Здравейте, не ми се отварят някой сайтове,като този на microsoft например. Windows-a ми е XP Service pack 3. Не съм проверявала за вируси с никоя програма, тъй като системата е току що преинсталирана. Възможно ли е да windows-a да не е бил читав? Благодаря Ви за помощта предварително  

Attach.txt

. UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2011-09-30.01) . Microsoft Windows XP Professional Boot Device: DeviceHarddiskVolume1 Install Date: 31.7.2013 г. 13:32:26 System Uptime: 31.7.2013 г. 18:36:47 (0 hours ago) . Motherboard: ASRock |  | N68-S Processor: AMD Athlon Processor LE-1600 | CPUSocket | 2210/200mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 29 GiB total, 20,525 GiB free. D: is FIXED (NTFS) - 157 GiB total, 151,294 GiB free. E: is CDROM () I: is Removable . ==== Disabled Device Manager Items ============= . ==== System Restore Points =================== . RP1: 31.7.2013 г. 15:58:56 - Контролна точка на системата RP2: 31.7.2013 г. 16:53:59 - Installed Platform RP3: 31.7.2013 г. 17:22:34 - SPTD setup V1.83 . ==== Installed Programs ====================== . µTorrent Adobe Flash Player 11 Plugin AIDA64 Extreme Edition v1.50 DAEMON Tools Pro High Definition Audio Driver Package - KB835221 KMP Service Microsoft Compression Client Pack 1.0 for Windows XP Microsoft Internationalized Domain Names Mitigation APIs Microsoft National Language Support Downlevel APIs Microsoft User-Mode Driver Framework Feature Pack 1.0 Mozilla Firefox 22.0 (x86 bg) Mozilla Maintenance Service NVIDIA Drivers NVIDIA ForceWare Network Access Manager Platform Skype Click to Call Skype™ 6.7 The KMPlayer (remove only) VIA п»ї WebFldrs XP Windows Internet Explorer 7 Windows Internet Explorer 7 Language Interface Pack (BGR) Windows Media Format 11 runtime Windows Media Player 11 WinRAR 5.00 Бета 7 (32-битова версия) . ==== Event Viewer Messages From Past Week ======== . 31.7.2013 г. 18:37:17, error: DCOM [10005]  - DCOM got error "%1058" attempting to start the service BITS with arguments "" in order to run the server: {4991D34B-80A1-4291-83B6-3328366B9097} 31.7.2013 г. 18:19:20, error: DCOM [10005]  - DCOM got error "%1058" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334} 31.7.2013 г. 18:07:18, error: DCOM [10005]  - DCOM got error "%1058" attempting to start the service BITS with arguments "" in order to run the server: {4991D34B-80A1-4291-83B6-3328366B9097} 31.7.2013 г. 17:25:37, error: Service Control Manager [7023]  - The Shell System service terminated with the following error:  A dynamic link library (DLL) initialization routine failed. 31.7.2013 г. 17:16:10, error: DCOM [10005]  - DCOM got error "%1058" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334} 31.7.2013 г. 16:51:17, error: SideBySide [59]  - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. . 31.7.2013 г. 16:51:17, error: SideBySide [59]  - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. . 31.7.2013 г. 16:51:17, error: SideBySide [59]  - Generate Activation Context failed for C:DOCUME~1oliLOCALS~1Tempbitool.dll. Reference error message: The operation completed successfully. . 31.7.2013 г. 16:51:17, error: SideBySide [59]  - Generate Activation Context failed for C:DOCUME~1oliLOCALS~1Tempbitool.dll. Reference error message: The operation completed successfully. . 31.7.2013 г. 16:51:17, error: SideBySide [32]  - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system. 31.7.2013 г. 16:51:17, error: SideBySide [32]  - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system. 31.7.2013 г. 16:51:09, error: SideBySide [59]  - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. . 31.7.2013 г. 16:51:09, error: SideBySide [59]  - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. . 31.7.2013 г. 16:51:09, error: SideBySide [59]  - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. . 31.7.2013 г. 16:51:09, error: SideBySide [59]  - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. . 31.7.2013 г. 16:51:09, error: SideBySide [59]  - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. . 31.7.2013 г. 16:51:09, error: SideBySide [59]  - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. . 31.7.2013 г. 16:51:09, error: SideBySide [59]  - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. . 31.7.2013 г. 16:51:09, error: SideBySide [59]  - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. . 31.7.2013 г. 16:51:09, error: SideBySide [59]  - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. . 31.7.2013 г. 16:51:09, error: SideBySide [59]  - Generate Activation Context failed for C:DOCUME~1oliLOCALS~1Tempbitool.dll. Reference error message: The operation completed successfully. . 31.7.2013 г. 16:51:09, error: SideBySide [59]  - Generate Activation Context failed for C:DOCUME~1oliLOCALS~1Tempbitool.dll. Reference error message: The operation completed successfully. . 31.7.2013 г. 16:51:09, error: SideBySide [59]  - Generate Activation Context failed for C:DOCUME~1oliLOCALS~1Tempbitool.dll. Reference error message: The operation completed successfully. . 31.7.2013 г. 16:51:09, error: SideBySide [59]  - Generate Activation Context failed for C:DOCUME~1oliLOCALS~1Tempbitool.dll. Reference error message: The operation completed successfully. . 31.7.2013 г. 16:51:09, error: SideBySide [59]  - Generate Activation Context failed for C:DOCUME~1oliLOCALS~1Tempbitool.dll. Reference error message: The operation completed successfully. . 31.7.2013 г. 16:51:09, error: SideBySide [59]  - Generate Activation Context failed for C:DOCUME~1oliLOCALS~1Tempbitool.dll. Reference error message: The operation completed successfully. . 31.7.2013 г. 16:51:09, error: SideBySide [59]  - Generate Activation Context failed for C:DOCUME~1oliLOCALS~1Tempbitool.dll. Reference error message: The operation completed successfully. . 31.7.2013 г. 16:51:09, error: SideBySide [59]  - Generate Activation Context failed for C:DOCUME~1oliLOCALS~1Tempbitool.dll. Reference error message: The operation completed successfully. . 31.7.2013 г. 16:51:09, error: SideBySide [59]  - Generate Activation Context failed for C:DOCUME~1oliLOCALS~1Tempbitool.dll. Reference error message: The operation completed successfully. . 31.7.2013 г. 16:51:09, error: SideBySide [32]  - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system. 31.7.2013 г. 16:51:09, error: SideBySide [32]  - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system. 31.7.2013 г. 16:51:09, error: SideBySide [32]  - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system. 31.7.2013 г. 16:51:09, error: SideBySide [32]  - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system. 31.7.2013 г. 16:51:09, error: SideBySide [32]  - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system. 31.7.2013 г. 16:51:09, error: SideBySide [32]  - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system. 31.7.2013 г. 16:51:09, error: SideBySide [32]  - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system. 31.7.2013 г. 16:51:09, error: SideBySide [32]  - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system. 31.7.2013 г. 16:51:09, error: SideBySide [32]  - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system. 31.7.2013 г. 16:48:32, error: DCOM [10005]  - DCOM got error "%1058" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334} 31.7.2013 г. 16:39:23, error: DCOM [10005]  - DCOM got error "%1058" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334} 31.7.2013 г. 16:31:58, error: DCOM [10005]  - DCOM got error "%1058" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334} 31.7.2013 г. 16:31:25, error: DCOM [10005]  - DCOM got error "%1058" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334} 31.7.2013 г. 16:21:18, error: DCOM [10005]  - DCOM got error "%1058" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334} 31.7.2013 г. 16:14:03, error: DCOM [10005]  - DCOM got error "%1058" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334} 31.7.2013 г. 16:03:09, error: DCOM [10005]  - DCOM got error "%1058" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334} 31.7.2013 г. 16:00:29, error: Service Control Manager [7023]  - The Shell System service terminated with the following error:  A dynamic link library (DLL) initialization routine failed. 31.7.2013 г. 16:00:26, error: SideBySide [59]  - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. . 31.7.2013 г. 16:00:26, error: SideBySide [59]  - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. . 31.7.2013 г. 16:00:26, error: SideBySide [59]  - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. . 31.7.2013 г. 16:00:26, error: SideBySide [59]  - Generate Activation Context failed for C:DOCUME~1oliLOCALS~1Tempbitool.dll. Reference error message: The operation completed successfully. . 31.7.2013 г. 16:00:26, error: SideBySide [59]  - Generate Activation Context failed for C:DOCUME~1oliLOCALS~1Tempbitool.dll. Reference error message: The operation completed successfully. . 31.7.2013 г. 16:00:26, error: SideBySide [59]  - Generate Activation Context failed for C:DOCUME~1oliLOCALS~1Tempbitool.dll. Reference error message: The operation completed successfully. . 31.7.2013 г. 16:00:26, error: SideBySide [32]  - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system. 31.7.2013 г. 16:00:26, error: SideBySide [32]  - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system. 31.7.2013 г. 16:00:26, error: SideBySide [32]  - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system. 31.7.2013 г. 16:00:19, error: SideBySide [59]  - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. . 31.7.2013 г. 16:00:19, error: SideBySide [59]  - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. . 31.7.2013 г. 16:00:19, error: SideBySide [59]  - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. . 31.7.2013 г. 16:00:19, error: SideBySide [59]  - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. . 31.7.2013 г. 16:00:19, error: SideBySide [59]  - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. . 31.7.2013 г. 16:00:19, error: SideBySide [59]  - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. . 31.7.2013 г. 16:00:19, error: SideBySide [59]  - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. . 31.7.2013 г. 16:00:19, error: SideBySide [59]  - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. . 31.7.2013 г. 16:00:19, error: SideBySide [59]  - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. . 31.7.2013 г. 16:00:19, error: SideBySide [59]  - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. . 31.7.2013 г. 16:00:19, error: SideBySide [59]  - Generate Activation Context failed for C:DOCUME~1oliLOCALS~1Tempbitool.dll. Reference error message: The operation completed successfully. . 31.7.2013 г. 16:00:19, error: SideBySide [59]  - Generate Activation Context failed for C:DOCUME~1oliLOCALS~1Tempbitool.dll. Reference error message: The operation completed successfully. . 31.7.2013 г. 16:00:19, error: SideBySide [59]  - Generate Activation Context failed for C:DOCUME~1oliLOCALS~1Tempbitool.dll. Reference error message: The operation completed successfully. . 31.7.2013 г. 16:00:19, error: SideBySide [59]  - Generate Activation Context failed for C:DOCUME~1oliLOCALS~1Tempbitool.dll. Reference error message: The operation completed successfully. . 31.7.2013 г. 16:00:19, error: SideBySide [59]  - Generate Activation Context failed for C:DOCUME~1oliLOCALS~1Tempbitool.dll. Reference error message: The operation completed successfully. . 31.7.2013 г. 16:00:19, error: SideBySide [59]  - Generate Activation Context failed for C:DOCUME~1oliLOCALS~1Tempbitool.dll. Reference error message: The operation completed successfully. . 31.7.2013 г. 16:00:19, error: SideBySide [59]  - Generate Activation Context failed for C:DOCUME~1oliLOCALS~1Tempbitool.dll. Reference error message: The operation completed successfully. . 31.7.2013 г. 16:00:19, error: SideBySide [59]  - Generate Activation Context failed for C:DOCUME~1oliLOCALS~1Tempbitool.dll. Reference error message: The operation completed successfully. . 31.7.2013 г. 16:00:19, error: SideBySide [59]  - Generate Activation Context failed for C:DOCUME~1oliLOCALS~1Tempbitool.dll. Reference error message: The operation completed successfully. . 31.7.2013 г. 16:00:19, error: SideBySide [59]  - Generate Activation Context failed for C:DOCUME~1oliLOCALS~1Tempbitool.dll. Reference error message: The operation completed successfully. . 31.7.2013 г. 16:00:19, error: SideBySide [32]  - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system. 31.7.2013 г. 16:00:19, error: SideBySide [32]  - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system. 31.7.2013 г. 16:00:19, error: SideBySide [32]  - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system. 31.7.2013 г. 16:00:19, error: SideBySide [32]  - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system. 31.7.2013 г. 16:00:19, error: SideBySide [32]  - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system. 31.7.2013 г. 16:00:19, error: SideBySide [32]  - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system. 31.7.2013 г. 16:00:19, error: SideBySide [32]  - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system. 31.7.2013 г. 16:00:19, error: SideBySide [32]  - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system. 31.7.2013 г. 16:00:19, error: SideBySide [32]  - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system. 31.7.2013 г. 16:00:19, error: SideBySide [32]  - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system. 31.7.2013 г. 16:00:10, error: SideBySide [59]  - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. . 31.7.2013 г. 16:00:10, error: SideBySide [59]  - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. . 31.7.2013 г. 16:00:10, error: SideBySide [59]  - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. . 31.7.2013 г. 16:00:10, error: SideBySide [59]  - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. . 31.7.2013 г. 16:00:10, error: SideBySide [59]  - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. . 31.7.2013 г. 16:00:10, error: SideBySide [59]  - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. . 31.7.2013 г. 16:00:10, error: SideBySide [59]  - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. . 31.7.2013 г. 16:00:10, error: SideBySide [59]  - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. . 31.7.2013 г. 16:00:10, error: SideBySide [59]  - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. . 31.7.2013 г. 16:00:10, error: SideBySide [59]  - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. . 31.7.2013 г. 16:00:10, error: SideBySide [59]  - Generate Activation Context failed for C:DOCUME~1oliLOCALS~1Tempbitool.dll. Reference error message: The operation completed successfully. . 31.7.2013 г. 16:00:10, error: SideBySide [59]  - Generate Activation Context failed for C:DOCUME~1oliLOCALS~1Tempbitool.dll. Reference error message: The operation completed successfully. . 31.7.2013 г. 16:00:10, error: SideBySide [59]  - Generate Activation Context failed for C:DOCUME~1oliLOCALS~1Tempbitool.dll. Reference error message: The operation completed successfully. . 31.7.2013 г. 16:00:10, error: SideBySide [59]  - Generate Activation Context failed for C:DOCUME~1oliLOCALS~1Tempbitool.dll. Reference error message: The operation completed successfully. . 31.7.2013 г. 16:00:10, error: SideBySide [59]  - Generate Activation Context failed for C:DOCUME~1oliLOCALS~1Tempbitool.dll. Reference error message: The operation completed successfully. . 31.7.2013 г. 16:00:10, error: SideBySide [59]  - Generate Activation Context failed for C:DOCUME~1oliLOCALS~1Tempbitool.dll. Reference error message: The operation completed successfully. . 31.7.2013 г. 16:00:10, error: SideBySide [59]  - Generate Activation Context failed for C:DOCUME~1oliLOCALS~1Tempbitool.dll. Reference error message: The operation completed successfully. . 31.7.2013 г. 16:00:10, error: SideBySide [59]  - Generate Activation Context failed for C:DOCUME~1oliLOCALS~1Tempbitool.dll. Reference error message: The operation completed successfully. . 31.7.2013 г. 16:00:10, error: SideBySide [59]  - Generate Activation Context failed for C:DOCUME~1oliLOCALS~1Tempbitool.dll. Reference error message: The operation completed successfully. . 31.7.2013 г. 16:00:10, error: SideBySide [59]  - Generate Activation Context failed for C:DOCUME~1oliLOCALS~1Tempbitool.dll. Reference error message: The operation completed successfully. . 31.7.2013 г. 16:00:10, error: SideBySide [32]  - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system. 31.7.2013 г. 16:00:10, error: SideBySide [32]  - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system. 31.7.2013 г. 16:00:10, error: SideBySide [32]  - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system. 31.7.2013 г. 16:00:10, error: SideBySide [32]  - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system. 31.7.2013 г. 16:00:10, error: SideBySide [32]  - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system. 31.7.2013 г. 16:00:10, error: SideBySide [32]  - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system. 31.7.2013 г. 16:00:10, error: SideBySide [32]  - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system. 31.7.2013 г. 16:00:10, error: SideBySide [32]  - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system. 31.7.2013 г. 16:00:10, error: SideBySide [32]  - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system. 31.7.2013 г. 16:00:10, error: SideBySide [32]  - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system. 31.7.2013 г. 15:58:40, error: Dhcp [1001]  - Your computer was not assigned an address from the network (by the DHCP Server) for the Network Card with network address 001966DC26F9.  The following error occurred:  The operation was canceled by the user. . Your computer will continue to try and obtain an address on its own from the network address (DHCP) server. 31.7.2013 г. 14:02:57, error: IPXRouterManager [20115]  - IPX Routing requires an internal network number for correct operation. 31.7.2013 г. 14:01:08, error: Server [2505]  - The server could not bind to the transport DeviceNwlnkNb because another computer on the network has the same name.  The server could not start. 31.7.2013 г. 14:01:08, error: Server [2505]  - The server could not bind to the transport DeviceNwlnkIpx because another computer on the network has the same name.  The server could not start. 31.7.2013 г. 13:43:02, error: Service Control Manager [7009]  - Timeout (30000 milliseconds) waiting for the crd service to connect. 31.7.2013 г. 13:43:02, error: Service Control Manager [7000]  - The crd service failed to start due to the following error:  The service did not respond to the start or control request in a timely fashion. 31.7.2013 г. 13:32:38, error: Setup [60055]  - Windows Setup encountered non-fatal errors during installation. Please check the setuperr.log found in your Windows directory for more information. . ==== End Of File ===========================  

 

dds.txt

 

DDS (Ver_2011-09-30.01) - NTFS_x86 Internet Explorer: 7.0.5730.13 Run by oli at 18:37:39 on 2013-07-31 Microsoft Windows XP Professional  5.1.2600.3.1251.359.1033.18.447.33 [GMT 3:00] . FW: ActiveArmor Firewall *Disabled* . ============== Running Processes ================ . C:WINDOWSsystem32spoolsv.exe C:WINDOWSExplorer.EXE C:WINDOWSsystem32RUNDLL32.EXE C:Program FilesNVIDIA CorporationNetworkAccessManagerApache GroupApache2binapache.exe C:WINDOWSsystem32msiexec.exe C:WINDOWSsystem32KaraokeSer.exe C:Program FilesNVIDIA CorporationNetworkAccessManagerbinnSvcLog.exe C:Program FilesNVIDIA CorporationNetworkAccessManagerApache GroupApache2binapache.exe C:WINDOWSsystem32nvsvc32.exe C:Program FilesPANDORA.TVPanServiceKMPService.exe C:Documents and SettingsAll UsersApplication DataSkypeToolbarsSkype C2C Servicec2c_service.exe C:Program FilesPANDORA.TVPanServiceKMPProcess.exe C:Program FilesSkypeUpdaterUpdater.exe C:Program FilesNVIDIA CorporationNetworkAccessManagerbinnSvcIp.exe C:WINDOWSSystem32alg.exe C:WINDOWSsystem32wbemwmiprvse.exe C:WINDOWSsystem32wbemwmiprvse.exe C:Program FilesVIAVIAudioiHDADeckHDeck.exe C:WINDOWSsystem32ctfmon.exe C:Documents and SettingsoliApplication DatauTorrentuTorrent.exe C:Program FilesSkypePhoneSkype.exe C:Documents and SettingsAll UsersApplication DataSystem1349780318.exe C:Program FilesMozilla Firefoxfirefox.exe C:WINDOWSSystem32svchost.exe -k netsvcs C:WINDOWSsystem32svchost.exe -k NetworkService C:WINDOWSsystem32svchost.exe -k LocalService C:WINDOWSsystem32svchost.exe . ============== Pseudo HJT Report =============== . BHO: Skype Browser Helper: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - c:program filesskypetoolbarsinternet explorerskypeieplugin.dll uRun: [CTFMON.EXE] c:windowssystem32ctfmon.exe uRun: [uTorrent] "c:documents and settingsoliapplication datautorrentuTorrent.exe"  /MINIMIZED uRun: [1349780318] c:documents and settingsall usersapplication datasystem1349780318.exe uRun: [DAEMON Tools Pro Agent] "c:program filesdaemon tools proDTAgent.exe" -autorun uRun: [skype] "c:program filesskypephoneSkype.exe" /minimized /regrun mRun: [NvCplDaemon] RUNDLL32.EXE c:windowssystem32NvCpl.dll,NvStartup mRun: [nwiz] nwiz.exe /install mRun: [NvMediaCenter] RUNDLL32.EXE c:windowssystem32NvMcTray.dll,NvTaskbarInit mRun: [HDAudDeck] c:program filesviaviaudioihdadeckHDeck.exe 1 dRun: [CTFMON.EXE] c:windowssystem32CTFMON.EXE uPolicies-Explorer: NoDriveTypeAutoRun = dword:145 mPolicies-Explorer: NoDriveTypeAutoRun = dword:145 IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:program filesskypetoolbarsinternet explorerskypeieplugin.dll IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%Network Diagnosticxpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:program filesmessengermsmsgs.exe TCP: NameServer = 89.215.233.2 89.215.246.40 TCP: Interfaces{D98D2B2B-71D5-439D-BCB6-789C6E94BC7F} : DHCPNameServer = 89.215.233.2 89.215.246.40 Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:program filesskypetoolbarsinternet explorerskypeieplugin.dll Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:program filescommon filesskypeSkype4COM.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:windowssystem32WPDShServiceObj.dll LSA: Authentication Packages =  msv1_0 nwprovau . ================= FIREFOX =================== . FF - ProfilePath - c:documents and settingsoliapplication datamozillafirefoxprofilesdgl0r0s3.default FF - plugin: c:windowssystem32macromedflashNPSWF32_11_8_800_94.dll . ============= SERVICES / DRIVERS =============== . R2 KaraokeService;VIA Karaoke digital mixer Service;c:windowssystem32KaraokeSer.exe [2013-7-31 88696] R2 PanService;PandoraService;c:program filespandora.tvpanserviceKMPService.exe [2013-7-31 1922600] R2 Skype C2C Service;Skype C2C Service;c:documents and settingsall usersapplication dataskypetoolbarsskype c2c servicec2c_service.exe [2013-7-12 3289472] R2 SkypeUpdate;Skype Updater;c:program filesskypeupdaterUpdater.exe [2013-7-25 162672] R3 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:windowssystem32driversdtsoftbus01.sys [2013-7-31 242240] R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:windowssystem32driversviahduaa.sys [2013-7-31 2558200] S2 apxgtyroo;Shell System;c:windowssystem32svchost.exe -k netsvcs [2008-4-14 14336] S3 AMBFilt;AMBFilt;c:windowssystem32driversAmbfilt.sys [2013-7-31 1656960] S3 MozillaMaintenance;Mozilla Maintenance Service;c:program filesmozilla maintenance servicemaintenanceservice.exe [2013-7-31 117144] . =============== Created Last 30 ================ . 2013-07-31 15:06:23  --------  d-----r-  c:program filesSkype 2013-07-31 14:52:13  --------  d-----w-  c:program filesAlcohol Soft 2013-07-31 14:22:34  466008  ----a-w-  c:windowssystem32driverssptd.sys 2013-07-31 14:17:59  242240  ----a-w-  c:windowssystem32driversdtsoftbus01.sys 2013-07-31 14:17:43  --------  d-----w-  c:documents and settingsoliapplication dataDAEMON Tools Pro 2013-07-31 14:17:35  --------  d-----w-  c:program filesDAEMON Tools Pro 2013-07-31 14:17:18  --------  d-----w-  c:documents and settingsall usersapplication dataDAEMON Tools Pro 2013-07-31 14:02:13  --------  d-----w-  c:documents and settingsall usersapplication dataSystem . ==================== Find3M  ==================== . 2013-07-31 12:49:07  692104  ----a-w-  c:windowssystem32FlashPlayerApp.exe 2013-07-31 12:49:06  71048  ----a-w-  c:windowssystem32FlashPlayerCPLApp.cpl 2013-07-31 10:28:42  8992  ----a-w-  c:windowssystem32KBD_PHO.DLL 2013-07-31 10:28:42  5632  ----a-w-  c:windowssystem32KBD_BDS.DLL . ============= FINISH: 18:38:13.79 ===============  

Здравейте,

 

Според логовете системата ви е заразена!

 

• [*]

Изтеглете OTL.exe и го запазете на десктопа.

[*]Стартирайте файла с двукратен клик на мишката (ако е необходимо, потвърдете през UAC). [*]Направете следните настройки: [*]Сложете отметка пред Scan All Users [*]Под менюто File Age изберете 90 days [*]Под менюто Standard Registry променете на ALL [*]Сложете отметки пред LOP и Purity Check

Под с Copy/ Paste въведете изцяло следната текстова информация (само това, което е поставено в карето):

netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%SYSTEMDRIVE%*.*
%USERPROFILE%*.*
%USERPROFILE%Application Data*.*
%USERPROFILE%Application Data*.
%USERPROFILE%Local Settings*.*
%USERPROFILE%Local Settingstemp*.exe
%USERPROFILE%Local SettingsTemporary Internet Files*.exe
%USERPROFILE%Local SettingsApplication Data*.*
%AllUsersProfile%*.*
%AllUsersProfile%Application Data*.*
%AllUsersProfile%Application Data*.
%AllUsersProfile%Application DataLocal Settings*.*
%AllUsersProfile%Application DataLocal SettingsTemp*.exe
%ALLUSERSPROFILE%DocumentsMy Music*.exe
%ALLUSERSPROFILE%DocumentsMy Pictures*.exe
%ALLUSERSPROFILE%DocumentsMy Videos*.exe
%ALLUSERSPROFILE%Documents*.exe
%USERPROFILE%My Documents*.*
%CommonProgramFiles%*.*
%CommonProgramFiles%ComObjects*.*
%PROGRAMFILES%*.*
%PROGRAMFILES%*.
%systemroot%system32configsystemprofile*.*
%systemroot%system32configsystemprofileApplication Data*.*
%systemroot%system32configsystemprofileLocal Settings*.*
%systemroot%system32configsystemprofileLocal SettingsApplication Data*.*
%systemroot%system32configsystemprofileLocal SettingsTemp*.exe
%systemroot%system32configsystemprofileLocal SettingsTemporary Internet Files*.exe
C:Documents and SettingsLocalServiceApplication Data*.*
C:Documents and SettingsLocalServiceLocal SettingsApplication Data*.*
C:Documents and SettingsLocalServiceLocal Settingstemp*.exe
C:Documents and SettingsLocalServiceLocal SettingsTemporary Internet Files*.exe
C:Documents and SettingsLocalServiceLocal Settings*.*
C:Documents and SettingsLocalService*.*
C:Documents and SettingsNetworkServiceApplication Data*.*
C:Documents and SettingsNetworkServiceLocal SettingsApplication Data*.*
C:Documents and SettingsNetworkServiceLocal Settingstemp*.exe
C:Documents and SettingsNetworkServiceLocal SettingsTemporary Internet Files*.exe
C:Documents and SettingsNetworkServiceLocal Settings*.*
C:Documents and SettingsNetworkService*.*
%windir%temp*.exe
%windir%*.
%windir%installer*.
%windir%system32*.
%Temp%smtmp1*.*
%Temp%smtmp2*.*
%Temp%smtmp3*.*
%Temp%smtmp4*.*
%systemroot%system32*.dll /lockedfiles
%systemroot%Tasks*.job /lockedfiles
%systemroot%system32drivers*.sys /90
%systemroot%system32drivers*.sys /lockedfiles
%systemroot%system32Spoolprtprocsw32x86*.dll
%SYSTEMDRIVE%*. /rp /s
%systemroot%assemblytmp*.* /S /MD5
%systemroot%assemblytemp*.* /S /MD5
%systemroot%assemblyGAC*.ini
%systemroot%assemblyGAC_32*.ini
%SystemRoot%assemblyGAC_MSIL*.ini
wsSystemRoot|l,n,u,@;True;False;True;$,{ /fn
%systemdrive%$Recycle.Bin|@;true;true;true /fp
HKEY_CLASSES_ROOTCLSID{7C857801-7381-11CF-884D-00AA004B2E24} /s
HKEY_CLASSES_ROOTCLSID{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1} /s
HKEY_CURRENT_USERSoftwareClassesCLSID{42aedc87-2188-41fd-b9a3-0c966feabec1} /s
HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1} /s
HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{42aedc87-2188-41fd-b9a3-0c966feabec1} /s
HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{a2a9545d-a0c2-42b4-9708-a0b2badd77c8} /s
HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{7C857801-7381-11CF-884D-00AA004B2E24} /s
HKEY_CLASSES_ROOTclsid{5839FCA9-774D-42A1-ACDA-D6A79037F57F} /s
HKEY_CLASSES_ROOTclsid{fbeb8a05-beee-4442-804e-409d6c4515e9} /s
HKEY_CURRENT_USERSoftwareClassesclsid{fbeb8a05-beee-4442-804e-409d6c4515e9} /s
HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{5839FCA9-774D-42A1-ACDA-D6A79037F57F} /s
HKEY_CURRENT_USERSoftwareClassesclsid{12d0253a-7c96-815c-11e0-3034bbd97cc0}] /s
HKEY_CLASSES_ROOTCLSID{312BFDCE-A901-4203-B4F2-ADCB957D1887} /s
HKEY_CLASSES_ROOTDirectoryShellexCopyHookHandlersMSCopy /s
HKEY_CURRENT_USERSoftwareMSOLoad /s
c:system volume information|_REGISTRY_MACHINE_SYSTEM;true;true;true /FP
c:system volume information|_REGISTRY_MACHINE_SOFTWARE;true;true;true /FP
>C:commands.txt echo list vol /raw /hide /c
/wait
>C:DiskReport.txt diskpart /s C:commands.txt /raw /hide /c
/wait
type c:diskreport.txt /c
/wait
erase c:commands.txt /hide /c
/wait
erase c:diskreport.txt /hide /c
/md5start
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
sceclt.dll
ntelogon.dll
logevent.dll
consrv.dll
services.exe
svchost.exe
explorer.exe
userinit.exe
winlogon.exe
smss.exe
lsass.exe
imapi.sys
fastfat.sys
atapi.sys
iaStor.sys
serial.sys
disk.sys
volsnap.sys
redbook.sys
i8042prt.sys
afd.sys
netbt.sys
tcpip.sys
ipsec.sys
kbdclass.sys
kbdhid.sys
mouclass.sys
mouhid.sys
hlp.dat
str.sys
crexv.ocx
/md5stop

• [*]Натиснете маркираният в синьо бутон:

Run Scan. [*]Като приключи проверката, ще се създадат два файла - OTL.Txt и Extras.Txt. Прикачете тези два файла в следващия си коментар (погледнете опцията Прикачени файлове, когато публикувате мнение).

Ето какво ми се получи:

 

OTL.Txt

Extras.Txt

[*]Стартирайте файла с двукратен клик на мишката.

[*]Под с Copy/ Paste въведете изцяло следната текстова информация (само това, което е поставено в карето):

:OTL

PRC - [2013/07/31 17:02:09 | 000,130,560 | -HS- | M] (SomePDF.com) -- C:Documents and SettingsAll UsersApplication DataSystem1349780318.exe

SRV - [2008/04/14 05:41:58 | 000,166,048 | RHS- | M] () [Auto | Stopped] -- C:WINDOWSsystem32vcdobhwn.dll -- (apxgtyroo)

DRV - File not found [Kernel | On_Demand | Unknown] -- C:DOCUME~1oliLOCALS~1Tempmbr.sys -- (mbr)

DRV - File not found [Kernel | On_Demand | Unknown] --  -- (apuelrih)

O4 - HKUS-1-5-21-329068152-682003330-1801674531-1003..Run: [1349780318] C:Documents and SettingsAll UsersApplication DataSystem1349780318.exe (SomePDF.com)

O6 - HKLMSOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorer: 3212083974 = 50 4B 03 04 7E CD E6 7B 06 83 74 BF B5 11 00 00 00 40 00 00 3B 52 04 7F 42 E5 F1 3F FC 79 C5 20 65 C1 BE 89 B5 0C D7 B4 76 9F 60 28 9B FB D9 84 D1 41 10 F2 D0 12 70 B1 6F C2 70 6B 1E DA 5D 73 99 3A 9F 91 60 03 04 1E 5B 35 D2 96 12 68 57 F9 E7 25 1C 73 D3 EF C0 97 01 D8 D7 AD C4 61 08 18 40 4E 80 E3 42 F2 84 FC 32 6F AF F9 63 9E BA 1E 04 B3 74 2F 5A 9C FF 01 38 2A 0C 43 DD 64 F0 C5 C7 2F 17 49 1D 19 AA 60 4C 54 BA FD 81 DA B7 66 00 98 60 6B C5 3B 2C CF AF CC 76 3E 85 AF 89 3E 2E C9 27 77 0A 5A 8F BD 74 9F 1F AD C9 CA C3 E3 2E D0 81 F1 7F 67 0C 36 13 41 DC A6 E6 AA B2 2F 35 F8 A0 1B F2 0D 6F 28 13 79 60 4D DF 2B 2D 3A AB 04 75 42 0E A3 51 40 CB D4 85 0B 5B 37 D2 E0 E5 82 56 9D 37 AC 0A EB FD 63 62 2E 50 1F 2B F5 15 2F CF 27 CA AC EF C4 62 6F B2 41 DB DA 40 EF 0B 12 DD 6F 0A D6 7E 93 DF DC 18 61 00 40 81 B9 D7 2C 75 BB 44 BE 9D 1E 27 10 61 03 C3 5A 24 C8 1A BF A9 A1 F7 7C ED 3C 03 82 BB 7B 0C D5 00 5C FD 4D 9C 12 BA A0 35 9A FB EE 31 3F E0 71 AF E8 70 3B D9 2A BE 22 A0 D5 1F 30 44 C7 41 0D 9D 6C 7A A0 33 7D 9B 7B BD 1F 34 42 DA BD 7B 34 DC F6 88 8C 18 89 49 65 A7 AC 67 02 C9 71 1F 39 05 F5 90 40 5B 70 02 13 3B E6 02 3C 13 76 BB 44 87 33 57 A9 55 56 95 62 5C D6 1A 62 34 3D C8 92 8E 68 5F EA E8 E0 40 D0 66 B1 9F AE 8E 6B 1F 52 EC 94 EB 23 38 2A 36 F9 82 A5 FE 7B 91 3C 17 07 AA 98 14 51 96 E1 16 89 40 B8 71 81 EC C8 4A 3D 07 48 75 B1 AA 30 63 14 B7 D0 FD 77 AC 56 02 E6 56 A4 FE 5F 7D 12 76 76 7A 26 14 E2 DE 7E 29 1B 77 29 A5 87 32 F4 42 E9 C0 98 42 E7 D8 E4 4E B4 B8 1D 4A 33 BB 5A 0E E4 A7 34 28 9B 6D 99 E8 7C 21 BF 02 48 F5 22 B3 8F 8E 69 C3 22 9F 88 BE 9B 87 47 50 0A 03 FE 71 AF 63 56 47 68 05 E7 7D A5 AC F4 59 79 17 CD 06 32 C1 E2 57 EA 8E B5 38 47 06 6E 81 08 E9 9D 0F B5 56 B2 BF 72 BB 5B ED 57 92 37 3C 64 86 72 06 19 E1 5B 5D 98 10 F5 78 37 60 94 9E 53 43 C6 DD 48 77 63 78 67 BE FD 76 8B 43 92 97 D7 E8 21 CF C4 BA 39 80 F1 CA 22 79 A2 E6 A4 59 47 0C 6F F2 8F A2 CA 72 36 E8 1B 6E 2A 1B 5C 34 9B CF 47 29 C2 43 88 38 5F 42 30 2C 6F 84 75 F4 4F 7B A9 0A 1B 7E 1E 10 A4 80 47 D4 1B C1 13 6D C5 1B 40 CF C8 5C 09 AE 83 F8 BA 3B 01 E3 59 FB 02 41 36 7E 51 68 F4 8E FC 6A F1 EF 1D C6 B0 DF 6E 69 B2 93 23 CC 1C BE 73 E3 9F 30 69 C1 5A B3 80 87 A2 FD B5 08 51 81 93 F8 67 71 0C 6B 37 8A F2 F2 5A 8D DC E7 2F 0D 61 E1 9E 47 87 7F 68 B7 8B 3E 8A F4 52 B2 2C C5 BE A2 AC 10 74 74 68 96 39 D2 3E 27 89 E4 D3 4F D4 24 BE DA 09 6E D4 F0 91 B9 CC F2 E3 D0 41 FD 66 06 79 5D 3A 09 CD 04 B5 ED 2A F5 BA 71 F4 A0 1C AE 89 A4 93 3F B1 E0 8B 12 91 38 CE D6 32 29 F7 ED 95 74 13 1F 0C 0E CE 1C 59 28 ED 9D 43 76 DE 50 DD F3 79 DB FC 33 DC 0E B0 00 B6 09 8D E6 F9 2B CE 50 3A DF C7 55 41 BF 4A 6B EC 97 B2 98 77 3E F6 5B 60 B1 77 21 43 13 FC 15 08 AB E3 0F DE 7B 48 83 6D 33 4F 61 04 7C F5 BF F2 09 3E 8F 38 0A 79 86 AD 8F FA 5A C6 A8 ED B4 39 29 68 AC AE EA 2B 0F 28 89 A8 0D 78 B3 06 48 B4 61 2E 6D F2 31 1C BF 0F C5 0B 7C AA F8 1E 3E 53 1A 82 1B 2A 07 2D 2F D2 A9 BF 12 17 0E A4 8E E2 03 9A 61 EC 4D C1 67 1B DF 2B 28 17 78 6B F9 81 D0 4F 8C CA 77 71 F0 88 08 CC 38 E0 48 56 FA 22 71 6B 10 F1 75 78 6C D6 B2 E2 AF F3 B6 38 F4 C4 11 E3 C0 85 12 32 DB 04 FD CB F6 64 8E BA C7 16 9F B7 FC 75 C9 D8 AF 98 13 3F 8D AA 18 E2 6B CA 98 39 77 CE 3B 32 21 06 05 0F F5 75 C7 07 B8 80 8C 8A 51 DD 02 75 8A BF 52 B1 DD 51 01 56 2D 5B 93 BB 24 61 FF E9 DC E0 6E 52 E2 B2 7E 84 88 DD B0 06 F2 78 34 60 F4 35 CD F3 CB 6D 13 71 A9 1F 65 49 7D E6 E9 B8 1D 63 06 4A F1 E5 AB 31 BE 29 0B 80 A5 30 DE 6B 09 4F 50 42 72 6B F8 AA 46 CD 46 52 B9 CB 71 F8 9C DD 25 CA 68 2E 6C 9E 25 02 3C 06 FA 53 8C A4 F3 DB C7 73 8F 35 C0 C0 91 2C 9C B1 6F 43 C8 CF FB 97 98 1C 00 32 F0 C7 45 97 4F 62 03 39 D7 CB E4 C5 9A DE A6 30 F9 2D 6E 69 90 53 2F 42 7E 79 5D 4D 2F 6B B1 8F C3 57 98 B4 94 8C AF 7E 28 64 D8 1A DA BF 22 C1 AB 59 AA CD 40 64 54 BA F9 FF F5 FF C8 8A 35 BD E9 66 72 51 3C 1A 29 7B A6 E1 6B A1 B7 80 53 92 37 3F CB A9 A2 F3 FD DA 7D 16 5B 57 56 0A DA A5 70 69 36 59 19 66 30 B6 51 9E E9 01 2B 76 BF 73 FD BE 80 70 85 BE 5F DE B9 ED C9 3E 57 43 96 11 3A 80 ED 04 FC A4 F5 72 AE 01 EB 82 79 A4 DC 9F 90 2B D5 CD 20 62 23 C9 8D A8 FC 6F 80 ED AD 25 25 4B 83 1B 17 6C FC B7 B8 3C 74 F6 3D 12 79 EC 6C 69 E2 08 B3 DD 8B 30 D2 79 AC A6 23 88 20 E7 94 D7 AF ED 9D E0 63 B8 F9 B8 8A C2 94 D0 8E 65 0C E9 B6 17 F6 90 48 21 BF C7 BE 17 75 83 A9 0A 88 AA 45 0F A2 E3 5F 66 19 AA 39 CF 29 63 2D B1 66 D5 63 61 E1 7D 58 45 C7 1E 43 B7 B2 EA 63 EA DE 16 37 7F DF C5 D5 1A B1 F3 1C C7 8D 9C 1F 31 D0 81 6C 78 A2 5A 8A 68 BA 87 07 0B 73 2D 9F 31 5E 45 4D CA 73 8C 23 70 B5 01 97 65 CA AD B6 B4 E8 22 6E 83 43 94 87 DA FB A9 3E A9 41 E3 B7 FC B9 02 9F 84 6C A2 D7 02 15 3A C8 5B 91 BB 8C B2 96 A2 96 62 EA 26 17 AF 46 3D C7 19 58 8C FB 7A 4E 2E 68 D1 65 AC F0 8E A0 47 73 76 66 1A A1 D5 37 79 31 FB BF B2 67 3C 01 F7 57 3D 2C 82 01 DE 8F 82 81 0F C4 56 F6 33 D0 0C A6 28 1F 8E 99 1A 75 97 92 27 D2 CE DF 74 00 C9 D3 02 2C A7 52 78 51 8F AA 2C DC 49 21 EC 58 C2 B1 EF 1D 30 5A DD 4C 5D D6 55 72 F8 93 4F 5F D6 10 B3 C9 DD 0D BA 0C AB C9 3D 46 D4 89 B7 FA 5E 67 6E 6A 4E D2 A5 88 4D 17 91 25 B9 DB CE 16 A0 D8 89 3F CA 9D B1 6D BD E2 39 27 CF 57 11 A9 91 7F 5F A9 9D AB 13 36 65 CA 56 48 BC B6 1E C2 B0 EE 01 39 44 F6 19 E8 D1 4B 77 D1 8B 48 9E EB DC A6 A5 73 28 B4 0F 2C 3B 25 62 EE EB E8 D6 7A A2 9C 98 84 BE 2F C8 12 99 EB 03 D2 57 F1 CB D2 6E CA B2 C9 BA 1C 84 3C DF E2 66 BF FE 68 FE 6D 2A 62 1F B0 83 19 D4 D8 C7 8E F4 D3 23 22 59 3F B7 F8 D3 1B 8B 19 B6 CE 0D 6F 0F 23 BB 67 76 43 E3 85 EA 4F 79 0C F9 C6 02 7D 86 35 E9 5C 3E C8 AB 6D 45 CB F8 6D 7F 2E 90 D4 CD 66 04 DA D3 A7 AE C9 5A 9C D4 62 1E 86 68 B6 D2 35 59 04 4C 31 85 28 DE 23 58 56 1C C5 18 E8 F2 DB 29 17 05 B5 F2 8B 55 F0 D4 FF B1 9C 0B 67 4C 84 EA 39 44 F0 B3 F2 DA C4 A4 42 4E D6 34 B3 C9 30 61 AA 25 2B 1C F0 59 AC E6 BD 18 22 52 F7 8B 21 B4 41 6F F9 31 7B 04 AE 61 E9 6E BD 96 51 9F C1 7C 5E 76 12 B6 15 54 D4 07 AA FD A3 79 91 34 C8 AF 4D 3E E7 13 54 27 5C 76 9E 20 0D B6 FA 41 8C C1 C7 F3 FA CB BD EE E3 5A 09 E7 92 25 25 D3 CD 8B F9 05 67 89 82 FD 35 0C 19 E2 EF AB 67 7C B7 E4 65 D3 07 FA 45 BA 28 95 32 B0 5B C1 DB 52 8C 37 A6 16 82 A5 55 79 6E 61 AB E0 07 71 D9 E9 08 4D F6 E5 22 64 05 52 22 76 C7 C4 AD 73 2A 47 FD 2D 0A D1 31 2F 71 C8 70 21 D6 E6 C0 7C EB 88 F5 3A 02 EA 38 29 57 A4 0F F9 CD A8 15 A0 72 98 BB 3F B4 83 96 EE 4A 1E 09 89 4F ED 5D 32 32 67 72 0A 36 96 52 E1 25 DF 77 77 7C 75 C0 63 FE 5C 4A 4F B1 8E A9 50 1E F6 4D 82 89 4C E9 91 7B C2 D4 3F 10 EA 1A BC DA 18 95 CC EB A1 8D 1D D0 50 1F 63 04 5F 0D 21 E3 E1 C8 15 FF 7B 58 01 CF 57 A1 CB 02 E4 B0 87 42 72 1F 17 2B C7 56 FC 4D 04 BC C6 D1 C7 F1 C5 2B EA 83 91 5A F2 BF 30 35 45 A5 5F F3 E6 01 E9 0A E8 48 CC 2A EF BD 68 80 30 0F BD 98 6A 78 DA 99 2A D8 5F B7 5D A1 DA A3 97 DF 86 E9 FE 1D BD 31 4A FB F2 7C BB 03 BF 73 D7 72 E7 F5 1E C3 D0 EB 33 B5 00 00 F1 A6 32 24 53 94 E0 FE 98 B4 68 91 62 3E 63 34 A4 A8 49 E0 C5 CC 94 03 CC 05 3F D5 DA 65 45 3B 89 5A 0A 02 3F 9A 4E C8 95 5A 41 E8 F9 51 AE 22 04 DE 5F FF B5 71 B2 DD 29 C0 98 B3 E7 57 71 06 F4 0D 39 C9 00 E5 A1 A9 50 33 03 94 C8 FD DF DC 48 E6 CC AD 17 8B 47 5F 44 03 73 B9 50 F2 BE 32 CE 82 3F 39 B2 C7 AE B5 24 F2 64 46 05 57 F2 6A 82 21 1B 15 4B 31 DF F4 67 65 C4 78 AE 98 E2 36 3F 21 E2 8A 76 3C B4 7B D9 CF E4 BD AC 59 B8 2D 7F 8B B0 4D 94 D6 53 90 96 1B 35 9D 61 21 46 12 E9 5E EE 70 9C B4 3C F5 F0 04 C5 4A FD FE 78 CF 75 20 E3 F8 4E F0 6F 35 85 31 EB 1D 84 F4 9D 60 EC AF 1D 4F 38 AE 64 8E E9 78 B6 0C 6C 81 B8 C8 33 24 5D 0D 9F 84 3B 7C 18 C6 9F A2 42 FD 62 85 87 79 11 9C 11 5B F3 32 B8 DC DE 8B 66 BA 55 F4 17 55 94 E1 AD 23 01 AF 04 EC 66 A9 BB 71 B2 0F FA D3 42 FB E5 E9 68 91 42 E4 4C 6D DA 4B D5 92 9C CF 37 D5 C2 B4 9B EF 50 3B 1B C2 29 10 11 23 B2 17 72 EF 93 92 77 02 4C EF 39 49 8C 44 C7 FC 3E 6B 7C 01 C7 CD D4 A2 47 E7 58 D3 AD 00 D5 60 31 A5 C7 F8 ED 6D D3 F9 44 EF 95 CB 8A 98 C9 F1 29 FD DF B7 5B 2E 6E 4E B6 8C C6 66 8A E9 70 66 23 C5 82 01 CF 12 F0 27 FA 05 32 CB 3D A0 87 24 6E 90 7C A3 E3 E6 CB 92 0F DB 31 96 D4 04 DB B9 7A 66 76 34 E6 75 80 E2 31 D9 2D 09 74 06 F3 EC 39 F6 2C 35 6B 68 29 FB 46 DD AB 51 4A 4E C7 C0 5B 40 A4 34 5E D0 CC 1E 00 3C 64 EF 51 73 F0 77 19 56 61 33 97 CD 5B 1D 3F AE 80 F8 56 02 1B BE 38 D5 B3 4A B0 E4 76 B9 1F A9 A5 30 4B 6F 38 28 04 29 93 03 94 AC FD BB D4 EB DC 43 3E 52 01 97 14 2B AC F7 B8 7B BD C0 5C B4 0F ED 6B EC 2D 70 0D 94 0A F5 51 12 50 6F F3 65 D9 7C F7 B7 E9 F7 A0 08 98 1D A0 53 C0 4F 37 42 A6 62 47 72 D3 B6 40 89 36 C1 E3 D7 70 4B 8B B2 A3 DF 87 0D 46 89 79 C4 6B D7 33 CA A7 1C AE 29 01 0B E5 79 53 E1 49 C7 C1 0B 81 A2 69 0D E5 F8 73 C3 79 5B C0 4A DC 43 41 EE 5A 56 27 AB 85 B7 0F 08 F3 2F 1B 36 1B CC 83 4B EF BB 3D EE 21 33 ED F1 76 15 55 CF 48 E8 26 48 1D 71 16 19 55 E3 50 94 AD 21 79 09 37 39 81 FE F5 62 11 76 D5 4C 69 E4 CC 72 26 29 28 E0 61 60 0C 95 92 8D 68 3C D7 49 0E 26 A8 E5 AA 1A B3 7A F0 D4 40 AC 85 D2 6F 35 57 A0 2F B2 6B D4 8D EE 04 29 0E 3D 7B 9F EB EB B5 92 94 FB 0F 6E 06 FE D0 81 45 85 6B F5 2F 80 6C 83 86 7E E6 B7 76 8D A5 F7 D6 B5 78 74 22 A3 B6 2E DC 67 0D F9 0C EB 18 14 4D 37 F5 49 C2 34 DF 7E 76 79 D7 E0 0A 52 CC B7 7D 42 68 81 C5 E4 B3 AE 86 21 77 64 66 47 77 C0 FE 81 F4 AE FD 18 14 C2 F6 6B 1F 28 82 3F 5C B8 E6 F8 F9 93 34 3D 2F D5 F9 FF 88 58 29 57 46 0D 3E FA FE B5 42 9D 23 57 38 09 BF B2 AE B2 9A B4 4C 2E 1E AD 93 B1 1E AF AE E4 6E 28 88 DC 1C C2 10 5C 6A 79 99 97 97 41 48 6E 8D 0F FB 88 D6 CD 76 34 E8 08 00 A0 92 94 EB AC 8B 47 66 DC 02 E2 EA C4 E6 A8 33 0D 97 8C 27 5E 19 D2 C6 4C 48 D3 16 2B 29 A7 19 21 44 97 45 F9 E0 BC 7C F5 5C DE E5 69 89 AD E2 BB B2 79 1B B4 31 83 3A 05 D5 94 34 DE 36 4B 75 0A 2D AE 8A 37 78 24 28 EF B4 10 30 70 2F C2 77 18 10 70 50 3D 90 B2 30 F5 80 76 84 AC 38 E4 A9 C3 00 0B 71 A8 D6 CA 83 F9 AB 86 43 44 26 9C 55 9D BD FA 36 76 67 87 A3 99 6E 49 6A AC B4 CA 56 ED AB 9C 2B FD 92 BF F2 41 4A FD 0C BF 5F B6 9E 66 49 FA AC 54 4A AE C3 3C 1B E4 04 D5 07 03 BC 57 EC BA 53 CE BF 66 5A B7 A6 DE 87 05 1F 6F 9D C4 7A F1 40 18 CB F7 87 8E 03 52 2F 87 B5 8E B8 20 56 BD 48 53 EB 3D F2 AB F7 D1 4A DD 5E D7 32 5E 58 EF 12 F4 EF 6B C7 D1 58 AC 2C B0 7C D3 CA 03 2E 2A A8 D9 9B B3 1F 4F A8 DC B3 74 15 B6 1E 71 DD 8E 09 F2 F0 79 E3 17 97 A2 09 C6 5D 61 7B 10 8F E8 2F 95 DD D7 9A 5B 91 BD B0 76 CE 8F 11 E8 D0 7E D9 2D 17 B9 08 DC 93 89 C6 CE 92 A4 8B 83 35 E4 C1 E8 F6 EE 4D DB 20 7B 15 DC 20 E0 4E 50 FC 54 89 E0 60 E3 BD 11 4B B7 AA 16 A7 55 68 5A 60 61 C3 08 A4 6A 3A CC 74 65 42 C0 22 88 97 C4 B2 03 B8 5B 4A CA A8 7A A1 34 E0 7C BE DA 2E B4 28 4A 6C FE 35 EB 35 16 C4 E4 73 9D CA 0A 83 58 BB 5F D9 6A 63 6B AF 2B 96 28 19 FE 25 91 01 1B 31 58 CD 54 E5 97 22 06 D2 6D 7D 5B 31 61 37 91 B3 A8 05 D7 57 71 D7 00 15 A6 3F 9C 3D 9F E9 DB 65 61 44 5B 8C 7F 2D 05 1F 88 C7 2F B3 D5 78 47 D3 E7 5E C5 8F 3F E4 F8 C7 F7 C1 72 14 56 E1 AE AA 94 33 47 F8 D3 D3 0D 1F 20 5A C2 88 FC 86 CC F6 F7 22 A6 3D 71 05 83 79 0C 66 D6 98 A1 1B D2 88 98 69 E3 7E 64 1B 5F AA D6 81 25 27 67 ED 8D 48 03 5F 80 5C BE 89 91 30 D0 C2 22 87 E9 1E 63 77 E9 A0 6B D2 7E 77 8C 0E 68 58 99 63 74 87 73 16 1D FC 1D 21 4C 53 A8 B3 74 96 D3 E6 70 2B 1E F6 F1 FA 7F A0 09 C8 AB A5 D1 1D FA 7D 9D 89 E0 C4 F2 9D F8 92 73 AD 5E 8E B6 C6 9F DB 23 62 86 F8 69 96 FF E2 CD 49 31 84 E9 9A 48 75 3A 80 A5 7A 6E D9 B2 8A AA C9 90 1B C9 EF A9 31 C9 DC 2E 6E B1 CD 4C 49 A3 CF 90 D7 6F 91 5C 8A 41 F2 2D 14 CC 81 22 A7 67 AC 50 51 03 0C 48 0D C2 14 F2 25 5F AA 48 E1 0A 37 24 22 39 9D BA 6B BA 46 A1 AC B6 DC 72 50 59 16 AE 43 C3 26 ED E9 2A DA 89 89 88 54 D2 7D 06 84 3C 78 14 C2 05 F0 00 5E 2A 03 83 82 71 92 0A 17 C0 19 D6 8A A3 4E 75 1F E5 97 62 99 9D AA E5 38 68 39 33 70 5E A5 29 F6 86 3B 81 4D 74 4E 6C 9F D1 70 CA A6 46 40 5D DE AE 78 31 56 6C F8 10 05 B8 32 B1 B9 72 DE FB B7 80 58 BE 36 57 B6 3A 33 34 AB 61 B5 D4 65 EB 35 5C 04 58 50 24 E4 2F 67 72 5F EE 76 14 28 30 CE D8 CF 98 AF A0 5F BB 9F C5 72 E8 F7 15 5F 2F 96 35 74 BD 49 FC 9E C3 41 86 BA 3D 48 BD 99 EF 8D 2D D8 C4 37 D0 EB 2B 14 72 36 B0 55 B6 E6 A2 CA DC C2 8D C6 4A EA E2 70 A9 74 9A E7 64 79 38 50 20 67 DB 5F AB 27 78 80 A6 2F 06 4C D1 26 88 75 2D 3B 24 07 9D E9 BD 98 5C 1F 16 E9 B5 EA C4 6E F5 D7 98 27 B6 98 65 BB F8 B6 52 A5 C2 16 1B 9C 71 8A EF 0E 1F 19 F8 24 7F 5B 22 47 62 21 91 FD 22 B1 2D 0E EA 5C B4 D9 57 27 35 85 25 78 97 85 8F 91 DB A7 64 05 BE A1 96 A7 E5 9B 48 8C A1 22 F4 FC 43 14 E6 11 19 3A 20 AB 08 D9 CB FE A8 0F 48 D3 CB DF 04 34 6D B7 9C D1 ED 4E B7 DC 3C 8E ED 4C E3 16 51 6C 55 96 C7 DC 20 4A 9A 0C A0 8A 4E 58 7E CE 00 E7 5B 0C EA A9 F2 6E AE 9C 03 9A 6A 3F 7D B0 57 20 50 AA 86 4A 1E 4E 23 3F 59 10 1B A2 2B E5 27 17 F6 CA 23 AA 4C E2 AA 11 51 8F 8D 51 2F 91 AF EA 3C F3 B2 24 43 A4 A0 BF 2A CA C8 EF 57 2E 26 67 C7 EA C0 1C 62 C9 D1 11 06 14 00 F1 19 FF DE 95 06 02 E3 07 4B AF 80 69 9D 9A 3D A9 6F 8A FF 97 A4 07 04 0C DE C1 10 21 2A 89 63 A5 66 9B FA F9 08 51 C5 6A E1 C2 26 C1 A8 F6 30 A6 35 D1 34 3E 3E 44 46 DB 83 59 9F 91 3C 06 19 B7 91 3E EA D1 73 07 5C 32 C3 01 52 65 03 26 1C A4 41 6F BC 8B A7 BE E9 60 D9 8C 4C 24 4F DE 30 DD F5 AB B3 16 3E 82 AC D4 4A 44 ED 24 E7 4B 3F 98 B2 9E 6C 48 1B 34 10 BA 08 A3 9D 3B F2 2D 9B 47 11 4E 04 AA 21 A7 D7 3B 4A 90 F9 83 23 1C 0A 73 84 B1 59 AB 76 0B 92 3A 54 8A 7D 0D 92 5E 76 A3 5E F3 02 B7 85 9D 8E 40 FB 77 B7 C0 4A 6F 2C C7 B0 84 81 CA 35 54 5A 2D 6C 4D 60 6E B1 10 0F 03 C9 08 3A 5F 95 75 61 92 0B 93 06 85 C4 E6 FD 04 9C 30 C8 BE E1 8D 88 67 B0 0B FA 4F 84 32 F0 5E AA 57 80 E6 DB 2E 4D 3D 76 7E 9D BF 1C E2 8D 98 7D EB 1C 7F 1A E2 11 17 B6 BF 6A 32 53 7C 84 57 69 3C 04 F8 80 2B 57 74 3A 9D DD 82 1F 10 09 8F E3 EA B3 93 43 56 FC 8C 24 C0 C3 5F 92 86 5C 62 F6 2D E0 6E AC 6E D8 88 4A A3 83 51 A2 F5 E8 FB 6E 8D 22 DE 67 28 71 41 6C 2B A4 E4 4C 47 7E C2 5D 04 C3 5F 54 93 56 DC 20 BE 1C C0 F4 47 71 C2 23 66 91 43 04 B0 8E 6B 5C 3A EF A2 D0 19 E3 E7 4B 5D 2F 47 24 F7 1F 47 CD 65 48 CF 3F CC 4D ED 19 3D 9A 2F 57 FD 8C CC D9 47 86 88 50 43 F4 72 1F FE A6 27 7A AF 2E C4 6B 61 43 2C 3B D4 88 1B 6D 9C D8 39 83 62 56 27 49 5D 69  [binary data over 200 bytes]

O6 - HKLMSOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorer: 301548880 = 50 4B 03 04 AF 7C B8 A0 50 45 F9 11 4D 07 00 00 00 30 00 00 3B 52 04 7F 42 E5 F1 3F FC 79 C5 20 65 C1 BE 89 B5 0C D7 B4 76 AF 60 28 9B FB D9 84 D1 41 10 F2 D0 12 70 B1 6F C2 70 6B 1E DA 5D 73 99 3A 9F 91 60 03 04 1E 5B 35 D2 96 12 68 57 F9 E7 25 1C 73 D3 EF C0 97 01 D8 D7 AD C4 61 08 18 40 4E 80 E3 42 F2 84 FC C6 2E F1 28 63 7F C2 E8 C4 BC A5 10 47 A1 E7 D4 57 1A 1B 18 39 8F 5F 6B 8E 44 D0 35 A4 CC C9 A9 0C 3B B2 91 8F 07 63 32 60 A7 77 0E 04 27 50 5D 9C D9 DA 45 AB CE 52 68 0F 80 22 7A B6 A4 A6 FE EC 46 B2 85 64 B3 27 06 80 08 C1 41 4A 62 D6 14 AB 6A DE AF 53 8D 4A 6E 4C 44 57 E5 80 BD A0 94 36 17 69 D3 10 91 63 57 92 AD BB AC 24 64 15 4A B1 99 2C 3A 4D 3F 40 0B 30 D0 4F 9F 52 95 4A 90 9B 6F FF DB 1E D0 0C 4B 77 08 85 9B E4 B7 69 E4 52 68 B4 A2 9F D7 F8 5D 0E B3 DE 75 20 E0 48 F9 63 6B 46 9B 3C 05 C2 59 4F 20 45 3E E2 6E BA 7F 2E 3E 00 74 DB 8B 2B A7 6D 8A 4D 85 75 BE 24 C6 5E E0 67 EC C4 92 13 05 58 5A E8 11 00 62 C5 6A 16 90 70 C3 3A E4 AC 31 81 02 B9 10 A1 BC 96 C2 B4 79 BE D0 46 D1 2D CD 65 C7 B8 B4 92 31 F9 58 8A 25 B9 7E F6 39 7A 8A 68 3D 88 DD D5 F6 E8 64 8A 74 07 EB DE E6 5A 3F 92 DC AA 58 0C 74 B6 98 32 9A E3 56 1E E6 6B 01 63 17 96 33 62 20 2B 91 52 D8 80 D5 93 BC 76 0D E1 40 BF 53 F2 83 00 0B B3 D0 36 B7 86 13 B6 83 11 AF 34 D0 79 16 FE 46 20 2F 89 6D 4C 01 53 87 3C 18 20 E1 10 BA 15 5E 39 45 93 0E 95 74 3A F6 50 93 50 78 D9 B6 AB 2C 28 92 60 33 0D BC 50 C9 9E 87 89 CA 6B 50 B6 70 76 88 79 8A 9F 81 A2 CE F8 B4 0F 96 F8 FD 9E 01 C0 07 74 81 5B 4D F8 CA 23 59 35 79 3F EB 99 D1 3B D3 AA E3 FE B2 43 45 40 B7 40 36 75 33 DC 9C 8E 2A 66 4A 52 0A CF BC 0A 7E DA 4B B5 D9 76 63 F0 A0 88 CE 0A B0 55 87 CA 95 91 1B D5 CF 90 B2 E4 B4 DF A0 DE B8 CE 53 F2 31 BE B5 00 C1 77 8C 0F 6F C8 6E 11 D9 23 FE 1C 8A 79 8E CD A6 D9 62 8A 23 E8 1E 3B 33 97 E9 4B 54 AB A0 69 EB E7 6B E1 B4 7D FF E1 A6 C7 F3 C0 71 59 50 2C 95 52 19 1D 5B DD 6C A7 6B F6 A1 B1 98 51 6A BD 7E A5 7C 39 C6 06 F0 E5 8B EC 5E 2C 60 E5 D4 46 48 B3 46 7E 52 DE 69 10 41 30 D3 95 43 04 8D E5 0A 97 38 ED A2 A1 20 25 CD AC 3B FC 02 57 87 97 90 77 96 1B 95 8A 7E 12 54 CD A2 C2 4A 4E F2 9A 72 71 9C D8 FF 74 07 AF 8A 8D 21 47 C2 00 0A D3 BA F6 C0 B4 0D 69 9D BF A4 23 0E A2 2E DF B5 63 1A E4 A5 C5 8E A9 CB 86 E5 A8 73 FF 7A F2 2D 79 0B 35 46 63 05 6D FF 36 F8 B0 4E 17 85 8C EA EC 8E DD 8E DD C4 A6 73 3D B3 E3 3E 3D D9 9F 87 69 EA FA 44 29 A2 CF 28 C6 7C 71 C9 3B BB FE 4D 2F AD A1 71 03 43 B4 CF B8 C1 37 6F AE 0B 06 04 77 57 F7 04 AE DF AA 25 CE 0D F9 E0 F8 CB 3D 63 75 E9 C5 93 F3 43 A3 B5 FE 3B 04 25 EA 94 7A 5B B3 7C 40 6B 3A 7C 57 AF FC 94 4C 00 8A D8 D5 AE 59 AC 8B 5D A2 82 39 6C CE E7 CF 52 6A CE 85 FF D8 F8 9E E7 66 33 E4 9D 36 62 F4 1D F7 9F 28 6E 8D 39 9A DF 02 A5 98 FC A2 EA 32 25 FF C4 F4 12 E3 0C 73 8E 07 FD CE FD 08 88 7B C8 65 8B 6A E2 EC 88 20 F4 B4 81 37 40 42 22 9D A9 97 8A 25 1D 7B 74 97 61 99 89 FA 2A 86 52 E6 80 AF 13 CD 32 FD FF A5 DF 97 CC 3A C9 79 B0 34 92 14 88 C9 83 5F DB C7 08 F5 A8 B4 07 98 0F 49 53 D2 7F EF 86 B4 FC 33 1B 43 08 A2 40 4E 06 4F 84 EE D4 09 2C E9 97 87 88 CE 0C 46 F0 75 60 A8 12 3D F5 47 1C DA 1C 34 AB E8 53 87 51 5D 27 A7 AC 43 EB AB 84 DE BD D2 99 14 A7 DB D8 48 76 73 2E E9 D3 65 90 CB 26 37 B6 D0 09 C7 A3 8E AE 49 7D 8D AF FD AA 60 BF C8 A4 0D 8D 17 53 D5 9E C9 E8 43 51 1B 2A 1E B9 90 7D D2 E3 7D 12 C6 FB CE 80 73 8A 27 A8 BC C4 2A CB 11 50 C1 3C 6B AB 24 70 E3 98 19 FE 10 55 31 D9 FF 21 67 83 E9 56 B0 EC E4 8D A8 DA D1 98 56 D2 A9 55 78 A2 35 07 78 AE B0 A2 BA 7C 18 0A D0 37 25 56 7A 5B 9C 21 AE CA FE D7 9C B6 10 F9 2A 59 6A A4 57 0C 4A 9A 25 EE A1 95 5A 66 95 B2 A3 92 8F C8 F0 B5 8D BC 93 A8 58 08 DD CE 0C FF CB 7E 4B 20 C7 88 06 B5 17 4D DA 44 DF 16 99 DE 57 D7 66 12 0C 93 ED 41 F4 D3 1C 18 71 0B 6C 10 7B 84 6F EF E4 E9 5A 56 0A 6B CC 2C C6 DA C0 4F C1 51 AD 17 51 B4 27 8A 54 D0 C2 67 1F 40 9C 85 75 67 2B 78 B5 E3 EA 28 A4 D2 08 64 52 BD 64 3D 83 1F B6 85 75 60 5C CD 69 35 EB 9E B2 88 6D 19 7B 64 6A B3 D2 A0 42 1D B1 2F A5 9E 5B 48 56 9E 59 9B 02 75 E3 99 A9 0D 90 CB 5C F6 EA B9 15 BA 8C A1 39 A4 F6 95 5E B0 A9 86 CB BD 2C 5F 1E B9 D2 2A 05 7A DB E7 29 16 EE 28 2B AD 46 CC E6 42 A1 CD 18 AF 9B F4 2A 6F 4D C3 D1 75 A7 8D DE D1 67 04 47 A9 9A B7 FF 4D 11 16 5E BB 9F C0 B4 B4 38 A1 D9 D7 93 B2 66 F3 35 6F 29 B7 D9 D8 82 E4 09 7A 09 69 54 01 27 F5 5D 8B 89 18 24 5B BF CA 9D C8 29 0D 14 F4 EC A4 92 1B 39 7F A4 E6 A1 61 55 72 3D D2 51 85 45 70 64 A4 D1 3C CB 64 06 0A 06 34 86 51 D2 E1 99 DE B7 C1 DC 31 E7 71 8F 5A 6A 65 8D B3 0C 80 7A DF 41 6E 73 1F 1B CC 5B 0D 59 B4 B8 1A 09 AE CC 83 A3 32 F5 93 24 63 DE 6D CC 5D E2 7F F0 81 00 DF 6E FB 3F 8C AD E4 3C 72 B6 44 99 4B 30 A4 85 BB EF D0 0E 23 43 4F CF 55 C5 4D 95 2E 59 9F E5 6A 40 83 61 BA F9 1D A4 B4 67 1F 26 90 63 5B AF 56 16 9A 48 AB A1 14 10 36 1D B9 20 FB 97 AF EF D9 4D 03 5A 16 1A 6D 8A F2 F2 E3 12 4C 09 14 88 3B 81 A5 D3 1B EA 60 B6 E7 F8 A0 D2 83 47 87 68 7B BB 05 98 77 A2 57 D2 1A 0A 3B 44 8D 29 12 29 51 2D EB 08 89 2C 54 15 67 E0 C3 3B 69 32 C3 D1 B4 C9 D5 7D C4 C7 6F FF 23 D2 24 08 2B D9 8E 40 60 A2 8F 72 A6 D8 9E A7 19 7A 08 CD 98 5C 28 92 BD 87 AF 5D ED 9B DE 90 75 91 BA 9A 51 43 A7 A7 E0 D2 C3 43 22 C7 0B 74 62 3A 66 B7 05 DD C5 13 0B 80 38 0B B1 2C 3E C6 10 6F 3D 0C B7 05 60 84 7B EE 21 15 12 57 8A 56 FE B5 DD F0 9E 01 CA 45 C1 AC 19 E6 C5 8C 1D 87 CA DB D5 73 C0 E8 ED D8 33 A5 1D 17 07 CC 03 01 1F D5 50 3C A2 E3 4E DE 0B 9D DE DF 94 E5 AC E1 67 81 1C C3 C6 6C 52 F9 AB 70 DB 1C 8B 71 97 BA A7 F4 95 39 15 7D 41 7D F2 DC 37 73 DF 37 05 73 D5 8C C5 D7 91 06 C7 2F B4 15 4B C1 9E 2E A5 BC 40 74 B2 8F 99 23 7B 99 D0 8C 1C 2A F8 09 86 69 62 D8 A8 14 86 A9 D9 13 5D 70 E4 0F FC 2A CF BE B7 D5 C6 44 35 9C BC 56 63 6F 78 12 F4 A3 92 0C 9B BF FE C4 97 CC D5 F4 D7 DD B1 DA C1 FF 2A 8C 9D 42 AC FC FC 80 C4 9F AE 67 9C D7  [binary data over 200 bytes]

O6 - HKLMSOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorerRun: 50 4 = Reg Error: Value error. File not found

O32 - AutoRun File - [2008/04/14 05:41:58 | 000,059,322 | RHS- | M] () - I:autorun.inf -- [ FAT32 ]

O33 - MountPoints2{9cda5398-f9d7-11e2-ba7b-dc70a05e6965}Shell - "" = AutoRun

O33 - MountPoints2{9cda5398-f9d7-11e2-ba7b-dc70a05e6965}ShellAutoRuncommand - "" = C:WINDOWSsystem32RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RuNdLl32.EXE   .RECYCLERS-5-3-42-2819952290-8240758988-879315005-3665jwgkvsq.vmx,ahaezedrn

NetSvcs: apxgtyroo - C:WINDOWSsystem32vcdobhwn.dll ()

[2013/07/31 18:20:16 | 000,000,000 | RHS- | C] () -- C:Documents and SettingsAll UsersDocumentskhq

[2013/07/31 18:20:14 | 000,596,053 | ---- | C] () -- C:Documents and SettingsAll UsersDocumentsgzyaaa.exe

[2013/07/31 17:02:09 | 000,130,560 | -HS- | M] (SomePDF.com) -- C:Documents and SettingsoliLocal Settingstemp1349780318.exe

[2013/07/31 16:17:36 | 002,394,184 | ---- | M] (Softonic) -- C:Documents and SettingsoliLocal SettingstempSoftonic_chr_1-8-19-3.exe

[2004/01/20 17:44:42 | 000,132,608 | ---- | M] (Microsoft Corp.) -- C:Documents and SettingsoliLocal SettingstempTFR50.exe

[2013/07/31 14:24:00 | 000,000,000 | -HSD | C] -- C:RECYCLER

:files

dir /s /a "C:Documents and SettingsAll UsersApplication DataSystem" /c

netsh winsock reset catalog /c

ipconfig /flushdns /c

:reg

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyStandardProfileGloballyOpenPortsList]

"1959:TCP"=-

:commands

[purity]

[resethosts]

[clearallrestorepoints]

[emptytemp]

[Reboot]

 

 

[*]След като въведете скрипта от цитата по-горе натиснете бутона, маркиран в червено: Run Fix

[*]Windows ще се рестартира и ще се създаде лог файл - OTL fix log. Публикувайте съдържанието му с Copy/Paste в следващия си коментар.

[*]Също така архивирайте папката C:_OTLMovedFiles => и я качете на този адрес => http://file.bg/ и публикувайте линк за теглене в следващия си пост (след това изтрийте архива, който създадохте, но не трийте самата папка...нея ще я изтрием накрая).

Поздрави!

Лог файлът, който ми се отвори имаше друго име - 07312013_193637, но предполагам това е, което трябваше да се получи.

 

 

All processes killed
========== OTL ==========
No active process named 1349780318.exe was found!
Service apxgtyroo stopped successfully!
Service apxgtyroo deleted successfully!
File move failed. C:WINDOWSsystem32vcdobhwn.dll scheduled to be moved on reboot.
Error: No service named mbr was found to stop!
Registry key HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesmbr deleted successfully.
File C:DOCUME~1oliLOCALS~1Tempmbr.sys not found.
Error: No service named apuelrih was found to stop!
Registry key HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesapuelrih deleted successfully.
Registry value HKEY_USERSS-1-5-21-329068152-682003330-1801674531-1003SoftwareMicrosoftWindowsCurrentVersionRun1349780318 deleted successfully.
C:Documents and SettingsAll UsersApplication DataSystem1349780318.exe moved successfully.
Registry value HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorer3212083974 deleted successfully.
Registry value HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorer301548880 deleted successfully.
Registry value HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorerRun50 4 not found.
I:autorun.inf moved successfully.
Registry key HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerMountPoints2{9cda5398-f9d7-11e2-ba7b-dc70a05e6965} deleted successfully.
Registry key HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{9cda5398-f9d7-11e2-ba7b-dc70a05e6965} not found.
Registry key HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerMountPoints2{9cda5398-f9d7-11e2-ba7b-dc70a05e6965} not found.
Registry key HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{9cda5398-f9d7-11e2-ba7b-dc70a05e6965} not found.
File C:WINDOWSsystem32RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RuNdLl32.EXE   .RECYCLERS-5-3-42-2819952290-8240758988-879315005-3665jwgkvsq.vmx,ahaezedrn not found.
apxgtyroo removed from NetSvcs value successfully!
File move failed. C:WINDOWSsystem32vcdobhwn.dll scheduled to be moved on reboot.
C:Documents and SettingsAll UsersDocumentskhq moved successfully.
C:Documents and SettingsAll UsersDocumentsgzyaaa.exe moved successfully.
C:Documents and SettingsoliLocal SettingsTemp1349780318.exe moved successfully.
C:Documents and SettingsoliLocal SettingsTempSoftonic_chr_1-8-19-3.exe moved successfully.
C:Documents and SettingsoliLocal SettingsTempTFR50.exe moved successfully.
C:RECYCLERS-1-5-21-329068152-682003330-1801674531-1003 folder moved successfully.
C:RECYCLER folder moved successfully.
========== FILES ==========
< dir /s /a "C:Documents and SettingsAll UsersApplication DataSystem" /c >
 Volume in drive C has no label.
 Volume Serial Number is B459-09AE
 Directory of C:Documents and SettingsAll UsersApplication DataSystem
07/31/2013  07:36 PM   <DIR>   .
07/31/2013  07:36 PM   <DIR>   ..
0 File(s)   0 bytes
Total Files Listed:
0 File(s)   0 bytes
2 Dir(s)  22,372,265,984 bytes free
C:Documents and SettingsoliDesktopcmd.bat deleted successfully.
C:Documents and SettingsoliDesktopcmd.txt deleted successfully.
< netsh winsock reset catalog /c >
Sucessfully reset the Winsock Catalog.
You must restart the machine in order to complete the reset.
C:Documents and SettingsoliDesktopcmd.bat deleted successfully.
C:Documents and SettingsoliDesktopcmd.txt deleted successfully.
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:Documents and SettingsoliDesktopcmd.bat deleted successfully.
C:Documents and SettingsoliDesktopcmd.txt deleted successfully.
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyStandardProfileGloballyOpenPortsList1959:TCP deleted successfully.
========== COMMANDS ==========
C:WINDOWSSystem32driversetcHosts moved successfully.
HOSTS file reset successfully
Restore point Set: OTL Restore Point
 
[EMPTYTEMP]
 
User: All Users
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33237 bytes
 
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 199285 bytes
 
User: oli
->Temp folder emptied: 485889360 bytes
->Temporary Internet Files folder emptied: 6656930 bytes
->FireFox cache emptied: 38477865 bytes
->Flash cache emptied: 1962 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 2402044 bytes
%systemroot%System32 .tmp files removed: 256577 bytes
%systemroot%System32dllcache .tmp files removed: 0 bytes
%systemroot%System32drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 36068 bytes
%systemroot%system32configsystemprofileLocal SettingsTemp folder emptied: 0 bytes
%systemroot%system32configsystemprofileLocal SettingsTemporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 509.00 mb
 
 
OTL by OldTimer - Version 3.2.69.0 log created on 07312013_193637

FilesFolders moved on Reboot...
C:WINDOWSsystem32vcdobhwn.dll moved successfully.
C:WINDOWStempPerflib_Perfdata_f50.dat moved successfully.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...
 

Редактирано 31 юли 201313 г. от B-boy[StyLe]
Премахнат опасен линк. :) (преглед на промените)

Да, това е файла. Справяте се блестящо!

Супер мисля, че премахнахме основния заподозрян - червея Conficker...сега малко по-превенцията:

 

 

СТЪПКА 1 - Спрете Autorun функцията.
 

Изтеглете и стартирайте следния файл
Стартирайте го и се съгласете с лицензионното споразумение.
Натиснете Next и изчакайте да си свърпи работата.
Рестартирайте системата ако се наложи.

Отворете и настройките на мрежовата карта и премахнете отметката пред File and Printer Sharing for Microsoft Networks, Client for Microsoft Networks (ако не използвате споделяне на файлове) и Qos Packet Scheduler и потвърдете с ОК.





СТЪПКА 2
 

Добре е да инсталирате всички актуализации за Windows. особено следните 3 кръпки: KB958687, KB957097, KB958644.

След инсталирането им рестартирайте компютъра.
 

 

СТЪПКА 3


Изтеглете и разархивирайте следния файл - KidoKiller на десктопа.
Копирайте файла kk.exe в C:
Отворете Start => Run => въведете CMD => натиснете Enter
В конзолата въведете командата:

cd c:

Натиснете Enter

След това въведете:

kk.exe -f -n -y -l report.txt

Натиснете Enter



Ще се генерира текст файл с името report.txt в C:

Копирайте съдържанието на лог файла в следващия си пост.



СТЪПКА 4

 

Изтеглете Security Check от screen317 от този линк или и го запаметете на вашия десктоп.

• [*]Кликнете два пъти върху

SecurityCheck.exe и следвайте инструкциите. [*]Накрая, автоматично ще се отвори текстов документ, наречен checkup.txt, моля поставете съдържанието му в следващия Ви коментар в тази тема. [*]Направете и нова проверка с DDS и прикачете двата файла които ще се създадат.

 

Поздрави!

Ето и резултатите:

 

report.txt

 

20:23:30:031 2076  ================================================================================
20:23:30:031 2076  SystemInfo:

20:23:30:031 2076  OS Version: 5.1.2600 ServicePack: 3.0
20:23:30:031 2076  Product type: Workstation
20:23:30:031 2076  ComputerName: INKA
20:23:30:031 2076  UserName: oli
20:23:30:031 2076  Windows directory: C:WINDOWS
20:23:30:031 2076  Processor architecture: Intel x86
20:23:30:031 2076  Number of processors: 1
20:23:30:031 2076  Page size: 0x1000
20:23:30:031 2076  Boot type: Normal boot
20:23:30:031 2076  ================================================================================
20:23:30:046 2076  scanning  jobs ...
20:23:30:062 2076  
20:23:30:062 2076  scanning  processes ...
20:23:31:078 2076  
20:23:31:078 2076  scanning  threads ...
20:23:44:265 2076  
20:23:44:265 2076  scanning  modules in svchost.exe...
20:23:44:453 2076  scanning  modules in services.exe...
20:23:44:453 2076  scanning  modules in explorer.exe...
20:23:44:468 2076  
20:23:44:468 2076  scanning  C:WINDOWSsystem32 ...
20:24:50:968 2076  scanning  C:Program FilesInternet Explorer ...
20:24:51:781 2076  scanning  C:Program FilesMovie Maker ...
20:24:52:250 2076  scanning  C:Program FilesWindows Media Player ...
20:24:52:828 2076  scanning  C:Program FilesWindows NT ...
20:24:53:593 2076  scanning  C:Documents and SettingsoliApplication Data ...
20:25:03:328 2076  scanning  C:DOCUME~1oliLOCALS~1Temp ...
20:25:03:453 2076  scanning  Flash drives ...
20:25:03:468 2076  scanning  C: ...
20:27:26:046 2076  C:_OTLMovedFiles07312013_193637C_WINDOWSsystem32vcdobhwn.dll  infected Net-Worm.Win32.Kido ... 20:27:26:484 2076    cured
20:27:26:500 2076  C:_OTLMovedFiles07312013_193637I_autorun.inf  infected Net-Worm.Win32.Kido ... 20:27:26:531 2076    cured
20:27:26:546 2076  scanning  D: ...
20:27:39:218 2076  
completed
20:27:39:234 2076  Infected jobs:      0
20:27:39:234 2076  Infected files:      2
20:27:39:234 2076  Infected threads:    0
20:27:39:234 2076  Spliced functions:    0
20:27:39:250 2076  Cured files:      2
20:27:39:250 2076  Fixed registry keys:    0
20:27:39:250 2076  

 

checkup.txt

 

 Results of screen317's Security Check version 0.99.71  
 Windows XP Service Pack 3 x86   
 Internet Explorer 7 Out of date!
``````````````Antivirus/Firewall Check:``````````````
 Windows Security Center service is not running! This report may not be accurate!
 Windows Firewall Enabled!  
Please wait while WMIC is being installed.
 WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````
 Adobe Flash Player  11.8.800.94  
 Mozilla Firefox (22.0)
````````Process Check: objlist.exe by Laurent````````  
`````````````````System Health check`````````````````
 Total Fragmentation on Drive C::  
````````````````````End of Log``````````````````````

dds.txt
 

DDS (Ver_2011-09-30.01) - NTFS_x86
Internet Explorer: 7.0.5730.13
Run by oli at 20:29:32 on 2013-07-31
Microsoft Windows XP Professional  5.1.2600.3.1251.359.1033.18.447.100 [GMT 3:00]
.
FW: ActiveArmor Firewall *Disabled*
.
============== Running Processes ================
.
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSExplorer.EXE
C:WINDOWSsystem32RUNDLL32.EXE
C:Program FilesNVIDIA CorporationNetworkAccessManagerApache GroupApache2binapache.exe
C:WINDOWSsystem32KaraokeSer.exe
C:Program FilesNVIDIA CorporationNetworkAccessManagerbinnSvcLog.exe
C:WINDOWSsystem32nvsvc32.exe
C:Program FilesPANDORA.TVPanServiceKMPService.exe
C:Documents and SettingsAll UsersApplication DataSkypeToolbarsSkype C2C Servicec2c_service.exe
C:Program FilesNVIDIA CorporationNetworkAccessManagerApache GroupApache2binapache.exe
C:Program FilesNVIDIA CorporationNetworkAccessManagerbinnSvcIp.exe
C:Program FilesMozilla Firefoxfirefox.exe
C:Program FilesPANDORA.TVPanServiceKMPProcess.exe
C:WINDOWSSystem32alg.exe
C:Program FilesVIAVIAudioiHDADeckHDeck.exe
C:WINDOWSsystem32ctfmon.exe
C:Documents and SettingsoliApplication DatauTorrentuTorrent.exe
C:Program FilesSkypePhoneSkype.exe
C:Program FilesMozilla Firefoxplugin-container.exe
C:Program FilesDAEMON Tools ProDTShellHlp.exe
C:WINDOWSsystem32wbemwmiprvse.exe
C:WINDOWSsystem32notepad.exe
C:WINDOWSsystem32NOTEPAD.EXE
C:WINDOWSSystem32svchost.exe -k netsvcs
C:WINDOWSsystem32svchost.exe -k NetworkService
C:WINDOWSsystem32svchost.exe -k LocalService
.
============== Pseudo HJT Report ===============
.
BHO: Skype Browser Helper: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - c:program filesskypetoolbarsinternet explorerskypeieplugin.dll
uRun: [CTFMON.EXE] c:windowssystem32ctfmon.exe
uRun: [uTorrent] "c:documents and settingsoliapplication datautorrentuTorrent.exe"  /MINIMIZED
uRun: [DAEMON Tools Pro Agent] "c:program filesdaemon tools proDTAgent.exe" -autorun
uRun: [skype] "c:program filesskypephoneSkype.exe" /minimized /regrun
mRun: [NvCplDaemon] RUNDLL32.EXE c:windowssystem32NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [NvMediaCenter] RUNDLL32.EXE c:windowssystem32NvMcTray.dll,NvTaskbarInit
mRun: [HDAudDeck] c:program filesviaviaudioihdadeckHDeck.exe 1
dRun: [CTFMON.EXE] c:windowssystem32CTFMON.EXE
uExplorerRun: [2478] c:docume~1alluse~1dxuuocid.exe
uPolicies-Explorer: NoDriveTypeAutoRun = dword:255
mPolicies-Explorer: NoDriveTypeAutoRun = dword:145
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:program filesskypetoolbarsinternet explorerskypeieplugin.dll
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%Network Diagnosticxpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:program filesmessengermsmsgs.exe
TCP: NameServer = 89.215.233.2 89.215.246.40
TCP: Interfaces{D98D2B2B-71D5-439D-BCB6-789C6E94BC7F} : DHCPNameServer = 89.215.233.2 89.215.246.40
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:program filesskypetoolbarsinternet explorerskypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:program filescommon filesskypeSkype4COM.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:windowssystem32WPDShServiceObj.dll
LSA: Authentication Packages =  msv1_0 nwprovau
.
================= FIREFOX ===================
.
FF - ProfilePath - c:documents and settingsoliapplication datamozillafirefoxprofilesdgl0r0s3.default
FF - plugin: c:windowssystem32macromedflashNPSWF32_11_8_800_94.dll
.
============= SERVICES / DRIVERS ===============
.
R2 KaraokeService;VIA Karaoke digital mixer Service;c:windowssystem32KaraokeSer.exe [2013-7-31 88696]
R2 PanService;PandoraService;c:program filespandora.tvpanserviceKMPService.exe [2013-7-31 1922600]
R2 Skype C2C Service;Skype C2C Service;c:documents and settingsall usersapplication dataskypetoolbarsskype c2c servicec2c_service.exe [2013-7-12 3289472]
R3 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:windowssystem32driversdtsoftbus01.sys [2013-7-31 242240]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:windowssystem32driversviahduaa.sys [2013-7-31 2558200]
S2 SkypeUpdate;Skype Updater;c:program filesskypeupdaterUpdater.exe [2013-7-25 162672]
S3 AMBFilt;AMBFilt;c:windowssystem32driversAmbfilt.sys [2013-7-31 1656960]
S3 MozillaMaintenance;Mozilla Maintenance Service;c:program filesmozilla maintenance servicemaintenanceservice.exe [2013-7-31 117144]
.
=============== Created Last 30 ================
.
2013-07-31 17:13:56  171344  ----a-w-  C:KK.exe
2013-07-31 17:08:05  455296  -c----w-  c:windowssystem32dllcachemrxsmb.sys
2013-07-31 16:36:37  --------  d-----w-  C:_OTL
2013-07-31 15:06:23  --------  d-----r-  c:program filesSkype
2013-07-31 14:52:13  --------  d-----w-  c:program filesAlcohol Soft
2013-07-31 14:22:34  466008  ----a-w-  c:windowssystem32driverssptd.sys
2013-07-31 14:17:59  242240  ----a-w-  c:windowssystem32driversdtsoftbus01.sys
2013-07-31 14:17:43  --------  d-----w-  c:documents and settingsoliapplication dataDAEMON Tools Pro
2013-07-31 14:17:35  --------  d-----w-  c:program filesDAEMON Tools Pro
2013-07-31 14:17:18  --------  d-----w-  c:documents and settingsall usersapplication dataDAEMON Tools Pro
2013-07-31 14:02:13  --------  d-----w-  c:documents and settingsall usersapplication dataSystem
.
==================== Find3M  ====================
.
2013-07-31 12:49:07  692104  ----a-w-  c:windowssystem32FlashPlayerApp.exe
2013-07-31 12:49:06  71048  ----a-w-  c:windowssystem32FlashPlayerCPLApp.cpl
2013-07-31 10:28:42  8992  ----a-w-  c:windowssystem32KBD_PHO.DLL
2013-07-31 10:28:42  5632  ----a-w-  c:windowssystem32KBD_BDS.DLL
.
============= FINISH: 20:29:50.54 ===============
 

attach.txt

 

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-09-30.01)
.
Microsoft Windows XP Professional
Boot Device: DeviceHarddiskVolume1
Install Date: 31.7.2013 г. 13:32:26
System Uptime: 31.7.2013 г. 20:09:50 (0 hours ago)
.
Motherboard: ASRock |  | N68-S
Processor: AMD Athlon Processor LE-1600 | CPUSocket | 2210/200mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 29 GiB total, 21,304 GiB free.
D: is FIXED (NTFS) - 157 GiB total, 151,286 GiB free.
E: is CDROM ()
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP4: 31.7.2013 г. 19:37:09 - Контролна точка на системата
RP5: 31.7.2013 г. 19:37:17 - OTL Restore Point - 7/31/2013 7:37:16 PM
RP6: 31.7.2013 г. 20:08:13 - Installed Windows XP KB957097.
RP7: 31.7.2013 г. 20:08:31 - Installed Windows XP KB958687.
RP8: 31.7.2013 г. 20:08:41 - Installed Windows XP KB958644.
.
==== Installed Programs ======================
.
µTorrent
Adobe Flash Player 11 Plugin
AIDA64 Extreme Edition v1.50
DAEMON Tools Pro
High Definition Audio Driver Package - KB835221
KMP Service
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft User-Mode Driver Framework Feature Pack 1.0
Mozilla Firefox 22.0 (x86 bg)
Mozilla Maintenance Service
NVIDIA Drivers
NVIDIA ForceWare Network Access Manager
Platform
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Skype Click to Call
Skype™ 6.7
The KMPlayer (remove only)
VIA п»ї
WebFldrs XP
Windows Internet Explorer 7
Windows Internet Explorer 7 Language Interface Pack (BGR)
Windows Media Format 11 runtime
Windows Media Player 11
WinRAR 5.00 Бета 7 (32-битова версия)
.
==== Event Viewer Messages From Past Week ========
.
31.7.2013 г. 20:10:25, error: DCOM [10005]  - DCOM got error "%1058" attempting to start the service BITS with arguments "" in order to run the server: {4991D34B-80A1-4291-83B6-3328366B9097}
31.7.2013 г. 20:05:16, error: DCOM [10005]  - DCOM got error "%1058" attempting to start the service BITS with arguments "" in order to run the server: {4991D34B-80A1-4291-83B6-3328366B9097}
31.7.2013 г. 19:42:24, error: Service Control Manager [7034]  - The Workstation service terminated unexpectedly.  It has done this 1 time(s).
31.7.2013 г. 19:42:24, error: Service Control Manager [7034]  - The Wireless Zero Configuration service terminated unexpectedly.  It has done this 1 time(s).
31.7.2013 г. 19:42:24, error: Service Control Manager [7034]  - The Windows Time service terminated unexpectedly.  It has done this 1 time(s).
31.7.2013 г. 19:42:24, error: Service Control Manager [7034]  - The Windows Firewall/Internet Connection Sharing (ICS) service terminated unexpectedly.  It has done this 1 time(s).
31.7.2013 г. 19:42:24, error: Service Control Manager [7034]  - The Windows Audio service terminated unexpectedly.  It has done this 1 time(s).
31.7.2013 г. 19:42:24, error: Service Control Manager [7034]  - The Telephony service terminated unexpectedly.  It has done this 1 time(s).
31.7.2013 г. 19:42:24, error: Service Control Manager [7034]  - The System Restore Service service terminated unexpectedly.  It has done this 1 time(s).
31.7.2013 г. 19:42:24, error: Service Control Manager [7034]  - The System Event Notification service terminated unexpectedly.  It has done this 1 time(s).
31.7.2013 г. 19:42:24, error: Service Control Manager [7034]  - The Shell Hardware Detection service terminated unexpectedly.  It has done this 1 time(s).
31.7.2013 г. 19:42:24, error: Service Control Manager [7034]  - The Server service terminated unexpectedly.  It has done this 1 time(s).
31.7.2013 г. 19:42:24, error: Service Control Manager [7034]  - The Secondary Logon service terminated unexpectedly.  It has done this 1 time(s).
31.7.2013 г. 19:42:24, error: Service Control Manager [7034]  - The SAP Agent service terminated unexpectedly.  It has done this 1 time(s).
31.7.2013 г. 19:42:24, error: Service Control Manager [7034]  - The Remote Access Connection Manager service terminated unexpectedly.  It has done this 1 time(s).
31.7.2013 г. 19:42:24, error: Service Control Manager [7034]  - The Network Location Awareness (NLA) service terminated unexpectedly.  It has done this 1 time(s).
31.7.2013 г. 19:42:24, error: Service Control Manager [7034]  - The Network Connections service terminated unexpectedly.  It has done this 1 time(s).
31.7.2013 г. 19:42:24, error: Service Control Manager [7034]  - The Logical Disk Manager service terminated unexpectedly.  It has done this 1 time(s).
31.7.2013 г. 19:42:24, error: Service Control Manager [7034]  - The Fast User Switching Compatibility service terminated unexpectedly.  It has done this 1 time(s).
31.7.2013 г. 19:42:24, error: Service Control Manager [7034]  - The Distributed Link Tracking Client service terminated unexpectedly.  It has done this 1 time(s).
31.7.2013 г. 19:42:24, error: Service Control Manager [7034]  - The DHCP Client service terminated unexpectedly.  It has done this 1 time(s).
31.7.2013 г. 19:42:24, error: Service Control Manager [7034]  - The Cryptographic Services service terminated unexpectedly.  It has done this 1 time(s).
31.7.2013 г. 19:42:24, error: Service Control Manager [7034]  - The Computer Browser service terminated unexpectedly.  It has done this 1 time(s).
31.7.2013 г. 19:42:24, error: Service Control Manager [7034]  - The COM+ Event System service terminated unexpectedly.  It has done this 1 time(s).
31.7.2013 г. 19:42:24, error: Service Control Manager [7034]  - The Client Service for NetWare service terminated unexpectedly.  It has done this 1 time(s).
31.7.2013 г. 19:42:24, error: Service Control Manager [7031]  - The Windows Management Instrumentation service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 60000 milliseconds: Restart the service.
31.7.2013 г. 19:42:24, error: Service Control Manager [7031]  - The Themes service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 60000 milliseconds: Restart the service.
31.7.2013 г. 19:42:24, error: Service Control Manager [7031]  - The Task Scheduler service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 6000 milliseconds: Restart the service.
31.7.2013 г. 19:42:24, error: Service Control Manager [7031]  - The Help and Support service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 100 milliseconds: Restart the service.
31.7.2013 г. 19:39:06, error: DCOM [10005]  - DCOM got error "%1058" attempting to start the service BITS with arguments "" in order to run the server: {4991D34B-80A1-4291-83B6-3328366B9097}
31.7.2013 г. 19:36:44, error: Service Control Manager [7034]  - The VIA Karaoke digital mixer Service service terminated unexpectedly.  It has done this 1 time(s).
31.7.2013 г. 19:36:44, error: Service Control Manager [7034]  - The Skype C2C Service service terminated unexpectedly.  It has done this 1 time(s).
31.7.2013 г. 19:36:44, error: Service Control Manager [7034]  - The PandoraService service terminated unexpectedly.  It has done this 1 time(s).
31.7.2013 г. 19:36:44, error: Service Control Manager [7034]  - The NVIDIA Display Driver Service service terminated unexpectedly.  It has done this 1 time(s).
31.7.2013 г. 19:36:44, error: Service Control Manager [7034]  - The Forceware Web Interface service terminated unexpectedly.  It has done this 1 time(s).
31.7.2013 г. 19:36:44, error: Service Control Manager [7034]  - The ForceWare user log service service terminated unexpectedly.  It has done this 1 time(s).
31.7.2013 г. 19:36:44, error: Service Control Manager [7034]  - The ForceWare IP service service terminated unexpectedly.  It has done this 1 time(s).
31.7.2013 г. 18:38:47, error: Service Control Manager [7023]  - The Shell System service terminated with the following error:  A dynamic link library (DLL) initialization routine failed.
31.7.2013 г. 18:37:17, error: DCOM [10005]  - DCOM got error "%1058" attempting to start the service BITS with arguments "" in order to run the server: {4991D34B-80A1-4291-83B6-3328366B9097}
31.7.2013 г. 18:19:20, error: DCOM [10005]  - DCOM got error "%1058" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}
31.7.2013 г. 18:07:18, error: DCOM [10005]  - DCOM got error "%1058" attempting to start the service BITS with arguments "" in order to run the server: {4991D34B-80A1-4291-83B6-3328366B9097}
31.7.2013 г. 17:25:37, error: Service Control Manager [7023]  - The Shell System service terminated with the following error:  A dynamic link library (DLL) initialization routine failed.
31.7.2013 г. 17:16:10, error: DCOM [10005]  - DCOM got error "%1058" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}
31.7.2013 г. 16:51:17, error: SideBySide [59]  - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. .
31.7.2013 г. 16:51:17, error: SideBySide [59]  - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. .
31.7.2013 г. 16:51:17, error: SideBySide [59]  - Generate Activation Context failed for C:DOCUME~1oliLOCALS~1Tempbitool.dll. Reference error message: The operation completed successfully. .
31.7.2013 г. 16:51:17, error: SideBySide [59]  - Generate Activation Context failed for C:DOCUME~1oliLOCALS~1Tempbitool.dll. Reference error message: The operation completed successfully. .
31.7.2013 г. 16:51:17, error: SideBySide [32]  - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system.
31.7.2013 г. 16:51:17, error: SideBySide [32]  - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system.
31.7.2013 г. 16:51:09, error: SideBySide [59]  - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. .
31.7.2013 г. 16:51:09, error: SideBySide [59]  - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. .
31.7.2013 г. 16:51:09, error: SideBySide [59]  - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. .
31.7.2013 г. 16:51:09, error: SideBySide [59]  - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. .
31.7.2013 г. 16:51:09, error: SideBySide [59]  - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. .
31.7.2013 г. 16:51:09, error: SideBySide [59]  - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. .
31.7.2013 г. 16:51:09, error: SideBySide [59]  - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. .
31.7.2013 г. 16:51:09, error: SideBySide [59]  - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. .
31.7.2013 г. 16:51:09, error: SideBySide [59]  - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. .
31.7.2013 г. 16:51:09, error: SideBySide [59]  - Generate Activation Context failed for C:DOCUME~1oliLOCALS~1Tempbitool.dll. Reference error message: The operation completed successfully. .
31.7.2013 г. 16:51:09, error: SideBySide [59]  - Generate Activation Context failed for C:DOCUME~1oliLOCALS~1Tempbitool.dll. Reference error message: The operation completed successfully. .
31.7.2013 г. 16:51:09, error: SideBySide [59]  - Generate Activation Context failed for C:DOCUME~1oliLOCALS~1Tempbitool.dll. Reference error message: The operation completed successfully. .
31.7.2013 г. 16:51:09, error: SideBySide [59]  - Generate Activation Context failed for C:DOCUME~1oliLOCALS~1Tempbitool.dll. Reference error message: The operation completed successfully. .
31.7.2013 г. 16:51:09, error: SideBySide [59]  - Generate Activation Context failed for C:DOCUME~1oliLOCALS~1Tempbitool.dll. Reference error message: The operation completed successfully. .
31.7.2013 г. 16:51:09, error: SideBySide [59]  - Generate Activation Context failed for C:DOCUME~1oliLOCALS~1Tempbitool.dll. Reference error message: The operation completed successfully. .
31.7.2013 г. 16:51:09, error: SideBySide [59]  - Generate Activation Context failed for C:DOCUME~1oliLOCALS~1Tempbitool.dll. Reference error message: The operation completed successfully. .
31.7.2013 г. 16:51:09, error: SideBySide [59]  - Generate Activation Context failed for C:DOCUME~1oliLOCALS~1Tempbitool.dll. Reference error message: The operation completed successfully. .
31.7.2013 г. 16:51:09, error: SideBySide [59]  - Generate Activation Context failed for C:DOCUME~1oliLOCALS~1Tempbitool.dll. Reference error message: The operation completed successfully. .
31.7.2013 г. 16:51:09, error: SideBySide [32]  - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system.
31.7.2013 г. 16:51:09, error: SideBySide [32]  - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system.
31.7.2013 г. 16:51:09, error: SideBySide [32]  - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system.
31.7.2013 г. 16:51:09, error: SideBySide [32]  - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system.
31.7.2013 г. 16:51:09, error: SideBySide [32]  - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system.
31.7.2013 г. 16:51:09, error: SideBySide [32]  - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system.
31.7.2013 г. 16:51:09, error: SideBySide [32]  - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system.
31.7.2013 г. 16:51:09, error: SideBySide [32]  - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system.
31.7.2013 г. 16:51:09, error: SideBySide [32]  - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system.
31.7.2013 г. 16:48:32, error: DCOM [10005]  - DCOM got error "%1058" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}
31.7.2013 г. 16:39:23, error: DCOM [10005]  - DCOM got error "%1058" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}
31.7.2013 г. 16:31:58, error: DCOM [10005]  - DCOM got error "%1058" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}
31.7.2013 г. 16:31:25, error: DCOM [10005]  - DCOM got error "%1058" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}
31.7.2013 г. 16:21:18, error: DCOM [10005]  - DCOM got error "%1058" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}
31.7.2013 г. 16:14:03, error: DCOM [10005]  - DCOM got error "%1058" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}
31.7.2013 г. 16:03:09, error: DCOM [10005]  - DCOM got error "%1058" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}
31.7.2013 г. 16:00:29, error: Service Control Manager [7023]  - The Shell System service terminated with the following error:  A dynamic link library (DLL) initialization routine failed.
31.7.2013 г. 16:00:26, error: SideBySide [59]  - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. .
31.7.2013 г. 16:00:26, error: SideBySide [59]  - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. .
31.7.2013 г. 16:00:26, error: SideBySide [59]  - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. .
31.7.2013 г. 16:00:26, error: SideBySide [59]  - Generate Activation Context failed for C:DOCUME~1oliLOCALS~1Tempbitool.dll. Reference error message: The operation completed successfully. .
31.7.2013 г. 16:00:26, error: SideBySide [59]  - Generate Activation Context failed for C:DOCUME~1oliLOCALS~1Tempbitool.dll. Reference error message: The operation completed successfully. .
31.7.2013 г. 16:00:26, error: SideBySide [59]  - Generate Activation Context failed for C:DOCUME~1oliLOCALS~1Tempbitool.dll. Reference error message: The operation completed successfully. .
31.7.2013 г. 16:00:26, error: SideBySide [32]  - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system.
31.7.2013 г. 16:00:26, error: SideBySide [32]  - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system.
31.7.2013 г. 16:00:26, error: SideBySide [32]  - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system.
31.7.2013 г. 16:00:19, error: SideBySide [59]  - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. .
31.7.2013 г. 16:00:19, error: SideBySide [59]  - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. .
31.7.2013 г. 16:00:19, error: SideBySide [59]  - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. .
31.7.2013 г. 16:00:19, error: SideBySide [59]  - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. .
31.7.2013 г. 16:00:19, error: SideBySide [59]  - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. .
31.7.2013 г. 16:00:19, error: SideBySide [59]  - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. .
31.7.2013 г. 16:00:19, error: SideBySide [59]  - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. .
31.7.2013 г. 16:00:19, error: SideBySide [59]  - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. .
31.7.2013 г. 16:00:19, error: SideBySide [59]  - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. .
31.7.2013 г. 16:00:19, error: SideBySide [59]  - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. .
31.7.2013 г. 16:00:19, error: SideBySide [59]  - Generate Activation Context failed for C:DOCUME~1oliLOCALS~1Tempbitool.dll. Reference error message: The operation completed successfully. .
31.7.2013 г. 16:00:19, error: SideBySide [59]  - Generate Activation Context failed for C:DOCUME~1oliLOCALS~1Tempbitool.dll. Reference error message: The operation completed successfully. .
31.7.2013 г. 16:00:19, error: SideBySide [59]  - Generate Activation Context failed for C:DOCUME~1oliLOCALS~1Tempbitool.dll. Reference error message: The operation completed successfully. .
31.7.2013 г. 16:00:19, error: SideBySide [59]  - Generate Activation Context failed for C:DOCUME~1oliLOCALS~1Tempbitool.dll. Reference error message: The operation completed successfully. .
31.7.2013 г. 16:00:19, error: SideBySide [59]  - Generate Activation Context failed for C:DOCUME~1oliLOCALS~1Tempbitool.dll. Reference error message: The operation completed successfully. .
31.7.2013 г. 16:00:19, error: SideBySide [59]  - Generate Activation Context failed for C:DOCUME~1oliLOCALS~1Tempbitool.dll. Reference error message: The operation completed successfully. .
31.7.2013 г. 16:00:19, error: SideBySide [59]  - Generate Activation Context failed for C:DOCUME~1oliLOCALS~1Tempbitool.dll. Reference error message: The operation completed successfully. .
31.7.2013 г. 16:00:19, error: SideBySide [59]  - Generate Activation Context failed for C:DOCUME~1oliLOCALS~1Tempbitool.dll. Reference error message: The operation completed successfully. .
31.7.2013 г. 16:00:19, error: SideBySide [59]  - Generate Activation Context failed for C:DOCUME~1oliLOCALS~1Tempbitool.dll. Reference error message: The operation completed successfully. .
31.7.2013 г. 16:00:19, error: SideBySide [59]  - Generate Activation Context failed for C:DOCUME~1oliLOCALS~1Tempbitool.dll. Reference error message: The operation completed successfully. .
31.7.2013 г. 16:00:19, error: SideBySide [32]  - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system.
31.7.2013 г. 16:00:19, error: SideBySide [32]  - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system.
31.7.2013 г. 16:00:19, error: SideBySide [32]  - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system.
31.7.2013 г. 16:00:19, error: SideBySide [32]  - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system.
31.7.2013 г. 16:00:19, error: SideBySide [32]  - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system.
31.7.2013 г. 16:00:19, error: SideBySide [32]  - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system.
31.7.2013 г. 16:00:19, error: SideBySide [32]  - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system.
31.7.2013 г. 16:00:19, error: SideBySide [32]  - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system.
31.7.2013 г. 16:00:19, error: SideBySide [32]  - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system.
31.7.2013 г. 16:00:19, error: SideBySide [32]  - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system.
31.7.2013 г. 16:00:10, error: SideBySide [59]  - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. .
31.7.2013 г. 16:00:10, error: SideBySide [59]  - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. .
31.7.2013 г. 16:00:10, error: SideBySide [59]  - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. .
31.7.2013 г. 16:00:10, error: SideBySide [59]  - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. .
31.7.2013 г. 16:00:10, error: SideBySide [59]  - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. .
31.7.2013 г. 16:00:10, error: SideBySide [59]  - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. .
31.7.2013 г. 16:00:10, error: SideBySide [59]  - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. .
31.7.2013 г. 16:00:10, error: SideBySide [59]  - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. .
31.7.2013 г. 16:00:10, error: SideBySide [59]  - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. .
31.7.2013 г. 16:00:10, error: SideBySide [59]  - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. .
31.7.2013 г. 16:00:10, error: SideBySide [59]  - Generate Activation Context failed for C:DOCUME~1oliLOCALS~1Tempbitool.dll. Reference error message: The operation completed successfully. .
31.7.2013 г. 16:00:10, error: SideBySide [59]  - Generate Activation Context failed for C:DOCUME~1oliLOCALS~1Tempbitool.dll. Reference error message: The operation completed successfully. .
31.7.2013 г. 16:00:10, error: SideBySide [59]  - Generate Activation Context failed for C:DOCUME~1oliLOCALS~1Tempbitool.dll. Reference error message: The operation completed successfully. .
31.7.2013 г. 16:00:10, error: SideBySide [59]  - Generate Activation Context failed for C:DOCUME~1oliLOCALS~1Tempbitool.dll. Reference error message: The operation completed successfully. .
31.7.2013 г. 16:00:10, error: SideBySide [59]  - Generate Activation Context failed for C:DOCUME~1oliLOCALS~1Tempbitool.dll. Reference error message: The operation completed successfully. .
31.7.2013 г. 16:00:10, error: SideBySide [59]  - Generate Activation Context failed for C:DOCUME~1oliLOCALS~1Tempbitool.dll. Reference error message: The operation completed successfully. .
31.7.2013 г. 16:00:10, error: SideBySide [59]  - Generate Activation Context failed for C:DOCUME~1oliLOCALS~1Tempbitool.dll. Reference error message: The operation completed successfully. .
31.7.2013 г. 16:00:10, error: SideBySide [59]  - Generate Activation Context failed for C:DOCUME~1oliLOCALS~1Tempbitool.dll. Reference error message: The operation completed successfully. .
31.7.2013 г. 16:00:10, error: SideBySide [59]  - Generate Activation Context failed for C:DOCUME~1oliLOCALS~1Tempbitool.dll. Reference error message: The operation completed successfully. .
31.7.2013 г. 16:00:10, error: SideBySide [59]  - Generate Activation Context failed for C:DOCUME~1oliLOCALS~1Tempbitool.dll. Reference error message: The operation completed successfully. .
31.7.2013 г. 16:00:10, error: SideBySide [32]  - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system.
31.7.2013 г. 16:00:10, error: SideBySide [32]  - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system.
31.7.2013 г. 16:00:10, error: SideBySide [32]  - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system.
31.7.2013 г. 16:00:10, error: SideBySide [32]  - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system.
31.7.2013 г. 16:00:10, error: SideBySide [32]  - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system.
31.7.2013 г. 16:00:10, error: SideBySide [32]  - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system.
31.7.2013 г. 16:00:10, error: SideBySide [32]  - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system.
31.7.2013 г. 16:00:10, error: SideBySide [32]  - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system.
31.7.2013 г. 16:00:10, error: SideBySide [32]  - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system.
31.7.2013 г. 16:00:10, error: SideBySide [32]  - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system.
31.7.2013 г. 15:58:40, error: Dhcp [1001]  - Your computer was not assigned an address from the network (by the DHCP Server) for the Network Card with network address 001966DC26F9.  The following error occurred:  The operation was canceled by the user. . Your computer will continue to try and obtain an address on its own from the network address (DHCP) server.
31.7.2013 г. 14:02:57, error: IPXRouterManager [20115]  - IPX Routing requires an internal network number for correct operation.
31.7.2013 г. 14:01:08, error: Server [2505]  - The server could not bind to the transport DeviceNwlnkNb because another computer on the network has the same name.  The server could not start.
31.7.2013 г. 14:01:08, error: Server [2505]  - The server could not bind to the transport DeviceNwlnkIpx because another computer on the network has the same name.  The server could not start.
31.7.2013 г. 13:43:02, error: Service Control Manager [7009]  - Timeout (30000 milliseconds) waiting for the crd service to connect.
31.7.2013 г. 13:43:02, error: Service Control Manager [7000]  - The crd service failed to start due to the following error:  The service did not respond to the start or control request in a timely fashion.
31.7.2013 г. 13:32:38, error: Setup [60055]  - Windows Setup encountered non-fatal errors during installation. Please check the setuperr.log found in your Windows directory for more information.
.
==== End Of File ===========================
 

Има още малко за почистване:

• [*]Стартирайте файла с двукратен клик на мишката. [*]Под с

Copy/ Paste въведете изцяло следната текстова информация (само това, което е поставено в карето):

:files
c:docume~1alluse~1dxuuocid.exe
:reg
[HKEY_CURRENT_USERsoftwaremicrosoftwindowsCurrentversionpoliciesexplorerRun]
"2478"=-
:commands
[emptytemp]

[*]След като въведете скрипта от цитата по-горе натиснете бутона, маркиран в червено: Run Fix [*]Windows ще се рестартира и ще се създаде лог файл. Публикувайте съдържанието му с Copy/Paste в следващия си коментар. [*]Също така архивирайте папката C:_OTLMovedFiles отново => и я качете на този адрес => http://file.bg/ и публикувайте линк за теглене в следващия си пост (след това изтрийте архива, който създадохте, но не трийте самата папка...нея ще я изтрием накрая).

Резултатът:

 

 

All processes killed ========== FILES ========== c:docume~1alluse~1dxuuocid.exe moved successfully. ========== REGISTRY ========== Registry key HKEY_CURRENT_USERsoftwaremicrosoftwindowsCurrentversionpoliciesexplorerRun not found. ========== COMMANDS ==========   [EMPTYTEMP]   User: All Users   User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes   User: LocalService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes   User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes   User: oli ->Temp folder emptied: 80668 bytes ->Temporary Internet Files folder emptied: 184320 bytes ->FireFox cache emptied: 86248176 bytes ->Flash cache emptied: 1008 bytes   %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%System32 .tmp files removed: 0 bytes %systemroot%System32dllcache .tmp files removed: 0 bytes %systemroot%System32drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 37145 bytes %systemroot%system32configsystemprofileLocal SettingsTemp folder emptied: 0 bytes %systemroot%system32configsystemprofileLocal SettingsTemporary Internet Files folder emptied: 0 bytes RecycleBin emptied: 0 bytes   Total Files Cleaned = 83.00 mb     OTL by OldTimer - Version 3.2.69.0 log created on 07312013_212638 FilesFolders moved on Reboot... FileFolder C:WINDOWStempPerflib_Perfdata_b64.dat not found! PendingFileRenameOperations files... Registry entries deleted on Reboot...  

Редактирано 31 юли 201313 г. от B-boy[StyLe]
Премахнат опасен линк. :) (преглед на промените)

Така, искам да проверя още някои неща:

 

 

СТЪПКА 1

 

• [*]Изтеглете

RogueKiller.exe и го запазете на десктопа. [*]Стартирайте приложението и натиснете бутона SCAN. [*]Ще се създаде лог файл на десктопа с името RKreport.txt на десктопа. [*]Публикувайте лог файла в следващия си пост.

 

 

СТЪПКА 2

 

 

Моля изтеглете последната версия на TDSSKiller оттук и я запазете на вашия декстоп.

• [*]Стартирайте

TDSSKiller.exe за да стартирате приложението. След това кликнете върху бутона Change parameters.

[*]Сложете отметка през Loaded Modules.

[*]Необходим е рестарт за осъществяване на промените. Направете го! [*]TDSSKiller ще стартира автоматично след рестарта. Важно е да се отбележи, че вашия компютър може да изглежда по-бавен, на моменти неизползваем и с по-ниска производителност. Това е нормално и ще трае само един рестарт. Дайте му достатъчно време да зареди приложенията стартиращи с Операционната Система във фонов режим. [*]След това натиснете Change parameters в TDSSKiller отново. [*]Сложете всички отметки (този път рестарт не се изисква).

[*]Натиснете бутона Start Scan.

[*]Проверката не би трябвало да отмене повече от 2 minutes. [*]Ако подозрителен обект бъде засечен, действието по подразбиране ще бъде Skip, кликнете върху Continue.

[*]Ако зловредни обекти бъдат намерени, тогава от падащото меню ще имате три възможности.
Бъдете сигурни, че избраното действие е Cure и натиснете върху Continue > Рестартирайте за да бъде завършена поправката.



Забележка: Ако Cure бутона не е наличен от възможностите, тогава моля изберете Skip бутона, не избирайте Delete освен ако не сте инструктирани затова. [*]Лог файл ще бъде създаден в свободната директория на дял C: . Потърсете за лог с името "TDSSKiller.[Version]_[Date]_[Time]_log.txt" и копирайте съдържанието му в следващия си пост.

 

 

СТЪПКА 3

 

 

Изтеглете Malwarebytes' Anti-Malware

 

• [*]Кликнете два пъти върху

mbam-setup.exe, за да инсталирате програмата. [*]Уверете се, че са поставени отметки на Update Malwarebytes' Anti-Malware и Launch Malwarebytes' Anti-Malware. След това кликнете на Finish. [*]Ако има намерени обновявания, тя ще ги изтегли и инсталира. [*]Стартирайте програмата и изберете "Perform Quick Scan", след това кликнете на Scan. [*]Сканирането ще отнеме малко време, затова моля да бъдете търпеливи. [*]Когато сканирането завърши, кликнете на OK, след това Show Results, за да видите резултата. [*]Натиснете Save Log (не натискайте Remove Selected засега) и запазете лог файла на десктопа. [*]Копирайте този лог и го публикувайте в следващия си коментар по темата.

 

 

СТЪПКА 4

 

 

Моля изтеглете Farbar Service Scanner и я стартирайте.

 

• [*]Сложете

всички отметки и натиснете бутона "Scan". [*]Ще се създаде лог файл с името (FSS.txt) в папката откъдето стартирате инструмента. [*]Прикачете лог файла в следващия си пост.

Системата наистина стана доста тромава   При изпълнение на стъпка две лог файловете станаха два, ще копирам единия, другия ще го прикача тъй като поста става доста дълъг и не ми позволява да го публикувам

 

RKreport.txt RogueKiller V8.6.4 [Jul 29 2013] by Tigzy mail : tigzyRK<at>gmail<dot>com Feedback : http://www.adlice.com/forum/ Website : http://www.adlice.com/softwares/roguekiller/ Blog : http://tigzyrk.blogspot.com/ Operating System : Windows XP (5.1.2600 Service Pack 3) 32 bits version Started in : Normal mode User : oli [Admin rights] Mode : Scan -- Date : 07/31/2013 22:04:41 | ARK || FAK || MBR | ¤¤¤ Bad processes : 0 ¤¤¤ ¤¤¤ Registry Entries : 1 ¤¤¤ [HJ DESK] HKLM[...]NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND ¤¤¤ Scheduled tasks : 0 ¤¤¤ ¤¤¤ Startup Entries : 0 ¤¤¤ ¤¤¤ Web browsers : 0 ¤¤¤ ¤¤¤ Particular Files / Folders: ¤¤¤ ¤¤¤ Driver : [LOADED] ¤¤¤ ¤¤¤ External Hives: ¤¤¤ ¤¤¤ Infection :  ¤¤¤ ¤¤¤ HOSTS File: ¤¤¤ --> %SystemRoot%System32driversetchosts ÿþ1 ¤¤¤ MBR Check: ¤¤¤ +++++ PhysicalDrive0: HDT722520DLA380 +++++ --- User --- [MBR] c5386202e27809d94cecee5de01f4499 [bSP] 154ee1efe7e37b9594c4514fb8e60036 : Windows XP MBR Code Partition table: 0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 29996 Mo 1 - [XXXXXX] EXTEN-LBA (0x0f) [VISIBLE] Offset (sectors): 61432560 | Size: 160775 Mo User = LL1 ... OK! Error reading LL2 MBR! Finished : << RKreport[0]_S_07312013_220441.txt >> TDSSKiller.txt 22:05:17.0281 3352  TDSS rootkit removing tool 2.8.18.0 Jun 10 2013 21:44:19 22:05:17.0765 3352  ============================================================ 22:05:17.0765 3352  Current date / time: 2013/07/31 22:05:17.0765 22:05:17.0765 3352  SystemInfo: 22:05:17.0765 3352   22:05:17.0765 3352  OS Version: 5.1.2600 ServicePack: 3.0 22:05:17.0765 3352  Product type: Workstation 22:05:17.0765 3352  ComputerName: INKA 22:05:17.0781 3352  UserName: oli 22:05:17.0781 3352  Windows directory: C:WINDOWS 22:05:17.0781 3352  System windows directory: C:WINDOWS 22:05:17.0781 3352  Processor architecture: Intel x86 22:05:17.0781 3352  Number of processors: 1 22:05:17.0781 3352  Page size: 0x1000 22:05:17.0781 3352  Boot type: Normal boot 22:05:17.0781 3352  ============================================================ 22:05:18.0218 3352  Drive DeviceHarddisk0DR0 - Size: 0x2E93E36000 (186.31 Gb), SectorSize: 0x200, Cylinders: 0x5F01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050 22:05:18.0234 3352  ============================================================ 22:05:18.0234 3352  DeviceHarddisk0DR0: 22:05:18.0234 3352  MBR partitions: 22:05:18.0234 3352  DeviceHarddisk0DR0Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x3A962B1 22:05:18.0234 3352  DeviceHarddisk0DR0Partition2: MBR, Type 0x7, StartLBA 0x3A9632F, BlocksNum 0x13A03BD1 22:05:18.0234 3352  ============================================================ 22:05:18.0281 3352  C: <-> DeviceHarddisk0DR0Partition1 22:05:18.0328 3352  D: <-> DeviceHarddisk0DR0Partition2 22:05:18.0328 3352  ============================================================ 22:05:18.0328 3352  Initialize success 22:05:18.0328 3352  ============================================================ 22:05:31.0796 1456  Deinitialize success FSS.txt Farbar Service Scanner Version: 26-07-2013 Ran by oli (administrator) on 31-07-2013 at 22:29:55 Running from "C:Documents and SettingsoliDesktop" Microsoft Windows XP Professional Service Pack 3 (X86) Boot Mode: Normal **************************************************************** Internet Services: ============ Connection Status: ============== Localhost is accessible. LAN connected. Google IP is accessible. Google.com is accessible. Yahoo.com is accessible. Windows Firewall: ============= Firewall Disabled Policy: ================== System Restore: ============ System Restore Disabled Policy: ======================== Security Center: ============ wscsvc Service is not running. Checking service configuration: The start type of wscsvc service is set to Disabled. The default start type is Auto. The ImagePath of wscsvc service is OK. The ServiceDll of wscsvc service is OK. Windows Update: ============ wuauserv Service is not running. Checking service configuration: The start type of wuauserv service is set to Disabled. The default start type is Auto. The ImagePath of wuauserv service is OK. The ServiceDll of wuauserv: "C:WINDOWSsystem32wuauserv.dll". BITS Service is not running. Checking service configuration: The start type of BITS service is set to Disabled. The default start type is Auto. The ImagePath of BITS service is OK. The ServiceDll of BITS: "C:WINDOWSsystem32qmgr.dll". Checking LEGACY_BITS: ATTENTION!=====> Unable to open LEGACY_BITS0000 registry key. The key does not exist. Windows Autoupdate Disabled Policy: ============================ File Check: ======== C:WINDOWSsystem32dhcpcsvc.dll => MD5 is legit C:WINDOWSsystem32Driversafd.sys => MD5 is legit C:WINDOWSsystem32Driversnetbt.sys => MD5 is legit C:WINDOWSsystem32Driverstcpip.sys => MD5 is legit C:WINDOWSsystem32Driversipsec.sys => MD5 is legit C:WINDOWSsystem32dnsrslvr.dll => MD5 is legit C:WINDOWSsystem32ipnathlp.dll => MD5 is legit C:WINDOWSsystem32netman.dll => MD5 is legit C:WINDOWSsystem32wbemWMIsvc.dll => MD5 is legit C:WINDOWSsystem32srsvc.dll => MD5 is legit C:WINDOWSsystem32Driverssr.sys => MD5 is legit C:WINDOWSsystem32wscsvc.dll => MD5 is legit C:WINDOWSsystem32wbemWMIsvc.dll => MD5 is legit C:WINDOWSsystem32wuauserv.dll => MD5 is legit C:WINDOWSsystem32qmgr.dll => MD5 is legit C:WINDOWSsystem32es.dll => MD5 is legit C:WINDOWSsystem32cryptsvc.dll => MD5 is legit C:WINDOWSsystem32svchost.exe => MD5 is legit C:WINDOWSsystem32rpcss.dll => MD5 is legit C:WINDOWSsystem32services.exe => MD5 is legit Extra List: ======= Gpc(6) IPSec(4) NetBT(5) NwlnkIpx(8) NwlnkNb(9) PSched(7) Tcpip(3) 0x09000000040000000100000002000000030000000500000006000000070000000800000009000000 IpSec Tag value is correct. **** End of log **** Malwarebytes.txt Malwarebytes Anti-Malware (Пробна версия) 1.75.0.1300 www.malwarebytes.org Версия на базата от данни: v2013.07.31.06 Windows XP Service Pack 3 x86 NTFS Internet Explorer 7.0.5730.13 oli :: INKA [администратор] Защита: включена 7/31/2013 10:27:27 PM MBAM-log-2013-07-31 (22-35-56).txt Тип сканиране: Бързо сканиране Включени опции за сканиране: Памет | Автоматично зареждане | Системен регистър | Файлова система | Евристики/Допълнителни | Евристики/Shuriken | PUP | PUM Изключени опции за сканиране: P2P Сканирани обекти: 190670 Изминало време: 7 минута(и), 32 секунда(и) Открити процеси в паметта: 0 (Не бяха открити зловредни обекти) Открити модули в паметта: 0 (Не бяха открити зловредни обекти) Открити ключове в системния регистър: 0 (Не бяха открити зловредни обекти) Открити стойности в системния регистър: 0 (Не бяха открити зловредни обекти) Открити информационни обекти в системния регистър: 1 HKLMSOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvancedFolderHiddenSHOWALL|CheckedValue (PUM.Hijack.System.Hidden) -> Лош: (0) Добър: (1) -> Не беше предприето действие. Открити папки: 0 (Не бяха открити зловредни обекти) Открити файлове: 1 C:Documents and SettingsoliMy DocumentsDownloadsSoftonicDownloader_for_everest.exe (PUP.Optional.Softonic) -> Не беше предприето действие. (край)  

 

TDSSKiller.2.8.18.0_31.07.2013_22.07.00_log.txt

В какъв смисъл тромава? Определено имаше нужда да сканираме със всички, защото имахте доста зарази и при това доста нови варианти.

 

Би трябвало след новия рестарт нещата да се нормализират (когато TDSSKiller спре своя драйвър).

 

Преди да приключим искам да оправим още нещо:

 

Изтеглете и стартирайте - ESET ServicesRepair utility

 

След като поправките приключат ще поиска рестарт. Съгласете се. След рестарта ще се създаде лог файл. Прикачете го в следващия си коментар.

 

И след това за да видим дали поправките са били успешни направете нова проверка само с Farbar Service Scanner (не забравяйте да сложите всички отметки) и прикачете новия лог файл.

 

Бтв: Не сте премахнали/поправили намерените неща от Malwarebytes' Anti-Malware...направете го...ако се наложи сканирайте пак и премахнете намерените неща.

Ето лог-файловете

 

SvcRepair.txt

 

Log Opened: 2013-07-31 @ 23:29:08 23:29:08 - ----------------- 23:29:08 - | Begin Logging | 23:29:08 - ----------------- 23:29:08 - Fix started on a WIN_XP X86 computer 23:29:08 - Prep in progress.  Please Wait. 23:29:11 - Prep complete 23:29:11 - Repairing Services Now.  Please wait... The operation completed successfully INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore. INFORMATION: Input file for restore operation opened: '.XPBITS.sddl' INFORMATION: Restoring SD of: <machineSystemCurrentControlsetServicesBITSEnum> INFORMATION: Restoring SD of: <machineSystemCurrentControlsetServicesBITSSecurity> INFORMATION: Restoring SD of: <machineSystemCurrentControlsetServicesBITSParameters> INFORMATION: Restoring SD of: <machineSystemCurrentControlsetServicesBITS> SetACL finished successfully. The operation completed successfully INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore. INFORMATION: Input file for restore operation opened: '.XPSharedAccess.sddl' INFORMATION: Restoring SD of: <machineSystemCurrentControlsetServicesSharedAccessEnum> INFORMATION: Restoring SD of: <machineSystemCurrentControlsetServicesSharedAccessSetup> INFORMATION: Restoring SD of: <machineSystemCurrentControlsetServicesSharedAccessParametersFirewallPolicyStandardProfileAuthorizedApplicationsList> INFORMATION: Restoring SD of: <machineSystemCurrentControlsetServicesSharedAccessParametersFirewallPolicyStandardProfileAuthorizedApplications> INFORMATION: Restoring SD of: <machineSystemCurrentControlsetServicesSharedAccessParametersFirewallPolicyStandardProfile> INFORMATION: Restoring SD of: <machineSystemCurrentControlsetServicesSharedAccessParametersFirewallPolicyDomainProfileAuthorizedApplicationsList> INFORMATION: Restoring SD of: <machineSystemCurrentControlsetServicesSharedAccessParametersFirewallPolicyDomainProfileAuthorizedApplications> INFORMATION: Restoring SD of: <machineSystemCurrentControlsetServicesSharedAccessParametersFirewallPolicyDomainProfile> INFORMATION: Restoring SD of: <machineSystemCurrentControlsetServicesSharedAccessParametersFirewallPolicy> INFORMATION: Restoring SD of: <machineSystemCurrentControlsetServicesSharedAccessParameters> INFORMATION: Restoring SD of: <machineSystemCurrentControlsetServicesSharedAccessEpoch> INFORMATION: Restoring SD of: <machineSystemCurrentControlsetServicesSharedAccess> SetACL finished successfully. The operation completed successfully INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore. INFORMATION: Input file for restore operation opened: '.XPwscsvc.sddl' INFORMATION: Restoring SD of: <machineSystemCurrentControlsetServiceswscsvcEnum> INFORMATION: Restoring SD of: <machineSystemCurrentControlsetServiceswscsvcSecurity> INFORMATION: Restoring SD of: <machineSystemCurrentControlsetServiceswscsvcParameters> INFORMATION: Restoring SD of: <machineSystemCurrentControlsetServiceswscsvc> SetACL finished successfully. The operation completed successfully INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore. INFORMATION: Input file for restore operation opened: '.XPwuauserv.sddl' INFORMATION: Restoring SD of: <machineSystemCurrentControlsetServiceswuauservEnum> INFORMATION: Restoring SD of: <machineSystemCurrentControlsetServiceswuauservSecurity> INFORMATION: Restoring SD of: <machineSystemCurrentControlsetServiceswuauservParameters> INFORMATION: Restoring SD of: <machineSystemCurrentControlsetServiceswuauserv> SetACL finished successfully. 23:29:14 - Services Repair Complete. 23:29:17 - Reboot Initiated  

 

FSS.txt

 

Farbar Service Scanner Version: 26-07-2013 Ran by oli (administrator) on 31-07-2013 at 23:37:42 Running from "C:Documents and SettingsoliDesktop" Microsoft Windows XP Professional Service Pack 3 (X86) Boot Mode: Normal **************************************************************** Internet Services: ============ Connection Status: ============== Localhost is accessible. LAN connected. Google IP is accessible. Google.com is accessible. Yahoo.com is accessible. Windows Firewall: ============= Firewall Disabled Policy: ================== [HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyStandardProfile] "EnableFirewall"=DWORD:0 System Restore: ============ System Restore Disabled Policy: ======================== Security Center: ============ Windows Update: ============ Windows Autoupdate Disabled Policy: ============================ File Check: ======== C:WINDOWSsystem32dhcpcsvc.dll => MD5 is legit C:WINDOWSsystem32Driversafd.sys => MD5 is legit C:WINDOWSsystem32Driversnetbt.sys => MD5 is legit C:WINDOWSsystem32Driverstcpip.sys => MD5 is legit C:WINDOWSsystem32Driversipsec.sys => MD5 is legit C:WINDOWSsystem32dnsrslvr.dll => MD5 is legit C:WINDOWSsystem32ipnathlp.dll => MD5 is legit C:WINDOWSsystem32netman.dll => MD5 is legit C:WINDOWSsystem32wbemWMIsvc.dll => MD5 is legit C:WINDOWSsystem32srsvc.dll => MD5 is legit C:WINDOWSsystem32Driverssr.sys => MD5 is legit C:WINDOWSsystem32wscsvc.dll => MD5 is legit C:WINDOWSsystem32wbemWMIsvc.dll => MD5 is legit C:WINDOWSsystem32wuauserv.dll => MD5 is legit C:WINDOWSsystem32qmgr.dll => MD5 is legit C:WINDOWSsystem32es.dll => MD5 is legit C:WINDOWSsystem32cryptsvc.dll => MD5 is legit C:WINDOWSsystem32svchost.exe => MD5 is legit C:WINDOWSsystem32rpcss.dll => MD5 is legit C:WINDOWSsystem32services.exe => MD5 is legit Extra List: ======= Gpc(6) IPSec(4) NetBT(5) NwlnkIpx(8) NwlnkNb(9) PSched(7) Tcpip(3) 0x09000000040000000100000002000000030000000500000006000000070000000800000009000000 IpSec Tag value is correct. **** End of log ****

Супер

 

За да почистим използваните от нас неща направете следното:

 

Изтеглете OTC.exe и го стартирайте. Натиснете бутона CleanUp!.
Рестартирайте компютъра, ако ви попита!

Изтеглете Delfix.exe и го стартирайте. Сложете отметка пред Remove disinfection tools => натиснете бутона Run

Инструмента ще се самоизтрие след като приключи своята задача!

 

Ако има инструменти, папки или логове от използваните от нас неща и те не са се изтрили при горе-споменатите процедури, ги изтрийте ръчно.

Инсталирайте и безплатна антивирусна по ваш избор.

 

Изтеглете и инсталирайте ъпдейта за Internet Explorer:

 

Изтегли: Internet Explorer 8.0 Final за Windows XP x86 (16.1 MB)

 

След това пишете дали има още някакви проблеми с Windows.

Сайтът се отваря без проблеми вече Системата си работи бързо, така като гледам всичко си е наред Благодаря много за отделеното време и помощта

Чудесно, тогава маркирам темата като решена.

Поздрави и приятна вечер