DDS

DDS (Ver_2011-09-30.01) - NTFS_AMD64 Internet Explorer: 9.10.9200.16576  BrowserJavaVersion: 10.21.2 Run by Acer at 18:54:32 on 2013-05-20 Microsoft Windows 7 Ultimate 6.1.7601.1.1251.359.1026.18.3067.1924 [GMT 3:00] . AV: avast! Antivirus *Enabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C} SP: avast! Antivirus *Enabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . ============== Running Processes =============== . C:Windowssystem32wininit.exe C:Windowssystem32lsm.exe C:Windowssystem32svchost.exe -k DcomLaunch C:Windowssystem32svchost.exe -k RPCSS C:Windowssystem32atiesrxx.exe C:WindowsSystem32svchost.exe -k LocalServiceNetworkRestricted C:WindowsSystem32svchost.exe -k LocalSystemNetworkRestricted C:Windowssystem32svchost.exe -k LocalService C:Windowssystem32svchost.exe -k netsvcs C:Windowssystem32svchost.exe -k GPSvcGroup C:Windowssystem32svchost.exe -k NetworkService C:Program FilesAVAST SoftwareAvastAvastSvc.exe C:WindowsSystem32spoolsv.exe C:Windowssystem32svchost.exe -k LocalServiceNoNetwork C:Windowssystem32svchost.exe -k LocalServiceAndNoImpersonation C:Windowssystem32svchost.exe -k imgsvc C:Windowssystem32atieclxx.exe C:Windowssystem32taskhost.exe C:Windowssystem32Dwm.exe C:Program Files (x86)Launch ManagerLManager.exe C:Program FilesAVAST SoftwareAvastAvastUI.exe C:Program Files (x86)ATI TechnologiesATI.ACECore-StaticMOM.exe C:Program Files (x86)Common FilesJavaJava Updatejusched.exe C:Program FilesWindows Media Playerwmpnetwk.exe C:Program Files (x86)ATI TechnologiesATI.ACECore-StaticCCC.exe C:WindowsMicrosoft.NetFramework64v3.0WPFPresentationFontCache.exe C:Program Files (x86)Common FilesAdobeARM1.0armsvc.exe C:Windowsexplorer.exe C:Windowssystem32svchost.exe -k SDRSVC C:Program FilesInternet Exploreriexplore.exe C:Program Files (x86)Internet ExplorerIEXPLORE.EXE C:Program Files (x86)SkypePhoneSkype.exe C:UsersAcerAppDataLocalTempTeamViewerVersion8TeamViewer.exe C:UsersAcerAppDataLocalTempTeamViewerVersion8tv_w32.exe C:UsersAcerAppDataLocalTempTeamViewerVersion8tv_x64.exe C:Windowssystem32conhost.exe C:Windowssystem32wbemwmiprvse.exe C:WindowsSystem32cscript.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://www.google.com uSearch Bar = Preserve mWinlogon: Userinit = userinit.exe BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:Program Files (x86)Javajre7binssv.dll BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:Program Files (x86)Javajre7binjp2ssv.dll TB: FireShot: {6E6E744E-4D20-4ce3-9A7A-26DFFFE22F68} - mRun: [startCCC] "C:Program Files (x86)ATI TechnologiesATI.ACECore-StaticCLIStart.exe" MSRun mRun: [LManager] C:Program Files (x86)Launch ManagerLManager.exe mRun: [avast] "C:Program FilesAVAST SoftwareAvastavastUI.exe" /nogui mRun: [Adobe ARM] "C:Program Files (x86)Common FilesAdobeARM1.0AdobeARM.exe" mRun: [sunJavaUpdateSched] "C:Program Files (x86)Common FilesJavaJava Updatejusched.exe" mRun: [bTE] C:Program Files (x86)Emailerbinemailer.exe -vhidden StartupFolder: C:PROGRA~3MICROS~1WindowsSTARTM~1ProgramsStartupstart.lnk - C:Windowsopitstartup.bat StartupFolder: C:PROGRA~3MICROS~1WindowsSTARTM~1ProgramsStartupstartup.lnk - C:WindowsXQLstartup.bat uPolicies-Explorer: NoDriveTypeAutoRun = dword:145 mPolicies-Explorer: NoActiveDesktop = dword:1 mPolicies-Explorer: NoActiveDesktopChanges = dword:1 mPolicies-System: ConsentPromptBehaviorAdmin = dword:0 mPolicies-System: ConsentPromptBehaviorUser = dword:3 mPolicies-System: EnableLUA = dword:0 mPolicies-System: EnableUIADesktopToggle = dword:0 mPolicies-System: PromptOnSecureDesktop = dword:0 IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab TCP: NameServer = 192.168.0.1 TCP: Interfaces{2C0C151F-02B9-4517-830C-4C85937B401E} : DHCPNameServer = 192.168.0.1 TCP: Interfaces{2C0C151F-02B9-4517-830C-4C85937B401E}D696D6F6 : DHCPNameServer = 192.168.1.1 TCP: Interfaces{6566FEED-884D-4CB3-8453-65DD3D33AEB8} : DHCPNameServer = 192.168.0.1 TCP: Interfaces{707DB68F-2ED3-4C43-9323-B23204010D71} : DHCPNameServer = 192.168.1.1 Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:Program Files (x86)Common FilesSkypeSkype4COM.dll SSODL: WebCheck - <orphaned> x64-TB: FireShot: {6E6E744E-4D20-4ce3-9A7A-26DFFFE22F68} - x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned> x64-SSODL: WebCheck - <orphaned> . ================= FIREFOX =================== . FF - ProfilePath - C:UsersAcerAppDataRoamingMozillaFirefoxProfiles8mu6rdyz.default FF - prefs.js: browser.startup.homepage - about:newtab FF - prefs.js: network.proxy.http - 75.147.246.155 FF - prefs.js: network.proxy.http_port - 5552 FF - prefs.js: network.proxy.type - 0 FF - plugin: C:Program Files (x86)AdobeReader 11.0ReaderAIRnppdf32.dll FF - plugin: C:Program Files (x86)Javajre7binplugin2npjp2.dll FF - plugin: C:Program Files (x86)Microsoft Silverlight5.1.20125.0npctrlui.dll FF - plugin: C:UsersAcerAppDataRoamingMozillaFirefoxProfiles8mu6rdyz.defaultextensions{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}pluginsnpGarmin.dll FF - plugin: C:WindowsSysWOW64MacromedFlashNPSWF32_11_7_700_202.dll . ============= SERVICES / DRIVERS =============== . R0 aswRvrt;aswRvrt;C:WindowsSystem32driversaswRvrt.sys [2013-2-28 65336] R0 aswVmm;aswVmm;C:WindowsSystem32driversaswVmm.sys [2013-2-28 178624] R1 aswSnx;aswSnx;C:WindowsSystem32driversaswSnx.sys [2013-2-1 1025808] R1 aswSP;aswSP;C:WindowsSystem32driversaswSP.sys [2013-2-1 377920] R1 vwififlt;Virtual WiFi Filter Driver;C:WindowsSystem32driversvwififlt.sys [2009-7-14 59904] R2 AdobeARMservice;Adobe Acrobat Update Service;C:Program Files (x86)Common FilesAdobeARM1.0armsvc.exe [2013-5-11 65640] R2 AMD External Events Utility;AMD External Events Utility;C:WindowsSystem32atiesrxx.exe [2012-11-16 238080] R2 aswFsBlk;aswFsBlk;C:WindowsSystem32driversaswFsBlk.sys [2013-2-1 33400] R2 aswMonFlt;aswMonFlt;C:WindowsSystem32driversaswMonFlt.sys [2013-2-1 80816] R2 avast! Antivirus;avast! Antivirus;C:Program FilesAVAST SoftwareAvastAvastSvc.exe [2013-3-19 45248] R3 amdkmdag;amdkmdag;C:WindowsSystem32driversatikmdag.sys [2012-11-17 11922944] R3 amdkmdap;amdkmdap;C:WindowsSystem32driversatikmpag.sys [2012-11-16 359936] R3 AtiHDAudioService;AMD Function Driver for HD Audio Service;C:WindowsSystem32driversAtihdW76.sys [2012-2-23 95760] R3 ATSwpWDF;AuthenTec TruePrint WBF Driver;C:WindowsSystem32driversATSwpWDF.sys [2012-10-18 1111856] R3 k57nd60a;Broadcom NetLink Gigabit Ethernet - NDIS 6.0;C:WindowsSystem32driversk57nd60a.sys [2009-6-10 270848] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:WindowsMicrosoft.NETFrameworkv4.0.30319mscorsvw.exe [2012-7-9 104912] S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:WindowsMicrosoft.NETFramework64v4.0.30319mscorsvw.exe [2012-7-9 123856] S2 SkypeUpdate;Skype Updater;C:Program Files (x86)SkypeUpdaterUpdater.exe [2013-2-28 161384] S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;C:WindowsSysWOW64MacromedFlashFlashPlayerUpdateService.exe [2013-2-2 256904] S3 athur;Wireless Network Adapter Service;C:WindowsSystem32driversathurx.sys [2013-3-16 1930240] S3 dmvsc;dmvsc;C:WindowsSystem32driversdmvsc.sys [2010-11-21 71168] S3 MozillaMaintenance;Mozilla Maintenance Service;C:Program Files (x86)Mozilla Maintenance Servicemaintenanceservice.exe [2013-2-1 115608] S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:WindowsSystem32driversrdpvideominiport.sys [2013-2-1 19456] S3 Synth3dVsc;Synth3dVsc;C:WindowsSystem32driversSynth3dVsc.sys [2010-11-21 88960] S3 terminpt;Microsoft Remote Desktop Input Driver;C:WindowsSystem32driversterminpt.sys [2013-2-1 29696] S3 TsUsbFlt;TsUsbFlt;C:WindowsSystem32driversTsUsbFlt.sys [2013-2-1 57856] S3 TsUsbGD;Remote Desktop Generic USB Device;C:WindowsSystem32driversTsUsbGD.sys [2013-2-1 30208] S3 tsusbhub;tsusbhub;C:WindowsSystem32driverstsusbhub.sys [2010-11-21 117248] . =============== Created Last 30 ================ . 2013-05-15 09:17:23  --------  d-----w-  C:UsersAcerAppDataRoamingGarmin 2013-05-15 07:27:58  3153920  ----a-w-  C:WindowsSystem32win32k.sys 2013-05-15 07:27:57  983400  ----a-w-  C:WindowsSystem32driversdxgkrnl.sys 2013-05-15 07:27:57  265064  ----a-w-  C:WindowsSystem32driversdxgmms1.sys 2013-05-15 07:27:57  144384  ----a-w-  C:WindowsSystem32cdd.dll 2013-05-11 10:37:28  209472  ----a-w-  C:Program Files (x86)Mozilla FirefoxPluginsnppdf32.dll 2013-05-11 05:27:42  --------  d-----w-  C:Program Files (x86)Litecoin 2013-05-10 14:44:49  66753  ----a-w-  C:WindowsSystem32pthreadGC2.dll 2013-05-10 14:44:49  342248  ----a-w-  C:WindowsSystem32libcurl-4.dll 2013-05-10 14:44:49  245  ----a-w-  C:WindowsSystem32auto.bat 2013-04-29 09:24:01  587768  ----a-w-  C:WindowsSysWow64Codejock.SkinFramework.Unicode.v15.2.1.ocx 2013-04-29 09:24:01  1931256  ----a-w-  C:WindowsSysWow64Codejock.Controls.Unicode.v15.2.1.ocx 2013-04-28 15:38:30  --------  d-----w-  C:UsersAcerAppDataRoaming2BrightSparks 2013-04-26 15:59:50  --------  d-----w-  C:UsersAcerAppDataRoamingMalwarebytes 2013-04-26 15:59:42  --------  d-----w-  C:ProgramDataMalwarebytes 2013-04-26 15:59:40  25928  ----a-w-  C:WindowsSystem32driversmbam.sys 2013-04-26 15:59:40  --------  d-----w-  C:Program Files (x86)Malwarebytes' Anti-Malware 2013-04-26 15:59:33  --------  d-----w-  C:UsersAcerAppDataLocalPrograms 2013-04-25 14:36:19  --------  d-----w-  C:UsersAcerAppDataLocalElevatedDiagnostics 2013-04-24 05:16:53  1656680  ----a-w-  C:WindowsSystem32driversntfs.sys . ==================== Find3M  ==================== . 2013-05-15 07:07:54  71048  ----a-w-  C:WindowsSysWow64FlashPlayerCPLApp.cpl 2013-05-15 07:07:54  692104  ----a-w-  C:WindowsSysWow64FlashPlayerApp.exe 2013-04-13 05:49:23  135168  ----a-w-  C:WindowsapppatchAppPatch64AcXtrnal.dll 2013-04-13 05:49:19  350208  ----a-w-  C:WindowsapppatchAppPatch64AcLayers.dll 2013-04-13 05:49:19  308736  ----a-w-  C:WindowsapppatchAppPatch64AcGenral.dll 2013-04-13 05:49:19  111104  ----a-w-  C:WindowsapppatchAppPatch64acspecfc.dll 2013-04-13 04:45:16  474624  ----a-w-  C:WindowsapppatchAcSpecfc.dll 2013-04-13 04:45:15  2176512  ----a-w-  C:WindowsapppatchAcGenral.dll 2013-04-05 06:52:14  2242048  ----a-w-  C:WindowsSystem32wininet.dll 2013-04-05 06:50:36  3958784  ----a-w-  C:WindowsSystem32jscript9.dll 2013-04-05 06:50:31  67072  ----a-w-  C:WindowsSystem32iesetup.dll 2013-04-05 06:50:31  136704  ----a-w-  C:WindowsSystem32iesysprep.dll 2013-04-05 05:28:24  1767424  ----a-w-  C:WindowsSysWow64wininet.dll 2013-04-05 05:26:26  2877440  ----a-w-  C:WindowsSysWow64jscript9.dll 2013-04-05 05:26:21  61440  ----a-w-  C:WindowsSysWow64iesetup.dll 2013-04-05 05:26:21  109056  ----a-w-  C:WindowsSysWow64iesysprep.dll 2013-04-05 04:43:00  2706432  ----a-w-  C:WindowsSystem32mshtml.tlb 2013-04-05 04:29:45  2706432  ----a-w-  C:WindowsSysWow64mshtml.tlb 2013-04-05 03:51:11  89600  ----a-w-  C:WindowsSystem32RegisterIEPKEYs.exe 2013-04-05 03:38:25  71680  ----a-w-  C:WindowsSysWow64RegisterIEPKEYs.exe 2013-04-04 02:35:05  95648  ----a-w-  C:WindowsSysWow64WindowsAccessBridge-32.dll 2013-03-19 06:04:06  5550424  ----a-w-  C:WindowsSystem32ntoskrnl.exe 2013-03-19 05:53:58  48640  ----a-w-  C:WindowsSystem32wwanprotdim.dll 2013-03-19 05:53:58  230400  ----a-w-  C:WindowsSystem32wwansvc.dll 2013-03-19 05:46:56  43520  ----a-w-  C:WindowsSystem32csrsrv.dll 2013-03-19 05:04:13  3968856  ----a-w-  C:WindowsSysWow64ntkrnlpa.exe 2013-03-19 05:04:10  3913560  ----a-w-  C:WindowsSysWow64ntoskrnl.exe 2013-03-19 04:47:50  6656  ----a-w-  C:WindowsSysWow64apisetschema.dll 2013-03-19 03:06:33  112640  ----a-w-  C:WindowsSystem32smss.exe 2013-03-06 23:33:21  70992  ----a-w-  C:WindowsSystem32driversaswRdr2.sys 2013-03-06 23:33:21  65336  ----a-w-  C:WindowsSystem32driversaswRvrt.sys 2013-03-06 23:33:21  178624  ----a-w-  C:WindowsSystem32driversaswVmm.sys 2013-03-06 23:33:21  1025808  ----a-w-  C:WindowsSystem32driversaswSnx.sys 2013-03-06 23:33:20  80816  ----a-w-  C:WindowsSystem32driversaswMonFlt.sys 2013-03-06 23:32:51  41664  ----a-w-  C:WindowsavastSS.scr 2013-03-06 07:45:50  861088  ----a-w-  C:WindowsSysWow64npDeployJava1.dll 2013-03-06 07:45:50  782240  ----a-w-  C:WindowsSysWow64deployJava1.dll 2013-02-27 06:02:44  111448  ----a-w-  C:WindowsSystem32consent.exe 2013-02-27 05:48:00  1930752  ----a-w-  C:WindowsSystem32authui.dll 2013-02-27 05:47:10  70144  ----a-w-  C:WindowsSystem32appinfo.dll 2013-02-27 04:49:24  1796096  ----a-w-  C:WindowsSysWow64authui.dll 2013-02-26 18:12:50  9728  ---ha-w-  C:WindowsSysWow64api-ms-win-downlevel-shlwapi-l1-1-0.dll . ============= FINISH: 18:54:56,69 ===============  

 

 

Attach:

. UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2011-09-30.01) . Microsoft Windows 7 Ultimate Boot Device: DeviceHarddiskVolume1 Install Date: 1.2.2013 г. 19:51:00 System Uptime: 17.5.2013 г. 03:25:26 (87 hours ago) . Motherboard: Acer | | JV50_MV Processor: Pentium® Dual-Core CPU T4300 @ 2.10GHz | U2E1 | 1197/200mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 35 GiB total, 11,02 GiB free. D: is FIXED (NTFS) - 263 GiB total, 35,092 GiB free. E: is CDROM () F: is CDROM () . ==== Disabled Device Manager Items ============= . ==== System Restore Points =================== . No restore point in system. . ==== Installed Programs ====================== . µTorrent Adobe Flash Player 11 ActiveX Adobe Flash Player 11 Plugin Adobe Reader XI (11.0.03) Age of Empires II HD © Microsoft Studios version 1 AIMP3 AMD Accelerated Video Transcoding AMD APP SDK Runtime AMD Catalyst Install Manager AMD Drag and Drop Transcoding AMD Media Foundation Decoders avast! Free Antivirus Catalyst Control Center Catalyst Control Center - Branding Catalyst Control Center Graphics Previews Common Catalyst Control Center InstallProxy Catalyst Control Center Localization All ccc-utility64 CCC Help Chinese Standard CCC Help Chinese Traditional CCC Help Czech CCC Help Danish CCC Help Dutch CCC Help English CCC Help Finnish CCC Help French CCC Help German CCC Help Greek CCC Help Hungarian CCC Help Italian CCC Help Japanese CCC Help Korean CCC Help Norwegian CCC Help Polish CCC Help Portuguese CCC Help Russian CCC Help Spanish CCC Help Swedish CCC Help Thai CCC Help Turkish Daum PotPlayer 1.5.37776 FastStone Photo Resizer 3.1 Java 7 Update 21 Java Auto Updater Launch Manager Litecoin MagicDisc 2.7.106 Malwarebytes Anti-Malware, версия 1.75.0.1300 Microsoft .NET Framework 4.5 Microsoft Office 2007 Service Pack 3 (SP3) Microsoft Office Access MUI (Bulgarian) 2007 Microsoft Office Enterprise 2007 Microsoft Office Excel 2007 Help Актуализация (KB963678) Microsoft Office Excel MUI (Bulgarian) 2007 Microsoft Office File Validation Add-In Microsoft Office Groove MUI (Bulgarian) 2007 Microsoft Office InfoPath MUI (Bulgarian) 2007 Microsoft Office Office 64-bit Components 2007 Microsoft Office OneNote MUI (Bulgarian) 2007 Microsoft Office Outlook MUI (Bulgarian) 2007 Microsoft Office Powerpoint 2007 Help Актуализация (KB963669) Microsoft Office PowerPoint MUI (Bulgarian) 2007 Microsoft Office Proof (Bulgarian) 2007 Microsoft Office Proof (English) 2007 Microsoft Office Proof (German) 2007 Microsoft Office Proof (Russian) 2007 Microsoft Office Proofing (Bulgarian) 2007 Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) Microsoft Office Publisher MUI (Bulgarian) 2007 Microsoft Office Shared 64-bit MUI (Bulgarian) 2007 Microsoft Office Shared MUI (Bulgarian) 2007 Microsoft Office Word 2007 Help Актуализация (KB963665) Microsoft Office Word MUI (Bulgarian) 2007 Microsoft Silverlight Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 Mozilla Firefox 20.0.1 (x86 bg) Mozilla Maintenance Service Paint.NET v3.5.10 Security Update for Microsoft .NET Framework 4.5 (KB2737083) Security Update for Microsoft .NET Framework 4.5 (KB2742613) Security Update for Microsoft .NET Framework 4.5 (KB2789648) Security Update for Microsoft .NET Framework 4.5 (KB2804582) Security Update for Microsoft Office 2007 suites (KB2596615) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596672) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596744) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596754) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596792) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2597969) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2687311) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2687439) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2687441) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2687499) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2760416) 32-Bit Edition Security Update for Microsoft Office Excel 2007 (KB2687307) 32-Bit Edition Security Update for Microsoft Office InfoPath 2007 (KB2687440) 32-Bit Edition Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition Security Update for Microsoft Office Publisher 2007 (KB2597971) 32-Bit Edition Security Update for Microsoft Office Word 2007 (KB2760421) 32-Bit Edition Skype™ 6.3 SopCast 3.5.0 TechPowerUp GPU-Z The Settlers II - 10th Anniversary Update for 2007 Microsoft Office System (KB967642) Update for Microsoft .NET Framework 4.5 (KB2750147) Update for Microsoft .NET Framework 4.5 (KB2805221) Update for Microsoft .NET Framework 4.5 (KB2805226) Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2596802) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2817359) 32-Bit Edition Windows Media Player Firefox Plugin WinRAR 4.20 (64-битова версия) . ==== Event Viewer Messages From Past Week ======== . 13.5.2013 г. 20:00:59, Error: Microsoft-Windows-HttpEvent [15005] - Unable to bind to the underlying transport for [::]:2869. The IP Listen-Only list may contain a reference to an interface which may not exist on this machine. The data field contains the error number. 13.5.2013 г. 20:00:59, Error: Microsoft-Windows-HttpEvent [15005] - Unable to bind to the underlying transport for [::]:2869. The IP Listen-Only list may contain a reference to an interface which may not exist on this machine. The data field contains the error number. . ==== End Of File ===========================

Всичко по работата на лаптопа  изглежда нормално, но аз имам някакви подозрения за зловредна дейност.

Здравейте Людмил,

 

Логовете изглеждат наред - има няколко неща за които ще изкажа мнение, но първо искам да ви попитам на базата на какви симптоми се изявяват вашите съмнения?

 

Колкото до лог файла - има излишни (според мен) услуги работещи във фонов режим, които можете да прецените дали да забраните или сложите на Manual поне от Start => Services.msc

 

 

AMD External Events Utility => знам че вие сте по-хардуера и правите тестове и клокване, но аз лично не съм установил никаква полза от услугите на Ati & nVidia и винаги ги спирам, но вече зависи дали използвате HDMI и Catalyst Control Center и т.н. Но като видях, че сте инсталирали всичко що се отнася до CCC и AMD, явно използвате капацитетите на картите напълно.
amdkmdag => същото като горното
amdkmdap => същото като горното
AtiHDAudioService => същото като горното

 

AdobeARMservice => услуга за обновяване на Adobe, аз лично обновява ръчно (а и според зависи дали използвате безплатните или платените версии за някои е "опасно" да се обновяват)...
SkypeUpdate => цяла услуга за ъпдейт на Skype...проверявам ръчно за актуализации
AdobeFlashPlayerUpdateSvc => същото като горното
MozillaMaintenance => ако не използвате UAC, можете направо да деинсталирате услугата от Control Panel-a

TeamViewer8 => лично аз я оставям на Manual

Windows Media Player Network Sharing Service => ако не се занимавате със шерване, можете да я спрете

Windows Presentation Foundation Font Cache 3.0.0.0 => според BlackViper можете да я сложите на Manual

 

Други теоритични неща за спиране са следните (от Start => msconfig.exe => Startup)

 

mRun: [startCCC] "C:Program Files (x86)ATI TechnologiesATI.ACECore-StaticCLIStart.exe" MSRun => ако не ползвате Catalyst Control Center
mRun: [Adobe ARM] "C:Program Files (x86)Common FilesAdobeARM1.0AdobeARM.exe" => същото като услугата за ъпдейт на Adobe
mRun: [sunJavaUpdateSched] "C:Program Files (x86)Common FilesJavaJava Updatejusched.exe" => обновява Java, което е добра идея, но ако не искате излишни процеси, можете да проверявате и ръчно.

Забелязах, че има и стартиран процес:

 

C:WindowsSystem32cscript.exe

 

Лично аз като сетъпвам дадема машина спирам изцяло Windows Scripting Host с този инструмент, защото много червеи като Brontok използват този метод за разпространяване, а те макар и стари са все още доста разпространени "in the wild".

 

Тези да са ви познати, защото аз не съм ги срещал:
 

 

mRun: [bTE] C:Program Files (x86)Emailerbinemailer.exe -vhidden
StartupFolder: C:PROGRA~3MICROS~1WindowsSTARTM~1ProgramsStartupstart.lnk - C:Windowsopitstartup.bat
StartupFolder: C:PROGRA~3MICROS~1WindowsSTARTM~1ProgramsStartupstartup.lnk - C:WindowsXQLstartup.bat
2013-05-10 14:44:49   245   ----a-w-   C:WindowsSystem32auto.bat

2013-04-29 09:24:01  587768  ----a-w-  C:WindowsSysWow64Codejock.SkinFramework.Unicode.v15.2.1.ocx
2013-04-29 09:24:01  1931256  ----a-w-  C:WindowsSysWow64Codejock.Controls.Unicode.v15.2.1.ocx

 

Като цяло всичко изглежда наред и казаното от мен е по-скоро въпрос на личен избор (защото обичам чистотата) и не обичам пилеенето на системни ресурси, ако това не се налага или не го използвам. Ако имате някакви съмнения, можем да направим още проверки, но ако е просто за профилактична проверка, мисля, че не е необходимо.

 

Поздрави!

Съмненията идват от понякога тромавата работа на браузъра и интензивна работа на харда. Спрях скрипта и упдейтърите, Каталиста и Тиймвюер се ползват, така че остават, но те не се опасни, а и ситемата има достатъчно ресурси, така че не ме притеснява, че заемат малко RAM.   Благодаря!

За браузъра почистете кеша с CCleaner и пробвайте да оптимизирате SQlite базата данни с SpeedyFox.
За заявките на хардиска - вижте какво е положението с Process Explorer или Process Hacker за I/O
 

 
За активността може да е и от индексирането нещо...или да си прави нещо чрез Scheduled Tasks при idle на системата - я дефраг, я Windows Defender проверка.
Вижте S.M.A.R.T. на хардиска...направете му и една проверка chkdsk c: /x /r /f  от команден ред.
 
Има и други методи:
 
Инструмента аналог за XP (bootvis) за Vista/7 се казва xperf
http://windowsitpro.com/windows-server/q-where-can-i-download-xperf-and-xperfview-tools
Има и вариант с GUI - xperf123
http://xperf123.codeplex.com/
Освен xperf123 в папката C:Program Files\Microsoft Windows Performance Toolkit ще имате и xperfview.exe - той също дава яка графика на натоварването.
http://www.verboon.info/index.php/2011/07/tooltip-xperf123-simplify-windows-performance-data-collection/
 
А иначе за I/O можете да пробвате и Comodo KillSwitch:
http://help.comodo.com/topic-119-1-328-3555-viewing-system-information.html

 

Друг начин е да използвате вградения инструмент Resource Monitor на Windows:

 

 

 
Можем да направим и една проверка за рууткити:
 
Изтеглете Gmer
 
 

• Временно изключете интернет достъпа си, всички работещи програми (включително и антивирусната си програма и браузъра).
• Стартирайте програмата.
• След завършването на автоматичната проверка, махнете отметките от следните позиции, но оставете всички останали:
  - Show all
  - махнете отметките от всички локални дискове. Маркирайте само системния дял (обикновенно това е C: )
• Натиснете бутона Scan
• Изчакайте програмата да завърши сканирането,след което натиснете бутона Save и запишете (save as) резултатите на десктопа с име Gmer.log.
• Включете Интернета си и прикачете Gmer.log в следващия си коментар.
  Забележка:
• Не предприемайте никакви действия върху редовете маркирани с "<--- ROOТKIT" ,защото това може да доведе до проблеми с Windows.
  
  Поздрави!