Не могу удалить информер порносайта. Combofix не помог.

[Vadik1988]

Результат сканирования RSIT

info.txt logfile of random’s system information tool 1.06 2009-03-26 00:44:47

======Uninstall list======

—>MsiExec.exe /X{E9F81423-211E-46B6-9AE0-38568BC5CF6F}
—>C:Program FilesDivXDivXConverterUninstall.exe /CONVERTER
—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1engine6INTEL3~1ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{C3F058C0-A21C-452D-8D99-95B1A45F417D}setup.exe» REMOVEALL
—>rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:WINDOWSINFPCHealth.inf
µTorrent—>»C:Program FilesuTorrentuninstall.exe»
1-2-3FileConvert v4.0—>C:PROGRA~1123FileConvertUNWISE.EXE /A C:PROGRA~1123FileConvertINSTALL.LOG
3114 SATARAID5—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1engine6INTEL3~1Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{8E4CF4E6-062E-11D8-BCF1-005004748D87}Setup.exe» -l0x9
ACDSee 10 Photo Manager—>MsiExec.exe /I{F8B98EB6-FC06-45BF-87D4-9784E0408611}
Adobe Flash Player 10 Plugin—>C:WINDOWSsystem32MacromedFlashuninstall_plugin.exe
Adobe Shockwave Player—>C:WINDOWSsystem32MacromedShockwave 10UNWISE.EXE C:WINDOWSsystem32MacromedShockwave 10Install.log
AIMP2—>C:Program FilesAIMP2UnInstall.exe
Ashampoo WinOptimizer 5.03—>»C:Program FilesAshampooAshampoo WinOptimizer 5unins000.exe»
Athlon 64 Processor Driver—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1PROFES~1RunTime91Intel32Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{C151CE54-E7EA-4804-854B-F515368B0798}setup.exe» -l0x19
Auto Gordian Knot 2.45—>C:Program FilesAutoGKuninst.exe
AVIConverter 2.0—>C:Program FilesAVIConverteruninst.exe
AviSynth 2.5—>»C:Program FilesAviSynth 2.5Uninstall.exe»
Classic PhoneTools—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1engine6INTEL3~1Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{E3436EE2-D5CB-4249-840B-3A0140CC34C3}setup.exe» -l0x9 ControlPanel
CleanCenter v1.33.2—>»C:Program FilesCleanCenterunins000.exe»
Cool Edit 2000—>C:Program FilesCool2000ce2Kunin.exe
Counter-Strike 1.6—>D:GamesCounter-Strike 1.6Uninstal.exe
DivX Converter—>C:Program FilesDivXDivXConverterUninstall.exe /CONVERTER
DivX Player—>C:Program FilesDivXDivXPlayerUninstall.exe /PLAYER
DivX Web Player—>C:Program FilesDivXDivXWebPlayerUninstall.exe /PLUGIN
Download Master version 5.5.10.1163—>»C:Program FilesDownload Masterunins000.exe»
ESET Smart Security—>MsiExec.exe /I{FFB5505B-B08F-47D8-99A9-B78A03B04A44}
Foxit Reader—>C:Program FilesFoxit SoftwareFoxit ReaderUninstall.exe
Garena—>C:Program FilesInstallShield Installation Information{89C89156-A70F-4C6D-9CAE-2EA71F1396FE}setup.exe -runfromtemp -l0x0019 -removeonly
Google Планета Земля—>MsiExec.exe /I{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}
GrandBilliards 1.0—>»C:Program FilesGrandBilliardsunins000.exe»
HijackThis 2.0.2—>»C:Program Filestrend microHijackThis.exe» /uninstall
ICE Book Reader Professional v8.9.2 Russian—>»C:Program FilesICE Book Reader Professional Russianunins000.exe»
IconDeveloper Professional—>C:PROGRA~1StardockObject DesktopIconDeveloperUNWISE.EXE C:PROGRA~1StardockObject DesktopIconDeveloperINSTALL.LOG
ICQ Toolbar—>C:Program FilesICQ6ToolbarICQUnToolbar.exe
ICQ6—>»C:Program FilesInstallShield Installation Information{60DE4033-9503-48D1-A483-7846BD217CA9}setup.exe» -runfromtemp -l0x0009 -removeonly
InterVideo DirectCD—>»C:Program FilesInstallShield Installation Information{883CC465-ED54-4400-A788-3C0DD29E199D}setup.exe» —u:{883CC465-ED54-4400-A788-3C0DD29E199D}
InterVideo Disc Master 2.5—>»C:Program FilesInstallShield Installation Information{F366D0C4-18F2-44A6-A4E7-7ED2DD37F3D3}setup.exe» —u:{F366D0C4-18F2-44A6-A4E7-7ED2DD37F3D3}
Java(TM) 6 Update 11—>MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216010FF}
K-Lite Mega Codec Pack 4.2.5—>»C:Program FilesK-Lite Codec Packunins000.exe»
LCard — Адресная книга—>C:Program FilesLcardUninstal.exe
Lernout & Hauspie TruVoice for Microsoft Agent—>RunDll32 advpack.dll,LaunchINFSection C:WINDOWSINFcgminst.inf, RemoveCgram
Light Alloy 4.4 (build 784)—>C:Program FilesLight Alloyuninst.exe
Lizardtech DjVu Control—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1engine6INTEL3~1Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{105CFC7C-6992-11D5-BD9D-000102C10FD8}Setup.exe» -l0x9
Magic Gooddy—>C:Program FilesMagic GooddyCMPSETUPUNINSTAL.EXE MG_0001
Magic Keyboard—>C:WINDOWSISUNINST.EXE -f»C:Program FilesMagicKeyuninst.isu» -c»C:Program FilesMagicKeyUnInst.dll»
Mail.Ru Агент 5.4 (сборка 2614, для всех пользователей)—>C:Program FilesMail.RuAgentmagentsetup.exe -uninstalllm
Mail.Ru Спутник 2.0.1.54—>C:Program FilesMail.RuSputnikSputnikInstaller.exe -uninstall
Microsoft Agent 1.5—>RunDll32 advpack.dll,LaunchINFSection C:WINDOWSINFagtinst.inf, RemoveAgent
Microsoft Command & Control Engine—>RunDll32 advpack.dll,LaunchINFSection C:WINDOWSINFmscnc.inf, Uninstall
Microsoft Office — профессиональный выпуск версии 2003—>MsiExec.exe /I{90110419-6000-11D3-8CFE-0150048383C9}
Microsoft Speech API 3.0—>RunDll32 advpack.dll,LaunchINFSection C:WINDOWSINFspchapi.inf, Uninstall
Microsoft Speech Lexicon—>RunDll32 advpack.dll,LaunchINFSection C:WINDOWSINFmslex.inf, Uninstall
Microsoft Visual C++ 2005 Redistributable—>MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Visual C++ 2008 Redistributable — x86 9.0.21022—>MsiExec.exe /X{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}
Migo—>C:Documents and SettingsВадикApplication DataPowerhouseMigoMigoCleanup.exe
Mozilla Firefox (3.0.1)—>C:Program FilesMozilla Firefoxuninstallhelper.exe
NVIDIA Drivers—>C:WINDOWSsystem32NVUNINST.EXE UninstallGUI
OpenAL—>»C:Program FilesOpenALoalinst.exe» /U
Opera 9.63—>MsiExec.exe /X{2C0CD17D-0B06-4700-83FA-7344B868B0A2}
PDF to Word—>»C:Program FilesPDF to Wordunins000.exe»
Punto Switcher 3.0—>C:Program FilesPunto Switcheruninstall.exe
Realtek AC’97 Audio—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1engine6INTEL3~1ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{FB08F381-6533-4108-B7DD-039E11FBC27E}setup.exe» REMOVE
Riston Capital Terminal 4.00—>»C:Program FilesRiston Capital TerminalUninstall.exe» «C:Program FilesRiston Capital Terminalinstall.log»
RuTube Media Uploader—>»C:Program FilesRuTube Media Uploaderuninst.exe»
SAMSUNG CDMA Modem Driver Set—>C:WINDOWSsystem32Samsung_USB_Drivers3SSCDUninstall.exe
SAMSUNG Mobile USB Modem 1.0 Software—>C:WINDOWSsystem32Samsung_USB_Drivers1SS_Uninstall.exe
SAMSUNG Mobile USB Modem Software—>C:WINDOWSsystem32Samsung_USB_Drivers2SSM_Uninstall.exe
Samsung PC Studio 3 USB Driver Installer—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1PROFES~1RunTime1050Intel32Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{EBA29752-DDD2-4B62-B2E3-9841F92A3E3A}setup.exe» -l0x19 -removeonly
SWF & FLV Toolbox 3.5 (build 3.5.19.275)—>»C:Program FilesEltima SoftwareSWF & FLV Toolboxunins000.exe»
TNR CodeExpert—>»C:Program FilesTNR CodeExpertUninstall.exe»
TNR ComiXView — просмотрщик комиксов—>»C:Program FilesTNR ComiXViewUninstall.exe»
TNR MoonLight — Лунный календарь—>»C:Program FilesTNR MoonLightUninstall.exe»
TNR Vision 3.3 — электронный сонник—>»C:Program FilesTNR Vision 3Uninstall.exe»
Total Commander 6.52 PowerPack—>»C:Program FilesTotal Commanderuninstall.exe»
Transformers—>»D:GamesTransformersunins000.exe»
Unlocker 1.8.7—>C:Program FilesUnlockeruninst.exe
ViewSonic Monitor Drivers—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1engine6INTEL3~1Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{B4FEA924-630D-11D4-B78E-005004566E4D}Setup.exe» -l0x9
VobSub v2.23 (Remove Only)—>»C:Program FilesGabestVobSubuninstall.exe»
Vodafone 804SS USB driver Software—>C:WINDOWSsystem32Samsung_USB_Drivers4SSVDUninstall.exe
VSO Image Resizer 2.0.1.9—>»C:Program FilesVSOImage Resizerunins000.exe»
Winamp—>»C:Program FilesWinampUninstWA.exe»
Windows Internet Explorer 8 Beta 2—>»C:WINDOWSie8spuninstspuninst.exe»
XviD MPEG4 Video Codec (remove only)—>»C:WINDOWSsystem32xvid-uninstall.exe»
Архиватор WinRAR (только удаление)—>C:Program FilesWinRARuninstall.exe
Данные ДубльГИС г.Барнаул 01.03.2009—>MsiExec.exe /X{05FA8712-FCA5-4F44-9036-931C59922088}
Декларация 2008—>»C:Program FilesДекларация 2008unins000.exe»
ДубльГИС 3.0.4.2—>MsiExec.exe /X{EBF56A8E-3483-4704-98B8-7685891F8EA7}
Книга Перемен—>»C:Program FilesПростые решенияКнига переменUnInstall_20132.exe»
Коляды Дар 2.1—>»C:Program FilesKolyadiDarunins000.exe»
Пакет обеспечения совместимости для выпуска 2007 системы Microsoft Office—>MsiExec.exe /X{90120000-0020-0419-0000-0000000FF1CE}
Печать НД с PDF417 3.0.9 (пакет)—>MsiExec.exe /I{476219D4-168B-4634-9A38-A5286BB3AFB5}
Программа обновлений Google—>»C:Program FilesGoogleGoogle UpdaterGoogleUpdater.exe» -uninstall
Центр обновлений ДубльГИС—>MsiExec.exe /X{2FB165EB-69C0-416D-9B4E-E805ABC8CB1F}

======Security center information======

AV: ESET Smart Security 3.0
FW: Персональный файервол ESET

======System event log======

Computer Name: ВАДЯ
Event Code: 7035
Message: Служба «Служба COM записи компакт-дисков IMAPI» успешно отправила управляющий элемент «запустить».

Record Number: 480
Source Name: Service Control Manager
Time Written: 20090218183839.000000+360
Event Type: информация
User: NT AUTHORITYSYSTEM

Computer Name: ВАДЯ
Event Code: 7035
Message: Служба «Диспетчер подключений удаленного доступа» успешно отправила управляющий элемент «запустить».

Record Number: 479
Source Name: Service Control Manager
Time Written: 20090218183839.000000+360
Event Type: информация
User: ВАДЯВадик

Computer Name: ВАДЯ
Event Code: 7036
Message: Служба «Телефония» перешла в состояние Работает.

Record Number: 478
Source Name: Service Control Manager
Time Written: 20090218183839.000000+360
Event Type: информация
User:

Computer Name: ВАДЯ
Event Code: 7036
Message: Служба «Совместимость быстрого переключения пользователей» перешла в состояние Работает.

Record Number: 477
Source Name: Service Control Manager
Time Written: 20090218183839.000000+360
Event Type: информация
User:

Computer Name: ВАДЯ
Event Code: 7035
Message: Служба «Совместимость быстрого переключения пользователей» успешно отправила управляющий элемент «запустить».

Record Number: 476
Source Name: Service Control Manager
Time Written: 20090218183839.000000+360
Event Type: информация
User: NT AUTHORITYSYSTEM

======Environment variables======

«ComSpec»=%SystemRoot%system32cmd.exe
«Path»=%systemroot%system32;%systemroot%;%systemroot%system32wbem;C:WINDOWSsystem32gsgs7.05bin
«windir»=%SystemRoot%
«FP_NO_HOST_CHECK»=NO
«OS»=Windows_NT
«PROCESSOR_ARCHITECTURE»=x86
«PROCESSOR_LEVEL»=15
«PROCESSOR_IDENTIFIER»=x86 Family 15 Model 47 Stepping 0, AuthenticAMD
«PROCESSOR_REVISION»=2f00
«NUMBER_OF_PROCESSORS»=1
«PATHEXT»=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
«TEMP»=%SystemRoot%TEMP
«TMP»=%SystemRoot%TEMP

---

EOF

---

Logfile of random’s system information tool 1.06 (written by random/random)
Run by Вадик at 2009-03-26 00:44:21
Microsoft Windows XP Professional Service Pack 2
System drive C: has 4 GB (21%) free of 20 GB
Total RAM: 511 MB (29% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 0:44:46, on 26.03.2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18241)
Boot mode: Normal

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSExplorer.EXE
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSsystem32RUNDLL32.EXE
C:Program FilesClassic PhoneToolsCapFax.EXE
C:WINDOWSsystem32rundll32.exe
C:Program FilesUnlockerUnlockerAssistant.exe
C:Program FilesJavajre6binjusched.exe
C:Program FilesESETESET Smart Securityegui.exe
C:Program FilesWinampwinampa.exe
C:WINDOWSsystem32ctfmon.exe
C:Program FilesDownload Masterdmaster.exe
C:Program Files2gisUpdateClientWin32UpdateClientService.exe
C:Program FilesESETESET Smart Securityekrn.exe
C:Program FilesGoogleCommonGoogle UpdaterGoogleUpdaterService.exe
C:Program FilesICQ6ToolbarICQ Service.exe
C:Program FilesJavajre6binjqs.exe
C:Program FilesCommon FilesMicrosoft SharedVS7DEBUGMDM.EXE
C:WINDOWSsystem32nvsvc32.exe
C:WINDOWSsystem32wbemwmiapsrv.exe
C:Program FilesOperaopera.exe
C:Program FilesMail.RuAgentmagent.exe
C:WINDOWSsystem32notepad.exe
C:Program FilesTotal CommanderTotalcmd.exe
C:Documents and SettingsВадикРабочий столRSIT.exe
C:Program Filestrend microВадик.exe

R0 — HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.garena.com/portal/
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 — HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://mail.ru
R0 — HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Ссылки
R3 — URLSearchHook: (no name) — {83821C2B-32A8-4DD7-B6D4-44309A78E668} — C:Program FilesMail.RuAgentMradllnewmrasearch.dll
R3 — URLSearchHook: (no name) — — (no file)
R3 — URLSearchHook: ICQToolBar — {855F3B16-6D32-4fe6-8A56-BBB695989046} — C:Program FilesICQ6ToolbarICQToolBar.dll
R3 — URLSearchHook: Спутник@Mail.Ru — {09900DE8-1DCA-443F-9243-26FF581438AF} — C:Program FilesMail.RuSputnikMailRuSputnik.dll
O2 — BHO: (no name) — {02478D38-C3F9-4efb-9B51-7695ECA05670} — (no file)
O2 — BHO: Java(tm) Plug-In SSV Helper — {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} — C:Program FilesJavajre6binssv.dll
O2 — BHO: MailRuBHO Class — {8984B388-A5BB-4DF7-B274-77B879E179DB} — C:Program FilesMail.RuSputnikMailRuSputnik.dll
O2 — BHO: IE 4.x-6.x BHO for Download Master — {9961627E-4059-41B4-8E0E-A7D6B3854ADF} — C:PROGRA~1Download Masterdmiehlp.dll
O2 — BHO: Google Toolbar Notifier BHO — {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} — C:Program FilesGoogleGoogleToolbarNotifier5.0.926.3450swg.dll
O2 — BHO: Java(tm) Plug-In 2 SSV Helper — {DBC80044-A445-435b-BC74-9C25C1C588A9} — C:Program FilesJavajre6binjp2ssv.dll
O2 — BHO: JQSIEStartDetectorImpl Class — {E7E6F031-17CE-4C07-BC86-EABFE594F69C} — C:Program FilesJavajre6libdeployjqsiejqs_plugin.dll
O3 — Toolbar: ICQToolBar — {855F3B16-6D32-4fe6-8A56-BBB695989046} — C:Program FilesICQ6ToolbarICQToolBar.dll
O3 — Toolbar: Спутник@Mail.Ru — {09900DE8-1DCA-443F-9243-26FF581438AF} — C:Program FilesMail.RuSputnikMailRuSputnik.dll
O4 — HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSsystem32NvCpl.dll,NvStartup
O4 — HKLM..Run: [nwiz] nwiz.exe /install
O4 — HKLM..Run: [NvMediaCenter] RUNDLL32.EXE C:WINDOWSsystem32NvMcTray.dll,NvTaskbarInit
O4 — HKLM..Run: [CapFax] C:Program FilesClassic PhoneToolsCapFax.EXE
O4 — HKLM..Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 — HKLM..Run: [UnlockerAssistant] «C:Program FilesUnlockerUnlockerAssistant.exe» -H
O4 — HKLM..Run: [SunJavaUpdateSched] «C:Program FilesJavajre6binjusched.exe»
O4 — HKLM..Run: [egui] «C:Program FilesESETESET Smart Securityegui.exe» /hide /waitservice
O4 — HKLM..Run: [WinampAgent] «C:Program FilesWinampwinampa.exe»
O4 — HKLM..Run: [MAgent] C:Program FilesMail.RuAgentMAgent.exe -LM
O4 — HKCU..Run: [CTFMON.EXE] C:WINDOWSsystem32ctfmon.exe
O4 — HKCU..Run: [Punto Switcher] C:Program FilesPunto Switcherpunto.exe
O4 — HKCU..Run: [Download Master] C:Program FilesDownload Masterdmaster.exe -autorun
O4 — HKUSS-1-5-18..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘SYSTEM’)
O4 — HKUS.DEFAULT..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘Default user’)
O8 — Extra context menu item: &Экспорт в Microsoft Excel — res://C:PROGRA~1MICROS~2OFFICE11EXCEL.EXE/3000
O8 — Extra context menu item: Закачать ВСЕ при помощи Download Master — C:Program FilesDownload Masterdmieall.htm
O8 — Extra context menu item: Закачать при помощи Download Master — C:Program FilesDownload Masterdmie.htm
O9 — Extra button: Mail.Ru Агент — {7558B7E5-7B26-4201-BEDB-00D5FF534523} — C:Program FilesMail.RuAgentmagent.exe
O9 — Extra ‘Tools’ menuitem: Mail.Ru Агент — {7558B7E5-7B26-4201-BEDB-00D5FF534523} — C:Program FilesMail.RuAgentmagent.exe
O9 — Extra button: Download Master — {8DAE90AD-4583-4977-9DD4-4360F7A45C74} — C:Program FilesDownload Masterdmaster.exe
O9 — Extra ‘Tools’ menuitem: &Download Master — {8DAE90AD-4583-4977-9DD4-4360F7A45C74} — C:Program FilesDownload Masterdmaster.exe
O9 — Extra button: Справочные материалы — {92780B25-18CC-41C8-B9BE-3C9C571A8263} — C:PROGRA~1MICROS~2OFFICE11REFIEBAR.DLL
O9 — Extra button: ICQ6 — {E59EB121-F339-4851-A3BA-FE49C35617C2} — C:Program FilesICQ6ICQ.exe
O9 — Extra ‘Tools’ menuitem: ICQ6 — {E59EB121-F339-4851-A3BA-FE49C35617C2} — C:Program FilesICQ6ICQ.exe
O9 — Extra button: Messenger — {FB5F1910-F110-11d2-BB9E-00C04F795683} — C:Program FilesMessengermsmsgs.exe
O9 — Extra ‘Tools’ menuitem: Windows Messenger — {FB5F1910-F110-11d2-BB9E-00C04F795683} — C:Program FilesMessengermsmsgs.exe
O16 — DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) — http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 — HKLMSystemCCSServicesTcpip..{D446A5AC-D918-49C5-8FE6-A8F8A02D8F4F}: NameServer = 212.94.96.124 212.94.96.70
O23 — Service: 2GIS UpdateClientService — ДубльГИС — C:Program Files2gisUpdateClientWin32UpdateClientService.exe
O23 — Service: Eset HTTP Server (EhttpSrv) — ESET — C:Program FilesESETESET Smart SecurityEHttpSrv.exe
O23 — Service: Eset Service (ekrn) — ESET — C:Program FilesESETESET Smart Securityekrn.exe
O23 — Service: Журнал событий (Eventlog) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: Google Updater Service (gusvc) — Google — C:Program FilesGoogleCommonGoogle UpdaterGoogleUpdaterService.exe
O23 — Service: ICQ Service — Unknown owner — C:Program FilesICQ6ToolbarICQ Service.exe
O23 — Service: Служба COM записи компакт-дисков IMAPI (ImapiService) — Корпорация Майкрософт — C:WINDOWSsystem32imapi.exe
O23 — Service: Java Quick Starter (JavaQuickStarterService) — Sun Microsystems, Inc. — C:Program FilesJavajre6binjqs.exe
O23 — Service: NVIDIA Display Driver Service (NVSvc) — NVIDIA Corporation — C:WINDOWSsystem32nvsvc32.exe
O23 — Service: Plug and Play (PlugPlay) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: Смарт-карты (SCardSvr) — Корпорация Майкрософт — C:WINDOWSSystem32SCardSvr.exe
O23 — Service: Журналы и оповещения производительности (SysmonLog) — Корпорация Майкрософт — C:WINDOWSsystem32smlogsvc.exe
O23 — Service: Теневое копирование тома (VSS) — Корпорация Майкрософт — C:WINDOWSSystem32vssvc.exe
O23 — Service: Адаптер производительности WMI (WmiApSrv) — Корпорация Майкрософт — C:WINDOWSsystem32wbemwmiapsrv.exe

—
End of file — 8158 bytes

======Registry dump======

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{02478D38-C3F9-4efb-9B51-7695ECA05670}]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper — C:Program FilesJavajre6binssv.dll [2008-11-10 320920]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{8984B388-A5BB-4DF7-B274-77B879E179DB}]
MailRuBHO Class — C:Program FilesMail.RuSputnikMailRuSputnik.dll [2009-01-09 676704]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{9961627E-4059-41B4-8E0E-A7D6B3854ADF}]
IE 4.x-6.x BHO for Download Master — C:PROGRA~1Download Masterdmiehlp.dll [2009-03-06 157696]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO — C:Program FilesGoogleGoogleToolbarNotifier5.0.926.3450swg.dll [2008-11-22 657904]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper — C:Program FilesJavajre6binjp2ssv.dll [2008-11-10 34816]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class — C:Program FilesJavajre6libdeployjqsiejqs_plugin.dll [2008-11-10 73728]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
{855F3B16-6D32-4fe6-8A56-BBB695989046} — ICQToolBar — C:Program FilesICQ6ToolbarICQToolBar.dll [2008-06-12 958712]
{09900DE8-1DCA-443F-9243-26FF581438AF} — Спутник@Mail.Ru — C:Program FilesMail.RuSputnikMailRuSputnik.dll [2009-01-09 676704]

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun]
«NvCplDaemon»=C:WINDOWSsystem32NvCpl.dll [2008-05-03 13529088]
«nwiz»=nwiz.exe /install []
«NvMediaCenter»=C:WINDOWSsystem32NvMcTray.dll [2008-05-03 86016]
«CapFax»=C:Program FilesClassic PhoneToolsCapFax.EXE [2001-12-10 20739]
«BluetoothAuthenticationAgent»=bthprops.cpl,,BluetoothAuthenticationAgent []
«UnlockerAssistant»=C:Program FilesUnlockerUnlockerAssistant.exe [2008-05-02 15872]
«SunJavaUpdateSched»=C:Program FilesJavajre6binjusched.exe [2008-11-10 136600]
«egui»=C:Program FilesESETESET Smart Securityegui.exe [2008-08-18 1447168]
«WinampAgent»=C:Program FilesWinampwinampa.exe [2008-08-04 36352]
«MAgent»=C:Program FilesMail.RuAgentMAgent.exe [2009-03-13 6221496]

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=C:WINDOWSsystem32ctfmon.exe [2004-10-22 15360]
«Punto Switcher»=C:Program FilesPunto Switcherpunto.exe [2008-10-07 734504]
«Download Master»=C:Program FilesDownload Masterdmaster.exe [2009-03-19 3776512]

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetwork{1a3e09be-1e45-494b-9174-d7385b45bbf5}]

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
«dontdisplaylastusername»=0
«legalnoticecaption»=
«legalnoticetext»=
«shutdownwithoutlogon»=1
«undockwithoutlogon»=1

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoDriveTypeAutoRun»=323
«NoDriveAutoRun»=67108863
«NoDrives»=0

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoResolveTrack»=
«NoDriveAutoRun»=
«NoDriveTypeAutoRun»=
«NoDrives»=

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicystandardprofileauthorizedapplicationslist]
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»
«C:Program FilesICQ6ICQ.exe»=»C:Program FilesICQ6ICQ.exe:*:Enabled:ICQ6»
«D:GamesМини игрыVoleyballvolley.exe»=»D:GamesМини игрыVoleyballvolley.exe:*:Enabled:volley»
«C:Program FilesuTorrentutorrent.exe»=»C:Program FilesuTorrentutorrent.exe:*:Enabled:µTorrent»
«C:Program FilesMail.RuAgentmagent.exe»=»C:Program FilesMail.RuAgentmagent.exe:*:Enabled:Mail.Ru Агент»

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicydomainprofileauthorizedapplicationslist]
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{47f9795b-921f-11dd-8bf2-806d6172696f}]
shellAutoRuncommand — E:ASUSACPI.exe

======List of files/folders created in the last 1 months======

2009-03-26 00:44:22 —-D—- C:Program Filestrend micro
2009-03-26 00:44:21 —-D—- C:rsit
2009-03-26 00:30:23 —-A—- C:logit.txt
2009-03-26 00:00:45 —-A—- C:ComboFix.txt
2009-03-25 23:57:53 —-A—- C:WINDOWSzip.exe
2009-03-25 23:57:53 —-A—- C:WINDOWSVFIND.exe
2009-03-25 23:57:53 —-A—- C:WINDOWSSWXCACLS.exe
2009-03-25 23:57:53 —-A—- C:WINDOWSSWSC.exe
2009-03-25 23:57:53 —-A—- C:WINDOWSSWREG.exe
2009-03-25 23:57:53 —-A—- C:WINDOWSsed.exe
2009-03-25 23:57:53 —-A—- C:WINDOWSNIRCMD.exe
2009-03-25 23:57:53 —-A—- C:WINDOWSgrep.exe
2009-03-25 23:57:53 —-A—- C:WINDOWSfdsv.exe
2009-03-25 23:57:50 —-D—- C:ComboFix
2009-03-25 23:57:49 —-D—- C:Qoobox
2009-03-25 23:40:28 —-D—- C:WINDOWSERDNT
2009-03-25 22:56:57 —-D—- C:Program FilesOpera
2009-03-17 04:32:45 —-D—- C:Program FilesGrandBilliards
2009-03-09 17:13:40 —-D—- C:Program FilesРНИВЦ
2009-03-09 17:13:22 —-D—- C:Program FilesДекларация 2008
2009-03-06 20:37:08 —-D—- C:Documents and SettingsВадикApplication DataInstallShield

======List of files/folders modified in the last 1 months======

2009-03-26 00:44:23 —-D—- C:WINDOWSTemp
2009-03-26 00:44:22 —-RD—- C:Program Files
2009-03-26 00:03:41 —-A—- C:WINDOWSSchedLgU.Txt
2009-03-26 00:00:48 —-D—- C:WINDOWSsystem32
2009-03-26 00:00:48 —-D—- C:WINDOWS
2009-03-26 00:00:02 —-A—- C:WINDOWSsystem.ini
2009-03-25 23:59:25 —-D—- C:WINDOWSsystem32drivers
2009-03-25 23:59:25 —-D—- C:WINDOWSAppPatch
2009-03-25 23:59:24 —-D—- C:Program FilesCommon Files
2009-03-25 23:58:39 —-D—- C:WINDOWSsystem32CatRoot2
2009-03-25 23:53:29 —-SHD—- C:System Volume Information
2009-03-25 23:53:29 —-D—- C:WINDOWSsystem32Restore
2009-03-25 23:40:28 —-D—- C:WINDOWSPrefetch
2009-03-25 23:15:22 —-D—- C:WINDOWSsystem32usmt
2009-03-25 22:57:19 —-SHD—- C:WINDOWSInstaller
2009-03-25 22:49:34 —-D—- C:Program FilesCleanCenter
2009-03-25 19:12:43 —-D—- C:Documents and SettingsAll UsersApplication DataGoogle Updater
2009-03-25 17:54:15 —-D—- C:Program FilesMozilla Firefox
2009-03-23 11:33:51 —-D—- C:Program FilesDownload Master
2009-03-20 22:03:34 —-D—- C:Documents and SettingsВадикApplication DataMra
2009-03-18 00:13:02 —-A—- C:WINDOWSUpdateClientUI.INI
2009-03-16 10:12:53 —-D—- C:Program FilesAIMP2
2009-03-10 14:22:01 —-RD—- C:distr
2009-03-09 17:13:42 —-D—- C:WINDOWSWinSxS
2009-03-09 17:13:24 —-RSD—- C:WINDOWSFonts
2009-03-06 20:37:52 —-HD—- C:Program FilesInstallShield Installation Information
2009-02-28 20:24:55 —-A—- C:WINDOWSphone.ini
2009-02-27 22:57:58 —-A—- C:WINDOWSwin.ini
2009-02-27 00:48:19 —-D—- C:Documents and SettingsВадикApplication DatauTorrent

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AmdK8;Драйвер AMD процессора; C:WINDOWSsystem32DRIVERSAmdK8.sys [2005-03-09 43008]
R1 easdrv;easdrv; C:WINDOWSsystem32DRIVERSeasdrv.sys [2008-08-18 53256]
R1 epfwtdi;epfwtdi; C:WINDOWSsystem32DRIVERSepfwtdi.sys [2008-08-18 54280]
R1 kbfilter;Keyboard Filter Driver; C:WINDOWSsystem32driverskbfilter.sys [2001-11-27 11886]
R2 eamon;EAMON; C:WINDOWSsystem32DRIVERSeamon.sys [2008-08-18 39944]
R2 epfw;epfw; C:WINDOWSsystem32DRIVERSepfw.sys [2008-08-18 71688]
R3 AgereSoftModem;Agere Systems Soft Modem; C:WINDOWSsystem32DRIVERSAGRSM.sys [2003-09-23 1197740]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:WINDOWSsystem32driversALCXWDM.SYS [2004-11-17 2297664]
R3 Arp1394;Протокол клиента 1394 ARP; C:WINDOWSsystem32DRIVERSarp1394.sys [2004-10-22 60800]
R3 Epfwndis;Eset Personal Firewall; C:WINDOWSsystem32DRIVERSEpfwndis.sys [2008-08-18 30728]
R3 hidusb;Драйвер класса HID Microsoft; C:WINDOWSsystem32DRIVERShidusb.sys [2004-10-22 9600]
R3 Iviaspi;IVI ASPI Shell; C:WINDOWSsystem32driversiviaspi.sys [2003-09-10 21060]
R3 MODEMCSA;Устройство фильтрации потока Unimodem; C:WINDOWSsystem32driversMODEMCSA.sys [2001-08-17 16128]
R3 mouhid;Драйвер мыши HID; C:WINDOWSsystem32DRIVERSmouhid.sys [2004-10-22 12160]
R3 MTsensor;ATK0110 ACPI UTILITY; C:WINDOWSsystem32DRIVERSASACPI.sys [2004-08-13 5810]
R3 NIC1394;Сетевой драйвер 1394; C:WINDOWSsystem32DRIVERSnic1394.sys [2004-10-22 61824]
R3 nv;nv; C:WINDOWSsystem32DRIVERSnv4_mini.sys [2008-05-03 6554496]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:WINDOWSsystem32DRIVERSNVENETFD.sys [2005-02-24 33408]
R3 nvnetbus;NVIDIA Network Bus Enumerator; C:WINDOWSsystem32DRIVERSnvnetbus.sys [2005-02-24 12928]
R3 usbehci;Драйвер минипорта Microsoft USB 2.0 расширенного хост-контроллера; C:WINDOWSsystem32DRIVERSusbehci.sys [2004-10-22 26624]
R3 usbhub;USB2 концентратор; C:WINDOWSsystem32DRIVERSusbhub.sys [2004-10-22 57600]
R3 usbohci;Драйвер минипорта Microsoft USB открытого хост-контроллера; C:WINDOWSsystem32DRIVERSusbohci.sys [2004-10-22 17024]
R3 yukonwxp;NDIS5.1 Miniport Driver for Marvell Yukon Ethernet Controller; C:WINDOWSsystem32DRIVERSyk51x86.sys [2004-08-19 189568]
S1 kbdhid;Драйвер клавиатуры HID; C:WINDOWSsystem32DRIVERSkbdhid.sys [2004-08-17 14848]
S3 BthEnum;Драйвер блока запроса Bluetooth; C:WINDOWSsystem32DRIVERSBthEnum.sys [2004-08-04 17024]
S3 BTHMODEM;Драйвер связи для модема Bluetooth; C:WINDOWSsystem32DRIVERSbthmodem.sys [2004-08-03 38016]
S3 BthPan;Bluetooth Device (Personal Area Network); C:WINDOWSsystem32DRIVERSbthpan.sys [2004-08-04 100992]
S3 BTHPORT;Драйвер порта Bluetooth; C:WINDOWSSystem32DriversBTHport.sys [2004-08-17 274688]
S3 BTHUSB;Драйвер порта USB радиомодуля Bluetooth; C:WINDOWSSystem32DriversBTHUSB.sys [2004-08-04 18944]
S3 catchme;catchme; ??C:ComboFixcatchme.sys []
S3 HidBth;Минипорт Bluetooth HID Microsoft; C:WINDOWSsystem32DRIVERShidbth.sys [2004-08-17 25728]
S3 iviudf;iviudf; C:WINDOWSsystem32driversIviUdf.sys [2004-10-07 103936]
S3 ms_mpu401;Драйвер UART Microsoft MPU-401 MIDI; C:WINDOWSsystem32driversmsmpu401.sys [2001-08-18 2944]
S3 RFCOMM;Устройство Bluetooth (протокол RFCOMM TDI); C:WINDOWSsystem32DRIVERSrfcomm.sys [2004-08-04 59648]
S3 ssm_bus;SAMSUNG Mobile USB Device II 1.0 driver (WDM); C:WINDOWSsystem32DRIVERSssm_bus.sys [2005-08-30 58320]
S3 ssm_mdfl;SAMSUNG Mobile USB Modem II 1.0 Filter; C:WINDOWSsystem32DRIVERSssm_mdfl.sys [2005-08-30 8336]
S3 ssm_mdm;SAMSUNG Mobile USB Modem II 1.0 Drivers; C:WINDOWSsystem32DRIVERSssm_mdm.sys [2005-08-30 94000]
S3 tap0801;TAP-Win32 Adapter V8; C:WINDOWSsystem32DRIVERStap0801.sys [2006-04-12 23552]
S3 USBSTOR;Драйвер запоминающих устройств для USB; C:WINDOWSsystem32DRIVERSUSBSTOR.SYS [2004-08-04 26496]
S4 IntelIde;IntelIde; C:WINDOWSsystem32driversIntelIde.sys []
S4 WS2IFSL;Среда Windows Socket 2.0 поддержки поставщиков не-IFS служб; C:WINDOWSSystem32driversws2ifsl.sys [2004-10-22 12032]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 2GIS UpdateClientService;2GIS UpdateClientService; C:Program Files2gisUpdateClientWin32UpdateClientService.exe [2008-09-17 1134592]
R2 BthServ;Bluetooth Support Service; C:WINDOWSsystem32svchost.exe [2004-10-22 14336]
R2 ekrn;Eset Service; C:Program FilesESETESET Smart Securityekrn.exe [2008-08-18 468224]
R2 gusvc;Google Updater Service; C:Program FilesGoogleCommonGoogle UpdaterGoogleUpdaterService.exe [2008-11-22 168432]
R2 ICQ Service;ICQ Service; C:Program FilesICQ6ToolbarICQ Service.exe [2008-06-10 222456]
R2 JavaQuickStarterService;Java Quick Starter; C:Program FilesJavajre6binjqs.exe [2008-11-10 152984]
R2 MDM;Machine Debug Manager; C:Program FilesCommon FilesMicrosoft SharedVS7DEBUGMDM.EXE [2003-06-20 322120]
R2 NVSvc;NVIDIA Display Driver Service; C:WINDOWSsystem32nvsvc32.exe [2008-05-03 159812]
S1 udffsrec;udffsrec; C:WINDOWSsystem32driversudffsrec.sys [2004-09-29 4992]
S3 EhttpSrv;Eset HTTP Server; C:Program FilesESETESET Smart SecurityEHttpSrv.exe [2008-08-18 19200]
S3 ose;Office Source Engine; C:Program FilesCommon FilesMicrosoft SharedSource EngineOSE.EXE [2003-07-28 89136]

---

EOF

---

[Admin]

Здравствуйте, добро пожаловать на Spyware-ru форум.

Запустите combofix ещё раз и получившийся лог вставьте в свой ответ.

[Автор]

Сообщения