Re: Re: Окно с порнухой на половину экрана

6 ноября, 2008 в 7:14 дп #19540

Аноним

Гость

Темы:532
Сообщений:1553

☆☆☆☆☆

Я дважды это сделала:
@Valeri wrote:

Запустите HijackThis, кликните по кнопке Do a system scan only.
Далее отметьте галочками (слева) следующие строки:
O2 - BHO: btulibP - {1ECA18AE-74CB-46E2-B528-B2AF0EAB64A7} - C:Windowssystem32btulib.dll

O2 - BHO: bellibP - {48F8FA55-4FDC-4896-A484-2AF2D50653A1} - C:Windowssystem32bellib.dll
Кликните по кнопке Fix checked и подтвердите свои действия выбрав YES.
Перезагрузите компьютер и проверьте наличие информера.

но информер никуда не делся. Проверяю снова через HijackThis эти строки опять на месте. 😥

Если ничего не изменилось нужно тогда вам эти файлы отправлять? На всякий случай отправлю 😳
info.txt logfile of random’s system information tool 1.04 2008-11-06 14:03:19

======Uninstall list======

Acer eDataSecurity Management—>C:AcerEmpowering TechnologyeDataSecurityeDSnstHelper.exe -Operation UNINSTALL
Acer eLock Management—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1PROFES~1RunTime1150Intel32Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{116FF17B-1A30-4FC2-9B01-5BC5BD46B0B3}setup.exe» -l0x9 -removeonly
Acer Empowering Technology—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1PROFES~1RunTime1150Intel32Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{AB6097D9-D722-4987-BD9E-A076E2848EE2}setup.exe» -l0x19 -removeonly
Acer eNet Management—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1PROFES~1RunTime1150Intel32Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{C06554A1-2C1E-4D20-B613-EE62C79927CC}setup.exe» -l0x19 -removeonly
Acer ePower Management—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1PROFES~1RunTime1150Intel32Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{58E5844B-7CE2-413D-83D1-99294BF6C74F}setup.exe» -l0x19 -removeonly
Acer ePresentation Management—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1PROFES~1RunTime1150Intel32Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{BF839132-BD43-4056-ACBF-4377F4A88E2A}setup.exe» -l0x9 -removeonly
Acer eSettings Management—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1PROFES~1RunTime1150Intel32Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{CE65A9A0-9686-45C6-9098-3C9543A412F0}setup.exe» -l0x19 -removeonly
Acer GridVista—>C:WindowsUnInst32.exe GridV.UNI
Acer Mobility Center Plug-In—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1PROFES~1RunTime1150Intel32Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{11316260-6666-467B-AC34-183FCB5D4335}setup.exe» -l0x9 -removeonly
Acer ScreenSaver—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1PROFES~1RunTime1150Intel32Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{79DD56FC-DB8B-47F5-9C80-78B62E05F9BC}setup.exe» -l0x9 -removeonly
Acer Tour—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1PROFES~1RunTime1150Intel32Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{94389919-B0AA-4882-9BE8-9F0B004ECA35}setup.exe» -l0x9 -removeonly
Activation Assistant for the 2007 Microsoft Office suites—>»C:ProgramData{174892B1-CBE7-44F5-86FF-AB555EFD73A3}Microsoft Office Activation Assistant.exe» REMOVE=TRUE MODIFY=FALSE
Adobe Flash Player 9 ActiveX—>C:Windowssystem32MacromedFlashFlashUtil9b.exe -uninstallDelete
Adobe Reader 7.0—>MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A70000000000}
Broadcom Gigabit Integrated Controller—>MsiExec.exe /X{D3B3B9B2-FE73-44CB-8C0A-F737D92F991B}
Canon Camera Access Library—>»C:Program FilesCommon FilesCanonUIW1.0.0.0Uninst.exe» «C:Program FilesCanonCALUninst.ini»
Canon Camera Support Core Library—>»C:Program FilesCommon FilesCanonUIW1.0.0.0Uninst.exe» «C:Program FilesCanonCSCLIBUninst.ini»
Canon Camera Window DC_DV 5 for ZoomBrowser EX—>»C:Program FilesCommon FilesCanonUIW1.0.0.0Uninst.exe» «C:Program FilesCanonCameraWindowCameraWindowDVCUninst.ini»
Canon Camera Window DC_DV 6 for ZoomBrowser EX—>»C:Program FilesCommon FilesCanonUIW1.0.0.0Uninst.exe» «C:Program FilesCanonCameraWindowCameraWindowDVC6Uninst.ini»
Canon Camera Window MC 6 for ZoomBrowser EX—>»C:Program FilesCommon FilesCanonUIW1.0.0.0Uninst.exe» «C:Program FilesCanonCameraWindowCameraWindowMCUninst.ini»
Canon G.726 WMP-Decoder—>»C:Program FilesCommon FilesCanonUIW1.0.0.0Uninst.exe» «C:Program FilesCanonG726DecoderG726DecUnInstall.ini»
Canon MovieEdit Task for ZoomBrowser EX—>»C:Program FilesCommon FilesCanonUIW1.0.0.0Uninst.exe» «C:Program FilesCanonZoomBrowser EXProgramMVWUninst.ini»
Canon RAW Image Task for ZoomBrowser EX—>»C:Program FilesCommon FilesCanonUIW1.0.0.0Uninst.exe» «C:Program FilesCanonRAW Image TaskUninst.ini»
Canon RemoteCapture Task for ZoomBrowser EX—>»C:Program FilesCommon FilesCanonUIW1.0.0.0Uninst.exe» «C:Program FilesCanonCameraWindowRemoteCaptureTask DCUninst.ini»
Canon Utilities EOS Utility—>»C:Program FilesCommon FilesCanonUIW1.0.0.0Uninst.exe» «C:Program FilesCanonEOS UtilityUninst.ini»
Canon Utilities PhotoStitch—>»C:Program FilesCommon FilesCanonUIW1.0.0.0Uninst.exe» «C:Program FilesCanonPhotoStitchUninst.ini»
Canon Utilities ZoomBrowser EX—>»C:Program FilesCommon FilesCanonUIW1.0.0.0Uninst.exe» «C:Program FilesCanonZoomBrowser EXProgramUninst.ini»
HDAUDIO Soft Data Fax Modem with SmartCP—>C:Program FilesCONEXANTCNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2BFAOR2C06_118UIU32m.exe -U -Ic:ReleaseFoxconn51338AcrZUn32z.inf
HijackThis 2.0.2—>»C:Program FilesTrend MicroHijackThisHijackThis.exe» /uninstall
Intel(R) Graphics Media Accelerator Driver—>C:Windowssystem32igxpun.exe -uninstall
Intel(R) Matrix Storage Manager—>C:WindowsSystem32Imsmudlg.exe
K-Lite Mega Codec Pack 1.38—>»C:Program FilesK-Lite Codec Packunins000.exe»
Launch Manager—>C:WindowsUnInst32.exe LManager.UNI
Max Payne 2—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1engine6INTEL3~1Ctor.dll
Microsoft Office 2003 — веб-компоненты—>MsiExec.exe /I{90A40419-6000-11D3-8CFE-0150048383C9}
Microsoft Office Access MUI (Russian) 2007—>MsiExec.exe /X{90120000-0015-0419-0000-0000000FF1CE}
Microsoft Office Excel MUI (Russian) 2007—>MsiExec.exe /X{90120000-0016-0419-0000-0000000FF1CE}
Microsoft Office InfoPath MUI (Russian) 2007—>MsiExec.exe /X{90120000-0044-0419-0000-0000000FF1CE}
Microsoft Office Outlook MUI (Russian) 2007—>MsiExec.exe /X{90120000-001A-0419-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (Russian) 2007—>MsiExec.exe /X{90120000-0018-0419-0000-0000000FF1CE}
Microsoft Office Professional Plus 2007—>MsiExec.exe /X{90120000-0011-0000-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007—>MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (German) 2007—>MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE}
Microsoft Office Proof (Russian) 2007—>MsiExec.exe /X{90120000-001F-0419-0000-0000000FF1CE}
Microsoft Office Proof (Ukrainian) 2007—>MsiExec.exe /X{90120000-001F-0422-0000-0000000FF1CE}
Microsoft Office Proofing (Russian) 2007—>MsiExec.exe /X{90120000-002C-0419-0000-0000000FF1CE}
Microsoft Office Publisher MUI (Russian) 2007—>MsiExec.exe /X{90120000-0019-0419-0000-0000000FF1CE}
Microsoft Office Shared MUI (Russian) 2007—>MsiExec.exe /X{90120000-006E-0419-0000-0000000FF1CE}
Microsoft Office Word MUI (Russian) 2007—>MsiExec.exe /X{90120000-001B-0419-0000-0000000FF1CE}
Microsoft Office Профессиональный плюс 2007—>»C:Program FilesCommon FilesMicrosoft SharedOFFICE12Office Setup Controllersetup.exe» /uninstall PROPLUS /dll OSETUP.DLL
Microsoft SQL Server 2005 Express Edition (MSSMLBIZ)—>MsiExec.exe /I{2AFFFDD7-ED85-4A90-8C52-5DA9EBDC9B8F}
Microsoft SQL Server 2005—>»C:Program FilesMicrosoft SQL Server90Setup BootstrapARPWrapper.exe» /Remove
Microsoft SQL Server Native Client—>MsiExec.exe /I{50A0893D-47D8-48E0-A7E8-44BCD7E4422E}
Microsoft SQL Server Setup Support Files (English)—>MsiExec.exe /X{53F5C3EE-05ED-4830-994B-50B2F0D50FCE}
Microsoft SQL Server VSS Writer—>MsiExec.exe /I{C0D2F614-5CE5-4DCB-8678-E5C9AF7044F8}
Microsoft Visual C++ 2005 Redistributable—>MsiExec.exe /X{A49F249F-0C91-497F-86DF-B2585E8E76B7}
MSRedist—>MsiExec.exe /I{B7C61755-DB48-4003-948F-3D34DB8EAF69}
neroxml—>MsiExec.exe /I{56C049BE-79E9-4502-BEA7-9754A3E60F9B}
NOD32 Antivirus System—>C:Program FilesEsetSetupsetup.exe /UNINSTALL
NOD32 FiX—>»C:Program FilesEsetunins000.exe»
Norton Internet Security (Symantec Corporation)—>»C:Program FilesCommon FilesSymantec SharedSymSetup{5AA2CD16-706F-41f3-87C5-2B5A031F2B3B}_10_1_0_26{5AA2CD16-706F-41f3-87C5-2B5A031F2B3B}.exe» /X
NTI Backup NOW! 4.7—>»C:Program FilesInstallShield Installation Information{67ADE9AF-5CD9-4089-8825-55DE4B366799}setup.exe» -removeonly
NTI CD & DVD-Maker—>C:PROGRA~1COMMON~1INSTAL~1Driver7INTEL3~1IDriver.exe /M{1577A05B-EE62-4BBC-9DB7-FE748FA44EC2} /l1049 CDM7
NTI Shadow—>»C:Program FilesInstallShield Installation Information{6F7EA6CA-79F4-44A0-A370-8E82BB16534A}setup.exe» -removeonly
PowerDVD—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1engine6INTEL3~1Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}Setup.exe» -uninstall
Realtek High Definition Audio Driver—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1PROFES~1RunTime1150Intel32Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}Setup.exe» -l0x19 -removeonly
Samsung ML-2010 Series—>C:Program FilesSamsungSamsung ML-2010 SeriesInstallSetup.exe /R
Sprut—>»C:Program FilesMaxPayne2 — Sprutunins000.exe»
Synaptics Pointing Device Driver—>rundll32.exe «C:Program FilesSynapticsSynTPSynISDLL.dll»,standAloneUninstall
Texas Instruments PCIxx21/x515/xx12 drivers.—>C:Program FilesInstallShield Installation Information{DB780B85-B4B5-4864-A49C-9B706B169C93}setup.exe -runfromtemp -l0x0409
Total Commander 7.01 Total Commander 7.01 PowerPack 1.20—>»C:Program FilesTotal Commanderuninstall.exe»
VCRedistSetup—>MsiExec.exe /I{3921A67A-5AB1-4E48-9444-C71814CF3027}
Yahoo! Toolbar—>C:PROGRA~1Yahoo!commonunyt.exe
Архиватор WinRAR—>C:Program FilesWinRARuninstall.exe
Данные ДубльГИС г.Красноярск 01.10.2008—>MsiExec.exe /X{4BBF5EAD-12FC-4257-A762-600F2E08A7DD}
Декларация 2007—>»C:Program FilesДекларация 2007unins000.exe»
Диспетчер контактов для Outlook 2007—>»C:Program FilesMicrosoft Small BusinessBusiness Contact ManagerSetupBootstrapSetup.exe» /remove {abaef6a0-3456-4fc8-b4f8-221f08b2eb95}
Диспетчер контактов для Outlook 2007—>MsiExec.exe /X{abaef6a0-3456-4fc8-b4f8-221f08b2eb95}
ДубльГИС 3.0.4—>MsiExec.exe /X{0C5720B0-0624-4DF7-A32B-877523BDC614}
Компоненты для подключения Microsoft Office Small Business—>MsiExec.exe /X{A939D341-5A04-4E0A-BB55-3E65B386432D}
Налогоплательщик ЮЛ—>MsiExec.exe /I{BED79A80-FACF-4458-AFA8-8789EED7663C}
Центр обновлений ДубльГИС—>MsiExec.exe /X{2FB165EB-69C0-416D-9B4E-E805ABC8CB1F}

======Security center information======

AV: Антивирусная система Eset NOD32 2.70 (outdated)
AV: Norton Internet Security (outdated)
FW: Norton Internet Security (disabled)
AS: Защитник Windows (outdated)
AS: Norton Internet Security (outdated)

======Environment variables======

«ComSpec»=%SystemRoot%system32cmd.exe
«FP_NO_HOST_CHECK»=NO
«OS»=Windows_NT
«Path»=%SystemRoot%system32;%SystemRoot%;%SystemRoot%System32Wbem;C:Program FilesMicrosoft SQL Server90Toolsbinn
«PATHEXT»=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
«PROCESSOR_ARCHITECTURE»=x86
«TEMP»=%SystemRoot%TEMP
«TMP»=%SystemRoot%TEMP
«USERNAME»=SYSTEM
«windir»=%SystemRoot%
«PROCESSOR_LEVEL»=6
«PROCESSOR_IDENTIFIER»=x86 Family 6 Model 22 Stepping 1, GenuineIntel
«PROCESSOR_REVISION»=1601
«NUMBER_OF_PROCESSORS»=1

EOF

Logfile of random’s system information tool 1.04 (written by random/random)
Run by Коротких at 2008-11-06 14:03:03
Microsoft® Windows Vista™ Home Basic
System drive C: has 13 GB (41%) free of 33 GB
Total RAM: 502 MB (22% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:03:13, on 06.11.2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16386)
Boot mode: Normal

Running processes:
C:Windowssystem32taskeng.exe
C:Windowssystem32Dwm.exe
C:WindowsExplorer.EXE
C:Program FilesWindows DefenderMSASCui.exe
C:Program FilesIntelIntel Matrix Storage ManagerIAAnotif.exe
C:WindowsRtHDVCpl.exe
C:Program FilesSynapticsSynTPSynTPEnh.exe
C:WindowsSystem32igfxtray.exe
C:WindowsSystem32hkcmd.exe
C:WindowsSystem32igfxpers.exe
C:Program FilesCyberLinkPowerDVDPDVDServ.exe
C:AcerEmpowering TechnologyeDataSecurityeDSLoader.exe
C:Program FilesInternet Explorerieuser.exe
C:Program FilesInternet Exploreriexplore.exe
C:Program FilesLaunch ManagerLManager.exe
C:WindowsSamsungPanelMgrSSMMgr.exe
C:Program FilesWindows Media Playerwmpnscfg.exe
C:Program FilesAdobeAcrobat 7.0Readerreader_sl.exe
C:Windowssystem32igfxsrvc.exe
C:AcerEmpowering TechnologyENETENMTRAY.EXE
C:Program FilesEsetnod32kui.exe
C:AcerEmpowering TechnologyEPOWEREPOWER_DMC.EXE
C:Users934B~1AppDataLocalTempRtkBtMnt.exe
C:AcerEmpowering TechnologyeRecoveryERAGENT.EXE
C:Windowssystem32igfxext.exe
C:Windowssystem32igfxsrvc.exe
C:UsersКороткихAppDataLocalMicrosoftWindowsTemporary Internet FilesContent.IE552H79E6VRSIT[1].exe
C:Program FilesTrend MicroHijackThisКоротких.exe

R1 — HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = http://uk.rd.yahoo.com/customize/ycomp/defaults/sp/*http://uk.yahoo.com
R0 — HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.skala-net.ru/
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://ru.intl.acer.yahoo.com
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 — HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://ru.intl.acer.yahoo.com
R0 — HKLMSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant =
R0 — HKLMSoftwareMicrosoftInternet ExplorerSearch,CustomizeSearch =
R1 — HKCUSoftwareMicrosoftInternet ExplorerSearchURL,(Default) = http://uk.rd.yahoo.com/customize/ycomp/defaults/su/*http://uk.yahoo.com
R0 — HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName =
R3 — URLSearchHook: Yahoo! Toolbar — {EF99BD32-C1FB-11D2-892F-0090271D4F88} — C:Program FilesYahoo!CompanionInstallscpnyt.dll
O1 — Hosts: ::1 localhost
O2 — BHO: Yahoo! Toolbar Helper — {02478D38-C3F9-4EFB-9B51-7695ECA05670} — C:Program FilesYahoo!CompanionInstallscpnyt.dll
O2 — BHO: AcroIEHlprObj Class — {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} — c:Program FilesAdobeAcrobat 7.0ActiveXAcroIEHelper.dll
O2 — BHO: btulibP — {1ECA18AE-74CB-46E2-B528-B2AF0EAB64A7} — C:Windowssystem32btulib.dll
O2 — BHO: bellibP — {48F8FA55-4FDC-4896-A484-2AF2D50653A1} — C:Windowssystem32bellib.dll
O2 — BHO: ShowBarObj Class — {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} — C:Windowssystem32ActiveToolBand.dll
O3 — Toolbar: Acer eDataSecurity Management — {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} — C:Windowssystem32eDStoolbar.dll
O3 — Toolbar: Yahoo! Toolbar — {EF99BD32-C1FB-11D2-892F-0090271D4F88} — C:Program FilesYahoo!CompanionInstallscpnyt.dll
O4 — HKLM..Run: [Windows Defender] %ProgramFiles%Windows DefenderMSASCui.exe -hide
O4 — HKLM..Run: [IAAnotif] «C:Program FilesIntelIntel Matrix Storage ManagerIaanotif.exe»
O4 — HKLM..Run: [RtHDVCpl] RtHDVCpl.exe
O4 — HKLM..Run: [SynTPEnh] C:Program FilesSynapticsSynTPSynTPEnh.exe
O4 — HKLM..Run: [IgfxTray] C:Windowssystem32igfxtray.exe
O4 — HKLM..Run: [HotKeysCmds] C:Windowssystem32hkcmd.exe
O4 — HKLM..Run: [Persistence] C:Windowssystem32igfxpers.exe
O4 — HKLM..Run: [RemoteControl] «C:Program FilesCyberLinkPowerDVDPDVDServ.exe»
O4 — HKLM..Run: [LanguageShortcut] «C:Program FilesCyberLinkPowerDVDLanguageLanguage.exe»
O4 — HKLM..Run: [eDataSecurity Loader] C:AcerEmpowering TechnologyeDataSecurityeDSloader.exe
O4 — HKLM..Run: [LManager] C:PROGRA~1LAUNCH~1LManager.exe
O4 — HKLM..Run: [WarReg_PopUp] C:AcerWR_PopUpWarReg_PopUp.exe
O4 — HKLM..Run: [Samsung PanelMgr] C:WindowsSamsungPanelMgrSSMMgr.exe /autorun
O4 — HKLM..Run: [nod32kui] «C:Program FilesEsetnod32kui.exe» /WAITSERVICE
O4 — HKCU..Run: [WMPNSCFG] C:Program FilesWindows Media PlayerWMPNSCFG.exe
O4 — HKUSS-1-5-19..Run: [Sidebar] %ProgramFiles%Windows SidebarSidebar.exe /detectMem (User ‘LOCAL SERVICE’)
O4 — HKUSS-1-5-19..Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User ‘LOCAL SERVICE’)
O4 — HKUSS-1-5-20..Run: [Sidebar] %ProgramFiles%Windows SidebarSidebar.exe /detectMem (User ‘NETWORK SERVICE’)
O4 — Global Startup: Adobe Reader Speed Launch.lnk = C:Program FilesAdobeAcrobat 7.0Readerreader_sl.exe
O4 — Global Startup: Empowering Technology Launcher.lnk = ?
O8 — Extra context menu item: &Экспорт в Microsoft Excel — res://C:PROGRA~1MICROS~2Office12EXCEL.EXE/3000
O9 — Extra button: Research — {92780B25-18CC-41C8-B9BE-3C9C571A8263} — C:PROGRA~1MICROS~2Office12REFIEBAR.DLL
O13 — Gopher Prefix:
O20 — AppInit_DLLs: eNetHook.dll
O23 — Service: 2GIS UpdateClientService — ДубльГИС — C:Program Files2gisUpdateClientWin32UpdateClientService.exe
O23 — Service: Canon Camera Access Library 8 (CCALib8) — Canon Inc. — C:Program FilesCanonCALCALMAIN.exe
O23 — Service: Symantec Lic NetConnect service (CLTNetCnService) — Unknown owner — c:Program FilesCommon FilesSymantec SharedccSvcHst.exe (file missing)
O23 — Service: eDSService.exe (eDataSecurity Service) — HiTRSUT — C:AcerEmpowering TechnologyeDataSecurityeDSService.exe
O23 — Service: eLock Service (eLockService) — Acer Inc. — C:AcerEmpowering TechnologyeLockServiceeLockServ.exe
O23 — Service: eNet Service — Acer Inc. — C:AcerEmpowering TechnologyeNeteNet Service.exe
O23 — Service: eRecovery Service (eRecoveryService) — Acer Inc. — C:AcerEmpowering TechnologyeRecoveryeRecoveryService.exe
O23 — Service: eSettings Service (eSettingsService) — Unknown owner — C:AcerEmpowering TechnologyeSettingsServicecapuserv.exe
O23 — Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) — Intel Corporation — C:Program FilesIntelIntel Matrix Storage ManagerIaantmon.exe
O23 — Service: LightScribeService Direct Disc Labeling Service (LightScribeService) — Hewlett-Packard Company — C:Program FilesCommon FilesLightScribeLSSrvc.exe
O23 — Service: MobilityService — Unknown owner — C:AcerMobility CenterMobilityService.exe
O23 — Service: NOD32 Kernel Service (NOD32krn) — Eset — C:Program FilesEsetnod32krn.exe
O23 — Service: Cyberlink RichVideo Service(CRVS) (RichVideo) — Unknown owner — C:Program FilesCyberLinkShared FilesRichVideo.exe
O23 — Service: ePower Service (WMIService) — acer — C:AcerEmpowering TechnologyePowerePowerSvc.exe
O23 — Service: @%systemroot%system32SearchIndexer.exe,-103 (WSearch) — Корпорация Майкрософт — C:Windowssystem32SearchIndexer.exe
O23 — Service: XAudioService — Conexant Systems, Inc. — C:Windowssystem32DRIVERSxaudio.exe

—
End of file — 7438 bytes

======Registry dump======

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{02478D38-C3F9-4EFB-9B51-7695ECA05670}]
Yahoo! Toolbar Helper — C:Program FilesYahoo!CompanionInstallscpnyt.dll [2006-11-29 436288]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class — c:Program FilesAdobeAcrobat 7.0ActiveXAcroIEHelper.dll [2004-12-14 63136]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{1ECA18AE-74CB-46E2-B528-B2AF0EAB64A7}]
WV Data Helper — C:Windowssystem32btulib.dll [2008-11-01 352256]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{48F8FA55-4FDC-4896-A484-2AF2D50653A1}]
AAC-SLS Media Feeder — C:Windowssystem32bellib.dll [2008-11-01 352256]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{83A2F9B1-01A2-4AA5-87D1-45B6B8505E96}]
ShowBarObj Class — C:Windowssystem32ActiveToolBand.dll [2007-04-25 299008]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
{5CBE3B7C-1E47-477e-A7DD-396DB0476E29} — Acer eDataSecurity Management — C:Windowssystem32eDStoolbar.dll [2007-04-25 151552]
{EF99BD32-C1FB-11D2-892F-0090271D4F88} — Yahoo! Toolbar — C:Program FilesYahoo!CompanionInstallscpnyt.dll [2006-11-29 436288]

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun]
«Windows Defender»=C:Program FilesWindows DefenderMSASCui.exe [2007-07-13 1006264]
«IAAnotif»=C:Program FilesIntelIntel Matrix Storage ManagerIaanotif.exe [2007-03-21 174872]
«RtHDVCpl»=C:WindowsRtHDVCpl.exe [2007-05-29 4472832]
«SynTPEnh»=C:Program FilesSynapticsSynTPSynTPEnh.exe [2006-10-24 815104]
«IgfxTray»=C:Windowssystem32igfxtray.exe [2007-04-05 138008]
«HotKeysCmds»=C:Windowssystem32hkcmd.exe [2007-04-05 154392]
«Persistence»=C:Windowssystem32igfxpers.exe [2007-04-05 133912]
«RemoteControl»=C:Program FilesCyberLinkPowerDVDPDVDServ.exe [2007-03-15 71216]
«LanguageShortcut»=C:Program FilesCyberLinkPowerDVDLanguageLanguage.exe [2007-02-07 54832]
«eDataSecurity Loader»=C:AcerEmpowering TechnologyeDataSecurityeDSloader.exe [2007-04-25 457216]
«LManager»=C:PROGRA~1LAUNCH~1LManager.exe [2007-06-15 850704]
«WarReg_PopUp»=C:AcerWR_PopUpWarReg_PopUp.exe [2006-11-06 57344]
«Samsung PanelMgr»=C:WindowsSamsungPanelMgrSSMMgr.exe [2007-01-03 520192]
«nod32kui»=C:Program FilesEsetnod32kui.exe [2008-03-07 949376]

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun]
«WMPNSCFG»=C:Program FilesWindows Media PlayerWMPNSCFG.exe [2006-11-02 201728]

C:ProgramDataMicrosoftWindowsStart MenuProgramsStartup
Adobe Reader Speed Launch.lnk — C:Program FilesAdobeAcrobat 7.0Readerreader_sl.exe
Empowering Technology Launcher.lnk — C:AcerEmpowering TechnologyeAPLauncher.exe

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWindows]
«AppInit_DLLS»=»eNetHook.dll»

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifyigfxcui]
C:Windowssystem32igfxdev.dll [2007-03-31 204800]

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
«dontdisplaylastusername»=0
«legalnoticecaption»=
«legalnoticetext»=
«shutdownwithoutlogon»=1
«undockwithoutlogon»=1

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicystandardprofileauthorizedapplicationslist]

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicydomainprofileauthorizedapplicationslist]

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{4805dd8e-b6dc-11dc-a42c-000000000000}]
shellAutocommand — F:sxs2.exe
shellAutoRuncommand — C:Windowssystem32RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL F:sxs2.exe

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{a25f2b7e-c978-11dc-936c-000000000000}]
shellAutocommand — F:sxs2.exe
shellAutoRuncommand — C:Windowssystem32RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL F:sxs2.exe

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{e8c97f54-394b-11dd-a953-ec4744471233}]
shellAutoRuncommand — G:LaunchU3.exe -a

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{ff02bb73-b6d8-11dc-9e36-000000000000}]
shellAutocommand — F:sxs2.exe
shellAutoRuncommand — C:Windowssystem32RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL F:sxs2.exe

======List of files/folders created in the last 1 months======

2008-11-06 14:03:03 —-D—- C:rsit
2008-11-05 15:37:12 —-D—- C:Program FilesTrend Micro
2008-11-01 14:22:55 —-A—- C:Windowssystem32bellib.dll
2008-11-01 14:21:05 —-A—- C:Windowssystem32btulib.dll
2008-10-31 15:03:55 —-D—- C:X-Disa
2008-10-31 15:03:29 —-D—- C:Program FilesStrongDC++

======List of files/folders modified in the last 1 months======

2008-11-06 14:03:13 —-D—- C:WindowsPrefetch
2008-11-06 14:03:07 —-D—- C:WindowsTemp
2008-11-05 19:44:26 —-SHD—- C:System Volume Information
2008-11-05 15:37:12 —-D—- C:Program Files
2008-11-05 14:10:57 —-AD—- C:WindowsSystem32
2008-11-05 14:10:56 —-D—- C:Windowsinf
2008-11-05 14:10:56 —-A—- C:Windowssystem32PerfStringBackup.INI
2008-10-25 16:13:01 —-D—- C:Windowssystem32catroot2
2008-10-23 14:13:09 —-D—- C:UsersКороткихAppDataRoamingGrym
2008-10-23 14:02:10 —-SHD—- C:WindowsInstaller
2008-10-23 13:52:49 —-D—- C:Program Files2gis

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 nod32drv;nod32drv; C:Windowssystem32driversnod32drv.sys [2008-03-07 15424]
R2 {95808DC4-FA4A-4c74-92FE-5B863F82066B};{95808DC4-FA4A-4c74-92FE-5B863F82066B}; ??C:Program FilesCyberLinkPowerDVD00.fcl [2006-11-02 13560]
R2 AMON;AMON; C:Windowssystem32driversamon.sys [2008-03-07 512096]
R2 int15;int15; ??C:Windowssystem32driversint15.sys [2007-03-02 76584]
R2 irda;IrDA Protocol; C:Windowssystem32DRIVERSirda.sys [2006-11-02 95744]
R2 mdmxsdk;mdmxsdk; C:Windowssystem32DRIVERSmdmxsdk.sys [2006-06-20 12672]
R2 SSPORT;SSPORT; ??C:Windowssystem32DriversSSPORT.sys [2007-01-03 5120]
R2 XAudio;XAudio; C:Windowssystem32DRIVERSxaudio.sys [2006-11-29 8192]
R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet — NDIS 6.0; C:Windowssystem32DRIVERSb57nd60x.sys [2007-02-09 179712]
R3 BCM43XX;Драйвер сетевого адаптера Broadcom 802.11; C:Windowssystem32DRIVERSbcmwl6.sys [2006-12-20 534016]
R3 CmBatt;Microsoft ACPI Control Method Battery Driver; C:Windowssystem32DRIVERSCmBatt.sys [2006-11-02 14208]
R3 DKbFltr;Dritek Keyboard Filter Driver; C:Windowssystem32DRIVERSDKbFltr.sys [2007-06-15 21264]
R3 HSF_DPV;HSF_DPV; C:Windowssystem32DRIVERSHSX_DPV.sys [2006-12-23 985600]
R3 HSXHWAZL;HSXHWAZL; C:Windowssystem32DRIVERSHSXHWAZL.sys [2006-12-23 207360]
R3 igfx;igfx; C:Windowssystem32DRIVERSigdkmd32.sys [2007-03-31 1671680]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:Windowssystem32driversRTKVHDA.sys [2007-05-31 1780576]
R3 NSCIRDA;NSC Infrared Device Driver; C:Windowssystem32DRIVERSnscirda.sys [2006-11-02 30720]
R3 NTIDrvr;Upper Class Filter Driver; C:Windowssystem32DRIVERSNTIDrvr.sys [2007-07-13 6144]
R3 sdbus;sdbus; C:Windowssystem32DRIVERSsdbus.sys [2006-11-02 82432]
R3 SynTP;Synaptics TouchPad Driver; C:Windowssystem32DRIVERSSynTP.sys [2006-10-24 179896]
R3 tifm21;tifm21; C:Windowssystem32driverstifm21.sys [2007-01-25 290304]
R3 winachsf;winachsf; C:Windowssystem32DRIVERSHSX_CNXT.sys [2006-12-23 659968]
R3 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:Windowssystem32DRIVERSwmiacpi.sys [2006-11-02 11264]
S2 DgiVecp;DgiVecp; ??C:Windowssystem32DriversDgiVecp.sys [2007-01-03 41984]
S3 BCM43XV;Драйвер сетевого адаптера Broadcom Extensible 802.11; C:Windowssystem32DRIVERSbcmwl6.sys [2006-12-20 534016]
S3 drmkaud;Microsoft Kernel DRM Audio Descrambler; C:Windowssystem32driversdrmkaud.sys [2006-11-02 5632]
S3 HdAudAddService;Microsoft 1.1 UAA Function Driver for High Definition Audio Service; C:Windowssystem32driversHdAudio.sys [2006-11-02 235520]
S3 HSFHWAZL;HSFHWAZL; C:Windowssystem32DRIVERSVSTAZL3.SYS [2006-11-02 200704]
S3 MSKSSRV;Microsoft Streaming Service Proxy; C:Windowssystem32driversMSKSSRV.sys [2006-11-02 8192]
S3 MSPCLOCK;Microsoft Streaming Clock Proxy; C:Windowssystem32driversMSPCLOCK.sys [2006-11-02 5888]
S3 MSPQM;Microsoft Streaming Quality Manager Proxy; C:Windowssystem32driversMSPQM.sys [2006-11-02 5504]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:Windowssystem32driversMSTEE.sys [2006-11-02 6016]
S3 NETw3v32;Драйвер адаптера беспроводной сети Intel(R) PRO/Wireless 3945ABG для 32-разрядной Windows Vista; C:Windowssystem32DRIVERSNETw3v32.sys [2006-11-02 1781760]
S3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:Windowssystem32DRIVERSnvm60x32.sys [2006-11-02 429056]
S3 usbvideo;USB Video Device (WDM); C:WindowsSystem32Driversusbvideo.sys [2006-11-02 132352]
S3 WUDFRd;WUDFRd; C:Windowssystem32DRIVERSWUDFRd.sys [2006-11-02 82560]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 2GIS UpdateClientService;2GIS UpdateClientService; C:Program Files2gisUpdateClientWin32UpdateClientService.exe [2008-09-17 1134592]
R2 CCALib8;Canon Camera Access Library 8; C:Program FilesCanonCALCALMAIN.exe [2005-09-30 96341]
R2 eDataSecurity Service;eDSService.exe; C:AcerEmpowering TechnologyeDataSecurityeDSService.exe [2007-04-25 457512]
R2 eLockService;eLock Service; C:AcerEmpowering TechnologyeLockServiceeLockServ.exe [2007-03-14 24576]
R2 eNet Service;eNet Service; C:AcerEmpowering TechnologyeNeteNet Service.exe [2007-05-22 135168]
R2 eRecoveryService;eRecovery Service; C:AcerEmpowering TechnologyeRecoveryeRecoveryService.exe [2007-07-03 53248]
R2 eSettingsService;eSettings Service; C:AcerEmpowering TechnologyeSettingsServicecapuserv.exe [2007-05-10 24576]
R2 IAANTMON;Intel(R) Matrix Storage Event Monitor; C:Program FilesIntelIntel Matrix Storage ManagerIaantmon.exe [2007-03-21 355096]
R2 Irmon;@%SystemRoot%System32irmon.dll,-2000; C:Windowssystem32svchost.exe [2006-11-02 22016]
R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:Program FilesCommon FilesLightScribeLSSrvc.exe [2007-01-17 61440]
R2 MobilityService;MobilityService; C:AcerMobility CenterMobilityService.exe [2006-11-24 107008]
R2 MSSQL$MSSMLBIZ;SQL Server (MSSMLBIZ); C:Program FilesMicrosoft SQL ServerMSSQL.1MSSQLBinnsqlservr.exe [2006-04-14 28933976]
R2 NOD32krn;NOD32 Kernel Service; C:Program FilesEsetnod32krn.exe [2008-03-07 552064]
R2 RichVideo;Cyberlink RichVideo Service(CRVS); C:Program FilesCyberLinkShared FilesRichVideo.exe [2007-04-03 272024]
R2 WMIService;ePower Service; C:AcerEmpowering TechnologyePowerePowerSvc.exe [2007-06-13 167936]
R2 XAudioService;XAudioService; C:Windowssystem32DRIVERSxaudio.exe [2006-11-29 386560]
S2 CLTNetCnService;Symantec Lic NetConnect service; c:Program FilesCommon FilesSymantec SharedccSvcHst.exe /h ccCommon []
S3 odserv;Microsoft Office Diagnostics Service; C:Program FilesCommon FilesMicrosoft SharedOFFICE12ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:Program FilesCommon FilesMicrosoft SharedSource EngineOSE.EXE [2006-10-26 145184]
S3 SQLWriter;SQL Server VSS Writer; C:Program FilesMicrosoft SQL Server90Sharedsqlwriter.exe [2006-04-14 87840]
S4 MSSQLServerADHelper;SQL Server Active Directory Helper; C:Program FilesMicrosoft SQL Server90Sharedsqladhlp90.exe [2005-10-14 45272]
S4 SQLBrowser;SQL Server Browser; C:Program FilesMicrosoft SQL Server90Sharedsqlbrowser.exe [2006-04-14 240416]