Премини към съдържанието
Форумът в приложение

По-лесно сърфиране. Научи повече.
Kaldata.com - Форуми

Приложение на форума на цял екран с push известия, значки и други.

За да инсталирате това приложение на iOS и iPadOS
  1. Докоснете Иконата за споделяне в Safari
  2. Превъртете менюто и докоснете Добавяне към началния екран.
  3. Докоснете Добавяне в горния десен ъгъл.
За да инсталирате това приложение на Android
  1. Докоснете менюто с 3 точки (⋮) в горния десен ъгъл на браузъра.
  2. Докоснете Добавяне към началния екран или Инсталиране на приложение.
  3. Потвърдете, като докоснете Инсталиране.
Добави Kaldata.com в предпочитани източници в Google

Добре дошли!

Добре дошли в нашите форуми, пълни с полезна информация. Имате проблем с компютъра или телефона си? Публикувайте нова тема и ще намерите решение на всичките си проблеми. Общувайте свободно и открийте безброй нови приятели.

Моля, регистрирайте се за да публикувате тема и да получите пълен достъп до всички функции.

 

Проблем с Вирус

fresh_bones
в Премахване на зловреден софтуер

Featured Replies

  • Автор

alwarebytes Anti-Rootkit BETA 1.06.0.1003 www.malwarebytes.org Database version: v2013.06.15.05 Windows XP Service Pack 3 x86 NTFS Internet Explorer 8.0.6001.18702 Milen :: MILEN-F57DDEC85 [administrator] 6/15/2013 8:46:47 PM mbar-log-2013-06-15 (20-46-47).txt Scan type: Quick scan Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUM | P2P Scan options disabled: Deep Anti-Rootkit Scan | PUP Objects scanned: 195958 Time elapsed: 6 minute(s), 57 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) Physical Sectors Detected: 0 (No malicious items detected) (end)  

Това беше на последната стъпка 7 .

  • Отговори 57
  • Прегледи 7,8k
  • Създадено
  • Последен отговор

Така...положението е супер - почти сме готови.
 
Последни стъпки:
 
 
1. Моля архивирайте папката C:QooboxQuarantine и качете архива на този адрес.
Пратете ми линка за download на Лични съобщения и след това изтрийте архива, който създадохте, но без да триете самата папка.
Нея ще я изтрием като деинсталираме Combofix накрая.
 
2. Да възстановим няколко погрешно изтрити файла от Combofix:
 
Отворете notepad и с copy/paste поставете следната информация

Dequarantine::c:qooboxquarantinecwindowssystem32frapsvid.dll.virc:qooboxquarantinecwindowswinhelp.ini.virQuit::

Запазете файла с име CFScript и го провлачете и пуснете в Combofix (както на картинката отдолу):

Публикувано изображение

Публикувайте лог файл в следващия си пост.
 
 
3. Да почистим още малко боклуци от системата ви:

  • [*]Стартирайте файла Публикувано изображение с двукратен клик на мишката. [*]Под Публикувано изображение с
Copy/ Paste въведете изцяло следната текстова информация (само това, което е поставено в карето):

:OTL
FF - HKLMSoftwareMozillaPlugins@VideoDownloadConverter_4z.com/Plugin:  File not found
[2013/04/14 13:51:07 | 000,000,000 | ---D | M] (SpeedAnalysis.com) -- C:Documents and SettingsMilenApplication [email protected]
[2013/04/16 20:30:31 | 000,002,506 | ---- | M] () -- C:Documents and SettingsMilenApplication DataMozillaFirefoxProfileswx7a8jyy.defaultsearchpluginsask-search.xml
SafeBootMin: 62325127.sys - Driver
SafeBootNet: 62325127.sys - Driver
[2013/04/16 14:46:34 | 000,519,304 | ---- | M] (Ask Partner Network) -- C:Documents and SettingsMilenMy DocumentsAPNSetup.exe
[2013/04/14 13:50:55 | 000,001,132 | ---- | M] () -- C:Documents and SettingsMilenDesktopSpeedAnalysis.lnk
[2012/12/30 22:43:21 | 000,000,227 | RHS- | M] () -- C:WINDOWSassemblyDesktop.ini
[2013/04/14 13:49:59 | 000,030,894 | ---- | M] () -- C:Documents and SettingsMilenApplication Dataspeedanalysis.ico
:commands
[resethosts]
[emptytemp]

[*]След като въведете скрипта от цитата по-горе натиснете бутона, маркиран в червено: Run Fix [*]Windows ще се рестартира и ще се създаде лог файл - OTL fix log. Публикувайте съдържанието му с Copy/Paste в следващия си коментар.

4. Искам да направим последна проверка с най-новата версия на RogueKiller. Първо изтрийте вашата и изтеглете нова от линка в синьо по-долу:

  • [*]Изтеглете
RogueKiller.exe и го запазете на десктопа. [*]Стартирайте приложението и натиснете бутона SCAN. [*]Ще се създаде лог файл на десктопа с името RKreport.txt на десктопа. [*]Публикувайте лог файла в следващия си пост.

 

 

5. И тъй като случая при вас бе странен искам да съм сигурен, че всичко е наред - време е за Hitmanpro:

 

1.Изтеглете Hitman Pro.

  • [*]За
32-битова система - Публикувано изображение

2.Стартирайте програмата.
3.След като сте стартирали програмата като кликнете върху иконата Публикувано изображение и натиснете бутона „Напред“ като се съгласите с лицензионното споразумение (EULA).
4.Сложете отметка пред "Не, искам да завърша еднократно сканиране на компютъра".

5.Натиснете бутона „Напред“.

6.Програмата ще започне да сканира. Времето за сканиране е около 2 минути.

7.След завършване на сканирането от списъка с намерените неща (ако има такива) изберете Apply to all => Ignore.

8.Натиснете "Next" и след това натиснете "Изнеси резултата в XML file" и запазете лог файла на десктопа.

9.Архивирайте файла и го прикачете в следващия си коментар или копирайте съдържанието му в следващия си коментар.

 

 

След това ще ви кажа как да изтриете използваните от нас неща.
 
Поздрави!

  • Автор

ComboFix log :

c:qooboxquarantinecwindowssystem32frapsvid.dll.vir -> c:windowssystem32frapsvid.dll ( 65536 bytes ) c:qooboxquarantinecwindowswinhelp.ini.vir -> c:windowswinhelp.ini ( 901 bytes )

OLT log :

 

 

All processes killed ========== OTL ========== Registry key HKEY_LOCAL_MACHINESoftwareMozillaPlugins@VideoDownloadConverter_4z.com/Plugin deleted successfully. C:Documents and SettingsMilenApplication [email protected] folder moved successfully. C:Documents and SettingsMilenApplication DataMozillaExtensionsspeedanalysis@SpeedAnalysis.comchromecontentmz folder moved successfully. C:Documents and SettingsMilenApplication DataMozillaExtensionsspeedanalysis@SpeedAnalysis.comchromecontent folder moved successfully. C:Documents and SettingsMilenApplication [email protected] folder moved successfully. C:Documents and SettingsMilenApplication [email protected] folder moved successfully. C:Documents and SettingsMilenApplication DataMozillaFirefoxProfileswx7a8jyy.defaultsearchpluginsask-search.xml moved successfully. Registry key HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootMinimal62325127.sys deleted successfully. Registry key HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootNetwork62325127.sys deleted successfully. C:Documents and SettingsMilenMy DocumentsAPNSetup.exe moved successfully. C:Documents and SettingsMilenDesktopSpeedAnalysis.lnk moved successfully. C:WINDOWSassemblyDesktop.ini moved successfully. C:Documents and SettingsMilenApplication Dataspeedanalysis.ico moved successfully. ========== COMMANDS ========== C:WINDOWSSystem32driversetcHosts moved successfully. HOSTS file reset successfully   [EMPTYTEMP]   User: All Users   User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes   User: LocalService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 9306246 bytes ->Flash cache emptied: 5494 bytes   User: Milen ->Temp folder emptied: 13390366 bytes ->Temporary Internet Files folder emptied: 5622270 bytes ->FireFox cache emptied: 75971121 bytes ->Google Chrome cache emptied: 9845379 bytes ->Flash cache emptied: 15701 bytes   User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes   %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 2402044 bytes %systemroot%System32 .tmp files removed: 2577 bytes %systemroot%System32dllcache .tmp files removed: 0 bytes %systemroot%System32drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 16384 bytes %systemroot%system32configsystemprofileLocal SettingsTemp folder emptied: 0 bytes %systemroot%system32configsystemprofileLocal SettingsTemporary Internet Files folder emptied: 33170 bytes RecycleBin emptied: 0 bytes   Total Files Cleaned = 111.00 mb     OTL by OldTimer - Version 3.2.69.0 log created on 06162013_095603 FilesFolders moved on Reboot... PendingFileRenameOperations files... Registry entries deleted on Reboot...  

Супер - останаха само последните две стъпки и давам финалните инструкции. :)

Само да попитам от тези програми може ли да ми стане по бавен компа?

 

Не, те не се инсталират и скоро ще ги премахнем напълно от компютъра.

 

Точно обратното - би трябвало да стане по-бърз след премахването на вредителите...Защо питате? Да не го усещата като по-бавен или по-принцип?

  • Автор

Ми да усеща се малко по бавен и като цяло ми развали и някои игри направо като влеза и забива.Също така става нещо и с интернета изчезва после пак се появява .

Публикувайте и последните два лог файла, които поисках за да видя дали има остатъци от гадината.

Колкото до интернета би трябвало да е точно обратното - Combofix успешно поправи afd.sys, който бе пачнат от рууткита, но  ако още има проблеми с нета ще пробваме 2-3 неща.

След това ще деинсталираме и програмите. Колкото за прецаканите игри, не виждам, кое може да ги е прецакало, защото изтрихме само заразата, а това, което не бе заплаха го възстанових от карантината на Combofix. Както и да е - игрите винаги можете да ги преинсталирате нали? Важното бе да спасим Операционната Система от преинсталация.

Ако видите къде се намират намерените от Есет файлове ще разберете, че това е:

 

1. Карантинната папка на Combofix - C:Qoobox и те са безвредни за компютъра, а самата папка ще се изтрие след като деинсталираме Combofix.2

2. Другия файл е архива на папката C:qoobox, който създадохте за мен, и който бях споменал да изтриете ръчно след като ми пратите линка към архива на Лично Съобщение (явно сте забвавили да го изтриете, но и той е безобиден).

 

Така че като заключения мога да спомена, че системата ви е чиста, но вие упорито не предоставяте исканите последни два лог файла от новата версия на RogueKiller и Hitmanpro за да можем да разчистим използваните от нас неща и да видим дали можем да подобрим малко скоростта на интернета...

  • Автор

Rougekiller log

 

RogueKiller V8.6.1 [Jun 17 2013] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/
Website : http://tigzy.geekstogo.com/roguekiller.php
Blog : http://tigzyrk.blogspot.com/

Operating System : Windows XP (5.1.2600 Service Pack 3) 32 bits version
Started in : Normal mode
User : Milen [Admin rights]
Mode : Remove -- Date : 06/18/2013 13:09:26
| ARK || FAK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 2 ¤¤¤
[HJ POL] HKLM[...]System : DisableRegistryTools (0) -> DELETED
[HJ DESK] HKLM[...]NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)

¤¤¤ Scheduled tasks : 0 ¤¤¤

¤¤¤ Startup Entries : 0 ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [LOADED] ¤¤¤
[Address] SSDT[19] : NtAssignProcessToJobObject @ 0x805D66D0 -> HOOKED (Unknown @ 0x8958CC90)
[Address] SSDT[57] : NtDebugActiveProcess @ 0x80643CB2 -> HOOKED (Unknown @ 0x8958D200)
[Address] SSDT[68] : NtDuplicateObject @ 0x805BE03C -> HOOKED (Unknown @ 0x8958D2F0)
[Address] SSDT[122] : NtOpenProcess @ 0x805CB486 -> HOOKED (Unknown @ 0x8958C590)
[Address] SSDT[128] : NtOpenThread @ 0x805CB712 -> HOOKED (Unknown @ 0x8958C800)
[Address] SSDT[137] : NtProtectVirtualMemory @ 0x805B8452 -> HOOKED (Unknown @ 0x8958CFD0)
[Address] SSDT[180] : NtQueueApcThread @ 0x805D2786 -> HOOKED (Unknown @ 0x8958D0E0)
[Address] SSDT[213] : NtSetContextThread @ 0x805D2C4A -> HOOKED (Unknown @ 0x8958CEC0)
[Address] SSDT[229] : NtSetInformationThread @ 0x805CC154 -> HOOKED (Unknown @ 0x8958CD90)
[Address] SSDT[237] : NtSetSecurityObject @ 0x805C0662 -> HOOKED (Unknown @ 0x89589DA0)
[Address] SSDT[253] : NtSuspendProcess @ 0x805D4B10 -> HOOKED (Unknown @ 0x8958CB90)
[Address] SSDT[254] : NtSuspendThread @ 0x805D4982 -> HOOKED (Unknown @ 0x8958CA80)
[Address] SSDT[257] : NtTerminateProcess @ 0x805D2308 -> HOOKED (Unknown @ 0x8958C6E0)
[Address] SSDT[258] : NtTerminateThread @ 0x805D2502 -> HOOKED (Unknown @ 0x8958CA50)
[Address] SSDT[277] : NtWriteVirtualMemory @ 0x805B4400 -> HOOKED (Unknown @ 0x8958D6D0)

¤¤¤ External Hives: ¤¤¤

¤¤¤ Infection :  ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
--> %SystemRoot%System32driversetchosts


ÿþ1

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: SAMSUNG HD502HJ +++++
--- User ---
[MBR] 7b38b521ed089e33361e4357e3d955d4
[bSP] e34e6f3e44a8c4bd4c3d92300b6919f0 : Windows XP MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 204797 Mo
1 - [XXXXXX] EXTEN-LBA (0x0f) [VISIBLE] Offset (sectors): 419425020 | Size: 272132 Mo
User = LL1 ... OK!
User = LL2 ... OK!

Finished : << RKreport[0]_D_06182013_130926.txt >>
RKreport[0]_S_06182013_130917.txt


 


RogueKiller V8.6.1 [Jun 17 2013] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/
Website : http://tigzy.geekstogo.com/roguekiller.php
Blog : http://tigzyrk.blogspot.com/

Operating System : Windows XP (5.1.2600 Service Pack 3) 32 bits version
Started in : Normal mode
User : Milen [Admin rights]
Mode : Scan -- Date : 06/18/2013 13:09:17
| ARK || FAK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 2 ¤¤¤
[HJ POL] HKLM[...]System : DisableRegistryTools (0) -> FOUND
[HJ DESK] HKLM[...]NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Scheduled tasks : 0 ¤¤¤

¤¤¤ Startup Entries : 0 ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [LOADED] ¤¤¤
[Address] SSDT[19] : NtAssignProcessToJobObject @ 0x805D66D0 -> HOOKED (Unknown @ 0x8958CC90)
[Address] SSDT[57] : NtDebugActiveProcess @ 0x80643CB2 -> HOOKED (Unknown @ 0x8958D200)
[Address] SSDT[68] : NtDuplicateObject @ 0x805BE03C -> HOOKED (Unknown @ 0x8958D2F0)
[Address] SSDT[122] : NtOpenProcess @ 0x805CB486 -> HOOKED (Unknown @ 0x8958C590)
[Address] SSDT[128] : NtOpenThread @ 0x805CB712 -> HOOKED (Unknown @ 0x8958C800)
[Address] SSDT[137] : NtProtectVirtualMemory @ 0x805B8452 -> HOOKED (Unknown @ 0x8958CFD0)
[Address] SSDT[180] : NtQueueApcThread @ 0x805D2786 -> HOOKED (Unknown @ 0x8958D0E0)
[Address] SSDT[213] : NtSetContextThread @ 0x805D2C4A -> HOOKED (Unknown @ 0x8958CEC0)
[Address] SSDT[229] : NtSetInformationThread @ 0x805CC154 -> HOOKED (Unknown @ 0x8958CD90)
[Address] SSDT[237] : NtSetSecurityObject @ 0x805C0662 -> HOOKED (Unknown @ 0x89589DA0)
[Address] SSDT[253] : NtSuspendProcess @ 0x805D4B10 -> HOOKED (Unknown @ 0x8958CB90)
[Address] SSDT[254] : NtSuspendThread @ 0x805D4982 -> HOOKED (Unknown @ 0x8958CA80)
[Address] SSDT[257] : NtTerminateProcess @ 0x805D2308 -> HOOKED (Unknown @ 0x8958C6E0)
[Address] SSDT[258] : NtTerminateThread @ 0x805D2502 -> HOOKED (Unknown @ 0x8958CA50)
[Address] SSDT[277] : NtWriteVirtualMemory @ 0x805B4400 -> HOOKED (Unknown @ 0x8958D6D0)

¤¤¤ External Hives: ¤¤¤

¤¤¤ Infection :  ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
--> %SystemRoot%System32driversetchosts


ÿþ1

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: SAMSUNG HD502HJ +++++
--- User ---
[MBR] 7b38b521ed089e33361e4357e3d955d4
[bSP] e34e6f3e44a8c4bd4c3d92300b6919f0 : Windows XP MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 204797 Mo
1 - [XXXXXX] EXTEN-LBA (0x0f) [VISIBLE] Offset (sectors): 419425020 | Size: 272132 Mo
User = LL1 ... OK!
User = LL2 ... OK!

Finished : << RKreport[0]_S_06182013_130917.txt >>



 


HITMAN PRO LOG:

HitmanPro 3.7.6.201www.hitmanpro.com   Computer name . . . . : MILEN-F57DDEC85   Windows . . . . . . . : 5.1.3.2600.X86/2   User name . . . . . . : MILEN-F57DDEC85Milen   License . . . . . . . : Trial (30 days left)   Scan date . . . . . . : 2013-06-18 13:20:34   Scan mode . . . . . . : Normal   Scan duration . . . . : 2m 0s   Disk access mode  . . : Direct disk access (SRB)   Cloud . . . . . . . . : Internet   Reboot  . . . . . . . : No   Threats . . . . . . . : 0   Traces  . . . . . . . : 12   Objects scanned . . . : 447,640   Files scanned . . . . : 12,162   Remnants scanned  . . : 103,187 files / 332,291 keysCookies _____________________________________________________________________   C:Documents and SettingsMilenApplication DataMozillaFirefoxProfileswx7a8jyy.defaultcookies.sqlite:ads.kaldata.com   C:Documents and SettingsMilenApplication DataMozillaFirefoxProfileswx7a8jyy.defaultcookies.sqlite:doubleclick.net

Само че това е 2ри скан на програмата първия не можа да се сейфа защото се рестартира компютъра и там видях че бяха засечени 9 вируса .И ги изтри.

Редактирано от bassTest (преглед на промените)

Не съм писал да триете нищо нито с RogueKiller, нито с Hitmanpro!!!

Искам да видя изтритите неща от HitmanPro и затова отворете папката:

 

C:Documents and SettingsAll UsersApplication DataHitmanProLogs

 

и отворете и публикувайте лога от първото сканиране с програмата.

Пак повтарям, дори да се е рестартирал не вярвам да не е създал лог файл. При мен винаги създава. Проверете в папката която посочих.

 

C:Documents and SettingsAll UsersApplication DataHitmanProLogs

 

Ако няма там, архивирайте тогава папката

 

C:Documents and SettingsAll UsersApplication DataHitmanProQuarantine

 

Архивирайте я, качете я на хостинг по-избор и ми пратете линка на Лични съобщения.

  • Автор

<Quarantine lastId="1"><Item type="Malware" malwareName="Trojan" score="110.0" status="None" id="1" title="MediaIconsOverlays.dll" subtitle="C:Documents and SettingsAll UsersApplication DataMicrosoftMedia Tools" action="Quarantined" dt="2013-06-18T13:16:43"><Scanners><Scanner id="Ikarus" name="Virus.Win32.Dropper!IK" /></Scanners><File path="C:Documents and SettingsAll UsersApplication DataMicrosoftMedia ToolsMediaIconsOverlays.dll" hash="09C2D020808482A6DA888A1326447F1AD38B42CCA6970934004A54CD56A7A076" q="b12c4df8-e13c-45dc-bfdd-bfb2ef363a8a" /></Item></Quarantine>

Намерих само това.

А намерих го ще пратя на лс.

  • Автор

Оффф пак същия вирус писна ми вече май по добре е да преинсталирам компютъра.Ето снимка http://prikachi.com/images.php?images/132/6240132I.jpg

Компютъра свързан ли е в домашна мрежа и нещо теглили/инсталирали ли сте по-време на почистващия процес?

ESET легална ли е или е кракната версия?

Питам, защото ZA се чисти сравнително лесно, макар да има известни условности и при вас се е върнала заразата поради някаква причина - нещо което се случва излкючително рядко (освен ако не е много нов вариант).

И защо правите някои неща супер съмнително - не изпълнявате точно инструкциите, пращате ми логовете на Л.С...каква е причината?

Винаги можете да преинсталирате - изборът е ваш, но това не е гаранция, че пак няма да се нахендрите на него. Аз все пак предлагам да видим кои са "подобренията" в тази нова версия на бацила за по-ефективно почистване занапред:

 

  • [*]Моля, изтеглете
SystemLook.exe и запазете програмата на десктопа. [*]Кликнете два пъти върху SystemLook.exe, за да стартирате програмата. [*]Копирайте съдържанието на следния код в текстовото поле на програмата.

:folderfind

b07fb120

:filefind
desktop.ini
services.exe
mswsock.dll

afd.sys

:dir
C:Documents and SettingsAll UsersApplication DataMicrosoftMedia Tools /s
:regfind
0MediaIconsOerlay
{1EC23CFF-4C58-458f-924C-8519AEF61B32}

 

[*]Кликнете на бутона Look, за да започне сканирането. [*]Когато сканирането завърши ще Ви се отвори Notepad с резултата от сканирането. [*]Моля, прикачете лог файла в следващия си коментар.

  • Автор

Лога на SystemLook:

 

SystemLook 30.07.11 by jpshortstuff Log created at 22:17 on 19/06/2013 by Milen Administrator - Elevation successful ========== folderfind ========== Searching for "b07fb120" No folders found. ========== filefind ========== Searching for "desktop.ini" C:Documents and SettingsAll UsersApplication Datadesktop.ini  --ahs-- 62 bytes  [14:58 29/12/2012]  [14:58 29/12/2012] 88CF0FF92A4A9FA7BD9B7513B2E9E22B C:Documents and SettingsAll UsersDocumentsdesktop.ini  --ahs-- 62 bytes  [14:58 29/12/2012]  [14:58 29/12/2012] 9E8D1B26D13D9E60D0F60609876B1B36 C:Documents and SettingsAll UsersDocumentsMy MusicDesktop.ini  --ahs-- 151 bytes  [23:21 29/12/2012]  [23:23 29/12/2012] 13F6DB4DA1386738053E37488C12C1FA C:Documents and SettingsAll UsersDocumentsMy MusicSample Musicdesktop.ini  ---hs-- 70 bytes  [23:23 29/12/2012]  [23:23 29/12/2012] E88B25EEF116900E85F81ABA7C075339 C:Documents and SettingsAll UsersDocumentsMy PicturesDesktop.ini  --ahs-- 150 bytes  [23:22 29/12/2012]  [23:23 29/12/2012] 3C9819ED4C8AD12C9201580481B55629 C:Documents and SettingsAll UsersDocumentsMy PicturesSample Picturesdesktop.ini  ---hs-- 42 bytes  [23:23 29/12/2012]  [23:23 29/12/2012] 35ED6CDB67F7B18AE5948023CEE1D02C C:Documents and SettingsAll UsersDocumentsMy VideosDesktop.ini  --ahs-- 151 bytes  [23:20 29/12/2012]  [23:20 29/12/2012] 1145EE7430368D44FC605D1D56B221D5 C:Documents and SettingsAll UsersStart Menudesktop.ini  --ahs-- 294 bytes  [14:58 29/12/2012]  [23:24 29/12/2012] E376498C7B447EF37A9DBBF3BD7A8B44 C:Documents and SettingsAll UsersStart MenuProgramsdesktop.ini  --ahs-- 150 bytes  [14:58 29/12/2012]  [23:23 29/12/2012] 5AB7C60E1BDC91F443472C16E537E896 C:Documents and SettingsAll UsersStart MenuProgramsAccessoriesdesktop.ini  --ahs-- 265 bytes  [23:21 29/12/2012]  [23:22 29/12/2012] 1A5457FD1ED8AB4E99AADDE451E8D02F C:Documents and SettingsAll UsersStart MenuProgramsAccessoriesAccessibilitydesktop.ini  --ahs-- 90 bytes  [23:22 29/12/2012]  [23:22 29/12/2012] 519122402777AA5F9B48DD48308F337F C:Documents and SettingsAll UsersStart MenuProgramsAccessoriesCommunicationsdesktop.ini  --ahs-- 448 bytes  [23:19 29/12/2012]  [23:24 29/12/2012] AECA7B2C6150367C7D05422D96AAAF16 C:Documents and SettingsAll UsersStart MenuProgramsAccessoriesEntertainmentdesktop.ini  --ahs-- 146 bytes  [23:22 29/12/2012]  [23:22 29/12/2012] 066B4ADDF90E51FC9A2E39EDE37C7B04 C:Documents and SettingsAll UsersStart MenuProgramsAccessoriesSystem Toolsdesktop.ini  --ahs-- 757 bytes  [23:22 29/12/2012]  [23:24 29/12/2012] A617726011586B5A08BBBC702BE41825 C:Documents and SettingsAll UsersStart MenuProgramsAdministrative Toolsdesktop.ini  --ahs-- 545 bytes  [23:21 29/12/2012]  [23:24 29/12/2012] 5511F321BA11E6EFCDDBC5418C2046F6 C:Documents and SettingsAll UsersStart MenuProgramsGamesdesktop.ini  --ahs-- 798 bytes  [23:22 29/12/2012]  [23:22 29/12/2012] B026A55EA6A495D60A484CF24DFD9E3C C:Documents and SettingsAll UsersStart MenuProgramsStartupdesktop.ini  --ahs-- 84 bytes  [14:58 29/12/2012]  [23:24 29/12/2012] D6A6856702E3F0953E7246A9B4A9FE35 C:Documents and SettingsDefault UserApplication Datadesktop.ini  --ahs-- 62 bytes  [14:58 29/12/2012]  [14:58 29/12/2012] 88CF0FF92A4A9FA7BD9B7513B2E9E22B C:Documents and SettingsDefault UserLocal Settingsdesktop.ini  --ahs-- 62 bytes  [14:58 29/12/2012]  [14:58 29/12/2012] AD99B9121E1C94D9B6FEB18B3573A02E C:Documents and SettingsDefault UserLocal SettingsHistorydesktop.ini  ---hs-- 113 bytes  [23:26 29/12/2012]  [23:26 29/12/2012] D332CE83B166D5C244D22587AD75AAC4 C:Documents and SettingsDefault UserLocal SettingsHistoryHistory.IE5desktop.ini  ---hs-- 113 bytes  [23:26 29/12/2012]  [23:26 29/12/2012] D332CE83B166D5C244D22587AD75AAC4 C:Documents and SettingsDefault UserSendTodesktop.ini  --ahs-- 181 bytes  [23:23 29/12/2012]  [23:23 29/12/2012] C68330847B2FBA3BEBF9D16214523A4B C:Documents and SettingsDefault UserStart Menudesktop.ini  --ahs-- 62 bytes  [14:58 29/12/2012]  [14:58 29/12/2012] 87F8888E1D77D9CEF69E901A97D40D73 C:Documents and SettingsDefault UserStart MenuProgramsdesktop.ini  --ahs-- 148 bytes  [14:58 29/12/2012]  [23:24 29/12/2012] 7978DAD9ACA214B1BFF36ECA20C3E898 C:Documents and SettingsDefault UserStart MenuProgramsAccessoriesdesktop.ini  --ahs-- 482 bytes  [23:23 29/12/2012]  [23:24 29/12/2012] 4CC85BE58E2B0BE50C22C6F454DC593D C:Documents and SettingsDefault UserStart MenuProgramsAccessoriesAccessibilitydesktop.ini  --ahs-- 348 bytes  [23:24 29/12/2012]  [23:24 29/12/2012] 9F7D56E96FCE7AF0E7599AADD8126239 C:Documents and SettingsDefault UserStart MenuProgramsAccessoriesEntertainmentdesktop.ini  --ahs-- 84 bytes  [23:24 29/12/2012]  [23:24 29/12/2012] 9406FB6347AE3C0A373ABA7ECE378702 C:Documents and SettingsDefault UserStart MenuProgramsStartupdesktop.ini  --ahs-- 84 bytes  [14:58 29/12/2012]  [23:24 29/12/2012] D6A6856702E3F0953E7246A9B4A9FE35 C:Documents and SettingsLocalServiceFavoritesDesktop.ini  --ahs-- 122 bytes  [09:48 03/06/2013]  [09:48 03/06/2013] FC2BF37169C033A08C1FD7680193CCE2 C:Documents and SettingsLocalServiceLocal Settingsdesktop.ini  --ahs-- 62 bytes  [23:27 29/12/2012]  [19:04 19/06/2013] AD99B9121E1C94D9B6FEB18B3573A02E C:Documents and SettingsLocalServiceLocal SettingsHistorydesktop.ini  ---hs-- 113 bytes  [23:27 29/12/2012]  [23:26 29/12/2012] D332CE83B166D5C244D22587AD75AAC4 C:Documents and SettingsLocalServiceLocal SettingsHistoryHistory.IE5desktop.ini  ---hs-- 113 bytes  [23:27 29/12/2012]  [23:26 29/12/2012] D332CE83B166D5C244D22587AD75AAC4 C:Documents and SettingsLocalServiceLocal SettingsTemporary Internet Filesdesktop.ini  ---hs-- 67 bytes  [06:57 16/06/2013]  [06:57 16/06/2013] 4A3DEB274BB5F0212C2419D3D8D08612 C:Documents and SettingsLocalServiceLocal SettingsTemporary Internet FilesContent.IE5desktop.ini  ---hs-- 67 bytes  [06:57 16/06/2013]  [06:57 16/06/2013] 4A3DEB274BB5F0212C2419D3D8D08612 C:Documents and SettingsLocalServiceLocal SettingsTemporary Internet FilesContent.IE53F3JIPH3desktop.ini  ---hs-- 67 bytes  [06:57 16/06/2013]  [06:57 16/06/2013] 4A3DEB274BB5F0212C2419D3D8D08612 C:Documents and SettingsLocalServiceLocal SettingsTemporary Internet FilesContent.IE58DLXW1TGdesktop.ini  ---hs-- 67 bytes  [15:01 19/06/2013]  [15:01 19/06/2013] 4A3DEB274BB5F0212C2419D3D8D08612 C:Documents and SettingsLocalServiceLocal SettingsTemporary Internet FilesContent.IE5DDVR68K8desktop.ini  ---hs-- 67 bytes  [15:01 19/06/2013]  [15:01 19/06/2013] 4A3DEB274BB5F0212C2419D3D8D08612 C:Documents and SettingsLocalServiceLocal SettingsTemporary Internet FilesContent.IE5ONCAYEVTdesktop.ini  ---hs-- 67 bytes  [15:01 19/06/2013]  [15:01 19/06/2013] 4A3DEB274BB5F0212C2419D3D8D08612 C:Documents and SettingsLocalServiceLocal SettingsTemporary Internet FilesContent.IE5X4DOEW8Vdesktop.ini  ---hs-- 67 bytes  [15:01 19/06/2013]  [15:01 19/06/2013] 4A3DEB274BB5F0212C2419D3D8D08612 C:Documents and SettingsMilenApplication Datadesktop.ini  --ahs-- 62 bytes  [23:27 29/12/2012]  [14:58 29/12/2012] 88CF0FF92A4A9FA7BD9B7513B2E9E22B C:Documents and SettingsMilenApplication DataMicrosoftInternet ExplorerQuick Launchdesktop.ini  --ahs-- 119 bytes  [23:27 29/12/2012]  [23:28 29/12/2012] B6F6999BB50AFAB3A0217640527F2AD3 C:Documents and SettingsMilenApplication DataMicrosoftOfficeRecentDesktop.ini  --ahs-- 95 bytes  [17:13 30/04/2013]  [17:13 30/04/2013] 39AE21045A0DE35A255CDDDA9FCBCB64 C:Documents and SettingsMilenFavoritesDesktop.ini  --ahs-- 122 bytes  [23:28 29/12/2012]  [23:28 29/12/2012] FC2BF37169C033A08C1FD7680193CCE2 C:Documents and SettingsMilenFavoritesLinksdesktop.ini  --ahs-- 84 bytes  [02:12 30/12/2012]  [02:12 30/12/2012] D954F262C6FDA8D2AB86E9E5AA5A6E30 C:Documents and SettingsMilenLocal Settingsdesktop.ini  --ahs-- 62 bytes  [23:27 29/12/2012]  [19:04 19/06/2013] AD99B9121E1C94D9B6FEB18B3573A02E C:Documents and SettingsMilenLocal SettingsApplication DataMicrosoftFeeds Cachedesktop.ini  ---hs-- 67 bytes  [02:12 30/12/2012]  [02:12 30/12/2012] 4A3DEB274BB5F0212C2419D3D8D08612 C:Documents and SettingsMilenLocal SettingsApplication DataMicrosoftFeeds Cache5QS3ZNOSdesktop.ini  ---hs-- 67 bytes  [02:12 30/12/2012]  [02:12 30/12/2012] 4A3DEB274BB5F0212C2419D3D8D08612 C:Documents and SettingsMilenLocal SettingsApplication DataMicrosoftFeeds CacheDQK5I3PUdesktop.ini  ---hs-- 67 bytes  [02:12 30/12/2012]  [02:12 30/12/2012] 4A3DEB274BB5F0212C2419D3D8D08612 C:Documents and SettingsMilenLocal SettingsApplication DataMicrosoftFeeds CacheIVOF2HHXdesktop.ini  ---hs-- 67 bytes  [02:12 30/12/2012]  [02:12 30/12/2012] 4A3DEB274BB5F0212C2419D3D8D08612 C:Documents and SettingsMilenLocal SettingsApplication DataMicrosoftFeeds CacheLTHF7JWZdesktop.ini  ---hs-- 67 bytes  [02:12 30/12/2012]  [02:12 30/12/2012] 4A3DEB274BB5F0212C2419D3D8D08612 C:Documents and SettingsMilenLocal SettingsHistorydesktop.ini  ---hs-- 113 bytes  [23:27 29/12/2012]  [23:27 29/12/2012] D332CE83B166D5C244D22587AD75AAC4 C:Documents and SettingsMilenLocal SettingsHistoryHistory.IE5desktop.ini  ---hs-- 113 bytes  [23:27 29/12/2012]  [23:26 29/12/2012] D332CE83B166D5C244D22587AD75AAC4 C:Documents and SettingsMilenLocal SettingsTemporary Internet Filesdesktop.ini  ---hs-- 67 bytes  [06:57 16/06/2013]  [06:57 16/06/2013] 4A3DEB274BB5F0212C2419D3D8D08612 C:Documents and SettingsMilenLocal SettingsTemporary Internet FilesContent.IE5desktop.ini  ---hs-- 67 bytes  [06:57 16/06/2013]  [06:57 16/06/2013] 4A3DEB274BB5F0212C2419D3D8D08612 C:Documents and SettingsMilenLocal SettingsTemporary Internet FilesContent.IE51NRDUMMZdesktop.ini  ---hs-- 67 bytes  [06:57 16/06/2013]  [06:57 16/06/2013] 4A3DEB274BB5F0212C2419D3D8D08612 C:Documents and SettingsMilenLocal SettingsTemporary Internet FilesContent.IE5FDT67R68desktop.ini  ---hs-- 67 bytes  [12:30 19/06/2013]  [12:30 19/06/2013] 4A3DEB274BB5F0212C2419D3D8D08612 C:Documents and SettingsMilenLocal SettingsTemporary Internet FilesContent.IE5G9NMOB0Tdesktop.ini  ---hs-- 67 bytes  [12:30 19/06/2013]  [12:30 19/06/2013] 4A3DEB274BB5F0212C2419D3D8D08612 C:Documents and SettingsMilenLocal SettingsTemporary Internet FilesContent.IE5IM2TL2OBdesktop.ini  ---hs-- 67 bytes  [12:30 19/06/2013]  [12:30 19/06/2013] 4A3DEB274BB5F0212C2419D3D8D08612 C:Documents and SettingsMilenLocal SettingsTemporary Internet FilesContent.IE5N6WEKHY2desktop.ini  ---hs-- 67 bytes  [12:30 19/06/2013]  [12:30 19/06/2013] 4A3DEB274BB5F0212C2419D3D8D08612 C:Documents and SettingsMilenMy Documentsdesktop.ini  --ahs-- 76 bytes  [23:27 29/12/2012]  [02:12 30/12/2012] FBD72C4ED7D0944AE06E83F1A113D91B C:Documents and SettingsMilenMy DocumentsMy MusicDesktop.ini  --ahs-- 181 bytes  [23:27 29/12/2012]  [02:12 30/12/2012] 0F5F28D36D0E6B426AC8A1350CD9324D C:Documents and SettingsMilenMy DocumentsMy PicturesDesktop.ini  --ahs-- 183 bytes  [23:27 29/12/2012]  [02:12 30/12/2012] D60E4678123201E49A46AA1ECA940A43 C:Documents and SettingsMilenMy DocumentsMy VideosDesktop.ini  --ahs-- 182 bytes  [13:53 15/06/2013]  [13:53 15/06/2013] 81B46EB6BB6CF9D6805343D4B364A610 C:Documents and SettingsMilenRecentDesktop.ini  --ahs-- 150 bytes  [23:28 29/12/2012]  [23:28 29/12/2012] 4365E54D9A4F05CC52EDBC7D79D0E13C C:Documents and SettingsMilenSendTodesktop.ini  --ahs-- 181 bytes  [23:27 29/12/2012]  [23:23 29/12/2012] C68330847B2FBA3BEBF9D16214523A4B C:Documents and SettingsMilenStart Menudesktop.ini  --ahs-- 62 bytes  [23:27 29/12/2012]  [14:58 29/12/2012] 87F8888E1D77D9CEF69E901A97D40D73 C:Documents and SettingsMilenStart MenuProgramsdesktop.ini  --ahs-- 234 bytes  [23:27 29/12/2012]  [23:28 29/12/2012] E694DC03FB0F8B5B3F3A38CCEFEC8B3C C:Documents and SettingsMilenStart MenuProgramsAccessoriesdesktop.ini  --ahs-- 542 bytes  [23:27 29/12/2012]  [23:28 29/12/2012] 0273C168051E821BE54B2D4FD087C747 C:Documents and SettingsMilenStart MenuProgramsAccessoriesAccessibilitydesktop.ini  --ahs-- 348 bytes  [23:27 29/12/2012]  [23:24 29/12/2012] 9F7D56E96FCE7AF0E7599AADD8126239 C:Documents and SettingsMilenStart MenuProgramsAccessoriesEntertainmentdesktop.ini  --ahs-- 84 bytes  [23:27 29/12/2012]  [23:24 29/12/2012] 9406FB6347AE3C0A373ABA7ECE378702 C:Documents and SettingsMilenStart MenuProgramsAdministrative Toolsdesktop.ini  --ahs-- 62 bytes  [13:53 15/06/2013]  [13:53 15/06/2013] 87834B64DA1414AE863EAA974E153AEE C:Documents and SettingsMilenStart MenuProgramsStartupdesktop.ini  --ahs-- 84 bytes  [23:27 29/12/2012]  [23:24 29/12/2012] D6A6856702E3F0953E7246A9B4A9FE35 C:Documents and SettingsNetworkServiceLocal Settingsdesktop.ini  --ahs-- 62 bytes  [23:26 29/12/2012]  [19:04 19/06/2013] AD99B9121E1C94D9B6FEB18B3573A02E C:Documents and SettingsNetworkServiceLocal SettingsHistorydesktop.ini  ---hs-- 113 bytes  [23:26 29/12/2012]  [23:26 29/12/2012] D332CE83B166D5C244D22587AD75AAC4 C:Documents and SettingsNetworkServiceLocal SettingsHistoryHistory.IE5desktop.ini  ---hs-- 113 bytes  [23:26 29/12/2012]  [23:26 29/12/2012] D332CE83B166D5C244D22587AD75AAC4 C:Documents and SettingsNetworkServiceLocal SettingsTemporary Internet Filesdesktop.ini  ---hs-- 67 bytes  [11:11 16/06/2013]  [11:11 16/06/2013] 4A3DEB274BB5F0212C2419D3D8D08612 C:Documents and SettingsNetworkServiceLocal SettingsTemporary Internet FilesContent.IE5desktop.ini  ---hs-- 67 bytes  [11:11 16/06/2013]  [11:11 16/06/2013] 4A3DEB274BB5F0212C2419D3D8D08612 C:Documents and SettingsNetworkServiceLocal SettingsTemporary Internet FilesContent.IE5ICNCCFG4desktop.ini  ---hs-- 67 bytes  [11:11 16/06/2013]  [11:11 16/06/2013] 4A3DEB274BB5F0212C2419D3D8D08612 C:Documents and SettingsNetworkServiceLocal SettingsTemporary Internet FilesContent.IE5ME26H4HQdesktop.ini  ---hs-- 67 bytes  [11:11 16/06/2013]  [11:11 16/06/2013] 4A3DEB274BB5F0212C2419D3D8D08612 C:Documents and SettingsNetworkServiceLocal SettingsTemporary Internet FilesContent.IE5XDOG1ZTEdesktop.ini  ---hs-- 67 bytes  [11:11 16/06/2013]  [11:11 16/06/2013] 4A3DEB274BB5F0212C2419D3D8D08612 C:Documents and SettingsNetworkServiceLocal SettingsTemporary Internet FilesContent.IE5Y44N68CXdesktop.ini  ---hs-- 67 bytes  [11:11 16/06/2013]  [11:11 16/06/2013] 4A3DEB274BB5F0212C2419D3D8D08612 C:Program FilesMicrosoft OfficeOFFICE111033DataServicesDESKTOP.INI  --a---- 70 bytes  [11:30 27/07/2000]  [11:30 27/07/2000] 466AFDBDD30770A1A6B47AFD85099E82 C:RECYCLERS-1-5-21-789336058-261478967-1177238915-1003desktop.ini  ---hs-- 65 bytes  [06:56 16/06/2013]  [14:57 19/06/2013] AD0B0B4416F06AF436328A3C12DC491B C:WINDOWSdesktop.ini  --a---- 2 bytes  [23:23 29/12/2012]  [12:00 14/04/2008] 81051BCC2CF1BEDF378224B0A93E2877 C:WINDOWSDownloaded Program Filesdesktop.ini  ---h--- 65 bytes  [23:23 29/12/2012]  [23:23 29/12/2012] 878B2E099C512B72A9FEA2257458C8B8 C:WINDOWSFontsdesktop.ini  --ahs-- 67 bytes  [12:00 14/04/2008]  [23:24 29/12/2012] 80C0482092BE4DDEBBFAE67A3651785A C:WINDOWSOffline Web Pagesdesktop.ini  ---h--- 65 bytes  [23:23 29/12/2012]  [23:23 29/12/2012] 5079E25C0E9F1B5640B856225F5F5560 C:WINDOWSsystem32desktop.ini  --a---- 2 bytes  [23:23 29/12/2012]  [12:00 14/04/2008] 81051BCC2CF1BEDF378224B0A93E2877 C:WINDOWSsystem32configsystemprofileApplication Datadesktop.ini  --ahs-- 62 bytes  [23:26 29/12/2012]  [14:58 29/12/2012] 88CF0FF92A4A9FA7BD9B7513B2E9E22B C:WINDOWSsystem32configsystemprofileLocal Settingsdesktop.ini  --ahs-- 62 bytes  [23:26 29/12/2012]  [14:58 29/12/2012] AD99B9121E1C94D9B6FEB18B3573A02E C:WINDOWSsystem32configsystemprofileLocal SettingsHistorydesktop.ini  ---hs-- 113 bytes  [23:27 29/12/2012]  [23:27 29/12/2012] D332CE83B166D5C244D22587AD75AAC4 C:WINDOWSsystem32configsystemprofileLocal SettingsHistoryHistory.IE5desktop.ini  ---hs-- 113 bytes  [23:27 29/12/2012]  [23:27 29/12/2012] D332CE83B166D5C244D22587AD75AAC4 C:WINDOWSsystem32configsystemprofileSendTodesktop.ini  --ahs-- 181 bytes  [23:26 29/12/2012]  [23:23 29/12/2012] C68330847B2FBA3BEBF9D16214523A4B C:WINDOWSsystem32configsystemprofileStart Menudesktop.ini  --ahs-- 62 bytes  [23:26 29/12/2012]  [14:58 29/12/2012] 87F8888E1D77D9CEF69E901A97D40D73 C:WINDOWSsystem32configsystemprofileStart MenuProgramsdesktop.ini  --ahs-- 148 bytes  [23:26 29/12/2012]  [23:24 29/12/2012] 7978DAD9ACA214B1BFF36ECA20C3E898 C:WINDOWSsystem32configsystemprofileStart MenuProgramsAccessoriesdesktop.ini  --ahs-- 482 bytes  [23:26 29/12/2012]  [23:24 29/12/2012] 4CC85BE58E2B0BE50C22C6F454DC593D C:WINDOWSsystem32configsystemprofileStart MenuProgramsAccessoriesAccessibilitydesktop.ini  --ahs-- 348 bytes  [23:26 29/12/2012]  [23:24 29/12/2012] 9F7D56E96FCE7AF0E7599AADD8126239 C:WINDOWSsystem32configsystemprofileStart MenuProgramsAccessoriesEntertainmentdesktop.ini  --ahs-- 84 bytes  [23:26 29/12/2012]  [23:24 29/12/2012] 9406FB6347AE3C0A373ABA7ECE378702 C:WINDOWSsystem32configsystemprofileStart MenuProgramsStartupdesktop.ini  --ahs-- 84 bytes  [23:26 29/12/2012]  [23:24 29/12/2012] D6A6856702E3F0953E7246A9B4A9FE35 C:WINDOWSTasksdesktop.ini  -r-h--- 65 bytes  [23:22 29/12/2012]  [12:00 14/04/2008] 6A82073D6E1CAEA8E63CF491BAADFA2B C:_OTLMovedFiles06162013_095603C_WINDOWSassemblyDesktop.ini  -rahs-- 227 bytes  [19:43 30/12/2012]  [19:43 30/12/2012] F7F759A5CD40BC52172E83486B6DE404 Searching for "services.exe" C:Documents and SettingsMilenMy DocumentsMy Picturesservices.exe  --a---- 238756 bytes  [15:03 19/06/2013]  [15:03 19/06/2013] C93D74773097F83B11F26C9623392ACC C:WINDOWS$hf_mig$KB956572SP3QFEservices.exe  --a---- 110592 bytes  [01:06 30/12/2012]  [11:06 06/02/2009] 020CEAAEDC8EB655B6506B8C70D53BB6 C:WINDOWS$NtUninstallKB956572$services.exe  -----c- 108544 bytes  [01:20 30/12/2012]  [12:00 14/04/2008] 0E776ED5F7CC9F94299E70461B7B8185 C:WINDOWSerdntcacheservices.exe  --a---- 110592 bytes  [14:10 15/06/2013]  [11:11 06/02/2009] 65DF52F5B8B6E9BBD183505225C37315 C:WINDOWSsystem32services.exe  --a---- 110592 bytes  [12:00 14/04/2008]  [11:11 06/02/2009] 65DF52F5B8B6E9BBD183505225C37315 C:WINDOWSsystem32dllcacheservices.exe  --a--c- 110592 bytes  [12:00 14/04/2008]  [11:11 06/02/2009] 65DF52F5B8B6E9BBD183505225C37315 Searching for "mswsock.dll" C:WINDOWS$hf_mig$KB2509553SP3QFEmswsock.dll  --a---- 245248 bytes  [17:43 20/06/2008]  [17:43 20/06/2008] FCEE5FCB99F7C724593365C706D28388 C:WINDOWS$NtUninstallKB2509553$mswsock.dll  -----c- 245248 bytes  [01:16 30/12/2012]  [12:00 14/04/2008] B4138E99236F0F57D4CF49BAE98A0746 C:WINDOWSerdntcachemswsock.dll  --a---- 245248 bytes  [14:10 15/06/2013]  [16:02 20/06/2008] 943337D786A56729263071623BBB9DE5 C:WINDOWSsystem32mswsock.dll  --a---- 245248 bytes  [12:00 14/04/2008]  [16:02 20/06/2008] 943337D786A56729263071623BBB9DE5 C:WINDOWSsystem32dllcachemswsock.dll  --a--c- 245248 bytes  [12:00 14/04/2008]  [16:02 20/06/2008] 943337D786A56729263071623BBB9DE5 Searching for "afd.sys" C:WINDOWS$hf_mig$KB2509553SP3QFEafd.sys  --a---- 138496 bytes  [15:07 16/10/2008]  [15:07 16/10/2008] 38D7B715504DA4741DF35E3594FE2099 C:WINDOWS$hf_mig$KB2592799SP3QFEafd.sys  --a---- 138496 bytes  [01:05 30/12/2012]  [13:41 17/08/2011] F6B7B1ECD7B41736BDB6FF4B092BCB79 C:WINDOWS$NtUninstallKB2509553$afd.sys  -----c- 138112 bytes  [01:16 30/12/2012]  [12:00 14/04/2008] 322D0E36693D6E24A2398BEE62A268CD C:WINDOWS$NtUninstallKB2592799$afd.sys  -----c- 138496 bytes  [01:19 30/12/2012]  [14:43 16/10/2008] 7618D5218F2A614672EC61A80D854A37 C:WINDOWSsystem32dllcacheafd.sys  --a--c- 138496 bytes  [13:56 15/06/2013]  [13:49 17/08/2011] 1E44BC1E83D8FD2305F8D452DB109CF9 C:WINDOWSsystem32driversafd.sys  --a---- 138496 bytes  [13:56 15/06/2013]  [13:49 17/08/2011] 1E44BC1E83D8FD2305F8D452DB109CF9 ========== dir ========== C:Documents and SettingsAll UsersApplication DataMicrosoftMedia Tools - Unable to find folder. ========== regfind ========== Searching for "0MediaIconsOerlay" No data found. Searching for "{1EC23CFF-4C58-458f-924C-8519AEF61B32}" No data found. -= EOF =-

Редактирано от bassTest (преглед на промените)

Моля архивирайте следния файл:

 

C:Documents and SettingsMilenMy DocumentsMy Picturesservices.exe

 

и ми го пратете на Лични Съобщения.

 

Възможно е това да е дропъра на заразата и ще е добре да видя какви промени прави.


Също така изтеглете WinObjEx.exe и я запазете на десктопа.

Стартирайте програмата и кликнете върху Global??

Кликнете на иконата с лупичката и въведете b07fb120 и натиснете бутона Find.

Пишете дали има намерени резултати и ако да, моля направете снимка.

Да опитаме нещо по-лесно преди по-сложните процесури:

 

Изтеглете ESETSirefefCleaner.exe и го запазете на десктопа.

 

Отворете Start => Run => в конзолата копирайте командите една по една и след всяка натиснете Enter

 

cd desktop

 

ESETSirefefCleaner.exe /f /r /d

 

След края на проверката, ако поиска рестарт се съгласете.

 

След рестарта публикувайте лог файла, който би трябвало да се е създал при работата на инструмента.

 

След това направете и ново търсене с WinObjEx.exe и приложете снимката от резултатите.

  • Автор

Лога от Eset SirefefCleaner:

 

[2013.06.20 13:59:47.859] - ....................................
[2013.06.20 13:59:47.859] - ..::::::::::::::::::....................
[2013.06.20 13:59:47.859] - .::EEEEEE:::SSSSSS::..EEEEEE..TTTTTTTT..   Win32/Sirefef (special build)
[2013.06.20 13:59:47.859] -  .::EE::::EE:SS:::::::.EE....EE....TT...... Version: 1.1.0.11
[2013.06.20 13:59:47.859] -  .::EEEEEEEE::SSSSSS::.EEEEEEEE....TT...... Built: May 23 2013
[2013.06.20 13:59:47.859] -  .::EE:::::::::::::SS:.EE..........TT......
[2013.06.20 13:59:47.859] - .::EEEEEE:::SSSSSS::..EEEEEE.....TT.....   Copyright © ESET, spol. s r.o.
[2013.06.20 13:59:47.859] - ..::::::::::::::::::....................   1992-2013. All rights reserved.
[2013.06.20 13:59:47.859] - ....................................
[2013.06.20 13:59:47.859] -
[2013.06.20 13:59:47.859] - --------------------------------------------------------------------------------
[2013.06.20 13:59:47.859] -
[2013.06.20 13:59:47.859] - INFO: OS: 5.1.2600 SP3
[2013.06.20 13:59:47.859] - INFO: Product Type: Workstation
[2013.06.20 13:59:47.859] - INFO: WoW64: False
[2013.06.20 13:59:47.859] - INFO: Machine guid: 0872AB7B-AFC1-46A8-BF2C-C5CDC55D4BF9
[2013.06.20 13:59:47.859] -
[2013.06.20 13:59:47.937] - INFO: EULA Accepted
[2013.06.20 13:59:47.937] - --------------------------------------------------------------------------------
[2013.06.20 13:59:47.937] - INFO: After reboot cleaning enabled...
[2013.06.20 13:59:47.937] - --------------------------------------------------------------------------------
[2013.06.20 13:59:47.937] -
[2013.06.20 13:59:47.937] - --------------------------------------------------------------------------------
[2013.06.20 13:59:47.937] - INFO: Scanning for system infection...
[2013.06.20 13:59:47.937] - --------------------------------------------------------------------------------
[2013.06.20 13:59:47.937] -
[2013.06.20 13:59:47.937] - INFO: System modules modification not detected...
[2013.06.20 13:59:47.937] - INFO: Current Shell HKLM [Explorer.exe].
[2013.06.20 13:59:47.937] - INFO: Current SubSystems [%SystemRoot%system32csrss.exe ObjectDirectory=Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16].
[2013.06.20 13:59:47.937] - INFO: Win32/Sirefef not found
[2013.06.20 13:59:54.921] -
[2013.06.20 13:59:54.921] - --------------------------------------------------------------------------------
[2013.06.20 13:59:54.921] - INFO: Removing remnants of Win32/Sirefef threat...
[2013.06.20 13:59:54.921] - --------------------------------------------------------------------------------
[2013.06.20 13:59:55.640] - INFO: Changed file permissions [C:WINDOWSAssemblyTMP]
[2013.06.20 13:59:55.703] - INFO: Changed file permissions [C:WINDOWSAssemblyTMP03B8GDLT]
[2013.06.20 13:59:55.718] - INFO: Successfully removed directory [C:WINDOWSAssemblyTMP03B8GDLT]
[2013.06.20 13:59:55.750] - INFO: Changed file permissions [C:WINDOWSAssemblyTMP03B8GDLTPresentationFramework.Classic.dll]
[2013.06.20 13:59:55.750] - INFO: Successfully removed directory [C:WINDOWSAssemblyTMP03B8GDLTPresentationFramework.Classic.dll]
[2013.06.20 13:59:55.750] - INFO: Changed file permissions [C:WINDOWSAssemblyTMP0GPXIQAI]
[2013.06.20 13:59:55.750] - INFO: Successfully removed directory [C:WINDOWSAssemblyTMP0GPXIQAI]
[2013.06.20 13:59:55.781] - INFO: Changed file permissions [C:WINDOWSAssemblyTMP0GPXIQAIUIAutomationTypes.dll]
[2013.06.20 13:59:55.781] - INFO: Successfully removed directory [C:WINDOWSAssemblyTMP0GPXIQAIUIAutomationTypes.dll]
[2013.06.20 13:59:55.781] - INFO: Changed file permissions [C:WINDOWSAssemblyTMP19HEBJRZ]
[2013.06.20 13:59:55.781] - INFO: Successfully removed directory [C:WINDOWSAssemblyTMP19HEBJRZ]
[2013.06.20 13:59:55.812] - INFO: Changed file permissions [C:WINDOWSAssemblyTMP19HEBJRZSystem.IO.Log.dll]
[2013.06.20 13:59:55.812] - INFO: Successfully removed directory [C:WINDOWSAssemblyTMP19HEBJRZSystem.IO.Log.dll]
[2013.06.20 13:59:55.812] - INFO: Changed file permissions [C:WINDOWSAssemblyTMP35DA74C9]
[2013.06.20 13:59:55.812] - INFO: Successfully removed directory [C:WINDOWSAssemblyTMP35DA74C9]
[2013.06.20 13:59:55.828] - INFO: Changed file permissions [C:WINDOWSAssemblyTMP35DA74C9System.ServiceModel.WasHosting.dll]
[2013.06.20 13:59:55.828] - INFO: Successfully removed directory [C:WINDOWSAssemblyTMP35DA74C9System.ServiceModel.WasHosting.dll]
[2013.06.20 13:59:55.828] - INFO: Changed file permissions [C:WINDOWSAssemblyTMP38GDM74D]
[2013.06.20 13:59:55.828] - INFO: Successfully removed directory [C:WINDOWSAssemblyTMP38GDM74D]
[2013.06.20 13:59:55.859] - INFO: Changed file permissions [C:WINDOWSAssemblyTMP38GDM74DUIAutomationClientsideProviders.dll]
[2013.06.20 13:59:55.859] - INFO: Successfully removed directory [C:WINDOWSAssemblyTMP38GDM74DUIAutomationClientsideProviders.dll]
[2013.06.20 13:59:55.859] - INFO: Changed file permissions [C:WINDOWSAssemblyTMP3XUFN7HP]
[2013.06.20 13:59:55.859] - INFO: Successfully removed directory [C:WINDOWSAssemblyTMP3XUFN7HP]
[2013.06.20 13:59:55.890] - INFO: Changed file permissions [C:WINDOWSAssemblyTMP3XUFN7HPUIAutomationClient.dll]
[2013.06.20 13:59:55.890] - INFO: Successfully removed directory [C:WINDOWSAssemblyTMP3XUFN7HPUIAutomationClient.dll]
[2013.06.20 13:59:55.890] - INFO: Changed file permissions [C:WINDOWSAssemblyTMP48GDAIQY]
[2013.06.20 13:59:55.890] - INFO: Successfully removed directory [C:WINDOWSAssemblyTMP48GDAIQY]
[2013.06.20 13:59:55.906] - INFO: Changed file permissions [C:WINDOWSAssemblyTMP48GDAIQYSystem.Workflow.ComponentModel.dll]
[2013.06.20 13:59:55.906] - INFO: Successfully removed directory [C:WINDOWSAssemblyTMP48GDAIQYSystem.Workflow.ComponentModel.dll]
[2013.06.20 13:59:55.906] - INFO: Changed file permissions [C:WINDOWSAssemblyTMP4VSDL5FN]
[2013.06.20 13:59:55.906] - INFO: Successfully removed directory [C:WINDOWSAssemblyTMP4VSDL5FN]
[2013.06.20 13:59:55.937] - INFO: Changed file permissions [C:WINDOWSAssemblyTMP4VSDL5FNPresentationCore.dll]
[2013.06.20 13:59:55.937] - INFO: Successfully removed directory [C:WINDOWSAssemblyTMP4VSDL5FNPresentationCore.dll]
[2013.06.20 13:59:55.937] - INFO: Changed file permissions [C:WINDOWSAssemblyTMP68GDAIQY]
[2013.06.20 13:59:55.937] - INFO: Successfully removed directory [C:WINDOWSAssemblyTMP68GDAIQY]
[2013.06.20 13:59:55.953] - INFO: Changed file permissions [C:WINDOWSAssemblyTMP68GDAIQYSystem.ServiceModel.dll]
[2013.06.20 13:59:55.953] - INFO: Successfully removed directory [C:WINDOWSAssemblyTMP68GDAIQYSystem.ServiceModel.dll]
[2013.06.20 13:59:55.953] - INFO: Changed file permissions [C:WINDOWSAssemblyTMP68GDAU2Z]
[2013.06.20 13:59:55.953] - INFO: Successfully removed directory [C:WINDOWSAssemblyTMP68GDAU2Z]
[2013.06.20 13:59:55.984] - INFO: Changed file permissions [C:WINDOWSAssemblyTMP68GDAU2ZPresentationUI.dll]
[2013.06.20 13:59:55.984] - INFO: Successfully removed directory [C:WINDOWSAssemblyTMP68GDAU2ZPresentationUI.dll]
[2013.06.20 13:59:55.984] - INFO: Changed file permissions [C:WINDOWSAssemblyTMP68GDNV3C]
[2013.06.20 13:59:55.984] - INFO: Successfully removed directory [C:WINDOWSAssemblyTMP68GDNV3C]
[2013.06.20 13:59:56.031] - INFO: Changed file permissions [C:WINDOWSAssemblyTMP68GDNV3CSystem.Workflow.Activities.dll]
[2013.06.20 13:59:56.031] - INFO: Successfully removed directory [C:WINDOWSAssemblyTMP68GDNV3CSystem.Workflow.Activities.dll]
[2013.06.20 13:59:56.031] - INFO: Changed file permissions [C:WINDOWSAssemblyTMP6KHPAIQY]
[2013.06.20 13:59:56.031] - INFO: Successfully removed directory [C:WINDOWSAssemblyTMP6KHPAIQY]
[2013.06.20 13:59:56.046] - INFO: Changed file permissions [C:WINDOWSAssemblyTMP6KHPAIQYSystem.IdentityModel.dll]
[2013.06.20 13:59:56.046] - INFO: Successfully removed directory [C:WINDOWSAssemblyTMP6KHPAIQYSystem.IdentityModel.dll]
[2013.06.20 13:59:56.062] - INFO: Changed file permissions [C:WINDOWSAssemblyTMP8N7HEMU2]
[2013.06.20 13:59:56.062] - INFO: Successfully removed directory [C:WINDOWSAssemblyTMP8N7HEMU2]
[2013.06.20 13:59:56.078] - INFO: Changed file permissions [C:WINDOWSAssemblyTMP8N7HEMU2SMdiagnostics.dll]
[2013.06.20 13:59:56.078] - INFO: Successfully removed directory [C:WINDOWSAssemblyTMP8N7HEMU2SMdiagnostics.dll]
[2013.06.20 13:59:56.078] - INFO: Changed file permissions [C:WINDOWSAssemblyTMP92MJ41WH]
[2013.06.20 13:59:56.078] - INFO: Successfully removed directory [C:WINDOWSAssemblyTMP92MJ41WH]
[2013.06.20 13:59:56.109] - INFO: Changed file permissions [C:WINDOWSAssemblyTMP92MJ41WHMicrosoft.Transactions.Bridge.Dtc.dll]
[2013.06.20 13:59:56.109] - INFO: Successfully removed directory [C:WINDOWSAssemblyTMP92MJ41WHMicrosoft.Transactions.Bridge.Dtc.dll]
[2013.06.20 13:59:56.109] - INFO: Changed file permissions [C:WINDOWSAssemblyTMP9EBW4DL6]
[2013.06.20 13:59:56.109] - INFO: Successfully removed directory [C:WINDOWSAssemblyTMP9EBW4DL6]
[2013.06.20 13:59:56.140] - INFO: Changed file permissions [C:WINDOWSAssemblyTMP9EBW4DL6WindowsBase.dll]
[2013.06.20 13:59:56.140] - INFO: Successfully removed directory [C:WINDOWSAssemblyTMP9EBW4DL6WindowsBase.dll]
[2013.06.20 13:59:56.140] - INFO: Changed file permissions [C:WINDOWSAssemblyTMPA7HQYJRB]
[2013.06.20 13:59:56.140] - INFO: Successfully removed directory [C:WINDOWSAssemblyTMPA7HQYJRB]
[2013.06.20 13:59:56.156] - INFO: Changed file permissions [C:WINDOWSAssemblyTMPA7HQYJRBPresentationFontCache.exe]
[2013.06.20 13:59:56.156] - INFO: Successfully removed directory [C:WINDOWSAssemblyTMPA7HQYJRBPresentationFontCache.exe]
[2013.06.20 13:59:56.156] - INFO: Changed file permissions [C:WINDOWSAssemblyTMPET1ZK41Y]
[2013.06.20 13:59:56.156] - INFO: Successfully removed directory [C:WINDOWSAssemblyTMPET1ZK41Y]
[2013.06.20 13:59:56.187] - INFO: Changed file permissions [C:WINDOWSAssemblyTMPET1ZK41YPresentationFramework.dll]
[2013.06.20 13:59:56.187] - INFO: Successfully removed directory [C:WINDOWSAssemblyTMPET1ZK41YPresentationFramework.dll]
[2013.06.20 13:59:56.187] - INFO: Changed file permissions [C:WINDOWSAssemblyTMPFTEM6GDX]
[2013.06.20 13:59:56.187] - INFO: Successfully removed directory [C:WINDOWSAssemblyTMPFTEM6GDX]
[2013.06.20 13:59:56.203] - INFO: Changed file permissions [C:WINDOWSAssemblyTMPFTEM6GDXSystem.Workflow.Runtime.dll]
[2013.06.20 13:59:56.203] - INFO: Successfully removed directory [C:WINDOWSAssemblyTMPFTEM6GDXSystem.Workflow.Runtime.dll]
[2013.06.20 13:59:56.203] - INFO: Changed file permissions [C:WINDOWSAssemblyTMPGGQY6FCK]
[2013.06.20 13:59:56.203] - INFO: Successfully removed directory [C:WINDOWSAssemblyTMPGGQY6FCK]
[2013.06.20 13:59:56.234] - INFO: Changed file permissions [C:WINDOWSAssemblyTMPGGQY6FCKMicrosoft.Transactions.Bridge.dll]
[2013.06.20 13:59:56.234] - INFO: Successfully removed directory [C:WINDOWSAssemblyTMPGGQY6FCKMicrosoft.Transactions.Bridge.dll]
[2013.06.20 13:59:56.234] - INFO: Changed file permissions [C:WINDOWSAssemblyTMPJOK4EBJ3]
[2013.06.20 13:59:56.234] - INFO: Successfully removed directory [C:WINDOWSAssemblyTMPJOK4EBJ3]
[2013.06.20 13:59:56.265] - INFO: Changed file permissions [C:WINDOWSAssemblyTMPJOK4EBJ3PresentationFramework.Aero.dll]
[2013.06.20 13:59:56.265] - INFO: Successfully removed directory [C:WINDOWSAssemblyTMPJOK4EBJ3PresentationFramework.Aero.dll]
[2013.06.20 13:59:56.265] - INFO: Changed file permissions [C:WINDOWSAssemblyTMPKAIQAIQY]
[2013.06.20 13:59:56.265] - INFO: Successfully removed directory [C:WINDOWSAssemblyTMPKAIQAIQY]
[2013.06.20 13:59:56.296] - INFO: Changed file permissions [C:WINDOWSAssemblyTMPKAIQAIQYPresentationFramework.Luna.dll]
[2013.06.20 13:59:56.296] - INFO: Successfully removed directory [C:WINDOWSAssemblyTMPKAIQAIQYPresentationFramework.Luna.dll]
[2013.06.20 13:59:56.296] - INFO: Changed file permissions [C:WINDOWSAssemblyTMPMDLTDLT1]
[2013.06.20 13:59:56.296] - INFO: Successfully removed directory [C:WINDOWSAssemblyTMPMDLTDLT1]
[2013.06.20 13:59:56.328] - INFO: Changed file permissions [C:WINDOWSAssemblyTMPMDLTDLT1System.Runtime.Serialization.dll]
[2013.06.20 13:59:56.328] - INFO: Successfully removed directory [C:WINDOWSAssemblyTMPMDLTDLT1System.Runtime.Serialization.dll]
[2013.06.20 13:59:56.328] - INFO: Changed file permissions [C:WINDOWSAssemblyTMPOOWHPX5R]
[2013.06.20 13:59:56.328] - INFO: Successfully removed directory [C:WINDOWSAssemblyTMPOOWHPX5R]
[2013.06.20 13:59:56.359] - INFO: Changed file permissions [C:WINDOWSAssemblyTMPOOWHPX5RPresentationFramework.Royale.dll]
[2013.06.20 13:59:56.359] - INFO: Successfully removed directory [C:WINDOWSAssemblyTMPOOWHPX5RPresentationFramework.Royale.dll]
[2013.06.20 13:59:56.359] - INFO: Changed file permissions [C:WINDOWSAssemblyTMPRGOW43YV]
[2013.06.20 13:59:56.359] - INFO: Successfully removed directory [C:WINDOWSAssemblyTMPRGOW43YV]
[2013.06.20 13:59:56.375] - INFO: Changed file permissions [C:WINDOWSAssemblyTMPRGOW43YVSystem.Speech.dll]
[2013.06.20 13:59:56.375] - INFO: Successfully removed directory [C:WINDOWSAssemblyTMPRGOW43YVSystem.Speech.dll]
[2013.06.20 13:59:56.375] - INFO: Changed file permissions [C:WINDOWSAssemblyTMPRV3PM6GO]
[2013.06.20 13:59:56.375] - INFO: Successfully removed directory [C:WINDOWSAssemblyTMPRV3PM6GO]
[2013.06.20 13:59:56.390] - INFO: Changed file permissions [C:WINDOWSAssemblyTMPRV3PM6GOUIAutomationProvider.dll]
[2013.06.20 13:59:56.390] - INFO: Successfully removed directory [C:WINDOWSAssemblyTMPRV3PM6GOUIAutomationProvider.dll]
[2013.06.20 13:59:56.390] - INFO: Changed file permissions [C:WINDOWSAssemblyTMPS8IFN74E]
[2013.06.20 13:59:56.390] - INFO: Successfully removed directory [C:WINDOWSAssemblyTMPS8IFN74E]
[2013.06.20 13:59:56.406] - INFO: Changed file permissions [C:WINDOWSAssemblyTMPS8IFN74EPresentationBuildTasks.dll]
[2013.06.20 13:59:56.406] - INFO: Successfully removed directory [C:WINDOWSAssemblyTMPS8IFN74EPresentationBuildTasks.dll]
[2013.06.20 13:59:56.406] - INFO: Changed file permissions [C:WINDOWSAssemblyTMPTEMU2OLT]
[2013.06.20 13:59:56.406] - INFO: Successfully removed directory [C:WINDOWSAssemblyTMPTEMU2OLT]
[2013.06.20 13:59:56.421] - INFO: Changed file permissions [C:WINDOWSAssemblyTMPTEMU2OLTReachFramework.dll]
[2013.06.20 13:59:56.421] - INFO: Successfully removed directory [C:WINDOWSAssemblyTMPTEMU2OLTReachFramework.dll]
[2013.06.20 13:59:56.421] - INFO: Changed file permissions [C:WINDOWSAssemblyTMPTZ7TQBJ3]
[2013.06.20 13:59:56.421] - INFO: Successfully removed directory [C:WINDOWSAssemblyTMPTZ7TQBJ3]
[2013.06.20 13:59:56.453] - INFO: Changed file permissions [C:WINDOWSAssemblyTMPTZ7TQBJ3System.Printing.dll]
[2013.06.20 13:59:56.468] - INFO: Successfully removed directory [C:WINDOWSAssemblyTMPTZ7TQBJ3System.Printing.dll]
[2013.06.20 13:59:56.468] - INFO: Changed file permissions [C:WINDOWSAssemblyTMPVMUFN7HQ]
[2013.06.20 13:59:56.468] - INFO: Successfully removed directory [C:WINDOWSAssemblyTMPVMUFN7HQ]
[2013.06.20 13:59:56.500] - INFO: Changed file permissions [C:WINDOWSAssemblyTMPVMUFN7HQWindowsFormsIntegration.dll]
[2013.06.20 13:59:56.515] - INFO: Successfully removed directory [C:WINDOWSAssemblyTMPVMUFN7HQWindowsFormsIntegration.dll]
[2013.06.20 13:59:56.531] - INFO: Changed file permissions [C:WINDOWSAssemblyTMPXBJRZ74C]
[2013.06.20 13:59:56.531] - INFO: Successfully removed directory [C:WINDOWSAssemblyTMPXBJRZ74C]
[2013.06.20 13:59:56.531] - INFO: Changed file permissions [C:WINDOWSAssemblyTMPXBJRZ74CSystem.ServiceModel.Install.dll]
[2013.06.20 13:59:56.531] - INFO: Successfully removed directory [C:WINDOWSAssemblyTMPXBJRZ74CSystem.ServiceModel.Install.dll]
[2013.06.20 13:59:56.578] - INFO: Changed file permissions [C:WINDOWSAssemblyTMPYP9JG0XI]
[2013.06.20 13:59:56.578] - INFO: Successfully removed directory [C:WINDOWSAssemblyTMPYP9JG0XI]
[2013.06.20 13:59:56.578] - INFO: Changed file permissions [C:WINDOWSAssemblyTMPYP9JG0XIPresentationCFFRasterizer.dll]
[2013.06.20 13:59:56.609] - INFO: Successfully removed directory [C:WINDOWSAssemblyTMPYP9JG0XIPresentationCFFRasterizer.dll]
[2013.06.20 13:59:56.656] - INFO: Directory [C:WINDOWSAssemblyTMP] removed successfully.
[2013.06.20 13:59:56.656] - INFO: Changed file permissions [C:WINDOWSAssemblyTEMP]
[2013.06.20 13:59:56.656] - INFO: Directory [C:WINDOWSAssemblyTEMP] removed successfully.
[2013.06.20 13:59:56.687] -
[2013.06.20 13:59:56.687] -
[2013.06.20 13:59:56.687] - --------------------------------------------------------------------------------
[2013.06.20 13:59:56.687] - INFO: Restoring system services...
[2013.06.20 13:59:56.687] - --------------------------------------------------------------------------------
[2013.06.20 13:59:56.687] -
[2013.06.20 13:59:56.687] - INFO: Processing registry key [systemCurrentControlsetServicesBITSType] ...
[2013.06.20 13:59:56.687] - INFO: Value [Type] doesn't exist...
[2013.06.20 13:59:56.687] - INFO: Overwriting [Type] value succeeded.
[2013.06.20 13:59:56.687] -
[2013.06.20 13:59:56.687] - INFO: Processing registry key [systemCurrentControlsetServicesBITSStart] ...
[2013.06.20 13:59:56.687] - INFO: Value [start] doesn't exist...
[2013.06.20 13:59:56.687] - INFO: Overwriting [start] value succeeded.
[2013.06.20 13:59:56.687] -
[2013.06.20 13:59:56.687] - INFO: Processing registry key [systemCurrentControlsetServicesBITSErrorControl] ...
[2013.06.20 13:59:56.687] - INFO: Value [ErrorControl] doesn't exist...
[2013.06.20 13:59:56.687] - INFO: Overwriting [ErrorControl] value succeeded.
[2013.06.20 13:59:56.687] -
[2013.06.20 13:59:56.687] - INFO: Processing registry key [systemCurrentControlsetServicesBITSImagePath] ...
[2013.06.20 13:59:56.687] - INFO: Value [imagePath] doesn't exist...
[2013.06.20 13:59:56.687] - INFO: Overwriting [imagePath] value succeeded.
[2013.06.20 13:59:56.687] -
[2013.06.20 13:59:56.687] - INFO: Processing registry key [systemCurrentControlsetServicesBITSDisplayName] ...
[2013.06.20 13:59:56.687] - INFO: Value [DisplayName] doesn't exist...
[2013.06.20 13:59:56.687] - INFO: Overwriting [DisplayName] value succeeded.
[2013.06.20 13:59:56.687] -
[2013.06.20 13:59:56.687] - INFO: Processing registry key [systemCurrentControlsetServicesBITSDependOnService] ...
[2013.06.20 13:59:56.687] - INFO: Value [DependOnService] doesn't exist...
[2013.06.20 13:59:56.687] - INFO: Overwriting [DependOnService] value succeeded.
[2013.06.20 13:59:56.687] -
[2013.06.20 13:59:56.687] - INFO: Processing registry key [systemCurrentControlsetServicesBITSDependOnGroup] ...
[2013.06.20 13:59:56.687] - INFO: Value [DependOnGroup] doesn't exist...
[2013.06.20 13:59:56.687] - INFO: Overwriting [DependOnGroup] value succeeded.
[2013.06.20 13:59:56.687] -
[2013.06.20 13:59:56.687] - INFO: Processing registry key [systemCurrentControlsetServicesBITSObjectName] ...
[2013.06.20 13:59:56.687] - INFO: Value [ObjectName] doesn't exist...
[2013.06.20 13:59:56.687] - INFO: Overwriting [ObjectName] value succeeded.
[2013.06.20 13:59:56.687] -
[2013.06.20 13:59:56.687] - INFO: Processing registry key [systemCurrentControlsetServicesBITSDescription] ...
[2013.06.20 13:59:56.687] - INFO: Value [Description] doesn't exist...
[2013.06.20 13:59:56.687] - INFO: Overwriting [Description] value succeeded.
[2013.06.20 13:59:56.687] -
[2013.06.20 13:59:56.687] - INFO: Processing registry key [systemCurrentControlsetServicesBITSFailureActions] ...
[2013.06.20 13:59:56.687] - INFO: Value [FailureActions] doesn't exist...
[2013.06.20 13:59:56.687] - INFO: Overwriting [FailureActions] value succeeded.
[2013.06.20 13:59:56.687] -
[2013.06.20 13:59:56.687] - INFO: Processing registry key [systemCurrentControlsetServicesBITSParametersServiceDll] ...
[2013.06.20 13:59:56.687] - INFO: Value [serviceDll] doesn't exist...
[2013.06.20 13:59:56.687] - INFO: Overwriting [serviceDll] value succeeded.
[2013.06.20 13:59:56.687] -
[2013.06.20 13:59:56.687] - INFO: Processing registry key [systemCurrentControlsetServicesBITSSecuritySecurity] ...
[2013.06.20 13:59:56.703] - INFO: Value [security] doesn't exist...
[2013.06.20 13:59:56.703] - INFO: Overwriting [security] value succeeded.
[2013.06.20 13:59:56.703] -
[2013.06.20 13:59:56.703] - INFO: Processing registry key [systemCurrentControlsetServicesBITSEnum0] ...
[2013.06.20 13:59:56.703] - INFO: Value [0] doesn't exist...
[2013.06.20 13:59:56.703] - INFO: Overwriting [0] value succeeded.
[2013.06.20 13:59:56.703] -
[2013.06.20 13:59:56.703] - INFO: Processing registry key [systemCurrentControlsetServicesBITSEnumCount] ...
[2013.06.20 13:59:56.703] - INFO: Value [Count] doesn't exist...
[2013.06.20 13:59:56.703] - INFO: Overwriting [Count] value succeeded.
[2013.06.20 13:59:56.703] -
[2013.06.20 13:59:56.703] - INFO: Processing registry key [systemCurrentControlsetServicesBITSEnumNextInstance] ...
[2013.06.20 13:59:56.703] - INFO: Value [NextInstance] doesn't exist...
[2013.06.20 13:59:56.703] - INFO: Overwriting [NextInstance] value succeeded.
[2013.06.20 13:59:56.703] -
[2013.06.20 13:59:56.703] - INFO: Processing registry key [systemCurrentControlsetServicesSharedAccessDependOnGroup] ...
[2013.06.20 13:59:56.703] - INFO: Value [DependOnGroup] doesn't exist...
[2013.06.20 13:59:56.703] - INFO: Overwriting [DependOnGroup] value succeeded.
[2013.06.20 13:59:56.703] -
[2013.06.20 13:59:56.703] - INFO: Processing registry key [systemCurrentControlsetServicesSharedAccessDependOnService] ...
[2013.06.20 13:59:56.703] - INFO: Value [DependOnService] doesn't exist...
[2013.06.20 13:59:56.703] - INFO: Overwriting [DependOnService] value succeeded.
[2013.06.20 13:59:56.703] -
[2013.06.20 13:59:56.703] - INFO: Processing registry key [systemCurrentControlsetServicesSharedAccessDescription] ...
[2013.06.20 13:59:56.703] - INFO: Value [Description] doesn't exist...
[2013.06.20 13:59:56.703] - INFO: Overwriting [Description] value succeeded.
[2013.06.20 13:59:56.703] -
[2013.06.20 13:59:56.703] - INFO: Processing registry key [systemCurrentControlsetServicesSharedAccessDisplayName] ...
[2013.06.20 13:59:56.703] - INFO: Value [DisplayName] doesn't exist...
[2013.06.20 13:59:56.703] - INFO: Overwriting [DisplayName] value succeeded.
[2013.06.20 13:59:56.703] -
[2013.06.20 13:59:56.703] - INFO: Processing registry key [systemCurrentControlsetServicesSharedAccessErrorControl] ...
[2013.06.20 13:59:56.703] - INFO: Value [ErrorControl] doesn't exist...
[2013.06.20 13:59:56.703] - INFO: Overwriting [ErrorControl] value succeeded.
[2013.06.20 13:59:56.703] -
[2013.06.20 13:59:56.703] - INFO: Processing registry key [systemCurrentControlsetServicesSharedAccessImagePath] ...
[2013.06.20 13:59:56.703] - INFO: Value [imagePath] doesn't exist...
[2013.06.20 13:59:56.703] - INFO: Overwriting [imagePath] value succeeded.
[2013.06.20 13:59:56.703] -
[2013.06.20 13:59:56.703] - INFO: Processing registry key [systemCurrentControlsetServicesSharedAccessObjectName] ...
[2013.06.20 13:59:56.703] - INFO: Value [ObjectName] doesn't exist...
[2013.06.20 13:59:56.703] - INFO: Overwriting [ObjectName] value succeeded.
[2013.06.20 13:59:56.703] -
[2013.06.20 13:59:56.703] - INFO: Processing registry key [systemCurrentControlsetServicesSharedAccessStart] ...
[2013.06.20 13:59:56.703] - INFO: Value [start] doesn't exist...
[2013.06.20 13:59:56.703] - INFO: Overwriting [start] value succeeded.
[2013.06.20 13:59:56.703] -
[2013.06.20 13:59:56.703] - INFO: Processing registry key [systemCurrentControlsetServicesSharedAccessType] ...
[2013.06.20 13:59:56.703] - INFO: Value [Type] doesn't exist...
[2013.06.20 13:59:56.703] - INFO: Overwriting [Type] value succeeded.
[2013.06.20 13:59:56.703] -
[2013.06.20 13:59:56.703] - INFO: Processing registry key [systemCurrentControlsetServicesSharedAccessEpochEpoch] ...
[2013.06.20 13:59:56.703] - INFO: Value [Epoch] doesn't exist...
[2013.06.20 13:59:56.703] - INFO: Overwriting [Epoch] value succeeded.
[2013.06.20 13:59:56.703] -
[2013.06.20 13:59:56.703] - INFO: Processing registry key [systemCurrentControlsetServicesSharedAccessParametersServiceDll] ...
[2013.06.20 13:59:56.703] - INFO: Value [serviceDll] doesn't exist...
[2013.06.20 13:59:56.703] - INFO: Overwriting [serviceDll] value succeeded.
[2013.06.20 13:59:56.703] -
[2013.06.20 13:59:56.703] - INFO: Processing registry key [systemCurrentControlsetServicesSharedAccessParametersFirewallPolicyDomainProfileEnableFirewall] ...
[2013.06.20 13:59:56.703] - INFO: Value [EnableFirewall] doesn't exist...
[2013.06.20 13:59:56.703] - INFO: Overwriting [EnableFirewall] value succeeded.
[2013.06.20 13:59:56.703] -
[2013.06.20 13:59:56.703] - INFO: Processing registry key [systemCurrentControlsetServicesSharedAccessParametersFirewallPolicyDomainProfileAuthorizedApplicationsList%windir%system32sessmgr.exe] ...
[2013.06.20 13:59:56.703] - INFO: Value [%windir%system32sessmgr.exe] doesn't exist...
[2013.06.20 13:59:56.703] - INFO: Overwriting [%windir%system32sessmgr.exe] value succeeded.
[2013.06.20 13:59:56.703] -
[2013.06.20 13:59:56.703] - INFO: Processing registry key [systemCurrentControlsetServicesSharedAccessParametersFirewallPolicyDomainProfileAuthorizedApplicationsList%windir%Network Diagnosticxpnetdiag.exe] ...
[2013.06.20 13:59:56.703] - INFO: Value [%windir%Network Diagnosticxpnetdiag.exe] doesn't exist...
[2013.06.20 13:59:56.703] - INFO: Overwriting [%windir%Network Diagnosticxpnetdiag.exe] value succeeded.
[2013.06.20 13:59:56.703] -
[2013.06.20 13:59:56.703] - INFO: Processing registry key [systemCurrentControlsetServicesSharedAccessParametersFirewallPolicyStandardProfileEnableFirewall] ...
[2013.06.20 13:59:56.703] - INFO: Value [EnableFirewall] doesn't exist...
[2013.06.20 13:59:56.703] - INFO: Overwriting [EnableFirewall] value succeeded.
[2013.06.20 13:59:56.703] -
[2013.06.20 13:59:56.703] - INFO: Processing registry key [systemCurrentControlsetServicesSharedAccessParametersFirewallPolicyStandardProfileAuthorizedApplicationsList%windir%system32sessmgr.exe] ...
[2013.06.20 13:59:56.703] - INFO: Value [%windir%system32sessmgr.exe] doesn't exist...
[2013.06.20 13:59:56.703] - INFO: Overwriting [%windir%system32sessmgr.exe] value succeeded.
[2013.06.20 13:59:56.703] -
[2013.06.20 13:59:56.703] - INFO: Processing registry key [systemCurrentControlsetServicesSharedAccessParametersFirewallPolicyStandardProfileAuthorizedApplicationsList%windir%Network Diagnosticxpnetdiag.exe] ...
[2013.06.20 13:59:56.703] - INFO: Value [%windir%Network Diagnosticxpnetdiag.exe] doesn't exist...
[2013.06.20 13:59:56.703] - INFO: Overwriting [%windir%Network Diagnosticxpnetdiag.exe] value succeeded.
[2013.06.20 13:59:56.703] -
[2013.06.20 13:59:56.703] - INFO: Processing registry key [systemCurrentControlsetServicesSharedAccessSetupServiceUpgrade] ...
[2013.06.20 13:59:56.703] - INFO: Value [serviceUpgrade] doesn't exist...
[2013.06.20 13:59:56.703] - INFO: Overwriting [serviceUpgrade] value succeeded.
[2013.06.20 13:59:56.703] -
[2013.06.20 13:59:56.703] - INFO: Processing registry key [systemCurrentControlsetServicesSharedAccessEnum0] ...
[2013.06.20 13:59:56.703] - INFO: Value [0] doesn't exist...
[2013.06.20 13:59:56.703] - INFO: Overwriting [0] value succeeded.
[2013.06.20 13:59:56.703] -
[2013.06.20 13:59:56.703] - INFO: Processing registry key [systemCurrentControlsetServicesSharedAccessEnumCount] ...
[2013.06.20 13:59:56.703] - INFO: Value [Count] doesn't exist...
[2013.06.20 13:59:56.703] - INFO: Overwriting [Count] value succeeded.
[2013.06.20 13:59:56.703] -
[2013.06.20 13:59:56.703] - INFO: Processing registry key [systemCurrentControlsetServicesSharedAccessEnumNextInstance] ...
[2013.06.20 13:59:56.703] - INFO: Value [NextInstance] doesn't exist...
[2013.06.20 13:59:56.703] - INFO: Overwriting [NextInstance] value succeeded.
[2013.06.20 13:59:56.703] -
[2013.06.20 13:59:56.703] - INFO: Processing registry key [systemCurrentControlsetServiceswscsvcType] ...
[2013.06.20 13:59:56.703] - INFO: Value [Type] doesn't exist...
[2013.06.20 13:59:56.703] - INFO: Overwriting [Type] value succeeded.
[2013.06.20 13:59:56.703] -
[2013.06.20 13:59:56.703] - INFO: Processing registry key [systemCurrentControlsetServiceswscsvcStart] ...
[2013.06.20 13:59:56.703] - INFO: Value [start] doesn't exist...
[2013.06.20 13:59:56.718] - INFO: Overwriting [start] value succeeded.
[2013.06.20 13:59:56.718] -
[2013.06.20 13:59:56.718] - INFO: Processing registry key [systemCurrentControlsetServiceswscsvcErrorControl] ...
[2013.06.20 13:59:56.718] - INFO: Value [ErrorControl] doesn't exist...
[2013.06.20 13:59:56.718] - INFO: Overwriting [ErrorControl] value succeeded.
[2013.06.20 13:59:56.718] -
[2013.06.20 13:59:56.718] - INFO: Processing registry key [systemCurrentControlsetServiceswscsvcImagePath] ...
[2013.06.20 13:59:56.718] - INFO: Value [imagePath] doesn't exist...
[2013.06.20 13:59:56.718] - INFO: Overwriting [imagePath] value succeeded.
[2013.06.20 13:59:56.718] -
[2013.06.20 13:59:56.718] - INFO: Processing registry key [systemCurrentControlsetServiceswscsvcDisplayName] ...
[2013.06.20 13:59:56.718] - INFO: Value [DisplayName] doesn't exist...
[2013.06.20 13:59:56.718] - INFO: Overwriting [DisplayName] value succeeded.
[2013.06.20 13:59:56.718] -
[2013.06.20 13:59:56.718] - INFO: Processing registry key [systemCurrentControlsetServiceswscsvcDependOnService] ...
[2013.06.20 13:59:56.718] - INFO: Value [DependOnService] doesn't exist...
[2013.06.20 13:59:56.718] - INFO: Overwriting [DependOnService] value succeeded.
[2013.06.20 13:59:56.718] -
[2013.06.20 13:59:56.718] - INFO: Processing registry key [systemCurrentControlsetServiceswscsvcObjectName] ...
[2013.06.20 13:59:56.718] - INFO: Value [ObjectName] doesn't exist...
[2013.06.20 13:59:56.718] - INFO: Overwriting [ObjectName] value succeeded.
[2013.06.20 13:59:56.718] -
[2013.06.20 13:59:56.718] - INFO: Processing registry key [systemCurrentControlsetServiceswscsvcDescription] ...
[2013.06.20 13:59:56.718] - INFO: Value [Description] doesn't exist...
[2013.06.20 13:59:56.718] - INFO: Overwriting [Description] value succeeded.
[2013.06.20 13:59:56.718] -
[2013.06.20 13:59:56.718] - INFO: Processing registry key [systemCurrentControlsetServiceswscsvcParametersServiceDll] ...
[2013.06.20 13:59:56.718] - INFO: Value [serviceDll] doesn't exist...
[2013.06.20 13:59:56.718] - INFO: Overwriting [serviceDll] value succeeded.
[2013.06.20 13:59:56.718] -
[2013.06.20 13:59:56.718] - INFO: Processing registry key [systemCurrentControlsetServiceswscsvcSecuritySecurity] ...
[2013.06.20 13:59:56.718] - INFO: Value [security] doesn't exist...
[2013.06.20 13:59:56.718] - INFO: Overwriting [security] value succeeded.
[2013.06.20 13:59:56.718] -
[2013.06.20 13:59:56.718] - INFO: Processing registry key [systemCurrentControlsetServiceswscsvcEnum0] ...
[2013.06.20 13:59:56.718] - INFO: Value [0] doesn't exist...
[2013.06.20 13:59:56.718] - INFO: Overwriting [0] value succeeded.
[2013.06.20 13:59:56.718] -
[2013.06.20 13:59:56.718] - INFO: Processing registry key [systemCurrentControlsetServiceswscsvcEnumCount] ...
[2013.06.20 13:59:56.718] - INFO: Value [Count] doesn't exist...
[2013.06.20 13:59:56.718] - INFO: Overwriting [Count] value succeeded.
[2013.06.20 13:59:56.718] -
[2013.06.20 13:59:56.718] - INFO: Processing registry key [systemCurrentControlsetServiceswscsvcEnumNextInstance] ...
[2013.06.20 13:59:56.718] - INFO: Value [NextInstance] doesn't exist...
[2013.06.20 13:59:56.718] - INFO: Overwriting [NextInstance] value succeeded.
[2013.06.20 13:59:56.718] -
[2013.06.20 13:59:56.718] - INFO: Processing registry key [systemCurrentControlsetServiceswuauservType] ...
[2013.06.20 13:59:56.718] - INFO: Value [Type] doesn't exist...
[2013.06.20 13:59:56.718] - INFO: Overwriting [Type] value succeeded.
[2013.06.20 13:59:56.718] -
[2013.06.20 13:59:56.718] - INFO: Processing registry key [systemCurrentControlsetServiceswuauservStart] ...
[2013.06.20 13:59:56.718] - INFO: Value [start] doesn't exist...
[2013.06.20 13:59:56.718] - INFO: Overwriting [start] value succeeded.
[2013.06.20 13:59:56.718] -
[2013.06.20 13:59:56.718] - INFO: Processing registry key [systemCurrentControlsetServiceswuauservErrorControl] ...
[2013.06.20 13:59:56.718] - INFO: Value [ErrorControl] doesn't exist...
[2013.06.20 13:59:56.718] - INFO: Overwriting [ErrorControl] value succeeded.
[2013.06.20 13:59:56.718] -
[2013.06.20 13:59:56.718] - INFO: Processing registry key [systemCurrentControlsetServiceswuauservImagePath] ...
[2013.06.20 13:59:56.718] - INFO: Value [imagePath] doesn't exist...
[2013.06.20 13:59:56.718] - INFO: Overwriting [imagePath] value succeeded.
[2013.06.20 13:59:56.718] -
[2013.06.20 13:59:56.718] - INFO: Processing registry key [systemCurrentControlsetServiceswuauservDisplayName] ...
[2013.06.20 13:59:56.718] - INFO: Value [DisplayName] doesn't exist...
[2013.06.20 13:59:56.718] - INFO: Overwriting [DisplayName] value succeeded.
[2013.06.20 13:59:56.718] -
[2013.06.20 13:59:56.718] - INFO: Processing registry key [systemCurrentControlsetServiceswuauservObjectName] ...
[2013.06.20 13:59:56.718] - INFO: Value [ObjectName] doesn't exist...
[2013.06.20 13:59:56.718] - INFO: Overwriting [ObjectName] value succeeded.
[2013.06.20 13:59:56.718] -
[2013.06.20 13:59:56.718] - INFO: Processing registry key [systemCurrentControlsetServiceswuauservDescription] ...
[2013.06.20 13:59:56.718] - INFO: Value [Description] doesn't exist...
[2013.06.20 13:59:56.718] - INFO: Overwriting [Description] value succeeded.
[2013.06.20 13:59:56.718] -
[2013.06.20 13:59:56.718] - INFO: Processing registry key [systemCurrentControlsetServiceswuauservParametersServiceDll] ...
[2013.06.20 13:59:56.718] - INFO: Value [serviceDll] doesn't exist...
[2013.06.20 13:59:56.718] - INFO: Overwriting [serviceDll] value succeeded.
[2013.06.20 13:59:56.718] -
[2013.06.20 13:59:56.718] - INFO: Processing registry key [systemCurrentControlsetServiceswuauservSecuritySecurity] ...
[2013.06.20 13:59:56.718] - INFO: Value [security] doesn't exist...
[2013.06.20 13:59:56.718] - INFO: Overwriting [security] value succeeded.
[2013.06.20 13:59:56.718] -
[2013.06.20 13:59:56.718] - INFO: Processing registry key [systemCurrentControlsetServiceswuauservEnum0] ...
[2013.06.20 13:59:56.718] - INFO: Value [0] doesn't exist...
[2013.06.20 13:59:56.718] - INFO: Overwriting [0] value succeeded.
[2013.06.20 13:59:56.718] -
[2013.06.20 13:59:56.718] - INFO: Processing registry key [systemCurrentControlsetServiceswuauservEnumCount] ...
[2013.06.20 13:59:56.718] - INFO: Value [Count] doesn't exist...
[2013.06.20 13:59:56.718] - INFO: Overwriting [Count] value succeeded.
[2013.06.20 13:59:56.718] -
[2013.06.20 13:59:56.718] - INFO: Processing registry key [systemCurrentControlsetServiceswuauservEnumNextInstance] ...
[2013.06.20 13:59:56.718] - INFO: Value [NextInstance] doesn't exist...
[2013.06.20 13:59:56.718] - INFO: Overwriting [NextInstance] value succeeded.
[2013.06.20 13:59:56.718] -
[2013.06.20 13:59:56.718] - INFO: After reboot cleaning finished successfully.
[2013.06.20 14:00:11.359] -
[2013.06.20 14:00:11.359] - --------------------------------------------------------------------------------
[2013.06.20 14:00:11.359] - INFO: System is rebooting...
[2013.06.20 14:00:11.375] - --------------------------------------------------------------------------------
[2013.06.20 14:00:11.375] - INFO: Logging finished successfully...
[2013.06.20 14:00:11.375] - --------------------------------------------------------------------------------
 


Създадоха се два затова сега качвам втория:

 

 

[2013.06.20 13:57:12.156] -
[2013.06.20 13:57:12.156] - ....................................
[2013.06.20 13:57:12.156] - ..::::::::::::::::::....................
[2013.06.20 13:57:12.156] - .::EEEEEE:::SSSSSS::..EEEEEE..TTTTTTTT..   Win32/Sirefef (special build)
[2013.06.20 13:57:12.156] -  .::EE::::EE:SS:::::::.EE....EE....TT...... Version: 1.1.0.11
[2013.06.20 13:57:12.171] -  .::EEEEEEEE::SSSSSS::.EEEEEEEE....TT...... Built: May 23 2013
[2013.06.20 13:57:12.171] -  .::EE:::::::::::::SS:.EE..........TT......
[2013.06.20 13:57:12.171] - .::EEEEEE:::SSSSSS::..EEEEEE.....TT.....   Copyright © ESET, spol. s r.o.
[2013.06.20 13:57:12.171] - ..::::::::::::::::::....................   1992-2013. All rights reserved.
[2013.06.20 13:57:12.171] - ....................................
[2013.06.20 13:57:12.171] -
[2013.06.20 13:57:12.171] - --------------------------------------------------------------------------------
[2013.06.20 13:57:12.171] -
[2013.06.20 13:57:12.171] - INFO: OS: 5.1.2600 SP3
[2013.06.20 13:57:12.171] - INFO: Product Type: Workstation
[2013.06.20 13:57:12.171] - INFO: WoW64: False
[2013.06.20 13:57:12.171] - INFO: Machine guid: 0872AB7B-AFC1-46A8-BF2C-C5CDC55D4BF9
[2013.06.20 13:57:12.171] -
[2013.06.20 13:57:13.484] - INFO: EULA Accepted
[2013.06.20 13:57:13.500] - --------------------------------------------------------------------------------
[2013.06.20 13:57:13.500] - INFO: Scanning for system infection...
[2013.06.20 13:57:13.500] - --------------------------------------------------------------------------------
[2013.06.20 13:57:13.500] -
[2013.06.20 13:57:13.500] - INFO: System modules modification not detected...
[2013.06.20 13:57:13.500] - INFO: Suspicious device - b07fb120
[2013.06.20 13:57:13.500] - INFO: Current Shell HKLM [Explorer.exe].
[2013.06.20 13:57:13.500] - INFO: Current SubSystems [%SystemRoot%system32csrss.exe ObjectDirectory=Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16].
[2013.06.20 13:57:13.500] - INFO: Suspicious device [b07fb120].
[2013.06.20 13:57:13.500] - INFO: Sirefef's volume device [b07fb120].
[2013.06.20 13:57:15.078] - INFO: Forged module [afd.sys].
[2013.06.20 13:57:15.093] - INFO: Win32/Sirefef found
[2013.06.20 13:58:21.515] - INFO: Reparse point [??C:WINDOWS$NtUninstallKB351$2220814219] deleted successfully.
[2013.06.20 13:58:21.703] - INFO: Win32/Sirefef was successfully scheduled to after reboot cleaning.
[2013.06.20 13:58:28.921] -
[2013.06.20 13:58:28.921] - --------------------------------------------------------------------------------
[2013.06.20 13:58:28.921] - INFO: System is rebooting...
[2013.06.20 13:58:28.937] - --------------------------------------------------------------------------------
[2013.06.20 13:58:28.937] - INFO: Logging finished successfully...
[2013.06.20 13:58:28.937] - --------------------------------------------------------------------------------
 


http://prikachi.com/images.php?images/677/6242677r.jpg

Редактирано от bassTest (преглед на промените)

Резултатите са задоволителни. :)

 

 

 

СТЪПКА 1

 

 
Да видим за остатъци:

  • [*]Стартирайте
OTL. [*]Направете следните настройки: [*]Сложете отметка пред Scan All Users [*]Под менюто File Age изберете 90 days [*]Под менюто Standard Registry променете на ALL [*]Сложете отметки пред LOP и Purity Check

Под Публикувано изображение с Copy/ Paste въведете изцяло следната текстова информация (само това, което е поставено в карето):

netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%SYSTEMDRIVE%*.*
%USERPROFILE%*.*
%USERPROFILE%Application Data*.*
%USERPROFILE%Application Data*.
%USERPROFILE%Local Settings*.*
%USERPROFILE%Local Settingstemp*.exe
%USERPROFILE%Local SettingsTemporary Internet Files*.exe
%USERPROFILE%Local SettingsApplication Data*.*
%AllUsersProfile%*.*
%AllUsersProfile%Application Data*.*
%AllUsersProfile%Application Data*.
%AllUsersProfile%Application DataLocal Settings*.*
%AllUsersProfile%Application DataLocal SettingsTemp*.exe
%ALLUSERSPROFILE%DocumentsMy Music*.exe
%ALLUSERSPROFILE%DocumentsMy Pictures*.exe
%ALLUSERSPROFILE%DocumentsMy Videos*.exe
%ALLUSERSPROFILE%Documents*.exe
%USERPROFILE%My Documents*.*
%CommonProgramFiles%*.*
%CommonProgramFiles%ComObjects*.*
%PROGRAMFILES%*.*
%PROGRAMFILES%*.
%systemroot%system32configsystemprofile*.*
%systemroot%system32configsystemprofileApplication Data*.*
%systemroot%system32configsystemprofileLocal Settings*.*
%systemroot%system32configsystemprofileLocal SettingsApplication Data*.*
%systemroot%system32configsystemprofileLocal SettingsTemp*.exe
%systemroot%system32configsystemprofileLocal SettingsTemporary Internet Files*.exe
C:Documents and SettingsLocalServiceApplication Data*.*
C:Documents and SettingsLocalServiceLocal SettingsApplication Data*.*
C:Documents and SettingsLocalServiceLocal Settingstemp*.exe
C:Documents and SettingsLocalServiceLocal SettingsTemporary Internet Files*.exe
C:Documents and SettingsLocalServiceLocal Settings*.*
C:Documents and SettingsLocalService*.*
C:Documents and SettingsNetworkServiceApplication Data*.*
C:Documents and SettingsNetworkServiceLocal SettingsApplication Data*.*
C:Documents and SettingsNetworkServiceLocal Settingstemp*.exe
C:Documents and SettingsNetworkServiceLocal SettingsTemporary Internet Files*.exe
C:Documents and SettingsNetworkServiceLocal Settings*.*
C:Documents and SettingsNetworkService*.*
%windir%temp*.exe
%windir%*.
%windir%installer*.
%windir%system32*.
%Temp%smtmp1*.*
%Temp%smtmp2*.*
%Temp%smtmp3*.*
%Temp%smtmp4*.*
%systemroot%system32*.dll /lockedfiles
%systemroot%Tasks*.job /lockedfiles
%systemroot%system32drivers*.sys /90
%systemroot%system32drivers*.sys /lockedfiles
%systemroot%system32Spoolprtprocsw32x86*.dll
%SYSTEMDRIVE%*. /rp /s
%systemroot%assemblytmp*.* /S /MD5
%systemroot%assemblytemp*.* /S /MD5
%systemroot%assemblyGAC*.ini
%systemroot%assemblyGAC_32*.ini
%SystemRoot%assemblyGAC_MSIL*.ini
wsSystemRoot|l,n,u,@;True;False;True;$,{ /fn
%systemdrive%$Recycle.Bin|@;true;true;true /fp
dir /s /a "C:WINDOWS$NtUninstallKB351$" /c
HKEY_CLASSES_ROOTCLSID{7C857801-7381-11CF-884D-00AA004B2E24} /s
HKEY_CLASSES_ROOTCLSID{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1} /s
HKEY_CURRENT_USERSoftwareClassesCLSID{42aedc87-2188-41fd-b9a3-0c966feabec1} /s
HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1} /s
HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{42aedc87-2188-41fd-b9a3-0c966feabec1} /s
HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{a2a9545d-a0c2-42b4-9708-a0b2badd77c8} /s
HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{7C857801-7381-11CF-884D-00AA004B2E24} /s
HKEY_CLASSES_ROOTclsid{5839FCA9-774D-42A1-ACDA-D6A79037F57F} /s
HKEY_CLASSES_ROOTclsid{fbeb8a05-beee-4442-804e-409d6c4515e9} /s
HKEY_CURRENT_USERSoftwareClassesclsid{fbeb8a05-beee-4442-804e-409d6c4515e9} /s
HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{5839FCA9-774D-42A1-ACDA-D6A79037F57F} /s
HKEY_CURRENT_USERSoftwareClassesclsid{12d0253a-7c96-815c-11e0-3034bbd97cc0}] /s
HKEY_CLASSES_ROOTCLSID{312BFDCE-A901-4203-B4F2-ADCB957D1887} /s
HKEY_CLASSES_ROOTDirectoryShellexCopyHookHandlersMSCopy /s
HKEY_CURRENT_USERSoftwareMSOLoad /s
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetservicesNla /s
/md5start
mswsock.dll
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
sceclt.dll
ntelogon.dll
logevent.dll
consrv.dll
services.exe
svchost.exe
explorer.exe
userinit.exe
winlogon.exe
smss.exe
lsass.exe
atapi.sys
iaStor.sys
serial.sys
disk.sys
volsnap.sys
redbook.sys
i8042prt.sys
afd.sys
netbt.sys
tcpip.sys
ipsec.sys
hlp.dat
str.sys
crexv.ocx
/md5stop

  • [*]Натиснете маркираният в синьо бутон:
Run Scan. [*]Като приключи проверката, ще се създадат два файла - OTL.Txt и Extras.Txt. Прикачете тези два файла в следващия си коментар (погледнете опцията Прикачени файлове, когато публикувате мнение).

 

 

 

СТЪПКА 2

 

 

Публикувано изображение Изтеглете Gmer

 

 

  • [*]Временно изключете интернет достъпа си, всички работещи програми (включително и антивирусната си програма и браузъра). [*]Стартирайте програмата. [*]След завършването на автоматичната проверка, махнете отметките от следните позиции, но оставете всички останали:
    - Show all
    - махнете отметките от всички локални дискове. Маркирайте само системния дял (обикновенно това е
C: ) [*]Натиснете бутона Scan [*]Изчакайте програмата да завърши сканирането,след което натиснете бутона Save и запишете (save as) резултатите на десктопа с име Gmer.log. [*]Включете Интернета си и прикачете Gmer.log в следващия си коментар.
Забележка: [*]Не предприемайте никакви действия върху редовете маркирани с "<--- ROOТKIT" ,защото това може да доведе до проблеми с Windows.

  • Автор

OLT Лог;

 

 

 

Резултатите са задоволителни. :)

 

 

 

СТЪПКА 1

 

 
Да видим за остатъци:

  • [*]Стартирайте
OTL. [*]Направете следните настройки: [*]Сложете отметка пред Scan All Users [*]Под менюто File Age изберете 90 days [*]Под менюто Standard Registry променете на ALL [*]Сложете отметки пред LOP и Purity Check

Под Публикувано изображение с Copy/ Paste въведете изцяло следната текстова информация (само това, което е поставено в карето):

  • [*]Натиснете маркираният в синьо бутон:
Run Scan. [*]Като приключи проверката, ще се създадат два файла - OTL.Txt и Extras.Txt. Прикачете тези два файла в следващия си коментар (погледнете опцията Прикачени файлове, когато публикувате мнение).

 

 

 

СТЪПКА 2

 

 

Публикувано изображение Изтеглете Gmer

 

 

  • [*]Временно изключете интернет достъпа си, всички работещи програми (включително и антивирусната си програма и браузъра). [*]Стартирайте програмата. [*]След завършването на автоматичната проверка, махнете отметките от следните позиции, но оставете всички останали:
    - Show all
    - махнете отметките от всички локални дискове. Маркирайте само системния дял (обикновенно това е
C: ) [*]Натиснете бутона Scan [*]Изчакайте програмата да завърши сканирането,след което натиснете бутона Save и запишете (save as) резултатите на десктопа с име Gmer.log. [*]Включете Интернета си и прикачете Gmer.log в следващия си коментар.
Забележка: [*]Не предприемайте никакви действия върху редовете маркирани с "<--- ROOТKIT" ,защото това може да доведе до проблеми с Windows.

 

 


OLT Лог;

 

Extras.Txt. Нещо не ми се създаде само олт.


Знам как да си изключа антивирусната и нета за другите не знам как става.

OTL.Txt

Архивирана тема

Темата е твърде стара и е архивирана. Не можете да добавяте нови отговори в нея, но винаги можете да публикувате нова тема, в която да продължи дискусията. Регистрирайте се или влезте във вашия профил за да публикувате нова тема.

Назад

Разглеждащи това в момента 0

  • Няма регистрирани потребители разглеждащи тази страница.

Дарение

  • Подкрепи съществуването на форума - направи дарение
    32%
    Дарени 315 € от нужните 1 000 €

Бюлетин

Получавайте известие, когато има важна промяна или новина свързана с форума.
Абонирайте се

Профил

Навигация

Търсене

Търсене

Конфигуриране на push известия в браузъра
Chrome (Android)
  1. Докоснете иконата на катинар до адресната лента.
  2. Докоснете Разрешения → Известия.
  3. Променете предпочитанията си.
Chrome (Desktop)
  1. Кликнете върху иконата на катинар в адресната лента.
  2. Изберете Настройки на сайта.
  3. Намерете Известия и коригирайте предпочитанията си.