Премини към съдържанието
Форумът в приложение

По-лесно сърфиране. Научи повече.
Kaldata.com - Форуми

Приложение на форума на цял екран с push известия, значки и други.

За да инсталирате това приложение на iOS и iPadOS
  1. Докоснете Иконата за споделяне в Safari
  2. Превъртете менюто и докоснете Добавяне към началния екран.
  3. Докоснете Добавяне в горния десен ъгъл.
За да инсталирате това приложение на Android
  1. Докоснете менюто с 3 точки (⋮) в горния десен ъгъл на браузъра.
  2. Докоснете Добавяне към началния екран или Инсталиране на приложение.
  3. Потвърдете, като докоснете Инсталиране.
Добави Kaldata.com в предпочитани източници в Google

Добре дошли!

Добре дошли в нашите форуми, пълни с полезна информация. Имате проблем с компютъра или телефона си? Публикувайте нова тема и ще намерите решение на всичките си проблеми. Общувайте свободно и открийте безброй нови приятели.

Моля, регистрирайте се за да публикувате тема и да получите пълен достъп до всички функции.

 

323.exe и Trojan horse Generic_c и става по зле

Heart Of The Swarm
в Премахване на зловреден софтуер

Featured Replies

Сичко трагна от една програма уж чиста стартираси eхето АВГ нищо неказа си викам за са добре нямаше някакви признаци на вирус до днешното стартиране направих един скан с нея под SAVE MOD и ето лога :

 

AVG 2014 AntiVirus command line scanner
Copyright © 1992 - 2013 AVG Technologies
Program version 2014.0.4830, engine 2014.0.4365
Virus Database: Version 4365/10593 2015-09-07
C:\Documents and Settings\Adnimistrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Locked file. Not scanned. is OK.
C:\Documents and Settings\Adnimistrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Locked file. Not scanned. is OK.
C:\Documents and Settings\Adnimistrator\NTUSER.DAT Locked file. Not scanned. is OK.
C:\Documents and Settings\Adnimistrator\ntuser.dat.LOG Locked file. Not scanned. is OK.
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\6T4D379U\ Locked file. Not scanned. is OK.
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini Locked file. Not scanned. is OK.
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Locked file. Not scanned. is OK.
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\JZ8DGDNR\ Locked file. Not scanned. is OK.
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\K4QG5WVV\ Locked file. Not scanned. is OK.
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\KDLEMF0G\ Locked file. Not scanned. is OK.
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Locked file. Not scanned. is OK.
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Locked file. Not scanned. is OK.
C:\Documents and Settings\NetworkService\NTUSER.DAT Locked file. Not scanned. is OK.
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Locked file. Not scanned. is OK.
C:\pagefile.sys Locked file. Not scanned. is OK.
C:\System Volume Information\ Locked file. Not scanned. is OK.
C:\WINDOWS\system32\config\default Locked file. Not scanned. is OK.
C:\WINDOWS\system32\config\default.LOG Locked file. Not scanned. is OK.
C:\WINDOWS\system32\config\SAM Locked file. Not scanned. is OK.
C:\WINDOWS\system32\config\SAM.LOG Locked file. Not scanned. is OK.
C:\WINDOWS\system32\config\SECURITY Locked file. Not scanned. is OK.
C:\WINDOWS\system32\config\SECURITY.LOG Locked file. Not scanned. is OK.
C:\WINDOWS\system32\config\software Locked file. Not scanned. is OK.
C:\WINDOWS\system32\config\software.LOG Locked file. Not scanned. is OK.
C:\WINDOWS\system32\config\system Locked file. Not scanned. is OK.
C:\WINDOWS\system32\config\system.LOG Locked file. Not scanned. is OK.

------------------------------------------------------------
Test started: 7.9.2015 19:26:07
Duration of test: 30 minute(s) 40 second(s)
------------------------------------------------------------
Objects scanned : 76633
Found infections : 26
Found high severity : 0
Found med severity : 0
Found info severity : 26
Fixed high severity : 0
Fixed med severity : 0
Fixed info severity : 0
------------------------------------------------------------

 

 

лог от FRST : 

 

 

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:07-09-2015
Ran by Adnimistrator (administrator) on SNAKE-45B7DC405 (07-09-2015 20:10:14)
Running from C:\Documents and Settings\Adnimistrator\My Documents
Loaded Profiles: Adnimistrator (Available Profiles: Adnimistrator & Administrator)
Platform: Microsoft Windows XP Professional Service Pack 3 (X86) Language: English (United States)
Internet Explorer Version 6 (Default browser: "C:\Program Files\Opera\Opera.exe" "%1")
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(IObit) C:\Program Files\IObit\Advanced SystemCare 5\ASCService.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2014\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2014\avgwdsvc.exe
(Apache Software Foundation) C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\Apache.exe
(Apache Software Foundation) C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\Apache.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2014\avgnsx.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2014\avgemcx.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
(NVIDIA Corporation) C:\WINDOWS\system32\nvsvc32.exe
(Microsoft Corporation) C:\WINDOWS\system32\rundll32.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2014\avgui.exe
(IObit) C:\Program Files\IObit\Advanced SystemCare 5\ASCTray.exe
() C:\Program Files\Pando Networks\Media Booster\PMB.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
() C:\WINDOWS\Datecs\Flex2K.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2014\avgrsx.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2014\avgcsrvx.exe
(Microsoft Corporation) C:\WINDOWS\system32\taskmgr.exe
(Microsoft Corporation) C:\WINDOWS\system32\wscntfy.exe
(Opera Software) C:\Program Files\Opera\opera.exe


==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [NvCplDaemon] => RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
HKLM\...\Run: [nwiz] => nwiz.exe /install
HKLM\...\Run: [NvMediaCenter] => RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
HKLM\...\Run: [RTHDCPL] => C:\WINDOWS\RTHDCPL.EXE [16855552 2007-10-16] (Realtek Semiconductor Corp.)
HKLM\...\Run: [skyTel] => C:\WINDOWS\SkyTel.EXE [1826816 2007-10-11] (Realtek Semiconductor Corp.)
HKLM\...\Run: [Alcmtr] => C:\WINDOWS\ALCMTR.EXE [69632 2005-05-03] (Realtek Semiconductor Corp.)
HKLM\...\Run: [AVG_UI] => C:\Program Files\AVG\AVG2014\avgui.exe [5212072 2015-07-29] (AVG Technologies CZ, s.r.o.)
HKU\S-1-5-21-527237240-2052111302-839522115-1003\...\Run: [Advanced SystemCare 5] => C:\Program Files\IObit\Advanced SystemCare 5\ASCTray.exe [620376 2011-12-29] (IObit)
HKU\S-1-5-21-527237240-2052111302-839522115-1003\...\Run: [Pando Media Booster] => C:\Program Files\Pando Networks\Media Booster\PMB.exe [3093624 2014-01-30] ()
HKU\S-1-5-21-527237240-2052111302-839522115-1003\...\Run: [AVG-Secure-Search-Update_0214c] => C:\Documents and Settings\Adnimistrator\Application Data\AVG 0214c Campaign\AVG-Secure-Search-Update-0214c.exe /PROMPT /mid=735d401eb98947d29004d1a90b4cfbea-8c5658c4bab55624c9cad81424e966c0f9e6dc34 /C (the data entry has 10 more characters).
HKU\S-1-5-21-527237240-2052111302-839522115-1003\...409d6c4515e9\InprocServer32: [Default-shell32] C:\Documents and Settings\Adnimistrator\Local Settings\Application Data\YmcPack\gzjjizlj.dllATTENTION! ====> ZeroAccess?
Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk [2014-01-25]
ShortcutTarget: Adobe Reader Speed Launch.lnk -> C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated)
Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\FlexType 2K.lnk [2014-01-30]
ShortcutTarget: FlexType 2K.lnk -> C:\WINDOWS\Datecs\Flex2K.exe ()
GroupPolicyScripts: Group Policy detected <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 84.238.242.1
Tcpip\..\Interfaces\{8DC8699D-5E9B-4F3A-B04F-46DAD2B5E1DF}: [DhcpNameServer] 84.238.242.1

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
HKU\S-1-5-21-527237240-2052111302-839522115-1003\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://www.google.bg/?gfe_rd=cr&ei=ybyJVOvVKYuu8welz4KgAQ&gws_rd=ssl
HKU\S-1-5-21-527237240-2052111302-839522115-1003\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
URLSearchHook: HKU\S-1-5-21-527237240-2052111302-839522115-1003 - Microsoft Url Search Hook - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\WINDOWS\system32\shdocvw.dll (Microsoft Corporation)
SearchScopes: HKLM -> DefaultScope value is missing
BHO: AcroIEHlprObj Class -> {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -> C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2004-12-14] (Adobe Systems Incorporated)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll [2013-02-26] (Skype Technologies)

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF32_12_0_0_43.dll [2014-01-30] ()
FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-30] (Microsoft Corporation)
FF Plugin: @pandonetworks.com/PandoWebPlugin -> C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll [2014-01-30] (Pando Networks)
FF Plugin: @real.com/nppl3260;version=6.0.12.69 -> C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll [2008-09-10] (RealNetworks, Inc.)
FF Plugin: @real.com/nprpjplug;version=6.0.12.69 -> C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll [2008-09-10] (RealNetworks, Inc.)
FF Plugin HKU\S-1-5-21-527237240-2052111302-839522115-1003: pandonetworks.com/PandoWebPlugin -> C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll [2014-01-30] (Pando Networks)
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2014-01-30]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AdvancedSystemCareService5; C:\Program Files\IObit\Advanced SystemCare 5\ASCService.exe [497496 2011-12-29] (IObit)
R2 AVGIDSAgent; C:\Program Files\AVG\AVG2014\avgidsagent.exe [3259304 2015-07-29] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files\AVG\AVG2014\avgwdsvc.exe [301896 2015-07-29] (AVG Technologies CZ, s.r.o.)
R2 ForcewareWebInterface; C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe [20543 2006-04-13] (Apache Software Foundation) [File not signed]
S2 MBAMScheduler; C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2015-06-18] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation)
R2 nSvcIp; C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe [135221 2006-11-27] (NVIDIA Corporation) [File not signed]
R2 nSvcLog; C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe [65593 2006-11-27] (NVIDIA Corporation) [File not signed]
S2 SkypeUpdate; "C:\Program Files\Skype\Updater\Updater.exe" [X]

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R1 AmdK8; C:\WINDOWS\System32\DRIVERS\AmdK8.sys [36864 2006-07-01] (Advanced Micro Devices)
R1 Avgdiskx; C:\WINDOWS\System32\DRIVERS\avgdiskx.sys [121624 2014-06-30] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriverl; C:\WINDOWS\System32\DRIVERS\avgidsdriverlx.sys [191256 2014-07-21] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHX; C:\WINDOWS\System32\DRIVERS\avgidshx.sys [179680 2015-05-26] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSShim; C:\WINDOWS\System32\DRIVERS\avgidsshimx.sys [31664 2015-07-29] (AVG Technologies CZ, s.r.o.)
R1 Avgldx86; C:\WINDOWS\System32\DRIVERS\avgldx86.sys [189720 2014-10-24] (AVG Technologies CZ, s.r.o.)
R0 Avglogx; C:\WINDOWS\System32\DRIVERS\avglogx.sys [271840 2015-05-26] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx86; C:\WINDOWS\System32\DRIVERS\avgmfx86.sys [161248 2015-05-26] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx86; C:\WINDOWS\System32\DRIVERS\avgrkx86.sys [27416 2014-06-17] (AVG Technologies CZ, s.r.o.)
R1 Avgtdix; C:\WINDOWS\System32\DRIVERS\avgtdix.sys [206304 2015-05-18] (AVG Technologies CZ, s.r.o.)
R1 BIOS; C:\WINDOWS\system32\drivers\BIOS.sys [13696 2005-03-16] (BIOSTAR Group) [File not signed]
R1 dtsoftbus01; C:\WINDOWS\System32\DRIVERS\dtsoftbus01.sys [243128 2014-01-30] (Disc Soft Ltd)
R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [23256 2015-06-18] (Malwarebytes Corporation)
S3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [98520 2015-09-07] (Malwarebytes Corporation)
R0 nvata; C:\WINDOWS\System32\DRIVERS\nvata.sys [105472 2006-10-18] (NVIDIA Corporation)
R3 NVENETFD; C:\WINDOWS\System32\DRIVERS\NVENETFD.sys [58368 2006-11-27] (NVIDIA Corporation)
R3 nvnetbus; C:\WINDOWS\System32\DRIVERS\nvnetbus.sys [19968 2006-11-27] (NVIDIA Corporation)
S4 IntelIde; no ImagePath
U5 ScsiPort; C:\WINDOWS\system32\drivers\scsiport.sys [96384 2008-04-14] (Microsoft Corporation)
U1 WS2IFSL; no ImagePath

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-09-07 20:10 - 2015-09-07 20:10 - 00011322 _____ C:\Documents and Settings\Adnimistrator\My Documents\FRST.txt
2015-09-07 20:10 - 2015-09-07 20:10 - 00000000 ____D C:\FRST
2015-09-07 20:09 - 2015-09-07 20:09 - 01692160 _____ (Farbar) C:\Documents and Settings\Adnimistrator\My Documents\FRST.exe
2015-09-07 20:03 - 2015-09-07 19:56 - 00003210 _____ C:\Documents and Settings\Adnimistrator\Desktop\Копие от avgrep.txt
2015-09-07 19:26 - 2015-09-07 19:56 - 00003210 _____ C:\Documents and Settings\Adnimistrator\Desktop\avgrep.txt
2015-09-07 19:13 - 2015-09-07 19:13 - 00000000 ____D C:\Documents and Settings\Administrator\Local Settings\Application Data\Opera
2015-09-07 19:13 - 2015-09-07 19:13 - 00000000 ____D C:\Documents and Settings\Administrator\Application Data\Opera
2015-09-07 19:12 - 2015-09-07 19:12 - 00000000 ____D C:\Documents and Settings\Administrator\Application Data\IObit
2015-09-07 19:11 - 2015-09-07 19:12 - 00000000 ____D C:\Documents and Settings\Administrator\Local Settings\Temp
2015-09-07 19:11 - 2015-09-07 19:11 - 00000020 ___SH C:\Documents and Settings\Administrator\ntuser.ini
2015-09-07 19:11 - 2015-09-07 19:11 - 00000000 ____D C:\Documents and Settings\Administrator
2015-09-07 19:11 - 2014-03-06 22:02 - 00000000 ____D C:\Documents and Settings\Administrator\Application Data\TuneUp Software
2015-09-07 19:11 - 2014-01-25 00:15 - 00001599 _____ C:\Documents and Settings\Administrator\Start Menu\Programs\Remote Assistance.lnk
2015-09-07 19:11 - 2014-01-25 00:15 - 00000792 _____ C:\Documents and Settings\Administrator\Start Menu\Programs\Windows Media Player.lnk
2015-09-07 19:11 - 2014-01-25 00:15 - 00000000 ___RD C:\Documents and Settings\Administrator\Start Menu\Programs\Accessories
2015-09-07 02:49 - 2015-09-07 02:49 - 00545775 _____ C:\Documents and Settings\Adnimistrator\My Documents\mojebi sazdava waypoint za podbot.rar
2015-09-07 01:46 - 2015-09-07 01:46 - 02070900 _____ C:\Documents and Settings\Adnimistrator\My Documents\realbot_ai_release_3.rar
2015-09-07 00:46 - 2015-09-07 00:48 - 02816121 _____ C:\Documents and Settings\Adnimistrator\My Documents\awp crysis.zip
2015-09-07 00:12 - 2015-09-07 00:12 - 00932385 _____ C:\Documents and Settings\Adnimistrator\My Documents\usp2.rar
2015-09-07 00:01 - 2015-09-07 00:01 - 01598427 _____ C:\Documents and Settings\Adnimistrator\My Documents\usp.rar
2015-09-06 23:29 - 2015-09-06 23:29 - 00535905 _____ C:\Documents and Settings\Adnimistrator\My Documents\nemskip228.rar
2015-09-06 23:21 - 2015-09-06 23:21 - 01688811 _____ C:\Documents and Settings\Adnimistrator\My Documents\p228.rar
2015-09-06 23:10 - 2015-09-06 23:15 - 01918566 _____ C:\Documents and Settings\Adnimistrator\My Documents\glok18.rar
2015-09-06 23:01 - 2015-09-07 19:07 - 00000000 ____D C:\Documents and Settings\Adnimistrator\Local Settings\Application Data\YmcPack
2015-09-06 22:36 - 2015-09-06 22:36 - 02657035 _____ C:\Documents and Settings\Adnimistrator\My Documents\TMP2.zip
2015-09-06 02:44 - 2015-09-06 02:44 - 00444533 _____ C:\Documents and Settings\Adnimistrator\My Documents\MP5.rar
2015-09-06 02:35 - 2015-09-06 02:35 - 03607196 _____ C:\Documents and Settings\Adnimistrator\My Documents\TMP.7z
2015-09-06 02:24 - 2015-09-06 02:24 - 02242428 _____ C:\Documents and Settings\Adnimistrator\My Documents\uzi glok.rar
2015-09-06 02:19 - 2015-09-06 02:19 - 02038432 _____ C:\Documents and Settings\Adnimistrator\My Documents\uzi.rar
2015-09-06 00:43 - 2015-09-06 01:55 - 00000000 ____D C:\Documents and Settings\Adnimistrator\My Documents\aaaaaaa
2015-09-05 23:48 - 2015-09-05 23:48 - 01426847 _____ C:\Documents and Settings\Adnimistrator\My Documents\wereweolf_black.rar
2015-09-05 23:45 - 2015-09-05 23:46 - 01368310 _____ C:\Documents and Settings\Adnimistrator\My Documents\adolf_hitler_2.zip
2015-09-05 23:35 - 2015-09-05 23:36 - 08544403 _____ C:\Documents and Settings\Adnimistrator\My Documents\ct pack.rar
2015-09-05 23:15 - 2015-09-05 23:15 - 00642756 _____ C:\Documents and Settings\Adnimistrator\My Documents\m3 weapon.rar
2015-09-05 03:19 - 2015-09-05 03:19 - 00683602 _____ C:\Documents and Settings\Adnimistrator\My Documents\minigun_10.rar
2015-09-05 02:36 - 2015-09-05 02:36 - 00650143 _____ C:\Documents and Settings\Adnimistrator\My Documents\qko knifar4e.rar
2015-09-04 01:38 - 2015-09-04 01:38 - 00022703 _____ C:\Documents and Settings\Adnimistrator\My Documents\mina.rar
2015-09-02 22:49 - 2015-09-02 22:49 - 00001962 _____ C:\Documents and Settings\Adnimistrator\My Documents\shot_light.sma
2015-08-31 21:51 - 2015-09-03 00:16 - 00000000 ____D C:\Documents and Settings\Adnimistrator\My Documents\experiment
2015-08-31 03:55 - 2015-08-31 04:08 - 00000023 _____ C:\WINDOWS\msModelInfo.INI
2015-08-31 00:57 - 2015-09-03 01:31 - 00000000 ____D C:\Documents and Settings\Adnimistrator\My Documents\2
2015-08-30 03:51 - 2015-09-06 01:54 - 00000000 ____D C:\Documents and Settings\Adnimistrator\My Documents\m249
2015-08-30 03:47 - 2010-07-24 15:43 - 01442232 _____ C:\Documents and Settings\Adnimistrator\My Documents\backweapons.mdl
2015-08-30 03:07 - 2015-08-30 03:40 - 01388759 _____ C:\Documents and Settings\Adnimistrator\My Documents\BackWeapons.zip
2015-08-28 22:32 - 2015-08-28 22:32 - 00000000 ____D C:\WINDOWS\ERUNT
2015-08-28 00:03 - 2015-08-28 00:03 - 00000008 __RSH C:\Documents and Settings\All Users\ntuser.pol
2015-08-28 00:03 - 2015-08-28 00:03 - 00000008 __RSH C:\Documents and Settings\Adnimistrator\ntuser.pol
2015-08-27 01:09 - 2015-09-07 19:16 - 00098520 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2015-08-27 01:09 - 2015-08-27 01:09 - 00000777 _____ C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
2015-08-27 01:09 - 2015-08-27 01:09 - 00000000 ____D C:\Program Files\Malwarebytes Anti-Malware
2015-08-27 01:09 - 2015-08-27 01:09 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Malwarebytes
2015-08-27 01:09 - 2015-06-18 08:41 - 00121560 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2015-08-27 01:09 - 2015-06-18 08:41 - 00023256 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2015-08-26 03:22 - 2015-08-26 03:22 - 00012100 _____ C:\Documents and Settings\Adnimistrator\My Documents\CS 1.6 WH (Wall Hack).rar
2015-08-23 21:27 - 2015-08-23 21:32 - 00001148 _____ C:\Documents and Settings\Adnimistrator\My Documents\Less Recoil For AK47 by Thug.rar

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-09-07 20:10 - 2014-01-30 21:19 - 00000000 ____D C:\Documents and Settings\Adnimistrator\Local Settings\Application Data\PMB Files
2015-09-07 20:10 - 2014-01-25 00:21 - 00000000 ____D C:\Documents and Settings\Adnimistrator\Local Settings\Temp
2015-09-07 20:05 - 2015-06-03 02:10 - 00000306 _____ C:\WINDOWS\Tasks\ASC5_AutoClean.job
2015-09-07 20:05 - 2014-01-25 00:14 - 01415386 _____ C:\WINDOWS\WindowsUpdate.log
2015-09-07 20:04 - 2014-05-21 21:57 - 00000159 _____ C:\WINDOWS\wiadebug.log
2015-09-07 20:04 - 2014-05-21 21:57 - 00000052 _____ C:\WINDOWS\wiaservc.log
2015-09-07 20:04 - 2014-01-25 00:30 - 00000000 _____ C:\WINDOWS\system32\nvapps.xml
2015-09-07 20:04 - 2014-01-25 00:29 - 00000000 _____ C:\WINDOWS\system32\nmp.log
2015-09-07 20:04 - 2014-01-25 00:18 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2015-09-07 19:08 - 2014-12-26 00:56 - 00000000 ___HD C:\WINDOWS\system32\GroupPolicy
2015-09-07 19:04 - 2014-01-25 00:21 - 00000178 ___SH C:\Documents and Settings\Adnimistrator\ntuser.ini
2015-09-07 19:04 - 2014-01-25 00:18 - 00032518 _____ C:\WINDOWS\SchedLgU.Txt
2015-09-07 19:01 - 2014-01-29 21:07 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\AVG2014
2015-09-07 19:01 - 2014-01-27 20:47 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\MFAData
2015-09-07 01:15 - 2014-08-21 21:38 - 00000000 ____D C:\Documents and Settings\Adnimistrator\Desktop\decal
2015-09-04 23:58 - 2014-01-30 23:16 - 00000000 ____D C:\Documents and Settings\Adnimistrator\Application Data\Skype
2015-09-04 23:26 - 2014-02-11 22:44 - 00000000 ____D C:\Documents and Settings\Adnimistrator\Desktop\StarCraftBroodWar
2015-09-04 22:23 - 2014-04-02 21:05 - 00002265 _____ C:\Documents and Settings\All Users\Desktop\Skype.lnk
2015-09-02 21:47 - 2014-01-27 20:40 - 00004206 _____ C:\Documents and Settings\Adnimistrator\Desktop\StarCraft II Heart of the Swarm.txt
2015-09-02 19:26 - 2001-08-23 18:00 - 00002206 _____ C:\WINDOWS\system32\wpa.dbl
2015-08-28 23:26 - 2014-01-25 00:13 - 00000000 ____D C:\WINDOWS\system32\Restore
2015-08-28 00:03 - 2014-01-25 00:21 - 00000000 ____D C:\Documents and Settings\Adnimistrator
2015-08-27 23:04 - 2015-05-30 03:33 - 00006459 _____ C:\Documents and Settings\Adnimistrator\Desktop\z4.txt
2015-08-27 02:21 - 2014-01-25 01:53 - 00000000 ____D C:\WINDOWS\Help
2015-08-25 00:32 - 2014-06-18 19:58 - 00069312 _____ C:\WINDOWS\setupapi.log
2015-08-11 22:29 - 2014-04-01 21:27 - 00000000 ____D C:\Documents and Settings\All Users\Start Menu\Programs\AVG
2015-08-11 22:29 - 2014-01-29 21:07 - 00000702 _____ C:\Documents and Settings\All Users\Desktop\AVG 2014.lnk

==================== Files in the root of some directories =======

2014-07-08 20:07 - 2014-07-08 20:07 - 0000016 ___RH () C:\Documents and Settings\Adnimistrator\Local Settings\Application Data\107EB065.ini
2014-04-18 22:01 - 2015-04-08 22:02 - 0010752 _____ () C:\Documents and Settings\Adnimistrator\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

==================== End of FRST.txt ============================

 

 

 

 

и лог от Addition :

 

 

Additional scan result of Farbar Recovery Scan Tool (x86) Version:07-09-2015
Ran by Adnimistrator (2015-09-07 20:10:51)
Running from C:\Documents and Settings\Adnimistrator\My Documents
Microsoft Windows XP Professional Service Pack 3 (X86) (2014-01-24 21:17:19)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-527237240-2052111302-839522115-500 - Administrator - Enabled) => %SystemDrive%\Documents and Settings\Administrator
Adnimistrator (S-1-5-21-527237240-2052111302-839522115-1003 - Administrator - Enabled) => %SystemDrive%\Documents and Settings\Adnimistrator
Guest (S-1-5-21-527237240-2052111302-839522115-501 - Limited - Disabled)
HelpAssistant (S-1-5-21-527237240-2052111302-839522115-1000 - Limited - Disabled)
SUPPORT_388945a0 (S-1-5-21-527237240-2052111302-839522115-1002 - Limited - Disabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: AVG AntiVirus Free Edition 2014 (Enabled - Up to date) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

µTorrent (HKU\S-1-5-21-527237240-2052111302-839522115-1003\...\uTorrent) (Version: 3.3.2.30446 - BitTorrent Inc.)
Adobe Flash Player 12 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 12.0.0.43 - Adobe Systems Incorporated)
Adobe Reader 7.0 (HKLM\...\{AC76BA86-7AD7-1033-7646-A70000000000}) (Version: 7.0.0 - Adobe Systems Incorporated)
Advanced SystemCare 5 (HKLM\...\Advanced SystemCare 5_is1) (Version: 5.1.0 - IObit)
AVG 2014 (HKLM\...\AVG) (Version: 2014.0.4830 - AVG Technologies)
AVG 2014 (Version: 14.0.4235 - AVG Technologies) Hidden
AVG 2014 (Version: 14.0.4365 - AVG Technologies) Hidden
AVG 2014 (Version: 14.0.4830 - AVG Technologies) Hidden
BSPViewer 1.5.6 (HKLM\...\BSPViewer_is1) (Version: - Ryan Gregg)
DAEMON Tools Lite (HKLM\...\DAEMON Tools Lite) (Version: 4.48.1.0347 - Disc Soft Ltd)
FlexType 2K (HKLM\...\FlexType 2K) (Version: - )
High Definition Audio Driver Package - KB888111 (HKLM\...\KB888111WXPSP2) (Version: 20040219.000000 - Microsoft Corporation)
Jed's Half-Life Model Viewer 1.3.6 (HKLM\...\Jed's Half-Life Model Viewer) (Version: 1.3.6 - wunderboy.org)
K-Lite Mega Codec Pack 5.1.0 (HKLM\...\KLiteCodecPack_is1) (Version: 5.1.0 - )
Malwarebytes Anti-Malware, версия 2.1.8.1057 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.8.1057 - Malwarebytes Corporation)
Microsoft .NET Framework 2.0 Service Pack 2 (HKLM\...\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}) (Version: 2.2.30729 - Microsoft Corporation)
Microsoft .NET Framework 3.0 Service Pack 2 (HKLM\...\{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}) (Version: 3.2.30729 - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version: - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
MilkShape 3D 1.8.4 (HKLM\...\MilkShape 3D 1.8.4) (Version: 1.8.4 - chUmbaLum sOft)
MSXML 4.0 SP3 Parser (HKLM\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: - )
NVIDIA ForceWare Network Access Manager (HKLM\...\InstallShield_{1F6423DE-7959-4178-80E0-023C7EAA5347}) (Version: 2.03.6548 - NVIDIA Corporation)
Opera 12.16 (HKLM\...\Opera 12.16.1860) (Version: 12.16.1860 - Opera Software ASA)
Pando Media Booster (HKLM\...\{980A182F-E0A2-4A40-94C1-AE0C1235902E}) (Version: - Pando Networks Inc.)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 5.10.0.5497 - Realtek Semiconductor Corp.)
Retribution (HKLM\...\Retribution) (Version: - )
Skype™ 6.14 (HKLM\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.14.104 - Skype Technologies S.A.)
Sledge Editor (HKLM\...\SledgeEditor) (Version: - )
Sprite Explorer 2.12 (HKLM\...\Sprite Explorer_is1) (Version: - Wrench Software)
Starcraft (HKLM\...\Starcraft) (Version: - )
StarCraft 2 - Wings of Liberty (HKLM\...\{0281213F-4FFE-40DB-B8D6-535FAC37E329}_is1) (Version: - )
The KMPlayer 2.9.4.1435 (CUDA+DXVA) (HKLM\...\The KMPlayer 2.9.4.1435 (CUDA+DXVA)_is1) (Version: - ©7sh3. [Сборка от 01.03.2010])
Valve Hammer Editor (HKLM\...\Valve Hammer Editor) (Version: - )
Visual Studio 2012 x86 Redistributables (HKLM\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
WebFldrs XP (Version: 9.50.7523 - Microsoft Corporation) Hidden
Windows Driver Package - Advanced Micro Devices (AmdK8) Processor (05/27/2006 1.3.2.0) (HKLM\...\53F13DB4D9611FD63BE580F06F0729BF236ABE68) (Version: 05/27/2006 1.3.2.0 - Advanced Micro Devices)
Windows XP Service Pack 3 (HKLM\...\Windows XP Service Pack) (Version: 20080414.031525 - Microsoft Corporation)
WinRAR 5.01 (32-битова версия) (HKLM\...\WinRAR archiver) (Version: 5.01.0 - win.rar GmbH)
Пакет за езиков интерфейс на Windows (HKLM\...\{787A0869-88F7-49CA-A762-1166A0F358B1}) (Version: 2.1.0.2600 - Microsoft Corporation)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-527237240-2052111302-839522115-1003_Classes\CLSID\{31261F21-2B16-45EE-BEAB-07C4CFA18B65}\InprocServer32 -> C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
CustomCLSID: HKU\S-1-5-21-527237240-2052111302-839522115-1003_Classes\CLSID\{FBEB8A05-BEEE-4442-804E-409D6C4515E9}\InprocServer32 -> C:\Documents and Settings\Adnimistrator\Local Settings\Application Data\YmcPack\gzjjizlj.dll No File

==================== Restore Points =========================

28-08-2015 23:26:12 Контролна точка на системата
30-08-2015 23:54:37 Контролна точка на системата
05-09-2015 22:50:31 Контролна точка на системата

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2001-08-23 18:00 - 2001-08-23 18:00 - 00000734 ____A C:\WINDOWS\system32\Drivers\etc\hosts
127.0.0.1 localhost

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\WINDOWS\Tasks\ASC5_AutoCare.job => C:\Program Files\IObit\Advanced SystemCare 5\AutoCare.exe
Task: C:\WINDOWS\Tasks\ASC5_AutoClean.job => C:\Program Files\IObit\Advanced SystemCare 5\AutoSweep.exe

==================== Loaded Modules (Whitelisted) ==============

2014-01-29 23:28 - 2011-04-21 17:54 - 00347024 _____ () C:\Program Files\IObit\Advanced SystemCare 5\madExcept_.bpl
2014-01-29 23:28 - 2011-04-21 17:54 - 00179088 _____ () C:\Program Files\IObit\Advanced SystemCare 5\madBasic_.bpl
2014-01-29 23:28 - 2011-04-21 17:54 - 00046480 _____ () C:\Program Files\IObit\Advanced SystemCare 5\madDisAsm_.bpl
2006-04-13 16:14 - 2006-04-13 16:14 - 00024691 _____ () C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\modules\mod_auth.so
2006-04-13 16:14 - 2006-04-13 16:14 - 00159744 _____ () C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\SSLEAY32.dll
2006-04-13 16:14 - 2006-04-13 16:14 - 00876544 _____ () C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\LIBEAY32.dll
2014-01-30 21:21 - 2000-12-13 01:55 - 00028672 _____ () C:\WINDOWS\system32\newdll.dll
2006-10-31 15:35 - 2006-10-31 15:35 - 00196608 _____ () C:\WINDOWS\system32\nvapi.dll
2006-10-31 15:35 - 2006-10-31 15:35 - 00466944 _____ () C:\WINDOWS\system32\nvshell.dll
2014-01-30 21:19 - 2014-01-30 21:20 - 03093624 _____ () C:\Program Files\Pando Networks\Media Booster\PMB.exe
2014-01-30 21:21 - 2000-12-30 13:39 - 00151552 _____ () C:\WINDOWS\Datecs\Flex2K.exe
2004-08-04 01:56 - 2008-04-14 06:41 - 00059904 _____ () C:\WINDOWS\system32\devenum.dll
2004-08-04 01:56 - 2008-04-14 06:42 - 00014336 _____ () C:\WINDOWS\system32\msdmo.dll
2014-01-30 21:14 - 2014-01-30 21:14 - 16287624 _____ () C:\WINDOWS\system32\Macromed\Flash\NPSWF32_12_0_0_43.dll
2014-09-17 22:42 - 2014-09-17 22:42 - 00835584 _____ () C:\Program Files\Opera\gstreamer\gstreamer.dll
2014-09-17 22:42 - 2014-09-17 22:42 - 00093696 _____ () C:\Program Files\Opera\gstreamer\plugins\gstaudioconvert.dll
2014-09-17 22:42 - 2014-09-17 22:42 - 00094208 _____ () C:\Program Files\Opera\gstreamer\plugins\gstaudioresample.dll
2014-09-17 22:42 - 2014-09-17 22:42 - 00057344 _____ () C:\Program Files\Opera\gstreamer\plugins\gstautodetect.dll
2014-09-17 22:42 - 2014-09-17 22:42 - 00096256 _____ () C:\Program Files\Opera\gstreamer\plugins\gstcoreplugins.dll
2014-09-17 22:42 - 2014-09-17 22:42 - 00062976 _____ () C:\Program Files\Opera\gstreamer\plugins\gstdecodebin2.dll
2014-09-17 22:42 - 2014-09-17 22:42 - 00067072 _____ () C:\Program Files\Opera\gstreamer\plugins\gstdirectsound.dll
2014-09-17 22:42 - 2014-09-17 22:42 - 00158208 _____ () C:\Program Files\Opera\gstreamer\plugins\gstffmpegcolorspace.dll
2014-09-17 22:42 - 2014-09-17 22:42 - 00312832 _____ () C:\Program Files\Opera\gstreamer\plugins\gstoggdec.dll
2014-09-17 22:42 - 2014-09-17 22:42 - 00038912 _____ () C:\Program Files\Opera\gstreamer\plugins\gstwaveform.dll
2014-09-17 22:42 - 2014-09-17 22:42 - 00073728 _____ () C:\Program Files\Opera\gstreamer\plugins\gstwavparse.dll
2014-09-17 22:42 - 2014-09-17 22:42 - 00101888 _____ () C:\Program Files\Opera\gstreamer\plugins\gstwebmdec.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" value will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMSwissArmy => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMSwissArmy => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{1a3e09be-1e45-494b-9174-d7385b45bbf5} => ""=""

==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-527237240-2052111302-839522115-1003\Control Panel\Desktop\\Wallpaper -> C:\Documents and Settings\Adnimistrator\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
DNS Servers: 84.238.242.1
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)


==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

DomainProfile\AuthorizedApplications: [C:\Program Files\Pando Networks\Media Booster\PMB.exe] => Enabled:Pando Media Booster
StandardProfile\AuthorizedApplications: [C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\Apache.exe] => Enabled:Apache HTTP Server
StandardProfile\AuthorizedApplications: [C:\Documents and Settings\Adnimistrator\Desktop\uTorrent.exe] => Enabled:µTorrent
StandardProfile\AuthorizedApplications: [C:\Program Files\uTorrent\uTorrent.exe] => Enabled:µTorrent
StandardProfile\AuthorizedApplications: [C:\Program Files\Pando Networks\Media Booster\PMB.exe] => Enabled:Pando Media Booster
StandardProfile\AuthorizedApplications: [C:\Documents and Settings\Adnimistrator\Desktop\StarCraftBroodWar\Counter-Strike 1.6\hl.exe] => Enabled:Half-Life Launcher
StandardProfile\AuthorizedApplications: [C:\Program Files\Skype\Phone\Skype.exe] => Enabled:Skype
StandardProfile\AuthorizedApplications: [C:\Documents and Settings\Adnimistrator\Desktop\StarCraftBroodWar\Counter-Strike 1.6\hlds.exe] => Enabled:HLDS Launcher
StandardProfile\AuthorizedApplications: [C:\Documents and Settings\Adnimistrator\Desktop\StarCraftBroodWar\CS1.6\cstrike.exe] => Enabled:Half-Life Launcher
StandardProfile\AuthorizedApplications: [C:\Documents and Settings\Adnimistrator\Desktop\StarCraftBroodWar\CS1.6\hlds.exe] => Enabled:HLDS Launcher
StandardProfile\AuthorizedApplications: [C:\Documents and Settings\Adnimistrator\Desktop\StarCraftBroodWar\CS1.6\hl.exe] => Enabled:Half-Life Launcher
StandardProfile\AuthorizedApplications: [C:\Documents and Settings\All Users\Application Data\Battle.net\Agent\Agent.1267\Agent.exe] => Enabled:Battle.net Update Agent
StandardProfile\AuthorizedApplications: [C:\Documents and Settings\All Users\Application Data\Battle.net\Agent\Agent.3182\Agent.exe] => Enabled:Battle.net Update Agent
StandardProfile\AuthorizedApplications: [C:\Program Files\StarCraft 2 - Wings of Liberty\Versions\Base15405\SC2.exe] => Enabled:StarCraft 2 - Wings of Liberty
StandardProfile\AuthorizedApplications: [C:\Program Files\AVG\AVG2014\avgmfapx.exe] => Enabled:AVG Installer
StandardProfile\AuthorizedApplications: [C:\Program Files\Opera\opera.exe] => Enabled:Opera Internet Browser
StandardProfile\AuthorizedApplications: [C:\Documents and Settings\Adnimistrator\Desktop\decal\cs\cstrike.exe] => Enabled:Half-Life Launcher
StandardProfile\AuthorizedApplications: [C:\Program Files\AVG\AVG2014\avgnsx.exe] => Enabled:Online Shield
StandardProfile\AuthorizedApplications: [C:\Program Files\AVG\AVG2014\avgdiagex.exe] => Enabled:AVG Diagnostics 2014
StandardProfile\AuthorizedApplications: [C:\Program Files\AVG\AVG2014\avgemcx.exe] => Enabled:Personal Email Scanner
DomainProfile\GloballyOpenPorts: [59054:TCP] => Enabled:Pando Media Booster
DomainProfile\GloballyOpenPorts: [59054:UDP] => Enabled:Pando Media Booster
DomainProfile\GloballyOpenPorts: [56500:TCP] => Enabled:Pando Media Booster
DomainProfile\GloballyOpenPorts: [56500:UDP] => Enabled:Pando Media Booster
StandardProfile\GloballyOpenPorts: [59054:TCP] => Enabled:Pando Media Booster
StandardProfile\GloballyOpenPorts: [59054:UDP] => Enabled:Pando Media Booster
StandardProfile\GloballyOpenPorts: [56500:TCP] => Enabled:Pando Media Booster
StandardProfile\GloballyOpenPorts: [56500:UDP] => Enabled:Pando Media Booster
StandardProfile\GloballyOpenPorts: [1900:UDP] => :LocalSubNet:Enabled:@xpsp2res.dll,-22007
StandardProfile\GloballyOpenPorts: [2869:TCP] => :LocalSubNet:Enabled:@xpsp2res.dll,-22008

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (08/31/2015 03:24:23 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Hanging application ms3d.exe, version 1.8.4.0, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Error: (08/31/2015 02:49:48 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Hanging application ms3d.exe, version 1.8.4.0, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Error: (08/31/2015 01:11:55 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Hanging application notepad.exe, version 5.1.2600.5512, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Error: (08/30/2015 12:34:47 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application hl.exe, version 1.1.1.1, faulting module unknown, version 0.0.0.0, fault address 0x090a81f2.
Processing media-specific event for [hl.exe!ws!]

Error: (08/27/2015 02:03:22 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application mbamscheduler.exe, version 3.1.3.0, faulting module unknown, version 0.0.0.0, fault address 0x0115a073.
Processing media-specific event for [mbamscheduler.exe!ws!]

Error: (08/25/2015 12:44:06 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application frst.exe, version 24.8.2015.0, faulting module frst.exe, version 24.8.2015.0, fault address 0x0002105e.
Processing media-specific event for [frst.exe!ws!]

Error: (06/08/2015 10:46:19 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application hlds.exe, version 4.1.1.1, faulting module unknown, version 0.0.0.0, fault address 0x43b954d3.
Processing media-specific event for [hlds.exe!ws!]

Error: (05/31/2015 12:17:44 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application ms3d.exe, version 1.8.4.0, faulting module ms3d.exe, version 1.8.4.0, fault address 0x000f6fc2.
Processing media-specific event for [ms3d.exe!ws!]

Error: (05/31/2015 12:15:36 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application ms3d.exe, version 1.8.4.0, faulting module ms3d.exe, version 1.8.4.0, fault address 0x000f6fc2.
Processing media-specific event for [ms3d.exe!ws!]

Error: (05/31/2015 12:14:52 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application ms3d.exe, version 1.8.4.0, faulting module ms3d.exe, version 1.8.4.0, fault address 0x000f6fc2.
Processing media-specific event for [ms3d.exe!ws!]


System errors:
=============
Error: (09/07/2015 08:05:35 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The MBAMScheduler service terminated unexpectedly. It has done this 1 time(s).

Error: (09/07/2015 08:00:45 PM) (Source: DCOM) (EventID: 10005) (User: SNAKE-45B7DC405)
Description: DCOM got error "%%1084" attempting to start the service StiSvc with arguments ""
in order to run the server:
{A1F4E726-8CF1-11D1-BF92-0060081ED811}

Error: (09/07/2015 07:58:12 PM) (Source: DCOM) (EventID: 10005) (User: SNAKE-45B7DC405)
Description: DCOM got error "%%1084" attempting to start the service StiSvc with arguments ""
in order to run the server:
{A1F4E726-8CF1-11D1-BF92-0060081ED811}

Error: (09/07/2015 07:47:35 PM) (Source: DCOM) (EventID: 10005) (User: SNAKE-45B7DC405)
Description: DCOM got error "%%1084" attempting to start the service StiSvc with arguments ""
in order to run the server:
{A1F4E726-8CF1-11D1-BF92-0060081ED811}

Error: (09/07/2015 07:26:18 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: The following boot-start or system-start driver(s) failed to load:
AFD
AmdK8
Avgdiskx
AVGIDSDriverl
AVGIDSShim
Avgldx86
Avgtdix
BIOS
Fips
IPSec
MRxSmb
NetBIOS
NetBT
RasAcd
Rdbss
Tcpip

Error: (09/07/2015 07:26:18 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error:
%%31

Error: (09/07/2015 07:26:18 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The Forceware Web Interface service depends on the AFD service which failed to start because of the following error:
%%31

Error: (09/07/2015 07:26:18 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The AVGIDSAgent service depends on the AVGIDSDriverl service which failed to start because of the following error:
%%31

Error: (09/07/2015 07:26:18 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The TCP/IP NetBIOS Helper service depends on the AFD service which failed to start because of the following error:
%%31

Error: (09/07/2015 07:26:18 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error:
%%31


Microsoft Office:
=========================
Error: (08/31/2015 03:24:23 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: ms3d.exe1.8.4.0hungapp0.0.0.000000000

Error: (08/31/2015 02:49:48 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: ms3d.exe1.8.4.0hungapp0.0.0.000000000

Error: (08/31/2015 01:11:55 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: notepad.exe5.1.2600.5512hungapp0.0.0.000000000

Error: (08/30/2015 12:34:47 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: hl.exe1.1.1.1unknown0.0.0.0090a81f2

Error: (08/27/2015 02:03:22 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: mbamscheduler.exe3.1.3.0unknown0.0.0.00115a073

Error: (08/25/2015 12:44:06 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: frst.exe24.8.2015.0frst.exe24.8.2015.00002105e

Error: (06/08/2015 10:46:19 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: hlds.exe4.1.1.1unknown0.0.0.043b954d3

Error: (05/31/2015 12:17:44 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: ms3d.exe1.8.4.0ms3d.exe1.8.4.0000f6fc2

Error: (05/31/2015 12:15:36 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: ms3d.exe1.8.4.0ms3d.exe1.8.4.0000f6fc2

Error: (05/31/2015 12:14:52 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: ms3d.exe1.8.4.0ms3d.exe1.8.4.0000f6fc2


==================== Memory info ===========================

Processor: AMD Athlon Processor LE-1600
Percentage of memory in use: 39%
Total physical RAM: 1790.48 MB
Available physical RAM: 1091.28 MB
Total Virtual: 4323.17 MB
Available Virtual: 3671.75 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:298.08 GB) (Free:273.57 GB) NTFS ==>[drive with boot components (Windows XP)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows XP) (Size: 298.1 GB) (Disk ID: 37544B85)
Partition 1: (Active) - (Size=298.1 GB) - (Type=07 NTFS)

==================== End of Addition.txt ============================

 

 

какво е според вас :/

какво е според вас :/

 

Казва се рууткит ZeroAccess..!

 

Не мога да разбера  как постоянно си заразявате системата.....??? Ще си отговоря сам...Поддръжката за Windows XP завърши на 8 април 2014 г.

 

Какво представлява прекратяването на поддръжката за Windows XP?

 

Освен това ви бях препоръчал в предната тема да направите някои неща,едно от които:

 

 

Обновете AVG 2014 с последната  AVG 2015 FREE - http://free.avg.com/.../free-downloads

 

В системата ви отново виждам AVG AntiVirus Free Edition 2014...Защо...? За последен път ще ви помогна...повече лапешки изпълнения няма да толерирам...не може всяка седмица да висите в подраздела и да искате помощ..тук никой не ви е длъжен...!

 

 

TDSSKiller_Kaspersky.pngСканиране с TDSSKiller

 

kaspersky.gif  Моля, изтеглете последната версия на TDSSKiller оттук и я запазете на вашия декстоп (задължително).

 

 

  • Кликнете на TDSSKiller.exe за да стартирате приложението
  • Натиснете бутона Start Scan.
  •  Не използвайте компютъра по време на сканирането
  •  Ако сканирането завърши с нищо не е намерено, щракнете върху Затвори, за да излезете.
  • Проверката не би трябвало да отмене повече от 2 минути.
  • Ако подозрителен обект бъде засечен, действието по подразбиране ще бъде Skip, кликнете върху Continue.
  • Ако зловредни обекти бъдат намерени, тогава от падащото меню ще имате три възможности.

    Бъдете сигурни, че избраното действие е Cure и натиснете върху Continue > Рестартирайте за да бъде завършена поправката.

    Забележка: Ако Cure бутона не е наличен от възможностите, тогава моля изберете Skip бутона, не избирайте Delete освен ако не сте инструктирани затова.

Лог файл ще бъде създаден в свободната директория на дял C: . Потърсете за лог с името "TDSSKiller.[Version]_[Date]_[Time]_log.txt" и копирайте съдържанието му в следващия си пост.

 

 

aA7bkRO.pngСканиране с aswMBR

 

 

1QYkxTZ.jpg Моля, изтеглете aswMBR и го запазете на вашия десктоп.

 

 

  • Кликнете  на  върху файла aswMBR.exe за да го стартирате.
  • Изчакайте да изтегли дефинициите на avast!
  • Изберете Scan бутона, за да започне проверката.
  • Когато проверката завърши, натиснете бутона save log, запазете съдържанието на лог файла на десктопа и публикувайте съдържанието му в следващия си коментар.

 

 

 

rendu2.pngИзтеглете RogueKiller и го запазете на десктопа.

Забележка: Трябва да изтеглите версия съвместима с вашата система.

  • RogueKiller.exe
  • RogueKillerX64.exe
  • Моля,затворете всички стартирани програми
  • Моля, изключете USB или външни дискове от компютъра, преди да стартирате това сканиране
  • Стартирайте RogueKiller.exe , изчакайте, докато Prescan приключи  и натиснете бутона SCAN.
  • Ще се създаде лог файл на десктопа с името RKreport.txt .
  • Публикувайте лог файла в следващия си пост.

     

     

    Дневници

     

    В следващия си отговор, моля да включите следните дневници:

     

  • TDSSKiller.[Version]_[Date]_[Time]_log.txt
  • Лог файл aswMBR
  • RKreport.txt
  • Автор

Първо компа е на повече от 8 години и как си представяте да му зложа по нов с последни актуализации неставайте смешен за да съм с XP си има причина ;) не си задавате правилните въпроси... все пак компа не е от стил "супер компютър" :/ 8 год ?>...

 

Лог TDSSKiller.log :

 

22:20:27.0203 0x0450 TDSS rootkit removing tool 3.1.0.5 Jul 24 2015 12:29:57
22:20:38.0781 0x0450 ============================================================
22:20:38.0781 0x0450 Current date / time: 2015/09/07 22:20:38.0781
22:20:38.0781 0x0450 SystemInfo:
22:20:38.0781 0x0450
22:20:38.0781 0x0450 OS Version: 5.1.2600 ServicePack: 3.0
22:20:38.0781 0x0450 Product type: Workstation
22:20:38.0781 0x0450 ComputerName: SNAKE-45B7DC405
22:20:38.0781 0x0450 UserName: Adnimistrator
22:20:38.0781 0x0450 Windows directory: C:\WINDOWS
22:20:38.0781 0x0450 System windows directory: C:\WINDOWS
22:20:38.0781 0x0450 Processor architecture: Intel x86
22:20:38.0781 0x0450 Number of processors: 1
22:20:38.0781 0x0450 Page size: 0x1000
22:20:38.0781 0x0450 Boot type: Normal boot
22:20:38.0781 0x0450 ============================================================
22:20:39.0015 0x0450 KLMD registered as C:\WINDOWS\system32\drivers\65043721.sys
22:20:39.0453 0x0450 System UUID: {CDCC11EE-297C-5D62-6E05-15484E003ADD}
22:20:40.0265 0x0450 Drive \Device\Harddisk0\DR0 - Size: 0x4A85D56000 ( 298.09 Gb ), SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050
22:20:40.0265 0x0450 ============================================================
22:20:40.0265 0x0450 \Device\Harddisk0\DR0:
22:20:40.0265 0x0450 MBR partitions:
22:20:40.0265 0x0450 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x254297C1
22:20:40.0265 0x0450 ============================================================
22:20:40.0296 0x0450 C: <-> \Device\Harddisk0\DR0\Partition1
22:20:40.0296 0x0450 ============================================================
22:20:40.0296 0x0450 Initialize success
22:20:40.0296 0x0450 ============================================================
22:21:15.0500 0x0f8c ============================================================
22:21:15.0500 0x0f8c Scan started
22:21:15.0500 0x0f8c Mode: Manual; SigCheck; TDLFS;
22:21:15.0500 0x0f8c ============================================================
22:21:15.0500 0x0f8c KSN ping started
22:21:36.0250 0x0f8c KSN ping finished: true
22:21:37.0046 0x0f8c ================ Scan system memory ========================
22:21:37.0046 0x0f8c System memory - ok
22:21:37.0046 0x0f8c ================ Scan services =============================
22:21:37.0125 0x0f8c Abiosdsk - ok
22:21:37.0125 0x0f8c abp480n5 - ok
22:21:37.0203 0x0f8c [ 8FD99680A539792A30E97944FDAECF17, 594F8E0C3695400B0C09A797AF6BDFAC6F750ECD67D0EE803914C572B1DCC43C ] ACPI C:\WINDOWS\system32\DRIVERS\ACPI.sys
22:21:37.0812 0x0f8c ACPI - ok
22:21:37.0859 0x0f8c [ 9859C0F6936E723E4892D7141B1327D5, 5E8F6A2FC4DF2E5E92A1D66ECC2810E08B42B64E9CD0DF4AD3F78EA8558B90AF ] ACPIEC C:\WINDOWS\system32\drivers\ACPIEC.sys
22:21:38.0015 0x0f8c ACPIEC - ok
22:21:38.0015 0x0f8c adpu160m - ok
22:21:38.0203 0x0f8c [ E410DA575FF48D976B41670C6D262A82, 97C12CA2FACB133319C5E41D5C75A9C18B579E9B547F5A4E0B0C0FD1DAB20C3E ] AdvancedSystemCareService5 C:\Program Files\IObit\Advanced SystemCare 5\ASCService.exe
22:21:38.0234 0x0f8c AdvancedSystemCareService5 - ok
22:21:38.0281 0x0f8c [ 8BED39E3C35D6A489438B8141717A557, 1B5796E56B0927360CE0759641B1151828BC0A9E45620D2B2D880491F5CE33D0 ] aec C:\WINDOWS\system32\drivers\aec.sys
22:21:38.0406 0x0f8c aec - ok
22:21:38.0421 0x0f8c [ 322D0E36693D6E24A2398BEE62A268CD, FB0BFF5846E50DBCC2826639318A6A1DE79EE7DEA2719ED74A5F6F44454E13D0 ] AFD C:\WINDOWS\System32\drivers\afd.sys
22:21:38.0546 0x0f8c AFD - ok
22:21:38.0546 0x0f8c Aha154x - ok
22:21:38.0546 0x0f8c aic78u2 - ok
22:21:38.0562 0x0f8c aic78xx - ok
22:21:38.0593 0x0f8c [ A9A3DAA780CA6C9671A19D52456705B4, 67C959144B57AE0BBF1D82DBED197F32CDB06FECD883A80C441A0202FE83FAB4 ] Alerter C:\WINDOWS\system32\alrsvc.dll
22:21:38.0703 0x0f8c Alerter - ok
22:21:38.0765 0x0f8c [ 8C515081584A38AA007909CD02020B3D, A5E13CA10F702928E0DE84C74D0EA8ACCB117FD76FBABC55220C75C4FFD596DC ] ALG C:\WINDOWS\System32\alg.exe
22:21:38.0906 0x0f8c ALG - ok
22:21:38.0906 0x0f8c AliIde - ok
22:21:38.0953 0x0f8c [ EFBB0956BAED786E137351B5CA272AEF, 613E34D31C21F5CA9AEDC4BF64B8EE365DA355F914738C4FD638DB3EBE75FBB5 ] AmdK8 C:\WINDOWS\system32\DRIVERS\AmdK8.sys
22:21:38.0984 0x0f8c AmdK8 - ok
22:21:38.0984 0x0f8c amsint - ok
22:21:39.0031 0x0f8c [ D8849F77C0B66226335A59D26CB4EDC6, 4990031453204C57E36E850252A39B05D6ECDAB9E71A8136FB4900F17E59C9CA ] AppMgmt C:\WINDOWS\System32\appmgmts.dll
22:21:39.0140 0x0f8c AppMgmt - ok
22:21:39.0156 0x0f8c asc - ok
22:21:39.0156 0x0f8c asc3350p - ok
22:21:39.0171 0x0f8c asc3550 - ok
22:21:39.0234 0x0f8c [ 0E5E4957549056E2BF2C49F4F6B601AD, F7F19FDC906B719A3516D30A9B4A2262C8CC5B36B94E3D4195C345EC4610FF2B ] aspnet_state C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
22:21:39.0265 0x0f8c aspnet_state - ok
22:21:39.0296 0x0f8c [ B153AFFAC761E7F5FCFA822B9C4E97BC, 7E60F572A6B3C6219E3C86225AA37243AFFD74337DB7F108B04778042E5CC959 ] AsyncMac C:\WINDOWS\system32\DRIVERS\asyncmac.sys
22:21:39.0406 0x0f8c AsyncMac - ok
22:21:39.0421 0x0f8c [ 9F3A2F5AA6875C72BF062C712CFA2674, B4DF1D2C56A593C6B54DE57395E3B51D288F547842893B32B0F59228A0CF70B9 ] atapi C:\WINDOWS\system32\DRIVERS\atapi.sys
22:21:39.0546 0x0f8c atapi - ok
22:21:39.0546 0x0f8c Atdisk - ok
22:21:39.0656 0x0f8c [ 9916C1225104BA14794209CFA8012159, 5D6F05F715C52A16D05CAE15C3DFE77A139A7F27F7AE710EC9A10F9EE05115A1 ] Atmarpc C:\WINDOWS\system32\DRIVERS\atmarpc.sys
22:21:39.0765 0x0f8c Atmarpc - ok
22:21:39.0796 0x0f8c [ DEF7A7882BEC100FE0B2CE2549188F9D, 462C95B63D0A1058291A2DC8CBFCB13D7D74CCD1CA43B613A7EB43D49E3276F8 ] AudioSrv C:\WINDOWS\System32\audiosrv.dll
22:21:39.0906 0x0f8c AudioSrv - ok
22:21:39.0953 0x0f8c [ D9F724AA26C010A217C97606B160ED68, 329B5118F2409731D06FDAE85B6ADD64A048292801BCB3546651CEB303111695 ] audstub C:\WINDOWS\system32\DRIVERS\audstub.sys
22:21:40.0078 0x0f8c audstub - ok
22:21:40.0109 0x0f8c [ 21C2F3000A7233E517D7AB62F97BF509, 07169A2512D616E4AE7FE0F6B66D2B84D526F6022985871CC29E9F53FDCFCB6D ] Avgdiskx C:\WINDOWS\system32\DRIVERS\avgdiskx.sys
22:21:40.0265 0x0f8c Avgdiskx - ok
22:21:40.0593 0x0f8c [ 0E3C06E1E9043F6EE2AFCB4E6FA20E68, 0A2A6D4373D5187E66A692F6A0672A2991A27AFCB770798B3EB2D36DBB3F258B ] AVGIDSAgent C:\Program Files\AVG\AVG2014\avgidsagent.exe
22:21:40.0750 0x0f8c AVGIDSAgent - ok
22:21:40.0796 0x0f8c [ DE1A454BBD7F43F9DF628F51C39BFD6C, DEB940E0C0C875D657C349C7B4C99610564EF3BDABCB65F1B0872B266CB09648 ] AVGIDSDriverl C:\WINDOWS\system32\DRIVERS\avgidsdriverlx.sys
22:21:40.0812 0x0f8c AVGIDSDriverl - ok
22:21:40.0828 0x0f8c [ A338A5ED62F2DA715460CF89059BD5C9, 73A1C751690B30887370BD2D87FBF4C8DFF0B819A310DD4A89CE7119C28692D4 ] AVGIDSHX C:\WINDOWS\system32\DRIVERS\avgidshx.sys
22:21:40.0859 0x0f8c AVGIDSHX - ok
22:21:40.0937 0x0f8c [ F018DA122D4190434F112C654894C7F8, C9A5D4AC3513A407A117F950470583620BEF7853DC1051BF405007DD1803F7A6 ] AVGIDSShim C:\WINDOWS\system32\DRIVERS\avgidsshimx.sys
22:21:40.0937 0x0f8c AVGIDSShim - ok
22:21:40.0968 0x0f8c [ 83645E273A9EEFB3B554AD0D8A01F33D, 23491C196156BC7BF47FCD4825CCE4DEC6BE0764D7113F2D612473551305860B ] Avgldx86 C:\WINDOWS\system32\DRIVERS\avgldx86.sys
22:21:41.0000 0x0f8c Avgldx86 - ok
22:21:41.0046 0x0f8c [ A48519FEC3F171EBAC0504FB93A33536, 3E96D0B20ABDC8CE3CF9D18E749E7F6C8F5F994E52E99580777E30DA9DFB461D ] Avglogx C:\WINDOWS\system32\DRIVERS\avglogx.sys
22:21:41.0062 0x0f8c Avglogx - ok
22:21:41.0078 0x0f8c [ 22E47CF9EABE8E429BB7371AD15E1C04, A073B473FB614558A0C98AB229DF060E841ECEB53BCFB966B10E1E0118F82ECD ] Avgmfx86 C:\WINDOWS\system32\DRIVERS\avgmfx86.sys
22:21:41.0093 0x0f8c Avgmfx86 - ok
22:21:41.0125 0x0f8c [ 86FCB8CE3E68C4777B98F7AF06FE8519, 6B7507DA927ECDBA8B2DAA87530DDAEAC5B0983D3CF11D1F6D00D36601FBC60C ] Avgrkx86 C:\WINDOWS\system32\DRIVERS\avgrkx86.sys
22:21:41.0140 0x0f8c Avgrkx86 - ok
22:21:41.0187 0x0f8c [ 11059657F147FCA9C1F2A049775909C1, EE294BAB0074C9F0C6A036730269DE73FC8DBDD339547E7BA6F79C7B1A10A227 ] Avgtdix C:\WINDOWS\system32\DRIVERS\avgtdix.sys
22:21:41.0203 0x0f8c Avgtdix - ok
22:21:41.0250 0x0f8c [ 9684BC50957AD3AB90075CA7273F3CCE, 0C2B2C1B5D058ECB8FB7224410689E640D12965A29E77A169FB184899E68A566 ] avgwd C:\Program Files\AVG\AVG2014\avgwdsvc.exe
22:21:41.0281 0x0f8c avgwd - ok
22:21:41.0312 0x0f8c [ DA1F27D85E0D1525F6621372E7B685E9, 5A81A46A3BDD19DAFC6C87D277267A5D44F3A1B5302F2CC1111D84B7BAD5610D ] Beep C:\WINDOWS\system32\drivers\Beep.sys
22:21:41.0453 0x0f8c Beep - ok
22:21:41.0531 0x0f8c [ BE5D50529799B9BAB6BE879EC768B6CF, 7110AFC1E16584C8C194EE0DE9D779A159D1AD2553EA650324F16C3DA847DE72 ] BIOS C:\WINDOWS\system32\drivers\BIOS.sys
22:21:41.0546 0x0f8c BIOS - detected UnsignedFile.Multi.Generic ( 1 )
22:21:41.0687 0x0f8c Detect skipped due to KSN trusted
22:21:41.0687 0x0f8c BIOS - ok
22:21:41.0796 0x0f8c [ 574738F61FCA2935F5265DC4E5691314, 3C7CCF064397186C3A3863DD2370AB6414A61B330097DCA4F299CA7BBAA3D1B4 ] BITS C:\WINDOWS\system32\qmgr.dll
22:21:41.0984 0x0f8c BITS - ok
22:21:42.0031 0x0f8c [ A06CE3399D16DB864F55FAEB1F1927A9, 3430FA8552D91670D9FB0A921C735ADBE2DA7FF108C199DDEEF2FB2E50713AF3 ] Browser C:\WINDOWS\System32\browser.dll
22:21:42.0140 0x0f8c Browser - ok
22:21:42.0218 0x0f8c [ 90A673FC8E12A79AFBED2576F6A7AAF9, BDE7858A3457DB979FEDD8577FA6321BF72848E4A7BF9F173C78A6A10CBB3EBE ] cbidf2k C:\WINDOWS\system32\drivers\cbidf2k.sys
22:21:42.0343 0x0f8c cbidf2k - ok
22:21:42.0343 0x0f8c cd20xrnt - ok
22:21:42.0390 0x0f8c [ C1B486A7658353D33A10CC15211A873B, AA4DD9E7AAE5AAB1146B360B17001F975D2F29A1281CF7B13E7136480410F347 ] Cdaudio C:\WINDOWS\system32\drivers\Cdaudio.sys
22:21:42.0562 0x0f8c Cdaudio - ok
22:21:42.0578 0x0f8c [ C885B02847F5D2FD45A24E219ED93B32, B26B2F8E3A831E2B65EB0C5195B0645CD50E22615CE79C9B0B391CD563B121DB ] Cdfs C:\WINDOWS\system32\drivers\Cdfs.sys
22:21:42.0671 0x0f8c Cdfs - ok
22:21:42.0765 0x0f8c [ 1F4260CC5B42272D71F79E570A27A4FE, B51C2A3ED3C309953D0EA45869C8E464C10F2533DADE9E0286AF674979098D1D ] Cdrom C:\WINDOWS\system32\DRIVERS\cdrom.sys
22:21:42.0875 0x0f8c Cdrom - ok
22:21:42.0890 0x0f8c Changer - ok
22:21:42.0921 0x0f8c [ 1CFE720EB8D93A7158A4EBC3AB178BDE, 65D2A9D9A88F38D4AF323134C151BA0F4B3CD0F6A134AF86E7AC9D07319F1726 ] CiSvc C:\WINDOWS\system32\cisvc.exe
22:21:43.0062 0x0f8c CiSvc - ok
22:21:43.0093 0x0f8c [ 34CBE729F38138217F9C80212A2A0C82, A9FD7A758D12E0818A11BEEF1CE772FEFA8373E92EF6C0DA8628CD4572CC9A43 ] ClipSrv C:\WINDOWS\system32\clipsrv.exe
22:21:43.0218 0x0f8c ClipSrv - ok
22:21:43.0250 0x0f8c [ D87ACAED61E417BBA546CED5E7E36D9C, 14AC6034A5BC0FB2A1AFDAD42BEF4DE641556E54AD30D0C46765660A4BE55462 ] clr_optimization_v2.0.50727_32 c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
22:21:43.0265 0x0f8c clr_optimization_v2.0.50727_32 - ok
22:21:43.0328 0x0f8c [ C5A75EB48E2344ABDC162BDA79E16841, 6070A8AAFD38FBC6A68A2B10C20117612354DF21B4492D90CA522BFB6870D726 ] clr_optimization_v4.0.30319_32 C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
22:21:43.0343 0x0f8c clr_optimization_v4.0.30319_32 - ok
22:21:43.0343 0x0f8c CmdIde - ok
22:21:43.0359 0x0f8c COMSysApp - ok
22:21:43.0375 0x0f8c Cpqarray - ok
22:21:43.0406 0x0f8c [ 3D4E199942E29207970E04315D02AD3B, 0825960894CF9C86CC8775BDD2A262948A09CA495AA7FE9F210FAF49E7086383 ] CryptSvc C:\WINDOWS\System32\cryptsvc.dll
22:21:43.0500 0x0f8c CryptSvc - ok
22:21:43.0515 0x0f8c dac2w2k - ok
22:21:43.0515 0x0f8c dac960nt - ok
22:21:43.0593 0x0f8c [ 2589FE6015A316C0F5D5112B4DA7B509, 2753785BA07A1A7A25E275332F5F9F403F6E8CBF396FD0905D6BA84B98C403A6 ] DcomLaunch C:\WINDOWS\system32\rpcss.dll
22:21:43.0750 0x0f8c DcomLaunch - ok
22:21:43.0859 0x0f8c [ 5E38D7684A49CACFB752B046357E0589, F192AD4190BCFB6939A5CBC91648FE63168AF79A5E227A111DEAD6A92E42AB8D ] Dhcp C:\WINDOWS\System32\dhcpcsvc.dll
22:21:43.0968 0x0f8c Dhcp - ok
22:21:43.0968 0x0f8c [ 044452051F3E02E7963599FC8F4F3E25, 584BDDB074618BE76454CF90E74829CFF588B5B5FAEB793E2F7AAD26352DD689 ] Disk C:\WINDOWS\system32\DRIVERS\disk.sys
22:21:44.0078 0x0f8c Disk - ok
22:21:44.0093 0x0f8c dmadmin - ok
22:21:44.0187 0x0f8c [ D992FE1274BDE0F84AD826ACAE022A41, C82BD6561A14F2932A761F5883A787B99031250EE5E9B7B5714AA045545C9B99 ] dmboot C:\WINDOWS\system32\drivers\dmboot.sys
22:21:44.0343 0x0f8c dmboot - ok
22:21:44.0359 0x0f8c [ 7C824CF7BBDE77D95C08005717A95F6F, A73CB323B7A6410C3D3F258BF204E716ADF8C84C9E4F6562C57AB73DAED8CCDE ] dmio C:\WINDOWS\system32\drivers\dmio.sys
22:21:44.0468 0x0f8c dmio - ok
22:21:44.0484 0x0f8c [ E9317282A63CA4D188C0DF5E09C6AC5F, D41E002F555FE9015EF620975255F58BB79198CA1FF0E09EC950CB450FF77CF7 ] dmload C:\WINDOWS\system32\drivers\dmload.sys
22:21:44.0625 0x0f8c dmload - ok
22:21:44.0640 0x0f8c [ 57EDEC2E5F59F0335E92F35184BC8631, 61F6F0DC2D1A6C61D5EF0D5CC4BE0FFC217F1E61FDA3EA9F704709293656600F ] dmserver C:\WINDOWS\System32\dmserver.dll
22:21:44.0718 0x0f8c dmserver - ok
22:21:44.0750 0x0f8c [ 8A208DFCF89792A484E76C40E5F50B45, 4E40E2EB38C6254E7CAA488200E89EE7DEBBBA773890BC6A84313CC68178D54F ] DMusic C:\WINDOWS\system32\drivers\DMusic.sys
22:21:44.0843 0x0f8c DMusic - ok
22:21:44.0937 0x0f8c [ 474B4DC3983173E4B4C9740B0DAC98A6, C0B1B5B3A87529FFA93BCFCC2BC013A96CAD7F5049ED4D999E8D5D9AC91F95B7 ] Dnscache C:\WINDOWS\System32\dnsrslvr.dll
22:21:45.0031 0x0f8c Dnscache - ok
22:21:45.0062 0x0f8c [ 0F0F6E687E5E15579EF4DA8DD6945814, 5C32D88119EB1465B2D719BEE2E05888D1A73454B5E33F2D4928DA710F8BFBA3 ] Dot3svc C:\WINDOWS\System32\dot3svc.dll
22:21:45.0171 0x0f8c Dot3svc - ok
22:21:45.0187 0x0f8c dpti2o - ok
22:21:45.0281 0x0f8c [ 8F5FCFF8E8848AFAC920905FBD9D33C8, C8C6FB97AB0871C8C88A2201525A5CF10D5131CB6980D32692ED7A8F58399AD5 ] drmkaud C:\WINDOWS\system32\drivers\drmkaud.sys
22:21:45.0375 0x0f8c drmkaud - ok
22:21:45.0468 0x0f8c [ E6B7D1B24E16FB24CE1FEA964E144EBC, 30F81E0A017163A1AB463FE3A13B5CC2905B973E782AEBC1EB63759BF2470658 ] dtsoftbus01 C:\WINDOWS\system32\DRIVERS\dtsoftbus01.sys
22:21:45.0484 0x0f8c dtsoftbus01 - ok
22:21:45.0515 0x0f8c [ 2187855A7703ADEF0CEF9EE4285182CC, 8233CC11F637866C0074043835A785EA2B616739B6B1181B143A253CF2508CFD ] EapHost C:\WINDOWS\System32\eapsvc.dll
22:21:45.0609 0x0f8c EapHost - ok
22:21:45.0640 0x0f8c [ BC93B4A066477954555966D77FEC9ECB, 27F5B780175EF46DA102EE33F7F33559C8B40C077EEA4405D579D9507F4B1C23 ] ERSvc C:\WINDOWS\System32\ersvc.dll
22:21:45.0750 0x0f8c ERSvc - ok
22:21:45.0781 0x0f8c [ 0E776ED5F7CC9F94299E70461B7B8185, 22750B3829133D1D4BB3CE2FA6247BE2373B5D15A6ED1C8A71673AA1CE7D9530 ] Eventlog C:\WINDOWS\system32\services.exe
22:21:45.0890 0x0f8c Eventlog - ok
22:21:45.0953 0x0f8c [ 19A799805B24990867B00C120D300C3A, 3C8CB64BE0508B5136D4F4919DA665AB86366EFFFFDD890A9B27E7CE39DCF098 ] EventSystem C:\WINDOWS\system32\es.dll
22:21:46.0078 0x0f8c EventSystem - ok
22:21:46.0125 0x0f8c [ 38D332A6D56AF32635675F132548343E, E6909DB836AF679B4F4D62C7396D6C82769CC7ABB8C919C2AABFE934FCE268F6 ] Fastfat C:\WINDOWS\system32\drivers\Fastfat.sys
22:21:46.0234 0x0f8c Fastfat - ok
22:21:46.0265 0x0f8c [ 1926899BF9FFE2602B63074971700412, F5C48EDBE5C6507527630B49C95BAA9F1E47EACC5A910F2B9A4528733E81A966 ] FastUserSwitchingCompatibility C:\WINDOWS\System32\shsvcs.dll
22:21:46.0390 0x0f8c FastUserSwitchingCompatibility - ok
22:21:46.0453 0x0f8c [ 92CDD60B6730B9F50F6A1A0C1F8CDC81, 8307A532AB4D05CBBCE206DC2759497708BF5AAA880BD00F0E4F281D8578A1F5 ] Fdc C:\WINDOWS\system32\drivers\Fdc.sys
22:21:46.0546 0x0f8c Fdc - ok
22:21:46.0593 0x0f8c [ D45926117EB9FA946A6AF572FBE1CAA3, 4C94EF009D778BE0BDF8F812F026B96F91F641BE30AA2531427A5E63DBD280DA ] Fips C:\WINDOWS\system32\drivers\Fips.sys
22:21:46.0687 0x0f8c Fips - ok
22:21:46.0703 0x0f8c [ 9D27E7B80BFCDF1CDD9B555862D5E7F0, 69C271AD5BCEBFD8AE5A769BDD7EC51256DA3A8ADAD5D12E5C0D13F4E82D8805 ] Flpydisk C:\WINDOWS\system32\drivers\Flpydisk.sys
22:21:46.0796 0x0f8c Flpydisk - ok
22:21:46.0828 0x0f8c [ B2CF4B0786F8212CB92ED2B50C6DB6B0, 280F5CF8A90F7BEDE73ADD0DD0F8952088133A7CA9A3D3B7041957E33B36845D ] FltMgr C:\WINDOWS\system32\drivers\fltmgr.sys
22:21:46.0921 0x0f8c FltMgr - ok
22:21:47.0031 0x0f8c [ 8BA7C024070F2B7FDD98ED8A4BA41789, 47585006F86B2C6016EC54250A416794792D1E4024FF229C120BC25B684AF66A ] FontCache3.0.0.0 c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
22:21:47.0046 0x0f8c FontCache3.0.0.0 - ok
22:21:47.0093 0x0f8c [ B81F8778F5BB485F3B75114F0C99A49F, 6A004B8A78732914C850E91FCF5A526BEF3A2DE943A8349F7B52E92C0F410809 ] ForcewareWebInterface C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
22:21:47.0109 0x0f8c ForcewareWebInterface - detected UnsignedFile.Multi.Generic ( 1 )
22:21:47.0234 0x0f8c Detect skipped due to KSN trusted
22:21:47.0234 0x0f8c ForcewareWebInterface - ok
22:21:47.0250 0x0f8c [ 3E1E2BD4F39B0E2B7DC4F4D2BCC2779A, EC635E071201A766845D48973772CBE0958942B4162F3F5F70660D114CC877E0 ] Fs_Rec C:\WINDOWS\system32\drivers\Fs_Rec.sys
22:21:47.0359 0x0f8c Fs_Rec - ok
22:21:47.0453 0x0f8c [ 6AC26732762483366C3969C9E4D2259D, FF2C9A23CC17F380093F0BEA955B1925794271C2FEA16B9B7639668E6999BAE3 ] Ftdisk C:\WINDOWS\system32\DRIVERS\ftdisk.sys
22:21:47.0578 0x0f8c Ftdisk - ok
22:21:47.0640 0x0f8c [ 0A02C63C8B144BD8C86B103DEE7C86A2, 7A3235DD3E1995DD72B212FAEB3ECA2A974434DE9BF6D269EA11BA65A80E7E50 ] Gpc C:\WINDOWS\system32\DRIVERS\msgpc.sys
22:21:47.0750 0x0f8c Gpc - ok
22:21:47.0781 0x0f8c [ 573C7D0A32852B48F3058CFD8026F511, BC384BBA394AFDCDA1A9ABC858C692AA84A1F0A31AF3DDF7F38D120C027927FB ] HDAudBus C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
22:21:47.0875 0x0f8c HDAudBus - ok
22:21:47.0953 0x0f8c [ 4FCCA060DFE0C51A09DD5C3843888BCD, D82417706B517F2610DDF7C86BE03A72EFA9A2A389DF5C8F8ADEAB8144E2C80A ] helpsvc C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
22:21:48.0046 0x0f8c helpsvc - ok
22:21:48.0046 0x0f8c HidServ - ok
22:21:48.0062 0x0f8c [ CCF82C5EC8A7326C3066DE870C06DAF1, 93395FA4C26B2E82DC8B7025ED3BCF583885E5D8C5F60CD6EEAA6335D6A126EC ] hidusb C:\WINDOWS\system32\DRIVERS\hidusb.sys
22:21:48.0156 0x0f8c hidusb - ok
22:21:48.0187 0x0f8c [ 8878BD685E490239777BFE51320B88E9, C5C3ECF6B049B6736E35B39518A8F830B45C45A88FFE8E3A6B7922AD946597E2 ] hkmsvc C:\WINDOWS\System32\kmsvc.dll
22:21:48.0328 0x0f8c hkmsvc - ok
22:21:48.0328 0x0f8c hpn - ok
22:21:48.0359 0x0f8c [ F6AACF5BCE2893E0C1754AFEB672E5C9, 62A7A70515B5570A649DC30A3A122B1302F6839A63927C8B29EBE04ABA654892 ] HTTP C:\WINDOWS\system32\Drivers\HTTP.sys
22:21:48.0484 0x0f8c HTTP - ok
22:21:48.0500 0x0f8c [ 6100A808600F44D999CEBDEF8841C7A3, 61A75118C327812C60622010985A2E80E79B6FD9030A5732390EE5426E4AF6C9 ] HTTPFilter C:\WINDOWS\System32\w3ssl.dll
22:21:48.0640 0x0f8c HTTPFilter - ok
22:21:48.0656 0x0f8c i2omgmt - ok
22:21:48.0656 0x0f8c i2omp - ok
22:21:48.0703 0x0f8c [ 4A0B06AA8943C1E332520F7440C0AA30, DB2452390CCFE67E0C5FEB4FD42CA24ABE2DDD40D0B22DD5F5B8F70416863918 ] i8042prt C:\WINDOWS\system32\DRIVERS\i8042prt.sys
22:21:48.0812 0x0f8c i8042prt - ok
22:21:49.0000 0x0f8c [ C01AC32DC5C03076CFB852CB5DA5229C, A4D7749220B5BC965D96A267F1E02FE8284A230BA249109207BD4B9EA8DFAC96 ] idsvc c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
22:21:49.0046 0x0f8c idsvc - ok
22:21:49.0093 0x0f8c [ 083A052659F5310DD8B6A6CB05EDCF8E, 48D39B03FFB6FAA1529B774443BA12618AE3982D9F65A7B9D18F2269F78B31F4 ] Imapi C:\WINDOWS\system32\DRIVERS\imapi.sys
22:21:49.0203 0x0f8c Imapi - ok
22:21:49.0312 0x0f8c [ 30DEAF54A9755BB8546168CFE8A6B5E1, 3936228CD3125C763ABFCB93E86E4B43838202BCC0913A28E84AC0263B43EE0D ] ImapiService C:\WINDOWS\system32\imapi.exe
22:21:49.0421 0x0f8c ImapiService - ok
22:21:49.0421 0x0f8c ini910u - ok
22:21:49.0656 0x0f8c [ C464CF7A58C011A70188602B55C64E99, D1C67B2F911D69C963FBF3CA27250636F54402E2D251B37C760219A6C96FB93A ] IntcAzAudAddService C:\WINDOWS\system32\drivers\RtkHDAud.sys
22:21:50.0015 0x0f8c IntcAzAudAddService - ok
22:21:50.0046 0x0f8c IntelIde - ok
22:21:50.0078 0x0f8c [ 3BB22519A194418D5FEC05D800A19AD0, F6662F440950596DC1382DD1DB5D7891CCEA30A6062BEA942C18445B5F0D8B16 ] Ip6Fw C:\WINDOWS\system32\drivers\ip6fw.sys
22:21:50.0187 0x0f8c Ip6Fw - ok
22:21:50.0250 0x0f8c [ 731F22BA402EE4B62748ADAF6363C182, 5C3BEBD008A5BE4DC2F92076FF41A10DDC01E10EC7E6552213CFA11970811848 ] IpFilterDriver C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
22:21:50.0375 0x0f8c IpFilterDriver - ok
22:21:50.0406 0x0f8c [ B87AB476DCF76E72010632B5550955F5, E6E74D3A86A7917A8BAED44F8E97CCD2EB171E4E4B27E9907F60D1523FAF319A ] IpInIp C:\WINDOWS\system32\DRIVERS\ipinip.sys
22:21:50.0515 0x0f8c IpInIp - ok
22:21:50.0562 0x0f8c [ CC748EA12C6EFFDE940EE98098BF96BB, AF523E21C25D9A1715EFEA573E4F52AF5D4FC9F28A2D613F5DB629C186C439E0 ] IpNat C:\WINDOWS\system32\DRIVERS\ipnat.sys
22:21:50.0671 0x0f8c IpNat - ok
22:21:50.0703 0x0f8c [ 23C74D75E36E7158768DD63D92789A91, 394D296F38E7D8EFD91A6EEC301D9CE6AF910E35EB9819F1A9E3363863AEDFDC ] IPSec C:\WINDOWS\system32\DRIVERS\ipsec.sys
22:21:50.0812 0x0f8c IPSec - ok
22:21:50.0828 0x0f8c [ C93C9FF7B04D772627A3646D89F7BF89, 805FA48E7A46D4F10240BF880A2468F53DEA36E83004399228AB70DB7D20544A ] IRENUM C:\WINDOWS\system32\DRIVERS\irenum.sys
22:21:50.0968 0x0f8c IRENUM - ok
22:21:51.0015 0x0f8c [ 05A299EC56E52649B1CF2FC52D20F2D7, 2654619DB3E6D6C385B63AB02F87D4241C4F0250CC31383D1B3586917166C2DC ] isapnp C:\WINDOWS\system32\DRIVERS\isapnp.sys
22:21:51.0109 0x0f8c isapnp - ok
22:21:51.0203 0x0f8c [ 463C1EC80CD17420A542B7F36A36F128, E3B11BA26AFEAFB50B0FC168EA07F6049DA6B88BCDDEEE20310602D7FC27A3A7 ] Kbdclass C:\WINDOWS\system32\DRIVERS\kbdclass.sys
22:21:51.0296 0x0f8c Kbdclass - ok
22:21:51.0328 0x0f8c [ 692BCF44383D056AED41B045A323D378, 1A99DEE83FFAF64E73067FC049C0A4CE07D94E4AE31EFA17B38CEFA9E41D67DC ] kmixer C:\WINDOWS\system32\drivers\kmixer.sys
22:21:51.0437 0x0f8c kmixer - ok
22:21:51.0500 0x0f8c [ 1705745D900DABF2D89F90EBADDC7517, FE90589415BDB3BA482D3EBE1A87A7BF1429791E8F18BCB66BF8874631CC8B2C ] KSecDD C:\WINDOWS\system32\drivers\KSecDD.sys
22:21:51.0609 0x0f8c KSecDD - ok
22:21:51.0625 0x0f8c [ F385F4B02C535BFFE1D70CAB80838123, A1695E161673BCB77CE150C2D98A07FCB454C53F10EEBECD754D2CC40DEAA1E0 ] lanmanserver C:\WINDOWS\System32\srvsvc.dll
22:21:51.0734 0x0f8c lanmanserver - ok
22:21:51.0781 0x0f8c [ 1B67B632786FEF1C1BBAEF46C2F3F2E6, 48A6DB1EC7515F0DDD0639AEE3056F32C273B4D541F3647915A32ABA140DA34A ] lanmanworkstation C:\WINDOWS\System32\wkssvc.dll
22:21:51.0890 0x0f8c lanmanworkstation - ok
22:21:51.0890 0x0f8c lbrtfdc - ok
22:21:51.0921 0x0f8c [ A7DB739AE99A796D91580147E919CC59, EDF4E039BA277B0E6D66FEB0B28096E67D682C09DFC18ECECF062D9DCFB75ACF ] LmHosts C:\WINDOWS\System32\lmhsvc.dll
22:21:52.0015 0x0f8c LmHosts - ok
22:21:52.0031 0x0f8c [ B4CD87E78A01562E3DA67FE1C2779204, 536AC01C53A18E7B43F02F345FC3088C189A2D01F5E060714C0534FE7ECA2356 ] MBAMProtector C:\WINDOWS\system32\drivers\mbam.sys
22:21:52.0062 0x0f8c MBAMProtector - ok
22:21:52.0171 0x0f8c [ 301E3FDFCF33640BB8763BA444BC5093, 362B069BB9A313A06B376CE27E6F7F8D569F6CA39A8ABC96D9DF231EE462C604 ] MBAMScheduler C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe
22:21:52.0328 0x0f8c MBAMScheduler - ok
22:21:52.0406 0x0f8c [ 83C982A395D00BAFF6515FB38424EA76, 0E1B66F84A483D47550347D4A9426B95A066DB5104C4284F606A16768A11DB0C ] MBAMService C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe
22:21:52.0468 0x0f8c MBAMService - ok
22:21:52.0531 0x0f8c [ 986B1FF5814366D71E0AC5755C88F2D3, E6AF051174531C24B38E73987755D366ABEC595476C6D17793E8DCCC73F55340 ] Messenger C:\WINDOWS\System32\msgsvc.dll
22:21:52.0640 0x0f8c Messenger - ok
22:21:52.0703 0x0f8c [ 4AE068242760A1FB6E1A44BF4E16AFA6, 1FB771162B96AAF787AC24867B818DF8511F0780BB094FA9A38C11D8DBFE68BC ] mnmdd C:\WINDOWS\system32\drivers\mnmdd.sys
22:21:52.0812 0x0f8c mnmdd - ok
22:21:52.0906 0x0f8c [ D18F1F0C101D06A1C1ADF26EED16FCDD, BA0837C7780BD8262E143E2935AFA63BE59C3C39EF56CB8608EED0F50AF070D4 ] mnmsrvc C:\WINDOWS\system32\mnmsrvc.exe
22:21:53.0015 0x0f8c mnmsrvc - ok
22:21:53.0062 0x0f8c [ DFCBAD3CEC1C5F964962AE10E0BCC8E1, B342CC9EC3729AB1AB4B5E2E99F890C1E0CA649162DE91F6768AB857B719E97B ] Modem C:\WINDOWS\system32\drivers\Modem.sys
22:21:53.0171 0x0f8c Modem - ok
22:21:53.0187 0x0f8c [ 35C9E97194C8CFB8430125F8DBC34D04, 0C0FCE6B0A23FB0ECB92E1663E1C72D2DD5B177D82E04782957690B69530DB39 ] Mouclass C:\WINDOWS\system32\DRIVERS\mouclass.sys
22:21:53.0296 0x0f8c Mouclass - ok
22:21:53.0343 0x0f8c [ B1C303E17FB9D46E87A98E4BA6769685, 161A45488522055D0F0474ABEDA04DDD0B5DAC2411AF9154B15190BBD66E7153 ] mouhid C:\WINDOWS\system32\DRIVERS\mouhid.sys
22:21:53.0468 0x0f8c mouhid - ok
22:21:53.0546 0x0f8c [ A80B9A0BAD1B73637DBCBBA7DF72D3FD, 2A5E15ED2C24C6C65EF2F7E1FD93374774076C9D8D451E4422561F4D269C012F ] MountMgr C:\WINDOWS\system32\drivers\MountMgr.sys
22:21:53.0656 0x0f8c MountMgr - ok
22:21:53.0656 0x0f8c mraid35x - ok
22:21:53.0671 0x0f8c [ 11D42BB6206F33FBB3BA0288D3EF81BD, 76ABCFB62C5AC549F58C231F72A99882CDEB74928104B77FE52554765C2B1A22 ] MRxDAV C:\WINDOWS\system32\DRIVERS\mrxdav.sys
22:21:53.0781 0x0f8c MRxDAV - ok
22:21:53.0812 0x0f8c [ 68755F0FF16070178B54674FE5B847B0, 2FFBCE3A67FA7E30E373624521C602E5510C5565F04381C6C9F961253DA928A6 ] MRxSmb C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
22:21:53.0953 0x0f8c MRxSmb - ok
22:21:54.0015 0x0f8c [ A137F1470499A205ABBB9AAFB3B6F2B1, FB4951727543030D9E6ED74149C3FAACE2CA9DA8C1B5F616301B30B858C724E8 ] MSDTC C:\WINDOWS\system32\msdtc.exe
22:21:54.0109 0x0f8c MSDTC - ok
22:21:54.0125 0x0f8c [ C941EA2454BA8350021D774DAF0F1027, C940E978C7B66A713A0FDAB54B5F995DF59D089AFCD96221DD3222948CD49BBD ] Msfs C:\WINDOWS\system32\drivers\Msfs.sys
22:21:54.0218 0x0f8c Msfs - ok
22:21:54.0234 0x0f8c MSIServer - ok
22:21:54.0250 0x0f8c [ D1575E71568F4D9E14CA56B7B0453BF1, 4ABE0E24786C0D39FA2B885447E56204CA6942FB175E534DCE675D7BCF0B176A ] MSKSSRV C:\WINDOWS\system32\drivers\MSKSSRV.sys
22:21:54.0343 0x0f8c MSKSSRV - ok
22:21:54.0359 0x0f8c [ 325BB26842FC7CCC1FCCE2C457317F3E, C07BE560513B1FB91D756494F0BA4AEEB2E1998DE0E1C21EE83DB1183B0CEE91 ] MSPCLOCK C:\WINDOWS\system32\drivers\MSPCLOCK.sys
22:21:54.0468 0x0f8c MSPCLOCK - ok
22:21:54.0484 0x0f8c [ BAD59648BA099DA4A17680B39730CB3D, 9AD4C7C94C186C8815D0BC75DCAFB962158DA6935A244BA243EDDDEB33F9816C ] MSPQM C:\WINDOWS\system32\drivers\MSPQM.sys
22:21:54.0578 0x0f8c MSPQM - ok
22:21:54.0609 0x0f8c [ AF5F4F3F14A8EA2C26DE30F7A1E17136, AC93A1E4ABB0D038B772E429015567E44CC2EDB66C54DBE23A5F98176FAC1520 ] mssmbios C:\WINDOWS\system32\DRIVERS\mssmbios.sys
22:21:54.0703 0x0f8c mssmbios - ok
22:21:54.0734 0x0f8c [ 2F625D11385B1A94360BFC70AAEFDEE1, 23E4974120233CF1A7BEE48977706A0A55418699379D1450502ABEB24191AC80 ] Mup C:\WINDOWS\system32\drivers\Mup.sys
22:21:54.0828 0x0f8c Mup - ok
22:21:54.0875 0x0f8c [ 0102140028FAD045756796E1C685D695, 5335B8278418CA200E2772124F0602C3E15A5CAF2D5CC59F6785DFAABF339B09 ] napagent C:\WINDOWS\System32\qagentrt.dll
22:21:54.0984 0x0f8c napagent - ok
22:21:55.0015 0x0f8c [ 1DF7F42665C94B825322FAE71721130D, FE0DCB728471465B39A42A7511F4133021FBA5DF88F88BCB5FE2FF34CFD713F9 ] NDIS C:\WINDOWS\system32\drivers\NDIS.sys
22:21:55.0125 0x0f8c NDIS - ok
22:21:55.0140 0x0f8c [ 1AB3D00C991AB086E69DB84B6C0ED78F, 1F881FCCF5557C44C078D99CA2DD38D635413D6212DBEDC06A428EDAC7F8B04E ] NdisTapi C:\WINDOWS\system32\DRIVERS\ndistapi.sys
22:21:55.0234 0x0f8c NdisTapi - ok
22:21:55.0265 0x0f8c [ F927A4434C5028758A842943EF1A3849, B1AA3AF150C05307461774925901789456B0CCCD03A5E71ADA4AB58455962BEE ] Ndisuio C:\WINDOWS\system32\DRIVERS\ndisuio.sys
22:21:55.0375 0x0f8c Ndisuio - ok
22:21:55.0468 0x0f8c [ EDC1531A49C80614B2CFDA43CA8659AB, 494042F790F33721328B4451E79842E21919681CC421A4F9633EC4D383E06097 ] NdisWan C:\WINDOWS\system32\DRIVERS\ndiswan.sys
22:21:55.0562 0x0f8c NdisWan - ok
22:21:55.0625 0x0f8c [ 6215023940CFD3702B46ABC304E1D45A, C767F3A349B365F6E7566C0738E2F62D8FFF8CB4457347E3614BD403BC6CADCB ] NDProxy C:\WINDOWS\system32\drivers\NDProxy.sys
22:21:55.0734 0x0f8c NDProxy - ok
22:21:55.0734 0x0f8c [ 5D81CF9A2F1A3A756B66CF684911CDF0, 7989C36607CAEA17AFA2C1C9904145CA0714A54B9F712D9D4C1AB140D0B2CC0C ] NetBIOS C:\WINDOWS\system32\DRIVERS\netbios.sys
22:21:55.0843 0x0f8c NetBIOS - ok
22:21:55.0890 0x0f8c [ 74B2B2F5BEA5E9A3DC021D685551BD3D, 7932B71F98B4122BE88F576BF6D745A757AE378A48924B7F4358837B75640A82 ] NetBT C:\WINDOWS\system32\DRIVERS\netbt.sys
22:21:55.0984 0x0f8c NetBT - ok
22:21:56.0078 0x0f8c [ B857BA82860D7FF85AE29B095645563B, 86FF0E4CDD9C394E8BABD93A4D57E73FF9A779261717DEC6E9CDE99F1C6B0F4C ] NetDDE C:\WINDOWS\system32\netdde.exe
22:21:56.0187 0x0f8c NetDDE - ok
22:21:56.0203 0x0f8c [ B857BA82860D7FF85AE29B095645563B, 86FF0E4CDD9C394E8BABD93A4D57E73FF9A779261717DEC6E9CDE99F1C6B0F4C ] NetDDEdsdm C:\WINDOWS\system32\netdde.exe
22:21:56.0312 0x0f8c NetDDEdsdm - ok
22:21:56.0328 0x0f8c [ BF2466B3E18E970D8A976FB95FC1CA85, F7794B5D12DC5D820A162850F4388E2AA80426AD07CB221799CF941C682AB501 ] Netlogon C:\WINDOWS\system32\lsass.exe
22:21:56.0421 0x0f8c Netlogon - ok
22:21:56.0500 0x0f8c [ 13E67B55B3ABD7BF3FE7AAE5A0F9A9DE, 4E0A67B3CC897E80D4B342FFE8B7B4CC4F6CA2EF2D34C136027A098B2E1C6166 ] Netman C:\WINDOWS\System32\netman.dll
22:21:56.0640 0x0f8c Netman - ok
22:21:56.0671 0x0f8c [ D34612C5D02D026535B3095D620626AE, 1BBCCCBF49EB8807240A77DCB43C25C21682073CC5356594E2C4F53EF36BF657 ] NetTcpPortSharing c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
22:21:56.0703 0x0f8c NetTcpPortSharing - ok
22:21:56.0734 0x0f8c [ B4138E99236F0F57D4CF49BAE98A0746, DDEAE046C1165C41F06933E808B143118208B02BB83FA80BEF8F550D4DC78149 ] Nla C:\WINDOWS\System32\mswsock.dll
22:21:56.0843 0x0f8c Nla - ok
22:21:56.0906 0x0f8c [ 3182D64AE053D6FB034F44B6DEF8034A, 4ADFC76965BA2A5F488E71789A4E4EA702A74AF42725F72130D1CA919406CF19 ] Npfs C:\WINDOWS\system32\drivers\Npfs.sys
22:21:57.0015 0x0f8c Npfs - ok
22:21:57.0125 0x0f8c [ DC75EDFF1A3737C539C00B8EE4A1A23C, 8A6CA1F25E44A27A2AFC01F89B9E40290E095BA8370DBC860F54DC93D2D61614 ] nSvcIp C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
22:21:57.0140 0x0f8c nSvcIp - detected UnsignedFile.Multi.Generic ( 1 )
22:21:57.0328 0x0f8c Detect skipped due to KSN trusted
22:21:57.0328 0x0f8c nSvcIp - ok
22:21:57.0390 0x0f8c [ 569D470A979245D9A10FDE8E70C4F048, 4FF57C7604BB26FA3A46E5384C460D2C2E35123CB02CE4244B4C932528889761 ] nSvcLog C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
22:21:57.0406 0x0f8c nSvcLog - detected UnsignedFile.Multi.Generic ( 1 )
22:21:57.0546 0x0f8c Detect skipped due to KSN trusted
22:21:57.0546 0x0f8c nSvcLog - ok
22:21:57.0578 0x0f8c [ 78A08DD6A8D65E697C18E1DB01C5CDCA, E0E6F3ED05068E32F1D5C2D2B38CDEF4536B8656DB6756C66CF6B40B60C8F3DA ] Ntfs C:\WINDOWS\system32\drivers\Ntfs.sys
22:21:57.0703 0x0f8c Ntfs - ok
22:21:57.0718 0x0f8c [ BF2466B3E18E970D8A976FB95FC1CA85, F7794B5D12DC5D820A162850F4388E2AA80426AD07CB221799CF941C682AB501 ] NtLmSsp C:\WINDOWS\system32\lsass.exe
22:21:57.0812 0x0f8c NtLmSsp - ok
22:21:57.0875 0x0f8c [ 156F64A3345BD23C600655FB4D10BC08, 9611BE411586E068D9297D77102DB3BE48AA67F1BAD6F61A84F83FC3043FA9CD ] NtmsSvc C:\WINDOWS\system32\ntmssvc.dll
22:21:57.0984 0x0f8c NtmsSvc - ok
22:21:58.0015 0x0f8c [ 73C1E1F395918BC2C6DD67AF7591A3AD, B21133A75253EC15E2DFF66D3B480AB1A7E1A2360476C810E7AA55D0F0EB08D4 ] Null C:\WINDOWS\system32\drivers\Null.sys
22:21:58.0125 0x0f8c Null - ok
22:21:58.0906 0x0f8c [ EB2858F920B8135B807B5CCAA3ED73DC, E51DAE3D053E2B0563CA4BA970D6268AEFC7C92B35E1F73B8A9B54B99DFAC384 ] nv C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
22:21:59.0187 0x0f8c nv - ok
22:21:59.0218 0x0f8c [ EF9941593B2E9B436F64A87DDB570D1A, 4AE749488CAAE76200D880B2DC010FCD3145DFB8A722EEB5F71CBDB5AA1FCE9F ] nvata C:\WINDOWS\system32\DRIVERS\nvata.sys
22:21:59.0265 0x0f8c nvata - ok
22:21:59.0312 0x0f8c [ 0AE6258709D58FB53638E8D28F4480D4, 71479B17ACAE646089EA79FAB334B95BFA3CAF6E9136BCF010722097E04C8B38 ] NVENETFD C:\WINDOWS\system32\DRIVERS\NVENETFD.sys
22:21:59.0359 0x0f8c NVENETFD - ok
22:21:59.0390 0x0f8c [ 1296B33C223A58485D5EAA779752216A, FDD2B1765C489E6BDBAB9913788F9C4CADC69C35E898FB8085A4BBC14F4166FC ] nvnetbus C:\WINDOWS\system32\DRIVERS\nvnetbus.sys
22:21:59.0421 0x0f8c nvnetbus - ok
22:21:59.0515 0x0f8c [ 36032035FA55F030D55237D5C639A81D, 0D3B26489A49752479183AE21C1F9D7F1D3C107F52A193D0ABA63599B249103C ] NVSvc C:\WINDOWS\system32\nvsvc32.exe
22:21:59.0562 0x0f8c NVSvc - ok
22:21:59.0609 0x0f8c [ B305F3FAD35083837EF46A0BBCE2FC57, 9D0E0E666D652D0FC9EAB97280A5D67AAF61D6B21929DF7CF8ED72A367720464 ] NwlnkFlt C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
22:21:59.0718 0x0f8c NwlnkFlt - ok
22:21:59.0718 0x0f8c [ C99B3415198D1AAB7227F2C88FD664B9, DD8DA4B5E804F134AB9233859544C025062902DFC3E8FB8A09A67337A4E73F55 ] NwlnkFwd C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
22:21:59.0828 0x0f8c NwlnkFwd - ok
22:21:59.0921 0x0f8c [ 5575FAF8F97CE5E713D108C2A58D7C7C, 96D4595D19A78CCBE8B325A08780AC077AE5CC99642ACD72FB47AEAE8D344D3B ] Parport C:\WINDOWS\system32\DRIVERS\parport.sys
22:22:00.0031 0x0f8c Parport - ok
22:22:00.0046 0x0f8c [ BEB3BA25197665D82EC7065B724171C6, 7E71C13BA30CD95CEE8A9CC85E6F48A01F30EDEAADEE69D80AE828BF97E5A5CA ] PartMgr C:\WINDOWS\system32\drivers\PartMgr.sys
22:22:00.0140 0x0f8c PartMgr - ok
22:22:00.0187 0x0f8c [ 70E98B3FD8E963A6A46A2E6247E0BEA1, 6771313EC41B3B5BFD398F60706E40BE71617046880CC352DD110B001AFC22A1 ] ParVdm C:\WINDOWS\system32\drivers\ParVdm.sys
22:22:00.0312 0x0f8c ParVdm - ok
22:22:00.0375 0x0f8c [ A219903CCF74233761D92BEF471A07B1, D4E6C360A1D2FCA4D17C991B834D68BF20F5111DD06B1FAB8B22984804CEC269 ] PCI C:\WINDOWS\system32\DRIVERS\pci.sys
22:22:00.0562 0x0f8c PCI - ok
22:22:00.0562 0x0f8c PCIDump - ok
22:22:00.0578 0x0f8c [ CCF5F451BB1A5A2A522A76E670000FF0, D63F7E5A39653EC9CCE94B7D84B2D3EBD4F54533BD65701020198724042C9257 ] PCIIde C:\WINDOWS\system32\DRIVERS\pciide.sys
22:22:00.0687 0x0f8c PCIIde - ok
22:22:00.0703 0x0f8c [ 9E89EF60E9EE05E3F2EEF2DA7397F1C1, 0BA3DB21DC7C641C181E2635B5C9B73965FDCDCD3EBBBE48FCFEC1C8C987F617 ] Pcmcia C:\WINDOWS\system32\drivers\Pcmcia.sys
22:22:00.0828 0x0f8c Pcmcia - ok
22:22:00.0828 0x0f8c PDCOMP - ok
22:22:00.0843 0x0f8c PDFRAME - ok
22:22:00.0843 0x0f8c PDRELI - ok
22:22:00.0859 0x0f8c PDRFRAME - ok
22:22:00.0859 0x0f8c perc2 - ok
22:22:00.0875 0x0f8c perc2hib - ok
22:22:00.0906 0x0f8c [ 0E776ED5F7CC9F94299E70461B7B8185, 22750B3829133D1D4BB3CE2FA6247BE2373B5D15A6ED1C8A71673AA1CE7D9530 ] PlugPlay C:\WINDOWS\system32\services.exe
22:22:01.0015 0x0f8c PlugPlay - ok
22:22:01.0031 0x0f8c [ BF2466B3E18E970D8A976FB95FC1CA85, F7794B5D12DC5D820A162850F4388E2AA80426AD07CB221799CF941C682AB501 ] PolicyAgent C:\WINDOWS\system32\lsass.exe
22:22:01.0125 0x0f8c PolicyAgent - ok
22:22:01.0203 0x0f8c [ EFEEC01B1D3CF84F16DDD24D9D9D8F99, C5F0C8C66A3AF7E7BB04CEDE4AC5306F8387AB384A2107DC5BE413AAE968EFF1 ] PptpMiniport C:\WINDOWS\system32\DRIVERS\raspptp.sys
22:22:01.0312 0x0f8c PptpMiniport - ok
22:22:01.0343 0x0f8c [ A32BEBAF723557681BFC6BD93E98BD26, 35039BA72A29F87B2CA37DCDE4EFDAABBDEAD8CE3EB8652ACC665994118145A6 ] Processor C:\WINDOWS\system32\DRIVERS\processr.sys
22:22:01.0453 0x0f8c Processor - ok
22:22:01.0468 0x0f8c [ BF2466B3E18E970D8A976FB95FC1CA85, F7794B5D12DC5D820A162850F4388E2AA80426AD07CB221799CF941C682AB501 ] ProtectedStorage C:\WINDOWS\system32\lsass.exe
22:22:01.0562 0x0f8c ProtectedStorage - ok
22:22:01.0625 0x0f8c [ 09298EC810B07E5D582CB3A3F9255424, 35473A1BE25AC289474090EB0806AC6B3035DC33D1F3DF97A14BF1E361AC6AC3 ] PSched C:\WINDOWS\system32\DRIVERS\psched.sys
22:22:01.0750 0x0f8c PSched - ok
22:22:01.0765 0x0f8c [ 80D317BD1C3DBC5D4FE7B1678C60CADD, DA76804B55D0CAB3DDD01EFC06673764AE4860693375C658B6063FB14AF7F12C ] Ptilink C:\WINDOWS\system32\DRIVERS\ptilink.sys
22:22:01.0890 0x0f8c Ptilink - ok
22:22:01.0890 0x0f8c ql1080 - ok
22:22:01.0906 0x0f8c Ql10wnt - ok
22:22:01.0906 0x0f8c ql12160 - ok
22:22:01.0921 0x0f8c ql1240 - ok
22:22:01.0921 0x0f8c ql1280 - ok
22:22:01.0937 0x0f8c [ FE0D99D6F31E4FAD8159F690D68DED9C, 998685622ABE631984B7E4DBF91AB3594B1F574378D75EB9F6265F4650470692 ] RasAcd C:\WINDOWS\system32\DRIVERS\rasacd.sys
22:22:02.0046 0x0f8c RasAcd - ok
22:22:02.0078 0x0f8c [ AD188BE7BDF94E8DF4CA0A55C00A5073, C7D76CB579FAEBCCC2873499441BACDD6BD6668ACF5ED7F31862656E96E2B20C ] RasAuto C:\WINDOWS\System32\rasauto.dll
22:22:02.0187 0x0f8c RasAuto - ok
22:22:02.0250 0x0f8c [ 11B4A627BC9614B885C4969BFA5FF8A6, EAE0A412A2B0F68919C32A96B3A08CC1A06585E4998819F5C9051745F63FF5AD ] Rasl2tp C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
22:22:02.0359 0x0f8c Rasl2tp - ok
22:22:02.0390 0x0f8c [ 76A9A3CBEADD68CC57CDA5E1D7448235, 4AFD048C5D2306AB8DE46F3AA60AC0213333DDA3B09A9E91F7585DB6EB978EC8 ] RasMan C:\WINDOWS\System32\rasmans.dll
22:22:02.0515 0x0f8c RasMan - ok
22:22:02.0531 0x0f8c [ 5BC962F2654137C9909C3D4603587DEE, A5CE5653D0105240F5E86CFAAB89E7917D42D939E2F27A5A7D6979289CA651B8 ] RasPppoe C:\WINDOWS\system32\DRIVERS\raspppoe.sys
22:22:02.0656 0x0f8c RasPppoe - ok
22:22:02.0656 0x0f8c [ FDBB1D60066FCFBB7452FD8F9829B242, 10A2DACF944BD000032EBA8C095CB3D879CC55B28C377ADF6E52E508E47444DB ] Raspti C:\WINDOWS\system32\DRIVERS\raspti.sys
22:22:02.0781 0x0f8c Raspti - ok
22:22:02.0796 0x0f8c [ 7AD224AD1A1437FE28D89CF22B17780A, 6645235CA27D671954E3557FA37082881C3D7D47492C71264CD8CB8D108EC801 ] Rdbss C:\WINDOWS\system32\DRIVERS\rdbss.sys
22:22:02.0906 0x0f8c Rdbss - ok
22:22:02.0921 0x0f8c [ 4912D5B403614CE99C28420F75353332, 975341ECD660209987B5E5171B8315E032439E408CBE8A5986E67AF767F373BB ] RDPCDD C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
22:22:03.0046 0x0f8c RDPCDD - ok
22:22:03.0062 0x0f8c [ 15CABD0F7C00C47C70124907916AF3F1, 66B5C978B7FB6359AD8BAC9F568FE9D469E358FEAB07B1F129BA9E85F1DF723E ] rdpdr C:\WINDOWS\system32\DRIVERS\rdpdr.sys
22:22:03.0171 0x0f8c rdpdr - ok
22:22:03.0203 0x0f8c [ 6728E45B66F93C08F11DE2E316FC70DD, EA63ECD4F84CAE08BD2BF843C48AF505B1B9D7B61349A63536C9C6FEBEF23452 ] RDPWD C:\WINDOWS\system32\drivers\RDPWD.sys
22:22:03.0312 0x0f8c RDPWD - ok
22:22:03.0343 0x0f8c [ 3C37BF86641BDA977C3BF8A840F3B7FA, AB9A6E54DBA3F4561CD4837372BECCE0D73943D02E3288F944333039375AC08C ] RDSessMgr C:\WINDOWS\system32\sessmgr.exe
22:22:03.0453 0x0f8c RDSessMgr - ok
22:22:03.0515 0x0f8c [ F828DD7E1419B6653894A8F97A0094C5, E6150E1F598BA4CFEDB8FF075BC0D576518C331B864388F1CAE8812EFF106ECF ] redbook C:\WINDOWS\system32\DRIVERS\redbook.sys
22:22:03.0625 0x0f8c redbook - ok
22:22:03.0656 0x0f8c [ 7E699FF5F59B5D9DE5390E3C34C67CF5, 3FCF0442D80AB181FED4303E570378736AA1F8718C0B8B70F689A1E45200FFE4 ] RemoteAccess C:\WINDOWS\System32\mprdim.dll
22:22:03.0765 0x0f8c RemoteAccess - ok
22:22:03.0828 0x0f8c [ 5B19B557B0C188210A56A6B699D90B8F, 0FA880B81AE615206FD1738B83428AAA491D54B24168339DE6E87FDE8C6C14B0 ] RemoteRegistry C:\WINDOWS\system32\regsvc.dll
22:22:03.0984 0x0f8c RemoteRegistry - ok
22:22:04.0000 0x0f8c [ AAED593F84AFA419BBAE8572AF87CF6A, CC0FFC5A69394C8830DC66320DA01A820BBF41AD7E57D0FC343561DC5EF9A360 ] RpcLocator C:\WINDOWS\system32\locator.exe
22:22:04.0109 0x0f8c RpcLocator - ok
22:22:04.0156 0x0f8c [ 2589FE6015A316C0F5D5112B4DA7B509, 2753785BA07A1A7A25E275332F5F9F403F6E8CBF396FD0905D6BA84B98C403A6 ] RpcSs C:\WINDOWS\system32\rpcss.dll
22:22:04.0296 0x0f8c RpcSs - ok
22:22:04.0328 0x0f8c [ 471B3F9741D762ABE75E9DEEA4787E47, D9ADE42965EC22AEB4B2AD21D429C3C8232A60AA9853DEFDA7AED86A13FE8623 ] RSVP C:\WINDOWS\system32\rsvp.exe
22:22:04.0468 0x0f8c RSVP - ok
22:22:04.0484 0x0f8c [ BF2466B3E18E970D8A976FB95FC1CA85, F7794B5D12DC5D820A162850F4388E2AA80426AD07CB221799CF941C682AB501 ] SamSs C:\WINDOWS\system32\lsass.exe
22:22:04.0578 0x0f8c SamSs - ok
22:22:04.0593 0x0f8c [ 86D007E7A654B9A71D1D7D856B104353, 7B1DE53D637A5FC9619D5D07C48927AFEC89D959207F6F2E2F45DD054EEA04C7 ] SCardSvr C:\WINDOWS\System32\SCardSvr.exe
22:22:04.0750 0x0f8c SCardSvr - ok
22:22:04.0828 0x0f8c [ 0A9A7365A1CA4319AA7C1D6CD8E4EAFA, 0B582F47BD70732BAC48B8B86E5D06CE7F299A20E8177F3F2E6F28217C3FB605 ] Schedule C:\WINDOWS\system32\schedsvc.dll
22:22:04.0953 0x0f8c Schedule - ok
22:22:05.0031 0x0f8c [ 90A3935D05B494A5A39D37E71F09A677, F72733A69BC6E1A2BB91D7632FF3463C12563F60FDCC00A2CDD67FF20D479952 ] Secdrv C:\WINDOWS\system32\DRIVERS\secdrv.sys
22:22:05.0125 0x0f8c Secdrv - ok
22:22:05.0156 0x0f8c [ CBE612E2BB6A10E3563336191EDA1250, C331797DC3569F0E715766561DE2562F60B924378842246C35D2B1CF867E9D96 ] seclogon C:\WINDOWS\System32\seclogon.dll
22:22:05.0265 0x0f8c seclogon - ok
22:22:05.0296 0x0f8c [ 7FDD5D0684ECA8C1F68B4D99D124DCD0, 7105B026F966A992430F86C3698ABE15EC73E4772F1A3E362E29FD5247A5DCA6 ] SENS C:\WINDOWS\system32\sens.dll
22:22:05.0406 0x0f8c SENS - ok
22:22:05.0453 0x0f8c [ 0F29512CCD6BEAD730039FB4BD2C85CE, 4F98AE390D1B14A755700DD6CEFB9CF921F0404AF2145D2D7E5F52394F87C6A5 ] serenum C:\WINDOWS\system32\DRIVERS\serenum.sys
22:22:05.0546 0x0f8c serenum - ok
22:22:05.0640 0x0f8c [ CCA207A8896D4C6A0C9CE29A4AE411A7, 5999B39242283CD803319AADCA171CCCC6E2A40FB2FAFA51B1D29F3FF2DD8D6C ] Serial C:\WINDOWS\system32\DRIVERS\serial.sys
22:22:05.0750 0x0f8c Serial - ok
22:22:05.0812 0x0f8c [ 8E6B8C671615D126FDC553D1E2DE5562, CEEC0067514555D5CA489F50E3D7562FCA8DB8E952C3C878604C9277FC77959F ] Sfloppy C:\WINDOWS\system32\drivers\Sfloppy.sys
22:22:05.0921 0x0f8c Sfloppy - ok
22:22:05.0968 0x0f8c [ 83F41D0D89645D7235C051AB1D9523AC, B681F33EEAA511D6A2DCB9FBAA407B739184C9FF6067C6B7E51F1FC37E9D4DD7 ] SharedAccess C:\WINDOWS\System32\ipnathlp.dll
22:22:06.0109 0x0f8c SharedAccess - ok
22:22:06.0125 0x0f8c [ 1926899BF9FFE2602B63074971700412, F5C48EDBE5C6507527630B49C95BAA9F1E47EACC5A910F2B9A4528733E81A966 ] ShellHWDetection C:\WINDOWS\System32\shsvcs.dll
22:22:06.0234 0x0f8c ShellHWDetection - ok
22:22:06.0234 0x0f8c Simbad - ok
22:22:06.0265 0x0f8c SkypeUpdate - ok
22:22:06.0281 0x0f8c Sparrow - ok
22:22:06.0296 0x0f8c [ AB8B92451ECB048A4D1DE7C3FFCB4A9F, DD17733CBB370FCA08F0296704D7CBEACA3C8F76D0ABE4761C3B1FFDF7481D9E ] splitter C:\WINDOWS\system32\drivers\splitter.sys
22:22:06.0390 0x0f8c splitter - ok
22:22:06.0421 0x0f8c [ D8E14A61ACC1D4A6CD0D38AEBAC7FA3B, 130D686A220AF97EBF33DD481B79990F259B4EE38DD95A35CD3D0F0517790FF0 ] Spooler C:\WINDOWS\system32\spoolsv.exe
22:22:06.0546 0x0f8c Spooler - ok
22:22:06.0562 0x0f8c [ 76BB022C2FB6902FD5BDD4F78FC13A5D, 6031CB2344D7277FC703480EB43CF856A0F8F818EA98FF26A2CA532336CD2DFA ] sr C:\WINDOWS\system32\DRIVERS\sr.sys
22:22:06.0656 0x0f8c sr - ok
22:22:06.0703 0x0f8c [ 3805DF0AC4296A34BA4BF93B346CC378, B57A14F1B7B0997E619DDD62B73157AA2399A9852166FB58139CBB358A88F6F3 ] srservice C:\WINDOWS\system32\srsvc.dll
22:22:06.0812 0x0f8c srservice - ok
22:22:06.0843 0x0f8c [ 5252605079810904E31C332E241CD59B, 039DD965DE2137219168F95CA3BF1CA7353957026BDD0481F7964E2578DF2128 ] Srv C:\WINDOWS\system32\DRIVERS\srv.sys
22:22:06.0953 0x0f8c Srv - ok
22:22:07.0031 0x0f8c [ 0A5679B3714EDAB99E357057EE88FCA6, 01E1A101FFF48402C77E385A78FEF27876E04533B60EB1C18558A737E57E5FA8 ] SSDPSRV C:\WINDOWS\System32\ssdpsrv.dll
22:22:07.0140 0x0f8c SSDPSRV - ok
22:22:07.0218 0x0f8c [ 8BAD69CBAC032D4BBACFCE0306174C30, 2AA0DA710FCBFF38FE8DA91EE02E7A4503269347E61F8D3246FCA3384BBA2305 ] stisvc C:\WINDOWS\system32\wiaservc.dll
22:22:07.0343 0x0f8c stisvc - ok
22:22:07.0375 0x0f8c [ 3941D127AEF12E93ADDF6FE6EE027E0F, EA1F0E32E1C5E90FA4AAC421DEBBE086512340758D3217A6334E886BCE638B51 ] swenum C:\WINDOWS\system32\DRIVERS\swenum.sys
22:22:07.0484 0x0f8c swenum - ok
22:22:07.0562 0x0f8c [ 8CE882BCC6CF8A62F2B2323D95CB3D01, B408550A581F3DA222355964AFA4E976AD8471F0AA37573C42C4948AE5A23A3B ] swmidi C:\WINDOWS\system32\drivers\swmidi.sys
22:22:07.0671 0x0f8c swmidi - ok
22:22:07.0687 0x0f8c SwPrv - ok
22:22:07.0687 0x0f8c symc810 - ok
22:22:07.0703 0x0f8c symc8xx - ok
22:22:07.0703 0x0f8c sym_hi - ok
22:22:07.0718 0x0f8c sym_u3 - ok
22:22:07.0765 0x0f8c [ 8B83F3ED0F1688B4958F77CD6D2BF290, 546D3602183702B4F53E84413CFA2C933D64C8540378E54A8DCD148F3F36A2DA ] sysaudio C:\WINDOWS\system32\drivers\sysaudio.sys
22:22:07.0875 0x0f8c sysaudio - ok
22:22:07.0921 0x0f8c [ C7ABBC59B43274B1109DF6B24D617051, 4384CA0AA6CE9B603CF7DB775A3C721E46715D5B120B94FB57DEADAADE18535B ] SysmonLog C:\WINDOWS\system32\smlogsvc.exe
22:22:08.0031 0x0f8c SysmonLog - ok
22:22:08.0078 0x0f8c [ 3CB78C17BB664637787C9A1C98F79C38, F35C31F6B7F366CB949D1044B357C76DEC9170441C5E559802794F62B72FD255 ] TapiSrv C:\WINDOWS\System32\tapisrv.dll
22:22:08.0187 0x0f8c TapiSrv - ok
22:22:08.0312 0x0f8c [ 93EA8D04EC73A85DB02EB8805988F733, 013008E23F5F14E0C836C28524D1181759BAF84530C6331163882A772217F398 ] Tcpip C:\WINDOWS\system32\DRIVERS\tcpip.sys
22:22:08.0437 0x0f8c Tcpip - ok
22:22:08.0515 0x0f8c [ 6471A66807F5E104E4885F5B67349397, F35CBFFB8BB235CCE30EF94A5273333900DD49FD506BF9D55D99A320B8A53A5A ] TDPIPE C:\WINDOWS\system32\drivers\TDPIPE.sys
22:22:08.0609 0x0f8c TDPIPE - ok
22:22:08.0687 0x0f8c [ C56B6D0402371CF3700EB322EF3AAF61, 7743FA4C734BCE38EFB1CA69BC17364D8421E2CD172F856F7E38E7AE1EE93F2F ] TDTCP C:\WINDOWS\system32\drivers\TDTCP.sys
22:22:08.0796 0x0f8c TDTCP - ok
22:22:08.0890 0x0f8c [ 88155247177638048422893737429D9E, B6D4E8691917946332C2208D01F8C8281978C1AD1E9951C5D99DF0D49AC34B3B ] TermDD C:\WINDOWS\system32\DRIVERS\termdd.sys
22:22:09.0000 0x0f8c TermDD - ok
22:22:09.0031 0x0f8c [ FF3477C03BE7201C294C35F684B3479F, D6246521539BA4ACD022D26983182F5E323D2EF1EA7C54265A248C43A1CE5202 ] TermService C:\WINDOWS\System32\termsrv.dll
22:22:09.0140 0x0f8c TermService - ok
22:22:09.0156 0x0f8c [ 1926899BF9FFE2602B63074971700412, F5C48EDBE5C6507527630B49C95BAA9F1E47EACC5A910F2B9A4528733E81A966 ] Themes C:\WINDOWS\System32\shsvcs.dll
22:22:09.0265 0x0f8c Themes - ok
22:22:09.0296 0x0f8c [ DB7205804759FF62C34E3EFD8A4CC76A, 13A4248F528CE98ACA66898E56822E4FC49B11F491FF1F61A687BA601BF0A802 ] TlntSvr C:\WINDOWS\system32\tlntsvr.exe
22:22:09.0421 0x0f8c TlntSvr - ok
22:22:09.0421 0x0f8c TosIde - ok
22:22:09.0453 0x0f8c [ 55BCA12F7F523D35CA3CB833C725F54E, 849FB1AE31B143B14B298BBC0D91230693D41DEB95F46516878F53A7F4186C38 ] TrkWks C:\WINDOWS\system32\trkwks.dll
22:22:09.0593 0x0f8c TrkWks - ok
22:22:09.0640 0x0f8c [ 5787B80C2E3C5E2F56C2A233D91FA2C9, 3774905CF77954DFCECDA5BCC7CDE3D0ED72712BFAAD85ADAE5246306447E46C ] Udfs C:\WINDOWS\system32\drivers\Udfs.sys
22:22:09.0750 0x0f8c Udfs - ok
22:22:09.0750 0x0f8c ultra - ok
22:22:09.0812 0x0f8c [ 402DDC88356B1BAC0EE3DD1580C76A31, 32A686595710336A6BFD54C03F552AE39439611662F84EF5D24193AE5665C6F3 ] Update C:\WINDOWS\system32\DRIVERS\update.sys
22:22:09.0953 0x0f8c Update - ok
22:22:09.0968 0x0f8c [ 1EBAFEB9A3FBDC41B8D9C7F0F687AD91, 7746916DB48E3F5B243B63C066596AD9037A494BF1AD935946DD04AC85D983DF ] upnphost C:\WINDOWS\System32\upnphost.dll
22:22:10.0093 0x0f8c upnphost - ok
22:22:10.0125 0x0f8c [ 05365FB38FCA1E98F7A566AAAF5D1815, 16843048CEEC3DAA3B953A12FF1EE339E86783A08F2A56DA7F94AD9F9717D77D ] UPS C:\WINDOWS\System32\ups.exe
22:22:10.0234 0x0f8c UPS - ok
22:22:10.0265 0x0f8c [ 173F317CE0DB8E21322E71B7E60A27E8, 7042441BA63AE38AE9D7BE0BC5CA7404FC9EE5BB3F084604A68F01E82769652A ] usbccgp C:\WINDOWS\system32\DRIVERS\usbccgp.sys
22:22:10.0375 0x0f8c usbccgp - ok
22:22:10.0406 0x0f8c [ 65DCF09D0E37D4C6B11B5B0B76D470A7, 90EBA8BAF45932B453D905EDF2BDDDF3A432BFD50B9F7DF58CDEAE98D11C2E2F ] usbehci C:\WINDOWS\system32\DRIVERS\usbehci.sys
22:22:10.0531 0x0f8c usbehci - ok
22:22:10.0546 0x0f8c [ 1AB3CDDE553B6E064D2E754EFE20285C, A99C4528C4227B1E96847614745AAFACD3C5F1BDFE435214DBF78740FFB300FE ] usbhub C:\WINDOWS\system32\DRIVERS\usbhub.sys
22:22:10.0656 0x0f8c usbhub - ok
22:22:10.0671 0x0f8c [ 0DAECCE65366EA32B162F85F07C6753B, 3C33AC2FC95E876933F2016CF0CDA2745491679728684DA8DF95A515CE4804BD ] usbohci C:\WINDOWS\system32\DRIVERS\usbohci.sys
22:22:10.0796 0x0f8c usbohci - ok
22:22:10.0890 0x0f8c [ A0B8CF9DEB1184FBDD20784A58FA75D4, D8AFD45BD9CF7B02F2554AA6085194DE82893AF794EDF479BC9B9E9C1758DC75 ] usbscan C:\WINDOWS\system32\DRIVERS\usbscan.sys
22:22:11.0031 0x0f8c usbscan - ok
22:22:11.0078 0x0f8c [ A32426D9B14A089EAA1D922E0C5801A9, ED1DC52EE45F8EAD3AEC4B1F817BB25634141CF48295494C5947DCE6CF7A9817 ] USBSTOR C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
22:22:11.0187 0x0f8c USBSTOR - ok
22:22:11.0265 0x0f8c [ 0D3A8FAFCEACD8B7625CD549757A7DF1, B9CFDEFCD66AA139F3DC2F967B184669532922563AD5A71769BABDC4370D065E ] VgaSave C:\WINDOWS\System32\drivers\vga.sys
22:22:11.0375 0x0f8c VgaSave - ok
22:22:11.0390 0x0f8c ViaIde - ok
22:22:11.0437 0x0f8c [ 4C8FCB5CC53AAB716D810740FE59D025, 010EAC43DBED700B73E4FC908FAAF9F6A0168EBBD5D86751E49BC33AAA18BFA4 ] VolSnap C:\WINDOWS\system32\drivers\VolSnap.sys
22:22:11.0546 0x0f8c VolSnap - ok
22:22:11.0578 0x0f8c [ 7A9DB3A67C333BF0BD42E42B8596854B, D31A9A3B1AAAB373EDD73B674102395212FCB616F829E938B7B2B7BE7D4752C5 ] VSS C:\WINDOWS\System32\vssvc.exe
22:22:11.0687 0x0f8c VSS - ok
22:22:11.0718 0x0f8c [ 54AF4B1D5459500EF0937F6D33B1914F, FA1876888BCB9C72A92369DBED4FF1A8666784523FB41E618FA0919490FCDDB9 ] W32Time C:\WINDOWS\system32\w32time.dll
22:22:11.0843 0x0f8c W32Time - ok
22:22:11.0906 0x0f8c [ E20B95BAEDB550F32DD489265C1DA1F6, 5589B2067E6C9FBA290D8C5EADDC198EBAF39C50C3CD7D2BC5CDA7CBFBC445E5 ] Wanarp C:\WINDOWS\system32\DRIVERS\wanarp.sys
22:22:12.0000 0x0f8c Wanarp - ok
22:22:12.0015 0x0f8c WDICA - ok
22:22:12.0046 0x0f8c [ 6768ACF64B18196494413695F0C3A00F, 3A8F8586F1D997D19A8478345338D2AECD785AEABDB61531DD3F92003D3230A5 ] wdmaud C:\WINDOWS\system32\drivers\wdmaud.sys
22:22:12.0156 0x0f8c wdmaud - ok
22:22:12.0171 0x0f8c [ 77A354E28153AD2D5E120A5A8687BC06, 8B2D37A4443501C0A8E70BC2079BE27F0A36FD07B561E6F68B40A72EABBC2DFE ] WebClient C:\WINDOWS\System32\webclnt.dll
22:22:12.0296 0x0f8c WebClient - ok
22:22:12.0359 0x0f8c [ 2D0E4ED081963804CCC196A0929275B5, E1D75C7D7233D81DFDE13160B0C80138DF8B35230D04FB79B367A52FACF69BF8 ] winmgmt C:\WINDOWS\system32\wbem\WMIsvc.dll
22:22:12.0468 0x0f8c winmgmt - ok
22:22:12.0593 0x0f8c [ C7E39EA41233E9F5B86C8DA3A9F1E4A8, 98C21DEEB7124426D749FACDAD06EBD7F500AE5C465A98D558919C2A51C08554 ] WmdmPmSN C:\WINDOWS\system32\mspmsnsv.dll
22:22:12.0687 0x0f8c WmdmPmSN - ok
22:22:12.0734 0x0f8c [ BAB489A5FE26F2D0C910CF7AF7E4CF92, 700325258CA7A2BC2D7AA6E3176194D21229BEA76EA37BEAE117BBF87CE4ECD4 ] Wmi C:\WINDOWS\System32\advapi32.dll
22:22:12.0921 0x0f8c Wmi - ok
22:22:12.0953 0x0f8c [ E0673F1106E62A68D2257E376079F821, 12992F18C9653050B10DC61D12988067933FCFDF02123D3A7EF5DE607A785DDC ] WmiApSrv C:\WINDOWS\system32\wbem\wmiapsrv.exe
22:22:13.0062 0x0f8c WmiApSrv - ok
22:22:13.0281 0x0f8c [ DCF3E3EDF5109EE8BC02FE6E1F045795, 4B8E14B1CFB095982D34DAEC336114F5039D7793080FB787DC95A63B6B945DD0 ] WPFFontCache_v0400 C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
22:22:13.0328 0x0f8c WPFFontCache_v0400 - ok
22:22:13.0375 0x0f8c [ 7C278E6408D1DCE642230C0585A854D5, DA46079A04F6E8E3441E4AE454AEAC02B3E935DE29CE7F6D4476F57867FCC12A ] wscsvc C:\WINDOWS\system32\wscsvc.dll
22:22:13.0484 0x0f8c wscsvc - ok
22:22:13.0546 0x0f8c [ 35321FB577CDC98CE3EB3A3EB9E4610A, C9A6F5CF282D8FCB3CDFCC4B306013480E78E1B664E1A60A4E27B161F9FFD4CD ] wuauserv C:\WINDOWS\system32\wuauserv.dll
22:22:13.0656 0x0f8c wuauserv - ok
22:22:13.0687 0x0f8c [ 81DC3F549F44B1C1FFF022DEC9ECF30B, 3D14BFEA539F9CEB16555BD56C5E3C7C8F6692FC62C2789F8AAEA1C042E63940 ] WZCSVC C:\WINDOWS\System32\wzcsvc.dll
22:22:13.0812 0x0f8c WZCSVC - ok
22:22:13.0906 0x0f8c [ 295D21F14C335B53CB8154E5B1F892B9, 9418477C2E3EA93E93D931A4EDD4500DA568FAD6040204B5201D1080203B0BBC ] xmlprov C:\WINDOWS\System32\xmlprov.dll
22:22:14.0015 0x0f8c xmlprov - ok
22:22:14.0031 0x0f8c ================ Scan global ===============================
22:22:14.0093 0x0f8c [ 42F1F4C0AFB08410E5F02D4B13EBB623, 924C30587C51C0D1E1F47991969AF492A644552E15F2480EA991DCB74A3E68D5 ] C:\WINDOWS\system32\basesrv.dll
22:22:14.0125 0x0f8c [ 1618F36D4F7F6CCCEB3EE44BA95BE85C, 1ED920E475221228EF215708701EC166A0B1BBCBD236E5B047420EBD0FF1371A ] C:\WINDOWS\system32\winsrv.dll
22:22:14.0140 0x0f8c [ 1618F36D4F7F6CCCEB3EE44BA95BE85C, 1ED920E475221228EF215708701EC166A0B1BBCBD236E5B047420EBD0FF1371A ] C:\WINDOWS\system32\winsrv.dll
22:22:14.0171 0x0f8c [ 0E776ED5F7CC9F94299E70461B7B8185, 22750B3829133D1D4BB3CE2FA6247BE2373B5D15A6ED1C8A71673AA1CE7D9530 ] C:\WINDOWS\system32\services.exe
22:22:14.0171 0x0f8c [ Global ] - ok
22:22:14.0187 0x0f8c ================ Scan MBR ==================================
22:22:14.0203 0x0f8c [ 8F558EB6672622401DA993E1E865C861 ] \Device\Harddisk0\DR0
22:22:15.0343 0x0f8c \Device\Harddisk0\DR0 - ok
22:22:15.0359 0x0f8c ================ Scan VBR ==================================
22:22:15.0359 0x0f8c [ 686C4C6085E7C78E64B779A86421BFE7 ] \Device\Harddisk0\DR0\Partition1
22:22:15.0375 0x0f8c \Device\Harddisk0\DR0\Partition1 - ok
22:22:15.0375 0x0f8c ================ Scan generic autorun ======================
22:22:15.0390 0x0f8c NvCplDaemon - ok
22:22:15.0390 0x0f8c nwiz - ok
22:22:15.0390 0x0f8c NvMediaCenter - ok
22:22:16.0500 0x0f8c [ 86C004E1EFE7FC23C2C173D5BC950B93, 48B8A2A32C219F882B3ECCE78E95C7D357F2DE1D60E246018D86A69F4CDDE0FC ] C:\WINDOWS\RTHDCPL.EXE
22:22:18.0937 0x0f8c RTHDCPL - ok
22:22:19.0140 0x0f8c [ 8A451B4C2E8688311B7483B2D61D3FB6, 55D364311F53C39A63E2CFFD8A4A7C304F0EC321D116EC4C7D74CFE2A070FD3A ] C:\WINDOWS\SkyTel.EXE
22:22:19.0265 0x0f8c SkyTel - ok
22:22:19.0312 0x0f8c [ 8B4CBBA1EA526830C7F97E7822E2493A, 1DFD05B1C0050DB44F5B4293E5574BFC292AF804A63FC0A70131BB498C326977 ] C:\WINDOWS\ALCMTR.EXE
22:22:19.0359 0x0f8c Alcmtr - ok
22:22:19.0578 0x0f8c [ E5FF7729053F67212768C5D37BE762B4, 1A0633FF2062F2C3D5675C7E532B30AF45D0E53D997A7357CC0AA8DA3BE6E1A6 ] C:\Program Files\AVG\AVG2014\avgui.exe
22:22:20.0031 0x0f8c AVG_UI - ok
22:22:20.0093 0x0f8c [ 5F1D5F88303D4A4DBC8E5F97BA967CC3, 5FB24FC7916A6E6B3BE7D84CB1684215B266CD1495575C2E5672B8447932E5B1 ] C:\WINDOWS\system32\CTFMON.EXE
22:22:20.0203 0x0f8c CTFMON.EXE - ok
22:22:20.0203 0x0f8c [ 5F1D5F88303D4A4DBC8E5F97BA967CC3, 5FB24FC7916A6E6B3BE7D84CB1684215B266CD1495575C2E5672B8447932E5B1 ] C:\WINDOWS\system32\CTFMON.EXE
22:22:20.0312 0x0f8c CTFMON.EXE - ok
22:22:20.0468 0x0f8c [ 78B24A64F84603784A10C86F4CEF71AF, EFA60567AADB6D273D22156DFCD60BD73CE6176FEBF62DAFDABACB72159BA396 ] C:\Program Files\IObit\Advanced SystemCare 5\ASCTray.exe
22:22:20.0515 0x0f8c Advanced SystemCare 5 - ok
22:22:20.0703 0x0f8c [ 4458989C34FA84B5A75DD3ABCFBE786A, D37CBB988E98929D65C4D22B030ABEBD2CE2FFE091B63424D0F55C16958DAEF1 ] C:\Program Files\Pando Networks\Media Booster\PMB.exe
22:22:21.0093 0x0f8c Pando Media Booster - ok
22:22:21.0156 0x0f8c AVG-Secure-Search-Update_0214c - ok
22:22:21.0171 0x0f8c [ 5F1D5F88303D4A4DBC8E5F97BA967CC3, 5FB24FC7916A6E6B3BE7D84CB1684215B266CD1495575C2E5672B8447932E5B1 ] C:\WINDOWS\system32\CTFMON.EXE
22:22:21.0281 0x0f8c CTFMON.EXE - ok
22:22:21.0281 0x0f8c Waiting for KSN requests completion. In queue: 9
22:22:22.0312 0x0f8c AV detected via SS1: AVG AntiVirus Free Edition 2014, 2014.0, enabled, updated
22:22:22.0312 0x0f8c Win FW state via NFM: enabled
22:22:22.0531 0x0f8c ============================================================
22:22:22.0531 0x0f8c Scan finished
22:22:22.0531 0x0f8c ============================================================
22:22:22.0546 0x0bc0 Detected object count: 0
22:22:22.0546 0x0bc0 Actual detected object count: 0
22:22:31.0015 0x029c Deinitialize success

 

лог от aswMBR

 

 

aswMBR version 1.0.1.2252 Copyright© 2014 AVAST Software
Run date: 2015-09-08 00:00:21
-----------------------------
00:00:21.515 OS Version: Windows 5.1.2600 Service Pack 3
00:00:21.515 Number of processors: 1 586 0x5F03
00:00:21.515 ComputerName: SNAKE-45B7DC405 UserName: Adnimistrator
00:00:22.281 Initialize success
00:00:22.390 VM: initialized successfully
00:00:22.390 VM: Amd CPU virtualization not supported
00:01:42.609 AVAST engine defs: 15090701
00:02:23.859 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\0000005f
00:02:23.859 Disk 0 Vendor: SAMSUNG_HD320KJ CP100-13 Size: 305245MB BusType: 3
00:02:23.953 Disk 0 MBR read successfully
00:02:23.953 Disk 0 MBR scan
00:02:23.984 Disk 0 Windows XP default MBR code
00:02:23.984 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 305234 MB offset 63
00:02:24.000 Disk 0 default boot code
00:02:24.015 Disk 0 scanning sectors +625121280
00:02:24.046 Disk 0 scanning C:\WINDOWS\system32\drivers
00:02:33.375 Service scanning
00:02:47.718 Modules scanning
00:02:48.218 Disk 0 trace - called modules:
00:02:48.234 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll nvata.sys
00:02:48.234 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8a3c2ab8]
00:02:48.234 3 CLASSPNP.SYS[ba8e8fd7] -> nt!IofCallDriver -> \Device\00000060[0x8a304f18]
00:02:48.234 5 ACPI.sys[ba77f620] -> nt!IofCallDriver -> \Device\0000005f[0x8a3c2030]
00:02:48.531 AVAST engine scan C:\WINDOWS
00:02:53.109 AVAST engine scan C:\WINDOWS\system32
00:06:46.312 AVAST engine scan C:\WINDOWS\system32\drivers
00:07:02.468 AVAST engine scan C:\Documents and Settings\Adnimistrator
00:31:37.484 AVAST engine scan C:\Documents and Settings\All Users
00:34:16.796 Disk 0 statistics 2364022/0/0 @ 0,77 MB/s
00:34:16.812 Scan finished successfully
00:34:39.984 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Adnimistrator\My Documents\MBR.dat"
00:34:39.984 The log file has been saved successfully to "C:\Documents and Settings\Adnimistrator\My Documents\aswMBR.txt"

лог от RK :

 

RogueKiller V10.10.4.0 [sep 4 2015] by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Website : http://www.adlice.com/software/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows XP (5.1.2600 Service Pack 3) 32 bits version
Started in : Normal mode
User : Adnimistrator [Administrator]
Started from : C:\Documents and Settings\Adnimistrator\My Documents\RogueKiller.exe
Mode : Scan Aborted -- Date : 09/08/2015 01:27:35

¤¤¤ Processes : 0 ¤¤¤

¤¤¤ Registry : 8 ¤¤¤
[suspicious.Path] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad | CDBurn : {fbeb8a05-beee-4442-804e-409d6c4515e9} [x] -> Found
[PUM.Dns] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters | DhcpNameServer : 84.238.242.1 ([X]) -> Found
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters | DhcpNameServer : 84.238.242.1 ([X]) -> Found
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Tcpip\Parameters | DhcpNameServer : 84.238.242.1 ([X]) -> Found
[PUM.Dns] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{8DC8699D-5E9B-4F3A-B04F-46DAD2B5E1DF} | DhcpNameServer : 84.238.242.1 ([X]) -> Found
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{8DC8699D-5E9B-4F3A-B04F-46DAD2B5E1DF} | DhcpNameServer : 84.238.242.1 ([X]) -> Found
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Tcpip\Parameters\Interfaces\{8DC8699D-5E9B-4F3A-B04F-46DAD2B5E1DF} | DhcpNameServer : 84.238.242.1 ([X]) -> Found
[suspicious.Path] HKEY_CLASSES_ROOT\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32 | (default) : C:\Documents and Settings\Adnimistrator\Local Settings\Application Data\YmcPack\gzjjizlj.dll [x] -> Found

¤¤¤ Tasks : 0 ¤¤¤

¤¤¤ Files : 0 ¤¤¤

¤¤¤ Hosts File : 0 ¤¤¤

¤¤¤ Antirootkit : 0 (Driver: Loaded) ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ MBR Check : ¤¤¤

FRST.gif Фикс с Farbar Recovery Scan Tool

 
icon13.gif Изтеглете прикачения файл и го запазете там, където сте свалили FRST.exe => fixlist.txt
Стартирайте отново FRST.exe и натиснете бутона Fix веднъж и изчакайте.
Ще се създаде нов лог файла FixLog.txt. Прикачете съдържанието му в следващия си коментар.
 
ЗАБЕЛЕЖКА: Този скрипт е написан специално за този потребител,и за тази конкретна машина. Изпълнението на фикса, на друг компютър може да доведе до увреждане на  операционната ви система
 
 
Пишете какво е моментното състояние след процедурите до сега..! Има ли подобрение..?
 
 
  Дневници
 
В следващия си отговор, моля да включите следните дневници:

  • FixLog.txt
  • Автор

Fix result of Farbar Recovery Scan Tool (x86) Version:07-09-2015
Ran by Adnimistrator (2015-09-08 21:58:38) Run:1
Running from C:\Documents and Settings\Adnimistrator\My Documents
Loaded Profiles: Adnimistrator & Administrator (Available Profiles: Adnimistrator & Administrator)
Boot Mode: Normal

==============================================

fixlist content:
*****************
start
CreateRestorePoint:
CloseProcesses:
HKU\S-1-5-21-527237240-2052111302-839522115-1003\...409d6c4515e9\InprocServer32: [Default-shell32] C:\Documents and Settings\Adnimistrator\Local Settings\Application Data\YmcPack\gzjjizlj.dll
C:\Documents and Settings\Adnimistrator\Local Settings\Application Data\YmcPack\gzjjizlj.dll
CustomCLSID:HKU\S-1-5-21-527237240-2052111302-839522115-1003_Classes\CLSID\{FBEB8A05-BEEE-4442-804E-409D6C4515E9}\InprocServer32 -> C:\Documents and Settings\Adnimistrator\Local Settings\Application Data\YmcPack\gzjjizlj.dll No File
emptytemp:
reboot:
end
*****************

Restore point was successfully created.
Processes closed successfully.
"HKU\S-1-5-21-527237240-2052111302-839522115-1003\Software\Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}" => key removed successfully.
"C:\Documents and Settings\Adnimistrator\Local Settings\Application Data\YmcPack\gzjjizlj.dll" => File/Folder not found.
CustomCLSID:HKU\S-1-5-21-527237240-2052111302-839522115-1003_Classes\CLSID\{FBEB8A05-BEEE-4442-804E-409D6C4515E9}\InprocServer32 -> C:\Documents and Settings\Adnimistrator\Local Settings\Application Data\YmcPack\gzjjizlj.dll No File => key could not remove. ErrorCode: 0xC000003B
EmptyTemp: => 389.1 MB temporary data Removed.


The system needed a reboot.

==== End of Fixlog 21:58:42 ====

 

има засега не се наблюдават някакви самостартиращисе процеси и небави толкова

Редактирано от DeadSpace3 (преглед на промените)

За контрол:

 

icon_zps423a0d9f.jpgМоля изтеглете ZHPcleaner и я запазете на вашия десктоп.

  • Стартирайте ZHPCleaner с десен клик върху файла и изберете от контекстното меню "Run as administrator"
  • Кликнете върху Ashampoo_Snap_20140819_13h09m50s_001__zp за да се съгласите с лицензионното споразумение.
  • Изберете бутона y3pI4LR.png.
  • Браузърите ще бъдат затворени автоматично.
  • Ще се отвори лог файл след приключването на проверката.
  • Публикувайте лог файла в следващия си коментар.

 

 

adwcleaner_new.png Сканиране с AdwCleaner
 
Моля, изтеглете и стартирайте програмата AdwCleaner (by Xplode):

  • Затворете всички стартирани програми и браузъри
  • Кликнете два пъти върху adwcleaner.exe за да стартирате инструмента.
  • Натиснете OK, за да потвърдите, че всички стартирани програми ще бъдат затворени.
  • Маркирайте Clean
  • Вашият компютър ще се рестартира автоматично. Текстовия файл ще се отвори след рестарта.
  • Моля, да публикувате съдържанието на този лог в отговора си
  • Можете да намерите лога,който автоматично се запомня тук C:AdwCleaner[s0].txt

 

 

JRTbythisisu.png Сканиране с Junkware Removal Tool
 
Моля, изтеглете Junkware Removal Tool (by Thisisu ) и запазете на вашия десктоп.

  • Спрете временно работата на защитните програми.
  • Стартирайте инструмента JRT.exe
  • Ще се отвори ДОС прозорец. Натиснете което и да е копче от клавиатурата.
  • Затворете излишните приложения и всички браузъри и изчакайте проверката да завърши.
  • Ще се появи лог файл (който можете да намерите и ръчно на десктопа с името JRT.txt).
  • Моля копирайте съдържанието на лог файла в следващия си пост.

 

 

GUZVCQN.jpg Моля, изтеглете Malwarebytes Anti -Malware и го запомнете на вашия работен плот .

Кликнете два пъти върху mbam-setup - 2.1.4.1018.exe и следвайте инструкциите, за да инсталирате програмата . Убедете се че преди края на инсталацията има отметка тук:

  • Launch Malwarebytes Anti-Malware
  • 14-дневен пробен период е предварително избран. Можете да премахнете отметката ако желаете, при което няма да се ограничат възможностите за сканиране и премахване на зловреден софтуер с програмата.
  • Натиснете Finish
  • В края на инсталацията, ще се извърши актуализация на база данни.
  • Отидете до табът Settings > Detection and Protection > и под категорията Detection Options включете опцията "Scan for rootkits".
  • Отидете до табът Scan, сложете радио-бутона пред Threat Scan и кликнете върху Scan Now и ще започне сканиране за зловреден софтуер.
  • При някои инфекции можете да видите съобщението:

                                      "Could not load DDA driver"

  • Натиснете "Yes" на това съобщение за да позволите драйвера да се зареди след рестарт.
  • Когато сканирането приключи, ако има някакви открити зарази , щракнете върху Remove Selected за да се позволи на Mbam да почисти засеченото. .
  • В повечето случаи, ще се поиска рестартиране
  • Изчакайте подканата за рестартиране на компютъра, за да се появи, след това кликнете върху Yes
  • След рестарта ,стартирайте Mbam още веднъж.
  • Кликнете на History tab > Application Logs .
  • Кликнете два пъти върху реда , който показва датата и часа на сканирането и натиснете бутона "Copy to Clipboard"
  • Поставете съдържанието на лог файла с клавишната комбинация Ctrl + V и го публикувайте в следващия си коментар.

 

 

Дневници
 
В следващия си отговор, моля да включите следните дневници:

 

  • Лог файл от ZHPCleaner
  • AdwCleaner[s0].txt
  • JRT.txt
  • Дневник от Malwarebytes Anti -Malware
  • Автор

~ ZHPCleaner v2015.9.8.344 by Nicolas Coolman (2015/09/08)
~ Run by Adnimistrator (Administrator) (09/09/2015 00:47:36)
~ Site : http://www.nicolascoolman.fr
~ Facebook : https://www.facebook.com/nicolascoolman1
~ State version : Version OK
~ Type : Scan
~ Report : C:\Documents and Settings\Adnimistrator\Desktop\ZHPCleaner.txt
~ Quarantine : C:\Documents and Settings\Adnimistrator\Application Data\ZHP\ZHPCleaner_Quarantine.txt
~ UAC : Deactivate
~ Boot Mode : Normal (Normal boot)
Windows XP, 32-bit Service Pack 3 (Build 2600)


---\\ Services (0)
~ No malicious or unnecessary items found.


---\\ Browser internet (0)
~ No malicious or unnecessary items found.


---\\ Hosts file (1)
~ The hosts file is legitimate (19)


---\\ Scheduled automatic tasks. (0)
~ No malicious or unnecessary items found.


---\\ Explorer ( File, Folder) (0)
~ No malicious or unnecessary items found.


---\\ Registry ( Key, Value, Data) (0)
~ No malicious or unnecessary items found.


---\\ Result of repair
~ Any repair made
~ Browser not found (Google Chrome)
~ Browser not found (Mozilla Firefox)


---\\ Statistics
~ Items scanned : 29948
~ Items found : 0
~ Items cancelled : 0
~ Items repaired : 0


~ End of search in 2 minutes
===================
ZHPCleaner--09092015-00_50_32.txt

____________________________________________________________________________

 

 

 

 

# AdwCleaner v5.007 - Logfile created 09/09/2015 at 01:06:57
# Updated 08/09/2015 by Xplode
# Database : 2015-09-08.2 [server]
# Operating system : Microsoft Windows XP Service Pack 3 (x86)
# Username : Adnimistrator - C0BRA
# Running from : C:\Documents and Settings\Adnimistrator\My Documents\adwcleaner_5.007.exe
# Option : Cleaning
# Support : http://toolslib.net/forum

***** [ Services ] *****


***** [ Folders ] *****


***** [ Files ] *****


***** [ Shortcuts ] *****


***** [ Scheduled tasks ] *****


***** [ Registry ] *****

[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{B2BC04DF-EFBD-409A-95CA-36874E5AB92A}
[-] Key Deleted : HKU\.DEFAULT\Software\Avg Secure Update
[-] Key Deleted : HKCU\Software\Avg Secure Update

***** [ Web browsers ] *****


*************************

:: Winsock settings cleared

########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt - [891 bytes] ##########

__________________________________________________________________________________

 

 

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 7.6.0 (08.31.2015:1)
OS: Microsoft Windows XP x86
Ran by Adnimistrator on 09.09.2015 Ј. at 1:45:11,01
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Tasks



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 09.09.2015 Ј. at 1:48:29,73
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

 

_________________________________________________________________________

 

 

 

 

 

 

 

 

Malwarebytes Anti-Malware
www.malwarebytes.org

Дата на сканиране: 09.9.2015 г.
Час на сканиране: 04:45:28
Дневник: Malware fox.txt
Администратор: Да

Версия: 2.1.8.1057
База от данни за злонамерен софтуер: v2015.09.08.07
База от данни за рууткити: v2015.08.16.01
Лиценз: Пробен период
Защита от злонамерен софтуер: Разрешено
Защита от злонамерени страници: Разрешено
Самозащита: Забранено

ОС: Windows XP Service Pack 3
Процесор: x86
Файлова система: NTFS
Потребител: Adnimistrator

Тип сканиране: Сканиране за заплахи
Резултат: Отменено
Сканиране обекти: 32228
Изминало време: 7 мин. 39 сек.

Памет: Разрешено
Начално стартиране: Разрешено
Файлова система: Разрешено
Архиви: Разрешено
Рууткити: Разрешено
Евристика: Разрешено
ПНП: Разрешено
ПНИ: Разрешено

Процеси: 0
(Не бяха открити злонамерени обекти)

Модули: 0
(Не бяха открити злонамерени обекти)

Ключове в системния регистър: 0
(Не бяха открити злонамерени обекти)

Стойности в системния регистър: 0
(Не бяха открити злонамерени обекти)

Данни в системния регистър: 0
(Не бяха открити злонамерени обекти)

Папки: 0
(Не бяха открити злонамерени обекти)

Файлове: 0
(Не бяха открити злонамерени обекти)

Физически сектори: 0
(Не бяха открити злонамерени обекти)


(end)

Абсолютно чиста система..! :)

 

icon_arrow.gif Изтеглете DelFix и го стартирайте. Сложете отметка пред:

  • Remove disinfection tools
  • Purge system restore
  • Reset system settings
  • Create registry backup

delfix.JPG
 
..и след това натиснете бутона Run

  • След като операцията е завърши,ще се създаде дневник
  • Копирате го и го поставите в следващия си отговор

Инструмента ще се самоизтрие след като приключи своята задача!

 

Ако има нещо което използвахме в лечението и не се е премахнало след последните инструкции го премахнете ръчно ,по стандартните методи..!

 

Ако нямате други проблеми да приключваме...Маркирам случая за "Решен"...! Пожелавам лек ден и безопасен интернет..! :)

  • Автор

# DelFix v1.011 - Logfile created 09/09/2015 at 18:54:46
# Updated 18/08/2015 by Xplode
# Username : Adnimistrator - C0BRA
# Operating System : Microsoft Windows XP Service Pack 3 (32 bits)

~ Removing disinfection tools ...

Deleted : C:\AdwCleaner
Deleted : HKLM\SOFTWARE\AdwCleaner
Deleted : HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ASWMBR

~ Creating registry backup ... OK

~ Cleaning system restore ...

Deleted : RP #235 [Контролна точка на системата | 08/28/2015 20:26:12]
Deleted : RP #236 [Контролна точка на системата | 08/30/2015 20:54:37]
Deleted : RP #237 [Контролна точка на системата | 09/05/2015 19:50:31]
Deleted : RP #238 [Контролна точка на системата | 09/07/2015 20:25:29]
Deleted : RP #239 [Restore Point Created by FRST | 09/08/2015 18:58:40]
Deleted : RP #240 [Restore Point Created by FRST | 09/08/2015 21:24:09]
Deleted : RP #241 [JRT Pre-Junkware Removal | 09/08/2015 22:45:13]

New restore point created !

~ Resetting system settings ... OK

########## - EOF - ##########

 

 Бях изтегли един архив WINRAR и в него имаше модел блабалбал.mdl  за Counter - Strike 1.6 авг го провери изписа 8 файла че има а там беше само блабал.mdl файл другото което забелязах беше че беше забранен криптиран да не се променя или трие този файл и след като го разархивирах почна да зареждат програми и изчезват които небях активирал

( това преди да ви пиша тук) възможнолие по някакъв начин да са били криптирани или "прикачени" към .mdl файла... имали начин да се разбере дали има нещо друго в архивите като този пример който дадох ?... примерно за определен архив защото за първи път попадам на такова нещо по принцип винаги са били ехета ?

Редактирано от Heart Of The Swarm (преглед на промените)

Архивирана тема

Темата е твърде стара и е архивирана. Не можете да добавяте нови отговори в нея, но винаги можете да публикувате нова тема, в която да продължи дискусията. Регистрирайте се или влезте във вашия профил за да публикувате нова тема.

Назад

Разглеждащи това в момента 0

  • Няма регистрирани потребители разглеждащи тази страница.

Дарение

  • Подкрепи съществуването на форума - направи дарение
    32%
    Дарени 315 € от нужните 1 000 €

Бюлетин

Получавайте известие, когато има важна промяна или новина свързана с форума.
Абонирайте се

Профил

Навигация

Търсене

Търсене

Конфигуриране на push известия в браузъра
Chrome (Android)
  1. Докоснете иконата на катинар до адресната лента.
  2. Докоснете Разрешения → Известия.
  3. Променете предпочитанията си.
Chrome (Desktop)
  1. Кликнете върху иконата на катинар в адресната лента.
  2. Изберете Настройки на сайта.
  3. Намерете Известия и коригирайте предпочитанията си.