- This topic has 4 ответа, 2 участника, and was last updated 15 years, 11 months назад by
.
-
Сообщения
-
info.txt logfile of random’s system information tool 1.06 2009-11-03 01:12:26
======Uninstall list======
—>MsiExec /X{C5C1C0F0-D62F-4DBF-81D4-D7EF397C228B}
—>rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:WINDOWSINFPCHealth.inf
2007 Microsoft Office Suite Service Pack 2 (SP2)—>msiexec /package {90120000-0015-0419-0000-0000000FF1CE} /uninstall {DCB382C1-7F1B-42B2-9D47-EDC4262E832F}
2007 Microsoft Office Suite Service Pack 2 (SP2)—>msiexec /package {90120000-0016-0419-0000-0000000FF1CE} /uninstall {DCB382C1-7F1B-42B2-9D47-EDC4262E832F}
2007 Microsoft Office Suite Service Pack 2 (SP2)—>msiexec /package {90120000-0018-0419-0000-0000000FF1CE} /uninstall {DCB382C1-7F1B-42B2-9D47-EDC4262E832F}
2007 Microsoft Office Suite Service Pack 2 (SP2)—>msiexec /package {90120000-0019-0419-0000-0000000FF1CE} /uninstall {DCB382C1-7F1B-42B2-9D47-EDC4262E832F}
2007 Microsoft Office Suite Service Pack 2 (SP2)—>msiexec /package {90120000-001A-0419-0000-0000000FF1CE} /uninstall {DCB382C1-7F1B-42B2-9D47-EDC4262E832F}
2007 Microsoft Office Suite Service Pack 2 (SP2)—>msiexec /package {90120000-001B-0419-0000-0000000FF1CE} /uninstall {DCB382C1-7F1B-42B2-9D47-EDC4262E832F}
2007 Microsoft Office Suite Service Pack 2 (SP2)—>msiexec /package {90120000-001F-0407-0000-0000000FF1CE} /uninstall {A0516415-ED61-419A-981D-93596DA74165}
2007 Microsoft Office Suite Service Pack 2 (SP2)—>msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {ABDDE972-355B-4AF1-89A8-DA50B7B5C045}
2007 Microsoft Office Suite Service Pack 2 (SP2)—>msiexec /package {90120000-001F-0419-0000-0000000FF1CE} /uninstall {57A92C5E-E76A-49CC-9EC2-A7B6CE1255EA}
2007 Microsoft Office Suite Service Pack 2 (SP2)—>msiexec /package {90120000-001F-0422-0000-0000000FF1CE} /uninstall {6F177D09-F21D-4F50-9436-353972D1D232}
2007 Microsoft Office Suite Service Pack 2 (SP2)—>msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}
2007 Microsoft Office Suite Service Pack 2 (SP2)—>msiexec /package {90120000-0044-0419-0000-0000000FF1CE} /uninstall {DCB382C1-7F1B-42B2-9D47-EDC4262E832F}
2007 Microsoft Office Suite Service Pack 2 (SP2)—>msiexec /package {90120000-006E-0419-0000-0000000FF1CE} /uninstall {37317C49-30C4-412C-B0B9-D95090F330D8}
2007 Microsoft Office Suite Service Pack 2 (SP2)—>msiexec /package {90120000-00A1-0419-0000-0000000FF1CE} /uninstall {DCB382C1-7F1B-42B2-9D47-EDC4262E832F}
2007 Microsoft Office Suite Service Pack 2 (SP2)—>msiexec /package {90120000-00BA-0419-0000-0000000FF1CE} /uninstall {DCB382C1-7F1B-42B2-9D47-EDC4262E832F}
7-Zip 4.65—>»C:Program Files7-ZipUninstall.exe»
ABBYY FineReader 9.0 Professional Edition—>MsiExec.exe /I{F9000000-0001-0000-0000-074957833700}
Adobe Flash Player 10 ActiveX—>C:WINDOWSsystem32MacromedFlashuninstall_activeX.exe
Adobe Flash Player 10 Plugin—>C:WINDOWSsystem32MacromedFlashuninstall_plugin.exe
AIMP2 2.51.328—>C:Program FilesAIMP2Uninstall.exe
AIMP2 Skins Pack 29.09.07 (By YurCompMan)—>»C:Program FilesAIMP2unins000.exe»
ArtMoney SE v7.30.1—>»C:Program FilesArtMoneyUninstallunins000.exe»
avast! Antivirus—>C:Program FilesAvast4aswRunDll.exe «C:Program FilesAvast4Setupsetiface.dll»,RunSetup
BootSkin—>C:PROGRA~1StardockWINCUS~1BootSkinUNWISE.EXE C:PROGRA~1StardockWINCUS~1BootSkinINSTALL.LOG
CCleaner (remove only)—>»C:Program FilesCCleaneruninst.exe»
CheMax Rus 8.9—>»C:Program FilesCheMaxRusunins000.exe»
CPU-Z and GPU-Z—>C:Program FilesCPU-ZUninstall.exe
CursorXP—>C:Program FilesCursorXPCurXPUtil.exe -u
Dark Messiah —>D:GameSDARKME~1UNWISE.EXE D:GameSDARKME~1INSTALL.LOG
Dark Messiah —>D:GameSDarkMessiahunwise.exe
DirectX 10 NE (New Edition)—>»C:Program FilesCommon Filesunins000.exe»
Download Master version 5.5.14.1175—>»C:Program FilesDownload Masterunins000.exe»
EB Documentation 1.1—>»C:Program FilesEB Documentationunins000.exe»
EB Trivial Script 0.125—>»C:Program FilesEBTrivialScriptunins000.exe»
Europa Barbarorum 1.1—>»C:Program FilesRome — Total Warunins001.exe»
Europa Barbarorum 1.2—>»C:Program FilesRome — Total Warunins002.exe»
Flora Enhancement Mod 1.2—>C:Program FilesMount and Bladeflorauninst.exe
Foxit Reader 3.0 Build 1122—>C:Program FilesFoxit ReaderUninstall.exe
Gothic 3 — Forsaken Gods—>»D:GameSGothic 3 — Forsaken Godsunins000.exe»
Gothic III—>»D:GameSGothic IIIunins000.exe»
Graphical Enhancement Resources 2.5—>C:Program FilesMount and Bladeuninstall_commonres_pack.exe
Graphical Enhancement Textures 2.5—>C:Program FilesMount and Bladeuninstall_texture_pack.exe
Haunted House Premium Screen Saver—>»C:PROGRA~1Freeze.comHaunted House PremiumUNINSTAL.EXE»
HijackThis 2.0.2—>»C:Program Filestrend microHijackThis.exe» /uninstall
Java(TM) 6 Update 11—>MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216011FF}
K-Lite Mega Codec Pack 4.4.2—>»C:Program FilesK-Lite Codec Packunins000.exe»
Mail.Ru Агент 5.5 (сборка 2842, для всех пользователей)—>C:Program FilesMail.RuAgentmagentsetup.exe -uninstalllm
Microsoft .NET Framework 1.1 Russian Language Pack—>MsiExec.exe /X{2BB372D9-52B4-410A-BC1A-FEAB63181EEF}
Microsoft .NET Framework 1.1—>msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1—>MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 2.0 Service Pack 1 Language Pack — RUS—>MsiExec.exe /I{34AB2437-1B34-3E2D-9DE8-3E2D35335B3F}
Microsoft .NET Framework 2.0 Service Pack 1—>MsiExec.exe /I{B508B3F1-A24A-32C0-B310-85786919EF28}
Microsoft .NET Framework 3.0 Service Pack 1 Language Pack — RUS—>MsiExec.exe /I{CFF15B94-E062-3701-869A-4CDF4590461E}
Microsoft .NET Framework 3.0 Service Pack 1—>MsiExec.exe /I{2BA00471-0328-3743-93BD-FA813353A783}
Microsoft .NET Framework 3.5 Language Pack — rus—>MsiExec.exe /I{95E44F11-19F0-39EA-A894-792E054AA1CF}
Microsoft .NET Framework 3.5—>C:WINDOWSMicrosoft.NETFrameworkv3.5Microsoft .NET Framework 3.5setup.exe
Microsoft .NET Framework 3.5—>MsiExec.exe /I{2FC099BD-AC9B-33EB-809C-D332E1B27C40}
Microsoft Games for Windows — LIVE Redistributable—>MsiExec.exe /X{D1B01DC9-CBAF-45F9-A387-7D00C11B630E}
Microsoft Office Access MUI (Russian) 2007—>MsiExec.exe /X{90120000-0015-0419-0000-0000000FF1CE}
Microsoft Office Enterprise 2007—>»C:Program FilesCommon FilesMicrosoft SharedOFFICE12Office Setup Controllersetup.exe» /uninstall ENTERPRISE /dll OSETUP.DLL
Microsoft Office Enterprise 2007—>MsiExec.exe /X{90120000-0030-0000-0000-0000000FF1CE}
Microsoft Office Excel MUI (Russian) 2007—>MsiExec.exe /X{90120000-0016-0419-0000-0000000FF1CE}
Microsoft Office Groove MUI (Russian) 2007—>MsiExec.exe /X{90120000-00BA-0419-0000-0000000FF1CE}
Microsoft Office InfoPath MUI (Russian) 2007—>MsiExec.exe /X{90120000-0044-0419-0000-0000000FF1CE}
Microsoft Office OneNote MUI (Russian) 2007—>MsiExec.exe /X{90120000-00A1-0419-0000-0000000FF1CE}
Microsoft Office Outlook MUI (Russian) 2007—>MsiExec.exe /X{90120000-001A-0419-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (Russian) 2007—>MsiExec.exe /X{90120000-0018-0419-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007—>MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (German) 2007—>MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE}
Microsoft Office Proof (Russian) 2007—>MsiExec.exe /X{90120000-001F-0419-0000-0000000FF1CE}
Microsoft Office Proof (Ukrainian) 2007—>MsiExec.exe /X{90120000-001F-0422-0000-0000000FF1CE}
Microsoft Office Proofing (Russian) 2007—>MsiExec.exe /X{90120000-002C-0419-0000-0000000FF1CE}
Microsoft Office Publisher MUI (Russian) 2007—>MsiExec.exe /X{90120000-0019-0419-0000-0000000FF1CE}
Microsoft Office Shared MUI (Russian) 2007—>MsiExec.exe /X{90120000-006E-0419-0000-0000000FF1CE}
Microsoft Office Word MUI (Russian) 2007—>MsiExec.exe /X{90120000-001B-0419-0000-0000000FF1CE}
Microsoft Visual C++ 2005 Redistributable—>MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Visual C++ 2005 Redistributable—>MsiExec.exe /X{A49F249F-0C91-497F-86DF-B2585E8E76B7}
Microsoft Visual C++ 2008 Redistributable — x86 9.0.21022—>MsiExec.exe /X{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}
Mount and Blade—>»C:Program FilesMount and Bladeunins000.exe»
Mozilla Firefox (3.0.10)—>C:Program FilesMozilla Firefoxuninstallhelper.exe
MSXML 4.0 SP2 (KB954430)—>MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
NVIDIA Drivers—>C:WINDOWSsystem32nvuninst.exe UninstallGUI
NVIDIA nView Desktop Manager—>C:Program FilesNVIDIA CorporationnViewnViewSetup.exe -uninstall
NVIDIA PhysX—>MsiExec.exe /X{C5C1C0F0-D62F-4DBF-81D4-D7EF397C228B}
OpenAL—>»C:Program FilesOpenALoalinst.exe» /U
Opera 10.01—>MsiExec.exe /X{4B296228-DF7C-43EA-8DED-76027355B219}
Paint.NET v 3.36—>rundll32.exe advpack.dll,LaunchINFSection PaintDN.inf,Uninstall
Partisan—>»D:GameSPartisanunins000.exe»
RAR Recovery Toolbox 1.1—>»C:Program FilesRAR Recovery Toolboxunins000.exe»
RAR Recovery Toolbox 1.1—>»C:Program FilesRAR Recovery Toolboxunins001.exe»
Recruitment Viewer 0.9—>»C:Program FilesRecruitment Viewerunins000.exe»
Rise of the Argonauts—>»D:GameSRise of the Argonautsunins000.exe»
Rome — Total War + BI + Alexander—>»C:Program FilesRome — Total Warunins000.exe»
Rus XIII Century 0.401—>C:Program FilesMount and BladeModulesRus XIIIuninst.exe
S.T.A.L.K.E.R. — Clear Sky—>D:GameSSTALKE~1.RCLUNWISE.EXE D:GameSSTALKE~1.RCLINSTALL.LOG
S.T.A.L.K.E.R. — Зов Припяти—>»D:GameSS.T.A.L.K.E.R. — Зов Припятиunins000.exe»
Samurai Warriors 2—>»D:GameSSamurai Warriors 2unins000.exe»
Shogun Total War Rus—>»D:GameSShogun Total WarUninstall.exe» «D:GameSShogun Total Warinstall.log»
System Requirements Lab—>C:Program FilesSystemRequirementsLabUninstall.exe
Takeda—>D:GameSTakedaunins000.exe
thriXXX VirtuallyJenna2-054.002—>»C:Program FilesthriXXXVirtuallyJenna 2 — ForeverBinariesUninstall-VirtuallyJenna2-Forever-054.002.exe»
Uninstall Tool 2.6.3.4081—>»C:Program FilesUninstall Toolunins000.exe»
Update for 2007 Microsoft Office System (KB967642)—>msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {C444285D-5E4F-48A4-91DD-47AAAA68E92D}
Update for Outlook 2007 Junk Email Filter (kb968503)—>msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {5DD98950-4D10-4B79-8BF6-59726705207D}
uTorrent 1.8.1 b12639 —>»C:Program FilesuTorrentuninstall.exe» uTorrent
VirtuallyJenna-2.017.002 (Cracked)—>MsiExec.exe /I{9AB77E48-5BAF-4EBA-A88B-40CAF43F237E}
Vista Drive Icon—>rundll32.exe advpack.dll,LaunchINFSection C:WINDOWSINFVistaDrv.inf,Uninstall
XML Paper Specification Shared Components Language Pack 1.0—>»C:WINDOWS$NtUninstallXPSEPSCLP$spuninstspuninst.exe»
Архиватор WinRAR—>C:Program FilesWinRARuninstall.exe
Билайн Интернет Дома—>C:Program FilesБилайн Интернет Домаuninst.exe
Боковая панель Windows—>rundll32.exe advpack.dll,LaunchINFSection C:WINDOWSINFSidebar.inf,DefaultUnInstall
Пакет обеспечения совместимости для выпуска 2007 системы Microsoft Office—>MsiExec.exe /X{90120000-0020-0419-0000-0000000FF1CE}
Языковой пакет Microsoft .NET Framework 3.5 — RUS—>C:WINDOWSMicrosoft.NETFrameworkv3.5Microsoft .NET Framework 3.5 Language Pack — russetup.exe
Яндекс.Бар 4.2 для Internet Explorer—>MsiExec.exe /X{6740F9E3-1353-47DD-9765-BA49FC4C3479}======Hosts File======
127.0.0.1 mpa.one.microsoft.com
======Security center information======
AV: avast! antivirus 4.8.1356 [VPS 091102-0]
======System event log======
Computer Name: MICROSOF-D3F51A
Event Code: 6009
Message: Microsoft (R) Windows 2000 (R) 5.01. 2600 Service Pack 3 Multiprocessor Free.Record Number: 155
Source Name: EventLog
Time Written: 20090928160141.000000+240
Event Type: информация
User:Computer Name: MICROSOF-D3F51A
Event Code: 6006
Message: Служба журнала событий остановлена.Record Number: 154
Source Name: EventLog
Time Written: 20090927103907.000000+240
Event Type: информация
User:Computer Name: MICROSOF-D3F51A
Event Code: 7036
Message: Служба «.NET Runtime Optimization Service v2.0.50727_X86» перешла в состояние Остановлена.Record Number: 153
Source Name: Service Control Manager
Time Written: 20090927103726.000000+240
Event Type: информация
User:Computer Name: MICROSOF-D3F51A
Event Code: 7036
Message: Служба «Служба COM записи компакт-дисков IMAPI» перешла в состояние Остановлена.Record Number: 152
Source Name: Service Control Manager
Time Written: 20090927103114.000000+240
Event Type: информация
User:Computer Name: MICROSOF-D3F51A
Event Code: 7036
Message: Служба «Служба COM записи компакт-дисков IMAPI» перешла в состояние Работает.Record Number: 151
Source Name: Service Control Manager
Time Written: 20090927103114.000000+240
Event Type: информация
User:=====Application event log=====
Computer Name: SARKEL
Event Code: 1033
Message: Установщик Windows выполнил установку продукта. Продукт: VirtuallyJenna-2.017.002 (Cracked). Версия: 1.0.0. Язык: 0. Установка завершена с состоянием: 0.Record Number: 627
Source Name: MsiInstaller
Time Written: 20091016011020.000000+240
Event Type: информация
User: SARKEL†SarKel†Computer Name: SARKEL
Event Code: 11707
Message: Продукт: VirtuallyJenna-2.017.002 (Cracked) — Установка завершена успешно.Record Number: 626
Source Name: MsiInstaller
Time Written: 20091016011020.000000+240
Event Type: информация
User: SARKEL†SarKel†Computer Name: SARKEL
Event Code: 1042
Message: Завершение транзакции установщика Windows: C:DOCUME~1SARKEL~1LOCALS~1TempRarSFX1VirtuallyJenna-2.017.002-cracked-installer.msi. ИД клиентского процесса: 3880.Record Number: 625
Source Name: MsiInstaller
Time Written: 20091016011017.000000+240
Event Type: информация
User: NT AUTHORITYSYSTEMComputer Name: SARKEL
Event Code: 1040
Message: Начата транзакция установщика Windows: C:DOCUME~1SARKEL~1LOCALS~1TempRarSFX1VirtuallyJenna-2.017.002-cracked-installer.msi. ИД клиентского процесса: 3880.Record Number: 624
Source Name: MsiInstaller
Time Written: 20091016011015.000000+240
Event Type: информация
User: SARKEL†SarKel†Computer Name: SARKEL
Event Code: 4097
Message: Приложение D:GameSDarkMessiahmm.exe вызвало ошибку
Ошибка в 11/10/2009 @ 22:03:31.093
Вызвано исключение c0000005 по адресу 01BC9737 (datacache)Record Number: 623
Source Name: DrWatson
Time Written: 20091011220331.000000+240
Event Type: информация
User:======Environment variables======
«ComSpec»=%SystemRoot%system32cmd.exe
«Path»=%SystemRoot%system32;%SystemRoot%;%SystemRoot%System32Wbem
«windir»=%SystemRoot%
«FP_NO_HOST_CHECK»=NO
«OS»=Windows_NT
«PROCESSOR_ARCHITECTURE»=x86
«PROCESSOR_LEVEL»=6
«PROCESSOR_IDENTIFIER»=x86 Family 6 Model 15 Stepping 2, GenuineIntel
«PROCESSOR_REVISION»=0f02
«NUMBER_OF_PROCESSORS»=2
«PATHEXT»=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
«TEMP»=%SystemRoot%TEMP
«TMP»=%SystemRoot%TEMP
EOF
Logfile of random’s system information tool 1.06 (written by random/random)
Run by †SarKel† at 2009-11-03 03:44:17
Microsoft Windows XP Professional Service Pack 3
System drive C: has 56 GB (56%) free of 100 GB
Total RAM: 2047 MB (76% free)Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:44:20, on 03.11.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20935)
Boot mode: NormalRunning processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32nvsvc32.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:Program FilesABBYY FineReader 9.0NetworkLicenseServer.exe
C:Program FilesCommon FilesDoctor WebScanning Enginedwengine.exe
C:Program FilesJavajre6binjqs.exe
C:Program FilesCommon FilesMicrosoft SharedVS7DEBUGmdm.exe
C:PROGRA~1DrWebspidernt.exe
C:WINDOWSExplorer.EXE
C:Program FilesMail.RuAgentMAgent.exe
C:Program FilesDrWebSpIDerAgent.exe
C:Program FilesDrWebspiderml.exe
C:PROGRA~1DrWebspiderui.exe
C:WINDOWSsystem32wbemwmiapsrv.exe
C:WINDOWSsystem32ctfmon.exe
C:Program FilesVistaDriveIconVistaDrv.exe
C:Program FilesDownload Masterdmaster.exe
C:Program FilesБилайн Интернет ДомаBeeline Internet at Home.exe
C:Program FilesOperaopera.exe
C:DownloadsRSIT.exe
C:Program Filestrend micro†SarKel†.exeR1 — HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 — HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.apeha.ru
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 — HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 — HKLMSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant =
R0 — HKLMSoftwareMicrosoftInternet ExplorerSearch,CustomizeSearch =
R1 — HKCUSoftwareMicrosoftInternet Connection Wizard,ShellNext = http://www.zvercd.com/
R0 — HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Ссылки
R3 — URLSearchHook: (no name) — {83821C2B-32A8-4DD7-B6D4-44309A78E668} — C:Program FilesMail.RuAgentMradllnewmrasearch.dll
O2 — BHO: Groove GFS Browser Helper — {72853161-30C5-4D22-B7F9-0BBC1D38A37E} — C:Program FilesMicrosoft OfficeOffice12GrooveShellExtensions.dll
O2 — BHO: Java(tm) Plug-In SSV Helper — {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} — C:Program FilesJavajre6binssv.dll
O2 — BHO: IE 4.x-6.x BHO for Download Master — {9961627E-4059-41B4-8E0E-A7D6B3854ADF} — C:PROGRA~1DOWNLO~1dmiehlp.dll
O2 — BHO: Java(tm) Plug-In 2 SSV Helper — {DBC80044-A445-435b-BC74-9C25C1C588A9} — C:Program FilesJavajre6binjp2ssv.dll
O2 — BHO: JQSIEStartDetectorImpl — {E7E6F031-17CE-4C07-BC86-EABFE594F69C} — C:Program FilesJavajre6libdeployjqsiejqs_plugin.dll
O3 — Toolbar: Яндекс.Бар — {91397D20-1446-11D4-8AF4-0040CA1127B6} — C:Program FilesYandexYandexBarIEyndbar.dll
O3 — Toolbar: DM Bar — {0E1230F8-EA50-42A9-983C-D22ABC2EED3C} — C:Program FilesDownload Masterdmbar.dll
O4 — HKLM..Run: [nwiz] C:Program FilesNVIDIA CorporationnViewnwiz.exe /install
O4 — HKLM..Run: [BootSkin Startup Jobs] «C:Program FilesStardockWinCustomizeBootSkinBootSkin.exe» /StartupJobs
O4 — HKLM..Run: [MAgent] C:Program FilesMail.RuAgentMAgent.exe -LM
O4 — HKLM..Run: [SpIDerAgent] «C:Program FilesDrWebSpIDerAgent.exe»
O4 — HKLM..Run: [SpIDerMail] «C:Program FilesDrWebspiderml.exe»
O4 — HKLM..Run: [SpIDerNT] C:PROGRA~1DrWebspiderui.exe /agent
O4 — HKLM..Run: [NvMediaCenter] RUNDLL32.EXE C:WINDOWSsystem32NvMcTray.dll,NvTaskbarInit
O4 — HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSsystem32NvCpl.dll,NvStartup
O4 — HKCU..Run: [CTFMON.EXE] C:WINDOWSsystem32ctfmon.exe
O4 — HKCU..Run: [VistaIcon] C:Program FilesVistaDriveIconVistaDrv.exe
O4 — HKCU..Run: [Download Master] C:Program FilesDownload Masterdmaster.exe -autorun
O4 — HKUSS-1-5-19..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘LOCAL SERVICE’)
O4 — HKUSS-1-5-19..Run: [VistaIcon] C:Program FilesVistaDriveIconVistaDrv.exe (User ‘LOCAL SERVICE’)
O4 — HKUSS-1-5-19..RunOnce: [ZZZZ1_FirstLogonSetting] %SystemRoot%System32rundll32.exe advpack.dll,LaunchINFSection C:WINDOWSINFcustom.inf,OnceFirstLogonInstall,0 (User ‘LOCAL SERVICE’)
O4 — HKUSS-1-5-19..RunOnce: [IE7_012] rundll32 advpack.dll,LaunchINFSectionEx IE7int.inf,AfterUserStart,,4,N (User ‘LOCAL SERVICE’)
O4 — HKUSS-1-5-20..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘NETWORK SERVICE’)
O4 — HKUSS-1-5-20..RunOnce: [ZZZZ1_FirstLogonSetting] %SystemRoot%System32rundll32.exe advpack.dll,LaunchINFSection C:WINDOWSINFcustom.inf,OnceFirstLogonInstall,0 (User ‘NETWORK SERVICE’)
O4 — HKUSS-1-5-18..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘SYSTEM’)
O4 — HKUSS-1-5-18..RunOnce: [ZZZZ2_FirstLogonSetting] %SystemRoot%System32rundll32.exe advpack.dll,LaunchINFSection C:WINDOWSINFcustom.inf,NewUserFirstLogonInstall,0 (User ‘SYSTEM’)
O4 — HKUS.DEFAULT..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘Default user’)
O4 — HKUS.DEFAULT..RunOnce: [ZZZZ2_FirstLogonSetting] %SystemRoot%System32rundll32.exe advpack.dll,LaunchINFSection C:WINDOWSINFcustom.inf,NewUserFirstLogonInstall,0 (User ‘Default user’)
O8 — Extra context menu item: &Экспорт в Microsoft Excel — res://C:PROGRA~1MICROS~1Office12EXCEL.EXE/3000
O8 — Extra context menu item: Закачать ВСЕ при помощи Download Master — C:Program FilesDownload Masterdmieall.htm
O8 — Extra context menu item: Закачать при помощи Download Master — C:Program FilesDownload Masterdmie.htm
O8 — Extra context menu item: Передать на удаленную закачку DM — C:Program FilesDownload Masterremdown.htm
O9 — Extra button: Отправить в OneNote — {2670000A-7350-4f3c-8081-5663EE0C6C49} — C:PROGRA~1MICROS~1Office12ONBttnIE.dll
O9 — Extra ‘Tools’ menuitem: &Отправить в OneNote — {2670000A-7350-4f3c-8081-5663EE0C6C49} — C:PROGRA~1MICROS~1Office12ONBttnIE.dll
O9 — Extra button: Mail.Ru Агент — {7558B7E5-7B26-4201-BEDB-00D5FF534523} — C:Program FilesMail.RuAgentmagent.exe
O9 — Extra ‘Tools’ menuitem: Mail.Ru Агент — {7558B7E5-7B26-4201-BEDB-00D5FF534523} — C:Program FilesMail.RuAgentmagent.exe
O9 — Extra button: Download Master — {8DAE90AD-4583-4977-9DD4-4360F7A45C74} — C:Program FilesDownload Masterdmaster.exe
O9 — Extra ‘Tools’ menuitem: &Download Master — {8DAE90AD-4583-4977-9DD4-4360F7A45C74} — C:Program FilesDownload Masterdmaster.exe
O9 — Extra button: Research — {92780B25-18CC-41C8-B9BE-3C9C571A8263} — C:PROGRA~1MICROS~1Office12REFIEBAR.DLL
O9 — Extra button: (no name) — {e2e2dd38-d088-4134-82b7-f2ba38496583} — C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O9 — Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 — {e2e2dd38-d088-4134-82b7-f2ba38496583} — C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O17 — HKLMSystemCCSServicesTcpip..{2C010018-9E22-4982-A315-9A744C60BE9E}: NameServer = 217.118.66.243 194.67.1.154
O17 — HKLMSystemCS2ServicesTcpip..{2C010018-9E22-4982-A315-9A744C60BE9E}: NameServer = 217.118.66.243 194.67.1.154
O18 — Protocol: grooveLocalGWS — {88FED34C-F0CA-4636-A375-3CB6248B04CD} — C:Program FilesMicrosoft OfficeOffice12GrooveSystemServices.dll
O23 — Service: ABBYY FineReader 9.0 Licensing Service (ABBYY.Licensing.FineReader.Professional.9.0) — ABBYY (BIT Software) — C:Program FilesABBYY FineReader 9.0NetworkLicenseServer.exe
O23 — Service: Application Driver Auto Removal Service (01) (appdrvrem01) — Protection Technology — C:WINDOWSSystem32appdrvrem01.exe
O23 — Service: Dr.Web Scanning Engine (DrWebEngine) (DrWebEngine) — Doctor Web, Ltd. — C:Program FilesCommon FilesDoctor WebScanning Enginedwengine.exe
O23 — Service: Журнал событий (Eventlog) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: Служба COM записи компакт-дисков IMAPI (ImapiService) — Корпорация Майкрософт — C:WINDOWSsystem32imapi.exe
O23 — Service: Java Quick Starter (JavaQuickStarterService) — Sun Microsystems, Inc. — C:Program FilesJavajre6binjqs.exe
O23 — Service: NVIDIA Display Driver Service (NVSvc) — NVIDIA Corporation — C:WINDOWSsystem32nvsvc32.exe
O23 — Service: Plug and Play (PlugPlay) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: Диспетчер сеанса справки для удаленного рабочего стола (RDSessMgr) — Корпорация Майкрософт — C:WINDOWSsystem32sessmgr.exe
O23 — Service: Смарт-карты (SCardSvr) — Корпорация Майкрософт — C:WINDOWSSystem32SCardSvr.exe
O23 — Service: SpIDer Guard for Windows (SPIDERNT) — Doctor Web, Ltd. — C:PROGRA~1DrWebspidernt.exe
O23 — Service: Журналы и оповещения производительности (SysmonLog) — Корпорация Майкрософт — C:WINDOWSsystem32smlogsvc.exe
O23 — Service: Теневое копирование тома (VSS) — Корпорация Майкрософт — C:WINDOWSSystem32vssvc.exe
O23 — Service: Адаптер производительности WMI (WmiApSrv) — Корпорация Майкрософт — C:WINDOWSsystem32wbemwmiapsrv.exe—
End of file — 9295 bytes======Scheduled tasks folder======
C:WINDOWStasksDr.Web Daily scan.job
C:WINDOWStasksDr.Web Update.job
C:WINDOWStasksSystem Check.job======Registry dump======
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper — C:Program FilesMicrosoft OfficeOffice12GrooveShellExtensions.dll [2009-02-12 2217848][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper — C:Program FilesJavajre6binssv.dll [2009-09-27 320920][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{9961627E-4059-41B4-8E0E-A7D6B3854ADF}]
IE 4.x-6.x BHO for Download Master — C:PROGRA~1DOWNLO~1dmiehlp.dll [2009-04-16 158208][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper — C:Program FilesJavajre6binjp2ssv.dll [2009-09-27 34816][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class — C:Program FilesJavajre6libdeployjqsiejqs_plugin.dll [2009-09-27 73728][HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
{91397D20-1446-11D4-8AF4-0040CA1127B6} — Яндекс.Бар — C:Program FilesYandexYandexBarIEyndbar.dll [2009-07-24 5586208]
{0E1230F8-EA50-42A9-983C-D22ABC2EED3C} — DM Bar — C:Program FilesDownload Masterdmbar.dll [2007-11-26 180224][HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun]
«nwiz»=C:Program FilesNVIDIA CorporationnViewnwiz.exe [2009-08-12 1657376]
«BootSkin Startup Jobs»=C:Program FilesStardockWinCustomizeBootSkinBootSkin.exe [2006-10-31 183808]
«MAgent»=C:Program FilesMail.RuAgentMAgent.exe [2009-10-09 7975608]
«SpIDerAgent»=C:Program FilesDrWebSpIDerAgent.exe [2009-06-01 447728]
«SpIDerMail»=C:Program FilesDrWebspiderml.exe [2009-06-30 644336]
«SpIDerNT»=C:PROGRA~1DrWebspiderui.exe [2009-08-17 231840]
«NvMediaCenter»=C:WINDOWSsystem32NvMcTray.dll [2009-08-17 86016]
«NvCplDaemon»=C:WINDOWSsystem32NvCpl.dll [2009-08-17 13877248][HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=C:WINDOWSsystem32ctfmon.exe [2008-12-25 30208]
«VistaIcon»=C:Program FilesVistaDriveIconVistaDrv.exe [2008-01-02 132096]
«Download Master»=C:Program FilesDownload Masterdmaster.exe [2009-10-02 3779072][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad]
WPDShServiceObj — {AAA288BA-9A4C-45B0-95D7-94D524869DB5} — C:WINDOWSsystem32wpdshserviceobj.dll [2008-03-02 133632][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerShellExecuteHooks]
«{B5A7F190-DDA6-4420-B3BA-52453494E6CD}»=C:Program FilesMicrosoft OfficeOffice12GrooveShellExtensions.dll [2009-02-12 2217848][HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
«dontdisplaylastusername»=0
«legalnoticecaption»=
«legalnoticetext»=
«shutdownwithoutlogon»=1
«undockwithoutlogon»=1[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoDriveTypeAutoRun»=145
«NoSharedDocuments»=1
«NoSMConfigurePrograms»=1[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicystandardprofileauthorizedapplicationslist]
«%windir%Network Diagnosticxpnetdiag.exe»=»%windir%Network Diagnosticxpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000»
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicydomainprofileauthorizedapplicationslist]
«%windir%Network Diagnosticxpnetdiag.exe»=»%windir%Network Diagnosticxpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000»
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{22e45238-ac54-11de-add4-00248c00e15b}]
shellAutoRuncommand — K:AutoRun.exe======List of files/folders created in the last 1 months======
2009-11-03 03:15:00 —-D—- C:WINDOWSpss
2009-11-03 01:55:20 —-D—- C:Program FilesCommon FilesDoctor Web
2009-11-03 01:55:19 —-D—- C:Documents and SettingsAll UsersApplication DataDoctor Web
2009-11-03 01:55:18 —-D—- C:Program FilesDrWeb
2009-11-03 01:11:53 —-D—- C:Program Filestrend micro
2009-11-03 01:11:51 —-D—- C:rsit
2009-11-02 17:23:20 —-D—- C:Documents and SettingsAll UsersApplication DataCrystalIdea Software
2009-11-02 04:53:20 —-A—- C:WINDOWSsystem32syschk32.exe
2009-11-02 04:53:20 —-A—- C:WINDOWSsystem32el32.dll
2009-11-01 01:04:12 —-D—- C:Program FilesRome — Total War
2009-10-31 08:51:56 —-D—- C:Program FilesEB Documentation
2009-10-31 08:51:49 —-D—- C:Program FilesRecruitment Viewer
2009-10-31 08:51:49 —-D—- C:Documents and Settings†SarKel†Application DataRecruitment Viewer
2009-10-31 08:51:34 —-D—- C:Program FilesEBTrivialScript
2009-10-26 07:08:14 —-D—- C:Rome — Total War
2009-10-25 19:11:31 —-D—- C:Documents and Settings†SarKel†Application DataXRay Engine
2009-10-24 19:50:47 —-A—- C:WINDOWSsystem32appdrvrem01.exe
2009-10-24 15:50:59 —-D—- C:Documents and Settings†SarKel†Application DataPartisan
2009-10-24 14:56:15 —-D—- C:Program FilesM&BMapEditor
2009-10-19 13:11:34 —-D—- C:Program FilesMount and Blade
2009-10-17 20:58:37 —-D—- C:Program FilesMount&Blade
2009-10-17 13:55:35 —-D—- C:Documents and Settings†SarKel†Application DataMount&Blade
2009-10-17 06:02:13 —-D—- C:Documents and Settings†SarKel†Application DataMedia Player Classic
2009-10-16 13:45:22 —-D—- C:Program FilesCursors
2009-10-16 00:10:16 —-D—- C:Program FilesthriXXX
2009-10-15 23:14:00 —-N—- C:WINDOWSSetup1.exe
2009-10-15 23:13:58 —-A—- C:WINDOWSST6UNST.EXE
2009-10-11 01:05:59 —-RHD—- C:Documents and Settings†SarKel†Application DataSecuROM
2009-10-11 01:03:22 —-D—- C:Documents and Settings†SarKel†Application DataInstallShield
2009-10-09 23:33:29 —-D—- C:Documents and Settings†SarKel†Application DataMra
2009-10-09 23:33:11 —-D—- C:Program FilesMail.Ru
2009-10-09 00:58:16 —-A—- C:WINDOWSsystem32CmdLineExt.dll
2009-10-08 19:52:20 —-D—- C:Documents and Settings†SarKel†Application DataTuneUp Software
2009-10-08 19:42:17 —-D—- C:Program FilesStardock
2009-10-08 19:42:17 —-D—- C:Program FilesCommon FilesStardock
2009-10-07 15:24:13 —-D—- C:BP
2009-10-07 06:47:26 —-A—- C:WINDOWSsystem32Vista.Emulation.dll
2009-10-07 06:47:26 —-A—- C:WINDOWSsystem32msvcrtnew.dll
2009-10-07 06:47:26 —-A—- C:WINDOWSsystem32msjava.dll
2009-10-07 06:47:26 —-A—- C:WINDOWSsystem32M2000Twn.dll
2009-10-07 06:47:26 —-A—- C:WINDOWSsystem32glut32.dll
2009-10-07 06:47:26 —-A—- C:WINDOWSsystem32glut.dll
2009-10-07 06:47:26 —-A—- C:WINDOWSsystem32dxgi.dll
2009-10-07 06:47:26 —-A—- C:WINDOWSsystem32dwmapi.dll
2009-10-07 06:47:26 —-A—- C:WINDOWSsystem32d3d10core.dll
2009-10-07 06:47:26 —-A—- C:WINDOWSsystem32d3d10.dll
2009-10-07 06:47:25 —-D—- C:Program FilesKM-Software
2009-10-07 06:47:25 —-A—- C:WINDOWSsystem32D3D10SDKLayers.DLL
2009-10-07 06:47:25 —-A—- C:WINDOWSsystem32d2d1.dll
2009-10-07 06:47:25 —-A—- C:WINDOWSsystem32CompressATI2.dll
2009-10-07 06:47:25 —-A—- C:WINDOWSsystem32avrt.dll
2009-10-07 06:47:25 —-A—- C:Program FilesCommon Filesunins000.exe
2009-10-06 07:09:14 —-D—- C:Program FilesGSC World Publishing
2009-10-06 07:04:35 —-D—- C:STALSTCS
2009-10-06 07:04:35 —-A—- C:Program Filesdaemon4301-lite.exe
2009-10-06 07:04:28 —-D—- C:Program FilesDirectX
2009-10-06 07:04:26 —-D—- C:Program FilesOpenAL
2009-10-06 07:04:09 —-A—- C:WINDOWSsystem32xmlinst.exe
2009-10-06 07:04:08 —-A—- C:WINDOWSsystem32vp6vfw.dll
2009-10-06 07:04:08 —-A—- C:WINDOWSsystem32vp6install.exe
2009-10-06 07:04:06 —-N—- C:WINDOWSsystem32msvcr80.dll
2009-10-06 07:04:06 —-A—- C:WINDOWSsystem32Vb5db.dll
2009-10-06 07:04:06 —-A—- C:WINDOWSsystem32msxml4a.dll
2009-10-06 07:04:06 —-A—- C:WINDOWSsystem32msxml3a.dll
2009-10-06 07:04:05 —-N—- C:WINDOWSsystem32msvcp80.dll
2009-10-06 07:04:05 —-A—- C:WINDOWSsystem32msvcr71d.dll
2009-10-06 07:04:05 —-A—- C:WINDOWSsystem32msvcr70d.dll
2009-10-06 07:04:05 —-A—- C:WINDOWSsystem32msvcp71d.dll
2009-10-06 07:04:04 —-N—- C:WINDOWSsystem32msvcm80.dll
2009-10-06 07:04:04 —-A—- C:WINDOWSsystem32msvcp70d.dll
2009-10-06 07:04:04 —-A—- C:WINDOWSsystem32Msvcp60d.dll
2009-10-06 07:04:04 —-A—- C:WINDOWSsystem32msvci70d.dll
2009-10-06 07:04:02 —-A—- C:WINDOWSsystem32mfcm80u.dll
2009-10-06 07:04:02 —-A—- C:WINDOWSsystem32mfcm80.dll
2009-10-06 07:04:02 —-A—- C:WINDOWSsystem32mfc80u.dll
2009-10-06 07:04:02 —-A—- C:WINDOWSsystem32mfc80.dll
2009-10-06 07:04:01 —-A—- C:WINDOWSsystem32eax.dll
2009-10-06 07:04:01 —-A—- C:WINDOWSsystem32Cc3250mt.dll
2009-10-06 07:04:00 —-A—- C:WINDOWSsystem32xmltok.dll
2009-10-06 07:04:00 —-A—- C:WINDOWSsystem32xmlparse.dll
2009-10-06 07:04:00 —-A—- C:WINDOWSsystem32Borlndmm.dll
2009-10-06 07:02:28 —-D—- C:WINDOWSsystem32xlive======List of files/folders modified in the last 1 months======
2009-11-03 03:44:09 —-A—- C:WINDOWSModemLog_HUAWEI Mobile Connect — 3G Modem #2.txt
2009-11-03 03:19:21 —-SH—- C:boot.ini
2009-11-03 03:19:21 —-A—- C:WINDOWSwin.ini
2009-11-03 03:19:21 —-A—- C:WINDOWSsystem.ini
2009-11-03 03:15:00 —-D—- C:WINDOWS
2009-11-03 02:03:54 —-D—- C:WINDOWSsystem32CatRoot2
2009-11-03 02:03:48 —-D—- C:WINDOWSTemp
2009-11-03 02:03:14 —-D—- C:Program FilesAvast4
2009-11-03 02:02:26 —-A—- C:WINDOWSSchedLgU.Txt
2009-11-03 02:01:13 —-SHD—- C:WINDOWSInstaller
2009-11-03 01:55:26 —-D—- C:WINDOWSsystem32drivers
2009-11-03 01:55:25 —-SD—- C:WINDOWSTasks
2009-11-03 01:55:20 —-AD—- C:Program FilesCommon Files
2009-11-03 01:55:18 —-AD—- C:Program Files
2009-11-03 01:51:55 —-AD—- C:WINDOWSsystem32
2009-11-03 01:49:41 —-D—- C:Downloads
2009-11-03 01:01:51 —-D—- C:Documents and Settings†SarKel†Application DatauTorrent
2009-11-02 19:58:22 —-D—- C:WINDOWSMinidump
2009-11-02 02:22:05 —-D—- C:Program FilesOpera
2009-10-31 08:52:03 —-RSD—- C:WINDOWSFonts
2009-10-27 00:07:54 —-D—- C:Program FilesArtMoney
2009-10-25 12:27:38 —-A—- C:WINDOWSsystem32PerfStringBackup.INI
2009-10-23 16:18:54 —-SD—- C:Documents and Settings†SarKel†Application DataMicrosoft
2009-10-23 16:18:53 —-D—- C:Documents and SettingsAll UsersApplication DataMicrosoft Help
2009-10-17 12:56:27 —-HD—- C:WINDOWSinf
2009-10-17 12:56:00 —-RSD—- C:WINDOWSassembly
2009-10-17 12:55:27 —-D—- C:WINDOWSsystem32directx
2009-10-16 14:06:10 —-A—- C:WINDOWSavisplitter.ini
2009-10-10 20:10:10 —-SD—- C:Documents and SettingsAll UsersApplication DataMicrosoft
2009-10-09 00:46:12 —-RSHDC—- C:WINDOWSsystem32dllcache
2009-10-08 20:35:40 —-D—- C:WINDOWSWinSxS
2009-10-08 19:57:34 —-D—- C:WINDOWSsystem32config
2009-10-07 15:31:32 —-D—- C:Program FilesAIMP2
2009-10-06 07:04:25 —-N—- C:WINDOWSsystem32wrap_oal.dll
2009-10-06 07:04:25 —-N—- C:WINDOWSsystem32OpenAL32.dll
2009-10-04 01:22:54 —-D—- C:Program FilesDownload Master======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R1 appdrv01;Application Driver (01); C:WINDOWSSystem32Driversappdrv01.sys [2009-10-24 2997872]
R1 intelppm;Драйвер Intel процессора; C:WINDOWSsystem32DRIVERSintelppm.sys [2008-04-15 40704]
R1 WS2IFSL;Среда Windows Socket 2.0 поддержки поставщиков не-IFS служб; C:WINDOWSSystem32driversws2ifsl.sys [2008-04-15 12032]
R2 rspndr;Ответчик обнаружения топологии уровня связи; C:WINDOWSsystem32DRIVERSrspndr.sys [2008-10-11 62848]
R2 SPIDER;SpIDer Guard File System Monitor; ??C:PROGRA~1DrWebspider.sys []
R3 HdAudAddService;VIA High Definition Audio Service; C:WINDOWSsystem32driversviahdb.sys [2007-08-17 203520]
R3 HDAudBus;Драйвер шины Microsoft UAA для High Definition Audio; C:WINDOWSsystem32DRIVERSHDAudBus.sys [2008-04-15 144384]
R3 HidUsb;Драйвер класса HID Microsoft; C:WINDOWSsystem32DRIVERShidusb.sys [2008-04-13 10368]
R3 hwdatacard;Huawei DataCard USB Modem and USB Serial; C:WINDOWSsystem32DRIVERSewusbmdm.sys [2008-09-26 101376]
R3 mouhid;Драйвер мыши HID; C:WINDOWSsystem32DRIVERSmouhid.sys [2001-10-19 12160]
R3 MTsensor;ATK0110 ACPI UTILITY; C:WINDOWSsystem32DRIVERSASACPI.sys [2006-02-26 5810]
R3 nv;nv; C:WINDOWSsystem32DRIVERSnv4_mini.sys [2009-08-16 7729568]
R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; C:WINDOWSsystem32DRIVERSRtenicxp.sys [2008-10-31 117888]
R3 usbccgp;Драйвер универсального родительского устройства USB (Microsoft); C:WINDOWSsystem32DRIVERSusbccgp.sys [2008-04-13 32128]
R3 usbehci;Драйвер минипорта Microsoft USB 2.0 расширенного хост-контроллера; C:WINDOWSsystem32DRIVERSusbehci.sys [2008-04-15 30208]
R3 usbhub;USB2 концентратор; C:WINDOWSsystem32DRIVERSusbhub.sys [2008-04-14 59520]
R3 usbstor;Драйвер запоминающих устройств для USB; C:WINDOWSsystem32DRIVERSUSBSTOR.SYS [2008-04-15 26368]
R3 usbuhci;Драйвер минипорта Microsoft USB универсального хост-контроллера; C:WINDOWSsystem32DRIVERSusbuhci.sys [2008-04-14 20608]
S3 akdzd459;akdzd459; C:WINDOWSsystem32driversakdzd459.sys []
S3 WudfPf;Windows Driver Foundation — User-mode Driver Framework Platform Driver; C:WINDOWSsystem32DRIVERSWudfPf.sys [2008-03-02 77568]
S3 WudfRd;Windows Driver Foundation — User-mode Driver Framework Reflector; C:WINDOWSsystem32DRIVERSwudfrd.sys [2008-03-02 82944]
S4 IntelIde;IntelIde; C:WINDOWSsystem32driversIntelIde.sys []======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 ABBYY.Licensing.FineReader.Professional.9.0;ABBYY FineReader 9.0 Licensing Service; C:Program FilesABBYY FineReader 9.0NetworkLicenseServer.exe [2007-11-02 566560]
R2 DrWebEngine;Dr.Web Scanning Engine (DrWebEngine); C:Program FilesCommon FilesDoctor WebScanning Enginedwengine.exe [2009-09-22 869688]
R2 JavaQuickStarterService;Java Quick Starter; C:Program FilesJavajre6binjqs.exe [2009-09-27 152984]
R2 MDM;Machine Debug Manager; C:Program FilesCommon FilesMicrosoft SharedVS7DEBUGmdm.exe [2006-10-26 335872]
R2 NVSvc;NVIDIA Display Driver Service; C:WINDOWSsystem32nvsvc32.exe [2009-08-17 168004]
R2 SPIDERNT;SpIDer Guard for Windows; C:PROGRA~1DrWebspidernt.exe [2009-08-17 231328]
S2 appdrvrem01;Application Driver Auto Removal Service (01); C:WINDOWSSystem32appdrvrem01.exe [2009-10-24 316816]
S3 aspnet_state;ASP.NET State Service; C:WINDOWSMicrosoft.NETFrameworkv2.0.50727aspnet_state.exe [2007-10-24 33800]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:WINDOWSMicrosoft.NETFrameworkv2.0.50727mscorsvw.exe [2007-10-24 70144]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:WINDOWSMicrosoft.NetFrameworkv3.0WPFPresentationFontCache.exe [2007-10-09 36864]
S3 idsvc;Windows CardSpace; C:WINDOWSMicrosoft.NETFrameworkv3.0Windows Communication Foundationinfocard.exe [2007-10-11 864256]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:Program FilesMicrosoft OfficeOffice12GrooveAuditService.exe [2008-10-25 65888]
S3 odserv;Microsoft Office Diagnostics Service; C:Program FilesCommon FilesMicrosoft SharedOFFICE12ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:Program FilesCommon FilesMicrosoft SharedSource EngineOSE.EXE [2006-10-26 145184]
S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:Program FilesWindows Media Playerwmpnetwk.exe [2006-10-18 913408]
S3 WudfSvc;Windows Driver Foundation — User-mode Driver Framework; C:WINDOWSsystem32svchost.exe [2008-04-15 14336]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:WINDOWSMicrosoft.NETFrameworkv3.0Windows Communication FoundationSMSvcHost.exe [2007-10-11 122880]
EOF
Прошу помочь мне. Баннер появляется даже когда нет подключения к интернету написанно что бы удалить его нужно отправить смс на номер 9800. Также при нажатии кнопки закрыть надо ждать 30сек ещё пытался отследить в диспечере задач, процессы, толку не дало!
хм заметил что если через диспечер задач закрыть explorer и потом через выполнить открыть, баннер не появляется
Здравствуйте, добро пожаловать на Spyware-ru форум.
Необходима дополнительная проверка.
Скачайте программу Combofix. Закройте все открытые окна и запустите эту программу.
После выполнения будет создан лог файл, пожалуйста вставьте его в ваш ответ.Примечание: перед использованием Combofix обязательно установите Recovery console. Как это сделать будет описано на странице, ссылку на которую я привёл выше.
- Для ответа в этой теме необходимо авторизоваться.
