Добре дошли!

Добре дошли в нашите форуми, пълни с полезна информация. Имате проблем с компютъра или телефона си? Публикувайте нова тема и ще намерите решение на всичките си проблеми. Общувайте свободно и открийте безброй нови приятели.

Моля, регистрирайте се за да публикувате тема и да получите пълен достъп до всички функции.

Инфекция

12 януари 201313 г.

Смятам че нещо не е наред но не знам изобщо какво, компютъра ми е много бавен, преди 2 месеца не беше така, разликата е огромна дори когато се опитам да пусна някой филм над 2 ГБ понякога и по малък с bs player ми забива по 2, 3 минути докато се стартира, понякога когато си включвам компа ми дава windows system error но доста рядко

... ето и данните от " dds " и " attach "

dds:

DDS (Ver_2011-09-30.01) - NTFS_x86 Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 10.9.2 Run by The_Phenomenon at 10:57:06 on 2013-01-12 Microsoft Windows XP Professional 5.1.2600.3.1251.359.1033.18.2038.1200 [GMT 2:00] . AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D} . ============== Running Processes ================ . C:Program FilesAVAST SoftwareAvastAvastSvc.exe C:WINXPsystem32spoolsv.exe C:WINXPExplorer.EXE C:WINXPsystem32hkcmd.exe C:Program FilesBroadcomASFIPMonAsfIpMon.exe C:WINXPsystem32igfxpers.exe C:Program FilesAVAST SoftwareAvastavastUI.exe C:Program FilesJavajre7binjqs.exe C:WINXPsystem32igfxsrvc.exe C:Program FilesMalwarebytes' Anti-Malwarembamscheduler.exe C:Program FilesAnalog DevicesCoresmax4pnp.exe C:Program FilesCommon FilesJavaJava Updatejusched.exe C:WINXPsystem32ctfmon.exe C:Program FilesSkypePhoneSkype.exe C:Documents and SettingsAll UsersApplication DataSkypeToolbarsSkype C2C Servicec2c_service.exe C:Program FilesMalwarebytes' Anti-Malwarembamgui.exe C:Program FilesTeamViewerVersion8TeamViewer_Service.exe C:Program FilesDatecsFlexType 2KFType2K.exe C:WINXPsystem32wscntfy.exe C:WINXPSystem32alg.exe C:Program FilesMozilla Firefoxfirefox.exe C:Program FilesuTorrentuTorrent.exe C:Program FilesMozilla Firefoxplugin-container.exe C:WINXPsystem32wbemwmiprvse.exe C:WINXPSystem32svchost.exe -k netsvcs C:WINXPsystem32svchost.exe -k WudfServiceGroup C:WINXPsystem32svchost.exe -k NetworkService C:WINXPsystem32svchost.exe -k LocalService C:WINXPsystem32svchost.exe -k LocalService C:WINXPsystem32svchost.exe -k imgsvc . ============== Pseudo HJT Report =============== . uStart Page = hxxp://www.google.bg/ BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:program filescommon filesadobeacrobatactivexAcroIEHelperShim.dll BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:program filesjavajre7binssv.dll BHO: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - c:program filesavast softwareavastaswWebRepIE.dll BHO: Skype Browser Helper: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - c:program filesskypetoolbarsinternet explorerskypeieplugin.dll BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:program filesjavajre7binjp2ssv.dll TB: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - c:program filesavast softwareavastaswWebRepIE.dll uRun: [CTFMON.EXE] c:winxpsystem32ctfmon.exe uRun: [skype] "c:program filesskypephoneSkype.exe" /minimized /regrun uRun: [DAEMON Tools Lite] "c:program filesdaemon tools liteDTLite.exe" -autorun mRun: [igfxTray] c:winxpsystem32igfxtray.exe mRun: [HotKeysCmds] c:winxpsystem32hkcmd.exe mRun: [Persistence] c:winxpsystem32igfxpers.exe mRun: [avast] "c:program filesavast softwareavastavastUI.exe" /nogui mRun: [soundMAXPnP] c:program filesanalog devicescoresmax4pnp.exe mRun: [sunJavaUpdateSched] "c:program filescommon filesjavajava updatejusched.exe" mRun: [Adobe Reader Speed Launcher] "c:program filesadobereader 10.0readerReader_sl.exe" mRun: [Adobe ARM] "c:program filescommon filesadobearm1.0AdobeARM.exe" dRun: [CTFMON.EXE] c:winxpsystem32CTFMON.EXE StartupFolder: c:docume~1alluse~1startm~1programsstartupflexty~1.lnk - c:program filesdatecsflextype 2kFType2K.exe uPolicies-Explorer: NoDriveTypeAutoRun = dword:145 mPolicies-Explorer: NoDriveTypeAutoRun = dword:145 IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:program filesskypetoolbarsinternet explorerskypeieplugin.dll IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%Network Diagnosticxpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:program filesmessengermsmsgs.exe TCP: Interfaces{48ED9DAE-3E70-4312-94E5-C01C699EE6A2} : NameServer = 213.91.177.254,85.196.176.254 Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:program filesskypetoolbarsinternet explorerskypeieplugin.dll Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:program filescommon filesskypeSkype4COM.dll Notify: igfxcui - igfxdev.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:winxpsystem32wpdshserviceobj.dll . ================= FIREFOX =================== . FF - ProfilePath - c:documents and settingsthe_phenomenonapplication datamozillafirefoxprofiles06m0a6c3.default FF - plugin: c:docume~1the_ph~1applic~1powerc~1nppowerloader.dll FF - plugin: c:program filesgooglegoogle earthpluginnpgeplugin.dll FF - plugin: c:program filesgoogleupdate1.3.21.124npGoogleUpdate3.dll FF - plugin: c:program filesjavajre7binplugin2npjp2.dll FF - plugin: c:winxpsystem32adobedirectornp32dsw_1168638.dll FF - plugin: c:winxpsystem32macromedflashNPSWF32_11_5_502_135.dll FF - plugin: c:winxpsystem32npDeployJava1.dll FF - plugin: c:winxpsystem32npptools.dll . ============= SERVICES / DRIVERS =============== . R1 aswSnx;aswSnx;c:winxpsystem32driversaswSnx.sys [2012-12-8 738504] R1 aswSP;aswSP;c:winxpsystem32driversaswSP.sys [2012-12-8 361032] R2 ASFIPmon;Broadcom ASF IP Monitor;c:program filesbroadcomasfipmonAsfIpMon.exe [2006-3-17 65536] R2 aswFsBlk;aswFsBlk;c:winxpsystem32driversaswFsBlk.sys [2012-12-8 21256] R2 avast! Antivirus;avast! Antivirus;c:program filesavast softwareavastAvastSvc.exe [2012-12-8 44808] R2 MBAMScheduler;MBAMScheduler;c:program filesmalwarebytes' anti-malwarembamscheduler.exe [2012-12-15 398184] R2 Skype C2C Service;Skype C2C Service;c:documents and settingsall usersapplication dataskypetoolbarsskype c2c servicec2c_service.exe [2012-12-13 3290896] R2 TeamViewer8;TeamViewer 8;c:program filesteamviewerversion8TeamViewer_Service.exe [2012-12-11 3463080] R3 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:winxpsystem32driversdtsoftbus01.sys [2012-12-24 242240] R3 MBAMProtector;MBAMProtector;c:winxpsystem32driversmbam.sys [2012-12-15 21104] S2 gupdate;Ус»уі° Ѕ° Google рєту°»ё·°цёя (gupdate);c:program filesgoogleupdateGoogleUpdate.exe [2012-12-8 116648] S2 MBAMService;MBAMService;c:program filesmalwarebytes' anti-malwarembamservice.exe [2012-12-15 682344] S2 SkypeUpdate;Skype Updater;c:program filesskypeupdaterUpdater.exe [2012-11-9 160944] S3 cpudrv;cpudrv;c:program filessystemrequirementslabcpudrv.sys [2011-6-2 11336] S3 gupdatem;Ус»уі° Ѕ° Google рєту°»ё·°цёя (gupdatem);c:program filesgoogleupdateGoogleUpdate.exe [2012-12-8 116648] S3 ip100xp;ASUS NX1001 Network Adapter NT Driver;c:winxpsystem32driversipfnd51.sys [2012-12-15 26752] S3 MozillaMaintenance;Mozilla Maintenance Service;c:program filesmozilla maintenance servicemaintenanceservice.exe [2012-12-8 115168] . =============== File Associations =============== . ShellExec: BitComet.exe: open="c:program filesbitcometBitComet.exe" . =============== Created Last 30 ================ . 2013-01-12 08:09:44 -------- d-----w- c:documents and settingsthe_phenomenonlocal settingsapplication dataProfiles 2013-01-12 08:09:44 -------- d-----w- c:documents and settingsthe_phenomenonapplication dataProfiles 2013-01-12 08:09:44 -------- d-----w- c:documents and settingsthe_phenomenonapplication dataCrash Reports 2013-01-12 07:16:11 -------- d-----w- c:winxpsystem32wbemrepositoryFS 2013-01-12 07:16:11 -------- d-----w- c:winxpsystem32wbemRepository 2013-01-12 05:36:09 -------- d-----w- c:program filesXP TCPIP Repair 2013-01-06 18:20:17 -------- d-----w- c:documents and settingsthe_phenomenonlocal settingsapplication dataOpera 2013-01-04 22:03:25 -------- d-----w- c:documents and settingsthe_phenomenonlocal settingsapplication dataTemp 2013-01-01 14:32:27 880640 ----a-w- c:winxpsystem32UniBox10.ocx 2013-01-01 14:32:27 212992 ----a-w- c:winxpsystem32UniBoxVB12.ocx 2013-01-01 14:32:27 1101824 ----a-w- c:winxpsystem32UniBox210.ocx 2013-01-01 14:32:27 108336 ----a-w- c:winxpsystem32MSWINSCK.OCX 2013-01-01 14:32:25 -------- d-----w- c:program filesuGet VGI 2012-12-27 21:57:51 -------- d-----w- c:program filesCheat Engine 6.2 2012-12-27 13:22:56 -------- d-----w- c:documents and settingsthe_phenomenonlocal settingsapplication dataPowerChallenge 2012-12-27 13:22:56 -------- d-----w- c:documents and settingsthe_phenomenonapplication dataPowerChallenge 2012-12-27 13:08:34 -------- d-----w- c:winxpsystem32Adobe 2012-12-27 08:26:28 -------- d--h--w- c:winxpsystem32GroupPolicy 2012-12-25 19:45:44 -------- d-----w- c:documents and settingsthe_phenomenonlocal settingsapplication dataThinstall 2012-12-24 21:22:28 -------- d--h--w- c:program filesZero G Registry 2012-12-24 21:22:12 -------- d--h--w- c:documents and settingsthe_phenomenonInstallAnywhere 2012-12-24 21:07:14 242240 ----a-w- c:winxpsystem32driversdtsoftbus01.sys 2012-12-24 21:06:56 -------- d-----w- c:documents and settingsthe_phenomenonapplication dataDAEMON Tools Lite 2012-12-24 21:06:50 -------- d-----w- c:program filesDAEMON Tools Lite 2012-12-24 21:05:44 -------- d-----w- c:documents and settingsall usersapplication dataDAEMON Tools Lite 2012-12-24 20:49:07 -------- d-----w- c:documents and settingsall usersapplication dataTarma Installer 2012-12-21 15:28:56 -------- d-----w- c:documents and settingsthe_phenomenonlocal settingsapplication dataAdobe 2012-12-20 23:17:14 -------- d-----w- c:documents and settingsthe_phenomenonlocal settingsapplication dataOOBE 2012-12-20 23:17:14 -------- d-----w- c:documents and settingsthe_phenomenonlocal settingsapplication dataColor 2012-12-20 23:17:14 -------- d-----w- c:documents and settingsthe_phenomenonapplication dataSwitchBoard 2012-12-20 23:17:14 -------- d-----w- c:documents and settingsall usersapplication dataSLStore 2012-12-20 23:17:14 -------- d-----w- c:documents and settingsall usersapplication dataAdobe PDF 2012-12-20 23:17:12 -------- d-----w- c:documents and settingsthe_phenomenonapplication dataColor 2012-12-20 23:17:12 -------- d-----w- c:documents and settingsthe_phenomenonapplication dataAdobe Photoshop CS6 2012-12-20 23:05:31 -------- d-----w- c:documents and settingsthe_phenomenonapplication dataThinstall 2012-12-19 20:29:50 -------- d-----w- C:New Folder 2012-12-19 20:07:36 -------- d-----w- c:documents and settingsall usersapplication dataPrivacyware 2012-12-17 21:18:12 -------- d-----w- c:program filesMy-Proxy 2012-12-17 21:18:12 -------- d-----w- c:documents and settingsall usersapplication dataEPS 2012-12-15 13:15:45 26752 ----a-r- c:winxpsystem32driversipfnd51.sys 2012-12-14 22:58:27 -------- d-----w- c:documents and settingsthe_phenomenonapplication dataMalwarebytes 2012-12-14 22:58:15 -------- d-----w- c:documents and settingsall usersapplication dataMalwarebytes 2012-12-14 22:58:12 21104 ----a-w- c:winxpsystem32driversmbam.sys 2012-12-14 22:58:12 -------- d-----w- c:program filesMalwarebytes' Anti-Malware 2012-12-14 19:17:11 -------- d-----w- c:documents and settingsthe_phenomenonlocal settingsapplication dataIdentities 2012-12-13 12:30:28 5955856 ----a-w- c:program filesmozilla firefoxextensions{82af8dca-6de9-405d-bd5e-43525bdad38a}componentsSkypeFfComponent.dll . ==================== Find3M ==================== . 2012-12-30 15:48:20 73656 ----a-w- c:winxpsystem32FlashPlayerCPLApp.cpl 2012-12-30 15:48:20 697272 ----a-w- c:winxpsystem32FlashPlayerApp.exe 2012-12-08 20:41:53 93672 ----a-w- c:winxpsystem32WindowsAccessBridge.dll 2012-12-08 20:41:49 143872 ----a-w- c:winxpsystem32javacpl.cpl 2012-12-08 20:41:48 821736 ----a-w- c:winxpsystem32npDeployJava1.dll 2012-12-08 20:41:48 746984 ----a-w- c:winxpsystem32deployJava1.dll 2012-10-30 22:51:58 738504 ----a-w- c:winxpsystem32driversaswSnx.sys 2012-10-30 22:51:07 41224 ----a-w- c:winxpavastSS.scr . ============= FINISH: 10:57:24,34 ===============

... това е от dds всичко

ето и от "attach"

attach:

. UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2011-09-30.01) . Microsoft Windows XP Professional Boot Device: DeviceHarddiskVolume1 Install Date: 08.12.2012 г. 21:52:47 System Uptime: 12.1.2013 г. 09:47:00 (1 hours ago) . Motherboard: Dell Inc. | | 0HR330 Processor: Genuine Intel® CPU 2160 @ 1.80GHz | Microprocessor | 1795/800mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 12 GiB total, 3,251 GiB free. D: is FIXED (NTFS) - 137 GiB total, 88,786 GiB free. E: is CDROM () G: is Removable . ==== Disabled Device Manager Items ============= . Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318} Description: ASUS NX1001 Network Adapter Device ID: PCIVEN_13F0&DEV_0200&SUBSYS_020113F0&REV_314&1B02CB0B&0&00F0 Manufacturer: ASUSTek Computer Inc. Name: ASUS NX1001 Network Adapter PNP Device ID: PCIVEN_13F0&DEV_0200&SUBSYS_020113F0&REV_314&1B02CB0B&0&00F0 Service: ip100xp . ==== System Restore Points =================== . RP41: 08.1.2013 г. 18:52:31 - System Checkpoint RP42: 09.1.2013 г. 19:16:40 - System Checkpoint RP43: 10.1.2013 г. 19:59:23 - System Checkpoint RP44: 11.1.2013 г. 23:37:25 - System Checkpoint RP45: 12.1.2013 г. 09:14:20 - Restore Operation . ==== Installed Programs ====================== . Adobe Flash Player 11 Plugin Adobe Reader X (10.0.1) Adobe Shockwave Player 11.6 avast! Free Antivirus Broadcom ASF Management Applications Broadcom Gigabit Integrated Controller Broadcom Management Programs BS.Player FREE Cheat Engine 6.2 DAEMON Tools Lite Driver Magician 3.5 Easy GIF Animator 5.2 FlexType 2K Google Chrome Google Earth Plug-in Google Update Helper Intel® Graphics Media Accelerator Driver Java 7 Update 9 Java Auto Updater Malwarebytes Anti-Malware, Іµрсёя 1.70.0.1100 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Mozilla Firefox 17.0.1 (x86 bg) Mozilla Maintenance Service Opera 12.12 PhotoScape Power Challenge Game Plugin Security Update for Windows XP (KB2508272) Security Update for Windows XP (KB2524375) Security Update for Windows XP (KB923789) Security Update for Windows XP (KB950760) Security Update for Windows XP (KB980195) Skype Click to Call Skype™ 6.0 SoundMAX swMSM System Requirements Lab for Intel TeamViewer 8 uGet, Іµрсёя 2.0.4 Update for Microsoft Windows (KB971513) Update for Windows XP (KB2467659) Update for Windows XP (KB898461) WebFldrs XP WinRAR 4.01 (32-±ётѕІ° Іµрсёя) µTorrent . ==== Event Viewer Messages From Past Week ======== . 12.1.2013 і. 09:04:03, error: Service Control Manager [7031] - The TeamViewer 8 service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 2000 milliseconds: Restart the service. 09.1.2013 і. 14:33:43, error: Service Control Manager [7034] - The MBAMService service terminated unexpectedly. It has done this 1 time(s). 05.1.2013 і. 13:47:33, error: System Error [1003] - Error code 1000008e, parameter1 80000004, parameter2 806edae1, parameter3 a5a18540, parameter4 00000000. . ==== End Of File ===========================

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

12 януари 201313 г.

Здравейте..!

Изтеглете Malwarebytes' Anti-Malware или от тук (не забравяйте да обновите програмата с нови дефиниции)

* Кликнете два пъти върху mbam-setup.exe, за да инсталирате програмата.
* Уверете се, че са поставени отметки на Update Malwarebytes' Anti-Malware и Launch Malwarebytes' Anti-Malware. След това кликнете на Finish.
* Ако има намерени обновявания, тя ще ги изтегли и инсталира.
* Стартирайте програмата и изберете "Perform Full Scan", след това кликнете на Scan.
* Сканирането ще отнеме малко време, затова моля да бъдете търпеливи.
* Когато сканирането завърши, кликнете на OK, след това Show Results, за да видите резултата.
* Уверете се, че на всички редове има отметки, и кликнете на Remove Selected.
* Когато всичко бъде премахнато, в Notepad ще бъде отворен лог. Копирайте този лог и го публикувайте в следващия си коментар по темата.

Забележка: Ако MalwareBytes' Anti-Malware се затрудни в премахването на откритите вируси/заплахи, той ще поиска да рестартира компютъра Ви и по време на рестартирането да премахне проблемните вируси/заплахи. Ако бъдете попитани, потвърдете че желаете вашия компютър да бъде рестартиран.

Изтеглете OTL (от OldTimer) и го запазете на вашия десктоп.

Кликнете два пъти върху OTL.exe, за да стартирате програмата.
Сложете отметки преди следните неща:

Scan all users
Lop check
Purity check

Под секцията Extra Registry, изберете Use SafeList
Кликнете на Run Scan и изчакайте да завърши сканирането. (може да отнеме 10-15 минути)
Когато завърши, публикувайте следните два лог файла:

OTL.txt (намира се на вашия десктоп)
Extras.txt (ще Ви се отвори автоматично)

12 януари 201313 г.

Автор

Ето от malwarebytes:

Malwarebytes Anti-Malware (PRO) 1.70.0.1100
www.malwarebytes.org

Версия на базата от данни: v2013.01.12.05

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
The_Phenomenon :: PHENOMENON [администратор]

Защита: включена

12.1.2013 г. 13:55:38
MBAM-log-2013-01-12 (14-22-00).txt

Тип сканиране: Пълно сканиране (C:|D:|)
Включени опции за сканиране: Памет | Автоматично зареждане | Системен регистър | Файлова система | Евристики/Допълнителни | Евристики/Shuriken | PUP | PUM
Изключени опции за сканиране: P2P
Сканирани обекти: 214519
Изминало време: 25 минута(и), 54 секунда(и)

Открити процеси в паметта: 0
(Не бяха открити зловредни обекти)

Открити модули в паметта: 0
(Не бяха открити зловредни обекти)

Открити ключове в системния регистър: 0
(Не бяха открити зловредни обекти)

Открити стойности в системния регистър: 0
(Не бяха открити зловредни обекти)

Открити информационни обекти в системния регистър: 0
(Не бяха открити зловредни обекти)

Открити папки: 0
(Не бяха открити зловредни обекти)

Открити файлове: 1
C:Documents and SettingsThe_PhenomenonMy DocumentsDownloadsxptcprep.exe (PUP.Adware.Bundler) -> Не беше предприето действие.

(край)

Ето това е OTL.Txt:

OTL logfile created on: 12.1.2013 г. 14:32:37 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:Documents and SettingsThe_PhenomenonDesktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000402 | Country: Bulgaria | Language: BGR | Date Format: dd.M.yyyy 'г.'

1,99 Gb Total Physical Memory | 1,25 Gb Available Physical Memory | 62,66% Memory free
3,84 Gb Paging File | 3,23 Gb Available in Paging File | 84,08% Paging File free
Paging file location(s): C:pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:WINXP | %ProgramFiles% = C:Program Files
Drive C: | 11,72 Gb Total Space | 3,23 Gb Free Space | 27,56% Space Free | Partition Type: NTFS
Drive D: | 137,28 Gb Total Space | 88,79 Gb Free Space | 64,67% Space Free | Partition Type: NTFS
Drive G: | 7,37 Gb Total Space | 3,22 Gb Free Space | 43,76% Space Free | Partition Type: FAT32

Computer Name: PHENOMENON | User Name: The_Phenomenon | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2013.01.12 14:30:36 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:Documents and SettingsThe_PhenomenonDesktopOTL.exe
PRC - [2012.12.14 16:49:28 | 000,682,344 | ---- | M] (Malwarebytes Corporation) -- C:Program FilesMalwarebytes' Anti-Malwarembamservice.exe
PRC - [2012.12.14 16:49:28 | 000,512,360 | ---- | M] (Malwarebytes Corporation) -- C:Program FilesMalwarebytes' Anti-Malwarembamgui.exe
PRC - [2012.12.14 16:49:28 | 000,398,184 | ---- | M] (Malwarebytes Corporation) -- C:Program FilesMalwarebytes' Anti-Malwarembamscheduler.exe
PRC - [2012.12.13 14:26:20 | 003,290,896 | ---- | M] (Skype Technologies S.A.) -- C:Documents and SettingsAll UsersApplication DataSkypeToolbarsSkype C2C Servicec2c_service.exe
PRC - [2012.12.08 22:41:51 | 000,161,768 | ---- | M] (Oracle Corporation) -- C:Program FilesJavajre7binjqs.exe
PRC - [2012.11.29 15:50:25 | 003,463,080 | ---- | M] (TeamViewer GmbH) -- C:Program FilesTeamViewerVersion8TeamViewer_Service.exe
PRC - [2012.11.29 10:26:08 | 000,916,960 | ---- | M] (Mozilla Corporation) -- C:Program FilesMozilla Firefoxfirefox.exe
PRC - [2012.10.31 00:50:59 | 004,297,136 | ---- | M] (AVAST Software) -- C:Program FilesAVAST SoftwareAvastAvastUI.exe
PRC - [2012.10.31 00:50:59 | 000,044,808 | ---- | M] (AVAST Software) -- C:Program FilesAVAST SoftwareAvastAvastSvc.exe
PRC - [2008.04.14 11:00:00 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:WINXPexplorer.exe
PRC - [2006.03.17 17:25:16 | 000,065,536 | ---- | M] (Broadcom Corporation) -- C:Program FilesBroadcomASFIPMonAsfIpMon.exe
PRC - [2002.05.19 09:24:00 | 000,095,232 | ---- | M] () -- C:Program FilesDatecsFlexType 2KFType2K.exe

========== Modules (No Company Name) ==========

MOD - [2013.01.12 10:52:30 | 002,043,392 | ---- | M] () -- C:Program FilesAVAST SoftwareAvastdefs13011200algo.dll
MOD - [2012.12.30 17:48:20 | 014,586,296 | ---- | M] () -- C:WINXPsystem32MacromedFlashNPSWF32_11_5_502_135.dll
MOD - [2012.11.29 10:26:21 | 002,397,152 | ---- | M] () -- C:Program FilesMozilla Firefoxmozjs.dll
MOD - [2011.05.28 22:04:56 | 000,140,288 | ---- | M] () -- C:Program FilesWinRARRarExt.dll
MOD - [2008.04.14 11:00:00 | 000,059,904 | ---- | M] () -- C:WINXPsystem32devenum.dll
MOD - [2008.04.14 11:00:00 | 000,014,336 | ---- | M] () -- C:WINXPsystem32msdmo.dll
MOD - [2002.05.19 09:24:00 | 000,095,232 | ---- | M] () -- C:Program FilesDatecsFlexType 2KFType2K.exe
MOD - [2002.04.23 00:17:06 | 000,045,056 | ---- | M] () -- C:WINXPsystem32newdll.dll

========== Services (SafeList) ==========

SRV - [2012.12.14 16:49:28 | 000,682,344 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:Program FilesMalwarebytes' Anti-Malwarembamservice.exe -- (MBAMService)
SRV - [2012.12.14 16:49:28 | 000,398,184 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:Program FilesMalwarebytes' Anti-Malwarembamscheduler.exe -- (MBAMScheduler)
SRV - [2012.12.13 14:26:20 | 003,290,896 | ---- | M] (Skype Technologies S.A.) [Auto | Running] -- C:Documents and SettingsAll UsersApplication DataSkypeToolbarsSkype C2C Servicec2c_service.exe -- (Skype C2C Service)
SRV - [2012.12.08 22:41:51 | 000,161,768 | ---- | M] (Oracle Corporation) [Auto | Running] -- C:Program FilesJavajre7binjqs.exe -- (JavaQuickStarterService)
SRV - [2012.11.29 15:50:25 | 003,463,080 | ---- | M] (TeamViewer GmbH) [Auto | Running] -- C:Program FilesTeamViewerVersion8TeamViewer_Service.exe -- (TeamViewer8)
SRV - [2012.11.29 10:26:17 | 000,115,168 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:Program FilesMozilla Maintenance Servicemaintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.11.09 11:21:24 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:Program FilesSkypeUpdaterUpdater.exe -- (SkypeUpdate)
SRV - [2012.10.31 00:50:59 | 000,044,808 | ---- | M] (AVAST Software) [Auto | Running] -- C:Program FilesAVAST SoftwareAvastAvastSvc.exe -- (avast! Antivirus)
SRV - [2006.03.17 17:25:16 | 000,065,536 | ---- | M] (Broadcom Corporation) [Auto | Running] -- C:Program FilesBroadcomASFIPMonAsfIpMon.exe -- (ASFIPmon)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump)
DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt)
DRV - File not found [Kernel | System | Stopped] -- -- (Changer)
DRV - [2012.12.24 23:20:43 | 000,242,240 | ---- | M] (DT Soft Ltd) [Kernel | On_Demand | Running] -- C:WINXPsystem32driversdtsoftbus01.sys -- (dtsoftbus01)
DRV - [2012.12.14 16:49:28 | 000,021,104 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:WINXPsystem32driversmbam.sys -- (MBAMProtector)
DRV - [2012.10.31 00:51:58 | 000,738,504 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:WINXPSystem32driversaswSnx.sys -- (aswSnx)
DRV - [2012.10.31 00:51:58 | 000,361,032 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:WINXPSystem32driversaswSP.sys -- (aswSP)
DRV - [2012.10.31 00:51:58 | 000,054,232 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:WINXPSystem32driversaswTdi.sys -- (aswTdi)
DRV - [2012.10.31 00:51:58 | 000,035,928 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:WINXPSystem32driversaswRdr.sys -- (AswRdr)
DRV - [2012.10.31 00:51:57 | 000,097,608 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:WINXPSystem32driversaswmon2.sys -- (aswMon2)
DRV - [2012.10.31 00:51:56 | 000,025,256 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:WINXPSystem32driversaavmker4.sys -- (Aavmker4)
DRV - [2012.10.31 00:51:56 | 000,021,256 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:WINXPSystem32driversaswFsBlk.sys -- (aswFsBlk)
DRV - [2011.06.02 11:08:34 | 000,011,336 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:Program FilesSystemRequirementsLabcpudrv.sys -- (cpudrv)
DRV - [2010.09.16 15:12:05 | 000,226,880 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:WINXPsystem32driverstcpip6.sys -- (Tcpip6)
DRV - [2007.06.06 12:51:04 | 000,161,792 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:WINXPsystem32driversb57xp32.sys -- (b57w2k)
DRV - [2006.03.27 04:48:34 | 000,026,752 | R--- | M] (ASUSTek Computer Inc. ) [Kernel | On_Demand | Stopped] -- C:WINXPsystem32driversipfnd51.sys -- (ip100xp)
DRV - [2003.04.24 16:21:50 | 000,006,025 | ---- | M] (Broadcom Corporation) [Kernel | Auto | Running] -- C:Program FilesBroadcomASFIPMonBASFND.sys -- (BASFND)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLMSOFTWAREMicrosoftInternet ExplorerMain,Local Page = C:WINXPsystem32blank.htm
IE - HKLM..SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM..SearchScopes{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}

IE - HKCUSOFTWAREMicrosoftInternet ExplorerMain,Local Page = C:WINXPsystem32blank.htm
IE - HKCUSOFTWAREMicrosoftInternet ExplorerMain,Start Page = http://www.google.bg/
IE - HKCUSOFTWAREMicrosoftInternet ExplorerMain,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp
IE - HKCUSOFTWAREMicrosoftInternet ExplorerMain,Start Page Redirect Cache AcceptLangs = bg
IE - HKCUSOFTWAREMicrosoftInternet ExplorerMain,Start Page Redirect Cache_TIMESTAMP = 0A 9E C5 C2 7F D5 CD 01 [binary data]
IE - HKCU..SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU..SearchScopes{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRC
IE - HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..extensions.enabledAddons: eliteproxyswitcher%40my-proxy.com:1.2.0.2
FF - prefs.js..network.proxy.backup.ftp: "127.0.0.1"
FF - prefs.js..network.proxy.backup.ftp_port: 9050
FF - prefs.js..network.proxy.backup.socks: "127.0.0.1"
FF - prefs.js..network.proxy.backup.socks_port: 9050
FF - prefs.js..network.proxy.backup.ssl: "127.0.0.1"
FF - prefs.js..network.proxy.backup.ssl_port: 9050
FF - prefs.js..network.proxy.ftp: "127.0.0.1"
FF - prefs.js..network.proxy.ftp_port: 9050
FF - prefs.js..network.proxy.http: "127.0.0.1"
FF - prefs.js..network.proxy.http_port: 9050
FF - prefs.js..network.proxy.share_proxy_settings: true
FF - prefs.js..network.proxy.socks: "127.0.0.1"
FF - prefs.js..network.proxy.socks_port: 9050
FF - prefs.js..network.proxy.ssl: "127.0.0.1"
FF - prefs.js..network.proxy.ssl_port: 9050

FF - [email protected]/FlashPlayer: C:WINXPsystem32MacromedFlashNPSWF32_11_5_502_135.dll ()
FF - [email protected]/ShockwavePlayer: C:WINXPsystem32AdobeDirectornp32dsw_1168638.dll (Adobe Systems, Inc.)
FF - [email protected]/GoogleEarthPlugin: C:Program FilesGoogleGoogle Earthpluginnpgeplugin.dll (Google)
FF - [email protected]/DTPlugin,version=10.9.2: C:WINXPsystem32npDeployJava1.dll (Oracle Corporation)
FF - [email protected]/JavaPlugin,version=10.9.2: C:Program FilesJavajre7binplugin2npjp2.dll (Oracle Corporation)
FF - [email protected]/Google Update;version=3: C:Program FilesGoogleUpdate1.3.21.124npGoogleUpdate3.dll (Google Inc.)
FF - [email protected]/Google Update;version=9: C:Program FilesGoogleUpdate1.3.21.124npGoogleUpdate3.dll (Google Inc.)
FF - [email protected]/PowerLoader: C:DOCUME~1THE_PH~1APPLIC~1POWERC~1nppowerloader.dll (Power Challenge Sweden AB)

FF - [email protected]: C:Program FilesAVAST SoftwareAvastWebRepFF [2012.12.08 22:20:13 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINEsoftwaremozillaMozilla Firefox 17.0.1extensionsComponents: C:Program FilesMozilla Firefoxcomponents [2013.01.12 09:15:05 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINEsoftwaremozillaMozilla Firefox 17.0.1extensionsPlugins: C:Program FilesMozilla Firefoxplugins [2013.01.12 09:15:02 | 000,000,000 | ---D | M]

[2012.12.08 22:10:37 | 000,000,000 | ---D | M] (No name found) -- C:Documents and SettingsThe_PhenomenonApplication DataMozillaExtensions
[2013.01.12 11:05:05 | 000,000,000 | ---D | M] (No name found) -- C:Documents and SettingsThe_PhenomenonApplication DataMozillaFirefoxProfiles06m0a6c3.defaultextensions
[2012.12.19 06:14:09 | 000,016,275 | ---- | M] () (No name found) -- C:Documents and SettingsThe_PhenomenonApplication DataMozillaFirefoxProfiles06m0a6c3.defaultextensionseliteproxyswitcher@my-proxy.com.xpi
[2013.01.12 10:05:20 | 000,001,639 | ---- | M] () -- C:Documents and SettingsThe_PhenomenonApplication DataMozillaFirefoxProfiles06m0a6c3.defaultsearchpluginsfirefox-.xml
[2013.01.12 09:15:04 | 000,000,000 | ---D | M] (No name found) -- C:Program FilesMozilla Firefoxextensions
[2013.01.12 09:15:04 | 000,000,000 | ---D | M] (No name found) -- C:Program FilesMozilla Firefoxextensions{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2013.01.11 11:37:38 | 000,000,000 | ---D | M] (No name found) -- C:Program FilesMozilla Firefoxupdatedextensions
[2013.01.12 09:15:18 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:Program FilesMozilla Firefoxupdatedextensions{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2013.01.11 11:37:50 | 000,000,000 | ---D | M] (Default) -- C:Program FilesMozilla Firefoxupdatedextensions{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2012.11.29 10:26:57 | 000,262,112 | ---- | M] (Mozilla Foundation) -- C:Program Filesmozilla firefoxcomponentsbrowsercomps.dll
[2012.01.12 10:58:30 | 000,917,816 | ---- | M] (BitComet) -- C:Program Filesmozilla firefoxpluginsnpBitCometAgent.dll

========== Chrome ==========

CHR - homepage:
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}&sugkey={google:suggestAPIKeyParameter}
CHR - homepage:
CHR - plugin: Shockwave Flash (Enabled) = C:Program FilesGoogleChromeApplication23.0.1271.97PepperFlashpepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:Program FilesGoogleChromeApplication23.0.1271.97ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:Program FilesGoogleChromeApplication23.0.1271.97pdf.dll
CHR - plugin: BitCometAgent (Enabled) = C:Program FilesMozilla FirefoxpluginsnpBitCometAgent.dll
CHR - plugin: Microsoftu00AE DRM (Enabled) = C:Program FilesWindows Media Playernpdrmv2.dll
CHR - plugin: Windows Media Player Plug-in Dynamic Link Library (Enabled) = C:Program FilesWindows Media Playernpdsplay.dll
CHR - plugin: Microsoftu00AE DRM (Enabled) = C:Program FilesWindows Media Playernpwmsdrm.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:Program FilesGoogleGoogle Earthpluginnpgeplugin.dll
CHR - plugin: Google Update (Enabled) = C:Program FilesGoogleUpdate1.3.21.124npGoogleUpdate3.dll
CHR - plugin: Java Platform SE 7 U9 (Enabled) = C:Program FilesJavajre7binplugin2npjp2.dll
CHR - plugin: Shockwave Flash (Enabled) = C:WINXPsystem32MacromedFlashNPSWF32_11_5_502_110.dll
CHR - plugin: Java Deployment Toolkit 7.0.90.5 (Enabled) = C:WINXPsystem32npDeployJava1.dll
CHR - Extension: Google u0414u0438u0441u043A = C:Documents and SettingsThe_PhenomenonLocal SettingsApplication DataGoogleChromeUser DataDefaultExtensionsapdfllckaahabafndbhieahigkjlhalf6.3_0
CHR - Extension: YouTube = C:Documents and SettingsThe_PhenomenonLocal SettingsApplication DataGoogleChromeUser DataDefaultExtensionsblpcfgokakmgnkcojhhkbfbldkacnbeo4.2.5_0
CHR - Extension: Google u0422u044Au0440u0441u0435u043Du0435 = C:Documents and SettingsThe_PhenomenonLocal SettingsApplication DataGoogleChromeUser DataDefaultExtensionscoobgpohoikkiipiblmjeljniedjpjpf0.0.0.19_0
CHR - Extension: avast! WebRep = C:Documents and SettingsThe_PhenomenonLocal SettingsApplication DataGoogleChromeUser DataDefaultExtensionsicmlaeflemplmjndnaapfdbbnpncnbda7.0.1474_0
CHR - Extension: Gmail = C:Documents and SettingsThe_PhenomenonLocal SettingsApplication DataGoogleChromeUser DataDefaultExtensionspjkljhegncpnkpknbcohdijeoejaedia7_0

O1 HOSTS File: ([2012.12.21 01:18:50 | 000,001,402 | ---- | M]) - C:WINXPsystem32driversetchosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 activate.adobe.com
O1 - Hosts: 127.0.0.1 activate-sjc0.adobe.com
O1 - Hosts: 127.0.0.1 practivate.adobe.com
O1 - Hosts: 127.0.0.1 ereg.adobe.com
O1 - Hosts: 127.0.0.1 activate.wip3.adobe.com
O1 - Hosts: 127.0.0.1 wip3.adobe.com
O1 - Hosts: 127.0.0.1 3dns-3.adobe.com
O1 - Hosts: 127.0.0.1 3dns-2.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns-2.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns-3.adobe.com
O1 - Hosts: 127.0.0.1 ereg.wip3.adobe.com
O1 - Hosts: 127.0.0.1 wwis-dubc1-vip60.adobe.com
O1 - Hosts: 127.0.0.1 ood.opsource.net
O1 - Hosts: 127.0.0.1 lm.licenses.adobe.com
O1 - Hosts: 127.0.0.1 adobeereg.com
O1 - Hosts: 127.0.0.1 OCSP.SPO1.VERISIGN.COM
O1 - Hosts: 127.0.0.1 activate-sea.adobe.com
O2 - BHO: (Java Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:Program FilesJavajre7binssv.dll (Oracle Corporation)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:Program FilesAVAST SoftwareAvastaswWebRepIE.dll (AVAST Software)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:Program FilesSkypeToolbarsInternet Explorerskypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Java Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:Program FilesJavajre7binjp2ssv.dll (Oracle Corporation)
O3 - HKLM..Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:Program FilesAVAST SoftwareAvastaswWebRepIE.dll (AVAST Software)
O4 - HKLM..Run: [Adobe Reader Speed Launcher] C:Program FilesAdobeReader 10.0ReaderReader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..Run: [avast] C:Program FilesAVAST SoftwareAvastavastUI.exe (AVAST Software)
O4 - HKCU..Run: [DAEMON Tools Lite] C:Program FilesDAEMON Tools LiteDTLite.exe (DT Soft Ltd)
O4 - Startup: C:Documents and SettingsAll UsersStart MenuProgramsStartupFlexType 2K.lnk = C:Program FilesDatecsFlexType 2KFType2K.exe ()
O6 - HKLMSOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorer: HonorAutoRunSetting = 1
O7 - HKCUSOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorer: NoDriveTypeAutoRun = 145
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:Program FilesSkypeToolbarsInternet Explorerskypeieplugin.dll (Skype Technologies S.A.)
O13 - gopher Prefix: missing
O17 - HKLMSystemCCSServicesTcpipParametersInterfaces{48ED9DAE-3E70-4312-94E5-C01C699EE6A2}: NameServer = 213.91.177.254,85.196.176.254
O18 - ProtocolHandlerskype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:Program FilesCommon FilesSkypeSkype4COM.dll (Skype Technologies)
O18 - ProtocolHandlerskype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:Program FilesSkypeToolbarsInternet Explorerskypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:WINXPexplorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:WINXPsystem32userinit.exe) - C:WINXPsystem32userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:Documents and SettingsThe_PhenomenonLocal SettingsApplication DataMicrosoftWallpaper1.bmp
O24 - Desktop BackupWallPaper: C:Documents and SettingsThe_PhenomenonLocal SettingsApplication DataMicrosoftWallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2012.12.08 21:50:25 | 000,000,000 | ---- | M] () - C:AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM..comfile [open] -- "%1" %*
O35 - HKLM..exefile [open] -- "%1" %*
O37 - HKLM...com [@ = comfile] -- "%1" %*
O37 - HKLM...exe [@ = exefile] -- "%1" %*
O38 - SubSystemsWindows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystemsWindows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2013.01.12 14:30:35 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:Documents and SettingsThe_PhenomenonDesktopOTL.exe
[2013.01.12 10:55:43 | 000,492,146 | R--- | C] (Swearware) -- C:Documents and SettingsThe_PhenomenonDesktopdds.exe
[2013.01.12 10:09:44 | 000,000,000 | ---D | C] -- C:Documents and SettingsThe_PhenomenonLocal SettingsApplication DataProfiles
[2013.01.12 10:09:44 | 000,000,000 | ---D | C] -- C:Documents and SettingsThe_PhenomenonApplication DataProfiles
[2013.01.12 10:09:44 | 000,000,000 | ---D | C] -- C:Documents and SettingsThe_PhenomenonApplication DataCrash Reports
[2013.01.12 09:15:01 | 000,000,000 | ---D | C] -- C:Program FilesMozilla Firefox
[2013.01.12 07:36:09 | 000,000,000 | ---D | C] -- C:Program FilesXP TCPIP Repair
[2013.01.06 20:20:17 | 000,000,000 | ---D | C] -- C:Documents and SettingsThe_PhenomenonLocal SettingsApplication DataOpera
[2013.01.06 20:20:17 | 000,000,000 | ---D | C] -- C:Documents and SettingsThe_PhenomenonApplication DataOpera
[2013.01.06 20:20:09 | 000,000,000 | ---D | C] -- C:Program FilesOpera
[2013.01.05 13:46:28 | 000,000,000 | ---D | C] -- C:WINXPMinidump
[2013.01.05 00:03:25 | 000,000,000 | ---D | C] -- C:Documents and SettingsThe_PhenomenonLocal SettingsApplication DataTemp
[2013.01.01 16:32:27 | 001,101,824 | ---- | C] (Woodbury Associates Limited) -- C:WINXPSystem32UniBox210.ocx
[2013.01.01 16:32:27 | 000,880,640 | ---- | C] (Woodbury Associates Limited) -- C:WINXPSystem32UniBox10.ocx
[2013.01.01 16:32:27 | 000,212,992 | ---- | C] (Woodbury Associates Limited) -- C:WINXPSystem32UniBoxVB12.ocx
[2013.01.01 16:32:27 | 000,108,336 | ---- | C] (Microsoft Corporation) -- C:WINXPSystem32MSWINSCK.OCX
[2013.01.01 16:32:27 | 000,000,000 | ---D | C] -- C:Documents and SettingsAll UsersStart MenuProgramsuGet VGI
[2013.01.01 16:32:25 | 000,000,000 | ---D | C] -- C:Program FilesuGet VGI
[2012.12.27 23:58:01 | 000,000,000 | ---D | C] -- C:Documents and SettingsThe_PhenomenonMy DocumentsMy Cheat Tables
[2012.12.27 23:57:55 | 000,000,000 | ---D | C] -- C:Documents and SettingsAll UsersStart MenuProgramsCheat Engine 6.2
[2012.12.27 23:57:51 | 000,000,000 | ---D | C] -- C:Program FilesCheat Engine 6.2
[2012.12.27 15:22:56 | 000,000,000 | ---D | C] -- C:Documents and SettingsThe_PhenomenonLocal SettingsApplication DataPowerChallenge
[2012.12.27 15:22:56 | 000,000,000 | ---D | C] -- C:Documents and SettingsThe_PhenomenonApplication DataPowerChallenge
[2012.12.27 15:08:34 | 000,000,000 | ---D | C] -- C:WINXPSystem32Adobe
[2012.12.27 10:26:28 | 000,000,000 | -H-D | C] -- C:WINXPSystem32GroupPolicy
[2012.12.25 21:45:44 | 000,000,000 | ---D | C] -- C:Documents and SettingsThe_PhenomenonLocal SettingsApplication DataThinstall
[2012.12.24 23:22:28 | 000,000,000 | -H-D | C] -- C:Program FilesZero G Registry
[2012.12.24 23:22:12 | 000,000,000 | -H-D | C] -- C:Documents and SettingsThe_PhenomenonInstallAnywhere
[2012.12.24 23:07:14 | 000,242,240 | ---- | C] (DT Soft Ltd) -- C:WINXPSystem32driversdtsoftbus01.sys
[2012.12.24 23:06:56 | 000,000,000 | ---D | C] -- C:Documents and SettingsThe_PhenomenonApplication DataDAEMON Tools Lite
[2012.12.24 23:06:50 | 000,000,000 | ---D | C] -- C:Program FilesDAEMON Tools Lite
[2012.12.24 23:05:44 | 000,000,000 | ---D | C] -- C:Documents and SettingsAll UsersApplication DataDAEMON Tools Lite
[2012.12.24 22:49:07 | 000,000,000 | ---D | C] -- C:Documents and SettingsAll UsersApplication DataTarma Installer
[2012.12.24 22:49:00 | 000,000,000 | ---D | C] -- C:Documents and SettingsThe_PhenomenonStart MenuProgramsTornTV.com
[2012.12.22 12:34:31 | 000,000,000 | ---D | C] -- C:Documents and SettingsAll UsersStart MenuProgramsGoogle Earth
[2012.12.21 17:28:56 | 000,000,000 | ---D | C] -- C:Documents and SettingsThe_PhenomenonLocal SettingsApplication DataAdobe
[2012.12.21 01:17:31 | 000,000,000 | ---D | C] -- C:Documents and SettingsAll UsersApplication DataAdobe
[2012.12.21 01:17:14 | 000,000,000 | ---D | C] -- C:Documents and SettingsThe_PhenomenonApplication DataSwitchBoard
[2012.12.21 01:17:14 | 000,000,000 | ---D | C] -- C:Documents and SettingsAll UsersApplication DataSLStore
[2012.12.21 01:17:14 | 000,000,000 | ---D | C] -- C:Documents and SettingsThe_PhenomenonLocal SettingsApplication DataOOBE
[2012.12.21 01:17:14 | 000,000,000 | ---D | C] -- C:Documents and SettingsThe_PhenomenonLocal SettingsApplication DataColor
[2012.12.21 01:17:14 | 000,000,000 | ---D | C] -- C:Documents and SettingsAll UsersApplication DataAdobe PDF
[2012.12.21 01:17:12 | 000,000,000 | ---D | C] -- C:Documents and SettingsThe_PhenomenonApplication DataColor
[2012.12.21 01:17:12 | 000,000,000 | ---D | C] -- C:Documents and SettingsThe_PhenomenonApplication DataAdobe Photoshop CS6
[2012.12.21 01:17:12 | 000,000,000 | ---D | C] -- C:Program FilesCommon FilesAdobe
[2012.12.21 01:17:12 | 000,000,000 | ---D | C] -- C:Program FilesAdobe
[2012.12.21 01:07:34 | 000,000,000 | ---D | C] -- C:Documents and SettingsThe_PhenomenonMy DocumentsOneNote Notebooks
[2012.12.21 01:05:31 | 000,000,000 | ---D | C] -- C:Documents and SettingsThe_PhenomenonApplication DataThinstall
[2012.12.20 23:43:43 | 000,000,000 | ---D | C] -- C:Config.Msi
[2012.12.19 22:29:50 | 000,000,000 | ---D | C] -- C:New Folder
[2012.12.19 22:07:36 | 000,000,000 | ---D | C] -- C:Documents and SettingsAll UsersApplication DataPrivacyware
[2012.12.17 23:18:12 | 000,000,000 | ---D | C] -- C:Program FilesMy-Proxy
[2012.12.17 23:18:12 | 000,000,000 | ---D | C] -- C:Documents and SettingsAll UsersApplication DataEPS
[2012.12.15 15:15:45 | 000,026,752 | R--- | C] (ASUSTek Computer Inc. ) -- C:WINXPSystem32driversipfnd51.sys
[2012.12.15 00:58:27 | 000,000,000 | ---D | C] -- C:Documents and SettingsThe_PhenomenonApplication DataMalwarebytes
[2012.12.15 00:58:17 | 000,000,000 | ---D | C] -- C:Documents and SettingsAll UsersStart MenuProgramsMalwarebytes' Anti-Malware
[2012.12.15 00:58:15 | 000,000,000 | ---D | C] -- C:Documents and SettingsAll UsersApplication DataMalwarebytes
[2012.12.15 00:58:12 | 000,021,104 | ---- | C] (Malwarebytes Corporation) -- C:WINXPSystem32driversmbam.sys
[2012.12.15 00:58:12 | 000,000,000 | ---D | C] -- C:Program FilesMalwarebytes' Anti-Malware
[2012.12.14 21:17:11 | 000,000,000 | ---D | C] -- C:Documents and SettingsThe_PhenomenonLocal SettingsApplication DataIdentities
[1 C:WINXPSystem32*.tmp files -> C:WINXPSystem32*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2013.01.12 14:30:36 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:Documents and SettingsThe_PhenomenonDesktopOTL.exe
[2013.01.12 14:28:52 | 000,311,740 | ---- | M] () -- C:WINXPSystem32perfh009.dat
[2013.01.12 14:28:52 | 000,040,128 | ---- | M] () -- C:WINXPSystem32perfc009.dat
[2013.01.12 14:27:00 | 000,001,002 | ---- | M] () -- C:WINXPtasksGoogleUpdateTaskMachineUA.job
[2013.01.12 14:25:13 | 000,000,364 | -H-- | M] () -- C:WINXPtasksavast! Emergency Update.job
[2013.01.12 14:25:07 | 000,000,998 | ---- | M] () -- C:WINXPtasksGoogleUpdateTaskMachineCore.job
[2013.01.12 14:24:29 | 000,002,048 | --S- | M] () -- C:WINXPbootstat.dat
[2013.01.12 10:55:46 | 000,492,146 | R--- | M] (Swearware) -- C:Documents and SettingsThe_PhenomenonDesktopdds.exe
[2013.01.12 10:09:44 | 000,000,111 | ---- | M] () -- C:Documents and SettingsThe_PhenomenonApplication Dataprofiles.ini
[2013.01.12 09:17:42 | 000,001,689 | ---- | M] () -- C:Documents and SettingsAll UsersDesktopavast! Free Antivirus.lnk
[2013.01.12 09:17:39 | 000,002,625 | ---- | M] () -- C:WINXPSystem32CONFIG.NT
[2013.01.12 09:16:49 | 000,002,206 | ---- | M] () -- C:WINXPSystem32wpa.dbl
[2013.01.11 00:42:37 | 000,063,655 | ---- | M] () -- C:Documents and SettingsThe_PhenomenonDesktop580678_584722858219957_134153991_n.jpg
[2013.01.10 21:51:52 | 000,126,812 | ---- | M] () -- C:Documents and SettingsThe_PhenomenonDesktopcats111.jpg
[2013.01.10 01:10:50 | 000,042,715 | ---- | M] () -- C:Documents and SettingsThe_PhenomenonDesktop37071_397562690331490_1329829129_n.jpg
[2013.01.10 00:58:44 | 000,069,871 | ---- | M] () -- C:Documents and SettingsThe_PhenomenonDesktop227681_321132684661723_946755778_n.jpg
[2013.01.10 00:19:59 | 000,514,805 | ---- | M] () -- C:Documents and SettingsThe_PhenomenonDesktopUntitled.png
[2013.01.07 22:18:41 | 000,216,049 | ---- | M] () -- C:Documents and SettingsThe_PhenomenonDesktopIMG_07012013_221815.png
[2013.01.07 20:10:40 | 000,012,773 | ---- | M] () -- C:Documents and SettingsThe_PhenomenonDesktop734694_582870405071869_272703984_n.jpg
[2013.01.07 18:44:42 | 002,812,918 | ---- | M] () -- C:Documents and SettingsThe_PhenomenonDesktop1357132405622.gif
[2013.01.07 17:09:20 | 000,027,648 | ---- | M] () -- C:Documents and SettingsThe_PhenomenonLocal SettingsApplication DataDCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2013.01.06 22:25:41 | 000,050,258 | ---- | M] () -- C:Documents and SettingsThe_PhenomenonDesktop16768_270635216395520_1375175951_n.jpg
[2013.01.06 20:20:14 | 000,001,510 | ---- | M] () -- C:Documents and SettingsThe_PhenomenonApplication DataMicrosoftInternet ExplorerQuick LaunchOpera.lnk
[2013.01.06 20:20:14 | 000,001,492 | ---- | M] () -- C:Documents and SettingsAll UsersDesktopOpera.lnk
[2013.01.06 18:55:01 | 000,002,261 | ---- | M] () -- C:Documents and SettingsAll UsersDesktopSkype.lnk
[2013.01.06 05:21:21 | 003,932,214 | ---- | M] () -- C:Documents and SettingsThe_PhenomenonDesktopuntitled.bmp
[2013.01.05 00:01:34 | 000,001,730 | ---- | M] () -- C:Documents and SettingsAll UsersDesktopAdobe Reader X.lnk
[2013.01.04 21:49:53 | 000,133,481 | ---- | M] () -- C:Documents and SettingsThe_PhenomenonDesktop527618_375271032534124_1640751876_n.jpg
[2013.01.03 12:51:28 | 008,125,158 | ---- | M] () -- C:Documents and SettingsThe_PhenomenonDesktopDJ Дамян и Бобеца - Ти си мой грях.mp3
[2013.01.02 00:34:32 | 000,059,666 | ---- | M] () -- C:Documents and SettingsThe_PhenomenonMy Documents11355832539285195_8.pic.jpeg
[2013.01.01 20:15:16 | 000,063,370 | ---- | M] () -- C:Documents and SettingsThe_PhenomenonMy Documents11352891577300252_4.pic.jpeg
[2013.01.01 16:40:01 | 008,873,305 | ---- | M] () -- C:Documents and SettingsThe_PhenomenonDesktopAlexandra Burke ft DJ Smash - tonight - www.uget.in.mp3
[2013.01.01 16:35:18 | 009,112,711 | ---- | M] () -- C:Documents and SettingsThe_PhenomenonDesktopAlexandra Stan - Cliche (Hush Hush) OFFICIAL HD MUSIC VIDEO - www.uget.in.mp3
[2013.01.01 16:32:28 | 000,000,658 | ---- | M] () -- C:Documents and SettingsAll UsersDesktopuGet.lnk
[2013.01.01 15:43:52 | 052,779,381 | R--- | M] () -- C:Documents and SettingsThe_PhenomenonDesktopШоуто на Слави, 31 декември 2012 г. Гъмзата - Сефте.flv
[2012.12.30 17:48:20 | 000,697,272 | ---- | M] (Adobe Systems Incorporated) -- C:WINXPSystem32FlashPlayerApp.exe
[2012.12.30 17:48:20 | 000,073,656 | ---- | M] (Adobe Systems Incorporated) -- C:WINXPSystem32FlashPlayerCPLApp.cpl
[2012.12.29 21:41:00 | 001,065,282 | ---- | M] () -- C:Documents and SettingsThe_PhenomenonMy Documentsfoto marina 006.JPG
[2012.12.29 21:38:44 | 001,042,941 | ---- | M] () -- C:Documents and SettingsThe_PhenomenonMy Documentsfoto marina 007.JPG
[2012.12.29 21:22:43 | 000,027,970 | ---- | M] () -- C:Documents and SettingsThe_PhenomenonMy Documentsfoto 2.jpeg
[2012.12.29 21:20:34 | 000,021,890 | ---- | M] () -- C:Documents and SettingsThe_PhenomenonMy Documentsfoto 5.jpeg
[2012.12.29 21:19:07 | 000,045,044 | ---- | M] () -- C:Documents and SettingsThe_PhenomenonMy Documentsport 5.JPG
[2012.12.29 21:14:57 | 000,032,866 | ---- | M] () -- C:Documents and SettingsThe_PhenomenonMy Documentsfoto 3.jpeg
[2012.12.29 21:11:53 | 000,028,182 | ---- | M] () -- C:Documents and SettingsThe_PhenomenonMy Documentsfoto 4.jpeg
[2012.12.28 12:00:34 | 000,000,784 | ---- | M] () -- C:Documents and SettingsAll UsersDesktopMalwarebytes Anti-Malware.lnk
[2012.12.27 23:57:55 | 000,000,760 | ---- | M] () -- C:Documents and SettingsThe_PhenomenonDesktopCheat Engine.lnk
[2012.12.26 02:21:29 | 000,000,652 | ---- | M] () -- C:Documents and SettingsThe_PhenomenonDesktopspeed2.lnk
[2012.12.25 21:45:59 | 000,000,663 | ---- | M] () -- C:price_list_may.LNK
[2012.12.24 23:20:43 | 000,242,240 | ---- | M] (DT Soft Ltd) -- C:WINXPSystem32driversdtsoftbus01.sys
[2012.12.24 23:07:15 | 000,001,613 | ---- | M] () -- C:Documents and SettingsAll UsersDesktopDAEMON Tools Lite.lnk
[2012.12.24 14:30:31 | 000,000,000 | -H-- | M] () -- C:WINXPSystem32driversUMDFMsft_User_WpdMtpDr_01_00_00.Wdf
[2012.12.16 16:58:51 | 000,001,789 | ---- | M] () -- C:WINXPSystem32AUTOEXEC.NT
[2012.12.14 16:49:28 | 000,021,104 | ---- | M] (Malwarebytes Corporation) -- C:WINXPSystem32driversmbam.sys
[1 C:WINXPSystem32*.tmp files -> C:WINXPSystem32*.tmp -> ]

========== Files Created - No Company Name ==========

[2013.01.12 10:09:44 | 000,000,111 | ---- | C] () -- C:Documents and SettingsThe_PhenomenonApplication Dataprofiles.ini
[2013.01.11 00:42:36 | 000,063,655 | ---- | C] () -- C:Documents and SettingsThe_PhenomenonDesktop580678_584722858219957_134153991_n.jpg
[2013.01.10 21:51:52 | 000,126,812 | ---- | C] () -- C:Documents and SettingsThe_PhenomenonDesktopcats111.jpg
[2013.01.10 01:10:50 | 000,042,715 | ---- | C] () -- C:Documents and SettingsThe_PhenomenonDesktop37071_397562690331490_1329829129_n.jpg
[2013.01.10 00:58:42 | 000,069,871 | ---- | C] () -- C:Documents and SettingsThe_PhenomenonDesktop227681_321132684661723_946755778_n.jpg
[2013.01.10 00:19:56 | 000,514,805 | ---- | C] () -- C:Documents and SettingsThe_PhenomenonDesktopUntitled.png
[2013.01.07 22:18:38 | 000,216,049 | ---- | C] () -- C:Documents and SettingsThe_PhenomenonDesktopIMG_07012013_221815.png
[2013.01.07 20:10:39 | 000,012,773 | ---- | C] () -- C:Documents and SettingsThe_PhenomenonDesktop734694_582870405071869_272703984_n.jpg
[2013.01.07 18:44:36 | 002,812,918 | ---- | C] () -- C:Documents and SettingsThe_PhenomenonDesktop1357132405622.gif
[2013.01.06 22:25:39 | 000,050,258 | ---- | C] () -- C:Documents and SettingsThe_PhenomenonDesktop16768_270635216395520_1375175951_n.jpg
[2013.01.06 20:20:14 | 000,001,510 | ---- | C] () -- C:Documents and SettingsThe_PhenomenonApplication DataMicrosoftInternet ExplorerQuick LaunchOpera.lnk
[2013.01.06 20:20:14 | 000,001,498 | ---- | C] () -- C:Documents and SettingsAll UsersStart MenuProgramsOpera.lnk
[2013.01.06 20:20:14 | 000,001,492 | ---- | C] () -- C:Documents and SettingsAll UsersDesktopOpera.lnk
[2013.01.06 05:21:20 | 003,932,214 | ---- | C] () -- C:Documents and SettingsThe_PhenomenonDesktopuntitled.bmp
[2013.01.05 00:01:33 | 000,001,800 | ---- | C] () -- C:Documents and SettingsAll UsersStart MenuProgramsAdobe Reader X.lnk
[2013.01.05 00:01:33 | 000,001,730 | ---- | C] () -- C:Documents and SettingsAll UsersDesktopAdobe Reader X.lnk
[2013.01.04 21:49:45 | 000,133,481 | ---- | C] () -- C:Documents and SettingsThe_PhenomenonDesktop527618_375271032534124_1640751876_n.jpg
[2013.01.03 12:51:17 | 008,125,158 | ---- | C] () -- C:Documents and SettingsThe_PhenomenonDesktopDJ Дамян и Бобеца - Ти си мой грях.mp3
[2013.01.02 00:31:56 | 000,059,666 | ---- | C] () -- C:Documents and SettingsThe_PhenomenonMy Documents11355832539285195_8.pic.jpeg
[2013.01.01 20:12:06 | 000,063,370 | ---- | C] () -- C:Documents and SettingsThe_PhenomenonMy Documents11352891577300252_4.pic.jpeg
[2013.01.01 16:39:47 | 008,873,305 | ---- | C] () -- C:Documents and SettingsThe_PhenomenonDesktopAlexandra Burke ft DJ Smash - tonight - www.uget.in.mp3
[2013.01.01 16:35:01 | 009,112,711 | ---- | C] () -- C:Documents and SettingsThe_PhenomenonDesktopAlexandra Stan - Cliche (Hush Hush) OFFICIAL HD MUSIC VIDEO - www.uget.in.mp3
[2013.01.01 16:32:28 | 000,000,658 | ---- | C] () -- C:Documents and SettingsAll UsersDesktopuGet.lnk
[2013.01.01 15:42:41 | 052,779,381 | R--- | C] () -- C:Documents and SettingsThe_PhenomenonDesktopШоуто на Слави, 31 декември 2012 г. Гъмзата - Сефте.flv
[2012.12.29 21:40:24 | 001,065,282 | ---- | C] () -- C:Documents and SettingsThe_PhenomenonMy Documentsfoto marina 006.JPG
[2012.12.29 21:38:13 | 001,042,941 | ---- | C] () -- C:Documents and SettingsThe_PhenomenonMy Documentsfoto marina 007.JPG
[2012.12.29 21:22:32 | 000,027,970 | ---- | C] () -- C:Documents and SettingsThe_PhenomenonMy Documentsfoto 2.jpeg
[2012.12.29 21:20:33 | 000,021,890 | ---- | C] () -- C:Documents and SettingsThe_PhenomenonMy Documentsfoto 5.jpeg
[2012.12.29 21:19:05 | 000,045,044 | ---- | C] () -- C:Documents and SettingsThe_PhenomenonMy Documentsport 5.JPG
[2012.12.29 21:14:56 | 000,032,866 | ---- | C] () -- C:Documents and SettingsThe_PhenomenonMy Documentsfoto 3.jpeg
[2012.12.27 23:57:55 | 000,000,760 | ---- | C] () -- C:Documents and SettingsThe_PhenomenonDesktopCheat Engine.lnk
[2012.12.26 19:29:53 | 000,028,182 | ---- | C] () -- C:Documents and SettingsThe_PhenomenonMy Documentsfoto 4.jpeg
[2012.12.26 02:20:58 | 000,000,652 | ---- | C] () -- C:Documents and SettingsThe_PhenomenonDesktopspeed2.lnk
[2012.12.25 21:45:59 | 000,000,663 | ---- | C] () -- C:price_list_may.LNK
[2012.12.25 18:32:18 | 125,897,413 | ---- | C] () -- C:Documents and SettingsThe_PhenomenonDesktop94237bba86.flv
[2012.12.24 23:07:15 | 000,001,613 | ---- | C] () -- C:Documents and SettingsAll UsersDesktopDAEMON Tools Lite.lnk
[2012.12.15 00:58:18 | 000,000,784 | ---- | C] () -- C:Documents and SettingsAll UsersDesktopMalwarebytes Anti-Malware.lnk
[2012.12.08 23:37:47 | 000,004,073 | ---- | C] () -- C:WINXPODBCINST.INI
[2012.12.08 23:36:36 | 000,097,456 | ---- | C] () -- C:WINXPSystem32FNTCACHE.DAT
[2012.12.08 23:23:07 | 000,110,602 | ---- | C] () -- C:WINXPSystem32xcdsfx32.bin
[2012.12.08 22:31:56 | 000,045,056 | ---- | C] () -- C:WINXPSystem32newdll.dll
[2012.12.08 21:58:36 | 001,445,112 | ---- | C] () -- C:WINXPSystem32igkrng400.bin
[2012.12.08 21:58:35 | 000,147,456 | ---- | C] () -- C:WINXPSystem32igfxCoIn_v4943.dll
[2012.12.08 21:57:15 | 000,027,648 | ---- | C] () -- C:Documents and SettingsThe_PhenomenonLocal SettingsApplication DataDCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.12.08 21:52:53 | 000,002,048 | --S- | C] () -- C:WINXPbootstat.dat
[2012.12.08 21:47:29 | 000,021,640 | ---- | C] () -- C:WINXPSystem32emptyregdb.dat

========== ZeroAccess Check ==========

[HKEY_CURRENT_USERSoftwareClassesclsid{42aedc87-2188-41fd-b9a3-0c966feabec1}InProcServer32]

[HKEY_CURRENT_USERSoftwareClassesclsid{fbeb8a05-beee-4442-804e-409d6c4515e9}InProcServer32]

[HKEY_LOCAL_MACHINESoftwareClassesclsid{42aedc87-2188-41fd-b9a3-0c966feabec1}InProcServer32]
"" = %SystemRoot%system32shdocvw.dll -- [2011.04.12 20:46:48 | 001,510,400 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINESoftwareClassesclsid{5839FCA9-774D-42A1-ACDA-D6A79037F57F}InProcServer32]
"" = C:WINXPsystem32wbemfastprox.dll -- [2010.09.16 15:11:04 | 000,473,600 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINESoftwareClassesclsid{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}InProcServer32]
"" = C:WINXPsystem32wbemwbemess.dll -- [2008.04.14 11:00:00 | 000,273,920 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== LOP Check ==========

[2012.12.08 22:19:48 | 000,000,000 | ---D | M] -- C:Documents and SettingsAll UsersApplication DataAVAST Software
[2012.12.09 15:18:06 | 000,000,000 | ---D | M] -- C:Documents and SettingsAll UsersApplication DataBlumentals
[2012.12.24 23:21:37 | 000,000,000 | ---D | M] -- C:Documents and SettingsAll UsersApplication DataDAEMON Tools Lite
[2012.12.21 21:06:35 | 000,000,000 | ---D | M] -- C:Documents and SettingsAll UsersApplication DataEPS
[2012.12.19 22:07:36 | 000,000,000 | ---D | M] -- C:Documents and SettingsAll UsersApplication DataPrivacyware
[2012.12.21 01:17:14 | 000,000,000 | ---D | M] -- C:Documents and SettingsAll UsersApplication DataSLStore
[2012.12.27 10:26:01 | 000,000,000 | ---D | M] -- C:Documents and SettingsAll UsersApplication DataTarma Installer
[2012.12.21 13:57:06 | 000,000,000 | ---D | M] -- C:Documents and SettingsAll UsersApplication DataTEMP
[2012.12.09 02:56:37 | 000,000,000 | ---D | M] -- C:Documents and SettingsThe_PhenomenonApplication DataBitComet
[2012.12.09 23:49:13 | 000,000,000 | ---D | M] -- C:Documents and SettingsThe_PhenomenonApplication DataBSplayer
[2012.12.09 02:56:54 | 000,000,000 | ---D | M] -- C:Documents and SettingsThe_PhenomenonApplication DataBSplayer Pro
[2012.12.21 21:04:55 | 000,000,000 | ---D | M] -- C:Documents and SettingsThe_PhenomenonApplication DataColor
[2013.01.12 10:09:44 | 000,000,000 | ---D | M] -- C:Documents and SettingsThe_PhenomenonApplication DataCrash Reports
[2012.12.24 23:21:33 | 000,000,000 | ---D | M] -- C:Documents and SettingsThe_PhenomenonApplication DataDAEMON Tools Lite
[2012.12.28 12:42:39 | 000,000,000 | ---D | M] -- C:Documents and SettingsThe_PhenomenonApplication DataFileZilla
[2013.01.06 20:20:17 | 000,000,000 | ---D | M] -- C:Documents and SettingsThe_PhenomenonApplication DataOpera
[2012.12.08 23:14:18 | 000,000,000 | ---D | M] -- C:Documents and SettingsThe_PhenomenonApplication DataPhotoScape
[2012.12.27 15:23:00 | 000,000,000 | ---D | M] -- C:Documents and SettingsThe_PhenomenonApplication DataPowerChallenge
[2013.01.12 10:09:44 | 000,000,000 | ---D | M] -- C:Documents and SettingsThe_PhenomenonApplication DataProfiles
[2012.12.21 21:04:54 | 000,000,000 | ---D | M] -- C:Documents and SettingsThe_PhenomenonApplication DataSwitchBoard
[2012.12.08 22:42:52 | 000,000,000 | ---D | M] -- C:Documents and SettingsThe_PhenomenonApplication DataSystemRequirementsLab
[2012.12.11 21:07:59 | 000,000,000 | ---D | M] -- C:Documents and SettingsThe_PhenomenonApplication DataTeamViewer
[2012.12.21 01:05:31 | 000,000,000 | ---D | M] -- C:Documents and SettingsThe_PhenomenonApplication DataThinstall
[2013.01.12 14:23:50 | 000,000,000 | ---D | M] -- C:Documents and SettingsThe_PhenomenonApplication DatauTorrent

========== Purity Check ==========

========== Alternate Data Streams ==========

@Alternate Data Stream - 173 bytes -> C:Documents and SettingsAll UsersApplication DataTEMP:F8B88761

< End of report >

Ето го и последния Extras.Txt файл:

OTL Extras logfile created on: 12.1.2013 г. 14:32:37 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:Documents and SettingsThe_PhenomenonDesktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000402 | Country: Bulgaria | Language: BGR | Date Format: dd.M.yyyy 'г.'

1,99 Gb Total Physical Memory | 1,25 Gb Available Physical Memory | 62,66% Memory free
3,84 Gb Paging File | 3,23 Gb Available in Paging File | 84,08% Paging File free
Paging file location(s): C:pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:WINXP | %ProgramFiles% = C:Program Files
Drive C: | 11,72 Gb Total Space | 3,23 Gb Free Space | 27,56% Space Free | Partition Type: NTFS
Drive D: | 137,28 Gb Total Space | 88,79 Gb Free Space | 64,67% Space Free | Partition Type: NTFS
Drive G: | 7,37 Gb Total Space | 3,22 Gb Free Space | 43,76% Space Free | Partition Type: FAT32

Computer Name: PHENOMENON | User Name: The_Phenomenon | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINESOFTWAREClasses<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = Opera.HTML] -- C:Program FilesOperaOpera.exe (Opera Software)

[HKEY_CURRENT_USERSOFTWAREClasses<extension>]
.html [@ = FirefoxHTML] -- C:Program FilesMozilla Firefoxfirefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINESOFTWAREClasses<key>shell[command]command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
http [open] -- "C:Program FilesOperaOpera.exe" "%1" (Opera Software)
https [open] -- "C:Program FilesOperaOpera.exe" "%1" (Opera Software)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%system32rundll32.exe %SystemRoot%system32shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoring]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringAhnlabAntiVirus]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringKasperskyAntiVirus]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringMcAfeeAntiVirus]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringMcAfeeFirewall]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringPandaAntiVirus]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringPandaFirewall]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringSophosAntiVirus]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringSymantecAntiVirus]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringSymantecFirewall]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringTinyFirewall]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringTrendAntiVirus]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringTrendFirewall]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionSystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSr]
"Start" = 0

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyDomainProfile]

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyStandardProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 1

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyStandardProfileGloballyOpenPortsList]
"15496:TCP" = 15496:TCP:*:Enabled:BitComet 15496 TCP
"15496:UDP" = 15496:UDP:*:Enabled:BitComet 15496 UDP

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyDomainProfileAuthorizedApplicationsList]
"%windir%Network Diagnosticxpnetdiag.exe" = %windir%Network Diagnosticxpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)
"%windir%system32sessmgr.exe" = %windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyStandardProfileAuthorizedApplicationsList]
"%windir%Network Diagnosticxpnetdiag.exe" = %windir%Network Diagnosticxpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)
"%windir%system32sessmgr.exe" = %windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)
"C:Program FilesSkypePhoneSkype.exe" = C:Program FilesSkypePhoneSkype.exe:*:Enabled:Skype -- (Skype Technologies S.A.)
"C:Program FilesBitCometBitComet.exe" = C:Program FilesBitCometBitComet.exe:*:Enabled:BitComet.exe
"C:Program FilesuTorrentuTorrent.exe" = C:Program FilesuTorrentuTorrent.exe:*:Enabled:µTorrent -- (BitTorrent, Inc.)
"C:Program FilesTeamViewerVersion8TeamViewer.exe" = C:Program FilesTeamViewerVersion8TeamViewer.exe:*:Enabled:Teamviewer Remote Control Application -- (TeamViewer GmbH)
"C:Program FilesTeamViewerVersion8TeamViewer_Service.exe" = C:Program FilesTeamViewerVersion8TeamViewer_Service.exe:*:Enabled:Teamviewer Remote Control Service -- (TeamViewer GmbH)
"C:Program FilesOperaopera.exe" = C:Program FilesOperaopera.exe:*:Enabled:Opera Internet Browser -- (Opera Software)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstall]
"{071B9AFA-EBE8-4ABF-8F4A-9F92612F517E}" = Broadcom ASF Management Applications
"{177D1318-3E4B-4A7C-A300-AC4E21BE090B}" = Broadcom Management Programs
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83217009FF}" = Java 7 Update 9
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{63B7AC7E-0178-4F4F-A79B-08D97ADD02D7}" = System Requirements Lab for Intel
"{71972D00-4596-11E2-B6EA-B8AC6F97B88E}" = Google Earth Plug-in
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1033-7B44-AA0000000001}" = Adobe Reader X (10.0.1)
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{EA17F4FC-FDBF-4CF8-A529-2D983132D053}" = Skype™ 6.0
"{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX
"{FC57FC53-104C-415C-98D7-B05E659461A9}" = Broadcom Gigabit Integrated Controller
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.6
"avast" = avast! Free Antivirus
"BSPlayerf" = BS.Player FREE
"Cheat Engine 6.2_is1" = Cheat Engine 6.2
"DAEMON Tools Lite" = DAEMON Tools Lite
"Driver Magician_is1" = Driver Magician 3.5
"Easy GIF Animator Cracked by zoo_is1" = Easy GIF Animator 5.2
"FlexType 2K" = FlexType 2K
"Google Chrome" = Google Chrome
"HDMI" = Intel® Graphics Media Accelerator Driver
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware, версия 1.70.0.1100
"Mozilla Firefox 17.0.1 (x86 bg)" = Mozilla Firefox 17.0.1 (x86 bg)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"Opera 12.12.1707" = Opera 12.12
"PhotoScape" = PhotoScape
"TeamViewer 8" = TeamViewer 8
"uGet_VGI_is1" = uGet, версия 2.0.4
"uTorrent" = µTorrent
"WinRAR archiver" = WinRAR 4.01 (32-битова версия)

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionUninstall]
"Power Loader" = Power Challenge Game Plugin

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 08.1.2013 г. 09:46:27 | Computer Name = PHENOMENON | Source = Application Hang | ID = 1002
Description = Hanging application bsplayer.exe, version 2.6.3.1071, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 08.1.2013 г. 09:46:27 | Computer Name = PHENOMENON | Source = Application Hang | ID = 1001
Description = Fault bucket -1097741192.

Error - 08.1.2013 г. 09:46:29 | Computer Name = PHENOMENON | Source = Application Hang | ID = 1001
Description = Fault bucket -1097741192.

Error - 08.1.2013 г. 13:01:48 | Computer Name = PHENOMENON | Source = Application Hang | ID = 1002
Description = Hanging application bsplayer.exe, version 2.6.3.1071, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 08.1.2013 г. 13:01:50 | Computer Name = PHENOMENON | Source = Application Hang | ID = 1002
Description = Hanging application bsplayer.exe, version 2.6.3.1071, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 09.1.2013 г. 10:17:56 | Computer Name = PHENOMENON | Source = Application Hang | ID = 1002
Description = Hanging application bsplayer.exe, version 2.6.3.1071, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 10.1.2013 г. 19:06:55 | Computer Name = PHENOMENON | Source = Application Hang | ID = 1002
Description = Hanging application bsplayer.exe, version 2.6.3.1071, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 10.1.2013 г. 19:07:00 | Computer Name = PHENOMENON | Source = Application Hang | ID = 1001
Description = Fault bucket -1097741192.

Error - 12.1.2013 г. 02:16:11 | Computer Name = PHENOMENON | Source = Application Hang | ID = 1002
Description = Hanging application explorer.exe, version 6.0.2900.5512, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 12.1.2013 г. 05:56:30 | Computer Name = PHENOMENON | Source = Application Hang | ID = 1002
Description = Hanging application bsplayer.exe, version 2.6.3.1071, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

[ System Events ]
Error - 05.1.2013 г. 07:47:33 | Computer Name = PHENOMENON | Source = System Error | ID = 1003
Description = Error code 1000008e, parameter1 80000004, parameter2 806edae1, parameter3
a5a18540, parameter4 00000000.

Error - 09.1.2013 г. 08:33:43 | Computer Name = PHENOMENON | Source = Service Control Manager | ID = 7034
Description = The MBAMService service terminated unexpectedly. It has done this
1 time(s).

Error - 12.1.2013 г. 03:04:03 | Computer Name = PHENOMENON | Source = Service Control Manager | ID = 7031
Description = The TeamViewer 8 service terminated unexpectedly. It has done this
1 time(s). The following corrective action will be taken in 2000 milliseconds:
Restart the service.

Error - 12.1.2013 г. 08:24:48 | Computer Name = PHENOMENON | Source = sr | ID = 1
Description = The System Restore filter encountered the unexpected error '0xC0000001'
while processing the file '' on the volume 'HarddiskVolume1'. It has stopped monitoring
the volume.

< End of report >

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

12 януари 201313 г.

Здравейте отново..!Нищо притеснително от зловреден характер..!

Стартирайте отново OTL, копирайте (Copy) и поставете (Paste) скриптовия текст от текстовото поле по-долу под колонката Custom Scans/Fixes, като не забравяте да копирате скрипта 1 към 1, както и двете точки преди първия ред на скрипта.

:OTL@Alternate Data Stream - 173 bytes -> C:Documents and SettingsAll UsersApplication DataTEMP:F8B88761:filesautorun.inf /alldrivesrecycler /alldrivesipconfig /flushdns /c:Commands[purity][emptytemp][resethosts][clearallrestorepoints][Reboot]

След като въведете скрипта от цитата по-горе натиснете бутона, маркиран в червено: Run Fix
Windows ще се рестартира и ще се създаде лог файл. Публикувайте съдържанието му с Copy/Paste в следващия си коментар.

12 януари 201313 г.

Автор

Опитах да го направя това и заби компа много жестоко че чак се наложи от тока да го изключа

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

12 януари 201313 г.

Той не е забил компютъра,ами вие все бързате и не оставяте програмата да си свърши работата..Както и да е ...системата е чиста.....!

Изтеглете програмата: ESET Online Scanner

Стартирайте esetsmartinstaller_enu.exe
Сложете отметка на YES, I accept the Terms of Use и изберете Start:
Скенерът ще започне да изтегля компонентите, които са му необходими:

Уверете се, че е премахната отметката от:

Remove found threats

Уверете се че са маркирани следните позиции:

Scan Archives

Кликнете върху Advanced Settings и маркирайте следните опции:

Scan for potentially unwanted applications
Scan for potentially unsafe applications
Enable Anti-Stealth Technology

Накрая изберете Start

Скенерът ще започне да изтегля последните дефиниции.
След, като сканирането завърши изберете Finish.
Отидете в: C:Program FilesESET ESET Online Scanner
Отворете файла log.txt , копирайте съдържанието му и го поставете в следващия си коментар.

И след това:

Изтеглете този инструмент - Windows Repair All in one
Инсталирайте приложението и го стартирайте.

От стъпка 2 => стартирайте Check Disk

От стъпка 3 => стартирайте SFC

от Start Repairs натиснете Start и оттук вече сложете всички отметки показани на снимката:

Сложете отметка пред restart system when finished и натиснете Start.

Архивирана тема

Темата е твърде стара и е архивирана. Не можете да добавяте нови отговори в нея, но винаги можете да публикувате нова тема, в която да продължи дискусията. Регистрирайте се или влезте във вашия профил за да публикувате нова тема.