- Темы:532
- Сообщений:1553
- ☆☆☆☆☆
========== PROCESSES ==========
Process explorer.exe killed successfully.
========== SERVICES/DRIVERS ==========
Service WebaltaController stopped successfully.
Service WebaltaController deleted successfully.
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{35A6E2B1-27A9-47D2-913C-559E1EF1D034}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{4CC691D1-2EED-4622-A13E-E9366D04C57F}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{6C517674-DE1C-4493-977C-34A1BFAB35BA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{6D7B211A-88EA-490c-BAB9-3600D8D7C503}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{831CBAC0-8283-4653-9D81-FEB9F3F6E47C}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{92860A02-4D69-48c1-82D7-EF6B2C609502}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{C7F3FA25-A9F5-4514-9F92-EB725A5FD01E}\ deleted successfully.
Registry key HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{677a586a-b56d-11dc-8147-00112fe53b77}\ deleted successfully.
Registry key HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{ba3b3530-9f0b-11da-9311-00112fe53b77}\ deleted successfully.
Registry key HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{d179277a-9acc-11dc-8104-00112fe53b77}\ deleted successfully.
========== FILES ==========
C:Documents and SettingsAll UsersApplication Dataqqmlib.dll unregistered successfully.
C:Documents and SettingsAll UsersApplication Dataqqmlib.dll moved successfully.
========== COMMANDS ==========
File delete failed. C:DOCUME~1СЕРГЕЙLOCALS~1TempJET3F17.tmp scheduled to be deleted on reboot.
File delete failed. C:DOCUME~1СЕРГЕЙLOCALS~1Temp~DF9E5D.tmp scheduled to be deleted on reboot.
File delete failed. C:DOCUME~1СЕРГЕЙLOCALS~1Tempetilqs_ats6VeOIbnHHJlyQQQmI scheduled to be deleted on reboot.
User’s Temp folder emptied.
User’s Temporary Internet Files folder emptied.
User’s Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
File delete failed. C:Documents and SettingsLocalServiceLocal SettingsTemporary Internet FilesContent.IE5index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
Windows Temp folder emptied.
File delete failed. C:Documents and SettingsСергейLocal SettingsApplication DataMozillaFirefoxProfilesrpyu31az.defaultCache_CACHE_MAP_ scheduled to be deleted on reboot.
File delete failed. C:Documents and SettingsСергейLocal SettingsApplication DataMozillaFirefoxProfilesrpyu31az.defaultCache_CACHE_001_ scheduled to be deleted on reboot.
File delete failed. C:Documents and SettingsСергейLocal SettingsApplication DataMozillaFirefoxProfilesrpyu31az.defaultCache_CACHE_002_ scheduled to be deleted on reboot.
File delete failed. C:Documents and SettingsСергейLocal SettingsApplication DataMozillaFirefoxProfilesrpyu31az.defaultCache_CACHE_003_ scheduled to be deleted on reboot.
File delete failed. C:Documents and SettingsСергейLocal SettingsApplication DataMozillaFirefoxProfilesrpyu31az.defaultXUL.mfl scheduled to be deleted on reboot.
File delete failed. C:Documents and SettingsСергейLocal SettingsApplication DataMozillaFirefoxProfilesrpyu31az.defaulturlclassifier3.sqlite scheduled to be deleted on reboot.
FireFox cache emptied.
Temp folders emptied.
Explorer started successfully
OTMoveIt3 by OldTimer — Version 1.0.8.0 log created on 02222009_222656
Files moved on Reboot…
File C:DOCUME~1СЕРГЕЙLOCALS~1TempJET3F17.tmp not found!
C:DOCUME~1СЕРГЕЙLOCALS~1Temp~DF9E5D.tmp moved successfully.
File C:DOCUME~1СЕРГЕЙLOCALS~1Tempetilqs_ats6VeOIbnHHJlyQQQmI not found!
C:Documents and SettingsLocalServiceLocal SettingsTemporary Internet FilesContent.IE5index.dat moved successfully.
C:Documents and SettingsСергейLocal SettingsApplication DataMozillaFirefoxProfilesrpyu31az.defaultCache_CACHE_MAP_ moved successfully.
C:Documents and SettingsСергейLocal SettingsApplication DataMozillaFirefoxProfilesrpyu31az.defaultCache_CACHE_001_ moved successfully.
C:Documents and SettingsСергейLocal SettingsApplication DataMozillaFirefoxProfilesrpyu31az.defaultCache_CACHE_002_ moved successfully.
C:Documents and SettingsСергейLocal SettingsApplication DataMozillaFirefoxProfilesrpyu31az.defaultCache_CACHE_003_ moved successfully.
C:Documents and SettingsСергейLocal SettingsApplication DataMozillaFirefoxProfilesrpyu31az.defaultXUL.mfl moved successfully.
C:Documents and SettingsСергейLocal SettingsApplication DataMozillaFirefoxProfilesrpyu31az.defaulturlclassifier3.sqlite moved successfully.
Logfile of random’s system information tool 1.05 (written by random/random)
Run by Сергей at 2009-02-22 22:31:32
Microsoft Windows XP Professional Service Pack 2
System drive C: has 29 GB (38%) free of 76 GB
Total RAM: 512 MB (28% free)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:31:36, on 22.02.2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal
Running processes:
C:windowsSystem32smss.exe
C:windowssystem32csrss.exe
C:windowsSYSTEM32winlogon.exe
C:windowssystem32services.exe
C:windowssystem32lsass.exe
C:windowssystem32svchost.exe
C:windowssystem32svchost.exe
C:windowsSystem32svchost.exe
C:windowssystem32svchost.exe
C:windowssystem32svchost.exe
C:windowssystem32spoolsv.exe
C:windowsExplorer.EXE
C:windowsnotepad.exe
C:windowsmHotkey.exe
C:windowssystem32RunDLL32.exe
C:Program FilesDAEMON Toolsdaemon.exe
C:Program FilesMail.RuAgentMAgent.exe
C:Program FilesWinampwinampa.exe
C:Program FilesFlashGetFlashGet.exe
C:Program FilesPC Tools AntiVirusPCTAV.exe
C:windowssystem32ctfmon.exe
C:Program FilesICQ6ICQ.exe
C:Program FilesCommon FilesMicrosoft SharedVS7Debugmdm.exe
C:windowssystem32nvsvc32.exe
C:Program FilesPC Tools AntiVirusPCTAVSvc.exe
C:Program FilesИгрыNevoDRMrun.exe
C:windowssystem32svchost.exe
C:WINDOWSsystem32wdfmgr.exe
C:windowssystem32WgaTray.exe
C:windowsSystem32alg.exe
C:Program FilesMozilla Firefoxfirefox.exe
C:windowssystem32wuauclt.exe
C:windowssystem32wuauclt.exe
C:DownloadsRSIT.exe
C:WINDOWSsystem32wbemwmiprvse.exe
C:Program Filestrend microСергей.exe
R1 — HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://google.icq.com/search/search_frame.php
R0 — HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.mail.ru/
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 — HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://mail.ru
R0 — HKLMSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant =
R0 — HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Ссылки
R3 — URLSearchHook: Спутник@Mail.Ru — {09900DE8-1DCA-443F-9243-26FF581438AF} — C:PROGRA~1Mail.RuSputnikMAILRU~1.DLL
R3 — URLSearchHook: (no name) — {83821C2B-32A8-4DD7-B6D4-44309A78E668} — C:Documents and SettingsСергейApplication DataMraUpdatemrasearch.dll
R3 — URLSearchHook: (no name) — {0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} — C:Program FilesAskSBarSrchAstt1.binA2SRCHAS.DLL (file missing)
O2 — BHO: Ask Search Assistant BHO — {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} — (no file)
O2 — BHO: AcroIEHlprObj Class — {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} — C:Program FilesAdobeAcrobat 5.0ReaderActiveXAcroIEHelper.ocx
O2 — BHO: flashget urlcatch — {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} — C:Program FilesFlashGetjccatch.dll
O2 — BHO: Burn4Free Toolbar Helper — {60BF5EE3-0105-4858-AD98-17C19F86B042} — C:Program FilesBurn4Free Toolbarv3.3.0.0Burn4Free_Toolbar.dll
O2 — BHO: Спутник@Mail.Ru — {8984B388-A5BB-4DF7-B274-77B879E179DB} — C:PROGRA~1Mail.RuSputnikMAILRU~1.DLL
O2 — BHO: EpsonToolBandKicker Class — {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} — C:Program FilesEPSONEPSON Web-To-PageEPSON Web-To-Page.dll
O2 — BHO: Ask Toolbar BHO — {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} — C:Program FilesAskSBarbar1.binASKSBAR.DLL
O2 — BHO: FlashGet GetFlash Class — {F156768E-81EF-470C-9057-481BA8380DBA} — C:Program FilesFlashGetgetflash.dll
O3 — Toolbar: (no name) — {BA52B914-B692-46c4-B683-905236F6F655} — (no file)
O3 — Toolbar: EPSON Web-To-Page — {EE5D279F-081B-4404-994D-C6B60AAEBA6D} — C:Program FilesEPSONEPSON Web-To-PageEPSON Web-To-Page.dll
O3 — Toolbar: Rambler-Ассистент — {468CD8A9-7C25-45FA-969E-3D925C689DC4} — C:Program FilesRambler AssistantramblertoolbarU0.dll
O3 — Toolbar: Спутник@Mail.Ru — {09900DE8-1DCA-443F-9243-26FF581438AF} — C:PROGRA~1Mail.RuSputnikMAILRU~1.DLL
O3 — Toolbar: Burn4Free Toolbar — {55FAF0F2-44D4-425F-B5F5-6B275B621EAB} — C:Program FilesBurn4Free Toolbarv3.3.0.0Burn4Free_Toolbar.dll
O3 — Toolbar: Ask Toolbar — {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} — C:Program FilesAskSBarbar1.binASKSBAR.DLL
O3 — Toolbar: &Webalta toolbar — {D4C56A33-3488-495B-8033-9BF834E276D8} — C:PROGRA~1WebaltaWEBALT~1.DLL
O4 — HKLM..Run: [CHotkey] mHotkey.exe
O4 — HKLM..Run: [Ins3DT] D:INSTALL4INS3DT.EXE
O4 — HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSsystem32NvCpl.dll,NvStartup
O4 — HKLM..Run: [nwiz] nwiz.exe /install
O4 — HKLM..Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 — HKLM..Run: [DrWebScheduler] «C:Program FilesDrWebDRWEBSCD.EXE»
O4 — HKLM..Run: [Tau Monitor] C:PROGRA~1AgnitumTAUSCA~1.10TAUMON.exe
O4 — HKLM..Run: [DAEMON Tools] «C:Program FilesDAEMON Toolsdaemon.exe» -lang 1033
O4 — HKLM..Run: [MAgent] C:Program FilesMail.RuAgentMAgent.exe -LM
O4 — HKLM..Run: [NBKeyScan] «C:Program FilesNeroNero8Nero BackItUpNBKeyScan.exe»
O4 — HKLM..Run: [WinampAgent] C:Program FilesWinampwinampa.exe
O4 — HKLM..Run: [Flashget] C:Program FilesFlashGetFlashGet.exe /min
O4 — HKLM..Run: [PCTAVApp] «C:Program FilesPC Tools AntiVirusPCTAV.exe» /MONITORSCAN
O4 — HKLM..Run: [OutpostMonitor] C:PROGRA~1AgnitumOUTPOS~1op_mon.exe /tray /noservice
O4 — HKLM..Run: [OutpostFeedBack] «C:Program FilesAgnitumOutpost Firewall Profeedback.exe» /dump:os_startup
O4 — HKLM..Run: [NevoDRM] «C:Program FilesИгрыNevoDRMNevoDRM.exe»
O4 — HKCU..Run: [AMP Agent] C:Program FilesCommon FilesARS CompanyAgentAgent.exe
O4 — HKCU..Run: [QIP2005] F:Новая папкаqipqip.exe
O4 — HKCU..Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] «C:Program FilesCommon FilesNeroLibNMBgMonitor.exe»
O4 — HKCU..Run: [ctfmon.exe] C:windowssystem32ctfmon.exe
O4 — HKCU..Run: [ICQ] «C:Program FilesICQ6ICQ.exe» silent
O4 — HKUSS-1-5-19..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘LOCAL SERVICE’)
O4 — HKUSS-1-5-20..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘NETWORK SERVICE’)
O4 — HKUSS-1-5-18..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘SYSTEM’)
O4 — HKUS.DEFAULT..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘Default user’)
O4 — S-1-5-18 Startup: Registration THE SETTLERS — Heritage of Kings.LNK = D:SupportRegisterRegistrationReminder.exe (User ‘SYSTEM’)
O4 — S-1-5-18 Startup: Registration Prince of Persia T2T.LNK = C:Program FilesUbisoftPrince of Persia T2TSupportRegisterRegistrationReminder.exe (User ‘SYSTEM’)
O4 — S-1-5-18 Startup: Adobe Gamma.lnk = C:Program FilesCommon FilesAdobeCalibrationAdobe Gamma Loader.exe (User ‘SYSTEM’)
O4 — .DEFAULT Startup: Registration THE SETTLERS — Heritage of Kings.LNK = D:SupportRegisterRegistrationReminder.exe (User ‘Default user’)
O4 — .DEFAULT Startup: Registration Prince of Persia T2T.LNK = C:Program FilesUbisoftPrince of Persia T2TSupportRegisterRegistrationReminder.exe (User ‘Default user’)
O4 — .DEFAULT Startup: Adobe Gamma.lnk = C:Program FilesCommon FilesAdobeCalibrationAdobe Gamma Loader.exe (User ‘Default user’)
O4 — Startup: Registration THE SETTLERS — Heritage of Kings.LNK = D:SupportRegisterRegistrationReminder.exe
O4 — Startup: Registration Prince of Persia T2T.LNK = C:Program FilesUbisoftPrince of Persia T2TSupportRegisterRegistrationReminder.exe
O4 — Startup: Adobe Gamma.lnk = C:Program FilesCommon FilesAdobeCalibrationAdobe Gamma Loader.exe
O4 — Global Startup: Microsoft Office.lnk = C:Program FilesMicrosoft OfficeOffice10OSA.EXE
O8 — Extra context menu item: &Search —
O8 — Extra context menu item: &Закачать все при помощи FlashGet — C:Program FilesFlashGetjc_all.htm
O8 — Extra context menu item: &Закачать при помощи FlashGet — C:Program FilesFlashGetjc_link.htm
O8 — Extra context menu item: &Экспорт в Microsoft Excel — res://C:PROGRA~1MICROS~2Office10EXCEL.EXE/3000
O8 — Extra context menu item: Webalta — Добавить в Анти-Баннер — C:Program FilesWebaltaextentionsWebalta_antiban.htm
O8 — Extra context menu item: Найти с помощью Рамблера — res://C:Program FilesRambler AssistantramblertoolbarU0.dll/search.htm
O8 — Extra context menu item: Перевести с помощью словарей Рамблера — res://C:Program FilesRambler AssistantramblertoolbarU0.dll/dic.htm
O8 — Extra context menu item: Поиск@Mail.Ru — res://C:PROGRA~1Mail.RuSputnikMAILRU~1.DLL/SEARCH.HTM
O8 — Extra context menu item: Словари@Mail.Ru — res://C:PROGRA~1Mail.RuSputnikMAILRU~1.DLL/TRANSLATE.HTM
O9 — Extra button: Быстрая настройка Outpost Firewall Pro — {44627E97-789B-40d4-B5C2-58BD171129A1} — C:Program FilesAgnitumOutpost Firewall Proie_bar.dll
O9 — Extra button: Mail.Ru Агент — {7558B7E5-7B26-4201-BEDB-00D5FF534523} — C:Program FilesMail.RuAgentmagent.exe
O9 — Extra ‘Tools’ menuitem: Mail.Ru Агент — {7558B7E5-7B26-4201-BEDB-00D5FF534523} — C:Program FilesMail.RuAgentmagent.exe
O9 — Extra button: ICQ Lite — {B863453A-26C3-4e1f-A54D-A2CD196348E9} — C:Program FilesICQLiteICQLite.exe (file missing)
O9 — Extra ‘Tools’ menuitem: ICQ Lite — {B863453A-26C3-4e1f-A54D-A2CD196348E9} — C:Program FilesICQLiteICQLite.exe (file missing)
O9 — Extra button: FlashGet — {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} — C:Program FilesFlashGetFlashGet.exe
O9 — Extra ‘Tools’ menuitem: FlashGet — {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} — C:Program FilesFlashGetFlashGet.exe
O9 — Extra button: Run IMVU — {d9288080-1baa-4bc4-9cf8-a92d743db949} — C:Documents and SettingsСергейГлавное менюПрограммыIMVURun IMVU.lnk (file missing)
O9 — Extra button: ICQ6 — {E59EB121-F339-4851-A3BA-FE49C35617C2} — C:Program FilesICQ6ICQ.exe
O9 — Extra ‘Tools’ menuitem: ICQ6 — {E59EB121-F339-4851-A3BA-FE49C35617C2} — C:Program FilesICQ6ICQ.exe
O9 — Extra button: Messenger — {FB5F1910-F110-11d2-BB9E-00C04F795683} — C:Program FilesMessengermsmsgs.exe
O9 — Extra ‘Tools’ menuitem: Windows Messenger — {FB5F1910-F110-11d2-BB9E-00C04F795683} — C:Program FilesMessengermsmsgs.exe
O12 — Plugin for .spop: C:Program FilesInternet ExplorerPluginsNPDocBox.dll
O15 — Trusted Zone: http://secure.gestrip.com (HKLM)
O15 — Trusted Zone: http://update.randhi.com (HKLM)
O16 — DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) — http://go.microsoft.com/fwlink/?linkid=39204
O16 — DPF: {33331111-1111-1111-1111-611111193423} — http://www.www2.p0rt2.com/files/777.cab
O16 — DPF: {33331111-1111-1111-1111-611111193429} — http://www.www2.p0rt2.com/files/_ipsec_.cab
O16 — DPF: {33331111-1111-1111-1111-615111193427} —
O16 — DPF: {33331111-1131-1111-1111-611111193428} —
O16 — DPF: {463ED66E-431B-11D2-ADB0-0080C83DA4EB} (AcceptWM Class) — https://w3s.webmoney.ru/WMAcceptor.dll
O16 — DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) — http://arcade.icq.com/carlo/zuma/popcaploader_v5.cab
O17 — HKLMSystemCCSServicesTcpip..{9D87A3C4-3499-41F9-A4B8-5BD3E42638FF}: NameServer = 89.191.240.1 172.28.0.1
O20 — AppInit_DLLs: c:progra~1agnitumoutpos~1wl_hook.dll
O23 — Service: Agnitum Client Security Service (acssrv) — Agnitum Ltd. — C:PROGRA~1AgnitumOUTPOS~1acs.exe
O23 — Service: Adobe LM Service — Adobe Systems — C:Program FilesCommon FilesAdobe Systems SharedServiceAdobelmsvc.exe
O23 — Service: Журнал событий (Eventlog) — Корпорация Майкрософт — C:windowssystem32services.exe
O23 — Service: Служба COM записи компакт-дисков IMAPI (ImapiService) — Корпорация Майкрософт — C:WINDOWSsystem32imapi.exe
O23 — Service: Event Log Watch (LogWatch) — Unknown owner — C:WINDOWSLogWatNT.exe
O23 — Service: NetMeeting Remote Desktop Sharing (mnmsrvc) — Корпорация Майкрософт — C:WINDOWSsystem32mnmsrvc.exe
O23 — Service: NVIDIA Display Driver Service (NVSvc) — NVIDIA Corporation — C:windowssystem32nvsvc32.exe
O23 — Service: PC Tools AntiVirus Engine (PCTAVSvc) — PC Tools Research Pty Ltd — C:Program FilesPC Tools AntiVirusPCTAVSvc.exe
O23 — Service: Plug and Play (PlugPlay) — Корпорация Майкрософт — C:windowssystem32services.exe
O23 — Service: Диспетчер сеанса справки для удаленного рабочего стола (RDSessMgr) — Корпорация Майкрософт — C:WINDOWSsystem32sessmgr.exe
O23 — Service: Смарт-карты (SCardSvr) — Корпорация Майкрософт — C:windowsSystem32SCardSvr.exe
O23 — Service: ServiceLayer — Nokia. — C:Program FilesCommon FilesPCSuiteServicesServiceLayer.exe
O23 — Service: Журналы и оповещения производительности (SysmonLog) — Корпорация Майкрософт — C:windowssystem32smlogsvc.exe
O23 — Service: Теневое копирование тома (VSS) — Корпорация Майкрософт — C:windowsSystem32vssvc.exe
O23 — Service: Адаптер производительности WMI (WmiApSrv) — Корпорация Майкрософт — C:WINDOWSsystem32wbemwmiapsrv.exe
O24 — Desktop Component 0: (no name) — http://foto.mail.ru/mail/john1985-85/FOTO/i-81.jpg
O24 — Desktop Component 1: (no name) — http://foto.mail.ru/mail/john1985-85/FOTO/i-109.jpg
O24 — Desktop Component 2: (no name) — http://foto.mail.ru/mail/john1985-85/FOTO/i-45.jpg
O24 — Desktop Component 3: (no name) — http://foto.mail.ru/mail/john1985-85/FOTO/i-10.jpg
—
End of file — 13428 bytes
======Registry dump======
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2}]
Ask Search Assistant BHO
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class — C:Program FilesAdobeAcrobat 5.0ReaderActiveXAcroIEHelper.ocx [2001-03-02 37808]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{2F364306-AA45-47B5-9F9D-39A8B94E7EF7}]
FGCatchUrl — C:Program FilesFlashGetjccatch.dll [2007-08-06 94308]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{60BF5EE3-0105-4858-AD98-17C19F86B042}]
Burn4Free Toolbar Helper — C:Program FilesBurn4Free Toolbarv3.3.0.0Burn4Free_Toolbar.dll [2008-12-24 827392]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{8984B388-A5BB-4DF7-B274-77B879E179DB}]
MailRuBHO Class — C:PROGRA~1Mail.RuSputnikMAILRU~1.DLL [2008-03-17 534016]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{E99421FB-68DD-40F0-B4AC-B7027CAE2F1A}]
EpsonToolBandKicker Class — C:Program FilesEPSONEPSON Web-To-PageEPSON Web-To-Page.dll [2004-02-10 339968]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA}]
Ask Toolbar BHO — C:Program FilesAskSBarbar1.binASKSBAR.DLL [2008-09-28 262144]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{F156768E-81EF-470C-9057-481BA8380DBA}]
FlashGet GetFlash Class — C:Program FilesFlashGetgetflash.dll [2007-05-18 163840]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
{BA52B914-B692-46c4-B683-905236F6F655}
{EE5D279F-081B-4404-994D-C6B60AAEBA6D} — EPSON Web-To-Page — C:Program FilesEPSONEPSON Web-To-PageEPSON Web-To-Page.dll [2004-02-10 339968]
{468CD8A9-7C25-45FA-969E-3D925C689DC4} — Rambler-Ассистент — C:Program FilesRambler AssistantramblertoolbarU0.dll [2007-04-05 694000]
{09900DE8-1DCA-443F-9243-26FF581438AF} — Спутник@Mail.Ru — C:PROGRA~1Mail.RuSputnikMAILRU~1.DLL [2008-03-17 534016]
{55FAF0F2-44D4-425F-B5F5-6B275B621EAB} — Burn4Free Toolbar — C:Program FilesBurn4Free Toolbarv3.3.0.0Burn4Free_Toolbar.dll [2008-12-24 827392]
{F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} — Ask Toolbar — C:Program FilesAskSBarbar1.binASKSBAR.DLL [2008-09-28 262144]
{D4C56A33-3488-495B-8033-9BF834E276D8} — &Webalta toolbar — C:PROGRA~1WebaltaWEBALT~1.DLL [2008-10-14 1691136]
[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun]
«CHotkey»=C:windowsmHotkey.exe [2002-10-09 493056]
«Ins3DT»=D:INSTALL4INS3DT.EXE []
«NvCplDaemon»=C:WINDOWSsystem32NvCpl.dll [2004-09-30 4603904]
«nwiz»=nwiz.exe /install []
«NvMediaCenter»=C:windowsSYSTEM32NvMCTray.dll [2004-09-30 86016]
«DrWebScheduler»=C:Program FilesDrWebDRWEBSCD.EXE []
«Tau Monitor»=C:PROGRA~1AgnitumTAUSCA~1.10TAUMON.exe []
«DAEMON Tools»=C:Program FilesDAEMON Toolsdaemon.exe [2005-11-09 128920]
«MAgent»=C:Program FilesMail.RuAgentMAgent.exe [2008-03-17 4457976]
«NBKeyScan»=C:Program FilesNeroNero8Nero BackItUpNBKeyScan.exe []
«WinampAgent»=C:Program FilesWinampwinampa.exe [2006-08-28 35328]
«Flashget»=C:Program FilesFlashGetFlashGet.exe [2007-09-25 2007088]
«VolC»= []
«PCTAVApp»=C:Program FilesPC Tools AntiVirusPCTAV.exe [2008-12-04 1370000]
«OutpostMonitor»=C:PROGRA~1AgnitumOUTPOS~1op_mon.exe [2009-02-13 1225032]
«OutpostFeedBack»=C:Program FilesAgnitumOutpost Firewall Profeedback.exe [2009-02-13 433480]
«NevoDRM»=C:Program FilesИгрыNevoDRMNevoDRM.exe [2008-07-29 41984]
[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun]
«AMP Agent»=C:Program FilesCommon FilesARS CompanyAgentAgent.exe []
«QIP2005″=F:Новая папкаqipqip.exe []
«BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}»=C:Program FilesCommon FilesNeroLibNMBgMonitor.exe []
«ctfmon.exe»=C:windowssystem32ctfmon.exe [2004-08-17 15360]
«ICQ»=C:Program FilesICQ6ICQ.exe [2008-09-01 173304]
C:Documents and SettingsAll UsersГлавное менюПрограммыАвтозагрузка
Microsoft Office.lnk — C:Program FilesMicrosoft OfficeOffice10OSA.EXE
C:Documents and SettingsСергейГлавное менюПрограммыАвтозагрузка
Registration THE SETTLERS — Heritage of Kings.LNK — D:SupportRegisterRegistrationReminder.exe
Registration Prince of Persia T2T.LNK — C:Program FilesUbisoftPrince of Persia T2TSupportRegisterRegistrationReminder.exe
Adobe Gamma.lnk — C:Program FilesCommon FilesAdobeCalibrationAdobe Gamma Loader.exe
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWindows]
«AppInit_DLLS»=»c:progra~1agnitumoutpos~1wl_hook.dll «
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifyWgaLogon]
C:windowsSYSTEM32WgaLogon.dll [2007-02-15 236928]
[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetworkPCTAVSvc]
[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
«dontdisplaylastusername»=0
«legalnoticecaption»=
«legalnoticetext»=
«shutdownwithoutlogon»=1
«undockwithoutlogon»=1
[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoDriveTypeAutoRun»=36
«NoDriveAutoRun»=FFFFFFFF
[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoDriveTypeAutoRun»=
«NoDriveAutoRun»=
[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicystandardprofileauthorizedapplicationslist]
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»
«C:Program FilesFlashGetFLASHGET.EXE»=»C:Program FilesFlashGetFLASHGET.EXE:*:Enabled:FlashGet»
[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicydomainprofileauthorizedapplicationslist]
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»
======List of files/folders created in the last 1 months======
2009-02-21 21:35:28 —-RASHD—- C:autorun.inf
2009-02-21 21:21:25 —-D—- C:_OTMoveIt
2009-02-21 21:14:07 —-D—- C:Program Filestrend micro
2009-02-21 21:14:06 —-D—- C:rsit
2009-02-20 22:02:50 —-D—- C:windowssystem32Filt
2009-02-20 22:02:50 —-D—- C:Program FilesAgnitum
2009-02-20 22:02:34 —-D—- C:Documents and SettingsAll UsersApplication DataAgnitum
2009-02-16 22:37:20 —-D—- C:Documents and SettingsСергейApplication DataPC Tools
2009-02-16 22:34:41 —-D—- C:Program FilesCommon FilesPC Tools
2009-02-16 22:34:32 —-D—- C:Program FilesPC Tools AntiVirus
2009-02-16 22:34:32 —-D—- C:Documents and SettingsAll UsersApplication DataPC Tools
2009-02-15 19:00:45 —-D—- C:Documents and SettingsСергейApplication DataYandex
2009-02-15 19:00:07 —-D—- C:Program FilesMozilla Firefox
2009-02-15 05:12:31 —-D—- C:Documents and SettingsAll UsersApplication DataDoctor Web
2009-02-15 05:12:30 —-D—- C:Program FilesDrWeb
2009-02-14 20:18:11 —-D—- C:Documents and SettingsAll UsersApplication DataNorton
2009-02-14 20:17:59 —-D—- C:Documents and SettingsAll UsersApplication DataNortonInstaller
2009-02-12 07:34:55 —-HD—- C:windows$NtUninstallKB960715$
======List of files/folders modified in the last 1 months======
2009-02-22 22:27:12 —-A—- C:windowsSchedLgU.Txt
2009-02-20 22:01:52 —-A—- C:windowswin.ini
2009-02-20 21:19:02 —-A—- C:windowsIE4 Error Log.txt
2009-02-14 21:52:22 —-A—- C:windowssystem32smlogsvc.exe
2009-02-12 07:34:54 —-A—- C:windowsimsins.BAK
2009-02-05 23:32:08 —-A—- C:windowsCatalog.ini
2009-02-05 23:25:02 —-A—- C:windowsWordSoliter.ini
2009-02-05 23:21:14 —-A—- C:windowsmsicpl.ini
2009-02-04 02:21:12 —-A—- C:windowssystem32MRT.exe
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R1 DumaNT;NVIDIA Stereo Helper Service; C:windowssystem32DRIVERSdumant.sys [2002-11-18 399700]
R1 intelppm;Драйвер Intel процессора; C:windowssystem32DRIVERSintelppm.sys [2004-08-17 40448]
R1 prodrv04;Star Force copy protection driver v4; C:windowsSystem32driversprodrv04.sys [2008-09-02 114496]
R1 prodrv06;StarForce Protection Environment Driver v6; C:windowsSystem32driversprodrv06.sys [2004-09-03 54368]
R1 SandBox;SandBox; ??C:windowssystem32driversSandBox.sys []
R1 WS2IFSL;Среда Windows Socket 2.0 поддержки поставщиков не-IFS служб; C:windowsSystem32driversws2ifsl.sys [2001-10-20 12032]
R2 Aspi32;Aspi32; C:windowsSystem32driversaspi32.sys [2005-11-21 16512]
R3 aeaudio;aeaudio; C:windowssystem32driversaeaudio.sys [2002-04-01 4816]
R3 afw;Agnitum firewall driver; C:windowssystem32DRIVERSafw.sys [2008-06-20 30864]
R3 afwcore;afwcore; C:windowssystem32driversafwcore.sys [2009-02-10 257432]
R3 ASWFilt;ASWFilt; ??C:windowssystem32FiltASWFilt.dll []
R3 dtscsi;dtscsi; C:windowsSystem32Driversdtscsi.sys [2006-06-15 223128]
R3 nv;nv; C:windowssystem32DRIVERSnv4_mini.sys [2004-09-30 2743840]
R3 SISNIC;SiS PCI Fast Ethernet адаптер, драйвер; C:windowssystem32DRIVERSsisnic.sys [2004-08-03 32768]
R3 smwdm;smwdm; C:windowssystem32driverssmwdm.sys [2003-08-29 578304]
R3 usbehci;Драйвер минипорта Microsoft USB 2.0 расширенного хост-контроллера; C:windowssystem32DRIVERSusbehci.sys [2004-08-03 26624]
R3 usbhub;Драйвер стандартного концентратора USB (Microsoft); C:windowssystem32DRIVERSusbhub.sys [2004-08-03 57600]
R3 usbohci;Драйвер минипорта Microsoft USB открытого хост-контроллера; C:windowssystem32DRIVERSusbohci.sys [2004-08-03 17024]
S2 AVFilter;AVFilter; C:windowssystem32driversAVFilter.sys [2008-02-12 21904]
S2 nvmini;NVIDIA Compatible Windows Miniport Driver; C:windowssystem32DRIVERSnvmini.sys []
S3 AVHook;AVHook; C:windowssystem32driversAVHook.sys [2007-12-06 28568]
S3 AVRec;AVRec; C:windowssystem32driversAVRec.sys [2007-12-06 21912]
S3 ggsemc;Sony Ericsson USB Flash Driver; C:windowssystem32DRIVERSggsemc.sys [2007-03-09 8704]
S3 GMSIPCI;GMSIPCI; ??D:INSTALLGMSIPCI.SYS []
S3 k750bus;Sony Ericsson 750 driver (WDM); C:windowssystem32DRIVERSk750bus.sys [2005-02-11 55216]
S3 k750mdfl;Sony Ericsson 750 USB WMC Modem Filter; C:windowssystem32DRIVERSk750mdfl.sys [2005-02-11 6576]
S3 k750mdm;Sony Ericsson 750 USB WMC Modem Drivers; C:windowssystem32DRIVERSk750mdm.sys [2005-02-11 89872]
S3 k750mgmt;Sony Ericsson 750 USB WMC Device Management Drivers; C:windowssystem32DRIVERSk750mgmt.sys [2005-02-11 81728]
S3 k750obex;Sony Ericsson 750 USB WMC OBEX Interface Drivers; C:windowssystem32DRIVERSk750obex.sys [2005-02-11 79488]
S3 nmwcd;Nokia USB Phone Parent; C:windowssystem32driversnmwcd.sys [2006-05-29 127488]
S3 nmwcdc;Nokia USB Generic; C:windowssystem32driversnmwcdc.sys [2007-06-28 8320]
S3 nmwcdcj;Nokia USB Port; C:windowssystem32driversnmwcdcj.sys [2007-06-28 12288]
S3 nmwcdcm;Nokia USB Modem; C:windowssystem32driversnmwcdcm.sys [2007-06-28 12288]
S3 QV2KUX;Casio цифровая камера; C:windowssystem32DRIVERSqv2kux.sys [2001-08-17 3328]
S3 ser2pl;USB Filter Driver; C:windowssystem32DRIVERSser2pl.sys [2004-08-15 42752]
S3 usbccgp;Драйвер универсального родительского устройства USB (Microsoft); C:windowssystem32DRIVERSusbccgp.sys [2004-08-03 31616]
S3 USBCM;Scientific-Atlanta USB Cable Modem Driver; C:windowssystem32DRIVERSSacm2A.sys [2004-06-10 15429]
S3 usbprint;Класс принтеров Microsoft USB; C:windowssystem32DRIVERSusbprint.sys [2004-08-03 25856]
S3 usbscan;Драйвер USB-сканера; C:windowssystem32DRIVERSusbscan.sys [2004-08-03 15104]
S3 USBSTOR;Драйвер запоминающих устройств для USB; C:windowssystem32DRIVERSUSBSTOR.SYS [2004-08-03 26496]
S3 w800bus;Sony Ericsson W800 driver (WDM); C:windowssystem32DRIVERSw800bus.sys [2005-05-24 52384]
S3 w800mdfl;Sony Ericsson W800 USB WMC Modem Filter; C:windowssystem32DRIVERSw800mdfl.sys [2005-05-24 6096]
S3 w800mdm;Sony Ericsson W800 USB WMC Modem Drivers; C:windowssystem32DRIVERSw800mdm.sys [2005-05-24 87424]
S3 w800mgmt;Sony Ericsson W800 USB WMC Device Management Drivers; C:windowssystem32DRIVERSw800mgmt.sys [2005-05-24 79216]
S3 w800obex;Sony Ericsson W800 USB WMC OBEX Interface Drivers; C:windowssystem32DRIVERSw800obex.sys [2005-05-24 77040]
S3 WpdUsb;WpdUsb; C:windowsSystem32Driverswpdusb.sys [2004-08-11 18944]
S4 dwshd;dwshd; C:windowsSystem32driversdwshd.sys []
S4 IntelIde;IntelIde; C:windowssystem32driversIntelIde.sys []
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 MDM;Machine Debug Manager; C:Program FilesCommon FilesMicrosoft SharedVS7Debugmdm.exe [2001-02-23 270336]
R2 NVSvc;NVIDIA Display Driver Service; C:windowssystem32nvsvc32.exe [2004-09-30 127043]
R2 PCTAVSvc;PC Tools AntiVirus Engine; C:Program FilesPC Tools AntiVirusPCTAVSvc.exe [2008-12-03 999640]
R2 UMWdf;Windows User Mode Driver Framework; C:WINDOWSsystem32wdfmgr.exe [2004-08-11 38912]
S2 acssrv;Agnitum Client Security Service; C:PROGRA~1AgnitumOUTPOS~1acs.exe [2009-02-13 1267016]
S2 LogWatch;Event Log Watch; C:WINDOWSLogWatNT.exe [2003-01-17 28186]
S3 Adobe LM Service;Adobe LM Service; C:Program FilesCommon FilesAdobe Systems SharedServiceAdobelmsvc.exe [2008-09-12 72704]
S3 aspnet_state;ASP.NET State Service; C:windowsMicrosoft.NETFrameworkv2.0.50727aspnet_state.exe [2007-04-13 33632]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:WINDOWSMicrosoft.NETFrameworkv2.0.50727mscorsvw.exe [2007-04-13 68952]
S3 ServiceLayer;ServiceLayer; C:Program FilesCommon FilesPCSuiteServicesServiceLayer.exe [2006-06-05 174080]
EOF
