Getting redirected to adf.ly; pricegong

shogel · November 13, 2013

Good afternoon,

I hope you can help me. Both google chrome and IE keep loading the www.adf.ly website. Malwarebytes found a PUP "pricegong" but doesn`t seem to remove it completely.

I found your instructions here: https://forums.malwarebytes.org/index.php?showtopic=130750 (logs arttached) but the problem is still there.

Thank you.

JRT.txt

dds.txt

MBAM-log-2013-11-13 (12-48-01).txt

AdwCleanerS0.txt

attach.txt

Psychotic · November 13, 2013

Hi there,
my name is Marius and I will assist you with your malware related problems.

Before we move on, please read the following points carefully.

First, read my instructions completely. If there is anything that you do not understand kindly ask before proceeding.
Perform everything in the correct order. Sometimes one step requires the previous one.
If you have any problems while following my instructions, Stop there and tell me the exact nature of your problem.
Do not run any other scans without instruction or add/remove software unless I tell you to do so. This would change the output of our tools and could be confusing for me.
Post all logfiles as a reply rather than as an attachment unless I specifically ask you. If you can not post all logfiles in one reply, feel free to use more posts.
If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed.
Stay with me. I will give you some advice about prevention after the cleanup process. Absence of symptoms does not always mean the computer is clean.
My first language is not english. So please do not use slang or idioms. It could be hard for me to read. Thanks for your understanding.

Sieh an - ein Eidgenosse!

Scan with Gmer rootkit scanner

Please download Gmer from here by clicking on the "Download EXE" Button.

Double click on the randomly named GMER.exe. If asked to allow gmer.sys driver to load, please consent.
If it gives you a warning about rootkit activity and asks if you want to run scan...click on NO.
In the right panel, you will see several boxes that have been checked. Uncheck the following ...
- Sections
- IAT/EAT
- Show All ( should be unchecked by default )
[*]Leave everything else as it is. [*]Close all other running programs as well as your Browser. [*]Click the Scan button & wait for it to finish. [*]Once done click on the Save.. button, and in the File name area, type in "ark.txt" or it will save as a .log file which cannot be uploaded to your post. [*]Save it where you can easily find it, such as your desktop. [*]Please post the content of the ark.txt here.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<--- ROOKIT" entries

shogel · November 13, 2013

Hi Marius,

Gmer said that it didn`t find any modifications and the text file was empty.

Sieh an - ein Eidgenosse!

Psychotic · November 13, 2013

Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!

Es sollte nie auf eigene Initiative hin ausgeführt werden!

Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Downloade dir bitte Combofix von einem dieser Downloadspiegel

Link 1
Link 2

WICHTIG - Speichere Combofix auf deinem Desktop

Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Combofix wird überprüfen, ob die Microsoft Windows Wiederherstellungskonsole installiert ist.
Ist diese nicht installiert, erlaube Combofix diese herunter zu laden und zu installieren. Folge dazu einfach den Anweisungen und aktzeptiere die End Nutzer Lizenz.
Bei heutiger Malware ist dies sehr empfehlenswert, da diese uns eine Möglichkeit bietet, dein System zu reparieren, falls was schief geht.
Bestätige die Information, dass die Wiederherstellungskonsole installiert wurde mit Ja.

Hinweis: Ist diese bereits installiert, wird Combofix mit der Malwareentfernung fortfahren.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.

shogel · November 13, 2013

I`m sorry, I heard about bad experiences about using combofix in the past and I`d prefer not to use it. Could you draw any conclusions about the problem I have from the files I sent you?

Psychotic · November 13, 2013

I don´t know what you have heard about combofix, but it is safe to use when under surveillance.

Please proceed.

shogel · November 13, 2013

Can we try to solve this problem without using combofix?

Psychotic · November 13, 2013

Scan with FRST in normal mode

Please download Farbar's Recovery Scan Tool to your desktop: FRST 32bit or FRST 64bit (If not sure: Start --> Computer (right click) --> properties)

Run FRST.
Don´t change one of the checkboxes and hit Scan.
Logfiles are created on your desktop.
Poste the FRST.txt and (after the first scan only!) the Addition.txt.

shogel · November 13, 2013

[scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 13-11-2013

Ran by vad (administrator) on TRIVADIS-DBA786 on 13-11-2013 18:55:01

Running from C:\Documents and Settings\vad\My Documents\Downloads

Microsoft Windows XP Professional Service Pack 3 (X86) OS Language: English(US)

Internet Explorer Version 8

Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(NVIDIA Corporation) C:\WINDOWS\system32\nvsvc32.exe

(Microsoft Corporation) c:\Program Files\Microsoft Security Client\MsMpEng.exe

(VIA Technologies, Inc.) C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe

(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

(PixArt Imaging Incorporation) C:\WINDOWS\PixArt\PAC7302\Monitor.exe

(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe

(Nero AG) C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe

(Oracle Corporation) C:\Program Files\Java\jre7\bin\jqs.exe

(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe

(Nero AG) C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe

(T2 API, LLC) C:\Program Files\QuoteTracker\stocks.exe

(Google Inc.) C:\Documents and Settings\vad\Local Settings\Application Data\Google\Chrome\Application\chrome.exe

(Anatoly Zaytsev) C:\ZET 9\zet.exe

() C:\Books\Market\New\calc2\DegreesCalc.exe

(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\WINWORD.EXE

(Google Inc.) C:\Documents and Settings\vad\Local Settings\Application Data\Google\Chrome\Application\chrome.exe

(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe

(Google Inc.) C:\Documents and Settings\vad\Local Settings\Application Data\Google\Chrome\Application\chrome.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [nwiz] - C:\Program Files\NVIDIA Corporation\nView\nwiz.exe [1657376 2009-08-05] ()

HKLM\...\Run: [NvMediaCenter] - RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

HKLM\...\Run: [NvCplDaemon] - RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

HKLM\...\Run: [HDAudDeck] - C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe [33628160 2009-06-17] (VIA Technologies, Inc.)

HKLM\...\Run: [NeroFilterCheck] - C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe [570664 2008-07-09] (Nero AG)

HKLM\...\Run: [GrooveMonitor] - C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)

HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)

HKLM\...\Run: [PAC7302_Monitor] - C:\WINDOWS\PixArt\Pac7302\Monitor.exe [319488 2006-11-03] (PixArt Imaging Incorporation)

HKLM\...\Run: [sunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)

HKLM\...\Run: [MSC] - C:\Program Files\Microsoft Security Client\msseces.exe [995176 2013-08-12] (Microsoft Corporation)

HKCU\...\Run: [Google Update] - C:\Documents and Settings\vad\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [116648 2012-07-07] (Google Inc.)

HKCU\...\Run: [indxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] - C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe [1840424 2008-06-24] (Nero AG)

HKU\Default User\...\RunOnce: [NeroHomeFirstStart] - C:\Program Files\Common Files\Nero\Lib\NMFirstStart.exe [ 2008-06-24] (Nero AG)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ch/

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

SearchScopes: HKLM - DefaultScope value is missing.

BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)

BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Toolbar: HKCU - &Address - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)

Toolbar: HKCU - &Links - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)

DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} http://office.microsoft.com/_layouts/ClientBin/ieawsdc32.cab

DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://windowsupdate.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1341692739180

DPF: {9BE31822-FDAD-461B-AD51-BE1D1C159921} http://iptv.kartina.tv/files/bin/VLC%20TV%20Player.cab

DPF: {B479199A-1242-4E3C-AD81-7F0DF801B4AE} http://download.microsoft.com/download/C/9/C/C9C3D86D-84AC-4AF0-8584-842756A66467/MicrosoftDownloadManager.cab

Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Tcpip\Parameters: [DhcpNameServer] 62.2.24.158 62.2.17.60 62.2.24.162 62.2.17.61

Chrome:

=======

CHR Plugin: (Remoting Viewer) - internal-remoting-viewer

CHR Plugin: (Native Client) - C:\Documents and Settings\vad\Local Settings\Application Data\Google\Chrome\Application\30.0.1599.101\ppGoogleNaClPluginChrome.dll ()

CHR Plugin: (Chrome PDF Viewer) - C:\Documents and Settings\vad\Local Settings\Application Data\Google\Chrome\Application\30.0.1599.101\pdf.dll ()

CHR Plugin: (Shockwave Flash) - C:\Documents and Settings\vad\Local Settings\Application Data\Google\Chrome\Application\30.0.1599.101\gcswf32.dll No File

CHR Plugin: (Microsoft\u00AE DRM) - C:\Program Files\Windows Media Player\npdrmv2.dll (Microsoft Corporation)

CHR Plugin: (Microsoft\u00AE DRM) - C:\Program Files\Windows Media Player\npwmsdrm.dll (Microsoft Corporation)

CHR Plugin: (Windows Media Player Plug-in Dynamic Link Library) - C:\Program Files\Windows Media Player\npdsplay.dll (Microsoft Corporation (written by Digital Renaissance Inc.))

CHR Plugin: (Google Update) - C:\Documents and Settings\vad\Local Settings\Application Data\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File

CHR Extension: (YouTube) - C:\DOCUME~1\vad\LOCALS~1\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0

CHR Extension: (Google Search) - C:\DOCUME~1\vad\LOCALS~1\Application Data\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0

CHR Extension: (Google Wallet) - C:\DOCUME~1\vad\LOCALS~1\Application Data\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.5.0_0

CHR Extension: (Gmail) - C:\DOCUME~1\vad\LOCALS~1\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1

CHR StartMenuInternet: Google Chrome - C:\Documents and Settings\vad\Local Settings\Application Data\Google\Chrome\Application\chrome.exe

========================== Services (Whitelisted) =================

R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)

S2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)

R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [22208 2013-08-12] (Microsoft Corporation)

R2 JavaQuickStarterService; "C:\Program Files\Java\jre7\bin\jqs.exe" -service -config "C:\Program Files\Java\jre7\lib\deploy\jqs\jqs.conf"

==================== Drivers (Whitelisted) ====================

S3 CCDECODE; C:\Windows\System32\DRIVERS\CCDECODE.sys [17024 2008-04-13] (Microsoft Corporation)

R1 ElbyCDIO; C:\Windows\System32\Drivers\ElbyCDIO.sys [31088 2010-12-16] (Elaborate Bytes AG)

R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)

R3 monfilt; C:\Windows\System32\drivers\monfilt.sys [1389056 2008-02-14] (Creative Technology Ltd.)

R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [211560 2013-06-18] (Microsoft Corporation)

R1 MpKsla546ac45; c:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{0188115E-92AA-4185-9C2E-2E17823E54D9}\MpKsla546ac45.sys [40392 2013-11-13] (Microsoft Corporation)

R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [5810 2004-08-13] ()

S3 NdisIP; C:\Windows\System32\DRIVERS\NdisIP.sys [10880 2008-04-13] (Microsoft Corporation)

R3 NVHDA; C:\Windows\System32\drivers\nvhda32.sys [56992 2009-08-11] (NVIDIA Corporation)

R3 PAC7302; C:\Windows\System32\DRIVERS\PAC7302.SYS [457856 2007-06-14] (PixArt Imaging Inc.)

R3 VIAHdAudAddService; C:\Windows\System32\drivers\viahduaa.sys [1374464 2009-06-02] (VIA Technologies, Inc.)

S4 IntelIde; No ImagePath

U5 ScsiPort; C:\Windows\system32\drivers\scsiport.sys [96384 2008-04-13] (Microsoft Corporation)

U1 WS2IFSL;

U3 fgxyrfod; \??\C:\DOCUME~1\vad\LOCALS~1\Temp\fgxyrfod.sys [x]

U3 mbr; \??\C:\DOCUME~1\vad\LOCALS~1\Temp\mbr.sys [x]

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2013-11-13 18:54 - 2013-11-13 18:54 - 00000000 ____D C:\FRST

2013-11-13 17:20 - 2013-11-13 17:20 - 00000000 _____ C:\Documents and Settings\vad\Desktop\ark.txt

2013-11-13 16:20 - 2013-11-13 16:30 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\HitmanPro

2013-11-13 14:38 - 2013-11-13 14:38 - 00023508 _____ C:\Documents and Settings\vad\Desktop\attach.txt

2013-11-13 14:38 - 2013-11-13 14:38 - 00008046 _____ C:\Documents and Settings\vad\Desktop\dds.txt

2013-11-13 13:58 - 2013-11-13 13:58 - 00001219 _____ C:\Documents and Settings\vad\Desktop\AdwCleaner[s0].txt

2013-11-13 13:50 - 2013-11-13 13:51 - 00001731 _____ C:\Documents and Settings\vad\Desktop\JRT.txt

2013-11-13 13:41 - 2013-11-13 13:41 - 00000000 ____D C:\WINDOWS\ERUNT

2013-11-13 13:40 - 2013-11-13 13:56 - 00000000 ____D C:\AdwCleaner

2013-11-06 11:53 - 2013-11-06 11:54 - 00000000 ____D C:\Documents and Settings\vad\Application Data\ICQ-Profile

2013-11-06 11:53 - 2013-11-06 11:53 - 00001681 _____ C:\Documents and Settings\vad\Start Menu\ICQ.lnk

2013-11-06 11:53 - 2013-11-06 11:53 - 00001681 _____ C:\Documents and Settings\vad\Desktop\ICQ.lnk

2013-11-06 11:53 - 2013-11-06 11:53 - 00000000 ____D C:\Program Files\ICQM

2013-11-06 11:53 - 2013-11-06 11:53 - 00000000 ____D C:\Documents and Settings\vad\Start Menu\Programs\ICQ

2013-11-06 11:53 - 2013-11-06 11:53 - 00000000 ____D C:\Documents and Settings\vad\Application Data\ICQM

==================== One Month Modified Files and Folders =======

2013-11-13 18:55 - 2012-07-10 14:17 - 00000000 ____D C:\Program Files\QuoteTracker

2013-11-13 18:54 - 2013-11-13 18:54 - 00000000 ____D C:\FRST

2013-11-13 18:53 - 2012-07-10 11:57 - 00000000 ____D C:\Documents and Settings\vad\Application Data\Skype

2013-11-13 18:51 - 2013-03-18 17:33 - 00001092 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job

2013-11-13 18:51 - 2012-07-07 22:49 - 00001182 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-343818398-1957994488-839522115-1003UA.job

2013-11-13 18:30 - 2012-07-08 09:58 - 00000830 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job

2013-11-13 18:18 - 2012-07-07 21:08 - 02085976 _____ C:\WINDOWS\WindowsUpdate.log

2013-11-13 17:31 - 2012-07-10 15:00 - 00000000 ____D C:\ZET 9

2013-11-13 17:20 - 2013-11-13 17:20 - 00000000 _____ C:\Documents and Settings\vad\Desktop\ark.txt

2013-11-13 16:30 - 2013-11-13 16:20 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\HitmanPro

2013-11-13 16:11 - 2013-02-13 22:58 - 00000000 ____D C:\Documents and Settings\vad\Application Data\vlc

2013-11-13 14:54 - 2013-02-14 13:21 - 00002305 _____ C:\Documents and Settings\All Users\Desktop\Betting Assistant.lnk

2013-11-13 14:38 - 2013-11-13 14:38 - 00023508 _____ C:\Documents and Settings\vad\Desktop\attach.txt

2013-11-13 14:38 - 2013-11-13 14:38 - 00008046 _____ C:\Documents and Settings\vad\Desktop\dds.txt

2013-11-13 14:10 - 2013-03-18 17:33 - 00001088 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job

2013-11-13 14:10 - 2012-08-01 16:27 - 00000159 _____ C:\WINDOWS\wiadebug.log

2013-11-13 14:10 - 2012-08-01 16:27 - 00000050 _____ C:\WINDOWS\wiaservc.log

2013-11-13 14:10 - 2012-07-08 10:22 - 00079824 _____ C:\Documents and Settings\vad\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2013-11-13 14:10 - 2012-07-07 23:00 - 00326704 _____ C:\WINDOWS\system32\FNTCACHE.DAT

2013-11-13 14:10 - 2012-07-07 21:12 - 00000000 ____D C:\Documents and Settings\vad

2013-11-13 14:10 - 2012-07-07 21:11 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT

2013-11-13 14:10 - 2009-08-06 08:44 - 00248739 _____ C:\WINDOWS\system32\NvApps.xml

2013-11-13 14:10 - 2002-12-31 13:00 - 00002206 _____ C:\WINDOWS\system32\wpa.dbl

2013-11-13 14:09 - 2012-07-07 21:12 - 00000178 ___SH C:\Documents and Settings\vad\ntuser.ini

2013-11-13 14:09 - 2012-07-07 21:11 - 00032550 _____ C:\WINDOWS\SchedLgU.Txt

2013-11-13 13:58 - 2013-11-13 13:58 - 00001219 _____ C:\Documents and Settings\vad\Desktop\AdwCleaner[s0].txt

2013-11-13 13:56 - 2013-11-13 13:40 - 00000000 ____D C:\AdwCleaner

2013-11-13 13:51 - 2013-11-13 13:50 - 00001731 _____ C:\Documents and Settings\vad\Desktop\JRT.txt

2013-11-13 13:41 - 2013-11-13 13:41 - 00000000 ____D C:\WINDOWS\ERUNT

2013-11-13 13:40 - 2012-07-19 15:02 - 00000069 _____ C:\WINDOWS\NeroDigital.ini

2013-11-13 13:28 - 2012-12-25 00:44 - 00000418 ____H C:\WINDOWS\Tasks\User_Feed_Synchronization-{5ACD7206-10B5-47D5-B980-C4304F10859E}.job

2013-11-13 02:35 - 2012-07-08 09:30 - 00000130 _____ C:\WINDOWS\ChssBase.ini

2013-11-13 01:51 - 2012-07-07 22:49 - 00001130 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-343818398-1957994488-839522115-1003Core.job

2013-11-13 01:09 - 2013-08-27 14:59 - 00000000 ____D C:\Documents and Settings\vad\.thinkorswim

2013-11-13 01:08 - 2012-10-24 15:22 - 00000000 ____D C:\Program Files\thinkTDA

2013-11-12 22:26 - 2012-07-08 10:25 - 00054784 _____ C:\Documents and Settings\vad\Desktop\stats.xls

2013-11-11 23:18 - 2012-07-08 10:25 - 00075264 _____ C:\Documents and Settings\vad\Desktop\My bets1.xls

2013-11-09 22:52 - 2012-07-10 10:25 - 00000000 ____D C:\Documents and Settings\vad\Application Data\Mozilla

2013-11-08 16:30 - 2012-07-10 11:57 - 00000000 ___RD C:\Program Files\Skype

2013-11-08 16:30 - 2012-07-10 11:57 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Skype

2013-11-06 11:54 - 2013-11-06 11:53 - 00000000 ____D C:\Documents and Settings\vad\Application Data\ICQ-Profile

2013-11-06 11:53 - 2013-11-06 11:53 - 00001681 _____ C:\Documents and Settings\vad\Start Menu\ICQ.lnk

2013-11-06 11:53 - 2013-11-06 11:53 - 00001681 _____ C:\Documents and Settings\vad\Desktop\ICQ.lnk

2013-11-06 11:53 - 2013-11-06 11:53 - 00000000 ____D C:\Program Files\ICQM

2013-11-06 11:53 - 2013-11-06 11:53 - 00000000 ____D C:\Documents and Settings\vad\Start Menu\Programs\ICQ

2013-11-06 11:53 - 2013-11-06 11:53 - 00000000 ____D C:\Documents and Settings\vad\Application Data\ICQM

2013-10-27 12:22 - 2012-07-07 23:01 - 00597242 _____ C:\WINDOWS\system32\PerfStringBackup.INI

2013-10-16 02:01 - 2012-08-01 12:40 - 00001917 _____ C:\WINDOWS\epplauncher.mif

2013-10-16 02:01 - 2012-08-01 12:40 - 00001698 _____ C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Security Essentials.lnk

2013-10-16 02:00 - 2012-08-01 12:40 - 00000000 ____D C:\Program Files\Microsoft Security Client

2013-10-14 11:32 - 2012-07-08 10:19 - 00000000 ____D C:\WINDOWS\Microsoft.NET

Some content of TEMP:

====================

C:\Documents and Settings\vad\Local Settings\Temp\Quarantine.exe

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== End Of Log ============================]

[Additional scan result of Farbar Recovery Scan Tool (x86) Version: 13-11-2013

Ran by vad at 2013-11-13 18:55:35

Running from C:\Documents and Settings\vad\My Documents\Downloads

Boot Mode: Normal

==========================================================

==================== Security Center ========================

AV: Microsoft Security Essentials (Disabled - Up to date) {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}

==================== Installed Programs ======================

µTorrent (Version: 3.3.0.29625)

Adobe Flash Player 11 ActiveX (Version: 11.9.900.117)

Adobe Reader X (10.1.8) (Version: 10.1.8)

Betting Assistant (Version: 1.0.64)

BlitzIn 3.0

CCleaner (Version: 3.21)

ChessBase 7.0

ChessBase 8.0

ChessBase Reader (Version: 2)

CycleTimer (Version: 1.1.2)

Deep Rybka 4 (Version: 12.0.0)

Gannalyst Professional 5.0

Google Chrome (HKCU Version: 30.0.1599.101)

Google Talk Plugin (Version: 4.9.1.16010)

Google Update Helper (Version: 1.3.21.165)

ICQ 8.2 (build 6870) (HKCU Version: 8.2.6870.0)

Jagannatha Hora 7.64 (Version: 7.64)

Java 7 Update 21 (Version: 7.0.210)

Java Auto Updater (Version: 2.1.9.5)

JavaFX 2.1.1 (Version: 2.1.1)

Malwarebytes Anti-Malware version 1.75.0.1300 (Version: 1.75.0.1300)

Microsoft .NET Framework 2.0 Service Pack 2 (Version: 2.2.30729)

Microsoft .NET Framework 3.0 Service Pack 2 (Version: 3.2.30729)

Microsoft .NET Framework 3.5 SP1

Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729)

Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)

Microsoft .NET Framework 4 Extended (Version: 4.0.30319)

Microsoft Application Error Reporting (Version: 12.0.6012.5000)

Microsoft Office 2007 Service Pack 3 (SP3)

Microsoft Office Access MUI (English) 2007 (Version: 12.0.6612.1000)

Microsoft Office Access Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000)

Microsoft Office Enterprise 2007 (Version: 12.0.6612.1000)

Microsoft Office Excel MUI (English) 2007 (Version: 12.0.6612.1000)

Microsoft Office File Validation Add-In (Version: 14.0.5130.5003)

Microsoft Office Groove MUI (English) 2007 (Version: 12.0.6612.1000)

Microsoft Office Groove Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000)

Microsoft Office InfoPath MUI (English) 2007 (Version: 12.0.6612.1000)

Microsoft Office OneNote MUI (English) 2007 (Version: 12.0.6612.1000)

Microsoft Office Outlook MUI (English) 2007 (Version: 12.0.6612.1000)

Microsoft Office PowerPoint MUI (English) 2007 (Version: 12.0.6612.1000)

Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000)

Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000)

Microsoft Office Proof (Spanish) 2007 (Version: 12.0.6612.1000)

Microsoft Office Proofing (English) 2007 (Version: 12.0.4518.1014)

Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)

Microsoft Office Publisher MUI (English) 2007 (Version: 12.0.6612.1000)

Microsoft Office Shared MUI (English) 2007 (Version: 12.0.6612.1000)

Microsoft Office Shared Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000)

Microsoft Office Word MUI (English) 2007 (Version: 12.0.6612.1000)

Microsoft Security Client (Version: 4.3.0219.0)

Microsoft Security Essentials (Version: 4.3.219.0)

Microsoft Software Update for Web Folders (English) 12 (Version: 12.0.6612.1000)

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (Version: 10.0.40219)

MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0)

MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)

Nero 8 Essentials (Version: 8.3.618)

neroxml (Version: 1.0.0)

NVIDIA Drivers (Version: 1.9)

NVIDIA nView Desktop Manager (Version: 125.18)

Platform (Version: 1.34)

PlayChess (Version: )

QuoteTracker

REALTEK GbE & FE Ethernet PCI-E NIC Driver (Version: 1.23.0000)

Russian Phonetic YaZHert - RusWin.net - Custom (Version: 1.0.3.40)

Skype™ 6.10 (Version: 6.10.104)

thinkorswim from TD AMERITRADE

Update for 2007 Microsoft Office System (KB967642)

Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (Version: 1)

Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition

Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition

Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition

Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition

Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2827325) 32-Bit Edition

Update for Windows Internet Explorer 8 (KB2598845) (Version: 1)

Update for Windows Internet Explorer 8 (KB2632503) (Version: 1)

Update for Windows XP (KB2345886) (Version: 1)

Update for Windows XP (KB2467659) (Version: 1)

Update for Windows XP (KB2661254-v2) (Version: 2)

Update for Windows XP (KB2718704) (Version: 1)

Update for Windows XP (KB2736233) (Version: 1)

Update for Windows XP (KB2749655) (Version: 1)

Update for Windows XP (KB2863058) (Version: 1)

Update for Windows XP (KB951978) (Version: 1)

Update for Windows XP (KB955759) (Version: 1)

Update for Windows XP (KB967715) (Version: 1)

Update for Windows XP (KB968389) (Version: 1)

Update for Windows XP (KB971029) (Version: 1)

Update for Windows XP (KB973687) (Version: 1)

Update for Windows XP (KB973815) (Version: 1)

VC80CRTRedist - 8.0.50727.6195 (Version: 1.2.0)

VCRedistSetup (Version: 1.0.0)

VIA Plattform-Geräte-Manager (Version: 1.34)

VirtualCloneDrive

VLC TV Player (Version: 1.0.5.0)

WebFldrs XP (Version: 9.50.7523)

WinDjView 2.0.1 (Version: 2.0.1)

Windows Genuine Advantage Notifications (KB905474) (Version: 1.9.0040.0)

Windows Genuine Advantage Validation Tool (KB892130)

Windows Genuine Advantage Validation Tool (KB892130) (Version: 1.7.0069.2)

Windows Internet Explorer 8 (Version: 20090308.140743)

Windows Media Format Runtime

Windows XP Service Pack 3 (Version: 20080414.031525)

WinRAR 4.20 (32-bit) (Version: 4.20.0)

ZET 9 Lite 1.69

==================== Restore Points =========================

15-08-2013 01:00:26 Software Distribution Service 3.0

15-08-2013 09:17:34 Software Distribution Service 3.0

16-08-2013 11:53:56 Software Distribution Service 3.0

18-08-2013 10:03:04 Software Distribution Service 3.0

19-08-2013 10:44:53 Software Distribution Service 3.0

20-08-2013 11:24:12 Software Distribution Service 3.0

21-08-2013 12:21:30 Software Distribution Service 3.0

22-08-2013 16:54:16 Software Distribution Service 3.0

24-08-2013 10:58:39 Software Distribution Service 3.0

25-08-2013 12:37:19 Software Distribution Service 3.0

27-08-2013 11:23:16 Software Distribution Service 3.0

28-08-2013 12:38:37 Software Distribution Service 3.0

29-08-2013 01:00:15 Software Distribution Service 3.0

30-08-2013 09:56:03 Software Distribution Service 3.0

31-08-2013 12:45:07 Software Distribution Service 3.0

02-09-2013 10:53:01 Software Distribution Service 3.0

03-09-2013 12:18:55 Software Distribution Service 3.0

04-09-2013 19:29:49 System Checkpoint

05-09-2013 09:03:01 Software Distribution Service 3.0

06-09-2013 10:15:49 Software Distribution Service 3.0

07-09-2013 18:42:36 Software Distribution Service 3.0

08-09-2013 20:47:54 Software Distribution Service 3.0

10-09-2013 09:16:51 Software Distribution Service 3.0

11-09-2013 10:18:58 Software Distribution Service 3.0

12-09-2013 01:00:34 Software Distribution Service 3.0

12-09-2013 02:06:49 Software Distribution Service 3.0

12-09-2013 16:44:35 Software Distribution Service 3.0

13-09-2013 01:00:30 Software Distribution Service 3.0

13-09-2013 03:14:54 Software Distribution Service 3.0

14-09-2013 01:00:28 Software Distribution Service 3.0

14-09-2013 01:59:04 Software Distribution Service 3.0

14-09-2013 10:56:04 Software Distribution Service 3.0

15-09-2013 11:06:34 Software Distribution Service 3.0

16-09-2013 13:00:59 System Checkpoint

17-09-2013 09:58:40 Software Distribution Service 3.0

19-09-2013 09:58:11 Software Distribution Service 3.0

21-09-2013 08:29:54 Software Distribution Service 3.0

22-09-2013 11:43:10 Software Distribution Service 3.0

24-09-2013 10:55:08 Software Distribution Service 3.0

25-09-2013 11:04:39 Software Distribution Service 3.0

27-09-2013 09:22:40 Software Distribution Service 3.0

28-09-2013 13:04:14 Software Distribution Service 3.0

30-09-2013 09:48:36 Software Distribution Service 3.0

02-10-2013 07:43:54 Software Distribution Service 3.0

03-10-2013 09:37:15 System Checkpoint

04-10-2013 10:01:13 Software Distribution Service 3.0

05-10-2013 15:40:33 System Checkpoint

06-10-2013 09:07:38 Software Distribution Service 3.0

07-10-2013 09:11:42 Software Distribution Service 3.0

08-10-2013 09:53:57 Software Distribution Service 3.0

09-10-2013 12:53:12 System Checkpoint

10-10-2013 00:33:47 Software Distribution Service 3.0

10-10-2013 03:01:24 Software Distribution Service 3.0

11-10-2013 06:12:50 Software Distribution Service 3.0

13-10-2013 19:56:21 Software Distribution Service 3.0

14-10-2013 01:00:14 Software Distribution Service 3.0

15-10-2013 08:52:12 Software Distribution Service 3.0

16-10-2013 01:00:15 Software Distribution Service 3.0

17-10-2013 03:36:37 Software Distribution Service 3.0

18-10-2013 08:58:52 Software Distribution Service 3.0

19-10-2013 23:28:20 System Checkpoint

20-10-2013 11:09:13 Software Distribution Service 3.0

21-10-2013 12:46:03 System Checkpoint

22-10-2013 09:39:37 Software Distribution Service 3.0

23-10-2013 11:02:53 Software Distribution Service 3.0

25-10-2013 11:38:57 Software Distribution Service 3.0

26-10-2013 12:34:35 System Checkpoint

27-10-2013 11:32:38 Software Distribution Service 3.0

28-10-2013 19:54:07 System Checkpoint

29-10-2013 10:34:36 Software Distribution Service 3.0

30-10-2013 11:40:18 Software Distribution Service 3.0

01-11-2013 12:11:37 Software Distribution Service 3.0

02-11-2013 22:29:55 Software Distribution Service 3.0

04-11-2013 11:36:39 Software Distribution Service 3.0

06-11-2013 10:22:50 Software Distribution Service 3.0

07-11-2013 11:26:35 System Checkpoint

08-11-2013 11:14:14 Software Distribution Service 3.0

09-11-2013 11:15:37 Software Distribution Service 3.0

10-11-2013 12:28:16 Software Distribution Service 3.0

12-11-2013 00:01:33 Software Distribution Service 3.0

13-11-2013 13:20:51 Software Distribution Service 3.0

==================== Hosts content: ==========================

2002-12-31 13:00 - 2002-12-31 13:00 - 00000734 ____A C:\WINDOWS\system32\Drivers\etc\hosts

127.0.0.1 localhost

==================== Scheduled Tasks (whitelisted) =============

Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe

Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe

Task: C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-343818398-1957994488-839522115-1003Core.job => C:\Documents and Settings\vad\Local Settings\Application Data\Google\Update\GoogleUpdate.exe

Task: C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-343818398-1957994488-839522115-1003UA.job => C:\Documents and Settings\vad\Local Settings\Application Data\Google\Update\GoogleUpdate.exe

Task: C:\WINDOWS\Tasks\User_Feed_Synchronization-{5ACD7206-10B5-47D5-B980-C4304F10859E}.job => C:\WINDOWS\system32\msfeedssync.exe

==================== Loaded Modules (whitelisted) =============

2013-11-06 11:53 - 2013-11-06 11:53 - 00307728 _____ () C:\Documents and Settings\vad\Application Data\ICQM\ICQ\dll\mramenu.dll

2012-07-10 14:17 - 2010-02-16 22:09 - 00106504 _____ () C:\Program Files\QuoteTracker\MYTRACKDLL.DLL

2002-12-31 13:00 - 2008-04-14 01:11 - 00059904 _____ () C:\WINDOWS\system32\devenum.dll

2002-12-31 13:00 - 2008-04-14 01:11 - 00014336 _____ () C:\WINDOWS\system32\msdmo.dll

2013-10-16 00:54 - 2013-10-09 01:02 - 04055504 _____ () C:\Documents and Settings\vad\Local Settings\Application Data\Google\Chrome\Application\30.0.1599.101\pdf.dll

2013-10-16 00:54 - 2013-10-09 01:02 - 00415184 _____ () C:\Documents and Settings\vad\Local Settings\Application Data\Google\Chrome\Application\30.0.1599.101\ppGoogleNaClPluginChrome.dll

2013-10-16 00:54 - 2013-10-09 01:01 - 01604560 _____ () C:\Documents and Settings\vad\Local Settings\Application Data\Google\Chrome\Application\30.0.1599.101\ffmpegsumo.dll

2011-02-02 15:51 - 2011-02-02 15:51 - 00491520 _____ () C:\ZET 9\swedll32.dll

2003-10-09 11:11 - 2003-10-09 11:11 - 00115712 _____ () C:\ZET 9\SAPI_DLL.DLL

2013-07-10 17:07 - 2013-07-10 17:07 - 00756888 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSPTLS.DLL

2013-10-16 00:54 - 2013-10-09 01:02 - 13584336 _____ () C:\Documents and Settings\vad\Local Settings\Application Data\Google\Chrome\Application\30.0.1599.101\PepperFlash\pepflashplayer.dll

==================== Alternate Data Streams (whitelisted) =========

==================== Safe Mode (whitelisted) ===================

==================== Faulty Device Manager Devices =============

Name: SM Bus Controller

Description: SM Bus Controller

Class Guid: {4D36E97E-E325-11CE-BFC1-08002BE10318}

Manufacturer:

Service:

Problem: : The drivers for this device are not installed. (Code 28)

Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

==================== Event log errors: =========================

Application errors:

==================

Error: (11/11/2013 04:52:10 PM) (Source: Application Error) (User: )

Description: Faulting application cb70.exe, version 7.0.0.11, faulting module unknown, version 0.0.0.0, fault address 0x01c3120b.

Processing media-specific event for [cb70.exe!ws!]

Error: (11/11/2013 07:48:17 AM) (Source: Application Error) (User: )

Description: Faulting application cb70.exe, version 7.0.0.11, faulting module unknown, version 0.0.0.0, fault address 0x01336742.

Processing media-specific event for [cb70.exe!ws!]

Error: (11/10/2013 10:13:28 PM) (Source: Application Error) (User: )

Description: Faulting application cb70.exe, version 7.0.0.11, faulting module unknown, version 0.0.0.0, fault address 0x0132074e.

Processing media-specific event for [cb70.exe!ws!]

Error: (11/08/2013 01:14:53 AM) (Source: Application Error) (User: )

Description: Faulting application cb70.exe, version 7.0.0.11, faulting module unknown, version 0.0.0.0, fault address 0x01336732.

Processing media-specific event for [cb70.exe!ws!]

Error: (11/07/2013 07:53:07 AM) (Source: Application Error) (User: )

Description: Faulting application cb70.exe, version 7.0.0.11, faulting module unknown, version 0.0.0.0, fault address 0x0132118e.

Processing media-specific event for [cb70.exe!ws!]

Error: (11/06/2013 07:22:22 PM) (Source: Application Error) (User: )

Description: Faulting application cb70.exe, version 7.0.0.11, faulting module unknown, version 0.0.0.0, fault address 0x0132af5d.

Processing media-specific event for [cb70.exe!ws!]

Error: (11/04/2013 03:50:55 PM) (Source: MPSampleSubmission) (User: )

Description: EventType mptelemetry, P1 2152759308, P2 unspecified, P3 scanfile, P4 4.3.219.0, P5 microsoft security essentials (edb4fa23-53b8-4afa-8c5d-99752cca7094), P6 unspecified, P7 unspecified, P8 NIL, P9 mptelemetry0, P10 mptelemetry1.

Error: (11/04/2013 00:58:14 PM) (Source: Application Error) (User: )

Description: Faulting application cb70.exe, version 7.0.0.11, faulting module unknown, version 0.0.0.0, fault address 0x0109afc8.

Processing media-specific event for [cb70.exe!ws!]

Error: (11/03/2013 06:33:49 PM) (Source: Application Error) (User: )

Description: Faulting application cb70.exe, version 7.0.0.11, faulting module unknown, version 0.0.0.0, fault address 0x39334399.

Processing media-specific event for [cb70.exe!ws!]

Error: (11/03/2013 02:03:36 AM) (Source: Application Error) (User: )

Description: Faulting application cb70.exe, version 7.0.0.11, faulting module unknown, version 0.0.0.0, fault address 0x0133676a.

Processing media-specific event for [cb70.exe!ws!]

System errors:

=============

Error: (11/13/2013 06:51:19 PM) (Source: 0) (User: )

Description: \Device\Harddisk0\D

Error: (11/13/2013 06:15:51 PM) (Source: 0) (User: )

Description: \Device\Harddisk0\D

Error: (11/13/2013 05:18:25 PM) (Source: 0) (User: )

Description: \Device\Ide\IdePort2

Error: (11/13/2013 05:18:25 PM) (Source: 0) (User: )

Description: \Device\Ide\IdePort2

Error: (11/13/2013 05:13:14 PM) (Source: 0) (User: )

Description: \Device\Ide\IdePort2

Error: (11/13/2013 05:10:34 PM) (Source: 0) (User: )

Description: \Device\Ide\IdePort2

Error: (11/13/2013 05:09:03 PM) (Source: 0) (User: )

Description: \Device\Ide\IdePort2

Error: (11/13/2013 05:03:19 PM) (Source: 0) (User: )

Description: \Device\Harddisk0\D

Error: (11/13/2013 04:23:33 PM) (Source: 0) (User: )

Description: \Device\Ide\IdePort2

Error: (11/13/2013 04:03:01 PM) (Source: 0) (User: )

Description: \Device\Harddisk0\D

Microsoft Office Sessions:

=========================

Error: (02/23/2013 00:06:21 PM) (Source: Microsoft Office 12 Sessions)(User: )

Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 1 seconds with 0 seconds of active time. This session ended with a crash.

Error: (11/14/2012 04:49:54 PM) (Source: Microsoft Office 12 Sessions)(User: )

Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6661.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 3 seconds with 0 seconds of active time. This session ended with a crash.

Error: (11/04/2012 03:28:28 PM) (Source: Microsoft Office 12 Sessions)(User: )

Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6661.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 4 seconds with 0 seconds of active time. This session ended with a crash.

Error: (10/26/2012 04:09:50 PM) (Source: Microsoft Office 12 Sessions)(User: )

Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6661.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 6 seconds with 0 seconds of active time. This session ended with a crash.

Error: (10/03/2012 03:51:19 PM) (Source: Microsoft Office 12 Sessions)(User: )

Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6661.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 2 seconds with 0 seconds of active time. This session ended with a crash.

==================== Memory info ===========================

Percentage of memory in use: 53%

Total physical RAM: 2047.04 MB

Available physical RAM: 945.53 MB

Total Pagefile: 3939.98 MB

Available Pagefile: 2866.61 MB

Total Virtual: 2047.88 MB

Available Virtual: 1944.75 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:465.75 GB) (Free:413.33 GB) NTFS ==>[Drive with boot components (Windows XP)]

==================== MBR & Partition Table ==================

========================================================

Disk: 0 (MBR Code: Windows XP) (Size: 466 GB) (Disk ID: 0E8E0E8D)

Partition 1: (Active) - (Size=466 GB) - (Type=07 NTFS)

==================== End Of Log ============================]

Psychotic · November 14, 2013

Nothing to see...

Scan with ESET Online Scan

Please go to here to run the online scannner from ESET.

Turn off the real time scanner of any existing antivirus program while performing the online scan
Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the activex control to install
Click Start
Make sure that the option Remove found threats is unticked
Click on Advanced Settings and ensure these options are ticked:
- Scan for potentially unwanted applications
Scan for potentially unsafe applications
Enable Anti-Stealth Technology

[*]Click Scan[*]Wait for the scan to finish[*]If any threats were found, click the 'List of found threats' , then click Export to text file.... [*]Save it to your desktop, then please copy and paste that log as a reply to this topic.

shogel · November 14, 2013

No threats found...

May be try OTL?

Psychotic · November 14, 2013

That would have been the next step...

Scan with OTL

Download OTL by OldTimer and save it to your desktop.
Double click on the OTL.exe icon on your desktop. If you are using Vista, please right-click and select run as administrator
Click the "Scan All Users" checkbox.

Note: If you are using a Windows 64bit machine, please make sure the checkbox next to Include 64Bit Scans is checked. It will be checked by default.
Push the button.
It will now begin to scan, please be paitent while it scans.
Two reports will open once it's done.
Please copy and paste them in your next reply:
- OTL.txt <-- Will be opened
- Extras.txt <-- Will be minimized

shogel · November 14, 2013

[OTL Extras logfile created on: 14.11.2013 10:18:34 - Run 1

OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\vad\My Documents\Downloads

Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale: 00000807 | Country: Switzerland | Language: DES | Date Format: dd.MM.yyyy

2.00 Gb Total Physical Memory | 1.12 Gb Available Physical Memory | 56.10% Memory free

3.85 Gb Paging File | 2.97 Gb Available in Paging File | 77.21% Paging File free

Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 465.75 Gb Total Space | 413.41 Gb Free Space | 88.76% Space Free | Partition Type: NTFS

Computer Name: TRIVADIS-DBA786 | User Name: vad | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*

[HKEY_USERS\S-1-5-21-343818398-1957994488-839522115-1003\SOFTWARE\Classes\<extension>]

.html [@ = htmlfile] -- Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*

exefile [open] -- "%1" %*

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)

Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"FirstRunDisabled" = 1

"AntiVirusDisableNotify" = 0

"FirewallDisableNotify" = 0

"UpdatesDisableNotify" = 0

"AntiVirusOverride" = 0

"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]

"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]

"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]

"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

"DoNotAllowExceptions" = 0

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)

"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)

"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)

"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE" = C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook -- (Microsoft Corporation)

"C:\Program Files\Microsoft Office\Office12\GROOVE.EXE" = C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove -- (Microsoft Corporation)

"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE" = C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote -- (Microsoft Corporation)

"C:\Program Files\uTorrent\uTorrent.exe" = C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent -- (BitTorrent Inc.)

"C:\WINDOWS\system32\fxsclnt.exe" = C:\WINDOWS\system32\fxsclnt.exe:*:Enabled:Microsoft Fax Console -- (Microsoft Corporation)

"C:\Documents and Settings\vad\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.exe" = C:\Documents and Settings\vad\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.exe:*:Enabled:Google Talk Plugin -- (Google)

"C:\Documents and Settings\vad\Application Data\ICQM\icq.exe" = C:\Documents and Settings\vad\Application Data\ICQM\icq.exe:*:Enabled:ICQ -- (ICQ)

"C:\Program Files\Skype\Phone\Skype.exe" = C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype -- (Skype Technologies S.A.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended

"{1111706F-666A-4037-7777-211328764D10}" = JavaFX 2.1.1

"{20D4A895-748C-4D88-871C-FDB1695B0169}" = Platform

"{26A24AE4-039D-4CA4-87B4-2F83217021FF}" = Java 7 Update 21

"{2A83AD05-56E6-3FBD-8752-B4143162EF59}" = Google Talk Plugin

"{30BDEFC3-6D77-4722-A8F1-9BA938BA69C8}" = ChessBase 8.0

"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP

"{3921A67A-5AB1-4E48-9444-C71814CF3027}" = VCRedistSetup

"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile

"{45B79548-7171-11D5-A1FD-F5EABC70E32B}" = CycleTimer

"{4937160D-9A3B-429C-A82E-645116A4EB17}" = VLC TV Player

"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater

"{4D24F198-A2CB-46B5-BB16-41B69C644B6C}" = Microsoft Security Client

"{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}" = Skype™ 6.10

"{5167B770-F0FF-4505-AA98-D4073C337E00}" = Russian Phonetic YaZHert - RusWin.net - Custom

"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml

"{58692A10-4A02-403F-B5B5-9D1D076E07FA}" = Deep Rybka 4

"{6A79665E-2B6A-4BDF-BEC9-22BE4CA41B15}" = ChessBase Reader

"{90120000-0010-0409-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (English) 12

"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007

"{90120000-0015-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007

"{90120000-0016-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007

"{90120000-0018-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007

"{90120000-0019-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007

"{90120000-001A-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007

"{90120000-001B-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007

"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)

"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007

"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)

"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007

"{90120000-001F-0C0A-0000-0000000FF1CE}_ENTERPRISE_{2314F9A1-126F-45CC-8A5E-DFAF866F3FBC}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)

"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007

"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007

"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007

"{90120000-0044-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007

"{90120000-006E-0409-0000-0000000FF1CE}_ENTERPRISE_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007

"{90120000-00A1-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90120000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2007

"{90120000-00BA-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90120000-0114-0409-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (English) 2007

"{90120000-0114-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007

"{90120000-0115-0409-0000-0000000FF1CE}_ENTERPRISE_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007

"{90120000-0117-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In

"{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195

"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting

"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2

"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper

"{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.8)

"{B70CDBAC-638A-4E67-916A-DB4C6F571031}" = Nero 8 Essentials

"{BC86ABDF-8148-44B3-8105-4AE9DDBFDCB6}" = Betting Assistant

"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2

"{C9BED750-1211-4480-B1A5-718A3BE15525}" = REALTEK GbE & FE Ethernet PCI-E NIC Driver

"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1

"{D1CE1C52-06D4-46BF-8FE2-81401F533446}" = Deep Rybka 4

"{D6330700-4083-48DD-A03C-E209674E7836}" = ChessBase Reader

"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219

"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX

"BlitzIn 3.0" = BlitzIn 3.0

"CCleaner" = CCleaner

"ChessBase 7.0" = ChessBase 7.0

"ENTERPRISE" = Microsoft Office Enterprise 2007

"Gannalyst Professional 5.0_is1" = Gannalyst Professional 5.0

"ie8" = Windows Internet Explorer 8

"InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}" = VIA Plattform-Geräte-Manager

"Jagannatha Hora_is1" = Jagannatha Hora 7.64

"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.75.0.1300

"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1

"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile

"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended

"Microsoft Security Client" = Microsoft Security Essentials

"NVIDIA Drivers" = NVIDIA Drivers

"NVIDIA nView Desktop Manager" = NVIDIA nView Desktop Manager

"PlayChess" = PlayChess

"QuoteTracker_is1" = QuoteTracker

"thinkorswim from TD AMERITRADE" = thinkorswim from TD AMERITRADE

"uTorrent" = µTorrent

"VirtualCloneDrive" = VirtualCloneDrive

"WinDjView" = WinDjView 2.0.1

"Windows Media Format Runtime" = Windows Media Format Runtime

"Windows XP Service Pack" = Windows XP Service Pack 3

"WinRAR archiver" = WinRAR 4.20 (32-bit)

"ZET 9 Lite 1.69" = ZET 9 Lite 1.69

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-343818398-1957994488-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"Google Chrome" = Google Chrome

"ICQ" = ICQ 8.2 (build 6870)

========== Last 20 Event Log Errors ==========

[ Application Events ]

Error - 18.06.2013 17:29:20 | Computer Name = TRIVADIS-DBA786 | Source = Application Error | ID = 1000

Description = Faulting application cb70.exe, version 7.0.0.11, faulting module unknown,

version 0.0.0.0, fault address 0x0133674a.

Error - 19.06.2013 11:01:53 | Computer Name = TRIVADIS-DBA786 | Source = MPSampleSubmission | ID = 5000

Description = EventType mptelemetry, P1 2152759308, P2 unspecified, P3 scanfile,

P4 4.2.223.0, P5 microsoft security essentials (edb4fa23-53b8-4afa-8c5d-99752cca7094),

P6 unspecified, P7 unspecified, P8 NIL, P9 NIL, P10 NIL.

Error - 20.06.2013 09:39:15 | Computer Name = TRIVADIS-DBA786 | Source = Application Error | ID = 1000

Description = Faulting application cb70.exe, version 7.0.0.11, faulting module unknown,

version 0.0.0.0, fault address 0x0132afc9.

Error - 21.06.2013 15:43:29 | Computer Name = TRIVADIS-DBA786 | Source = Application Error | ID = 1000

Description = Faulting application cb70.exe, version 7.0.0.11, faulting module unknown,

version 0.0.0.0, fault address 0x0132af98.

Error - 22.06.2013 17:09:12 | Computer Name = TRIVADIS-DBA786 | Source = Application Hang | ID = 1002

Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module

hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 22.06.2013 21:18:49 | Computer Name = TRIVADIS-DBA786 | Source = Application Error | ID = 1000

Description = Faulting application cb70.exe, version 7.0.0.11, faulting module unknown,

version 0.0.0.0, fault address 0x01377c12.

Error - 23.07.2013 22:03:58 | Computer Name = TRIVADIS-DBA786 | Source = Application Error | ID = 1000

Description = Faulting application cb70.exe, version 7.0.0.11, faulting module unknown,

version 0.0.0.0, fault address 0x3933e1bb.

Error - 24.07.2013 19:22:55 | Computer Name = TRIVADIS-DBA786 | Source = Application Error | ID = 1000

Description = Faulting application cb70.exe, version 7.0.0.11, faulting module unknown,

version 0.0.0.0, fault address 0x0133c174.

Error - 24.07.2013 19:42:54 | Computer Name = TRIVADIS-DBA786 | Source = Application Error | ID = 1000

Description = Faulting application cb70.exe, version 7.0.0.11, faulting module unknown,

version 0.0.0.0, fault address 0x01321236.

Error - 24.07.2013 20:40:15 | Computer Name = TRIVADIS-DBA786 | Source = Application Error | ID = 1000

Description = Faulting application cb70.exe, version 7.0.0.11, faulting module unknown,

version 0.0.0.0, fault address 0x013b0d06.

[ OSession Events ]

Error - 03.10.2012 10:51:19 | Computer Name = TRIVADIS-DBA786 | Source = Microsoft Office 12 Sessions | ID = 7001

Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:

12.0.6661.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 2

seconds with 0 seconds of active time. This session ended with a crash.

Error - 26.10.2012 11:09:50 | Computer Name = TRIVADIS-DBA786 | Source = Microsoft Office 12 Sessions | ID = 7001

Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:

12.0.6661.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 6

seconds with 0 seconds of active time. This session ended with a crash.

Error - 04.11.2012 10:28:28 | Computer Name = TRIVADIS-DBA786 | Source = Microsoft Office 12 Sessions | ID = 7001

Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:

12.0.6661.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 4

seconds with 0 seconds of active time. This session ended with a crash.

Error - 14.11.2012 11:49:54 | Computer Name = TRIVADIS-DBA786 | Source = Microsoft Office 12 Sessions | ID = 7001

Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:

12.0.6661.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 3

seconds with 0 seconds of active time. This session ended with a crash.

Error - 23.02.2013 07:06:21 | Computer Name = TRIVADIS-DBA786 | Source = Microsoft Office 12 Sessions | ID = 7001

Description = ID: 0, Application Name: Microsoft Office Word, Application Version:

12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 1

seconds with 0 seconds of active time. This session ended with a crash.

[ System Events ]

Error - 13.11.2013 12:18:25 | Computer Name = TRIVADIS-DBA786 | Source = atapi | ID = 262155

Description = The driver detected a controller error on \Device\Ide\IdePort2.

Error - 13.11.2013 13:15:51 | Computer Name = TRIVADIS-DBA786 | Source = Disk | ID = 262151