Вирус от USB флашка създава shortcut

31 март 201412 г.

Преди да пусна за проверка Farbar Recovery Scan Tool бих искал да споделя,че компютъра е свързан в мрежа с още два компютъра и един сървър.

Необходимо ли е да се разкачи мрежата или може да се изчистят един по един докато са в мрежа?

Цитирай

31 март 201412 г.

Зависи от червея...засега не ги разкачайте, а ги сканирайте по-етапно и публикувайте логовете за всяка една система.

Цитирай

1 април 201412 г.

Автор

Зависи от червея...засега не ги разкачайте, а ги сканирайте по-етапно и публикувайте логовете за всяка една система.

Tова са логовете от първия компютър

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 13-03-2014 01

Ran by Janeta Veskova (administrator) on JANETA on 01-04-2014 09:37:49

Running from C:Documents and SettingsJaneta VeskovaDesktop

Microsoft Windows XP Home Edition Service Pack 3 (X86) OS Language: English(US)

Internet Explorer Version 8

Boot Mode: Normal

The only official download link for FRST:

Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/

Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/

Download link from any site other than Bleeping Computer is unpermitted or outdated.

See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(Malwarebytes Corporation) C:Program FilesMalwarebytes' Anti-Malwarembamscheduler.exe

(Google Inc.) C:Program FilesGoogleUpdate1.3.22.5GoogleCrashHandler.exe

(Malwarebytes Corporation) C:Program FilesMalwarebytes' Anti-Malwarembamservice.exe

(Malwarebytes Corporation) C:Program FilesMalwarebytes' Anti-Malwarembamgui.exe

(Microsoft Corporation) C:WINDOWSsystem32wscntfy.exe

(Realtek Semiconductor Corp.) C:WINDOWSRTHDCPL.EXE

(Macrovision Corporation) C:Program FilesCommon FilesInstallShieldUpdateServiceissch.exe

(Intel Corporation) C:WINDOWSsystem32hkcmd.exe

(Intel Corporation) C:WINDOWSsystem32igfxpers.exe

(Intel Corporation) C:WINDOWSsystem32igfxsrvc.exe

(Microsoft Corporation) C:WINDOWSsystem32wscript.exe

(Electronics For Imaging, Inc.) C:Program FilesFieryCStationcstation.exe

() C:Program FilesDatecsFlexType 2KFType2K.exe

(Panda Security) C:Program FilesPanda USB VaccineUSBVaccine.exe

(Microsoft Corporation) C:WINDOWSsystem32wuauclt.exe

(Mozilla Corporation) C:Program FilesMozilla Firefoxfirefox.exe

(Mozilla Corporation) C:Program FilesMozilla Firefoxplugin-container.exe

==================== Registry (Whitelisted) ==================

HKLM...Run: [RTHDCPL] - C:WINDOWSRTHDCPL.EXE [16871936 2008-06-13] (Realtek Semiconductor Corp.)

HKLM...Run: [iSUSPM Startup] - C:Program FilesCommon FilesInstallShieldUpdateServiceisuspm.exe [249856 2005-08-11] (Macrovision Corporation)

HKLM...Run: [iSUSScheduler] - C:Program FilesCommon FilesInstallShieldUpdateServiceissch.exe [81920 2005-08-11] (Macrovision Corporation)

HKLM...Run: [rspwqkvjgw] - wscript.exe //B "C:DOCUME~1JANETA~1LOCALS~1Temprspwqkvjgw.vbs" <===== ATTENTION

HKUS-1-5-21-2025429265-884357618-682003330-1004...Run: [Wxiaiw] - C:Documents and SettingsJaneta VeskovaApplication DataWxiaiw.scr

HKUS-1-5-21-2025429265-884357618-682003330-1004...Run: [rspwqkvjgw] - wscript.exe //B "C:DOCUME~1JANETA~1LOCALS~1Temprspwqkvjgw.vbs" <===== ATTENTION

Startup: C:Documents and SettingsAll UsersStart MenuProgramsStartupAdobe Gamma Loader.lnk

ShortcutTarget: Adobe Gamma Loader.lnk -> C:Program FilesCommon FilesAdobeCalibrationAdobe Gamma Loader.exe (Adobe Systems, Inc.)

Startup: C:Documents and SettingsAll UsersStart MenuProgramsStartupAdobe Reader Speed Launch.lnk

ShortcutTarget: Adobe Reader Speed Launch.lnk -> C:Program FilesAdobeAcrobat 7.0Readerreader_sl.exe (Adobe Systems Incorporated)

Startup: C:Documents and SettingsAll UsersStart MenuProgramsStartupCommand WorkStation.lnk

ShortcutTarget: Command WorkStation.lnk -> C:Program FilesFieryCStationcstation.exe (Electronics For Imaging, Inc.)

Startup: C:Documents and SettingsAll UsersStart MenuProgramsStartupFlexType 2K.lnk

ShortcutTarget: FlexType 2K.lnk -> C:Program FilesDatecsFlexType 2KFType2K.exe ()

Startup: C:Documents and SettingsJaneta VeskovaStart MenuProgramsStartupPandaUSBVaccine.lnk

ShortcutTarget: PandaUSBVaccine.lnk -> C:Program FilesPanda USB VaccineUSBVaccine.exe (Panda Security)

Startup: C:Documents and SettingsJaneta VeskovaStart MenuProgramsStartuprspwqkvjgw.vbs ()

==================== Internet (Whitelisted) ====================

HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.google.bg/

HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:Program FilesAdobeAcrobat 7.0ActiveXAcroIEHelper.dll (Adobe Systems Incorporated)

Toolbar: HKCU - &Address - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:WINDOWSsystem32browseui.dll (Microsoft Corporation)

Toolbar: HKCU - &Links - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - C:WINDOWSsystem32SHELL32.dll (Microsoft Corporation)

TcpipParameters: [DhcpNameServer] 192.168.4.1

FireFox:

========

FF ProfilePath: C:Documents and SettingsJaneta VeskovaApplication DataMozillaFirefoxProfilesvrp47w1s.default-1377870160375

FF Homepage: hxxp://www.google.bg/

FF Plugin: @adobe.com/FlashPlayer - C:WINDOWSsystem32MacromedFlashNPSWF32_12_0_0_77.dll ()

FF Plugin: @microsoft.com/WPF,version=3.5 - C:WINDOWSMicrosoft.NETFrameworkv3.5Windows Presentation FoundationNPWPF.dll (Microsoft Corporation)

FF Plugin: @tools.google.com/Google Update;version=3 - C:Program FilesGoogleUpdate1.3.22.5npGoogleUpdate3.dll (Google Inc.)

FF Plugin: @tools.google.com/Google Update;version=9 - C:Program FilesGoogleUpdate1.3.22.5npGoogleUpdate3.dll (Google Inc.)

FF SearchPlugin: C:Program Filesmozilla firefoxbrowsersearchplugins911bg.xml

FF SearchPlugin: C:Program Filesmozilla firefoxbrowsersearchpluginsdiribg.xml

FF SearchPlugin: C:Program Filesmozilla firefoxbrowsersearchpluginspe-bg.xml

FF SearchPlugin: C:Program Filesmozilla firefoxbrowsersearchpluginsportalbgdict.xml

FF Extension: Bulgarian+Germany Dictionary - C:Documents and SettingsJaneta VeskovaApplication DataMozillaFirefoxProfilesvrp47w1s.default-1377870160375Extensionsde-BG@dictionaries.addons.mozilla.org [2013-08-30]

FF HKLM...FirefoxExtensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:WINDOWSMicrosoft.NETFrameworkv3.5Windows Presentation FoundationDotNetAssistantExtension

FF Extension: Microsoft .NET Framework Assistant - C:WINDOWSMicrosoft.NETFrameworkv3.5Windows Presentation FoundationDotNetAssistantExtension []

Chrome:

=======

CHR Plugin: (Shockwave Flash) - C:Program FilesGoogleChromeApplication33.0.1750.154PepperFlashpepflashplayer.dll ()

CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer

CHR Plugin: (Native Client) - C:Program FilesGoogleChromeApplication33.0.1750.154ppGoogleNaClPluginChrome.dll ()

CHR Plugin: (Chrome PDF Viewer) - C:Program FilesGoogleChromeApplication33.0.1750.154pdf.dll ()

CHR Plugin: (Adobe Acrobat) - C:Program FilesAdobeAcrobat 7.0ReaderBrowsernppdf32.dll (Adobe Systems Inc.)

CHR Plugin: (Microsoft® DRM) - C:Program FilesWindows Media Playernpdrmv2.dll (Microsoft Corporation)

CHR Plugin: (Windows Media Player Plug-in Dynamic Link Library) - C:Program FilesWindows Media Playernpdsplay.dll (Microsoft Corporation (written by Digital Renaissance Inc.))

CHR Plugin: (Microsoft® DRM) - C:Program FilesWindows Media Playernpwmsdrm.dll (Microsoft Corporation)

CHR Plugin: (Google Update) - C:Program FilesGoogleUpdate1.3.21.124npGoogleUpdate3.dll No File

CHR Plugin: (Shockwave Flash) - C:WINDOWSsystem32MacromedFlashNPSWF32_11_5_502_146.dll No File

CHR Extension: (Google Документи) - C:Documents and SettingsJaneta VeskovaLocal SettingsApplication DataGoogleChromeUser DataDefaultExtensionsaohghmighlieiainnegkcijnfilokake [2013-01-31]

CHR Extension: (Google Диск) - C:Documents and SettingsJaneta VeskovaLocal SettingsApplication DataGoogleChromeUser DataDefaultExtensionsapdfllckaahabafndbhieahigkjlhalf [2013-01-31]

CHR Extension: (YouTube) - C:Documents and SettingsJaneta VeskovaLocal SettingsApplication DataGoogleChromeUser DataDefaultExtensionsblpcfgokakmgnkcojhhkbfbldkacnbeo [2013-01-31]

CHR Extension: (Google Търсене) - C:Documents and SettingsJaneta VeskovaLocal SettingsApplication DataGoogleChromeUser DataDefaultExtensionscoobgpohoikkiipiblmjeljniedjpjpf [2013-01-31]

CHR Extension: (Google Wallet) - C:Documents and SettingsJaneta VeskovaLocal SettingsApplication DataGoogleChromeUser DataDefaultExtensionsnmmhkkegccagdldgiimedpiccmgmieda [2013-10-31]

CHR Extension: (Gmail) - C:Documents and SettingsJaneta VeskovaLocal SettingsApplication DataGoogleChromeUser DataDefaultExtensionspjkljhegncpnkpknbcohdijeoejaedia [2013-01-31]

========================== Services (Whitelisted) =================

R2 MBAMScheduler; C:Program FilesMalwarebytes' Anti-Malwarembamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)

R2 MBAMService; C:Program FilesMalwarebytes' Anti-Malwarembamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)

==================== Drivers (Whitelisted) ====================

R3 MBAMProtector; C:WINDOWSsystem32driversmbam.sys [22856 2013-04-04] (Malwarebytes Corporation)

S3 EverestDriver; ??C:Program FilesLavalysEVEREST Ultimate Editionkerneld.wnt [X]

S4 IntelIde; No ImagePath

U5 ScsiPort; C:WINDOWSsystem32driversscsiport.sys [96384 2008-04-14] (Microsoft Corporation)

U1 WS2IFSL;

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2014-04-01 09:37 - 2014-04-01 09:37 - 01145856 _____ (Farbar) C:Documents and SettingsJaneta VeskovaDesktopFRST.exe

2014-04-01 09:37 - 2014-04-01 09:37 - 00009540 _____ () C:Documents and SettingsJaneta VeskovaDesktopFRST.txt

2014-04-01 09:37 - 2014-04-01 09:37 - 00000000 ____D () C:FRST

2014-03-24 11:59 - 2014-03-24 11:59 - 00000000 _____ () C:WINDOWSsystem32Internet Explorer.exe

2014-03-19 11:39 - 2014-03-19 11:40 - 00000000 ____D () C:Program FilesMozilla Firefox

2014-03-19 09:15 - 2014-04-01 09:09 - 00000240 _____ () C:WINDOWSTasksMicrosoft Windows XP End of Service Notification Logon.job

2014-03-19 09:15 - 2014-03-20 10:07 - 00000234 _____ () C:WINDOWSTasksMicrosoft Windows XP End of Service Notification Monthly.job

2014-03-18 19:27 - 2014-03-18 19:27 - 00004016 _____ () C:WINDOWSKB2934207.log

2014-03-18 19:27 - 2014-03-18 19:27 - 00000000 __HDC () C:WINDOWS$NtUninstallKB2934207$

2014-03-18 11:42 - 2014-02-26 04:59 - 00013312 ____N (Microsoft Corporation) C:WINDOWSsystem32xp_eos.exe

2014-03-18 11:42 - 2014-02-26 04:59 - 00013312 ____C (Microsoft Corporation) C:WINDOWSsystem32dllcachexp_eos.exe

2014-03-14 18:31 - 2014-03-14 18:31 - 00011088 _____ () C:WINDOWSKB2925418-IE8.log

2014-03-14 18:31 - 2014-03-14 18:31 - 00000000 __HDC () C:WINDOWS$NtUninstallKB2930275$

2014-03-14 18:31 - 2014-03-14 18:31 - 00000000 __HDC () C:WINDOWS$NtUninstallKB2929961$

2014-03-14 10:02 - 2014-03-14 18:31 - 00008291 _____ () C:WINDOWSKB2929961.log

2014-03-14 10:01 - 2014-03-14 18:31 - 00009560 _____ () C:WINDOWSKB2930275.log

==================== One Month Modified Files and Folders =======

2014-04-01 09:37 - 2014-04-01 09:37 - 01145856 _____ (Farbar) C:Documents and SettingsJaneta VeskovaDesktopFRST.exe

2014-04-01 09:37 - 2014-04-01 09:37 - 00009540 _____ () C:Documents and SettingsJaneta VeskovaDesktopFRST.txt

2014-04-01 09:37 - 2014-04-01 09:37 - 00000000 ____D () C:FRST

2014-04-01 09:37 - 2013-01-23 10:07 - 00000392 _____ () C:WINDOWSefinl.ini

2014-04-01 09:13 - 2013-01-22 18:09 - 00509828 _____ () C:WINDOWSsystem32PerfStringBackup.INI

2014-04-01 09:11 - 2013-01-22 16:17 - 01499787 _____ () C:WINDOWSWindowsUpdate.log

2014-04-01 09:10 - 2013-07-19 09:14 - 00422681 _____ () C:WINDOWSKB2686509.log

2014-04-01 09:10 - 2013-07-19 09:14 - 00000056 _____ () C:WINDOWSfaultykeyboard.log

2014-04-01 09:09 - 2014-03-19 09:15 - 00000240 _____ () C:WINDOWSTasksMicrosoft Windows XP End of Service Notification Logon.job

2014-04-01 09:09 - 2013-01-31 11:00 - 00000898 _____ () C:WINDOWSTasksGoogleUpdateTaskMachineCore.job

2014-04-01 09:09 - 2013-01-22 18:32 - 00000282 _____ () C:WINDOWSTasksGo for FilesUpdate.job

2014-04-01 09:09 - 2013-01-22 18:11 - 00000159 _____ () C:WINDOWSwiadebug.log

2014-04-01 09:09 - 2013-01-22 18:11 - 00000052 _____ () C:WINDOWSwiaservc.log

2014-04-01 09:09 - 2013-01-22 16:22 - 00000006 ____H () C:WINDOWSTasksSA.DAT

2014-03-31 18:19 - 2013-01-22 16:24 - 00000178 ___SH () C:Documents and SettingsJaneta Veskovantuser.ini

2014-03-31 18:19 - 2013-01-22 16:22 - 00032602 _____ () C:WINDOWSSchedLgU.Txt

2014-03-31 18:05 - 2013-01-22 18:00 - 00000830 _____ () C:WINDOWSTasksAdobe Flash Player Updater.job

2014-03-31 17:46 - 2013-01-31 11:00 - 00000902 _____ () C:WINDOWSTasksGoogleUpdateTaskMachineUA.job

2014-03-31 12:23 - 2014-01-23 16:30 - 00145742 _____ () C:WINDOWSsetupapi.log

2014-03-31 08:53 - 2006-02-28 15:00 - 00013646 _____ () C:WINDOWSsystem32wpa.dbl

2014-03-28 17:50 - 2013-01-23 17:46 - 00002516 ___SH () C:WINDOWSsystem32KGyGaAvL.sys

2014-03-24 11:59 - 2014-03-24 11:59 - 00000000 _____ () C:WINDOWSsystem32Internet Explorer.exe

2014-03-20 15:49 - 2013-01-23 11:14 - 00000110 _____ () C:WINDOWSfiery.ini

2014-03-20 10:07 - 2014-03-19 09:15 - 00000234 _____ () C:WINDOWSTasksMicrosoft Windows XP End of Service Notification Monthly.job

2014-03-20 10:06 - 2013-08-30 12:41 - 00000000 ____D () C:Program FilesMozilla Maintenance Service

2014-03-19 11:40 - 2014-03-19 11:39 - 00000000 ____D () C:Program FilesMozilla Firefox

2014-03-18 19:27 - 2014-03-18 19:27 - 00004016 _____ () C:WINDOWSKB2934207.log

2014-03-18 19:27 - 2014-03-18 19:27 - 00000000 __HDC () C:WINDOWS$NtUninstallKB2934207$

2014-03-18 19:27 - 2013-01-22 18:09 - 01068771 _____ () C:WINDOWSFaxSetup.log

2014-03-18 19:27 - 2013-01-22 18:09 - 00520030 _____ () C:WINDOWSocgen.log

2014-03-18 19:27 - 2013-01-22 18:09 - 00410772 _____ () C:WINDOWStsoc.log

2014-03-18 19:27 - 2013-01-22 18:09 - 00365590 _____ () C:WINDOWScomsetup.log

2014-03-18 19:27 - 2013-01-22 18:09 - 00219838 _____ () C:WINDOWSntdtcsetup.log

2014-03-18 19:27 - 2013-01-22 18:09 - 00167776 _____ () C:WINDOWSiis6.log

2014-03-18 19:27 - 2013-01-22 18:09 - 00059186 _____ () C:WINDOWSocmsn.log

2014-03-18 19:27 - 2013-01-22 18:09 - 00053554 _____ () C:WINDOWSmsgsocm.log

2014-03-18 19:27 - 2013-01-22 18:09 - 00001374 _____ () C:WINDOWSimsins.log

2014-03-17 10:53 - 2013-01-31 11:01 - 00001845 _____ () C:Documents and SettingsAll UsersDesktopGoogle Chrome.lnk

2014-03-17 10:03 - 2013-01-22 18:08 - 00921384 _____ () C:WINDOWSsystem32FNTCACHE.DAT

2014-03-14 18:31 - 2014-03-14 18:31 - 00011088 _____ () C:WINDOWSKB2925418-IE8.log

2014-03-14 18:31 - 2014-03-14 18:31 - 00000000 __HDC () C:WINDOWS$NtUninstallKB2930275$

2014-03-14 18:31 - 2014-03-14 18:31 - 00000000 __HDC () C:WINDOWS$NtUninstallKB2929961$

2014-03-14 18:31 - 2014-03-14 10:02 - 00008291 _____ () C:WINDOWSKB2929961.log

2014-03-14 18:31 - 2014-03-14 10:01 - 00009560 _____ () C:WINDOWSKB2930275.log

2014-03-14 18:31 - 2013-01-23 12:58 - 00157177 _____ () C:WINDOWSupdspapi.log

2014-03-14 18:31 - 2013-01-22 18:09 - 00001374 _____ () C:WINDOWSimsins.BAK

2014-03-12 12:05 - 2013-01-22 18:00 - 00692616 _____ (Adobe Systems Incorporated) C:WINDOWSsystem32FlashPlayerApp.exe

2014-03-12 12:05 - 2013-01-22 18:00 - 00071048 _____ (Adobe Systems Incorporated) C:WINDOWSsystem32FlashPlayerCPLApp.cpl

2014-03-06 16:11 - 2013-03-22 11:07 - 00126976 ___SH () C:Documents and SettingsJaneta VeskovaDesktopThumbs.db

Some content of TEMP:

====================

C:Documents and SettingsJaneta VeskovaLocal SettingsTemphtmlayout.dll

C:Documents and SettingsJaneta VeskovaLocal SettingsTempPicaView.dll

C:Documents and SettingsJaneta VeskovaLocal SettingsTempuninstall596828.exe

==================== Bamital & volsnap Check =================

C:WINDOWSexplorer.exe => MD5 is legit

C:WINDOWSsystem32winlogon.exe => MD5 is legit

C:WINDOWSsystem32svchost.exe => MD5 is legit

C:WINDOWSsystem32services.exe => MD5 is legit

C:WINDOWSsystem32User32.dll => MD5 is legit

C:WINDOWSsystem32userinit.exe => MD5 is legit

C:WINDOWSsystem32rpcss.dll => MD5 is legit

C:WINDOWSsystem32Driversvolsnap.sys => MD5 is legit

==================== End Of Log ============================

Tова са логовете от втори компютър

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 13-03-2014 01

Ran by Galin Marinov (administrator) on GMM on 01-04-2014 09:44:59

Running from C:Documents and SettingsGalin MarinovDesktop

Microsoft Windows XP Home Edition Service Pack 3 (X86) OS Language: English(US)

Internet Explorer Version 8

Boot Mode: Normal

The only official download link for FRST:

Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/

Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/

Download link from any site other than Bleeping Computer is unpermitted or outdated.

See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(ATI Technologies Inc.) C:WINDOWSsystem32Ati2evxx.exe

(HP) C:WINDOWSsystem32HPSIsvc.exe

(ATI Technologies Inc.) C:WINDOWSsystem32Ati2evxx.exe

(Microsoft Corporation) C:WINDOWSsystem32wscntfy.exe

(Realtek Semiconductor Corp.) C:WINDOWSSkyTel.EXE

(Realtek Semiconductor Corp.) C:WINDOWSRTHDCPL.EXE

(JMicron Technology Corp.) C:WINDOWSsystem32JMRaidTool.exe

() C:Program FilesWinampwinampa.exe

(Macrovision Corporation) C:Program FilesCommon FilesInstallShieldUpdateServiceissch.exe

(Microsoft Corporation) C:Program FilesMessengermsmsgs.exe

(Electronics For Imaging, Inc.) C:Program FilesFieryCStationcstation.exe

() C:WINDOWSDatecsFlex2K.exe

(Panda Security) C:Program FilesPanda USB VaccineUSBVaccine.exe

(Microsoft Corporation) C:WINDOWSsystem32wscript.exe

(Mozilla Corporation) C:Program FilesMozilla Firefoxfirefox.exe

(Mozilla Corporation) C:Program FilesMozilla Firefoxplugin-container.exe

(Corel Corporation) C:Program FilesCorelGraphics9Programscoreldrw.exe

==================== Registry (Whitelisted) ==================

HKLM...Run: [skyTel] - C:WINDOWSSkyTel.EXE [1448960 2006-04-24] (Realtek Semiconductor Corp.)

HKLM...Run: [RTHDCPL] - C:WINDOWSRTHDCPL.EXE [16206848 2006-05-04] (Realtek Semiconductor Corp.)

HKLM...Run: [JMB36X Configure] - C:WINDOWSsystem32JMRaidTool.exe [385024 2006-04-20] (JMicron Technology Corp.)

HKLM...Run: [WinampAgent] - C:Program FilesWinampwinampa.exe [37888 2009-07-01] ()

HKLM...Run: [iSUSPM Startup] - C:Program FilesCommon FilesInstallShieldUpdateServiceisuspm.exe [249856 2005-08-11] (Macrovision Corporation)

HKLM...Run: [iSUSScheduler] - C:Program FilesCommon FilesInstallShieldUpdateServiceissch.exe [81920 2005-08-11] (Macrovision Corporation)

HKLM...Run: [NeroFilterCheck] - C:WINDOWSsystem32NeroCheck.exe [155648 2001-07-09] (Ahead Software Gmbh)

HKLM...Run: [HPUsageTrackingLEDM] - C:Program FilesHPHP UT LEDMbinhppusg.exe [30264 2009-08-04] (Hewlett-Packard Company)

HKLM...Run: [Adobe ARM] - C:Program FilesCommon FilesAdobeARM1.0AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)

HKLM...Run: [rspwqkvjgw] - wscript.exe //B "C:DOCUME~1GALINM~1LOCALS~1Temprspwqkvjgw.vbs" <===== ATTENTION

WinlogonNotifyAtiExtEvent: C:WINDOWSsystem32Ati2evxx.dll (ATI Technologies Inc.)

HKUS-1-5-21-117609710-602609370-682003330-1004...Run: [MSMSGS] - C:Program FilesMessengermsmsgs.exe [1695232 2008-04-14] (Microsoft Corporation)

HKUS-1-5-21-117609710-602609370-682003330-1004...Run: [rspwqkvjgw] - wscript.exe //B "C:DOCUME~1GALINM~1LOCALS~1Temprspwqkvjgw.vbs" <===== ATTENTION

Startup: C:Documents and SettingsAll UsersStart MenuProgramsStartupAdobe Gamma Loader.lnk

ShortcutTarget: Adobe Gamma Loader.lnk -> C:Program FilesCommon FilesAdobeCalibrationAdobe Gamma Loader.exe (Adobe Systems, Inc.)

Startup: C:Documents and SettingsAll UsersStart MenuProgramsStartupCommand WorkStation.lnk

ShortcutTarget: Command WorkStation.lnk -> C:Program FilesFieryCStationcstation.exe (Electronics For Imaging, Inc.)

Startup: C:Documents and SettingsAll UsersStart MenuProgramsStartupFlexType 2K.lnk

ShortcutTarget: FlexType 2K.lnk -> C:WINDOWSDatecsFlex2K.exe ()

Startup: C:Documents and SettingsGalin MarinovStart MenuProgramsStartupPandaUSBVaccine.lnk

ShortcutTarget: PandaUSBVaccine.lnk -> C:Program FilesPanda USB VaccineUSBVaccine.exe (Panda Security)

Startup: C:Documents and SettingsGalin MarinovStart MenuProgramsStartuprspwqkvjgw.vbs ()

==================== Internet (Whitelisted) ====================

HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = about:blank

HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://www.google.com/ie

URLSearchHook: ATTENTION ==> Default URLSearchHook is missing.

BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:Program FilesJavajre6binjp2ssv.dll No File

Toolbar: HKCU - &Address - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:WINDOWSsystem32browseui.dll (Microsoft Corporation)

Toolbar: HKCU - &Links - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - C:WINDOWSsystem32SHELL32.dll (Microsoft Corporation)

DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

TcpipParameters: [DhcpNameServer] 192.168.4.1

FireFox:

========

FF ProfilePath: C:Documents and SettingsGalin MarinovApplication DataMozillaFirefoxProfiles4fgnhrif.default

FF user.js: detected! => C:Documents and SettingsGalin MarinovApplication DataMozillaFirefoxProfiles4fgnhrif.defaultuser.js

FF NewTab: user_pref("browser.newtab.url", "");

FF DefaultSearchEngine: user_pref("browser.search.defaultenginename", "");

FF SelectedSearchEngine: user_pref("browser.search.selectedEngine", "");

FF Homepage: hxxp://www.google.bg/

FF Plugin: @adobe.com/FlashPlayer - C:WINDOWSsystem32MacromedFlashNPSWF32_12_0_0_77.dll ()

FF Plugin: @adobe.com/ShockwavePlayer - C:WINDOWSsystem32AdobeDirectornp32dsw.dll (Adobe Systems, Inc.)

FF Plugin: @real.com/nppl3260;version=6.0.12.709 - C:Program FilesK-Lite Codec PackRealbrowserpluginsnppl3260.dll (RealNetworks, Inc.)

FF Plugin: @real.com/nprpjplug;version=6.0.12.709 - C:Program FilesK-Lite Codec PackRealbrowserpluginsnprpjplug.dll (RealNetworks, Inc.)

FF Plugin: Adobe Reader - C:Program FilesAdobeReader 10.0ReaderAIRnppdf32.dll (Adobe Systems Inc.)

FF Plugin ProgramFiles/Appdata: C:Program Filesmozilla firefoxpluginsnp-mswmp.dll (Microsoft Corporation)

FF Plugin ProgramFiles/Appdata: C:Program Filesmozilla firefoxpluginsnpdeployJava1.dll (Sun Microsystems, Inc.)

FF Plugin ProgramFiles/Appdata: C:Program Filesmozilla firefoxpluginsnppdf32.dll (Adobe Systems Inc.)

FF Plugin ProgramFiles/Appdata: C:Program Filesmozilla firefoxpluginsnppl3260.dll (RealNetworks, Inc.)

FF Plugin ProgramFiles/Appdata: C:Program Filesmozilla firefoxpluginsnprpjplug.dll (RealNetworks, Inc.)

FF SearchPlugin: C:Program Filesmozilla firefoxbrowsersearchplugins911bg.xml

FF SearchPlugin: C:Program Filesmozilla firefoxbrowsersearchpluginsdiribg.xml

FF SearchPlugin: C:Program Filesmozilla firefoxbrowsersearchpluginspe-bg.xml

FF SearchPlugin: C:Program Filesmozilla firefoxbrowsersearchpluginsportalbgdict.xml

FF Extension: ABV Notifier - C:Documents and SettingsGalin MarinovApplication DataMozillaFirefoxProfiles4fgnhrif.defaultExtensionsabvnotifier@netinfo.bg.xpi [2013-07-11]

FF HKLM...FirefoxExtensions: [[email protected]] - C:Documents and SettingsGalin MarinovApplication DataiPumperextension_firefox.xpi

========================== Services (Whitelisted) =================

S2 ATI Smart; C:WINDOWSsystem32ati2sgag.exe [516096 2005-08-05] ()

S2 HP LaserJet Service; C:Program FilesHPHPLaserJetServiceHPLaserJetService.exe [136704 2009-06-24] (HP)

S2 Browser Defender Update Service; "C:Program FilesPC ToolsPC Tools SecurityBDTBDTUpdateService.exe" [X]

==================== Drivers (Whitelisted) ====================

S3 andnetadb; C:WINDOWSSystem32Driverslgandnetadb.sys [25856 2010-11-29] (Google Inc)

S3 CCDECODE; C:WINDOWSSystem32DRIVERSCCDECODE.sys [17024 2008-04-14] (Microsoft Corporation)

R1 cdrbsvsd; C:WINDOWSsystem32Driverscdrbsvsd.sys [10940 2003-04-29] (B.H.A Corporation)

R0 JGOGO; C:WINDOWSSystem32DRIVERSJGOGO.sys [6912 2006-02-07] (JMicron )

R0 JRAID; C:WINDOWSSystem32DRIVERSjraid.sys [42368 2006-04-20] (JMicron Technology Corp.)

R3 LgBttPort; C:WINDOWSSystem32DRIVERSlgbtport.sys [12160 2009-09-29] (LG Electronics Inc.)

R3 lgbusenum; C:WINDOWSSystem32DRIVERSlgbtbus.sys [10496 2009-09-29] (LG Electronics Inc.)

R3 LGVMODEM; C:WINDOWSSystem32DRIVERSlgvmodem.sys [12928 2009-09-29] (LG Electronics Inc.)

S3 NdisIP; C:WINDOWSSystem32DRIVERSNdisIP.sys [10880 2008-04-14] (Microsoft Corporation)

S3 rtl8139; C:WINDOWSSystem32DRIVERSRTL8139.SYS [20992 2004-08-04] (Realtek Semiconductor Corporation)

S3 sonypvs1; C:WINDOWSSystem32DRIVERSsonypvs1.sys [102220 2002-10-15] (Sony Corporation)

S3 SONYPVU1; C:WINDOWSSystem32DRIVERSSONYPVU1.SYS [7552 2001-08-17] (Sony Corporation)

S3 GMSIPCI; ??E:INSTALLGMSIPCI.SYS [X]

S4 IntelIde; No ImagePath

S3 NTACCESS; ??E:NTACCESS.sys [X]

U5 ScsiPort; C:WINDOWSsystem32driversscsiport.sys [96384 2008-04-14] (Microsoft Corporation)

S3 SetupNTGLM7X; ??E:NTGLM7X.sys [X]

U3 TlntSvr;

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2014-04-01 09:44 - 2014-04-01 09:45 - 00009758 _____ () C:Documents and SettingsGalin MarinovDesktopFRST.txt

2014-04-01 09:44 - 2014-04-01 09:44 - 00000000 ____D () C:FRST

2014-04-01 09:44 - 2014-04-01 09:37 - 01145856 _____ (Farbar) C:Documents and SettingsGalin MarinovDesktopFRST.exe

2014-04-01 09:22 - 2014-04-01 09:22 - 00278720 _____ () C:Documents and SettingsGalin MarinovDesktopBackup_of_Panajot_Nikolov.cdr

2014-03-31 15:48 - 2014-03-31 15:48 - 00062104 _____ () C:Documents and SettingsGalin MarinovDesktopPapki_print.cdr

2014-03-31 15:35 - 2014-03-31 15:35 - 00000000 ____D () C:Program FilesESET

2014-03-31 15:32 - 2014-03-31 15:32 - 02347384 _____ (ESET) C:Documents and SettingsGalin MarinovDesktopesetsmartinstaller_bgr.exe

2014-03-31 12:40 - 2014-03-31 13:26 - 214375800 _____ () C:Documents and SettingsGalin MarinovDesktopMenu_2014.cdr

2014-03-31 12:40 - 2014-03-31 13:10 - 214752994 _____ () C:Documents and SettingsGalin MarinovDesktopMenu_2014_ceni.cdr

2014-03-31 12:29 - 2014-03-31 12:36 - 37169730 _____ () C:Documents and SettingsGalin MarinovDesktopMenu_Korici.cdr

2014-03-31 12:18 - 2014-03-31 12:19 - 00058076 _____ () C:Documents and SettingsGalin MarinovDesktopStikeri_Print.cdr

2014-03-31 09:24 - 2014-03-31 09:26 - 00029996 _____ () C:Documents and SettingsGalin MarinovDesktopZnamena_print.cdr

2014-03-29 14:30 - 2014-03-29 14:38 - 00000000 ____D () C:Documents and SettingsGalin MarinovDesktopMenu

2014-03-29 11:30 - 2014-03-29 11:34 - 00000000 ____D () C:Program FilesMozilla Firefox

2014-03-28 10:59 - 2014-03-28 11:06 - 00109942 _____ () C:Documents and SettingsGalin MarinovDesktopKaska.cdr

2014-03-27 11:11 - 2014-03-27 11:10 - 00067722 _____ () C:Documents and SettingsGalin MarinovDesktopplaket.cdr

2014-03-24 12:16 - 2014-03-24 12:16 - 00090112 _____ () C:WINDOWSMinidumpMini032414-01.dmp

2014-03-24 12:16 - 2014-03-24 12:16 - 00000000 ____D () C:WINDOWSMinidump

2014-03-24 10:16 - 2014-03-24 10:18 - 00013970 _____ () C:Documents and SettingsGalin MarinovDesktopPrege.cdr

2014-03-21 15:26 - 2014-03-31 17:45 - 00000000 ____D () C:Documents and SettingsGalin MarinovDesktopUM

2014-03-21 09:54 - 2014-03-25 15:28 - 00000000 ____D () C:Documents and SettingsGalin MarinovDesktopLodka

2014-03-20 13:52 - 2014-04-01 09:26 - 02313838 _____ () C:Documents and SettingsGalin MarinovDesktopPanajot_Nikolov.cdr

2014-03-19 19:34 - 2014-03-19 19:34 - 00050300 _____ () C:Documents and SettingsGalin MarinovDesktopOrnaments2.cdr

2014-03-19 19:32 - 2014-03-19 19:32 - 00055698 _____ () C:Documents and SettingsGalin MarinovDesktopOrnaments.cdr

2014-03-17 10:37 - 2014-03-28 13:39 - 00000000 ____D () C:Documents and SettingsGalin MarinovDesktopVip_Room_Cosmetics

2014-03-13 12:16 - 2014-03-13 12:40 - 06680460 _____ () C:Documents and SettingsGalin MarinovDesktopDarenie.cdr

2014-03-12 18:34 - 2014-03-13 14:57 - 82795064 _____ () C:Documents and SettingsGalin MarinovDesktopPrinter_print.cdr

2014-03-12 16:27 - 2014-03-27 18:12 - 00000000 ____D () C:Documents and SettingsGalin MarinovDesktopKatalog

2014-03-11 09:40 - 2014-03-13 11:30 - 00000000 ____D () C:Documents and SettingsGalin MarinovDesktopSkara

2014-03-06 17:19 - 2014-04-01 09:41 - 00000000 ____D () C:Documents and SettingsGalin MarinovDesktopZnamena

==================== One Month Modified Files and Folders =======

2014-04-01 09:45 - 2014-04-01 09:44 - 00009758 _____ () C:Documents and SettingsGalin MarinovDesktopFRST.txt

2014-04-01 09:44 - 2014-04-01 09:44 - 00000000 ____D () C:FRST

2014-04-01 09:41 - 2014-03-06 17:19 - 00000000 ____D () C:Documents and SettingsGalin MarinovDesktopZnamena

2014-04-01 09:37 - 2014-04-01 09:44 - 01145856 _____ (Farbar) C:Documents and SettingsGalin MarinovDesktopFRST.exe

2014-04-01 09:33 - 2012-09-21 11:00 - 00000830 _____ () C:WINDOWSTasksAdobe Flash Player Updater.job

2014-04-01 09:26 - 2014-03-20 13:52 - 02313838 _____ () C:Documents and SettingsGalin MarinovDesktopPanajot_Nikolov.cdr

2014-04-01 09:22 - 2014-04-01 09:22 - 00278720 _____ () C:Documents and SettingsGalin MarinovDesktopBackup_of_Panajot_Nikolov.cdr

2014-04-01 09:15 - 2010-08-13 10:27 - 00437109 _____ () C:WINDOWSWindowsUpdate.log

2014-04-01 09:11 - 2010-08-13 13:31 - 00000392 _____ () C:WINDOWSefinl.ini

2014-04-01 09:11 - 2010-08-13 13:17 - 00554168 _____ () C:WINDOWSsystem32PerfStringBackup.INI

2014-04-01 09:10 - 2013-01-14 13:07 - 00000290 _____ () C:WINDOWSTasksExpress FilesUpdate.job

2014-04-01 09:10 - 2010-08-13 13:19 - 00000159 _____ () C:WINDOWSwiadebug.log

2014-04-01 09:10 - 2010-08-13 13:19 - 00000052 _____ () C:WINDOWSwiaservc.log

2014-04-01 09:09 - 2010-08-13 10:31 - 00000006 ____H () C:WINDOWSTasksSA.DAT

2014-04-01 09:09 - 2004-08-04 15:00 - 00013680 _____ () C:WINDOWSsystem32wpa.dbl

2014-03-31 18:18 - 2010-08-13 10:32 - 00000178 ___SH () C:Documents and SettingsGalin Marinovntuser.ini

2014-03-31 18:18 - 2010-08-13 10:31 - 00032372 _____ () C:WINDOWSSchedLgU.Txt

2014-03-31 18:01 - 2010-08-23 12:25 - 00000110 _____ () C:WINDOWSfiery.ini

2014-03-31 17:45 - 2014-03-21 15:26 - 00000000 ____D () C:Documents and SettingsGalin MarinovDesktopUM

2014-03-31 15:48 - 2014-03-31 15:48 - 00062104 _____ () C:Documents and SettingsGalin MarinovDesktopPapki_print.cdr

2014-03-31 15:35 - 2014-03-31 15:35 - 00000000 ____D () C:Program FilesESET

2014-03-31 15:34 - 2013-03-19 17:38 - 00012288 ___SH () C:WINDOWSThumbs.db

2014-03-31 15:32 - 2014-03-31 15:32 - 02347384 _____ (ESET) C:Documents and SettingsGalin MarinovDesktopesetsmartinstaller_bgr.exe

2014-03-31 13:26 - 2014-03-31 12:40 - 214375800 _____ () C:Documents and SettingsGalin MarinovDesktopMenu_2014.cdr

2014-03-31 13:10 - 2014-03-31 12:40 - 214752994 _____ () C:Documents and SettingsGalin MarinovDesktopMenu_2014_ceni.cdr

2014-03-31 12:36 - 2014-03-31 12:29 - 37169730 _____ () C:Documents and SettingsGalin MarinovDesktopMenu_Korici.cdr

2014-03-31 12:19 - 2014-03-31 12:18 - 00058076 _____ () C:Documents and SettingsGalin MarinovDesktopStikeri_Print.cdr

2014-03-31 11:40 - 2010-08-13 12:39 - 00002828 ___SH () C:WINDOWSsystem32KGyGaAvL.sys

2014-03-31 09:26 - 2014-03-31 09:24 - 00029996 _____ () C:Documents and SettingsGalin MarinovDesktopZnamena_print.cdr

2014-03-29 14:38 - 2014-03-29 14:30 - 00000000 ____D () C:Documents and SettingsGalin MarinovDesktopMenu

2014-03-29 11:34 - 2014-03-29 11:30 - 00000000 ____D () C:Program FilesMozilla Firefox

2014-03-28 15:08 - 2010-08-13 15:44 - 08881746 ___SH () C:Documents and SettingsGalin MarinovDesktopThumbs.db

2014-03-28 13:39 - 2014-03-17 10:37 - 00000000 ____D () C:Documents and SettingsGalin MarinovDesktopVip_Room_Cosmetics

2014-03-28 13:39 - 2010-08-13 13:16 - 01666552 _____ () C:WINDOWSsetupapi.log

2014-03-28 11:06 - 2014-03-28 10:59 - 00109942 _____ () C:Documents and SettingsGalin MarinovDesktopKaska.cdr

2014-03-27 18:12 - 2014-03-12 16:27 - 00000000 ____D () C:Documents and SettingsGalin MarinovDesktopKatalog

2014-03-27 17:57 - 2011-05-05 11:36 - 00000284 _____ () C:WINDOWSTasksAppleSoftwareUpdate.job

2014-03-27 11:10 - 2014-03-27 11:11 - 00067722 _____ () C:Documents and SettingsGalin MarinovDesktopplaket.cdr

2014-03-25 15:33 - 2014-02-28 17:38 - 00019454 _____ () C:Documents and SettingsGalin MarinovDesktopTenor.cdr

2014-03-25 15:28 - 2014-03-21 09:54 - 00000000 ____D () C:Documents and SettingsGalin MarinovDesktopLodka

2014-03-24 13:36 - 2010-08-13 13:08 - 00000000 ____D () C:WINDOWSsecurity

2014-03-24 12:16 - 2014-03-24 12:16 - 00090112 _____ () C:WINDOWSMinidumpMini032414-01.dmp

2014-03-24 12:16 - 2014-03-24 12:16 - 00000000 ____D () C:WINDOWSMinidump

2014-03-24 10:18 - 2014-03-24 10:16 - 00013970 _____ () C:Documents and SettingsGalin MarinovDesktopPrege.cdr

2014-03-21 18:51 - 2012-09-21 10:37 - 00000000 __HDC () C:WINDOWS$NtServicePackUninstall$

2014-03-21 17:24 - 2011-12-20 17:03 - 00297666 _____ () C:Documents and SettingsGalin MarinovDesktoppechat.cdr

2014-03-21 09:51 - 2010-08-13 10:25 - 00000000 ____D () C:WINDOWSRegistration

2014-03-20 13:50 - 2010-08-23 13:19 - 00327081 _____ () C:WINDOWSsystem32AdobeFnt.lst

2014-03-19 19:34 - 2014-03-19 19:34 - 00050300 _____ () C:Documents and SettingsGalin MarinovDesktopOrnaments2.cdr

2014-03-19 19:32 - 2014-03-19 19:32 - 00055698 _____ () C:Documents and SettingsGalin MarinovDesktopOrnaments.cdr

2014-03-14 17:43 - 2010-08-13 15:04 - 00000000 ____D () C:Documents and SettingsGalin MarinovDesktopC

2014-03-13 14:57 - 2014-03-12 18:34 - 82795064 _____ () C:Documents and SettingsGalin MarinovDesktopPrinter_print.cdr

2014-03-13 12:40 - 2014-03-13 12:16 - 06680460 _____ () C:Documents and SettingsGalin MarinovDesktopDarenie.cdr

2014-03-13 11:30 - 2014-03-11 09:40 - 00000000 ____D () C:Documents and SettingsGalin MarinovDesktopSkara

2014-03-13 11:05 - 2013-03-19 18:52 - 00002561 _____ () C:Documents and SettingsGalin MarinovDesktopWord.lnk

2014-03-12 19:09 - 2013-01-17 11:50 - 00000000 ____D () C:Documents and SettingsGalin MarinovApplication DatauTorrent

2014-03-12 12:33 - 2012-09-21 11:00 - 00692616 _____ (Adobe Systems Incorporated) C:WINDOWSsystem32FlashPlayerApp.exe

2014-03-12 12:33 - 2011-08-18 09:47 - 00071048 _____ (Adobe Systems Incorporated) C:WINDOWSsystem32FlashPlayerCPLApp.cpl

2014-03-04 15:49 - 2012-02-16 12:24 - 00000000 ____D () C:Documents and SettingsGalin MarinovDesktopRazni

==================== Bamital & volsnap Check =================

C:WINDOWSexplorer.exe => MD5 is legit

C:WINDOWSsystem32winlogon.exe => MD5 is legit

C:WINDOWSsystem32svchost.exe => MD5 is legit

C:WINDOWSsystem32services.exe => MD5 is legit

C:WINDOWSsystem32User32.dll => MD5 is legit

C:WINDOWSsystem32userinit.exe => MD5 is legit

C:WINDOWSsystem32rpcss.dll => MD5 is legit

C:WINDOWSsystem32Driversvolsnap.sys => MD5 is legit

==================== End Of Log ============================

Tова са логовете от трети компютър

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 13-03-2014 01

Ran by GMarinov (administrator) on GAMA-7 on 01-04-2014 09:52:56

Running from C:Documents and SettingsGMarinovDesktop

Microsoft Windows XP Home Edition Service Pack 3 (X86) OS Language: English(US)

Internet Explorer Version 6

Boot Mode: Normal

The only official download link for FRST:

Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/

Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/

Download link from any site other than Bleeping Computer is unpermitted or outdated.

See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(Malwarebytes Corporation) C:Program FilesMalwarebytes' Anti-Malwarembamscheduler.exe

(Malwarebytes Corporation) C:Program FilesMalwarebytes' Anti-Malwarembamservice.exe

(Malwarebytes Corporation) C:Program FilesMalwarebytes' Anti-Malwarembamgui.exe

(Realtek Semiconductor Corp.) C:WINDOWSSOUNDMAN.EXE

(Macrovision Corporation) C:Program FilesCommon FilesInstallShieldUpdateServiceissch.exe

(Microsoft Corporation) C:Program FilesMicrosoft OfficeOffice12GrooveMonitor.exe

(Skype Technologies S.A.) C:Program FilesSkypePhoneSkype.exe

(Electronics For Imaging, Inc.) C:Program FilesFieryCStationcstation.exe

() C:WINDOWSDatecsFlex2K.exe

(WinZip Computing, Inc.) C:Program FilesWinZipWZQKPICK.EXE

(Panda Security) C:Program FilesPanda USB VaccineUSBVaccine.exe

(Brother Industries, Ltd.) C:Program FilesBrowny02BrYNSvc.exe

(Microsoft Corporation) C:WINDOWSsystem32wscntfy.exe

(Skype Technologies) C:Program FilesSkypePlugin ManagerskypePM.exe

==================== Registry (Whitelisted) ==================

HKLM...Run: [soundMan] - C:WINDOWSSOUNDMAN.EXE [69632 2004-09-16] (Realtek Semiconductor Corp.)

HKLM...Run: [iSUSPM Startup] - C:Program FilesCommon FilesInstallShieldUpdateServiceisuspm.exe [249856 2005-08-11] (Macrovision Corporation)

HKLM...Run: [iSUSScheduler] - C:Program FilesCommon FilesInstallShieldUpdateServiceissch.exe [81920 2005-08-11] (Macrovision Corporation)

HKLM...Run: [GrooveMonitor] - C:Program FilesMicrosoft OfficeOffice12GrooveMonitor.exe [31072 2008-10-25] (Microsoft Corporation)

HKLM...Run: [] - [X]

HKLM...Run: [HPUsageTrackingLEDM] - C:Program FilesHPHP UT LEDMbinhppusg.exe [30264 2009-08-04] (Hewlett-Packard Company)

HKLM...Run: [brStsMon00] - C:Program FilesBrowny02BrotherBrStMonW.exe [2621440 2010-06-10] (Brother Industries, Ltd.)

HKLM...Run: [CanonMyPrinter] - C:Program FilesCanonMyPrinterBJMyPrt.exe [1848648 2009-07-07] (CANON INC.)

HKUS-1-5-21-790525478-1757981266-725345543-1004...Run: [Google Update] - C:Documents and SettingsGMarinovLocal SettingsApplication DataGoogleUpdateGoogleUpdate.exe [136176 2011-05-30] (Google Inc.)

HKUS-1-5-21-790525478-1757981266-725345543-1004...Run: [skype] - C:Program FilesSkypePhoneSkype.exe [21633320 2008-11-07] (Skype Technologies S.A.)