Лог до обновления MBAM:
Malwarebytes’ Anti-Malware 1.41
Версия базы данных: 2775
Windows 6.0.6002 Service Pack 2
03.11.2009 18:35:06
mbam-log-2009-11-03 (18-35-06).txt
Тип проверки: Полная (C:|H:|)
Проверено объектов: 268737
Прошло времени: 50 minute(s), 35 second(s)
Заражено процессов в памяти: 0
Заражено модулей в памяти: 0
Заражено ключей реестра: 1
Заражено значений реестра: 0
Заражено параметров реестра: 0
Заражено папок: 0
Заражено файлов: 0
Заражено процессов в памяти:
(Вредоносные программы не обнаружены)
Заражено модулей в памяти:
(Вредоносные программы не обнаружены)
Заражено ключей реестра:
HKEY_CLASSES_ROOTCLSID{147a976f-eee1-4377-8ea7-4716e4cdd239} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
Заражено значений реестра:
(Вредоносные программы не обнаружены)
Заражено параметров реестра:
(Вредоносные программы не обнаружены)
Заражено папок:
(Вредоносные программы не обнаружены)
Заражено файлов:
(Вредоносные программы не обнаружены)
Лог после обновления MBAM:
Malwarebytes’ Anti-Malware 1.41
Версия базы данных: 3092
Windows 6.0.6002 Service Pack 2
03.11.2009 19:37:36
mbam-log-2009-11-03 (19-37-36).txt
Тип проверки: Полная (C:|)
Проверено объектов: 238553
Прошло времени: 40 minute(s), 56 second(s)
Заражено процессов в памяти: 0
Заражено модулей в памяти: 0
Заражено ключей реестра: 0
Заражено значений реестра: 0
Заражено параметров реестра: 0
Заражено папок: 0
Заражено файлов: 3
Заражено процессов в памяти:
(Вредоносные программы не обнаружены)
Заражено модулей в памяти:
(Вредоносные программы не обнаружены)
Заражено ключей реестра:
(Вредоносные программы не обнаружены)
Заражено значений реестра:
(Вредоносные программы не обнаружены)
Заражено параметров реестра:
(Вредоносные программы не обнаружены)
Заражено папок:
(Вредоносные программы не обнаружены)
Заражено файлов:
C:Program FilesSamsungSamsung PC Studio 3utilSMSMoveD500.exe (Worm.Koobface) -> Quarantined and deleted successfully.
C:Program FilesSamsungSamsung PC Studio 3utilSMSMoveX800.exe (Worm.Koobface) -> Quarantined and deleted successfully.
C:Program FilesSamsungSamsung PC Studio 3utilSMSMoveZ510.exe (Worm.Koobface) -> Quarantined and deleted successfully.
Лог RSIT:
Logfile of random’s system information tool 1.06 (written by random/random)
Run by Irbis at 2009-11-03 22:03:40
Microsoft® Windows Vista™ Home Basic Service Pack 2
System drive C: has 19 GB (39%) free of 47 GB
Total RAM: 3326 MB (60% free)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:03:47, on 03.11.2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18828)
Boot mode: Normal
Running processes:
C:Windowssystem32taskeng.exe
C:Windowssystem32Dwm.exe
C:Windowssystem32taskeng.exe
C:WindowsExplorer.EXE
C:Program FilesIObitAdvanced SystemCare 3AWC.exe
C:WindowsWindowsMobilewmdSync.exe
C:Program FilesESETESET NOD32 Antivirusegui.exe
C:Windowssystem32wbemunsecapp.exe
C:Program FilesAPCAPC PowerChute Personal Editionapcsystray.exe
C:Program FilesWindows DefenderMSASCui.exe
C:Program FilesMozilla Firefoxfirefox.exe
C:Program FilesWindows Media Playerwmpnscfg.exe
H:Программыудаляет вредоносные прогиЧерви, вирусы вредонсн прогиRSIT.exe
C:Program FilesTrend MicroHijackThisIrbis.exe
R1 — HKCUSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://search.qip.ru
R1 — HKCUSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://search.qip.ru
R1 — HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://search.qip.ru/ie
R1 — HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = http://search.qip.ru
R0 — HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.apeha.ru
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 — HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 — HKCUSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant = http://search.qip.ru/ie
R0 — HKLMSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant =
R0 — HKLMSoftwareMicrosoftInternet ExplorerSearch,CustomizeSearch =
R1 — HKCUSoftwareMicrosoftInternet ExplorerSearchURL,(Default) = http://search.qip.ru/search?query=%s&from=IE
R0 — HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName =
R3 — URLSearchHook: QIPBHO Class — {95289393-33EA-4F8D-B952-483415B9C955} — C:UsersIrbisAppDataRoamingMicrosoftInternet Explorerqipsearchbar.dll
R3 — URLSearchHook: Спутник@Mail.Ru — {09900DE8-1DCA-443F-9243-26FF581438AF} — c:program filesmail.rusputnikMailRuSputnik.dll
R3 — URLSearchHook: Winamp Search Class — {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} — C:Program FilesWinamp Toolbarwinamptb.dll
O1 — Hosts: ::1 localhost
O4 — HKLM..Run: [Windows Mobile-based device management] %windir%WindowsMobilewmdSync.exe
O4 — HKLM..Run: [egui] «C:Program FilesESETESET NOD32 Antivirusegui.exe» /hide /waitservice
O4 — HKLM..Run: [Malwarebytes Anti-Malware (reboot)] «C:Program FilesMalwarebytes’ Anti-Malwarembam.exe» /runcleanupscript
O4 — HKUSS-1-5-19..Run: [Sidebar] %ProgramFiles%Windows SidebarSidebar.exe /detectMem (User ‘LOCAL SERVICE’)
O4 — HKUSS-1-5-19..Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User ‘LOCAL SERVICE’)
O4 — HKUSS-1-5-20..Run: [Sidebar] %ProgramFiles%Windows SidebarSidebar.exe /detectMem (User ‘NETWORK SERVICE’)
O4 — Startup: explorer — Ярлык.lnk = C:Windowsexplorer.exe
O4 — Global Startup: APC UPS Status.lnk = ?
O8 — Extra context menu item: &Winamp Search — C:ProgramDataWinamp ToolbarieToolbarresourcesen-USlocalsearch.html
O13 — Gopher Prefix:
O17 — HKLMSystemCCSServicesTcpip..{0BE9002C-16D0-4D5C-8E24-72119F8E8B16}: NameServer = 195.98.160.26,80.253.30.20
O17 — HKLMSystemCCSServicesTcpip..{AA8B0828-9FF6-4C43-8E03-08D6FABCDA25}: NameServer = 195.98.160.26 195.98.161.26
O23 — Service: APC UPS Service — American Power Conversion Corporation — C:Program FilesAPCAPC PowerChute Personal Editionmainserv.exe
O23 — Service: Eset HTTP Server (EhttpSrv) — ESET — C:Program FilesESETESET NOD32 AntivirusEHttpSrv.exe
O23 — Service: Eset Service (ekrn) — ESET — C:Program FilesESETESET NOD32 Antivirusekrn.exe
O23 — Service: Nero BackItUp Scheduler 3 — Nero AG — C:Program FilesNeroNero8Nero BackItUpNBService.exe
O23 — Service: NMIndexingService — Nero AG — C:Program FilesCommon FilesNeroLibNMIndexingService.exe
—
End of file — 4415 bytes
======Scheduled tasks folder======
C:WindowstasksAWC Startup.job
C:WindowstasksCrysis Wars(R) Updates.job
C:WindowstasksUser_Feed_Synchronization-{11B80F1F-A2FA-4650-AE3D-FF57D2DC2C9B}.job
======Registry dump======
[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun]
«Windows Mobile-based device management»=C:WindowsWindowsMobilewmdSync.exe [2008-01-21 215552]
«egui»=C:Program FilesESETESET NOD32 Antivirusegui.exe [2008-07-01 1447168]
«Malwarebytes Anti-Malware (reboot)»=C:Program FilesMalwarebytes’ Anti-Malwarembam.exe [2009-09-10 1312080]
[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregAdobe Reader Speed Launcher]
C:Program FilesAdobeReader 8.0ReaderReader_sl.exe [2008-01-11 39792]
[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregComrade.exe]
C:Program FilesGameSpyComradeComrade.exe [2007-06-29 36864]
[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregEA Core]
C:Program FilesElectronic ArtsEADMCore.exe [2008-07-22 2772992]
[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregIndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
C:Program FilesCommon FilesNeroLibNMIndexStoreSvr.exe [2007-09-20 1410344]
[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregNBKeyScan]
C:Program FilesNeroNero8Nero BackItUpNBKeyScan.exe [2007-09-20 1836328]
[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregNeroFilterCheck]
C:Program FilesCommon FilesNeroLibNeroCheck.exe [2007-03-01 153136]
[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregOrb]
C:Program FilesWinamp RemotebinOrbTray.exe [2008-04-01 507904]
[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregPC Suite Tray]
C:Program FilesNokiaNokia PC Suite 7PCSuite.exe [2009-06-25 1414144]
[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregRGSC]
H:GamesGTA4Rockstar Games Social ClubRGSCLauncher.exe /silent []
[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregRtHDVCpl]
RtHDVCpl.exe []
[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregSkype]
C:Program FilesSkypePhoneSkype.exe /nosplash /minimized []
[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregSunJavaUpdateSched]
C:Program FilesJavajre1.6.0_04binjusched.exe [2007-12-14 144784]
[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregUnlockerAssistant]
C:Program FilesUnlockerUnlockerAssistant.exe [2008-05-02 15872]
[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregWinampAgent]
C:Program FilesWinampwinampa.exe [2008-08-04 36352]
[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregWindows Defender]
C:Program FilesWindows DefenderMSASCui.exe [2008-01-21 1008184]
[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregYandexDesktopSearch]
C:Program FilesYandexDesktopyandesk.exe [2007-12-10 7456256]
[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregYupdate!]
C:Program FilesCommon FilesYandexYupdateyupdate.exe []
[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupfolderC:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^FlyLinkDC++.lnk]
C:PROGRA~1FLYLIN~1FLYLIN~1.EXE [2008-11-20 3002880]
[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupfolderC:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^IP-TV Player Agent.lnk]
C:PROGRA~1IP-TVP~1IPTVPL~1.EXE [2008-12-17 359424]
[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupfolderC:^Users^Irbis^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Punto Switcher.lnk]
C:PROGRA~1YandexPUNTOS~1punto.exe [2009-07-13 830248]
C:ProgramDataMicrosoftWindowsStart MenuProgramsStartup
APC UPS Status.lnk — C:Program FilesAPCAPC PowerChute Personal EditionDisplay.exe
C:UsersIrbisAppDataRoamingMicrosoftWindowsStart MenuProgramsStartup
explorer — Ярлык.lnk — C:Windowsexplorer.exe
[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetworkWudfPf]
[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetworkWudfRd]
[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetworkWudfSvc]
[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetworkWudfUsbccidDriver]
[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
«dontdisplaylastusername»=0
«legalnoticecaption»=
«legalnoticetext»=
«shutdownwithoutlogon»=1
«undockwithoutlogon»=1
«EnableUIADesktopToggle»=0
[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«BindDirectlyToPropertySetStorage»=
[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicystandardprofileauthorizedapplicationslist]
[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicydomainprofileauthorizedapplicationslist]
[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{40f65ff5-a063-11de-8fb5-001e90ce2363}]
shellAutoRuncommand — J:Autorun.exe
[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{876a6357-453c-11de-8ec8-001e90ce2363}]
shellAutoRuncommand — internet_free.exe -flash
======File associations======
.js — edit — C:WindowsSystem32Notepad.exe %1
.js — open — C:WindowsSystem32WScript.exe «%1» %*
======List of files/folders created in the last 1 months======
2009-11-03 14:52:36 —-D—- C:UsersIrbisAppDataRoamingMalwarebytes
2009-11-03 14:52:29 —-D—- C:ProgramDataMalwarebytes
2009-11-03 14:52:27 —-D—- C:Program FilesMalwarebytes’ Anti-Malware
2009-10-30 20:24:43 —-D—- C:Program FilesWindows Portable Devices
2009-10-30 18:48:22 —-A—- C:Windowssystem32UIAnimation.dll
2009-10-30 18:48:21 —-A—- C:Windowssystem32UIRibbonRes.dll
2009-10-30 18:48:21 —-A—- C:Windowssystem32UIRibbon.dll
2009-10-30 18:47:37 —-A—- C:Windowssystem32WMPhoto.dll
2009-10-30 18:47:35 —-A—- C:Windowssystem32cdd.dll
2009-10-30 18:47:33 —-A—- C:Windowssystem32XpsRasterService.dll
2009-10-30 18:47:33 —-A—- C:Windowssystem32printfilterpipelineprxy.dll
2009-10-30 18:47:33 —-A—- C:Windowssystem32d3d10warp.dll
2009-10-30 18:47:32 —-A—- C:Windowssystem32XpsGdiConverter.dll
2009-10-30 18:47:32 —-A—- C:Windowssystem32WindowsCodecsExt.dll
2009-10-30 18:47:32 —-A—- C:Windowssystem32WindowsCodecs.dll
2009-10-30 18:47:32 —-A—- C:Windowssystem32printfilterpipelinesvc.exe
2009-10-30 18:47:32 —-A—- C:Windowssystem32PhotoMetadataHandler.dll
2009-10-30 18:47:32 —-A—- C:Windowssystem32dxdiagn.dll
2009-10-30 18:47:32 —-A—- C:Windowssystem32dxdiag.exe
2009-10-30 18:47:32 —-A—- C:Windowssystem32d2d1.dll
2009-10-30 18:47:31 —-A—- C:Windowssystem32xpsservices.dll
2009-10-30 18:47:31 —-A—- C:Windowssystem32XpsPrint.dll
2009-10-30 18:47:31 —-A—- C:Windowssystem32OpcServices.dll
2009-10-30 18:47:31 —-A—- C:Windowssystem32FntCache.dll
2009-10-30 18:47:31 —-A—- C:Windowssystem32dxgi.dll
2009-10-30 18:47:31 —-A—- C:Windowssystem32DWrite.dll
2009-10-30 18:47:31 —-A—- C:Windowssystem32d3d11.dll
2009-10-30 18:47:31 —-A—- C:Windowssystem32d3d10level9.dll
2009-10-30 18:47:31 —-A—- C:Windowssystem32d3d10core.dll
2009-10-30 18:47:31 —-A—- C:Windowssystem32d3d10_1core.dll
2009-10-30 18:47:31 —-A—- C:Windowssystem32d3d10_1.dll
2009-10-30 18:47:30 —-A—- C:Windowssystem32d3d10.dll
2009-10-30 18:46:27 —-A—- C:Windowssystem32WPDShextAutoplay.exe
2009-10-30 18:46:26 —-A—- C:Windowssystem32wpdbusenum.dll
2009-10-30 18:46:26 —-A—- C:Windowssystem32BthMtpContextHandler.dll
2009-10-30 18:46:15 —-A—- C:Windowssystem32PortableDeviceConnectApi.dll
2009-10-30 18:46:07 —-A—- C:Windowssystem32WPDSp.dll
2009-10-30 18:46:07 —-A—- C:Windowssystem32WPDShServiceObj.dll
2009-10-30 18:46:07 —-A—- C:Windowssystem32wpdshext.dll
2009-10-30 18:46:07 —-A—- C:Windowssystem32wpd_ci.dll
2009-10-30 18:46:07 —-A—- C:Windowssystem32PortableDeviceWMDRM.dll
2009-10-30 18:46:07 —-A—- C:Windowssystem32PortableDeviceTypes.dll
2009-10-30 18:46:07 —-A—- C:Windowssystem32PortableDeviceClassExtension.dll
2009-10-30 18:46:07 —-A—- C:Windowssystem32PortableDeviceApi.dll
2009-10-30 18:43:55 —-A—- C:Windowssystem32UIAutomationCore.dll
2009-10-30 18:43:55 —-A—- C:Windowssystem32oleaccrc.dll
2009-10-30 18:43:55 —-A—- C:Windowssystem32oleacc.dll
2009-10-30 16:12:25 —-A—- C:Windowssystem32jscript.dll
2009-10-30 16:11:54 —-A—- C:Windowssystem32wmp.dll
2009-10-30 16:11:46 —-A—- C:Windowssystem32unregmp2.exe
2009-10-30 16:11:42 —-A—- C:Windowssystem32wmploc.DLL
2009-10-27 18:25:35 —-D—- C:Windowssystem32eu-ES
2009-10-27 18:25:35 —-D—- C:Windowssystem32ca-ES
2009-10-27 18:25:24 —-D—- C:Windowssystem32vi-VN
2009-10-27 17:41:05 —-D—- C:rsit
2009-10-27 17:28:01 —-D—- C:Windowssystem32EventProviders
2009-10-27 16:53:49 —-D—- C:Program FilesTrend Micro
2009-10-27 16:48:02 —-A—- C:Windowssystem32occache.dll
2009-10-27 16:48:02 —-A—- C:Windowssystem32jsproxy.dll
2009-10-27 16:48:01 —-A—- C:Windowssystem32msfeedsbs.dll
2009-10-27 16:48:01 —-A—- C:Windowssystem32msfeeds.dll
2009-10-27 16:48:01 —-A—- C:Windowssystem32ieui.dll
2009-10-27 16:48:01 —-A—- C:Windowssystem32iepeers.dll
2009-10-27 16:48:00 —-A—- C:Windowssystem32wininet.dll
2009-10-27 16:48:00 —-A—- C:Windowssystem32iesetup.dll
2009-10-27 16:48:00 —-A—- C:Windowssystem32iernonce.dll
2009-10-27 16:47:59 —-A—- C:Windowssystem32msfeedssync.exe
2009-10-27 16:47:59 —-A—- C:Windowssystem32iertutil.dll
2009-10-27 16:47:59 —-A—- C:Windowssystem32ie4uinit.exe
2009-10-27 16:47:58 —-A—- C:Windowssystem32ieUnatt.exe
2009-10-27 16:47:58 —-A—- C:Windowssystem32iesysprep.dll
2009-10-27 16:47:58 —-A—- C:Windowssystem32iedkcs32.dll
2009-10-27 16:47:57 —-A—- C:Windowssystem32urlmon.dll
2009-10-27 16:47:56 —-A—- C:Windowssystem32ieframe.dll
2009-10-27 16:47:55 —-A—- C:Windowssystem32mshtml.dll
2009-10-27 16:45:36 —-A—- C:Windowssystem32mshtmler.dll
2009-10-27 16:45:36 —-A—- C:Windowssystem32mshtmled.dll
2009-10-27 16:45:36 —-A—- C:Windowssystem32icardie.dll
2009-10-27 16:45:36 —-A—- C:Windowssystem32admparse.dll
2009-10-27 16:45:35 —-A—- C:Windowssystem32msls31.dll
2009-10-27 16:45:35 —-A—- C:Windowssystem32corpol.dll
2009-10-27 16:45:34 —-A—- C:Windowssystem32imgutil.dll
2009-10-27 16:45:34 —-A—- C:Windowssystem32ieakeng.dll
2009-10-27 16:45:34 —-A—- C:Windowssystem32dxtrans.dll
2009-10-27 16:45:34 —-A—- C:Windowssystem32dxtmsft.dll
2009-10-27 16:45:33 —-A—- C:Windowssystem32licmgr10.dll
2009-10-27 16:45:33 —-A—- C:Windowssystem32inseng.dll
2009-10-27 16:45:32 —-A—- C:Windowssystem32webcheck.dll
2009-10-27 16:45:32 —-A—- C:Windowssystem32msrating.dll
2009-10-27 16:45:32 —-A—- C:Windowssystem32ieakui.dll
2009-10-27 16:45:32 —-A—- C:Windowssystem32ieaksie.dll
2009-10-27 16:45:31 —-A—- C:Windowssystem32WinFXDocObj.exe
2009-10-27 16:45:31 —-A—- C:Windowssystem32wextract.exe
2009-10-27 16:45:31 —-A—- C:Windowssystem32mstime.dll
2009-10-27 16:45:30 —-A—- C:Windowssystem32pngfilt.dll
2009-10-27 16:45:30 —-A—- C:Windowssystem32ieapfltr.dll
2009-10-27 16:45:30 —-A—- C:Windowssystem32advpack.dll
2009-10-27 16:45:29 —-A—- C:Windowssystem32vbscript.dll
2009-10-27 16:45:29 —-A—- C:Windowssystem32url.dll
2009-10-27 16:45:27 —-A—- C:Windowssystem32SetDepNx.exe
2009-10-27 16:45:27 —-A—- C:Windowssystem32RegisterIEPKEYs.exe
2009-10-27 16:45:27 —-A—- C:Windowssystem32mshta.exe
2009-10-27 16:45:27 —-A—- C:Windowssystem32iexpress.exe
2009-10-27 16:45:26 —-A—- C:Windowssystem32SetIEInstalledDate.exe
2009-10-27 16:45:26 —-A—- C:Windowssystem32PDMSetup.exe
2009-10-27 16:40:28 —-A—- C:Windowssystem32wups2.dll
2009-10-27 16:40:28 —-A—- C:Windowssystem32wuauclt.exe
2009-10-27 16:40:27 —-A—- C:Windowssystem32wucltux.dll
2009-10-27 16:40:27 —-A—- C:Windowssystem32wuaueng.dll
2009-10-27 16:40:10 —-A—- C:Windowssystem32wups.dll
2009-10-27 16:40:10 —-A—- C:Windowssystem32wudriver.dll
2009-10-27 16:40:10 —-A—- C:Windowssystem32wuapi.dll
2009-10-27 16:40:00 —-A—- C:Windowssystem32wuwebv.dll
2009-10-27 16:40:00 —-A—- C:Windowssystem32wuapp.exe
2009-10-21 14:25:52 —-D—- C:UsersIrbisAppDataRoamingPeerNetworking
2009-10-19 21:25:37 —-D—- C:Program FilesAPC
2009-10-15 23:50:18 —-D—- C:Program FilesESET
2009-10-15 22:35:26 —-D—- C:ProgramDataESET
2009-10-15 19:27:05 —-D—- C:Program FilesIObit
2009-10-15 16:00:22 —-A—- C:Windowssystem32msv1_0.dll
2009-10-15 15:56:40 —-A—- C:Windowssystem32ntkrnlpa.exe
2009-10-15 15:56:38 —-A—- C:Windowssystem32ntoskrnl.exe
2009-10-15 15:34:59 —-A—- C:Windowssystem32msasn1.dll
2009-10-15 15:34:56 —-A—- C:Windowssystem32WMSPDMOD.DLL
2009-10-13 10:07:49 —-D—- C:UsersIrbisAppDataRoamingSamsung
2009-10-13 10:03:40 —-D—- C:Windowssystem32Samsung_USB_Drivers
2009-10-13 10:03:38 —-D—- C:Program FilesSamsung
2009-10-12 19:39:19 —-A—- C:Windowssystem32ShellManager310E2D762.dll
2009-10-12 18:32:13 —-D—- C:UsersIrbisAppDataRoamingAhead
2009-10-12 18:31:04 —-D—- C:Program FilesCommon FilesAhead
2009-10-12 17:56:37 —-D—- C:UsersIrbisAppDataRoamingNeroDigital(TM)
2009-10-09 19:34:57 —-D—- C:Program FilesIVT Corporation
2009-10-09 18:32:01 —-A—- C:WindowsDIFxAPI.dll
2009-10-09 18:32:00 —-A—- C:Windowssystem32RtkHDMI.dll
2009-10-09 18:32:00 —-A—- C:Windowssystem32RHDMIExt.dll
2009-10-09 18:32:00 —-A—- C:Windowssystem32RHCoInst.dll
2009-10-09 18:32:00 —-A—- C:WindowsRtkUpd.exe
2009-10-09 14:51:49 —-D—- C:ProgramDataATI
2009-10-09 10:51:55 —-A—- C:Windowsntbtlog.txt
2009-10-06 17:16:34 —-D—- C:UsersIrbisAppDataRoamingCMedia
2009-10-06 14:06:54 —-D—- C:Windowspss
======List of files/folders modified in the last 1 months======
2009-11-03 22:03:45 —-D—- C:WindowsTemp
2009-11-03 22:03:37 —-D—- C:WindowsPrefetch
2009-11-03 19:45:40 —-D—- C:WindowsSystem32
2009-11-03 19:45:39 —-D—- C:Windowsinf
2009-11-03 19:45:39 —-A—- C:Windowssystem32PerfStringBackup.INI
2009-11-03 19:42:40 —-D—- C:UsersIrbisAppDataRoamingOpenOffice.org2
2009-11-03 14:52:31 —-D—- C:Windowssystem32drivers
2009-11-03 14:52:29 —-HD—- C:ProgramData
2009-11-03 14:52:27 —-RD—- C:Program Files
2009-11-03 14:45:35 —-D—- C:Windowsrescache
2009-11-03 14:40:20 —-SHD—- C:System Volume Information
2009-10-30 20:28:46 —-D—- C:Windowssystem32Tasks
2009-10-30 20:24:52 —-D—- C:Windows
2009-10-30 20:24:45 —-D—- C:Windowssystem32ru-RU
2009-10-30 20:24:43 —-D—- C:Windowssystem32wbem
2009-10-30 20:24:41 —-D—- C:Windowssystem32zh-TW
2009-10-30 20:24:41 —-D—- C:Windowssystem32zh-HK
2009-10-30 20:24:41 —-D—- C:Windowssystem32zh-CN
2009-10-30 20:24:41 —-D—- C:Windowssystem32uk-UA
2009-10-30 20:24:41 —-D—- C:Windowssystem32tr-TR
2009-10-30 20:24:41 —-D—- C:Windowssystem32th-TH
2009-10-30 20:24:41 —-D—- C:Windowssystem32sv-SE
2009-10-30 20:24:41 —-D—- C:Windowssystem32sr-Latn-CS
2009-10-30 20:24:41 —-D—- C:Windowssystem32sl-SI
2009-10-30 20:24:41 —-D—- C:Windowssystem32sk-SK
2009-10-30 20:24:41 —-D—- C:Windowssystem32ro-RO
2009-10-30 20:24:41 —-D—- C:Windowssystem32pt-PT
2009-10-30 20:24:41 —-D—- C:Windowssystem32pt-BR
2009-10-30 20:24:41 —-D—- C:Windowssystem32pl-PL
2009-10-30 20:24:41 —-D—- C:Windowssystem32nl-NL
2009-10-30 20:24:41 —-D—- C:Windowssystem32nb-NO
2009-10-30 20:24:41 —-D—- C:Windowssystem32lv-LV
2009-10-30 20:24:41 —-D—- C:Windowssystem32lt-LT
2009-10-30 20:24:41 —-D—- C:Windowssystem32ko-KR
2009-10-30 20:24:41 —-D—- C:Windowssystem32ja-JP
2009-10-30 20:24:41 —-D—- C:Windowssystem32it-IT
2009-10-30 20:24:41 —-D—- C:Windowssystem32hu-HU
2009-10-30 20:24:41 —-D—- C:Windowssystem32hr-HR
2009-10-30 20:24:41 —-D—- C:Windowssystem32he-IL
2009-10-30 20:24:41 —-D—- C:Windowssystem32fr-FR
2009-10-30 20:24:41 —-D—- C:Windowssystem32fi-FI
2009-10-30 20:24:41 —-D—- C:Windowssystem32et-EE
2009-10-30 20:24:41 —-D—- C:Windowssystem32es-ES
2009-10-30 20:24:41 —-D—- C:Windowssystem32en-US
2009-10-30 20:24:41 —-D—- C:Windowssystem32el-GR
2009-10-30 20:24:41 —-D—- C:Windowssystem32de-DE
2009-10-30 20:24:41 —-D—- C:Windowssystem32da-DK
2009-10-30 20:24:41 —-D—- C:Windowssystem32cs-CZ
2009-10-30 20:24:41 —-D—- C:Windowssystem32bg-BG
2009-10-30 20:24:41 —-D—- C:Windowssystem32ar-SA
2009-10-30 19:30:34 —-D—- C:WindowsMicrosoft.NET
2009-10-30 19:29:50 —-RSD—- C:Windowsassembly
2009-10-30 18:48:39 —-D—- C:Windowswinsxs
2009-10-30 18:48:37 —-D—- C:Windowssystem32catroot
2009-10-30 18:47:04 —-D—- C:Windowssystem32catroot2
2009-10-30 18:38:21 —-D—- C:Program FilesInternet Explorer
2009-10-30 18:37:56 —-D—- C:Program FilesWindows Media Player
2009-10-27 18:51:22 —-D—- C:WindowsTasks
2009-10-27 18:35:03 —-SHD—- C:Boot
2009-10-27 18:27:56 —-D—- C:Program FilesWindows Calendar
2009-10-27 18:27:55 —-D—- C:Program FilesWindows Mail
2009-10-27 18:27:54 —-D—- C:Program FilesMovie Maker
2009-10-27 18:27:52 —-D—- C:Program FilesWindows Sidebar
2009-10-27 18:27:51 —-D—- C:Program FilesWindows Collaboration
2009-10-27 18:27:48 —-D—- C:Program FilesWindows Photo Gallery
2009-10-27 18:27:48 —-D—- C:Program FilesCommon FilesSystem
2009-10-27 18:27:39 —-D—- C:Windowsservicing
2009-10-27 18:27:39 —-D—- C:Program FilesWindows Defender
2009-10-27 18:27:21 —-D—- C:WindowsIME
2009-10-27 18:27:20 —-D—- C:Windowssystem32XPSViewer
2009-10-27 18:27:20 —-D—- C:Windowssystem32oobe
2009-10-27 18:27:19 —-D—- C:Windowssystem32migration
2009-10-27 18:27:14 —-D—- C:Windowssystem32AdvancedInstallers
2009-10-27 18:27:11 —-D—- C:Windowssystem32SLUI
2009-10-27 18:27:11 —-D—- C:Windowssystem32setup
2009-10-27 18:27:10 —-D—- C:Windowssystem32ru
2009-10-27 18:27:10 —-D—- C:Windowssystem32manifeststore
2009-10-27 18:27:02 —-D—- C:Windowssystem32migwiz
2009-10-27 18:25:43 —-RSD—- C:WindowsFonts
2009-10-27 18:25:42 —-D—- C:WindowsAppPatch
2009-10-27 18:25:23 —-D—- C:Windowssystem32Boot
2009-10-27 17:20:55 —-D—- C:WindowsPolicyDefinitions
2009-10-22 15:33:30 —-SHD—- C:WindowsInstaller
2009-10-22 15:33:15 —-A—- C:Windowssystem32MsiExec.exe.log
2009-10-22 15:31:43 —-D—- C:Program FilesCommon FilesNero
2009-10-22 15:29:48 —-D—- C:ProgramDataNero
2009-10-19 22:54:19 —-D—- C:Program FilesMozilla Firefox
2009-10-19 21:25:31 —-HD—- C:Program FilesInstallShield Installation Information
2009-10-19 19:18:09 —-D—- C:UsersIrbisAppDataRoamingDesktopicon
2009-10-19 19:13:40 —-D—- C:Program FilesUnlocker
2009-10-19 18:01:55 —-D—- C:Windowssystem32RTCOM
2009-10-18 22:00:37 —-A—- C:Windowssystem32PnkBstrB.exe
2009-10-15 23:30:08 —-D—- C:ProgramDataSkype
2009-10-15 23:30:08 —-D—- C:Program FilesCommon Files
2009-10-15 15:12:17 —-D—- C:UsersIrbisAppDataRoamingskypePM
2009-10-12 20:15:33 —-D—- C:Program FilesNero
2009-10-12 19:20:57 —-D—- C:UsersIrbisAppDataRoamingNero
2009-10-12 18:16:04 —-A—- C:WindowsIrremote.ini
2009-10-09 19:36:47 —-D—- C:ProgramDataBluetooth
2009-10-09 17:48:41 —-D—- C:WindowsDebug
2009-10-09 17:39:31 —-D—- C:Windowssystem32WDI
2009-10-09 14:51:49 —-SHD—- C:$Recycle.Bin
2009-10-09 14:49:04 —-RD—- C:Users
2009-10-06 14:20:01 —-D—- C:ProgramDataInstallations
2009-10-06 14:02:55 —-D—- C:UsersIrbisAppDataRoamingIP-TV Player
2009-10-04 03:06:51 —-HDC—- C:ProgramData{0151C9FC-719D-4459-B1E2-4685CC6E62A8}
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R1 easdrv;easdrv; C:Windowssystem32DRIVERSeasdrv.sys [2008-07-01 53256]
R1 epfwtdir;epfwtdir; C:Windowssystem32DRIVERSepfwtdir.sys [2008-07-01 34312]
R1 StarOpen;StarOpen; C:Windowssystem32driversStarOpen.sys [2006-07-24 5632]
R1 Uim_IM;UIM Drive Backup Image Plugin; C:WindowsSystem32DriversUim_IM.sys [2007-07-16 131192]
R1 UimBus;Universal Image Mounter Controller; C:Windowssystem32DRIVERSUimBus.sys [2007-07-16 32080]
R2 atksgt;atksgt; C:Windowssystem32DRIVERSatksgt.sys [2009-04-18 279712]
R2 eamon;EAMON; C:Windowssystem32DRIVERSeamon.sys [2008-07-01 39944]
R2 lirsgt;lirsgt; C:Windowssystem32DRIVERSlirsgt.sys [2009-04-18 25888]
R3 atikmdag;atikmdag; C:Windowssystem32DRIVERSatikmdag.sys [2008-06-21 3695616]
R3 BlueletAudio;Bluetooth Audio Service; C:Windowssystem32DRIVERSblueletaudio.sys [2007-06-24 34312]
R3 BlueletSCOAudio;Bluetooth SCO Audio Service; C:Windowssystem32DRIVERSBlueletSCOAudio.sys [2007-06-24 27656]
R3 BT;Bluetooth PAN Network Adapter; C:Windowssystem32DRIVERSbtnetdrv.sys [2007-03-05 18320]
R3 Btcsrusb;Bluetooth USB For Bluetooth Service; C:WindowsSystem32Driversbtcusb.sys [2007-06-24 38920]
R3 dc3d;USBCCGP filter driver (dc3d); C:Windowssystem32DRIVERSdc3d.sys [2009-01-15 15360]
R3 HdAudAddService;Драйвер функции UAA для службы High Definition Audio (Microsoft), версия 1.1; C:Windowssystem32driversHdAudio.sys [2009-04-11 236544]
R3 NuidFltr;NUID filter driver; C:Windowssystem32DRIVERSNuidFltr.sys [2009-05-09 14736]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:Windowssystem32DRIVERSnvmfdx32.sys [2007-11-18 1040544]
R3 Point32;Microsoft IntelliPoint Filter Driver; C:Windowssystem32DRIVERSpoint32k.sys [2007-08-21 24064]
R3 ROOTMODEM;Microsoft Legacy Modem Driver; C:WindowsSystem32DriversRootMdm.sys [2008-01-21 8192]
R3 RTHDMIAzAudService;Service for HDMI; C:Windowssystem32driversRtHDMIV.sys [2008-08-26 150560]
R3 VComm;Virtual Serial port driver; C:Windowssystem32DRIVERSVComm.sys [2007-03-05 34448]
R3 VcommMgr;Bluetooth VComm Manager Service; C:WindowsSystem32DriversVcommMgr.sys [2007-03-05 44304]
R3 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:Windowssystem32DRIVERSwmiacpi.sys [2008-01-21 11264]
S3 a0w0llan;a0w0llan; C:Windowssystem32driversa0w0llan.sys []
S3 BthEnum;Служба перечислителя Bluetooth; C:Windowssystem32DRIVERSBthEnum.sys [2009-04-11 22528]
S3 BthPan;Устройства Bluetooth (личной сети); C:Windowssystem32DRIVERSbthpan.sys [2008-01-21 92160]
S3 BTHPORT;Драйвер порта Bluetooth; C:WindowsSystem32DriversBTHport.sys [2008-04-29 220160]
S3 BTHUSB;Драйвер порта USB радиомодуля Bluetooth; C:WindowsSystem32DriversBTHUSB.sys [2008-04-29 29184]
S3 btnetBUs;Bluetooth PAN Bus Service; C:WindowsSystem32DriversbtnetBus.sys [2009-06-17 29192]
S3 drmkaud;Звуковой дешифратор DRM ядра системы; C:Windowssystem32driversdrmkaud.sys [2008-01-21 5632]
S3 HidBatt;Драйвер батареи ИБП HID; C:Windowssystem32DRIVERSHidBatt.sys [2008-01-21 21504]
S3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:Windowssystem32driversRTKVHDA.sys []
S3 IvtBtBUs;IVT Bluetooth Bus Service; C:WindowsSystem32DriversIvtBtBus.sys []
S3 MSKSSRV;Представитель служб потоков Microsoft; C:Windowssystem32driversMSKSSRV.sys [2008-01-21 8192]
S3 MSPCLOCK;Посредник синхронизации потоков Microsoft; C:Windowssystem32driversMSPCLOCK.sys [2008-01-21 5888]
S3 MSPQM;Представитель диспетчера качества потоков Microsoft; C:Windowssystem32driversMSPQM.sys [2008-01-21 5504]
S3 MSTEE;Преобразователь потоков Tee/Sink-to-Sink Microsoft; C:Windowssystem32driversMSTEE.sys [2008-01-21 6016]
S3 nmwcd;Nokia USB Phone Parent; C:Windowssystem32driversccdcmb.sys [2009-02-09 17664]
S3 nmwcdc;Nokia USB Generic; C:Windowssystem32driversccdcmbo.sys [2009-02-09 22016]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:Windowssystem32DRIVERSpccsmcfd.sys [2008-08-26 18816]
S3 RFCOMM;Устройство Bluetooth (протокол RFCOMM TDI); C:Windowssystem32DRIVERSrfcomm.sys [2009-04-11 148992]
S3 RTL8169;Realtek 8169 NT драйвер; C:Windowssystem32DRIVERSRtlh86.sys [2006-11-02 44544]
S3 upperdev;upperdev; C:Windowssystem32DRIVERSusbser_lowerflt.sys [2009-02-09 7808]
S3 usbser;Nokia USB Serial Port; C:Windowssystem32driversusbser.sys [2009-04-11 27648]
S3 UsbserFilt;UsbserFilt; C:Windowssystem32DRIVERSusbser_lowerfltj.sys [2009-02-09 7808]
S3 vaxscsi;vaxscsi; C:WindowsSystem32Driversvaxscsi.sys [2008-12-28 223128]
S3 winusb;WinUSB Service; C:Windowssystem32DRIVERSwinusb.sys [2009-04-11 31616]
S3 WUDFRd;WUDFRd; C:Windowssystem32DRIVERSWUDFRd.sys [2008-01-21 83328]
S4 ErrDev;Microsoft Hardware Error Device Driver; C:Windowssystem32driverserrdev.sys [2008-01-21 6656]
S4 MegaSR;MegaSR; C:Windowssystem32driversmegasr.sys [2008-01-21 386616]
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 APC UPS Service;APC UPS Service; C:Program FilesAPCAPC PowerChute Personal Editionmainserv.exe [2005-12-12 176193]
R2 ekrn;Eset Service; C:Program FilesESETESET NOD32 Antivirusekrn.exe [2007-12-21 468224]
R2 Nero BackItUp Scheduler 3;Nero BackItUp Scheduler 3; C:Program FilesNeroNero8Nero BackItUpNBService.exe [2007-09-20 853288]
R2 RapiMgr;@%windir%WindowsMobilerapimgr.dll,-104; C:Windowssystem32svchost.exe [2008-01-21 21504]
R2 WcesComm;@%windir%WindowsMobilewcescomm.dll,-40079; C:Windowssystem32svchost.exe [2008-01-21 21504]
S3 aspnet_state;Служба состояний ASP.NET; C:WindowsMicrosoft.NETFrameworkv2.0.50727aspnet_state.exe [2009-03-30 31048]
S3 EhttpSrv;Eset HTTP Server; C:Program FilesESETESET NOD32 AntivirusEHttpSrv.exe [2008-07-01 19200]
S3 FontCache;@%systemroot%system32FntCache.dll,-100; C:Windowssystem32svchost.exe [2008-01-21 21504]
S3 NMIndexingService;NMIndexingService; C:Program FilesCommon FilesNeroLibNMIndexingService.exe [2007-09-20 382248]
S3 usprserv;User Privilege Service; C:WindowsSystem32svchost.exe [2008-01-21 21504]
S4 BthServ;@%SystemRoot%System32bthserv.dll,-101; C:Windowssystem32svchost.exe [2008-01-21 21504]
EOF
