Antivirus_Pro2010

[spoznanie2009]

Не получается удалить вредоносную программу Antivirus_Pro2010

Logfile of random’s system information tool 1.06 (written by random/random)
Run by admin at 2009-10-08 11:33:19
Microsoft Windows XP Professional Service Pack 3
System drive C: has 35 GB (68%) free of 51 GB
Total RAM: 1023 MB (60% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:34:46, on 08.10.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20815)
Boot mode: Normal

Running processes:
C:WINDOWS.0System32smss.exe
C:WINDOWS.0system32winlogon.exe
C:WINDOWS.0system32services.exe
C:WINDOWS.0system32lsass.exe
C:WINDOWS.0system32Ati2evxx.exe
C:WINDOWS.0system32svchost.exe
C:WINDOWS.0System32svchost.exe
C:WINDOWS.0system32Ati2evxx.exe
C:Program FilesAlwil SoftwareAvast4aswUpdSv.exe
C:Program FilesAlwil SoftwareAvast4ashServ.exe
C:WINDOWS.0system32spoolsv.exe
C:WINDOWS.0system32svchost.exe
C:Program FilesCommon FilesMicrosoft SharedVS7DEBUGMDM.EXE
C:WINDOWS.0System32svchost.exe
C:WINDOWS.0Explorer.EXE
C:WINDOWS.0System32svchost.exe
C:Program FilesAlcohol 120StarWindStarWindServiceAE.exe
C:WINDOWS.0system32svchost.exe
C:Program FilesAlwil SoftwareAvast4ashMaiSv.exe
C:WINDOWS.0SOUNDMAN.EXE
C:Program FilesHPHP Software UpdateHPWuSchd2.exe
C:PROGRA~1ALWILS~1Avast4ashDisp.exe
C:Program FilesAlwil SoftwareAvast4ashWebSv.exe
C:WINDOWS.0system32ctfmon.exe
C:Program FilesVistaDriveIconVistaDrv.exe
C:Program FilesSkypePhoneSkype.exe
C:Program FilesHPDigital Imagingbinhpqtra08.exe
C:Program FilesOperaACopera.exe
C:Program FilesSkypePlugin ManagerskypePM.exe
C:WINDOWS.0system32msiexec.exe
C:Documents and Settingsadmin.SCHOOLРабочий столRSIT.exe
C:Program Filestrend microadmin.exe

R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R0 — HKLMSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant =
R0 — HKLMSoftwareMicrosoftInternet ExplorerSearch,CustomizeSearch =
R0 — HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Ссылки
O1 — Hosts: 61.129.115.198 http://www.xldd.com
O1 — Hosts: 61.129.115.198 http://www.ojiang.com
O1 — Hosts: 61.129.115.198 http://www.shuixian.net
O1 — Hosts: 61.129.115.198 http://www.xlarea.com
O4 — HKLM..Run: [SoundMan] SOUNDMAN.EXE
O4 — HKLM..Run: [NeroFilterCheck] C:WINDOWS.0system32NeroCheck.exe
O4 — HKLM..Run: [Adobe Reader Speed Launcher] «C:Program FilesAdobeReader 8.0ReaderReader_sl.exe»
O4 — HKLM..Run: [HP Software Update] C:Program FilesHPHP Software UpdateHPWuSchd2.exe
O4 — HKLM..Run: [avast!] C:PROGRA~1ALWILS~1Avast4ashDisp.exe
O4 — HKLM..Run: [Malwarebytes Anti-Malware (reboot)] «C:Program FilesMalwarebytes’ Anti-Malwarembam.exe» /runcleanupscript
O4 — HKCU..Run: [CTFMON.EXE] C:WINDOWS.0system32ctfmon.exe
O4 — HKCU..Run: [VistaIcon] C:Program FilesVistaDriveIconVistaDrv.exe
O4 — HKCU..Run: [Skype] «C:Program FilesSkypePhoneSkype.exe» /nosplash /minimized
O4 — HKUSS-1-5-19..Run: [CTFMON.EXE] C:WINDOWS.0system32CTFMON.EXE (User ‘LOCAL SERVICE’)
O4 — HKUSS-1-5-19..Run: [VistaIcon] C:Program FilesVistaDriveIconVistaDrv.exe (User ‘LOCAL SERVICE’)
O4 — HKUSS-1-5-19..RunOnce: [ZZZZ1_FirstLogonSetting] %SystemRoot%System32rundll32.exe advpack.dll,LaunchINFSection C:WINDOWS.0INFcustom.inf,OnceFirstLogonInstall,0 (User ‘LOCAL SERVICE’)
O4 — HKUSS-1-5-19..RunOnce: [IE7_012] rundll32 advpack.dll,LaunchINFSectionEx IE7int.inf,AfterUserStart,,4,N (User ‘LOCAL SERVICE’)
O4 — HKUSS-1-5-20..Run: [CTFMON.EXE] C:WINDOWS.0system32CTFMON.EXE (User ‘NETWORK SERVICE’)
O4 — HKUSS-1-5-20..RunOnce: [ZZZZ1_FirstLogonSetting] %SystemRoot%System32rundll32.exe advpack.dll,LaunchINFSection C:WINDOWS.0INFcustom.inf,OnceFirstLogonInstall,0 (User ‘NETWORK SERVICE’)
O4 — HKUSS-1-5-18..Run: [CTFMON.EXE] C:WINDOWS.0system32CTFMON.EXE (User ‘SYSTEM’)
O4 — HKUSS-1-5-18..RunOnce: [ZZZZ2_FirstLogonSetting] %SystemRoot%System32rundll32.exe advpack.dll,LaunchINFSection C:WINDOWS.0INFcustom.inf,NewUserFirstLogonInstall,0 (User ‘SYSTEM’)
O4 — HKUS.DEFAULT..Run: [CTFMON.EXE] C:WINDOWS.0system32CTFMON.EXE (User ‘Default user’)
O4 — HKUS.DEFAULT..RunOnce: [ZZZZ2_FirstLogonSetting] %SystemRoot%System32rundll32.exe advpack.dll,LaunchINFSection C:WINDOWS.0INFcustom.inf,NewUserFirstLogonInstall,0 (User ‘Default user’)
O4 — Global Startup: HP Digital Imaging Monitor.lnk = C:Program FilesHPDigital Imagingbinhpqtra08.exe
O8 — Extra context menu item: &Экспорт в Microsoft Excel — res://C:PROGRA~1MICROS~2OFFICE11EXCEL.EXE/3000
O9 — Extra button: (no name) — {08B0E5C0-4FCB-11CF-AAA5-00401C608501} — C:Program FilesJavajre1.6.0_06binssv.dll
O9 — Extra ‘Tools’ menuitem: Sun Java Console — {08B0E5C0-4FCB-11CF-AAA5-00401C608501} — C:Program FilesJavajre1.6.0_06binssv.dll
O9 — Extra button: Альбом клипов HP — {58ECB495-38F0-49cb-A538-10282ABF65E7} — C:Program FilesHPSmart Web Printinghpswp_extensions.dll
O9 — Extra button: Расширенный выбор HP — {700259D7-1666-479a-93B1-3250410481E8} — C:Program FilesHPSmart Web Printinghpswp_extensions.dll
O9 — Extra button: Download Master — {8DAE90AD-4583-4977-9DD4-4360F7A45C74} — C:Program FilesDownload Masterdmaster.exe
O9 — Extra ‘Tools’ menuitem: &Download Master — {8DAE90AD-4583-4977-9DD4-4360F7A45C74} — C:Program FilesDownload Masterdmaster.exe
O9 — Extra button: Справочные материалы — {92780B25-18CC-41C8-B9BE-3C9C571A8263} — C:PROGRA~1MICROS~2OFFICE11REFIEBAR.DLL
O9 — Extra button: (no name) — {e2e2dd38-d088-4134-82b7-f2ba38496583} — C:WINDOWS.0Network Diagnosticxpnetdiag.exe
O9 — Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 — {e2e2dd38-d088-4134-82b7-f2ba38496583} — C:WINDOWS.0Network Diagnosticxpnetdiag.exe
O17 — HKLMSystemCCSServicesTcpipParameters: Domain = school.local
O17 — HKLMSoftware..Telephony: DomainName = school.local
O17 — HKLMSystemCCSServicesTcpip..{215D4B26-1163-4BB0-B86A-9ED8A789D599}: NameServer = 195.34.32.116 212.188.4.10
O17 — HKLMSystemCS1ServicesTcpipParameters: Domain = school.local
O17 — HKLMSystemCS1ServicesTcpip..{215D4B26-1163-4BB0-B86A-9ED8A789D599}: NameServer = 195.34.32.116 212.188.4.10
O17 — HKLMSystemCS2ServicesTcpipParameters: Domain = school.local
O17 — HKLMSystemCS2ServicesTcpip..{215D4B26-1163-4BB0-B86A-9ED8A789D599}: NameServer = 195.34.32.116 212.188.4.10
O18 — Protocol: skype4com — {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} — C:PROGRA~1COMMON~1SkypeSKYPE4~1.DLL
O23 — Service: avast! iAVS4 Control Service (aswupdsv) — ALWIL Software — C:Program FilesAlwil SoftwareAvast4aswUpdSv.exe
O23 — Service: Ati HotKey Poller — ATI Technologies Inc. — C:WINDOWS.0system32Ati2evxx.exe
O23 — Service: avast! Antivirus (avast! antivirus) — ALWIL Software — C:Program FilesAlwil SoftwareAvast4ashServ.exe
O23 — Service: avast! Mail Scanner (avast! mail scanner) — ALWIL Software — C:Program FilesAlwil SoftwareAvast4ashMaiSv.exe
O23 — Service: avast! Web Scanner (avast! web scanner) — ALWIL Software — C:Program FilesAlwil SoftwareAvast4ashWebSv.exe
O23 — Service: Журнал событий (Eventlog) — Корпорация Майкрософт — C:WINDOWS.0system32services.exe
O23 — Service: Служба COM записи компакт-дисков IMAPI (ImapiService) — Корпорация Майкрософт — C:WINDOWS.0system32imapi.exe
O23 — Service: NetMeeting Remote Desktop Sharing (mnmsrvc) — Корпорация Майкрософт — C:WINDOWS.0system32mnmsrvc.exe
O23 — Service: Plug and Play (PlugPlay) — Корпорация Майкрософт — C:WINDOWS.0system32services.exe
O23 — Service: Смарт-карты (SCardSvr) — Корпорация Майкрософт — C:WINDOWS.0System32SCardSvr.exe
O23 — Service: StarWind AE Service (StarWindServiceAE) — Rocket Division Software — C:Program FilesAlcohol 120StarWindStarWindServiceAE.exe
O23 — Service: Журналы и оповещения производительности (SysmonLog) — Корпорация Майкрософт — C:WINDOWS.0system32smlogsvc.exe
O23 — Service: Теневое копирование тома (VSS) — Корпорация Майкрософт — C:WINDOWS.0System32vssvc.exe
O23 — Service: Адаптер производительности WMI (WmiApSrv) — Корпорация Майкрософт — C:WINDOWS.0system32wbemwmiapsrv.exe

—
End of file — 8069 bytes

======Registry dump======

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun]
«SoundMan»=C:WINDOWS.0SOUNDMAN.EXE [2007-04-17 577536]
«NeroFilterCheck»=C:WINDOWS.0system32NeroCheck.exe [2006-01-12 155648]
«Adobe Reader Speed Launcher»=C:Program FilesAdobeReader 8.0ReaderReader_sl.exe [2007-05-11 40048]
«HP Software Update»=C:Program FilesHPHP Software UpdateHPWuSchd2.exe [2007-03-11 49152]
«avast!»=C:PROGRA~1ALWILS~1Avast4ashDisp.exe [2009-08-17 81000]
«Malwarebytes Anti-Malware (reboot)»=C:Program FilesMalwarebytes’ Anti-Malwarembam.exe [2009-09-10 1312080]

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=C:WINDOWS.0system32ctfmon.exe [2008-06-25 17408]
«VistaIcon»=C:Program FilesVistaDriveIconVistaDrv.exe [2008-03-23 132096]
«Skype»=C:Program FilesSkypePhoneSkype.exe [2009-07-16 25604904]

C:Documents and SettingsAll Users.WINDOWS.0Главное менюПрограммыАвтозагрузка
HP Digital Imaging Monitor.lnk — C:Program FilesHPDigital Imagingbinhpqtra08.exe

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifyAtiExtEvent]
C:WINDOWS.0system32Ati2evxx.dll [2008-02-26 126976]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad]
WPDShServiceObj — {AAA288BA-9A4C-45B0-95D7-94D524869DB5} — C:WINDOWS.0system32WPDShServiceObj.dll [2008-03-21 133632]

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetwork{1a3e09be-1e45-494b-9174-d7385b45bbf5}]

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
«SetVisualStyle»=

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
«dontdisplaylastusername»=0
«legalnoticecaption»=
«legalnoticetext»=
«shutdownwithoutlogon»=1
«undockwithoutlogon»=1
«SynchronousMachineGroupPolicy»=0
«SynchronousUserGroupPolicy»=0

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoDriveTypeAutoRun»=145
«NoThumbnailCache»=1
«NoSMConfigurePrograms»=1

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoDriveTypeAutoRun»=

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicystandardprofileauthorizedapplicationslist]
«%windir%Network Diagnosticxpnetdiag.exe»=»%windir%Network Diagnosticxpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000»
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicydomainprofileauthorizedapplicationslist]
«%windir%Network Diagnosticxpnetdiag.exe»=»%windir%Network Diagnosticxpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000»
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»

======List of files/folders created in the last 1 months======

2009-10-08 11:33:20 —-D—- C:Program Filestrend micro
2009-10-08 11:33:19 —-D—- C:rsit
2009-10-08 07:51:44 —-A—- C:WINDOWS.0system32ykujezoky.vbs
2009-10-08 07:51:44 —-A—- C:WINDOWS.0fetycedys.com
2009-10-08 07:51:44 —-A—- C:WINDOWS.0dusesan.vbs
2009-10-08 07:51:44 —-A—- C:WINDOWS.0body.vbs
2009-10-07 11:39:41 —-A—- C:WINDOWS.0uvyqysa.exe
2009-10-07 11:39:40 —-A—- C:WINDOWS.0system32irebu.exe
2009-10-07 11:39:40 —-A—- C:WINDOWS.0system32fodaqafemy.exe
2009-10-07 08:25:50 —-A—- C:WINDOWS.0unaryno.exe
2009-10-07 08:25:50 —-A—- C:WINDOWS.0ujedojiz.vbs
2009-10-07 08:25:50 —-A—- C:WINDOWS.0system32ojorytahot.dll
2009-10-07 08:25:50 —-A—- C:WINDOWS.0ofuv.exe
2009-10-07 08:25:50 —-A—- C:WINDOWS.0kujihep.bat
2009-10-07 08:25:50 —-A—- C:WINDOWS.0exiviji.bat
2009-10-07 08:25:50 —-A—- C:WINDOWS.0alorej.exe
2009-10-07 08:25:33 —-D—- C:AntivirusPro_2010
2009-10-06 15:32:39 —-D—- C:Documents and Settingsadmin.SCHOOLApplication DataMalwarebytes
2009-10-06 15:32:33 —-D—- C:Program FilesMalwarebytes’ Anti-Malware
2009-10-06 15:32:33 —-D—- C:Documents and SettingsAll Users.WINDOWS.0Application DataMalwarebytes
2009-10-06 10:51:11 —-A—- C:WINDOWS.0IsUninst.exe
2009-10-02 07:57:15 —-A—- C:WINDOWS.0ywygajifu.com
2009-10-02 07:57:15 —-A—- C:WINDOWS.0wyfeluhuj.dll
2009-10-02 07:57:15 —-A—- C:Program FilesCommon Filesudyqi.vbs
2009-10-02 07:57:15 —-A—- C:Documents and SettingsAll Users.WINDOWS.0Application Datainoz.vbs
2009-09-29 07:00:05 —-A—- C:Documents and Settingsadmin.SCHOOLApplication Dataryhahage.vbs
2009-09-28 09:48:26 —-A—- C:WINDOWS.0ehomaho.vbs
2009-09-28 09:48:26 —-A—- C:Program FilesCommon Filesyqemira.dll
2009-09-28 09:48:26 —-A—- C:Documents and SettingsAll Users.WINDOWS.0Application Datalafo.bat
2009-09-28 09:48:26 —-A—- C:Documents and SettingsAll Users.WINDOWS.0Application Databytyfil.exe
2009-09-23 10:47:02 —-A—- C:WINDOWS.0system32odar.bat
2009-09-23 10:47:02 —-A—- C:WINDOWS.0system32isomo.exe
2009-09-23 10:47:02 —-A—- C:WINDOWS.0oxowy.bat
2009-09-23 10:47:02 —-A—- C:WINDOWS.0owimo.com
2009-09-23 10:47:02 —-A—- C:Program FilesCommon Fileslane.vbs
2009-09-23 10:47:02 —-A—- C:Documents and SettingsAll Users.WINDOWS.0Application Datamigawygeh.exe
2009-09-14 15:40:57 —-D—- C:Documents and Settingsadmin.SCHOOLApplication DataReal

======List of files/folders modified in the last 1 months======

2009-10-08 11:33:26 —-D—- C:WINDOWS.0Prefetch
2009-10-08 11:33:20 —-RD—- C:Program Files
2009-10-08 11:32:59 —-A—- C:WINDOWS.0ModemLog_Rockwell 56000 External Modem PnP.txt
2009-10-08 11:08:27 —-D—- C:Documents and Settingsadmin.SCHOOLApplication DataSkype
2009-10-08 11:05:23 —-D—- C:Documents and Settingsadmin.SCHOOLApplication DataskypePM
2009-10-08 11:04:13 —-D—- C:WINDOWS.0Temp
2009-10-08 11:00:02 —-D—- C:WINDOWS.0system32
2009-10-08 10:59:20 —-A—- C:WINDOWS.0SchedLgU.Txt
2009-10-08 07:51:44 —-D—- C:WINDOWS.0
2009-10-08 07:51:44 —-D—- C:Program FilesCommon Files
2009-10-07 14:16:00 —-SHD—- C:WINDOWS.0Installer
2009-10-07 14:16:00 —-HD—- C:Config.Msi
2009-10-07 14:15:25 —-D—- C:Documents and SettingsAll Users.WINDOWS.0Application DataMicrosoft Help
2009-10-07 12:54:01 —-D—- C:WINDOWS.0system32drivers
2009-10-07 12:52:56 —-D—- C:WINDOWS.0system32CatRoot2
2009-10-07 11:13:53 —-SHD—- C:WINDOWS.0CSC
2009-10-07 09:31:16 —-D—- C:WINDOWS.0security
2009-10-06 15:14:27 —-D—- C:Антивирус
2009-10-06 10:51:55 —-HD—- C:WINDOWS.0inf
2009-10-06 10:51:21 —-D—- C:Program FilesCommon FilesAdobe
2009-10-06 10:51:21 —-D—- C:Program FilesAdobe
2009-10-06 10:51:00 —-D—- C:Documents and Settings
2009-10-05 15:27:11 —-D—- C:Program FilesOperaAC
2009-10-05 10:42:00 —-D—- C:Program FilesMozilla Firefox
2009-10-01 12:32:47 —-A—- C:WINDOWS.0NeroDigital.ini
2009-09-30 18:30:53 —-D—- C:WINDOWS
2009-09-18 08:20:06 —-RSHDC—- C:WINDOWS.0system32dllcache
2009-09-10 11:45:13 —-SD—- C:Documents and SettingsAll Users.WINDOWS.0Application DataMicrosoft
2009-09-09 08:54:13 —-D—- C:Program Fileshghjg

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 aavmker4;avast! Asynchronous Virus Monitor; C:WINDOWS.0system32driversaavmker4.sys [2009-08-17 26944]
R1 aswsp;avast! Self Protection; C:WINDOWS.0system32driversaswsp.sys [2009-08-17 114768]
R1 aswtdi;avast! Network Shield Support; C:WINDOWS.0system32driversaswtdi.sys [2009-08-17 51376]
R2 aswfsblk;aswFsBlk; C:WINDOWS.0system32DRIVERSaswFsBlk.sys [2009-08-17 20560]
R2 aswmon2;avast! Standard Shield Support; C:WINDOWS.0system32driversaswmon2.sys [2009-08-17 94160]
R2 ElbyCDIO;ElbyCDIO Driver; C:WINDOWS.0System32DriversElbyCDIO.sys [2005-04-21 10624]
R2 rspndr;Ответчик обнаружения топологии уровня связи; C:WINDOWS.0system32DRIVERSrspndr.sys [2008-06-05 62336]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:WINDOWS.0system32driversALCXWDM.SYS [2008-01-25 4127488]
R3 Arp1394;Протокол клиента 1394 ARP; C:WINDOWS.0system32DRIVERSarp1394.sys [2008-06-25 60800]
R3 aswrdr;aswRdr; C:WINDOWS.0system32driversaswrdr.sys [2009-08-17 23152]
R3 ati2mtag;ati2mtag; C:WINDOWS.0system32DRIVERSati2mtag.sys [2008-02-26 2863616]
R3 ElbyCDFL;ElbyCDFL; C:WINDOWS.0System32DriversElbyCDFL.sys [2005-05-03 27392]
R3 NIC1394;Сетевой драйвер 1394; C:WINDOWS.0system32DRIVERSnic1394.sys [2008-06-25 61824]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:WINDOWS.0system32DRIVERSNVENETFD.sys [2006-04-14 34176]
R3 nvnetbus;NVIDIA Network Bus Enumerator; C:WINDOWS.0system32DRIVERSnvnetbus.sys [2006-04-14 13056]
R3 RTSTOR;USB Mass Stroage Device; C:WINDOWS.0system32driversRTSTOR.SYS [2007-09-18 44032]
R3 usbehci;Драйвер минипорта Microsoft USB 2.0 расширенного хост-контроллера; C:WINDOWS.0system32DRIVERSusbehci.sys [2008-06-25 30336]
R3 usbhub;USB2 концентратор; C:WINDOWS.0system32DRIVERSusbhub.sys [2008-04-15 59520]
R3 usbohci;Драйвер минипорта Microsoft USB открытого хост-контроллера; C:WINDOWS.0system32DRIVERSusbohci.sys [2008-06-25 17152]
S1 40cfbff2;40cfbff2; C:WINDOWS.0System32drivers40cfbff2.sys []
S3 apwxczld;apwxczld; C:WINDOWS.0system32driversapwxczld.sys []
S3 HPZid412;IEEE-1284.4 Driver HPZid412; C:WINDOWS.0system32DRIVERSHPZid412.sys [2007-03-08 49920]
S3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:WINDOWS.0system32DRIVERSHPZipr12.sys [2007-03-08 16496]
S3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:WINDOWS.0system32DRIVERSHPZius12.sys [2007-03-08 21568]
S3 usbccgp;Драйвер универсального родительского устройства USB (Microsoft); C:WINDOWS.0system32DRIVERSusbccgp.sys [2008-06-25 32384]
S3 usbprint;Класс принтеров Microsoft USB; C:WINDOWS.0system32DRIVERSusbprint.sys [2008-04-14 25856]
S3 usbscan;Драйвер USB-сканера; C:WINDOWS.0system32DRIVERSusbscan.sys [2008-04-14 15104]
S3 USBSTOR;Драйвер запоминающих устройств для USB; C:WINDOWS.0system32DRIVERSUSBSTOR.SYS [2008-04-14 26368]
S3 WudfPf;Windows Driver Foundation — User-mode Driver Framework Platform Driver; C:WINDOWS.0system32DRIVERSWudfPf.sys [2008-03-21 77568]
S3 WudfRd;Windows Driver Foundation — User-mode Driver Framework Reflector; C:WINDOWS.0system32DRIVERSwudfrd.sys [2008-03-21 82944]
S4 atapi;atapi; C:WINDOWS.0system32driversatapi.sys [2008-04-15 96512]
S4 IntelIde;IntelIde; C:WINDOWS.0system32driversIntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 aswupdsv;avast! iAVS4 Control Service; C:Program FilesAlwil SoftwareAvast4aswUpdSv.exe [2009-08-17 18752]
R2 Ati HotKey Poller;Ati HotKey Poller; C:WINDOWS.0system32Ati2evxx.exe [2008-02-26 520192]
R2 avast! antivirus;avast! Antivirus; C:Program FilesAlwil SoftwareAvast4ashServ.exe [2009-08-17 138680]
R2 hpqddsvc;Служба HP CUE DeviceDiscovery; C:WINDOWS.0system32svchost.exe [2008-04-15 14336]
R2 MDM;Machine Debug Manager; C:Program FilesCommon FilesMicrosoft SharedVS7DEBUGMDM.EXE [2003-06-19 322120]
R2 Net Driver HPZ12;Net Driver HPZ12; C:WINDOWS.0System32svchost.exe [2008-04-15 14336]
R2 Pml Driver HPZ12;Pml Driver HPZ12; C:WINDOWS.0System32svchost.exe [2008-04-15 14336]
R2 StarWindServiceAE;StarWind AE Service; C:Program FilesAlcohol 120StarWindStarWindServiceAE.exe [2007-05-28 275968]
R3 avast! mail scanner;avast! Mail Scanner; C:Program FilesAlwil SoftwareAvast4ashMaiSv.exe [2009-08-17 254040]
R3 avast! web scanner;avast! Web Scanner; C:Program FilesAlwil SoftwareAvast4ashWebSv.exe [2009-08-17 352920]
R3 hpqcxs08;hpqcxs08; C:WINDOWS.0system32svchost.exe [2008-04-15 14336]
S3 aspnet_state;ASP.NET State Service; C:WINDOWS.0Microsoft.NETFrameworkv2.0.50727aspnet_state.exe [2007-10-24 33800]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; c:WINDOWS.0Microsoft.NETFrameworkv2.0.50727mscorsvw.exe [2007-10-24 70144]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:WINDOWS.0Microsoft.NetFrameworkv3.0WPFPresentationFontCache.exe [2007-10-09 36864]
S3 idsvc;Windows CardSpace; c:WINDOWS.0Microsoft.NETFrameworkv3.0Windows Communication Foundationinfocard.exe [2007-10-11 864256]
S3 odserv;Microsoft Office Diagnostics Service; C:Program FilesCommon FilesMicrosoft SharedOFFICE12ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:Program FilesCommon FilesMicrosoft SharedSource EngineOSE.EXE [2006-10-26 145184]
S3 WMPNetworkSvc;Служба общих сетевых ресурсов проигрывателя Windows Media; C:Program FilesWindows Media PlayerWMPNetwk.exe [2008-03-21 914944]
S3 WudfSvc;Windows Driver Foundation — User-mode Driver Framework; C:WINDOWS.0system32svchost.exe [2008-04-15 14336]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:WINDOWS.0Microsoft.NETFrameworkv3.0Windows Communication FoundationSMSvcHost.exe [2007-10-11 122880]

---

EOF

---

info.txt logfile of random’s system information tool 1.06 2009-10-08 11:34:48

======Uninstall list======

—>msiexec /package {90120000-0012-0000-0000-0000000FF1CE} /uninstall {744C859F-C225-48A9-A524-4DED432F36C7}
—>rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:WINDOWS.0INFPCHealth.inf
32 Bit HP CIO Components Installer—>MsiExec.exe /I{2614F54E-A828-49FA-93BA-45A3F756BFAA}
7-Zip 4.59 alpha 3—>»C:Program Files7-ZipUninstall.exe»
ABBYY FineReader 8.0 Professional Edition—>MsiExec.exe /I{AAF80000-22B9-4CE9-98D6-2CCF359BAC07}
Adobe Acrobat 4.0—>C:WINDOWS.0ISUNINST.EXE -f»C:Program FilesCommon FilesAdobeAcrobat 4.0NTUninst.isu» -c»C:Program FilesCommon FilesAdobeAcrobat 4.0NTUninst.dll»
Adobe Flash Player ActiveX—>C:WINDOWS.0system32MacromedFlashuninstall_activeX.exe
Adobe Reader 8.1.0 — Russian—>MsiExec.exe /I{AC76BA86-7AD7-1049-7B44-A81000000003}
ATI Display Driver—>rundll32 C:WINDOWS.0system32atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
avast! Antivirus—>C:Program FilesAlwil SoftwareAvast4aswRunDll.exe «C:Program FilesAlwil SoftwareAvast4Setupsetiface.dll»,RunSetup
Cab Tools 1.8—>C:WINDOWS.0system32delete.cmd
CloneCD—>»C:Program FilesSlySoftCloneCDccd-uninst.exe» /D=»C:Program FilesSlySoftCloneCD»
CorelDRAW Graphics Suite X3—>MsiExec.exe /I{7C5123A9-30A8-4C44-89CA-A8C87A1FCC91}
Download Master version 5.5.4.1133—>»C:Program FilesDownload Masterunins000.exe»
Foxit Reader—>MsiExec.exe /I{376DA9DC-71B3-4AB7-A80C-8ED02A736172}
HashTab 2.1.0—>C:WINDOWS.0system32ShellExthtdel32.bat
HijackThis 2.0.2—>»C:Program Filestrend microHijackThis.exe» /uninstall
Hotfix for Windows Media Format 11 SDK (KB929399)—>»C:WINDOWS.0$NtUninstallKB929399$spuninstspuninst.exe»
HP Customer Participation Program 9.0—>C:Program FilesHPDigital ImagingExtCapUninstallhpzscr01.exe -datfile hpqhsc01.dat
HP Deskjet All-In-One Software 9.0—>C:Program FilesHPDigital Imaging{B2C61EBB-F47C-48ba-B375-27A40F8F48F7}setuphpzscr01.exe -datfile hposcr14.dat
HP Imaging Device Functions 9.0—>C:Program FilesHPDigital ImagingDeviceManagementhpzscr01.exe -datfile hpqbud01.dat
HP Photosmart Essential 2.01—>C:Program FilesHPDigital ImagingPhotoSmartEssentialhpzscr01.exe -datfile hpqbud13.dat
HP Print Diagnostic Utility—>MsiExec.exe /I{E14B8A08-42B3-4676-9E91-1D39F8158DA1}
HP Smart Web Printing—>MsiExec.exe /X{415CDA53-9100-476F-A7B2-476691E117C7}
HP Solution Center 9.0—>C:Program FilesHPDigital ImagingeSupporthpzscr01.exe -datfile hpqbud05.dat
HP Update—>MsiExec.exe /X{AB40272D-92AB-4F30-B36B-22EDE16F8FE5}
HPSSupply—>MsiExec.exe /X{487B0B9B-DCD4-440D-89A0-A6EDE1A545A3}
Java(TM) 6 Update 6—>MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160060}
K-Lite Mega Codec Pack 3.9.5—>»C:Program FilesK-Lite Codec Packunins000.exe»
KMPlayer 2.9.3.1430—>»C:Program FilesThe KMPlayerunins000.exe»
Malwarebytes’ Anti-Malware—>»C:Program FilesMalwarebytes’ Anti-Malwareunins000.exe»
Microsoft .NET Framework 1.1 Russian Language Pack—>MsiExec.exe /X{2BB372D9-52B4-410A-BC1A-FEAB63181EEF}
Microsoft .NET Framework 1.1—>msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1—>MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 2.0 Language Pack — RUS—>C:WINDOWS.0Microsoft.NETFrameworkv2.0.50727Microsoft .NET Framework 2.0 Language Pack — RUSinstall.exe
Microsoft .NET Framework 2.0 Service Pack 1—>MsiExec.exe /I{B508B3F1-A24A-32C0-B310-85786919EF28}
Microsoft .NET Framework 3.0 Service Pack 1—>MsiExec.exe /I{2BA00471-0328-3743-93BD-FA813353A783}
Microsoft .NET Framework 3.5—>C:WINDOWS.0Microsoft.NETFrameworkv3.5Microsoft .NET Framework 3.5setup.exe
Microsoft .NET Framework 3.5—>MsiExec.exe /I{2FC099BD-AC9B-33EB-809C-D332E1B27C40}
Microsoft Compression Client Pack 1.0 for Windows XP—>»C:WINDOWS.0$NtUninstallMSCompPackV1$spuninstspuninst.exe»
Microsoft Office — профессиональный выпуск версии 2003—>MsiExec.exe /I{90110419-6000-11D3-8CFE-0150048383C9}
Microsoft Office Excel MUI (Russian) 2007—>MsiExec.exe /X{90120000-0016-0419-0000-0000000FF1CE}
Microsoft Office Outlook MUI (Russian) 2007—>MsiExec.exe /X{90120000-001A-0419-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (Russian) 2007—>MsiExec.exe /X{90120000-0018-0419-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007—>MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (German) 2007—>MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE}
Microsoft Office Proof (Russian) 2007—>MsiExec.exe /X{90120000-001F-0419-0000-0000000FF1CE}
Microsoft Office Proof (Ukrainian) 2007—>MsiExec.exe /X{90120000-001F-0422-0000-0000000FF1CE}
Microsoft Office Proofing (Russian) 2007—>MsiExec.exe /X{90120000-002C-0419-0000-0000000FF1CE}
Microsoft Office Shared MUI (Russian) 2007—>MsiExec.exe /X{90120000-006E-0419-0000-0000000FF1CE}
Microsoft Office Standard 2007—>MsiExec.exe /X{90120000-0012-0000-0000-0000000FF1CE}
Microsoft Office Word MUI (Russian) 2007—>MsiExec.exe /X{90120000-001B-0419-0000-0000000FF1CE}
Microsoft Office Стандартный 2007—>»C:Program FilesCommon FilesMicrosoft SharedOFFICE12Office Setup Controllersetup.exe» /uninstall STANDARD /dll OSETUP.DLL
Microsoft User-Mode Driver Framework Feature Pack 1.0—>»C:WINDOWS.0$NtUninstallWudf01000$spuninstspuninst.exe»
Microsoft Visual C++ 2005 Redistributable—>MsiExec.exe /X{A49F249F-0C91-497F-86DF-B2585E8E76B7}
Mozilla Firefox (3.0)—>C:Program FilesMozilla Firefoxuninstallhelper.exe
MSXML 4.0 SP2 (KB936181)—>MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
Nero 6—>C:Program FilesAheadnerouninstallUNNERO.exe /UNINSTALL
NVIDIA Drivers—>C:WINDOWS.0system32nvunrm.exe UninstallGUI
Opera AC 3.5.2—>»C:Program FilesOperaACunins000.exe»
Path2Clipboard 1.0.7.67—>C:WINDOWS.0system32ShellExtP2Cdel.bat
PROMT Expert 8 Giant Try-Buy—>MsiExec.exe /I{A4F761F7-FBC8-49BF-BC37-15550C3EAA85}
Realtek AC’97 Audio—>Alcrmv.exe -r -m
RU—>MsiExec.exe /I{01AE68B4-C785-4865-BC7E-78456372BB75}
Skype web features—>MsiExec.exe /I{541DEAC0-5F3D-45E6-B7CB-94ECF3B96748}
Skype™ 4.1—>MsiExec.exe /X{D103C4BA-F905-437A-8049-DB24763BBE36}
Total Commander—>C:Program FilesTotal CommanderUninstall.exe
Ukrainian language for ABBYY FineReader 8.0 Professional Edition—>MsiExec.exe /X{9274109B-3F04-4608-8B3E-4AC55B5DDAF1}
VBA—>MsiExec.exe /I{C94E45B0-6AA6-4FB9-9AAE-22085F631880}
Vista Drive Icon—>rundll32.exe advpack.dll,LaunchINFSection C:WINDOWS.0INFVistaDrv.inf,Uninstall
Water Control — 1.5.1 от 20.04.2009—>»C:Program FilesWater Controlunins000.exe»
Windows Media Format 11 runtime—>»C:Program FilesWindows Media Playerwmsetsdk.exe» /UninstallAll
Windows Media Format 11 runtime—>»C:WINDOWS.0$NtUninstallWMFDist11$spuninstspuninst.exe»
Windows Media Player 11—>»C:WINDOWS.0$NtUninstallwmp11$spuninstspuninst.exe»
Архиватор WinRAR—>C:Program FilesWinRARuninstall.exe
Обновление безопасности для Windows XP — (KB941569)—>»C:WINDOWS.0$NtUninstallKB941569$spuninstspuninst.exe»
Проигрыватель Windows Media 11—>»C:Program FilesWindows Media PlayerSetup_wm.exe» /Uninstall
ХроноГраф 2.0 Лайт—>C:WINDOWS.0unin0419.exe -f»C:Program FilesХронобусХроноГраф 2.0 ЛайтDeIsL1.isu» -c»C:Program FilesХронобусХроноГраф 2.0 Лайт_ISREG32.DLL»

======Hosts File======

61.129.115.198 http://www.xldd.com
61.129.115.198 http://www.ojiang.com
61.129.115.198 http://www.shuixian.net
61.129.115.198 http://www.xlarea.com

======Security center information======

AV: avast! antivirus 4.8.1351 [VPS 091007-0]

======System event log======

Computer Name: MICROSOF-F47491
Event Code: 7036
Message: Служба «Установщик Windows» перешла в состояние Остановлена.

Record Number: 5623
Source Name: Service Control Manager
Time Written: 20090908171615.000000+240
Event Type: информация
User:

Computer Name: MICROSOF-F47491
Event Code: 7036
Message: Служба «Установщик Windows» перешла в состояние Работает.

Record Number: 5622
Source Name: Service Control Manager
Time Written: 20090908170306.000000+240
Event Type: информация
User:

Computer Name: MICROSOF-F47491
Event Code: 7035
Message: Служба «Установщик Windows» успешно отправила управляющий элемент «запустить».

Record Number: 5621
Source Name: Service Control Manager
Time Written: 20090908170306.000000+240
Event Type: информация
User: NT AUTHORITYSYSTEM

Computer Name: MICROSOF-F47491
Event Code: 7036
Message: Служба «Установщик Windows» перешла в состояние Остановлена.

Record Number: 5620
Source Name: Service Control Manager
Time Written: 20090908165516.000000+240
Event Type: информация
User:

Computer Name: MICROSOF-F47491
Event Code: 7036
Message: Служба «Установщик Windows» перешла в состояние Работает.

Record Number: 5619
Source Name: Service Control Manager
Time Written: 20090908164041.000000+240
Event Type: информация
User:

=====Application event log=====

Computer Name: MICROSOF-F47491
Event Code: 1040
Message: Начата транзакция установщика Windows: C:Program FilesHPDigital Imaging{B2C61EBB-F47C-48ba-B375-27A40F8F48F7}DJ_AIO_productcontext.msi. ИД клиентского процесса: 1316.

Record Number: 8836
Source Name: MsiInstaller
Time Written: 20090925114525.000000+240
Event Type: информация
User: NT AUTHORITYSYSTEM

Computer Name: MICROSOF-F47491
Event Code: 1042
Message: Завершение транзакции установщика Windows: C:Program FilesHPDigital Imaging{B2C61EBB-F47C-48ba-B375-27A40F8F48F7}DJ_AIO_productcontext.msi. ИД клиентского процесса: 2964.

Record Number: 8835
Source Name: MsiInstaller
Time Written: 20090925113923.000000+240
Event Type: информация
User: NT AUTHORITYSYSTEM

Computer Name: MICROSOF-F47491
Event Code: 1040
Message: Начата транзакция установщика Windows: C:Program FilesHPDigital Imaging{B2C61EBB-F47C-48ba-B375-27A40F8F48F7}DJ_AIO_productcontext.msi. ИД клиентского процесса: 2964.

Record Number: 8834
Source Name: MsiInstaller
Time Written: 20090925113923.000000+240
Event Type: информация
User: NT AUTHORITYSYSTEM

Computer Name: MICROSOF-F47491
Event Code: 1042
Message: Завершение транзакции установщика Windows: C:Program FilesHPDigital Imaging{B2C61EBB-F47C-48ba-B375-27A40F8F48F7}DJ_AIO_productcontext.msi. ИД клиентского процесса: 3600.

Record Number: 8833
Source Name: MsiInstaller
Time Written: 20091025113050.000000+180
Event Type: информация
User: NT AUTHORITYSYSTEM

Computer Name: MICROSOF-F47491
Event Code: 1040
Message: Начата транзакция установщика Windows: C:Program FilesHPDigital Imaging{B2C61EBB-F47C-48ba-B375-27A40F8F48F7}DJ_AIO_productcontext.msi. ИД клиентского процесса: 3600.

Record Number: 8832
Source Name: MsiInstaller
Time Written: 20091025113050.000000+180
Event Type: информация
User: NT AUTHORITYSYSTEM

======Environment variables======

«ComSpec»=%SystemRoot%system32cmd.exe
«Path»=%SystemRoot%system32;%SystemRoot%;%SystemRoot%System32Wbem
«windir»=%SystemRoot%
«FP_NO_HOST_CHECK»=NO
«OS»=Windows_NT
«PROCESSOR_ARCHITECTURE»=x86
«PROCESSOR_LEVEL»=15
«PROCESSOR_IDENTIFIER»=x86 Family 15 Model 47 Stepping 2, AuthenticAMD
«PROCESSOR_REVISION»=2f02
«NUMBER_OF_PROCESSORS»=1
«PATHEXT»=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
«TEMP»=%SystemRoot%TEMP
«TMP»=%SystemRoot%TEMP
«Page2Chm»=C:Program FilesOperaACMisc

---

EOF

---

[Admin]

Здравствуйте, добро пожаловать на Spyware-ru форум.

Скачайте программу Combofix. Закройте все открытые окна и запустите эту программу.
После выполнения будет создан лог файл, пожалуйста вставьте его в ваш ответ.

Примечание: перед использованием Combofix обязательно установите Recovery console. Как это сделать будет описано на странице, ссылку на которую я привёл выше.

[Автор]

Сообщения