Премини към съдържанието
Форумът в приложение

По-лесно сърфиране. Научи повече.
Kaldata.com - Форуми

Приложение на форума на цял екран с push известия, значки и други.

За да инсталирате това приложение на iOS и iPadOS
  1. Докоснете Иконата за споделяне в Safari
  2. Превъртете менюто и докоснете Добавяне към началния екран.
  3. Докоснете Добавяне в горния десен ъгъл.
За да инсталирате това приложение на Android
  1. Докоснете менюто с 3 точки (⋮) в горния десен ъгъл на браузъра.
  2. Докоснете Добавяне към началния екран или Инсталиране на приложение.
  3. Потвърдете, като докоснете Инсталиране.
Добави Kaldata.com в предпочитани източници в Google

Добре дошли!

Добре дошли в нашите форуми, пълни с полезна информация. Имате проблем с компютъра или телефона си? Публикувайте нова тема и ще намерите решение на всичките си проблеми. Общувайте свободно и открийте безброй нови приятели.

Моля, регистрирайте се за да публикувате тема и да получите пълен достъп до всички функции.

 

Проблем със Facebook профил

overwhelmii
в Facebook - проблеми, въпроси, вируси

Featured Replies

Здравейте,

Днес малко по-рано към 21:45 някой проникна в профила ми и започна да пише всякакви простотии на приятели.Естествено веднага аз си смених паролата.Има ли някакъв начин да предотвратя това да няма повтаряне на случката.И най-важното да проверя логовете в профила ми IP address.Ако може да дадете нещо да тествам машинката.Никога не съм запаметявал паролата на чужд компютър.Паролата беше 10цифри.На email беше различна също.

Редактирано от overwhelmii (преглед на промените)

и като му разбереш ip-то какво следва

Зависи от ISP-то и нивото на компетентност на задмониторното устройство (потребителя). Основните потребители могат да разберат горе-долу къде се намира личността зад това IP чрез сервизи като utrace. Пак зависи от вида IP (статичен или динамичен адрес). Вече ако вдигнем нивото на знания на потребителя, IP адреса може да се разглежда като врата към системата ти. Преди време на по старите операционни системи (XP и преди това) имаше сериозни дупки в сервизи като "telnet" с които можеше да получиш неоторизиран достъп до дадена машина. Сега с последни патчове и прочие такива неща стават доста по-трудни, като въпросното влизане на 99 % става само със съгласие от домакина (оторизирано). Още по-напреднал потребител или "Script kiddie" с правилен софтуер може да постигне DDOS атака. Обаче такова нещо постигнато само от една машина изискват доста скилове. Освен това също напреднал потребител може да успее да прихване пакети от информация изпратени от това IP. Говорим за пароли и всякакви такива. Ако не са криптирани. Обаче в днешно време почти всички сайтове за банки и прочие използват https именно поради тази причина. А сега за проблема с facebook : Преди време дори имаше един софтуер специално за този сайт с който, ако си на публичен wi-fi можеш да "снъфваш" за пакети изпратени от др потребители и да им крадеш лични данни. Но както казах беше отдавна, а и трябва да си в тази мрежа. Сега facebook също е с HTTP Secure. Как точно някой се е логнал едва ли ще разберем. При 80% от случаите това са някакви познати, които са ти намерили паролата някъде. Ако си влизал в профила си от компютъра на приятел и той е имал "кейлогър" - няма какво повече да говорим. И последно, от към защита facebook е дори на много добро ниво. Все едно пари имаш в него. Обаче явно някой хора си взимат имагинерното лично виртуално пространство на сериозно, така че това идва желана мярка. Може да ограничиш устройствата които се логват към профила ти и така само от твоята машина да влизаш. Може да сложиш известия, ако някой др се опита да влезе от друго място. Може да въведеш номера си и да се логваш всеки път със специфичен код изпратен на смс. Изобщо само защита да искаш. Всичко това го има в меню настройки - поверителност. Къде точно няма да обяснявам, по нета е пълно със статии. П.П. И накрая най-забавното. Ако имаш статичен IP адрес на някой, може да провериш какви публични торенти е свалял и кога. 99% винаги са порно :D

Редактирано от An0n (преглед на промените)

Здравейте,

.Ако може да дадете нещо да тествам машинката.....

 

 

Здравейте...! :) Да опитаме с това: http://www.kaldata.com/forums/topic/132819-%D1%81%D0%B8%D1%81%D1%82%D0%B5%D0%BC%D0%B0%D1%82%D0%B0-%D0%BC%D0%B8-%D0%B5-%D0%B8%D0%BD%D1%84%D0%B5%D0%BA%D1%82%D0%B8%D1%80%D0%B0%D0%BD%D0%B0-%D0%BA%D0%B0%D0%BA%D0%B2%D0%BE-%D0%B4%D0%B0-%D0%BF%D1%80%D0%B0%D0%B2%D1%8F-%D1%81%D0%B5%D0%B3%D0%B0/]Системата ми е инфектирана - Какво да правя сега?

  • Автор

 Това е информацията от DDS :

DDS (Ver_2011-09-30.01) - NTFS_x86 Internet Explorer: 7.0.5730.13  BrowserJavaVersion: 10.15.2 Run by ih at 11:24:04 on 2013-02-24 Microsoft Windows XP Professional  5.1.2600.3.1251.1.1033.18.2047.1249 [GMT 2:00] . FW: COMODO Firewall *Enabled* . ============== Running Processes ================ . C:Documents and SettingsihMy DocumentsMSDCSCmsdcsc.exe C:WINDOWSExplorer.EXE C:WINDOWSsystem32notepad.exe C:WINDOWSsystem32spoolsv.exe C:WINDOWSexplorer.exe c:xamppapachebinhttpd.exe C:Program FilesJavajre7binjqs.exe C:Program FilesNVIDIA CorporationnTunenTuneService.exe C:WINDOWSsystem32nvsvc32.exe C:Program FilesNVIDIA CorporationNVIDIA Update Coredaemonu.exe C:Program FilesCommon FilesVMwareUSBvmware-usbarbitrator.exe C:Program FilesMozilla Firefoxfirefox.exe C:xamppapachebinhttpd.exe C:Program FilesVMwareVMware Workstationvmware-authd.exe C:Documents and SettingsAll UsersApplication DataBetterSoftOptimizerProOptimizerPro.exe C:WINDOWSSystem32alg.exe C:WINDOWSRTHDCPL.EXE C:WINDOWSVM_STI.EXE C:PROGRA~1MARINE~2bar1.bin57srchmn.exe C:Program FilesCommon FilesJavaJava Updatejusched.exe C:Program FilesSkypePhoneSkype.exe C:WINDOWSsystem32ctfmon.exe C:Program FilesMozilla Firefoxfirefox.exe C:Program FilesSkypePlugin ManagerskypePM.exe C:Program FilesMozilla Firefoxplugin-container.exe C:WINDOWSsystem32wbemwmiprvse.exe C:WINDOWSSystem32svchost.exe -k netsvcs C:WINDOWSsystem32svchost.exe -k NetworkService C:WINDOWSsystem32svchost.exe -k LocalService C:WINDOWSsystem32svchost.exe -k LocalService C:WINDOWSsystem32svchost.exe -k imgsvc . ============== Pseudo HJT Report =============== . uStart Page = hxxp://blekko.com/ws/?source=5f97ddbe&tbp=homepage&u=20ed2233000000000000b0487a947e65 mStart Page = hxxp://websearch.pu-results.info/?pid=377&r=2013/02/21&hid=2283671635&lg=EN&cc=BG mSearchAssistant = ${SEARCH_URL_IE7} uURLSearchHooks: SweetIM ToolbarURLSearchHook Class: {EEE6C35D-6118-11DC-9C72-001320C79847} - mWinlogon: Userinit = c:windowssystem32userinit.exe,c:documents and settingsihmy documentsmsdcscmsdcsc.exe BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:program filescommon filesadobeacrobatactivexAcroIEHelperShim.dll BHO: Browse2save: {43F1B789-E42F-B3A4-2310-1D1D5612778F} - c:documents and settingsall usersapplication databrowse2save512648e1f1b6a.dll BHO: Search-NewTab: {59B591F2-F892-F531-029A-68CA7C314684} - c:documents and settingsall usersapplication datasearch-newtab5126495d72822.dll BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:program filesjavajre7binssv.dll BHO: Blekko Search Bar Helper Object: {BAE35237-8D73-44D0-905C-8A95EA1E7E69} - c:program filesblekkospamfreesearch1.8.3.9bhspamfreesearch.dll BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:program filesjavajre7binjp2ssv.dll BHO: SweetPacks Browser Helper: {EEE6C35C-6118-11DC-9C72-001320C79847} - BHO: smartdownloader Class: {F1AF26F8-1828-4279-ABCE-074EF3235BD7} - TB: SweetPacks Toolbar for Internet Explorer: {EEE6C35B-6118-11DC-9C72-001320C79847} - TB: SweetPacks Toolbar for Internet Explorer: {EEE6C35B-6118-11DC-9C72-001320C79847} - TB: Blekko Search Bar Toolbar: {EECF410C-006C-4A05-AD13-6741A0814DBF} - c:program filesblekkospamfreesearch1.8.3.9spamfreesearchTlbr.dll uRun: [skype] "c:program filesskypephoneSkype.exe" /nosplash /minimized uRun: [MicroUpdate] c:documents and settingsihmy documentsmsdcscmsdcsc.exe uRun: [NVIDIA nTune] "c:program filesnvidia corporationntunenTuneCmd.exe" clear uRun: [ctfmon.exe] c:windowssystem32ctfmon.exe uRun: [Facebook Update] "c:documents and settingsihlocal settingsapplication datafacebookupdateFacebookUpdate.exe" /c /nocrashserver uRun: [MSMSGS] "c:program filesmessengermsmsgs.exe" /background uRun: [Free Hide IP] c:program filesfreehideipFreeHideIP.exe uRun: [Optimizer Pro] c:program filesoptimizer proOptProLauncher.exe mRun: [RTHDCPL] RTHDCPL.EXE mRun: [NvCplDaemon] RUNDLL32.EXE c:windowssystem32NvCpl.dll,NvStartup mRun: [bigDogPath] c:windowsVM_STI.EXE VIMICRO USB PC Camera mRun: [Marine Aquarium Lite Search Scope Monitor] "c:progra~1marine~2bar1.bin57srchmn.exe" /m=2 /w /h mRun: [sunJavaUpdateSched] "c:program filescommon filesjavajava updatejusched.exe" mRunOnce: [WIAWizardMenu] RUNDLL32.EXE c:windowssystem32sti_ci.dll,WiaCreateWizardMenu dRun: [CTFMON.EXE] c:windowssystem32ctfmon.exe dRunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 uExplorerRun: [Policies] c:windowssystem32installserver.exe uExplorerRun: [Policies] c:windowssystem32installserver.exe uExplorerRun: [MMAT] c:windowssystem32odfox32I.exe StartupFolder: c:docume~1ihstartm~1programsstartupfacebo~1.lnk - c:documents and settingsihlocal settingsapplication datafacebookmessenger2.1.4651.0FacebookMessenger.exe StartupFolder: c:documents and settingsihstart menuprogramsstartupserver.exe uPolicies-Explorer: NoDriveTypeAutoRun = dword:145 uPolicies-System: DisableRegistryTools = dword:1 uPolicies-System: DisableTaskMgr = dword:1 mPolicies-Explorer: NoDriveTypeAutoRun = dword:255 mPolicies-Explorer: NoDriveTypeAutoRun = dword:145 IE: E&xport to Microsoft Excel - c:progra~1micros~3office11EXCEL.EXE/3000 IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%Network Diagnosticxpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:program filesmessengermsmsgs.exe DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab TCP: NameServer = 192.168.1.1 TCP: Interfaces{4BB4C3AC-9218-4829-B21B-C305E1B4D43B} : NameServer = 8.26.56.26,156.154.70.22 TCP: Interfaces{4BB4C3AC-9218-4829-B21B-C305E1B4D43B} : DHCPNameServer = 192.168.1.1 Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:program filescommon filesskypeSkype4COM.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:windowssystem32wpdshserviceobj.dll mASetup: {AVE674RB-4QG4-R27S-1V6D-1IO0D3267OE2} - c:windowssystem32installserver.exe Hosts: 255.255.255.255 easyanticheat.se # misleading site Hosts: 255.255.255.255 www.easyanticheat.se # misleading site Hosts: 255.255.255.255 easyanticheat.com # misleading site Hosts: 255.255.255.255 www.easyanticheat.com # misleading site Hosts: 255.255.255.255   easyanticheat.info   # misleading site . Note: multiple HOSTS entries found. Please refer to Attach.txt . ================= FIREFOX =================== . FF - ProfilePath - c:documents and settingsihapplication datamozillafirefoxprofilesm23axj0l.default FF - prefs.js: browser.search.defaulturl - hxxp://websearch.pu-results.info/?pid=377&r=2013/02/21&hid=2283671635&lg=EN&cc=BG&l=1&q= FF - prefs.js: browser.search.selectedEngine - Google SSL FF - prefs.js: browser.startup.homepage - hxxp://home.mywebsearch.com/index.jhtml?ptb=2A1DB8A7-5369-4FE3-8714-45206D91E8BB&n=77fc45a4&p2=^0D^xdm060^YY^bg&si=275192 FF - prefs.js: keyword.URL - hxxp://search.mywebsearch.com/mywebsearch/GGmain.jhtml?st=kwd&ptb=2A1DB8A7-5369-4FE3-8714-45206D91E8BB&n=77fc45a4&ind=2013021604&p2=^0D^xdm060^YY^bg&si=275192&searchfor= FF - plugin: c:program filesadobereader 11.0readerairnppdf32.dll FF - plugin: c:program filesjavajre7binplugin2npjp2.dll FF - plugin: c:program filesmarineaquarium3free_57bar1.binNP57Stub.dll FF - plugin: c:windowssystem32macromedflashNPSWF32_11_5_502_149.dll FF - plugin: c:windowssystem32npDeployJava1.dll FF - plugin: c:windowssystem32npptools.dll . ---- FIREFOX POLICIES ---- FF - user.js: extensions.spamfreesearch.autoRvrt - false FF - user.js: extensions.spamfreesearch_i.hmpg - true FF - user.js: extensions.spamfreesearch.hmpgUrl - hxxp://blekko.com/ws/?source=5f97ddbe&tbp=homepage&u=20ed2233000000000000b0487a947e65 FF - user.js: extensions.spamfreesearch.dfltSrch - true FF - user.js: extensions.spamfreesearch.srchPrvdr - blekko FF - user.js: extensions.spamfreesearch.keyWordUrl - hxxp://blekko.com/ws/?source=5f97ddbe&tbp=rbox&u=20ed2233000000000000b0487a947e65&q= FF - user.js: extensions.spamfreesearch_i.dnsErr - true FF - user.js: extensions.spamfreesearch_i.newTab - true FF - user.js: extensions.spamfreesearch.newTabUrl - chrome://spamfreesearch/content/new browser tab.html?source=5f97ddbe&tbp=tab&u=20ed2233000000000000b0487a947e65 FF - user.js: extensions.spamfreesearch.tlbrSrchUrl - hxxp://blekko.com/ws/?source=5f97ddbe&tbp=main&u=20ed2233000000000000b0487a947e65&q= FF - user.js: extensions.spamfreesearch.id - 20ed2233000000000000b0487a947e65 FF - user.js: extensions.spamfreesearch.appId - {1005247F-A178-490A-8DC3-6BAF09EA427B} FF - user.js: extensions.spamfreesearch.instlDay - 15758 FF - user.js: extensions.spamfreesearch.vrsn - 1.8.3.9 FF - user.js: extensions.spamfreesearch.vrsni - 1.8.3.9 FF - user.js: extensions.spamfreesearch_i.vrsnTs - 1.8.3.913:52:56 FF - user.js: extensions.spamfreesearch.prtnrId - blekko FF - user.js: extensions.spamfreesearch.prdct - spamfreesearch FF - user.js: extensions.spamfreesearch.aflt - orgnl FF - user.js: extensions.spamfreesearch_i.smplGrp - none FF - user.js: extensions.spamfreesearch.tlbrId - base FF - user.js: extensions.spamfreesearch.instlRef - 5f97ddbe FF - user.js: extensions.spamfreesearch.dfltLng - FF - user.js: extensions.spamfreesearch.excTlbr - false FF - user.js: extensions.spamfreesearch.admin - false . ============= SERVICES / DRIVERS =============== . R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:windowssystem32driversdtsoftbus01.sys [2012-11-9 242240] R2 Apache2.4;Apache2.4;c:xamppapachebinhttpd.exe [2012-8-18 22016] R2 nvUpdatusService;NVIDIA Update Service Daemon;c:program filesnvidia corporationnvidia update coredaemonu.exe [2012-12-2 1258856] R2 vmci;VMware vmci;c:windowssystem32driversvmci.sys [2011-3-25 70768] R2 VMUSBArbService;VMware USB Arbitration Service;c:program filescommon filesvmwareusbvmware-usbarbitrator.exe [2011-3-25 539248] R3 AR9271;Wireless Network Adapter Service;c:windowssystem32driversathuw.sys [2012-11-8 1763584] R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:windowssystem32driversnvhda32.sys [2012-12-2 124264] R3 VCSVADHWSer;Avnex Virtual Audio Device (WDM);c:windowssystem32driversvcsvad.sys [2012-12-29 17792] S2 MarineAquarium3Free_57Service;Marine Aquarium LiteService;c:progra~1marine~2bar1.bin57barsvc.exe [2013-2-16 42504] S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:windowssystem32macromedflashFlashPlayerUpdateService.exe [2013-1-14 251248] S3 MozillaMaintenance;Mozilla Maintenance Service;c:program filesmozilla maintenance servicemaintenanceservice.exe [2012-12-1 115608] S3 ZSMC302;VIMICRO USB PC Camera;c:windowssystem32driversusbVM31b.sys [2013-1-13 90568] S4 Apache2.2;Apache2.2;c:xamppapachebinhttpd.exe [2012-8-18 22016] . =============== Created Last 30 ================ . 2013-02-23 00:21:26  143872  ----a-w-  c:windowssystem32javacpl.cpl 2013-02-23 00:21:18  94112  ----a-w-  c:windowssystem32WindowsAccessBridge.dll 2013-02-22 11:59:00  --------  d-----w-  c:program filesFinalWire 2013-02-22 11:52:54  --------  d-----w-  c:program filesblekko 2013-02-21 16:23:32  36  ----a-w-  c:documents and settingsihapplication dataflood.bat 2013-02-21 15:52:21  --------  d-----w-  c:documents and settingsall usersapplication dataSoftSafe 2013-02-21 15:52:11  --------  d-----w-  c:documents and settingsall usersapplication dataSearch-NewTab 2013-02-21 15:52:08  --------  d-----w-  c:program filesWebSearch 2013-02-21 15:51:35  --------  d-----w-  c:documents and settingsall usersapplication dataBetterSoft 2013-02-21 15:51:21  --------  d-----w-  c:program filesOptimizer Pro 2013-02-21 15:50:52  --------  d-----w-  c:program filesBrowseToSave 2013-02-20 16:10:38  --------  d-----w-  c:documents and settingsihlocal settingsapplication dataWMTools Downloaded Files 2013-02-20 15:48:31  --------  d-----w-  c:documents and settingsall usersDocuments 2013-02-20 15:03:19  --------  d-----w-  c:program filesVirtualDJ 2013-02-18 19:02:55  --------  d-----w-  c:documents and settingsall usersapplication dataphpDesigner 2013-02-17 16:15:44  77824  ----a-w-  c:program filescommon filesinstallshieldengine6intel 32ctor.dll 2013-02-17 16:15:44  32768  ----a-w-  c:program filescommon filesinstallshieldengine6intel 32objectps.dll 2013-02-17 16:15:44  225280  ----a-w-  c:program filescommon filesinstallshieldiscriptiscript.dll 2013-02-17 16:15:44  176128  ----a-w-  c:program filescommon filesinstallshieldengine6intel 32iuser.dll 2013-02-17 16:15:43  610436  ----a-w-  c:program filescommon filesinstallshieldengine6intel 32IKernel.exe 2013-02-16 03:56:14  --------  d-----w-  c:documents and settingsall usersapplication dataRegClean 2013-02-16 03:55:58  --------  d-----w-  c:documents and settingsihlocal settingsapplication dataPackageAware 2013-02-16 03:36:51  --------  d-----w-  c:documents and settingsihapplication dataMarine Aquarium Lite 2013-02-16 02:41:43  6037504  ----a-w-  c:windowssystem32MarineAquariumLite.scr 2013-02-16 02:41:43  --------  d-----w-  c:program filesSereneScreen 2013-02-16 02:41:27  --------  d-----w-  c:documents and settingsihapplication dataMarineAquarium3Free_57 2013-02-16 02:41:22  --------  d-----w-  c:program filesMarineAquarium3Free_57 2013-02-12 11:21:00  --------  d-----w-  c:documents and settingsihlocal settingsapplication dataHelp 2013-02-11 03:36:27  --------  d-----w-  c:documents and settingsihlocal settingsapplication dataFVPN 2013-02-09 15:31:09  61493  ----a-w-  c:windowssystem32MFCN42D.DLL 2013-02-09 15:31:09  434252  ----a-w-  c:windowssystem32MSVCRTD.DLL 2013-02-09 15:31:08  962612  ----a-w-  c:windowssystem32MFC42D.DLL 2013-02-09 15:31:05  137000  ----a-w-  c:windowssystem32MSMAPI32.OCX 2013-02-09 15:31:05  114688  ----a-w-  c:windowssystem32CCGNU32.dll 2013-02-09 15:31:02  544768  ----a-w-  c:windowssystem32msvcr71d.dll 2013-02-09 15:31:01  81920  ----a-w-  c:windowssystem32msado25.tlb 2013-02-09 15:31:01  10752  ----a-w-  c:windowssystem32aamd532.dll 2013-02-09 15:31:01  103744  ----a-w-  c:windowssystem32MSCOMM32.OCX 2013-02-09 15:31:01  1009336  ----a-w-  c:windowssystem32mschrt20.ocx 2013-02-09 15:30:59  939224  ----a-w-  c:windowssystem32Flash.ocx 2013-02-09 15:30:59  61440  ----a-w-  c:windowssystem32msado20.tlb 2013-02-09 15:30:59  608448  ----a-w-  c:windowssystem32comctl32.ocx 2013-02-09 15:30:59  59904  ----a-w-  c:windowssystem32wbemdisp.tlb 2013-02-09 15:30:59  561179  ----a-w-  c:windowssystem32dao360.dll 2013-02-09 15:30:59  299008  ----a-w-  c:windowssystem32MSDBRPTR.DLL 2013-02-09 15:30:59  209608  ----a-w-  c:windowssystem32tabctl32.ocx 2013-02-09 15:30:59  164144  ----a-w-  c:windowssystem32comct232.ocx 2013-02-09 15:30:59  137216  ----a-w-  c:windowssystem32MSDERUN.DLL 2013-02-09 15:30:59  115920  ----a-w-  c:windowssystem32MSINET.ocx 2013-02-07 21:59:17  --------  d-----w-  c:program filesMicrosoft ActiveSync 2013-02-07 21:59:02  --------  d-----w-  c:windowsSHELLNEW 2013-02-07 08:40:04  --------  d-----w-  c:documents and settingsihlocal settingsapplication dataGoogle 2013-02-07 08:40:04  --------  d-----w-  c:documents and settingsall usersapplication dataBrowse2save 2013-02-07 08:39:41  --------  d-----w-  c:documents and settingsall usersapplication dataInstallMate 2013-02-06 20:05:31  --------  d-----w-  c:documents and settingsihapplication dataPunkBuster 2013-02-06 15:45:32  --------  d-----w-  c:program filesMozilla Firefox.bak 2013-02-05 13:36:00  145920  --sha-r-  c:windowssystem32odfox32I.exe 2013-02-04 22:42:10  279599  ----a-w-  c:documents and settingsihapplication datafuckme.exe 2013-02-04 20:37:51  422279  ----a-w-  c:documents and settingsihapplication datawifi password hack.exe 2013-02-02 01:36:17  --------  d-----w-  c:documents and settingsihlocal settingsapplication dataVMware 2013-02-02 01:12:16  --------  d-----w-  c:documents and settingsihapplication dataMagic Stones 2013-02-02 01:02:50  --------  d-----w-  c:documents and settingsihapplication dataFreeHideIP 2013-02-02 01:02:50  --------  d-----w-  c:documents and settingsall usersapplication dataFreeHideIP 2013-02-01 23:06:53  107888  ----a-w-  c:windowssystem32CmdLineExt.dll 2013-02-01 23:05:16  22328  ----a-w-  c:documents and settingsihapplication dataPnkBstrK.sys 2013-02-01 23:04:54  2250024  ----a-w-  c:windowssystem32pbsvc.exe 2013-02-01 22:47:59  --------  d-----w-  c:documents and settingsihapplication dataDAEMON Tools Lite 2013-02-01 22:47:58  --------  d-----w-  c:documents and settingsall usersapplication dataDAEMON Tools Lite 2013-02-01 19:39:29  --------  d-----w-  c:program filesSystemRequirementsLab 2013-01-28 21:35:41  615038  ----a-w-  c:documents and settingsihapplication dataServer.exe 2013-01-27 21:15:38  --------  d-----w-  c:program filesEvisoft . ==================== Find3M  ==================== . 2013-02-23 00:21:06  861088  ----a-w-  c:windowssystem32npDeployJava1.dll 2013-02-23 00:21:06  782240  ----a-w-  c:windowssystem32deployJava1.dll 2013-02-09 19:17:08  74096  ----a-w-  c:windowssystem32FlashPlayerCPLApp.cpl 2013-02-09 19:17:08  697712  ----a-w-  c:windowssystem32FlashPlayerApp.exe 2013-01-22 20:24:33  287760  ----a-w-  c:documents and settingsihapplication datammeeeeeeeeeeeeeeeeeeee.exe 2013-01-19 12:26:13  1102568  ----a-w-  c:windowssystem32nvdrsdb1.bin 2013-01-19 12:26:13  1  ----a-w-  c:windowssystem32nvdrssel.bin 2013-01-19 12:26:11  1102568  ----a-w-  c:windowssystem32nvdrsdb0.bin 2012-12-17 09:38:54  867344  ----a-w-  c:windowssystem32driversESLWireACD.sys . ============= FINISH: 11:24:38.61 ===============

 

______________________________________________________________________________________________

 

 

. UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2011-09-30.01) . Microsoft Windows XP Professional Boot Device: DeviceHarddiskVolume1 Install Date: 11/8/2012 12:29:33 AM System Uptime: 2/24/2013 11:16:13 AM (0 hours ago) . Motherboard: Gigabyte Technology Co., Ltd. |  | M61SME-S2 Processor: AMD Athlon 64 Processor 3000+ | Socket M2 | 2266/252mhz . ==== Disk Partitions ========================= . A: is Removable C: is FIXED (NTFS) - 24 GiB total, 4.554 GiB free. D: is FIXED (NTFS) - 125 GiB total, 13.411 GiB free. F: is CDROM () . ==== Disabled Device Manager Items ============= . Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318} Description: SM Bus Controller Device ID: PCIVEN_10DE&DEV_03EB&SUBSYS_0C111458&REV_A23&2411E6FE&0&09 Manufacturer: Name: SM Bus Controller PNP Device ID: PCIVEN_10DE&DEV_03EB&SUBSYS_0C111458&REV_A23&2411E6FE&0&09 Service: . Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318} Description: Other PCI Bridge Device Device ID: PCIVEN_10DE&DEV_03EF&SUBSYS_E0001458&REV_A23&2411E6FE&0&38 Manufacturer: Name: Other PCI Bridge Device PNP Device ID: PCIVEN_10DE&DEV_03EF&SUBSYS_E0001458&REV_A23&2411E6FE&0&38 Service: . Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318} Description: VMware Virtual Ethernet Adapter for VMnet1 Device ID: ROOTVMWARE0000 Manufacturer: VMware, Inc. Name: VMware Virtual Ethernet Adapter for VMnet1 PNP Device ID: ROOTVMWARE0000 Service: VMnetAdapter . Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318} Description: VMware Virtual Ethernet Adapter for VMnet8 Device ID: ROOTVMWARE0001 Manufacturer: VMware, Inc. Name: VMware Virtual Ethernet Adapter for VMnet8 PNP Device ID: ROOTVMWARE0001 Service: VMnetAdapter . ==== System Restore Points =================== . RP16: 2/15/2013 3:04:41 PM - Removed System Requirements Lab Detection RP17: 2/15/2013 3:05:18 PM - Removed Ubisoft Game Launcher RP18: 2/16/2013 3:21:33 AM - Removed Microsoft Office Excel Viewer RP19: 2/16/2013 3:22:23 AM - Removed Microsoft Office PowerPoint Viewer 2003 RP20: 2/16/2013 3:22:59 AM - Removed Microsoft Office PowerPoint Viewer 2007 (English) RP21: 2/16/2013 3:25:57 AM - Removed Microsoft Office Word Viewer 2003 RP22: 2/16/2013 3:27:10 AM - Removed inSSIDer RP23: 2/17/2013 3:36:57 AM - Контролна точка на системата RP24: 2/17/2013 6:15:59 PM - Installed Cabela's 4x4 Off-Road Adventure  2 RP25: 2/19/2013 3:23:17 AM - Контролна точка на системата RP26: 2/20/2013 5:03:17 PM - Installed VirtualDJ Home FREE RP27: 2/22/2013 1:55:22 AM - Контролна точка на системата RP28: 2/23/2013 2:20:43 AM - Removed Java 7 Update 9 RP29: 2/23/2013 2:21:00 AM - Installed Java 7 Update 15 . ==== Hosts File Hijack ====================== . Hosts: 255.255.255.255   easyanticheat.se   # misleading site Hosts: 255.255.255.255   www.easyanticheat.se   # misleading site Hosts: 255.255.255.255   easyanticheat.com   # misleading site Hosts: 255.255.255.255   www.easyanticheat.com   # misleading site Hosts: 255.255.255.255   easyanticheat.info   # misleading site Hosts: 255.255.255.255   www.easyanticheat.info   # misleading site Hosts: 255.255.255.255   easyanticheat.org   # misleading site Hosts: 255.255.255.255   www.easyanticheat.org   # misleading site . ==== Installed Programs ====================== . 18 WoS Extreme Trucker 2 (v.1.0) A-Mac Address Change 5.2 Adobe Flash Player 11 ActiveX Adobe Flash Player 11 Plugin Adobe Reader XI AIDA64 Extreme Edition v2.80 Assassin's Creed Revelations 1.03 Blekko Search Bar Browse2save BrowseToSave 1.74 Cabela's 4x4 Off-Road Adventure  2 Call of Duty: Black Ops II - Multiplayer Counter-Strike Counter-Strike Global Offensive Counter-Strike: Global Offensive DAEMON Tools Lite Facebook Messenger 2.1.4651.0 Far Cry 2 FlexType 2K GOM Player Hotfix for Windows Media Format 11 SDK (KB929399) Hotfix for Windows Media Player 11 (KB939683) Hotfix for Windows XP (KB970653-v3) Java 7 Update 15 Java Auto Updater Marine Aquarium Lite Toolbar Microfit for Windows Microsoft .NET Framework 2.0 Service Pack 2 Microsoft .NET Framework 3.0 Service Pack 1 Microsoft .NET Framework 3.5 Microsoft Office Professional Edition 2003 Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 Mozilla Firefox 17.0.1 (x86 bg) Mozilla Maintenance Service MSXML 6.0 Parser (KB925673) NetBeans IDE 7.2.1 Notepad++ NVIDIA Control Panel 306.81 NVIDIA Graphics Driver 306.81 NVIDIA HD Audio Driver 1.3.18.0 NVIDIA Install Application NVIDIA nTune NVIDIA nView 136.28 NVIDIA PhysX NVIDIA PhysX System Software 9.12.0604 NVIDIA Update 1.10.8 NVIDIA Update Components Optimizer Pro v3.0 OptimizerPro Realtek High Definition Audio Driver Search-NewTab Search Assistant WebSearch 1.74 Security Update for Windows Internet Explorer 7 (KB2559049) Security Update for Windows Internet Explorer 7 (KB938127-v2) Security Update for Windows Internet Explorer 7 (KB958215) Security Update for Windows Media Player 11 (KB936782) Security Update for Windows Media Player 11 (KB954154) Security Update for Windows XP (KB2347290) Security Update for Windows XP (KB2624667) Security Update for Windows XP (KB2719985) Security Update for Windows XP (KB2731847-v2) Security Update for Windows XP (KB923789) Security Update for Windows XP (KB938464) Security Update for Windows XP (KB941569) Security Update for Windows XP (KB953839) Security Update for Windows XP (KB956391) Security Update for Windows XP (KB956572) Security Update for Windows XP (KB971486) Security Update for Windows XP (KB978601) Security Update for Windows XP (KB979309) SereneScreen Marine Aquarium Lite Skype™ 3.8 Steam swMSM System Requirements Lab CYRI TeamSpeak 3 Client TL-WN721N/TL-WN722N Driver tools-freebsd tools-linux tools-netware tools-solaris tools-windows tools-winPre2k TrackerPro 1.0 TuneUp Utilities Language Pack (en-US) Update for Windows XP (KB955839) Update for Windows XP (KB973815) Ventrilo Client Vimicro USB PC Camera VirtualDJ Home FREE VMware Workstation WebFldrs XP Windows Media Player Firefox Plugin Windows Presentation Foundation WinRAR 4.20 (32-bit) XAMPP 1.8.1 XML Paper Specification Shared Components Pack 1.0 µTorrent . ==== Event Viewer Messages From Past Week ======== . 2/22/2013 2:31:16 PM, error: Server [2505]  - The server could not bind to the transport DeviceNetBT_Tcpip_{4BB4C3AC-9218-4829-B21B-C305E1B4D43B} because another computer on the network has the same name.  The server could not start. 2/21/2013 6:39:57 PM, error: Service Control Manager [7031]  - The VMware USB Arbitration Service service terminated unexpectedly.  It has done this 4 time(s).  The following corrective action will be taken in 10000 milliseconds: Restart the service. 2/21/2013 6:39:52 PM, error: Service Control Manager [7034]  - The DNS Client service terminated unexpectedly.  It has done this 1 time(s). 2/21/2013 6:16:45 PM, error: Service Control Manager [7031]  - The VMware USB Arbitration Service service terminated unexpectedly.  It has done this 3 time(s).  The following corrective action will be taken in 10000 milliseconds: Restart the service. 2/20/2013 9:15:54 PM, error: Service Control Manager [7009]  - Timeout (30000 milliseconds) waiting for the VMware Authorization Service service to connect. 2/20/2013 9:15:54 PM, error: Service Control Manager [7000]  - The VMware Authorization Service service failed to start due to the following error:  The service did not respond to the start or control request in a timely fashion. 2/19/2013 8:59:08 PM, error: Service Control Manager [7034]  - The Apache2.4 service terminated unexpectedly.  It has done this 1 time(s). 2/19/2013 8:59:05 PM, error: Service Control Manager [7034]  - The Java Quick Starter service terminated unexpectedly.  It has done this 1 time(s). 2/19/2013 8:59:00 PM, error: Service Control Manager [7034]  - The nTune Service service terminated unexpectedly.  It has done this 1 time(s). 2/19/2013 8:58:59 PM, error: Service Control Manager [7034]  - The VMware Authorization Service service terminated unexpectedly.  It has done this 1 time(s). 2/19/2013 8:58:57 PM, error: Service Control Manager [7031]  - The VMware USB Arbitration Service service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 10000 milliseconds: Restart the service. 2/19/2013 8:58:46 PM, error: Service Control Manager [7034]  - The Application Layer Gateway Service service terminated unexpectedly.  It has done this 1 time(s). 2/19/2013 8:53:25 PM, error: Dhcp [1001]  - Your computer was not assigned an address from the network (by the DHCP Server) for the Network Card with network address B0487A947E65.  The following error occurred:  The operation was canceled by the user. . Your computer will continue to try and obtain an address on its own from the network address (DHCP) server. 2/19/2013 1:42:31 PM, error: Service Control Manager [7034]  - The VMware NAT Service service terminated unexpectedly.  It has done this 1 time(s). 2/19/2013 1:41:02 PM, error: VMnetDHCP [2]  - Can't open C:Documents and SettingsAll UsersApplication DataVMwarevmnetdhcp.conf: The system cannot find the file specified.  / The system cannot find the file specified 2/19/2013 1:15:03 AM, error: Service Control Manager [7031]  - The VMware USB Arbitration Service service terminated unexpectedly.  It has done this 2 time(s).  The following corrective action will be taken in 10000 milliseconds: Restart the service. 2/19/2013 1:14:59 AM, error: Service Control Manager [7034]  - The NVIDIA Update Service Daemon service terminated unexpectedly.  It has done this 1 time(s). 2/19/2013 1:10:22 AM, error: Dhcp [1002]  - The IP address lease 192.168.1.101 for the Network Card with network address B0487A947E65 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message). 2/18/2013 2:54:30 PM, error: PSched [14101]  - QoS [Adapter {4BB4C3AC-9218-4829-B21B-C305E1B4D43B}]: The netcard driver failed the query for OID_GEN_MAXIMUM_FRAME_SIZE. 2/18/2013 2:53:59 PM, error: AR9271 [1]  - 2/18/2013 2:50:07 PM, error: Dhcp [1002]  - The IP address lease 192.168.1.2 for the Network Card with network address B0487A947E65 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message). 2/17/2013 8:40:52 PM, error: Dhcp [1002]  - The IP address lease 192.168.1.103 for the Network Card with network address B0487A947E65 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message). 2/17/2013 11:07:39 AM, error: atapi [9]  - The device, DeviceIdeIdePort3, did not respond within the timeout period. . ==== End Of File ===========================

За съжаление системата ви е заразена..Да продължим така:

Публикувано изображение Изтеглете ComboFix Публикувано изображение от тук и го запазете на десктопа си
Изключете вашата антивирусна и антишпионска програма, обикновено това става чрез натискане на десния бутон на мишката върху иконата на програма в системния трей.
Бележка: Ако не можете я спрете или не сте сигурни коя програма да изключите, моля прегледайте информацията от този линк: How to Disable your Security Programs


Стартирайте Combo-Fix.com Публикувано изображение и следвайте инструкциите.
Бележка: ComboFix ще се стартира без инсталирана Recovery Console.
Като част от неговата работа, ComboFix ще провери дали Microsoft Windows Recovery Console е инсталирана. Предвид бързо развиващия се зловреден софтуер е силно препоръчително да бъде инсталирана преди премахването на зловредния софтуер. Това ще Ви позволи да влезете в специален recovery/repai режим, който ще ни позволи по-лесно да решите проблем, който би могъл да възникне при премахване на зловредния софтуер.

  • [*]Следвайте инструкциите, за да позволите на
ComboFix да изтегли и инсталира Microsoft Windows Recovery Console.В един момент ще бъдете попитани дали сте съгласни с лицензното споразумение. Необходимо е да потвърдите, че сте съгласни, за да инсталирате Microsoft Windows Recovery Console.

** Забележете: Ако Microsoft Windows Recovery Console е вече инсталирана, ComboFix ще продължи към процеса по премахване на зловредния софтуер.

Публикувано изображение


След като Microsoft Windows Recovery Console е инсталирана, използвайки ComboFix, Вие ще видите следното съобщение:


Публикувано изображение


Изберете Yes, за да продължи сканирането за зловреден софтуер.
Когато процесът приключи успешно, инструментът ще създаде лог файл. Моля, включете съдържанието на C:ComboFix.txt в следващия Ви коментар в тази тема.

 


Бележка:

  • [*]Моля, не движете мишката, докато ComboFix работи. Това може да наруши процеса на работа. [*]ComboFix ще нулира всички настройки на
Microsoft Internet Explorer, включително да направи IE браузър по подразбиране. [*]ComboFix ще изключи autorun функцията на ВСИЧКИ CD, Floppy и USB устройства, за да помогне при премахването на зловредния софтуер и Ви защити от бъдещи вируси/заплахи, които поразява чрез autorun. Ако това е проблем за вас - моля, уведомете ме. [*]ComboFix ще изключи вашата интернет връзка. Интернет връзката ще се възстанови автоматично, преди ComboFix да завърши процеса на работа. При проблем, той ще прекрати интернет връзката. За да възстановите интернет връзката си, рестартирайте компютъра си. [*]В случай на проблем с ComboFix, той може да създаде лог файл. Моля, включете съдържанието на C:BUG.txt в следващия Ви коментар в тази тема.

Публикувано изображение Моля, не прикачвайте лог файла/овете от програмата, а го/ги копирайте и поставете в следващия Ви коментар в тази тема.

  • Автор

ComboFix 13-02-24.01 - ih 02/25/2013  17:04:42.1.1 - x86
Microsoft Windows XP Professional  5.1.2600.3.1251.1.1033.18.2047.1139 [GMT 2:00]
Running from: c:documents and settingsihDesktopComboFix.exe
FW: COMODO Firewall *Enabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:documents and settingsAll UsersApplication DataBrowse2save
c:documents and settingsAll UsersApplication DataBrowse2save511367b0bcc2f.dll
c:documents and settingsAll UsersApplication DataBrowse2save511367b0bcc2f.tlb
c:documents and settingsAll UsersApplication DataBrowse2save512648e1f1b6a.dll
c:documents and settingsAll UsersApplication DataBrowse2save512648e1f1b6a.tlb
c:documents and settingsAll UsersApplication DataBrowse2savesettings.ini
c:documents and settingsAll UsersApplication DataBrowse2saveuninstall.exe
c:documents and settingsAll UsersApplication DataTEMP
c:documents and settingsihApplication Datadclogs
c:documents and settingsihApplication Datadclogs2013-01-10-5.dc
c:documents and settingsihApplication Datadclogs2013-01-11-6.dc
c:documents and settingsihApplication Datadclogs2013-01-12-7.dc
c:documents and settingsihApplication Datadclogs2013-01-13-1.dc
c:documents and settingsihApplication Datadclogs2013-01-18-6.dc
c:documents and settingsihApplication Datadclogs2013-01-19-7.dc
c:documents and settingsihApplication Datadclogs2013-01-20-1.dc
c:documents and settingsihApplication Datadclogs2013-01-21-2.dc
c:documents and settingsihApplication Datadclogs2013-01-22-3.dc
c:documents and settingsihApplication Datadclogs2013-01-23-4.dc
c:documents and settingsihApplication Datadclogs2013-01-24-5.dc
c:documents and settingsihApplication Datadclogs2013-01-25-6.dc
c:documents and settingsihApplication Datadclogs2013-01-26-7.dc
c:documents and settingsihApplication Datadclogs2013-01-27-1.dc
c:documents and settingsihApplication Datadclogs2013-01-28-2.dc
c:documents and settingsihApplication Datadclogs2013-01-29-3.dc
c:documents and settingsihApplication Datadclogs2013-01-30-4.dc
c:documents and settingsihApplication Datadclogs2013-01-31-5.dc
c:documents and settingsihApplication Datadclogs2013-02-01-6.dc
c:documents and settingsihApplication Datadclogs2013-02-02-7.dc
c:documents and settingsihApplication Datadclogs2013-02-03-1.dc
c:documents and settingsihApplication Datadclogs2013-02-04-2.dc
c:documents and settingsihApplication Datadclogs2013-02-05-3.dc
c:documents and settingsihApplication Datadclogs2013-02-06-4.dc
c:documents and settingsihApplication Datadclogs2013-02-08-6.dc
c:documents and settingsihApplication Datadclogs2013-02-09-7.dc
c:documents and settingsihApplication Datadclogs2013-02-11-2.dc
c:documents and settingsihApplication Datadclogs2013-02-12-3.dc
c:documents and settingsihApplication Datadclogs2013-02-13-4.dc
c:documents and settingsihApplication Datadclogs2013-02-14-5.dc
c:documents and settingsihApplication Datadclogs2013-02-15-6.dc
c:documents and settingsihApplication Datadclogs2013-02-17-1.dc
c:documents and settingsihApplication Datadclogs2013-02-18-2.dc
c:documents and settingsihApplication Datadclogs2013-02-19-3.dc
c:documents and settingsihApplication Datadclogs2013-02-20-4.dc
c:documents and settingsihApplication Datadclogs2013-02-21-5.dc
c:documents and settingsihApplication Datadclogs2013-02-22-6.dc
c:documents and settingsihApplication Datadclogs2013-02-23-7.dc
c:documents and settingsihApplication Datadclogs2013-02-24-1.dc
c:documents and settingsihApplication Datadclogs2013-02-25-2.dc
c:documents and settingsihApplication Datafuckme.exe
c:documents and settingsihApplication Datammeeeeeeeeeeeeeeeeeeee.exe
c:documents and settingsihApplication DataServer.exe
c:documents and settingsihApplication Datawifi password hack.exe
c:documents and settingsihLocal SettingsTemporary Internet FilesApnStub.exe
c:windowssystem32install
c:windowssystem32installserver.exe
c:windowssystem32Packet.dll
c:windowssystem32pthreadVC.dll
c:windowssystem32wpcap.dll
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------Legacy_NPF
.
.
((((((((((((((((((((((((( Files Created from 2013-01-25 to 2013-02-25  )))))))))))))))))))))))))))))))
.
.
2013-02-23 00:21 . 2013-02-23 00:21  143872  ----a-w-  c:windowssystem32javacpl.cpl
2013-02-23 00:21 . 2013-02-23 00:21  94112  ----a-w-  c:windowssystem32WindowsAccessBridge.dll
2013-02-23 00:21 . 2013-02-23 00:21  --------  d-----w-  c:program filesJava
2013-02-22 11:59 . 2013-02-22 11:59  --------  d-----w-  c:program filesFinalWire
2013-02-22 11:52 . 2013-02-22 11:52  --------  d-----w-  c:program filesblekko
2013-02-21 16:23 . 2013-02-21 16:27  36  ----a-w-  c:documents and settingsihApplication Dataflood.bat
2013-02-21 15:52 . 2013-02-21 15:52  --------  d-----w-  c:documents and settingsAll UsersApplication DataSoftSafe
2013-02-21 15:52 . 2013-02-21 15:52  --------  d-----w-  c:documents and settingsAll UsersApplication DataSearch-NewTab
2013-02-21 15:52 . 2013-02-21 15:52  --------  d-----w-  c:program filesWebSearch
2013-02-21 15:51 . 2013-02-21 15:51  --------  d-----w-  c:documents and settingsAll UsersApplication DataBetterSoft
2013-02-21 15:51 . 2013-02-21 15:51  --------  d-----w-  c:program filesOptimizer Pro
2013-02-21 15:50 . 2013-02-21 15:50  --------  d-----w-  c:program filesBrowseToSave
2013-02-20 16:10 . 2013-02-20 16:16  --------  d-----w-  c:documents and settingsihLocal SettingsApplication DataWMTools Downloaded Files
2013-02-20 15:48 . 2013-02-20 15:48  --------  d-----w-  c:documents and settingsAll UsersDocuments
2013-02-20 15:03 . 2013-02-20 15:03  --------  d-----w-  c:program filesVirtualDJ
2013-02-18 19:02 . 2013-02-18 19:02  --------  d-----w-  c:documents and settingsAll UsersApplication DataphpDesigner
2013-02-17 16:15 . 2001-09-05 02:18  77824  ----a-w-  c:program filesCommon FilesInstallShieldengine6Intel 32ctor.dll
2013-02-17 16:15 . 2001-09-05 02:18  225280  ----a-w-  c:program filesCommon FilesInstallShieldIScriptiscript.dll
2013-02-17 16:15 . 2001-09-05 02:14  176128  ----a-w-  c:program filesCommon FilesInstallShieldengine6Intel 32iuser.dll
2013-02-17 16:15 . 2001-09-05 02:13  32768  ----a-w-  c:program filesCommon FilesInstallShieldengine6Intel 32objectps.dll
2013-02-17 16:15 . 2001-09-05 10:24  610436  ----a-w-  c:program filesCommon FilesInstallShieldengine6Intel 32IKernel.exe
2013-02-16 03:56 . 2013-02-16 03:56  --------  d-----w-  c:documents and settingsAll UsersApplication DataRegClean
2013-02-16 03:55 . 2013-02-16 03:55  --------  d-----w-  c:documents and settingsihLocal SettingsApplication DataPackageAware
2013-02-16 03:36 . 2013-02-16 03:37  --------  d-----w-  c:documents and settingsihApplication DataMarine Aquarium Lite
2013-02-16 02:41 . 2013-02-16 02:41  --------  d-----w-  c:program filesSereneScreen
2013-02-16 02:41 . 2012-03-06 08:22  6037504  ----a-w-  c:windowssystem32MarineAquariumLite.scr
2013-02-16 02:41 . 2013-02-16 02:41  --------  d-----w-  c:documents and settingsihApplication DataMarineAquarium3Free_57
2013-02-16 02:41 . 2013-02-16 02:41  --------  d-----w-  c:program filesMarineAquarium3Free_57
2013-02-12 11:21 . 2013-02-12 11:21  --------  d-----w-  c:documents and settingsihLocal SettingsApplication DataHelp
2013-02-11 03:36 . 2013-02-11 03:36  --------  d-----w-  c:documents and settingsihLocal SettingsApplication DataFVPN
2013-02-09 19:31 . 2013-02-09 19:31  --------  d-----w-  c:documents and settingsAll UsersApplication DataMcAfee
2013-02-09 15:31 . 2004-02-26 22:00  61493  ----a-w-  c:windowssystem32MFCN42D.DLL
2013-02-09 15:31 . 2004-02-16 22:00  434252  ----a-w-  c:windowssystem32MSVCRTD.DLL
2013-02-09 15:31 . 2004-02-26 22:00  962612  ----a-w-  c:windowssystem32MFC42D.DLL
2013-02-09 15:31 . 2001-11-26 22:13  114688  ----a-w-  c:windowssystem32CCGNU32.dll
2013-02-09 15:31 . 1998-06-23 22:00  137000  ----a-w-  c:windowssystem32MSMAPI32.OCX
2013-02-09 15:31 . 2003-03-19 00:03  544768  ----a-w-  c:windowssystem32msvcr71d.dll
2013-02-09 15:31 . 2004-08-04 02:21  81920  ----a-w-  c:windowssystem32msado25.tlb
2013-02-09 15:31 . 2001-04-05 14:43  1009336  ----a-w-  c:windowssystem32mschrt20.ocx
2013-02-09 15:31 . 1999-04-16 22:06  10752  ----a-w-  c:windowssystem32aamd532.dll
2013-02-09 15:31 . 1998-06-23 22:00  103744  ----a-w-  c:windowssystem32MSCOMM32.OCX
2013-02-09 15:30 . 2004-07-10 02:44  608448  ----a-w-  c:windowssystem32comctl32.ocx
2013-02-09 15:30 . 2004-06-09 13:59  939224  ----a-w-  c:windowssystem32Flash.ocx
2013-02-09 15:30 . 2004-03-01 18:55  561179  ----a-w-  c:windowssystem32dao360.dll
2013-02-09 15:30 . 2001-09-07 12:00  59904  ----a-w-  c:windowssystem32wbemdisp.tlb
2013-02-09 15:30 . 2001-09-07 11:00  61440  ----a-w-  c:windowssystem32msado20.tlb
2013-02-09 15:30 . 2000-12-05 23:00  209608  ----a-w-  c:windowssystem32tabctl32.ocx
2013-02-09 15:30 . 2000-05-21 22:00  115920  ----a-w-  c:windowssystem32MSINET.ocx
2013-02-09 15:30 . 2000-04-03 14:52  164144  ----a-w-  c:windowssystem32comct232.ocx
2013-02-09 15:30 . 1998-06-17 22:00  299008  ----a-w-  c:windowssystem32MSDBRPTR.DLL
2013-02-09 15:30 . 1998-06-08 22:00  137216  ----a-w-  c:windowssystem32MSDERUN.DLL
2013-02-07 21:59 . 2013-02-07 21:59  --------  d-----w-  c:program filesMicrosoft ActiveSync
2013-02-07 21:59 . 2013-02-07 21:59  --------  d-----w-  c:windowsSHELLNEW
2013-02-07 21:59 . 2013-02-07 21:59  --------  d-----w-  c:program filesMicrosoft.NET
2013-02-07 08:40 . 2013-02-07 08:40  --------  d-----w-  c:documents and settingsihLocal SettingsApplication DataGoogle
2013-02-07 08:39 . 2013-02-21 15:52  --------  d-----w-  c:documents and settingsAll UsersApplication DataInstallMate
2013-02-06 20:10 . 2013-02-06 20:10  --------  d-----w-  c:documents and settingsAll UsersApplication DataUbisoft
2013-02-06 20:05 . 2013-02-06 20:05  --------  d-----w-  c:documents and settingsihApplication DataPunkBuster
2013-02-05 13:36 . 2013-02-05 13:36  145920  --sha-r-  c:windowssystem32odfox32I.exe
2013-02-02 01:36 . 2013-02-10 16:04  --------  d-----w-  c:documents and settingsihLocal SettingsApplication DataVMware
2013-02-02 01:36 . 2013-02-10 15:20  --------  d-----w-  c:documents and settingsihApplication DataVMware
2013-02-02 01:12 . 2013-02-02 01:12  --------  d-----w-  c:documents and settingsihApplication DataMagic Stones
2013-02-02 01:02 . 2013-02-02 01:02  --------  d-----w-  c:documents and settingsihApplication DataFreeHideIP
2013-02-02 01:02 . 2013-02-02 01:02  --------  d-----w-  c:documents and settingsAll UsersApplication DataFreeHideIP
2013-02-01 23:06 . 2013-02-01 23:06  107888  ----a-w-  c:windowssystem32CmdLineExt.dll
2013-02-01 23:05 . 2013-02-01 23:05  22328  ----a-w-  c:documents and settingsihApplication DataPnkBstrK.sys
2013-02-01 23:04 . 2013-02-01 23:04  2250024  ----a-w-  c:windowssystem32pbsvc.exe
2013-02-01 22:47 . 2013-02-01 22:57  --------  d-----w-  c:documents and settingsihApplication DataDAEMON Tools Lite
2013-02-01 22:47 . 2013-02-01 22:57  --------  d-----w-  c:documents and settingsAll UsersApplication DataDAEMON Tools Lite
2013-02-01 19:39 . 2013-02-15 13:04  --------  d-----w-  c:program filesSystemRequirementsLab
2013-02-01 19:39 . 2013-02-01 19:39  --------  d-----w-  c:documents and settingsihApplication DataSystemRequirementsLab
2013-01-27 21:15 . 2013-01-27 21:15  --------  d-----w-  c:program filesEvisoft
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-02-23 00:21 . 2012-11-10 23:01  861088  ----a-w-  c:windowssystem32npDeployJava1.dll
2013-02-23 00:21 . 2012-11-10 23:01  782240  ----a-w-  c:windowssystem32deployJava1.dll
2013-02-09 19:17 . 2013-01-14 16:10  74096  ----a-w-  c:windowssystem32FlashPlayerCPLApp.cpl
2013-02-09 19:17 . 2013-01-14 16:10  697712  ----a-w-  c:windowssystem32FlashPlayerApp.exe
2012-12-17 09:38 . 2012-11-10 10:27  867344  ----a-w-  c:windowssystem32driversESLWireACD.sys
2013-02-20 12:12 . 2013-02-20 12:11  263064  ----a-w-  c:program filesmozilla firefoxcomponentsbrowsercomps.dll
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2008-12-22 . 362BC5AF8EAF712832C58CC13AE05750 . 1614848 . . [5.1.2600.5512] . . c:windowssystem32sfcfiles.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINESOFTWARE~Browser Helper Objects{59B591F2-F892-F531-029A-68CA7C314684}]
2013-02-21 16:20  118272  ----a-w-  c:documents and settingsAll UsersApplication DataSearch-NewTab5126495d72822.dll
.
[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
"Skype"="c:program filesSkypePhoneSkype.exe" [2008-11-07 21633320]
"NVIDIA nTune"="c:program filesNVIDIA CorporationnTunenTuneCmd.exe" [2007-09-04 81920]
"Optimizer Pro"="c:program filesOptimizer ProOptProLauncher.exe" [2012-10-21 81952]
.
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
"RTHDCPL"="RTHDCPL.EXE" [2007-07-05 16380416]
"NvCplDaemon"="c:windowssystem32NvCpl.dll" [2012-09-23 15512424]
"BigDogPath"="c:windowsVM_STI.EXE" [2004-06-09 40960]
"Marine Aquarium Lite Search Scope Monitor"="c:progra~1MARINE~2bar1.bin57srchmn.exe" [2013-02-16 42536]
"SunJavaUpdateSched"="c:program filesCommon FilesJavaJava Updatejusched.exe" [2012-07-03 252848]
.
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunOnce]
"WIAWizardMenu"="c:windowssystem32sti_ci.dll" [2008-04-14 136704]
.
[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
"CTFMON.EXE"="c:windowssystem32ctfmon.exe" [2008-04-14 15360]
.
[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRunOnce]
"_nltide_2"="shell32" [X]
.
[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowsCurrentversionpoliciesexplorerRun]
"Policies"="c:windowssystem32installserver.exe" [2013-02-25 287744]
.
[HKEY_CURRENT_USERsoftwaremicrosoftwindowsCurrentversionpoliciesexplorerRun]
"Policies"="c:windowssystem32installserver.exe" [2013-02-25 287744]
.
c:documents and settingsihStart MenuProgramsStartup
Facebook Messenger.lnk - c:documents and settingsihLocal SettingsApplication DataFacebookMessenger2.1.4651.0FacebookMessenger.exe [2012-9-25 247728]
server.exe [2013-2-25 287744]
.
[HKLM~startupfolderC:^Documents and Settings^All Users^Start Menu^Programs^Startup^McAfee Security Scan Plus.lnk]
path=c:documents and settingsAll UsersStart MenuProgramsStartupMcAfee Security Scan Plus.lnk
backup=c:windowspssMcAfee Security Scan Plus.lnkCommon Startup
.
[HKLM~startupfolderC:^Documents and Settings^ih^Start Menu^Programs^Startup^server.exe]
path=c:documents and settingsihStart MenuProgramsStartupserver.exe
backup=c:windowspssserver.exeStartup
.
[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregAdobe ARM]
2012-09-23 18:43  926896  ----a-w-  c:program filesCommon FilesAdobeARM1.0AdobeARM.exe
.
[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregAlcmtr]
2005-05-03 10:43  69632  ------r-  c:windowsAlcmtr.exe
.
[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregCTFMON.EXE]
2008-04-14 08:00  15360  ----a-w-  c:windowssystem32ctfmon.exe
.
[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregDAEMON Tools Lite]
2012-11-06 10:46  3673728  ----a-w-  c:program filesDAEMON Tools LiteDTLite.exe
.
[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregIMJPMIG8.1]
2008-04-14 08:00  208952  ----a-w-  c:windowsimeIMJP8_1imjpmig.exe
.
[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregMicroUpdate]
2012-11-12 00:22  962560  --sh--w-  c:documents and settingsihMy DocumentsMSDCSCmsdcsc.exe
.
[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregMSMSGS]
2008-04-14 01:42  1695232  ------w-  c:program filesMessengermsmsgs.exe
.
[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregNvCplDaemon]
2012-09-23 13:04  15512424  ----a-w-  c:windowssystem32nvcpl.dll
.
[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregNVIDIA nTune]
2007-09-04 17:25  81920  ----a-w-  c:program filesNVIDIA CorporationnTunenTuneCmd.exe
.
[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregNvMediaCenter]
2012-09-23 13:04  108392  ----a-w-  c:windowssystem32nvmctray.dll
.
[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregnwiz]
2012-09-23 14:28  1634112  ----a-w-  c:program filesNVIDIA Corporationnviewnwiz.exe
.
[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregPHIME2002A]
2008-04-14 08:00  455168  ----a-w-  c:windowssystem32IMETINTLGNTTINTSETP.EXE
.
[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregPHIME2002ASync]
2008-04-14 08:00  455168  ----a-w-  c:windowssystem32IMETINTLGNTTINTSETP.EXE
.
[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregSunJavaUpdateSched]
2012-07-03 07:04  252848  ----a-w-  c:program filesCommon FilesJavaJava Updatejusched.exe
.
[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupreguTorrent]
2012-12-30 23:26  969104  ----a-w-  c:program filesuTorrentuTorrent.exe
.
[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity center]
"AntiVirusOverride"=dword:00000001
.
[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
"%windir%Network Diagnosticxpnetdiag.exe"=
"%windir%system32sessmgr.exe"=
"c:Program FilesuTorrentuTorrent.exe"=
"c:Program FilesSteamSteam.exe"=
"c:Program FilesVMwareVMware Workstationvmware-authd.exe"=
"d:ИгриCounter-Strike Global Offensivecsgo.exe"=
"c:Program FilesGRETECHGomPlayerGOM.EXE"=
"c:Program FilesNVIDIA CorporationNVIDIA Update Coredaemonu.exe"=
"c:WINDOWSsystem32dpvsetup.exe"=
"c:WINDOWSsystem32msiexec.exe"=
"d:ИгриFarCry2Far Cry 2binFarCry2.exe"=
"d:ИгриFarCry2Far Cry 2binFC2Launcher.exe"=
"d:ИгриFarCry2Far Cry 2binFC2Editor.exe"=
"d:ИгриAssasin`s CreedACRSP.exe"=
"d:ИгриAssasin`s CreedACRMP.exe"=
"d:ИгриAssasin`s CreedAssassinsCreedRevelations.exe"=
"c:xamppmysqlbinmysqld.exe"=
"d:ТорентИгриCS 1.6 [CSMegaGaming Edition]hl.exe"=
"c:Program FilesSteamsteamappscommonHalf-Lifehl.exe"=
"c:Program FilesJavajre7binjava.exe"=
"c:Program FilesSkypePhoneSkype.exe"=
.
[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileGloballyOpenPortsList]
"5900:TCP"= 5900:TCP:vnc5900
"5800:TCP"= 5800:TCP:vnc5800
.
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:windowssystem32driversdtsoftbus01.sys [11/9/2012 6:34 PM 242240]
R2 Apache2.4;Apache2.4;c:xamppapachebinhttpd.exe [8/18/2012 12:38 PM 22016]
R2 vmci;VMware vmci;c:windowssystem32driversvmci.sys [3/25/2011 11:42 PM 70768]
R2 VMUSBArbService;VMware USB Arbitration Service;c:program filesCommon FilesVMwareUSBvmware-usbarbitrator.exe [3/25/2011 10:27 PM 539248]
R3 AR9271;Wireless Network Adapter Service;c:windowssystem32driversathuw.sys [11/8/2012 12:39 AM 1763584]
R3 VCSVADHWSer;Avnex Virtual Audio Device (WDM);c:windowssystem32driversvcsvad.sys [12/29/2012 7:55 PM 17792]
S2 MarineAquarium3Free_57Service;Marine Aquarium LiteService;c:progra~1MARINE~2bar1.bin57barsvc.exe [2/16/2013 4:41 AM 42504]
S3 ZSMC302;VIMICRO USB PC Camera;c:windowssystem32driversusbVM31b.sys [1/13/2013 4:18 PM 90568]
S4 Apache2.2;Apache2.2;c:xamppapachebinhttpd.exe [8/18/2012 12:38 PM 22016]
.
[HKEY_LOCAL_MACHINEsoftwaremicrosoftactive setupinstalled components{AVE674RB-4QG4-R27S-1V6D-1IO0D3267OE2}]
2013-02-25 11:08  287744  ------w-  c:windowssystem32installserver.exe
.
Contents of the 'Scheduled Tasks' folder
.
2013-02-25 c:windowsTasksAdobe Flash Player Updater.job
- c:windowssystem32MacromedFlashFlashPlayerUpdateService.exe [2013-01-14 19:17]
.
2013-02-25 c:windowsTasksContinueToSaveUpdaterTask{A78AD3F0-1F59-4658-A6ED-7BABA71195C6}.job
- c:documents and settingsAll UsersApplication DataPremiumContinueToSaveContinueToSave.exe [2013-01-03 14:50]
.
2013-02-25 c:windowsTasksschedule!1173230912.job
- c:documents and settingsAll UsersApplication DataBetterSoftOptimizerProOptimizerPro.exe [2013-02-21 19:58]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://blekko.com/ws/?source=5f97ddbe&tbp=homepage&u=20ed2233000000000000b0487a947e65
mStart Page = hxxp://websearch.pu-results.info/?pid=377&r=2013/02/21&hid=2283671635&lg=EN&cc=BG
IE: E&xport to Microsoft Excel - c:progra~1MICROS~3OFFICE11EXCEL.EXE/3000
LSP: c:program filesVMwareVMware Workstationvsocklib.dll
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces{4BB4C3AC-9218-4829-B21B-C305E1B4D43B}: NameServer = 8.26.56.26,156.154.70.22
FF - ProfilePath - c:documents and settingsihApplication DataMozillaFirefoxProfilesm23axj0l.default
FF - prefs.js: browser.search.defaulturl - hxxp://websearch.pu-results.info/?pid=377&r=2013/02/21&hid=2283671635&lg=EN&cc=BG&l=1&q=
FF - prefs.js: browser.search.selectedEngine - Google SSL
FF - prefs.js: browser.startup.homepage - hxxp://home.mywebsearch.com/index.jhtml?ptb=2A1DB8A7-5369-4FE3-8714-45206D91E8BB&n=77fc45a4&p2=^0D^xdm060^YY^bg&si=275192
FF - prefs.js: keyword.URL - hxxp://search.mywebsearch.com/mywebsearch/GGmain.jhtml?st=kwd&ptb=2A1DB8A7-5369-4FE3-8714-45206D91E8BB&n=77fc45a4&ind=2013021604&p2=^0D^xdm060^YY^bg&si=275192&searchfor=
FF - ExtSQL: 2013-01-10 18:30; {e9876d64-8bac-4287-bdc4-0f0c56804b4f}; c:documents and settingsihApplication DataMozillaFirefoxProfilesm23axj0l.defaultextensions{e9876d64-8bac-4287-bdc4-0f0c56804b4f}.xpi
FF - ExtSQL: 2013-01-10 18:37; {d47a9f51-8281-43fa-f450-f28ef8735e9a}; c:documents and settingsihApplication DataMozillaFirefoxProfilesm23axj0l.defaultextensions{d47a9f51-8281-43fa-f450-f28ef8735e9a}.xpi
FF - ExtSQL: 2013-01-10 18:44; {BCC877E7-7F3F-4632-8338-DAEE4475DE35}; c:documents and settingsihApplication DataMozillaFirefoxProfilesm23axj0l.defaultextensions{BCC877E7-7F3F-4632-8338-DAEE4475DE35}.xpi
FF - ExtSQL: 2013-01-10 18:46; {166745b8-8d4a-4c86-9120-696de51a77aa}; c:documents and settingsihApplication DataMozillaFirefoxProfilesm23axj0l.defaultextensions{166745b8-8d4a-4c86-9120-696de51a77aa}.xpi
FF - ExtSQL: 2013-01-11 11:22; [email protected]; c:documents and settingsihApplication DataMozillaFirefoxProfilesm23axj0l.defaultextensionschecker@mail.bg.xpi
FF - ExtSQL: 2013-02-07 10:40; [email protected]; c:documents and settingsihApplication DataMozillaFirefoxProfilesm23axj0l.defaultextensions511367b0bcaa1@511367b0bcad9.com
FF - ExtSQL: 2013-02-16 04:41; 57ffxtbr@MarineAquarium3Free_57.com; c:documents and settingsihApplication DataMozillaFirefoxProfilesm23axj0l.defaultextensions57ffxtbr@MarineAquarium3Free_57.com
FF - ExtSQL: 2013-02-20 13:41; [email protected]; c:documents and settingsihApplication DataMozillaFirefoxProfilesm23axj0l.defaultextensionszZ2jWZ1H22Jb5NdELHS@o0jQVWZkY1gx1.com.xpi
FF - ExtSQL: 2013-02-21 18:18; [email protected]; c:documents and settingsihApplication DataMozillaFirefoxProfilesm23axj0l.defaultextensions512648e1f19e8@512648e1f1a1f.com
FF - ExtSQL: 2013-02-21 18:20; [email protected]; c:documents and settingsihApplication DataMozillaFirefoxProfilesm23axj0l.defaultextensions5126495d72690@5126495d726c9.com
FF - ExtSQL: !HIDDEN! 2013-02-16 04:41; 57ffxtbr@MarineAquarium3Free_57.com; c:program filesMarineAquarium3Free_57bar1.bin
FF - user.js: extensions.spamfreesearch.autoRvrt - false
FF - user.js: extensions.spamfreesearch_i.hmpg - true
FF - user.js: extensions.spamfreesearch.hmpgUrl - hxxp://blekko.com/ws/?source=5f97ddbe&tbp=homepage&u=20ed2233000000000000b0487a947e65
FF - user.js: extensions.spamfreesearch.dfltSrch - true
FF - user.js: extensions.spamfreesearch.srchPrvdr - blekko
FF - user.js: extensions.spamfreesearch.keyWordUrl - hxxp://blekko.com/ws/?source=5f97ddbe&tbp=rbox&u=20ed2233000000000000b0487a947e65&q=
FF - user.js: extensions.spamfreesearch_i.dnsErr - true
FF - user.js: extensions.spamfreesearch_i.newTab - true
FF - user.js: extensions.spamfreesearch.newTabUrl - chrome://spamfreesearch/content/new browser tab.html?source=5f97ddbe&tbp=tab&u=20ed2233000000000000b0487a947e65
FF - user.js: extensions.spamfreesearch.tlbrSrchUrl - hxxp://blekko.com/ws/?source=5f97ddbe&tbp=main&u=20ed2233000000000000b0487a947e65&q=
FF - user.js: extensions.spamfreesearch.id - 20ed2233000000000000b0487a947e65
FF - user.js: extensions.spamfreesearch.appId - {1005247F-A178-490A-8DC3-6BAF09EA427B}
FF - user.js: extensions.spamfreesearch.instlDay - 15758
FF - user.js: extensions.spamfreesearch.vrsn - 1.8.3.9
FF - user.js: extensions.spamfreesearch.vrsni - 1.8.3.9
FF - user.js: extensions.spamfreesearch_i.vrsnTs - 1.8.3.913:52
FF - user.js: extensions.spamfreesearch.prtnrId - blekko
FF - user.js: extensions.spamfreesearch.prdct - spamfreesearch
FF - user.js: extensions.spamfreesearch.aflt - orgnl
FF - user.js: extensions.spamfreesearch_i.smplGrp - none
FF - user.js: extensions.spamfreesearch.tlbrId - base
FF - user.js: extensions.spamfreesearch.instlRef - 5f97ddbe
FF - user.js: extensions.spamfreesearch.dfltLng -
FF - user.js: extensions.spamfreesearch.excTlbr - false
FF - user.js: extensions.spamfreesearch.admin - false
.
- - - - ORPHANS REMOVED - - - -
.
BHO-{43F1B789-E42F-B3A4-2310-1D1D5612778F} - c:documents and settingsAll UsersApplication DataBrowse2save512648e1f1b6a.dll
BHO-{F1AF26F8-1828-4279-ABCE-074EF3235BD7} - c:program filesPutLockerDownloadersmarterdownloader.dll
HKCU-Run-Facebook Update - c:documents and settingsihLocal SettingsApplication DataFacebookUpdateFacebookUpdate.exe
HKCU-Run-Free Hide IP - c:program filesFreeHideIPFreeHideIP.exe
MSConfigStartUp-ESL Wire - c:program filesEslWirewire.exe
MSConfigStartUp-EVGAPrecision - c:program filesEVGA Precision XEVGAPrecision.exe
MSConfigStartUp-Sweetpacks Communicator - c:program filesSweetIMCommunicatorSweetPacksUpdateManager.exe
AddRemove-ContinueToSave - c:docume~1ALLUSE~1APPLIC~1INSTAL~1CONTIN~1Setup.exe
AddRemove-SP_09b71135 - c:program filesContinueToSaveuninstall.exe
AddRemove-VMware_Workstation - c:documents and settingsAll UsersApplication DataVMwareVMware WorkstationUninstalleruninstall.exe
AddRemove-{C3F3165C-74D3-6FDB-3274-14FDA8698CFA} - c:documents and settingsAll UsersApplication DataBrowse2saveuninstall.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-02-25 17:24
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...  
.
scanning hidden autostart entries ...
.
scanning hidden files ...  
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINEsoftwareClassesCLSID{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:WINDOWSsystem32MacromedFlashFlashUtil32_11_5_502_149_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINEsoftwareClassesCLSID{73C9DFA0-750D-11E1-B0C4-0800200C9A66}Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINEsoftwareClassesCLSID{73C9DFA0-750D-11E1-B0C4-0800200C9A66}LocalServer32]
@="c:WINDOWSsystem32MacromedFlashFlashUtil32_11_5_502_149_ActiveX.exe"
.
[HKEY_LOCAL_MACHINEsoftwareClassesCLSID{73C9DFA0-750D-11E1-B0C4-0800200C9A66}TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINEsoftwareClassesInterface{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINEsoftwareClassesInterface{6AE38AE0-750C-11E1-B0C4-0800200C9A66}ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINEsoftwareClassesInterface{6AE38AE0-750C-11E1-B0C4-0800200C9A66}TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINEsoftwareMicrosoftWindows NTCurrentVersion561ad306-5297-65a9-c042-86c8e66e327]
@Denied: (Full) (AuthenticatedUsers)
@Denied: (Full) (Administrators)
"1vkf5hql6xj02"=hex:65,64,33,34,36,61,35,30,2d,61,30,37,64,2d,34,34,31,62,2d,
39,62,62,38,2d,33,62,38,31,64,33,66,35,34,38,63,62
"1a636p124tavd"=hex:65,00,00,00,f8,00,00,00,ce,b1,f4,ec,64,6a,65,6d,00,00,00,
00,00,00,00,00,00,00,00,00,50,6a,34,ed,7d,a0,1b,44,9b,b8,3b,81,d3,f5,48,cb,
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'explorer.exe'(4068)
c:windowssystem32WININET.dll
c:program filesInternet Explorermui0402shdoclc.dll
c:progra~1MARINE~2bar1.bin57hkstub.dll
c:windowssystem32ieframe.dll
c:windowssystem32wpdshserviceobj.dll
c:windowssystem32portabledevicetypes.dll
c:windowssystem32portabledeviceapi.dll
.
------------------------ Other Running Processes ------------------------
.
c:windowssystem32nvsvc32.exe
c:windowssystem32wscntfy.exe
c:windowsRTHDCPL.EXE
c:program filesInternet Exploreriexplore.exe
c:windowssystem32taskmgr.exe
.
**************************************************************************
.
Completion time: 2013-02-25  17:30:34 - machine was rebooted
ComboFix-quarantined-files.txt  2013-02-25 15:30
.
Pre-Run: 4,695,818,240 bytes free
Post-Run: 5,184,520,192 bytes free
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)WINDOWS
[operating systems]
c:cmdconsBOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(2)WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - FFC0F485DD91C57CD10ECA23ECE99CB8
 

Здравейте..!Ако трябва да бъда честен ...скоро не съм виждал по-заразена система...!Ще имаме доста работа..!

Проверете на VirusTotal следните файлове:

 

c:windowssystem32installserver.exe

c:windowssystem32odfox32I.exe

c:windowspssserver.exe

Публикувайте линкове към резултатите от проверката...!

 

 

McAfee Security Scan Plus - премахнете с помоща на този инструмент MCPR.exe

Изтеглете SystemLook (32-bit) или SystemLook (64-bit) и запазете програмата на десктопа.

[*]Кликнете два пъти върху SystemLook.exe, за да стартирате програмата.

[*]Копирайте съдържанието от цитата по-долу в текстовото поле на програмата:

:filefind*sfcfiles**server*:folderfind*server*:regfind*server*

[*]Кликнете на бутона Look, за да започне сканирането.

[*]Когато сканирането завърши ще се отвори Notepad с резултата от

сканирането. После публикувайте лог файла в следващия си коментар.

  • Автор

Публикувано изображение

Публикувано изображение

 

При "c:windowssystem32odfox32I.exe" не иска да зареди файла...пише само "Зареждане" чаках повече от 10-15минути..

Нормално е системата да ми е заразена след,като месеци наред блъсках адски много гадости и не се интересувах какво се случва с компютъра ми :(.Просто проверявах веднъж месечно за Вируси и то ОНЛАЙН!

SystemLook 30.07.11 by jpshortstuff
Log created at 18:56 on 25/02/2013 by ih
Administrator - Elevation successful

========== filefind ==========

Searching for "*sfcfiles*"
C:WINDOWSsystem32sfcfiles.dll  --a---- 1614848 bytes  [06:10 22/12/2008]  [06:10 22/12/2008] 362BC5AF8EAF712832C58CC13AE05750

Searching for "*server*"
C:Documents and SettingsAll UsersApplication DataMicrosoftWindowsGameExplorer{B0A9E454-D155-4E53-885B-D456EDDC107E}PlayTasks4Dedicated Server.lnk  --a---- 523 bytes  [22:59 01/02/2013]  [22:59 01/02/2013] C19E2DBEF4B5FF306C538F6D1B9317C5
C:Documents and SettingsAll UsersApplication DataMicrosoftWindowsGameExplorer{BF35E5CF-C66E-4B52-BC9C-DB928E77211A}PlayTasks4Dedicated Server.lnk  --a---- 707 bytes  [23:04 01/02/2013]  [23:04 01/02/2013] 2F548BD6C2DC41DF54185358B205885B
C:Documents and SettingsAll UsersStart MenuProgramsUbisoftFar Cry 2Dedicated Server.lnk  --a---- 809 bytes  [23:04 01/02/2013]  [23:04 01/02/2013] 32DD443FA076137DDF590B04939E2B82
C:Documents and SettingsihApplication DataFileZillarecentservers.xml  --a---- 74 bytes  [11:13 12/01/2013]  [16:28 12/01/2013] 98029147C46D90BD39115942AA86863D
C:Documents and SettingsihApplication Datainstallserver.exe  --a---- 287744 bytes  [08:43 18/01/2013]  [19:02 24/02/2013] 799EBC322A8DA7BDE79C2D5B7D48AF88
C:Documents and SettingsihApplication DataTS3ClientchatsbFFnRGxSRmIyV0lrMW1vMmRZWTlBR0t0cUp3PQ==server.html  --a---- 2119 bytes  [20:53 30/01/2013]  [20:58 30/01/2013] DB1840FD6A93C2003FA59925958A5A82
C:Documents and SettingsihApplication DataTS3ClientchatsbFFnRGxSRmIyV0lrMW1vMmRZWTlBR0t0cUp3PQ==server.txt  --a---- 35 bytes  [20:53 30/01/2013]  [20:53 30/01/2013] 27EDE0AD8F789302E8949E7730DD27DF
C:Documents and SettingsihApplication DataTS3ClientchatsYzJKUmNpZ0Jxc3g4KzJCa3d1T2NxOG1KUzNzPQ==server.html  --a---- 41975 bytes  [17:39 24/01/2013]  [17:56 24/01/2013] 7F3AFCBE1C7B1A53456938004846A680
C:Documents and SettingsihApplication DataTS3ClientchatsYzJKUmNpZ0Jxc3g4KzJCa3d1T2NxOG1KUzNzPQ==server.txt  --a---- 35 bytes  [17:39 24/01/2013]  [17:39 24/01/2013] 4535B4CC6221E7A7CBC6CC117A42824D
C:Documents and SettingsihRecentserver.lnk  --a---- 1140 bytes  [12:42 13/02/2013]  [12:42 13/02/2013] 637093E9F1FA2DF2C392889423AD7CE8
C:Documents and SettingsihStart MenuProgramsStartupserver.exe  --a---- 287744 bytes  [15:27 25/02/2013]  [11:08 25/02/2013] 799EBC322A8DA7BDE79C2D5B7D48AF88
C:Program FilesAdobeReader 11.0ReaderTrackerserver_issue.gif  --a---- 576 bytes  [18:43 23/09/2012]  [18:43 23/09/2012] B55A9D2EE28011AE5B03D273CC058DD0
C:Program FilesAdobeReader 11.0ReaderTrackerserver_lg.gif  --a---- 1255 bytes  [18:43 23/09/2012]  [18:43 23/09/2012] A16A193512421D6550101F2BE9793A1E
C:Program FilesAdobeReader 11.0ReaderTrackerserver_ok.gif  --a---- 225 bytes  [18:43 23/09/2012]  [18:43 23/09/2012] 7F26427F58798F300D445C37CC509493
C:Program FilesJavajre7binservertool.exe  --a---- 15264 bytes  [00:21 23/02/2013]  [00:21 23/02/2013] 704D315DE74B1FFA14B12C57601EED30
C:Program FilesMicrosoft OfficeOFFICE111033DataServices+New SQL Server Connection.odc  --a---- 196 bytes  [15:08 25/09/2000]  [15:08 25/09/2000] 149E8C684B9EA9887DD2E7E596E7187C
C:Program FilesNetBeans 7.2.1ideconfigModulesorg-netbeans-modules-httpserver.xml  --a---- 475 bytes  [16:44 12/01/2013]  [12:03 10/10/2012] 7C69BD3E576EA9C9A6F78A0C9C79BB4E
C:Program FilesNetBeans 7.2.1ideconfigModulesorg-netbeans-modules-server.xml  --a---- 427 bytes  [16:44 12/01/2013]  [12:03 10/10/2012] 2274A29D9BA84CC94508A8EB3C93B8B4
C:Program FilesNetBeans 7.2.1idemodulesorg-netbeans-modules-httpserver.jar  --a---- 74417 bytes  [16:44 12/01/2013]  [16:44 12/01/2013] 615F702ED15199472E2CC3DD6E9F0D74
C:Program FilesNetBeans 7.2.1idemodulesorg-netbeans-modules-server.jar  --a---- 157945 bytes  [16:44 12/01/2013]  [16:44 12/01/2013] BCA3E71B2AD87B0ECF2EE964E876D53D
C:Program FilesNetBeans 7.2.1idemodulesextwebserver.jar  --a---- 399853 bytes  [16:45 12/01/2013]  [16:45 12/01/2013] B5FDCE5A13B7EF5A6E696930710825CF
C:Program FilesNetBeans 7.2.1idemoduleslocaleorg-netbeans-modules-httpserver_ja.jar  --a---- 3793 bytes  [16:44 12/01/2013]  [16:44 12/01/2013] B0684A89F0FBA5BDB2F26C508C00D8FE
C:Program FilesNetBeans 7.2.1idemoduleslocaleorg-netbeans-modules-httpserver_pt_BR.jar  --a---- 3581 bytes  [16:43 12/01/2013]  [16:43 12/01/2013] 9941CB4F3C7536C97639DFD2F64E5852
C:Program FilesNetBeans 7.2.1idemoduleslocaleorg-netbeans-modules-httpserver_ru.jar  --a---- 4138 bytes  [16:44 12/01/2013]  [16:44 12/01/2013] 111CEBE36E38218271F9878E03113E21
C:Program FilesNetBeans 7.2.1idemoduleslocaleorg-netbeans-modules-httpserver_zh_CN.jar  --a---- 3668 bytes  [16:43 12/01/2013]  [16:43 12/01/2013] 44684EE886E177CAEA533C60D87D5E96
C:Program FilesNetBeans 7.2.1idemoduleslocaleorg-netbeans-modules-server_ja.jar  --a---- 9660 bytes  [16:44 12/01/2013]  [16:44 12/01/2013] 1AE6B45BE2D977529683E3A97DB30826
C:Program FilesNetBeans 7.2.1idemoduleslocaleorg-netbeans-modules-server_pt_BR.jar  --a---- 9306 bytes  [16:44 12/01/2013]  [16:44 12/01/2013] 144B1F961762DA79DFF8E3F9FDCD4517
C:Program FilesNetBeans 7.2.1idemoduleslocaleorg-netbeans-modules-server_ru.jar  --a---- 9976 bytes  [16:44 12/01/2013]  [16:44 12/01/2013] 7643F256BE43441263D4D2DBD2C468A6
C:Program FilesNetBeans 7.2.1idemoduleslocaleorg-netbeans-modules-server_zh_CN.jar  --a---- 9490 bytes  [16:44 12/01/2013]  [16:44 12/01/2013] 2BF23BBFDBE6997812C882D70F6E234D
C:Program FilesNetBeans 7.2.1ideupdate_trackingorg-netbeans-modules-httpserver.xml  --a---- 873 bytes  [16:44 12/01/2013]  [16:45 12/01/2013] 6658BF6F950183E4A5C2158A6E5128BC
C:Program FilesNetBeans 7.2.1ideupdate_trackingorg-netbeans-modules-server.xml  --a---- 774 bytes  [16:44 12/01/2013]  [16:45 12/01/2013] 3E7402D2323E46940D6E9AD8CBECB1EE
C:Program FilesNVIDIA CorporationnTunenTuneServer.dll  --a---- 688128 bytes  [17:23 04/09/2007]  [17:23 04/09/2007] 1B8DFA999676BB6858A2DAC9F1ABBC6F
C:Program FilesNVIDIA CorporationnTunenTuneServerAR.dll  --a---- 270336 bytes  [17:23 04/09/2007]  [17:23 04/09/2007] 5C30944AD8D8B082E642BCD0665029C7
C:Program FilesNVIDIA CorporationnTunenTuneServerCS.dll  --a---- 274432 bytes  [17:23 04/09/2007]  [17:23 04/09/2007] F624118FEFF42724115E16D3166662AF
C:Program FilesNVIDIA CorporationnTunenTuneServerDA.dll  --a---- 274432 bytes  [17:23 04/09/2007]  [17:23 04/09/2007] FFABBCEF7A93899C3F9B8FAE3486ED13
C:Program FilesNVIDIA CorporationnTunenTuneServerDE.dll  --a---- 278528 bytes  [17:23 04/09/2007]  [17:23 04/09/2007] A1204AD5994371F6F8453A78AA1374A1
C:Program FilesNVIDIA CorporationnTunenTuneServerEL.dll  --a---- 278528 bytes  [17:23 04/09/2007]  [17:23 04/09/2007] 07624CBB2E360D67524B098A68E3E102
C:Program FilesNVIDIA CorporationnTunenTuneServerENG.dll  --a---- 270336 bytes  [17:23 04/09/2007]  [17:23 04/09/2007] 13CC7243D9C2A8E9CBBFADF3DAB1EE25
C:Program FilesNVIDIA CorporationnTunenTuneServerENU.dll  --a---- 270336 bytes  [17:22 04/09/2007]  [17:22 04/09/2007] 1B68CB465B0F1FAB00B7E2B9A5A74A94
C:Program FilesNVIDIA CorporationnTunenTuneServerES.dll  --a---- 278528 bytes  [17:23 04/09/2007]  [17:23 04/09/2007] DACAD92220BD756A7F03E066E59C616D
C:Program FilesNVIDIA CorporationnTunenTuneServerESM.dll  --a---- 278528 bytes  [17:23 04/09/2007]  [17:23 04/09/2007] E17BC30B642B2B8164A5694542C868BB
C:Program FilesNVIDIA CorporationnTunenTuneServerFI.dll  --a---- 274432 bytes  [17:23 04/09/2007]  [17:23 04/09/2007] A75DF3CA0F595C7A6D2D4E8306AF4B88
C:Program FilesNVIDIA CorporationnTunenTuneServerFR.dll  --a---- 278528 bytes  [17:23 04/09/2007]  [17:23 04/09/2007] 96C0E3AE6BE8A31D8C04726E914721E7
C:Program FilesNVIDIA CorporationnTunenTuneServerHE.dll  --a---- 270336 bytes  [17:23 04/09/2007]  [17:23 04/09/2007] 37A820C23F0FC64D5C79E7B7C89B96D1
C:Program FilesNVIDIA CorporationnTunenTuneServerHU.dll  --a---- 274432 bytes  [17:23 04/09/2007]  [17:23 04/09/2007] 449D2F4B3E97A58A3F2D7290D499125A
C:Program FilesNVIDIA CorporationnTunenTuneServerIT.dll  --a---- 278528 bytes  [17:23 04/09/2007]  [17:23 04/09/2007] 6055FB5B2724DB3D5EFE808AD7A6EA3D
C:Program FilesNVIDIA CorporationnTunenTuneServerJA.dll  --a---- 253952 bytes  [17:23 04/09/2007]  [17:23 04/09/2007] F71BD7B4248C93626F334EE62DF8B53A
C:Program FilesNVIDIA CorporationnTunenTuneServerKO.dll  --a---- 253952 bytes  [17:23 04/09/2007]  [17:23 04/09/2007] 53C402BBE2EDDAFDDC4C77ACB335DC95
C:Program FilesNVIDIA CorporationnTunenTuneServerNL.dll  --a---- 278528 bytes  [17:23 04/09/2007]  [17:23 04/09/2007] 32DEC87A0A29B3AF7AC3AAF73152EDBC
C:Program FilesNVIDIA CorporationnTunenTuneServerNO.dll  --a---- 274432 bytes  [17:23 04/09/2007]  [17:23 04/09/2007] 620056E483EBBCCA6FAC372A2617AB6E
C:Program FilesNVIDIA CorporationnTunenTuneServerPL.dll  --a---- 274432 bytes  [17:23 04/09/2007]  [17:23 04/09/2007] 35E55E5BCE10EB68BA63890EAB16D964
C:Program FilesNVIDIA CorporationnTunenTuneServerPT.dll  --a---- 278528 bytes  [17:23 04/09/2007]  [17:23 04/09/2007] 92DAECA4FFB878E165D1E219CFAF502B
C:Program FilesNVIDIA CorporationnTunenTuneServerPTB.dll  --a---- 278528 bytes  [17:23 04/09/2007]  [17:23 04/09/2007] 6FE6C92C768CEC578C3ECDD70B9030ED
C:Program FilesNVIDIA CorporationnTunenTuneServerRU.dll  --a---- 274432 bytes  [17:23 04/09/2007]  [17:23 04/09/2007] 51808EF9407766BC8ED7A390202C75E0
C:Program FilesNVIDIA CorporationnTunenTuneServerSK.dll  --a---- 274432 bytes  [17:23 04/09/2007]  [17:23 04/09/2007] 44EEB0C59248ADE92B7A72151C76B0BF
C:Program FilesNVIDIA CorporationnTunenTuneServerSL.dll  --a---- 278528 bytes  [17:23 04/09/2007]  [17:23 04/09/2007] C8E813876FB1AA2556D8E98F0E9CB6FB
C:Program FilesNVIDIA CorporationnTunenTuneServerSV.dll  --a---- 274432 bytes  [17:23 04/09/2007]  [17:23 04/09/2007] D7F93F03F3B736E53AD5A4683BF82DDB
C:Program FilesNVIDIA CorporationnTunenTuneServerTH.dll  --a---- 270336 bytes  [17:23 04/09/2007]  [17:23 04/09/2007] 183BC664242AAC957F631970D6E57A1D
C:Program FilesNVIDIA CorporationnTunenTuneServerTR.dll  --a---- 274432 bytes  [17:23 04/09/2007]  [17:23 04/09/2007] 968969B38E3DD9DE68F24F1F48EBD31C
C:Program FilesNVIDIA CorporationnTunenTuneServerZHC.dll  --a---- 249856 bytes  [17:23 04/09/2007]  [17:23 04/09/2007] 35DA1B36D9C9A48FB70F71648E2A9923
C:Program FilesNVIDIA CorporationnTunenTuneServerZHT.dll  --a---- 249856 bytes  [17:23 04/09/2007]  [17:23 04/09/2007] CA7BCB333BC7EF489D4512FC73447AC2
C:Program FilesNVIDIA CorporationnTuneStressTestServer.dll  --a---- 147456 bytes  [17:24 04/09/2007]  [17:24 04/09/2007] 16A6285C797A0BD67B1E6CC08178F1AD
C:Program FilesNVIDIA CorporationnTuneStressTestServerAR.dll  --a---- 176128 bytes  [17:24 04/09/2007]  [17:24 04/09/2007] 017F9156619FDFA2A7A19DE7BCE791E2
C:Program FilesNVIDIA CorporationnTuneStressTestServerCS.dll  --a---- 176128 bytes  [17:24 04/09/2007]  [17:24 04/09/2007] 505ADF8FC327DA6E56E96DD881819DC9
C:Program FilesNVIDIA CorporationnTuneStressTestServerDA.dll  --a---- 176128 bytes  [17:24 04/09/2007]  [17:24 04/09/2007] 7062B95B7B52DFD3A6903DCB99B09ACD
C:Program FilesNVIDIA CorporationnTuneStressTestServerDE.dll  --a---- 176128 bytes  [17:24 04/09/2007]  [17:24 04/09/2007] DCC1553376BFDA257EA798F2CA533F14
C:Program FilesNVIDIA CorporationnTuneStressTestServerEL.dll  --a---- 176128 bytes  [17:24 04/09/2007]  [17:24 04/09/2007] 4578BB62C79DA6CA78D1593156B821D0
C:Program FilesNVIDIA CorporationnTuneStressTestServerENG.dll  --a---- 176128 bytes  [17:24 04/09/2007]  [17:24 04/09/2007] 023571808873D878AF4844BD7072F5ED
C:Program FilesNVIDIA CorporationnTuneStressTestServerENU.dll  --a---- 176128 bytes  [17:24 04/09/2007]  [17:24 04/09/2007] E145E7928DC1266B43DB045B1EF89903
C:Program FilesNVIDIA CorporationnTuneStressTestServerES.dll  --a---- 176128 bytes  [17:24 04/09/2007]  [17:24 04/09/2007] F45CDDA859E160205C30CC18363D8B76
C:Program FilesNVIDIA CorporationnTuneStressTestServerESM.dll  --a---- 176128 bytes  [17:24 04/09/2007]  [17:24 04/09/2007] 13FD92D0DD2E11B2315875A95D90DB5A
C:Program FilesNVIDIA CorporationnTuneStressTestServerFI.dll  --a---- 176128 bytes  [17:24 04/09/2007]  [17:24 04/09/2007] 5C0079AA75854FB3F60E0546958E80B8
C:Program FilesNVIDIA CorporationnTuneStressTestServerFR.dll  --a---- 176128 bytes  [17:24 04/09/2007]  [17:24 04/09/2007] E4F00D0E53C06A0CDE3CA1E198BED6C5
C:Program FilesNVIDIA CorporationnTuneStressTestServerHE.dll  --a---- 176128 bytes  [17:24 04/09/2007]  [17:24 04/09/2007] 49C36D6F00045B8A049EEB70AD7AC86D
C:Program FilesNVIDIA CorporationnTuneStressTestServerHU.dll  --a---- 176128 bytes  [17:24 04/09/2007]  [17:24 04/09/2007] D8D8C55AC1FA701513EBD7D603441B06
C:Program FilesNVIDIA CorporationnTuneStressTestServerIT.dll  --a---- 176128 bytes  [17:24 04/09/2007]  [17:24 04/09/2007] B7EE4B4942A9F33404BBD27F7F058228
C:Program FilesNVIDIA CorporationnTuneStressTestServerJA.dll  --a---- 176128 bytes  [17:24 04/09/2007]  [17:24 04/09/2007] 6CAF481F28CF15BBC92F0791011A55B6
C:Program FilesNVIDIA CorporationnTuneStressTestServerKO.dll  --a---- 176128 bytes  [17:24 04/09/2007]  [17:24 04/09/2007] 6D589D9C2920F065D4934678AC799F8E
C:Program FilesNVIDIA CorporationnTuneStressTestServerNL.dll  --a---- 176128 bytes  [17:24 04/09/2007]  [17:24 04/09/2007] AB9883CBACFC8A45FC61C710641A7B3F
C:Program FilesNVIDIA CorporationnTuneStressTestServerNO.dll  --a---- 176128 bytes  [17:24 04/09/2007]  [17:24 04/09/2007] 5D5205DDD119E4CBE3707933968B7DCC
C:Program FilesNVIDIA CorporationnTuneStressTestServerPL.dll  --a---- 176128 bytes  [17:24 04/09/2007]  [17:24 04/09/2007] 13FB41E9E2283D9A133021426742809D
C:Program FilesNVIDIA CorporationnTuneStressTestServerPT.dll  --a---- 176128 bytes  [17:24 04/09/2007]  [17:24 04/09/2007] 95E391245E5A7D4185600B728BCEC2BF
C:Program FilesNVIDIA CorporationnTuneStressTestServerPTB.dll  --a---- 176128 bytes  [17:24 04/09/2007]  [17:24 04/09/2007] 370E0DD74D102992B3EDC8F06FA5106E
C:Program FilesNVIDIA CorporationnTuneStressTestServerRU.dll  --a---- 176128 bytes  [17:24 04/09/2007]  [17:24 04/09/2007] F6605A20C2BA208665668AE8CDC15A84
C:Program FilesNVIDIA CorporationnTuneStressTestServerSK.dll  --a---- 176128 bytes  [17:24 04/09/2007]  [17:24 04/09/2007] 58AF0016B9CE6E039F7278921805C9AF
C:Program FilesNVIDIA CorporationnTuneStressTestServerSL.dll  --a---- 176128 bytes  [17:24 04/09/2007]  [17:24 04/09/2007] 7B02C720BDBDA06FE278FF774CA191F8
C:Program FilesNVIDIA CorporationnTuneStressTestServerSV.dll  --a---- 176128 bytes  [17:24 04/09/2007]  [17:24 04/09/2007] B9CA26E90B06DACF77ABD9EBA9B4371A
C:Program FilesNVIDIA CorporationnTuneStressTestServerTH.dll  --a---- 176128 bytes  [17:24 04/09/2007]  [17:24 04/09/2007] 63D43959C94EAA6197ABA5C93F4AC7A2
C:Program FilesNVIDIA CorporationnTuneStressTestServerTR.dll  --a---- 176128 bytes  [17:24 04/09/2007]  [17:24 04/09/2007] 53702E744D83EDCB53DBBEC993C518A8
C:Program FilesNVIDIA CorporationnTuneStressTestServerZHC.dll  --a---- 176128 bytes  [17:24 04/09/2007]  [17:24 04/09/2007] 44A10679486B21F06B934D486F762350
C:Program FilesNVIDIA CorporationnTuneStressTestServerZHT.dll  --a---- 176128 bytes  [17:24 04/09/2007]  [17:24 04/09/2007] 40F5BE7C491CAF8D2E08E023FB2BA5E7
C:Program FilesSteambinserverbrowser.dll  --a---- 1786280 bytes  [13:03 08/11/2012]  [11:08 15/02/2013] 1B3C3D1C64BCB0845819C0142ED39149
C:Program FilesSteamconfigMasterServer2.vdf  --a---- 357 bytes  [13:25 08/11/2012]  [12:53 13/02/2013] 70446D5CC539FDFD0F2AFA4E6EB33901
C:Program FilesSteamconfigserverbrowser.vdf  --a---- 766 bytes  [13:08 08/11/2012]  [13:12 14/02/2013] E6C47B2CD5E33DB1AF42A07EAD1DAA2A
C:Program FilesSteamGraphicsicon_button_servers.tga  --a---- 20844 bytes  [13:03 08/11/2012]  [11:54 10/03/2010] 669CC16988E2A22A87569EB3F627139D
C:Program FilesSteamGraphicsicon_button_servers_mousedown.tga  --a---- 20844 bytes  [13:03 08/11/2012]  [11:54 10/03/2010] B022D7AFB81A7A229A376A25CD7D83AF
C:Program FilesSteamGraphicsicon_button_servers_mouseover.tga  --a---- 20844 bytes  [13:03 08/11/2012]  [11:54 10/03/2010] B4A134C2D5BAA79176D841E9CAE565FF
C:Program FilesSteamserversaddservergamespage.res  --a---- 6564 bytes  [11:54 10/03/2010]  [11:54 10/03/2010] 49FC1A643A74971740886F17097AA1E6
C:Program FilesSteamserversdialogaddserver.res  --a---- 3713 bytes  [11:54 10/03/2010]  [11:54 10/03/2010] 3BD67635F58A985919551CD831E07F5B
C:Program FilesSteamserversdialogserverbrowser.res  --a---- 961 bytes  [15:19 16/12/2010]  [15:19 16/12/2010] 1F21390E7FE726F62FF74B965707AE93
C:Program FilesSteamserversdialogserverpassword.res  --a---- 2712 bytes  [11:54 10/03/2010]  [11:54 10/03/2010] 60CABF61DABA6293BCD4ADB7029690FC
C:Program FilesSteamserversserverbrowser_brazilian.txt  --a---- 42744 bytes  [15:42 21/01/2013]  [11:08 15/02/2013] F5E7C81441EA30C541ECD6714966F852
C:Program FilesSteamserversserverbrowser_bulgarian.txt  --a---- 42156 bytes  [10:52 28/01/2013]  [11:08 15/02/2013] 792A729D9A5CA92A55C188A699752B31
C:Program FilesSteamserversserverbrowser_czech.txt  --a---- 42560 bytes  [12:28 02/11/2012]  [12:28 02/11/2012] 77BB923A4BA641D81EE26B8B83C2A32A
C:Program FilesSteamserversserverbrowser_danish.txt  --a---- 42426 bytes  [15:37 14/01/2013]  [11:08 15/02/2013] 430E65892EA0F41409FD8BB29DCA9560
C:Program FilesSteamserversserverbrowser_dutch.txt  --a---- 42540 bytes  [15:13 11/09/2012]  [15:13 11/09/2012] B341AD5DDFE86C000EC7895173C365D8
C:Program FilesSteamserversserverbrowser_english.txt  --a---- 20306 bytes  [11:54 10/03/2010]  [11:54 10/03/2010] 9BDA4B5C39446592F4FCB78024E4E352
C:Program FilesSteamserversserverbrowser_finnish.txt  --a---- 42566 bytes  [12:57 07/11/2011]  [12:57 07/11/2011] 6D100C9472433B02465F661E01015960
C:Program FilesSteamserversserverbrowser_french.txt  --a---- 43100 bytes  [12:51 19/06/2012]  [12:51 19/06/2012] 7DC8E4AA5B278B341EAEA52B5F07D516
C:Program FilesSteamserversserverbrowser_german.txt  --a---- 43270 bytes  [11:06 19/11/2012]  [11:06 19/11/2012] A15D331B2E374BE20851304722ADEEB1
C:Program FilesSteamserversserverbrowser_greek.txt  --a---- 43978 bytes  [09:48 30/10/2012]  [09:48 30/10/2012] 39544B5B489F5B0A3C31A88E944C28C2
C:Program FilesSteamserversserverbrowser_hungarian.txt  --a---- 42070 bytes  [10:09 19/03/2012]  [10:09 19/03/2012] 875099FA589C9867E980B6C9DABE7C15
C:Program FilesSteamserversserverbrowser_italian.txt  --a---- 43386 bytes  [09:26 05/10/2012]  [09:26 05/10/2012] 7E95E1E7A81B02D53D5ACFF8B7E7620B
C:Program FilesSteamserversserverbrowser_japanese.txt  --a---- 37978 bytes  [10:57 10/07/2012]  [10:57 10/07/2012] 5D28158962E23518650F83159B3B2AD9
C:Program FilesSteamserversserverbrowser_korean.txt  --a---- 38032 bytes  [09:05 25/05/2011]  [09:05 25/05/2011] C971F80592BA9990FD1FD3F869CDB40C
C:Program FilesSteamserversserverbrowser_koreana.txt  --a---- 38032 bytes  [09:05 25/05/2011]  [09:05 25/05/2011] C971F80592BA9990FD1FD3F869CDB40C
C:Program FilesSteamserversserverbrowser_norwegian.txt  --a---- 41994 bytes  [14:09 03/12/2012]  [14:09 03/12/2012] 2802CE1E4E1D3625FDFA75ED4AC08307
C:Program FilesSteamserversserverbrowser_polish.txt  --a---- 42156 bytes  [10:44 24/10/2011]  [10:44 24/10/2011] 7E22F109021E64260CCA5EDD4A67D976
C:Program FilesSteamserversserverbrowser_portuguese.txt  --a---- 43062 bytes  [15:42 21/01/2013]  [15:42 21/01/2013] 3E3BA3F88B989E795A03CFE0CC4E4F11
C:Program FilesSteamserversserverbrowser_romanian.txt  --a---- 42594 bytes  [14:56 13/08/2012]  [14:56 13/08/2012] 65805C112ED04F4FF8F935ACA8F408A3
C:Program FilesSteamserversserverbrowser_russian.txt  --a---- 41750 bytes  [14:09 03/12/2012]  [14:09 03/12/2012] 3F11606E635BA6F114E3BD879260F107
C:Program FilesSteamserversserverbrowser_schinese.txt  --a---- 36732 bytes  [14:56 13/08/2012]  [14:56 13/08/2012] DE5CB72746E1E2F442E2E354D9CF73ED
C:Program FilesSteamserversserverbrowser_spanish.txt  --a---- 43840 bytes  [10:00 20/02/2012]  [10:00 20/02/2012] 274D55BEE127C917B7B1083BDA8B1F20
C:Program FilesSteamserversserverbrowser_swedish.txt  --a---- 42464 bytes  [15:13 11/09/2012]  [15:13 11/09/2012] C45412DEF20B6B974946E2A2A1B54D89
C:Program FilesSteamserversserverbrowser_tchinese.txt  --a---- 36692 bytes  [10:00 20/02/2012]  [10:00 20/02/2012] C254BAEDCB36D34085622CD5A8FDC595
C:Program FilesSteamserversserverbrowser_thai.txt  --a---- 42180 bytes  [06:29 23/05/2012]  [06:29 23/05/2012] D888322C8466A95F05A5562AEC732827
C:Program FilesSteamserversserverbrowser_turkish.txt  --a---- 41546 bytes  [14:53 26/03/2012]  [11:08 15/02/2013] 75C34F3063A5FF974E580812F8433000
C:Program FilesSteamsteamcachedreceipt_server_failure.res  --a---- 1504 bytes  [11:54 10/03/2010]  [11:54 10/03/2010] 7F388D542F560C987DD4C8F74FC72EE6
C:Program FilesSteamsteamcachedreceipt_server_regionnotsupported.res  --a---- 1539 bytes  [11:54 10/03/2010]  [11:54 10/03/2010] B2CC6563BA1B78CB1C283CE0C6477511
C:Program FilesSteamsteamcachedreceipt_server_timeout.res  --a---- 1201 bytes  [11:54 10/03/2010]  [11:54 10/03/2010] EF81DB318CA32DD2BF08C4584D36E36A
C:Program FilesSteamsteamcachedreceipt_server_timeout_bfs.res  --a---- 1187 bytes  [11:54 10/03/2010]  [11:54 10/03/2010] 668D4B19770CB4BECA5E96F8041B1AC2
C:Program FilesSteamsteamcachedreceipt_server_timeout_steam3.res  --a---- 1273 bytes  [11:54 10/03/2010]  [11:54 10/03/2010] D110515FE377ACA69FC3EFF33C5EC113
C:Program FilesSteamsteamgamesdedicated server install.html  --a---- 1968 bytes  [11:54 10/03/2010]  [11:54 10/03/2010] 688B6E3744E9CD68DF38E459D64D1EEC
C:Program FilesSteamsteamgamessource dedicated server install.html  --a---- 1846 bytes  [11:54 10/03/2010]  [11:54 10/03/2010] 7F9B63011953E5D830057CA071BB3450
C:Program FilesSteamsteamappscommonHalf-LifecstrikeGameServerConfig.vdf  --a---- 1777 bytes  [03:58 16/02/2013]  [03:58 16/02/2013] 6330A74C8B639027098356BEAFB2403C
C:Program FilesSteamsteamappscommonHalf-Lifecstrikelistenserver.cfg  --a---- 431 bytes  [04:00 16/02/2013]  [04:00 16/02/2013] D15ACD4F37FA3B6288755FAE530089BC
C:Program FilesSteamsteamappscommonHalf-Lifecstrikeserver.cfg  --a---- 465 bytes  [04:00 16/02/2013]  [04:00 16/02/2013] 2FAAFEC6A708BA5BA2B319A435333A28
C:Program FilesSteamsteamappscommonHalf-LifecstrikeServerBrowser.vdf  --a---- 734 bytes  [17:30 18/02/2013]  [17:30 18/02/2013] 80823B52D30CA02BB63937C4AE0C1F7B
C:Program FilesSteamsteamappscommonHalf-LifecstrikeresourceCreateMultiplayerGameServerPage.res  --a---- 4080 bytes  [04:01 16/02/2013]  [04:01 16/02/2013] 6A0A7B6B57996132B8121D9512C4834B
C:Program FilesSteamsteamappscommonHalf-Lifecstrikespritesobserver.txt  --a---- 79 bytes  [04:00 16/02/2013]  [04:00 16/02/2013] 65DE9EED3E9C5C6396EE6509F36AD902
C:Program FilesSteamsteamappscommonHalf-Lifecstrike_addonServerBrowser.vdf  --a---- 734 bytes  [10:20 16/02/2013]  [17:38 19/02/2013] 80823B52D30CA02BB63937C4AE0C1F7B
C:Program FilesSteamsteamappscommonHalf-LifeplatformconfigServerBrowser.vdf  --a---- 735 bytes  [09:46 16/02/2013]  [16:50 25/02/2013] 68039B6B23FB9446B40D910B76BF86FC
C:Program FilesSteamsteamappscommonHalf-LifeplatformserversAddServerGamesPage.res  --a---- 6564 bytes  [09:44 16/02/2013]  [09:44 16/02/2013] 49FC1A643A74971740886F17097AA1E6
C:Program FilesSteamsteamappscommonHalf-LifeplatformserversDialogAddServer.res  --a---- 2926 bytes  [09:44 16/02/2013]  [09:44 16/02/2013] CCDB10889E15B606F4839ED011CED2D2
C:Program FilesSteamsteamappscommonHalf-LifeplatformserversDialogServerBrowser.res  --a---- 854 bytes  [09:44 16/02/2013]  [09:44 16/02/2013] 83A80742E4FE30B401CAAA6B4E7629AE
C:Program FilesSteamsteamappscommonHalf-LifeplatformserversDialogServerPassword.res  --a---- 2712 bytes  [09:44 16/02/2013]  [09:44 16/02/2013] 60CABF61DABA6293BCD4ADB7029690FC
C:Program FilesSteamsteamappscommonHalf-LifeplatformserversServerBrowser.dll  --a---- 536064 bytes  [20:13 20/02/2013]  [20:14 20/02/2013] 16081F2B44097AA7017FFA20B541B274
C:Program FilesSteamsteamappscommonHalf-Lifeplatformserversserverbrowser_english.txt  --a---- 20158 bytes  [09:44 16/02/2013]  [09:44 16/02/2013] 7F80D9AFF8A0EE62CA389A1EA42C7C58
C:Program FilesSteamsteamappscommonHalf-Lifeplatformserversserverbrowser_french.txt  --a---- 44210 bytes  [09:44 16/02/2013]  [09:44 16/02/2013] C58FF871C1A3BABF114274EDC675F28E
C:Program FilesSteamsteamappscommonHalf-Lifeplatformserversserverbrowser_german.txt  --a---- 44054 bytes  [09:44 16/02/2013]  [09:44 16/02/2013] 627A806CA686D23F47EE780BE1448808
C:Program FilesSteamsteamappscommonHalf-Lifeplatformserversserverbrowser_italian.txt  --a---- 44176 bytes  [09:44 16/02/2013]  [09:44 16/02/2013] 13D7F4E6933BC4D1DDA03D243FEA73B6
C:Program FilesSteamsteamappscommonHalf-Lifeplatformserversserverbrowser_japanese.txt  --a---- 38942 bytes  [09:44 16/02/2013]  [09:44 16/02/2013] EAE0EAA23FD641E7C3B394C38040DF7B
C:Program FilesSteamsteamappscommonHalf-Lifeplatformserversserverbrowser_korean.txt  --a---- 38886 bytes  [09:44 16/02/2013]  [09:44 16/02/2013] 791759935E06A12026D001F806E569B6
C:Program FilesSteamsteamappscommonHalf-Lifeplatformserversserverbrowser_koreana.txt  --a---- 38886 bytes  [09:44 16/02/2013]  [09:44 16/02/2013] 791759935E06A12026D001F806E569B6
C:Program FilesSteamsteamappscommonHalf-Lifeplatformserversserverbrowser_polish.txt  --a---- 41198 bytes  [09:44 16/02/2013]  [09:44 16/02/2013] E8A4442BD893984F38EF6DF19C3E7342
C:Program FilesSteamsteamappscommonHalf-Lifeplatformserversserverbrowser_portuguese.txt  --a---- 43996 bytes  [09:44 16/02/2013]  [09:44 16/02/2013] DC20B5C8A366882F955E16B550E83196
C:Program FilesSteamsteamappscommonHalf-Lifeplatformserversserverbrowser_russian.txt  --a---- 40084 bytes  [09:44 16/02/2013]  [09:44 16/02/2013] 0D0C07B6C39A3934CB5E0DDE51B299B6
C:Program FilesSteamsteamappscommonHalf-Lifeplatformserversserverbrowser_schinese.txt  --a---- 37692 bytes  [09:44 16/02/2013]  [09:44 16/02/2013] 7F82F2D137BCF5E010B3BEC43EEE00A9
C:Program FilesSteamsteamappscommonHalf-Lifeplatformserversserverbrowser_spanish.txt  --a---- 45030 bytes  [09:44 16/02/2013]  [09:44 16/02/2013] B67567A94E2D867A4EC2912353CCC2B0
C:Program FilesSteamsteamappscommonHalf-Lifeplatformserversserverbrowser_tchinese.txt  --a---- 37692 bytes  [09:44 16/02/2013]  [09:44 16/02/2013] 25BC1EF8D967C99E9F77E4974CEAAB01
C:Program FilesSteamsteamappscommonHalf-Lifeplatformserversserverbrowser_thai.txt  --a---- 42922 bytes  [09:44 16/02/2013]  [09:44 16/02/2013] A5C016B1B1033412583763AA5EFA752B
C:Program FilesSteamsteamappscommonHalf-LifevalveGameServerConfig.vdf  --a---- 566 bytes  [04:02 16/02/2013]  [04:02 16/02/2013] C1AFFBD62F30E10BC18C0E7FECA9FC01
C:Program FilesSteamsteamappscommonHalf-Lifevalvelistenserver.cfg  --a---- 821 bytes  [04:02 16/02/2013]  [04:02 16/02/2013] A8AF3F50139A96FCDDE8F2E465187EB4
C:Program FilesSteamsteamappscommonHalf-Lifevalveserver.cfg  --a---- 469 bytes  [09:43 16/02/2013]  [09:43 16/02/2013] 74DB64F1E13D943D056A73FC99C0A8B6
C:Program FilesSteamsteamappscommonHalf-LifevalveresourceCreateMultiplayerGameServerPage.res  --a---- 4078 bytes  [09:43 16/02/2013]  [09:43 16/02/2013] 03FA7E5F096B7E064F7F7F125B9CEC8C
C:Program FilesSteamsteamappsdownloading730binadminserver.dll  --a---- 960512 bytes  [18:09 07/02/2013]  [23:47 15/02/2013] C0E0C0C8CA7C7BB72CC1CFB1E16DBB4C
C:Program FilesSteamsteamappsdownloading730binserverbrowser.dll  --a---- 1010176 bytes  [18:09 07/02/2013]  [23:47 15/02/2013] 0F57AA48F58F6805EFD67AC44EFAF5E1
C:Program FilesSteamsteamappsdownloading730csgobinserver.dll  --a---- 8519168 bytes  [18:09 07/02/2013]  [23:47 15/02/2013] 6507F20B8265ACA779839943F2B79C96
C:Program FilesSteamuserdata496805167remoteserverbrowser_hist.vdf  --a---- 2545 bytes  [00:44 25/11/2012]  [23:26 01/12/2012] 32A43B5838A7DEA3A926F283FEFCC960
C:Program FilesSteamuserdata496805167remoteserverbrowser_hist.vdf.bkp  --a---- 2545 bytes  [13:25 25/11/2012]  [22:03 01/12/2012] 32A43B5838A7DEA3A926F283FEFCC960
C:Program FilesSteamuserdata496805167remoteserverbrowser_hist.vdf.bkp.org  --a---- 306 bytes  [13:25 25/11/2012]  [02:04 25/11/2012] DAF100099C7F0B004BA279D28E6B3192
C:Program FilesSteamuserdata669040957remoteserverbrowser_hist.vdf  --a---- 2075 bytes  [13:05 08/11/2012]  [16:19 25/02/2013] 550B80391A13D3590C69B6B92FD14A4F
C:Program FilesSteamuserdata66904095configserverbrowser_ui.vdf  --a---- 1031 bytes  [13:05 08/11/2012]  [14:46 25/02/2013] 132594A28A87FE89BEE129EA208809B1
C:Program FilesTeamSpeak 3 Clientgfxdefault16x16_kick_from_server.png  --a---- 1219 bytes  [10:08 29/10/2012]  [10:08 29/10/2012] A05E01C2EBCB6CF9F83AE63CAA33906D
C:Program FilesTeamSpeak 3 Clientgfxdefault16x16_permissions_server_groups.png  --a---- 1301 bytes  [10:08 29/10/2012]  [10:08 29/10/2012] 275C9CFE0B29833BC9BEEADCE275C0E9
C:Program FilesTeamSpeak 3 Clientgfxdefault16x16_server_green.png  --a---- 827 bytes  [10:08 29/10/2012]  [10:08 29/10/2012] EB25381526623A43A20F9118C7AC6E1B
C:Program FilesTeamSpeak 3 Clientgfxdefault16x16_server_log.png  --a---- 1110 bytes  [10:08 29/10/2012]  [10:08 29/10/2012] E18567DCB2EA45D5E3ABA22FEF9EBF83
C:Program FilesTeamSpeak 3 Clientgfxdefault16x16_server_query.png  --a---- 1160 bytes  [10:08 29/10/2012]  [10:08 29/10/2012] 1F4C64E6BF9ABDC43C401BC527F66FFE
C:Program FilesTeamSpeak 3 Clientgfxdefault16x16_temp_server_password.png  --a---- 952 bytes  [10:08 29/10/2012]  [10:08 29/10/2012] 9357D5925A998370AE72162C5159BE4C
C:Program FilesTeamSpeak 3 Clientgfxdefault16x16_temp_server_password_add.png  --a---- 966 bytes  [10:08 29/10/2012]  [10:08 29/10/2012] 6BD97FC1FF0CE271C933EC6F7E1DC9A9
C:Program FilesTeamSpeak 3 Clientgfxdefault16x16_virtualserver_edit.png  --a---- 1088 bytes  [10:08 29/10/2012]  [10:08 29/10/2012] 7D29E7E467DD87E2DAF54FB9616410B3
C:Program FilesTeamSpeak 3 Clientgfxdefault24x24_permission_server_group.png  --a---- 1345 bytes  [10:08 29/10/2012]  [10:08 29/10/2012] E5C816A99035E4FEFFB79547EF7532C4
C:Program FilesTeamSpeak 3 Clientpluginsclientquery_pluginserverconnectinfo.txt  --a---- 208 bytes  [10:08 29/10/2012]  [10:08 29/10/2012] A988047FC42F21935BD35182EA79575C
C:Program FilesTeamSpeak 3 Clientpluginsclientquery_pluginserverconnectionhandlerlist.txt  --a---- 211 bytes  [10:08 29/10/2012]  [10:08 29/10/2012] EB3A5D1FA145FB9D2C02CCF18D624312
C:Program FilesTeamSpeak 3 Clientpluginsclientquery_pluginservergroupadd.txt  --a---- 314 bytes  [10:08 29/10/2012]  [10:08 29/10/2012] 4ECF3CC38A1AD23F9443D757769D2682
C:Program FilesTeamSpeak 3 Clientpluginsclientquery_pluginservergroupaddclient.txt  --a---- 271 bytes  [10:08 29/10/2012]  [10:08 29/10/2012] 05894E529582843187F55417735330E4
C:Program FilesTeamSpeak 3 Clientpluginsclientquery_pluginservergroupaddperm.txt  --a---- 568 bytes  [10:08 29/10/2012]  [10:08 29/10/2012] 2CAA718944B98CEFBE02D914358A0E08
C:Program FilesTeamSpeak 3 Clientpluginsclientquery_pluginservergroupclientlist.txt  --a---- 412 bytes  [10:08 29/10/2012]  [10:08 29/10/2012] E425C63B29DF50490AB709CCB5F6715E
C:Program FilesTeamSpeak 3 Clientpluginsclientquery_pluginservergroupdel.txt  --a---- 242 bytes  [10:08 29/10/2012]  [10:08 29/10/2012] ED9AC8CEB373289FDE459D96F1A890AA
C:Program FilesTeamSpeak 3 Clientpluginsclientquery_pluginservergroupdelclient.txt  --a---- 195 bytes  [10:08 29/10/2012]  [10:08 29/10/2012] 3E3421B38E1C9AEB681D0C2443E1328A
C:Program FilesTeamSpeak 3 Clientpluginsclientquery_pluginservergroupdelperm.txt  --a---- 378 bytes  [10:08 29/10/2012]  [10:08 29/10/2012] 4774669679A983D4A01FE27DF2A0375E
C:Program FilesTeamSpeak 3 Clientpluginsclientquery_pluginservergrouplist.txt  --a---- 341 bytes  [10:08 29/10/2012]  [10:08 29/10/2012] 1FFFC61535EBA6A37C916B7344A3E94D
C:Program FilesTeamSpeak 3 Clientpluginsclientquery_pluginservergrouppermlist.txt  --a---- 273 bytes  [10:08 29/10/2012]  [10:08 29/10/2012] E55B7EE43016D7CA7D7AC78A46889239
C:Program FilesTeamSpeak 3 Clientpluginsclientquery_pluginservergroupsbyclientid.txt  --a---- 243 bytes  [10:08 29/10/2012]  [10:08 29/10/2012] 87F10F8C98A60E0A7ABDDC972730B04A
C:Program FilesTeamSpeak 3 Clientpluginsclientquery_pluginservervariable.txt  --a---- 2507 bytes  [10:08 29/10/2012]  [10:08 29/10/2012] D325AEFCC301272108F82832062FE66F
C:Program FilesTeamSpeak 3 Clientpluginsclientquery_pluginverifyserverpassword.txt  --a---- 218 bytes  [10:08 29/10/2012]  [10:08 29/10/2012] C85243D10591C21565428C04E0FEE655
C:Program FilesTeamSpeak 3 Clientpluginsts3overlaystylesimagesetsserver.png  --a---- 771 bytes  [10:08 29/10/2012]  [10:08 29/10/2012] BC4100B8D9D7B42B2956A3C9785DB7CC
C:Program FilesTeamSpeak 3 Clientsounddefaultblocked_user_banned_server_currentchannel.wav  --a---- 233098 bytes  [10:08 29/10/2012]  [10:08 29/10/2012] 0434AE690C79FBB1632BD857E9C6C2F9
C:Program FilesTeamSpeak 3 Clientsounddefaultblocked_user_kicked_server_currentchannel.wav  --a---- 229304 bytes  [10:08 29/10/2012]  [10:08 29/10/2012] 5A46C0811A2E0D32AF46F6F9BF351084
C:Program FilesTeamSpeak 3 Clientsounddefaultfriend_banned_server_currentchannel.wav  --a---- 211382 bytes  [10:08 29/10/2012]  [10:08 29/10/2012] B95F42C4A1250816EA00FBCBEF0999B7
C:Program FilesTeamSpeak 3 Clientsounddefaultfriend_kicked_server_currentchannel.wav  --a---- 208762 bytes  [10:08 29/10/2012]  [10:08 29/10/2012] 682133E0751A05CEFDDA34B890D28D52
C:Program FilesTeamSpeak 3 Clientsounddefaultneutral_banned_server_currentchannel.wav  --a---- 218768 bytes  [10:08 29/10/2012]  [10:08 29/10/2012] 6D851E306BB13F83345A536D1F0B9BBB
C:Program FilesTeamSpeak 3 Clientsounddefaultneutral_kicked_server_currentchannel.wav  --a---- 223686 bytes  [10:08 29/10/2012]  [10:08 29/10/2012] B0618335977AC225BEFE970B604F580C
C:Program FilesTeamSpeak 3 Clientsounddefaultservergroup_assigned.wav  --a---- 117248 bytes  [10:08 29/10/2012]  [10:08 29/10/2012] 0E585EB1D35B7B0569847AA0F85FC96D
C:Program FilesTeamSpeak 3 Clientsounddefaultservergroup_revoked.wav  --a---- 130438 bytes  [10:08 29/10/2012]  [10:08 29/10/2012] 5394E676C02F350505196D6CD52A7937
C:Program FilesTeamSpeak 3 Clientsounddefaultyou_edited_server.wav  --a---- 108638 bytes  [10:08 29/10/2012]  [10:08 29/10/2012] 27955371158EBEDCAC9AF2E1F64C60EB
C:Program FilesTeamSpeak 3 Clientsounddefaultyou_kicked_server.wav  --a---- 128804 bytes  [10:08 29/10/2012]  [10:08 29/10/2012] 9E26638480FDDC2D0A644479861FBC46
C:Program FilesTeamSpeak 3 Clientsounddefault_maleblocked_user_banned_server_currentchannel.wav  --a---- 252198 bytes  [10:08 29/10/2012]  [10:08 29/10/2012] 84F20FBEAE460E06B449A7AB7E16A720
C:Program FilesTeamSpeak 3 Clientsounddefault_maleblocked_user_kicked_server_currentchannel.wav  --a---- 248758 bytes  [10:08 29/10/2012]  [10:08 29/10/2012] 4A6740013101692013E37E50667BC9C5
C:Program FilesTeamSpeak 3 Clientsounddefault_malefriend_banned_server_currentchannel.wav  --a---- 220634 bytes  [10:08 29/10/2012]  [10:08 29/10/2012] BE674FA7EDDF17DD1389FAD3FBE4247E
C:Program FilesTeamSpeak 3 Clientsounddefault_malefriend_kicked_server_currentchannel.wav  --a---- 222206 bytes  [10:08 29/10/2012]  [10:08 29/10/2012] 65A003581AF32E85BA74F4F00A61980F
C:Program FilesTeamSpeak 3 Clientsounddefault_maleneutral_banned_server_currentchannel.wav  --a---- 208346 bytes  [10:08 29/10/2012]  [10:08 29/10/2012] 892FC82B4AB4E77D4DE61A92ACE53659
C:Program FilesTeamSpeak 3 Clientsounddefault_maleneutral_kicked_server_currentchannel.wav  --a---- 212186 bytes  [10:08 29/10/2012]  [10:08 29/10/2012] 0F602B6B9D4389D2E1E8BC861F0C3F36
C:Program FilesTeamSpeak 3 Clientsounddefault_maleservergroup_assigned.wav  --a---- 134874 bytes  [10:08 29/10/2012]  [10:08 29/10/2012] 4AFEA101C5F7BE35F859ABFC1ACA2FEF
C:Program FilesTeamSpeak 3 Clientsounddefault_maleservergroup_revoked.wav  --a---- 124634 bytes  [10:08 29/10/2012]  [10:08 29/10/2012] 460946A8952989E959E366D7882D9894
C:Program FilesTeamSpeak 3 Clientsounddefault_maleyou_edited_server.wav  --a---- 143858 bytes  [10:08 29/10/2012]  [10:08 29/10/2012] D87E4AF3131BAA8045BEB17EB2510A3F
C:Program FilesTeamSpeak 3 Clientsounddefault_maleyou_kicked_server.wav  --a---- 143834 bytes  [10:08 29/10/2012]  [10:08 29/10/2012] EF8F16529896E54408A3025089A1AA63
C:Program FilesTeamSpeak 3 Clientstylesdefaultserverinfo.tpl  --a---- 2964 bytes  [10:08 29/10/2012]  [10:08 29/10/2012] AD2E96657B43CBD52BF36EE502464112
C:Program FilesTeamSpeak 3 Clientstylesdefaultserverinfo_de.tpl  --a---- 2986 bytes  [10:08 29/10/2012]  [10:08 29/10/2012] CCFD692FA6BCFEB3C4BD60D1C89C1816
C:Program FilesVentriloDocserver.htm  --a---- 5717 bytes  [19:12 14/06/2005]  [19:12 14/06/2005] 5517A79C7F9FB516FAB62C3BBC223FE6
C:Program FilesVMwareVMware WorkstationvixDiskMountServer.exe  --a---- 68144 bytes  [11:57 19/08/2010]  [11:57 19/08/2010] 2722CF6ADC27F27098AC093E1F107D60
C:Program FilesVMwareVMware Workstationhelpplayer_wint_configure_keyboard_mapping_for_remote_x_server.html  --a---- 8922 bytes  [14:10 11/05/2010]  [14:10 11/05/2010] B58E8DEC1A0520694D40D02A3AB74361
C:Program FilesVMwareVMware Workstationhelpplayer_wint_make_vms_available_for_streaming_from_web_server.html  --a---- 8760 bytes  [14:10 11/05/2010]  [14:10 11/05/2010] FEE6195512D8EBCD0C97F3101D09EE67
C:Program FilesVMwareVMware Workstationhelpplayer_wint_open_vm_created_in_esx_server_more_than_two_processors.html  --a---- 8426 bytes  [14:10 11/05/2010]  [14:10 11/05/2010] 56D7775F77C7066DA9078D742BEAB679
C:Program FilesVMwareVMware Workstationhelpworkstation_winws_net_component_dhcpserver.html  --a---- 3767 bytes  [14:10 11/05/2010]  [14:10 11/05/2010] 36F3AB04410B589ECA66EA13108367B8
C:Program FilesVMwareVMware Workstationmessagesjahelpplayer_wint_configure_keyboard_mapping_for_remote_x_server.html  --a---- 9529 bytes  [09:31 13/05/2010]  [09:31 13/05/2010] 95B19C3E6E1B135D0E3E9FDEC7A64C2E
C:Program FilesVMwareVMware Workstationmessagesjahelpplayer_wint_make_vms_available_for_streaming_from_web_server.html  --a---- 9584 bytes  [09:31 13/05/2010]  [09:31 13/05/2010] E680730F1639E45B350C3201722CBAB4
C:Program FilesVMwareVMware Workstationmessagesjahelpplayer_wint_open_vm_created_in_esx_server_more_than_two_processors.html  --a---- 8768 bytes  [09:31 13/05/2010]  [09:31 13/05/2010] 0662A1D54A256B09553A82A35FFE78A5
C:Program FilesVMwareVMware Workstationmessagesjahelpworkstation_winws_net_component_dhcpserver.html  --a---- 4003 bytes  [11:40 16/05/2010]  [11:40 16/05/2010] 5AC12D5804FFEB1C60B97E9612311BAC
C:QooboxQuarantineCDocuments and SettingsihApplication DataServer.exe.vir  --a---- 615038 bytes  [21:35 28/01/2013]  [21:41 28/01/2013] A8D900F85CB3AB171571C101C9BE392B
C:QooboxQuarantineCWINDOWSsystem32installserver.exe.vir  --a---- 287744 bytes  [12:14 28/01/2013]  [11:08 25/02/2013] 799EBC322A8DA7BDE79C2D5B7D48AF88
C:WINDOWSMicrosoft.NETFrameworkv3.5SqlServer.targets  --a---- 2277 bytes  [19:19 30/05/2005]  [19:19 30/05/2005] FFD534B8379DC842A5CF72D9333EDFBA
C:WINDOWSpchealthhelpctrSystemHomePage__SERVER.htm  --a---- 7355 bytes  [23:29 07/11/2012]  [23:29 07/11/2012] 09BF1C8A2892A8D337B2D8560A3BE900
C:WINDOWSpchealthhelpctrSystemRemote AssistanceInteractionServerRAChatServer.htm  --a---- 8095 bytes  [23:29 07/11/2012]  [23:29 07/11/2012] 8CF0E38B648A64A59E6497A77048C464
C:WINDOWSpchealthhelpctrSystemRemote AssistanceInteractionServerRAServer.htm  --a---- 21049 bytes  [23:29 07/11/2012]  [23:29 07/11/2012] 77C836215C64AF0FB11174CAD8CB0830
C:WINDOWSpchealthhelpctrSystemRemote AssistanceInteractionServerRAServer.js  --a---- 5158 bytes  [23:29 07/11/2012]  [23:29 07/11/2012] AD61FA577F80A75A2C6A0A334A552D7C
C:WINDOWSpchealthhelpctrSystemRemote AssistanceInteractionServerRAServerToolBar.htm  --a---- 14557 bytes  [23:29 07/11/2012]  [23:29 07/11/2012] D5F169E0F82FC2BEAFA5BFEEA0D8FF54
C:WINDOWSpchealthhelpctrSystemRemote AssistanceInteractionServerSettingServer.htm  --a---- 4797 bytes  [23:29 07/11/2012]  [23:29 07/11/2012] 113C9F74D9E5B59451791751ADAAE3EC
C:WINDOWSpchealthhelpctrSystemscriptsHomePage__SERVER.js  --a---- 8844 bytes  [23:29 07/11/2012]  [23:29 07/11/2012] 1408745CE2AA78463245D5FCEE2974CA
C:WINDOWSPrefetchSERVER.EXE-08CC5480.pf  --a---- 7406 bytes  [15:25 25/02/2013]  [15:30 25/02/2013] E22AAFFF7BE07723B540075020BAC103
C:WINDOWSPrefetchSERVER.EXE-2272FCCE.pf  --a---- 9548 bytes  [19:04 24/02/2013]  [15:25 25/02/2013] 8A5F88307157207B652FECE9A78DBD92
C:WINDOWSpssserver.exeStartup  ------- 287744 bytes  [11:15 04/12/2012]  [20:14 20/12/2012] 799EBC322A8DA7BDE79C2D5B7D48AF88
C:WINDOWSsystem32dmserver.dll  --a---- 23552 bytes  [08:00 14/04/2008]  [08:00 14/04/2008] 57EDEC2E5F59F0335E92F35184BC8631
C:WINDOWSsystem32dllcachedmserver.dll  --a--c- 23552 bytes  [08:00 14/04/2008]  [08:00 14/04/2008] 57EDEC2E5F59F0335E92F35184BC8631
C:WINDOWSsystem32installserver.exe  ------- 287744 bytes  [15:24 25/02/2013]  [11:08 25/02/2013] 799EBC322A8DA7BDE79C2D5B7D48AF88
C:xamppapacheconfssl.crtserver.crt  --a---- 623 bytes  [15:30 16/04/2012]  [15:30 16/04/2012] 6D27B6DAADBF36C2FBB30A0D54A11D7D
C:xamppapacheconfssl.csrserver.csr  --a---- 578 bytes  [15:30 16/04/2012]  [15:30 16/04/2012] B4B2577690A0A773BA90A2FCAF559829
C:xamppapacheconfssl.keyserver.key  --a---- 887 bytes  [15:30 16/04/2012]  [15:30 16/04/2012] 75DDB96F53A4EC25B2AA7E306ABA381A
C:xamppapacheerrorHTTP_INTERNAL_SERVER_ERROR.html.var  --a---- 14015 bytes  [21:07 10/10/2011]  [21:07 10/10/2011] 2B736DCCB43EEADB6D10C3A2E6FD6A2C
C:xamppapachemanualserver-wide.html  --a---- 515 bytes  [23:46 08/11/2011]  [23:46 08/11/2011] 2D1C743A5EF1BAB57072882F4AFBE1D6
C:xamppapachemanualserver-wide.html.en  --a---- 12031 bytes  [06:23 12/07/2012]  [06:23 12/07/2012] B099A2F8095203EB1EC171FC643754EA
C:xamppapachemanualserver-wide.html.fr  --a---- 12506 bytes  [06:23 12/07/2012]  [06:23 12/07/2012] C7E3F6AFD27B514FA361793718903F45
C:xamppapachemanualserver-wide.html.ja.utf8  --a---- 12162 bytes  [06:23 12/07/2012]  [06:23 12/07/2012] 6741A33D6474E33541285094D923ED84
C:xamppapachemanualserver-wide.html.ko.euc-kr  --a---- 10515 bytes  [06:23 12/07/2012]  [06:23 12/07/2012] 6C07B0FEE3337F01E736DA5A74BFD9E5
C:xamppapachemanualserver-wide.html.tr.utf8  --a---- 12552 bytes  [06:23 12/07/2012]  [06:23 12/07/2012] FF35CDE8E68152DF8E9DBAF6D5C066C3
C:xamppapachemanualprogramslog_server_status.html  --a---- 138 bytes  [14:59 01/05/2012]  [14:59 01/05/2012] D1926D9A418E469EE2B78FCAED071715
C:xamppapachemanualprogramslog_server_status.html.en  --a---- 6281 bytes  [06:23 12/07/2012]  [06:23 12/07/2012] F537D5E98F055375BFF2AB6EA38FB8D9
C:xamppFileZillaFTPFileZilla Server Interface.exe  --a---- 1044992 bytes  [07:24 11/05/2012]  [07:24 11/05/2012] 0C4F09A95C35114A48CE00CCB084473E
C:xamppFileZillaFTPFileZilla Server Interface.xml  --a---- 131 bytes  [15:30 16/04/2012]  [15:30 16/04/2012] 85BD2A223871F0354E8534BEB9DD94F4
C:xamppFileZillaFTPFileZilla Server Interface_example.xml  --a---- 411 bytes  [15:30 16/04/2012]  [15:30 16/04/2012] 83F73306945BF557F6B9CAB927AA63A2
C:xamppFileZillaFTPFileZilla server.exe  --a---- 632320 bytes  [07:24 11/05/2012]  [07:24 11/05/2012] 7E76EED28B8B8696B7F7ED5F757AA304
C:xamppFileZillaFTPFileZilla Server.xml  --a---- 285 bytes  [18:00 20/06/2012]  [22:29 19/01/2013] AAE297F5EA8FED2FBC44E363D0600A52
C:xamppFileZillaFTPFileZilla Server_example.xml  --a---- 5354 bytes  [15:30 16/04/2012]  [15:30 16/04/2012] F3B853F95B93F68A2D5BB1CDFAB6531E
C:xamppFileZillaFTPFileZillaServer.exe  --a---- 632320 bytes  [07:24 11/05/2012]  [07:24 11/05/2012] 7E76EED28B8B8696B7F7ED5F757AA304
C:xamppFileZillaFTPsourceFileZilla server.rc  --a---- 2713 bytes  [15:30 16/04/2012]  [15:30 16/04/2012] D17BD6FB90911BE10DCF5D477A57091C
C:xamppFileZillaFTPsourceFileZilla server.sln  --a---- 2816 bytes  [15:30 16/04/2012]  [15:30 16/04/2012] FBC3B0E235F8C820D125F5F10DB02F39
C:xamppFileZillaFTPsourceFileZilla server.vcproj  --a---- 40904 bytes  [15:30 16/04/2012]  [15:30 16/04/2012] F3783DBC43D768C7E5735696895F1A18
C:xamppFileZillaFTPsourceServer.cpp  --a---- 43352 bytes  [15:30 16/04/2012]  [15:30 16/04/2012] 2B408667182821A7E04A24BF2EF73D83
C:xamppFileZillaFTPsourceServer.h  --a---- 2103 bytes  [15:30 16/04/2012]  [15:30 16/04/2012] 0028A31CE5055EEF1D62D127A7ADA3F1
C:xamppFileZillaFTPsourceServerThread.cpp  --a---- 26758 bytes  [15:30 16/04/2012]  [15:30 16/04/2012] 46C7BD013279F267428DDD675C9C9C23
C:xamppFileZillaFTPsourceServerThread.h  --a---- 4312 bytes  [15:30 16/04/2012]  [15:30 16/04/2012] 6843F1722127CF2406580DF6F2B6FAFB
C:xamppFileZillaFTPsourceinstallFileZilla Server.nsi  --a---- 21415 bytes  [15:30 16/04/2012]  [15:30 16/04/2012] DB0C4328435964C7DB6E99EAD426CA06
C:xamppFileZillaFTPsourceinterfaceFileZilla Server Interface.vcproj  --a---- 47408 bytes  [15:30 16/04/2012]  [15:30 16/04/2012] A7B305319E583BF93558217C4A54885B
C:xamppFileZillaFTPsourceinterfaceFileZilla server.cpp  --a---- 6239 bytes  [15:30 16/04/2012]  [15:30 16/04/2012] 88CBF1CE3B9B218548455AD162B25245
C:xamppFileZillaFTPsourceinterfaceFileZilla server.h  --a---- 2428 bytes  [15:30 16/04/2012]  [15:30 16/04/2012] FC610F6A8E72EFA1560D906B05B5EE2F
C:xamppFileZillaFTPsourceinterfaceFileZilla server.rc  --a---- 68244 bytes  [15:30 16/04/2012]  [15:30 16/04/2012] 173FEEE65BA56F6305DC958488447482
C:xamppFileZillaFTPsourceinterfaceresFileZilla server.ico  --a---- 4710 bytes  [15:30 16/04/2012]  [15:30 16/04/2012] D1C61F167D2537F39CC1A7BD3FB0D40F
C:xamppFileZillaFTPsourceinterfaceresFileZilla server.rc2  --a---- 432 bytes  [15:30 16/04/2012]  [15:30 16/04/2012] 904AC810A6A99AFBF2FC8F087FFAE97C
C:xamppFileZillaFTPsourceresFileZilla server.ico  --a---- 4710 bytes  [15:30 16/04/2012]  [15:30 16/04/2012] D1C61F167D2537F39CC1A7BD3FB0D40F
C:xampphtdocsadministratorcomponentscom_configviewsapplicationtmpldefault_server.php  --a---- 649 bytes  [23:21 08/02/2013]  [15:23 03/02/2013] 7A33EBA90BACD55BFA076F0E653318D0
C:xampphtdocslibrariesjoomlabaseobserver.php  --a---- 1218 bytes  [23:21 08/02/2013]  [15:23 03/02/2013] 382A29CC6A053B14FBB4FDD1926D53B9
C:xamppinstallxamppserver.inc  --a---- 149 bytes  [15:30 16/04/2012]  [15:30 16/04/2012] 59C4C7F1193FA0D8E48841041F7B61E3
C:xamppmysqlbackupmysqlservers.frm  --a---- 8838 bytes  [08:52 02/12/2008]  [08:52 02/12/2008] D0F8E3A938D528278F43EE416FC2861E
C:xamppmysqlbackupmysqlservers.MYD  --a---- 0 bytes  [08:52 02/12/2008]  [08:52 02/12/2008] D41D8CD98F00B204E9800998ECF8427E
C:xamppmysqlbackupmysqlservers.MYI  --a---- 1024 bytes  [08:52 02/12/2008]  [08:52 02/12/2008] CB0C30726A7B9C06E8AE4B10753B6357
C:xamppmysqldatamysqlservers.frm  --a---- 8838 bytes  [08:52 02/12/2008]  [08:52 02/12/2008] D0F8E3A938D528278F43EE416FC2861E
C:xamppmysqldatamysqlservers.MYD  --a---- 0 bytes  [08:52 02/12/2008]  [08:52 02/12/2008] D41D8CD98F00B204E9800998ECF8427E
C:xamppmysqldatamysqlservers.MYI  --a---- 1024 bytes  [08:52 02/12/2008]  [08:52 02/12/2008] CB0C30726A7B9C06E8AE4B10753B6357
C:xamppmysqllibmysqlserver.lib  --a---- 52719782 bytes  [18:07 20/07/2012]  [18:07 20/07/2012] 407876ED46F9C0F037E3F1FBA56816DA
C:xamppmysqllibdebugmysqlserver.lib  --a---- 57551570 bytes  [18:03 20/07/2012]  [18:03 20/07/2012] 80CC375CFFFF4DC3E68DF568DE2A4803
C:xamppmysqllibpluginqa_auth_server.dll  --a---- 118272 bytes  [18:08 20/07/2012]  [18:08 20/07/2012] 9351178181447B68295EFA094525A8FA
C:xamppmysqllibplugindebugqa_auth_server.dll  --a---- 446464 bytes  [18:04 20/07/2012]  [18:04 20/07/2012] F6D3106259DD0981C0FF80595F72AC74
C:xamppmysqlmysql-testincludehave_plugin_server.inc  --a---- 191 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] 06AF42834BA5175AB1E70AD608768C55
C:xamppmysqlmysql-testincluderpl_restart_server.inc  --a---- 1068 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] E0BDA7CC7819EF8E07137221BF6D17A9
C:xamppmysqlmysql-testincluderpl_start_server.inc  --a---- 1570 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] D62F049011C32D75E81D9918C3D4FEC4
C:xamppmysqlmysql-testincluderpl_stop_server.inc  --a---- 1962 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] C6E4D039F526868AAB07CB270C8F5C0C
C:xamppmysqlmysql-testrnot_embedded_server.result  --a---- 1717 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] C1B85B0B8357DBC57DC3FF919CA3228E
C:xamppmysqlmysql-testrserver_id.require  --a---- 32 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] 7A1A313D43BCDA8ED97C6F3F941316C2
C:xamppmysqlmysql-testrserver_id1.require  --a---- 34 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] 69FC765AFD338084F45B46512C2053FE
C:xamppmysqlmysql-teststd_dataserver-cert.pem  --a---- 2013 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] 7A31E392F199F1774232B3E60E438F02
C:xamppmysqlmysql-teststd_dataserver-key.pem  --a---- 497 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] A566ED3422F7926D756A07D1AA0B4CDA
C:xamppmysqlmysql-teststd_dataserver8k-cert.pem  --a---- 3207 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] 82F13B0D6F7F8749DC8AC39A59D7256E
C:xamppmysqlmysql-teststd_dataserver8k-key.pem  --a---- 6363 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] 9C4BA8CA30A0C9BB46BDA24B831BA7D8
C:xamppmysqlmysql-testsuitebinlogrbinlog_server_id.result  --a---- 1320 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] 0D9093ED0F14F132C00C9362F4D82CEE
C:xamppmysqlmysql-testsuitebinlogtbinlog_server_id.test  --a---- 663 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] 7215F72505D322A54E499404AB58AA84
C:xamppmysqlmysql-testsuiteenginesfuncsrrpl_server_id1.result  --a---- 1198 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] 931DB30282CDDC38051DDC47E245C8EB
C:xamppmysqlmysql-testsuiteenginesfuncsrrpl_server_id2.result  --a---- 1161 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] CB298FFBD8830BDAAF840252BDE0C016
C:xamppmysqlmysql-testsuiteenginesfuncstrpl_server_id1.test  --a---- 907 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] 8DA643152A4FC0A75451D17FC5792110
C:xamppmysqlmysql-testsuiteenginesfuncstrpl_server_id2-slave.opt  --a---- 55 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] B938FA913EC8DDA5CA9433D39E410022
C:xamppmysqlmysql-testsuiteenginesfuncstrpl_server_id2.test  --a---- 739 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] 2F8AE9B1EA1740C848F22270A2CA483A
C:xamppmysqlmysql-testsuitefederatedfederated_server.result  --a---- 8679 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] 3AD35C9131A2CACFE054D2674AC23CFA
C:xamppmysqlmysql-testsuitefederatedfederated_server.test  --a---- 8875 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] 2BD409A0C08B87FD79099486473A0473
C:xamppmysqlmysql-testsuiteinnodbrinnodb_prefix_index_restart_server.result  --a---- 2982 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] 92DC39F405ACEC232F4EA93FC522D19C
C:xamppmysqlmysql-testsuiteinnodbtinnodb_prefix_index_restart_server.test  --a---- 4471 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] EE3432196D99FC4DD0B18FAFC70277EB
C:xamppmysqlmysql-testsuiteperfschemaincludestart_server_common.inc  --a---- 1855 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] 4F15D35953CDEF78D5441E87DB0B47D4
C:xamppmysqlmysql-testsuiteperfschemarserver_init.result  --a---- 5388 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] 5A66C232195A1E872784667DA3262BBD
C:xamppmysqlmysql-testsuiteperfschemarstart_server_no_cond_class.result  --a---- 2693 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] 705D0D75CF9D3A585D27370E2D08472A
C:xamppmysqlmysql-testsuiteperfschemarstart_server_no_cond_inst.result  --a---- 2819 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] A549BB0F6BBC3244C33BA35C4C5A180A
C:xamppmysqlmysql-testsuiteperfschemarstart_server_no_file_class.result  --a---- 2690 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] 86D0DFE6317A28F87315C5CDFD3B75CD
C:xamppmysqlmysql-testsuiteperfschemarstart_server_no_file_inst.result  --a---- 2815 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] 2C43F6F40733349359B0997129DC9010
C:xamppmysqlmysql-testsuiteperfschemarstart_server_no_mutex_class.result  --a---- 2699 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] 71380CACE2FDE2D56FE67A2613812C20
C:xamppmysqlmysql-testsuiteperfschemarstart_server_no_mutex_inst.result  --a---- 2828 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] 50906240401C137763F147DC7018FDFD
C:xamppmysqlmysql-testsuiteperfschemarstart_server_no_rwlock_class.result  --a---- 2707 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] 1E179989873010ACA743A90BF3456FB3
C:xamppmysqlmysql-testsuiteperfschemarstart_server_no_rwlock_inst.result  --a---- 2836 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] 1B289676B82E5277250C453BCB01D628
C:xamppmysqlmysql-testsuiteperfschemarstart_server_no_thread_class.result  --a---- 2687 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] E06573367627160980DE503F43195B84
C:xamppmysqlmysql-testsuiteperfschemarstart_server_no_thread_inst.result  --a---- 2712 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] FCAB63177AD34EB20C42CABE559ABD8D
C:xamppmysqlmysql-testsuiteperfschemarstart_server_off.result  --a---- 2759 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] 1EACF39E0ED53F12503FD64D4D55F6ED
C:xamppmysqlmysql-testsuiteperfschemarstart_server_on.result  --a---- 2758 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] E6A3A899B1430D5756A9E720D95187B8
C:xamppmysqlmysql-testsuiteperfschematserver_init.test  --a---- 6276 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] AA9020BB38B51C27AA9ED9BF4B4EBABD
C:xamppmysqlmysql-testsuiteperfschematstart_server_no_cond_class-master.opt  --a---- 80 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] FD4436FF91ADABC5CD823817258949BE
C:xamppmysqlmysql-testsuiteperfschematstart_server_no_cond_class.test  --a---- 651 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] 1631CD985251C0150D422D78F9F3FEB9
C:xamppmysqlmysql-testsuiteperfschematstart_server_no_cond_inst-master.opt  --a---- 82 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] 4FD39B10079D6B0F620EA2A901A60A06
C:xamppmysqlmysql-testsuiteperfschematstart_server_no_cond_inst.test  --a---- 709 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] 04362FB65628058178194CBE90A9B006
C:xamppmysqlmysql-testsuiteperfschematstart_server_no_file_class-master.opt  --a---- 80 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] 72378415218B67326F9C0224CBBAF5EA
C:xamppmysqlmysql-testsuiteperfschematstart_server_no_file_class.test  --a---- 648 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] 7C97C84BF34A71FA1E2B641AD9240A7C
C:xamppmysqlmysql-testsuiteperfschematstart_server_no_file_inst-master.opt  --a---- 82 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] 6C23AA880FBCD3291629BA1A74B5DD00
C:xamppmysqlmysql-testsuiteperfschematstart_server_no_file_inst.test  --a---- 706 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] C75ED780CBD1975279ACD21D999A01FD
C:xamppmysqlmysql-testsuiteperfschematstart_server_no_mutex_class-master.opt  --a---- 81 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] 0ACCD90467376E7CA93F00C08DB03E88
C:xamppmysqlmysql-testsuiteperfschematstart_server_no_mutex_class.test  --a---- 656 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] 47E7885ED8A10D86A1F06A47BDA3D251
C:xamppmysqlmysql-testsuiteperfschematstart_server_no_mutex_inst-master.opt  --a---- 83 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] 5B94872C39208B491BAE695EF0F3ACA8
C:xamppmysqlmysql-testsuiteperfschematstart_server_no_mutex_inst.test  --a---- 715 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] 93A96AD54CD2B4F70A4063D444607984
C:xamppmysqlmysql-testsuiteperfschematstart_server_no_rwlock_class-master.opt  --a---- 82 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] AC9765BC5AD6576782DD7C585211893B
C:xamppmysqlmysql-testsuiteperfschematstart_server_no_rwlock_class.test  --a---- 661 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] 74F535D5499B0E00DC4C6E550E862EC2
C:xamppmysqlmysql-testsuiteperfschematstart_server_no_rwlock_inst-master.opt  --a---- 84 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] 54DB7C89CA6DB3CB79BE5AB3CE3BDFB8
C:xamppmysqlmysql-testsuiteperfschematstart_server_no_rwlock_inst.test  --a---- 721 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] 9CC5D609A6B99973D5F26EC3D60808B2
C:xamppmysqlmysql-testsuiteperfschematstart_server_no_thread_class-master.opt  --a---- 82 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] 3A165ABEDC30F73D079DB384C2F26775
C:xamppmysqlmysql-testsuiteperfschematstart_server_no_thread_class.test  --a---- 641 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] 1940A1753974A6A5B1D71D8E804AD7BB
C:xamppmysqlmysql-testsuiteperfschematstart_server_no_thread_inst-master.opt  --a---- 84 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] C973E1A3FACDB9D9FD56AAE616DD1149
C:xamppmysqlmysql-testsuiteperfschematstart_server_no_thread_inst.test  --a---- 726 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] 5F393FFF7D623E5DA6EA03B8EC0FAC31
C:xamppmysqlmysql-testsuiteperfschematstart_server_off-master.opt  --a---- 35 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] 749C19C00124AE21C0CF3D63DD517CC6
C:xamppmysqlmysql-testsuiteperfschematstart_server_off.test  --a---- 217 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] 4E84551420755E5BE8DACCCD78BD1386
C:xamppmysqlmysql-testsuiteperfschematstart_server_on-master.opt  --a---- 34 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] CF5D4FA98A4784B59FCD767FB9C05730
C:xamppmysqlmysql-testsuiteperfschematstart_server_on.test  --a---- 239 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] 57F6CA23EB96754CF1DCE10DC8964913
C:xamppmysqlmysql-testsuiterplrrpl_server_id1.result  --a---- 466 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] BE6FC55BAAF0133D8BCBF9F2F906E191
C:xamppmysqlmysql-testsuiterplrrpl_server_id2.result  --a---- 773 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] 7E63CBE1A274E0498BA98142DFC7D2D5
C:xamppmysqlmysql-testsuiterplrrpl_server_id_ignore.result  --a---- 1600 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] 81A18EBDD56470A9DE6CBC183E2E105C
C:xamppmysqlmysql-testsuiterpltrpl_server_id1.test  --a---- 664 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] 517A6404E91A5502B558DB3D8B959C71
C:xamppmysqlmysql-testsuiterpltrpl_server_id2-slave.opt  --a---- 55 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] B938FA913EC8DDA5CA9433D39E410022
C:xamppmysqlmysql-testsuiterpltrpl_server_id2.test  --a---- 1924 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] 2E635EC8C6D23FADEC9DE728CFE1FB25
C:xamppmysqlmysql-testsuiterpltrpl_server_id_ignore-slave.opt  --a---- 55 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] B938FA913EC8DDA5CA9433D39E410022
C:xamppmysqlmysql-testsuiterpltrpl_server_id_ignore.test  --a---- 3994 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] 2FFE319B917457EC3E0C0C06F1AA3060
C:xamppmysqlmysql-testsuitesys_varsrcharacter_set_server_basic.result  --a---- 15879 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] 43A24BE0CCEB7AAC523D2B61FB954800
C:xamppmysqlmysql-testsuitesys_varsrcharacter_set_server_func.result  --a---- 2121 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] 17097249E1FE7C51A81CDA807A2EC58F
C:xamppmysqlmysql-testsuitesys_varsrcollation_server_basic.result  --a---- 39042 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] C3A37C27F1D3D4500E135454872910E5
C:xamppmysqlmysql-testsuitesys_varsrcollation_server_func.result  --a---- 2815 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] 46A655A0FEB713B5F45C45FC37DA244C
C:xamppmysqlmysql-testsuitesys_varsrserver_id_basic.result  --a---- 3722 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] CFF9FA8BB57102008FA03F325F906680
C:xamppmysqlmysql-testsuitesys_varstcharacter_set_server_basic.test  --a---- 12487 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] 69E1B24DD055372464167AF2E62477F8
C:xamppmysqlmysql-testsuitesys_varstcharacter_set_server_func.test  --a---- 4654 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] C3657BF2D9067D092EC2247FC48CD667
C:xamppmysqlmysql-testsuitesys_varstcollation_server_basic.test  --a---- 12205 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] 6010BC3FF3AD47F502C4B52026BC6DF7
C:xamppmysqlmysql-testsuitesys_varstcollation_server_func.test  --a---- 5222 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] 2CA037AD0326E30EC5C888471BF296F4
C:xamppmysqlmysql-testsuitesys_varstserver_id_basic.test  --a---- 7616 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] 6938216F8E9B53498AC198A59A01C66E
C:xamppmysqlmysql-testtnot_embedded_server-master.opt  --a---- 16 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] 1EE158EB8039B871E0123174C869239A
C:xamppmysqlmysql-testtnot_embedded_server.test  --a---- 2496 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] D7B0EC64357FEA54F7EB0B1C9E83BA9D
C:xamppmysqlsql-benchserver-cfg.pl  --a---- 105307 bytes  [18:01 20/07/2012]  [18:01 20/07/2012] 2091DD2F58C0E47ADD04C506373AA80A
C:xamppmysqlsql-benchlimitsinterbase-superserver.cfg  --a---- 23404 bytes  [17:38 20/07/2012]  [17:38 20/07/2012] 785424B68E4933531516C35F4622FECE
C:xamppperlvendorlibautoNetSSLeayset_server_cert_and_key.al  --a---- 427 bytes  [08:56 09/08/2012]  [08:56 09/08/2012] F6A8D23FC040B32215B07DF4FC48023F
C:xamppperlvendorlibCryptOpenPGPKeyServer.pm  --a---- 4421 bytes  [23:06 10/12/2009]  [23:06 10/12/2009] 68204F34CB254ED2E980CFCA6D444DB1
C:xamppperlvendorlibDBIProxyServer.pm  --a---- 26269 bytes  [14:43 02/01/2012]  [14:43 02/01/2012] 7D1EA3844A0F35CAFB05A3B7B16DAFDC
C:xamppperlvendorlibSOAPServer.pod  --a---- 12171 bytes  [19:28 15/08/2011]  [19:28 15/08/2011] 58462956E6447F17E2CB1202CD7D0AC7
C:xamppperlvendorlibURI_server.pm  --a---- 3702 bytes  [13:48 11/02/2012]  [13:48 11/02/2012] 88A2771EF74DE72C247531AF09E5F57D
C:xamppphppearadodbserver.php  --a---- 2296 bytes  [06:44 19/01/2012]  [06:44 19/01/2012] 912E0742F3912355637F689B77EDB499
C:xamppphppearLogobserver.php  --a---- 4067 bytes  [15:30 16/04/2012]  [15:30 16/04/2012] DC9B968A48252CB2E108784E90E606A4
C:xamppphppearNetFTPObserver.php  --a---- 3024 bytes  [15:30 16/04/2012]  [15:30 16/04/2012] 32489C98844878592A4A7A3F4CAAD437
C:xamppphppearSOAPServer.php  --a---- 31976 bytes  [15:30 16/04/2012]  [15:30 16/04/2012] E21427068D6FC0305577220391AB96B6
C:xamppphpmyadminserver_binlog.php  --a---- 6210 bytes  [13:45 12/08/2012]  [13:45 12/08/2012] 8D436B149581D16C7A57A7F52A76646A
C:xamppphpmyadminserver_collations.php  --a---- 2602 bytes  [13:45 12/08/2012]  [13:45 12/08/2012] BCB134B5BE8D6EAC95C526CBF36F3D6A
C:xamppphpmyadminserver_databases.php  --a---- 10111 bytes  [13:45 12/08/2012]  [13:45 12/08/2012] DFF9C0F938633BF3D026D374D293F678
C:xamppphpmyadminserver_engines.php  --a---- 4998 bytes  [13:45 12/08/2012]  [13:45 12/08/2012] 548D0BEB3D95796BC8EE6503BCE45A04
C:xamppphpmyadminserver_export.php  --a---- 2077 bytes  [13:45 12/08/2012]  [13:45 12/08/2012] 2D41BF1FB8B9CE10D235D9A41E2DA3C6
C:xamppphpmyadminserver_import.php  --a---- 477 bytes  [13:45 12/08/2012]  [13:45 12/08/2012] F74834F7B79D8D7EE6DDE2ED73BD306B
C:xamppphpmyadminserver_plugins.php  --a---- 7212 bytes  [13:45 12/08/2012]  [13:45 12/08/2012] 7747521C46553F344463D1031D6E6513
C:xamppphpmyadminserver_privileges.php  --a---- 109758 bytes  [13:45 12/08/2012]  [13:45 12/08/2012] F7EF09FCE5FF65F8CFB7DDB3AD7D33BA
C:xamppphpmyadminserver_replication.php  --a---- 17071 bytes  [13:45 12/08/2012]  [13:45 12/08/2012] C1D6A01532A23F2EE207CA45C78F9E98
C:xamppphpmyadminserver_sql.php  --a---- 743 bytes  [13:45 12/08/2012]  [13:45 12/08/2012] 0725A895D53E075F3004D00C0163E474
C:xamppphpmyadminserver_status.php  --a---- 78223 bytes  [13:45 12/08/2012]  [13:45 12/08/2012] 17FA8F1EA8E4AFB659192941D7DA6208
C:xamppphpmyadminserver_synchronize.php  --a---- 57282 bytes  [13:45 12/08/2012]  [13:45 12/08/2012] CF0FC2B224A74696B4C9EFC8FE62807B
C:xamppphpmyadminserver_variables.php  --a---- 5807 bytes  [13:45 12/08/2012]  [13:45 12/08/2012] E9E97E38436555AB8855243B4ED488F1
C:xamppphpmyadminjsserver_plugins.js  --a---- 462 bytes  [13:45 12/08/2012]  [13:45 12/08/2012] D36163D413F29507B32CB046F8AB48BF
C:xamppphpmyadminjsserver_privileges.js  --a---- 7373 bytes  [13:45 12/08/2012]  [13:45 12/08/2012] 14678988C3B0960AB84448CDD040BF66
C:xamppphpmyadminjsserver_status.js  --a---- 12004 bytes  [13:45 12/08/2012]  [13:45 12/08/2012] 07977C08EAEF317BDA5D7379D4332139
C:xamppphpmyadminjsserver_status_monitor.js  --a---- 33592 bytes  [13:45 12/08/2012]  [13:45 12/08/2012] B158B42EF692F05A91A000CFF1A75AF2
C:xamppphpmyadminjsserver_synchronize.js  --a---- 4936 bytes  [13:45 12/08/2012]  [13:45 12/08/2012] 1171D78871CE912680D63E2869CE9AD5
C:xamppphpmyadminjsserver_variables.js  --a---- 3537 bytes  [13:45 12/08/2012]  [13:45 12/08/2012] C81C0E3CCE36E4AC0C4C9478031B3865
C:xamppphpmyadminlibrariesselect_server.lib.php  --a---- 3292 bytes  [13:45 12/08/2012]  [13:45 12/08/2012] 7625E6BA9124424E4CC71A0ADFC6CF82
C:xamppphpmyadminlibrariesserver_common.inc.php  --a---- 1161 bytes  [13:45 12/08/2012]  [13:45 12/08/2012] 50AED82F14F8C9816B4425AED718CF55
C:xamppphpmyadminlibrariesserver_links.inc.php  --a---- 3579 bytes  [13:45 12/08/2012]  [13:45 12/08/2012] 4EB6369AED7EF5933224F560BE248ED4
C:xamppphpmyadminlibrariesserver_synchronize.lib.php  --a---- 80353 bytes  [13:45 12/08/2012]  [13:45 12/08/2012] 9F74C8C8B61DFAC10C4490B08AE76658
C:xamppphpmyadminlibrariesserver_variables_doc.php  --a---- 42385 bytes  [13:45 12/08/2012]  [13:45 12/08/2012] 5AC1460E652E703F4F49A3FB4999B77C
C:xamppphpmyadminsetupframesservers.inc.php  --a---- 1248 bytes  [13:45 12/08/2012]  [13:45 12/08/2012] C15EB5A04453D3EBA55C8A4901246BC8
C:xampptomcatconfserver.xml  --a---- 6577 bytes  [07:52 02/09/2012]  [07:52 02/09/2012] C942F6DE1D53B0C0D06C80346F3CA19A
C:xampptomcatwebappsdocsarchitecturestartupserverStartup.pdf  --a---- 46175 bytes  [07:52 02/09/2012]  [07:52 02/09/2012] F50ECECF48039E0631C6B88FD3E6BBCA
C:xampptomcatwebappsdocsarchitecturestartupserverStartup.txt  --a---- 8717 bytes  [07:52 02/09/2012]  [07:52 02/09/2012] 028E4C6915330A217FCBCFABC428EDB8
C:xampptomcatwebappsdocsconfigserver.html  --a---- 9531 bytes  [07:52 02/09/2012]  [07:52 02/09/2012] 3BD04CFEDDEBDE8F5CC2DDE336C67FCB

========== folderfind ==========

Searching for "*server*"
C:Program FilesCommon FilesMicrosoft Sharedweb server extensions  d------  [22:28 07/11/2012]
C:Program FilesSteamservers  d------  [02:24 15/02/2013]
C:Program FilesSteampackagetmpservers  d------  [02:23 15/02/2013]
C:Program FilesSteamsteamappscommonHalf-Lifeplatformservers  d------  [23:45 15/02/2013]
C:Program FilesSteamsteamappsdownloading70platformservers  d------  [23:36 15/02/2013]
C:Program FilesSteamsteamappstemp70platformservers  d------  [13:02 15/02/2013]
C:WINDOWSpchealthhelpctrSystemRemote AssistanceInteractionServer  d------  [23:29 07/11/2012]
C:xamppperlvendorlibautoHTTPServer  d------  [22:28 19/01/2013]
C:xamppperlvendorlibHTTPServer  d------  [22:28 19/01/2013]
C:xamppphppearHTTPRequest2Observer  d------  [22:28 19/01/2013]
C:xamppphppearSOAPServer  d------  [22:28 19/01/2013]

========== regfind ==========

Searching for "*server* "
No data found.

-= EOF =-

Копирайте текста в карето на notepad и го запазвате с име CFScript.txt на десктопа си:

 

 

KILLALL::ClearJavaCache:: File::c:documents and settingsAll UsersApplication DataSearch-NewTab5126495d72822.dllc:windowssystem32installserver.exec:windowspssserver.exeStartupc:documents and settingsihStart MenuProgramsStartupserver.exec:documents and settingsihMy DocumentsMSDCSCmsdcsc.exe FileLook::c:windowssystem32odfox32I.exec:documents and settingsihApplication Dataflood.bat  Folder::c:program filesblekko  Registry::[-HKLM~startupfolderC:^Documents and Settings^ih^Start Menu^Programs^Startup^server.exe][HKLM~servicessharedaccessparametersfirewallpolicystandardprofileGloballyOpenPortsList]"5900:TCP"=-"5800:TCP"=-DDS::uStart Page = hxxp://blekko.com/ws/?source=5f97ddbe&tbp=homepage&u=20ed2233000000000000b0487a947e65mStart Page = hxxp://websearch.pu-results.info/?pid=377&r=2013/02/21&hid=2283671635&lg=EN&cc=BG


След съхранението преместете  CFScript.txt на иконата на ComboFix.exe

 

Публикувано изображение

 

Генерирания рапорт копирайте  и го поставете в следващия си коментар...!

  • Автор

ComboFix 13-02-24.01 - ih 02/25/2013  21:05:20.2.1 - x86
Microsoft Windows XP Professional  5.1.2600.3.1251.1.1033.18.2047.1463 [GMT 2:00]
Running from: c:documents and settingsihDesktopComboFix.exe
Command switches used :: c:documents and settingsihDesktopCFScript.txt
FW: COMODO Firewall *Enabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}
.
FILE ::
"c:documents and settingsAll UsersApplication DataSearch-NewTab5126495d72822.dll"
"c:documents and settingsihMy DocumentsMSDCSCmsdcsc.exe"
"c:documents and settingsihStart MenuProgramsStartupserver.exe"
"c:windowspssserver.exeStartup"
"c:windowssystem32installserver.exe"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:documents and settingsAll UsersApplication DataSearch-NewTab5126495d72822.dll
c:documents and settingsihApplication Datachrtmp
c:documents and settingsihApplication Datainstallserver.exe
c:documents and settingsihMy DocumentsMSDCSCmsdcsc.exe
c:program filesblekko
c:program filesblekkospamfreesearch1.8.3.9bhspamfreesearch.dll
c:program filesblekkospamfreesearch1.8.3.9escortShld.dll
c:program filesblekkospamfreesearch1.8.3.9spamfreesearch.crx
c:program filesblekkospamfreesearch1.8.3.9spamfreesearchApp.dll
c:program filesblekkospamfreesearch1.8.3.9spamfreesearchEng.dll
c:program filesblekkospamfreesearch1.8.3.9spamfreesearchsrv.exe
c:program filesblekkospamfreesearch1.8.3.9spamfreesearchTlbr.dll
c:program filesblekkospamfreesearch1.8.3.9uninstall.exe
c:windowspssserver.exeStartup
c:windowssystem32DEBUG.log
c:windowssystem32driversetchosts.ics
c:windowssystem32driversnpf.sys
c:windowssystem32install
c:windowssystem32installserver.exe
c:windowssystem32roboot.exe
.
.
((((((((((((((((((((((((( Files Created from 2013-01-25 to 2013-02-25  )))))))))))))))))))))))))))))))
.
.
2013-02-23 00:21 . 2013-02-23 00:21  143872  ----a-w-  c:windowssystem32javacpl.cpl
2013-02-23 00:21 . 2013-02-23 00:21  94112  ----a-w-  c:windowssystem32WindowsAccessBridge.dll
2013-02-23 00:21 . 2013-02-23 00:21  --------  d-----w-  c:program filesJava
2013-02-22 11:59 . 2013-02-22 11:59  --------  d-----w-  c:program filesFinalWire
2013-02-21 16:23 . 2013-02-21 16:27  36  ----a-w-  c:documents and settingsihApplication Dataflood.bat
2013-02-21 15:52 . 2013-02-21 15:52  --------  d-----w-  c:documents and settingsAll UsersApplication DataSoftSafe
2013-02-21 15:52 . 2013-02-25 19:09  --------  d-----w-  c:documents and settingsAll UsersApplication DataSearch-NewTab
2013-02-21 15:52 . 2013-02-21 15:52  --------  d-----w-  c:program filesWebSearch
2013-02-21 15:51 . 2013-02-21 15:51  --------  d-----w-  c:documents and settingsAll UsersApplication DataBetterSoft
2013-02-21 15:51 . 2013-02-21 15:51  --------  d-----w-  c:program filesOptimizer Pro
2013-02-21 15:50 . 2013-02-21 15:50  --------  d-----w-  c:program filesBrowseToSave
2013-02-20 16:10 . 2013-02-20 16:16  --------  d-----w-  c:documents and settingsihLocal SettingsApplication DataWMTools Downloaded Files
2013-02-20 15:48 . 2013-02-20 15:48  --------  d-----w-  c:documents and settingsAll UsersDocuments
2013-02-20 15:03 . 2013-02-20 15:03  --------  d-----w-  c:program filesVirtualDJ
2013-02-18 19:02 . 2013-02-18 19:02  --------  d-----w-  c:documents and settingsAll UsersApplication DataphpDesigner
2013-02-17 16:15 . 2001-09-05 02:18  77824  ----a-w-  c:program filesCommon FilesInstallShieldengine6Intel 32ctor.dll
2013-02-17 16:15 . 2001-09-05 02:18  225280  ----a-w-  c:program filesCommon FilesInstallShieldIScriptiscript.dll
2013-02-17 16:15 . 2001-09-05 02:14  176128  ----a-w-  c:program filesCommon FilesInstallShieldengine6Intel 32iuser.dll
2013-02-17 16:15 . 2001-09-05 02:13  32768  ----a-w-  c:program filesCommon FilesInstallShieldengine6Intel 32objectps.dll
2013-02-17 16:15 . 2001-09-05 10:24  610436  ----a-w-  c:program filesCommon FilesInstallShieldengine6Intel 32IKernel.exe
2013-02-16 03:56 . 2013-02-16 03:56  --------  d-----w-  c:documents and settingsAll UsersApplication DataRegClean
2013-02-16 03:55 . 2013-02-16 03:55  --------  d-----w-  c:documents and settingsihLocal SettingsApplication DataPackageAware
2013-02-16 03:36 . 2013-02-16 03:37  --------  d-----w-  c:documents and settingsihApplication DataMarine Aquarium Lite
2013-02-16 02:41 . 2013-02-16 02:41  --------  d-----w-  c:program filesSereneScreen
2013-02-16 02:41 . 2012-03-06 08:22  6037504  ----a-w-  c:windowssystem32MarineAquariumLite.scr
2013-02-16 02:41 . 2013-02-16 02:41  --------  d-----w-  c:documents and settingsihApplication DataMarineAquarium3Free_57
2013-02-16 02:41 . 2013-02-16 02:41  --------  d-----w-  c:program filesMarineAquarium3Free_57
2013-02-12 11:21 . 2013-02-12 11:21  --------  d-----w-  c:documents and settingsihLocal SettingsApplication DataHelp
2013-02-11 03:36 . 2013-02-11 03:36  --------  d-----w-  c:documents and settingsihLocal SettingsApplication DataFVPN
2013-02-09 15:31 . 2004-02-26 22:00  61493  ----a-w-  c:windowssystem32MFCN42D.DLL
2013-02-09 15:31 . 2004-02-16 22:00  434252  ----a-w-  c:windowssystem32MSVCRTD.DLL
2013-02-09 15:31 . 2004-02-26 22:00  962612  ----a-w-  c:windowssystem32MFC42D.DLL
2013-02-09 15:31 . 2001-11-26 22:13  114688  ----a-w-  c:windowssystem32CCGNU32.dll
2013-02-09 15:31 . 1998-06-23 22:00  137000  ----a-w-  c:windowssystem32MSMAPI32.OCX
2013-02-09 15:31 . 2003-03-19 00:03  544768  ----a-w-  c:windowssystem32msvcr71d.dll
2013-02-09 15:31 . 2004-08-04 02:21  81920  ----a-w-  c:windowssystem32msado25.tlb
2013-02-09 15:31 . 2001-04-05 14:43  1009336  ----a-w-  c:windowssystem32mschrt20.ocx
2013-02-09 15:31 . 1999-04-16 22:06  10752  ----a-w-  c:windowssystem32aamd532.dll
2013-02-09 15:31 . 1998-06-23 22:00  103744  ----a-w-  c:windowssystem32MSCOMM32.OCX
2013-02-09 15:30 . 2004-07-10 02:44  608448  ----a-w-  c:windowssystem32comctl32.ocx
2013-02-09 15:30 . 2004-06-09 13:59  939224  ----a-w-  c:windowssystem32Flash.ocx
2013-02-09 15:30 . 2004-03-01 18:55  561179  ----a-w-  c:windowssystem32dao360.dll
2013-02-09 15:30 . 2001-09-07 12:00  59904  ----a-w-  c:windowssystem32wbemdisp.tlb
2013-02-09 15:30 . 2001-09-07 11:00  61440  ----a-w-  c:windowssystem32msado20.tlb
2013-02-09 15:30 . 2000-12-05 23:00  209608  ----a-w-  c:windowssystem32tabctl32.ocx
2013-02-09 15:30 . 2000-05-21 22:00  115920  ----a-w-  c:windowssystem32MSINET.ocx
2013-02-09 15:30 . 2000-04-03 14:52  164144  ----a-w-  c:windowssystem32comct232.ocx
2013-02-09 15:30 . 1998-06-17 22:00  299008  ----a-w-  c:windowssystem32MSDBRPTR.DLL
2013-02-09 15:30 . 1998-06-08 22:00  137216  ----a-w-  c:windowssystem32MSDERUN.DLL
2013-02-07 21:59 . 2013-02-07 21:59  --------  d-----w-  c:program filesMicrosoft ActiveSync
2013-02-07 21:59 . 2013-02-07 21:59  --------  d-----w-  c:windowsSHELLNEW
2013-02-07 21:59 . 2013-02-07 21:59  --------  d-----w-  c:program filesMicrosoft.NET
2013-02-07 08:40 . 2013-02-07 08:40  --------  d-----w-  c:documents and settingsihLocal SettingsApplication DataGoogle
2013-02-07 08:39 . 2013-02-21 15:52  --------  d-----w-  c:documents and settingsAll UsersApplication DataInstallMate
2013-02-06 20:10 . 2013-02-06 20:10  --------  d-----w-  c:documents and settingsAll UsersApplication DataUbisoft
2013-02-06 20:05 . 2013-02-06 20:05  --------  d-----w-  c:documents and settingsihApplication DataPunkBuster
2013-02-05 13:36 . 2013-02-05 13:36  145920  --sha-r-  c:windowssystem32odfox32I.exe
2013-02-02 01:36 . 2013-02-10 16:04  --------  d-----w-  c:documents and settingsihLocal SettingsApplication DataVMware
2013-02-02 01:36 . 2013-02-10 15:20  --------  d-----w-  c:documents and settingsihApplication DataVMware
2013-02-02 01:12 . 2013-02-02 01:12  --------  d-----w-  c:documents and settingsihApplication DataMagic Stones
2013-02-02 01:02 . 2013-02-02 01:02  --------  d-----w-  c:documents and settingsihApplication DataFreeHideIP
2013-02-02 01:02 . 2013-02-02 01:02  --------  d-----w-  c:documents and settingsAll UsersApplication DataFreeHideIP
2013-02-01 23:06 . 2013-02-01 23:06  107888  ----a-w-  c:windowssystem32CmdLineExt.dll
2013-02-01 23:05 . 2013-02-01 23:05  22328  ----a-w-  c:documents and settingsihApplication DataPnkBstrK.sys
2013-02-01 23:04 . 2013-02-01 23:04  2250024  ----a-w-  c:windowssystem32pbsvc.exe
2013-02-01 22:47 . 2013-02-01 22:57  --------  d-----w-  c:documents and settingsihApplication DataDAEMON Tools Lite
2013-02-01 22:47 . 2013-02-01 22:57  --------  d-----w-  c:documents and settingsAll UsersApplication DataDAEMON Tools Lite
2013-02-01 19:39 . 2013-02-15 13:04  --------  d-----w-  c:program filesSystemRequirementsLab
2013-02-01 19:39 . 2013-02-01 19:39  --------  d-----w-  c:documents and settingsihApplication DataSystemRequirementsLab
2013-01-27 21:15 . 2013-01-27 21:15  --------  d-----w-  c:program filesEvisoft
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-02-23 00:21 . 2012-11-10 23:01  861088  ----a-w-  c:windowssystem32npDeployJava1.dll
2013-02-23 00:21 . 2012-11-10 23:01  782240  ----a-w-  c:windowssystem32deployJava1.dll
2013-02-09 19:17 . 2013-01-14 16:10  74096  ----a-w-  c:windowssystem32FlashPlayerCPLApp.cpl
2013-02-09 19:17 . 2013-01-14 16:10  697712  ----a-w-  c:windowssystem32FlashPlayerApp.exe
2012-12-17 09:38 . 2012-11-10 10:27  867344  ----a-w-  c:windowssystem32driversESLWireACD.sys
2013-02-20 12:12 . 2013-02-20 12:11  263064  ----a-w-  c:program filesmozilla firefoxcomponentsbrowsercomps.dll
.
.
(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
--- c:documents and settingsihApplication Dataflood.bat ---
Company: ------
File Description: ------
File Version: ------
Product Name: ------
Copyright: ------
Original Filename: ------
File size: 36
Created time: 2013-02-21 16:23
Modified time: 2013-02-21 16:27
MD5: A90EB00FE9C0C4B68DD90186BA472DC3
SHA1: 074FBADF6B097EF35A0FFFA97310202739C61700
.
.
--- c:windowssystem32odfox32I.exe ---
Company: ------
File Description: ------
File Version: ------
Product Name: ------
Copyright: ------
Original Filename: ------
File size: 145920
Created time: 2013-02-05 13:36
Modified time: 2013-02-05 13:36
MD5: !HASH: COULD NOT OPEN FILE !!!!!
SHA1: !HASH: COULD NOT OPEN FILE !!!!!
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2008-12-22 . 362BC5AF8EAF712832C58CC13AE05750 . 1614848 . . [5.1.2600.5512] . . c:windowssystem32sfcfiles.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
"Skype"="c:program filesSkypePhoneSkype.exe" [2008-11-07 21633320]
.
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
"RTHDCPL"="RTHDCPL.EXE" [2007-07-05 16380416]
"NvCplDaemon"="c:windowssystem32NvCpl.dll" [2012-09-23 15512424]
.
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunOnce]
"WIAWizardMenu"="c:windowssystem32sti_ci.dll" [2008-04-14 136704]
.
[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
"CTFMON.EXE"="c:windowssystem32ctfmon.exe" [2008-04-14 15360]
.
[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRunOnce]
"_nltide_2"="shell32" [X]
.
[HKLM~startupfolderC:^Documents and Settings^All Users^Start Menu^Programs^Startup^McAfee Security Scan Plus.lnk]
path=c:documents and settingsAll UsersStart MenuProgramsStartupMcAfee Security Scan Plus.lnk
backup=c:windowspssMcAfee Security Scan Plus.lnkCommon Startup
.
[HKLM~startupfolderC:^Documents and Settings^ih^Start Menu^Programs^Startup^Facebook Messenger.lnk]
path=c:documents and settingsihStart MenuProgramsStartupFacebook Messenger.lnk
backup=c:windowspssFacebook Messenger.lnkStartup
.
[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregAdobe ARM]
2012-09-23 18:43  926896  ----a-w-  c:program filesCommon FilesAdobeARM1.0AdobeARM.exe
.
[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregAlcmtr]
2005-05-03 10:43  69632  ------r-  c:windowsAlcmtr.exe
.
[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregBigDogPath]
2004-06-09 13:37  40960  ----a-w-  c:windowsVm_sti.exe
.
[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregCTFMON.EXE]
2008-04-14 08:00  15360  ----a-w-  c:windowssystem32ctfmon.exe
.
[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregDAEMON Tools Lite]
2012-11-06 10:46  3673728  ----a-w-  c:program filesDAEMON Tools LiteDTLite.exe
.
[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregIMJPMIG8.1]
2008-04-14 08:00  208952  ----a-w-  c:windowsimeIMJP8_1imjpmig.exe
.
[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregMarine Aquarium Lite Search Scope Monitor]
2013-02-16 02:41  42536  ----a-w-  c:progra~1MARINE~2bar1.bin57SrchMn.exe
.
[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregMSMSGS]
2008-04-14 01:42  1695232  ------w-  c:program filesMessengermsmsgs.exe
.
[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregNvCplDaemon]
2012-09-23 13:04  15512424  ----a-w-  c:windowssystem32nvcpl.dll
.
[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregNVIDIA nTune]
2007-09-04 17:25  81920  ----a-w-  c:program filesNVIDIA CorporationnTunenTuneCmd.exe
.
[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregNvMediaCenter]
2012-09-23 13:04  108392  ----a-w-  c:windowssystem32nvmctray.dll
.
[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregnwiz]
2012-09-23 14:28  1634112  ----a-w-  c:program filesNVIDIA Corporationnviewnwiz.exe
.
[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregOptimizer Pro]
2012-10-21 07:46  81952  ----a-w-  c:program filesOptimizer ProOptProLauncher.exe
.
[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregPHIME2002A]
2008-04-14 08:00  455168  ----a-w-  c:windowssystem32IMETINTLGNTTINTSETP.EXE
.
[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregPHIME2002ASync]
2008-04-14 08:00  455168  ----a-w-  c:windowssystem32IMETINTLGNTTINTSETP.EXE
.
[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregSunJavaUpdateSched]
2012-07-03 07:04  252848  ----a-w-  c:program filesCommon FilesJavaJava Updatejusched.exe
.
[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupreguTorrent]
2012-12-30 23:26  969104  ----a-w-  c:program filesuTorrentuTorrent.exe
.
[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigservices]
"VMware NAT Service"=2 (0x2)
"VMUSBArbService"=2 (0x2)
"VMnetDHCP"=2 (0x2)
"VMAuthdService"=2 (0x2)
"ufad-ws60"=3 (0x3)
"nTuneService"=2 (0x2)
"HTTPFilter"=3 (0x3)
"helpsvc"=2 (0x2)
"Apache2.4"=2 (0x2)
.
[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity center]
"AntiVirusOverride"=dword:00000001
.
[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
"%windir%Network Diagnosticxpnetdiag.exe"=
"%windir%system32sessmgr.exe"=
"c:Program FilesuTorrentuTorrent.exe"=
"c:Program FilesSteamSteam.exe"=
"c:Program FilesVMwareVMware Workstationvmware-authd.exe"=
"d:ИгриCounter-Strike Global Offensivecsgo.exe"=
"c:Program FilesGRETECHGomPlayerGOM.EXE"=
"c:Program FilesNVIDIA CorporationNVIDIA Update Coredaemonu.exe"=
"c:WINDOWSsystem32dpvsetup.exe"=
"c:WINDOWSsystem32msiexec.exe"=
"d:ИгриFarCry2Far Cry 2binFarCry2.exe"=
"d:ИгриFarCry2Far Cry 2binFC2Launcher.exe"=
"d:ИгриFarCry2Far Cry 2binFC2Editor.exe"=
"d:ИгриAssasin`s CreedACRSP.exe"=
"d:ИгриAssasin`s CreedACRMP.exe"=
"d:ИгриAssasin`s CreedAssassinsCreedRevelations.exe"=
"c:xamppmysqlbinmysqld.exe"=
"d:ТорентИгриCS 1.6 [CSMegaGaming Edition]hl.exe"=
"c:Program FilesSteamsteamappscommonHalf-Lifehl.exe"=
"c:Program FilesJavajre7binjava.exe"=
"c:Program FilesSkypePhoneSkype.exe"=
.
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:windowssystem32driversdtsoftbus01.sys [11/9/2012 6:34 PM 242240]
R2 vmci;VMware vmci;c:windowssystem32driversvmci.sys [3/25/2011 11:42 PM 70768]
R3 AR9271;Wireless Network Adapter Service;c:windowssystem32driversathuw.sys [11/8/2012 12:39 AM 1763584]
R3 VCSVADHWSer;Avnex Virtual Audio Device (WDM);c:windowssystem32driversvcsvad.sys [12/29/2012 7:55 PM 17792]
S2 MarineAquarium3Free_57Service;Marine Aquarium LiteService;c:progra~1MARINE~2bar1.bin57barsvc.exe [2/16/2013 4:41 AM 42504]
S3 ZSMC302;VIMICRO USB PC Camera;c:windowssystem32driversusbVM31b.sys [1/13/2013 4:18 PM 90568]
S4 Apache2.2;Apache2.2;c:xamppapachebinhttpd.exe [8/18/2012 12:38 PM 22016]
S4 Apache2.4;Apache2.4;c:xamppapachebinhttpd.exe [8/18/2012 12:38 PM 22016]
S4 VMUSBArbService;VMware USB Arbitration Service;c:program filesCommon FilesVMwareUSBvmware-usbarbitrator.exe [3/25/2011 10:27 PM 539248]
.
Contents of the 'Scheduled Tasks' folder
.
2013-02-25 c:windowsTasksAdobe Flash Player Updater.job
- c:windowssystem32MacromedFlashFlashPlayerUpdateService.exe [2013-01-14 19:17]
.
2013-02-25 c:windowsTasksContinueToSaveUpdaterTask{A78AD3F0-1F59-4658-A6ED-7BABA71195C6}.job
- c:documents and settingsAll UsersApplication DataPremiumContinueToSaveContinueToSave.exe [2013-01-03 14:50]
.
2013-02-25 c:windowsTasksschedule!1173230912.job
- c:documents and settingsAll UsersApplication DataBetterSoftOptimizerProOptimizerPro.exe [2013-02-21 19:58]
.
.
------- Supplementary Scan -------
.
IE: E&xport to Microsoft Excel - c:progra~1MICROS~3OFFICE11EXCEL.EXE/3000
LSP: c:program filesVMwareVMware Workstationvsocklib.dll
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces{4BB4C3AC-9218-4829-B21B-C305E1B4D43B}: NameServer = 8.26.56.26,156.154.70.22
FF - ProfilePath - c:documents and settingsihApplication DataMozillaFirefoxProfilesm23axj0l.default
FF - prefs.js: browser.search.defaulturl - hxxp://websearch.pu-results.info/?pid=377&r=2013/02/21&hid=2283671635&lg=EN&cc=BG&l=1&q=
FF - prefs.js: browser.search.selectedEngine - Google SSL
FF - prefs.js: browser.startup.homepage - hxxp://home.mywebsearch.com/index.jhtml?ptb=2A1DB8A7-5369-4FE3-8714-45206D91E8BB&n=77fc45a4&p2=^0D^xdm060^YY^bg&si=275192
FF - prefs.js: keyword.URL - hxxp://search.mywebsearch.com/mywebsearch/GGmain.jhtml?st=kwd&ptb=2A1DB8A7-5369-4FE3-8714-45206D91E8BB&n=77fc45a4&ind=2013021604&p2=^0D^xdm060^YY^bg&si=275192&searchfor=
FF - ExtSQL: 2013-01-10 18:30; {e9876d64-8bac-4287-bdc4-0f0c56804b4f}; c:documents and settingsihApplication DataMozillaFirefoxProfilesm23axj0l.defaultextensions{e9876d64-8bac-4287-bdc4-0f0c56804b4f}.xpi
FF - ExtSQL: 2013-01-10 18:37; {d47a9f51-8281-43fa-f450-f28ef8735e9a}; c:documents and settingsihApplication DataMozillaFirefoxProfilesm23axj0l.defaultextensions{d47a9f51-8281-43fa-f450-f28ef8735e9a}.xpi
FF - ExtSQL: 2013-01-10 18:44; {BCC877E7-7F3F-4632-8338-DAEE4475DE35}; c:documents and settingsihApplication DataMozillaFirefoxProfilesm23axj0l.defaultextensions{BCC877E7-7F3F-4632-8338-DAEE4475DE35}.xpi
FF - ExtSQL: 2013-01-10 18:46; {166745b8-8d4a-4c86-9120-696de51a77aa}; c:documents and settingsihApplication DataMozillaFirefoxProfilesm23axj0l.defaultextensions{166745b8-8d4a-4c86-9120-696de51a77aa}.xpi
FF - ExtSQL: 2013-01-11 11:22; [email protected]; c:documents and settingsihApplication DataMozillaFirefoxProfilesm23axj0l.defaultextensionschecker@mail.bg.xpi
FF - ExtSQL: 2013-02-07 10:40; [email protected]; c:documents and settingsihApplication DataMozillaFirefoxProfilesm23axj0l.defaultextensions511367b0bcaa1@511367b0bcad9.com
FF - ExtSQL: 2013-02-16 04:41; 57ffxtbr@MarineAquarium3Free_57.com; c:documents and settingsihApplication DataMozillaFirefoxProfilesm23axj0l.defaultextensions57ffxtbr@MarineAquarium3Free_57.com
FF - ExtSQL: 2013-02-20 13:41; [email protected]; c:documents and settingsihApplication DataMozillaFirefoxProfilesm23axj0l.defaultextensionszZ2jWZ1H22Jb5NdELHS@o0jQVWZkY1gx1.com.xpi
FF - ExtSQL: 2013-02-21 18:18; [email protected]; c:documents and settingsihApplication DataMozillaFirefoxProfilesm23axj0l.defaultextensions512648e1f19e8@512648e1f1a1f.com
FF - ExtSQL: 2013-02-21 18:20; [email protected]; c:documents and settingsihApplication DataMozillaFirefoxProfilesm23axj0l.defaultextensions5126495d72690@5126495d726c9.com
FF - ExtSQL: !HIDDEN! 2013-02-16 04:41; 57ffxtbr@MarineAquarium3Free_57.com; c:program filesMarineAquarium3Free_57bar1.bin
FF - user.js: extensions.spamfreesearch.autoRvrt - false
FF - user.js: extensions.spamfreesearch_i.hmpg - true
FF - user.js: extensions.spamfreesearch.hmpgUrl - hxxp://blekko.com/ws/?source=5f97ddbe&tbp=homepage&u=20ed2233000000000000b0487a947e65
FF - user.js: extensions.spamfreesearch.dfltSrch - true
FF - user.js: extensions.spamfreesearch.srchPrvdr - blekko
FF - user.js: extensions.spamfreesearch.keyWordUrl - hxxp://blekko.com/ws/?source=5f97ddbe&tbp=rbox&u=20ed2233000000000000b0487a947e65&q=
FF - user.js: extensions.spamfreesearch_i.dnsErr - true
FF - user.js: extensions.spamfreesearch_i.newTab - true
FF - user.js: extensions.spamfreesearch.newTabUrl - chrome://spamfreesearch/content/new browser tab.html?source=5f97ddbe&tbp=tab&u=20ed2233000000000000b0487a947e65
FF - user.js: extensions.spamfreesearch.tlbrSrchUrl - hxxp://blekko.com/ws/?source=5f97ddbe&tbp=main&u=20ed2233000000000000b0487a947e65&q=
FF - user.js: extensions.spamfreesearch.id - 20ed2233000000000000b0487a947e65
FF - user.js: extensions.spamfreesearch.appId - {1005247F-A178-490A-8DC3-6BAF09EA427B}
FF - user.js: extensions.spamfreesearch.instlDay - 15758
FF - user.js: extensions.spamfreesearch.vrsn - 1.8.3.9
FF - user.js: extensions.spamfreesearch.vrsni - 1.8.3.9
FF - user.js: extensions.spamfreesearch_i.vrsnTs - 1.8.3.913:52
FF - user.js: extensions.spamfreesearch.prtnrId - blekko
FF - user.js: extensions.spamfreesearch.prdct - spamfreesearch
FF - user.js: extensions.spamfreesearch.aflt - orgnl
FF - user.js: extensions.spamfreesearch_i.smplGrp - none
FF - user.js: extensions.spamfreesearch.tlbrId - base
FF - user.js: extensions.spamfreesearch.instlRef - 5f97ddbe
FF - user.js: extensions.spamfreesearch.dfltLng -
FF - user.js: extensions.spamfreesearch.excTlbr - false
FF - user.js: extensions.spamfreesearch.admin - false
.
- - - - ORPHANS REMOVED - - - -
.
BHO-{59B591F2-F892-F531-029A-68CA7C314684} - c:documents and settingsAll UsersApplication DataSearch-NewTab5126495d72822.dll
MSConfigStartUp-MicroUpdate - c:documents and settingsihMy DocumentsMSDCSCmsdcsc.exe
AddRemove-spamfreesearch - c:program filesblekkospamfreesearch1.8.3.9uninstall.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-02-25 21:12
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...  
.
scanning hidden autostart entries ...
.
scanning hidden files ...  
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINEsoftwareClassesCLSID{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:WINDOWSsystem32MacromedFlashFlashUtil32_11_5_502_149_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINEsoftwareClassesCLSID{73C9DFA0-750D-11E1-B0C4-0800200C9A66}Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINEsoftwareClassesCLSID{73C9DFA0-750D-11E1-B0C4-0800200C9A66}LocalServer32]
@="c:WINDOWSsystem32MacromedFlashFlashUtil32_11_5_502_149_ActiveX.exe"
.
[HKEY_LOCAL_MACHINEsoftwareClassesCLSID{73C9DFA0-750D-11E1-B0C4-0800200C9A66}TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINEsoftwareClassesInterface{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINEsoftwareClassesInterface{6AE38AE0-750C-11E1-B0C4-0800200C9A66}ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINEsoftwareClassesInterface{6AE38AE0-750C-11E1-B0C4-0800200C9A66}TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINEsoftwareMicrosoftWindows NTCurrentVersion561ad306-5297-65a9-c042-86c8e66e327]
@Denied: (Full) (AuthenticatedUsers)
@Denied: (Full) (Administrators)
"1vkf5hql6xj02"=hex:65,64,33,34,36,61,35,30,2d,61,30,37,64,2d,34,34,31,62,2d,
39,62,62,38,2d,33,62,38,31,64,33,66,35,34,38,63,62
"1a636p124tavd"=hex:65,00,00,00,f8,00,00,00,ce,b1,f4,ec,64,6a,65,6d,00,00,00,
00,00,00,00,00,00,00,00,00,50,6a,34,ed,7d,a0,1b,44,9b,b8,3b,81,d3,f5,48,cb,
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'explorer.exe'(2144)
c:windowssystem32WININET.dll
c:windowssystem32ieframe.dll
c:windowssystem32wpdshserviceobj.dll
c:windowssystem32portabledevicetypes.dll
c:windowssystem32portabledeviceapi.dll
c:program filesWinRARrarext.dll
c:program filesInternet Explorermui0402browselc.dll
c:program filesCommon FilesAdobeAcrobatActiveXPDFShell.dll
.
------------------------ Other Running Processes ------------------------
.
c:windowssystem32nvsvc32.exe
c:windowsRTHDCPL.EXE
.
**************************************************************************
.
Completion time: 2013-02-25  21:15:02 - machine was rebooted
ComboFix-quarantined-files.txt  2013-02-25 19:15
ComboFix2.txt  2013-02-25 15:30
.
Pre-Run: 5,470,633,984 bytes free
Post-Run: 5,470,208,000 bytes free
.
- - End Of File - - 807FEB28373FAC104C62ED7337A34E9E

 

Публикувано изображениеМоля, изтеглете и стартирайте програмата AdwCleaner(by Xplode):

  • Затворете всички стартирани програми и браузъри
  • Кликнете два пъти върху adwcleaner.exe за да стартирате инструмента.
  • Този път маркирайте Delete
  • Вашият компютър ще се рестартира автоматично. Текстовия файл ще се отвори след рестарта.
  • Моля, да публикувате съдържанието на този лог в отговора си
  • Можете да намерите лога,който автоматично се запомня тук C:AdwCleaner[s1].txt.
Публикувано изображение

 


Публикувано изображение Моля, изтеглете Junkware Removal Tool (by Thisisu ) и запазете на вашия десктоп.

  • Спрете временно работата на защитните програми.
  • Стартирайте инструмента JRT.exe
  • Ще се отвори ДОС прозорец. Натиснете което и да е копче от клавиатурата.
  • Затворете излишните приложения и всички браузъри и изчакайте проверката да завърши.
  • Ще се появи лог файл (който можете да намерите и ръчно на десктопа с името JRT.txt).
  • Моля копирайте съдържанието на лог файла в следващия си пост.
Публикувано изображение

 

 

Публикувано изображение Изтеглете Malwarebytes' Anti-Malware или от тук (не забравяйте да обновите програмата с нови дефиниции)
* Кликнете два пъти върху mbam-setup.exe, за да инсталирате програмата.
* Уверете се, че са поставени отметки на Update Malwarebytes' Anti-Malware и Launch Malwarebytes' Anti-Malware. След това кликнете на Finish.
* Ако има намерени обновявания, тя ще ги изтегли и инсталира.
* Стартирайте програмата и изберете "Perform Full Scan", след това кликнете на Scan.
* Сканирането ще отнеме малко време, затова моля да бъдете търпеливи.
* Когато сканирането завърши, кликнете на OK, след това Show Results, за да видите резултата
* Уверете се, че на всички редове има отметки, и кликнете на Remove Selected.
* Когато всичко бъде премахнато, в Notepad ще бъде отворен лог.
Копирайте този лог и го публикувайте в следващия си коментар по темата.

 

Забележка: Ако MalwareBytes' Anti-Malware се затрудни в премахването на откритите вируси/заплахи, той ще поиска да рестартира компютъра Ви и по време на рестартирането да премахне проблемните вируси/заплахи. Ако бъдете попитани, потвърдете че желаете вашия компютър да бъде рестартиран.

  • Автор

Може ли да се активира "Malwarebytes"  да не е на пробен период..а пълната версия :)?

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Junkware Removal Tool (JRT) by Thisisu Version: 4.6.5 (02.18.2013:1) OS: Microsoft Windows XP x64 Ran by ih on вторник 02/26/2013 at  0:47:54.59 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services ~~~ Registry Values Successfully deleted: [Registry Value] hkey_current_usersoftwaremicrosoftinternet explorersearchscopesbprotectordefaultscope Successfully repaired: [Registry Value] hkey_local_machinesoftwaremicrosoftinternet explorermainStart Page Successfully repaired: [Registry Value] hkey_current_usersoftwaremicrosoftinternet explorersearchscopes{0633ee93-d776-472f-a0ff-e1416b8b2e3a}DisplayName Successfully repaired: [Registry Value] hkey_current_usersoftwaremicrosoftinternet explorersearchscopes{0633ee93-d776-472f-a0ff-e1416b8b2e3a}URL Successfully repaired: [Registry Value] hkey_local_machinesoftwaremicrosoftinternet explorersearchscopes{0633ee93-d776-472f-a0ff-e1416b8b2e3a}DisplayName Successfully repaired: [Registry Value] hkey_local_machinesoftwaremicrosoftinternet explorersearchscopes{0633ee93-d776-472f-a0ff-e1416b8b2e3a}URL Successfully repaired: [Registry Value] hkey_local_machinesoftwaremicrosoftinternet explorerabouturlsTabs ~~~ Registry Keys Successfully deleted: [Registry Key] hkey_classes_rootescort.escortiepane Successfully deleted: [Registry Key] hkey_classes_rootescort.escortiepane.1 Successfully deleted: [Registry Key] hkey_classes_rootesrv.funmoodsesrvc Successfully deleted: [Registry Key] hkey_classes_rootesrv.funmoodsesrvc.1 Successfully deleted: [Registry Key] hkey_current_usersoftware1clickdownload Successfully deleted: [Registry Key] hkey_local_machinesoftwarebabylon Successfully deleted: [Registry Key] hkey_current_usersoftwarecrossrider Failed to delete: [Registry Key] hkey_current_usersoftwaredatamngr_toolbar Successfully deleted: [Registry Key] hkey_current_usersoftwaredsnr labs Successfully deleted: [Registry Key] hkey_local_machinesoftwareiminent Successfully deleted: [Registry Key] hkey_current_usersoftwareoptimizer pro Successfully deleted: [Registry Key] hkey_current_usersoftwaresoftonic Successfully deleted: [Registry Key] hkey_current_usersoftwarestartsearch Successfully deleted: [Registry Key] hkey_current_usersoftwaresweetim Successfully deleted: [Registry Key] hkey_local_machinesoftwaresweetim Successfully deleted: [Registry Key] hkey_current_usersoftwareyourfiledownloader Successfully deleted: [Registry Key] hkey_local_machinesoftwareyourfiledownloader Successfully deleted: [Registry Key] hkey_current_usersoftwareappdatalowsprotector Successfully deleted: [Registry Key] hkey_local_machinesoftwareclassesappidescort.dll Successfully deleted: [Registry Key] hkey_local_machinesoftwareclassesappidescortapp.dll Successfully deleted: [Registry Key] hkey_local_machinesoftwareclassesappidescorteng.dll Successfully deleted: [Registry Key] hkey_local_machinesoftwareclassesappidescortlbr.dll Successfully deleted: [Registry Key] hkey_local_machinesoftwareclassesappidesrv.exe Successfully deleted: [Registry Key] hkey_local_machinesoftwareclassesprod.cap Successfully deleted: [Registry Key] hkey_current_usersoftwaremicrosoftinternet explorersearchscopes{0ecdf796-c2dc-4d79-a620-cce0c0a66cc9} Successfully deleted: [Registry Key] hkey_classes_rootclsid{75a4d144-506d-4be5-81db-ec7da1e7f840} Successfully deleted: [Registry Key] hkey_current_usersoftwaremicrosoftinternet explorersearchscopes{b7971660-a1ce-4fdd-b9e0-2c37d77afb0b} Successfully deleted: [Registry Key] hkey_local_machinesoftwaremicrosoftinternet explorersearchscopes{b7971660-a1ce-4fdd-b9e0-2c37d77afb0b} Successfully deleted: [Registry Key] hkey_current_usersoftwaremicrosoftinternet explorersearchscopes{bb74de59-bc4c-4172-9ac4-73315f71cffe} Successfully deleted: [Registry Key] hkey_local_machinesoftwaremicrosoftinternet explorersearchscopes{bb74de59-bc4c-4172-9ac4-73315f71cffe} Successfully deleted: [Registry Key] hkey_current_usersoftwaremicrosoftinternet explorersearchscopes{eee6c360-6118-11dc-9c72-001320c79847} Successfully deleted: [Registry Key] hkey_local_machinesoftwaremicrosoftinternet explorersearchscopes{eee6c360-6118-11dc-9c72-001320c79847} Successfully deleted: [Registry Key] "hkey_current_usersoftwareapn pip" Successfully deleted: [Registry Key] "hkey_local_machinesoftwarepip" ~~~ Files ~~~ Folders ~~~ FireFox Successfully deleted: [File] C:Documents and SettingsihApplication Datamozillafirefoxprofilesm23axj0l.defaultuser.js Successfully deleted: [File] C:Documents and SettingsihApplication Datamozillafirefoxprofilesm23axj0l.defaultsearchpluginsmy-web-search.xml Successfully deleted: [File] C:Documents and SettingsihApplication Datamozillafirefoxprofilesm23axj0l.defaultsearchpluginsspamfreesearch.xml Successfully deleted: [File] C:Documents and SettingsihApplication Datamozillafirefoxprofilesm23axj0l.defaultsearchpluginswebsearch.xml Successfully deleted: [Folder] C:Documents and SettingsihApplication Datamozillafirefoxprofilesm23axj0l.defaultextensions511367b0bcaa1@511367b0bcad9.com Successfully deleted: [Folder] C:Documents and SettingsihApplication Datamozillafirefoxprofilesm23axj0l.defaultextensions512648e1f19e8@512648e1f1a1f.com Successfully deleted: [Folder] C:Documents and SettingsihApplication Datamozillafirefoxprofilesm23axj0l.defaultextensions5126495d72690@5126495d726c9.com Successfully deleted: [Folder] C:Documents and SettingsihApplication Datamozillafirefoxprofilesm23axj0l.defaultextensions57ffxtbr@marineaquarium3free_57.com Successfully deleted: [Registry Value] hkey_local_machinesoftwaremozillafirefoxextensions57ffxtbr@marineaquarium3free_57.com Successfully deleted: [Registry Value] hkey_local_machinesoftwaremozillafirefoxextensions{acaa314b-eeba-48e4-ad47-84e31c44796c} Successfully deleted the following from C:Documents and SettingsihApplication Datamozillafirefoxprofilesm23axj0l.defaultprefs.js user_pref("aol_toolbar.default.homepage.check", false); user_pref("aol_toolbar.default.search.check", false); user_pref("browser.search.defaultenginename", "WebSearch"); user_pref("browser.search.defaultenginename,S", "WebSearch"); user_pref("browser.search.defaulturl", "hxxp://websearch.pu-results.info/?pid=377&r=2013/02/21&hid=2283671635&lg=EN&cc=BG&l=1&q="); user_pref("browser.search.order.1", "blekko"); user_pref("browser.search.order.1,S", "WebSearch"); user_pref("browser.search.selectedEngine,S", "WebSearch"); user_pref("browser.startup.homepage", "hxxp://home.mywebsearch.com/index.jhtml?ptb=2A1DB8A7-5369-4FE3-8714-45206D91E8BB&n=77fc45a4&p2=^0D^xdm060^YY^bg&si=275192"); user_pref("extensions.511367b0bcb4c.scode", "(function(){try{if('aol.com,mail.google.com,premiumreports.info,search.babylon.com,search.gboxapp.com'.indexOf(window.self.locatio user_pref("extensions.512648e1f1a8c.scode", "(function(){try{if('aol.com,mail.google.com,premiumreports.info,search.babylon.com,search.gboxapp.com'.indexOf(window.self.locatio user_pref("extensions.BabylonToolbar.prtkDS", 0); user_pref("extensions.BabylonToolbar.prtkHmpg", 0); user_pref("extensions.mywebsearch.prevDefaultEngine", "Google"); user_pref("extensions.mywebsearch.prevKwdEnabled", true); user_pref("extensions.mywebsearch.prevKwdURL", "hxxp://search.mywebsearch.com/mywebsearch/GGmain.jhtml?st=kwd&ptb=2A1DB8A7-5369-4FE3-8714-45206D91E8BB&n=77fc45a4&ind=201302160 user_pref("extensions.mywebsearch.prevSelectedEngine", "Google SSL"); user_pref("extensions.spamfreesearch.hmpgUrl", "hxxp://blekko.com/ws/?source=5f97ddbe&tbp=homepage&u=20ed2233000000000000b0487a947e65"); user_pref("extensions.spamfreesearch.keyWordUrl", "hxxp://blekko.com/ws/?source=5f97ddbe&tbp=rbox&u=20ed2233000000000000b0487a947e65&q="); user_pref("extensions.spamfreesearch.prtnrId", "blekko"); user_pref("extensions.spamfreesearch.srchPrvdr", "blekko"); user_pref("extensions.spamfreesearch.tlbrSrchUrl", "hxxp://blekko.com/ws/?source=5f97ddbe&tbp=main&u=20ed2233000000000000b0487a947e65&q="); user_pref("extensions.toolbar.mindspark._57Members_.homepage", "hxxp://home.mywebsearch.com/index.jhtml?ptb=2A1DB8A7-5369-4FE3-8714-45206D91E8BB&n=77fc45a4&p2=^0D^xdm060^YY^bg user_pref("extensions.toolbar.mindspark._57Members_.hp.enabled", true); user_pref("extensions.toolbar.mindspark._57Members_.hp.lastGuardTime", 290351343); user_pref("extensions.toolbar.mindspark._57Members_.hp.numGuards", 1); user_pref("extensions.toolbar.mindspark._57Members_.initialized", true); user_pref("extensions.toolbar.mindspark._57Members_.installation.contextKey", ""); user_pref("extensions.toolbar.mindspark._57Members_.installation.installDate", "2013021604"); user_pref("extensions.toolbar.mindspark._57Members_.installation.partnerId", "^0D^xdm060^YY^bg"); user_pref("extensions.toolbar.mindspark._57Members_.installation.partnerSubId", "275192"); user_pref("extensions.toolbar.mindspark._57Members_.installation.success", true); user_pref("extensions.toolbar.mindspark._57Members_.installation.toolbarId", "2A1DB8A7-5369-4FE3-8714-45206D91E8BB"); user_pref("extensions.toolbar.mindspark._57Members_.lastActivePing", "1361812522086"); user_pref("extensions.toolbar.mindspark._57Members_.options.defaultSearch", false); user_pref("extensions.toolbar.mindspark._57Members_.options.homePageEnabled", true); user_pref("extensions.toolbar.mindspark._57Members_.options.keywordEnabled", true); user_pref("extensions.toolbar.mindspark._57Members_.options.tabEnabled", true); user_pref("extensions.toolbar.mindspark._57Members_.searchHistory", ""); user_pref("extensions.toolbar.mindspark._57Members_.weather.location", "10001"); user_pref("extensions.toolbar.mindspark._65Members_.homepage", "hxxp://home.mywebsearch.com/index.jhtml?ptb=3F60AED6-38E3-4C20-A30F-CB2525421732&n=77fc2099&p2=^Y6^xdm039^YY^bg user_pref("extensions.toolbar.mindspark._65Members_.initialized", true); user_pref("extensions.toolbar.mindspark._65Members_.installation.contextKey", ""); user_pref("extensions.toolbar.mindspark._65Members_.installation.installDate", "2013012121"); user_pref("extensions.toolbar.mindspark._65Members_.installation.partnerId", "^Y6^xdm039^YY^bg"); user_pref("extensions.toolbar.mindspark._65Members_.installation.partnerSubId", "swissconverter"); user_pref("extensions.toolbar.mindspark._65Members_.installation.success", true); user_pref("extensions.toolbar.mindspark._65Members_.installation.toolbarId", "3F60AED6-38E3-4C20-A30F-CB2525421732"); user_pref("extensions.toolbar.mindspark._65Members_.lastActivePing", "1360273635210"); user_pref("extensions.toolbar.mindspark._65Members_.options.defaultSearch", false); user_pref("extensions.toolbar.mindspark._65Members_.options.homePageEnabled", false); user_pref("extensions.toolbar.mindspark._65Members_.options.keywordEnabled", false); user_pref("extensions.toolbar.mindspark._65Members_.options.tabEnabled", false); user_pref("extensions.toolbar.mindspark._65Members_.weather.location", "10001"); user_pref("extensions.toolbar.mindspark.hp.enabled", true); user_pref("extensions.toolbar.mindspark.hp.enabled.guid", "[email protected]"); user_pref("extensions.toolbar.mindspark.lastInstalled", "[email protected]"); user_pref("keyword.URL", "hxxp://search.mywebsearch.com/mywebsearch/GGmain.jhtml?st=kwd&ptb=2A1DB8A7-5369-4FE3-8714-45206D91E8BB&n=77fc45a4&ind=2013021604&p2=^0D^xdm060^YY^bg& user_pref("sweetim.toolbar.previous.browser.search.defaultenginename", ""); user_pref("sweetim.toolbar.previous.browser.search.selectedEngine", ""); user_pref("sweetim.toolbar.previous.browser.startup.homepage", ""); user_pref("sweetim.toolbar.previous.keyword.URL", ""); user_pref("sweetim.toolbar.scripts.1.domain-blacklist", ""); user_pref("sweetim.toolbar.searchguard.UserRejectedGuard_DS", ""); user_pref("sweetim.toolbar.searchguard.UserRejectedGuard_HP", ""); user_pref("sweetim.toolbar.searchguard.enable", ""); Emptied folder: C:Documents and SettingsihApplication Datamozillafirefoxprofilesm23axj0l.defaultminidumps [4 files] ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Scan was completed on вторник 02/26/2013 at  1:00:52.90 End of JRT log ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  

 

 

 

Malwarebytes Anti-Malware (Пробна версия) 1.70.0.1100 www.malwarebytes.org Версия на базата от данни: v2013.02.25.08 Windows XP Service Pack 3 x86 NTFS Internet Explorer 7.0.5730.13 ih :: INDUSTRI-61C180 [администратор] Защита: включена 2/26/2013 12:56:16 AM mbam-log-2013-02-26 (00-56-16).txt Тип сканиране: Пълно сканиране (C:|D:|) Включени опции за сканиране: Памет | Автоматично зареждане | Системен регистър | Файлова система | Евристики/Допълнителни | Евристики/Shuriken | PUP | PUM Изключени опции за сканиране: P2P Сканирани обекти: 265665 Изминало време: 29 минута(и), 7 секунда(и) Открити процеси в паметта: 0 (Не бяха открити зловредни обекти) Открити модули в паметта: 0 (Не бяха открити зловредни обекти) Открити ключове в системния регистър: 9 HKCUSOFTWAREMicrosoftInternet ExplorerSearchScopes{B7971660-A1CE-4FDD-B9E0-2C37D77AFB0B} (PUP.FunMoods) -> Поставен под карантина и изтрит успешно. HKLMSOFTWAREMicrosoftInternet ExplorerSearchScopes{B7971660-A1CE-4FDD-B9E0-2C37D77AFB0B} (PUP.FunMoods) -> Поставен под карантина и изтрит успешно. HKLMSOFTWAREMicrosoftInternet ExplorerLow RightsElevationPolicy{11111111-1111-1111-1111-110011341191} (PUP.GamePlayLab) -> Поставен под карантина и изтрит успешно. HKLMSOFTWAREMicrosoftInternet ExplorerLow RightsElevationPolicy{C87FC351-A80D-43E9-9A86-CF1E29DC443A} (PUP.Funmoods) -> Поставен под карантина и изтрит успешно. HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsSETUP.EXE (PUP.Offerware) -> Поставен под карантина и изтрит успешно. HKCUSoftwareGoogleChromeExtensionsbbjciahceamgodcoidkjpchnokgfpphh (PUP.Funmoods) -> Поставен под карантина и изтрит успешно. HKCUSoftwareGoogleChromeExtensionscjpglkicenollcignonpgiafdgfeehoj (PUP.FunMoods) -> Поставен под карантина и изтрит успешно. HKLMSOFTWAREGoogleChromeExtensionsbbjciahceamgodcoidkjpchnokgfpphh (PUP.Funmoods) -> Поставен под карантина и изтрит успешно. HKLMSOFTWAREGoogleChromeExtensionscjpglkicenollcignonpgiafdgfeehoj (PUP.FunMoods) -> Поставен под карантина и изтрит успешно. Открити стойности в системния регистър: 0 (Не бяха открити зловредни обекти) Открити информационни обекти в системния регистър: 0 (Не бяха открити зловредни обекти) Открити папки: 0 (Не бяха открити зловредни обекти) Открити файлове: 53 C:Documents and SettingsihMy DocumentsDownloadssetup.exe (PUP.Offerware) -> Поставен под карантина и изтрит успешно. C:Program FilesSteamsteamappscommonHalf-Lifeflood.exe (Spyware.PWS) -> Поставен под карантина и изтрит успешно. C:Program FilesSteamsteamappscommonHalf-Lifecstrikeflood.exe (Spyware.PWS) -> Поставен под карантина и изтрит успешно. C:QooboxQuarantineCDocuments and SettingsihApplication Datafuckme.exe.vir (Trojan.Downloader) -> Поставен под карантина и изтрит успешно. C:QooboxQuarantineCDocuments and SettingsihApplication Datammeeeeeeeeeeeeeeeeeeee.exe.vir (Trojan.Downloader) -> Поставен под карантина и изтрит успешно. C:QooboxQuarantineCDocuments and SettingsihApplication Datawifi password hack.exe.vir (Trojan.Agent) -> Поставен под карантина и изтрит успешно. C:QooboxQuarantineCDocuments and SettingsihApplication Datainstallserver.exe.vir (Trojan.Agent) -> Поставен под карантина и изтрит успешно. C:QooboxQuarantineCDocuments and SettingsihMy DocumentsMSDCSCmsdcsc.exe.vir (Backdoor.Agent.DCRSAGen) -> Поставен под карантина и изтрит успешно. C:QooboxQuarantineCWINDOWSpssserver.exeStartup.vir (Trojan.Agent) -> Поставен под карантина и изтрит успешно. C:QooboxQuarantineCWINDOWSsystem32installserver.exe.vir (Trojan.Agent) -> Поставен под карантина и изтрит успешно. C:System Volume Information_restore{10875B51-E556-48E1-8CC4-36DE25FA1810}RP17A0011748.exe (PUP.Passwordtool.Cain) -> Поставен под карантина и изтрит успешно. C:System Volume Information_restore{10875B51-E556-48E1-8CC4-36DE25FA1810}RP17A0011751.exe (HackTool.Cain) -> Поставен под карантина и изтрит успешно. C:System Volume Information_restore{10875B51-E556-48E1-8CC4-36DE25FA1810}RP17A0011753.exe (HackTool.Cain) -> Поставен под карантина и изтрит успешно. C:System Volume Information_restore{10875B51-E556-48E1-8CC4-36DE25FA1810}RP23A0013010.exe (Trojan.Agent) -> Поставен под карантина и изтрит успешно. C:System Volume Information_restore{10875B51-E556-48E1-8CC4-36DE25FA1810}RP23A0013012.exe (Trojan.Agent) -> Поставен под карантина и изтрит успешно. C:System Volume Information_restore{10875B51-E556-48E1-8CC4-36DE25FA1810}RP23A0014004.exe (Trojan.Agent) -> Поставен под карантина и изтрит успешно. C:System Volume Information_restore{10875B51-E556-48E1-8CC4-36DE25FA1810}RP23A0014007.exe (Trojan.Agent) -> Поставен под карантина и изтрит успешно. C:System Volume Information_restore{10875B51-E556-48E1-8CC4-36DE25FA1810}RP24A0015004.exe (Trojan.Agent) -> Поставен под карантина и изтрит успешно. C:System Volume Information_restore{10875B51-E556-48E1-8CC4-36DE25FA1810}RP24A0015008.exe (Trojan.Agent) -> Поставен под карантина и изтрит успешно. C:System Volume Information_restore{10875B51-E556-48E1-8CC4-36DE25FA1810}RP24A0016004.exe (Trojan.Agent) -> Поставен под карантина и изтрит успешно. C:System Volume Information_restore{10875B51-E556-48E1-8CC4-36DE25FA1810}RP24A0016007.exe (Trojan.Agent) -> Поставен под карантина и изтрит успешно. C:System Volume Information_restore{10875B51-E556-48E1-8CC4-36DE25FA1810}RP24A0017004.exe (Trojan.Agent) -> Поставен под карантина и изтрит успешно. C:System Volume Information_restore{10875B51-E556-48E1-8CC4-36DE25FA1810}RP24A0017006.exe (Trojan.Agent) -> Поставен под карантина и изтрит успешно. C:System Volume Information_restore{10875B51-E556-48E1-8CC4-36DE25FA1810}RP25A0018004.exe (Trojan.Agent) -> Поставен под карантина и изтрит успешно. C:System Volume Information_restore{10875B51-E556-48E1-8CC4-36DE25FA1810}RP25A0018007.exe (Trojan.Agent) -> Поставен под карантина и изтрит успешно. C:System Volume Information_restore{10875B51-E556-48E1-8CC4-36DE25FA1810}RP25A0019004.exe (Trojan.Agent) -> Поставен под карантина и изтрит успешно. C:System Volume Information_restore{10875B51-E556-48E1-8CC4-36DE25FA1810}RP25A0019006.exe (Trojan.Agent) -> Поставен под карантина и изтрит успешно. C:System Volume Information_restore{10875B51-E556-48E1-8CC4-36DE25FA1810}RP26A0020006.exe (Trojan.Agent) -> Поставен под карантина и изтрит успешно. C:System Volume Information_restore{10875B51-E556-48E1-8CC4-36DE25FA1810}RP26A0020007.exe (Trojan.Agent) -> Поставен под карантина и изтрит успешно. C:System Volume Information_restore{10875B51-E556-48E1-8CC4-36DE25FA1810}RP26A0021004.exe (Trojan.Agent) -> Поставен под карантина и изтрит успешно. C:System Volume Information_restore{10875B51-E556-48E1-8CC4-36DE25FA1810}RP26A0021007.exe (Trojan.Agent) -> Поставен под карантина и изтрит успешно. C:System Volume Information_restore{10875B51-E556-48E1-8CC4-36DE25FA1810}RP26A0021019.exe (PUP.Offerware) -> Поставен под карантина и изтрит успешно. C:System Volume Information_restore{10875B51-E556-48E1-8CC4-36DE25FA1810}RP26A0021032.exe (Spyware.PWS) -> Поставен под карантина и изтрит успешно. C:System Volume Information_restore{10875B51-E556-48E1-8CC4-36DE25FA1810}RP26A0022004.exe (Trojan.Agent) -> Поставен под карантина и изтрит успешно. C:System Volume Information_restore{10875B51-E556-48E1-8CC4-36DE25FA1810}RP26A0022005.exe (Trojan.Agent) -> Поставен под карантина и изтрит успешно. C:System Volume Information_restore{10875B51-E556-48E1-8CC4-36DE25FA1810}RP27A0023005.exe (Trojan.Agent) -> Поставен под карантина и изтрит успешно. C:System Volume Information_restore{10875B51-E556-48E1-8CC4-36DE25FA1810}RP27A0023006.exe (Trojan.Agent) -> Поставен под карантина и изтрит успешно. C:System Volume Information_restore{10875B51-E556-48E1-8CC4-36DE25FA1810}RP29A0024005.exe (Trojan.Agent) -> Поставен под карантина и изтрит успешно. C:System Volume Information_restore{10875B51-E556-48E1-8CC4-36DE25FA1810}RP29A0024008.exe (Trojan.Agent) -> Поставен под карантина и изтрит успешно. C:System Volume Information_restore{10875B51-E556-48E1-8CC4-36DE25FA1810}RP29A0025005.exe (Trojan.Agent) -> Поставен под карантина и изтрит успешно. C:System Volume Information_restore{10875B51-E556-48E1-8CC4-36DE25FA1810}RP29A0025008.exe (Trojan.Agent) -> Поставен под карантина и изтрит успешно. C:System Volume Information_restore{10875B51-E556-48E1-8CC4-36DE25FA1810}RP29A0026005.exe (Trojan.Agent) -> Поставен под карантина и изтрит успешно. C:System Volume Information_restore{10875B51-E556-48E1-8CC4-36DE25FA1810}RP29A0026007.exe (Trojan.Agent) -> Поставен под карантина и изтрит успешно. C:System Volume Information_restore{10875B51-E556-48E1-8CC4-36DE25FA1810}RP30A0027005.exe (Trojan.Agent) -> Поставен под карантина и изтрит успешно. C:System Volume Information_restore{10875B51-E556-48E1-8CC4-36DE25FA1810}RP30A0027009.exe (Trojan.Agent) -> Поставен под карантина и изтрит успешно. C:System Volume Information_restore{10875B51-E556-48E1-8CC4-36DE25FA1810}RP30A0027067.exe (Trojan.Downloader) -> Поставен под карантина и изтрит успешно. C:System Volume Information_restore{10875B51-E556-48E1-8CC4-36DE25FA1810}RP30A0027068.exe (Trojan.Downloader) -> Поставен под карантина и изтрит успешно. C:System Volume Information_restore{10875B51-E556-48E1-8CC4-36DE25FA1810}RP30A0027070.exe (Trojan.Agent) -> Поставен под карантина и изтрит успешно. C:System Volume Information_restore{10875B51-E556-48E1-8CC4-36DE25FA1810}RP30A0027089.exe (Trojan.Agent) -> Поставен под карантина и изтрит успешно. C:System Volume Information_restore{10875B51-E556-48E1-8CC4-36DE25FA1810}RP30A0027324.exe (Trojan.Agent) -> Поставен под карантина и изтрит успешно. C:WINDOWSsystem32odfox32I.exe (Adware.SanctionedMedia) -> Поставен под карантина и изтрит успешно. D:phpDesignerphpDesigner 8.1.1keygen.exe (Malware.Packer) -> Поставен под карантина и изтрит успешно. D:ТорентПрограмиVMware Workstation Full v7.1.4 build 385536Keygenkeygen.exe (Trojan.Agent.CK) -> Поставен под карантина и изтрит успешно. (край)

Малко сте съкратили инструкциите ми.....!!! :(

 

 

Копирайте текста в карето на notepad и го запазвате с име CFScript.txt на десктопа си:

 

KILLALL:: File::c:documents and settingsihApplication Dataflood.bat RegLock::[HKEY_LOCAL_MACHINEsoftwareMicrosoftWindows NTCurrentVersion561ad306-5297-65a9-c042-86c8e66e327]   


След съхранението преместете  CFScript.txt на иконата на ComboFix.exe

 

Публикувано изображение

 

Генерирания рапорт копирайте  и го поставете в следващия си коментар...!

Архивирана тема

Темата е твърде стара и е архивирана. Не можете да добавяте нови отговори в нея, но винаги можете да публикувате нова тема, в която да продължи дискусията. Регистрирайте се или влезте във вашия профил за да публикувате нова тема.

Назад

Разглеждащи това в момента 0

  • Няма регистрирани потребители разглеждащи тази страница.

Дарение

  • Подкрепи съществуването на форума - направи дарение
    32%
    Дарени 315 € от нужните 1 000 €

Бюлетин

Получавайте известие, когато има важна промяна или новина свързана с форума.
Абонирайте се

Профил

Навигация

Търсене

Търсене

Конфигуриране на push известия в браузъра
Chrome (Android)
  1. Докоснете иконата на катинар до адресната лента.
  2. Докоснете Разрешения → Известия.
  3. Променете предпочитанията си.
Chrome (Desktop)
  1. Кликнете върху иконата на катинар в адресната лента.
  2. Изберете Настройки на сайта.
  3. Намерете Известия и коригирайте предпочитанията си.