не можем удалить вирус PC Defender

[tasha]

Вирус предлагает скачать программу защиты компа. Постоянно лезут окошки интим характера. Выдает отправить смс на номер 6681 и получит код активации. Пробовали сканер д веб и др. не помогло. делаю лог

[tasha]

Logfile of random’s system information tool 1.08 (written by random/random)
Run by Dell 1300 at 2010-08-25 15:23:33
Microsoft Windows XP Professional Service Pack 2
System drive C: has 14 GB (45%) free of 30 GB
Total RAM: 503 MB (17% free)

HijackThis download failed

======Registry dump======

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class — C:Program FilesAdobeAcrobat 7.0ActiveXAcroIEHelper.dll [2004-12-14 63136]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{8984B388-A5BB-4DF7-B274-77B879E179DB}]
MailRuBHO Class — C:Program FilesMail.RuSputnikMailRuSputnik.dll [2010-08-20 1145016]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{9BFBA68E-E21B-458E-AE12-FE85E903D2C1}]
AlterGeoBHO Class — C:Program FilesAlterGeoAlterGeo Magic Scanner2.8.3.585AlterGeo.BrowserPlugin.dll [2010-06-21 255632]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{AE7CD045-E861-484f-8273-0445EE161910}]
AcroIEToolbarHelper Class — C:Program FilesAdobeAcrobat 7.0AcrobatAcroIEFavClient.dll [2004-12-14 225280]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
{47833539-D0C5-4125-9FA8-0819E2EAAC93} — Adobe PDF — C:Program FilesAdobeAcrobat 7.0AcrobatAcroIEFavClient.dll [2004-12-14 225280]
{09900DE8-1DCA-443F-9243-26FF581438AF} — Спутник@Mail.Ru — C:Program FilesMail.RuSputnikMailRuSputnik.dll [2010-08-20 1145016]

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun]
«igfxtray»=C:WINDOWSsystem32igfxtray.exe [2005-07-19 94208]
«igfxhkcmd»=C:WINDOWSsystem32hkcmd.exe [2005-07-19 77824]
«igfxpers»=C:WINDOWSsystem32igfxpers.exe [2005-07-19 114688]
«nod32kui»=C:Program FilesEsetnod32kui.exe [2007-04-04 921600]
«QuickTime Task»=C:WINDOWSsystem32qttask.exe [2007-09-04 98304]
«WinampAgent»=C:Program FilesWinampwinampa.exe [2007-08-22 39424]
«RemoteControl»=C:Program FilesCyberLinkPowerDVDPDVDServ.exe [2006-12-06 69216]
«LanguageShortcut»=C:Program FilesCyberLinkPowerDVDLanguageLanguage.exe [2006-12-05 54832]
«MAgent»=C:Program FilesMail.RuAgentMAgent.exe [2010-08-20 12270784]
«Guard.Mail.ru.gui»=C:Program FilesMail.RuGuardGuardMailRu.exe [2010-08-20 974528]
«PC Defender»=C:Program FilesDef GroupPC Defenderpcdef.exe [2010-08-24 1170432]

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=C:WINDOWSsystem32ctfmon.exe [2003-08-18 15360]
«amva»=C:WINDOWSsystem32amvo.exe []
«avpa»=C:WINDOWSsystem32avpo.exe []
«USB Safely Remove»=C:Program FilesUSB Safely RemoveUSBSafelyRemove.exe [2009-06-16 1434384]
«SkinClock»=C:Program FilesAtomic Alarm ClockAtomicAlarmClock.exe [2009-05-17 1742848]
«RocketDock»=C:Program FilesRocketDockRocketDock.exe [2007-03-19 630784]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregAcrobat Assistant 7.0]
C:Program FilesAdobeAcrobat 7.0DistillrAcrotray.exe [2004-12-14 483328]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregDell Wireless Manager UI]
C:WINDOWSsystem32WLTRAY []

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregIntelWireless]
C:Program FilesIntelWirelessBinifrmewrk.exe [2005-07-22 385024]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregIntelZeroConfig]
C:Program FilesIntelWirelessbinZCfgSvc.exe [2005-07-22 401408]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregNeroFilterCheck]
C:WINDOWSsystem32NeroCheck.exe []

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregSigmatelSysTrayApp]
C:WINDOWSstsystra.exe [2005-08-24 393216]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregSunJavaUpdateSched]
C:Program FilesJavaj2re1.4.2_03binjusched.exe [2003-11-19 32881]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregSynTPEnh]
C:Program FilesSynapticsSynTPSynTPEnh.exe []

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupfolderC:^Documents and Settings^All Users^Главное меню^Программы^Автозагрузка^Adobe Acrobat Speed Launcher.lnk]
C:WINDOWSInstaller{AC76BA86-1033-0000-7760-000000000002}SC_Acrobat.exe [2006-11-28 25214]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigservices]
«RemoteRegistry»=2
«RSVP»=3
«WZCSVC»=2

C:Documents and SettingsAll UsersГлавное менюПрограммыАвтозагрузка
Atomic Alarm Clock.lnk — C:Program FilesAtomic Alarm ClockAtomicAlarmClock.exe

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifyigfxcui]
C:WINDOWSsystem32igfxdev.dll [2005-07-19 135168]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifyIntelWireless]
C:Program FilesIntelWirelessBinLgNotify.dll [2005-07-22 110592]

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
«dontdisplaylastusername»=0
«legalnoticecaption»=
«legalnoticetext»=
«shutdownwithoutlogon»=1
«undockwithoutlogon»=1
«EnableLUA»=0

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoDriveTypeAutoRun»=145

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicystandardprofileauthorizedapplicationslist]
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»
«C:Program FilesMail.RuSputnikSputnikFlashPlayer.exe»=»C:Program FilesMail.RuSputnikSputnikFlashPlayer.exe:*:Enabled:Sputnik@Mail.Ru flash player»
«C:Program FilesMail.RuSputnikSputnikHelper.exe»=»C:Program FilesMail.RuSputnikSputnikHelper.exe:*:Enabled:Sputnik@Mail.Ru helper object»

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicydomainprofileauthorizedapplicationslist]
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»

======File associations======

.scr — open —
.scr — install —
.scr — config —

======List of files/folders created in the last 1 months======

2010-08-25 15:23:35 —-D—- C:Program Filestrend micro
2010-08-25 15:23:33 —-D—- C:rsit
2010-08-25 14:20:23 —-D—- C:_OTM
2010-08-24 16:14:18 —-D—- C:Program FilesDef Group
2010-08-24 16:14:11 —-D—- C:Program FilesFusionmedia
2010-08-20 15:43:47 —-D—- C:Program FilesAlterGeo
2010-08-20 15:42:43 —-D—- C:Program FilesMail.Ru
2010-08-20 15:42:42 —-D—- C:Documents and SettingsDell 1300Application DataMra
2010-07-29 15:44:36 —-D—- C:Program FilesICQ6Toolbar
2010-07-29 15:44:30 —-D—- C:Documents and SettingsAll UsersApplication DataICQ
2010-07-29 15:35:37 —-D—- C:Documents and SettingsDell 1300Application DataICQ

======List of files/folders modified in the last 1 months======

2010-08-25 15:23:42 —-D—- C:WINDOWSPrefetch
2010-08-25 15:23:35 —-RD—- C:Program Files
2010-08-25 15:11:37 —-D—- C:WINDOWSTemp
2010-08-25 15:10:19 —-A—- C:Documents and SettingsDell 1300Application DataAtomicAlarmClock.ini
2010-08-25 15:10:12 —-D—- C:WINDOWS
2010-08-25 15:08:59 —-A—- C:WINDOWSSchedLgU.Txt
2010-08-24 16:14:50 —-SHD—- C:WINDOWSInstaller
2010-08-24 16:14:50 —-SHD—- C:Config.Msi
2010-07-29 15:44:44 —-HD—- C:Program FilesInstallShield Installation Information

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 PxHelp20;PxHelp20; C:WINDOWSSystem32DriversPxHelp20.sys [2007-03-08 43528]
R0 sfdrv01;StarForce Protection Environment Driver (version 1.x); C:WINDOWSSystem32driverssfdrv01.sys [2005-03-03 48640]
R0 sfhlp02;StarForce Protection Helper Driver (version 2.x); C:WINDOWSSystem32driverssfhlp02.sys [2005-02-23 6656]
R0 sfsync02;StarForce Protection Synchronization Driver (version 2.x); C:WINDOWSSystem32driverssfsync02.sys [2004-12-03 20544]
R1 intelppm;Драйвер Intel процессора; C:WINDOWSsystem32DRIVERSintelppm.sys [2003-08-18 40448]
R1 ISODrive;ISO CD-ROM Device Driver; ??C:Program FilesUltraISOdriversISODrive.sys []
R1 OMCI;OMCI; C:WINDOWSSYSTEM32DRIVERSOMCI.SYS [2001-08-22 13632]
R1 WS2IFSL;Среда Windows Socket 2.0 поддержки поставщиков не-IFS служб; C:WINDOWSSystem32driversws2ifsl.sys [2003-08-18 12032]
R2 {95808DC4-FA4A-4c74-92FE-5B863F82066B};{95808DC4-FA4A-4c74-92FE-5B863F82066B}; ??C:Program FilesCyberLinkPowerDVD00.fcl []
R2 AMON;AMON; ??C:WINDOWSsystem32driversamon.sys []
R2 Hardlock;Hardlock; ??C:WINDOWSsystem32drivershardlock.sys []
R2 haspflt;haspflt; ??C:WINDOWSsystem32drivershaspflt.sys []
R2 haspft;Hasp Emulator; ??C:WINDOWSsystem32drivershaspft.sys []
R2 Haspnt;Haspnt; ??C:WINDOWSsystem32driversHaspnt.sys []
R2 mdmxsdk;mdmxsdk; C:WINDOWSsystem32DRIVERSmdmxsdk.sys [2004-03-17 13059]
R2 s24trans;Транспорт беспроводной сети; C:WINDOWSsystem32DRIVERSs24trans.sys [2005-07-23 11354]
R3 bcm4sbxp;Broadcom 440x 10/100 Integrated Controller XP Driver; C:WINDOWSsystem32DRIVERSbcm4sbxp.sys [2005-08-05 45312]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:WINDOWSsystem32DRIVERSHDAudBus.sys [2004-08-12 137728]
R3 HidUsb;Драйвер класса HID Microsoft; C:WINDOWSsystem32DRIVERShidusb.sys [2001-08-17 9600]
R3 HSF_DPV;HSF_DPV; C:WINDOWSsystem32DRIVERSHSF_DPV.sys [2005-07-22 1035008]
R3 HSFHWAZL;HSFHWAZL; C:WINDOWSsystem32DRIVERSHSFHWAZL.sys [2005-07-22 201600]
R3 ialm;ialm; C:WINDOWSsystem32DRIVERSialmnt5.sys [2005-07-19 1049180]
R3 mouhid;Драйвер мыши HID; C:WINDOWSsystem32DRIVERSmouhid.sys [2001-10-19 12160]
R3 pfc;Padus ASPI Shell; C:WINDOWSsystem32driverspfc.sys [2006-11-28 9856]
R3 STHDA;SigmaTel High Definition Audio CODEC; C:WINDOWSsystem32driverssthda.sys [2005-08-30 1031720]
R3 usbuhci;Драйвер минипорта Microsoft USB универсального хост-контроллера; C:WINDOWSsystem32DRIVERSusbuhci.sys [2004-08-04 20480]
R3 winachsf;winachsf; C:WINDOWSsystem32DRIVERSHSF_CNXT.sys [2005-07-22 717952]
S1 InCDPass;InCDPass; C:WINDOWSsystem32driversInCDPass.sys []
S1 InCDRm;InCD Reader; C:WINDOWSsystem32driversInCDRm.sys []
S3 actser;actser; C:WINDOWSsystem32driversactser.sys [2004-12-16 29440]
S3 BCM43XX;Драйвер адаптера беспроводной сети Dell Wireless WLAN; C:WINDOWSsystem32DRIVERSbcmwl5.sys [2005-05-26 376192]
S3 UIUSys;Conexant Setup API; C:WINDOWSsystem32driversUIUSys.sys []
S3 USBSTOR;Драйвер запоминающих устройств для USB; C:WINDOWSsystem32DRIVERSUSBSTOR.SYS [2004-08-04 26496]
S3 vsbus;Virtual Serial Bus Enumerator; C:WINDOWSsystem32DRIVERSvsb.sys [2005-07-18 15264]
S3 vserial;ELTIMA Virtual Serial Ports Driver; C:WINDOWSSystem32DRIVERSvserial.sys [2005-07-18 47744]
S4 InCDFs;InCD File System; C:WINDOWSsystem32driversInCDFs.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 EvtEng;EvtEng; C:Program FilesIntelWirelessBinEvtEng.exe [2005-07-22 86016]
R2 Guard.Mail.ru;Guard.Mail.ru; C:Program FilesMail.RuGuardGuardMailRu.exe [2010-08-20 974528]
R2 InterBaseGuardian;InterBaseGuardian; C:INECFireBirdBinIBGuard.EXE [2002-04-29 32768]
R2 NOD32krn;NOD32 Kernel Service; C:Program FilesEsetnod32krn.exe [2007-04-04 507904]
R2 RegSrvc;RegSrvc; C:Program FilesIntelWirelessBinRegSrvc.exe [2005-07-22 139264]
R2 RichVideo;Cyberlink RichVideo Service(CRVS); C:Program FilesCyberLinkShared FilesRichVideo.exe [2005-08-08 167936]
R2 S24EventMonitor;Spectrum24 Event Monitor; C:Program FilesIntelWirelessBinS24EvMon.exe [2005-07-22 372809]
R2 USBSafelyRemoveService;USB Safely Remove Assistant; C:Program FilesUSB Safely RemoveUSBSRService.exe [2009-06-16 213776]
R2 WLANKEEPER;WLANKEEPER; C:Program FilesIntelWirelessBinWLKeeper.exe [2005-07-22 225353]
R2 wltrysvc;Dell Wireless WLAN Tray Service; C:WINDOWSSystem32wltrysvc.exe [2005-05-26 65536]
R3 InterBaseServer;InterBaseServer; C:INECFireBirdBinibserver.exe [2002-04-29 1748992]
S3 Adobe LM Service;Adobe LM Service; C:Program FilesCommon FilesAdobe Systems SharedServiceAdobelmsvc.exe [2007-04-04 72704]
S3 aspnet_state;ASP.NET State Service; C:WINDOWSMicrosoft.NETFrameworkv1.1.4322aspnet_state.exe [2003-02-20 32768]
S3 IDriverT;InstallDriver Table Manager; C:Program FilesCommon FilesInstallShieldDriver1050Intel 32IDriverT.exe [2004-10-22 73728]
S3 ose;Office Source Engine; C:Program FilesCommon FilesMicrosoft SharedSource EngineOSE.EXE [2003-07-28 89136]
S3 SolidWorks Licensing Service;SolidWorks Licensing Service; C:Program FilesCommon FilesSolidWorks SharedServiceSolidWorksLicensing.exe [2006-11-29 69632]

---

EOF

---

[tasha]

info.txt logfile of random’s system information tool 1.08 2010-08-25 15:23:58

======Uninstall list======

—>rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:WINDOWSINFPCHealth.inf
1C:Предприятие 8.2 (8.2.10.77)—>MsiExec.exe /I{8150646B-4F88-4415-AF2A-F96199E3DA37}
ACDSee 6.0 PowerPack—>MsiExec.exe /I{38A0BB97-772D-422E-BCCA-4BA2A5D81F42}
ACE Mega CoDecS Pack—>»C:Program FilesACE Mega CoDecS Packunins000.exe»
Adobe Acrobat 7.0 Professional—>msiexec /I {AC76BA86-1033-0000-7760-000000000002}
Adobe Photoshop CS2—>msiexec /I {236BB7C4-4419-42FD-0409-1E257A25E34D}
AlterGeo Magic Scanner—>MsiExec.exe /I{15F62E9A-24C6-46CC-AEAA-8854120E5A25}
Atomic Alarm Clock 5.8—>C:Program FilesAtomic Alarm Clockuninstall.bat
Autodesk Express Viewer—>C:PROGRA~1AutodeskAUTODE~1Setup.exe /remove
Conexant HDA D110 MDC V.92 Modem—>C:Program FilesCONEXANTCNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2BFA&SUBSYS_14F100C3HXFSETUP.EXE -U -Idel1028k.inf
Dell Wireless WLAN Card—>C:WINDOWSsystem32BCMWLU00.exe verbose
Fusion Media Player—>MsiExec.exe /I{7DACEC08-5794-48A2-9CA6-4182CA9E2048}
Google Toolbar for Firefox—>MsiExec.exe /X{2CCBABCB-6427-4A55-B091-49864623C43F}
Guard.Mail.ru—>»C:Program FilesMail.RuGuardGuardMailRu.exe» /uninstall
High Definition Audio Driver Package — KB835221—>C:WINDOWS$NtUninstallKB835221WXP$spuninstspuninst.exe
Intel(R) Graphics Media Accelerator Driver for Mobile—>RUNDLL32.EXE C:WINDOWSsystem32ialmrem.dll,UninstallW2KIGfx2ID PCIVEN_8086&DEV_2792 PCIVEN_8086&DEV_2592
Intel(R) PROSet/Wireless Software—>C:WINDOWSInstalleriProInst.exe
Java 2 Runtime Environment, SE v1.4.2_03—>MsiExec.exe /I{7148F0A8-6813-11D6-A77B-00B0D0142030}
KC Softwares VideoInspector—>»C:Program FilesKC SoftwaresVideoInspectorunins000.exe»
Mail.Ru Агент 5.7 (сборка 3686, для всех пользователей)—>C:Program FilesMail.RuAgentmagentsetup.exe -uninstalllm
Mail.Ru Спутник 2.3.0.244—>C:Program FilesMail.RuSputnikmailrusputnik.exe uninstall
mCore—>MsiExec.exe /I{6DE14BE4-6F04-4935-8ABD-A0A19FE2E55A}
mDriver—>MsiExec.exe /I{28DA872A-0848-48CF-B749-19A198157A2A}
mDrWiFi—>MsiExec.exe /I{F6090A17-0967-4A8A-B3C3-422A1B514D49}
mHlpDell—>MsiExec.exe /I{49D687E5-6784-431B-A0A2-2F23B8CC5A1B}
Microsoft .NET Framework 1.1—>MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft Office — профессиональный выпуск версии 2003—>MsiExec.exe /I{90110419-6000-11D3-8CFE-0150048383C9}
Microsoft Windows Media Video 9 VCM—>RunDll32 advpack.dll,LaunchINFSection C:WINDOWSINFwmv9vcm.inf, Uninstall
mIWA—>MsiExec.exe /I{3E9D596A-61D4-4239-BD19-2DB984D2A16F}
mIWCA—>MsiExec.exe /I{6FFFE74E-3FBD-4E2E-97F9-5E9A2A077626}
mLogView—>MsiExec.exe /I{0E2B0B41-7E08-4F9F-B21F-41C4133F43B7}
mMHouse—>MsiExec.exe /I{F0BFC7EF-9CF8-44EE-91B0-158884CD87C5}
Mozilla Firefox (2.0.0.6)—>C:Program FilesMozilla Firefoxuninstallhelper.exe
mPfMgr—>MsiExec.exe /I{8B928BA1-EDEC-4227-A2DA-DD83026C36F5}
mPfWiz—>MsiExec.exe /I{90B0D222-8C21-4B35-9262-53B042F18AF9}
mProSafe—>MsiExec.exe /I{23FB368F-1399-4EAC-817C-4B83ECBE3D83}
mSSO—>MsiExec.exe /I{06BE8AFD-A8E2-4B63-BAE7-287016D16ACB}
mToolkit—>MsiExec.exe /I{CA9BAADB-C262-4E05-B2E2-CEE8CE9809EC}
mWlsSafe—>MsiExec.exe /I{FCA651F3-5BDA-4DDA-9E4A-5D87D6914CC4}
mXML—>MsiExec.exe /I{9CC89556-3578-48DD-8408-04E66EBEF401}
mZConfig—>MsiExec.exe /I{7CD7A451-7224-49C8-95EF-9A1859C66607}
New Dimension—>»C:Program FilesNew Dimensionunins000.exe»
NOD32 FiX—>»C:Program FilesEsetunins000.exe»
PC Defender—>MsiExec.exe /X{456A3B12-8FE6-41AE-9E5C-5E55F0712C09}
PowerDVD—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1engine6INTEL3~1Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}setup.exe» -uninstall
RocketDock 1.00—>C:Program FilesRocketDockUninstall.exe
SeaStorm 3D Screensaver 1.5—>»C:Program FilesSeaStorm 3D Screensaverunins000.exe»
SereneScreen Marine Aquarium 2—>»C:Program FilesSereneScreenMarine Aquarium 2unins000.exe»
Total Commander Adis 2010—>»C:Program FilesTCDLunins000.exe»
UltraISO Premium V8.61—>»C:Program FilesUltraISOunins000.exe»
USB Safely Remove 4.1.5.800—>»C:Program FilesUSB Safely Removeunins000.exe»
Winamp (remove only)—>»C:Program FilesWinampUninstWA.exe»
womenonyourdesktop—>C:WINDOWSuninst.exe -fc:windowssystemDeIsL4.isu -cc:windowssystem_ISREG32.DLL
Xvid 1.1.3 final uninstall—>»C:Program FilesXvidunins000.exe»
XviD MPEG-4 Codec—>»C:Program FilesXviDUninstXviD.exe»
Антивирусная система NOD32—>C:Program FilesEsetSetupsetup.exe /UNINSTALL
Архиватор WinRAR—>C:Program FilesWinRARuninstall.exe
Деинсталляция ПК серии АНАЛИТИК—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1engine6INTEL3~1Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{4B1C4548-830D-4516-AAEB-68FAD154D2DB}Setup.exe»
Звуковое устройство SigmaTel—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1PROFES~1RunTime101Intel32Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{A462213D-EED4-42C2-9A60-7BDD4D4B0B17}setup.exe» -l0x19 -remove -removeonly

======Security center information======

AV: Антивирусная система Eset NOD32 2.51 (outdated)

======System event log======

Computer Name: NOUT
Event Code: 7036
Message: Служба «Служба обнаружения SSDP» перешла в состояние Работает.

Record Number: 14066
Source Name: Service Control Manager
Time Written: 20100611083557.000000+240
Event Type: информация
User:

Computer Name: NOUT
Event Code: 7035
Message: Служба «Служба обнаружения SSDP» успешно отправила управляющий элемент «запустить».

Record Number: 14065
Source Name: Service Control Manager
Time Written: 20100611083557.000000+240
Event Type: информация
User: NT AUTHORITYSYSTEM

Computer Name: NOUT
Event Code: 7036
Message: Служба «Служба COM записи компакт-дисков IMAPI» перешла в состояние Работает.

Record Number: 14064
Source Name: Service Control Manager
Time Written: 20100611083557.000000+240
Event Type: информация
User:

Computer Name: NOUT
Event Code: 7035
Message: Служба «Служба COM записи компакт-дисков IMAPI» успешно отправила управляющий элемент «запустить».

Record Number: 14063
Source Name: Service Control Manager
Time Written: 20100611083557.000000+240
Event Type: информация
User: NT AUTHORITYSYSTEM

Computer Name: NOUT
Event Code: 7036
Message: Служба «Диспетчер подключений удаленного доступа» перешла в состояние Работает.

Record Number: 14062
Source Name: Service Control Manager
Time Written: 20100611083556.000000+240
Event Type: информация
User:

======Environment variables======

«ComSpec»=%SystemRoot%system32cmd.exe
«Path»=%SystemRoot%system32;%SystemRoot%;%SystemRoot%System32Wbem
«windir»=%SystemRoot%
«FP_NO_HOST_CHECK»=NO
«OS»=Windows_NT
«PROCESSOR_ARCHITECTURE»=x86
«PROCESSOR_LEVEL»=6
«PROCESSOR_IDENTIFIER»=x86 Family 6 Model 13 Stepping 8, GenuineIntel
«PROCESSOR_REVISION»=0d08
«NUMBER_OF_PROCESSORS»=1
«PATHEXT»=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
«TEMP»=%SystemRoot%TEMP
«TMP»=%SystemRoot%TEMP

---

EOF

---

[tasha]

вирус вырубает браузер каждые 3 минуты а комп каждые 5 мин. на компе важная информация. проги 1с и зп. помогите пожалуйста

[tasha]

еще лог HijackThis
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 15:35:49, on 25.08.2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:Program FilesUSB Safely RemoveUSBSRService.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:Program FilesIntelWirelessBinEvtEng.exe
C:Program FilesIntelWirelessBinS24EvMon.exe
C:Program FilesIntelWirelessBinWLKeeper.exe
C:Program FilesIntelWirelessBinZcfgSvc.exe
C:WINDOWSExplorer.EXE
C:WINDOWSSystem32wltrysvc.exe
C:WINDOWSSystem32bcmwltry.exe
C:WINDOWSsystem32spoolsv.exe
C:Program FilesMail.RuGuardGuardMailRu.exe
C:INECFireBirdBinIBGuard.EXE
C:Program FilesEsetnod32krn.exe
C:Program FilesIntelWirelessBinRegSrvc.exe
C:Program FilesCyberLinkShared FilesRichVideo.exe
C:INECFireBirdBinibserver.exe
C:WINDOWSsystem32hkcmd.exe
C:WINDOWSsystem32igfxpers.exe
C:Program FilesEsetnod32kui.exe
C:WINDOWSsystem32qttask.exe
C:Program FilesWinampwinampa.exe
C:Program FilesCyberLinkPowerDVDPDVDServ.exe
C:Program FilesMail.RuAgentMAgent.exe
C:Program FilesMail.RuGuardGuardMailRu.exe
C:Program FilesDef GroupPC Defenderpcdef.exe
C:WINDOWSsystem32ctfmon.exe
C:Program FilesUSB Safely RemoveUSBSafelyRemove.exe
C:Program FilesAtomic Alarm ClockAtomicAlarmClock.exe
C:WINDOWSsystem32igfxsrvc.exe
C:Program FilesRocketDockRocketDock.exe
C:Program FilesDef GroupPC Defenderprockill32.exe
C:Program FilesDef GroupPC Defenderproccheck.exe
C:Program FilesDef GroupPC Defenderprockill32.exe
C:WINDOWSSystem32svchost.exe
C:Program FilesMozilla Firefoxfirefox.exe
C:Documents and SettingsDell 1300Рабочий столHijackThis.exe

R0 — HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.mail.ru/cnt/7227
R0 — HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.ya.ru
R1 — HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings,ProxyServer = 172.21.15.122:3128
R0 — HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Ссылки
R3 — URLSearchHook: Спутник@Mail.Ru — {09900DE8-1DCA-443F-9243-26FF581438AF} — C:Program FilesMail.RuSputnikMailRuSputnik.dll
O2 — BHO: AcroIEHlprObj Class — {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} — C:Program FilesAdobeAcrobat 7.0ActiveXAcroIEHelper.dll
O2 — BHO: Спутник@Mail.Ru — {8984B388-A5BB-4DF7-B274-77B879E179DB} — C:Program FilesMail.RuSputnikMailRuSputnik.dll
O2 — BHO: AlterGeo Magic Scanner — {9BFBA68E-E21B-458E-AE12-FE85E903D2C1} — C:Program FilesAlterGeoAlterGeo Magic Scanner2.8.3.585AlterGeo.BrowserPlugin.dll
O2 — BHO: AcroIEToolbarHelper Class — {AE7CD045-E861-484f-8273-0445EE161910} — C:Program FilesAdobeAcrobat 7.0AcrobatAcroIEFavClient.dll
O3 — Toolbar: Adobe PDF — {47833539-D0C5-4125-9FA8-0819E2EAAC93} — C:Program FilesAdobeAcrobat 7.0AcrobatAcroIEFavClient.dll
O3 — Toolbar: Спутник@Mail.Ru — {09900DE8-1DCA-443F-9243-26FF581438AF} — C:Program FilesMail.RuSputnikMailRuSputnik.dll
O4 — HKLM..Run: [igfxtray] C:WINDOWSsystem32igfxtray.exe
O4 — HKLM..Run: [igfxhkcmd] C:WINDOWSsystem32hkcmd.exe
O4 — HKLM..Run: [igfxpers] C:WINDOWSsystem32igfxpers.exe
O4 — HKLM..Run: [nod32kui] «C:Program FilesEsetnod32kui.exe» /WAITSERVICE
O4 — HKLM..Run: [QuickTime Task] «C:WINDOWSsystem32qttask.exe» -atboottime
O4 — HKLM..Run: [WinampAgent] C:Program FilesWinampwinampa.exe
O4 — HKLM..Run: [RemoteControl] «C:Program FilesCyberLinkPowerDVDPDVDServ.exe»
O4 — HKLM..Run: [LanguageShortcut] «C:Program FilesCyberLinkPowerDVDLanguageLanguage.exe»
O4 — HKLM..Run: [MAgent] C:Program FilesMail.RuAgentMAgent.exe -LM
O4 — HKLM..Run: [Guard.Mail.ru.gui] «C:Program FilesMail.RuGuardGuardMailRu.exe» /gui
O4 — HKLM..Run: [PC Defender] C:Program FilesDef GroupPC Defenderpcdef.exe
O4 — HKCU..Run: [CTFMON.EXE] C:WINDOWSsystem32ctfmon.exe
O4 — HKCU..Run: [amva] C:WINDOWSsystem32amvo.exe
O4 — HKCU..Run: [avpa] C:WINDOWSsystem32avpo.exe
O4 — HKCU..Run: [USB Safely Remove] C:Program FilesUSB Safely RemoveUSBSafelyRemove.exe /startup
O4 — HKCU..Run: [SkinClock] C:Program FilesAtomic Alarm ClockAtomicAlarmClock.exe
O4 — HKCU..Run: [RocketDock] «C:Program FilesRocketDockRocketDock.exe»
O4 — HKUSS-1-5-19..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘LOCAL SERVICE’)
O4 — HKUSS-1-5-20..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘NETWORK SERVICE’)
O4 — HKUSS-1-5-18..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘SYSTEM’)
O4 — HKUS.DEFAULT..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘Default user’)
O4 — Global Startup: Atomic Alarm Clock.lnk = C:Program FilesAtomic Alarm ClockAtomicAlarmClock.exe
O8 — Extra context menu item: &Экспорт в Microsoft Excel — res://C:PROGRA~1MICROS~2OFFICE11EXCEL.EXE/3000
O8 — Extra context menu item: Convert link target to Adobe PDF — res://C:Program FilesAdobeAcrobat 7.0AcrobatAcroIEFavClient.dll/AcroIECapture.html
O8 — Extra context menu item: Convert link target to existing PDF — res://C:Program FilesAdobeAcrobat 7.0AcrobatAcroIEFavClient.dll/AcroIEAppend.html
O8 — Extra context menu item: Convert selected links to Adobe PDF — res://C:Program FilesAdobeAcrobat 7.0AcrobatAcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 — Extra context menu item: Convert selected links to existing PDF — res://C:Program FilesAdobeAcrobat 7.0AcrobatAcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 — Extra context menu item: Convert selection to Adobe PDF — res://C:Program FilesAdobeAcrobat 7.0AcrobatAcroIEFavClient.dll/AcroIECapture.html
O8 — Extra context menu item: Convert selection to existing PDF — res://C:Program FilesAdobeAcrobat 7.0AcrobatAcroIEFavClient.dll/AcroIEAppend.html
O8 — Extra context menu item: Convert to Adobe PDF — res://C:Program FilesAdobeAcrobat 7.0AcrobatAcroIEFavClient.dll/AcroIECapture.html
O8 — Extra context menu item: Convert to existing PDF — res://C:Program FilesAdobeAcrobat 7.0AcrobatAcroIEFavClient.dll/AcroIEAppend.html
O9 — Extra button: (no name) — {08B0E5C0-4FCB-11CF-AAA5-00401C608501} — C:Program FilesJavaj2re1.4.2_03binnpjpi142_03.dll
O9 — Extra ‘Tools’ menuitem: Sun Java Console — {08B0E5C0-4FCB-11CF-AAA5-00401C608501} — C:Program FilesJavaj2re1.4.2_03binnpjpi142_03.dll
O9 — Extra button: Mail.Ru Агент — {7558B7E5-7B26-4201-BEDB-00D5FF534523} — C:Program FilesMail.RuAgentmagent.exe
O9 — Extra ‘Tools’ menuitem: Mail.Ru Агент — {7558B7E5-7B26-4201-BEDB-00D5FF534523} — C:Program FilesMail.RuAgentmagent.exe
O9 — Extra button: Справочные материалы — {92780B25-18CC-41C8-B9BE-3C9C571A8263} — C:PROGRA~1MICROS~2OFFICE11REFIEBAR.DLL
O9 — Extra button: Messenger — {FB5F1910-F110-11d2-BB9E-00C04F795683} — C:Program FilesMessengermsmsgs.exe
O9 — Extra ‘Tools’ menuitem: Windows Messenger — {FB5F1910-F110-11d2-BB9E-00C04F795683} — C:Program FilesMessengermsmsgs.exe
O16 — DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} (AcDcToday Control) — file://C:Program FilesMDT6AcDcToday.ocx
O16 — DPF: {AE563720-B4F5-11D4-A415-00108302FDFD} (NOXLATE-BANR) — file://C:Program FilesMDT6InstBanr.ocx
O16 — DPF: {C6637286-300D-11D4-AE0A-0010830243BD} (InstaFred) — file://C:Program FilesMDT6InstFred.ocx
O16 — DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) — file://C:Program FilesMDT6AcPreview.ocx
O17 — HKLMSystemCCSServicesTcpip..{3E9CA8B2-DF93-4905-8115-EBB8F6B76131}: NameServer = 192.168.0.1
O22 — SharedTaskScheduler: Предзагрузчик Browseui — {438755C2-A8BA-11D1-B96B-00A0C90312E1} — C:WINDOWSsystem32browseui.dll
O22 — SharedTaskScheduler: Демон кэша категорий компонентов — {8C7461EF-2B13-11d2-BE35-3078302C2030} — C:WINDOWSsystem32browseui.dll
O23 — Service: Adobe LM Service — Adobe Systems — C:Program FilesCommon FilesAdobe Systems SharedServiceAdobelmsvc.exe
O23 — Service: Журнал событий (Eventlog) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: EvtEng — Intel Corporation — C:Program FilesIntelWirelessBinEvtEng.exe
O23 — Service: Guard.Mail.ru — Unknown owner — C:Program FilesMail.RuGuardGuardMailRu.exe
O23 — Service: InstallDriver Table Manager (IDriverT) — Macrovision Corporation — C:Program FilesCommon FilesInstallShieldDriver1050Intel 32IDriverT.exe
O23 — Service: Служба COM записи компакт-дисков IMAPI (ImapiService) — Корпорация Майкрософт — C:WINDOWSsystem32imapi.exe
O23 — Service: InterBaseGuardian — FirebirdSQL Project — C:INECFireBirdBinIBGuard.EXE
O23 — Service: InterBaseServer — FirebirdSQL Project — C:INECFireBirdBinibserver.exe
O23 — Service: NetMeeting Remote Desktop Sharing (mnmsrvc) — Корпорация Майкрософт — C:WINDOWSsystem32mnmsrvc.exe
O23 — Service: NOD32 Kernel Service (NOD32krn) — Eset — C:Program FilesEsetnod32krn.exe
O23 — Service: Plug and Play (PlugPlay) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: Диспетчер сеанса справки для удаленного рабочего стола (RDSessMgr) — Корпорация Майкрософт — C:WINDOWSsystem32sessmgr.exe
O23 — Service: RegSrvc — Intel Corporation — C:Program FilesIntelWirelessBinRegSrvc.exe
O23 — Service: Cyberlink RichVideo Service(CRVS) (RichVideo) — Unknown owner — C:Program FilesCyberLinkShared FilesRichVideo.exe
O23 — Service: Spectrum24 Event Monitor (S24EventMonitor) — Intel Corporation — C:Program FilesIntelWirelessBinS24EvMon.exe
O23 — Service: Смарт-карты (SCardSvr) — Корпорация Майкрософт — C:WINDOWSSystem32SCardSvr.exe
O23 — Service: SolidWorks Licensing Service — SolidWorks — C:Program FilesCommon FilesSolidWorks SharedServiceSolidWorksLicensing.exe
O23 — Service: Журналы и оповещения производительности (SysmonLog) — Корпорация Майкрософт — C:WINDOWSsystem32smlogsvc.exe
O23 — Service: USB Safely Remove Assistant (USBSafelyRemoveService) — Unknown owner — C:Program FilesUSB Safely RemoveUSBSRService.exe
O23 — Service: Теневое копирование тома (VSS) — Корпорация Майкрософт — C:WINDOWSSystem32vssvc.exe
O23 — Service: WLANKEEPER — Intel® Corporation — C:Program FilesIntelWirelessBinWLKeeper.exe
O23 — Service: Dell Wireless WLAN Tray Service (wltrysvc) — Unknown owner — C:WINDOWSSystem32wltrysvc.exe
O23 — Service: Адаптер производительности WMI (WmiApSrv) — Корпорация Майкрософт — C:WINDOWSsystem32wbemwmiapsrv.exe

—
End of file — 10733 bytes

[Автор]

Сообщения