Здравствуйте! Выкладываю логи.
log.txt
Logfile of random’s system information tool 1.06 (written by random/random)
Run by Елена at 2009-10-23 22:34:38
Microsoft® Windows Vista™ Home Premium Service Pack 2
System drive C: has 21 GB (35%) free of 60 GB
Total RAM: 2047 MB (58% free)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:35:05, on 23.10.2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18813)
Boot mode: Normal
Running processes:
C:Windowssystem32Dwm.exe
C:Windowssystem32taskeng.exe
C:WindowsExplorer.EXE
C:WindowsSystem32mobsync.exe
C:Program FilesWindows DefenderMSASCui.exe
C:Program FilesRealtekAudioHDARtHDVCpl.exe
C:Program FilesMail.RuAgentmagent.exe
C:WindowsWindowsMobilewmdcBase.exe
C:Windowstsnpstd3.exe
C:Windowsvsnpstd3.exe
C:Program FilesWindows Sidebarsidebar.exe
C:Program FilesDownload Masterdmaster.exe
C:Program FilesNetUPUTM5_wintrayutm5_wintray.exe
C:Program FilesHewlett-PackardDigital Imagingbinhpobnz08.exe
C:Program FilesWindows Media Playerwmpnscfg.exe
C:Windowssystem32wbemunsecapp.exe
C:Program FilesMozilla Firefoxfirefox.exe
C:Windowssystem32wuauclt.exe
C:Windowsexplorer.exe
C:DownloadsПрограммыRSIT.exe
C:Program Filestrend microЕлена.exe
C:Program FilesSkypeToolbarsSharedSkypeNames.exe
R1 — HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 — HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = about:blank
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 — HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 — HKLMSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant =
R0 — HKLMSoftwareMicrosoftInternet ExplorerSearch,CustomizeSearch =
R0 — HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName =
R3 — URLSearchHook: (no name) — {83821C2B-32A8-4DD7-B6D4-44309A78E668} — C:Program FilesMail.RuAgentMradllnewmrasearch.dll
O2 — BHO: AcroIEHelperStub — {18DF081C-E8AD-4283-A596-FA578C2EBDC3} — C:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelperShim.dll
O2 — BHO: IE 4.x-6.x BHO for Download Master — {9961627E-4059-41B4-8E0E-A7D6B3854ADF} — C:PROGRA~1DOWNLO~1dmiehlp.dll
O3 — Toolbar: DM Bar — {0E1230F8-EA50-42A9-983C-D22ABC2EED3C} — C:Program FilesDownload Masterdmbar.dll
O4 — HKLM..Run: [Windows Defender] %ProgramFiles%Windows DefenderMSASCui.exe -hide
O4 — HKLM..Run: [RtHDVCpl] C:Program FilesRealtekAudioHDARtHDVCpl.exe
O4 — HKLM..Run: [MAgent] C:Program FilesMail.RuAgentMAgent.exe -LM
O4 — HKLM..Run: [OutpostMonitor] C:PROGRA~1AgnitumOUTPOS~1op_mon.exe /tray /noservice
O4 — HKLM..Run: [OutpostFeedBack] «C:Program FilesAgnitumOutpost Security Suite Profeedback.exe» /dump:os_startup
O4 — HKLM..Run: [Adobe Reader Speed Launcher] «C:Program FilesAdobeReader 9.0ReaderReader_sl.exe»
O4 — HKLM..Run: [Windows Mobile-based device management] %windir%WindowsMobilewmdcBase.exe
O4 — HKLM..Run: [tsnpstd3] C:Windowstsnpstd3.exe
O4 — HKLM..Run: [snpstd3] C:Windowsvsnpstd3.exe
O4 — HKCU..Run: [Sidebar] C:Program FilesWindows Sidebarsidebar.exe /autoRun
O4 — HKCU..Run: [Download Master] C:Program FilesDownload Masterdmaster.exe -autorun
O4 — HKCU..Run: [utm5_wintray] C:Program FilesNetUPUTM5_wintrayutm5_wintray.exe
O4 — HKUSS-1-5-19..Run: [Sidebar] %ProgramFiles%Windows SidebarSidebar.exe /detectMem (User ‘LOCAL SERVICE’)
O4 — HKUSS-1-5-19..Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User ‘LOCAL SERVICE’)
O4 — HKUSS-1-5-20..Run: [Sidebar] %ProgramFiles%Windows SidebarSidebar.exe /detectMem (User ‘NETWORK SERVICE’)
O4 — Global Startup: hp psc 2000 Series.lnk = C:Program FilesHewlett-PackardDigital Imagingbinhpobnz08.exe
O4 — Global Startup: hpoddt01.exe.lnk = ?
O4 — Global Startup: VPN Client.lnk = ?
O8 — Extra context menu item: &Экспорт в Microsoft Excel — res://C:PROGRA~1MICROS~2Office12EXCEL.EXE/3000
O8 — Extra context menu item: Закачать ВСЕ при помощи Download Master — C:Program FilesDownload Masterdmieall.htm
O8 — Extra context menu item: Закачать при помощи Download Master — C:Program FilesDownload Masterdmie.htm
O8 — Extra context menu item: Передать на удаленную закачку DM — C:Program FilesDownload Masterremdown.htm
O9 — Extra button: Mail.Ru Агент — {7558B7E5-7B26-4201-BEDB-00D5FF534523} — C:Program FilesMail.RuAgentmagent.exe
O9 — Extra ‘Tools’ menuitem: Mail.Ru Агент — {7558B7E5-7B26-4201-BEDB-00D5FF534523} — C:Program FilesMail.RuAgentmagent.exe
O9 — Extra button: Download Master — {8DAE90AD-4583-4977-9DD4-4360F7A45C74} — C:Program FilesDownload Masterdmaster.exe
O9 — Extra ‘Tools’ menuitem: &Download Master — {8DAE90AD-4583-4977-9DD4-4360F7A45C74} — C:Program FilesDownload Masterdmaster.exe
O9 — Extra button: Research — {92780B25-18CC-41C8-B9BE-3C9C571A8263} — C:PROGRA~1MICROS~2Office12REFIEBAR.DLL
O13 — Gopher Prefix:
O16 — DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) — http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 — HKLMSystemCCSServicesTcpip..{68611C7A-D3D4-45AF-86AB-93723FF1BBF2}: NameServer = 89.222.165.2,89.222.167.2
O18 — Protocol: skype4com — {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} — C:PROGRA~1COMMON~1SkypeSKYPE4~1.DLL
O20 — AppInit_DLLs: c:progra~1agnitumoutpos~1wl_hook.dll
O23 — Service: Agnitum Client Security Service (acssrv) — Agnitum Ltd. — C:PROGRA~1AgnitumOUTPOS~1acs.exe
O23 — Service: Cisco Systems, Inc. VPN Service (CVPND) — Cisco Systems, Inc. — C:Program FilesCisco SystemsVPN Clientcvpnd.exe
O23 — Service: @dfsrres.dll,-101 (DFSR) — Корпорация Майкрософт — C:Windowssystem32DFSR.exe
O23 — Service: Служба Google Update (gupdate1ca1350ac3845c) (gupdate1ca1350ac3845c) — Google Inc. — C:Program FilesGoogleUpdateGoogleUpdate.exe
O23 — Service: NVIDIA Display Driver Service (nvsvc) — NVIDIA Corporation — C:Windowssystem32nvvsvc.exe
O23 — Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) — NVIDIA Corporation — C:Program FilesNVIDIA Corporation3D VisionnvSCPAPISvr.exe
—
End of file — 6371 bytes
======Scheduled tasks folder======
C:WindowstasksGoogleUpdateTaskMachineCore.job
C:WindowstasksGoogleUpdateTaskMachineUA.job
C:WindowstasksUser_Feed_Synchronization-{B1F49A5E-8084-4DE8-BDFE-BB499D4E1A86}.job
======Registry dump======
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper — C:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelperShim.dll [2008-06-11 75128]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{9961627E-4059-41B4-8E0E-A7D6B3854ADF}]
IE 4.x-6.x BHO for Download Master — C:PROGRA~1DOWNLO~1dmiehlp.dll [2009-04-16 158208]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
{0E1230F8-EA50-42A9-983C-D22ABC2EED3C} — DM Bar — C:Program FilesDownload Masterdmbar.dll [2007-11-26 180224]
[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun]
«Windows Defender»=C:Program FilesWindows DefenderMSASCui.exe [2008-01-21 1008184]
«RtHDVCpl»=C:Program FilesRealtekAudioHDARtHDVCpl.exe [2009-03-12 6965792]
«MAgent»=C:Program FilesMail.RuAgentMAgent.exe [2009-07-30 7975608]
«OutpostMonitor»=C:PROGRA~1AgnitumOUTPOS~1op_mon.exe [2008-07-15 1207128]
«OutpostFeedBack»=C:Program FilesAgnitumOutpost Security Suite Profeedback.exe [2008-07-15 435544]
«Adobe Reader Speed Launcher»=C:Program FilesAdobeReader 9.0ReaderReader_sl.exe [2008-06-12 34672]
«Windows Mobile-based device management»=C:WindowsWindowsMobilewmdcBase.exe [2007-05-31 648072]
«tsnpstd3″=C:Windowstsnpstd3.exe [2007-03-30 262144]
«snpstd3″=C:Windowsvsnpstd3.exe [2006-09-18 843776]
[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun]
«Sidebar»=C:Program FilesWindows Sidebarsidebar.exe [2009-04-11 1233920]
«Download Master»=C:Program FilesDownload Masterdmaster.exe [2009-08-05 3777536]
«utm5_wintray»=C:Program FilesNetUPUTM5_wintrayutm5_wintray.exe [2005-12-26 462848]
C:ProgramDataMicrosoftWindowsStart MenuProgramsStartup
hp psc 2000 Series.lnk — C:Program FilesHewlett-PackardDigital Imagingbinhpobnz08.exe
hpoddt01.exe.lnk — C:Program FilesHewlett-PackardDigital Imagingbinhpotdd01.exe
VPN Client.lnk — C:WindowsInstaller{4C271126-C295-4828-A901-5910AE0C258B}Icon3E5562ED7.ico
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWindows]
«AppInit_DLLS»=»c:progra~1agnitumoutpos~1wl_hook.dll»
[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetworkWudfPf]
[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetworkWudfRd]
[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetworkWudfSvc]
[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetworkWudfUsbccidDriver]
[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
«dontdisplaylastusername»=0
«legalnoticecaption»=
«legalnoticetext»=
«shutdownwithoutlogon»=1
«undockwithoutlogon»=1
«EnableUIADesktopToggle»=0
[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«BindDirectlyToPropertySetStorage»=
[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicystandardprofileauthorizedapplicationslist]
[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicydomainprofileauthorizedapplicationslist]
[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{fcc5880c-9721-11de-bf4a-001d9272c9ad}]
shellAutoRuncommand — C:Windowssystem32RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RuNdLl32.EXE .RECYCLERS-5-3-42-2819952290-8240758988-879315005-3665jwgkvsq.vmx,ahaezedrn
======File associations======
.js — edit — C:WindowsSystem32Notepad.exe %1
.js — open — C:WindowsSystem32WScript.exe «%1» %*
======List of files/folders created in the last 1 months======
2009-10-23 22:34:39 —-D—- C:Program Filestrend micro
2009-10-23 22:34:38 —-D—- C:rsit
2009-10-23 22:14:34 —-D—- C:UsersЕленаAppDataRoamingMalwarebytes
2009-10-23 22:14:28 —-D—- C:ProgramDataMalwarebytes
2009-10-23 22:14:23 —-D—- C:Program FilesMalwarebytes’ Anti-Malware
2009-10-15 21:31:56 —-A—- C:Windowssystem32msv1_0.dll
2009-10-15 21:31:50 —-A—- C:Windowssystem32ntoskrnl.exe
2009-10-15 21:31:50 —-A—- C:Windowssystem32ntkrnlpa.exe
2009-10-15 21:11:08 —-A—- C:Windowssystem32msasn1.dll
2009-10-15 21:06:17 —-A—- C:Windowssystem32WMSPDMOD.DLL
2009-10-06 21:54:50 —-A—- C:Windowssystem32wups2.dll
2009-10-06 21:54:50 —-A—- C:Windowssystem32wucltux.dll
2009-10-06 21:54:50 —-A—- C:Windowssystem32wuaueng.dll
2009-10-06 21:54:50 —-A—- C:Windowssystem32wuauclt.exe
2009-10-06 21:54:26 —-A—- C:Windowssystem32wups.dll
2009-10-06 21:54:26 —-A—- C:Windowssystem32wudriver.dll
2009-10-06 21:54:26 —-A—- C:Windowssystem32wuapi.dll
2009-10-06 21:54:16 —-A—- C:Windowssystem32wuwebv.dll
2009-10-06 21:54:16 —-A—- C:Windowssystem32wuapp.exe
2009-10-04 19:51:42 —-D—- C:Program FilesLongman
2009-10-02 22:07:47 —-N—- C:Windowssystem32MpSigStub.exe
2009-09-28 22:07:07 —-D—- C:Program FilesCPUID
2009-09-27 16:22:34 —-D—- C:Program FilesGridinSoft Trojan Killer
2009-09-27 15:46:27 —-D—- C:Program FilesTrojan Killer
2009-09-25 20:36:42 —-A—- C:Windowsntbtlog.txt
======List of files/folders modified in the last 1 months======
2009-10-23 22:34:58 —-D—- C:WindowsPrefetch
2009-10-23 22:34:50 —-D—- C:WindowsTemp
2009-10-23 22:34:39 —-RD—- C:Program Files
2009-10-23 22:28:42 —-D—- C:WindowsSystem32
2009-10-23 22:28:42 —-D—- C:Windowsinf
2009-10-23 22:28:42 —-A—- C:Windowssystem32PerfStringBackup.INI
2009-10-23 22:21:28 —-D—- C:ProgramDataNVIDIA
2009-10-23 22:14:30 —-D—- C:Windowssystem32drivers
2009-10-23 22:14:28 —-HD—- C:ProgramData
2009-10-23 21:03:04 —-SHD—- C:System Volume Information
2009-10-23 21:00:55 —-D—- C:Windowssystem32Filt
2009-10-21 19:50:34 —-D—- C:Windowstracing
2009-10-18 22:43:08 —-D—- C:UsersЕленаAppDataRoamingSkype
2009-10-18 21:18:37 —-D—- C:UsersЕленаAppDataRoamingskypePM
2009-10-17 13:15:41 —-D—- C:Windowswinsxs
2009-10-17 13:07:50 —-D—- C:WindowsMicrosoft.NET
2009-10-17 13:07:49 —-RSD—- C:Windowsassembly
2009-10-17 13:05:35 —-D—- C:Windowssystem32catroot
2009-10-16 22:23:27 —-D—- C:Windowsehome
2009-10-16 22:23:27 —-D—- C:Program FilesWindows Mail
2009-10-16 22:11:26 —-SHD—- C:WindowsInstaller
2009-10-16 22:11:23 —-D—- C:ProgramDataMicrosoft Help
2009-10-16 22:07:37 —-D—- C:Windowssystem32catroot2
2009-10-10 00:06:37 —-D—- C:Downloads
2009-10-09 22:12:04 —-D—- C:UsersЕленаAppDataRoamingdvdcss
2009-10-07 21:18:34 —-D—- C:Windowsrescache
2009-10-07 21:00:38 —-D—- C:Windowssystem32ru-RU
2009-10-04 19:53:37 —-D—- C:Windowssystem32Tasks
2009-10-02 22:01:57 —-A—- C:Windowssystem32mrt.exe
2009-09-27 17:30:00 —-D—- C:Program FilesGoogle
2009-09-27 16:18:59 —-D—- C:WindowsTasks
2009-09-27 16:18:43 —-D—- C:Windows
2009-09-27 15:54:19 —-D—- C:Program FilesMozilla Firefox
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R1 afw;Agnitum Firewall Driver; C:Windowssystem32DRIVERSafw.sys [2008-06-30 28688]
R1 SandBox;SandBox; C:Windowssystem32DRIVERSSandBox.sys [2008-07-11 673920]
R2 CVPNDRVA;Cisco Systems Inc. IPSec Driver; ??C:Windowssystem32DriversCVPNDRVA.sys [2008-04-17 306299]
R3 afwcore;afwcore; C:Windowssystem32driversafwcore.sys [2008-06-30 242704]
R3 ASWFilt;ASWFilt; C:Windowssystem32FiltASWFilt.dll [2008-07-11 33408]
R3 DNE;Deterministic Network Enhancer Miniport; C:Windowssystem32DRIVERSdne2000.sys [2008-03-29 125328]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:Windowssystem32driversRTKVHDA.sys [2009-03-12 2342688]
R3 nvlddmkm;nvlddmkm; C:Windowssystem32DRIVERSnvlddmkm.sys [2009-07-14 9557216]
R3 RTL8169;Realtek 8169 NT Driver; C:Windowssystem32DRIVERSRtlh86.sys [2009-03-17 140288]
R3 SNPSTD3;PLEOMAX PWC-4200; C:Windowssystem32DRIVERSsnpstd3.sys [2007-05-17 10246400]
R3 usbaudio;Аудио драйвер USB (WDM); C:Windowssystem32driversusbaudio.sys [2009-04-11 73216]
R3 VBEngNT;VBEngNT; C:Windowssystem32DRIVERSVBEngNT.sys [2008-06-04 1072722]
R3 VBFilt;VBFilt; C:Windowssystem32FiltVBFilt.dll [2008-07-11 158816]
R3 WUDFRd;WUDFRd; C:Windowssystem32DRIVERSWUDFRd.sys [2008-01-21 83328]
S3 cpuz132;cpuz132; ??C:Windowssystem32driverscpuz132_x32.sys [2009-03-27 12672]
S3 CVirtA;Cisco Systems VPN Adapter; C:Windowssystem32DRIVERSCVirtA.sys [2007-01-18 5275]
S3 drmkaud;Звуковой дешифратор DRM ядра системы; C:Windowssystem32driversdrmkaud.sys [2008-01-21 5632]
S3 HdAudAddService;Драйвер функции UAA для службы High Definition Audio (Microsoft), версия 1.1; C:Windowssystem32driversHdAudio.sys [2009-04-11 236544]
S3 MSKSSRV;Представитель служб потоков Microsoft; C:Windowssystem32driversMSKSSRV.sys [2008-01-21 8192]
S3 MSPCLOCK;Посредник синхронизации потоков Microsoft; C:Windowssystem32driversMSPCLOCK.sys [2008-01-21 5888]
S3 MSPQM;Представитель диспетчера качества потоков Microsoft; C:Windowssystem32driversMSPQM.sys [2008-01-21 5504]
S3 MSTEE;Преобразователь потоков Tee/Sink-to-Sink Microsoft; C:Windowssystem32driversMSTEE.sys [2008-01-21 6016]
S3 usb_rndisx;Адаптер USB RNDIS; C:Windowssystem32DRIVERSusb8023x.sys [2009-04-11 15872]
S3 usbscan;Драйвер USB-сканера; C:Windowssystem32DRIVERSusbscan.sys [2008-01-21 35328]
S3 winusb;WinUSB Service; C:Windowssystem32DRIVERSwinusb.sys [2009-04-11 31616]
S4 ErrDev;Microsoft Hardware Error Device Driver; C:Windowssystem32driverserrdev.sys [2008-01-21 6656]
S4 MegaSR;MegaSR; C:Windowssystem32driversmegasr.sys [2008-01-21 386616]
S4 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:Windowssystem32driverswmiacpi.sys [2008-01-21 11264]
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 acssrv;Agnitum Client Security Service; C:PROGRA~1AgnitumOUTPOS~1acs.exe [2008-07-15 1570136]
R2 CVPND;Cisco Systems, Inc. VPN Service; C:Program FilesCisco SystemsVPN Clientcvpnd.exe [2008-04-17 1528608]
R2 nvsvc;NVIDIA Display Driver Service; C:Windowssystem32nvvsvc.exe [2009-07-14 215584]
R2 RapiMgr;@%windir%WindowsMobilerapimgr.dll,-104; C:Windowssystem32svchost.exe [2008-01-21 21504]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service; C:Program FilesNVIDIA Corporation3D VisionnvSCPAPISvr.exe [2009-07-14 239648]
R2 WcesComm;@%windir%WindowsMobilewcescomm.dll,-40079; C:Windowssystem32svchost.exe [2008-01-21 21504]
S2 gupdate1ca1350ac3845c;Служба Google Update (gupdate1ca1350ac3845c); C:Program FilesGoogleUpdateGoogleUpdate.exe [2009-08-02 133104]
S3 odserv;Microsoft Office Diagnostics Service; C:Program FilesCommon FilesMicrosoft SharedOFFICE12ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:Program FilesCommon FilesMicrosoft SharedSource EngineOSE.EXE [2006-10-26 145184]
EOF
