- This topic has 8 ответов, 2 участника, and was last updated 16 years, 3 months назад by
.
-
Сообщения
-
здравствуйтеююю борюсь с такой же проблемой… нод постоянно удаляет его(начал удалять совсем недавно…. посмотрел по базе сигнатур… вирус внесли туда только в версии 3772 за 16.01.09) но он удалят и после буквально перезагрузки он снова появляется… собвствено вот лог программы RSIT.exe
Logfile of random’s system information tool 1.05 (written by random/random)
Run by adm at 2009-01-18 18:57:52
Microsoft Windows XP Professional Service Pack 3
System drive C: has 85 GB (85%) free of 100 GB
Total RAM: 3582 MB (71% free)HijackThis download failed
======Registry dump======
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper — C:PROGRA~1MICROS~2Office12GRA8E1~1.DLL [2006-10-27 2210608][HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun]
«SoundMAXPnP»=C:Program FilesAnalog DevicesCoresmax4pnp.exe [2006-12-19 868352]
«SoundMAX»=C:Program FilesAnalog DevicesSoundMAXSmax4.exe [2006-07-13 729088]
«JMB36X IDE Setup»=C:WINDOWSJMJMInsIDE.exe [2006-10-31 36864]
«36X Raid Configurer»=C:WINDOWSsystem32JMRaidSetup.exe [2006-11-16 1953792]
«NvCplDaemon»=C:WINDOWSsystem32NvCpl.dll [2007-09-17 8491008]
«nwiz»=nwiz.exe /install []
«NvMediaCenter»=C:WINDOWSsystem32NvMcTray.dll [2007-09-17 81920]
«egui»=C:Program FilesESETESET NOD32 Antivirusegui.exe [2008-03-13 1443072]
«OutpostMonitor»=C:PROGRA~1AgnitumOUTPOS~1op_mon.exe [2008-07-15 1153352]
«OutpostFeedBack»=C:Program FilesAgnitumOutpost Firewall Profeedback.exe [2008-07-15 435528]
«UserFaultCheck»=C:WINDOWSsystem32dumprep 0 -u []
«KernelFaultCheck»=C:WINDOWSsystem32dumprep 0 -k [][HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=C:WINDOWSsystem32ctfmon.exe [2004-08-18 15360]
«QIP2005″=C:Program FilesQIPqip.exe [2008-12-09 3259392]
«RGSC»=D:GamesRockstar GamesRockstar Games Social ClubRGSCLauncher.exe [2009-01-17 306088]C:Documents and SettingsadmГлавное менюПрограммыАвтозагрузка
Ярлык для ipchmon.exe.lnk — C:Program Filesipchmonipchmon.exe[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWindows]
«AppInit_DLLS»=»c:progra~1agnitumoutpos~1wl_hook.dll»[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad]
WPDShServiceObj — {AAA288BA-9A4C-45B0-95D7-94D524869DB5} — C:WINDOWSsystem32WPDShServiceObj.dll [2006-10-18 133632][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerShellExecuteHooks]
«{B5A7F190-DDA6-4420-B3BA-52453494E6CD}»=C:PROGRA~1MICROS~2Office12GRA8E1~1.DLL [2006-10-27 2210608][HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetwork{1a3e09be-1e45-494b-9174-d7385b45bbf5}]
[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
«dontdisplaylastusername»=0
«legalnoticecaption»=
«legalnoticetext»=
«shutdownwithoutlogon»=1
«undockwithoutlogon»=1[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoDriveTypeAutoRun»=145[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicystandardprofileauthorizedapplicationslist]
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»
«C:Program FilesNVIDIA CorporationNetworkAccessManagerApache GroupApache2binApache.exe»=»C:Program FilesNVIDIA CorporationNetworkAccessManagerApache GroupApache2binApache.exe:*:Enabled:Apache HTTP Server»
«C:Program FilesMicrosoft OfficeOffice12OUTLOOK.EXE»=»C:Program FilesMicrosoft OfficeOffice12OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook»
«C:Program FilesMicrosoft OfficeOffice12GROOVE.EXE»=»C:Program FilesMicrosoft OfficeOffice12GROOVE.EXE:*:Enabled:Microsoft Office Groove»
«C:Program FilesMicrosoft OfficeOffice12ONENOTE.EXE»=»C:Program FilesMicrosoft OfficeOffice12ONENOTE.EXE:*:Enabled:Microsoft Office OneNote»
«D:GamesRockstar GamesRockstar Games Social ClubRGSCLauncher.exe»=»D:GamesRockstar GamesRockstar Games Social ClubRGSCLauncher.exe:*:Enabled:Rockstar Games Social Club»
«D:GamesRockstar GamesGrand Theft Auto IVLaunchGTAIV.exe»=»D:GamesRockstar GamesGrand Theft Auto IVLaunchGTAIV.exe:*:Enabled:Grand Theft Auto IV»
«D:GamesRockstar GamesGrand Theft Auto IVGTAIV.exe»=»D:GamesRockstar GamesGrand Theft Auto IVGTAIV.exe:*:Enabled:Grand Theft Auto IV»[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicydomainprofileauthorizedapplicationslist]
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{85d2cb10-e38c-11dd-816a-001d60addc20}]
shellAutoRuncommand — C:WINDOWSsystem32RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RUNdLl32.ExE .RECYCLERS-5-3-42-2819952290-8240758988-879315005-3665jwgkvsq.vmx,ahaezedrn[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{b12793c3-e351-11dd-86a4-806d6172696f}]
shellAutoRuncommand — E:Setup.exe======List of files/folders created in the last 1 months======
2009-01-18 18:26:35 —-D—- C:Program Filestrend micro
2009-01-18 18:26:30 —-D—- C:rsit
2009-01-18 14:18:41 —-D—- C:Documents and SettingsadmApplication DataWinRAR
2009-01-17 17:26:36 —-D—- C:WINDOWSMinidump
2009-01-17 15:33:28 —-A—- C:WINDOWSNeroDigital.ini
2009-01-17 15:33:26 —-D—- C:Documents and SettingsadmApplication DataMedia Player Classic
2009-01-17 15:18:25 —-N—- C:WINDOWSsystem32spmsg.dll
2009-01-17 15:18:25 —-D—- C:WINDOWSsystem32LogFiles
2009-01-17 15:18:23 —-HDC—- C:WINDOWS$NtUninstallWudf01000$
2009-01-17 15:18:01 —-HDC—- C:WINDOWS$NtUninstallWMFDist11$
2009-01-17 15:16:21 —-D—- C:WINDOWSsystem32xlive
2009-01-17 15:16:21 —-D—- C:Program FilesMicrosoft Games for Windows — LIVE
2009-01-17 14:50:14 —-HDC—- C:WINDOWS$NtUninstallXPSEPSCLP$
2009-01-17 14:50:10 —-D—- C:WINDOWSsystem32ru-RU
2009-01-17 14:44:59 —-D—- C:WINDOWSsystem32XPSViewer
2009-01-17 14:44:58 —-D—- C:WINDOWSsystem32en-us
2009-01-17 14:44:02 —-D—- C:Program FilesReference Assemblies
2009-01-17 14:43:26 —-N—- C:WINDOWSsystem32spmsg2.dll
2009-01-17 14:42:30 —-RSD—- C:WINDOWSassembly
2009-01-17 14:42:16 —-D—- C:WINDOWSMicrosoft.NET
2009-01-17 14:41:50 —-HDC—- C:WINDOWS$NtUninstallWIC$
2009-01-17 14:37:09 —-D—- C:Program FilesWinRAR
2009-01-16 16:51:02 —-D—- C:VertrigoServ
2009-01-16 15:20:05 —-SHD—- C:RECYCLER
2009-01-16 10:18:47 —-A—- C:WINDOWSsystem32h323log.txt
2009-01-16 10:17:54 —-A—- C:WINDOWSsystem32hidserv.dll
2009-01-16 10:16:50 —-A—- C:WINDOWSsystem32usbui.dll
2009-01-16 10:15:52 —-A—- C:WINDOWSimsins.BAK
2009-01-16 10:15:50 —-SHD—- C:WINDOWSInstaller
2009-01-16 10:15:50 —-A—- C:WINDOWSsystem32PerfStringBackup.INI
2009-01-16 10:15:49 —-D—- C:Program FilesCommon FilesODBC
2009-01-16 10:15:49 —-A—- C:WINDOWSODBCINST.INI
2009-01-16 10:15:47 —-RD—- C:Program Files
2009-01-16 10:15:47 —-D—- C:Program FilesCommon FilesSpeechEngines
2009-01-16 10:15:47 —-D—- C:Program FilesCommon FilesMicrosoft Shared
2009-01-16 10:15:47 —-D—- C:Program FilesCommon Files
2009-01-16 10:15:45 —-RA—- C:WINDOWSsystem32kbdazel.dll
2009-01-16 10:15:44 —-RA—- C:WINDOWSsystem32kbdtuq.dll
2009-01-16 10:15:44 —-RA—- C:WINDOWSsystem32kbdtuf.dll
2009-01-16 10:15:43 —-RA—- C:WINDOWSsystem32kbdhept.dll
2009-01-16 10:15:43 —-RA—- C:WINDOWSsystem32kbdhela3.dll
2009-01-16 10:15:43 —-RA—- C:WINDOWSsystem32kbdhela2.dll
2009-01-16 10:15:43 —-RA—- C:WINDOWSsystem32kbdhe319.dll
2009-01-16 10:15:43 —-RA—- C:WINDOWSsystem32kbdhe220.dll
2009-01-16 10:15:43 —-RA—- C:WINDOWSsystem32kbdhe.dll
2009-01-16 10:15:43 —-RA—- C:WINDOWSsystem32kbdgkl.dll
2009-01-16 10:15:42 —-RA—- C:WINDOWSsystem32kbdlv1.dll
2009-01-16 10:15:42 —-RA—- C:WINDOWSsystem32kbdlv.dll
2009-01-16 10:15:42 —-RA—- C:WINDOWSsystem32kbdlt1.dll
2009-01-16 10:15:42 —-RA—- C:WINDOWSsystem32kbdlt.dll
2009-01-16 10:15:42 —-RA—- C:WINDOWSsystem32kbdest.dll
2009-01-16 10:15:41 —-RA—- C:WINDOWSsystem32kbdycl.dll
2009-01-16 10:15:41 —-RA—- C:WINDOWSsystem32kbdsl1.dll
2009-01-16 10:15:41 —-RA—- C:WINDOWSsystem32kbdsl.dll
2009-01-16 10:15:41 —-RA—- C:WINDOWSsystem32kbdro.dll
2009-01-16 10:15:41 —-RA—- C:WINDOWSsystem32kbdpl1.dll
2009-01-16 10:15:41 —-RA—- C:WINDOWSsystem32kbdpl.dll
2009-01-16 10:15:41 —-RA—- C:WINDOWSsystem32kbdhu1.dll
2009-01-16 10:15:41 —-RA—- C:WINDOWSsystem32kbdhu.dll
2009-01-16 10:15:41 —-RA—- C:WINDOWSsystem32kbdcz2.dll
2009-01-16 10:15:41 —-RA—- C:WINDOWSsystem32kbdcz1.dll
2009-01-16 10:15:41 —-RA—- C:WINDOWSsystem32kbdcz.dll
2009-01-16 10:15:41 —-RA—- C:WINDOWSsystem32kbdcr.dll
2009-01-16 10:15:41 —-RA—- C:WINDOWSsystem32KBDAL.DLL
2009-01-16 10:15:39 —-A—- C:WINDOWSsystem32kbdycc.dll
2009-01-16 10:15:39 —-A—- C:WINDOWSsystem32kbduzb.dll
2009-01-16 10:15:39 —-A—- C:WINDOWSsystem32kbdur.dll
2009-01-16 10:15:39 —-A—- C:WINDOWSsystem32kbdtat.dll
2009-01-16 10:15:39 —-A—- C:WINDOWSsystem32kbdmon.dll
2009-01-16 10:15:39 —-A—- C:WINDOWSsystem32kbdkyr.dll
2009-01-16 10:15:39 —-A—- C:WINDOWSsystem32kbdkaz.dll
2009-01-16 10:15:39 —-A—- C:WINDOWSsystem32kbdbu.dll
2009-01-16 10:15:39 —-A—- C:WINDOWSsystem32kbdblr.dll
2009-01-16 10:15:39 —-A—- C:WINDOWSsystem32kbdaze.dll
2009-01-16 10:15:38 —-A—- C:WINDOWSsystem32spxcoins.dll
2009-01-16 10:15:38 —-A—- C:WINDOWSsystem32irclass.dll
2009-01-16 10:15:38 —-A—- C:WINDOWSsystem32EqnClass.Dll
2009-01-16 10:15:38 —-A—- C:WINDOWSsystem32dgsetup.dll
2009-01-16 10:15:38 —-A—- C:WINDOWSsystem32dgrpsetu.dll
2009-01-16 10:15:36 —-N—- C:WINDOWSsystem32CONFIG.TMP
2009-01-16 10:15:36 —-A—- C:WINDOWSTASKMAN.EXE
2009-01-16 10:15:36 —-A—- C:WINDOWSsystem32batt.dll
2009-01-16 10:15:33 —-A—- C:WINDOWSNOTEPAD.EXE
2009-01-16 10:15:32 —-A—- C:WINDOWSsystem32storprop.dll
2009-01-16 10:15:27 —-ASH—- C:Documents and SettingsAll UsersApplication Datadesktop.ini
2009-01-16 10:13:46 —-RA—- C:WINDOWSSET8.tmp
2009-01-16 10:13:44 —-RA—- C:WINDOWSSET4.tmp
2009-01-16 10:13:43 —-RA—- C:WINDOWSSET3.tmp
2009-01-16 10:13:40 —-D—- C:WINDOWSsystem32CatRoot2
2009-01-16 10:13:40 —-D—- C:WINDOWSsystem32CatRoot
2009-01-16 10:13:34 —-SD—- C:Documents and SettingsAll UsersApplication DataMicrosoft
2009-01-16 10:13:22 —-A—- C:WINDOWSsetuplog.txt
2009-01-16 10:13:19 —-SHD—- C:System Volume Information
2009-01-16 10:13:19 —-D—- C:Documents and Settings
2009-01-16 10:12:35 —-RSH—- C:boot.ini
2009-01-16 10:10:00 —-RSHDC—- C:WINDOWSsystem32dllcache
2009-01-16 10:10:00 —-RSD—- C:WINDOWSFonts
2009-01-16 10:10:00 —-RD—- C:WINDOWSWeb
2009-01-16 10:10:00 —-HD—- C:WINDOWSinf
2009-01-16 10:10:00 —-D—- C:WINDOWSWinSxS
2009-01-16 10:10:00 —-D—- C:WINDOWStwain_32
2009-01-16 10:10:00 —-D—- C:WINDOWSTemp
2009-01-16 10:10:00 —-D—- C:WINDOWSsystem32wins
2009-01-16 10:10:00 —-D—- C:WINDOWSsystem32wbem
2009-01-16 10:10:00 —-D—- C:WINDOWSsystem32usmt
2009-01-16 10:10:00 —-D—- C:WINDOWSsystem32spool
2009-01-16 10:10:00 —-D—- C:WINDOWSsystem32ShellExt
2009-01-16 10:10:00 —-D—- C:WINDOWSsystem32Setup
2009-01-16 10:10:00 —-D—- C:WINDOWSsystem32ras
2009-01-16 10:10:00 —-D—- C:WINDOWSsystem32oobe
2009-01-16 10:10:00 —-D—- C:WINDOWSsystem32npp
2009-01-16 10:10:00 —-D—- C:WINDOWSsystem32mui
2009-01-16 10:10:00 —-D—- C:WINDOWSsystem32inetsrv
2009-01-16 10:10:00 —-D—- C:WINDOWSsystem32IME
2009-01-16 10:10:00 —-D—- C:WINDOWSsystem32icsxml
2009-01-16 10:10:00 —-D—- C:WINDOWSsystem32ias
2009-01-16 10:10:00 —-D—- C:WINDOWSsystem32export
2009-01-16 10:10:00 —-D—- C:WINDOWSsystem32drivers
2009-01-16 10:10:00 —-D—- C:WINDOWSsystem32dhcp
2009-01-16 10:10:00 —-D—- C:WINDOWSsystem32config
2009-01-16 10:10:00 —-D—- C:WINDOWSsystem323com_dmi
2009-01-16 10:10:00 —-D—- C:WINDOWSsystem323076
2009-01-16 10:10:00 —-D—- C:WINDOWSsystem322052
2009-01-16 10:10:00 —-D—- C:WINDOWSsystem321054
2009-01-16 10:10:00 —-D—- C:WINDOWSsystem321049
2009-01-16 10:10:00 —-D—- C:WINDOWSsystem321042
2009-01-16 10:10:00 —-D—- C:WINDOWSsystem321041
2009-01-16 10:10:00 —-D—- C:WINDOWSsystem321037
2009-01-16 10:10:00 —-D—- C:WINDOWSsystem321033
2009-01-16 10:10:00 —-D—- C:WINDOWSsystem321031
2009-01-16 10:10:00 —-D—- C:WINDOWSsystem321028
2009-01-16 10:10:00 —-D—- C:WINDOWSsystem321025
2009-01-16 10:10:00 —-D—- C:WINDOWSsystem32
2009-01-16 10:10:00 —-D—- C:WINDOWSsystem
2009-01-16 10:10:00 —-D—- C:WINDOWSsecurity
2009-01-16 10:10:00 —-D—- C:WINDOWSResources
2009-01-16 10:10:00 —-D—- C:WINDOWSrepair
2009-01-16 10:10:00 —-D—- C:WINDOWSProvisioning
2009-01-16 10:10:00 —-D—- C:WINDOWSPeerNet
2009-01-16 10:10:00 —-D—- C:WINDOWSpchealth
2009-01-16 10:10:00 —-D—- C:WINDOWSmui
2009-01-16 10:10:00 —-D—- C:WINDOWSmsapps
2009-01-16 10:10:00 —-D—- C:WINDOWSmsagent
2009-01-16 10:10:00 —-D—- C:WINDOWSMedia
2009-01-16 10:10:00 —-D—- C:WINDOWSjava
2009-01-16 10:10:00 —-D—- C:WINDOWSime
2009-01-16 10:10:00 —-D—- C:WINDOWSHelp
2009-01-16 10:10:00 —-D—- C:WINDOWSehome
2009-01-16 10:10:00 —-D—- C:WINDOWSDriver Cache
2009-01-16 10:10:00 —-D—- C:WINDOWSDebug
2009-01-16 10:10:00 —-D—- C:WINDOWSCursors
2009-01-16 10:10:00 —-D—- C:WINDOWSConnection Wizard
2009-01-16 10:10:00 —-D—- C:WINDOWSConfig
2009-01-16 10:10:00 —-D—- C:WINDOWSAppPatch
2009-01-16 10:10:00 —-D—- C:WINDOWSaddins
2009-01-16 10:10:00 —-D—- C:WINDOWS
2009-01-16 01:24:38 —-D—- C:Documents and SettingsadmApplication DataYandex
2009-01-16 01:24:31 —-D—- C:Documents and SettingsadmApplication DataMozilla
2009-01-16 01:24:21 —-D—- C:Program FilesMozilla Firefox
2009-01-16 01:24:16 —-D—- C:Documents and SettingsadmApplication DataAhead
2009-01-16 01:23:50 —-A—- C:WINDOWSsystem32unrar.dll
2009-01-16 01:23:44 —-A—- C:WINDOWSsystem32yv12vfw.dll
2009-01-16 01:23:44 —-A—- C:WINDOWSsystem32xvidvfw.dll
2009-01-16 01:23:44 —-A—- C:WINDOWSsystem32xvidcore.dll
2009-01-16 01:23:44 —-A—- C:WINDOWSsystem32qt-dx331.dll
2009-01-16 01:23:44 —-A—- C:WINDOWSsystem32dpl100.dll
2009-01-16 01:23:39 —-A—- C:WINDOWSsystem32divx.dll
2009-01-16 01:23:37 —-D—- C:Program FilesK-Lite Codec Pack
2009-01-16 01:23:37 —-A—- C:WINDOWSsystem32msvcr71.dll
2009-01-16 01:23:37 —-A—- C:WINDOWSsystem32ff_vfw.dll.manifest
2009-01-16 01:23:37 —-A—- C:WINDOWSsystem32ff_vfw.dll
2009-01-16 01:23:19 —-D—- C:Program FilesNero
2009-01-16 01:23:19 —-D—- C:Program FilesCommon FilesAhead
2009-01-16 01:23:19 —-D—- C:Documents and SettingsAll UsersApplication DataNero
2009-01-16 01:22:49 —-D—- C:WINDOWSRegisteredPackages
2009-01-16 01:22:40 —-D—- C:Program FilesRadmin Viewer 3.0
2009-01-16 01:18:33 —-A—- C:WINDOWSsystem32msonpmon.dll
2009-01-16 01:18:11 —-D—- C:Program FilesMicrosoft Works
2009-01-16 01:18:08 —-D—- C:Program FilesMSBuild
2009-01-16 01:17:59 —-D—- C:Program FilesMicrosoft Visual Studio
2009-01-16 01:17:59 —-D—- C:Program FilesCommon FilesDESIGNER
2009-01-16 01:17:34 —-D—- C:Program Filessgconfig
2009-01-16 01:16:45 —-D—- C:Program FilesQIP
2009-01-16 01:16:44 —-D—- C:Program FilesLanSpy
2009-01-16 01:16:44 —-D—- C:Program Filesipchmon
2009-01-16 01:16:44 —-D—- C:Program FilesInetAccess
2009-01-16 01:16:37 —-D—- C:Program FilesFPinger
2009-01-16 01:16:36 —-D—- C:Program FilesStrongDC++
2009-01-16 01:15:58 —-D—- C:WINDOWSSHELLNEW
2009-01-16 01:15:45 —-D—- C:Program FilesMicrosoft Office
2009-01-16 01:15:45 —-D—- C:Documents and SettingsAll UsersApplication DataMicrosoft Help
2009-01-16 01:15:23 —-RHD—- C:MSOCache
2009-01-16 01:08:39 —-A—- C:WINDOWSsystem32XAudio2_1.dll
2009-01-16 01:08:39 —-A—- C:WINDOWSsystem32XAPOFX1_0.dll
2009-01-16 01:08:38 —-A—- C:WINDOWSsystem32xactengine3_1.dll
2009-01-16 01:08:23 —-A—- C:WINDOWSsystem32X3DAudio1_4.dll
2009-01-16 01:08:22 —-A—- C:WINDOWSsystem32XAudio2_0.dll
2009-01-16 01:08:22 —-A—- C:WINDOWSsystem32D3DX9_38.dll
2009-01-16 01:08:22 —-A—- C:WINDOWSsystem32d3dx10_38.dll
2009-01-16 01:08:22 —-A—- C:WINDOWSsystem32D3DCompiler_38.dll
2009-01-16 01:08:21 —-A—- C:WINDOWSsystem32xactengine3_0.dll
2009-01-16 01:08:21 —-A—- C:WINDOWSsystem32X3DAudio1_3.dll
2009-01-16 01:08:21 —-A—- C:WINDOWSsystem32d3dx10_37.dll
2009-01-16 01:08:21 —-A—- C:WINDOWSsystem32D3DCompiler_37.dll
2009-01-16 01:08:20 —-A—- C:WINDOWSsystem32xactengine2_10.dll
2009-01-16 01:08:20 —-A—- C:WINDOWSsystem32D3DX9_37.dll
2009-01-16 01:08:19 —-A—- C:WINDOWSsystem32xactengine2_9.dll
2009-01-16 01:08:19 —-A—- C:WINDOWSsystem32d3dx9_36.dll
2009-01-16 01:08:19 —-A—- C:WINDOWSsystem32d3dx10_36.dll
2009-01-16 01:08:19 —-A—- C:WINDOWSsystem32D3DCompiler_36.dll
2009-01-16 01:08:18 —-A—- C:WINDOWSsystem32d3dx9_35.dll
2009-01-16 01:08:18 —-A—- C:WINDOWSsystem32d3dx10_35.dll
2009-01-16 01:08:18 —-A—- C:WINDOWSsystem32D3DCompiler_35.dll
2009-01-16 01:08:17 —-A—- C:WINDOWSsystem32xactengine2_8.dll
2009-01-16 01:08:17 —-A—- C:WINDOWSsystem32X3DAudio1_2.dll
2009-01-16 01:08:17 —-A—- C:WINDOWSsystem32d3dx9_34.dll
2009-01-16 01:08:17 —-A—- C:WINDOWSsystem32d3dx10_34.dll
2009-01-16 01:08:17 —-A—- C:WINDOWSsystem32D3DCompiler_34.dll
2009-01-16 01:08:16 —-A—- C:WINDOWSsystem32xinput1_3.dll
2009-01-16 01:08:16 —-A—- C:WINDOWSsystem32xactengine2_7.dll
2009-01-16 01:08:15 —-A—- C:WINDOWSsystem32d3dx10_33.dll
2009-01-16 01:08:15 —-A—- C:WINDOWSsystem32D3DCompiler_33.dll
2009-01-16 01:08:14 —-A—- C:WINDOWSsystem32xactengine2_6.dll
2009-01-16 01:08:14 —-A—- C:WINDOWSsystem32xactengine2_5.dll
2009-01-16 01:08:14 —-A—- C:WINDOWSsystem32d3dx9_33.dll
2009-01-16 01:08:14 —-A—- C:WINDOWSsystem32d3dx9_32.dll
2009-01-16 01:08:13 —-A—- C:WINDOWSsystem32xinput1_2.dll
2009-01-16 01:08:13 —-A—- C:WINDOWSsystem32xinput1_1.dll
2009-01-16 01:08:13 —-A—- C:WINDOWSsystem32xactengine2_4.dll
2009-01-16 01:08:13 —-A—- C:WINDOWSsystem32xactengine2_3.dll
2009-01-16 01:08:13 —-A—- C:WINDOWSsystem32xactengine2_2.dll
2009-01-16 01:08:13 —-A—- C:WINDOWSsystem32xactengine2_1.dll
2009-01-16 01:08:13 —-A—- C:WINDOWSsystem32x3daudio1_1.dll
2009-01-16 01:08:13 —-A—- C:WINDOWSsystem32d3dx9_31.dll
2009-01-16 01:08:12 —-A—- C:WINDOWSsystem32xinput9_1_0.dll
2009-01-16 01:08:12 —-A—- C:WINDOWSsystem32xactengine2_0.dll
2009-01-16 01:08:12 —-A—- C:WINDOWSsystem32x3daudio1_0.dll
2009-01-16 01:08:12 —-A—- C:WINDOWSsystem32d3dx9_30.dll
2009-01-16 01:08:12 —-A—- C:WINDOWSsystem32d3dx9_29.dll
2009-01-16 01:08:12 —-A—- C:WINDOWSsystem32d3dx9_28.dll
2009-01-16 01:08:12 —-A—- C:WINDOWSsystem32d3dx9_27.dll
2009-01-16 01:08:11 —-A—- C:WINDOWSsystem32d3dx9_26.dll
2009-01-16 01:08:11 —-A—- C:WINDOWSsystem32d3dx9_25.dll
2009-01-16 01:08:11 —-A—- C:WINDOWSsystem32d3dx9_24.dll
2009-01-16 01:07:24 —-D—- C:WINDOWSLogs
2009-01-16 00:58:42 —-D—- C:WINDOWSsystem32Filt
2009-01-16 00:58:42 —-D—- C:Program FilesAgnitum
2009-01-16 00:58:37 —-D—- C:Documents and SettingsAll UsersApplication DataAgnitum
2009-01-16 00:56:39 —-D—- C:Program FilesESET
2009-01-16 00:56:39 —-D—- C:Documents and SettingsAll UsersApplication DataESET
2009-01-16 00:48:34 —-D—- C:WINDOWSnview
2009-01-16 00:48:34 —-A—- C:WINDOWSsystem32nvudisp.exe
2009-01-16 00:46:11 —-R—- C:WINDOWSsystem32JMRaidSetup.exe
2009-01-16 00:46:11 —-R—- C:WINDOWSsystem32JMRaidAPI.dll
2009-01-16 00:46:11 —-D—- C:JM
2009-01-16 00:46:07 —-D—- C:WINDOWSJM
2009-01-16 00:45:20 —-RA—- C:WINDOWSsystem32PostProc.dll
2009-01-16 00:45:20 —-RA—- C:WINDOWSsystem32a3d.dll
2009-01-16 00:45:18 —-A—- C:WINDOWSsystem32ksuser.dll
2009-01-16 00:45:14 —-N—- C:WINDOWSsystem32wdmioctl.dll
2009-01-16 00:45:14 —-N—- C:WINDOWSsystem32SMMedia.dll
2009-01-16 00:45:13 —-N—- C:WINDOWSsystem32DSndUp.exe
2009-01-16 00:45:13 —-N—- C:WINDOWSsystem32CleanUp.exe
2009-01-16 00:45:13 —-D—- C:Program FilesAnalog Devices
2009-01-16 00:44:26 —-HDC—- C:WINDOWS$NtUninstallKB888111WXPSP2$
2009-01-16 00:44:26 —-A—- C:WINDOWSsystem32spupdsvc.exe
2009-01-16 00:43:58 —-D—- C:Program FilesDIFX
2009-01-16 00:43:57 —-DC—- C:WINDOWSsystem32DRVSTORE
2009-01-15 22:37:25 —-HD—- C:Program FilesInstallShield Installation Information
2009-01-15 22:36:53 —-D—- C:Program FilesNVIDIA Corporation
2009-01-15 22:35:55 —-A—- C:WINDOWSsystem32CapabilityTable.exe
2009-01-15 22:35:47 —-RA—- C:WINDOWSsystem32NVCOI.DLL
2009-01-15 22:35:47 —-RA—- C:WINDOWSsystem32idecoiins.dll
2009-01-15 22:35:47 —-N—- C:WINDOWSsystem32nvuide.exe
2009-01-15 22:35:46 —-RA—- C:WINDOWSsystem32idecoi.dll
2009-01-15 22:35:46 —-D—- C:WINDOWSsystem32ReinstallBackups
2009-01-15 22:35:23 —-RA—- C:WINDOWSsystem32fdco1ins.dll
2009-01-15 22:35:23 —-A—- C:WINDOWSsystem32fdco1.dll
2009-01-15 22:35:22 —-RA—- C:WINDOWSsystem32nvconrm.dll
2009-01-15 22:35:22 —-A—- C:WINDOWSsystem32nvunrm.exe
2009-01-15 22:35:21 —-RA—- C:WINDOWSsystem32bdco1ins.dll
2009-01-15 22:35:21 —-RA—- C:WINDOWSsystem32bdco1.dll
2009-01-15 22:33:17 —-A—- C:WINDOWSsystem32NVUNINST.EXE
2009-01-15 22:33:08 —-D—- C:Program FilesCommon FilesInstallShield
2009-01-15 22:33:06 —-RA—- C:WINDOWSsystem32raidmgmt.ini
2009-01-15 22:33:06 —-RA—- C:WINDOWSsystem32AsusSetup.ini
2009-01-15 22:33:06 —-RA—- C:WINDOWSsystem32AsusSetup.exe
2009-01-15 22:33:05 —-A—- C:WINDOWSAS_Debug.txt
2009-01-15 22:32:46 —-A—- C:WINDOWSAscd_tmp.ini
2009-01-15 22:31:02 —-D—- C:Documents and SettingsadmApplication DataIdentities
2009-01-15 22:31:01 —-HD—- C:Program FilesUninstall Information
2009-01-15 22:30:46 —-SD—- C:Documents and SettingsadmApplication DataMicrosoft
2009-01-15 22:30:46 —-ASH—- C:Documents and SettingsadmApplication Datadesktop.ini
2009-01-15 22:27:10 —-D—- C:WINDOWSSoftwareDistribution
2009-01-15 22:27:09 —-D—- C:WINDOWSPrefetch
2009-01-15 22:27:08 —-SD—- C:WINDOWSsystem32Microsoft
2009-01-15 22:27:08 —-A—- C:WINDOWSSchedLgU.Txt
2009-01-15 22:24:58 —-D—- C:WINDOWSsystem32xircom
2009-01-15 22:24:58 —-D—- C:Program Filesxerox
2009-01-15 22:24:58 —-D—- C:Program Filesmicrosoft frontpage
2009-01-15 22:24:41 —-A—- C:WINDOWScontrol.ini
2009-01-15 22:24:41 —-A—- C:AUTOEXEC.BAT
2009-01-15 22:24:34 —-A—- C:WINDOWSOEWABLog.txt
2009-01-15 22:24:31 —-A—- C:WINDOWSsystem32mapi32.dll
2009-01-15 22:23:56 —-SD—- C:WINDOWSDownloaded Program Files
2009-01-15 22:23:56 —-RD—- C:WINDOWSOffline Web Pages
2009-01-15 22:23:56 —-RAH—- C:WINDOWSsystem32logonui.exe.manifest
2009-01-15 22:23:52 —-RAH—- C:WINDOWSsystem32cdplayer.exe.manifest
2009-01-15 22:23:49 —-HD—- C:Program FilesWindowsUpdate
2009-01-15 22:23:46 —-D—- C:Program FilesOnline Services
2009-01-15 22:23:36 —-D—- C:WINDOWSsystem32DirectX
2009-01-15 22:23:24 —-A—- C:WINDOWSsystem32atrace.dll
2009-01-15 22:23:22 —-A—- C:WINDOWSsystem32desktop.ini
2009-01-15 22:23:22 —-A—- C:WINDOWSdesktop.ini
2009-01-15 22:23:18 —-A—- C:WINDOWSsystem32nmevtmsg.dll
2009-01-15 22:23:17 —-A—- C:WINDOWSsystem32acctres.dll
2009-01-15 22:23:16 —-D—- C:Program FilesCommon FilesServices
2009-01-15 22:23:15 —-SD—- C:WINDOWSTasks
2009-01-15 22:23:15 —-A—- C:WINDOWSsystem32icfgnt5.dll
2009-01-15 22:23:14 —-D—- C:Program FilesCommon FilesMSSoap
2009-01-15 22:23:12 —-D—- C:WINDOWSsrchasst
2009-01-15 22:23:11 —-D—- C:WINDOWSsystem32Macromed
2009-01-15 22:23:09 —-A—- C:WINDOWSsystem32wuweb.dll
2009-01-15 22:23:09 —-A—- C:WINDOWSsystem32wups.dll
2009-01-15 22:23:09 —-A—- C:WINDOWSsystem32wucltui.dll
2009-01-15 22:23:09 —-A—- C:WINDOWSsystem32wuauserv.dll
2009-01-15 22:23:09 —-A—- C:WINDOWSsystem32wuaueng1.dll
2009-01-15 22:23:09 —-A—- C:WINDOWSsystem32wuaueng.dll
2009-01-15 22:23:09 —-A—- C:WINDOWSsystem32wuauclt1.exe
2009-01-15 22:23:09 —-A—- C:WINDOWSsystem32wuauclt.exe
2009-01-15 22:23:09 —-A—- C:WINDOWSsystem32wuapi.dll
2009-01-15 22:23:09 —-A—- C:WINDOWSsystem32bitsprx3.dll
2009-01-15 22:23:09 —-A—- C:WINDOWSsystem32bitsprx2.dll
2009-01-15 22:23:08 —-A—- C:WINDOWSsystem32qmgrprxy.dll
2009-01-15 22:23:08 —-A—- C:WINDOWSsystem32qmgr.dll
2009-01-15 22:23:06 —-D—- C:Program FilesMovie Maker
2009-01-15 22:23:04 —-A—- C:WINDOWSsystem32safrslv.dll
2009-01-15 22:23:04 —-A—- C:WINDOWSsystem32safrdm.dll
2009-01-15 22:23:04 —-A—- C:WINDOWSsystem32safrcdlg.dll
2009-01-15 22:23:04 —-A—- C:WINDOWSsystem32racpldlg.dll
2009-01-15 22:23:02 —-A—- C:WINDOWSsystem32fltMc.exe
2009-01-15 22:23:02 —-A—- C:WINDOWSsystem32fltlib.dll
2009-01-15 22:23:01 —-D—- C:WINDOWSsystem32Restore
2009-01-15 22:23:01 —-A—- C:WINDOWSsystem32srsvc.dll
2009-01-15 22:23:01 —-A—- C:WINDOWSsystem32srrstr.dll
2009-01-15 22:23:01 —-A—- C:WINDOWSsystem32srclient.dll
2009-01-15 22:23:01 —-A—- C:WINDOWSsystem32mnmdd.dll
2009-01-15 22:23:01 —-A—- C:WINDOWSsystem32isrdbg32.dll
2009-01-15 22:23:01 —-A—- C:WINDOWSsystem32ils.dll
2009-01-15 22:23:00 —-A—- C:WINDOWSsystem32nmmkcert.dll
2009-01-15 22:23:00 —-A—- C:WINDOWSsystem32msconf.dll
2009-01-15 22:23:00 —-A—- C:WINDOWSsystem32mnmsrvc.exe
2009-01-15 22:22:59 —-D—- C:Program FilesNetMeeting
2009-01-15 22:22:58 —-A—- C:WINDOWSsystem32msoert2.dll
2009-01-15 22:22:58 —-A—- C:WINDOWSsystem32msoeacct.dll
2009-01-15 22:22:58 —-A—- C:WINDOWSsystem32inetres.dll
2009-01-15 22:22:58 —-A—- C:WINDOWSsystem32inetcomm.dll
2009-01-15 22:22:57 —-D—- C:Program FilesOutlook Express
2009-01-15 22:22:57 —-A—- C:WINDOWSsystem32schedsvc.dll
2009-01-15 22:22:57 —-A—- C:WINDOWSsystem32mstinit.exe
2009-01-15 22:22:57 —-A—- C:WINDOWSsystem32mstask.dll
2009-01-15 22:22:56 —-A—- C:WINDOWSsystem32isign32.dll
2009-01-15 22:22:56 —-A—- C:WINDOWSsystem32inetcfg.dll
2009-01-15 22:22:56 —-A—- C:WINDOWSsystem32icwphbk.dll
2009-01-15 22:22:56 —-A—- C:WINDOWSsystem32icwdial.dll
2009-01-15 22:22:53 —-D—- C:Program FilesCommon FilesSystem
2009-01-15 22:22:52 —-D—- C:Program FilesInternet Explorer
2009-01-15 22:22:29 —-D—- C:Program FilesComPlus Applications
2009-01-15 22:22:28 —-A—- C:WINDOWSvbaddin.ini
2009-01-15 22:22:28 —-A—- C:WINDOWSvb.ini
2009-01-15 22:22:24 —-D—- C:WINDOWSRegistration
2009-01-15 22:22:18 —-D—- C:Program FilesWindows Media Player
2009-01-15 22:22:14 —-D—- C:Program FilesMessenger
2009-01-15 22:22:12 —-D—- C:Program FilesMSN Gaming Zone
2009-01-15 22:22:12 —-A—- C:WINDOWSsystem32write.exe
2009-01-15 22:22:07 —-A—- C:WINDOWSsystem32sndvol32.exe
2009-01-15 22:22:06 —-A—- C:WINDOWSsystem32winchat.exe
2009-01-15 22:22:06 —-A—- C:WINDOWSsystem32hticons.dll
2009-01-15 22:22:06 —-A—- C:WINDOWSsystem32avwav.dll
2009-01-15 22:22:06 —-A—- C:WINDOWSsystem32avtapi.dll
2009-01-15 22:22:06 —-A—- C:WINDOWSsystem32avmeter.dll
2009-01-15 22:22:02 —-A—- C:WINDOWSsystem32getuname.dll
2009-01-15 22:22:01 —-A—- C:WINDOWSsystem32winmine.exe
2009-01-15 22:22:01 —-A—- C:WINDOWSsystem32sol.exe
2009-01-15 22:22:01 —-A—- C:WINDOWSsystem32reset.exe
2009-01-15 22:22:01 —-A—- C:WINDOWSsystem32mshearts.exe
2009-01-15 22:22:01 —-A—- C:WINDOWSsystem32freecell.exe
2009-01-15 22:22:01 —-A—- C:WINDOWSsystem32charmap.exe
2009-01-15 22:22:01 —-A—- C:WINDOWSsystem32calc.exe
2009-01-15 22:22:00 —-A—- C:WINDOWSsystem32usrlogon.cmd
2009-01-15 22:22:00 —-A—- C:WINDOWSsystem32tsshutdn.exe
2009-01-15 22:22:00 —-A—- C:WINDOWSsystem32tslabels.ini
2009-01-15 22:22:00 —-A—- C:WINDOWSsystem32tskill.exe
2009-01-15 22:22:00 —-A—- C:WINDOWSsystem32tsdiscon.exe
2009-01-15 22:22:00 —-A—- C:WINDOWSsystem32tscon.exe
2009-01-15 22:22:00 —-A—- C:WINDOWSsystem32shadow.exe
2009-01-15 22:22:00 —-A—- C:WINDOWSsystem32rwinsta.exe
2009-01-15 22:22:00 —-A—- C:WINDOWSsystem32regini.exe
2009-01-15 22:22:00 —-A—- C:WINDOWSsystem32rdpcfgex.dll
2009-01-15 22:22:00 —-A—- C:WINDOWSsystem32qwinsta.exe
2009-01-15 22:22:00 —-A—- C:WINDOWSsystem32qappsrv.exe
2009-01-15 22:22:00 —-A—- C:WINDOWSsystem32msg.exe
2009-01-15 22:22:00 —-A—- C:WINDOWSsystem32msdtcprf.ini
2009-01-15 22:22:00 —-A—- C:WINDOWSsystem32logoff.exe
2009-01-15 22:22:00 —-A—- C:WINDOWSsystem32cdmodem.dll
2009-01-15 22:21:59 —-A—- C:WINDOWSsystem32stclient.dll
2009-01-15 22:21:59 —-A—- C:WINDOWSsystem32mtxlegih.dll
2009-01-15 22:21:59 —-A—- C:WINDOWSsystem32mtxex.dll
2009-01-15 22:21:59 —-A—- C:WINDOWSsystem32mtxdm.dll
2009-01-15 22:21:59 —-A—- C:WINDOWSsystem32dcomcnfg.exe
2009-01-15 22:21:59 —-A—- C:WINDOWSsystem32comsnap.dll
2009-01-15 22:21:59 —-A—- C:WINDOWSsystem32comrepl.dll
2009-01-15 22:21:59 —-A—- C:WINDOWSsystem32comaddin.dll
2009-01-15 22:21:55 —-A—- C:WINDOWSsystem32wmimgmt.msc
2009-01-15 22:21:55 —-A—- C:WINDOWSsystem32sndrec32.exe
2009-01-15 22:21:55 —-A—- C:WINDOWSsystem32accwiz.exe
2009-01-15 22:21:54 —-D—- C:Program FilesWindows NT
2009-01-15 22:21:54 —-A—- C:WINDOWSsystem32spider.exe
2009-01-15 22:21:54 —-A—- C:WINDOWSsystem32mspaint.exe
2009-01-15 22:21:54 —-A—- C:WINDOWSsystem32mplay32.exe
2009-01-15 22:21:54 —-A—- C:WINDOWSsystem32hypertrm.dll
2009-01-15 22:21:54 —-A—- C:WINDOWSsystem32clipbrd.exe
2009-01-15 22:21:53 —-A—- C:WINDOWSsystem32tscupgrd.exe
2009-01-15 22:21:53 —-A—- C:WINDOWSsystem32tscfgwmi.dll
2009-01-15 22:21:53 —-A—- C:WINDOWSsystem32termsrv.dll
2009-01-15 22:21:53 —-A—- C:WINDOWSsystem32sessmgr.exe
2009-01-15 22:21:53 —-A—- C:WINDOWSsystem32remotepg.dll
2009-01-15 22:21:53 —-A—- C:WINDOWSsystem32rdshost.exe
2009-01-15 22:21:53 —-A—- C:WINDOWSsystem32rdsaddin.exe
2009-01-15 22:21:53 —-A—- C:WINDOWSsystem32rdchost.dll
2009-01-15 22:21:53 —-A—- C:WINDOWSsystem32mstscax.dll
2009-01-15 22:21:53 —-A—- C:WINDOWSsystem32mstsc.exe
2009-01-15 22:21:52 —-D—- C:WINDOWSsystem32MsDtc
2009-01-15 22:21:52 —-A—- C:WINDOWSsystem32xolehlp.dll
2009-01-15 22:21:52 —-A—- C:WINDOWSsystem32rdpwsx.dll
2009-01-15 22:21:52 —-A—- C:WINDOWSsystem32rdpsnd.dll
2009-01-15 22:21:52 —-A—- C:WINDOWSsystem32rdpclip.exe
2009-01-15 22:21:52 —-A—- C:WINDOWSsystem32qprocess.exe
2009-01-15 22:21:52 —-A—- C:WINDOWSsystem32mtxoci.dll
2009-01-15 22:21:52 —-A—- C:WINDOWSsystem32msdtcuiu.dll
2009-01-15 22:21:52 —-A—- C:WINDOWSsystem32msdtctm.dll
2009-01-15 22:21:52 —-A—- C:WINDOWSsystem32msdtcprx.dll
2009-01-15 22:21:52 —-A—- C:WINDOWSsystem32icaapi.dll
2009-01-15 22:21:52 —-A—- C:WINDOWSsystem32cfgbkend.dll
2009-01-15 22:21:51 —-D—- C:WINDOWSsystem32Com
2009-01-15 22:21:51 —-A—- C:WINDOWSsystem32msdtclog.dll
2009-01-15 22:21:51 —-A—- C:WINDOWSsystem32msdtc.exe
2009-01-15 22:21:51 —-A—- C:WINDOWSsystem32colbact.dll
2009-01-15 22:21:51 —-A—- C:WINDOWSsystem32clbcatex.dll
2009-01-15 22:21:51 —-A—- C:WINDOWSsystem32catsrvut.dll
2009-01-15 22:21:51 —-A—- C:WINDOWSsystem32catsrvps.dll
2009-01-15 22:21:51 —-A—- C:WINDOWSsystem32catsrv.dll
2009-01-15 22:21:50 —-A—- C:WINDOWSsystem32comuid.dll
2009-01-15 22:21:50 —-A—- C:WINDOWSsystem32comsvcs.dll
2009-01-15 22:21:50 —-A—- C:WINDOWSsystem32clbcatq.dll
2009-01-15 22:21:47 —-A—- C:WINDOWSsystem32servdeps.dll
2009-01-15 22:21:47 —-A—- C:WINDOWSsystem32mmfutil.dll
2009-01-15 22:21:46 —-A—- C:WINDOWSsystem32licwmi.dll
2009-01-15 22:21:46 —-A—- C:WINDOWSsystem32cmprops.dll======List of files/folders modified in the last 1 months======
2009-01-16 10:15:46 —-A—- C:WINDOWSsystem.ini
2009-01-16 01:16:17 —-A—- C:WINDOWSwin.ini======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R1 AmdK8;Драйвер AMD процессора; C:WINDOWSsystem32DRIVERSAmdK8.sys [2006-06-18 43520]
R1 easdrv;easdrv; C:WINDOWSsystem32DRIVERSeasdrv.sys [2008-03-13 29704]
R1 epfwtdir;epfwtdir; C:WINDOWSsystem32DRIVERSepfwtdir.sys [2008-03-13 33800]
R1 kbdhid;Драйвер клавиатуры HID; C:WINDOWSsystem32DRIVERSkbdhid.sys [2004-08-17 14848]
R1 NVTCP;NVIDIA TCP/IP Protocol Driver; C:WINDOWSSystem32DRIVERSNVTcp.sys [2006-09-11 110592]
R1 SandBox;SandBox; C:WINDOWSsystem32DRIVERSSandBox.sys [2008-07-11 673920]
R1 WS2IFSL;Среда Windows Socket 2.0 поддержки поставщиков не-IFS служб; C:WINDOWSSystem32driversws2ifsl.sys [2001-10-21 12032]
R2 eamon;EAMON; C:WINDOWSsystem32DRIVERSeamon.sys [2008-03-13 40456]
R3 ADIHdAudAddService;ADI UAA Function Driver for High Definition Audio Service; C:WINDOWSsystem32driversADIHdAud.sys [2007-01-16 293888]
R3 AEAudio;AE Audio Service; C:WINDOWSsystem32driversAEAudio.sys [2006-08-07 93952]
R3 afw;Agnitum firewall driver; C:WINDOWSsystem32DRIVERSafw.sys [2008-06-30 30864]
R3 afwcore;afwcore; C:WINDOWSsystem32driversafwcore.sys [2008-06-30 234640]
R3 Arp1394;Протокол клиента 1394 ARP; C:WINDOWSsystem32DRIVERSarp1394.sys [2004-08-18 60800]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:WINDOWSsystem32DRIVERSHDAudBus.sys [2004-10-27 138240]
R3 hidusb;Драйвер класса HID Microsoft; C:WINDOWSsystem32DRIVERShidusb.sys [2001-10-21 9600]
R3 laPP;LostAngel’s protect driver; ??F:ИгрыWoWRuSlaPP.sys []
R3 mouhid;Драйвер мыши HID; C:WINDOWSsystem32DRIVERSmouhid.sys [2001-10-21 12160]
R3 MTsensor;ATK0110 ACPI UTILITY; C:WINDOWSsystem32DRIVERSASACPI.sys [2004-08-13 5810]
R3 NIC1394;Сетевой драйвер 1394; C:WINDOWSsystem32DRIVERSnic1394.sys [2004-08-18 61824]
R3 nv;nv; C:WINDOWSsystem32DRIVERSnv4_mini.sys [2007-09-17 6853088]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:WINDOWSsystem32DRIVERSNVENETFD.sys [2006-09-11 57856]
R3 nvnetbus;NVIDIA Network Bus Enumerator; C:WINDOWSsystem32DRIVERSnvnetbus.sys [2006-09-11 19968]
R3 SenFiltService;SenFilt Service; C:WINDOWSsystem32driversSenfilt.sys [2006-03-17 392960]
R3 usbccgp;Драйвер универсального родительского устройства USB (Microsoft); C:WINDOWSsystem32DRIVERSusbccgp.sys [2004-08-04 31616]
R3 usbehci;Драйвер минипорта Microsoft USB 2.0 расширенного хост-контроллера; C:WINDOWSsystem32DRIVERSusbehci.sys [2004-08-04 26624]
R3 usbhub;USB2 концентратор; C:WINDOWSsystem32DRIVERSusbhub.sys [2004-08-04 57600]
R3 usbohci;Драйвер минипорта Microsoft USB открытого хост-контроллера; C:WINDOWSsystem32DRIVERSusbohci.sys [2004-08-04 17024]
S3 ASWFilt;ASWFilt; C:WINDOWSsystem32FiltASWFilt.dll [2008-07-11 33408]
S3 USBSTOR;Драйвер запоминающих устройств для USB; C:WINDOWSsystem32DRIVERSUSBSTOR.SYS [2004-08-03 26496]
S3 WudfPf;Windows Driver Foundation — User-mode Driver Framework Platform Driver; C:WINDOWSsystem32DRIVERSWudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation — User-mode Driver Framework Reflector; C:WINDOWSsystem32DRIVERSwudfrd.sys [2006-09-28 82944]
S4 IntelIde;IntelIde; C:WINDOWSsystem32driversIntelIde.sys []
S4 sr;Драйвер фильтра восстановления системы; C:WINDOWSsystem32DRIVERSsr.sys [2004-08-17 73472]======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 acssrv;Agnitum Client Security Service; C:PROGRA~1AgnitumOUTPOS~1acs.exe [2008-07-15 1238344]
R2 ekrn;Eset Service; C:Program FilesESETESET NOD32 Antivirusekrn.exe [2008-03-13 472320]
R2 ForceWare Intelligent Application Manager (IAM);ForceWare Intelligent Application Manager (IAM); C:Program FilesNVIDIA CorporationNetworkAccessManagerbinnSvcAppFlt.exe [2006-09-11 172032]
R2 ForcewareWebInterface;Forceware Web Interface; C:Program FilesNVIDIA CorporationNetworkAccessManagerApache GroupApache2binapache.exe [2006-04-13 20543]
R2 nSvcIp;ForceWare IP service; C:Program FilesNVIDIA CorporationNetworkAccessManagerbinnSvcIp.exe [2006-09-11 135227]
R2 nSvcLog;ForceWare user log service; C:Program FilesNVIDIA CorporationNetworkAccessManagerbinnSvcLog.exe [2006-09-11 65599]
R2 NVSvc;NVIDIA Display Driver Service; C:WINDOWSsystem32nvsvc32.exe [2007-09-17 155716]
R3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:WINDOWSMicrosoft.NetFrameworkv3.0WPFPresentationFontCache.exe [2006-10-20 36864]
S2 giqvpbz;Boot Image; C:WINDOWSsystem32svchost.exe [2004-08-18 14336]
S3 aspnet_state;ASP.NET State Service; C:WINDOWSMicrosoft.NETFrameworkv2.0.50727aspnet_state.exe [2005-09-23 29896]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:WINDOWSMicrosoft.NETFrameworkv2.0.50727mscorsvw.exe [2005-09-23 66240]
S3 EhttpSrv;Eset HTTP Server; C:Program FilesESETESET NOD32 AntivirusEHttpSrv.exe [2008-03-13 19200]
S3 idsvc;Windows CardSpace; C:WINDOWSMicrosoft.NETFrameworkv3.0Windows Communication Foundationinfocard.exe [2006-10-30 741376]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:Program FilesMicrosoft OfficeOffice12GrooveAuditService.exe [2006-10-27 65824]
S3 NBService;NBService; C:Program FilesNeroNero 7Nero BackItUpNBService.exe [2007-01-15 774144]
S3 NMIndexingService;NMIndexingService; C:Program FilesCommon FilesAheadLibNMIndexingService.exe [2007-03-12 271920]
S3 odserv;Microsoft Office Diagnostics Service; C:Program FilesCommon FilesMicrosoft SharedOFFICE12ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:Program FilesCommon FilesMicrosoft SharedSource EngineOSE.EXE [2006-10-26 145184]
S3 Vertrigo_MySQL;Vertrigo_MySQL; C:VertrigoServmysqlbinv_mysqld.exe [2007-05-04 5701632]
S3 WudfSvc;Windows Driver Foundation — User-mode Driver Framework; C:WINDOWSsystem32svchost.exe [2004-08-18 14336]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:WINDOWSMicrosoft.NETFrameworkv3.0Windows Communication FoundationSMSvcHost.exe [2006-10-30 122880]
EOF
info.txt logfile of random’s system information tool 1.05 2009-01-18 18:26:41======Uninstall list======
—>C:Program FilesNeroNero 7\nerouninstallUNNERO.exe /UNINSTALL
—>C:WINDOWSUNNeroBackItUp.exe /UNINSTALL
—>C:WINDOWSUNNeroMediaHome.exe /UNINSTALL
—>C:WINDOWSUNNeroShowTime.exe /UNINSTALL
—>C:WINDOWSUNNeroVision.exe /UNINSTALL
—>C:WINDOWSUNRecode.exe /UNINSTALL
—>rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:WINDOWSINFPCHealth.inf
Agnitum Outpost Firewall Pro—>»C:Program FilesAgnitumOutpost Firewall Prounins000.exe»
ESET NOD32 Antivirus—>MsiExec.exe /I{B6E1E1DC-6DB4-420D-A80E-C8DF699C25EA}
Grand Theft Auto IV—>»C:Program FilesInstallShield Installation Information{579BA58C-F33D-4970-9953-B94B43768AC3}setup.exe» -runfromtemp -l0x0019 -removeonly
High Definition Audio Driver Package — KB888111—>C:WINDOWS$NtUninstallKB888111WXPSP2$spuninstspuninst.exe
JMB36X Raid Configurer—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1PROFES~1RunTime11 0Intel32Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{3A1B5D40-41E9-43FA-8C7B-A8667F5586EF}setup.exe» -l0x19 -removeonly
K-Lite Codec Pack 3.9.0 Full—>»C:Program FilesK-Lite Codec Packunins000.exe»
Microsoft .NET Framework 2.0 Language Pack — RUS—>C:WINDOWSMicrosoft.NETFrameworkv2.0.50727Microsoft .NET Framework 2.0 Language Pack — RUSinstall.exe
Microsoft .NET Framework 2.0—>C:WINDOWSMicrosoft.NETFrameworkv2.0.50727Microsoft .NET Framework 2.0install.exe
Microsoft .NET Framework 3.0 Russian Language Pack—>C:WINDOWSMicrosoft.NETFrameworkv3.0Microsoft .NET Framework 3.0 Russian Language Packsetup.exe
Microsoft .NET Framework 3.0 Russian Language Pack—>MsiExec.exe /X{855B04CC-4F7A-4FBB-B7BA-D965D23F7AD5}
Microsoft .NET Framework 3.0—>C:WINDOWSMicrosoft.NETFrameworkv3.0Microsoft .NET Framework 3.0setup.exe
Microsoft .NET Framework 3.0—>MsiExec.exe /X{15095BF3-A3D7-4DDF-B193-3A496881E003}
Microsoft Games for Windows — LIVE Redistributable—>MsiExec.exe /X{FD052FB9-FE90-4438-B355-15EDC89D8FB1}
Microsoft Office Access MUI (Russian) 2007—>MsiExec.exe /X{90120000-0015-0419-0000-0000000FF1CE}
Microsoft Office Enterprise 2007—>»C:Program FilesCommon FilesMicrosoft SharedOFFICE12Office Setup Controllersetup.exe» /uninstall ENTERPRISE /dll OSETUP.DLL
Microsoft Office Enterprise 2007—>MsiExec.exe /X{90120000-0030-0000-0000-0000000FF1CE}
Microsoft Office Excel MUI (Russian) 2007—>MsiExec.exe /X{90120000-0016-0419-0000-0000000FF1CE}
Microsoft Office Groove MUI (Russian) 2007—>MsiExec.exe /X{90120000-00BA-0419-0000-0000000FF1CE}
Microsoft Office InfoPath MUI (Russian) 2007—>MsiExec.exe /X{90120000-0044-0419-0000-0000000FF1CE}
Microsoft Office OneNote MUI (Russian) 2007—>MsiExec.exe /X{90120000-00A1-0419-0000-0000000FF1CE}
Microsoft Office Outlook MUI (Russian) 2007—>MsiExec.exe /X{90120000-001A-0419-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (Russian) 2007—>MsiExec.exe /X{90120000-0018-0419-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007—>MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (German) 2007—>MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE}
Microsoft Office Proof (Russian) 2007—>MsiExec.exe /X{90120000-001F-0419-0000-0000000FF1CE}
Microsoft Office Proof (Ukrainian) 2007—>MsiExec.exe /X{90120000-001F-0422-0000-0000000FF1CE}
Microsoft Office Proofing (Russian) 2007—>MsiExec.exe /X{90120000-002C-0419-0000-0000000FF1CE}
Microsoft Office Publisher MUI (Russian) 2007—>MsiExec.exe /X{90120000-0019-0419-0000-0000000FF1CE}
Microsoft Office Shared MUI (Russian) 2007—>MsiExec.exe /X{90120000-006E-0419-0000-0000000FF1CE}
Microsoft Office Word MUI (Russian) 2007—>MsiExec.exe /X{90120000-001B-0419-0000-0000000FF1CE}
Microsoft User-Mode Driver Framework Feature Pack 1.0—>»C:WINDOWS$NtUninstallWudf01000$spuninstspuninst.exe»
Microsoft Visual C++ 2005 Redistributable—>MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Mozilla Firefox (3.0)—>C:Program FilesMozilla Firefoxuninstallhelper.exe
MSXML 6.0 Parser (KB925673)—>MsiExec.exe /I{FE9126DB-5F84-495A-BB46-3C724F1C2D08}
Nero 7 Ultra Edition—>MsiExec.exe /I{400348D1-032F-4717-A840-D52F975C1049}
neroxml—>MsiExec.exe /I{56C049BE-79E9-4502-BEA7-9754A3E60F9B}
NVIDIA Drivers—>C:WINDOWSsystem32nvudisp.exe UninstallGUI
NVIDIA ForceWare Network Access Manager—>C:PROGRA~1COMMON~1INSTAL~1Driver9INTEL3~1IDriver.exe /M{1F6423DE-7959-4178-80E0-023C7EAA5347} /l1033
Radmin Viewer 3.0—>»C:Program FilesRadmin Viewer 3.0uninstall.exe»
Rockstar Games Social Club—>»C:Program FilesInstallShield Installation Information{08B3869E-D282-424C-9AFC-870E04A4BA14}setup.exe» -runfromtemp -l0x0019 -removeonly
SoundMAX—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1PROFES~1RunTime10 0Intel32Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{F0A37341-D692-11D4-A984-009027EC0A9C}setup.exe» -l0x19 -removeonly
VertrigoServ (remove only)—>C:VertrigoServUninstall.exe
Windows Communication Foundation—>MsiExec.exe /X{491DD792-AD81-429C-9EB4-86DD3D22E333}
Windows Imaging Component—>»C:WINDOWS$NtUninstallWIC$spuninstspuninst.exe»
Windows Media Format 11 runtime—>»C:Program FilesWindows Media Playerwmsetsdk.exe» /UninstallAll
Windows Media Format 11 runtime—>»C:WINDOWS$NtUninstallWMFDist11$spuninstspuninst.exe»
Windows Presentation Foundation Language Pack (RUS)—>MsiExec.exe /X{D83A3DFC-8528-4E31-93DC-0A41C477109C}
Windows Presentation Foundation—>MsiExec.exe /X{BAF78226-3200-4DB4-BE33-4D922A799840}
Windows Workflow Foundation RU Language Pack—>MsiExec.exe /I{1C7ADED3-C371-40DF-A69D-FE0EA73DC394}
Windows Workflow Foundation—>MsiExec.exe /I{7D1B85BD-AA07-48B8-808D-67A4067FC6BD}
XML Paper Specification Shared Components Language Pack 1.0—>»C:WINDOWS$NtUninstallXPSEPSCLP$spuninstspuninst.exe»
Архиватор WinRAR—>C:Program FilesWinRARuninstall.exe
Пакет драйверов Windows — Advanced Micro Devices (AmdK8) Processor (05/27/2006 1.3.2.0)—>C:PROGRA~1DIFX7B44739871F4D539FA473F57A832EA4B6A59EF06DPInst.exe /d /u C:WINDOWSsystem32DRVSTOREamdk8_A8D26169E6EDA9205D39A3918FEA7EFFFE870B0Aamdk8.inf======Security center information======
AV: ESET NOD32 Antivirus 3.0
FW: Outpost Firewall ProSystem event log
Computer Name: HELL
Event Code: 3260
Message: Этот компьютер был успешно присоединен к workgroup ‘WORKGROUP’.Record Number: 5
Source Name: Workstation
Time Written: 20090115222137.000000+720
Event Type: информация
User:Computer Name: HELL
Event Code: 6011
Message: NetBIOS-имя и имя DNS-узла этого компьютера были изменены с «MACHINENAME» на «HELL».Record Number: 4
Source Name: EventLog
Time Written: 20090115221857.000000+720
Event Type: информация
User:Computer Name: MACHINENAME
Event Code: 2
Message: При проверке, что DeviceSerial0 является последовательным портом, обнаружена и будет использоваться прямая очередь.Record Number: 3
Source Name: Serial
Time Written: 20090116101346.000000+720
Event Type: информация
User:Computer Name: MACHINENAME
Event Code: 6005
Message: Запущена служба журнала событий.Record Number: 2
Source Name: EventLog
Time Written: 20090116101325.000000+720
Event Type: информация
User:Computer Name: MACHINENAME
Event Code: 6009
Message: Microsoft (R) Windows 2000 (R) 5.01. 2600 Service Pack 2 Multiprocessor Free.Record Number: 1
Source Name: EventLog
Time Written: 20090116101325.000000+720
Event Type: информация
User:Application event log
Computer Name: HELL
Event Code: 1000
Message: Счетчики производительности для службы MSDTC (MSDTC) загружены успешно.
Данные записи содержат новые значение индекса,
назначенного этой службе.Record Number: 5
Source Name: LoadPerf
Time Written: 20090115222221.000000+720
Event Type: информация
User:Computer Name: HELL
Event Code: 1000
Message: Счетчики производительности для службы TermService (Службы терминалов) загружены успешно.
Данные записи содержат новые значение индекса,
назначенного этой службе.Record Number: 4
Source Name: LoadPerf
Time Written: 20090115222218.000000+720
Event Type: информация
User:Computer Name: HELL
Event Code: 1000
Message: Счетчики производительности для службы RemoteAccess (Маршрутизация и удаленный доступ) загружены успешно.
Данные записи содержат новые значение индекса,
назначенного этой службе.Record Number: 3
Source Name: LoadPerf
Time Written: 20090115221931.000000+720
Event Type: информация
User:Computer Name: HELL
Event Code: 1000
Message: Счетчики производительности для службы PSched (PSched) загружены успешно.
Данные записи содержат новые значение индекса,
назначенного этой службе.Record Number: 2
Source Name: LoadPerf
Time Written: 20090115221907.000000+720
Event Type: информация
User:Computer Name: HELL
Event Code: 1000
Message: Счетчики производительности для службы RSVP (QoS RSVP) загружены успешно.
Данные записи содержат новые значение индекса,
назначенного этой службе.Record Number: 1
Source Name: LoadPerf
Time Written: 20090115221906.000000+720
Event Type: информация
User:======Environment variables======
«ComSpec»=%SystemRoot%system32cmd.exe
«Path»=%SystemRoot%system32;%SystemRoot%;%SystemRoot%System32Wbem
«windir»=%SystemRoot%
«FP_NO_HOST_CHECK»=NO
«OS»=Windows_NT
«PROCESSOR_ARCHITECTURE»=x86
«PROCESSOR_LEVEL»=15
«PROCESSOR_IDENTIFIER»=x86 Family 15 Model 67 Stepping 3, AuthenticAMD
«PROCESSOR_REVISION»=4303
«NUMBER_OF_PROCESSORS»=2
«PATHEXT»=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
«TEMP»=%SystemRoot%TEMP
«TMP»=%SystemRoot%TEMP
«RGSCLauncher»=D:GamesRockstar GamesRockstar Games Social Club
«RGSC»=D:GamesRockstar GamesRockstar Games Social Club1_0_0_0
EOF
после прощелся программой anti-Downadup-EN (по вашему совету) на что она сказала что комп чист… но червяк продолжает терроризировать меня:( подскажите чем ещ можно воспользоваться??? переустанавливал винду 3 раза стоит хп сп2 нахожусь в локальной сети пользуюсь фаерволом аутпостом и через него вижу что я не один с такой проблемой…Здравствуйте, добро пожаловать на Spyware-ru форум.
Мало вылечить ваш компьютер, нужно так же закрыть уязвимость в Windows, которую этот червь использует для распространения.
Установите этот патч http://www.microsoft.com/technet/security/Bulletin/MS08-067.mspxПосле чего уже лечите компьютер антивирусом.
Сообщите о результате.И ещё, этот червь может использовать autorun.inf файлы для распространения.
Прочитайте эту инструкцию Flash_Disinfector ещё одно оружие против autorun.inf троянов. Скачайте и запустите Flash_Disinfector, не забудьте при этом по требованию программы вставить ваш флэш диск или подключить другие внешние устройства хранения информации.хм…. данный пакет был установлен у меня за долго как я забрёл на данный форум… ладно попробую снести винду сделать жёское форматирование установить винду залатать дырку установить антивирь фаервол и лишь потом подключить винт с данными;) о результатах отпишу…
Хмм червь удаляется и стандартными средставами. Но хозяин-барин.
Вы пробовали утилиты специально разработанные для борьбы с этим червём ?
Они перечислены в этой статье (Eng): http://www.myantispyware.com/2009/01/12/how-to-remove-win32confickeraa-win32wormdownadupgen/
Если конкретно, то:
1 утилита (от BitDefender).
2 утилита (от F-Secure)
3 утилита (от лаборатории Касперского).хм… все проги использовал в разнобой… а ща сделал все как написано в инструкции (с отключением сетевого кабеля) сейчас же после перезагрузки выдает сообщение как выдавал раньше до того как я узнал что это вообще вирус… 😥 о работе червя пока ничего сказать немогу так как сказать информация из первых рук…. если опять начнет злорадствовать то отпишу;)
З.Ы. очень благодарю за поддержку… буду всем советовать данный форум 😎вообщем что то не помогло((( ошибка появилась пару раз после перезагрузки и все.. а вирус досих пор остался… хотя нод его почему то ща уже невидет((((
Ясно, попробуем тогда удалить червя вручную.
Скачайте программу Combofix. Закройте все открытые окна и запустите эту программу.
После выполнения будет создан лог файл, пожалуйста вставьте его в ваш ответ.вообщем закрыл вроде все что смог)))
ComboFix 09-01-21.04 — adm 2009-01-24 12:53:12.1 — NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1251.7.1049.18.3582.3159 [GMT 12:00]
Running from: c:documents and settingsadmРабочий столComboFix.exe
AV: Антивирус Касперского *On-access scanning enabled* (Updated)
* Created a new restore pointWARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.((((((((((((((((((((((((( Files Created from 2008-12-24 to 2009-01-24 )))))))))))))))))))))))))))))))
.2009-01-24 12:56 . 2009-01-24 12:56 53,248 —a
c:tempcatchme.dll
2009-01-24 12:55 . 2009-01-24 12:55d
c:tempWPDNSE
2009-01-24 04:56 . 2009-01-24 04:56d
c:program filesK-Lite Codec Pack
2009-01-24 04:56 . 2009-01-24 04:56d
c:documents and settingsadmApplication DataMedia Player Classic
2009-01-23 23:56 . 2009-01-23 23:57d
c:windowssystem32XPSViewer
2009-01-23 23:56 . 2009-01-23 23:56d
c:program filesReference Assemblies
2009-01-23 23:56 . 2009-01-23 23:56d
c:program filesMSBuild
2009-01-23 23:55 . 2006-06-29 13:07 22,752 —a
c:windowssystem32spupdsvc.exe
2009-01-23 23:55 . 2006-06-29 13:07 14,048
c:windowssystem32spmsg2.dll
2009-01-23 23:45 . 2009-01-24 11:56d
C:VertrigoServ
2009-01-23 19:47 . 2009-01-23 11:25d
c:tempplugtmp
2009-01-23 19:39 . 2009-01-23 19:39 0 —a
c:windowsnsreg.dat
2009-01-23 15:52 . 2009-01-24 04:58 69 —a
c:windowsNeroDigital.ini
2009-01-23 15:33 . 2009-01-23 15:34d
c:tempnps.tmp
2009-01-23 15:33 . 2009-01-23 15:33d
c:program filesNero
2009-01-23 15:33 . 2009-01-23 15:33d
c:program filesCommon FilesAhead
2009-01-23 15:33 . 2009-01-23 15:33d
c:documents and settingsAll UsersApplication DataNero
2009-01-23 15:33 . 2009-01-23 15:37d
c:documents and settingsadmApplication DataAhead
2009-01-23 15:32 . 2009-01-24 12:55d
c:tempnro.tmp
2009-01-23 15:32 . 2009-01-23 15:32d
c:tempnro.log
2009-01-23 15:31 . 2009-01-24 12:55d
c:tempNeroDemo12570
2009-01-23 13:59 . 2009-01-23 13:59d
c:documents and settingsadmApplication DataYandex
2009-01-23 13:43 . 2009-01-23 13:43d
c:program filessgconfig
2009-01-23 13:43 . 2009-01-23 13:45d
c:program filesQIP
2009-01-23 13:43 . 2009-01-23 13:43d
c:program filesLanSpy
2009-01-23 13:43 . 2009-01-23 13:43d
c:program filesipchmon
2009-01-23 13:43 . 2009-01-23 13:43d
c:program filesInetAccess
2009-01-23 13:43 . 2009-01-23 13:43d
c:program filesFPinger
2009-01-23 13:32 . 2009-01-23 13:32d—h
c:windows$hf_mig$
2009-01-23 11:27 . 2009-01-23 11:27d—h
c:windowsPIF
2009-01-23 09:02 . 2009-01-23 09:02d
c:program filesKaspersky Lab
2009-01-23 09:02 . 2009-01-24 12:55d
c:documents and settingsAll UsersApplication DataKaspersky Lab
2009-01-23 09:02 . 2009-01-24 12:55 4,515,872 —ahs—- c:windowssystem32driversfidbox.dat
2009-01-23 09:02 . 2009-01-24 12:55 278,560 —ahs—- c:windowssystem32driversfidbox2.dat
2009-01-23 09:02 . 2009-01-23 09:02 96,976 —a
c:windowssystem32driversklin.dat
2009-01-23 09:02 . 2009-01-23 09:02 87,855 —a
c:windowssystem32driversklick.dat
2009-01-23 09:02 . 2009-01-24 12:55 38,456 —ahs—- c:windowssystem32driversfidbox.idx
2009-01-23 09:02 . 2009-01-24 12:56 4,156 —ahs—- c:windowssystem32driversfidbox2.idx
2009-01-23 09:01 . 2009-01-23 09:02d
c:temp{6580C5A3-2336-4EC5-85F1-3448C5F6208A}
2009-01-23 09:01 . 2009-01-23 09:01d
c:documents and settingsAll UsersApplication DataKaspersky Lab Setup Files
2009-01-23 08:56 . 2008-04-14 09:15 26,368 —a—c— c:windowssystem32dllcacheusbstor.sys
2009-01-23 08:33 . 2009-01-23 08:33d
c:windowsnview
2009-01-23 08:33 . 2007-09-17 17:37 356,352 —a
c:windowssystem32nvudisp.exe
2009-01-23 08:33 . 2009-01-23 08:36 138,074 —a
c:windowssystem32nvapps.xml
2009-01-23 08:33 . 2007-09-17 17:37 17,525 —a
c:windowssystem32nvdisp.nvu
2009-01-23 08:29 . 2009-01-23 08:29d
c:windowsJM
2009-01-23 08:29 . 2009-01-24 12:55d
c:tempisp18E.tmp
2009-01-23 08:29 . 2009-01-24 12:55d
c:tempisp180.tmp
2009-01-23 08:29 . 2009-01-24 12:55d
c:tempisp16C.tmp
2009-01-23 08:29 . 2009-01-23 08:29d
C:JM
2009-01-23 08:29 . 2006-11-16 21:05 1,953,792 -r
c:windowssystem32JMRaidSetup.exe
2009-01-23 08:29 . 2006-12-05 20:39 139,264 -r
c:windowssystem32JMRaidAPI.dll
2009-01-23 08:29 . 2006-12-06 23:41 44,416 -ra
c:windowssystem32driversjraid.sys
2009-01-23 08:29 . 2006-02-07 23:52 6,912 -ra
c:windowssystem32driversJGOGO.sys
2009-01-23 08:28 . 2009-01-23 08:28d—-c— c:windowssystem32DRVSTORE
2009-01-23 08:28 . 2009-01-23 08:28d
c:tempAMD
2009-01-23 08:28 . 2009-01-23 08:28d
c:temp{A8321EC2-8831-43C3-942D-A205BE70D7D5}
2009-01-23 08:28 . 2009-01-24 12:55d
c:temp{1F6423DE-7959-4178-80E0-023C7EAA5347}
2009-01-23 08:28 . 2009-01-23 08:29d—h
c:program filesInstallShield Installation Information
2009-01-23 08:28 . 2009-01-23 08:28d
c:program filesDIFX
2009-01-23 08:28 . 2001-09-11 23:20 1,285,632
c:windowssystem32SMMedia.dll
2009-01-23 08:28 . 2006-03-24 04:53 442,368 —a
c:windowssystem32CapabilityTable.exe
2009-01-23 08:28 . 2006-08-21 22:24 363,008 -ra
c:windowssystem32SETEF.tmp
2009-01-23 08:28 . 2006-08-21 22:24 363,008 -ra
c:windowssystem32SETE7.tmp
2009-01-23 08:28 . 2005-05-04 17:20 53,248
c:windowssystem32wdmioctl.dll
2009-01-23 08:28 . 2006-07-10 23:42 49,152
c:windowssystem32DSndUp.exe
2009-01-23 08:28 . 2002-04-17 23:05 45,056
c:windowssystem32CleanUp.exe
2009-01-23 08:28 . 2006-06-19 08:38 43,520 —a
c:windowssystem32driversAmdK8.sys
2009-01-23 08:28 . 2006-08-18 14:28 35,840 -ra
c:windowssystem32SETF3.tmp
2009-01-23 08:28 . 2006-08-18 14:28 35,840 -ra
c:windowssystem32SETEB.tmp
2009-01-23 08:27 . 2009-01-23 08:28d
c:tempiss9A.tmp
2009-01-23 08:27 . 2009-01-23 08:28d
c:program filesCommon FilesInstallShield
2009-01-23 08:26 . 2009-01-23 08:28d
c:program filesAnalog Devices
2009-01-23 08:26 . 2001-09-19 16:47 765,952 -ra
c:windowssystemcrlds3d.dll.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-23 00:49
d
w c:program filesAIMP2
2009-01-22 16:49
d
w c:program filesmicrosoft frontpage
2009-01-22 16:45
d
w c:program filesWindows Media Connect 2
.
Sigcheck
2008-02-17 22:03 360832 ce3ec03c9f65302e44af5c452d20a86f c:windowssystem32driverstcpip.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32ctfmon.exe» [2008-04-16 15360]
«QIP2005″=»c:program filesQIPqip.exe» [2008-12-09 3259392]
«BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}»=»c:program filesCommon FilesAheadLibNMBgMonitor.exe» [2007-03-12 153136][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«SoundMAXPnP»=»c:program filesAnalog DevicesCoresmax4pnp.exe» [2006-12-19 868352]
«JMB36X IDE Setup»=»c:windowsJMJMInsIDE.exe» [2006-10-31 36864]
«36X Raid Configurer»=»c:windowssystem32JMRaidSetup.exe» [2006-11-16 1953792]
«NvCplDaemon»=»c:windowssystem32NvCpl.dll» [2007-09-17 8491008]
«NvMediaCenter»=»c:windowssystem32NvMcTray.dll» [2007-09-17 81920]
«AVP»=»c:program filesKaspersky LabKaspersky Anti-Virus 2009avp.exe» [2008-11-12 206088]
«NeroFilterCheck»=»c:program filesCommon FilesAheadLibNeroCheck.exe» [2007-03-09 153136]
«nwiz»=»nwiz.exe» [2007-09-17 c:windowssystem32nwiz.exe][HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32CTFMON.EXE» [2008-04-16 15360][HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRunOnce]
«IE7_011″=»shell32» [X]
«IE7_012″=»advpack.dll» [2008-06-30 c:windowssystem32advpack.dll][HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«Start_NotifyNewApps»= 0 (0x0)[HKEY_USERS.defaultsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«Start_NotifyNewApps»= 0 (0x0)[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity centerMonitoringKasperskyAntiVirus]
«DisableMonitoring»=dword:00000001[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\Network Diagnostic\xpnetdiag.exe»=
«%windir%\system32\sessmgr.exe»=
«f:\prodramm\QIP\qip.exe»=
«c:\Program Files\InetAccess\InetAccess.exe»=
«c:\Program Files\QIP\qip.exe»=
«c:\VertrigoServ\Apache\bin\v_apache.exe»=
«c:\VertrigoServ\Mysql\bin\v_mysqld.exe»=R0 klbg;Kaspersky Lab Boot Guard Driver;c:windowssystem32driversklbg.sys [2008-01-30 32784]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:windowssystem32driversklim5.sys [2008-05-01 24592]
.
.
Supplementary Scan
.
uStart Page = hxxp://philka.ru
TCP: {EA19FAEE-48C7-4FD0-962E-F34DC3B4E161} = 91.189.239.67,91.189.232.2
FF — ProfilePath — c:documents and settingsadmApplication DataMozillaFirefoxProfilesm1rwe7lj.default
FF — prefs.js: browser.search.selectedEngine — Яндекс
.**************************************************************************
catchme 0.3.1367 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-24 12:56:00
Windows 5.1.2600 Service Pack 3 NTFSscanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0**************************************************************************
.
Other Running Processes
.
c:windowssystem32nvsvc32.exe
c:windowssystem32wscntfy.exe
c:windowssystem32rundll32.exe
c:program filesCommon FilesAheadLibNMIndexingService.exe
c:program filesCommon FilesAheadLibNMIndexStoreSvr.exe
.
**************************************************************************
.
Completion time: 2009-01-24 12:57:10 — machine was rebooted
ComboFix-quarantined-files.txt 2009-01-24 00:57:08Pre-Run: 95 826 632 704 байт свободно
Post-Run: 96,537,042,944 байт свободно166
- Для ответа в этой теме необходимо авторизоваться.
