AntivirusXP Pro

This topic has 1 ответ, 2 участника, and was last updated 16 years, 2 months назад by Admin.

Просмотр 2 сообщений - с 1 по 2 (из 2 всего)

Автор

Сообщения
16 февраля, 2009 в 2:48 пп #16301
solomander
Participant
- Темы:1
- Сообщений:1
Вроде бы его удалил,а все равно открывает интернет браузер и говорит о том что есть трояны.

Logfile of random’s system information tool 1.05 (written by random/random)
Run by Анна at 2009-02-16 17:41:02
Microsoft Windows XP Professional Service Pack 2
System drive C: has 29 GB (57%) free of 50 GB
Total RAM: 1023 MB (62% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:41:14, on 16.02.2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:CORESystem32smss.exe
C:COREsystem32csrss.exe
C:COREsystem32winlogon.exe
C:COREsystem32services.exe
C:COREsystem32lsass.exe
C:COREsystem32svchost.exe
C:COREsystem32svchost.exe
C:CORESystem32svchost.exe
C:COREsystem32svchost.exe
C:COREsystem32spoolsv.exe
c:coresystem32userinit.exe
C:BinGoogleUpdateGoogleUpdate.exe
C:BinCyberLinkPowerDVDPDVDServ.exe
C:BinWebMoney Agentwmagent.exe
C:BinNeroNero8Nero BackItUpNBKeyScan.exe
C:BinMicrosoft OfficeOffice12GrooveMonitor.exe
C:BinNokiaNOKIAP~1LAUNCH~1.EXE
C:COREsystem32ctfmon.exe
C:BinDNAbtdna.exe
C:BinElectronic ArtsEADMCore.exe
C:COREsystem32CTsvcCDA.exe
C:BinNeroNero8Nero BackItUpNBService.exe
C:UsersАннаLocal SettingsApplication DataGoogleUpdateGoogleUpdate.exe
C:COREsystem32svchost.exe
C:COREsystem32wdfmgr.exe
C:COREsystem32MsPMSPSv.exe
C:BinCommonPCSuiteServicesServiceLayer.exe
C:CORESystem32alg.exe
C:BinMozilla Firefoxfirefox.exe
C:COREexplorer.exe
D:RSIT.exe
C:COREsystem32wbemwmiprvse.exe
C:Bintrend microАнна.exe

R0 — HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = about:blank
R0 — HKCUSoftwareMicrosoftInternet ExplorerMain,Local Page = C:windowssystem32blank.htm
R0 — HKLMSoftwareMicrosoftInternet ExplorerMain,Local Page = C:windowssystem32blank.htm
R0 — HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Ссылки
R3 — URLSearchHook: (no name) — {00A6FAF6-072E-44cf-8957-5838F569A31D} — (no file)
F2 — REG:system.ini: UserInit=c:coresystem32userinit.exe,C:COREsystem32twext.exe,
O2 — BHO: AcroIEHlprObj Class — {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} — C:BinAdobeAcrobat 5.0ReaderActiveXAcroIEHelper.ocx
O2 — BHO: flashget urlcatch — {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} — C:BinFlashGetjccatch.dll
O2 — BHO: IEVkbdBHO — {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} — D:BinKaspersky LabKaspersky Anti-Virus 2009ievkbd.dll
O2 — BHO: Groove GFS Browser Helper — {72853161-30C5-4D22-B7F9-0BBC1D38A37E} — C:BinMICROS~2Office12GRA8E1~1.DLL
O2 — BHO: BP Data Feeder — {9D64F819-9380-8473-DAB2-702FCB3D7A3E} — (no file)
O2 — BHO: TBSB03223 — {B4806C1A-FE8A-4008-9DA3-8CEDB6E82C10} — C:BinWebMoney Advisorwmadvisor.dll
O2 — BHO: (no name) — {CF272101-7F6E-4CF2-9453-B4C5D2FC32C0} — (no file)
O2 — BHO: FlashGet GetFlash Class — {F156768E-81EF-470C-9057-481BA8380DBA} — C:BinFlashGetgetflash.dll
O3 — Toolbar: WebMoney Advisor — {3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840} — C:BinWebMoney Advisorwmadvisor.dll
O3 — Toolbar: (no name) — {07B18EA9-A523-4961-B6BB-170DE4475CCA} — (no file)
O4 — HKLM..Run: [RemoteControl] C:BinCyberLinkPowerDVDPDVDServ.exe
O4 — HKLM..Run: [Flashget] C:BinFlashGetFlashGet.exe /min
O4 — HKLM..Run: [wmagent.exe] «C:BinWebMoney Agentwmagent.exe»
O4 — HKLM..Run: [NeroFilterCheck] C:BinCommonNeroLibNeroCheck.exe
O4 — HKLM..Run: [NBKeyScan] «C:BinNeroNero8Nero BackItUpNBKeyScan.exe»
O4 — HKLM..Run: [GrooveMonitor] «C:BinMicrosoft OfficeOffice12GrooveMonitor.exe»
O4 — HKLM..Run: [PCSuiteTrayApplication] C:BinNokiaNOKIAP~1LAUNCH~1.EXE -startup
O4 — HKLM..Run: [DAEMON Tools-1033] «C:BinDRToolsdaemon.exe» -lang 1033
O4 — HKLM..Run: [AVP] «D:BinKaspersky LabKaspersky Anti-Virus 2009avp.exe»
O4 — HKLM..Run: [SpyHunter Security Suite] C:BinEnigma Software GroupSpyHunterSpyHunter3.exe
O4 — HKLM..RunOnce: [Malwarebytes’ Anti-Malware] C:BinMalwarebytes’ Anti-Malwarembamgui.exe /install /silent
O4 — HKCU..Run: [CTFMON.EXE] C:COREsystem32ctfmon.exe
O4 — HKCU..Run: [BitTorrent DNA] «C:BinDNAbtdna.exe»
O4 — HKCU..Run: [EA Core] «C:BinElectronic ArtsEADMCore.exe» -silent
O4 — HKCU..Run: [BitTorrent] «C:BinBitTorrentbittorrent.exe»
O4 — HKCU..Run: [Google Update] «C:UsersАннаLocal SettingsApplication DataGoogleUpdateGoogleUpdate.exe» /c
O4 — HKUSS-1-5-19..Run: [CTFMON.EXE] C:COREsystem32CTFMON.EXE (User ‘LOCAL SERVICE’)
O4 — HKUSS-1-5-20..Run: [CTFMON.EXE] C:COREsystem32CTFMON.EXE (User ‘NETWORK SERVICE’)
O4 — HKUSS-1-5-18..Run: [CTFMON.EXE] C:COREsystem32CTFMON.EXE (User ‘SYSTEM’)
O4 — HKUS.DEFAULT..Run: [CTFMON.EXE] C:COREsystem32CTFMON.EXE (User ‘Default user’)
O4 — Global Startup: Adobe Gamma Loader.lnk = C:BinCommonAdobeCalibrationAdobe Gamma Loader.exe
O8 — Extra context menu item: &Search — http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZCxdm490YYRU
O8 — Extra context menu item: &Закачать все при помощи FlashGet — C:BinFlashGetjc_all.htm
O8 — Extra context menu item: &Закачать при помощи FlashGet — C:BinFlashGetjc_link.htm
O8 — Extra context menu item: &Экспорт в Microsoft Excel — res://C:BinMICROS~2Office12EXCEL.EXE/3000
O9 — Extra button: Статистика защиты веб-трафика — {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} — D:BinKaspersky LabKaspersky Anti-Virus 2009SCIEPlgn.dll
O9 — Extra button: Отправить в OneNote — {2670000A-7350-4f3c-8081-5663EE0C6C49} — C:BinMICROS~2Office12ONBttnIE.dll
O9 — Extra ‘Tools’ menuitem: &Отправить в OneNote — {2670000A-7350-4f3c-8081-5663EE0C6C49} — C:BinMICROS~2Office12ONBttnIE.dll
O9 — Extra button: WebMoney Advisor — {3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840} — C:BinWebMoney Advisorwmadvisor.dll
O9 — Extra ‘Tools’ menuitem: WebMoney Advisor — {3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840} — C:BinWebMoney Advisorwmadvisor.dll
O9 — Extra button: Research — {92780B25-18CC-41C8-B9BE-3C9C571A8263} — C:BinMICROS~2Office12REFIEBAR.DLL
O9 — Extra button: PartyPoker.com — {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} — C:COREsystem32shdocvw.dll
O9 — Extra ‘Tools’ menuitem: PartyPoker.com — {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} — C:COREsystem32shdocvw.dll
O9 — Extra button: FlashGet — {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} — C:BinFlashGetFlashGet.exe
O9 — Extra ‘Tools’ menuitem: FlashGet — {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} — C:BinFlashGetFlashGet.exe
O9 — Extra button: ICQ6 — {E59EB121-F339-4851-A3BA-FE49C35617C2} — C:BinICQ6ICQ.exe
O9 — Extra ‘Tools’ menuitem: ICQ6 — {E59EB121-F339-4851-A3BA-FE49C35617C2} — C:BinICQ6ICQ.exe
O9 — Extra button: PokerStars.net — {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} — C:BinPokerStars.NETPokerStarsUpdate.exe
O10 — Unknown file in Winsock LSP: c:userse4bc~1locals~1tempntdll64.dll
O10 — Unknown file in Winsock LSP: c:userse4bc~1locals~1tempntdll64.dll
O12 — Plugin for .spop: C:BinInternet ExplorerPluginsNPDocBox.dll
O16 — DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} — http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei-4/CursorManiaInitialSetup1.0.1.1.cab
O16 — DPF: {463ED66E-431B-11D2-ADB0-0080C83DA4EB} (AcceptWM Class) — https://w3s.webmoney.ru/WMAcceptor.dll
O16 — DPF: {F7EDBBEA-1AD2-4EBF-AA07-D453CC29EE65} (Flash Casino Helper Control) — https://plugins.valueactive.eu/flashax/iefax.cab
O18 — Protocol: grooveLocalGWS — {88FED34C-F0CA-4636-A375-3CB6248B04CD} — C:BinMICROS~2Office12GR99D3~1.DLL
O20 — AppInit_DLLs: D:BinKASPER~1KASPER~1mzvkbd.dll,D:BinKASPER~1KASPER~1mzvkbd3.dll
O23 — Service: Kaspersky Anti-Virus (AVP) — Kaspersky Lab — D:BinKaspersky LabKaspersky Anti-Virus 2009avp.exe
O23 — Service: Creative Service for CDROM Access — Creative Technology Ltd — C:COREsystem32CTsvcCDA.exe
O23 — Service: Журнал событий (Eventlog) — Корпорация Майкрософт — C:COREsystem32services.exe
O23 — Service: Google Update Service (gupdate1c98addf44e9fee) (gupdate1c98addf44e9fee) — Google Inc. — C:BinGoogleUpdateGoogleUpdate.exe
O23 — Service: InstallDriver Table Manager (IDriverT) — Macrovision Corporation — C:BinCommonInstallShieldDriver11Intel 32IDriverT.exe
O23 — Service: Служба COM записи компакт-дисков IMAPI (ImapiService) — Корпорация Майкрософт — C:COREsystem32imapi.exe
O23 — Service: NetMeeting Remote Desktop Sharing (mnmsrvc) — Корпорация Майкрософт — C:COREsystem32mnmsrvc.exe
O23 — Service: Nero BackItUp Scheduler 3 — Nero AG — C:BinNeroNero8Nero BackItUpNBService.exe
O23 — Service: NMIndexingService — Nero AG — C:BinCommonNeroLibNMIndexingService.exe
O23 — Service: Plug and Play (PlugPlay) — Корпорация Майкрософт — C:COREsystem32services.exe
O23 — Service: Диспетчер сеанса справки для удаленного рабочего стола (RDSessMgr) — Корпорация Майкрософт — C:COREsystem32sessmgr.exe
O23 — Service: Смарт-карты (SCardSvr) — Корпорация Майкрософт — C:CORESystem32SCardSvr.exe
O23 — Service: ServiceLayer — Nokia. — C:BinCommonPCSuiteServicesServiceLayer.exe
O23 — Service: Журналы и оповещения производительности (SysmonLog) — Корпорация Майкрософт — C:COREsystem32smlogsvc.exe
O23 — Service: Теневое копирование тома (VSS) — Корпорация Майкрософт — C:CORESystem32vssvc.exe
O23 — Service: Адаптер производительности WMI (WmiApSrv) — Корпорация Майкрософт — C:COREsystem32wbemwmiapsrv.exe

—
End of file — 9207 bytes

======Scheduled tasks folder======

C:COREtasksGoogleUpdateTaskMachine.job
C:COREtasksGoogleUpdateTaskUserS-1-5-21-2000478354-1123561945-682003330-1003.job

======Registry dump======

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class — C:BinAdobeAcrobat 5.0ReaderActiveXAcroIEHelper.ocx [2001-03-02 37808]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{2F364306-AA45-47B5-9F9D-39A8B94E7EF7}]
FGCatchUrl — C:BinFlashGetjccatch.dll [2007-08-06 94308]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C}]
IEVkbdBHO Class — D:BinKaspersky LabKaspersky Anti-Virus 2009ievkbd.dll [2008-11-11 62728]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper — C:BinMICROS~2Office12GRA8E1~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{9D64F819-9380-8473-DAB2-702FCB3D7A3E}]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{B4806C1A-FE8A-4008-9DA3-8CEDB6E82C10}]
TBSB03223 Class — C:BinWebMoney Advisorwmadvisor.dll [2008-09-05 2409472]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{CF272101-7F6E-4CF2-9453-B4C5D2FC32C0}]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{F156768E-81EF-470C-9057-481BA8380DBA}]
FlashGet GetFlash Class — C:BinFlashGetgetflash.dll [2007-05-18 163840]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840} — WebMoney Advisor — C:BinWebMoney Advisorwmadvisor.dll [2008-09-05 2409472]
{07B18EA9-A523-4961-B6BB-170DE4475CCA}

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun]
«RemoteControl»=C:BinCyberLinkPowerDVDPDVDServ.exe [2004-11-02 32768]
«Flashget»=C:BinFlashGetFlashGet.exe [2007-09-11 1998896]
«wmagent.exe»=C:BinWebMoney Agentwmagent.exe [2008-10-01 209376]
«NeroFilterCheck»=C:BinCommonNeroLibNeroCheck.exe [2007-03-01 153136]
«NBKeyScan»=C:BinNeroNero8Nero BackItUpNBKeyScan.exe [2007-09-20 1836328]
«GrooveMonitor»=C:BinMicrosoft OfficeOffice12GrooveMonitor.exe [2006-10-27 31016]
«PCSuiteTrayApplication»=C:BinNokiaNOKIAP~1LAUNCH~1.EXE [2006-04-26 237568]
«DAEMON Tools-1033″=C:BinDRToolsdaemon.exe [2004-08-22 81920]
«AVP»=D:BinKaspersky LabKaspersky Anti-Virus 2009avp.exe [2009-02-05 206088]
«SpyHunter Security Suite»=C:BinEnigma Software GroupSpyHunterSpyHunter3.exe [2009-01-13 864256]

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunOnce]
«Malwarebytes’ Anti-Malware»=C:BinMalwarebytes’ Anti-Malwarembamgui.exe [2009-02-11 399504]

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=C:COREsystem32ctfmon.exe [2004-08-17 15360]
«BitTorrent DNA»=C:BinDNAbtdna.exe [2008-12-19 342848]
«EA Core»=C:BinElectronic ArtsEADMCore.exe [2009-01-09 3321856]
«BitTorrent»=C:BinBitTorrentbittorrent.exe [2008-12-16 637232]
«Google Update»=C:UsersАннаLocal SettingsApplication DataGoogleUpdateGoogleUpdate.exe [2009-02-05 133104]

C:UsersAll UsersГлавное менюПрограммыАвтозагрузка
Adobe Gamma Loader.lnk — C:BinCommonAdobeCalibrationAdobe Gamma Loader.exe

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWindows]
«AppInit_DLLS»=»D:BinKASPER~1KASPER~1mzvkbd.dll,D:BinKASPER~1KASPER~1mzvkbd3.dll»

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifyklogon]
C:COREsystem32klogon.dll [2008-11-11 218376]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerShellExecuteHooks]
«{B5A7F190-DDA6-4420-B3BA-52453494E6CD}»=C:BinMICROS~2Office12GRA8E1~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetworknm]

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetworknm.sys]

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
«dontdisplaylastusername»=0
«legalnoticecaption»=
«legalnoticetext»=
«shutdownwithoutlogon»=1
«undockwithoutlogon»=1

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoDriveTypeAutoRun»=145
«Start_NotifyNewApps»=0
«NoSetActiveDesktop»=1

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoSetActiveDesktop»=

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicystandardprofileauthorizedapplicationslist]

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicydomainprofileauthorizedapplicationslist]
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{5da564ce-856e-11dd-8661-00179a300101}]
shellAutocommand — J:
shellAutoRuncommand — C:COREsystem32RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{c57de693-6b8d-11dd-862c-00179a300101}]
shellAutoRuncommand — H:Autorun.exe

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{c7a3a320-b887-11dd-8723-0017312c6828}]
shellAutoRuncommand — C:COREsystem32RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RUNdLl32.ExE .RECYCLERS-5-3-42-2819952290-8240758988-879315005-3665jwgkvsq.vmx,ahaezedrn

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{c7a3a321-b887-11dd-8723-0017312c6828}]
shellAutoRuncommand — C:COREsystem32RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RUNdLl32.ExE .RECYCLERS-5-3-42-2819952290-8240758988-879315005-3665jwgkvsq.vmx,ahaezedrn

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{e677056c-688e-11dd-861f-00179a300101}]
shellAutoRuncommand — C:COREsystem32RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RuNdLl32.EXE .RECYCLERS-5-3-42-2819952290-8240758988-879315005-3665jwgkvsq.vmx,ahaezedrn

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{e9d32560-7e5e-11dd-864d-00179a300101}]
shellAutocommand — H:Ghost.pif
shellAutoRuncommand — C:COREsystem32RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Ghost.pif

======List of files/folders created in the last 1 months======

2009-02-16 17:41:04 —-D—- C:Bintrend micro
2009-02-16 17:41:02 —-D—- C:rsit
2009-02-16 17:30:10 —-D—- C:UsersАннаApplication DataMalwarebytes
2009-02-16 17:30:01 —-D—- C:UsersAll UsersApplication DataMalwarebytes
2009-02-16 17:30:01 —-D—- C:BinMalwarebytes’ Anti-Malware
2009-02-16 17:29:15 —-A—- C:mbam-setup.exe
2009-02-16 16:27:32 —-D—- C:klwk
2009-02-16 16:08:28 —-D—- C:BinEnigma Software Group
2009-02-16 16:02:03 —-A—- C:COREsystem32o4Patch.exe
2009-02-16 16:02:03 —-A—- C:COREsystem32Agent.OMZ.Fix.exe
2009-02-16 16:02:02 —-A—- C:COREsystem32WS2Fix.exe
2009-02-16 16:02:02 —-A—- C:COREsystem32VACFix.exe
2009-02-16 16:02:02 —-A—- C:COREsystem32IEDFix.exe
2009-02-16 16:02:02 —-A—- C:COREsystem32IEDFix.C.exe
2009-02-16 16:02:02 —-A—- C:COREsystem32404Fix.exe
2009-02-16 16:02:01 —-A—- C:COREsystem32VCCLSID.exe
2009-02-16 16:02:01 —-A—- C:COREsystem32swxcacls.exe
2009-02-16 16:02:01 —-A—- C:COREsystem32swsc.exe
2009-02-16 16:02:01 —-A—- C:COREsystem32swreg.exe
2009-02-16 16:02:01 —-A—- C:COREsystem32SrchSTS.exe
2009-02-16 16:02:01 —-A—- C:COREsystem32Process.exe
2009-02-16 16:02:01 —-A—- C:COREsystem32dumphive.exe
2009-02-16 16:01:58 —-D—- C:SmitfraudFix
2009-02-16 15:49:41 —-A—- C:COREsystem32tmp.txt
2009-02-16 15:49:38 —-A—- C:rapport.txt
2009-02-16 15:49:24 —-A—- C:Spyhunter-Detection-Utility-Install.exe
2009-02-16 15:37:19 —-A—- C:SmitfraudFix.exe
2009-02-15 23:34:08 —-A—- C:COREntbtlog.txt
2009-02-15 19:44:26 —-A—- C:COREsystem32ntdll64.exe
2009-02-15 19:38:18 —-D—- C:UsersAll UsersApplication DataMicrogaming
2009-02-15 19:38:18 —-D—- C:UsersAll UsersApplication DataMGS
2009-02-15 19:35:45 —-D—- C:MicroGaming
2009-02-15 16:55:00 —-A—- C:COREsystem32~.exe
2009-02-15 16:54:48 —-SHD—- C:COREsystem32twain_32
2009-02-06 15:32:02 —-D—- C:UsersAll UsersApplication DataGoogle
2009-02-05 19:47:21 —-D—- C:UsersAll UsersApplication DataKaspersky Lab
2009-02-05 19:03:39 —-D—- C:UsersAll UsersApplication DataKaspersky Lab Setup Files
2009-02-05 18:20:20 —-D—- C:UsersАннаApplication DataFDRLab
2009-02-03 19:51:20 —-D—- C:UsersAll UsersApplication DataAvira
2009-02-02 23:09:45 —-D—- C:BinDRTools
2009-02-01 17:28:21 —-A—- C:COREsystem32Vista.Emulation.dll
2009-02-01 17:28:16 —-A—- C:COREVista.Emulation.dll
2009-02-01 03:29:00 —-D—- C:Downloads
2009-01-31 18:46:00 —-D—- C:BinJ A Formoso
2009-01-31 18:45:01 —-D—- C:BinShape Viewer
2009-01-31 14:59:46 —-D—- C:UsersAll UsersApplication DataElectronic Arts
2009-01-20 20:17:47 —-A—- C:COREsystem32ctcoinst.dll
2009-01-20 20:17:45 —-A—- C:COREsystem32ctsblfx.dll
2009-01-20 20:17:45 —-A—- C:COREsystem32ctaudfx.dll
2009-01-20 20:17:45 —-A—- C:COREsystem32commonfx.dll
2009-01-20 20:10:58 —-A—- C:COREsystem32CTSVCCTL.EXE
2009-01-20 20:10:58 —-A—- C:COREsystem32CTSVCCDA.EXE
2009-01-20 20:10:58 —-A—- C:COREsystem32CTDetres.dll
2009-01-20 20:10:56 —-N—- C:COREsystem32CTMEDENG.DLL
2009-01-20 20:10:55 —-A—- C:COREsystem32CTMERes.DLL
2009-01-19 22:34:18 —-D—- C:UsersАннаApplication Datatheimagingfactory
2009-01-19 22:33:28 —-A—- C:COREbuZZL2lic.dll
2009-01-17 19:08:20 —-D—- C:UsersАннаApplication DataSecondLife

======List of files/folders modified in the last 1 months======

2009-02-16 17:41:08 —-D—- C:COREPrefetch
2009-02-16 17:41:04 —-RD—- C:Bin
2009-02-16 17:38:17 —-D—- C:UsersАннаApplication DataDNA
2009-02-16 17:30:35 —-D—- C:UsersАннаApplication DataBitTorrent
2009-02-16 17:30:32 —-D—- C:BinFlashGet
2009-02-16 17:30:30 —-D—- C:CORETemp
2009-02-16 17:30:05 —-D—- C:COREsystem32drivers
2009-02-16 16:54:36 —-D—- C:COREsystem32config
2009-02-16 16:32:53 —-D—- C:COREsystem32
2009-02-16 16:32:24 —-D—- C:BinMozilla Firefox
2009-02-16 16:01:20 —-AD—- C:UsersAll UsersApplication DataTEMP
2009-02-16 15:58:07 —-D—- C:BinDNA
2009-02-16 15:57:56 —-D—- C:CORE
2009-02-16 15:57:14 —-A—- C:CORESchedLgU.Txt
2009-02-16 15:16:37 —-D—- C:BinRadioBOSS
2009-02-16 15:16:21 —-D—- C:UsersАннаApplication DataOrbit
2009-02-16 15:16:10 —-D—- C:Casino
2009-02-15 23:34:28 —-D—- C:Users
2009-02-15 20:40:01 —-D—- C:CORERegistration
2009-02-15 19:36:16 —-SD—- C:COREDownloaded Program Files
2009-02-15 19:14:13 —-A—- C:COREsystem32userinit.exe
2009-02-15 19:11:41 —-D—- C:UsersАннаApplication DataWebMoney
2009-02-15 18:11:10 —-D—- C:COREsystem32CatRoot2
2009-02-13 23:31:20 —-A—- C:CORENeroDigital.ini
2009-02-13 15:39:36 —-SD—- C:CORETasks
2009-02-13 15:39:24 —-SHD—- C:COREInstaller
2009-02-13 15:39:14 —-D—- C:BinGoogle
2009-02-12 20:18:15 —-RSD—- C:COREFonts
2009-02-09 20:46:44 —-D—- C:Config.Msi
2009-02-06 12:12:14 —-D—- C:BinSHOUTcast
2009-02-06 12:12:14 —-D—- C:BinPokerStars.NET
2009-02-06 12:12:13 —-D—- C:COREsystem32MsDtc
2009-02-06 12:12:13 —-D—- C:CORESoftwareDistribution
2009-02-06 12:12:13 —-D—- C:COREDebug
2009-02-06 12:12:13 —-D—- C:BinWinRAR
2009-02-06 12:12:13 —-D—- C:BinWebMoney
2009-02-05 20:07:57 —-D—- C:UsersАннаApplication DataAldea
2009-02-05 19:47:46 —-HD—- C:COREinf
2009-02-04 23:49:27 —-RSHDC—- C:COREsystem32dllcache
2009-02-03 18:58:06 —-D—- C:UsersАннаApplication DataYandex
2009-02-03 00:15:14 —-D—- C:UsersАннаApplication DatauTorrent
2009-02-03 00:15:14 —-D—- C:UsersАннаApplication DataJanes_Realty
2009-02-03 00:15:14 —-D—- C:USD
2009-02-01 17:27:46 —-D—- C:Program Files
2009-01-24 14:56:06 —-D—- C:BinWebMoney Advisor
2009-01-22 00:34:19 —-SHD—- C:System Volume Information
2009-01-22 00:34:19 —-D—- C:COREsystem32Restore
2009-01-20 20:18:35 —-D—- C:COREsystem32CatRoot
2009-01-20 20:11:51 —-HD—- C:BinInstallShield Installation Information
2009-01-20 20:11:23 —-AC—- C:CORESBWIN.INI
2009-01-20 20:07:13 —-D—- C:COREsystem32Data
2009-01-20 20:06:33 —-D—- C:UsersАннаApplication DataCreative
2009-01-20 20:05:55 —-D—- C:BinCreative

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 intelppm;Драйвер Intel процессора; C:COREsystem32DRIVERSintelppm.sys [2004-08-17 40448]
R1 KLIF;Kaspersky Lab Driver; C:COREsystem32DRIVERSklif.sys [2009-02-05 226832]
R1 Tcpip6;Драйвер протокола IPv6 (Microsoft); C:COREsystem32DRIVERStcpip6.sys [2004-08-03 223616]
R1 WS2IFSL;Среда Windows Socket 2.0 поддержки поставщиков не-IFS служб; C:CORESystem32driversws2ifsl.sys [2003-05-29 12032]
R2 irda;ИК-протокол IrDA; C:COREsystem32DRIVERSirda.sys [2004-08-03 87424]
R2 PfModNT;PfModNT; ??C:COREsystem32PfModNT.sys []
R3 Arp1394;Протокол клиента 1394 ARP; C:COREsystem32DRIVERSarp1394.sys [2004-08-17 60800]
R3 ctaud2k;Creative Audio Driver (WDM); C:COREsystem32driversctaud2k.sys [2003-04-11 502160]
R3 ctgame;Game Port; C:COREsystem32DRIVERSctgame.sys [2002-12-30 12160]
R3 emupia;E-mu Plug-in Architecture Driver; C:COREsystem32driversemupia2k.sys [2003-03-25 144736]
R3 ha10kx2k;Creative Hardware Abstract Layer Driver; C:COREsystem32driversha10kx2k.sys [2003-04-03 850880]
R3 klim5;Kaspersky Anti-Virus NDIS Filter; C:COREsystem32DRIVERSklim5.sys [2008-04-30 24592]
R3 NIC1394;Сетевой драйвер 1394; C:COREsystem32DRIVERSnic1394.sys [2004-08-17 61824]
R3 nv;nv; C:COREsystem32DRIVERSnv4_mini.sys [2004-08-04 1897408]
R3 ossrv;Creative OS Services Driver; C:COREsystem32driversctoss2k.sys [2003-03-25 190176]
R3 pfc;Padus ASPI Shell; C:COREsystem32driverspfc.sys [2008-07-29 10368]
R3 Rasirda;Минипорт WAN (IrDA); C:COREsystem32DRIVERSrasirda.sys [2001-08-17 19584]
R3 tunmp;Драйвер адаптера минипорта Microsoft Tun; C:COREsystem32DRIVERStunmp.sys [2004-08-17 12416]
R3 usbehci;Драйвер минипорта Microsoft USB 2.0 расширенного хост-контроллера; C:COREsystem32DRIVERSusbehci.sys [2004-08-03 26624]
R3 usbhub;USB2 концентратор; C:COREsystem32DRIVERSusbhub.sys [2004-08-03 57600]
R3 usbuhci;Драйвер минипорта Microsoft USB универсального хост-контроллера; C:COREsystem32DRIVERSusbuhci.sys [2004-08-03 20480]
R3 yukonwxp;NDIS5.1 Miniport Driver for Marvell Yukon Ethernet Controller; C:COREsystem32DRIVERSyk51x86.sys [2004-08-19 189568]
S3 ctdvda2k;Creative DVD-Audio Device Driver; C:COREsystem32driversctdvda2k.sys [2003-03-27 287920]
S3 EagleNT;EagleNT; ??C:COREsystem32driversEagleNT.sys []
S3 mpr_freader;MPR FileReader Driver; ??C:BinMulti Password Recoverympr_freader.sys []
S3 MSIRCOMM;Microsoft IR Communications Driver; C:COREsystem32DRIVERSMSIRCOMM.sys [2004-08-03 22016]
S3 nm;Драйвер сетевого монитора; C:COREsystem32DRIVERSNMnt.sys [2004-08-03 40320]
S3 Nokia USB Generic;Nokia USB Generic; C:COREsystem32driversnmwcdc.sys [2006-03-24 8704]
S3 Nokia USB Modem;Nokia USB Modem; C:COREsystem32driversnmwcdcm.sys [2006-03-24 13312]
S3 Nokia USB Phone Parent;Nokia USB Phone Parent; C:COREsystem32driversnmwcd.sys [2006-03-24 127488]
S3 Nokia USB Port;Nokia USB Port; C:COREsystem32driversnmwcdcj.sys [2006-03-24 13312]
S3 npkcrypt;npkcrypt; C:COREsystem32driversnpkcrypt.sys []
S3 pctvvbi;PCTVVBI; C:COREsystem32DRIVERSpctvvbi.sys [2002-11-11 6400]
S3 STIrUsb;SigmaTel USB-IrDA Dongle; C:COREsystem32DRIVERSirstusb.sys [2001-08-17 26624]
S3 usbscan;Драйвер USB-сканера; C:COREsystem32DRIVERSusbscan.sys [2004-08-03 15104]
S3 USBSTOR;Драйвер запоминающих устройств для USB; C:COREsystem32DRIVERSUSBSTOR.SYS [2004-08-03 26496]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 6to4;Служба поддержки IPv6; C:COREsystem32svchost.exe [2004-08-17 14336]
R2 Creative Service for CDROM Access;Creative Service for CDROM Access; C:COREsystem32CTsvcCDA.exe [1999-12-13 44032]
R2 Irmon;Монитор инфракрасной связи; C:COREsystem32svchost.exe [2004-08-17 14336]
R2 Nero BackItUp Scheduler 3;Nero BackItUp Scheduler 3; C:BinNeroNero8Nero BackItUpNBService.exe [2007-09-20 853288]
R2 UMWdf;Windows User Mode Driver Framework; C:COREsystem32wdfmgr.exe [2004-08-10 38912]
R2 WMDM PMSP Service;WMDM PMSP Service; C:COREsystem32MsPMSPSv.exe [2000-06-26 53520]
R3 ServiceLayer;ServiceLayer; C:BinCommonPCSuiteServicesServiceLayer.exe [2006-04-12 176640]
S2 AVP;Kaspersky Anti-Virus; D:BinKaspersky LabKaspersky Anti-Virus 2009avp.exe [2009-02-05 206088]
S2 gupdate1c98addf44e9fee;Google Update Service (gupdate1c98addf44e9fee); C:BinGoogleUpdateGoogleUpdate.exe [2009-02-09 133104]
S3 aspnet_state;ASP.NET State Service; C:COREMicrosoft.NETFrameworkv2.0.50727aspnet_state.exe [2005-09-23 29896]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:COREMicrosoft.NETFrameworkv2.0.50727mscorsvw.exe [2005-09-23 66240]
S3 IDriverT;InstallDriver Table Manager; C:BinCommonInstallShieldDriver11Intel 32IDriverT.exe [2005-04-04 69632]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:BinMicrosoft OfficeOffice12GrooveAuditService.exe [2006-10-27 65824]
S3 NMIndexingService;NMIndexingService; C:BinCommonNeroLibNMIndexingService.exe [2007-09-20 382248]
S3 odserv;Microsoft Office Diagnostics Service; C:BinCommonMicrosoft SharedOFFICE12ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:BinCommonMicrosoft SharedSource EngineOSE.EXE [2006-10-26 145184]
S3 usprserv;User Privilege Service; C:CORESystem32svchost.exe [2004-08-17 14336]

EOF

info.txt logfile of random’s system information tool 1.05 2009-02-16 17:41:18

======Uninstall list======

—>MsiExec.exe /X{E9F81423-211E-46B6-9AE0-38568BC5CF6F}
«Новая Эра» ver 7.08—>»D:GamesNewAgeunins000.exe»
—>C:BinNeroNero8\nerouninstallUNNERO.exe /UNINSTALL
—>C:COREUNNeroBackItUp.exe /UNINSTALL
—>C:COREUNNeroMediaHome.exe /UNINSTALL
—>C:COREUNNeroShowTime.exe /UNINSTALL
—>C:COREUNNeroVision.exe /UNINSTALL
—>C:COREUNRecode.exe /UNINSTALL
—>RunDll32 C:BinCommonINSTAL~1engine6INTEL3~1Ctor.dll,LaunchSetup «C:BinInstallShield Installation Information{236FADD8-58FD-11D6-A285-00A0CC51B2FE}setup.exe» -l0x9
—>RunDll32 C:BinCommonINSTAL~1engine6INTEL3~1Ctor.dll,LaunchSetup «C:BinInstallShield Installation Information{236FADD8-58FD-11D6-A285-00A0CC51B2FE}setup.exe» -l0x9 /remove
—>RunDll32 C:BinCommonINSTAL~1engine6INTEL3~1Ctor.dll,LaunchSetup «C:BinInstallShield Installation Information{435E969D-867E-4364-8E74-3DC8A69C5BDB}setup.exe» -l0x9
—>RunDll32 C:BinCommonINSTAL~1engine6INTEL3~1Ctor.dll,LaunchSetup «C:BinInstallShield Installation Information{435E969D-867E-4364-8E74-3DC8A69C5BDB}setup.exe» -l0x9 /remove
—>RunDll32 C:BinCommonINSTAL~1engine6INTEL3~1Ctor.dll,LaunchSetup «C:BinInstallShield Installation Information{7201B853-5833-11D6-A285-00A0CC51B2FE}setup.exe» -l0x9
—>RunDll32 C:BinCommonINSTAL~1engine6INTEL3~1Ctor.dll,LaunchSetup «C:BinInstallShield Installation Information{7201B853-5833-11D6-A285-00A0CC51B2FE}setup.exe» -l0x9 /remove
—>RunDll32 C:BinCommonINSTAL~1engine6INTEL3~1Ctor.dll,LaunchSetup «C:BinInstallShield Installation Information{9154ED7C-926E-49CC-B677-0CF3C5267457}setup.exe» -l0x9
—>RunDll32 C:BinCommonINSTAL~1engine6INTEL3~1Ctor.dll,LaunchSetup «C:BinInstallShield Installation Information{9154ED7C-926E-49CC-B677-0CF3C5267457}setup.exe» -l0x9 /remove
—>RunDll32 C:BinCommonINSTAL~1engine6INTEL3~1Ctor.dll,LaunchSetup «C:BinInstallShield Installation Information{AC157741-3285-4D6A-B934-9174587A3493}setup.exe» -l0x9
—>RunDll32 C:BinCommonINSTAL~1engine6INTEL3~1Ctor.dll,LaunchSetup «C:BinInstallShield Installation Information{AC157741-3285-4D6A-B934-9174587A3493}setup.exe» -l0x9 /remove
—>rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:COREINFPCHealth.inf
ACDSee 9 Photo Manager—>MsiExec.exe /I{B2D41883-3BFC-4BA0-A2F6-5A2C9836C238}
Activation (Nero 9)—>C:BinCommonNeroNero ProductInstaller 4SetupX.exe REMOVESERIALNUMBER=»5E30-4K05-18X7-4283-AC52-M5A0-5742″
Adobe Acrobat 5.0—>C:COREISUNINST.EXE -f»C:BinCommonAdobeAcrobat 5.0NTUninst.isu» -c»C:BinCommonAdobeAcrobat 5.0NTUninst.dll»
Adobe Flash Player 10 ActiveX—>C:COREsystem32MacromedFlashuninstall_activeX.exe
Adobe Flash Player 10 Plugin—>C:COREsystem32MacromedFlashuninstall_plugin.exe
Adobe Photoshop 7.0.1—>C:COREISUNINST.EXE -f»C:BinAdobePhotoshop 7.0Uninst.isu» -c»C:BinAdobePhotoshop 7.0Uninst.dll»
Adobe Shockwave Player 11—>C:COREsystem32adobeSHOCKW~1UNWISE.EXE C:COREsystem32AdobeSHOCKW~1Install.log
buZZ.Lite 2.0—>MsiExec.exe /I{D894C63E-80F1-11D5-B0DE-0050FC02154F}
buZZ.PiX 1.0—>MsiExec.exe /I{B4FD51C4-AB88-11D5-B0DE-0050FC02154F}
buZZ.Pro 2.0—>MsiExec.exe /I{A7DBCA76-97E2-11D5-B0DE-0050FC02154F}
buZZ.Simplifier 1.0—>MsiExec.exe /I{B4FD51B2-AB88-11D5-B0DE-0050FC02154F}
DAEMON Tools—>MsiExec.exe /I{3DED3A72-61A8-4B87-98A5-EF0BC8038AA0}
Data Cod Downloader 1.24—>»C:BinDCodDownloaderunins000.exe»
EA Download Manager—>C:BinElectronic ArtsEADMUninstall.exe
EasyGPRS—>RunDll32 C:BinCommonINSTAL~1engine6INTEL3~1Ctor.dll,LaunchSetup «C:BinInstallShield Installation Information{56108448-9B38-4FF8-BE61-2ED13C19D0FE}Setup.exe» -l0x19
EAX Console—>RunDll32 C:BinCommonINSTAL~1engine6INTEL3~1Ctor.dll,LaunchSetup «C:BinInstallShield Installation Information{DEBD7BF3-5856-11D6-A285-00A0CC51B2FE}setup.exe» -l0x9
Eye Candy 4000—>C:BinAdobePHOTOS~1.0Plug-InsEYECAN~1UNWISE.EXE C:BinAdobePHOTOS~1.0Plug-InsEYECAN~1INSTALL.LOG
FlashGet 1.9.4.1063—>C:BinFlashGetuninst.exe
Fragoria OnLine Game—>MsiExec.exe /X{96E23163-D3CE-4CE8-909D-7213AEF0425D}
Google Earth Pro—>MsiExec.exe /X{9578C0CD-8108-4379-9026-4601F59859A0}
Google Update Helper—>MsiExec.exe /I{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
Google Планета Земля—>MsiExec.exe /X{548EAC70-EE00-11DD-908C-005056806466}
HijackThis 2.0.2—>»C:Bintrend microHijackThis.exe» /uninstall
HtmlReader v1.7—>D:BinHtmlReaderunins000.exe
ICQ6—>C:BinInstallShield Installation Information{60DE4033-9503-48D1-A483-7846BD217CA9}setup.exe -runfromtemp -l0x0009 -removeonly
K-Lite Codec Pack 2.53 Full—>»C:BinK-Lite Codec Packunins000.exe»
LEAD JPEG 2000 PhotoShop® Plugin (EVAL)—>RunDll32 C:BinCommonINSTAL~1engine6INTEL3~1ctor.dll,LaunchSetup «C:BinInstallShield Installation Information{A746943F-1165-4762-8D2D-D34274D11F3B}setup.exe»
Malwarebytes’ Anti-Malware—>»C:BinMalwarebytes’ Anti-Malwareunins000.exe»
Marvell Miniport Driver—>MsiExec.exe /X{C950420B-4182-49EA-850A-A6A2ABF06C6B}
Microsoft .NET Framework 2.0—>C:COREMicrosoft.NETFrameworkv2.0.50727Microsoft .NET Framework 2.0install.exe
Microsoft Office Access MUI (Russian) 2007—>MsiExec.exe /X{90120000-0015-0419-0000-0000000FF1CE}
Microsoft Office Enterprise 2007—>»C:BinCommonMicrosoft SharedOFFICE12Office Setup Controllersetup.exe» /uninstall ENTERPRISE /dll OSETUP.DLL
Microsoft Office Enterprise 2007—>MsiExec.exe /X{90120000-0030-0000-0000-0000000FF1CE}
Microsoft Office Excel MUI (Russian) 2007—>MsiExec.exe /X{90120000-0016-0419-0000-0000000FF1CE}
Microsoft Office Groove MUI (Russian) 2007—>MsiExec.exe /X{90120000-00BA-0419-0000-0000000FF1CE}
Microsoft Office InfoPath MUI (Russian) 2007—>MsiExec.exe /X{90120000-0044-0419-0000-0000000FF1CE}
Microsoft Office OneNote MUI (Russian) 2007—>MsiExec.exe /X{90120000-00A1-0419-0000-0000000FF1CE}
Microsoft Office Outlook MUI (Russian) 2007—>MsiExec.exe /X{90120000-001A-0419-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (Russian) 2007—>MsiExec.exe /X{90120000-0018-0419-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007—>MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (German) 2007—>MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE}
Microsoft Office Proof (Russian) 2007—>MsiExec.exe /X{90120000-001F-0419-0000-0000000FF1CE}
Microsoft Office Proof (Ukrainian) 2007—>MsiExec.exe /X{90120000-001F-0422-0000-0000000FF1CE}
Microsoft Office Proofing (Russian) 2007—>MsiExec.exe /X{90120000-002C-0419-0000-0000000FF1CE}
Microsoft Office Publisher MUI (Russian) 2007—>MsiExec.exe /X{90120000-0019-0419-0000-0000000FF1CE}
Microsoft Office Shared MUI (Russian) 2007—>MsiExec.exe /X{90120000-006E-0419-0000-0000000FF1CE}
Microsoft Office Word MUI (Russian) 2007—>MsiExec.exe /X{90120000-001B-0419-0000-0000000FF1CE}
Microsoft Visual C++ 2005 Redistributable—>MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
MidRadio Player 4.2.2—>»D:BinMidRadio Playerunins000.exe»
Mozilla Firefox (3.0)—>C:BinMozilla Firefoxuninstallhelper.exe
Nero 8—>MsiExec.exe /X{81C6BFED-691E-402A-95DA-F6DE1A351033}
neroxml—>MsiExec.exe /I{56C049BE-79E9-4502-BEA7-9754A3E60F9B}
Nokia Connectivity Cable Driver—>MsiExec.exe /X{E4DD8B33-6F9B-41C5-96FF-5DBF27ED23E7}
Nokia PC Connectivity Solution—>MsiExec.exe /I{588AA47B-9115-44D3-B2E5-4F10BC659D6C}
Nokia PC Suite—>MsiExec.exe /I{77296E63-8C19-462B-ABA1-F510750A8C51}
Opera AC 3.5.0—>»C:BinOpera ACunins000.exe»
Perfect World 1.3.4.2265—>»D:GamesNival OnlinePerfect Worldunins000.exe»
PokerStars.net—>»C:BinPokerStars.NETPokerStarsUninstall.exe» /u:PokerStars.net
PowerDVD—>RunDll32 C:BinCommonINSTAL~1engine6INTEL3~1Ctor.dll,LaunchSetup «C:BinInstallShield Installation Information{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}Setup.exe» -uninstall
Rapid Hacker v3.7—>»C:BinRapid Hackerunins000.exe»
‘Rappelz’—>»D:BinNikitaRappelzunins000.exe»
Scavenger 1.0.3.41—>C:BinScavengeruninst.exe
Shape Viewer—>MsiExec.exe /I{88DA244E-4CEA-49E4-AD6A-301B65131E25}
SHOUTcast DNAS (remove only)—>»C:BinSHOUTcastuninst-dnas.exe»
SHOUTcast Source DSP 1.9.0 (remove only)—>C:BinWinampuninst-dsp.exe
Sims 2 — Sex and the City — Season 1—>D:GamesSIMS2_~1UNWISE.EXE D:GamesSIMS2_~1INSTALL.LOG
Splat! 1.0—>C:BinAdobePHOTOS~1.0Plug-InsSplatUNWISE.EXE C:BinAdobePHOTOS~1.0Plug-InsSplatINSTALL.LOG
SpyHunter—>»C:BinEnigma Software GroupSpyHunterUninstall.exe» «C:BinEnigma Software GroupSpyHunterinstall.log» -u
The Sims 2 Nightlife—>D:GamesTHESIM~2UNWISE.EXE D:GamesTHESIM~2INSTALL.LOG
Train Store V3.2—>C:BinJ A FormosoTrain StoreUninstal.exe
VCRedistSetup—>MsiExec.exe /I{3921A67A-5AB1-4E48-9444-C71814CF3027}
VegasSky—>C:BinVegasSkyuninst.exe
Vit Registry Fix 8.1 (remove only)—>C:BinVITSOFTVit Registry FixUninstall.exe
WebMoney Advisor—>regsvr32 /u /s «C:BinWebMoney Advisorwmadvisor.dll»
WebMoney Agent—>C:BinWebMoney Agentuninst_wmagent.exe
WebMoney Keeper Classic 3.7.0.0—>»C:BinWebMoneyUninstall.exe» «C:BinWebMoneyinstall.log» -u
Winamp—>»C:BinWinampUninstWA.exe»
Windows Installer 3.1 (KB893803)—>»C:CORE$MSI31Uninstall_KB893803v2$spuninstspuninst.exe»
Windows Media Format Runtime—>»C:BinWindows Media Playerwmsetsdk.exe» /UninstallAll
WOS Online—>MsiExec.exe /X{E3C06762-5FCB-4EAE-86B9-F144E11B4479}
Your Application Name—>RunDll32 C:BinCommonINSTAL~1engine6INTEL3~1Ctor.dll,LaunchSetup «C:BinInstallShield Installation Information{5CDDF96A-BC34-4D72-9ABA-E1FFF0C39977}setup.exe» -l0x9
Антивирус Касперского 2009—>MsiExec.exe /I{6580C5A3-2336-4EC5-85F1-3448C5F6208A}
Антивирус Касперского 2009—>MsiExec.exe /I{6580C5A3-2336-4EC5-85F1-3448C5F6208A}
Архиватор WinRAR—>C:BinWinRARuninstall.exe
Бесплатный контент Aldea—>C:UsersАннаApplication DataAldeaAldeaUninstall.exe
Единый модуль поддержки сети Fiery—>C:BinFieryAdsFieryAdsUninstall.exe
Пиратия Online 1.36.003—>»D:BinNival OnlineПиратия Onlineunins000.exe»
Русская рыбалка 1.6—>D:GamesRussian Fishing 1.6Uninstall.exe

======Security center information======

AV: Doctor Web Anti-Virus
AV: Антивирус Касперского (disabled) (outdated)

System event log

Computer Name: COMPUTER
Event Code: 7036
Message: Служба «Служба сетевого расположения (NLA)» перешла в состояние Работает.

Record Number: 2194
Source Name: Service Control Manager
Time Written: 20090120155035.000000+180
Event Type: информация
User:

Computer Name: COMPUTER
Event Code: 7035
Message: Служба «Служба сетевого расположения (NLA)» успешно отправила управляющий элемент «запустить».

Record Number: 2193
Source Name: Service Control Manager
Time Written: 20090120155035.000000+180
Event Type: информация
User: NT AUTHORITYSYSTEM

Computer Name: COMPUTER
Event Code: 7036
Message: Служба «Совместимость быстрого переключения пользователей» перешла в состояние Работает.

Record Number: 2192
Source Name: Service Control Manager
Time Written: 20090120155035.000000+180
Event Type: информация
User:

Computer Name: COMPUTER
Event Code: 7035
Message: Служба «Совместимость быстрого переключения пользователей» успешно отправила управляющий элемент «запустить».

Record Number: 2191
Source Name: Service Control Manager
Time Written: 20090120155035.000000+180
Event Type: информация
User: NT AUTHORITYSYSTEM

Computer Name: COMPUTER
Event Code: 8033
Message: Драйвер обозревателя сети инициировал выборы в сети DeviceNetBT_Tcpip_{B70D6678-DBF9-4281-8727-9375B9386291}, так как был остановлен основной обозреватель сети.

Record Number: 2190
Source Name: BROWSER
Time Written: 20090120154945.000000+180
Event Type: информация
User:

Application event log

Computer Name: COMPUTER
Event Code: 0
Message:
Record Number: 1637
Source Name: NMIndexingService
Time Written: 20081020125251.000000+240
Event Type: информация
User:

Computer Name: COMPUTER
Event Code: 105
Message: The service was started.

Record Number: 1636
Source Name: WMDM PMSP Service
Time Written: 20081020125243.000000+240
Event Type: информация
User:

Computer Name: COMPUTER
Event Code: 105
Message:
Record Number: 1635
Source Name: PLFlash DeviceIoControl Service
Time Written: 20081020125243.000000+240
Event Type: информация
User:

Computer Name: COMPUTER
Event Code: 0
Message:
Record Number: 1634
Source Name: Nero BackItUp Scheduler 3
Time Written: 20081020125243.000000+240
Event Type: информация
User:

Computer Name: COMPUTER
Event Code: 105
Message: The service was started.

Record Number: 1633
Source Name: Creative Service for CDROM Access
Time Written: 20081020125242.000000+240
Event Type: информация
User:

======Environment variables======

«ComSpec»=%SystemRoot%system32cmd.exe
«Path»=%SystemRoot%system32;%SystemRoot%;%SystemRoot%System32Wbem;c:binadobephotoshop 7.0plug-insVizros4.0lib
«windir»=%SystemRoot%
«FP_NO_HOST_CHECK»=NO
«OS»=Windows_NT
«PROCESSOR_ARCHITECTURE»=x86
«PROCESSOR_LEVEL»=15
«PROCESSOR_IDENTIFIER»=x86 Family 15 Model 3 Stepping 3, GenuineIntel
«PROCESSOR_REVISION»=0303
«NUMBER_OF_PROCESSORS»=2
«PATHEXT»=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
«TEMP»=%SystemRoot%TEMP
«TMP»=%SystemRoot%TEMP
«AC_OPERA»=C:BinOpera AC
«AC_SOURCH»=C:UsersE4BC~1LOCALS~1Temp

EOF
17 февраля, 2009 в 3:14 пп #22061
Admin
Keymaster
- Темы:40
- Сообщений:5676
Здравствуйте, добро пожаловать на Spyware-ru форум.

Судя по логам ваш компьютер так же заражён autorun.inf трояном.
Прочитайте эту инструкцию Flash_Disinfector ещё одно оружие против autorun.inf троянов.

* Отключите ваш антивирус.
* Скачайте и запустите Flash_Disinfector.
* По требованию программы вставьте ваш флэш диск или подключите другие внешние устройства хранения информации.

Примечание: запускайте программу столько раз, сколько нужно чтобы очистить все ваши подключаемые диски.

Запустите HijackThis, для этого кликните Пуск, Выполнить, введите C:Bintrend microАнна.exe и нажмите Enter.
Кликните по кнопке Do a system scan only.
Далее отметьте галочкой (слева) следующие строки:
```
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - (no file)

F2 - REG:system.ini: UserInit=c:coresystem32userinit.exe,C:COREsystem32twext.exe,
```
Кликните по кнопке Fix checked и подтвердите свои действия выбрав YES.

Скачайте OTMoveIt3 by OldTimer кликнув по этой ссылке.
Запустите программу и в большое поле ввода (заголовок этого поля выделен желтым цветом) скопируйте следующий текст.
```
:Processes

explorer.exe



:services

usprserv



:reg

[-HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{9D64F819-9380-8473-DAB2-702FCB3D7A3E}]

[-HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{CF272101-7F6E-4CF2-9453-B4C5D2FC32C0}]

[-HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{5da564ce-856e-11dd-8661-00179a300101}]

[-HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{c57de693-6b8d-11dd-862c-00179a300101}]

[-HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{c7a3a320-b887-11dd-8723-0017312c6828}]

[-HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{c7a3a321-b887-11dd-8723-0017312c6828}]

[-HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{e677056c-688e-11dd-861f-00179a300101}]

[-HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{e9d32560-7e5e-11dd-864d-00179a300101}]



:files

c:RECYCLERS-5-3-42-2819952290-8240758988-879315005-3665



:Commands

[emptytemp]

[start explorer]

[Reboot]
```
Кликните по кнопке MoveIt!. В процессе работы возможна перезагрузка компьютера.
По-завершении работы программы должен будет показан лог. Если лог не будет показан, то его можно найти в папке C:_OTMoveItMovedFiles.

Вставьте в ваше ответное сообщение содержимое этого лога. Так же приложите свежий RSIT лог.
Автор

Сообщения

Просмотр 2 сообщений - с 1 по 2 (из 2 всего)

Для ответа в этой теме необходимо авторизоваться.

AntivirusXP Pro

Добро пожаловать

Поиск

Последние темы

СПАЙВАРЕ РУ

Нужна помощь?

Ссылки