows Registry Editor Version 5.00 [HKEY_CURRENT_USERSoftwareClassesCLSID{42aedc87-2188-41fd-b9a3-0c966feabec1}] [HKEY_CURRENT_USERSoftwareClassesCLSID{42aedc87-2188-41fd-b9a3-0c966feabec1}InprocServer32] "ThreadingModel"="Both" @="C:UsersToshibaAppDataLocal{c25edaa9-4085-1174-f85f-1a915fadf364}n." третиq: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}] @="Microsoft WBEM New Event Subsystem" [HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}InprocServer32] @=hex(2):25,00,73,00,79,00,73,00,74,00,65,00,6d,00,72,00,6f,00,6f,00,74,00,25, 00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,77,00,62,00, 65,00,6d,00,5c,00,77,00,62,00,65,00,6d,00,65,00,73,00,73,00,2e,00,64,00,6c, 00,6c,00,00,00 "ThreadingModel"="Both" четвйртиq: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{42aedc87-2188-41fd-b9a3-0c966feabec1}] @="MruPidlList" [HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{42aedc87-2188-41fd-b9a3-0c966feabec1}InProcServer32] @=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25, 00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,00,68,00, 65,00,6c,00,6c,00,33,00,32,00,2e,00,64,00,6c,00,6c,00,00,00 "ThreadingModel"="Apartment"

Изтеглете файла fix.zip и го разархивирайте на десктопа. fix.zip

Копирайте файла fix.bat в основната директория на C:

  • Изтеглете BlitzBlank от emsisoft и го запазете на вашия десктоп.
  • Стартирайте Blitzblank.exe.
  • Натиснете OK на предупредителното съобщение
  • Натиснете Script и с копи/пейст въведете следната информация.

    DeleteFolder: 
C:WindowsInstaller{c25edaa9-4085-1174-f85f-1a915fadf364}
"C:UsersToshibaAppDataLocal{c25edaa9-4085-1174-f85f-1a915fadf364}"

Execute: 
C:fix.bat
  • Натиснете Execute Now. Компютъра ще се рестартира в опит за изтриване на файловете.
  • Когато процедурата завърши ще се създаде лог файл в C: => Публикувайте го в следващия си коментар.
  • Автор

Като се рестартира ме вкара в normal mode и след това трябваше да рестартирам пак за да вляза в safe mode. Надqвам се не е проблем. Ето го лога: BlitzBlank 1.0.0.32 File/Registry Modification Engine native application MoveDirectoryOnReboot: sourceDirectory = "??c:windowsinstaller{c25edaa9-4085-1174-f85f-1a915fadf364}", destinationDirectory = "(null)", replaceWithDummy = 0 MoveFileOnReboot: sourceFile = "??c:windowsinstaller{c25edaa9-4085-1174-f85f-1a915fadf364}@", destinationFile = "(null)", replaceWithDummy = 0 MoveDirectoryOnReboot: sourceDirectory = "??c:windowsinstaller{c25edaa9-4085-1174-f85f-1a915fadf364}L", destinationDirectory = "(null)", replaceWithDummy = 0 MoveFileOnReboot: sourceFile = "??c:windowsinstaller{c25edaa9-4085-1174-f85f-1a915fadf364}n", destinationFile = "(null)", replaceWithDummy = 0 MoveDirectoryOnReboot: sourceDirectory = "??c:windowsinstaller{c25edaa9-4085-1174-f85f-1a915fadf364}U", destinationDirectory = "(null)", replaceWithDummy = 0 MoveFileOnReboot: sourceFile = "??c:windowsinstaller{c25edaa9-4085-1174-f85f-1a915fadf364}U00000001.@", destinationFile = "(null)", replaceWithDummy = 0 MoveFileOnReboot: sourceFile = "??c:windowsinstaller{c25edaa9-4085-1174-f85f-1a915fadf364}U80000000.@", destinationFile = "(null)", replaceWithDummy = 0 MoveFileOnReboot: sourceFile = "??c:windowsinstaller{c25edaa9-4085-1174-f85f-1a915fadf364}U800000cb.@", destinationFile = "(null)", replaceWithDummy = 0 MoveDirectoryOnReboot: sourceDirectory = "??c:users oshibaappdatalocal{c25edaa9-4085-1174-f85f-1a915fadf364}", destinationDirectory = "(null)", replaceWithDummy = 0 MoveFileOnReboot: sourceFile = "??c:users oshibaappdatalocal{c25edaa9-4085-1174-f85f-1a915fadf364}@", destinationFile = "(null)", replaceWithDummy = 0 MoveDirectoryOnReboot: sourceDirectory = "??c:users oshibaappdatalocal{c25edaa9-4085-1174-f85f-1a915fadf364}L", destinationDirectory = "(null)", replaceWithDummy = 0 MoveFileOnReboot: sourceFile = "??c:users oshibaappdatalocal{c25edaa9-4085-1174-f85f-1a915fadf364}n", destinationFile = "(null)", replaceWithDummy = 0 MoveDirectoryOnReboot: sourceDirectory = "??c:users oshibaappdatalocal{c25edaa9-4085-1174-f85f-1a915fadf364}U", destinationDirectory = "(null)", replaceWithDummy = 0 LaunchOnReboot: launchName = "fix.bat", commandLine = "c:fix.bat"

Супер...резнахме му крилцата.

Сега:

1. Изтеглете ComboFix от BleepingComputer

и го запазете (бутон Save -> Save as) ComboFix на вашия десктоп:

Публикувано изображение

След приключване на изтеглянето на ComboFix, иконката на програмата би трябвало да изглежда така:

Публикувано изображение

2. Затворете всички работещи приложения, отворени прозорци и програми работещи във фонов режим. Спрете временно защитата в реално време на антивирусната програма и на другите програми за сигурност, ако има такива.

3. Стартирайте с двоен клик Combofix.exe. Изберете YES, за да се съгласите с условията за използване на програмата. Важно: По време на работата на ComboFix не бива да се движи мишката и да се натискат клавиши от клавиатурата. Просто търпеливо оставете ComboFix да си свърши работата, без да използвате компютъра за други цели.

4. Ако получите предупреждение от UAC, съгласете се.

5 ComboFix ще спре временно Интернет връзката, но след като приключи работата на програмата тази връзка ще бъде възстановена автоматично. ComboFix ще сканира за проблеми и за заразени файлове, като това може да отнеме известно време. Моля да бъдете търпеливи. Ако има проблем с Интернет връзката след приключване на работата на Combofix, моля да прочетете това: Manually restoring the Internet connection section.

6 Когато работата на ComboFix приключи, ще се появи текстов документ (log) в Notepad:

Публикувано изображение

Копирайте с (Copy) и поставете с (Paste) съдържанието на лога в следващия си коментар.

Забележка: Ако се появи следното съобщение при отварянето на различни програми след завършване на сканирането с Combofix - "illegal operation on a registry key that has been marked for deletion." просто рестартирайте компютъра още веднъж и то ще изчезне.

По време на сканирането не използвайте компютъра си !

  • Автор

Имам малък проблем. Понеже съм в safe mode и в процесите avirata и antispyware-а ми излизат спрени, а като пуснах combofix-а ми ги засече пуснати и ми казва да ги спра и тогава да му дам ОК. Да му дам ли ОК все пак или да изключа компютъра и да влqза в normal mode и от там да ги спра и да пробвам да пусна combo-to?

Временно деинсталирайте Авира (в момента има проблеми между нея и Combofix) и след това повторете процедурата. Направете проверката от Normal Mode, не от Safe Mode!

  • Автор

Вече не ми изкача нищо в normal mode. Ето го и лога: ComboFix 12-06-10.01 - Toshiba 06.2012 г. 17:35:55.1.2 - x86 Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1251.359.1033.18.2038.1024 [GMT 3:00] Running from: c:usersToshibaDesktopComboFix.exe SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:usersToshibaAppDataLocal.# c:usersToshibaAppDataLocal.#MBX@14BC@A1E19A0.### c:usersToshibaAppDataLocalTempppcrlui_3796_3 c:usersToshibaAppDataRoamingKaspersky_Key_Finder_(KKF c:usersToshibaAppDataRoamingKaspersky_Key_Finder_(KKFKaspersky_Key_Finder.exe_Url_pd013ypqcdhenxvyk5mtq520z1mtjehf1.4.1.0user.config c:usersToshibaAppDataRoamingMicrosoftWindowsStart MenuProgramsLive Security Platinum c:windowssecurityDatabase mp.edb c:windowssystem32driversetchosts.ics c:windowsXSxS . Infected copy of c:windowssystem32Services.exe was found and disinfected Restored copy from - c:combofixHarddiskVolumeShadowCopy8_!Windows!System32!services.exe . . ((((((((((((((((((((((((( Files Created from 2012-05-11 to 2012-06-11 ))))))))))))))))))))))))))))))) . . 2012-06-11 14:47 . 2012-06-11 14:47 -------- d-----w- c:userspostgresAppDataLocal emp 2012-06-11 14:47 . 2012-06-11 14:47 -------- d-----w- c:userspostgres.Toshiba-PCAppDataLocal emp 2012-06-11 14:47 . 2012-06-11 14:47 -------- d-----w- c:usersDefaultAppDataLocal emp 2012-06-11 12:49 . 2012-06-11 12:29 80 ----a-w- C:fix.bat 2012-06-11 10:25 . 2012-06-11 14:24 17408 ----a-w- c:windowssystem32rpcnetp.dll 2012-06-11 10:18 . 2012-06-11 10:18 -------- d-sh--w- c:windowssystem32%APPDATA% 2012-06-11 06:49 . 2012-06-11 14:49 17408 ----a-w- c:windowssystem32rpcnetp.exe 2012-06-09 22:09 . 2012-06-09 22:09 770384 ----a-w- c:program filesMozilla Firefoxmsvcr100.dll 2012-06-09 22:09 . 2012-06-09 22:09 421200 ----a-w- c:program filesMozilla Firefoxmsvcp100.dll 2012-06-09 22:03 . 2012-06-09 22:03 -------- d-----w- c:programdataF4D55F3E000DF644006F4B3C570F1C8B 2012-06-09 15:43 . 2012-06-09 15:43 -------- d-----w- c:usersToshibaAppDataRoamingThinstall 2012-06-09 06:05 . 2012-05-08 16:40 6737808 ----a-w- c:programdataMicrosoftWindows DefenderDefinition Updates{48F84DF3-8923-4253-8CDC-E12C3C739673}mpengine.dll 2012-05-29 14:19 . 2012-05-29 14:19 -------- d-----w- c:program filesApplication Updater 2012-05-29 14:19 . 2012-05-29 14:19 -------- d-----w- c:program filesYouTube Downloader Toolbar 2012-05-29 14:19 . 2012-05-29 14:19 -------- d-----w- c:program filesCommon FilesSpigot . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-04-03 08:16 . 2012-05-11 06:11 3602816 ----a-w- c:windowssystem32ntkrnlpa.exe 2012-04-03 08:16 . 2012-05-11 06:11 3550080 ----a-w- c:windowssystem32ntoskrnl.exe 2012-04-02 13:36 . 2012-05-11 06:11 2044928 ----a-w- c:windowssystem32win32k.sys 2012-03-30 12:39 . 2012-05-11 06:11 905600 ----a-w- c:windowssystem32drivers cpip.sys 2012-03-20 23:28 . 2012-05-11 06:11 53120 ----a-w- c:windowssystem32driverspartmgr.sys 2012-03-14 15:08 . 2012-03-14 15:08 161792 ----a-w- c:windowssystem32msls31.dll 2012-03-14 15:08 . 2012-03-14 15:08 86528 ----a-w- c:windowssystem32iesysprep.dll 2012-03-14 15:08 . 2012-03-14 15:08 76800 ----a-w- c:windowssystem32SetIEInstalledDate.exe 2012-03-14 15:08 . 2012-03-14 15:08 74752 ----a-w- c:windowssystem32RegisterIEPKEYs.exe 2012-03-14 15:08 . 2012-03-14 15:08 48640 ----a-w- c:windowssystem32mshtmler.dll 2012-03-14 15:08 . 2012-03-14 15:08 63488 ----a-w- c:windowssystem32 dc.ocx 2012-03-14 15:08 . 2012-03-14 15:08 367104 ----a-w- c:windowssystem32html.iec 2012-03-14 15:08 . 2012-03-14 15:08 74752 ----a-w- c:windowssystem32iesetup.dll 2012-03-14 15:08 . 2012-03-14 15:08 23552 ----a-w- c:windowssystem32licmgr10.dll 2012-03-14 15:08 . 2012-03-14 15:08 152064 ----a-w- c:windowssystem32wextract.exe 2012-03-14 15:08 . 2012-03-14 15:08 150528 ----a-w- c:windowssystem32iexpress.exe 2012-03-14 15:08 . 2012-03-14 15:08 420864 ----a-w- c:windowssystem32vbscript.dll 2012-03-14 15:08 . 2012-03-14 15:08 142848 ----a-w- c:windowssystem32ieUnatt.exe 2012-03-14 15:08 . 2012-03-14 15:08 11776 ----a-w- c:windowssystem32mshta.exe 2012-03-14 15:08 . 2012-03-14 15:08 101888 ----a-w- c:windowssystem32admparse.dll 2012-03-14 15:08 . 2012-03-14 15:08 35840 ----a-w- c:windowssystem32imgutil.dll 2012-03-14 15:08 . 2012-03-14 15:08 110592 ----a-w- c:windowssystem32IEAdvpack.dll 2012-03-14 15:07 . 2012-03-14 15:07 979456 ----a-w- c:windowssystem32MFH264Dec.dll 2012-03-14 15:07 . 2012-03-14 15:07 357376 ----a-w- c:windowssystem32MFHEAACdec.dll 2012-03-14 15:07 . 2012-03-14 15:07 302592 ----a-w- c:windowssystem32mfmp4src.dll 2012-03-14 15:07 . 2012-03-14 15:07 98816 ----a-w- c:windowssystem32mfps.dll 2012-03-14 15:07 . 2012-03-14 15:07 2873344 ----a-w- c:windowssystem32mf.dll 2012-03-14 15:07 . 2012-03-14 15:07 261632 ----a-w- c:windowssystem32mfreadwrite.dll 2012-03-14 15:07 . 2012-03-14 15:07 586240 ----a-w- c:windowssystem32stobject.dll 2012-03-14 15:07 . 2012-03-14 15:07 209920 ----a-w- c:windowssystem32mfplat.dll 2012-03-14 15:07 . 2012-03-14 15:07 288768 ----a-w- c:windowssystem32XpsGdiConverter.dll 2012-03-14 15:07 . 2012-03-14 15:07 135680 ----a-w- c:windowssystem32XpsRasterService.dll 2012-03-14 15:07 . 2012-03-14 15:07 797184 ----a-w- c:windowssystem32FntCache.dll 2012-03-14 15:07 . 2012-03-14 15:07 486400 ----a-w- c:windowssystem32d3d10level9.dll 2012-03-14 15:07 . 2012-03-14 15:07 638336 ----a-w- c:windowssystem32driversdxgkrnl.sys 2012-03-14 15:07 . 2012-03-14 15:07 478720 ----a-w- c:windowssystem32dxgi.dll 2012-03-14 15:07 . 2012-03-14 15:07 37376 ----a-w- c:windowssystem32cdd.dll 2012-03-14 15:07 . 2012-03-14 15:07 26112 ----a-w- c:windowssystem32printfilterpipelineprxy.dll 2012-03-14 15:07 . 2012-03-14 15:07 258048 ----a-w- c:windowssystem32winspool.drv 2012-03-14 15:07 . 2012-03-14 15:07 189952 ----a-w- c:windowssystem32d3d10core.dll 2012-03-14 15:07 . 2012-03-14 15:07 1029120 ----a-w- c:windowssystem32d3d10.dll 2012-03-14 15:07 . 2012-03-14 15:07 876032 ----a-w- c:windowssystem32XpsPrint.dll 2012-03-14 15:07 . 2012-03-14 15:07 847360 ----a-w- c:windowssystem32OpcServices.dll 2012-03-14 15:07 . 2012-03-14 15:07 667648 ----a-w- c:windowssystem32printfilterpipelinesvc.exe 2012-03-14 15:07 . 2012-03-14 15:07 1554432 ----a-w- c:windowssystem32xpsservices.dll 2012-03-14 15:04 . 2012-03-14 15:04 4096 ----a-w- c:windowssystem32driversen-USdxgkrnl.sys.mui 2012-03-14 15:04 . 2012-03-14 15:04 519680 ----a-w- c:windowssystem32d3d11.dll 2012-03-14 15:04 . 2012-03-14 15:04 369664 ----a-w- c:windowssystem32WMPhoto.dll 2012-03-14 15:04 . 2012-03-14 15:04 252928 ----a-w- c:windowssystem32dxdiag.exe 2012-03-14 15:04 . 2012-03-14 15:04 195584 ----a-w- c:windowssystem32dxdiagn.dll 2012-03-14 15:04 . 2012-03-14 15:04 321024 ----a-w- c:windowssystem32PhotoMetadataHandler.dll 2012-03-14 15:04 . 2012-03-14 15:04 189440 ----a-w- c:windowssystem32WindowsCodecsExt.dll 2012-03-14 15:04 . 2012-03-14 15:04 974848 ----a-w- c:windowssystem32WindowsCodecs.dll 2012-06-09 22:09 . 2011-09-27 21:09 85472 ----a-w- c:program filesmozilla firefoxcomponentsbrowsercomps.dll 2010-08-17 20:00 . 2010-02-11 18:55 119808 ----a-w- c:program filesmozilla firefoxcomponentsGoogleDesktopMozilla.dll . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerURLSearchHooks] "{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:program filesAsk.comGenericAskToolbar.dll" [2011-05-17 1490312] . [HKEY_CLASSES_ROOTclsid{00000000-6e41-4fd3-8538-502f5495e5fc}] . [HKEY_LOCAL_MACHINE~Browser Helper Objects{D4027C7F-154A-4066-A1AD-4243D8127440}] 2011-05-17 10:29 1490312 ----a-w- c:program filesAsk.comGenericAskToolbar.dll . [HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar] "{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:program filesAsk.comGenericAskToolbar.dll" [2011-05-17 1490312] . [HKEY_CLASSES_ROOTclsid{d4027c7f-154a-4066-a1ad-4243d8127440}] [HKEY_CLASSES_ROOTGenericAskToolbar.ToolbarWnd.1] [HKEY_CLASSES_ROOTTypeLib{2996F0E7-292B-4CAE-893F-47B8B1C05B56}] [HKEY_CLASSES_ROOTGenericAskToolbar.ToolbarWnd] . [HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerToolbarWebbrowser] "{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:program filesAsk.comGenericAskToolbar.dll" [2011-05-17 1490312] . [HKEY_CLASSES_ROOTclsid{d4027c7f-154a-4066-a1ad-4243d8127440}] [HKEY_CLASSES_ROOTGenericAskToolbar.ToolbarWnd.1] [HKEY_CLASSES_ROOTTypeLib{2996F0E7-292B-4CAE-893F-47B8B1C05B56}] [HKEY_CLASSES_ROOTGenericAskToolbar.ToolbarWnd] . [HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun] "Sidebar"="c:program filesWindows Sidebarsidebar.exe" [2009-04-11 1233920] "TOSCDSPD"="c:program filesTOSHIBATOSCDSPD oscdspd.exe" [2007-12-29 430080] "HW_OPENEYE_OUC_M-Tel NETAGENT"="c:program filesM-Tel NETAGENTUpdateDogouc.exe" [2011-11-19 218624] "WMPNSCFG"="c:program filesWindows Media PlayerWMPNSCFG.exe" [2008-01-21 202240] "swg"="c:program filesGoogleGoogleToolbarNotifierGoogleToolbarNotifier.exe" [2009-01-12 39408] . [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun] "NokiaMServer"="c:program filesCommon FilesNokiaMPlatformNokiaMServer" [X] "IgfxTray"="c:windowssystem32igfxtray.exe" [2008-01-25 141848] "HotKeysCmds"="c:windowssystem32hkcmd.exe" [2008-01-25 154136] "Persistence"="c:windowssystem32igfxpers.exe" [2008-01-25 129560] "NDSTray.exe"="NDSTray.exe" [bU] "ITSecMng"="c:program filesTOSHIBABluetooth Toshiba StackItSecMng.exe" [2007-09-28 75136] "Desktop SMS"="c:program filesIDMDesktop SMSDesktopSMS.exe" [2007-06-18 1507328] "Google Desktop Search"="c:program filesGoogleGoogle Desktop SearchGoogleDesktop.exe" [2010-08-17 30192] "topi"="c:program filesTOSHIBAToshiba Online Product Information opi.exe" [2007-07-10 581632] "SynTPEnh"="c:program filesSynapticsSynTPSynTPEnh.exe" [2007-11-29 1029416] "Camera Assistant Software"="c:program filesCamera Assistant Software for Toshiba raybar.exe" [2007-10-25 413696] "TPwrMain"="c:program filesTOSHIBAPower SaverTPwrMain.EXE" [2008-01-17 431456] "HSON"="c:program filesTOSHIBATBSHSON.exe" [2007-10-31 54608] "SmoothView"="c:program filesToshibaSmoothViewSmoothView.exe" [2008-01-25 509816] "00TCrdMain"="c:program filesTOSHIBAFlashCardsTCrdMain.exe" [2008-01-22 712704] "Toshiba Registration"="c:program filesToshibaRegistrationToshibaRegistration.exe" [2007-05-04 571024] "GrooveMonitor"="c:program filesMicrosoft OfficeOffice12GrooveMonitor.exe" [2009-02-26 30040] "DAEMON Tools"="c:program filesDAEMON Toolsdaemon.exe" [2006-09-14 157592] "SunJavaUpdateSched"="c:program filesCommon FilesJavaJava Updatejusched.exe" [2010-02-18 248040] "NokiaMusic FastStart"="c:program filesNokiaNokia MusicNokiaMusic.exe" [2009-07-22 2331936] "nmctxth"="c:program filesCommon FilesPure Networks SharedPlatformnmctxth.exe" [2009-04-07 642856] "nmapp"="c:program filesPure NetworksNetwork Magicnmapp.exe" [2009-04-07 467240] "QuickTime Task"="c:program filesQuickTimeQTTask.exe" [2010-03-18 421888] "ApnUpdater"="c:program filesAsk.comUpdaterUpdater.exe" [2011-05-17 395144] "APSDaemon"="c:program filesCommon FilesAppleApple Application SupportAPSDaemon.exe" [2011-11-01 59240] "iTunesHelper"="c:program filesiTunesiTunesHelper.exe" [2011-12-07 421736] "Adobe Reader Speed Launcher"="c:program filesAdobeReader 8.0ReaderReader_sl.exe" [2008-01-11 39792] "LogMeIn Hamachi Ui"="c:program filesLogMeIn Hamachihamachi-2-ui.exe" [2012-02-28 1987976] "SearchSettings"="c:program filesCommon FilesSpigotSearch SettingsSearchSettings.exe" [2012-05-25 992648] . c:programdataMicrosoftWindowsStart MenuProgramsStartup Bluetooth Manager.lnk - c:program filesToshibaBluetooth Toshiba StackTosBtMng.exe [2008-1-25 2938184] . c:usersDefault UserAppDataRoamingMicrosoftWindowsStart MenuProgramsStartup TRDCReminder.lnk - c:program filesToshibaTRDCReminderTRDCReminder.exe [2007-7-27 389120] . [HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionpoliciessystem] "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversionwindows] "AppInit_DLLs"=c:progra~1WI0498~1Datamngrdatamngr.dll c:progra~1WI0498~1DatamngrIEBHO.dll c:progra~1GoogleGOOGLE~3GoogleDesktopNetwork3.dll . [HKEY_LOCAL_MACHINEsystemcurrentcontrolsetcontrolsession manager] BootExecute REG_MULTI_SZ autocheck autochk *0c:windowssystem32blzblk.exe ??c:windowssystem32blzblk.dat blzblk . [HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootMinimal!SASCORE] @="" . [HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity center] "AntiVirusOverride"=dword:00000001 "FirewallOverride"=dword:00000001 . [HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity centerMonitoringMcAfeeAntiSpyware] "DisableMonitoring"=dword:00000001 . S2 !SASCORE;SAS Core Service;c:program filesSUPERAntiSpywareSASCORE.EXE [2011-11-07 116608] . . [HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversionsvchost] LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache . Contents of the 'Scheduled Tasks' folder . 2012-06-11 c:windowsTasksGoogleUpdateTaskMachineCore.job - c:program filesGoogleUpdateGoogleUpdate.exe [2009-04-02 16:30] . 2012-06-11 c:windowsTasksGoogleUpdateTaskMachineUA.job - c:program filesGoogleUpdateGoogleUpdate.exe [2009-04-02 16:30] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.garena.com/portal/ mStart Page = hxxp://search.localstrike.com.ar/ uInternet Settings,ProxyOverride = *.local IE: Add to Google Photos Screensa&ver - c:windowssystem32GPhotos.scr/200 IE: E&xport to Microsoft Excel - c:progra~1MICROS~2Office12EXCEL.EXE/3000 IE: Save video on Savevid.com - c:program filesSavevidPlug-inredirect.htm FF - ProfilePath - c:usersToshibaAppDataRoamingMozillaFirefoxProfiles49485toh.default FF - prefs.js: browser.search.defaulturl - hxxp://search.localstrike.com.ar/?q={searchTerms} FF - prefs.js: browser.search.selectedEngine - Ask.com FF - prefs.js: browser.startup.homepage - hxxp://www.searchqu.com/405 FF - prefs.js: keyword.URL - hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=SPC2&o=15000&locale=en_EU&apn_uid=4F4248D1-AE2A-45D1-871A-A8F9E6995F0D&apn_ptnrs=PV&apn_sauid=C0928DB3-A1F6-4C2F-9B81-4593E52B3081&apn_dtid=YYYYYYYYBG&q= . - - - - ORPHANS REMOVED - - - - . Toolbar-10 - (no file) AddRemove-DX-Ball 2 - e:gamesUninstall.exe . . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2012-06-11 17:54 Windows 6.0.6002 Service Pack 2 NTFS . scanning hidden processes ... . scanning hidden autostart entries ... . scanning hidden files ... . scan completed successfully hidden files: 0 . ************************************************************************** . [HKEY_LOCAL_MACHINESYSTEMControlSet001Servicespostgresql-8.4] "ImagePath"="C:/Program Files/PostgreSQL/8.4/bin/pg_ctl.exe runservice -N "postgresql-8.4" -D "C:/Program Files/PostgreSQL/8.4/data" -w" . [HKEY_LOCAL_MACHINESYSTEMControlSet001Servicespostgresql-8.4] "ImagePath"="C:/Program Files/PostgreSQL/8.4/bin/pg_ctl.exe runservice -N "postgresql-8.4" -D "C:/Program Files/PostgreSQL/8.4/data" -w" . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_LOCAL_MACHINESYSTEMControlSet001ControlClass{4D36E96D-E325-11CE-BFC1-08002BE10318}0000AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINESYSTEMControlSet001ControlClass{4D36E96D-E325-11CE-BFC1-08002BE10318}0001AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINESYSTEMControlSet001ControlClass{4D36E96D-E325-11CE-BFC1-08002BE10318}0002AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . --------------------- DLLs Loaded Under Running Processes --------------------- . - - - - - - - > 'Explorer.exe'(5364) c:program filesIDMDesktop SMSoehook.dll c:program filesPure NetworksNetwork Magicnmrsrc.dll c:windowssystem32pnidui.dll . ------------------------ Other Running Processes ------------------------ . c:windowsMicrosoft.NetFrameworkv3.0WPFPresentationFontCache.exe c:windowssystem32conime.exe c:windowssystem32igfxsrvc.exe c:program filesToshibaConfigFreeNDSTray.exe c:program filesCommon FilesAppleMobile Device SupportAppleMobileDeviceService.exe c:program filesApplication UpdaterApplicationUpdater.exe c:windowssystem32atashost.exe c:program filesCamera Assistant Software for ToshibaCEC_MAIN.exe c:program filesBonjourmDNSResponder.exe c:program filesTOSHIBAConfigFreeCFSvcs.exe c:program filesLogMeIn Hamachihamachi-2.exe c:programdataDatacardServiceHWDeviceService.exe c:programdataDatacardServiceDCSHelper.exe c:program filesWindows MailWinMail.exe c:program filesCommon FilesNokiaMPlatformNokiaMServer.exe c:program filesO2Micro Flash Memory Card Drivero2flash.exe c:windowsSystem32rpcnetp.exe c:program filesToshibaTOSHIBA DVD PLAYERTNaviSrv.exe c:windowssystem32TODDSrv.exe c:program filesToshibaPower SaverTosCoSrv.exe c:program filesToshibaBluetooth Toshiba StackTosBtSrv.exe c:program filesTOSHIBASMARTLogServiceTosIPCSrv.exe c:program filesCommon FilesUlead SystemsDVDULCDRSvr.exe c:windowssystem32DRIVERSxaudio.exe c:program filesCommon FilesPure Networks SharedPlatformnmsrvc.exe c:program filesWindows Savevid ToolbarDatamngrdatamngrUI.exe c:program filesSynapticsSynTPSynTPHelper.exe c:programdataM-Tel NETAGENTOnlineUpdateouc.exe c:program filesToshibaBluetooth Toshiba StackTosA2dp.exe c:program filesToshibaBluetooth Toshiba StackTosBtHid.exe c:program filesToshibaBluetooth Toshiba StackTosBtHsp.exe c:program filesWindows Media Playerwmpnetwk.exe c:program filesToshibaConfigFreeCFSwMgr.exe c:program filesiPodbiniPodService.exe . ************************************************************************** . Completion time: 2012-06-11 17:57:07 - machine was rebooted ComboFix-quarantined-files.txt 2012-06-11 14:56 . Pre-Run: 44 863 291 392 bytes free Post-Run: 45 581 873 152 bytes free . - - End Of File - - EA3BE85F505B75DBEEE9E1209818A4C3

  • Отворете notepad и с copy/paste въведете следната информация:

    File::
c:windowssystem32blzblk.exe
c:windowssystem32blzblk.dat
Folder::
c:programdataF4D55F3E000DF644006F4B3C570F1C8B
c:program filesApplication Updater
c:program filesYouTube Downloader Toolbar
c:program filesCommon FilesSpigot
c:program filesAsk.com
Registry::
[HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerURLSearchHooks]
"{00000000-6E41-4FD3-8538-502F5495E5FC}"=-
[-HKEY_CLASSES_ROOTclsid{00000000-6e41-4fd3-8538-502f5495e5fc}]
[-HKEY_LOCAL_MACHINE~Browser Helper Objects{D4027C7F-154A-4066-A1AD-4243D8127440}]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
[-HKEY_CLASSES_ROOTclsid{d4027c7f-154a-4066-a1ad-4243d8127440}]
[-HKEY_CLASSES_ROOTGenericAskToolbar.ToolbarWnd.1]
[-HKEY_CLASSES_ROOTTypeLib{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[-HKEY_CLASSES_ROOTGenericAskToolbar.ToolbarWnd]
[HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerToolbarWebbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
[-HKEY_CLASSES_ROOTclsid{d4027c7f-154a-4066-a1ad-4243d8127440}]
[-HKEY_CLASSES_ROOTGenericAskToolbar.ToolbarWnd.1]
[-HKEY_CLASSES_ROOTTypeLib{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[-HKEY_CLASSES_ROOTGenericAskToolbar.ToolbarWnd]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
"NokiaMServer"=-
"NDSTray.exe"=-
"ApnUpdater"=-
"SearchSettings"=-
[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetcontrolsession manager]
"BootExecute"=hex(7):61,75,74,6f,63,68,65,63,6b,20,61,75,74,6f,63,68,6b,20,2a,00,00
[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity center]
"AntiVirusOverride"=dword:00000000
"FirewallOverride"=dword:00000000
[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity centerMonitoringMcAfeeAntiSpyware]
"DisableMonitoring"=dword:00000000
DDS::
mStart Page = hxxp://search.localstrike.com.ar/
Firefox::
FF - ProfilePath - c:usersToshibaAppDataRoamingMozillaFirefoxProfiles49485toh.default
FF - prefs.js: browser.search.defaulturl - hxxp://search.localstrike.com.ar/?q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - Ask.com
FF - prefs.js: browser.startup.homepage - hxxp://www.searchqu.com/405
FF - prefs.js: keyword.URL - hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=SPC2&o=15000&locale=en_EU&apn_uid=4F4248D1-AE2A-45D1-871A-A8F9E6995F0D&apn_ptnrs=PV&apn_sauid=C0928DB3-A1F6-4C2F-9B81-4593E52B3081&apn_dtid=YYYYYYYYBG&q=
RegLock::
[HKEY_LOCAL_MACHINESYSTEMControlSet001ControlClass{4D36E96D-E325-11CE-BFC1-08002BE10318}0000AllUserSettings]
[HKEY_LOCAL_MACHINESYSTEMControlSet001ControlClass{4D36E96D-E325-11CE-BFC1-08002BE10318}0001AllUserSettings]
[HKEY_LOCAL_MACHINESYSTEMControlSet001ControlClass{4D36E96D-E325-11CE-BFC1-08002BE10318}0002AllUserSettings]
  • Запазете файла с име CFScript и го провлачете и пуснете в Combofix (както е показано на картинката отдолу).

    Публикувано изображение

  • По време на сканиране от страна на ComboFix не стартирайте никакви други приложения, не натискайте клавиши от клавиатурата и не местете мишката !
  • Публикувайте лог файла, който ще се създаде след рестарта на компютъра в следващия си пост.
  • Автор

Ето го и новия лог: ComboFix 12-06-10.01 - Toshiba 06.2012 г. 0:35.2.2 - x86 Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1251.359.1033.18.2038.999 [GMT 3:00] Running from: c:usersToshibaDesktopComboFix.exe Command switches used :: c:usersToshibaDesktopCFScript.txt SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . FILE :: "c:windowssystem32blzblk.dat" "c:windowssystem32blzblk.exe" . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:program filesApplication Updater c:program filesApplication UpdaterApplicationUpdater.exe c:program filesApplication Updaterconfig.ini c:program filesAsk.com c:program filesAsk.comassetsoobeb.png c:program filesAsk.comassetsoobebl.png c:program filesAsk.comassetsoobebr.png c:program filesAsk.comassetsoobel.png c:program filesAsk.comassetsoobepointer.png c:program filesAsk.comassetsoober.png c:program filesAsk.comassetsoobe .png c:program filesAsk.comassetsoobe l.png c:program filesAsk.comassetsoobe r.png c:program filesAsk.comcb_72b9.ico c:program filesAsk.comcobrand.ico c:program filesAsk.comconfig.xml c:program filesAsk.comfavicon.ico c:program filesAsk.comfv_6c33.ico c:program filesAsk.comGenericAskToolbar.dll c:program filesAsk.commupcfg.xml c:program filesAsk.comprecache.exe c:program filesAsk.comSaUpdate.exe c:program filesAsk.comUpdaterconfig.xml c:program filesAsk.comUpdaterUpdater.exe c:program filesAsk.comUpdateTask.exe c:program filesCommon FilesSpigot c:program filesCommon FilesSpigotGCcoupons_1.0.crx c:program filesCommon FilesSpigotSearch Settingsbaidu_ff.xml c:program filesCommon FilesSpigotSearch Settingsbaidu_ie.xml c:program filesCommon FilesSpigotSearch Settingsconfig.ini c:program filesCommon FilesSpigotSearch SettingsLangres1031.ini c:program filesCommon FilesSpigotSearch SettingsLangres1033.ini c:program filesCommon FilesSpigotSearch SettingsLangres1034.ini c:program filesCommon FilesSpigotSearch SettingsLangres1036.ini c:program filesCommon FilesSpigotSearch SettingsLangres1040.ini c:program filesCommon FilesSpigotSearch SettingsSearchSettings.exe c:program filesCommon FilesSpigotSearch Settingswth.dll c:program filesCommon FilesSpigotSearch Settingsyahoo_ff.xml c:program filesCommon FilesSpigotSearch Settingsyahoo_ie.xml c:program filesCommon FilesSpigotSearch Settingsyandex_ff.xml c:program filesCommon FilesSpigotSearch Settingsyandex_ie.xml c:program filesCommon FilesSpigotwtxpcomchrome.manifest c:program filesCommon FilesSpigotwtxpcomcomponentschrome.manifest c:program filesCommon FilesSpigotwtxpcomcomponentsIFBHOHelperWidgiToolbar.xpt c:program filesCommon FilesSpigotwtxpcomcomponentsIFBHOWidgiToolbar.xpt c:program filesCommon FilesSpigotwtxpcomcomponentsinstall.rdf c:program filesCommon FilesSpigotwtxpcomcomponentsWidgiToolbarFF.dll c:program filesCommon FilesSpigotwtxpcomcomponentsWidgiToolbarFF.dll.10 c:program filesCommon FilesSpigotwtxpcomcomponentsWidgiToolbarFF.dll.11 c:program filesCommon FilesSpigotwtxpcomcomponentsWidgiToolbarFF.dll.12 c:program filesCommon FilesSpigotwtxpcomcomponentsWidgiToolbarFF.dll.13 c:program filesCommon FilesSpigotwtxpcomcomponentsWidgiToolbarFF.dll.14 c:program filesCommon FilesSpigotwtxpcomcomponentsWidgiToolbarFF.dll.5 c:program filesCommon FilesSpigotwtxpcomcomponentsWidgiToolbarFF.dll.6 c:program filesCommon FilesSpigotwtxpcomcomponentsWidgiToolbarFF.dll.7 c:program filesCommon FilesSpigotwtxpcomcomponentsWidgiToolbarFF.dll.8 c:program filesCommon FilesSpigotwtxpcomcomponentsWidgiToolbarFF.dll.9 c:program filesCommon FilesSpigotwtxpcominstall.rdf c:program filesYouTube Downloader Toolbar c:program filesYouTube Downloader ToolbarFFchrome.manifest c:program filesYouTube Downloader ToolbarFFchromechrome.jar c:program filesYouTube Downloader ToolbarFFinstall.rdf c:program filesYouTube Downloader ToolbarIE5.8config.ini c:program filesYouTube Downloader ToolbarIE5.8youtubedownloaderToolbarIE.dll c:program filesYouTube Downloader ToolbarResamazon.gif c:program filesYouTube Downloader ToolbarResdailymotion.gif c:program filesYouTube Downloader ToolbarResdropinsavings.gif c:program filesYouTube Downloader ToolbarResdropinsavingsabt.gif c:program filesYouTube Downloader ToolbarResebay.gif c:program filesYouTube Downloader ToolbarResfacebook.gif c:program filesYouTube Downloader ToolbarResgoogleplus.gif c:program filesYouTube Downloader ToolbarReshulu.gif c:program filesYouTube Downloader ToolbarResicon_settings.gif c:program filesYouTube Downloader ToolbarResLangres1031.ini c:program filesYouTube Downloader ToolbarResLangres1033.ini c:program filesYouTube Downloader ToolbarResLangres1034.ini c:program filesYouTube Downloader ToolbarResLangres1036.ini c:program filesYouTube Downloader ToolbarResLangres1040.ini c:program filesYouTube Downloader ToolbarResmetacafe.gif c:program filesYouTube Downloader ToolbarResradio-close.gif c:program filesYouTube Downloader ToolbarResradio-minimize.gif c:program filesYouTube Downloader ToolbarResradiobeta.gif c:program filesYouTube Downloader ToolbarRessearch-button-hover.gif c:program filesYouTube Downloader ToolbarRessearch-button.gif c:program filesYouTube Downloader ToolbarRessearch-chevron-hover.gif c:program filesYouTube Downloader ToolbarRessearch-chevron.gif c:program filesYouTube Downloader ToolbarRessearch_amazon.gif c:program filesYouTube Downloader ToolbarRessearch_baidu.gif c:program filesYouTube Downloader ToolbarRessearch_ebay.gif c:program filesYouTube Downloader ToolbarRessearch_yahoo.gif c:program filesYouTube Downloader ToolbarRessearch_yandex.gif c:program filesYouTube Downloader ToolbarRessearch_youtube.gif c:program filesYouTube Downloader ToolbarRes witter.gif c:program filesYouTube Downloader ToolbarResveoh.gif c:program filesYouTube Downloader ToolbarReswidgets.xml c:program filesYouTube Downloader ToolbarResyoutube.gif c:program filesYouTube Downloader ToolbarResytd.gif c:program filesYouTube Downloader ToolbarResytd_logo.gif c:program filesYouTube Downloader ToolbarResytd_logo_hover.gif c:program filesYouTube Downloader ToolbarWidgiHelper.exe c:programdataF4D55F3E000DF644006F4B3C570F1C8B c:programdataF4D55F3E000DF644006F4B3C570F1C8BF4D55F3E000DF644006F4B3C570F1C8B c:programdataF4D55F3E000DF644006F4B3C570F1C8BF4D55F3E000DF644006F4B3C570F1C8B.exe c:usersToshibaAppDataLocalTempppcrlui_3640_2 . . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . . -------Service_Application Updater -------Service_Application Updater . . ((((((((((((((((((((((((( Files Created from 2012-05-11 to 2012-06-11 ))))))))))))))))))))))))))))))) . . 2012-06-11 21:44 . 2012-06-11 21:44 17408 ----a-w- c:windowssystem32rpcnetp.exe 2012-06-11 21:42 . 2012-06-11 21:42 -------- d-----w- c:userspostgresAppDataLocal emp 2012-06-11 12:49 . 2012-06-11 12:29 80 ----a-w- C:fix.bat 2012-06-11 10:18 . 2012-06-11 10:18 -------- d-sh--w- c:windowssystem32%APPDATA% 2012-06-09 22:09 . 2012-06-09 22:09 770384 ----a-w- c:program filesMozilla Firefoxmsvcr100.dll 2012-06-09 22:09 . 2012-06-09 22:09 421200 ----a-w- c:program filesMozilla Firefoxmsvcp100.dll 2012-06-09 15:43 . 2012-06-09 15:43 -------- d-----w- c:usersToshibaAppDataRoamingThinstall 2012-06-09 06:05 . 2012-05-08 16:40 6737808 ----a-w- c:programdataMicrosoftWindows DefenderDefinition Updates{48F84DF3-8923-4253-8CDC-E12C3C739673}mpengine.dll . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-06-11 21:46 . 2012-06-11 21:46 17408 ----a-w- c:windowssystem32rpcnetp.dll 2012-06-11 15:09 . 2010-08-24 21:36 44544 ----a-w- c:windowssystem32agremove.exe 2012-04-03 08:16 . 2012-05-11 06:11 3602816 ----a-w- c:windowssystem32ntkrnlpa.exe 2012-04-03 08:16 . 2012-05-11 06:11 3550080 ----a-w- c:windowssystem32ntoskrnl.exe 2012-04-02 13:36 . 2012-05-11 06:11 2044928 ----a-w- c:windowssystem32win32k.sys 2012-03-30 12:39 . 2012-05-11 06:11 905600 ----a-w- c:windowssystem32drivers cpip.sys 2012-03-20 23:28 . 2012-05-11 06:11 53120 ----a-w- c:windowssystem32driverspartmgr.sys 2012-03-14 15:08 . 2012-03-14 15:08 161792 ----a-w- c:windowssystem32msls31.dll 2012-03-14 15:08 . 2012-03-14 15:08 86528 ----a-w- c:windowssystem32iesysprep.dll 2012-03-14 15:08 . 2012-03-14 15:08 76800 ----a-w- c:windowssystem32SetIEInstalledDate.exe 2012-03-14 15:08 . 2012-03-14 15:08 74752 ----a-w- c:windowssystem32RegisterIEPKEYs.exe 2012-03-14 15:08 . 2012-03-14 15:08 48640 ----a-w- c:windowssystem32mshtmler.dll 2012-03-14 15:08 . 2012-03-14 15:08 63488 ----a-w- c:windowssystem32 dc.ocx 2012-03-14 15:08 . 2012-03-14 15:08 367104 ----a-w- c:windowssystem32html.iec 2012-03-14 15:08 . 2012-03-14 15:08 74752 ----a-w- c:windowssystem32iesetup.dll 2012-03-14 15:08 . 2012-03-14 15:08 23552 ----a-w- c:windowssystem32licmgr10.dll 2012-03-14 15:08 . 2012-03-14 15:08 152064 ----a-w- c:windowssystem32wextract.exe 2012-03-14 15:08 . 2012-03-14 15:08 150528 ----a-w- c:windowssystem32iexpress.exe 2012-03-14 15:08 . 2012-03-14 15:08 420864 ----a-w- c:windowssystem32vbscript.dll 2012-03-14 15:08 . 2012-03-14 15:08 142848 ----a-w- c:windowssystem32ieUnatt.exe 2012-03-14 15:08 . 2012-03-14 15:08 11776 ----a-w- c:windowssystem32mshta.exe 2012-03-14 15:08 . 2012-03-14 15:08 101888 ----a-w- c:windowssystem32admparse.dll 2012-03-14 15:08 . 2012-03-14 15:08 35840 ----a-w- c:windowssystem32imgutil.dll 2012-03-14 15:08 . 2012-03-14 15:08 110592 ----a-w- c:windowssystem32IEAdvpack.dll 2012-03-14 15:07 . 2012-03-14 15:07 979456 ----a-w- c:windowssystem32MFH264Dec.dll 2012-03-14 15:07 . 2012-03-14 15:07 357376 ----a-w- c:windowssystem32MFHEAACdec.dll 2012-03-14 15:07 . 2012-03-14 15:07 302592 ----a-w- c:windowssystem32mfmp4src.dll 2012-03-14 15:07 . 2012-03-14 15:07 98816 ----a-w- c:windowssystem32mfps.dll 2012-03-14 15:07 . 2012-03-14 15:07 2873344 ----a-w- c:windowssystem32mf.dll 2012-03-14 15:07 . 2012-03-14 15:07 261632 ----a-w- c:windowssystem32mfreadwrite.dll 2012-03-14 15:07 . 2012-03-14 15:07 586240 ----a-w- c:windowssystem32stobject.dll 2012-03-14 15:07 . 2012-03-14 15:07 209920 ----a-w- c:windowssystem32mfplat.dll 2012-03-14 15:07 . 2012-03-14 15:07 288768 ----a-w- c:windowssystem32XpsGdiConverter.dll 2012-03-14 15:07 . 2012-03-14 15:07 135680 ----a-w- c:windowssystem32XpsRasterService.dll 2012-03-14 15:07 . 2012-03-14 15:07 797184 ----a-w- c:windowssystem32FntCache.dll 2012-03-14 15:07 . 2012-03-14 15:07 486400 ----a-w- c:windowssystem32d3d10level9.dll 2012-03-14 15:07 . 2012-03-14 15:07 638336 ----a-w- c:windowssystem32driversdxgkrnl.sys 2012-03-14 15:07 . 2012-03-14 15:07 478720 ----a-w- c:windowssystem32dxgi.dll 2012-03-14 15:07 . 2012-03-14 15:07 37376 ----a-w- c:windowssystem32cdd.dll 2012-03-14 15:07 . 2012-03-14 15:07 26112 ----a-w- c:windowssystem32printfilterpipelineprxy.dll 2012-03-14 15:07 . 2012-03-14 15:07 258048 ----a-w- c:windowssystem32winspool.drv 2012-03-14 15:07 . 2012-03-14 15:07 189952 ----a-w- c:windowssystem32d3d10core.dll 2012-03-14 15:07 . 2012-03-14 15:07 1029120 ----a-w- c:windowssystem32d3d10.dll 2012-03-14 15:07 . 2012-03-14 15:07 876032 ----a-w- c:windowssystem32XpsPrint.dll 2012-03-14 15:07 . 2012-03-14 15:07 847360 ----a-w- c:windowssystem32OpcServices.dll 2012-03-14 15:07 . 2012-03-14 15:07 667648 ----a-w- c:windowssystem32printfilterpipelinesvc.exe 2012-03-14 15:07 . 2012-03-14 15:07 1554432 ----a-w- c:windowssystem32xpsservices.dll 2012-03-14 15:04 . 2012-03-14 15:04 4096 ----a-w- c:windowssystem32driversen-USdxgkrnl.sys.mui 2012-03-14 15:04 . 2012-03-14 15:04 519680 ----a-w- c:windowssystem32d3d11.dll 2012-03-14 15:04 . 2012-03-14 15:04 369664 ----a-w- c:windowssystem32WMPhoto.dll 2012-03-14 15:04 . 2012-03-14 15:04 252928 ----a-w- c:windowssystem32dxdiag.exe 2012-03-14 15:04 . 2012-03-14 15:04 195584 ----a-w- c:windowssystem32dxdiagn.dll 2012-03-14 15:04 . 2012-03-14 15:04 321024 ----a-w- c:windowssystem32PhotoMetadataHandler.dll 2012-03-14 15:04 . 2012-03-14 15:04 189440 ----a-w- c:windowssystem32WindowsCodecsExt.dll 2012-03-14 15:04 . 2012-03-14 15:04 974848 ----a-w- c:windowssystem32WindowsCodecs.dll 2012-06-09 22:09 . 2011-09-27 21:09 85472 ----a-w- c:program filesmozilla firefoxcomponentsbrowsercomps.dll 2010-08-17 20:00 . 2010-02-11 18:55 119808 ----a-w- c:program filesmozilla firefoxcomponentsGoogleDesktopMozilla.dll . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun] "Sidebar"="c:program filesWindows Sidebarsidebar.exe" [2009-04-11 1233920] "TOSCDSPD"="c:program filesTOSHIBATOSCDSPD oscdspd.exe" [2007-12-29 430080] "HW_OPENEYE_OUC_M-Tel NETAGENT"="c:program filesM-Tel NETAGENTUpdateDogouc.exe" [2011-11-19 218624] "WMPNSCFG"="c:program filesWindows Media PlayerWMPNSCFG.exe" [2008-01-21 202240] "swg"="c:program filesGoogleGoogleToolbarNotifierGoogleToolbarNotifier.exe" [2009-01-12 39408] . [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun] "IgfxTray"="c:windowssystem32igfxtray.exe" [2008-01-25 141848] "HotKeysCmds"="c:windowssystem32hkcmd.exe" [2008-01-25 154136] "Persistence"="c:windowssystem32igfxpers.exe" [2008-01-25 129560] "ITSecMng"="c:program filesTOSHIBABluetooth Toshiba StackItSecMng.exe" [2007-09-28 75136] "Desktop SMS"="c:program filesIDMDesktop SMSDesktopSMS.exe" [2007-06-18 1507328] "Google Desktop Search"="c:program filesGoogleGoogle Desktop SearchGoogleDesktop.exe" [2010-08-17 30192] "topi"="c:program filesTOSHIBAToshiba Online Product Information opi.exe" [2007-07-10 581632] "SynTPEnh"="c:program filesSynapticsSynTPSynTPEnh.exe" [2007-11-29 1029416] "Camera Assistant Software"="c:program filesCamera Assistant Software for Toshiba raybar.exe" [2007-10-25 413696] "TPwrMain"="c:program filesTOSHIBAPower SaverTPwrMain.EXE" [2008-01-17 431456] "HSON"="c:program filesTOSHIBATBSHSON.exe" [2007-10-31 54608] "SmoothView"="c:program filesToshibaSmoothViewSmoothView.exe" [2008-01-25 509816] "00TCrdMain"="c:program filesTOSHIBAFlashCardsTCrdMain.exe" [2008-01-22 712704] "Toshiba Registration"="c:program filesToshibaRegistrationToshibaRegistration.exe" [2007-05-04 571024] "GrooveMonitor"="c:program filesMicrosoft OfficeOffice12GrooveMonitor.exe" [2009-02-26 30040] "DAEMON Tools"="c:program filesDAEMON Toolsdaemon.exe" [2006-09-14 157592] "SunJavaUpdateSched"="c:program filesCommon FilesJavaJava Updatejusched.exe" [2010-02-18 248040] "NokiaMusic FastStart"="c:program filesNokiaNokia MusicNokiaMusic.exe" [2009-07-22 2331936] "nmctxth"="c:program filesCommon FilesPure Networks SharedPlatformnmctxth.exe" [2009-04-07 642856] "nmapp"="c:program filesPure NetworksNetwork Magicnmapp.exe" [2009-04-07 467240] "QuickTime Task"="c:program filesQuickTimeQTTask.exe" [2010-03-18 421888] "APSDaemon"="c:program filesCommon FilesAppleApple Application SupportAPSDaemon.exe" [2011-11-01 59240] "iTunesHelper"="c:program filesiTunesiTunesHelper.exe" [2011-12-07 421736] "Adobe Reader Speed Launcher"="c:program filesAdobeReader 8.0ReaderReader_sl.exe" [2008-01-11 39792] "LogMeIn Hamachi Ui"="c:program filesLogMeIn Hamachihamachi-2-ui.exe" [2012-02-28 1987976] . c:programdataMicrosoftWindowsStart MenuProgramsStartup Bluetooth Manager.lnk - c:program filesToshibaBluetooth Toshiba StackTosBtMng.exe [2008-1-25 2938184] . c:usersDefault UserAppDataRoamingMicrosoftWindowsStart MenuProgramsStartup TRDCReminder.lnk - c:program filesToshibaTRDCReminderTRDCReminder.exe [2007-7-27 389120] . [HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionpoliciessystem] "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversionwindows] "AppInit_DLLs"=c:progra~1WI0498~1Datamngrdatamngr.dll c:progra~1WI0498~1DatamngrIEBHO.dll c:progra~1GoogleGOOGLE~3GoogleDesktopNetwork3.dll c:progra~1GoogleGOOGLE~3GoogleDesktopNetwork3.dll . [HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootMinimal!SASCORE] @="" . S2 !SASCORE;SAS Core Service;c:program filesSUPERAntiSpywareSASCORE.EXE [2011-11-07 116608] . . [HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversionsvchost] LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache . Contents of the 'Scheduled Tasks' folder . 2012-06-11 c:windowsTasksGoogleUpdateTaskMachineCore.job - c:program filesGoogleUpdateGoogleUpdate.exe [2009-04-02 16:30] . 2012-06-11 c:windowsTasksGoogleUpdateTaskMachineUA.job - c:program filesGoogleUpdateGoogleUpdate.exe [2009-04-02 16:30] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.garena.com/portal/ uInternet Settings,ProxyOverride = *.local IE: Add to Google Photos Screensa&ver - c:windowssystem32GPhotos.scr/200 IE: E&xport to Microsoft Excel - c:progra~1MICROS~2Office12EXCEL.EXE/3000 IE: Save video on Savevid.com - c:program filesSavevidPlug-inredirect.htm FF - ProfilePath - c:usersToshibaAppDataRoamingMozillaFirefoxProfiles49485toh.default . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2012-06-12 00:48 Windows 6.0.6002 Service Pack 2 NTFS . scanning hidden processes ... . scanning hidden autostart entries ... . scanning hidden files ... . scan completed successfully hidden files: 0 . ************************************************************************** . [HKEY_LOCAL_MACHINESYSTEMControlSet001Servicespostgresql-8.4] "ImagePath"="C:/Program Files/PostgreSQL/8.4/bin/pg_ctl.exe runservice -N "postgresql-8.4" -D "C:/Program Files/PostgreSQL/8.4/data" -w" . [HKEY_LOCAL_MACHINESYSTEMControlSet001Servicespostgresql-8.4] "ImagePath"="C:/Program Files/PostgreSQL/8.4/bin/pg_ctl.exe runservice -N "postgresql-8.4" -D "C:/Program Files/PostgreSQL/8.4/data" -w" . --------------------- DLLs Loaded Under Running Processes --------------------- . - - - - - - - > 'Explorer.exe'(3668) c:program filesIDMDesktop SMSoehook.dll . ------------------------ Other Running Processes ------------------------ . c:windowsMicrosoft.NetFrameworkv3.0WPFPresentationFontCache.exe c:windowssystem32conime.exe c:program filesCommon FilesAppleMobile Device SupportAppleMobileDeviceService.exe c:windowssystem32atashost.exe c:windowssystem32igfxsrvc.exe c:program filesBonjourmDNSResponder.exe c:program filesTOSHIBAConfigFreeCFSvcs.exe c:program filesLogMeIn Hamachihamachi-2.exe c:programdataDatacardServiceHWDeviceService.exe c:program filesWindows Savevid ToolbarDatamngrdatamngrUI.exe c:program filesO2Micro Flash Memory Card Drivero2flash.exe c:program filesToshibaTOSHIBA DVD PLAYERTNaviSrv.exe c:windowssystem32TODDSrv.exe c:program filesToshibaPower SaverTosCoSrv.exe c:program filesToshibaBluetooth Toshiba StackTosBtSrv.exe c:program filesTOSHIBASMARTLogServiceTosIPCSrv.exe c:program filesCommon FilesUlead SystemsDVDULCDRSvr.exe c:windowssystem32DRIVERSxaudio.exe c:program filesCommon FilesPure Networks SharedPlatformnmsrvc.exe c:program filesWindows MailWinMail.exe c:program filesToshibaBluetooth Toshiba StackTosA2dp.exe c:program filesToshibaBluetooth Toshiba StackTosBtHid.exe c:program filesToshibaBluetooth Toshiba StackTosBtHsp.exe c:programdataM-Tel NETAGENTOnlineUpdateouc.exe c:program filesToshibaBluetooth Toshiba StackTosAVRC.exe c:program filesToshibaBluetooth Toshiba Stack osOBEX.exe c:program filesToshibaBluetooth Toshiba StackTosBtProc.exe c:program filesiPodbiniPodService.exe c:program filesWindows Media Playerwmpnetwk.exe . ************************************************************************** . Completion time: 2012-06-12 00:52:47 - machine was rebooted ComboFix-quarantined-files.txt 2012-06-11 21:52 ComboFix2.txt 2012-06-11 14:57 . Pre-Run: 45 293 125 632 bytes free Post-Run: 44 817 641 472 bytes free . - - End Of File - - 6F18485E8620B34F4199043388402B13

Така...

  • Моля изтеглете OTS.exe и го запазете на десктопа.
  • Стартирайте файла OTS.exe.
  • Сложете отметка пред Scan All Users.
  • Под Custom Scan копирайте и поставете следния скрипт:

    c:windowssystem32*.
  • Натиснете бутона Публикувано изображение.
  • Сега натиснете Run Scan.
  • След като проверката приключи ще се появи текстов лог файл в notepad.
  • Кликнете на Format менюто и се уверете, че няма отметка пред Wordwrap. Ако има я махнете.
  • След това копирайте съдържанието на лог файла в следващия си пост.
  • Автор

Дава ми грешка като с OTL. Ето я: Problem signature: Problem Event Name: APPCRASH Application Name: OTS.exe Application Version: 3.1.47.2 Application Timestamp: 2a425e19 Fault Module Name: kernel32.dll Fault Module Version: 6.0.6002.18005 Fault Module Timestamp: 49e037dd Exception Code: c0000005 Exception Offset: 000bf9cd OS Version: 6.0.6002.2.2.0.768.3 Locale ID: 1026 Additional Information 1: b37c Additional Information 2: 2a7328d8bb40c81c93b4b5f46adb8e10 Additional Information 3: b37c Additional Information 4: 2a7328d8bb40c81c93b4b5f46adb8e10

Интересно...премахнах всички следи от рууткита и би трябвало вече OTL/OTS да стартират коректно.

Ок, да видим дали не съм изтървал нещо:

СТЪПКА 1

  • Изтеглете Malwarebytes' Anti-Malware Free от тук
  • Кликнете два пъти върху mbam-setup.exe, за да инсталирате програмата.
  • Уверете се, че са поставени отметки на Update Malwarebytes' Anti-Malware и Launch Malwarebytes' Anti-Malware. След това кликнете на Finish.
  • Ако има намерени обновявания, тя ще ги изтегли и инсталира.
  • Стартирайте програмата и изберете "Perform Quick Scan", след това кликнете на Scan.
  • Сканирането ще отнеме малко време, затова моля да бъдете търпеливи.
  • Когато сканирането завърши, кликнете на OK, след това Show Results, за да видите резултата.
  • Уверете се, че на всички редове има отметки, и кликнете на Remove Selected.
  • Когато всичко бъде премахнато, в Notepad ще бъде отворен лог. Копирайте този лог и го публикувайте в следващия си коментар по темата.
Забележка: Ако MalwareBytes' Anti-Malware се затрудни в премахването на откритите вируси/заплахи, той ще поиска да рестартира компютъра Ви и по време на рестартирането да премахне проблемните вируси/заплахи. Ако бъдете попитани, потвърдете че желаете вашия компютър да бъде рестартиран.

СТЪПКА 2

Моля изтеглете последната версия на TDSSKiller оттук и я запазете на вашия декстоп.

  • Стартирайте TDSSKiller.exe за да стартирате приложението. След това кликнете върху бутона Change parameters.

    Публикувано изображение

  • Сложете отметки пред Verify Driver Digital Signature и Detect TDLFS file system и натиснете ОК.

    Публикувано изображение

  • Натиснете бутона Start Scan.

    Публикувано изображение

  • Ако подозрителен обект бъде засечен, действието по подразбиране ще бъде Skip, кликнете върху Continue.

    Публикувано изображение

  • Ако зловредни обекти бъдат намерени, тогава от падащото меню ще имате три възможности.

    Бъдете сигурни, че избраното действие е Cure и натиснете върху Continue > Рестартирайте за да бъде завършена поправката.

    Публикувано изображение

    Забележка: Ако Cure бутона не е наличен от възможностите, тогава моля изберете Skip бутона, не избирайте Delete освен ако не сте инструктирани затова.

  • Лог файл ще бъде създаден в свободната директория на дял C: . Потърсете за лог с името "TDSSKiller.[Version]_[Date]_[Time]_log.txt" и копирайте съдържанието му в следващия си пост.

СТЪПКА 3

Моля, изтеглете aswMBR и го запазете на вашия десктоп.

  • Кликнете с двоен клин на мишката върху файла aswMBR.exe за да го стартирате.
  • Изчакайте да изтегли дефинициите на avast!
  • От падащото меню посочете дял C: както е на снимката:
Публикувано изображение
  • Изберете Scan бутона, за да започне проверката.
  • Когато проверката завърши, натиснете бутона save log, запазете съдържанието на лог файла на десктопа и публикувайте съдържанието му в следващия си коментар

СТЪПКА 4

1.Изтеглете Hitman Pro.

  • За 32-битова система - Публикувано изображение
2.Стартирайте програмата.

3.След като сте стартирали програмата като кликнете върху иконата Публикувано изображение и натиснете бутона „Напред“ като се съгласите с лицензионното споразумение (EULA).

4.Сложете отметка пред "Не, искам да завърша еднократно сканиране на компютъра".

5.Натиснете бутона „Напред“.

6.Програмата ще започне да сканира. Времето за сканиране е около 2 минути.

7.След завършване на сканирането от списъка с намерените неща (ако има такива) изберете Apply to all => Ignore.

8.Натиснете "Next" и след това натиснете "Изнеси резултата в XML file".

9.Архивирайте файла и го прикачете в следващия си коментар.

  • Автор

Скановете продължиха около 10 часа. При последния с Hitman му дадох ignore all и след това да изнесе резултата в XML, но не го направи, а го чаках около 30мин. Също и не можех да отварям нищо - нито My computer, My document Или пък да пускам програми. Рестартирах и сега е добре, но пак си няма log oт Hitman.

Ето и логовете:

MALWARE:

Malwarebytes Anti-Malware (Trial) 1.61.0.1400

www.malwarebytes.org

Database version: v2012.06.11.09

Windows Vista Service Pack 2 x86 NTFS

Internet Explorer 9.0.8112.16421

Toshiba :: TOSHIBA-PC [administrator]

Protection: Enabled

12/06/2012 01:43:43

mbam-log-2012-06-12 (01-43-43).txt

Scan type: Quick scan

Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM

Scan options disabled: P2P

Objects scanned: 250172

Time elapsed: 6 minute(s), 34 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 1

C:UsersToshibaDownloadsCR-BS228.EXE (Trojan.Dropper.PGen) -> Quarantined and deleted successfully.

(end)

TDSSKILLER:

01:57:42.0510 5460 TDSS rootkit removing tool 2.7.36.0 May 21 2012 16:40:16

01:57:42.0634 5460 ============================================================

01:57:42.0634 5460 Current date / time: 2012/06/12 01:57:42.0634

01:57:42.0634 5460 SystemInfo:

01:57:42.0634 5460

01:57:42.0634 5460 OS Version: 6.0.6002 ServicePack: 2.0

01:57:42.0634 5460 Product type: Workstation

01:57:42.0635 5460 ComputerName: TOSHIBA-PC

01:57:42.0635 5460 UserName: Toshiba

01:57:42.0635 5460 Windows directory: C:Windows

01:57:42.0635 5460 System windows directory: C:Windows

01:57:42.0635 5460 Processor architecture: Intel x86

01:57:42.0635 5460 Number of processors: 2

01:57:42.0635 5460 Page size: 0x1000

01:57:42.0635 5460 Boot type: Normal boot

01:57:42.0635 5460 ============================================================

01:57:43.0124 5460 Drive DeviceHarddisk0DR0 - Size: 0x3A38B2E000 (232.89 Gb), SectorSize: 0x200, Cylinders: 0x76C1, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050

01:57:43.0126 5460 ============================================================

01:57:43.0126 5460 DeviceHarddisk0DR0:

01:57:43.0126 5460 MBR partitions:

01:57:43.0127 5460 DeviceHarddisk0DR0Partition0: MBR, Type 0x7, StartLBA 0x2EE800, BlocksNum 0xEB14000

01:57:43.0127 5460 DeviceHarddisk0DR0Partition1: MBR, Type 0x7, StartLBA 0xEE02800, BlocksNum 0xE3C3000

01:57:43.0127 5460 ============================================================

01:57:43.0183 5460 C: <-> DeviceHarddisk0DR0Partition0

01:57:43.0416 5460 E: <-> DeviceHarddisk0DR0Partition1

01:57:43.0417 5460 ============================================================

01:57:43.0417 5460 Initialize success

01:57:43.0417 5460 ============================================================

01:57:53.0466 3700 ============================================================

01:57:53.0466 3700 Scan started

01:57:53.0466 3700 Mode: Manual; SigCheck; TDLFS;

01:57:53.0466 3700 ============================================================

01:57:54.0259 3700 !SASCORE (c0393eb99a6c72c6bef9bfc4a72b33a6) C:Program FilesSUPERAntiSpywareSASCORE.EXE

01:57:54.0621 3700 !SASCORE - ok

01:57:54.0854 3700 ACPI (82b296ae1892fe3dbee00c9cf92f8ac7) C:Windowssystem32driversacpi.sys

01:57:54.0888 3700 ACPI - ok

01:57:54.0969 3700 adp94xx (04f0fcac69c7c71a3ac4eb97fafc8303) C:Windowssystem32driversadp94xx.sys

01:57:55.0008 3700 adp94xx - ok

01:57:55.0056 3700 adpahci (60505e0041f7751bdbb80f88bf45c2ce) C:Windowssystem32driversadpahci.sys

01:57:55.0089 3700 adpahci - ok

01:57:55.0133 3700 adpu160m (8a42779b02aec986eab64ecfc98f8bd7) C:Windowssystem32driversadpu160m.sys

01:57:55.0153 3700 adpu160m - ok

01:57:55.0185 3700 adpu320 (241c9e37f8ce45ef51c3de27515ca4e5) C:Windowssystem32driversadpu320.sys

01:57:55.0204 3700 adpu320 - ok

01:57:55.0321 3700 AeLookupSvc (9d1fda9e086ba64e3c93c9de32461bcf) C:WindowsSystem32aelupsvc.dll

01:57:55.0442 3700 AeLookupSvc - ok

01:57:55.0497 3700 AFD (3911b972b55fea0478476b2e777b29fa) C:Windowssystem32driversafd.sys

01:57:55.0562 3700 AFD - ok

01:57:55.0615 3700 agp440 (13f9e33747e6b41a3ff305c37db0d360) C:Windowssystem32driversagp440.sys

01:57:55.0630 3700 agp440 - ok

01:57:55.0671 3700 aic78xx (ae1fdf7bf7bb6c6a70f67699d880592a) C:Windowssystem32driversdjsvs.sys

01:57:55.0688 3700 aic78xx - ok

01:57:55.0715 3700 ALG (a1545b731579895d8cc44fc0481c1192) C:WindowsSystem32alg.exe

01:57:55.0842 3700 ALG - ok

01:57:55.0867 3700 aliide (9eaef5fc9b8e351afa7e78a6fae91f91) C:Windowssystem32driversaliide.sys

01:57:55.0881 3700 aliide - ok

01:57:55.0941 3700 amdagp (c47344bc706e5f0b9dce369516661578) C:Windowssystem32driversamdagp.sys

01:57:55.0964 3700 amdagp - ok

01:57:55.0982 3700 amdide (9b78a39a4c173fdbc1321e0dd659b34c) C:Windowssystem32driversamdide.sys

01:57:55.0996 3700 amdide - ok

01:57:56.0017 3700 AmdK7 (18f29b49ad23ecee3d2a826c725c8d48) C:Windowssystem32driversamdk7.sys

01:57:56.0080 3700 AmdK7 - ok

01:57:56.0103 3700 AmdK8 (93ae7f7dd54ab986a6f1a1b37be7442d) C:Windowssystem32driversamdk8.sys

01:57:56.0152 3700 AmdK8 - ok

01:57:56.0434 3700 appdrv01 (98f481241ba8bba38aa565bd3bf678f9) C:Windowssystem32Driversappdrv01.sys

01:57:56.0982 3700 appdrv01 - ok

01:57:57.0092 3700 appdrvrem01 - ok

01:57:57.0138 3700 Appinfo (c6d704c7f0434dc791aac37cac4b6e14) C:WindowsSystem32appinfo.dll

01:57:57.0188 3700 Appinfo - ok

01:57:57.0321 3700 Apple Mobile Device (3debbecf665dcdde3a95d9b902010817) C:Program FilesCommon FilesAppleMobile Device SupportAppleMobileDeviceService.exe

01:57:57.0338 3700 Apple Mobile Device - ok

01:57:57.0415 3700 arc (5d2888182fb46632511acee92fdad522) C:Windowssystem32driversarc.sys

01:57:57.0431 3700 arc - ok

01:57:57.0478 3700 arcsas (5e2a321bd7c8b3624e41fdec3e244945) C:Windowssystem32driversarcsas.sys

01:57:57.0495 3700 arcsas - ok

01:57:57.0531 3700 AsyncMac (53b202abee6455406254444303e87be1) C:Windowssystem32DRIVERSasyncmac.sys

01:57:57.0589 3700 AsyncMac - ok

01:57:57.0609 3700 atapi (1f05b78ab91c9075565a9d8a4b880bc4) C:Windowssystem32driversatapi.sys

01:57:57.0625 3700 atapi - ok

01:57:57.0659 3700 atashost (40767b965a8d575d794f1f95e2e017e9) C:Windowssystem32atashost.exe

01:57:57.0670 3700 atashost - ok

01:57:57.0729 3700 athr (6046a55f79de9c581b8d5e9c1366cc81) C:Windowssystem32DRIVERSathr.sys

01:57:57.0929 3700 athr - ok

01:57:58.0003 3700 AudioEndpointBuilder (68e2a1a0407a66cf50da0300852424ab) C:WindowsSystem32Audiosrv.dll

01:57:58.0091 3700 AudioEndpointBuilder - ok

01:57:58.0097 3700 Audiosrv (68e2a1a0407a66cf50da0300852424ab) C:WindowsSystem32Audiosrv.dll

01:57:58.0122 3700 Audiosrv - ok

01:57:58.0171 3700 Beep (67e506b75bd5326a3ec7b70bd014dfb6) C:Windowssystem32driversBeep.sys

01:57:58.0258 3700 Beep - ok

01:57:58.0370 3700 BFE (c789af0f724fda5852fb9a7d3a432381) C:WindowsSystem32bfe.dll

01:57:58.0427 3700 BFE - ok

01:57:58.0554 3700 BITS (93952506c6d67330367f7e7934b6a02f) C:Windowssystem32qmgr.dll

01:57:58.0626 3700 BITS - ok

01:57:58.0648 3700 blbdrive (d4df28447741fd3d953526e33a617397) C:Windowssystem32driversblbdrive.sys

01:57:58.0689 3700 blbdrive - ok

01:57:58.0722 3700 blzblk - ok

01:57:58.0800 3700 Bonjour Service (db5bea73edaf19ac68b2c0fad0f92b1a) C:Program FilesBonjourmDNSResponder.exe

01:57:58.0824 3700 Bonjour Service - ok

01:57:58.0866 3700 bowser (35f376253f687bde63976ccb3f2108ca) C:Windowssystem32DRIVERSbowser.sys

01:57:58.0893 3700 bowser - ok

01:57:58.0947 3700 BrFiltLo (9f9acc7f7ccde8a15c282d3f88b43309) C:Windowssystem32driversbrfiltlo.sys

01:57:58.0984 3700 BrFiltLo - ok

01:57:59.0000 3700 BrFiltUp (56801ad62213a41f6497f96dee83755a) C:Windowssystem32driversbrfiltup.sys

01:57:59.0054 3700 BrFiltUp - ok

01:57:59.0087 3700 Browser (a3629a0c4226f9e9c72faaeebc3ad33c) C:WindowsSystem32browser.dll

01:57:59.0141 3700 Browser - ok

01:57:59.0195 3700 Brserid (b304e75cff293029eddf094246747113) C:Windowssystem32driversbrserid.sys

01:57:59.0301 3700 Brserid - ok

01:57:59.0334 3700 BrSerWdm (203f0b1e73adadbbb7b7b1fabd901f6b) C:Windowssystem32driversbrserwdm.sys

01:57:59.0429 3700 BrSerWdm - ok

01:57:59.0459 3700 BrUsbMdm (bd456606156ba17e60a04e18016ae54b) C:Windowssystem32driversbrusbmdm.sys

01:57:59.0525 3700 BrUsbMdm - ok

01:57:59.0555 3700 BrUsbSer (af72ed54503f717a43268b3cc5faec2e) C:Windowssystem32driversbrusbser.sys

01:57:59.0637 3700 BrUsbSer - ok

01:57:59.0682 3700 BTHMODEM (ad07c1ec6665b8b35741ab91200c6b68) C:Windowssystem32driversbthmodem.sys

01:57:59.0738 3700 BTHMODEM - ok

01:57:59.0837 3700 catchme - ok

01:57:59.0856 3700 cdfs (7add03e75beb9e6dd102c3081d29840a) C:Windowssystem32DRIVERScdfs.sys

01:57:59.0897 3700 cdfs - ok

01:57:59.0925 3700 cdrom (6b4bffb9becd728097024276430db314) C:Windowssystem32DRIVERScdrom.sys

01:57:59.0953 3700 cdrom - ok

01:57:59.0996 3700 CertPropSvc (312ec3e37a0a1f2006534913e37b4423) C:WindowsSystem32certprop.dll

01:58:00.0029 3700 CertPropSvc - ok

01:58:00.0057 3700 circlass (e5d4133f37219dbcfe102bc61072589d) C:Windowssystem32driverscirclass.sys

01:58:00.0096 3700 circlass - ok

01:58:00.0151 3700 CLFS (d7659d3b5b92c31e84e53c1431f35132) C:Windowssystem32CLFS.sys

01:58:00.0172 3700 CLFS - ok

01:58:00.0255 3700 clr_optimization_v2.0.50727_32 (8ee772032e2fe80a924f3b8dd5082194) C:WindowsMicrosoft.NETFrameworkv2.0.50727mscorsvw.exe

01:58:00.0270 3700 clr_optimization_v2.0.50727_32 - ok

01:58:00.0316 3700 CmBatt (99afc3795b58cc478fbbbcdc658fcb56) C:Windowssystem32DRIVERSCmBatt.sys

01:58:00.0359 3700 CmBatt - ok

01:58:00.0380 3700 cmdide (0ca25e686a4928484e9fdabd168ab629) C:Windowssystem32driverscmdide.sys

01:58:00.0394 3700 cmdide - ok

01:58:00.0441 3700 CnxtHdAudAddService (76ffd950394c45196d09239edc9b006b) C:Windowssystem32driversCHDART.sys

01:58:00.0488 3700 CnxtHdAudAddService - ok

01:58:00.0522 3700 Compbatt (6afef0b60fa25de07c0968983ee4f60a) C:Windowssystem32DRIVERScompbatt.sys

01:58:00.0536 3700 Compbatt - ok

01:58:00.0540 3700 COMSysApp - ok

01:58:00.0615 3700 ConfigFree Service (596e452b5152ec9afe8153d296459d2b) C:Program FilesTOSHIBAConfigFreeCFSvcs.exe

01:58:00.0630 3700 ConfigFree Service ( UnsignedFile.Multi.Generic ) - warning

01:58:00.0630 3700 ConfigFree Service - detected UnsignedFile.Multi.Generic (1)

01:58:00.0645 3700 crcdisk (741e9dff4f42d2d8477d0fc1dc0df871) C:Windowssystem32driverscrcdisk.sys

01:58:00.0660 3700 crcdisk - ok

01:58:00.0683 3700 Crusoe (1f07becdca750766a96cda811ba86410) C:Windowssystem32driverscrusoe.sys

01:58:00.0720 3700 Crusoe - ok

01:58:00.0769 3700 CryptSvc (fb27772beaf8e1d28ccd825c09da939b) C:Windowssystem32cryptsvc.dll

01:58:00.0807 3700 CryptSvc - ok

01:58:00.0888 3700 DcomLaunch (3b5b4d53fec14f7476ca29a20cc31ac9) C:Windowssystem32rpcss.dll

01:58:00.0944 3700 DcomLaunch - ok

01:58:00.0983 3700 DfsC (622c41a07ca7e6dd91770f50d532cb6c) C:Windowssystem32Driversdfsc.sys

01:58:01.0027 3700 DfsC - ok

01:58:01.0208 3700 DFSR (2cc3dcfb533a1035b13dcab6160ab38b) C:Windowssystem32DFSR.exe

01:58:01.0388 3700 DFSR - ok

01:58:01.0526 3700 Dhcp (9028559c132146fb75eb7acf384b086a) C:WindowsSystem32dhcpcsvc.dll

01:58:01.0565 3700 Dhcp - ok

01:58:01.0633 3700 disk (5d4aefc3386920236a548271f8f1af6a) C:Windowssystem32driversdisk.sys

01:58:01.0649 3700 disk - ok

01:58:01.0681 3700 Dnscache (57d762f6f5974af0da2be88a3349baaa) C:WindowsSystem32dnsrslvr.dll

01:58:01.0740 3700 Dnscache - ok

01:58:01.0810 3700 dot3svc (324fd74686b1ef5e7c19a8af49e748f6) C:WindowsSystem32dot3svc.dll

01:58:01.0836 3700 dot3svc - ok

01:58:01.0866 3700 DPS (a622e888f8aa2f6b49e9bc466f0e5def) C:Windowssystem32dps.dll

01:58:01.0897 3700 DPS - ok

01:58:01.0939 3700 drmkaud (97fef831ab90bee128c9af390e243f80) C:Windowssystem32driversdrmkaud.sys

01:58:01.0980 3700 drmkaud - ok

01:58:02.0043 3700 DXGKrnl (c68ac676b0ef30cfbb1080adce49eb1f) C:WindowsSystem32driversdxgkrnl.sys

01:58:02.0081 3700 DXGKrnl - ok

01:58:02.0119 3700 E1G60 (5425f74ac0c1dbd96a1e04f17d63f94c) C:Windowssystem32DRIVERSE1G60I32.sys

01:58:02.0181 3700 E1G60 - ok

01:58:02.0213 3700 EapHost (c0b95e40d85cd807d614e264248a45b9) C:WindowsSystem32eapsvc.dll

01:58:02.0245 3700 EapHost - ok

01:58:02.0342 3700 Ecache (7f64ea048dcfac7acf8b4d7b4e6fe371) C:Windowssystem32driversecache.sys

01:58:02.0371 3700 Ecache - ok

01:58:02.0445 3700 ehRecvr (9be3744d295a7701eb425332014f0797) C:WindowsehomeehRecvr.exe

01:58:02.0483 3700 ehRecvr - ok

01:58:02.0514 3700 ehSched (ad1870c8e5d6dd340c829e6074bf3c3f) C:Windowsehomeehsched.exe

01:58:02.0551 3700 ehSched - ok

01:58:02.0564 3700 ehstart (c27c4ee8926e74aa72efcab24c5242c3) C:Windowsehomeehstart.dll

01:58:02.0584 3700 ehstart - ok

01:58:02.0638 3700 elxstor (23b62471681a124889978f6295b3f4c6) C:Windowssystem32driverselxstor.sys

01:58:02.0664 3700 elxstor - ok

01:58:02.0733 3700 EMDMgmt (4e6b23dfc917ea39306b529b773950f4) C:Windowssystem32emdmgmt.dll

01:58:02.0858 3700 EMDMgmt - ok

01:58:02.0914 3700 ErrDev (3db974f3935483555d7148663f726c61) C:Windowssystem32driverserrdev.sys

01:58:02.0956 3700 ErrDev - ok

01:58:03.0033 3700 EventSystem (67058c46504bc12d821f38cf99b7b28f) C:Windowssystem32es.dll

01:58:03.0085 3700 EventSystem - ok

01:58:03.0162 3700 ewusbnet (fb54f67974d13d73be3e2f1df042d295) C:Windowssystem32DRIVERSewusbnet.sys

01:58:03.0219 3700 ewusbnet - ok

01:58:03.0268 3700 ew_hwusbdev (57c171ea22f0a7f068fcb0caedd1e8e7) C:Windowssystem32DRIVERSew_hwusbdev.sys

01:58:03.0317 3700 ew_hwusbdev - ok

01:58:03.0396 3700 exfat (22b408651f9123527bcee54b4f6c5cae) C:Windowssystem32driversexfat.sys

01:58:03.0462 3700 exfat - ok

01:58:03.0513 3700 fastfat (1e9b9a70d332103c52995e957dc09ef8) C:Windowssystem32driversfastfat.sys

01:58:03.0584 3700 fastfat - ok

01:58:03.0638 3700 fdc (afe1e8b9782a0dd7fb46bbd88e43f89a) C:Windowssystem32DRIVERSfdc.sys

01:58:03.0691 3700 fdc - ok

01:58:03.0727 3700 fdPHost (6629b5f0e98151f4afdd87567ea32ba3) C:Windowssystem32fdPHost.dll

01:58:03.0759 3700 fdPHost - ok

01:58:03.0774 3700 FDResPub (89ed56dce8e47af40892778a5bd31fd2) C:Windowssystem32fdrespub.dll

01:58:03.0842 3700 FDResPub - ok

01:58:03.0889 3700 FileInfo (a8c0139a884861e3aae9cfe73b208a9f) C:Windowssystem32driversfileinfo.sys

01:58:03.0907 3700 FileInfo - ok

01:58:03.0939 3700 Filetrace (0ae429a696aecbc5970e3cf2c62635ae) C:Windowssystem32driversfiletrace.sys

01:58:03.0990 3700 Filetrace - ok

01:58:04.0037 3700 flpydisk (85b7cf99d532820495d68d747fda9ebd) C:Windowssystem32DRIVERSflpydisk.sys

01:58:04.0070 3700 flpydisk - ok

01:58:04.0154 3700 FltMgr (01334f9ea68e6877c4ef05d3ea8abb05) C:Windowssystem32driversfltmgr.sys

01:58:04.0179 3700 FltMgr - ok

01:58:04.0260 3700 FontCache (452feaab2a8dbb42ed751754cb2594f5) C:Windowssystem32FntCache.dll

01:58:04.0376 3700 FontCache - ok

01:58:04.0448 3700 FontCache3.0.0.0 (c7fbdd1ed42f82bfa35167a5c9803ea3) C:WindowsMicrosoft.NetFrameworkv3.0WPFPresentationFontCache.exe

01:58:04.0465 3700 FontCache3.0.0.0 - ok

01:58:04.0520 3700 Fs_Rec (b972a66758577e0bfd1de0f91aaa27b5) C:Windowssystem32driversFs_Rec.sys

01:58:04.0567 3700 Fs_Rec - ok

01:58:04.0591 3700 gagp30kx (34582a6e6573d54a07ece5fe24a126b5) C:Windowssystem32driversgagp30kx.sys

01:58:04.0606 3700 gagp30kx - ok

01:58:04.0658 3700 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:Windowssystem32DRIVERSGEARAspiWDM.sys

01:58:04.0677 3700 GEARAspiWDM - ok

01:58:04.0774 3700 GoogleDesktopManager-051210-111108 (9f5f2f0fb0a7f5aa9f16b9a7b6dad89f) C:Program FilesGoogleGoogle Desktop SearchGoogleDesktop.exe

01:58:04.0785 3700 GoogleDesktopManager-051210-111108 - ok

01:58:04.0872 3700 gpsvc (cd5d0aeee35dfd4e986a5aa1500a6e66) C:WindowsSystem32gpsvc.dll

01:58:04.0979 3700 gpsvc - ok

01:58:05.0061 3700 gupdate1c9b3b05e509870 (626a24ed1228580b9518c01930936df9) C:Program FilesGoogleUpdateGoogleUpdate.exe

01:58:05.0077 3700 gupdate1c9b3b05e509870 - ok

01:58:05.0110 3700 gupdatem (626a24ed1228580b9518c01930936df9) C:Program FilesGoogleUpdateGoogleUpdate.exe

01:58:05.0135 3700 gupdatem - ok

01:58:05.0196 3700 gusvc (cc839e8d766cc31a7710c9f38cf3e375) C:Program FilesGoogleCommonGoogle UpdaterGoogleUpdaterService.exe

01:58:05.0212 3700 gusvc - ok

01:58:05.0252 3700 hamachi (833051c6c6c42117191935f734cfbd97) C:Windowssystem32DRIVERShamachi.sys

01:58:05.0264 3700 hamachi - ok

01:58:05.0388 3700 Hamachi2Svc (fa89c0429821c7c429eec7a0ce1c02d3) C:Program FilesLogMeIn Hamachihamachi-2.exe

01:58:05.0450 3700 Hamachi2Svc - ok

01:58:05.0619 3700 HdAudAddService (cb04c744be0a61b1d648faed182c3b59) C:Windowssystem32driversHdAudio.sys

01:58:05.0683 3700 HdAudAddService - ok

01:58:05.0744 3700 HDAudBus (062452b7ffd68c8c042a6261fe8dff4a) C:Windowssystem32DRIVERSHDAudBus.sys

01:58:05.0781 3700 HDAudBus - ok

01:58:05.0816 3700 HidBth (1338520e78d90154ed6be8f84de5fceb) C:Windowssystem32drivershidbth.sys

01:58:05.0881 3700 HidBth - ok

01:58:05.0898 3700 HidIr (ff3160c3a2445128c5a6d9b076da519e) C:Windowssystem32drivershidir.sys

01:58:05.0963 3700 HidIr - ok

01:58:06.0008 3700 hidserv (84067081f3318162797385e11a8f0582) C:WindowsSystem32hidserv.dll

01:58:06.0059 3700 hidserv - ok

01:58:06.0077 3700 HidUsb (cca4b519b17e23a00b826c55716809cc) C:Windowssystem32DRIVERShidusb.sys

01:58:06.0112 3700 HidUsb - ok

01:58:06.0146 3700 hkmsvc (d8ad255b37da92434c26e4876db7d418) C:Windowssystem32kmsvc.dll

01:58:06.0183 3700 hkmsvc - ok

01:58:06.0214 3700 HpCISSs (16ee7b23a009e00d835cdb79574a91a6) C:Windowssystem32drivershpcisss.sys

01:58:06.0229 3700 HpCISSs - ok

01:58:06.0353 3700 HSF_DPV (cc267848cb3508e72762be65734e764d) C:Windowssystem32DRIVERSHSX_DPV.sys

01:58:06.0469 3700 HSF_DPV - ok

01:58:06.0513 3700 HSXHWAZL (a2882945cc4b6e3e4e9e825590438888) C:Windowssystem32DRIVERSHSXHWAZL.sys

01:58:06.0528 3700 HSXHWAZL - ok

01:58:06.0581 3700 HTTP (f870aa3e254628ebeafe754108d664de) C:Windowssystem32driversHTTP.sys

01:58:06.0650 3700 HTTP - ok

01:58:06.0692 3700 huawei_enumerator (f44461e66f1b7dd267957fe9baa63ed0) C:Windowssystem32DRIVERSew_jubusenum.sys

01:58:06.0751 3700 huawei_enumerator - ok

01:58:06.0928 3700 hwdatacard (f547f862b8907f1bcbd9b72a72a6449e) C:Windowssystem32DRIVERSewusbmdm.sys

01:58:07.0015 3700 hwdatacard - ok

01:58:07.0202 3700 HWDeviceService.exe - ok

01:58:07.0436 3700 i2omp (c6b032d69650985468160fc9937cf5b4) C:Windowssystem32driversi2omp.sys

01:58:07.0456 3700 i2omp - ok

01:58:07.0748 3700 i8042prt (22d56c8184586b7a1f6fa60be5f5a2bd) C:Windowssystem32DRIVERSi8042prt.sys

01:58:07.0873 3700 i8042prt - ok

01:58:09.0080 3700 iaStor (e5a0034847537eaee3c00349d5c34c5f) C:Windowssystem32DRIVERSiaStor.sys

01:58:09.0097 3700 iaStor - ok

01:58:09.0635 3700 iaStorV (54155ea1b0df185878e0fc9ec3ac3a14) C:Windowssystem32driversiastorv.sys

01:58:09.0695 3700 iaStorV - ok

01:58:10.0050 3700 IDriverT (1cf03c69b49acb70c722df92755c0c8c) C:Program FilesCommon FilesInstallShieldDriver11Intel 32IDriverT.exe

01:58:10.0071 3700 IDriverT ( UnsignedFile.Multi.Generic ) - warning

01:58:10.0071 3700 IDriverT - detected UnsignedFile.Multi.Generic (1)

01:58:11.0053 3700 idsvc (98477b08e61945f974ed9fdc4cb6bdab) C:WindowsMicrosoft.NETFrameworkv3.0Windows Communication Foundationinfocard.exe

01:58:11.0203 3700 idsvc - ok

01:58:15.0120 3700 igfx (038815297078d236d8cc064c295a74c6) C:Windowssystem32DRIVERSigdkmd32.sys

01:58:15.0518 3700 igfx - ok

01:58:15.0733 3700 iirsp (2d077bf86e843f901d8db709c95b49a5) C:Windowssystem32driversiirsp.sys

01:58:15.0754 3700 iirsp - ok

01:58:15.0853 3700 IKEEXT (9908d8a397b76cd8d31d0d383c5773c9) C:WindowsSystem32ikeext.dll

01:58:15.0926 3700 IKEEXT - ok

01:58:16.0019 3700 IntcHdmiAddService (98d303ccb3415e9202e82043b37d66dc) C:Windowssystem32driversIntcHdmi.sys

01:58:16.0077 3700 IntcHdmiAddService - ok

01:58:16.0098 3700 intelide (83aa759f3189e6370c30de5dc5590718) C:Windowssystem32driversintelide.sys

01:58:16.0114 3700 intelide - ok

01:58:16.0139 3700 intelppm (224191001e78c89dfa78924c3ea595ff) C:Windowssystem32DRIVERSintelppm.sys

01:58:16.0205 3700 intelppm - ok

01:58:16.0239 3700 IPBusEnum (9ac218c6e6105477484c6fdbe7d409a4) C:Windowssystem32ipbusenum.dll

01:58:16.0299 3700 IPBusEnum - ok

01:58:16.0326 3700 IpFilterDriver (62c265c38769b864cb25b4bcf62df6c3) C:Windowssystem32DRIVERSipfltdrv.sys

01:58:16.0378 3700 IpFilterDriver - ok

01:58:16.0450 3700 iphlpsvc (1998bd97f950680bb55f55a7244679c2) C:WindowsSystem32iphlpsvc.dll

01:58:16.0502 3700 iphlpsvc - ok

01:58:16.0506 3700 IpInIp - ok

01:58:16.0538 3700 IPMIDRV (b25aaf203552b7b3491139d582b39ad1) C:Windowssystem32driversipmidrv.sys

01:58:16.0587 3700 IPMIDRV - ok

01:58:16.0629 3700 IPNAT (8793643a67b42cec66490b2a0cf92d68) C:Windowssystem32DRIVERSipnat.sys

01:58:16.0658 3700 IPNAT - ok

01:58:17.0187 3700 iPod Service (178fe38b7740f598391eb2f51ae4ccac) C:Program FilesiPodbiniPodService.exe

01:58:17.0366 3700 iPod Service - ok

01:58:17.0473 3700 IRENUM (109c0dfb82c3632fbd11949b73aeeac9) C:Windowssystem32driversirenum.sys

01:58:17.0502 3700 IRENUM - ok

01:58:17.0558 3700 isapnp (6c70698a3e5c4376c6ab5c7c17fb0614) C:Windowssystem32driversisapnp.sys

01:58:17.0598 3700 isapnp - ok

01:58:17.0726 3700 iScsiPrt (232fa340531d940aac623b121a595034) C:Windowssystem32DRIVERSmsiscsi.sys

01:58:17.0751 3700 iScsiPrt - ok

01:58:17.0822 3700 iteatapi (bced60d16156e428f8df8cf27b0df150) C:Windowssystem32driversiteatapi.sys

01:58:17.0837 3700 iteatapi - ok

01:58:17.0882 3700 iteraid (06fa654504a498c30adca8bec4e87e7e) C:Windowssystem32driversiteraid.sys

01:58:17.0903 3700 iteraid - ok

01:58:17.0961 3700 kbdclass (37605e0a8cf00cbba538e753e4344c6e) C:Windowssystem32DRIVERSkbdclass.sys

01:58:17.0984 3700 kbdclass - ok

01:58:18.0000 3700 kbdhid (18247836959ba67e3511b62846b9c2e0) C:Windowssystem32driverskbdhid.sys

01:58:18.0079 3700 kbdhid - ok

01:58:18.0191 3700 KernelPort - ok

01:58:18.0336 3700 KeyIso (a3e186b4b935905b829219502557314e) C:Windowssystem32lsass.exe

01:58:18.0404 3700 KeyIso - ok

01:58:19.0138 3700 KSecDD (2b2f1638466e8cb091400c9019cc730e) C:Windowssystem32Driversksecdd.sys

01:58:19.0247 3700 KSecDD - ok

01:58:20.0076 3700 KtmRm (8078f8f8f7a79e2e6b494523a828c585) C:Windowssystem32msdtckrm.dll

01:58:20.0252 3700 KtmRm - ok

01:58:20.0497 3700 LanmanServer (1bf5eebfd518dd7298434d8c862f825d) C:WindowsSystem32srvsvc.dll

01:58:20.0558 3700 LanmanServer - ok

01:58:20.0797 3700 LanmanWorkstation (1db69705b695b987082c8baec0c6b34f) C:WindowsSystem32wkssvc.dll

01:58:20.0857 3700 LanmanWorkstation - ok

01:58:20.0881 3700 LLRING0 - ok

01:58:20.0937 3700 lltdio (d1c5883087a0c3f1344d9d55a44901f6) C:Windowssystem32DRIVERSlltdio.sys

01:58:20.0989 3700 lltdio - ok

01:58:21.0210 3700 lltdsvc (2d5a428872f1442631d0959a34abff63) C:WindowsSystem32lltdsvc.dll

01:58:21.0569 3700 lltdsvc - ok

01:58:21.0599 3700 lmhosts (35d40113e4a5b961b6ce5c5857702518) C:WindowsSystem32lmhsvc.dll

01:58:21.0651 3700 lmhosts - ok

01:58:21.0691 3700 LSI_FC (c7e15e82879bf3235b559563d4185365) C:Windowssystem32driverslsi_fc.sys

01:58:21.0721 3700 LSI_FC - ok

01:58:21.0850 3700 LSI_SAS (ee01ebae8c9bf0fa072e0ff68718920a) C:Windowssystem32driverslsi_sas.sys

01:58:21.0883 3700 LSI_SAS - ok

01:58:21.0978 3700 LSI_SCSI (912a04696e9ca30146a62afa1463dd5c) C:Windowssystem32driverslsi_scsi.sys

01:58:22.0003 3700 LSI_SCSI - ok

01:58:22.0081 3700 luafv (8f5c7426567798e62a3b3614965d62cc) C:Windowssystem32driversluafv.sys

01:58:22.0111 3700 luafv - ok

01:58:22.0327 3700 M-Tel NETAGENT. RunOuc (38106c7bd34eae89d2769ac0ba2e846b) C:Program FilesM-Tel NETAGENTUpdateDogouc.exe

01:58:22.0347 3700 M-Tel NETAGENT. RunOuc ( UnsignedFile.Multi.Generic ) - warning

01:58:22.0347 3700 M-Tel NETAGENT. RunOuc - detected UnsignedFile.Multi.Generic (1)

01:58:22.0424 3700 MBAMProtector (fb097bbc1a18f044bd17bd2fccf97865) C:Windowssystem32driversmbam.sys

01:58:22.0439 3700 MBAMProtector - ok

01:58:22.0712 3700 MBAMService (ba400ed640bca1eae5c727ae17c10207) C:Program FilesMalwarebytes' Anti-Malwarembamservice.exe

01:58:22.0805 3700 MBAMService - ok

01:58:22.0890 3700 Mcx2Svc (aef9babb8a506bc4ce0451a64aaded46) C:Windowssystem32Mcx2Svc.dll

01:58:22.0931 3700 Mcx2Svc - ok

01:58:22.0988 3700 mdmxsdk (0cea2d0d3fa284b85ed5b68365114f76) C:Windowssystem32DRIVERSmdmxsdk.sys

01:58:23.0006 3700 mdmxsdk - ok

01:58:23.0088 3700 megasas (0001ce609d66632fa17b84705f658879) C:Windowssystem32driversmegasas.sys

01:58:23.0104 3700 megasas - ok

01:58:23.0384 3700 MegaSR (c252f32cd9a49dbfc25ecf26ebd51a99) C:Windowssystem32driversmegasr.sys

01:58:23.0498 3700 MegaSR - ok

01:58:23.0650 3700 Microsoft Office Groove Audit Service (123271bd5237ab991dc5c21fdf8835eb) C:Program FilesMicrosoft OfficeOffice12GrooveAuditService.exe

01:58:23.0664 3700 Microsoft Office Groove Audit Service - ok

01:58:23.0708 3700 MMCSS (1076ffcffaae8385fd62dfcb25ac4708) C:Windowssystem32mmcss.dll

01:58:23.0750 3700 MMCSS - ok

01:58:23.0791 3700 Modem (e13b5ea0f51ba5b1512ec671393d09ba) C:Windowssystem32driversmodem.sys

01:58:23.0819 3700 Modem - ok

01:58:23.0853 3700 monitor (0a9bb33b56e294f686abb7c1e4e2d8a8) C:Windowssystem32DRIVERSmonitor.sys

01:58:23.0899 3700 monitor - ok

01:58:23.0957 3700 mouclass (5bf6a1326a335c5298477754a506d263) C:Windowssystem32DRIVERSmouclass.sys

01:58:23.0992 3700 mouclass - ok

01:58:24.0032 3700 mouhid (93b8d4869e12cfbe663915502900876f) C:Windowssystem32DRIVERSmouhid.sys

01:58:24.0073 3700 mouhid - ok

01:58:24.0090 3700 MountMgr (bdafc88aa6b92f7842416ea6a48e1600) C:Windowssystem32driversmountmgr.sys

01:58:24.0106 3700 MountMgr - ok

01:58:24.0215 3700 MozillaMaintenance (96aa8ba23142cc8e2b30f3cae0c80254) C:Program FilesMozilla Maintenance Servicemaintenanceservice.exe

01:58:24.0235 3700 MozillaMaintenance - ok

01:58:24.0308 3700 mpio (511d011289755dd9f9a7579fb0b064e6) C:Windowssystem32driversmpio.sys

01:58:24.0329 3700 mpio - ok

01:58:24.0349 3700 mpsdrv (22241feba9b2defa669c8cb0a8dd7d2e) C:Windowssystem32driversmpsdrv.sys

01:58:24.0395 3700 mpsdrv - ok

01:58:24.0542 3700 MpsSvc (5de62c6e9108f14f6794060a9bdecaec) C:Windowssystem32mpssvc.dll

01:58:24.0602 3700 MpsSvc - ok

01:58:24.0690 3700 Mraid35x (4fbbb70d30fd20ec51f80061703b001e) C:Windowssystem32driversmraid35x.sys

01:58:24.0705 3700 Mraid35x - ok

01:58:24.0850 3700 MRxDAV (82cea0395524aacfeb58ba1448e8325c) C:Windowssystem32driversmrxdav.sys

01:58:24.0906 3700 MRxDAV - ok

01:58:25.0018 3700 mrxsmb (1e94971c4b446ab2290deb71d01cf0c2) C:Windowssystem32DRIVERSmrxsmb.sys

01:58:25.0074 3700 mrxsmb - ok

01:58:25.0223 3700 mrxsmb10 (4fccb34d793b116423209c0f8b7a3b03) C:Windowssystem32DRIVERSmrxsmb10.sys

01:58:25.0326 3700 mrxsmb10 - ok

01:58:25.0364 3700 mrxsmb20 (c3cb1b40ad4a0124d617a1199b0b9d7c) C:Windowssystem32DRIVERSmrxsmb20.sys

01:58:25.0470 3700 mrxsmb20 - ok

01:58:25.0597 3700 msahci (28023e86f17001f7cd9b15a5bc9ae07d) C:Windowssystem32driversmsahci.sys

01:58:25.0614 3700 msahci - ok

01:58:25.0713 3700 msdsm (4468b0f385a86ecddaf8d3ca662ec0e7) C:Windowssystem32driversmsdsm.sys

01:58:25.0730 3700 msdsm - ok

01:58:25.0936 3700 MSDTC (fd7520cc3a80c5fc8c48852bb24c6ded) C:WindowsSystem32msdtc.exe

01:58:25.0980 3700 MSDTC - ok

01:58:26.0068 3700 Msfs (a9927f4a46b816c92f461acb90cf8515) C:Windowssystem32driversMsfs.sys

01:58:26.0114 3700 Msfs - ok

01:58:26.0203 3700 msisadrv (0f400e306f385c56317357d6dea56f62) C:Windowssystem32driversmsisadrv.sys

01:58:26.0217 3700 msisadrv - ok

01:58:26.0302 3700 MSiSCSI (85466c0757a23d9a9aecdc0755203cb2) C:Windowssystem32iscsiexe.dll

01:58:26.0352 3700 MSiSCSI - ok

01:58:26.0359 3700 msiserver - ok

01:58:26.0473 3700 MSKSSRV (d8c63d34d9c9e56c059e24ec7185cc07) C:Windowssystem32driversMSKSSRV.sys

01:58:26.0519 3700 MSKSSRV - ok

01:58:26.0603 3700 MSPCLOCK (1d373c90d62ddb641d50e55b9e78d65e) C:Windowssystem32driversMSPCLOCK.sys

01:58:26.0656 3700 MSPCLOCK - ok

01:58:26.0674 3700 MSPQM (b572da05bf4e098d4bba3a4734fb505b) C:Windowssystem32driversMSPQM.sys

01:58:26.0727 3700 MSPQM - ok

01:58:26.0855 3700 MsRPC (b49456d70555de905c311bcda6ec6adb) C:Windowssystem32driversMsRPC.sys

01:58:26.0877 3700 MsRPC - ok

01:58:27.0014 3700 mssmbios (e384487cb84be41d09711c30ca79646c) C:Windowssystem32DRIVERSmssmbios.sys

01:58:27.0029 3700 mssmbios - ok

01:58:27.0084 3700 MSTEE (7199c1eec1e4993caf96b8c0a26bd58a) C:Windowssystem32driversMSTEE.sys

01:58:27.0148 3700 MSTEE - ok

01:58:27.0260 3700 Mup (6a57b5733d4cb702c8ea4542e836b96c) C:Windowssystem32Driversmup.sys

01:58:27.0279 3700 Mup - ok

01:58:27.0521 3700 napagent (e4eaf0c5c1b41b5c83386cf212ca9584) C:Windowssystem32qagentRT.dll

01:58:27.0580 3700 napagent - ok

01:58:27.0723 3700 NativeWifiP (85c44fdff9cf7e72a40dcb7ec06a4416) C:Windowssystem32DRIVERSnwifi.sys

01:58:27.0767 3700 NativeWifiP - ok

01:58:27.0959 3700 NDIS (1357274d1883f68300aeadd15d7bbb42) C:Windowssystem32driversndis.sys

01:58:28.0046 3700 NDIS - ok

01:58:28.0144 3700 NdisTapi (0e186e90404980569fb449ba7519ae61) C:Windowssystem32DRIVERSndistapi.sys

01:58:28.0178 3700 NdisTapi - ok

01:58:28.0212 3700 Ndisuio (d6973aa34c4d5d76c0430b181c3cd389) C:Windowssystem32DRIVERSndisuio.sys

01:58:28.0261 3700 Ndisuio - ok

01:58:28.0354 3700 NdisWan (818f648618ae34f729fdb47ec68345c3) C:Windowssystem32DRIVERSndiswan.sys

01:58:28.0409 3700 NdisWan - ok

01:58:28.0458 3700 NDProxy (71dab552b41936358f3b541ae5997fb3) C:Windowssystem32driversNDProxy.sys

01:58:28.0524 3700 NDProxy - ok

01:58:28.0569 3700 NetBIOS (bcd093a5a6777cf626434568dc7dba78) C:Windowssystem32DRIVERSnetbios.sys

01:58:28.0604 3700 NetBIOS - ok

01:58:28.0905 3700 netbt (ecd64230a59cbd93c85f1cd1cab9f3f6) C:Windowssystem32DRIVERSnetbt.sys

01:58:28.0947 3700 netbt - ok

01:58:29.0014 3700 Netlogon (a3e186b4b935905b829219502557314e) C:Windowssystem32lsass.exe

01:58:29.0029 3700 Netlogon - ok

01:58:29.0453 3700 Netman (c8052711daecc48b982434c5116ca401) C:WindowsSystem32netman.dll

01:58:29.0576 3700 Netman - ok

01:58:29.0826 3700 netprofm (2ef3bbe22e5a5acd1428ee387a0d0172) C:WindowsSystem32netprofm.dll

01:58:29.0925 3700 netprofm - ok

01:58:30.0106 3700 NetTcpPortSharing (d6c4e4a39a36029ac0813d476fbd0248) C:WindowsMicrosoft.NETFrameworkv3.0Windows Communication FoundationSMSvcHost.exe

01:58:30.0143 3700 NetTcpPortSharing - ok

01:58:33.0569 3700 NETw3v32 (35d5458d9a1b26b2005abffbf4c1c5e7) C:Windowssystem32DRIVERSNETw3v32.sys

01:58:34.0687 3700 NETw3v32 - ok

01:58:38.0645 3700 NETw4v32 (6522dd40a5f67ced020bd81b856613fb) C:Windowssystem32DRIVERSNETw4v32.sys

01:58:39.0946 3700 NETw4v32 - ok

01:58:40.0760 3700 nfrd960 (2e7fb731d4790a1bc6270accefacb36e) C:Windowssystem32driversnfrd960.sys

01:58:40.0801 3700 nfrd960 - ok

01:58:41.0159 3700 NlaSvc (2997b15415f9bbe05b5a4c1c85e0c6a2) C:WindowsSystem32nlasvc.dll

01:58:41.0617 3700 NlaSvc - ok

01:58:42.0356 3700 nmservice (cd2fe9c33cfd0fe0af124e05907e5c3d) C:Program FilesCommon FilesPure Networks SharedPlatformnmsrvc.exe

01:58:42.0569 3700 nmservice - ok

01:58:42.0695 3700 Npfs (d36f239d7cce1931598e8fb90a0dbc26) C:Windowssystem32driversNpfs.sys

01:58:42.0748 3700 Npfs - ok

01:58:42.0778 3700 nsi (8bb86f0c7eea2bded6fe095d0b4ca9bd) C:Windowssystem32nsisvc.dll

01:58:42.0809 3700 nsi - ok

01:58:42.0835 3700 nsiproxy (609773e344a97410ce4ebf74a8914fcf) C:Windowssystem32driversnsiproxy.sys

01:58:42.0895 3700 nsiproxy - ok

01:58:43.0190 3700 Ntfs (6a4a98cee84cf9e99564510dda4baa47) C:Windowssystem32driversNtfs.sys

01:58:43.0671 3700 Ntfs - ok

01:58:43.0728 3700 ntrigdigi (e875c093aec0c978a90f30c9e0dfbb72) C:Windowssystem32driversntrigdigi.sys

01:58:43.0777 3700 ntrigdigi - ok

01:58:43.0817 3700 Null (c5dbbcda07d780bda9b685df333bb41e) C:Windowssystem32driversNull.sys

01:58:43.0854 3700 Null - ok

01:58:44.0160 3700 nvraid (2edf9e7751554b42cbb60116de727101) C:Windowssystem32driversnvraid.sys

01:58:44.0213 3700 nvraid - ok

01:58:44.0273 3700 nvstor (abed0c09758d1d97db0042dbb2688177) C:Windowssystem32driversnvstor.sys

01:58:44.0289 3700 nvstor - ok

01:58:44.0386 3700 nv_agp (18bbdf913916b71bd54575bdb6eeac0b) C:Windowssystem32driversnv_agp.sys

01:58:44.0433 3700 nv_agp - ok

01:58:44.0437 3700 NwlnkFlt - ok

01:58:44.0453 3700 NwlnkFwd - ok

01:58:44.0972 3700 o2flash (d955d5de998db2476bf0892be3a96c26) C:Program FilesO2Micro Flash Memory Card Drivero2flash.exe

01:58:44.0999 3700 o2flash ( UnsignedFile.Multi.Generic ) - warning

01:58:44.0999 3700 o2flash - detected UnsignedFile.Multi.Generic (1)

01:58:45.0060 3700 O2MDRDR (d51942f12090fc947ca8aa01736dade2) C:Windowssystem32DRIVERSo2media.sys

01:58:45.0072 3700 O2MDRDR - ok

01:58:45.0921 3700 odserv (785f487a64950f3cb8e9f16253ba3b7b) C:Program FilesCommon FilesMicrosoft SharedOFFICE12ODSERV.EXE

01:58:46.0236 3700 odserv - ok

01:58:46.0432 3700 ohci1394 (6f310e890d46e246e0e261a63d9b36b4) C:Windowssystem32DRIVERSohci1394.sys

01:58:46.0482 3700 ohci1394 - ok

01:58:46.0790 3700 ose (5a432a042dae460abe7199b758e8606c) C:Program FilesCommon FilesMicrosoft SharedSource EngineOSE.EXE

01:58:46.0845 3700 ose - ok

01:58:47.0011 3700 p2pimsvc (0c8e8e61ad1eb0b250b846712c917506) C:Windowssystem32p2psvc.dll

01:58:47.0153 3700 p2pimsvc - ok

01:58:47.0164 3700 p2psvc (0c8e8e61ad1eb0b250b846712c917506) C:Windowssystem32p2psvc.dll

01:58:47.0214 3700 p2psvc - ok

01:58:47.0299 3700 Parport (0fa9b5055484649d63c303fe404e5f4d) C:Windowssystem32driversparport.sys

01:58:47.0359 3700 Parport - ok

01:58:47.0392 3700 partmgr (b9c2b89f08670e159f7181891e449cd9) C:Windowssystem32driverspartmgr.sys

01:58:47.0410 3700 partmgr - ok

01:58:47.0441 3700 Parvdm (4f9a6a8a31413180d0fcb279ad5d8112) C:Windowssystem32driversparvdm.sys

01:58:47.0518 3700 Parvdm - ok

01:58:47.0561 3700 PcaSvc (c6276ad11f4bb49b58aa1ed88537f14a) C:WindowsSystem32pcasvc.dll

01:58:47.0604 3700 PcaSvc - ok

01:58:47.0680 3700 pccsmcfd (fd2041e9ba03db7764b2248f02475079) C:Windowssystem32DRIVERSpccsmcfd.sys

01:58:47.0727 3700 pccsmcfd - ok

01:58:47.0766 3700 pci (941dc1d19e7e8620f40bbc206981efdb) C:Windowssystem32driverspci.sys

01:58:47.0788 3700 pci - ok

01:58:47.0825 3700 pciide (fc175f5ddab666d7f4d17449a547626f) C:Windowssystem32driverspciide.sys

01:58:47.0878 3700 pciide - ok

01:58:47.0914 3700 pcmcia (e6f3fb1b86aa519e7698ad05e58b04e5) C:Windowssystem32driverspcmcia.sys

01:58:47.0935 3700 pcmcia - ok

01:58:48.0018 3700 PEAUTH (6349f6ed9c623b44b52ea3c63c831a92) C:Windowssystem32driverspeauth.sys

01:58:48.0167 3700 PEAUTH - ok

01:58:48.0347 3700 pgsql-8.3 (7c620e950bf1fe96e0fc81985b0b0b4a) C:Program FilesPostgreSQL8.3binpg_ctl.exe

01:58:48.0364 3700 pgsql-8.3 ( UnsignedFile.Multi.Generic ) - warning

01:58:48.0364 3700 pgsql-8.3 - detected UnsignedFile.Multi.Generic (1)

01:58:48.0937 3700 pla (b1689df169143f57053f795390c99db3) C:Windowssystem32pla.dll

01:58:49.0309 3700 pla - ok

01:58:49.0628 3700 PlugPlay (c5e7f8a996ec0a82d508fd9064a5569e) C:Windowssystem32umpnpmgr.dll

01:58:49.0696 3700 PlugPlay - ok

01:58:49.0779 3700 pnarp (63200893c9d5934a7504d20f68276cc7) C:Windowssystem32DRIVERSpnarp.sys

01:58:49.0799 3700 pnarp - ok

01:58:50.0140 3700 PNRPAutoReg (0c8e8e61ad1eb0b250b846712c917506) C:Windowssystem32p2psvc.dll

01:58:50.0486 3700 PNRPAutoReg - ok

01:58:50.0497 3700 PNRPsvc (0c8e8e61ad1eb0b250b846712c917506) C:Windowssystem32p2psvc.dll

01:58:50.0663 3700 PNRPsvc - ok

01:58:50.0804 3700 PolicyAgent (d0494460421a03cd5225cca0059aa146) C:WindowsSystem32ipsecsvc.dll

01:58:50.0870 3700 PolicyAgent - ok

01:58:50.0961 3700 postgresql-8.4 - ok

01:58:50.0996 3700 PptpMiniport (ecfffaec0c1ecd8dbc77f39070ea1db1) C:Windowssystem32DRIVERSraspptp.sys

01:58:51.0120 3700 PptpMiniport - ok

01:58:51.0177 3700 Processor (2027293619dd0f047c584cf2e7df4ffd) C:Windowssystem32driversprocessr.sys

01:58:51.0217 3700 Processor - ok

01:58:51.0311 3700 ProfSvc (0508faa222d28835310b7bfca7a77346) C:Windowssystem32profsvc.dll

01:58:51.0339 3700 ProfSvc - ok

01:58:51.0361 3700 ProtectedStorage (a3e186b4b935905b829219502557314e) C:Windowssystem32lsass.exe

01:58:51.0401 3700 ProtectedStorage - ok

01:58:51.0517 3700 PSched (99514faa8df93d34b5589187db3aa0ba) C:Windowssystem32DRIVERSpacer.sys

01:58:51.0595 3700 PSched - ok

01:58:51.0668 3700 purendis (748bcab4eff5959ed347c05a1c1a0af8) C:Windowssystem32DRIVERSpurendis.sys

01:58:51.0678 3700 purendis - ok

01:58:51.0729 3700 PxHelp20 (d86b4a68565e444d76457f14172c875a) C:Windowssystem32DriversPxHelp20.sys

01:58:51.0741 3700 PxHelp20 - ok

01:58:51.0778 3700 QIOMem (674eba70a52c02696e503b0a57ae6372) C:Windowssystem32DRIVERSQIOMem.sys

01:58:51.0817 3700 QIOMem - ok

01:58:51.0957 3700 ql2300 (0a6db55afb7820c99aa1f3a1d270f4f6) C:Windowssystem32driversql2300.sys

01:58:52.0080 3700 ql2300 - ok

01:58:52.0100 3700 ql40xx (81a7e5c076e59995d54bc1ed3a16e60b) C:Windowssystem32driversql40xx.sys

01:58:52.0118 3700 ql40xx - ok

01:58:52.0162 3700 QWAVE (e9ecae663f47e6cb43962d18ab18890f) C:Windowssystem32qwave.dll

01:58:52.0192 3700 QWAVE - ok

01:58:52.0208 3700 QWAVEdrv (9f5e0e1926014d17486901c88eca2db7) C:Windowssystem32driversqwavedrv.sys

01:58:52.0223 3700 QWAVEdrv - ok

01:58:52.0237 3700 RasAcd (147d7f9c556d259924351feb0de606c3) C:Windowssystem32DRIVERSrasacd.sys

01:58:52.0321 3700 RasAcd - ok

01:58:52.0377 3700 RasAuto (f6a452eb4ceadbb51c9e0ee6b3ecef0f) C:WindowsSystem32rasauto.dll

01:58:52.0440 3700 RasAuto - ok

01:58:52.0515 3700 Rasl2tp (a214adbaf4cb47dd2728859ef31f26b0) C:Windowssystem32DRIVERSrasl2tp.sys

01:58:52.0555 3700 Rasl2tp - ok

01:58:53.0262 3700 RasMan (75d47445d70ca6f9f894b032fbc64fcf) C:WindowsSystem32rasmans.dll

01:58:53.0365 3700 RasMan - ok

01:58:53.0479 3700 RasPppoe (509a98dd18af4375e1fc40bc175f1def) C:Windowssystem32DRIVERSraspppoe.sys

01:58:53.0534 3700 RasPppoe - ok

01:58:53.0702 3700 RasSstp (2005f4a1e05fa09389ac85840f0a9e4d) C:Windowssystem32DRIVERSrassstp.sys

01:58:53.0763 3700 RasSstp - ok

01:58:54.0123 3700 rdbss (b14c9d5b9add2f84f70570bbbfaa7935) C:Windowssystem32DRIVERSrdbss.sys

01:58:54.0148 3700 rdbss - ok

01:58:54.0212 3700 RDPCDD (89e59be9a564262a3fb6c4f4f1cd9899) C:Windowssystem32DRIVERSRDPCDD.sys

01:58:54.0258 3700 RDPCDD - ok

01:58:54.0560 3700 rdpdr (fbc0bacd9c3d7f6956853f64a66e252d) C:Windowssystem32driversrdpdr.sys

01:58:54.0660 3700 rdpdr - ok

01:58:54.0691 3700 RDPENCDD (9d91fe5286f748862ecffa05f8a0710c) C:Windowssystem32driversrdpencdd.sys

01:58:54.0753 3700 RDPENCDD - ok

01:58:55.0358 3700 RDPWD (79c6df8477250f5c54f7c5ae1d6b814e) C:Windowssystem32driversRDPWD.sys

01:58:55.0447 3700 RDPWD - ok

01:58:55.0565 3700 RemoteAccess (bcdd6b4804d06b1f7ebf29e53a57ece9) C:WindowsSystem32mprdim.dll

01:58:55.0631 3700 RemoteAccess - ok

01:58:55.0694 3700 RemoteRegistry (9e6894ea18daff37b63e1005f83ae4ab) C:Windowssystem32regsvc.dll

01:58:55.0753 3700 RemoteRegistry - ok

01:58:55.0824 3700 ROOTMODEM (75e8a6bfa7374aba833ae92bf41ae4e6) C:Windowssystem32DriversRootMdm.sys

01:58:55.0854 3700 ROOTMODEM - ok

01:58:55.0882 3700 RpcLocator (5123f83cbc4349d065534eeb6bbdc42b) C:Windowssystem32locator.exe

01:58:55.0926 3700 RpcLocator - ok

01:58:56.0003 3700 RpcSs (3b5b4d53fec14f7476ca29a20cc31ac9) C:Windowssystem32rpcss.dll

01:58:56.0043 3700 RpcSs - ok

01:58:56.0074 3700 rspndr (9c508f4074a39e8b4b31d27198146fad) C:Windowssystem32DRIVERSrspndr.sys

01:58:56.0123 3700 rspndr - ok

01:58:56.0139 3700 SamSs (a3e186b4b935905b829219502557314e) C:Windowssystem32lsass.exe

01:58:56.0156 3700 SamSs - ok

01:58:56.0205 3700 SASKUTIL - ok

01:58:56.0390 3700 sbp2port (3ce8f073a557e172b330109436984e30) C:Windowssystem32driverssbp2port.sys

01:58:56.0405 3700 sbp2port - ok

01:58:56.0462 3700 SCardSvr (77b7a11a0c3d78d3386398fbbea1b632) C:WindowsSystem32SCardSvr.dll

01:58:56.0488 3700 SCardSvr - ok

01:58:56.0552 3700 Schedule (1a58069db21d05eb2ab58ee5753ebe8d) C:Windowssystem32schedsvc.dll

01:58:56.0729 3700 Schedule - ok

01:58:56.0835 3700 SCPolicySvc (312ec3e37a0a1f2006534913e37b4423) C:WindowsSystem32certprop.dll

01:58:56.0857 3700 SCPolicySvc - ok

01:58:56.0921 3700 sdbus (8f36b54688c31eed4580129040c6a3d3) C:Windowssystem32DRIVERSsdbus.sys

01:58:56.0947 3700 sdbus - ok

01:58:56.0984 3700 SDRSVC (716313d9f6b0529d03f726d5aaf6f191) C:WindowsSystem32SDRSVC.dll

01:58:57.0055 3700 SDRSVC - ok

01:58:57.0100 3700 secdrv (90a3935d05b494a5a39d37e71f09a677) C:Windowssystem32driverssecdrv.sys

01:58:57.0165 3700 secdrv - ok

01:58:57.0224 3700 seclogon (fd5199d4d8a521005e4b5ee7fe00fa9b) C:Windowssystem32seclogon.dll

01:58:57.0275 3700 seclogon - ok

01:58:57.0359 3700 SENS (a9bbab5759771e523f55563d6cbe140f) C:Windowssystem32sens.dll

01:58:57.0443 3700 SENS - ok

01:58:57.0537 3700 Serenum (68e44e331d46f0fb38f0863a84cd1a31) C:Windowssystem32driversserenum.sys

01:58:57.0622 3700 Serenum - ok

01:58:57.0680 3700 Serial (c70d69a918b178d3c3b06339b40c2e1b) C:Windowssystem32driversserial.sys

01:58:57.0757 3700 Serial - ok

01:58:57.0817 3700 sermouse (8af3d28a879bf75db53a0ee7a4289624) C:Windowssystem32driverssermouse.sys

01:58:57.0871 3700 sermouse - ok

01:58:58.0586 3700 ServiceLayer (58d5bfdf3adf49fe9cabd78cc61d92f6) C:Program FilesNokiaPC Connectivity SolutionServiceLayer.exe

01:58:58.0676 3700 ServiceLayer ( UnsignedFile.Multi.Generic ) - warning

01:58:58.0677 3700 ServiceLayer - detected UnsignedFile.Multi.Generic (1)

01:58:58.0830 3700 SessionEnv (d2193326f729b163125610dbf3e17d57) C:Windowssystem32sessenv.dll

01:58:58.0874 3700 SessionEnv - ok

01:58:58.0930 3700 sffdisk (3efa810bdca87f6ecc24f9832243fe86) C:Windowssystem32driverssffdisk.sys

01:58:58.0956 3700 sffdisk - ok

01:58:58.0979 3700 sffp_mmc (e95d451f7ea3e583aec75f3b3ee42dc5) C:Windowssystem32driverssffp_mmc.sys

01:58:59.0020 3700 sffp_mmc - ok

01:58:59.0060 3700 sffp_sd (3d0ea348784b7ac9ea9bd9f317980979) C:Windowssystem32driverssffp_sd.sys

01:58:59.0101 3700 sffp_sd - ok

01:58:59.0146 3700 sfloppy (46ed8e91793b2e6f848015445a0ac188) C:Windowssystem32driverssfloppy.sys

01:58:59.0259 3700 sfloppy - ok

01:58:59.0398 3700 SharedAccess (e1499bd0ff76b1b2fbbf1af339d91165) C:WindowsSystem32ipnathlp.dll

01:58:59.0452 3700 SharedAccess - ok

01:58:59.0668 3700 ShellHWDetection (c7230fbee14437716701c15be02c27b8) C:WindowsSystem32shsvcs.dll

01:58:59.0735 3700 ShellHWDetection - ok

01:58:59.0757 3700 sisagp (1d76624a09a054f682d746b924e2dbc3) C:Windowssystem32driverssisagp.sys

01:58:59.0772 3700 sisagp - ok

01:58:59.0839 3700 SiSRaid2 (43cb7aa756c7db280d01da9b676cfde2) C:Windowssystem32driverssisraid2.sys

01:58:59.0854 3700 SiSRaid2 - ok

01:58:59.0879 3700 SiSRaid4 (a99c6c8b0baa970d8aa59ddc50b57f94) C:Windowssystem32driverssisraid4.sys

01:58:59.0896 3700 SiSRaid4 - ok

01:59:00.0050 3700 SkypeUpdate (6128e98eaaed364ed1a32708d2fd22cb) C:Program FilesSkypeUpdaterUpdater.exe

01:59:00.0067 3700 SkypeUpdate - ok

01:59:00.0469 3700 slsvc (862bb4cbc05d80c5b45be430e5ef872f) C:Windowssystem32SLsvc.exe

01:59:00.0980 3700 slsvc - ok

01:59:01.0341 3700 SLUINotify (6edc422215cd78aa8a9cde6b30abbd35) C:Windowssystem32SLUINotify.dll

01:59:01.0387 3700 SLUINotify - ok

01:59:01.0473 3700 Smb (7b75299a4d201d6a6533603d6914ab04) C:Windowssystem32DRIVERSsmb.sys

01:59:01.0529 3700 Smb - ok

01:59:01.0557 3700 SNMPTRAP (2a146a055b4401c16ee62d18b8e2a032) C:WindowsSystem32snmptrap.exe

01:59:01.0573 3700 SNMPTRAP - ok

01:59:01.0658 3700 spldr (7aebdeef071fe28b0eef2cdd69102bff) C:Windowssystem32driversspldr.sys

01:59:01.0677 3700 spldr - ok

01:59:01.0755 3700 Spooler (8554097e5136c3bf9f69fe578a1b35f4) C:WindowsSystem32spoolsv.exe

01:59:01.0791 3700 Spooler - ok

01:59:01.0982 3700 sptd (d390675b8ce45e5fb359338e5e649329) C:Windowssystem32Driverssptd.sys

01:59:01.0982 3700 Suspicious file (NoAccess): C:Windowssystem32Driverssptd.sys. md5: d390675b8ce45e5fb359338e5e649329

01:59:01.0985 3700 sptd ( LockedFile.Multi.Generic ) - warning

01:59:01.0985 3700 sptd - detected LockedFile.Multi.Generic (1)

01:59:02.0092 3700 srv (41987f9fc0e61adf54f581e15029ad91) C:Windowssystem32DRIVERSsrv.sys

01:59:02.0186 3700 srv - ok

01:59:02.0227 3700 srv2 (ff33aff99564b1aa534f58868cbe41ef) C:Windowssystem32DRIVERSsrv2.sys

01:59:02.0281 3700 srv2 - ok

01:59:02.0349 3700 srvnet (7605c0e1d01a08f3ecd743f38b834a44) C:Windowssystem32DRIVERSsrvnet.sys

01:59:02.0385 3700 srvnet - ok

01:59:02.0461 3700 SSDPSRV (03d50b37234967433a5ea5ba72bc0b62) C:WindowsSystem32ssdpsrv.dll

01:59:02.0497 3700 SSDPSRV - ok

01:59:02.0523 3700 SstpSvc (6f1a32e7b7b30f004d9a20afadb14944) C:Windowssystem32sstpsvc.dll

01:59:02.0557 3700 SstpSvc - ok

01:59:02.0639 3700 stisvc (5de7d67e49b88f5f07f3e53c4b92a352) C:WindowsSystem32wiaservc.dll

01:59:02.0746 3700 stisvc - ok

01:59:02.0781 3700 swenum (7ba58ecf0c0a9a69d44b3dca62becf56) C:Windowssystem32DRIVERSswenum.sys

01:59:02.0796 3700 swenum - ok

01:59:02.0854 3700 swprv (f21fd248040681cca1fb6c9a03aaa93d) C:WindowsSystem32swprv.dll

01:59:02.0884 3700 swprv - ok

01:59:02.0905 3700 Symc8xx (192aa3ac01df071b541094f251deed10) C:Windowssystem32driverssymc8xx.sys

01:59:02.0920 3700 Symc8xx - ok

01:59:02.0951 3700 Sym_hi (8c8eb8c76736ebaf3b13b633b2e64125) C:Windowssystem32driverssym_hi.sys

01:59:02.0968 3700 Sym_hi - ok

01:59:02.0988 3700 Sym_u3 (8072af52b5fd103bbba387a1e49f62cb) C:Windowssystem32driverssym_u3.sys

01:59:03.0002 3700 Sym_u3 - ok

01:59:03.0043 3700 SynTP (91ac243740ca09a907e7cbd2da274c96) C:Windowssystem32DRIVERSSynTP.sys

01:59:03.0059 3700 SynTP - ok

01:59:03.0168 3700 SysMain (9a51b04e9886aa4ee90093586b0ba88d) C:Windowssystem32sysmain.dll

01:59:03.0228 3700 SysMain - ok

01:59:03.0314 3700 TabletInputService (2dca225eae15f42c0933e998ee0231c3) C:WindowsSystem32TabSvc.dll

01:59:03.0340 3700 TabletInputService - ok

01:59:03.0416 3700 TapiSrv (d7673e4b38ce21ee54c59eeeb65e2483) C:WindowsSystem32 apisrv.dll

01:59:03.0479 3700 TapiSrv - ok

01:59:03.0514 3700 TBS (cb05822cd9cc6c688168e113c603dbe7) C:WindowsSystem32 bssvc.dll

01:59:03.0593 3700 TBS - ok

01:59:03.0686 3700 Tcpip (27d470dabc77bc60d0a3b0e4deb6cb91) C:Windowssystem32drivers cpip.sys

01:59:03.0771 3700 Tcpip - ok

01:59:03.0790 3700 Tcpip6 (27d470dabc77bc60d0a3b0e4deb6cb91) C:Windowssystem32DRIVERS cpip.sys

01:59:03.0873 3700 Tcpip6 - ok

01:59:03.0924 3700 tcpipreg (608c345a255d82a6289c2d468eb41fd7) C:Windowssystem32drivers cpipreg.sys

01:59:04.0003 3700 tcpipreg - ok

01:59:04.0047 3700 tdcmdpst (1825bceb47bf41c5a9f0e44de82fc27a) C:Windowssystem32DRIVERS dcmdpst.sys

01:59:04.0093 3700 tdcmdpst - ok

01:59:04.0203 3700 TDPIPE (5dcf5e267be67a1ae926f2df77fbcc56) C:Windowssystem32drivers dpipe.sys

01:59:04.0269 3700 TDPIPE - ok

01:59:04.0339 3700 TDTCP (389c63e32b3cefed425b61ed92d3f021) C:Windowssystem32drivers dtcp.sys

01:59:04.0386 3700 TDTCP - ok

01:59:04.0550 3700 tdx (76b06eb8a01fc8624d699e7045303e54) C:Windowssystem32DRIVERS dx.sys

01:59:04.0605 3700 tdx - ok

01:59:04.0657 3700 TermDD (3cad38910468eab9a6479e2f01db43c7) C:Windowssystem32DRIVERS ermdd.sys

01:59:04.0674 3700 TermDD - ok

01:59:05.0311 3700 TermService (bb95da09bef6e7a131bff3ba5032090d) C:WindowsSystem32 ermsrv.dll

01:59:05.0370 3700 TermService - ok

01:59:05.0662 3700 Themes (c7230fbee14437716701c15be02c27b8) C:Windowssystem32shsvcs.dll

01:59:05.0680 3700 Themes - ok

01:59:05.0733 3700 THREADORDER (1076ffcffaae8385fd62dfcb25ac4708) C:Windowssystem32mmcss.dll

01:59:05.0779 3700 THREADORDER - ok

01:59:06.0427 3700 TNaviSrv (e47f35a87ff0da38def37a0eb0c2d2df) C:Program FilesToshibaTOSHIBA DVD PLAYERTNaviSrv.exe

01:59:06.0565 3700 TNaviSrv - ok

01:59:06.0756 3700 TODDSrv (c5ac715b65b01788abc22d10749dddd8) C:Windowssystem32TODDSrv.exe

01:59:06.0782 3700 TODDSrv - ok

01:59:07.0379 3700 TosCoSrv (da6903958cbdc091ffcbbca70ccff34c) C:Program FilesToshibaPower SaverTosCoSrv.exe

01:59:07.0497 3700 TosCoSrv - ok

01:59:07.0754 3700 TOSHIBA Bluetooth Service (2e7315b147e524e055026e6634b14ea6) c:Program FilesToshibaBluetooth Toshiba StackTosBtSrv.exe

01:59:07.0858 3700 TOSHIBA Bluetooth Service - ok

01:59:07.0963 3700 TOSHIBA SMART Log Service (22690dffc7f2a18279a7a0489aa02bac) C:Program FilesTOSHIBASMARTLogServiceTosIPCSrv.exe

01:59:08.0002 3700 TOSHIBA SMART Log Service ( UnsignedFile.Multi.Generic ) - warning

01:59:08.0002 3700 TOSHIBA SMART Log Service - detected UnsignedFile.Multi.Generic (1)

01:59:08.0411 3700 tosporte (8d624d3bd1f2d78bd1c01a2d4e954b4e) C:Windowssystem32DRIVERS osporte.sys

01:59:08.0463 3700 tosporte - ok

01:59:08.0640 3700 tosrfbd (ae43138b0dea239b3621b0faf1bb1fe7) C:Windowssystem32DRIVERS osrfbd.sys

01:59:08.0854 3700 tosrfbd - ok

01:59:09.0001 3700 tosrfbnp (181e217a7a326817d97946d045b3cb46) C:Windowssystem32Drivers osrfbnp.sys

01:59:09.0082 3700 tosrfbnp - ok

01:59:09.0472 3700 Tosrfcom (e90ace3b4fa7a85f992bc21eb779c407) C:Windowssystem32Drivers osrfcom.sys

01:59:09.0522 3700 Tosrfcom - ok

01:59:09.0571 3700 tosrfec (5c4103544612e5011ef46301b93d1aa6) C:Windowssystem32DRIVERS osrfec.sys

01:59:09.0631 3700 tosrfec - ok

01:59:09.0713 3700 Tosrfhid (87700714f25131ed21901d617b8b321f) C:Windowssystem32DRIVERSTosrfhid.sys

01:59:09.0783 3700 Tosrfhid - ok

01:59:09.0862 3700 tosrfnds (c52fd27b9adf3a1f22cb90e6bcf9b0cb) C:Windowssystem32DRIVERS osrfnds.sys

01:59:09.0923 3700 tosrfnds - ok

01:59:10.0127 3700 TosRfSnd (156d63f6898e4d95f2962f2b72862868) C:Windowssystem32drivers osrfsnd.sys

01:59:10.0251 3700 TosRfSnd - ok

01:59:10.0791 3700 Tosrfusb (98c04a6432ce9c2ad328f57b9384d348) C:Windowssystem32DRIVERS osrfusb.sys

01:59:10.0857 3700 Tosrfusb - ok

01:59:11.0174 3700 tos_sps32 (1ea5f27c29405bf49799feca77186da9) C:Windowssystem32DRIVERS os_sps32.sys

01:59:11.0389 3700 tos_sps32 - ok

01:59:11.0447 3700 TrkWks (ec74e77d0eb004bd3a809b5f8fb8c2ce) C:WindowsSystem32 rkwks.dll

01:59:11.0509 3700 TrkWks - ok

01:59:11.0646 3700 TrustedInstaller (97d9d6a04e3ad9b6c626b9931db78dba) C:WindowsservicingTrustedInstaller.exe

01:59:11.0668 3700 TrustedInstaller - ok

01:59:11.0747 3700 tssecsrv (dcf0f056a2e4f52287264f5ab29cf206) C:Windowssystem32DRIVERS ssecsrv.sys

01:59:11.0781 3700 tssecsrv - ok

01:59:11.0833 3700 tunmp (caecc0120ac49e3d2f758b9169872d38) C:Windowssystem32DRIVERS unmp.sys

01:59:11.0898 3700 tunmp - ok

01:59:11.0983 3700 tunnel (300db877ac094feab0be7688c3454a9c) C:Windowssystem32DRIVERS unnel.sys

01:59:12.0016 3700 tunnel - ok

01:59:12.0091 3700 TVALZ (792a8b80f8188aba4b2be271583f3e46) C:Windowssystem32DRIVERSTVALZ_O.SYS

01:59:12.0121 3700 TVALZ - ok

01:59:12.0197 3700 uagp35 (7d33c4db2ce363c8518d2dfcf533941f) C:Windowssystem32driversuagp35.sys

01:59:12.0225 3700 uagp35 - ok

01:59:12.0594 3700 udfs (d9728af68c4c7693cb100b8441cbdec6) C:Windowssystem32DRIVERSudfs.sys

01:59:12.0683 3700 udfs - ok

01:59:13.0137 3700 UI0Detect (ecef404f62863755951e09c802c94ad5) C:Windowssystem32UI0Detect.exe

01:59:13.0212 3700 UI0Detect - ok

01:59:13.0870 3700 UleadBurningHelper (332d341d92b933600d41953b08360dfb) C:Program FilesCommon FilesUlead SystemsDVDULCDRSvr.exe

01:59:13.0895 3700 UleadBurningHelper ( UnsignedFile.Multi.Generic ) - warning

01:59:13.0895 3700 UleadBurningHelper - detected UnsignedFile.Multi.Generic (1)

01:59:13.0978 3700 uliagpkx (b0acfdc9e4af279e9116c03e014b2b27) C:Windowssystem32driversuliagpkx.sys

01:59:13.0995 3700 uliagpkx - ok

01:59:14.0242 3700 uliahci (9224bb254f591de4ca8d572a5f0d635c) C:Windowssystem32driversuliahci.sys

01:59:14.0263 3700 uliahci - ok

01:59:14.0461 3700 UlSata (8514d0e5cd0534467c5fc61be94a569f) C:Windowssystem32driversulsata.sys

01:59:14.0483 3700 UlSata - ok

01:59:14.0636 3700 ulsata2 (38c3c6e62b157a6bc46594fada45c62b) C:Windowssystem32driversulsata2.sys

01:59:14.0710 3700 ulsata2 - ok

01:59:14.0798 3700 umbus (32cff9f809ae9aed85464492bf3e32d2) C:Windowssystem32DRIVERSumbus.sys

01:59:14.0880 3700 umbus - ok

01:59:15.0177 3700 upnphost (68308183f4ae0be7bf8ecd07cb297999) C:WindowsSystem32upnphost.dll

01:59:15.0291 3700 upnphost - ok

01:59:15.0555 3700 USBAAPL (83cafcb53201bbac04d822f32438e244) C:Windowssystem32Driversusbaapl.sys

01:59:15.0703 3700 USBAAPL - ok

01:59:15.0844 3700 usbccgp (caf811ae4c147ffcd5b51750c7f09142) C:Windowssystem32DRIVERSusbccgp.sys

01:59:15.0898 3700 usbccgp - ok

01:59:16.0028 3700 usbcir (e9476e6c486e76bc4898074768fb7131) C:Windowssystem32driversusbcir.sys

01:59:16.0116 3700 usbcir - ok

01:59:16.0545 3700 usbehci (79e96c23a97ce7b8f14d310da2db0c9b) C:Windowssystem32DRIVERSusbehci.sys

01:59:16.0600 3700 usbehci - ok

01:59:16.0795 3700 usbhub (4673bbcb006af60e7abddbe7a130ba42) C:Windowssystem32DRIVERSusbhub.sys

01:59:16.0866 3700 usbhub - ok

01:59:16.0906 3700 usbohci (38dbc7dd6cc5a72011f187425384388b) C:Windowssystem32driversusbohci.sys

01:59:16.0987 3700 usbohci - ok

01:59:17.0016 3700 usbprint (b51e52acf758be00ef3a58ea452fe360) C:Windowssystem32driversusbprint.sys

01:59:17.0067 3700 usbprint - ok

01:59:17.0147 3700 USBSTOR (be3da31c191bc222d9ad503c5224f2ad) C:Windowssystem32DRIVERSUSBSTOR.SYS

01:59:17.0185 3700 USBSTOR - ok

01:59:17.0243 3700 usbuhci (814d653efc4d48be3b04a307eceff56f) C:Windowssystem32DRIVERSusbuhci.sys

01:59:17.0284 3700 usbuhci - ok

01:59:17.0678 3700 usbvideo (e67998e8f14cb0627a769f6530bcb352) C:Windowssystem32Driversusbvideo.sys

01:59:17.0755 3700 usbvideo - ok

01:59:17.0815 3700 UVCFTR (8c5094a8ab24de7496c7c19942f2df04) C:Windowssystem32DriversUVCFTR_S.SYS

01:59:17.0848 3700 UVCFTR - ok

01:59:17.0904 3700 UxSms (1509e705f3ac1d474c92454a5c2dd81f) C:WindowsSystem32uxsms.dll

01:59:17.0944 3700 UxSms - ok

01:59:18.0349 3700 vds (cd88d1b7776dc17a119049742ec07eb4) C:WindowsSystem32vds.exe

01:59:18.0467 3700 vds - ok

01:59:18.0527 3700 vga (87b06e1f30b749a114f74622d013f8d4) C:Windowssystem32DRIVERSvgapnp.sys

01:59:18.0576 3700 vga - ok

01:59:18.0614 3700 VgaSave (2e93ac0a1d8c79d019db6c51f036636c) C:WindowsSystem32driversvga.sys

01:59:18.0649 3700 VgaSave - ok

01:59:18.0737 3700 viaagp (5d7159def58a800d5781ba3a879627bc) C:Windowssystem32driversviaagp.sys

01:59:18.0753 3700 viaagp - ok

01:59:18.0829 3700 ViaC7 (c4f3a691b5bad343e6249bd8c2d45dee) C:Windowssystem32driversviac7.sys

01:59:18.0911 3700 ViaC7 - ok

01:59:18.0985 3700 viaide (aadf5587a4063f52c2c3fed7887426fc) C:Windowssystem32driversviaide.sys

01:59:19.0024 3700 viaide - ok

01:59:19.0137 3700 volmgr (69503668ac66c77c6cd7af86fbdf8c43) C:Windowssystem32driversvolmgr.sys

01:59:19.0152 3700 volmgr - ok

01:59:19.0486 3700 volmgrx (23e41b834759917bfd6b9a0d625d0c28) C:Windowssystem32driversvolmgrx.sys

01:59:19.0547 3700 volmgrx - ok

01:59:20.0029 3700 volsnap (147281c01fcb1df9252de2a10d5e7093) C:Windowssystem32driversvolsnap.sys

01:59:20.0081 3700 volsnap - ok

01:59:20.0264 3700 vsmraid (587253e09325e6bf226b299774b728a9) C:Windowssystem32driversvsmraid.sys

01:59:20.0329 3700 vsmraid - ok

01:59:21.0123 3700 VSS (db3d19f850c6eb32bdcb9bc0836acddb) C:Windowssystem32vssvc.exe

01:59:21.0440 3700 VSS - ok

01:59:21.0896 3700 W32Time (96ea68b9eb310a69c25ebb0282b2b9de) C:Windowssystem32w32time.dll

01:59:21.0963 3700 W32Time - ok

01:59:23.0314 3700 WacomPen (48dfee8f1af7c8235d4e626f0c4fe031) C:Windowssystem32driverswacompen.sys

01:59:23.0376 3700 WacomPen - ok

01:59:23.0454 3700 Wanarp (55201897378cca7af8b5efd874374a26) C:Windowssystem32DRIVERSwanarp.sys

01:59:23.0528 3700 Wanarp - ok

01:59:23.0539 3700 Wanarpv6 (55201897378cca7af8b5efd874374a26) C:Windowssystem32DRIVERSwanarp.sys

01:59:23.0562 3700 Wanarpv6 - ok

01:59:24.0021 3700 wcncsvc (a3cd60fd826381b49f03832590e069af) C:WindowsSystem32wcncsvc.dll

01:59:24.0119 3700 wcncsvc - ok

01:59:24.0279 3700 WcsPlugInService (11bcb7afcdd7aadacb5746f544d3a9c7) C:WindowsSystem32WcsPlugInService.dll

01:59:24.0327 3700 WcsPlugInService - ok

01:59:24.0420 3700 Wd (78fe9542363f297b18c027b2d7e7c07f) C:Windowssystem32driverswd.sys

01:59:24.0448 3700 Wd - ok

01:59:25.0082 3700 Wdf01000 (b6f0a7ad6d4bd325fbcd8bac96cd8d96) C:Windowssystem32driversWdf01000.sys

01:59:25.0259 3700 Wdf01000 - ok

01:59:25.0444 3700 WdiServiceHost (abfc76b48bb6c96e3338d8943c5d93b5) C:Windowssystem32wdi.dll

01:59:25.0545 3700 WdiServiceHost - ok

01:59:25.0549 3700 WdiSystemHost (abfc76b48bb6c96e3338d8943c5d93b5) C:Windowssystem32wdi.dll

01:59:25.0580 3700 WdiSystemHost - ok

01:59:25.0785 3700 WebClient (04c37d8107320312fbae09926103d5e2) C:WindowsSystem32webclnt.dll

01:59:25.0855 3700 WebClient - ok

01:59:26.0076 3700 Wecsvc (905214925a88311fce52f66153de7610) C:Windowssystem32wecsvc.dll

01:59:26.0151 3700 Wecsvc - ok

01:59:26.0260 3700 wercplsupport (670ff720071ed741206d69bd995ea453) C:WindowsSystem32wercplsupport.dll

01:59:26.0319 3700 wercplsupport - ok

01:59:26.0523 3700 WerSvc (32b88481d3b326da6deb07b1d03481e7) C:WindowsSystem32WerSvc.dll

01:59:26.0582 3700 WerSvc - ok

01:59:27.0116 3700 winachsf (0acd399f5db3df1b58903cf4949ab5a8) C:Windowssystem32DRIVERSHSX_CNXT.sys

01:59:27.0165 3700 winachsf - ok

01:59:27.0601 3700 WinDefend (4575aa12561c5648483403541d0d7f2b) C:Program FilesWindows Defendermpsvc.dll

01:59:27.0711 3700 WinDefend - ok

01:59:27.0720 3700 WinHttpAutoProxySvc - ok

01:59:28.0029 3700 Winmgmt (6b2a1d0e80110e3d04e6863c6e62fd8a) C:Windowssystem32wbemWMIsvc.dll

01:59:28.0089 3700 Winmgmt - ok

01:59:28.0776 3700 WinRM (01874d4689c212460fbabf0ecd7cb7f7) C:Windowssystem32WsmSvc.dll

01:59:29.0013 3700 WinRM - ok

01:59:29.0581 3700 Wlansvc (c008405e4feeb069e30da1d823910234) C:WindowsSystem32wlansvc.dll

01:59:29.0746 3700 Wlansvc - ok

01:59:30.0112 3700 WmiAcpi (2e7255d172df0b8283cdfb7b433b864e) C:Windowssystem32DRIVERSwmiacpi.sys

01:59:30.0133 3700 WmiAcpi - ok

01:59:30.0382 3700 wmiApSrv (43be3875207dcb62a85c8c49970b66cc) C:Windowssystem32wbemWmiApSrv.exe

01:59:30.0421 3700 wmiApSrv - ok

01:59:31.0360 3700 WMPNetworkSvc (3978704576a121a9204f8cc49a301a9b) C:Program FilesWindows Media Playerwmpnetwk.exe

01:59:31.0999 3700 WMPNetworkSvc - ok

01:59:32.0366 3700 WPCSvc (cfc5a04558f5070cee3e3a7809f3ff52) C:WindowsSystem32wpcsvc.dll

01:59:32.0462 3700 WPCSvc - ok

01:59:32.0562 3700 WPDBusEnum (396d406292b0cd26e3504ffe82784702) C:Windowssystem32wpdbusenum.dll

01:59:32.0625 3700 WPDBusEnum - ok

01:59:32.0864 3700 WpdUsb (0cec23084b51b8288099eb710224e955) C:Windowssystem32DRIVERSwpdusb.sys

01:59:32.0914 3700 WpdUsb - ok

01:59:32.0957 3700 ws2ifsl (e3a3cb253c0ec2494d4a61f5e43a389c) C:Windowssystem32driversws2ifsl.sys

01:59:32.0999 3700 ws2ifsl - ok

01:59:33.0093 3700 wscsvc (1ca6c40261ddc0425987980d0cd2aaab) C:Windowssystem32wscsvc.dll

01:59:33.0136 3700 wscsvc - ok

01:59:33.0142 3700 WSearch - ok

01:59:35.0675 3700 wuauserv (6298277b73c77fa99106b271a7525163) C:Windowssystem32wuaueng.dll

01:59:36.0086 3700 wuauserv - ok

01:59:37.0324 3700 WUDFRd (ac13cb789d93412106b0fb6c7eb2bcb6) C:Windowssystem32DRIVERSWUDFRd.sys

01:59:37.0360 3700 WUDFRd - ok

01:59:37.0499 3700 wudfsvc (575a4190d989f64732119e4114045a4f) C:WindowsSystem32WUDFSvc.dll

01:59:37.0554 3700 wudfsvc - ok

01:59:37.0650 3700 XAudio (dab33cfa9dd24251aaa389ff36b64d4b) C:Windowssystem32DRIVERSxaudio.sys

01:59:37.0662 3700 XAudio - ok

01:59:38.0179 3700 XAudioService (cd5f291a1161f15896d1a4d63daff5df) C:Windowssystem32DRIVERSxaudio.exe

01:59:38.0721 3700 XAudioService - ok

01:59:39.0492 3700 yukonwlh (04e268adfc81964c49dc0c082d520f7e) C:Windowssystem32DRIVERSyk60x86.sys

01:59:39.0586 3700 yukonwlh - ok

01:59:39.0618 3700 MBR (0x1B8) (5c616939100b85e558da92b899a0fc36) DeviceHarddisk0DR0

01:59:46.0046 3700 DeviceHarddisk0DR0 - ok

01:59:46.0078 3700 Boot (0x1200) (9a5d6ed57c13c55fb5cad57f6edc3579) DeviceHarddisk0DR0Partition0

01:59:46.0096 3700 DeviceHarddisk0DR0Partition0 - ok

01:59:46.0126 3700 Boot (0x1200) (554c6c7ecb0625ea608bdfb28fe66dc3) DeviceHarddisk0DR0Partition1

01:59:46.0154 3700 DeviceHarddisk0DR0Partition1 - ok

01:59:46.0155 3700 ============================================================

01:59:46.0155 3700 Scan finished

01:59:46.0155 3700 ============================================================

01:59:46.0170 6088 Detected object count: 9

01:59:46.0170 6088 Actual detected object count: 9

02:02:08.0874 6088 ConfigFree Service ( UnsignedFile.Multi.Generic ) - skipped by user

02:02:08.0874 6088 ConfigFree Service ( UnsignedFile.Multi.Generic ) - User select action: Skip

02:02:08.0875 6088 IDriverT ( UnsignedFile.Multi.Generic ) - skipped by user

02:02:08.0875 6088 IDriverT ( UnsignedFile.Multi.Generic ) - User select action: Skip

02:02:08.0904 6088 M-Tel NETAGENT. RunOuc ( UnsignedFile.Multi.Generic ) - skipped by user

02:02:08.0904 6088 M-Tel NETAGENT. RunOuc ( UnsignedFile.Multi.Generic ) - User select action: Skip

02:02:08.0904 6088 o2flash ( UnsignedFile.Multi.Generic ) - skipped by user

02:02:08.0904 6088 o2flash ( UnsignedFile.Multi.Generic ) - User select action: Skip

02:02:08.0907 6088 pgsql-8.3 ( UnsignedFile.Multi.Generic ) - skipped by user

02:02:08.0907 6088 pgsql-8.3 ( UnsignedFile.Multi.Generic ) - User select action: Skip

02:02:08.0908 6088 ServiceLayer ( UnsignedFile.Multi.Generic ) - skipped by user

02:02:08.0908 6088 ServiceLayer ( UnsignedFile.Multi.Generic ) - User select action: Skip

02:02:08.0910 6088 sptd ( LockedFile.Multi.Generic ) - skipped by user

02:02:08.0910 6088 sptd ( LockedFile.Multi.Generic ) - User select action: Skip

02:02:08.0912 6088 TOSHIBA SMART Log Service ( UnsignedFile.Multi.Generic ) - skipped by user

02:02:08.0912 6088 TOSHIBA SMART Log Service ( UnsignedFile.Multi.Generic ) - User select action: Skip

02:02:08.0916 6088 UleadBurningHelper ( UnsignedFile.Multi.Generic ) - skipped by user

02:02:08.0916 6088 UleadBurningHelper ( UnsignedFile.Multi.Generic ) - User select action: Skip

02:02:37.0845 5412 Deinitialize success

aswMBR:

aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software

Run date: 2012-06-12 02:03:27

-----------------------------

02:03:27.464 OS Version: Windows 6.0.6002 Service Pack 2

02:03:27.464 Number of processors: 2 586 0xF0D

02:03:27.466 ComputerName: TOSHIBA-PC UserName: Toshiba

02:04:06.112 Initialize success

02:05:29.909 AVAST engine defs: 12061101

02:05:48.262 Disk 0 (boot) DeviceHarddisk0DR0 -> DeviceIdeIAAStorageDevice-0

02:05:48.264 Disk 0 Vendor: Hitachi_ BBFO Size: 238475MB BusType: 3

02:05:48.277 Disk 0 MBR read successfully

02:05:48.280 Disk 0 MBR scan

02:05:48.321 Disk 0 Windows VISTA default MBR code

02:05:48.339 Disk 0 Partition 1 00 27 Hidden NTFS WinRE NTFS 1500 MB offset 2048

02:05:48.359 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 120360 MB offset 3074048

02:05:48.396 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 116614 MB offset 249571328

02:05:48.420 Disk 0 scanning sectors +488396800

02:05:48.521 Disk 0 scanning C:Windowssystem32drivers

02:06:06.313 Service scanning

02:06:29.781 Service sptd C:WindowsSystem32Driverssptd.sys **LOCKED** 32

02:06:37.856 Modules scanning

02:07:12.830 Disk 0 trace - called modules:

02:07:12.850 ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll >>UNKNOWN [0x84c621e8]<<

02:07:12.854 1 nt!IofCallDriver -> DeviceHarddisk0DR0[0x86778ac8]

02:07:12.858 3 CLASSPNP.SYS[8870c8b3] -> nt!IofCallDriver -> [0x85685700]

02:07:12.862 5 acpi.sys[807aa6bc] -> nt!IofCallDriver -> DeviceIdeIAAStorageDevice-0[0x85c5a028]

02:07:12.866 DriveriaStor[0x85649c20] -> IRP_MJ_CREATE -> 0x84c621e8

02:07:13.469 AVAST engine scan C:

02:36:03.926 File: C:QooboxQuarantineCProgramDataF4D55F3E000DF644006F4B3C570F1C8BF4D55F3E000DF644006F4B3C570F1C8B.exe.vir **INFECTED** Win32:FakeAV-DMB [Trj]

06:53:03.583 Scan finished successfully

09:11:46.611 Disk 0 MBR has been saved successfully to "C:UsersToshibaDesktopMBR.dat"

09:11:46.615 The log file has been saved successfully to "C:UsersToshibaDesktopaswMBR.txt"

Трябва ли да повторя с Hitman?

Всичко логове са чисти.

Изчакайте за момента с HitmanPro...

Лол...10 часа са продължили проверките. Нормално и MBAM и HitmanPro продължават около 2-5 минути всяка.

aswMBR трае около час някъде. Както и да е. Може и всичко да е чисто вече, но не ми харесва, че OTL/OTS не искат да стартират.

Изтеглете прикачения файл и го разархивирайте на десктопа. expand.zip

Стартирайте файла expand.bat.

Ще се отворят 5 файла (или поне би трябвало) с текстово съдържание.

Копирайте съдържанието на тези 5 файла в следващия си коментар.

(Ако се появи съобщение за грешка при изъпнението на файла просто натиснете OK).

  • Автор

Скана с aswMBR беше от 2 до 7, а с Hitman отне 3 часа.... не знам по каква причина.

Отвори ми само 4 файла:

export0:

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}]

@="Microsoft WBEM New Event Subsystem"

[HKEY_CLASSES_ROOT\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InprocServer32]

@=hex(2):25,00,73,00,79,00,73,00,74,00,65,00,6d,00,72,00,6f,00,6f,00,74,00,25,\

00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,77,00,62,00,\

65,00,6d,00,5c,00,77,00,62,00,65,00,6d,00,65,00,73,00,73,00,2e,00,64,00,6c,\

00,6c,00,00,00

"ThreadingModel"="Both"

export1:

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}]

@="MruPidlList"

[HKEY_CLASSES_ROOT\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\

00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,00,68,00,\

65,00,6c,00,6c,00,33,00,32,00,2e,00,64,00,6c,00,6c,00,00,00

"ThreadingModel"="Apartment"

export3:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}]

@="Microsoft WBEM New Event Subsystem"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InprocServer32]

@=hex(2):25,00,73,00,79,00,73,00,74,00,65,00,6d,00,72,00,6f,00,6f,00,74,00,25,\

00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,77,00,62,00,\

65,00,6d,00,5c,00,77,00,62,00,65,00,6d,00,65,00,73,00,73,00,2e,00,64,00,6c,\

00,6c,00,00,00

"ThreadingModel"="Both"

export4:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}]

@="MruPidlList"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\

00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,00,68,00,\

65,00,6c,00,6c,00,33,00,32,00,2e,00,64,00,6c,00,6c,00,00,00

"ThreadingModel"="Apartment"

  • Моля изтеглете Junction.zip и го запазете на вашия десктоп.
  • Разархивирайте архива и копирайте файла junction.exe в C:Windows.
  • Отворете notepad и въведете следния код:

    @ECHO OFF
junction -s c: > log.txt
start log.txt
del %0
  • Запазете файла с иметo - Check.bat и го стартирайте с десен бутон => Run as administrator
  • Изчакайте проверката да завърши и да се появи лог файла.
  • Копирайте съдържанието му в следващия си пост.
  • Автор

Ето го: Junction v1.06 - Windows junction creator and reparse point viewer Copyright © 2000-2010 Mark Russinovich Sysinternals - www.sysinternals.com No reparse points found.

Остана да премахнем една папка създадена от гадината:

  • Моля изтеглете zoek.exe и я запазете на вашия десктоп.
  • Кликнете с десен бутон върху програмата и изберете Run as administrator.
  • Копирайте следния текстов скрипт и го поставете в програмата:

    attrib -r -s -h "C:WINDOWSsystem32%%APPDA~1*" /S /D;b
attrib -r -s -h "C:WINDOWSsystem32%%APPDA~1" /S /D;b
ren "C:WINDOWSsystem32%%APPDA~1" appdata;b
C:WINDOWSsystem32appdata;f
  • Изберете Combined fix и след това кликнете върху Run Script.
  • Ще се появи текстов лог файл с име на файла zoek-results.log.
  • Копирайте съдържанието му в следващия си пост.
  • Автор

Ето го: Zoek.exe Version 3.0.0.2 Updated 11-June-2012 Tool run by Toshiba on ўІ 12.06.2012 Ј. at 15:26:05,10. Microsoft® Windows Vista™ Home Premium 6.0.6002 Service Pack 2 x86 Running from: C:UsersToshibaDesktopzoek.exe ==== Batch Command(s) Run By Tool====================== ==== Deleting Files Folders ====================== "C:WINDOWSsystem32appdataMicrosoftWindowsIETldCacheindex.dat" deleted "C:WINDOWSsystem32appdata" deleted "C:WINDOWSsystem32appdataMicrosoft" deleted "C:WINDOWSsystem32appdataMicrosoftWindows" deleted "C:WINDOWSsystem32appdataMicrosoftWindowsIETldCache" deleted

Архивирана тема

Темата е твърде стара и е архивирана. Не можете да добавяте нови отговори в нея, но винаги можете да публикувате нова тема, в която да продължи дискусията. Регистрирайте се или влезте във вашия профил за да публикувате нова тема.

Назад

Разглеждащи това в момента 0

  • Няма регистрирани потребители разглеждащи тази страница.

Дарение

  • Подкрепи съществуването на форума - направи дарение
    32%
    Дарени 315 € от нужните 1 000 €

Бюлетин

Получавайте известие, когато има важна промяна или новина свързана с форума.
Абонирайте се

Профил

Навигация

Търсене

Търсене

Конфигуриране на push известия в браузъра
Chrome (Android)
  1. Докоснете иконата на катинар до адресната лента.
  2. Докоснете Разрешения → Известия.
  3. Променете предпочитанията си.
Chrome (Desktop)
  1. Кликнете върху иконата на катинар в адресната лента.
  2. Изберете Настройки на сайта.
  3. Намерете Известия и коригирайте предпочитанията си.