Вирус Live security platinum

18 септември 201214 г.

Вируса забранява достъпа до инсталираните приложения. Двата файла са качени при Save Mode.

Редактирано 21 септември 201213 г. от B-boy[StyLe] (преглед на промените)

18 септември 201214 г.

Здравейте,

Отворете следния сайт и изтеглете RKill.com и/или RKill.scr и ги запазете на вашия десктоп.

Стартирате програмата с двоен клик върху файла и изчакайте търпеливо.

След приключване на проверката ще се генерира лог файл с извършените процедури.

Публикувайте лог файла в следващия си пост.

Не рестартирайте системата!

Изтеглете Malwarebytes' Anti-Malware

* Кликнете два пъти върху mbam-setup.exe, за да инсталирате програмата.

* Уверете се, че са поставени отметки на Update Malwarebytes' Anti-Malware и Launch Malwarebytes' Anti-Malware. След това кликнете на Finish.

* Ако има намерени обновявания, тя ще ги изтегли и инсталира.

* Стартирайте програмата и изберете "Perform Quick Scan", след това кликнете на Scan.

* Сканирането ще отнеме малко време, затова моля да бъдете търпеливи.

* Когато сканирането завърши, кликнете на OK, след това Show Results, за да видите резултата.

* Уверете се, че на всички редове има отметки, и кликнете на Remove Selected.

* Когато всичко бъде премахнато, в Notepad ще бъде отворен лог.

* Копирайте този лог и го публикувайте в следващия си коментар по темата.

Забележка: Ако MalwareBytes' Anti-Malware се затрудни в премахването на откритите вируси/заплахи, той ще поиска да рестартира компютъра Ви и по време на рестартирането да премахне проблемните вируси/заплахи. Ако бъдете попитани, потвърдете че желаете вашия компютър да бъде рестартиран.

18 септември 201214 г.

Автор

Здравей, всичките насоки правим в SaveMode, че в нормален режим вируса ни блокира достъпа. Rkill 2.3.15 by Lawrence Abrams (Grinler) http://www.bleepingcomputer.com/ Copyright 2008-2012 BleepingComputer.com More Information about Rkill can be found at this link: http://www.bleepingcomputer.com/forums/topic308364.html Program started at: 09/18/2012 01:36:25 PM in x86 mode. Windows Version: Microsoft Windows XP Service Pack 2 Checking for Windows services to stop: * No malware services found to stop. Checking for processes to terminate: * C:WINDOWSDatecsFlex2K.exe (PID: 1104) [WD-HEUR] 1 proccess terminated! Checking Registry for malware related settings: * No issues found in the Registry. Resetting .EXE, .COM, & .BAT associations in the Windows Registry. Performing miscellaneous checks: * Windows Firewall Disabled [HKLMSYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyStandardProfile] "EnableFirewall" = dword:00000000 Checking Windows Service Integrity: * COM+ Event System (EventSystem) is not Running. Startup Type set to: Manual * Security Center (wscsvc) is not Running. Startup Type set to: Automatic * Security Center (wuauserv) is not Running. Startup Type set to: Automatic Searching for Missing Digital Signatures: * C:WINDOWSSystem32Driverstcpip.sys [NoSig] +-> C:WINDOWSsystem32dllcachetcpip.sys : 359 040 : 08/04/2004 03:00 PM : 9f4b36614a0fc234525ba224957de55c [Pos Repl] Program finished at: 09/18/2012 01:37:01 PM Execution time: 0 hours(s), 0 minute(s), and 35 seconds(s) Malwarebytes Anti-Malware 1.65.0.1400 www.malwarebytes.org Database version: v2012.09.18.01 Windows XP Service Pack 2 x86 NTFS (Safe Mode/Networking) Internet Explorer 6.0.2900.2180 Galin Marinov :: GMM [administrator] 18.9.2012 г. 13:42:01 mbam-log-2012-09-18 (13-42-01).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 205120 Time elapsed: 3 minute(s), 32 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 1 HKCUSOFTWAREMicrosoftWindowsCurrentVersionRunOnce|036DFF35C19FA9E700001979E56C34C7 (Trojan.LameShield) -> Data: C:Documents and SettingsAll UsersApplication Data036DFF35C19FA9E700001979E56C34C7036DFF35C19FA9E700001979E56C34C7.exe -> Quarantined and deleted successfully. Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 1 C:Documents and SettingsGalin MarinovLocal SettingstempE_N4 (Worm.Autorun) -> Quarantined and deleted successfully. Files Detected: 9 C:Documents and SettingsAll UsersApplication Data036DFF35C19FA9E700001979E56C34C7036DFF35C19FA9E700001979E56C34C7.exe (Trojan.LameShield) -> Quarantined and deleted successfully. C:Documents and SettingsGalin MarinovLocal SettingstempE_N4cnvpe.fne (Worm.Autorun) -> Quarantined and deleted successfully. C:Documents and SettingsGalin MarinovLocal SettingstempE_N4dp1.fne (Worm.Autorun) -> Quarantined and deleted successfully. C:Documents and SettingsGalin MarinovLocal SettingstempE_N4eAPI.fne (Worm.Autorun) -> Quarantined and deleted successfully. C:Documents and SettingsGalin MarinovLocal SettingstempE_N4HtmlView.fne (HackTool.Patcher) -> Quarantined and deleted successfully. C:Documents and SettingsGalin MarinovLocal SettingstempE_N4internet.fne (HackTool.Patcher) -> Quarantined and deleted successfully. C:Documents and SettingsGalin MarinovLocal SettingstempE_N4krnln.fnr (Trojan.Agent) -> Quarantined and deleted successfully. C:Documents and SettingsGalin MarinovLocal SettingstempE_N4shell.fne (Worm.Autorun) -> Quarantined and deleted successfully. C:Documents and SettingsGalin MarinovLocal SettingstempE_N4spec.fne (Worm.Autorun) -> Quarantined and deleted successfully. (end)

18 септември 201214 г.

Я сега повторете стъпките в нормален режим. Знам, че гадинката блокира достъпа и затова съм дал инструкции за Rkill. Очаквам резултатите от Normal Mode!

18 септември 201214 г.

Автор

Ето и в нормален режим. Rkill 2.3.15 by Lawrence Abrams (Grinler) http://www.bleepingcomputer.com/ Copyright 2008-2012 BleepingComputer.com More Information about Rkill can be found at this link: http://www.bleepingcomputer.com/forums/topic308364.html Program started at: 09/18/2012 04:44:08 PM in x86 mode. Windows Version: Microsoft Windows XP Service Pack 2 Checking for Windows services to stop: * No malware services found to stop. Checking for processes to terminate: * C:WINDOWSsystem32JMRaidTool.exe (PID: 1628) [WD-HEUR] * C:WINDOWSsystem32BBFFE3C6E5AA.EXE (PID: 1596) [WD-HEUR] * C:WINDOWSDatecsFlex2K.exe (PID: 2004) [WD-HEUR] 3 proccesses terminated! Checking Registry for malware related settings: * No issues found in the Registry. Resetting .EXE, .COM, & .BAT associations in the Windows Registry. Performing miscellaneous checks: * Windows Firewall Disabled [HKLMSYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyStandardProfile] "EnableFirewall" = dword:00000000 Checking Windows Service Integrity: * No issues found. Searching for Missing Digital Signatures: * C:WINDOWSSystem32Driverstcpip.sys [NoSig] +-> C:WINDOWSsystem32dllcachetcpip.sys : 359 040 : 08/04/2004 03:00 PM : 9f4b36614a0fc234525ba224957de55c [Pos Repl] Program finished at: 09/18/2012 04:44:44 PM Execution time: 0 hours(s), 0 minute(s), and 35 seconds(s) Malwarebytes Anti-Malware 1.65.0.1400 www.malwarebytes.org Database version: v2012.09.18.01 Windows XP Service Pack 2 x86 NTFS Internet Explorer 6.0.2900.2180 Galin Marinov :: GMM [administrator] 18.9.2012 г. 16:45:10 mbam-log-2012-09-18 (16-45-10).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 205646 Time elapsed: 3 minute(s), 26 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 1 C:Documents and SettingsGalin MarinovLocal SettingstempE_N4 (Worm.Autorun) -> Quarantined and deleted successfully. Files Detected: 8 C:Documents and SettingsGalin MarinovLocal SettingstempE_N4cnvpe.fne (Worm.Autorun) -> Quarantined and deleted successfully. C:Documents and SettingsGalin MarinovLocal SettingstempE_N4dp1.fne (Worm.Autorun) -> Quarantined and deleted successfully. C:Documents and SettingsGalin MarinovLocal SettingstempE_N4eAPI.fne (Worm.Autorun) -> Quarantined and deleted successfully. C:Documents and SettingsGalin MarinovLocal SettingstempE_N4HtmlView.fne (HackTool.Patcher) -> Quarantined and deleted successfully. C:Documents and SettingsGalin MarinovLocal SettingstempE_N4internet.fne (HackTool.Patcher) -> Quarantined and deleted successfully. C:Documents and SettingsGalin MarinovLocal SettingstempE_N4krnln.fnr (Trojan.Agent) -> Quarantined and deleted successfully. C:Documents and SettingsGalin MarinovLocal SettingstempE_N4shell.fne (Worm.Autorun) -> Quarantined and deleted successfully. C:Documents and SettingsGalin MarinovLocal SettingstempE_N4spec.fne (Worm.Autorun) -> Quarantined and deleted successfully. (end)

18 септември 201214 г.

Моля проверете този файл на VirusTotal и публикувайте линка с резултатите от проверката:

C:\WINDOWS\system32\BBFFE3\C6E5AA.EXE

Ако файла вече е бил анализиран, моля натиснете reanalyse.

Изтеглете RogueKiller.exe и го запазете на десктопа.
Стартирайте приложението и натиснете бутона SCAN.

Ще се създаде лог файл на десктопа с името RKreport.txt на десктопа.
Публикувайте лог файла в следващия си пост.

18 септември 201214 г.

Автор

Това трябва да е линка:https://www.virustotal.com/file/b4c0372abe22d4e466ddd668699cfd90381ef8b2d596922e036e4077f06c7a03/analysis/

Заразените файлове да ги изтрия ли?от RogueKiller

mail: tigzyRK<at>gmail<dot>com

Feedback: http://www.geekstogo...13-roguekiller/

Blog: http://tigzyrk.blogspot.com

Operating System: Windows XP (5.1.2600 Service Pack 2) 32 bits version

Started in : Normal mode

User : Galin Marinov [Admin rights]

Mode : Scan -- Date : 09/18/2012 17:27:51

¤¤¤ Bad processes : 1 ¤¤¤

[sUSP PATH] SkyTel.exe -- C:WINDOWSSkyTel.exe -> KILLED [TermProc]

¤¤¤ Registry Entries : 13 ¤¤¤

[RUN][sUSP PATH] HKCU[...]Run : Xeumuj (C:Documents and SettingsGalin MarinovApplication DataXeumuj.exe) -> FOUND

[RUN][sUSP PATH] HKCU[...]Run : 9opkp5cit5 (C:Documents and SettingsGalin Marinov9opkp5cit5.exe) -> FOUND

[RUN][sUSP PATH] HKCU[...]Run : myq0bgeflv (C:Documents and SettingsGalin Marinovmyq0bgeflv.exe) -> FOUND

[RUN][sUSP PATH] HKCU[...]Run : ml71kou6c6 (C:Documents and SettingsGalin Marinovml71kou6c6.exe) -> FOUND

[RUN][sUSP PATH] HKUSS-1-5-21-117609710-602609370-682003330-1004[...]Run : Xeumuj (C:Documents and SettingsGalin MarinovApplication DataXeumuj.exe) -> FOUND

[RUN][sUSP PATH] HKUSS-1-5-21-117609710-602609370-682003330-1004[...]Run : 9opkp5cit5 (C:Documents and SettingsGalin Marinov9opkp5cit5.exe) -> FOUND

[RUN][sUSP PATH] HKUSS-1-5-21-117609710-602609370-682003330-1004[...]Run : myq0bgeflv (C:Documents and SettingsGalin Marinovmyq0bgeflv.exe) -> FOUND

[RUN][sUSP PATH] HKUSS-1-5-21-117609710-602609370-682003330-1004[...]Run : ml71kou6c6 (C:Documents and SettingsGalin Marinovml71kou6c6.exe) -> FOUND

[HJPOL] HKCU[...]System : disableregistrytools (0) -> FOUND

[HJPOL] HKLM[...]System : DisableRegistryTools (0) -> FOUND

[HJ] HKLM[...]System : ConsentPromptBehaviorAdmin (0) -> FOUND

[HJ] HKLM[...]System : ConsentPromptBehaviorUser (0) -> FOUND

[HJ DESK] HKLM[...]NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [NOT LOADED] ¤¤¤

¤¤¤ Infection : ¤¤¤

¤¤¤ HOSTS File: ¤¤¤

--> C:WINDOWSsystem32driversetchosts

127.0.0.1 localhost

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: ST3160811AS +++++

--- User ---

[MBR] 44cb5311860147b31f123fef487ad9f2

[bSP] 038cf3c1a518c52c537aac696b54a6b7 : Windows XP MBR Code

Partition table:

0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 30098 Mo

1 - [XXXXXX] EXTEN-LBA (0x0f) [VISIBLE] Offset (sectors): 61641405 | Size: 122519 Mo

User = LL1 ... OK!

User = LL2 ... OK!

Finished : << RKreport[1].txt >>

RKreport[1].txt

Ето го и дневнка след Delete:

RogueKiller V8.0.3 [09/13/2012] by Tigzy

mail: tigzyRK<at>gmail<dot>com

Feedback: http://www.geekstogo.com/forum/files/file/413-roguekiller/

Blog: http://tigzyrk.blogspot.com

Operating System: Windows XP (5.1.2600 Service Pack 2) 32 bits version

Started in : Normal mode

User : Galin Marinov [Admin rights]

Mode : Remove -- Date : 09/18/2012 17:42:15

¤¤¤ Bad processes : 1 ¤¤¤

[sUSP PATH] SkyTel.exe -- C:WINDOWSSkyTel.exe -> KILLED [TermProc]

¤¤¤ Registry Entries : 9 ¤¤¤

[RUN][sUSP PATH] HKCU[...]Run : Xeumuj (C:Documents and SettingsGalin MarinovApplication DataXeumuj.exe) -> DELETED

[RUN][sUSP PATH] HKCU[...]Run : 9opkp5cit5 (C:Documents and SettingsGalin Marinov9opkp5cit5.exe) -> DELETED

[RUN][sUSP PATH] HKCU[...]Run : myq0bgeflv (C:Documents and SettingsGalin Marinovmyq0bgeflv.exe) -> DELETED

[RUN][sUSP PATH] HKCU[...]Run : ml71kou6c6 (C:Documents and SettingsGalin Marinovml71kou6c6.exe) -> DELETED

[HJPOL] HKCU[...]System : disableregistrytools (0) -> DELETED

[HJPOL] HKLM[...]System : DisableRegistryTools (0) -> DELETED

[HJ] HKLM[...]System : ConsentPromptBehaviorAdmin (0) -> REPLACED (2)

[HJ] HKLM[...]System : ConsentPromptBehaviorUser (0) -> REPLACED (1)

[HJ DESK] HKLM[...]NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [NOT LOADED] ¤¤¤

¤¤¤ Infection : ¤¤¤

¤¤¤ HOSTS File: ¤¤¤

--> C:WINDOWSsystem32driversetchosts

127.0.0.1 localhost

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: ST3160811AS +++++

--- User ---

[MBR] 44cb5311860147b31f123fef487ad9f2

[bSP] 038cf3c1a518c52c537aac696b54a6b7 : Windows XP MBR Code

Partition table:

0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 30098 Mo

1 - [XXXXXX] EXTEN-LBA (0x0f) [VISIBLE] Offset (sectors): 61641405 | Size: 122519 Mo

User = LL1 ... OK!

User = LL2 ... OK!

Finished : << RKreport[2].txt >>

RKreport[1].txt ; RKreport[2].txt

Редактирано 18 септември 201214 г. от Lugos (преглед на промените)

18 септември 201214 г.

Занапред ще помоля да ме изчаквате и да не предприемате действия на своя глава! Не съм споменавал да натискате Delete в RogueKiller за всички елементи!

18 септември 201214 г.

Автор

ОК. Извинявай.

18 септември 201214 г.

Надявам се разбирате, че това е за ваша безопасност. Не всички неща намерени от програмите са за триене. Отделно някои програми нямат UNDO И става лошо...

Изтеглете OTL.exe и го запазете на десктопа.

Стартирайте OTL (ако е необходимо, потвърдете през UAC).
Направете следните настройки:
Сложете отметка пред Scan All Users
Под менюто File Age изберете 90 days
Под менюто Standard Registry променете на ALL
Сложете отметки пред LOP и Purity Check

Под

с Copy/ Paste въведете изцяло следната текстова информация (само това, което е поставено в карето):

netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%SYSTEMDRIVE%*.*
%USERPROFILE%*.*
%USERPROFILE%Application Data*.*
%USERPROFILE%Application Data*.
%USERPROFILE%Local Settings*.*
%USERPROFILE%Local Settingstemp*.exe
%USERPROFILE%Local SettingsTemporary Internet Files*.exe
%USERPROFILE%Local SettingsApplication Data*.*
%AllUsersProfile%*.*
%AllUsersProfile%Application Data*.*
%AllUsersProfile%Application Data*.
%AllUsersProfile%Application DataLocal Settings*.*
%AllUsersProfile%Application DataLocal SettingsTemp*.exe
%ALLUSERSPROFILE%DocumentsMy Music*.exe
%ALLUSERSPROFILE%DocumentsMy Pictures*.exe
%ALLUSERSPROFILE%DocumentsMy Videos*.exe
%ALLUSERSPROFILE%Documents*.exe
%USERPROFILE%My Documents*.*
%CommonProgramFiles%*.*
%CommonProgramFiles%ComObjects*.*
%PROGRAMFILES%*.*
%PROGRAMFILES%*.
%systemroot%system32configsystemprofile*.*
%systemroot%system32configsystemprofileApplication Data*.*
%systemroot%system32configsystemprofileLocal Settings*.*
%systemroot%system32configsystemprofileLocal SettingsApplication Data*.*
%systemroot%system32configsystemprofileLocal SettingsTemp*.exe
%systemroot%system32configsystemprofileLocal SettingsTemporary Internet Files*.exe
C:Documents and SettingsLocalServiceApplication Data*.*
C:Documents and SettingsLocalServiceLocal SettingsApplication Data*.*
C:Documents and SettingsLocalServiceLocal Settingstemp*.exe
C:Documents and SettingsLocalServiceLocal SettingsTemporary Internet Files*.exe
C:Documents and SettingsLocalServiceLocal Settings*.*
C:Documents and SettingsLocalService*.*
C:Documents and SettingsNetworkServiceApplication Data*.*
C:Documents and SettingsNetworkServiceLocal SettingsApplication Data*.*
C:Documents and SettingsNetworkServiceLocal Settingstemp*.exe
C:Documents and SettingsNetworkServiceLocal SettingsTemporary Internet Files*.exe
C:Documents and SettingsNetworkServiceLocal Settings*.*
C:Documents and SettingsNetworkService*.*
%windir%temp*.exe
%windir%*.
%windir%installer*.
%windir%system32*.
%Temp%smtmp1*.*
%Temp%smtmp2*.*
%Temp%smtmp3*.*
%Temp%smtmp4*.*
%systemroot%system32*.dll /lockedfiles
%systemroot%Tasks*.job /lockedfiles
%systemroot%system32drivers*.sys /90
%systemroot%system32drivers*.sys /lockedfiles
%systemroot%system32Spoolprtprocsw32x86*.dll
%systemroot%*. /rp /s
%systemroot%assemblytmp*.* /S /MD5
%systemroot%assemblytemp*.* /S /MD5
%systemroot%assemblyGAC*.ini
%systemroot%assemblyGAC_32*.ini
%SystemRoot%assemblyGAC_MSIL*.ini
HKEY_CLASSES_ROOTCLSID{7C857801-7381-11CF-884D-00AA004B2E24} /s
HKEY_CLASSES_ROOTCLSID{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1} /s
HKEY_CURRENT_USERSoftwareClassesCLSID{42aedc87-2188-41fd-b9a3-0c966feabec1} /s
HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1} /s
HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{42aedc87-2188-41fd-b9a3-0c966feabec1} /s
HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{a2a9545d-a0c2-42b4-9708-a0b2badd77c8} /s
HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{7C857801-7381-11CF-884D-00AA004B2E24} /s
HKEY_CLASSES_ROOTclsid{5839FCA9-774D-42A1-ACDA-D6A79037F57F} /s
HKEY_CLASSES_ROOTclsid{fbeb8a05-beee-4442-804e-409d6c4515e9} /s
HKEY_CURRENT_USERSoftwareClassesclsid{fbeb8a05-beee-4442-804e-409d6c4515e9} /s
HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{5839FCA9-774D-42A1-ACDA-D6A79037F57F} /s
HKEY_CURRENT_USERSoftwareMSOLoad /s
>C:commands.txt echo list vol /raw /hide /c
/wait
>C:DiskReport.txt diskpart /s C:commands.txt /raw /hide /c
/wait
type c:diskreport.txt /c
/wait
erase c:commands.txt /hide /c
/wait
erase c:diskreport.txt /hide /c
/md5start
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
sceclt.dll
ntelogon.dll
logevent.dll
consrv.dll
services.exe
svchost.exe
explorer.exe
userinit.exe
winlogon.exe
smss.exe
lsass.exe
atapi.sys
iaStor.sys
serial.sys
disk.sys
volsnap.sys
redbook.sys
i8042prt.sys
afd.sys
netbt.sys
tcpip.sys
ipsec.sys
hlp.dat
str.sys
crexv.ocx
/md5stop

Натиснете маркираният в синьо бутон: Run Scan.
Като приключи проверката, ще се създадат два файла - OTL.Txt и Extras.Txt. Прикачете тези два файла в следващия си коментар (погледнете опцията Прикачени файлове, когато публикувате мнение).

18 септември 201214 г.

Автор

Файлът OTL е голям и немога да го прикача. Да го кача ли на някой сайт?

Редактирано 18 септември 201214 г. от Lugos (преглед на промените)

18 септември 201214 г.

Може да го качите тук: http://file.bg/

18 септември 201214 г.

Автор

http://file.bg/c185976MNjfh

18 септември 201214 г.

Олала...rootkit Necurs. Маха се по-лесно при Windows Vista/7, защото можем да използваме Farbar Recovery Scan Tool.

Можем да го подкараме и под Windows XP, но е малко по-трудно. Да опитаме първо така:

Моля изтеглете ESETNecursRemover.zip и го разархивирайте на десктопа.

Стартирайте файла ESETNecursRemover.exe.

Ако видите съобщението: "Win32Necurs was found active on your system, do you want to perform cleaning" => Изберете YES.

После ще видите това: "To remove win32 necurs it's required to install driver and restart your computer, perform this action". => Изберете YES.

Сега ще видите това: "Driver installed successfully, restart now? => Изберете YES.

Ако нищо не се случи, когато стартирате ESETNecursRemover.exe това означава, че рууткита не е активен в момента.

След това ще почистим и останалите неща в лога на ОTL.

18 септември 201214 г.

Автор

Изпълних стъпките.

18 септември 201214 г.

Стартирайте файла с двукратен клик на мишката.
Под с Copy/ Paste въведете изцяло следната текстова информация (само това, което е поставено в карето):

:OTL
PRC - [2012.09.18 17:07:26 | 000,018,944 | ---- | M] () -- C:\WINDOWS\system32\F86F41\V7M3BFB1.EXE
PRC - [2012.08.07 11:26:48 | 001,404,701 | RHS- | M] () -- C:\WINDOWS\system32\BBFFE3\C6E5AA.EXE
MOD - [2012.09.18 17:07:26 | 000,018,944 | ---- | M] () -- C:\WINDOWS\system32\F86F41\V7M3BFB1.EXE
MOD - [2012.09.18 16:52:19 | 000,323,584 | ---- | M] () -- C:\Documents and Settings\Galin Marinov\Local Settings\temp\E_N4\eAPI.fne
MOD - [2012.09.18 16:52:19 | 000,184,320 | ---- | M] () -- C:\Documents and Settings\Galin Marinov\Local Settings\temp\E_N4\internet.fne
MOD - [2012.09.18 16:52:19 | 000,073,728 | ---- | M] () -- C:\Documents and Settings\Galin Marinov\Local Settings\temp\E_N4\spec.fne
MOD - [2012.09.18 16:52:18 | 001,101,824 | ---- | M] () -- C:\Documents and Settings\Galin Marinov\Local Settings\temp\E_N4\krnln.fnr
MOD - [2012.09.18 16:52:18 | 000,217,088 | ---- | M] () -- C:\Documents and Settings\Galin Marinov\Local Settings\temp\E_N4\HtmlView.fne
MOD - [2012.09.18 16:52:18 | 000,114,688 | ---- | M] () -- C:\Documents and Settings\Galin Marinov\Local Settings\temp\E_N4\dp1.fne
MOD - [2012.09.18 16:52:18 | 000,040,960 | ---- | M] () -- C:\Documents and Settings\Galin Marinov\Local Settings\temp\E_N4\shell.fne
MOD - [2012.09.18 10:47:07 | 000,323,584 | -HS- | M] () -- C:\WINDOWS\system32\F86F41\eAPI.fne
MOD - [2012.09.18 10:47:06 | 001,101,824 | -HS- | M] () -- C:\WINDOWS\system32\F86F41\krnln.fnr
MOD - [2012.09.18 10:47:06 | 000,114,688 | -HS- | M] () -- C:\WINDOWS\system32\F86F41\dp1.fne
MOD - [2012.08.07 11:26:48 | 001,404,701 | RHS- | M] () -- C:\WINDOWS\system32\BBFFE3\C6E5AA.EXE
SRV - [2012.02.18 10:41:12 | 000,047,168 | ---- | M] () [Unknown (-1) | Unknown] -- C:\WINDOWS\System32\drivers\b1991ed8bf9f523.sys -- (b1991ed8bf9f523)
DRV - [2012.02.18 10:41:12 | 000,047,168 | ---- | M] () [Unknown (-1) | Unknown (-1) | Unknown] -- C:\WINDOWS\System32\drivers\b1991ed8bf9f523.sys -- (b1991ed8bf9f523)
IE - HKU\.DEFAULT\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - No CLSID value found
IE - HKU\S-1-5-18\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - No CLSID value found
FF - prefs.js..browser.search.defaultenginename: "MyStart Search"
FF - prefs.js..keyword.URL: "http://mystart.incredibar.com/mb143/?loc=IB_DS&a=6PQxmdP37t&&i=26&search="
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{336D0C35-8A85-403a-B9D2-65C292C39087}: C:\Program Files\Web Assistant\Firefox
[2012.05.14 15:25:18 | 000,002,203 | ---- | M] () -- C:\Documents and Settings\Galin Marinov\Application Data\Mozilla\Firefox\Profiles\4fgnhrif.default\searchplugins\MyStart Search.xml
O2 - BHO: (no name) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No CLSID value found.
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [C6E5AA] C:\WINDOWS\system32\BBFFE3\C6E5AA.EXE ()
O4 - Startup: C:\Documents and Settings\Galin Marinov\Start Menu\Programs\Startup\C6E5AA.lnk = C:\WINDOWS\system32\BBFFE3\C6E5AA.EXE ()
[2012.09.18 09:36:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\036DFF35C19FA9E700001979E56C34C7
[2012.09.18 09:38:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\036DFF35C19FA9E700001979E56C34C7
[2012.09.18 17:07:37 | 000,000,708 | ---- | M] () -- C:\Documents and Settings\Galin Marinov\Start Menu\Programs\Startup\C6E5AA.lnk
[2012.08.07 11:26:49 | 000,000,708 | ---- | C] () -- C:\Documents and Settings\Galin Marinov\Start Menu\Programs\Startup\C6E5AA.lnk
[2012.02.18 10:41:12 | 000,047,168 | ---- | C] () -- C:\WINDOWS\System32\drivers\b1991ed8bf9f523.sys
[2010.08.13 10:42:52 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini
[2012.05.17 11:26:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Galin Marinov\Application Data\Incredibar.com
[2012.05.14 15:25:41 | 000,000,000 | ---D | M] -- C:\Program Files\Incredibar.com
[2011.06.09 12:49:25 | 000,000,036 | ---- | M] ()(C:\WINDOWS\System32\??) -- C:\WINDOWS\System32\??
[2011.06.09 12:49:25 | 000,000,036 | ---- | C] ()(C:\WINDOWS\System32\??) -- C:\WINDOWS\System32\??
[2011.04.04 15:07:41 | 000,000,036 | ---- | M] ()(C:\WINDOWS\System32\??) -- C:\WINDOWS\System32\??
[2011.04.04 15:07:41 | 000,000,036 | ---- | C] ()(C:\WINDOWS\System32\??) -- C:\WINDOWS\System32\??
[2011.03.21 13:52:09 | 000,000,036 | ---- | M] ()(C:\WINDOWS\System32\?t) -- C:\WINDOWS\System32\??
[2011.03.21 13:52:09 | 000,000,036 | ---- | C] ()(C:\WINDOWS\System32\?t) -- C:\WINDOWS\System32\??
[2011.03.17 13:23:01 | 000,000,036 | ---- | M] ()(C:\WINDOWS\System32\??) -- C:\WINDOWS\System32\??
[2011.03.17 13:23:01 | 000,000,036 | ---- | C] ()(C:\WINDOWS\System32\??) -- C:\WINDOWS\System32\??
@Alternate Data Stream - 127 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:430C6D84
@Alternate Data Stream - 103 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2
:files
C:\WINDOWS\system32\F86F41
C:\WINDOWS\system32\BBFFE3
C:\Documents and Settings\Galin Marinov\Local Settings\temp\E_N4
dir /s /a "C:\Documents and Settings\Galin Marinov\Application Data\Algi" /c
dir /s /a "C:\Documents and Settings\Galin Marinov\Application Data\Infay" /c
dir /s /a "C:\Documents and Settings\Galin Marinov\Application Data\Otda" /c
dir /s /a "C:\Documents and Settings\Galin Marinov\Application Data\Uhhea" /c
:commands
[emptytemp]

След като въведете скрипта от цитата по-горе натиснете бутона, маркиран в червено: Run Fix

Windows ще се рестартира и ще се създаде лог файл - OTL fix log. Публикувайте съдържанието му с Copy/Paste в следващия си коментар.

19 септември 201214 г.

Автор

Вчера ми се наложи да изляза.

Ето и резултатите.

All processes killed

========== OTL ==========

No active process named V7M3BFB1.EXE was found!

No active process named C6E5AA.EXE was found!

Service b1991ed8bf9f523 stopped successfully!

Service b1991ed8bf9f523 deleted successfully!

File C:WINDOWSSystem32driversb1991ed8bf9f523.sys not found.

Error: No service named b1991ed8bf9f523 was found to stop!

ServiceDriver key b1991ed8bf9f523 not found.

File C:WINDOWSSystem32driversb1991ed8bf9f523.sys not found.

Registry value HKEY_USERS.DEFAULTSoftwareMicrosoftInternet ExplorerURLSearchHooks{A3BC75A2-1F87-4686-AA43-5347D756017C} deleted successfully.

Registry key HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{A3BC75A2-1F87-4686-AA43-5347D756017C} not found.

Registry value HKEY_USERSS-1-5-18SoftwareMicrosoftInternet ExplorerURLSearchHooks{A3BC75A2-1F87-4686-AA43-5347D756017C} not found.

Registry key HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{A3BC75A2-1F87-4686-AA43-5347D756017C} not found.

Prefs.js: "MyStart Search" removed from browser.search.defaultenginename

Prefs.js: "http://mystart.incredibar.com/mb143/?loc=IB_DS&a=6PQxmdP37t&&i=26&search=" removed from keyword.URL

Registry value HKEY_LOCAL_MACHINEsoftwaremozillaFirefoxExtensions{336D0C35-8A85-403a-B9D2-65C292C39087} deleted successfully.

Registry key HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{336D0C35-8A85-403a-B9D2-65C292C39087} not found.

File C:Program FilesWeb AssistantFirefox not found.

C:Documents and SettingsGalin MarinovApplication DataMozillaFirefoxProfiles4fgnhrif.defaultsearchpluginsMyStart Search.xml moved successfully.

Registry key HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} deleted successfully.

Registry key HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} not found.

Registry value HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun deleted successfully.

Registry value HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunC6E5AA deleted successfully.

C:WINDOWSsystem32BBFFE3C6E5AA.EXE moved successfully.

C:Documents and SettingsGalin MarinovStart MenuProgramsStartupC6E5AA.lnk moved successfully.

File C:WINDOWSsystem32BBFFE3C6E5AA.EXE not found.

Folder C:Documents and SettingsAll UsersApplication Data036DFF35C19FA9E700001979E56C34C7 not found.

File C:Documents and SettingsGalin MarinovStart MenuProgramsStartupC6E5AA.lnk not found.

File C:WINDOWSSystem32driversb1991ed8bf9f523.sys not found.

C:WINDOWSassemblyDesktop.ini moved successfully.

C:Documents and SettingsGalin MarinovApplication DataIncredibar.comincredibar folder moved successfully.

C:Documents and SettingsGalin MarinovApplication DataIncredibar.com folder moved successfully.

C:Program FilesIncredibar.comincredibar1.5.11.14bh folder moved successfully.

C:Program FilesIncredibar.comincredibar1.5.11.14 folder moved successfully.

C:Program FilesIncredibar.comincredibar folder moved successfully.

C:Program FilesIncredibar.com folder moved successfully.

C:WINDOWSsystem32?? moved successfully.

File C:WINDOWSSystem32?? not found.

C:WINDOWSsystem32?? moved successfully.

File C:WINDOWSSystem32?? not found.

C:WINDOWSsystem32?? moved successfully.

File C:WINDOWSSystem32?? not found.

C:WINDOWSsystem32?? moved successfully.

File C:WINDOWSSystem32?? not found.

ADS C:Documents and SettingsAll UsersApplication DataTEMP:430C6D84 deleted successfully.

ADS C:Documents and SettingsAll UsersApplication DataTEMP:DFC5A2B2 deleted successfully.

========== FILES ==========

C:WINDOWSsystem32F86F41 folder moved successfully.

C:WINDOWSsystem32BBFFE3 folder moved successfully.

C:Documents and SettingsGalin MarinovLocal SettingstempE_N4 folder moved successfully.

< dir /s /a "C:Documents and SettingsGalin MarinovApplication DataAlgi" /c >

Volume in drive C has no label.

Volume Serial Number is 407C-35A3

Directory of C:Documents and SettingsGalin MarinovApplication DataAlgi

18.04.2012 г. 09:25 <DIR> .

18.04.2012 г. 09:25 <DIR> ..

0 File(s) 0 bytes

Total Files Listed:

0 File(s) 0 bytes

2 Dir(s) 19 387 236 352 bytes free

C:Documents and SettingsGalin MarinovDesktopcmd.bat deleted successfully.

C:Documents and SettingsGalin MarinovDesktopcmd.txt deleted successfully.

< dir /s /a "C:Documents and SettingsGalin MarinovApplication DataInfay" /c >

Volume in drive C has no label.

Volume Serial Number is 407C-35A3

Directory of C:Documents and SettingsGalin MarinovApplication DataInfay

29.02.2012 г. 15:52 <DIR> .

29.02.2012 г. 15:52 <DIR> ..

0 File(s) 0 bytes

Total Files Listed:

0 File(s) 0 bytes

2 Dir(s) 19 387 236 352 bytes free

C:Documents and SettingsGalin MarinovDesktopcmd.bat deleted successfully.

C:Documents and SettingsGalin MarinovDesktopcmd.txt deleted successfully.

< dir /s /a "C:Documents and SettingsGalin MarinovApplication DataOtda" /c >

Volume in drive C has no label.

Volume Serial Number is 407C-35A3

Directory of C:Documents and SettingsGalin MarinovApplication DataOtda

29.02.2012 г. 15:24 <DIR> .

29.02.2012 г. 15:24 <DIR> ..

0 File(s) 0 bytes

Total Files Listed:

0 File(s) 0 bytes

2 Dir(s) 19 387 236 352 bytes free

C:Documents and SettingsGalin MarinovDesktopcmd.bat deleted successfully.

C:Documents and SettingsGalin MarinovDesktopcmd.txt deleted successfully.

< dir /s /a "C:Documents and SettingsGalin MarinovApplication DataUhhea" /c >

Volume in drive C has no label.

Volume Serial Number is 407C-35A3

Directory of C:Documents and SettingsGalin MarinovApplication DataUhhea

23.03.2012 г. 09:24 <DIR> .

23.03.2012 г. 09:24 <DIR> ..

22.03.2012 г. 18:53 1 554 puegw.cac.0

1 File(s) 1 554 bytes

Total Files Listed:

1 File(s) 1 554 bytes

2 Dir(s) 19 387 236 352 bytes free

C:Documents and SettingsGalin MarinovDesktopcmd.bat deleted successfully.

C:Documents and SettingsGalin MarinovDesktopcmd.txt deleted successfully.

========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

User: All Users

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

User: Galin Marinov

->Temp folder emptied: 11405504 bytes

->Temporary Internet Files folder emptied: 175399242 bytes

->Java cache emptied: 2451583 bytes

->FireFox cache emptied: 382609860 bytes

->Flash cache emptied: 47123 bytes

User: LocalService

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 613068 bytes

User: NetworkService

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 2204480 bytes

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%System32 .tmp files removed: 0 bytes

%systemroot%System32dllcache .tmp files removed: 0 bytes

%systemroot%System32drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 5453707 bytes

%systemroot%system32configsystemprofileLocal SettingsTemp folder emptied: 0 bytes

%systemroot%system32configsystemprofileLocal SettingsTemporary Internet Files folder emptied: 0 bytes

RecycleBin emptied: 419728167 bytes

Total Files Cleaned = 954,00 mb

OTL by OldTimer - Version 3.2.63.0 log created on 09192012_090012

FilesFolders moved on Reboot...

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

19 септември 201214 г.

Стартирайте файла с двукратен клик на мишката.
Под с Copy/ Paste въведете изцяло следната текстова информация (само това, което е поставено в карето):

:files
C:Documents and SettingsGalin MarinovApplication DataAlgi
C:Documents and SettingsGalin MarinovApplication DataInfay
C:Documents and SettingsGalin MarinovApplication DataOtda
C:Documents and SettingsGalin MarinovApplication DataUhhea
:commands
[emptytemp]

След като въведете скрипта от цитата по-горе натиснете бутона, маркиран в червено: Run Fix

Windows ще се рестартира и ще се създаде лог файл - OTL fix log. Публикувайте съдържанието му с Copy/Paste в следващия си коментар.

Също така архивирайте папката C:_OTL и я качете тук.

Пратете ми линка за download на лично съобщение.

След това изтрийте архива, но не трийте папката засега. Ще я изтрием като деинсталираме OTL накарая.

После направете нова проверка с MBAM и публикувайте резултатите.

Имам и един въпрос:

Имате ли представа кое приложение или вие ръчно сте отворили следните портове, ако не да ги затворя? Подозирам, че са от Bitcomet, но по-принцип изписва, че е от него...

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyStandardProfileGloballyOpenPortsList]

"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007

"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008

"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004

"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005

"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001

"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002

"26946:UDP" = 26946:UDP:*:Enabled:UDP 26946

"16123:TCP" = 16123:TCP:*:Enabled:TCP 16123

"13385:UDP" = 13385:UDP:*:Enabled:UDP 13385

"18057:TCP" = 18057:TCP:*:Enabled:TCP 18057

"24164:UDP" = 24164:UDP:*:Enabled:UDP 24164

"22154:TCP" = 22154:TCP:*:Enabled:TCP 22154

19 септември 201214 г.

Автор

Ето го и линка:

Относно въпроса незнам кое е приложението

All processes killed

========== FILES ==========

C:Documents and SettingsGalin MarinovApplication DataAlgi folder moved successfully.

C:Documents and SettingsGalin MarinovApplication DataInfay folder moved successfully.

C:Documents and SettingsGalin MarinovApplication DataOtda folder moved successfully.

C:Documents and SettingsGalin MarinovApplication DataUhhea folder moved successfully.

========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

User: All Users

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

User: Galin Marinov

->Temp folder emptied: 3025494 bytes

->Temporary Internet Files folder emptied: 175585 bytes

->Java cache emptied: 0 bytes

->FireFox cache emptied: 66857904 bytes

->Flash cache emptied: 2389 bytes

User: LocalService

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

%systemdrive% .tmp files removed: 66699963 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%System32 .tmp files removed: 0 bytes

%systemroot%System32dllcache .tmp files removed: 0 bytes

%systemroot%System32drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 1232 bytes

%systemroot%system32configsystemprofileLocal SettingsTemp folder emptied: 0 bytes

%systemroot%system32configsystemprofileLocal SettingsTemporary Internet Files folder emptied: 0 bytes

RecycleBin emptied: 4515812 bytes

Total Files Cleaned = 135,00 mb

OTL by OldTimer - Version 3.2.63.0 log created on 09192012_145225

FilesFolders moved on Reboot...

C:Documents and SettingsGalin MarinovLocal SettingsTempZTR2D8.tmp moved successfully.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

Ето и резултатите от МВАМ:

Malwarebytes Anti-Malware 1.65.0.1400

www.malwarebytes.org

Database version: v2012.09.18.01

Windows XP Service Pack 2 x86 NTFS

Internet Explorer 6.0.2900.2180

Galin Marinov :: GMM [administrator]

19.9.2012 г. 14:59:53

mbam-log-2012-09-19 (14-59-53).txt

Scan type: Quick scan

Scan options disabled: P2P

Objects scanned: 201189

Time elapsed: 2 minute(s), 37 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 0

(No malicious items detected)

(end)

Редактирано 19 септември 201214 г. от B-boy[StyLe]
Премахнат опасен линк! (преглед на промените)

19 септември 201214 г.

Супер...имаме напредък.

За да проверим дали наистина е така...

Направете нова проверка с DDS, както е описано тук => Системата ми е инфектирана - Какво да правя сега?

Направете и нова проверка с OTL (забележка свалете нова версия от линка в поста)

Публикувайте новите резултати. После ще продължим с останалите 5 задължителни проверки и приключваме.

Само, че заминавам на работа и ще мога да пиша чак след 24.00 часа. Така че ако не сте на линия утре сутринта с кафето ще довършим.

19 септември 201214 г.

Автор

Ето файла OTL:http://file.bg/c186132cNiES,

незнам защо но файла Extras.Txt не се създава.

DDS (Ver_2011-09-30.01) - NTFS_x86

Internet Explorer: 6.0.2900.2180 BrowserJavaVersion: 1.6.0_26

Run by Galin Marinov at 16:42:23 on 2012-09-19

Microsoft Windows XP Home Edition 5.1.2600.2.1251.359.1033.18.1022.145 [GMT 3:00]

.

FW: AVG Firewall *Disabled*

.

============== Running Processes ================

.

C:WINDOWSsystem32Ati2evxx.exe

C:WINDOWSsystem32spoolsv.exe

C:Program FilesPC ToolsPC Tools SecurityBDTBDTUpdateService.exe

C:WINDOWSsystem32HPSIsvc.exe

C:Program FilesJavajre6binjqs.exe

C:WINDOWSsystem32wdfmgr.exe

C:WINDOWSsystem32Ati2evxx.exe

C:WINDOWSExplorer.EXE

C:WINDOWSSystem32alg.exe

C:WINDOWSsystem32wscntfy.exe

C:WINDOWSSkyTel.EXE

C:WINDOWSRTHDCPL.EXE

C:WINDOWSsystem32JMRaidTool.exe

C:Program FilesWinampwinampa.exe

C:Program FilesCommon FilesInstallShieldUpdateServiceissch.exe

C:Program FilesCommon FilesJavaJava Updatejusched.exe

C:WINDOWSsystem32ctfmon.exe

C:Program FilesFieryCStationcstation.exe

C:WINDOWSDatecsFlex2K.exe

C:Program FilesPanda USB VaccineUSBVaccine.exe

C:Program FilesMozilla Firefoxfirefox.exe

C:Program FilesMozilla Firefoxplugin-container.exe

C:Program FilesCommon FilesJavaJava Updatejucheck.exe

C:Program FilesCorelGraphics9Programscoreldrw.exe

C:WINDOWSsystem32wbemwmiprvse.exe

C:WINDOWSSystem32svchost.exe -k netsvcs

C:WINDOWSsystem32svchost.exe -k NetworkService

C:WINDOWSsystem32svchost.exe -k LocalService

C:WINDOWSsystem32svchost.exe -k imgsvc

.

============== Pseudo HJT Report ===============

.

uStart Page = about:blank

uSearch Bar = hxxp://www.google.com/ie

uSearch Page = hxxp://www.google.com

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

uURLSearchHooks: PC Tools Browser Guard: {472734EA-242A-422b-ADF8-83D1E48CC825} - c:program filespc toolspc tools securitybdtPCTBrowserDefender.dll

BHO: AcroIEHlprObj Class: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:program filesadobeacrobat 7.0activexAcroIEHelper.dll

BHO: PC Tools Browser Guard BHO: {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - c:program filespc toolspc tools securitybdtPCTBrowserDefender.dll

BHO: Incredibar.com Helper Object: {6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99} -

BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:program filesjavajre6binjp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - c:program filesjavajre6libdeployjqsiejqs_plugin.dll

TB: Incredibar Toolbar: {F9639E4A-801B-4843-AEE3-03D9DA199E77} -

TB: PC Tools Browser Guard: {472734EA-242A-422B-ADF8-83D1E48CC825} - c:program filespc toolspc tools securitybdtPCTBrowserDefender.dll

uRun: [ctfmon.exe] c:windowssystem32ctfmon.exe

mRun: [skyTel] SkyTel.EXE

mRun: [RTHDCPL] RTHDCPL.EXE

mRun: [JMB36X Configure] c:windowssystem32JMRaidTool.exe boot

mRun: [WinampAgent] "c:program fileswinampwinampa.exe"

mRun: [iSUSPM Startup] "c:program filescommon filesinstallshieldupdateserviceisuspm.exe" -startup

mRun: [iSUSScheduler] "c:program filescommon filesinstallshieldupdateserviceissch.exe" -start

mRun: [NeroFilterCheck] c:windowssystem32NeroCheck.exe

mRun: [sunJavaUpdateSched] "c:program filescommon filesjavajava updatejusched.exe"

mRun: [HPUsageTrackingLEDM] "c:program fileshphp ut ledmbinhppusg.exe" "c:program fileshphp ut ledm"

dRun: [CTFMON.EXE] c:windowssystem32CTFMON.EXE

StartupFolder: c:docume~1galinm~1startm~1programsstartuppandau~1.lnk - c:program filespanda usb vaccineUSBVaccine.exe

StartupFolder: c:docume~1alluse~1startm~1programsstartupadobeg~1.lnk - c:program filescommon filesadobecalibrationAdobe Gamma Loader.exe

StartupFolder: c:docume~1alluse~1startm~1programsstartupadober~1.lnk - c:program filesadobeacrobat 7.0readerreader_sl.exe

StartupFolder: c:docume~1alluse~1startm~1programsstartupcomman~1.lnk - c:program filesfierycstationcstation.exe

StartupFolder: c:docume~1alluse~1startm~1programsstartupflexty~1.lnk - c:windowsdatecsFlex2K.exe

uPolicies-Explorer: NoDriveTypeAutoRun = dword:323

uPolicies-Explorer: NoDriveAutoRun = dword:67108863

uPolicies-Explorer: NoDrives = dword:0

mPolicies-Explorer: NoDriveTypeAutoRun = dword:323

mPolicies-Explorer: NoDriveAutoRun = dword:67108863

mPolicies-Explorer: NoDrives = dword:0

mPolicies-System: EnableInstallerDetection = dword:0

mPolicies-System: EnableSecureUIAPaths = dword:0

mPolicies-System: EnableVirtualization = dword:0

mPolicies-System: PromptOnSecureDesktop = dword:0

mPolicies-Explorer: NoDriveTypeAutoRun = dword:323

mPolicies-Explorer: NoDriveAutoRun = dword:67108863

IE: &Експортиране към Microsoft Excel - c:progra~1micros~2office12EXCEL.EXE/3000

IE: Google Sidewiki... - c:program filesgooglegoogle toolbarcomponentGoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:program filesmessengermsmsgs.exe

DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

TCP: NameServer = 192.168.4.1

TCP: Interfaces{8449FB41-9B5E-49F3-B4D2-6B6501B3F8AA} : DHCPNameServer = 192.168.4.1

Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} -

Notify: AtiExtEvent - Ati2evxx.dll

.

================= FIREFOX ===================

.

FF - ProfilePath - c:documents and settingsgalin marinovapplication datamozillafirefoxprofiles4fgnhrif.default

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - hxxp://www.google.bg/

FF - plugin: c:program filesjavajre6binnew_pluginnpdeployJava1.dll

FF - plugin: c:program filesk-lite codec packrealbrowserpluginsnppl3260.dll

FF - plugin: c:program filesk-lite codec packrealbrowserpluginsnprpjplug.dll

FF - plugin: c:program filesmozilla firefoxpluginsnpdeployJava1.dll

.

---- FIREFOX POLICIES ----

FF - user.js: network.cookie.cookieBehavior - 0

FF - user.js: privacy.clearOnShutdown.cookies - false

FF - user.js: security.warn_viewing_mixed - false

FF - user.js: security.warn_viewing_mixed.show_once - false

FF - user.js: security.warn_submit_insecure - false

FF - user.js: security.warn_submit_insecure.show_once - false

FF - user.js: extensions.incredibar_i.newTab - false

FF - user.js: extensions.incredibar_i.tlbrSrchUrl - hxxp://mystart.Incredibar.com/?a=6PQxmdP37t&loc=IB_TB&i=26&search=

FF - user.js: extensions.incredibar_i.id - 407c35a30000000000000019db240f88

FF - user.js: extensions.incredibar_i.instlDay - 15474

FF - user.js: extensions.incredibar_i.vrsn - 1.5.11.14

FF - user.js: extensions.incredibar_i.vrsni - 1.5.11.14

FF - user.js: extensions.incredibar_i.vrsnTs - 1.5.11.1415:25:43

FF - user.js: extensions.incredibar_i.prtnrId - Incredibar

FF - user.js: extensions.incredibar_i.prdct - incredibar

FF - user.js: extensions.incredibar_i.aflt - orgnl

FF - user.js: extensions.incredibar_i.smplGrp - none

FF - user.js: extensions.incredibar_i.tlbrId - base

FF - user.js: extensions.incredibar_i.instlRef -

FF - user.js: extensions.incredibar_i.dfltLng -

FF - user.js: extensions.incredibar_i.excTlbr - false

FF - user.js: extensions.incredibar_i.ms_url_id -

FF - user.js: extensions.incredibar_i.upn2 - 6PQxmdP37t

FF - user.js: extensions.incredibar_i.upn2n - 92542883388889491

FF - user.js: extensions.incredibar_i.productid - 26

FF - user.js: extensions.incredibar_i.installerproductid - 26

FF - user.js: extensions.incredibar_i.did - 10643

FF - user.js: extensions.incredibar_i.ppd - 1

.

============= SERVICES / DRIVERS ===============

.

R2 Browser Defender Update Service;Browser Defender Update Service;c:program filespc toolspc tools securitybdtBDTUpdateService.exe [2012-9-18 575448]

R2 HPSIService;HP SI Service;c:windowssystem32HPSIsvc.exe [2012-3-26 99896]

R3 LgBttPort;LGE Bluetooth TransPort;c:windowssystem32driverslgbtport.sys [2009-9-29 12160]

R3 lgbusenum;LG Bluetooth Bus Enumerator;c:windowssystem32driverslgbtbus.sys [2009-9-29 10496]

R3 LGVMODEM;LGE Virtual Modem;c:windowssystem32driverslgvmodem.sys [2009-9-29 12928]

S2 HP LaserJet Service;HP LaserJet Service;c:program fileshphplaserjetserviceHPLaserJetService.exe [2009-6-24 136704]

S3 ExterminateIt;ExterminateIt;c:windowssystem32driversextit.sys [2011-1-27 70760]

S3 MozillaMaintenance;Mozilla Maintenance Service;c:program filesmozilla maintenance servicemaintenanceservice.exe [2012-7-6 114144]

S3 mvusbews;USB EWS Device;c:windowssystem32driversmvusbews.sys [2012-2-1 17408]

S3 PCTBD;PC Tools Browser Defender Driver;c:windowssystem32driversPCTBD.sys [2012-9-18 70768]

S3 SetupNTGLM7X;SetupNTGLM7X;??e:ntglm7x.sys --> e:NTGLM7X.sys [?]

.

=============== Created Last 30 ================

.

2012-09-19 06:00:12 -------- d-----w- C:_OTL

2012-09-18 08:59:07 767960 ----a-w- c:windowsBDTSupport.dll

2012-09-18 08:59:07 70768 ----a-w- c:windowssystem32driversPCTBD.sys

2012-09-18 08:59:06 2267096 ----a-w- c:windowsPCTBDCore.dll

2012-09-18 08:59:06 1689560 ----a-w- c:windowsPCTBDRes.dll

2012-09-18 08:59:06 149464 ----a-w- c:windowsSGDetectionTool.dll

2012-09-18 08:58:02 -------- d-----w- c:program filesPC Tools

2012-09-18 08:52:50 203120 ----a-w- c:windowssystem32driversPCTSD.sys

2012-09-18 08:52:50 -------- d-----w- c:program filescommon filesPC Tools

2012-09-18 08:52:14 -------- d-----w- c:documents and settingsgalin marinovapplication dataTestApp

2012-09-18 08:52:14 -------- d-----w- c:documents and settingsall usersapplication dataPC Tools

2012-09-18 06:36:15 -------- d-----w- c:documents and settingsall usersapplication data036DFF35C19FA9E700001979E56C34C7

.

==================== Find3M ====================

.

2012-09-19 07:45:32 2828 --sha-w- c:windowssystem32KGyGaAvL.sys

2012-09-07 14:04:46 22856 ----a-w- c:windowssystem32driversmbam.sys

.

============= FINISH: 16:47:43,14 ===============

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2011-09-30.01)

.

Microsoft Windows XP Home Edition

Boot Device: DeviceHarddiskVolume1

Install Date: 13.8.2010 г. 10:30:07

System Uptime: 19.9.2012 г. 14:53:52 (2 hours ago)

.

Motherboard: MICRO-STAR INTERNATIONAL CO., LTD | | MS-7235

Processor: Intel® Core™2 CPU 6300 @ 1.86GHz | Socket 775 | 1863/66mhz

.

==== Disk Partitions =========================

.

A: is Removable

C: is FIXED (NTFS) - 29 GiB total, 18,754 GiB free.

D: is FIXED (NTFS) - 120 GiB total, 117,68 GiB free.

E: is CDROM ()

Q: is NetworkDisk (NTFS) - 24 GiB total, 10,788 GiB free.

R: is NetworkDisk (NTFS) - 52 GiB total, 50,683 GiB free.

S: is NetworkDisk (NTFS) - 38 GiB total, 31,154 GiB free.

T: is NetworkDisk (NTFS) - 73 GiB total, 70,95 GiB free.

U: is NetworkDisk (NTFS) - 29 GiB total, 27,351 GiB free.

V: is NetworkDisk (NTFS) - 89 GiB total, 75,627 GiB free.

W: is NetworkDisk (NTFS) - 89 GiB total, 8,845 GiB free.

X: is NetworkDisk (NTFS) - 90 GiB total, 11,99 GiB free.

.

==== Disabled Device Manager Items =============

.

==== System Restore Points ===================

.

RP297: 20.6.2012 г. 16:03:18 - System Checkpoint

RP298: 21.6.2012 г. 16:12:09 - System Checkpoint

RP299: 22.6.2012 г. 18:17:27 - System Checkpoint

RP300: 25.6.2012 г. 07:10:09 - System Checkpoint

RP301: 26.6.2012 г. 10:58:15 - System Checkpoint

RP302: 27.6.2012 г. 14:33:57 - System Checkpoint

RP303: 29.6.2012 г. 11:41:16 - System Checkpoint

RP304: 02.7.2012 г. 10:03:53 - System Checkpoint

RP305: 03.7.2012 г. 10:21:12 - System Checkpoint

RP306: 04.7.2012 г. 18:03:59 - System Checkpoint

RP307: 06.7.2012 г. 09:17:54 - System Checkpoint

RP308: 09.7.2012 г. 11:06:47 - System Checkpoint

RP309: 10.7.2012 г. 11:27:07 - System Checkpoint

RP310: 11.7.2012 г. 14:41:30 - System Checkpoint

RP311: 12.7.2012 г. 15:29:25 - System Checkpoint

RP312: 16.7.2012 г. 09:57:49 - System Checkpoint

RP313: 17.7.2012 г. 14:04:46 - System Checkpoint

RP314: 19.7.2012 г. 12:48:39 - System Checkpoint

RP315: 20.7.2012 г. 15:29:47 - System Checkpoint

RP316: 23.7.2012 г. 11:05:33 - System Checkpoint

RP317: 24.7.2012 г. 11:42:10 - System Checkpoint

RP318: 26.7.2012 г. 10:37:17 - System Checkpoint

RP319: 27.7.2012 г. 11:19:48 - System Checkpoint

RP320: 30.7.2012 г. 10:10:02 - System Checkpoint

RP321: 31.7.2012 г. 14:21:07 - System Checkpoint

RP322: 02.8.2012 г. 10:47:24 - System Checkpoint

RP323: 06.8.2012 г. 13:51:56 - System Checkpoint

RP324: 07.8.2012 г. 13:58:24 - System Checkpoint

RP325: 09.8.2012 г. 11:05:57 - System Checkpoint

RP326: 15.8.2012 г. 09:54:24 - System Checkpoint

RP327: 16.8.2012 г. 12:42:18 - System Checkpoint

RP328: 20.8.2012 г. 11:39:14 - System Checkpoint

RP329: 21.8.2012 г. 18:09:55 - System Checkpoint

RP330: 24.8.2012 г. 14:07:27 - System Checkpoint

RP331: 28.8.2012 г. 09:50:49 - System Checkpoint

RP332: 29.8.2012 г. 10:51:58 - System Checkpoint

RP333: 30.8.2012 г. 16:29:28 - System Checkpoint

RP334: 03.9.2012 г. 10:50:39 - System Checkpoint

RP335: 04.9.2012 г. 15:13:09 - System Checkpoint

RP336: 05.9.2012 г. 18:10:09 - System Checkpoint

RP337: 10.9.2012 г. 10:22:03 - System Checkpoint

RP338: 11.9.2012 г. 11:07:36 - System Checkpoint

RP339: 12.9.2012 г. 11:50:59 - System Checkpoint

RP340: 13.9.2012 г. 16:03:51 - System Checkpoint

RP341: 17.9.2012 г. 10:06:30 - System Checkpoint

RP342: 19.9.2012 г. 15:59:09 - System Checkpoint

.

==== Installed Programs ======================

.

2007 Microsoft Office Suite Service Pack 2 (SP2)

Adobe Flash Player 10 ActiveX

Adobe Flash Player 10 Plugin

Adobe Photoshop 7.0

Adobe Reader 7.0

Adobe Shockwave Player 11.5

Apple Application Support

Apple Software Update

ATI - Software Uninstall Utility

ATI Display Driver

ATI HYDRAVISION

Browser Guard 4.0

Command WorkStation

Corel Applications

CorelDRAW Graphics Suite X3

EN

ESET Online Scanner v3

FlexType 2K

FontNav

High Definition Audio Driver Package - KB888111

HP LaserJet Professional P1100-P1560-P1600 Series

hppLaserJetService

hppP1100P1560P1600SeriesLaserJetService

hppusgP1100P1560P1600Series

HPSSupply

Incredibar Toolbar on IE

Java Auto Updater

Java™ 6 Update 26

JRAID

K-Lite Mega Codec Pack 5.8.3

LG Bluetooth Drivers

LG United Mobile Drivers

Malwarebytes Anti-Malware version 1.65.0.1400

MarketResearch

Microsoft .NET Framework 1.1

Microsoft .NET Framework 2.0

Microsoft Kernel-Mode Driver Framework Feature Pack 1.7

Microsoft Office Access MUI (Bulgarian) 2007

Microsoft Office Enterprise 2007

Microsoft Office Excel MUI (Bulgarian) 2007

Microsoft Office Groove MUI (Bulgarian) 2007

Microsoft Office InfoPath MUI (Bulgarian) 2007

Microsoft Office OneNote MUI (Bulgarian) 2007

Microsoft Office Outlook MUI (Bulgarian) 2007

Microsoft Office PowerPoint MUI (Bulgarian) 2007

Microsoft Office Proof (Bulgarian) 2007

Microsoft Office Proof (English) 2007

Microsoft Office Proof (German) 2007

Microsoft Office Proof (Russian) 2007

Microsoft Office Proofing (Bulgarian) 2007

Microsoft Office Publisher MUI (Bulgarian) 2007

Microsoft Office Shared MUI (Bulgarian) 2007

Microsoft Office Word MUI (Bulgarian) 2007

Microsoft Software Update for Web Folders (Bulgarian) 12

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

Mozilla Firefox 15.0.1 (x86 bg)

Mozilla Maintenance Service

MSXML 4.0 SP2 (KB927978)

Nero 6 Ultra Edition

Panda USB Vaccine 1.0.1.4

PANTONE® color bridge™

PicaView32

Realtek High Definition Audio Driver

Sony USB Driver

TWAIN FieryScan

Update Manager

VBA

WebFldrs XP

Winamp

Windows Installer 3.1 (KB893803)

Windows Media Format Runtime

Windows Media Player Firefox Plugin

WinRAR archiver

X-Fonter 5.5

.

==== Event Viewer Messages From Past Week ========

.

19.9.2012 і. 15:18:50, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

19.9.2012 і. 15:18:20, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

19.9.2012 і. 15:17:50, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

19.9.2012 і. 15:17:20, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

19.9.2012 і. 15:16:50, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

19.9.2012 і. 15:16:20, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

19.9.2012 і. 15:15:50, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

19.9.2012 і. 15:15:20, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

19.9.2012 і. 15:14:50, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

19.9.2012 і. 15:14:20, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

19.9.2012 і. 15:13:50, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

19.9.2012 і. 15:13:20, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

19.9.2012 і. 15:12:50, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

19.9.2012 і. 15:12:20, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

19.9.2012 і. 15:11:50, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

19.9.2012 і. 15:11:20, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

19.9.2012 і. 15:10:50, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

19.9.2012 і. 15:10:20, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

19.9.2012 і. 15:09:50, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

19.9.2012 і. 15:09:20, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

19.9.2012 і. 15:08:50, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

19.9.2012 і. 15:08:20, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

19.9.2012 і. 15:07:50, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

19.9.2012 і. 15:07:20, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

19.9.2012 і. 15:06:50, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

19.9.2012 і. 15:06:20, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

19.9.2012 і. 15:05:50, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

19.9.2012 і. 15:05:20, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

19.9.2012 і. 15:04:50, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

19.9.2012 і. 15:04:20, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

19.9.2012 і. 14:52:33, error: Service Control Manager [7034] - The Java Quick Starter service terminated unexpectedly. It has done this 1 time(s).

19.9.2012 і. 14:52:33, error: Service Control Manager [7034] - The Browser Defender Update Service service terminated unexpectedly. It has done this 1 time(s).

19.9.2012 і. 14:52:33, error: Service Control Manager [7034] - The Ati HotKey Poller service terminated unexpectedly. It has done this 1 time(s).

19.9.2012 і. 14:52:33, error: Service Control Manager [7031] - The HP SI Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 1000 milliseconds: Restart the service.

19.9.2012 і. 09:27:39, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

19.9.2012 і. 09:27:09, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

19.9.2012 і. 09:26:39, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

19.9.2012 і. 09:26:09, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

19.9.2012 і. 09:25:39, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

19.9.2012 і. 09:25:09, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

19.9.2012 і. 09:24:39, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

19.9.2012 і. 09:24:09, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

19.9.2012 і. 09:23:39, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

19.9.2012 і. 09:23:09, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

19.9.2012 і. 09:22:39, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

19.9.2012 і. 09:22:09, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

19.9.2012 і. 09:21:39, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

19.9.2012 і. 09:21:09, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

19.9.2012 і. 09:20:39, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

19.9.2012 і. 09:20:09, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

19.9.2012 і. 09:19:39, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

19.9.2012 і. 09:19:09, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

19.9.2012 і. 09:18:39, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

19.9.2012 і. 09:18:09, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

19.9.2012 і. 09:17:39, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

19.9.2012 і. 09:17:09, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

19.9.2012 і. 09:16:39, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

19.9.2012 і. 09:16:09, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

19.9.2012 і. 09:15:39, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

19.9.2012 і. 09:15:09, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

19.9.2012 і. 09:14:39, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

19.9.2012 і. 09:14:09, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

19.9.2012 і. 09:13:39, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

19.9.2012 і. 09:13:09, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

19.9.2012 і. 09:00:13, error: Service Control Manager [7034] - The Java Quick Starter service terminated unexpectedly. It has done this 1 time(s).

19.9.2012 і. 09:00:13, error: Service Control Manager [7034] - The Browser Defender Update Service service terminated unexpectedly. It has done this 1 time(s).

19.9.2012 і. 09:00:13, error: Service Control Manager [7034] - The Ati HotKey Poller service terminated unexpectedly. It has done this 1 time(s).

19.9.2012 і. 09:00:13, error: Service Control Manager [7031] - The HP SI Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 1000 milliseconds: Restart the service.

18.9.2012 і. 19:19:24, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

18.9.2012 і. 19:18:54, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

18.9.2012 і. 19:18:24, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

18.9.2012 і. 19:17:54, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

18.9.2012 і. 19:17:24, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

18.9.2012 і. 19:16:54, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

18.9.2012 і. 19:16:24, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

18.9.2012 і. 19:15:54, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

18.9.2012 і. 19:15:24, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

18.9.2012 і. 19:14:54, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

18.9.2012 і. 19:14:24, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

18.9.2012 і. 19:13:54, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

18.9.2012 і. 19:13:24, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

18.9.2012 і. 19:12:54, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

18.9.2012 і. 19:12:24, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

18.9.2012 і. 19:11:54, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

18.9.2012 і. 19:11:24, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

18.9.2012 і. 19:10:54, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

18.9.2012 і. 19:10:24, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

18.9.2012 і. 19:09:54, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

18.9.2012 і. 19:09:24, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

18.9.2012 і. 19:08:54, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

18.9.2012 і. 19:08:24, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

18.9.2012 і. 19:07:54, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

18.9.2012 і. 19:07:24, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

18.9.2012 і. 19:06:54, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

18.9.2012 і. 19:06:24, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

18.9.2012 і. 19:05:54, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

18.9.2012 і. 17:35:17, error: Service Control Manager [7000] - The MBAMSwissArmy service failed to start due to the following error: A device attached to the system is not functioning.

18.9.2012 і. 17:16:37, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

18.9.2012 і. 17:16:07, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

18.9.2012 і. 17:15:37, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

18.9.2012 і. 17:15:07, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

18.9.2012 і. 17:14:37, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

18.9.2012 і. 17:14:07, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

18.9.2012 і. 17:13:37, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

18.9.2012 і. 17:13:07, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

18.9.2012 і. 17:12:37, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

18.9.2012 і. 17:12:07, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

18.9.2012 і. 17:11:37, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

18.9.2012 і. 17:11:07, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

18.9.2012 і. 17:10:37, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

18.9.2012 і. 17:10:07, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

18.9.2012 і. 17:09:37, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

18.9.2012 і. 17:09:07, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

18.9.2012 і. 17:08:37, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

18.9.2012 і. 17:08:07, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

18.9.2012 і. 17:07:37, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

18.9.2012 і. 17:07:07, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

18.9.2012 і. 17:06:37, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

18.9.2012 і. 17:06:07, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

18.9.2012 і. 17:05:37, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

18.9.2012 і. 17:05:07, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

18.9.2012 і. 17:04:37, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

18.9.2012 і. 17:04:07, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

18.9.2012 і. 17:03:37, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

18.9.2012 і. 17:03:07, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

18.9.2012 і. 17:02:37, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

18.9.2012 і. 17:02:07, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

18.9.2012 і. 16:45:00, error: Service Control Manager [7000] - The MBAMSwissArmy service failed to start due to the following error: A device attached to the system is not functioning.

18.9.2012 і. 16:40:47, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

18.9.2012 і. 14:01:04, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: Fips intelppm

18.9.2012 і. 13:59:50, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

18.9.2012 і. 13:58:28, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

18.9.2012 і. 13:57:08, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

18.9.2012 і. 13:57:07, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

18.9.2012 і. 13:57:04, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

18.9.2012 і. 13:46:32, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

18.9.2012 і. 13:27:33, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

18.9.2012 і. 12:30:21, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

18.9.2012 і. 12:25:17, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

18.9.2012 і. 12:24:47, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

18.9.2012 і. 12:24:10, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

18.9.2012 і. 12:24:09, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

18.9.2012 і. 12:22:38, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

18.9.2012 і. 11:58:04, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service MSIServer with arguments "" in order to run the server: {000C101C-0000-0000-C000-000000000046}

18.9.2012 і. 11:49:40, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

18.9.2012 і. 11:49:38, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

18.9.2012 і. 11:47:16, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

18.9.2012 і. 11:45:05, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: Fips intelppm

18.9.2012 і. 10:47:11, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the HP SI Service service to connect.

18.9.2012 і. 10:47:11, error: Service Control Manager [7000] - The HP SI Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.

18.9.2012 і. 10:47:10, error: Service Control Manager [7031] - The HP SI Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 1000 milliseconds: Restart the service.

18.9.2012 і. 10:47:09, error: Service Control Manager [7034] - The Windows User Mode Driver Framework service terminated unexpectedly. It has done this 1 time(s).

18.9.2012 і. 10:47:09, error: Service Control Manager [7034] - The Java Quick Starter service terminated unexpectedly. It has done this 1 time(s).

18.9.2012 і. 10:47:09, error: Service Control Manager [7034] - The HP LaserJet Service service terminated unexpectedly. It has done this 1 time(s).

18.9.2012 і. 10:47:09, error: Service Control Manager [7034] - The Ati HotKey Poller service terminated unexpectedly. It has done this 1 time(s).

18.9.2012 і. 10:47:09, error: Service Control Manager [7031] - The HP SI Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 1000 milliseconds: Restart the service.

18.9.2012 і. 10:45:53, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

18.9.2012 і. 10:26:33, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

18.9.2012 і. 10:23:20, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: Fips intelppm

18.9.2012 і. 10:22:37, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

18.9.2012 і. 10:20:44, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

18.9.2012 і. 10:05:31, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

18.9.2012 і. 10:05:18, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

18.9.2012 і. 10:03:23, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: Fips intelppm

18.9.2012 і. 10:03:21, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

18.9.2012 і. 10:02:08, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

18.9.2012 і. 09:58:24, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the HP SI Service service to connect.

18.9.2012 і. 09:58:24, error: Service Control Manager [7000] - The HP SI Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.

18.9.2012 і. 09:58:23, error: Service Control Manager [7031] - The HP SI Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 1000 milliseconds: Restart the service.

18.9.2012 і. 09:58:22, error: Service Control Manager [7031] - The HP SI Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 1000 milliseconds: Restart the service.

18.9.2012 і. 09:58:21, error: Service Control Manager [7031] - The HP SI Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 1000 milliseconds: Restart the service.

18.9.2012 і. 09:58:19, error: Service Control Manager [7031] - The HP SI Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 1000 milliseconds: Restart the service.

18.9.2012 і. 09:58:18, error: Service Control Manager [7031] - The HP SI Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 1000 milliseconds: Restart the service.

18.9.2012 і. 09:58:17, error: Service Control Manager [7031] - The HP SI Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 1000 milliseconds: Restart the service.

18.9.2012 і. 09:58:16, error: Service Control Manager [7031] - The HP SI Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 1000 milliseconds: Restart the service.

18.9.2012 і. 09:58:14, error: Service Control Manager [7031] - The HP SI Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 1000 milliseconds: Restart the service.

18.9.2012 і. 09:58:13, error: Service Control Manager [7031] - The HP SI Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 1000 milliseconds: Restart the service.

18.9.2012 і. 09:58:12, error: Service Control Manager [7031] - The HP SI Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 1000 milliseconds: Restart the service.

18.9.2012 і. 09:58:11, error: Service Control Manager [7031] - The HP SI Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 1000 milliseconds: Restart the service.

18.9.2012 і. 09:58:09, error: Service Control Manager [7031] - The HP SI Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 1000 milliseconds: Restart the service.

18.9.2012 і. 09:58:08, error: Service Control Manager [7031] - The HP SI Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 1000 milliseconds: Restart the service.

18.9.2012 і. 09:58:07, error: Service Control Manager [7031] - The HP SI Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 1000 milliseconds: Restart the service.

18.9.2012 і. 09:58:06, error: Service Control Manager [7034] - The Windows User Mode Driver Framework service terminated unexpectedly. It has done this 1 time(s).

18.9.2012 і. 09:58:06, error: Service Control Manager [7034] - The Java Quick Starter service terminated unexpectedly. It has done this 1 time(s).

18.9.2012 і. 09:58:06, error: Service Control Manager [7034] - The HP LaserJet Service service terminated unexpectedly. It has done this 1 time(s).

18.9.2012 і. 09:58:06, error: Service Control Manager [7034] - The Ati HotKey Poller service terminated unexpectedly. It has done this 1 time(s).

18.9.2012 і. 09:58:06, error: Service Control Manager [7031] - The HP SI Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 1000 milliseconds: Restart the service.

18.9.2012 і. 09:44:05, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the HP SI Service service to connect.

18.9.2012 і. 09:44:05, error: Service Control Manager [7000] - The HP SI Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.

18.9.2012 і. 09:44:04, error: Service Control Manager [7031] - The HP SI Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 1000 milliseconds: Restart the service.

18.9.2012 і. 09:44:03, error: Service Control Manager [7031] - The HP SI Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 1000 milliseconds: Restart the service.

18.9.2012 і. 09:44:02, error: Service Control Manager [7034] - The Windows User Mode Driver Framework service terminated unexpectedly. It has done this 1 time(s).

18.9.2012 і. 09:44:02, error: Service Control Manager [7034] - The Java Quick Starter service terminated unexpectedly. It has done this 1 time(s).

18.9.2012 і. 09:44:02, error: Service Control Manager [7034] - The HP LaserJet Service service terminated unexpectedly. It has done this 1 time(s).

18.9.2012 і. 09:44:02, error: Service Control Manager [7034] - The Ati HotKey Poller service terminated unexpectedly. It has done this 1 time(s).

18.9.2012 і. 09:44:02, error: Service Control Manager [7031] - The HP SI Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 1000 milliseconds: Restart the service.

18.9.2012 і. 09:38:43, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the HP SI Service service to connect.

18.9.2012 і. 09:38:43, error: Service Control Manager [7000] - The HP SI Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.

18.9.2012 і. 09:38:42, error: Service Control Manager [7031] - The HP SI Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 1000 milliseconds: Restart the service.

18.9.2012 і. 09:38:41, error: Service Control Manager [7031] - The HP SI Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 1000 milliseconds: Restart the service.

18.9.2012 і. 09:38:39, error: Service Control Manager [7031] - The HP SI Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 1000 milliseconds: Restart the service.

18.9.2012 і. 09:38:38, error: Service Control Manager [7031] - The HP SI Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 1000 milliseconds: Restart the service.

18.9.2012 і. 09:38:37, error: Service Control Manager [7031] - The HP SI Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 1000 milliseconds: Restart the service.

18.9.2012 і. 09:38:36, error: Service Control Manager [7031] - The HP SI Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 1000 milliseconds: Restart the service.

18.9.2012 і. 09:38:34, error: Service Control Manager [7031] - The HP SI Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 1000 milliseconds: Restart the service.

18.9.2012 і. 09:38:33, error: Service Control Manager [7031] - The HP SI Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 1000 milliseconds: Restart the service.

18.9.2012 і. 09:38:32, error: Service Control Manager [7034] - The Windows User Mode Driver Framework service terminated unexpectedly. It has done this 1 time(s).

18.9.2012 і. 09:38:32, error: Service Control Manager [7034] - The Java Quick Starter service terminated unexpectedly. It has done this 1 time(s).

18.9.2012 і. 09:38:32, error: Service Control Manager [7034] - The Ati HotKey Poller service terminated unexpectedly. It has done this 1 time(s).

18.9.2012 і. 09:38:32, error: Service Control Manager [7031] - The HP SI Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 1000 milliseconds: Restart the service.

17.9.2012 і. 09:36:41, error: Service Control Manager [7000] - The MBAMSwissArmy service failed to start due to the following error: A device attached to the system is not functioning.

14.9.2012 і. 15:06:46, error: Service Control Manager [7000] - The MBAMSwissArmy service failed to start due to the following error: A device attached to the system is not functioning.

14.9.2012 і. 15:06:31, error: Service Control Manager [7000] - The MBAMSwissArmy service failed to start due to the following error: A device attached to the system is not functioning.

14.9.2012 і. 15:06:15, error: Service Control Manager [7000] - The MBAMSwissArmy service failed to start due to the following error: A device attached to the system is not functioning.

14.9.2012 і. 15:05:34, error: Service Control Manager [7000] - The MBAMSwissArmy service failed to start due to the following error: A device attached to the system is not functioning.

14.9.2012 і. 12:21:24, error: Service Control Manager [7000] - The MBAMSwissArmy service failed to start due to the following error: A device attached to the system is not functioning.

14.9.2012 і. 12:02:28, error: Service Control Manager [7000] - The MBAMSwissArmy service failed to start due to the following error: A device attached to the system is not functioning.

14.9.2012 і. 12:01:59, error: Service Control Manager [7000] - The MBAMSwissArmy service failed to start due to the following error: A device attached to the system is not functioning.

13.9.2012 і. 14:11:25, error: Service Control Manager [7000] - The MBAMSwissArmy service failed to start due to the following error: A device attached to the system is not functioning.

13.9.2012 і. 13:15:36, error: Service Control Manager [7000] - The MBAMSwissArmy service failed to start due to the following error: A device attached to the system is not functioning.

.

==== End Of File ===========================

Редактирано 19 септември 201214 г. от Lugos (преглед на промените)

20 септември 201213 г.

Така, да продължим:

Деинсталирайте PC Tools продуктите, които са тежки и неефективни от Start => Control Panel => Add or remove Programs.

Това е важно да се направи, защото съм включил файловете на програмата в скрипта за изтриване в трета стъпка и ако програмата не е деинсталирана преди това може да се стигне до син екран...

Също така разкарайте остатъците от AVG. За допълнително почистване използвайте следните два инструмента: (за всеки случай).

AVG Remover(32bit) 2012(avg_remover_stf_x86_2012_2125.exe)

AVG Remover(32bit) 2013(avg_remover_stf_x86_2013_2706.exe)

После ще изберем читава защитна програма.

СТЪПКА 1

Стартирайте отново програмата AdwCleaner (by Xplode).

Затворете всички стартирани програми и браузъри
Кликнете два пъти върху adwcleaner.exe за да стартирате инструмента.
Този път маркирайте Delete
Вашият компютър ще се рестартира автоматично. Текстовия файл ще се отвори след рестарта.
Моля, да публикувате съдържанието на този лог в отговора си
Можете да намерите лога,който автоматично се запомня тук C:AdwCleaner[s1].txt.

СТЪПКА 2

Моля отворете Start => Control Panel => Add or Remove Programs => деинсталирайте всички версии на JAVA (накрая ще сложим най-новата).
Моля изтеглете JavaRa и я разархивирайте на вашия десктоп.
Стартирайте файла JavaRa.exe.
Изберете бутона Settings и сложете отметка пред Create a log file. Натиснете бутона Back.
Натиснете бутона Update JavaRa Definitions. Изберете download. Когато приключи изберете Back.
Сега вече натиснете Remove JRE, тъй като вече я деинсталирахме в началото просто натиснете бутона Next.
Сега натиснете Perform Removal Routine за да премахнете всички остатъци от JAVA в регистъра и от компютъра.
Когато приключи натиснете бутона OK за да затворите съобщението.
Изберете Next. Изберете бутона Next. После ще се занимаваме със свалянето на най-новата версия и затова сега пропускаме тази стъпка.
Сега изберете бутона Close this wizard и натиснете Finish.
От основното меню изберете сега Additional tasks
Сложете отметка пред Remove Outdated JRE Firefox Extentions и натиснете бутона Run. Mozilla Firefox трябва да бъде затворен преди да се опитате да изпълните тази стъпка!
След като приключи успешно, ще видите съобщението: "Selected tasks completed successfully".
Ще се създаде лог файл в същата папка от която сте стартирали JavaRa.
Моля, публикувайте този файл в следващия си коментар. Ако е много голям го качете на file.bg.
Затворете JavaRa с натискането на червения хикс.

СТЪПКА 3

Да премахнем използваните от нас инструменти и техните карантинни папки, остатъци от антивирусни програми, от преименуваните вирусни файлове и прочие боклуци:

Стартирайте файла с двукратен клик на мишката.
Под с Copy/ Paste въведете изцяло следната текстова информация (само това, което е поставено в карето):

:OTL
DRV - File not found [Kernel | On_Demand | Unknown] -- C:DOCUME~1GALINM~1LOCALS~1Tempmbr.sys -- (mbr)
IE - HKU.DEFAULT..SearchScopes{CCC7A320-B3CA-4199-B1A6-9F516DD69829}: "URL" = http://search.avg.com/route/?d=4e0c3940&v=6.11.25.1&i=26&tp=chrome&q={searchTerms}&lng={language}&iy=&ychte=us
IE - HKUS-1-5-18..SearchScopes{CCC7A320-B3CA-4199-B1A6-9F516DD69829}: "URL" = http://search.avg.com/route/?d=4e0c3940&v=6.11.25.1&i=26&tp=chrome&q={searchTerms}&lng={language}&iy=&ychte=us
IE - HKUS-1-5-21-117609710-602609370-682003330-1004..URLSearchHook: {472734EA-242A-422b-ADF8-83D1E48CC825} - C:Program FilesPC ToolsPC Tools SecurityBDTPCTBrowserDefender.dll (Threat Expert Ltd.)
FF - HKEY_LOCAL_MACHINEsoftwaremozillaFirefoxExtensionsavg@igeared: C:Program FilesAVGAVG10ToolbarFirefoxavg@igeared
FF - HKEY_LOCAL_MACHINEsoftwaremozillaFirefoxExtensions{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:Program FilesAVGAVG10Firefox4 [2011.07.02 09:46:57 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINEsoftwaremozillaFirefoxExtensions{cb84136f-9c44-433a-9048-c5cd9df1dc16}: C:Program FilesPC ToolsPC Tools SecurityBDTFirefox [2012.09.18 11:59:08 | 000,000,000 | ---D | M]
O2 - BHO: (PC Tools Browser Guard BHO) - {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - C:Program FilesPC ToolsPC Tools SecurityBDTPCTBrowserDefender.dll (Threat Expert Ltd.)
O2 - BHO: (Incredibar.com Helper Object) - {6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99} - C:Program FilesIncredibar.comincredibar1.5.11.14bhincredibar.dll File not found
O3 - HKLM..Toolbar: (PC Tools Browser Guard) - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:Program FilesPC ToolsPC Tools SecurityBDTPCTBrowserDefender.dll (Threat Expert Ltd.)
O3 - HKLM..Toolbar: (Incredibar Toolbar) - {F9639E4A-801B-4843-AEE3-03D9DA199E77} - C:Program FilesIncredibar.comincredibar1.5.11.14incredibarTlbr.dll File not found
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O18 - ProtocolHandleravgsecuritytoolbar {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - C:Program FilesAVGAVG10ToolbarIEToolbar.dll File not found
[2012.09.18 17:27:22 | 000,000,000 | ---D | C] -- C:Documents and SettingsGalin MarinovDesktopRK_Quarantine
[2012.09.18 11:59:07 | 000,070,768 | ---- | C] (PC Tools) -- C:WINDOWSSystem32driversPCTBD.sys
[2012.09.18 11:59:06 | 002,267,096 | ---- | C] (Threat Expert Ltd.) -- C:WINDOWSPCTBDCore.dll
[2012.09.18 11:59:06 | 001,689,560 | ---- | C] (Threat Expert Ltd.) -- C:WINDOWSPCTBDRes.dll
[2012.09.18 11:59:06 | 000,149,464 | ---- | C] (PC Tools) -- C:WINDOWSSGDetectionTool.dll
[2012.09.18 11:58:02 | 000,000,000 | ---D | C] -- C:Program FilesPC Tools
[2012.09.18 11:52:50 | 000,203,120 | ---- | C] (PC Tools) -- C:WINDOWSSystem32driversPCTSD.sys
[2012.09.18 11:52:50 | 000,000,000 | ---D | C] -- C:Program FilesCommon FilesPC Tools
[2012.09.18 11:52:14 | 000,000,000 | ---D | C] -- C:Documents and SettingsAll UsersApplication DataPC Tools
[2012.09.18 09:36:15 | 000,000,000 | ---D | C] -- C:Documents and SettingsAll UsersApplication Data036DFF35C19FA9E700001979E56C34C7
[2012.09.18 18:50:48 | 000,052,696 | ---- | M] () -- C:Documents and SettingsGalin MarinovDesktopESETNecursRemover.zip
[2012.09.18 17:27:12 | 001,378,816 | ---- | M] () -- C:Documents and SettingsGalin MarinovDesktopRogueKiller.exe
[2012.09.18 13:35:21 | 001,659,808 | ---- | M] (Bleeping Computer, LLC) -- C:Documents and SettingsGalin MarinovDesktoprkill.exe
[2012.09.18 12:28:24 | 000,492,146 | R--- | M] (Swearware) -- C:Documents and SettingsGalin MarinovDesktopdds.exe
[2012.06.22 15:34:52 | 000,203,120 | ---- | M] (PC Tools) -- C:WINDOWSSystem32driversPCTSD.sys
[2012.06.22 11:39:14 | 000,070,768 | ---- | M] (PC Tools) -- C:WINDOWSSystem32driversPCTBD.sys
[2012.06.22 11:39:02 | 000,149,464 | ---- | M] (PC Tools) -- C:WINDOWSSGDetectionTool.dll
[2012.06.22 11:39:00 | 002,267,096 | ---- | M] (Threat Expert Ltd.) -- C:WINDOWSPCTBDCore.dll
[2012.06.22 11:39:00 | 001,689,560 | ---- | M] (Threat Expert Ltd.) -- C:WINDOWSPCTBDRes.dll
[2012.06.22 11:38:38 | 000,767,960 | ---- | M] () -- C:WINDOWSBDTSupport.dll
[2012.06.22 10:43:40 | 000,003,488 | ---- | M] () -- C:WINDOWSUDB.zip
[2012.06.22 10:43:40 | 000,000,882 | ---- | M] () -- C:WINDOWSRegSDImport.xml
[2012.06.22 10:43:40 | 000,000,879 | ---- | M] () -- C:WINDOWSRegISSImport.xml
[2012.06.22 10:43:40 | 000,000,131 | ---- | M] () -- C:WINDOWSIDB.zip
[2012.02.18 10:41:12 | 000,047,168 | ---- | C] () -- C:WINDOWSSystem32driversb1991ed8bf9f523.sys.vir
[2012.09.19 09:03:08 | 000,000,227 | RHS- | M] () -- C:WINDOWSassemblyDesktop.ini
[2012.09.18 09:38:06 | 000,000,000 | ---D | M] -- C:Documents and SettingsAll UsersApplication Data036DFF35C19FA9E700001979E56C34C7
[2011.01.31 10:52:15 | 000,000,000 | ---D | M] -- C:Documents and SettingsAll UsersApplication DataMFAData
[2011.01.27 12:41:19 | 000,000,000 | ---D | M] -- C:Documents and SettingsGalin MarinovApplication DataAVG10
[2011.01.31 10:58:16 | 000,000,000 | ---D | M] -- C:Program FilesAVG
[2012.09.18 11:58:02 | 000,000,000 | ---D | M] -- C:Program FilesPC Tools
@Alternate Data Stream - 127 bytes -> C:Documents and SettingsAll UsersApplication DataTEMP:430C6D84
@Alternate Data Stream - 103 bytes -> C:Documents and SettingsAll UsersApplication DataTEMP:DFC5A2B2
:commands
[emptytemp]

След като въведете скрипта от цитата по-горе натиснете бутона, маркиран в червено: Run Fix

Windows ще се рестартира и ще се създаде лог файл - OTL fix log. Публикувайте съдържанието му с Copy/Paste в следващия си коментар.

СТЪПКА 4

Направете скритите файлове видими:

My Computer => Folder Options => View => сложете отметка пред:

Show hidden files and folders и махнете отметката пред Hide Protected Operating System Files (Recommended).

След това отворете VirusTotal и пратете този файл за анализ:

C:Documents and SettingsGalin MarinovLocal SettingsApplication Datawudysy.ipq

Ако вече е бил анализиран натиснете reanalyse.

Публикувайте линка с резултатите от проверката.

След това пишете как е положението.

20 септември 201213 г.

Автор

СТЪПКА 1

# AdwCleaner v2.002 - Logfile created 09/20/2012 at 09:20:33

# Updated 16/09/2012 by Xplode

# Operating system : Microsoft Windows XP Service Pack 2 (32 bits)

# User : Galin Marinov - GMM

# Boot Mode : Normal

# Running from : C:\Documents and Settings\Galin Marinov\Desktop\adwcleaner.exe

# Option [Delete]

***** [services] *****

***** [Files / Folders] *****

***** [Registry] *****

Key Deleted : HKCU\Software\IM

Key Deleted : HKCU\Software\ImInstaller

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F9639E4A-801B-4843-AEE3-03D9DA199E77}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{CFE8AAFD-A0F3-4329-84E9-6B679EC93EC2}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\escort.DLL

Key Deleted : HKLM\SOFTWARE\Classes\AppID\escortApp.DLL

Key Deleted : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL

Key Deleted : HKLM\SOFTWARE\Classes\AppID\escorTlbr.DLL

Key Deleted : HKLM\SOFTWARE\Classes\AppID\esrv.EXE

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{C01315C7-B4E2-4864-B43D-5FAFC414D179}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{C1545464-C77C-4130-A572-1C619E2895FE}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{ED0E67AD-926C-4008-87E5-03CF72AA2A7E}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{EF7FEC6D-451B-4452-9D26-7E10C6B5DB6E}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{F9639E4A-801B-4843-AEE3-03D9DA199E77}

Key Deleted : HKLM\SOFTWARE\Classes\escort.escortIEPane

Key Deleted : HKLM\SOFTWARE\Classes\escort.escortIEPane.1

Key Deleted : HKLM\SOFTWARE\Classes\esrv.IncredibarESrvc

Key Deleted : HKLM\SOFTWARE\Classes\esrv.IncredibarESrvc.1

Key Deleted : HKLM\SOFTWARE\Classes\I

Key Deleted : HKLM\SOFTWARE\Classes\Incredibar.dskBnd

Key Deleted : HKLM\SOFTWARE\Classes\Incredibar.dskBnd.1

Key Deleted : HKLM\SOFTWARE\Classes\Incredibar.IncredibarHlpr

Key Deleted : HKLM\SOFTWARE\Classes\Incredibar.IncredibarHlpr.1

Key Deleted : HKLM\SOFTWARE\Classes\IncredibarApp.appCore

Key Deleted : HKLM\SOFTWARE\Classes\IncredibarApp.appCore.1

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{22B0769F-794B-4422-AC84-47B123C8986D}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{255E0B2A-D747-4EEF-B7CE-159D73A3656D}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{28ED590D-F5ED-4E05-A87F-1D759F1C6169}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{45D5B93F-E2ED-4AF2-915E-DCDDBDA8C33C}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{771B99AB-636F-4A11-9039-8DFEB927B061}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{A8321AA2-2227-40C7-8525-6C2F4E1B0EBE}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{AA41A731-6814-4A70-A6F1-C0A20FBBFBD5}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{ABBB8A9E-D8AF-40D1-94BE-5175077465FC}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{BF737694-56F6-46FA-9FDC-FA99A5B25FAD}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{CFCD164E-8AC9-478E-9ECC-B616A932016C}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D5961CC0-B442-4567-8030-67E241EF4CC2}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E450067F-1C93-41A7-928E-07E5C2EEC680}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{F977D9F2-4BDC-44A6-B508-7C0284C61EED}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{48C9C8B0-A546-46C1-A81F-47A31E623E9D}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{CFE8AAFD-A0F3-4329-84E9-6B679EC93EC2}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}

Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{74C36554-31F0-49DD-8857-ED6A64DF45BE}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\incredibar

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\incredibar

Key Deleted : HKLM\Software\Web Assistant

Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{F9639E4A-801B-4843-AEE3-03D9DA199E77}]

***** [internet Browsers] *****

-\\ Internet Explorer v6.0.2900.2180

Restored : [HKCU\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]

Restored : [HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes - DefaultScope]

Restored : [HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]

Restored : [HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]

Restored : [HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]

-\\ Mozilla Firefox v15.0.1 (bg)

Profile name : default

File : C:\Documents and Settings\Galin Marinov\Application Data\Mozilla\Firefox\Profiles\4fgnhrif.default\prefs.js

C:\Documents and Settings\Galin Marinov\Application Data\Mozilla\Firefox\Profiles\4fgnhrif.default\user.js ... Deleted !

Deleted : user_pref("extensions.incredibar.actvtyRptTime", "1339583815248");

Deleted : user_pref("extensions.incredibar.admin", false);

Deleted : user_pref("extensions.incredibar.aflt", "orgnl");

Deleted : user_pref("extensions.incredibar.afterInstallRpt", "sent");

Deleted : user_pref("extensions.incredibar.cntry", "BG");

Deleted : user_pref("extensions.incredibar.dfltLng", "EN");

Deleted : user_pref("extensions.incredibar.dfltSrch", false);

Deleted : user_pref("extensions.incredibar.dfltlng", "EN");

Deleted : user_pref("extensions.incredibar.dfltsrch", "false");

Deleted : user_pref("extensions.incredibar.did", "10643");

Deleted : user_pref("extensions.incredibar.envrmnt", "production");

Deleted : user_pref("extensions.incredibar.excTlbr", false);

Deleted : user_pref("extensions.incredibar.hdrMd5", "8930CA0786A32C129DC86C67C7E0311E");

Deleted : user_pref("extensions.incredibar.hmpg", false);

Deleted : user_pref("extensions.incredibar.hrdid", "0");

Deleted : user_pref("extensions.incredibar.id", "407c35a30000000000000019db240f88");

Deleted : user_pref("extensions.incredibar.installerproductid", "26");

Deleted : user_pref("extensions.incredibar.instlDay", "15474");

Deleted : user_pref("extensions.incredibar.instlRef", "");

Deleted : user_pref("extensions.incredibar.instlday", "15474");

Deleted : user_pref("extensions.incredibar.instlref", "");

Deleted : user_pref("extensions.incredibar.isDcmntCmplt", true);

Deleted : user_pref("extensions.incredibar.isdcmntcmplt", "false");

Deleted : user_pref("extensions.incredibar.keywordurl", "");

Deleted : user_pref("extensions.incredibar.lastVrsnTs", "1.5.11.1415:25:43");

Deleted : user_pref("extensions.incredibar.mntrvrsn", "1.2.0");

Deleted : user_pref("extensions.incredibar.newTab", false);

Deleted : user_pref("extensions.incredibar.newtab", "false");

Deleted : user_pref("extensions.incredibar.newtaburl", "");

Deleted : user_pref("extensions.incredibar.noFFXTlbr", false);

Deleted : user_pref("extensions.incredibar.ppd", "1");

Deleted : user_pref("extensions.incredibar.prdct", "incredibar");

Deleted : user_pref("extensions.incredibar.productid", "26");

Deleted : user_pref("extensions.incredibar.propectorlck", 78143814);

Deleted : user_pref("extensions.incredibar.prtnrId", "Incredibar");

Deleted : user_pref("extensions.incredibar.prtnrid", "Incredibar");

Deleted : user_pref("extensions.incredibar.sg", "none");

Deleted : user_pref("extensions.incredibar.smplGrp", "none");

Deleted : user_pref("extensions.incredibar.smplgrp", "none");

Deleted : user_pref("extensions.incredibar.srch", "");

Deleted : user_pref("extensions.incredibar.srchprvdr", "");

Deleted : user_pref("extensions.incredibar.tlbrId", "base");

Deleted : user_pref("extensions.incredibar.tlbrSrchUrl", "hxxp://mystart.Incredibar.com/?a=6PQxmdP37t&loc=IB_T[...]

Deleted : user_pref("extensions.incredibar.tlbrid", "base");

Deleted : user_pref("extensions.incredibar.tlbrsrchurl", "hxxp://mystart.Incredibar.com/?a=6PQxmdP37t&loc=IB_T[...]

Deleted : user_pref("extensions.incredibar.upn2", "6PQxmdP37t");

Deleted : user_pref("extensions.incredibar.upn2n", "92542883388889491");

Deleted : user_pref("extensions.incredibar.vrsn", "1.5.11.14");

Deleted : user_pref("extensions.incredibar.vrsnTs", "1.5.11.1415:25:43");

Deleted : user_pref("extensions.incredibar.vrsni", "1.5.11.14");

Deleted : user_pref("extensions.incredibar.vrsnts", "1.5.11.1415:25:43");

Deleted : user_pref("extensions.incredibar_i.aflt", "orgnl");

Deleted : user_pref("extensions.incredibar_i.dfltLng", "");

Deleted : user_pref("extensions.incredibar_i.did", "10643");

Deleted : user_pref("extensions.incredibar_i.excTlbr", false);

Deleted : user_pref("extensions.incredibar_i.id", "407c35a30000000000000019db240f88");

Deleted : user_pref("extensions.incredibar_i.installerproductid", "26");

Deleted : user_pref("extensions.incredibar_i.instlDay", "15474");

Deleted : user_pref("extensions.incredibar_i.instlRef", "");

Deleted : user_pref("extensions.incredibar_i.ms_url_id", "");

Deleted : user_pref("extensions.incredibar_i.newTab", false);

Deleted : user_pref("extensions.incredibar_i.ppd", "1");

Deleted : user_pref("extensions.incredibar_i.prdct", "incredibar");

Deleted : user_pref("extensions.incredibar_i.productid", "26");

Deleted : user_pref("extensions.incredibar_i.prtnrId", "Incredibar");

Deleted : user_pref("extensions.incredibar_i.smplGrp", "none");

Deleted : user_pref("extensions.incredibar_i.tlbrId", "base");

Deleted : user_pref("extensions.incredibar_i.tlbrSrchUrl", "hxxp://mystart.Incredibar.com/?a=6PQxmdP37t&loc=IB[...]

Deleted : user_pref("extensions.incredibar_i.upn2", "6PQxmdP37t");

Deleted : user_pref("extensions.incredibar_i.upn2n", "92542883388889491");

Deleted : user_pref("extensions.incredibar_i.vrsn", "1.5.11.14");

Deleted : user_pref("extensions.incredibar_i.vrsnTs", "1.5.11.1415:25:43");

Deleted : user_pref("extensions.incredibar_i.vrsni", "1.5.11.14");

Deleted : user_pref("{336D0C35-8A85-403a-B9D2-65C292C39087}.ScriptData_WSG_whiteList", "{\"search.babylon.com\[...]

*************************

AdwCleaner[s1].txt - [10679 octets] - [20/09/2012 09:20:33]

########## EOF - C:\AdwCleaner[s1].txt - [10740 octets] ##########

СТЪПКА 2

http://file.bg/c186179wlskP

СТЪПКА 3

All processes killed

========== OTL ==========

Error: No service named mbr was found to stop!

Service\Driver key mbr not found.

File C:\DOCUME~1\GALINM~1\LOCALS~1\Temp\mbr.sys not found.

Registry key HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}\ not found.

Registry key HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}\ not found.

Registry value HKEY_USERS\S-1-5-21-117609710-602609370-682003330-1004\Software\Microsoft\Internet Explorer\URLSearchHooks\\{472734EA-242A-422b-ADF8-83D1E48CC825} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{472734EA-242A-422b-ADF8-83D1E48CC825}\ deleted successfully.

C:\Program Files\PC Tools\PC Tools Security\BDT\PCTBrowserDefender.dll moved successfully.

Registry value HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\avg@igeared deleted successfully.

File C:\Program Files\AVG\AVG10\Toolbar\Firefox\avg@igeared not found.

Registry value HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4} not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}\ not found.

File C:\Program Files\AVG\AVG10\Firefox4\ not found.

Registry value HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{cb84136f-9c44-433a-9048-c5cd9df1dc16} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cb84136f-9c44-433a-9048-c5cd9df1dc16}\ not found.

C:\Program Files\PC Tools\PC Tools Security\BDT\Firefox\platform\WINNT_x86-msvc\components folder moved successfully.

C:\Program Files\PC Tools\PC Tools Security\BDT\Firefox\platform\WINNT_x86-msvc folder moved successfully.

C:\Program Files\PC Tools\PC Tools Security\BDT\Firefox\platform\Linux_x86_64-gcc3\components folder moved successfully.

C:\Program Files\PC Tools\PC Tools Security\BDT\Firefox\platform\Linux_x86_64-gcc3 folder moved successfully.

C:\Program Files\PC Tools\PC Tools Security\BDT\Firefox\platform\Linux_x86-gcc3\components folder moved successfully.

C:\Program Files\PC Tools\PC Tools Security\BDT\Firefox\platform\Linux_x86-gcc3 folder moved successfully.

C:\Program Files\PC Tools\PC Tools Security\BDT\Firefox\platform\9\WINNT_x86-msvc\components folder moved successfully.

C:\Program Files\PC Tools\PC Tools Security\BDT\Firefox\platform\9\WINNT_x86-msvc folder moved successfully.

C:\Program Files\PC Tools\PC Tools Security\BDT\Firefox\platform\9 folder moved successfully.

C:\Program Files\PC Tools\PC Tools Security\BDT\Firefox\platform\8\WINNT_x86-msvc\components folder moved successfully.

C:\Program Files\PC Tools\PC Tools Security\BDT\Firefox\platform\8\WINNT_x86-msvc folder moved successfully.

C:\Program Files\PC Tools\PC Tools Security\BDT\Firefox\platform\8 folder moved successfully.

C:\Program Files\PC Tools\PC Tools Security\BDT\Firefox\platform\7\WINNT_x86-msvc\components folder moved successfully.

C:\Program Files\PC Tools\PC Tools Security\BDT\Firefox\platform\7\WINNT_x86-msvc folder moved successfully.

C:\Program Files\PC Tools\PC Tools Security\BDT\Firefox\platform\7 folder moved successfully.

C:\Program Files\PC Tools\PC Tools Security\BDT\Firefox\platform\6\WINNT_x86-msvc\components folder moved successfully.

C:\Program Files\PC Tools\PC Tools Security\BDT\Firefox\platform\6\WINNT_x86-msvc folder moved successfully.

C:\Program Files\PC Tools\PC Tools Security\BDT\Firefox\platform\6 folder moved successfully.

C:\Program Files\PC Tools\PC Tools Security\BDT\Firefox\platform\5\WINNT_x86-msvc\components folder moved successfully.

C:\Program Files\PC Tools\PC Tools Security\BDT\Firefox\platform\5\WINNT_x86-msvc folder moved successfully.

C:\Program Files\PC Tools\PC Tools Security\BDT\Firefox\platform\5 folder moved successfully.

C:\Program Files\PC Tools\PC Tools Security\BDT\Firefox\platform\13\WINNT_x86-msvc\components folder moved successfully.

C:\Program Files\PC Tools\PC Tools Security\BDT\Firefox\platform\13\WINNT_x86-msvc folder moved successfully.

C:\Program Files\PC Tools\PC Tools Security\BDT\Firefox\platform\13 folder moved successfully.

C:\Program Files\PC Tools\PC Tools Security\BDT\Firefox\platform\12\WINNT_x86-msvc\components folder moved successfully.

C:\Program Files\PC Tools\PC Tools Security\BDT\Firefox\platform\12\WINNT_x86-msvc folder moved successfully.

C:\Program Files\PC Tools\PC Tools Security\BDT\Firefox\platform\12 folder moved successfully.

C:\Program Files\PC Tools\PC Tools Security\BDT\Firefox\platform\11\WINNT_x86-msvc\components folder moved successfully.

C:\Program Files\PC Tools\PC Tools Security\BDT\Firefox\platform\11\WINNT_x86-msvc folder moved successfully.

C:\Program Files\PC Tools\PC Tools Security\BDT\Firefox\platform\11 folder moved successfully.

C:\Program Files\PC Tools\PC Tools Security\BDT\Firefox\platform\10\WINNT_x86-msvc\components folder moved successfully.

C:\Program Files\PC Tools\PC Tools Security\BDT\Firefox\platform\10\WINNT_x86-msvc folder moved successfully.

C:\Program Files\PC Tools\PC Tools Security\BDT\Firefox\platform\10 folder moved successfully.

C:\Program Files\PC Tools\PC Tools Security\BDT\Firefox\platform folder moved successfully.

C:\Program Files\PC Tools\PC Tools Security\BDT\Firefox\data folder moved successfully.

C:\Program Files\PC Tools\PC Tools Security\BDT\Firefox\components folder moved successfully.

C:\Program Files\PC Tools\PC Tools Security\BDT\Firefox\chrome folder moved successfully.

C:\Program Files\PC Tools\PC Tools Security\BDT\Firefox folder moved successfully.

Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2A0F3D1B-0909-4FF4-B272-609CCE6054E7}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2A0F3D1B-0909-4FF4-B272-609CCE6054E7}\ deleted successfully.

File C:\Program Files\PC Tools\PC Tools Security\BDT\PCTBrowserDefender.dll not found.

Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99}\ not found.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{472734EA-242A-422B-ADF8-83D1E48CC825} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{472734EA-242A-422B-ADF8-83D1E48CC825}\ not found.

File C:\Program Files\PC Tools\PC Tools Security\BDT\PCTBrowserDefender.dll not found.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{F9639E4A-801B-4843-AEE3-03D9DA199E77} not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F9639E4A-801B-4843-AEE3-03D9DA199E77}\ not found.

Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93}

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.

Starting removal of ActiveX control {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}\ not found.

Starting removal of ActiveX control {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\avgsecuritytoolbar\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F2DDE6B2-9684-4A55-86D4-E255E237B77C}\ deleted successfully.

File {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll File not found not found.

C:\Documents and Settings\Galin Marinov\Desktop\RK_Quarantine folder moved successfully.

C:\WINDOWS\system32\drivers\PCTBD.sys moved successfully.

C:\WINDOWS\PCTBDCore.dll moved successfully.

C:\WINDOWS\PCTBDRes.dll moved successfully.

C:\WINDOWS\SGDetectionTool.dll moved successfully.

C:\Program Files\PC Tools\PC Tools Security\BDT\WCID folder moved successfully.

C:\Program Files\PC Tools\PC Tools Security\BDT\DRM folder moved successfully.

C:\Program Files\PC Tools\PC Tools Security\BDT folder moved successfully.

C:\Program Files\PC Tools\PC Tools Security\avengine folder moved successfully.

C:\Program Files\PC Tools\PC Tools Security folder moved successfully.

C:\Program Files\PC Tools folder moved successfully.

C:\WINDOWS\system32\drivers\PCTSD.sys moved successfully.

C:\Program Files\Common Files\PC Tools\pctEFA folder moved successfully.

C:\Program Files\Common Files\PC Tools\Lsp folder moved successfully.

C:\Program Files\Common Files\PC Tools\KDS folder moved successfully.

C:\Program Files\Common Files\PC Tools folder moved successfully.

C:\Documents and Settings\All Users\Application Data\PC Tools\DownloadManager\SecurityScanner folder moved successfully.

C:\Documents and Settings\All Users\Application Data\PC Tools\DownloadManager\SecurityPackage folder moved successfully.

C:\Documents and Settings\All Users\Application Data\PC Tools\DownloadManager\SecurityLanguageFiles folder moved successfully.

C:\Documents and Settings\All Users\Application Data\PC Tools\DownloadManager\SecurityDatabase folder moved successfully.

C:\Documents and Settings\All Users\Application Data\PC Tools\DownloadManager\Security\7.0.0.0\SD\NRMA\17 folder moved successfully.

C:\Documents and Settings\All Users\Application Data\PC Tools\DownloadManager\Security\7.0.0.0\SD\NRMA folder moved successfully.

C:\Documents and Settings\All Users\Application Data\PC Tools\DownloadManager\Security\7.0.0.0\SD folder moved successfully.

C:\Documents and Settings\All Users\Application Data\PC Tools\DownloadManager\Security\7.0.0.0 folder moved successfully.

C:\Documents and Settings\All Users\Application Data\PC Tools\DownloadManager\Security folder moved successfully.

C:\Documents and Settings\All Users\Application Data\PC Tools\DownloadManager folder moved successfully.

C:\Documents and Settings\All Users\Application Data\PC Tools folder moved successfully.

Folder C:\Documents and Settings\All Users\Application Data\036DFF35C19FA9E700001979E56C34C7\ not found.

C:\Documents and Settings\Galin Marinov\Desktop\ESETNecursRemover.zip moved successfully.

C:\Documents and Settings\Galin Marinov\Desktop\RogueKiller.exe moved successfully.

C:\Documents and Settings\Galin Marinov\Desktop\rkill.exe moved successfully.

C:\Documents and Settings\Galin Marinov\Desktop\dds.exe moved successfully.

File C:\WINDOWS\System32\drivers\PCTSD.sys not found.

File C:\WINDOWS\System32\drivers\PCTBD.sys not found.

File C:\WINDOWS\SGDetectionTool.dll not found.

File C:\WINDOWS\PCTBDCore.dll not found.

File C:\WINDOWS\PCTBDRes.dll not found.

C:\WINDOWS\BDTSupport.dll moved successfully.

C:\WINDOWS\UDB.zip moved successfully.

C:\WINDOWS\RegSDImport.xml moved successfully.

C:\WINDOWS\RegISSImport.xml moved successfully.

C:\WINDOWS\IDB.zip moved successfully.

C:\WINDOWS\system32\drivers\b1991ed8bf9f523.sys.vir moved successfully.

C:\WINDOWS\assembly\Desktop.ini moved successfully.

Folder C:\Documents and Settings\All Users\Application Data\036DFF35C19FA9E700001979E56C34C7\ not found.

C:\Documents and Settings\All Users\Application Data\MFAData\SelfUpd\bins folder moved successfully.

C:\Documents and Settings\All Users\Application Data\MFAData\SelfUpd folder moved successfully.

C:\Documents and Settings\All Users\Application Data\MFAData\pack\bins folder moved successfully.

C:\Documents and Settings\All Users\Application Data\MFAData\pack folder moved successfully.

C:\Documents and Settings\All Users\Application Data\MFAData folder moved successfully.

C:\Documents and Settings\Galin Marinov\Application Data\AVG10\cfgall folder moved successfully.

C:\Documents and Settings\Galin Marinov\Application Data\AVG10 folder moved successfully.

Folder C:\Program Files\AVG\ not found.

Folder C:\Program Files\PC Tools\ not found.

ADS C:\Documents and Settings\All Users\Application Data\TEMP:430C6D84 deleted successfully.

ADS C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2 deleted successfully.

========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

User: All Users

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

User: Galin Marinov

->Temp folder emptied: 1163208 bytes

->Temporary Internet Files folder emptied: 300120 bytes

->Java cache emptied: 0 bytes

->FireFox cache emptied: 66271952 bytes

->Flash cache emptied: 3210 bytes

User: LocalService

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32\dllcache .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 0 bytes

%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes

%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes

RecycleBin emptied: 12315331 bytes

Total Files Cleaned = 76,00 mb

OTL by OldTimer - Version 3.2.64.0 log created on 09202012_093657

Files\Folders moved on Reboot...

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

СТЪПКА 4

https://www.virustotal.com/file/bebb706b122967f9e199e811d27c7c2452f02b5e24296900f1229695d9500190/analysis/1348123400/

20 септември 201213 г.

Супер...Сега са задължителните проверки:

Моля изтеглете последната версия на TDSSKiller оттук и я запазете на вашия декстоп.

Стартирайте TDSSKiller.exe за да стартирате приложението. След това кликнете върху бутона Change parameters.
Сложете отметка през Loaded Modules.
Необходим е рестарт за осъществяване на промените. Направете го!
TDSSKiller ще стартира автоматично след рестарта. Важно е да се отбележи, че вашия компютър може да изглежда по-бавен, на моменти неизползваем и с по-ниска производителност. Това е нормално и ще трае само един рестарт. Дайте му достатъчно време да зареди приложенията стартиращи с Операционната Система във фонов режим.
След това натиснете Change parameters в TDSSKiller отново.
Сложете всички отметки (този път рестарт не се изисква).
Натиснете бутона Start Scan.
Проверката не би трябвало да отмене повече от 2 minutes.
Ако подозрителен обект бъде засечен, действието по подразбиране ще бъде Skip, кликнете върху Continue.
Ако зловредни обекти бъдат намерени, тогава от падащото меню ще имате три възможности.
Бъдете сигурни, че избраното действие е Cure и натиснете върху Continue > Рестартирайте за да бъде завършена поправката.

Забележка: Ако Cure бутона не е наличен от възможностите, тогава моля изберете Skip бутона, не избирайте Delete освен ако не сте инструктирани затова.
Лог файл ще бъде създаден в свободната директория на дял C: . Потърсете за лог с името "TDSSKiller.[Version]_[Date]_[Time]_log.txt" и копирайте съдържанието му в следващия си пост.

Видях, че вече имате инсталиран Eset Online Scanner...така че да го използваме:

1) Изтеглете: ESET Online Scanner

2) Стартирайте esetsmartinstaller_enu.exe

3) Сложете отметка на YES, I accept the Terms of Use и изберете Start

4) Скенерът ще започне да изтегля компонентите, които са му необходими.

5) Уверете се, че има отметки на следните редове, включително и тези от менюто Advanced Settings:

Remove found threats
Scan archives
Scan for potentially unwanted applications
Scan for potentially unsafe applications
Enable Anti-Stealth technology

И накрая изберете Start

6) Скенерът ще започне да изтегля последните дефиниции.

7) След, като сканирането завърши изберете Finish.

8) Отидете в:

C:Program FilesESETESET Online Scanner

Отворете файла log.txt , копирайте съдържанието му и го поставете в следващия си пост.

И да проверим за повредени услуги, защото имаше индикации и за рууткит ZeroAccess, а той омазва услугите.

Моля изтеглете Farbar Service Scanner и я стартирайте.

Сложете всички отметки
Натиснете бутона "Scan".
Ще се създаде лог файл с името (FSS.txt) в папката откъдето стартирате инструмента.
Копирайте съдържанието на лог файла в следващия си пост.

Да проверим за стар софтуер и да се ориентираме към приключване.

Изтеглете Security Check от screen317 от тук или и го запаметете на вашия десктоп.

Кликнете два пъти върху SecurityCheck.exe и следвайте инструкциите.
Накрая, автоматично ще се отвори текстов документ, наречен checkup.txt, моля поставете съдържанието му в следващия Ви коментар в тази тема.
Направете и нова проверка с DDS и прикачете двата файла които ще се създадат.

20 септември 201213 г.

Автор

Файлът е по-голям и съм го качил: http://file.bg/c186293SJtBi

ESETSmartInstaller@High as downloader log:

all ok

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6419

# api_version=3.0.2

# EOSSerial=6d85f78795403b44b5a70435dabf73e5

# end=finished

# remove_checked=true

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=true

# antistealth_checked=true

# utc_time=2011-01-31 01:31:24

# local_time=2011-01-31 03:31:24 (+0200, FLE Standard Time)

# country="Bulgaria"

# lang=1033

# osver=5.1.2600 NT Service Pack 2

# compatibility_mode=1032 16777173 100 97 5803 39776739 0 0

# compatibility_mode=8192 67108863 100 0 3727 3727 0 0

# scanned=72062

# found=0

# cleaned=0

# scan_time=1539

ESETSmartInstaller@High as downloader log:

all ok

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6583

# api_version=3.0.2

# EOSSerial=6d85f78795403b44b5a70435dabf73e5

# end=finished

# remove_checked=true

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=true

# antistealth_checked=true

# utc_time=2012-09-20 12:48:20

# local_time=2012-09-20 03:48:20 (+0200, FLE Standard Time)

# country="Bulgaria"

# lang=1033

# osver=5.1.2600 NT Service Pack 2

# compatibility_mode=8192 67108863 100 0 51668606 51668606 0 0

# scanned=76857

# found=6

# cleaned=6

# scan_time=1276

C:_OTLMovedFiles09192012_090012C_Documents and SettingsGalin MarinovLocal SettingstempE_N4krnln.fnr a variant of Win32/FlyStudio application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:_OTLMovedFiles09192012_090012C_WINDOWSsystem32BBFFE3C6E5AA.EXE Win32/AutoRun.FlyStudio.QP worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:_OTLMovedFiles09192012_090012C_WINDOWSsystem32F86F41G8N3.EXE a variant of Win32/Packed.FlyStudio application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:_OTLMovedFiles09192012_090012C_WINDOWSsystem32F86F41krnln.fnr a variant of Win32/FlyStudio application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:_OTLMovedFiles09192012_090012C_WINDOWSsystem32F86F41V7M3BFB1.EXE a variant of Win32/Packed.FlyStudio application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:_OTLMovedFiles09202012_093657C_WINDOWSsystem32driversb1991ed8bf9f523.sys.vir a variant of Win32/Rootkit.Kryptik.HT trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

Farbar Service Scanner Version: 19-09-2012

Ran by Galin Marinov (administrator) on 20-09-2012 at 15:55:20

Running from "C:Documents and SettingsGalin MarinovDesktop"

Microsoft Windows XP Home Edition Service Pack 2 (X86)

Boot Mode: Normal

****************************************************************

Internet Services:

============

Connection Status:

==============

Localhost is accessible.

LAN connected.

Google IP is accessible.

Google.com is accessible.

Yahoo IP is accessible.

Yahoo.com is accessible.

Windows Firewall:

=============

Firewall Disabled Policy:

==================

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyStandardProfile]

"EnableFirewall"=DWORD:0

System Restore:

============

System Restore Disabled Policy:

========================

Security Center:

============

Windows Update:

============

Windows Autoupdate Disabled Policy:

============================

File Check:

========

C:WINDOWSsystem32dhcpcsvc.dll => MD5 is legit

C:WINDOWSsystem32Driversafd.sys => MD5 is legit

C:WINDOWSsystem32Driversnetbt.sys

[2004-08-04 15:00] - [2004-08-04 15:00] - 0162816 ____A (Microsoft Corporation) 0C80E410CD2F47134407EE7DD19CC86B

C:WINDOWSsystem32Driverstcpip.sys

[2004-08-04 15:00] - [2004-08-04 15:00] - 0359040 ____A (Microsoft Corporation) 7399D854596BFEFEED6B60879F28CE07

C:WINDOWSsystem32Driversipsec.sys

[2004-08-04 15:00] - [2004-08-04 15:00] - 0074752 ____A (Microsoft Corporation) 64537AA5C003A6AFEEE1DF819062D0D1

C:WINDOWSsystem32dnsrslvr.dll

[2004-08-04 15:00] - [2004-08-04 15:00] - 0045568 ____A (Microsoft Corporation) 7379DE06FD196E396A00AA97B990C00D

C:WINDOWSsystem32ipnathlp.dll

[2004-08-04 15:00] - [2004-08-04 15:00] - 0331264 ____A (Microsoft Corporation) 36CC8C01B5E50163037BEF56CB96DEFF

C:WINDOWSsystem32netman.dll

[2004-08-04 15:00] - [2004-08-04 15:00] - 0198144 ____A (Microsoft Corporation) DAB9E6C7105D2EF49876FE92C524F565

C:WINDOWSsystem32wbemWMIsvc.dll

[2010-08-13 10:24] - [2004-08-04 15:00] - 0144896 ____A (Microsoft Corporation) F399242A80C4066FD155EFA4CF96658E

C:WINDOWSsystem32srsvc.dll

[2010-08-13 10:26] - [2004-08-04 15:00] - 0170496 ____A (Microsoft Corporation) 92BDF74F12D6CBEC43C94D4B7F804838

C:WINDOWSsystem32Driverssr.sys

[2010-08-13 10:26] - [2004-08-04 15:00] - 0073472 ____A (Microsoft Corporation) E41B6D037D6CD08461470AF04500DC24

C:WINDOWSsystem32wscsvc.dll

[2004-08-04 15:00] - [2004-08-04 15:00] - 0081408 ____A (Microsoft Corporation) 4D59DAA66C60858CDF4F67A900F42D4A

C:WINDOWSsystem32wbemWMIsvc.dll

[2010-08-13 10:24] - [2004-08-04 15:00] - 0144896 ____A (Microsoft Corporation) F399242A80C4066FD155EFA4CF96658E

C:WINDOWSsystem32wuauserv.dll

[2010-08-13 10:26] - [2004-08-04 15:00] - 0006656 ____A (Microsoft Corporation) 13D72740963CBA12D9FF76A7F218BCD8

C:WINDOWSsystem32qmgr.dll

[2010-08-13 10:26] - [2004-08-04 15:00] - 0382464 ____A (Microsoft Corporation) 2C69EC7E5A311334D10DD95F338FCCEA

C:WINDOWSsystem32es.dll

[2004-08-04 15:00] - [2004-08-04 15:00] - 0243200 ____A (Microsoft Corporation) ACD36A2DD7D1E9D8A060AA651DC07E63

C:WINDOWSsystem32cryptsvc.dll

[2004-08-04 15:00] - [2004-08-04 15:00] - 0060416 ____A (Microsoft Corporation) 10654F9DDCEA9C46CFB77554231BE73B

C:WINDOWSsystem32svchost.exe

[2004-08-04 15:00] - [2010-10-04 12:16] - 0014336 ____A (Microsoft Corporation) 8F078AE4ED187AAABC0A305146DE6716

C:WINDOWSsystem32rpcss.dll

[2004-08-04 15:00] - [2004-08-04 15:00] - 0395776 ____A (Microsoft Corporation) 5C83A4408604F737717AB96371201680

C:WINDOWSsystem32services.exe

[2004-08-04 15:00] - [2004-08-04 15:00] - 0108032 ____A (Microsoft Corporation) C6CE6EEC82F187615D1002BB3BB50ED4

Extra List:

=======

Gpc(3) IPSec(5) NetBT(6) PSched(7) Tcpip(4)

0x0B000000050000000100000002000000030000000400000008000000090000000A0000000B0000000600000007000000

IpSec Tag value is correct.

**** End of log ****

Results of screen317's Security Check version 0.99.51

Windows XP Service Pack 2 x86

Out of date service pack!!

Internet Explorer 6 Out of date!

``````````````Antivirus/Firewall Check:``````````````

Windows Firewall Disabled!

ESET Online Scanner v3

`````````Anti-malware/Other Utilities Check:`````````

Malwarebytes Anti-Malware version 1.65.0.1400

Adobe Flash Player 10 Flash Player out of Date!

Adobe Flash Player 10.3.183.5 Flash Player out of Date!

Adobe Reader 7 Adobe Reader out of Date!

Mozilla Firefox (15.0.1)

````````Process Check: objlist.exe by Laurent````````

`````````````````System Health check`````````````````

Total Fragmentation on Drive C:: 9%

````````````````````End of Log``````````````````````

DDS (Ver_2011-09-30.01) - NTFS_x86

Internet Explorer: 6.0.2900.2180

Run by Galin Marinov at 16:00:27 on 2012-09-20

Microsoft Windows XP Home Edition 5.1.2600.2.1251.359.1033.18.1022.311 [GMT 3:00]

.

FW: AVG Firewall *Disabled*

.

============== Running Processes ================

.

C:WINDOWSsystem32Ati2evxx.exe

C:WINDOWSsystem32spoolsv.exe

C:WINDOWSsystem32HPSIsvc.exe

C:WINDOWSsystem32wdfmgr.exe

C:WINDOWSSystem32alg.exe

C:WINDOWSsystem32Ati2evxx.exe

C:WINDOWSsystem32wscntfy.exe

C:WINDOWSExplorer.EXE

C:WINDOWSSkyTel.EXE

C:WINDOWSRTHDCPL.EXE

C:WINDOWSsystem32JMRaidTool.exe

C:Program FilesWinampwinampa.exe

C:Program FilesCommon FilesInstallShieldUpdateServiceissch.exe

C:WINDOWSsystem32ctfmon.exe

C:WINDOWSDatecsFlex2K.exe

C:Program FilesPanda USB VaccineUSBVaccine.exe

C:Program FilesMozilla Firefoxfirefox.exe

C:Program FilesMozilla Firefoxplugin-container.exe

C:WINDOWSsystem32wbemwmiprvse.exe

C:WINDOWSSystem32svchost.exe -k netsvcs

C:WINDOWSsystem32svchost.exe -k NetworkService

C:WINDOWSsystem32svchost.exe -k LocalService

C:WINDOWSsystem32svchost.exe -k imgsvc

.

============== Pseudo HJT Report ===============

.

uStart Page = about:blank

uSearch Bar = hxxp://www.google.com/ie

uSearch Page = hxxp://www.google.com

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

BHO: AcroIEHlprObj Class: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:program filesadobeacrobat 7.0activexAcroIEHelper.dll

BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} -

uRun: [ctfmon.exe] c:windowssystem32ctfmon.exe

mRun: [skyTel] SkyTel.EXE

mRun: [RTHDCPL] RTHDCPL.EXE

mRun: [JMB36X Configure] c:windowssystem32JMRaidTool.exe boot

mRun: [WinampAgent] "c:program fileswinampwinampa.exe"

mRun: [iSUSPM Startup] "c:program filescommon filesinstallshieldupdateserviceisuspm.exe" -startup

mRun: [iSUSScheduler] "c:program filescommon filesinstallshieldupdateserviceissch.exe" -start

mRun: [NeroFilterCheck] c:windowssystem32NeroCheck.exe

mRun: [HPUsageTrackingLEDM] "c:program fileshphp ut ledmbinhppusg.exe" "c:program fileshphp ut ledm"

dRun: [CTFMON.EXE] c:windowssystem32CTFMON.EXE

StartupFolder: c:docume~1galinm~1startm~1programsstartuppandau~1.lnk - c:program filespanda usb vaccineUSBVaccine.exe

StartupFolder: c:docume~1alluse~1startm~1programsstartupadobeg~1.lnk - c:program filescommon filesadobecalibrationAdobe Gamma Loader.exe

StartupFolder: c:docume~1alluse~1startm~1programsstartupadober~1.lnk - c:program filesadobeacrobat 7.0readerreader_sl.exe

StartupFolder: c:docume~1alluse~1startm~1programsstartupcomman~1.lnk - c:program filesfierycstationcstation.exe

StartupFolder: c:docume~1alluse~1startm~1programsstartupflexty~1.lnk - c:windowsdatecsFlex2K.exe

uPolicies-Explorer: NoDriveTypeAutoRun = dword:323

uPolicies-Explorer: NoDriveAutoRun = dword:67108863

uPolicies-Explorer: NoDrives = dword:0

mPolicies-Explorer: NoDriveTypeAutoRun = dword:323

mPolicies-Explorer: NoDriveAutoRun = dword:67108863

mPolicies-Explorer: NoDrives = dword:0

mPolicies-System: EnableInstallerDetection = dword:0

mPolicies-System: EnableSecureUIAPaths = dword:0

mPolicies-System: EnableVirtualization = dword:0

mPolicies-System: PromptOnSecureDesktop = dword:0

mPolicies-Explorer: NoDriveTypeAutoRun = dword:323

mPolicies-Explorer: NoDriveAutoRun = dword:67108863

IE: &Експортиране към Microsoft Excel - c:progra~1micros~2office12EXCEL.EXE/3000

IE: Google Sidewiki... - c:program filesgooglegoogle toolbarcomponentGoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:program filesmessengermsmsgs.exe

DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

TCP: NameServer = 192.168.4.1

TCP: Interfaces{8449FB41-9B5E-49F3-B4D2-6B6501B3F8AA} : DHCPNameServer = 192.168.4.1

Notify: AtiExtEvent - Ati2evxx.dll

.

================= FIREFOX ===================

.

FF - ProfilePath - c:documents and settingsgalin marinovapplication datamozillafirefoxprofiles4fgnhrif.default

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - hxxp://www.google.bg/

FF - plugin: c:program filesjavajre6binnew_pluginnpdeployJava1.dll

FF - plugin: c:program filesk-lite codec packrealbrowserpluginsnppl3260.dll

FF - plugin: c:program filesk-lite codec packrealbrowserpluginsnprpjplug.dll

FF - plugin: c:program filesmozilla firefoxpluginsnpdeployJava1.dll

.

============= SERVICES / DRIVERS ===============

.

R2 HPSIService;HP SI Service;c:windowssystem32HPSIsvc.exe [2012-3-26 99896]

R3 LgBttPort;LGE Bluetooth TransPort;c:windowssystem32driverslgbtport.sys [2009-9-29 12160]

R3 lgbusenum;LG Bluetooth Bus Enumerator;c:windowssystem32driverslgbtbus.sys [2009-9-29 10496]

R3 LGVMODEM;LGE Virtual Modem;c:windowssystem32driverslgvmodem.sys [2009-9-29 12928]

S2 Browser Defender Update Service;Browser Defender Update Service;"c:program filespc toolspc tools securitybdtbdtupdateservice.exe" --> c:program filespc toolspc tools securitybdtBDTUpdateService.exe [?]

S2 HP LaserJet Service;HP LaserJet Service;c:program fileshphplaserjetserviceHPLaserJetService.exe [2009-6-24 136704]

S3 ExterminateIt;ExterminateIt;c:windowssystem32driversextit.sys [2011-1-27 70760]

S3 MozillaMaintenance;Mozilla Maintenance Service;c:program filesmozilla maintenance servicemaintenanceservice.exe [2012-7-6 114144]

S3 mvusbews;USB EWS Device;c:windowssystem32driversmvusbews.sys [2012-2-1 17408]

S3 PCTBD;PC Tools Browser Defender Driver;c:windowssystem32driverspctbd.sys --> c:windowssystem32driversPCTBD.sys [?]

S3 SetupNTGLM7X;SetupNTGLM7X;??e:ntglm7x.sys --> e:NTGLM7X.sys [?]

.

=============== Created Last 30 ================

.

2012-09-19 06:00:12 -------- d-----w- C:_OTL

2012-09-18 08:52:14 -------- d-----w- c:documents and settingsgalin marinovapplication dataTestApp

2012-09-18 06:36:15 -------- d-----w- c:documents and settingsall usersapplication data036DFF35C19FA9E700001979E56C34C7

.

==================== Find3M ====================

.

2012-09-20 08:34:08 2828 --sha-w- c:windowssystem32KGyGaAvL.sys

2012-09-07 14:04:46 22856 ----a-w- c:windowssystem32driversmbam.sys

.

============= FINISH: 16:00:44,12 ===============

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2011-09-30.01)

.

Microsoft Windows XP Home Edition

Boot Device: DeviceHarddiskVolume1

Install Date: 13.8.2010 г. 10:30:07

System Uptime: 20.9.2012 г. 15:10:39 (1 hours ago)

.

Motherboard: MICRO-STAR INTERNATIONAL CO., LTD | | MS-7235

Processor: Intel® Core2 CPU 6300 @ 1.86GHz | Socket 775 | 1863/66mhz

.

==== Disk Partitions =========================

.

A: is Removable

C: is FIXED (NTFS) - 29 GiB total, 18,54 GiB free.

D: is FIXED (NTFS) - 120 GiB total, 117,68 GiB free.

E: is CDROM ()

Q: is NetworkDisk (NTFS) - 24 GiB total, 11,04 GiB free.

R: is NetworkDisk (NTFS) - 52 GiB total, 50,683 GiB free.

S: is NetworkDisk (NTFS) - 38 GiB total, 31,19 GiB free.

T: is NetworkDisk (NTFS) - 73 GiB total, 70,945 GiB free.

U: is NetworkDisk (NTFS) - 29 GiB total, 27,351 GiB free.

V: is NetworkDisk (NTFS) - 89 GiB total, 75,627 GiB free.

W: is NetworkDisk (NTFS) - 89 GiB total, 8,845 GiB free.

X: is NetworkDisk (NTFS) - 90 GiB total, 11,99 GiB free.

.

==== Disabled Device Manager Items =============

.

==== System Restore Points ===================

.

RP297: 20.6.2012 г. 16:03:18 - System Checkpoint

RP298: 21.6.2012 г. 16:12:09 - System Checkpoint

RP299: 22.6.2012 г. 18:17:27 - System Checkpoint

RP300: 25.6.2012 г. 07:10:09 - System Checkpoint

RP301: 26.6.2012 г. 10:58:15 - System Checkpoint

RP302: 27.6.2012 г. 14:33:57 - System Checkpoint

RP303: 29.6.2012 г. 11:41:16 - System Checkpoint

RP304: 02.7.2012 г. 10:03:53 - System Checkpoint

RP305: 03.7.2012 г. 10:21:12 - System Checkpoint

RP306: 04.7.2012 г. 18:03:59 - System Checkpoint

RP307: 06.7.2012 г. 09:17:54 - System Checkpoint

RP308: 09.7.2012 г. 11:06:47 - System Checkpoint

RP309: 10.7.2012 г. 11:27:07 - System Checkpoint

RP310: 11.7.2012 г. 14:41:30 - System Checkpoint

RP311: 12.7.2012 г. 15:29:25 - System Checkpoint

RP312: 16.7.2012 г. 09:57:49 - System Checkpoint

RP313: 17.7.2012 г. 14:04:46 - System Checkpoint

RP314: 19.7.2012 г. 12:48:39 - System Checkpoint

RP315: 20.7.2012 г. 15:29:47 - System Checkpoint

RP316: 23.7.2012 г. 11:05:33 - System Checkpoint

RP317: 24.7.2012 г. 11:42:10 - System Checkpoint

RP318: 26.7.2012 г. 10:37:17 - System Checkpoint

RP319: 27.7.2012 г. 11:19:48 - System Checkpoint

RP320: 30.7.2012 г. 10:10:02 - System Checkpoint

RP321: 31.7.2012 г. 14:21:07 - System Checkpoint

RP322: 02.8.2012 г. 10:47:24 - System Checkpoint

RP323: 06.8.2012 г. 13:51:56 - System Checkpoint

RP324: 07.8.2012 г. 13:58:24 - System Checkpoint

RP325: 09.8.2012 г. 11:05:57 - System Checkpoint

RP326: 15.8.2012 г. 09:54:24 - System Checkpoint

RP327: 16.8.2012 г. 12:42:18 - System Checkpoint

RP328: 20.8.2012 г. 11:39:14 - System Checkpoint

RP329: 21.8.2012 г. 18:09:55 - System Checkpoint

RP330: 24.8.2012 г. 14:07:27 - System Checkpoint

RP331: 28.8.2012 г. 09:50:49 - System Checkpoint

RP332: 29.8.2012 г. 10:51:58 - System Checkpoint

RP333: 30.8.2012 г. 16:29:28 - System Checkpoint

RP334: 03.9.2012 г. 10:50:39 - System Checkpoint

RP335: 04.9.2012 г. 15:13:09 - System Checkpoint

RP336: 05.9.2012 г. 18:10:09 - System Checkpoint

RP337: 10.9.2012 г. 10:22:03 - System Checkpoint

RP338: 11.9.2012 г. 11:07:36 - System Checkpoint

RP339: 12.9.2012 г. 11:50:59 - System Checkpoint

RP340: 13.9.2012 г. 16:03:51 - System Checkpoint

RP341: 17.9.2012 г. 10:06:30 - System Checkpoint

RP342: 19.9.2012 г. 15:59:09 - System Checkpoint

RP343: 20.9.2012 г. 09:23:36 - Removed Java 6 Update 22

.

==== Installed Programs ======================

.

2007 Microsoft Office Suite Service Pack 2 (SP2)

Adobe Flash Player 10 ActiveX

Adobe Flash Player 10 Plugin

Adobe Photoshop 7.0

Adobe Reader 7.0

Adobe Shockwave Player 11.5

Apple Application Support

Apple Software Update

ATI - Software Uninstall Utility

ATI Display Driver

ATI HYDRAVISION

Browser Guard 4.0

Command WorkStation

Corel Applications

CorelDRAW Graphics Suite X3

EN

ESET Online Scanner v3

FlexType 2K

FontNav

High Definition Audio Driver Package - KB888111

HP LaserJet Professional P1100-P1560-P1600 Series

hppLaserJetService

hppP1100P1560P1600SeriesLaserJetService

hppusgP1100P1560P1600Series

HPSSupply

JRAID

K-Lite Mega Codec Pack 5.8.3

LG Bluetooth Drivers

LG United Mobile Drivers

Malwarebytes Anti-Malware version 1.65.0.1400

MarketResearch

Microsoft .NET Framework 1.1

Microsoft .NET Framework 2.0

Microsoft Kernel-Mode Driver Framework Feature Pack 1.7

Microsoft Office Access MUI (Bulgarian) 2007

Microsoft Office Enterprise 2007

Microsoft Office Excel MUI (Bulgarian) 2007

Microsoft Office Groove MUI (Bulgarian) 2007

Microsoft Office InfoPath MUI (Bulgarian) 2007

Microsoft Office OneNote MUI (Bulgarian) 2007

Microsoft Office Outlook MUI (Bulgarian) 2007

Microsoft Office PowerPoint MUI (Bulgarian) 2007

Microsoft Office Proof (Bulgarian) 2007

Microsoft Office Proof (English) 2007

Microsoft Office Proof (German) 2007

Microsoft Office Proof (Russian) 2007

Microsoft Office Proofing (Bulgarian) 2007

Microsoft Office Publisher MUI (Bulgarian) 2007

Microsoft Office Shared MUI (Bulgarian) 2007

Microsoft Office Word MUI (Bulgarian) 2007

Microsoft Software Update for Web Folders (Bulgarian) 12

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

Mozilla Firefox 15.0.1 (x86 bg)

Mozilla Maintenance Service

MSXML 4.0 SP2 (KB927978)

Nero 6 Ultra Edition

Panda USB Vaccine 1.0.1.4

PANTONE® color bridge

PicaView32

Realtek High Definition Audio Driver

Sony USB Driver

TWAIN FieryScan

Update Manager

VBA

WebFldrs XP

Winamp

Windows Installer 3.1 (KB893803)

Windows Media Format Runtime

Windows Media Player Firefox Plugin

WinRAR archiver

X-Fonter 5.5

.

==== Event Viewer Messages From Past Week ========

.

20.9.2012 і. 09:36:58, error: Service Control Manager [7034] - The Browser Defender Update Service service terminated unexpectedly. It has done this 1 time(s).

20.9.2012 і. 09:36:58, error: Service Control Manager [7031] - The HP SI Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 1000 milliseconds: Restart the service.

20.9.2012 і. 09:36:57, error: Service Control Manager [7034] - The Ati HotKey Poller service terminated unexpectedly. It has done this 1 time(s).

20.9.2012 і. 09:36:46, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

20.9.2012 і. 09:36:16, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

20.9.2012 і. 09:35:46, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

20.9.2012 і. 09:35:16, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

20.9.2012 і. 09:34:46, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

20.9.2012 і. 09:34:16, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

20.9.2012 і. 09:33:46, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

20.9.2012 і. 09:33:16, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

20.9.2012 і. 09:32:46, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

20.9.2012 і. 09:32:16, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

20.9.2012 і. 09:31:46, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore

20.9.2012 і. 09:24:06, error: Service Control Manager [7023] - The Application Management service terminated with the following error: The specified module could not be found.

20.9.2012 і. 09:24:05, error: Service Control Manager [7023] - The Application Management service terminated with the following error: The specified module could not be found.

20.9.2012 і. 09:24:04, error: Service Control Manager [7023] - The Application Management service terminated with the following error: The specified module could not be found.

20.9.2012 і. 09:24:03, error: Service Control Manager [7023] - The Application Management service terminated with the following error: The specified module could not be found.

20.9.2012 і. 09:24:02, error: Service Control Manager [7023] - The Application Management service terminated with the following error: The specified module could not be found.

20.9.2012 і. 09:24:01, error: Service Control Manager [7023] - The Application Management service terminated with the following error: The specified module could not be found.

20.9.2012 і. 09:24:00, error: Service Control Manager [7023] - The Application Management service terminated with the following error: The specified module could not be found.

20.9.2012 і. 09:23:59, error: Service Control Manager [7023] - The Application Management service terminated with the following error: The specified module could not be found.

20.9.2012 і. 09:23:58, error: Service Control Manager [7023] - The Application Management service terminated with the following error: The specified module could not be found.

20.9.2012 і. 09:23:57, error: Service Control Manager [7023] - The Application Management service terminated with the following error: The specified module could not be found.

20.9.2012 і. 09:23:56, error: Service Control Manager [7023] - The Application Management service terminated with the following error: The specified module could not be found.