- This topic has 3 ответа, 2 участника, and was last updated 16 years, 3 months назад by
.
-
Сообщения
-
многоуважаемые ))) помогите пожалуйсто удалить Новостную ленту. всё зделал как написано , вот прилогается info txt и log txt ) буду очень признателен за помощь ! 🙂
info.txt logfile of random’s system information tool 1.05 2009-02-09 09:44:53
======Uninstall list======
—>C:Program FilesDivXDivXConverterUninstall.exe /CONVERTER
—>MsiExec /X{85EBB283-65AF-4C53-9EBE-7C0A232762F7}
—>MsiExec.exe /X{69495273-FCDC-4A86-BCB7-49B504D3FB0E}
—>rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:WINDOWSINFPCHealth.inf
Adobe AIR—>C:Program FilesCommon FilesAdobe AIRVersions1.0ResourcesAdobe AIR Updater.exe -arp:uninstall
Adobe AIR—>MsiExec.exe /I{A2BCA9F1-566C-4805-97D1-7FDC93386723}
Adobe Flash Player 10 ActiveX—>C:WINDOWSsystem32MacromedFlashuninstall_activeX.exe
Adobe Flash Player 10 Plugin—>C:WINDOWSsystem32MacromedFlashuninstall_plugin.exe
Adobe Media Player—>MsiExec.exe /X{9455959E-D588-EFAE-329C-F66CC797F32A}
AGEIA PhysX v7.03.21—>MsiExec.exe /X{85EBB283-65AF-4C53-9EBE-7C0A232762F7}
Athlon 64 Processor Driver—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1PROFES~1RunTime 9 1Intel32Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{C151CE54-E7EA-4804-854B-F515368B0798}setup.exe» -l0x19
ATI — Утилита деинсталляции—>C:Program FilesATI TechnologiesUninstallAllAtiCimUn.exe
ATI Control Panel—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1engine6INTEL3~1ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{0BEDBD4E-2D34-47B5-9973-57E62B29307C}setup.exe»
ATI Display Driver—>rundll32 C:WINDOWSsystem32atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
ATI HYDRAVISION—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1engine6INTEL3~1ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{3EA9D975-BFDC-4E8E-B88B-0446FBC8CA66}setup.exe»
Behold TV v4.75—>C:Program FilesBeholdTVBhUninst.exe
Counter-Strike 1.6—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1PROFES~1RunTime 9 0Intel32Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{13B792AA-C078-43A4-8A3A-8B12D629940D}Setup.exe» -l0x19
Daemon Tools LIte—>»C:Program FilesDaemon Tools LiteUninst.exe»
Disciples II — Rise of the Elves—>D:gamesDIS2_ROTEunins000.exe
DivX Codec—>C:Program FilesDivXDivXCodecUninstall.exe /CODEC
DivX Converter—>C:Program FilesDivXDivXConverterUninstall.exe /CONVERTER
DivX Player—>C:Program FilesDivXDivXPlayerUninstall.exe /PLAYER
DivX Plus DirectShow Filters—>C:Program FilesDivXDivXDSFiltersUninstall.exe /DSFILTERS
DivX Web Player—>C:Program FilesDivXDivXWebPlayerUninstall.exe /PLUGIN
Empire Earth III—>C:Program FilesInstallShield Installation Information{B17E235C-7A3B-4482-B650-21FFDE1D452E}setup.exe -runfromtemp -l0x0009 -removeonly
Google Toolbar for Internet Explorer—>MsiExec.exe /I{DBEA1034-5882-4A88-8033-81C4EF0CFA29}
Google Toolbar for Internet Explorer—>regsvr32 /u /s «c:program filesgooglegoogletoolbar1.dll»
HijackThis 2.0.2—>»C:Program Filestrend microHijackThis.exe» /uninstall
Icon Restore 1.0—>C:WINDOWSunins000.exe
ICQ Toolbar—>C:Program FilesICQ6ToolbarICQUnToolbar.exe
ICQ6.5—>»C:Program FilesInstallShield Installation Information{60DE4033-9503-48D1-A483-7846BD217CA9}setup.exe» -runfromtemp -l0x0009 -removeonly
Imperium Romanum—>»d:gamesBukaKalypsoImperium Romanumunins000.exe»
Java(TM) 6 Update 5—>MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160050}
K-Lite Codec Pack 4.1.7 (Full)—>»C:Program FilesK-Lite Codec Packunins000.exe»
MagicRotation—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1PROFES~1RunTime 9 1Intel32Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{B5428E17-1886-4DBB-A148-DACBB60D7A3D}setup.exe» -l0x19
Malwarebytes’ Anti-Malware—>»C:Program FilesMalwarebytes’ Anti-Malwareunins000.exe»
Microsoft .NET Framework 1.1 Russian Language Pack—>MsiExec.exe /X{2BB372D9-52B4-410A-BC1A-FEAB63181EEF}
Microsoft .NET Framework 1.1—>msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1—>MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 2.0 Service Pack 1—>MsiExec.exe /I{B508B3F1-A24A-32C0-B310-85786919EF28}
Microsoft Games for Windows — LIVE Redistributable—>MsiExec.exe /X{929CE49F-1CA7-4CF3-A9A1-6D757443C63F}
Microsoft Internationalized Domain Names Mitigation APIs—>»C:WINDOWS$NtServicePackUninstallIDNMitigationAPIs$spuninstspuninst.exe»
Microsoft National Language Support Downlevel APIs—>»C:WINDOWS$NtServicePackUninstallNLSDownlevelMapping$spuninstspuninst.exe»
Microsoft Office Access MUI (Russian) 2007—>MsiExec.exe /X{90120000-0015-0419-0000-0000000FF1CE}
Microsoft Office Enterprise 2007—>»C:Program FilesCommon FilesMicrosoft SharedOFFICE12Office Setup Controllersetup.exe» /uninstall ENTERPRISE /dll OSETUP.DLL
Microsoft Office Enterprise 2007—>MsiExec.exe /X{90120000-0030-0000-0000-0000000FF1CE}
Microsoft Office Excel MUI (Russian) 2007—>MsiExec.exe /X{90120000-0016-0419-0000-0000000FF1CE}
Microsoft Office Groove MUI (Russian) 2007—>MsiExec.exe /X{90120000-00BA-0419-0000-0000000FF1CE}
Microsoft Office InfoPath MUI (Russian) 2007—>MsiExec.exe /X{90120000-0044-0419-0000-0000000FF1CE}
Microsoft Office OneNote MUI (Russian) 2007—>MsiExec.exe /X{90120000-00A1-0419-0000-0000000FF1CE}
Microsoft Office Outlook MUI (Russian) 2007—>MsiExec.exe /X{90120000-001A-0419-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (Russian) 2007—>MsiExec.exe /X{90120000-0018-0419-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007—>MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (German) 2007—>MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE}
Microsoft Office Proof (Russian) 2007—>MsiExec.exe /X{90120000-001F-0419-0000-0000000FF1CE}
Microsoft Office Proof (Ukrainian) 2007—>MsiExec.exe /X{90120000-001F-0422-0000-0000000FF1CE}
Microsoft Office Proofing (Russian) 2007—>MsiExec.exe /X{90120000-002C-0419-0000-0000000FF1CE}
Microsoft Office Publisher MUI (Russian) 2007—>MsiExec.exe /X{90120000-0019-0419-0000-0000000FF1CE}
Microsoft Office Shared MUI (Russian) 2007—>MsiExec.exe /X{90120000-006E-0419-0000-0000000FF1CE}
Microsoft Office Word MUI (Russian) 2007—>MsiExec.exe /X{90120000-001B-0419-0000-0000000FF1CE}
Microsoft Visual C++ 2005 Redistributable—>MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Windows Media Video 9 VCM—>RunDll32 advpack.dll,LaunchINFSection C:WINDOWSINFwmv9vcm.inf, Uninstall
Mozilla Firefox (3.0.6)—>C:Program FilesMozilla Firefoxuninstallhelper.exe
MSXML 4.0 SP2 (KB936181)—>MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 Parser and SDK—>MsiExec.exe /I{716E0306-8318-4364-8B8F-0CC4E9376BAC}
MSXML 6.0 Parser (KB933579)—>MsiExec.exe /I{8FCE7820-08DF-4663-AF5B-B190EF387C4B}
Need for Speed™ Undercover—>MsiExec.exe /X{E6D22FE1-AB5F-42CA-9480-6F70B96DDD88}
Nero 6—>C:Program FilesAheadnerouninstallUNNERO.exe /UNINSTALL
NVIDIA Drivers—>C:WINDOWSsystem32NVUNINST.EXE UninstallGUI
NVIDIA ForceWare Network Access Manager—>C:PROGRA~1COMMON~1INSTAL~1Driver9INTEL3~1IDriver.exe /M{1F6423DE-7959-4178-80E0-023C7EAA5347} /l1033
Paint.NET v3.22—>rundll32.exe advpack.dll,LaunchINFSection C:WINDOWSINFPaintDN.inf,Uninstall
Realtek AC’97 Audio—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1PROFES~1RunTime11 0Intel32Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{FB08F381-6533-4108-B7DD-039E11FBC27E}Setup.exe» -l0x19 -removeonly
ToolTipFixer 1.0.1—>C:Program FilesNeoSmart TechnologiesToolTipFixeruninstall.exe
VC80CRTRedist — 8.0.50727.762—>MsiExec.exe /I{767CC44C-9BBC-438D-BAD3-FD4595DD148B}
Vista Drive Icon—>rundll32.exe advpack.dll,LaunchINFSection C:WINDOWSINFVistaDrv.inf,Uninstall
Winamp—>»C:Program FilesWinampunins000.exe»
Windows Internet Explorer 7—>»C:WINDOWSie7spuninstspuninst.exe»
Архиватор WinRAR—>C:Program FilesWinRARuninstall.exe
Большая рыбалка—>C:Program FilesInstallShield Installation Information{09067C87-A39C-499D-9295-5AC3CDAAC095}setup.exe -runfromtemp -l0x0019 -removeonly
Данные ДубльГИС г.Екатеринбург 01.11.2008—>MsiExec.exe /X{01C1ADAF-4CB5-414B-92FF-6FA81E1ED0F0}
ДубльГИС 3.0.4.1—>MsiExec.exe /X{FA671504-B676-42B9-A5E5-30399BD8F676}
Танчики—>D:скачкаТанчики (Бука)TanksUnins000.exe======Security center information======
FW: NVIDIA Firewall (disabled)
System event log
Computer Name: MICROSOF-7EDCFE
Event Code: 7036
Message: Служба «Сетевые подключения» перешла в состояние Работает.Record Number: 5768
Source Name: Service Control Manager
Time Written: 20090126234900.000000+300
Event Type: информация
User:Computer Name: MICROSOF-7EDCFE
Event Code: 7036
Message: Служба «Служба COM записи компакт-дисков IMAPI» перешла в состояние Работает.Record Number: 5767
Source Name: Service Control Manager
Time Written: 20090126234900.000000+300
Event Type: информация
User:Computer Name: MICROSOF-7EDCFE
Event Code: 7035
Message: Служба «Служба COM записи компакт-дисков IMAPI» успешно отправила управляющий элемент «запустить».Record Number: 5766
Source Name: Service Control Manager
Time Written: 20090126234900.000000+300
Event Type: информация
User: NT AUTHORITYSYSTEMComputer Name: MICROSOF-7EDCFE
Event Code: 7035
Message: Служба «Сетевые подключения» успешно отправила управляющий элемент «запустить».Record Number: 5765
Source Name: Service Control Manager
Time Written: 20090126234900.000000+300
Event Type: информация
User: NT AUTHORITYSYSTEMComputer Name: MICROSOF-7EDCFE
Event Code: 7036
Message: Служба «Совместимость быстрого переключения пользователей» перешла в состояние Работает.Record Number: 5764
Source Name: Service Control Manager
Time Written: 20090126234900.000000+300
Event Type: информация
User:Application event log
Computer Name: MICROSOF-7EDCFE
Event Code: 11707
Message: Product: Need for Speed™ Undercover — Installation completed successfully.Record Number: 97
Source Name: MsiInstaller
Time Written: 20081203002555.000000+300
Event Type: информация
User: MICROSOF-7EDCFEAdminComputer Name: MICROSOF-7EDCFE
Event Code: 2
Message: Title Fallout3.exe (1.0.0.12)
XLive 1.2.0241.0 C:WINDOWSsystem32xlive.dll0x80004005
Games for Windows LIVE DLL
C:WINDOWSsystem32msidcrl40.dll 4.200.513.1Record Number: 96
Source Name: XLive
Time Written: 20081202234634.000000+300
Event Type: предупреждение
User:Computer Name: MICROSOF-7EDCFE
Event Code: 2
Message: Title Fallout3.exe (1.0.0.12)
XLive 1.2.0241.0 C:WINDOWSsystem32xlive.dll0x80004005
Games for Windows LIVE DLL
C:WINDOWSsystem32msidcrl40.dll 4.200.513.1Record Number: 95
Source Name: XLive
Time Written: 20081202234510.000000+300
Event Type: предупреждение
User:Computer Name: MICROSOF-7EDCFE
Event Code: 4097
Message: Приложение D:gamesBethesda SoftworksFallout 3Fallout3.exe вызвало ошибку
Ошибка в 02/12/2008 @ 21:45:02.390
Вызвано исключение c0000005 по адресу 00B48D95 (Fallout3)Record Number: 94
Source Name: DrWatson
Time Written: 20081202234502.000000+300
Event Type: информация
User:Computer Name: MICROSOF-7EDCFE
Event Code: 2
Message: Title Fallout3.exe (1.0.0.12)
XLive 1.2.0241.0 C:WINDOWSsystem32xlive.dll0x80004005
Games for Windows LIVE DLL
C:WINDOWSsystem32msidcrl40.dll 4.200.513.1Record Number: 93
Source Name: XLive
Time Written: 20081202234501.000000+300
Event Type: предупреждение
User:======Environment variables======
«ComSpec»=%SystemRoot%system32cmd.exe
«Path»=%systemroot%system32;%systemroot%;%systemroot%system32wbem;C:Program FilesATI TechnologiesATI Control Panel
«windir»=%SystemRoot%
«FP_NO_HOST_CHECK»=NO
«OS»=Windows_NT
«PROCESSOR_ARCHITECTURE»=x86
«PROCESSOR_LEVEL»=15
«PROCESSOR_IDENTIFIER»=x86 Family 15 Model 44 Stepping 2, AuthenticAMD
«PROCESSOR_REVISION»=2c02
«NUMBER_OF_PROCESSORS»=1
«PATHEXT»=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
«TEMP»=%SystemRoot%TEMP
«TMP»=%SystemRoot%TEMP
EOF
Logfile of random’s system information tool 1.05 (written by random/random)
Run by Admin at 2009-02-09 10:02:57
Microsoft Windows XP Professional Service Pack 2
System drive C: has 51 GB (66%) free of 76 GB
Total RAM: 2047 MB (81% free)Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:03:00, on 09.02.2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Boot mode: NormalRunning processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32Ati2evxx.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSsystem32Ati2evxx.exe
C:WINDOWSExplorer.EXE
C:Program FilesNVIDIA CorporationNetworkAccessManagerApache GroupApache2binapache.exe
C:Program FilesMicrosoft OfficeOffice12GrooveMonitor.exe
C:Program FilesATI TechnologiesATI Control Panelatiptaxx.exe
C:Program FilesICQ6ToolbarICQ Service.exe
C:Program FilesNVIDIA CorporationNetworkAccessManagerbinnSvcIp.exe
C:WINDOWSSOUNDMAN.EXE
C:WINDOWSsystem32ctfmon.exe
C:Program FilesVistaDriveIconVistaDrv.exe
C:Program FilesDAEMON Tools Litedaemon.exe
C:Program FilesGoogleGoogleToolbarNotifier1.2.1128.5462GoogleToolbarNotifier.exe
C:Program FilesNVIDIA CorporationNetworkAccessManagerbinnSvcLog.exe
C:WINDOWSsystem32PnkBstrA.exe
C:Program FilesNeoSmart TechnologiesToolTipFixerToolTipFixer.exe
D:прогипрогиauthcliw.exe
C:Program FilesuTorrentutorrent.exe
C:Program FilesNVIDIA CorporationNetworkAccessManagerApache GroupApache2binapache.exe
C:Program FilesNVIDIA CorporationNetworkAccessManagerbinnSvcAppFlt.exe
C:WINDOWSsystem32wscntfy.exe
C:Documents and SettingsAdminРабочий столRSIT.exe
C:Program Filestrend microAdmin.exeR1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 — HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Ссылки
R3 — URLSearchHook: (no name) — — (no file)
R3 — URLSearchHook: ICQToolBar — {855F3B16-6D32-4fe6-8A56-BBB695989046} — C:Program FilesICQ6ToolbarICQToolBar.dll
O2 — BHO: yvulibP — {4D43A883-4FED-4148-B6C2-3E065E77F5D8} — C:Documents and SettingsAll UsersApplication Datayvulib.dll
O2 — BHO: Groove GFS Browser Helper — {72853161-30C5-4D22-B7F9-0BBC1D38A37E} — C:PROGRA~1MICROS~2Office12GRA8E1~1.DLL
O2 — BHO: SSVHelper Class — {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} — C:Program FilesJavajre1.6.0_05binssv.dll
O2 — BHO: mlqlibP — {99EB8A8F-604F-4017-8309-13E28F824776} — C:Documents and SettingsAll UsersApplication Datamlqlib.dll
O2 — BHO: Google Toolbar Helper — {AA58ED58-01DD-4d91-8333-CF10577473F7} — c:program filesgooglegoogletoolbar1.dll (file missing)
O2 — BHO: aqplibP — {CBC43FBB-B0CD-4343-88C3-BFB1F2C1E89D} — C:Documents and SettingsAll UsersApplication Dataaqplib.dll
O3 — Toolbar: ICQToolBar — {855F3B16-6D32-4fe6-8A56-BBB695989046} — C:Program FilesICQ6ToolbarICQToolBar.dll
O3 — Toolbar: &Google — {2318C2B1-4965-11d4-9B18-009027A5CD4F} — c:program filesgooglegoogletoolbar1.dll (file missing)
O4 — HKLM..Run: [NeroFilterCheck] C:WINDOWSsystem32NeroCheck.exe
O4 — HKLM..Run: [GrooveMonitor] «C:Program FilesMicrosoft OfficeOffice12GrooveMonitor.exe»
O4 — HKLM..Run: [ATIPTA] C:Program FilesATI TechnologiesATI Control Panelatiptaxx.exe
O4 — HKLM..Run: [nTrayFw] C:Program FilesNVIDIA CorporationNetworkAccessManagerbinnTrayFw.exe
O4 — HKLM..Run: [SoundMan] SOUNDMAN.EXE
O4 — HKCU..Run: [CTFMON.EXE] C:WINDOWSsystem32ctfmon.exe
O4 — HKCU..Run: [VistaIcon] C:Program FilesVistaDriveIconVistaDrv.exe
O4 — HKCU..Run: [DAEMON Tools Lite] «C:Program FilesDAEMON Tools Litedaemon.exe» -autorun
O4 — HKCU..Run: [swg] C:Program FilesGoogleGoogleToolbarNotifier1.2.1128.5462GoogleToolbarNotifier.exe
O4 — HKUSS-1-5-18..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘SYSTEM’)
O4 — HKUSS-1-5-18..Run: [VistaIcon] C:Program FilesVistaDriveIconVistaDrv.exe (User ‘SYSTEM’)
O4 — HKUSS-1-5-18..RunOnce: [ZZZZ2_FirstLogonSetting] %SystemRoot%System32rundll32.exe advpack.dll,LaunchINFSection C:WINDOWSINFcustom.inf,NewUserFirstLogonInstall,0 (User ‘SYSTEM’)
O4 — HKUS.DEFAULT..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘Default user’)
O4 — HKUS.DEFAULT..RunOnce: [ZZZZ2_FirstLogonSetting] %SystemRoot%System32rundll32.exe advpack.dll,LaunchINFSection C:WINDOWSINFcustom.inf,NewUserFirstLogonInstall,0 (User ‘Default user’)
O4 — Startup: authcliw.exe (3).lnk = ?
O4 — Startup: utorrent.exe.lnk = C:Program FilesuTorrentutorrent.exe
O8 — Extra context menu item: &Экспорт в Microsoft Excel — res://C:PROGRA~1MICROS~2Office12EXCEL.EXE/3000
O9 — Extra button: (no name) — {08B0E5C0-4FCB-11CF-AAA5-00401C608501} — C:Program FilesJavajre1.6.0_05binssv.dll
O9 — Extra ‘Tools’ menuitem: Sun Java Console — {08B0E5C0-4FCB-11CF-AAA5-00401C608501} — C:Program FilesJavajre1.6.0_05binssv.dll
O9 — Extra button: Отправить в OneNote — {2670000A-7350-4f3c-8081-5663EE0C6C49} — C:PROGRA~1MICROS~2Office12ONBttnIE.dll
O9 — Extra ‘Tools’ menuitem: &Отправить в OneNote — {2670000A-7350-4f3c-8081-5663EE0C6C49} — C:PROGRA~1MICROS~2Office12ONBttnIE.dll
O9 — Extra button: Research — {92780B25-18CC-41C8-B9BE-3C9C571A8263} — C:PROGRA~1MICROS~2Office12REFIEBAR.DLL
O9 — Extra button: (no name) — {e2e2dd38-d088-4134-82b7-f2ba38496583} — C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O9 — Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 — {e2e2dd38-d088-4134-82b7-f2ba38496583} — C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O9 — Extra button: ICQ6 — {E59EB121-F339-4851-A3BA-FE49C35617C2} — C:Program FilesICQ6.5ICQ.exe
O9 — Extra ‘Tools’ menuitem: ICQ6 — {E59EB121-F339-4851-A3BA-FE49C35617C2} — C:Program FilesICQ6.5ICQ.exe
O15 — Trusted Zone: http://*.drochinehochu.ru
O15 — Trusted Zone: http://www.vesti.ru
O17 — HKLMSystemCCSServicesTcpip..{A4811310-E4F0-4144-83A7-0DF416049921}: NameServer = 195.64.220.2,195.64.192.35
O18 — Protocol: grooveLocalGWS — {88FED34C-F0CA-4636-A375-3CB6248B04CD} — C:PROGRA~1MICROS~2Office12GR99D3~1.DLL
O23 — Service: Ati HotKey Poller — Unknown owner — C:WINDOWSsystem32Ati2evxx.exe
O23 — Service: ATI Smart — Unknown owner — C:WINDOWSsystem32ati2sgag.exe
O23 — Service: Журнал событий (Eventlog) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: ForceWare Intelligent Application Manager (IAM) — Unknown owner — C:Program FilesNVIDIA CorporationNetworkAccessManagerbinnSvcAppFlt.exe
O23 — Service: Forceware Web Interface (ForcewareWebInterface) — Apache Software Foundation — C:Program FilesNVIDIA CorporationNetworkAccessManagerApache GroupApache2binapache.exe
O23 — Service: Google Updater Service (gusvc) — Google — C:Program FilesGoogleCommonGoogle UpdaterGoogleUpdaterService.exe
O23 — Service: ICQ Service — Unknown owner — C:Program FilesICQ6ToolbarICQ Service.exe
O23 — Service: InstallDriver Table Manager (IDriverT) — Macrovision Corporation — C:Program FilesCommon FilesInstallShieldDriver11Intel 32IDriverT.exe
O23 — Service: Служба COM записи компакт-дисков IMAPI (ImapiService) — Корпорация Майкрософт — C:WINDOWSsystem32imapi.exe
O23 — Service: ForceWare IP service (nSvcIp) — NVIDIA — C:Program FilesNVIDIA CorporationNetworkAccessManagerbinnSvcIp.exe
O23 — Service: ForceWare user log service (nSvcLog) — NVIDIA — C:Program FilesNVIDIA CorporationNetworkAccessManagerbinnSvcLog.exe
O23 — Service: Plug and Play (PlugPlay) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: PnkBstrA — Unknown owner — C:WINDOWSsystem32PnkBstrA.exe
O23 — Service: Диспетчер сеанса справки для удаленного рабочего стола (RDSessMgr) — Корпорация Майкрософт — C:WINDOWSsystem32sessmgr.exe
O23 — Service: Смарт-карты (SCardSvr) — Корпорация Майкрософт — C:WINDOWSSystem32SCardSvr.exe
O23 — Service: Журналы и оповещения производительности (SysmonLog) — Корпорация Майкрософт — C:WINDOWSsystem32smlogsvc.exe
O23 — Service: NST ToolTipFixer (TTFixerService) — NeoSmart Technologies — C:Program FilesNeoSmart TechnologiesToolTipFixerToolTipFixer.exe
O23 — Service: Теневое копирование тома (VSS) — Корпорация Майкрософт — C:WINDOWSSystem32vssvc.exe
O23 — Service: Адаптер производительности WMI (WmiApSrv) — Корпорация Майкрософт — C:WINDOWSsystem32wbemwmiapsrv.exe—
End of file — 8639 bytes======Registry dump======
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{4D43A883-4FED-4148-B6C2-3E065E77F5D8}]
SHN Video Provider — C:Documents and SettingsAll UsersApplication Datayvulib.dll [2009-02-08 323072][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper — C:PROGRA~1MICROS~2Office12GRA8E1~1.DLL [2006-10-27 2210608][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class — C:Program FilesJavajre1.6.0_05binssv.dll [2008-02-22 509328][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{99EB8A8F-604F-4017-8309-13E28F824776}]
LPAC Video Helper — C:Documents and SettingsAll UsersApplication Datamlqlib.dll [2009-02-08 321536][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper — c:program filesgooglegoogletoolbar1.dll [][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{CBC43FBB-B0CD-4343-88C3-BFB1F2C1E89D}]
PPCM Data Extension — C:Documents and SettingsAll UsersApplication Dataaqplib.dll [2009-02-08 320000][HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
{855F3B16-6D32-4fe6-8A56-BBB695989046} — ICQToolBar — C:Program FilesICQ6ToolbarICQToolBar.dll [2008-06-12 958712]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} — &Google — c:program filesgooglegoogletoolbar1.dll [][HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun]
«NeroFilterCheck»=C:WINDOWSsystem32NeroCheck.exe [2006-01-12 155648]
«GrooveMonitor»=C:Program FilesMicrosoft OfficeOffice12GrooveMonitor.exe [2006-10-27 31016]
«ATIPTA»=C:Program FilesATI TechnologiesATI Control Panelatiptaxx.exe [2004-08-25 339968]
«nTrayFw»=C:Program FilesNVIDIA CorporationNetworkAccessManagerbinnTrayFw.exe [2005-02-24 266240]
«SoundMan»=C:WINDOWSSOUNDMAN.EXE [2005-06-20 77824][HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=C:WINDOWSsystem32ctfmon.exe [2008-03-15 30208]
«VistaIcon»=C:Program FilesVistaDriveIconVistaDrv.exe [2008-01-02 132096]
«DAEMON Tools Lite»=C:Program FilesDAEMON Tools Litedaemon.exe [2008-02-14 486856]
«swg»=C:Program FilesGoogleGoogleToolbarNotifier1.2.1128.5462GoogleToolbarNotifier.exe [2009-02-08 171448]C:Documents and SettingsAdminГлавное менюПрограммыАвтозагрузка
authcliw.exe (3).lnk — D:прогипрогиauthcliw.exe
utorrent.exe.lnk — C:Program FilesuTorrentutorrent.exe[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifyAtiExtEvent]
C:WINDOWSsystem32Ati2evxx.dll [2004-08-25 86016][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad]
WPDShServiceObj — {AAA288BA-9A4C-45B0-95D7-94D524869DB5} — C:WINDOWSsystem32wpdshserviceobj.dll [2008-03-02 133632][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerShellExecuteHooks]
«{B5A7F190-DDA6-4420-B3BA-52453494E6CD}»=C:PROGRA~1MICROS~2Office12GRA8E1~1.DLL [2006-10-27 2210608][HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetwork{1a3e09be-1e45-494b-9174-d7385b45bbf5}]
[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
«dontdisplaylastusername»=0
«legalnoticecaption»=
«legalnoticetext»=
«shutdownwithoutlogon»=1
«undockwithoutlogon»=1[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoDriveTypeAutoRun»=323
«NoSharedDocuments»=1
«NoSMConfigurePrograms»=1
«NoDriveAutoRun»=67108863
«NoDrives»=0[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoDriveAutoRun»=
«NoDriveTypeAutoRun»=
«NoDrives»=[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicystandardprofileauthorizedapplicationslist]
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»
«%windir%Network Diagnosticxpnetdiag.exe»=»%windir%Network Diagnosticxpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000»
«C:Program FilesuTorrentutorrent.exe»=»C:Program FilesuTorrentutorrent.exe:*:Enabled:µTorrent»
«D:прогипрогиauthcliw.exe»=»D:прогипрогиauthcliw.exe:*:Enabled:authcliw»
«D:прогиGreyLink4.84_igro.edgreylink.exe»=»D:прогиGreyLink4.84_igro.edgreylink.exe:*:Enabled:greylink: a new generation dc++ client»
«D:gamesAge of Chivalryhl2.exe»=»D:gamesAge of Chivalryhl2.exe:*:Enabled:hl2»[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicydomainprofileauthorizedapplicationslist]
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»
«%windir%Network Diagnosticxpnetdiag.exe»=»%windir%Network Diagnosticxpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000»[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{e2e30cd2-bbad-11dd-9084-000461a02382}]
shellAutoRuncommand — WD_Windows_ToolsSetup.exe======List of files/folders created in the last 1 months======
2009-02-09 09:44:39 —-D—- C:rsit
2009-02-09 09:44:39 —-D—- C:Program Filestrend micro
2009-02-08 22:54:08 —-D—- C:WINDOWStemp
2009-02-08 22:54:08 —-A—- C:ComboFix.txt
2009-02-08 22:51:50 —-D—- C:ComboFix
2009-02-08 22:45:15 —-A—- C:WINDOWSNIRCMD.exe
2009-02-08 22:30:20 —-A—- C:WINDOWSzip.exe
2009-02-08 22:30:20 —-A—- C:WINDOWSVFIND.exe
2009-02-08 22:30:20 —-A—- C:WINDOWSSWXCACLS.exe
2009-02-08 22:30:20 —-A—- C:WINDOWSSWSC.exe
2009-02-08 22:30:20 —-A—- C:WINDOWSSWREG.exe
2009-02-08 22:30:20 —-A—- C:WINDOWSsed.exe
2009-02-08 22:30:20 —-A—- C:WINDOWSgrep.exe
2009-02-08 22:30:20 —-A—- C:WINDOWSfdsv.exe
2009-02-08 22:30:16 —-D—- C:Qoobox
2009-02-08 22:16:25 —-A—- C:WINDOWSsystem32tmp.txt
2009-02-08 22:16:24 —-A—- C:rapport.txt
2009-02-08 22:09:33 —-D—- C:SDFix
2009-02-08 21:54:56 —-D—- C:_OTMoveIt
2009-02-08 20:44:38 —-D—- C:ERDNT
2009-02-08 20:44:36 —-D—- C:WINDOWSERUNT
2009-02-08 20:44:36 —-D—- C:WINDOWSERDNT
2009-02-08 20:44:34 —-D—- C:!FixIEDef
2009-02-08 20:34:20 —-D—- C:Documents and SettingsAdminApplication DataMalwarebytes
2009-02-08 20:34:15 —-D—- C:Program FilesMalwarebytes’ Anti-Malware
2009-02-08 20:34:15 —-D—- C:Documents and SettingsAll UsersApplication DataMalwarebytes
2009-02-08 20:23:24 —-D—- C:WINDOWSsystem32appmgmt
2009-02-08 20:08:58 —-AD—- C:autorun.inf
2009-02-08 18:56:16 —-HDC—- C:WINDOWSie7
2009-02-08 18:56:02 —-HDC—- C:WINDOWS$NtServicePackUninstallIDNMitigationAPIs$
2009-02-08 18:55:42 —-HDC—- C:WINDOWS$NtServicePackUninstallNLSDownlevelMapping$
2009-02-08 18:55:22 —-HD—- C:WINDOWS$hf_mig$
2009-02-08 18:54:52 —-D—- C:Documents and SettingsAll UsersApplication DataWindows Genuine Advantage
2009-02-08 15:56:27 —-D—- C:TEMP
2009-02-08 09:42:59 —-D—- C:Documents and SettingsAll UsersApplication DataAdobe
2009-02-08 09:42:58 —-D—- C:Program FilesAdobe Media Player
2009-02-08 09:42:55 —-D—- C:Program FilesCommon FilesAdobe AIR
2009-02-08 09:41:24 —-D—- C:Program FilesMozilla Firefox
2009-02-08 08:36:31 —-N—- C:WINDOWSsystem32vxblock.dll
2009-02-08 08:36:31 —-N—- C:WINDOWSsystem32pxwave.dll
2009-02-08 08:36:31 —-N—- C:WINDOWSsystem32pxsfs.dll
2009-02-08 08:36:31 —-N—- C:WINDOWSsystem32pxmas.dll
2009-02-08 08:36:31 —-N—- C:WINDOWSsystem32pxinsi64.exe
2009-02-08 08:36:31 —-N—- C:WINDOWSsystem32pxinsa64.exe
2009-02-08 08:36:31 —-N—- C:WINDOWSsystem32pxhpinst.exe
2009-02-08 08:36:31 —-N—- C:WINDOWSsystem32pxdrv.dll
2009-02-08 08:36:31 —-N—- C:WINDOWSsystem32pxcpyi64.exe
2009-02-08 08:36:31 —-N—- C:WINDOWSsystem32pxcpya64.exe
2009-02-08 08:36:31 —-N—- C:WINDOWSsystem32pxafs.dll
2009-02-08 08:36:07 —-D—- C:Program FilesDivX
2009-02-08 08:30:42 —-D—- C:Documents and SettingsAdminApplication DataGoogle
2009-02-08 08:29:35 —-D—- C:Documents and SettingsAll UsersApplication DataGoogle
2009-02-08 08:29:24 —-D—- C:Program FilesGoogle
2009-02-08 08:16:11 —-A—- C:Documents and SettingsAll UsersApplication Datamlqlib.dll
2009-02-08 08:14:44 —-A—- C:Documents and SettingsAll UsersApplication Datayvulib.dll
2009-02-08 08:14:44 —-A—- C:Documents and SettingsAll UsersApplication Dataaqplib.dll
2009-01-25 01:49:50 —-D—- C:Documents and SettingsAdminApplication DataImperium Romanum
2009-01-23 02:34:14 —-D—- C:Program FilesBeholdTV
2009-01-23 02:33:09 —-D—- C:Documents and SettingsAdminApplication DataBeholdTV
2009-01-15 22:48:58 —-A—- C:WINDOWSsystem32XAudio2_2.dll
2009-01-15 22:48:58 —-A—- C:WINDOWSsystem32XAPOFX1_1.dll
2009-01-15 22:48:57 —-A—- C:WINDOWSsystem32xactengine3_2.dll
2009-01-15 22:48:56 —-A—- C:WINDOWSsystem32d3dx10_39.dll
2009-01-15 22:48:56 —-A—- C:WINDOWSsystem32D3DCompiler_39.dll
2009-01-15 22:48:55 —-A—- C:WINDOWSsystem32D3DX9_39.dll
2009-01-15 22:48:06 —-D—- C:Program FilesMSXML 4.0
2009-01-15 22:48:01 —-D—- C:Program FilesWMV9_VCM
2009-01-14 13:09:43 —-D—- C:Program FilesCommon FilesDirectX
2009-01-13 20:05:06 —-D—- C:Documents and SettingsAdminApplication DataSierra Entertainment
2009-01-13 20:02:31 —-DC—- C:WINDOWSsystem32DRVSTORE
2009-01-13 20:02:12 —-D—- C:WINDOWSsystem32AGEIA
2009-01-13 20:02:12 —-D—- C:Program FilesAGEIA Technologies
2009-01-13 20:02:04 —-D—- C:Program FilesCommon FilesWise Installation Wizard======List of files/folders modified in the last 1 months======
2009-02-09 10:02:48 —-D—- C:Documents and SettingsAdminApplication DatauTorrent
2009-02-09 09:44:39 —-RD—- C:Program Files
2009-02-09 02:57:48 —-A—- C:WINDOWSSchedLgU.Txt
2009-02-08 22:54:09 —-D—- C:WINDOWSsystem32
2009-02-08 22:54:08 —-D—- C:WINDOWS
2009-02-08 22:52:56 —-A—- C:WINDOWSsystem.ini
2009-02-08 22:52:41 —-D—- C:WINDOWSsystem32drivers
2009-02-08 22:52:41 —-D—- C:WINDOWSAppPatch
2009-02-08 22:52:41 —-D—- C:Program FilesCommon Files
2009-02-08 22:52:17 —-D—- C:WINDOWSsystem32CatRoot2
2009-02-08 22:34:38 —-D—- C:WINDOWSSoftwareDistribution
2009-02-08 22:32:05 —-D—- C:WINDOWSsystem32config
2009-02-08 20:44:35 —-SHD—- C:System Volume Information
2009-02-08 20:44:35 —-D—- C:WINDOWSsystem32Restore
2009-02-08 20:23:11 —-SHD—- C:WINDOWSInstaller
2009-02-08 19:43:14 —-D—- C:WINDOWSHelp
2009-02-08 19:40:07 —-HD—- C:Program FilesInstallShield Installation Information
2009-02-08 19:01:58 —-RSHDC—- C:WINDOWSsystem32dllcache
2009-02-08 18:56:34 —-HD—- C:WINDOWSinf
2009-02-08 18:56:30 —-D—- C:Program FilesInternet Explorer
2009-02-08 18:56:04 —-A—- C:WINDOWSimsins.BAK
2009-02-08 17:57:36 —-SD—- C:Documents and SettingsAdminApplication DataMicrosoft
2009-02-08 11:41:04 —-A—- C:WINDOWSsystem32PerfStringBackup.INI
2009-02-08 11:24:38 —-D—- C:WINDOWSsystem32CatRoot
2009-02-08 11:24:24 —-D—- C:WINDOWS%DownloadedProgramFiles%
2009-02-08 09:43:02 —-D—- C:Documents and SettingsAdminApplication DataAdobe
2009-02-08 08:28:50 —-SD—- C:WINDOWSDownloaded Program Files
2009-02-08 08:28:48 —-D—- C:WINDOWSsystem32Macromed
2009-02-07 21:36:49 —-A—- C:WINDOWSsystem32PnkBstrB.exe
2009-02-06 15:45:32 —-A—- C:WINDOWSNeroDigital.ini
2009-01-25 01:42:07 —-D—- C:WINDOWSsystem32DirectX
2009-01-15 22:48:08 —-D—- C:WINDOWSWinSxS======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R1 magicpvt;magicpvt; C:WINDOWSsystem32driversmagicpvt.sys [2005-06-10 9728]
R1 WS2IFSL;Среда Windows Socket 2.0 поддержки поставщиков не-IFS служб; C:WINDOWSSystem32driversws2ifsl.sys [2004-08-18 12032]
R2 rspndr;Ответчик обнаружения топологии уровня связи; C:WINDOWSsystem32DRIVERSrspndr.sys [2006-12-04 62336]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:WINDOWSsystem32driversALCXWDM.SYS [2005-06-20 2324480]
R3 ati2mtag;ati2mtag; C:WINDOWSsystem32DRIVERSati2mtag.sys [2004-08-25 787456]
R3 ltmodem5;LT Modem Driver; C:WINDOWSsystem32DRIVERSltmdmnt.sys [2008-03-15 606940]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:WINDOWSsystem32DRIVERSNVENETFD.sys [2005-02-25 33408]
R3 nvnetbus;NVIDIA Network Bus Enumerator; C:WINDOWSsystem32DRIVERSnvnetbus.sys [2005-02-25 12928]
R3 usbehci;Драйвер минипорта Microsoft USB 2.0 расширенного хост-контроллера; C:WINDOWSsystem32DRIVERSusbehci.sys [2008-03-15 30208]
R3 usbhub;USB2 концентратор; C:WINDOWSsystem32DRIVERSusbhub.sys [2008-03-15 59520]
R3 usbohci;Драйвер минипорта Microsoft USB открытого хост-контроллера; C:WINDOWSsystem32DRIVERSusbohci.sys [2008-03-15 17152]
S3 aexrbobf;aexrbobf; C:WINDOWSsystem32driversaexrbobf.sys []
S3 npkcrypt;npkcrypt; ??D:gamesLineage IIsystemnpkcrypt.sys []
S3 USBSTOR;Драйвер запоминающих устройств для USB; C:WINDOWSsystem32DRIVERSUSBSTOR.SYS [2008-03-15 26496]
S3 WudfPf;Windows Driver Foundation — User-mode Driver Framework Platform Driver; C:WINDOWSsystem32DRIVERSWudfPf.sys [2008-03-02 77568]
S3 WudfRd;Windows Driver Foundation — User-mode Driver Framework Reflector; C:WINDOWSsystem32DRIVERSwudfrd.sys [2008-03-02 82944]
S4 IntelIde;IntelIde; C:WINDOWSsystem32driversIntelIde.sys []======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 Ati HotKey Poller;Ati HotKey Poller; C:WINDOWSsystem32Ati2evxx.exe [2004-08-25 389120]
R2 ForceWare Intelligent Application Manager (IAM);ForceWare Intelligent Application Manager (IAM); C:Program FilesNVIDIA CorporationNetworkAccessManagerbinnSvcAppFlt.exe [2005-02-24 139264]
R2 ForcewareWebInterface;Forceware Web Interface; C:Program FilesNVIDIA CorporationNetworkAccessManagerApache GroupApache2binapache.exe [2004-11-30 20543]
R2 ICQ Service;ICQ Service; C:Program FilesICQ6ToolbarICQ Service.exe [2008-06-10 222456]
R2 nSvcIp;ForceWare IP service; C:Program FilesNVIDIA CorporationNetworkAccessManagerbinnSvcIp.exe [2005-02-24 131133]
R2 nSvcLog;ForceWare user log service; C:Program FilesNVIDIA CorporationNetworkAccessManagerbinnSvcLog.exe [2005-02-24 57409]
R2 PnkBstrA;PnkBstrA; C:WINDOWSsystem32PnkBstrA.exe [2008-12-03 66872]
R2 TTFixerService;NST ToolTipFixer; C:Program FilesNeoSmart TechnologiesToolTipFixerToolTipFixer.exe [2007-06-27 10240]
S2 ATI Smart;ATI Smart; C:WINDOWSsystem32ati2sgag.exe [2004-08-25 516096]
S3 aspnet_state;ASP.NET State Service; C:WINDOWSMicrosoft.NETFrameworkv2.0.50727aspnet_state.exe [2007-10-24 33800]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:WINDOWSMicrosoft.NETFrameworkv2.0.50727mscorsvw.exe [2007-10-24 70144]
S3 gusvc;Google Updater Service; C:Program FilesGoogleCommonGoogle UpdaterGoogleUpdaterService.exe [2009-02-08 138168]
S3 IDriverT;InstallDriver Table Manager; C:Program FilesCommon FilesInstallShieldDriver11Intel 32IDriverT.exe [2005-04-04 69632]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:Program FilesMicrosoft OfficeOffice12GrooveAuditService.exe [2006-10-27 65824]
S3 odserv;Microsoft Office Diagnostics Service; C:Program FilesCommon FilesMicrosoft SharedOFFICE12ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:Program FilesCommon FilesMicrosoft SharedSource EngineOSE.EXE [2006-10-26 145184]
S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:Program FilesWindows Media Playerwmpnetwk.exe [2006-10-18 913408]
S3 WudfSvc;Windows Driver Foundation — User-mode Driver Framework; C:WINDOWSsystem32svchost.exe [2004-08-18 14336]
EOF
Здравствуйте, добро пожаловать на Spyware-ru форум.
Я вижу у вас есть Combofix, поэтому воспользуемся этой программой для лечения вашего компьютера.
Откройте блокнот (Кликните Пуск, Выполнить, в строке ввода введите notepad и нажмите Enter) и вставьте в него следующий текст:
Driver::
aexrbobf
Registry::
[-HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{4D43A883-4FED-4148-B6C2-3E065E77F5D8}]
[-HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{99EB8A8F-604F-4017-8309-13E28F824776}]
[-HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{CBC43FBB-B0CD-4343-88C3-BFB1F2C1E89D}]
File::
C:Documents and SettingsAll UsersApplication Dataaqplib.dll
C:Documents and SettingsAll UsersApplication Datamlqlib.dll
C:Documents and SettingsAll UsersApplication Datayvulib.dll
C:WINDOWSsystem32driversaexrbobf.sysЗапишите получившийся файл на ваш рабочий стол под именем CFScript
Далее перетащите получившийся файл на иконку Combofix, как показано на картинке ниже.
Сombofix запуститься и выполнит процедуры описанные в созданном нами файле.
По результатам работы Combofix будет создан новый лог, его и вставьте в свой следующий ответ.
И конечно-же проверьте InternetExplorer в работе.Благодарю вас от всей души 🙂 новостная лента изчезла!!!!!! вот лог который получился :
ComboFix 09-02-08.02 — Admin 2009-02-10 20:57:50.1 — NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1251.1.1049.18.2047.1643 [GMT 5:00]
Running from: c:documents and settingsAdminРабочий столComboFix.exe
Command switches used :: c:documents and settingsAdminРабочий столCFScript.txt
FW: NVIDIA Firewall *disabled*
* Created a new restore pointWARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
FILE ::
c:documents and settingsAll UsersApplication Dataaqplib.dll
c:documents and settingsAll UsersApplication Datamlqlib.dll
c:documents and settingsAll UsersApplication Datayvulib.dll
c:windowssystem32driversaexrbobf.sys
.((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.c:documents and settingsAdminLocal SettingsTemporary Internet Files0EB9F12C_6E6B_4c03_AEBA_8C04CFA98AA4.gif
c:documents and settingsAdminLocal SettingsTemporary Internet Files0EB9F12C_6E6B_4c03_AEBA_8C04CFA98AA4.jpg
c:documents and settingsAdminLocal SettingsTemporary Internet Files15913497_F86C_4218_8817_F50940D1E1B2.gif
c:documents and settingsAdminLocal SettingsTemporary Internet Files15913497_F86C_4218_8817_F50940D1E1B2.jpg
c:documents and settingsAdminLocal SettingsTemporary Internet Files29887DDE_00B9_4011_9CF7_59511F1ECC1B.gif
c:documents and settingsAdminLocal SettingsTemporary Internet Files29887DDE_00B9_4011_9CF7_59511F1ECC1B.jpg
c:documents and settingsAdminLocal SettingsTemporary Internet Files2A665EDD_5758_480c_8366_66DFC5F23877.gif
c:documents and settingsAdminLocal SettingsTemporary Internet Files35B7DFFA_884F_4fbc_8E60_DA601BDC7BF7.gif
c:documents and settingsAdminLocal SettingsTemporary Internet Files362FD6E8_8CDA_4c2a_A8AA-BDA22B321711.gif
c:documents and settingsAdminLocal SettingsTemporary Internet Files362FD6E8_8CDA_4c2a_A8AA-BDA22B321711.jpg
c:documents and settingsAdminLocal SettingsTemporary Internet Files3DF04940_9866_4241_A998_0CDDFAFD147A.gif
c:documents and settingsAdminLocal SettingsTemporary Internet Files3DF04940_9866_4241_A998_0CDDFAFD147A.jpg
c:documents and settingsAdminLocal SettingsTemporary Internet Files426500D7_0FF3_426c_828D_065DBAEA0581.gif
c:documents and settingsAdminLocal SettingsTemporary Internet Files478BD4AE_2691_438d_BDCA_3485DC022700.gif
c:documents and settingsAdminLocal SettingsTemporary Internet Files5C6C645F_BAA8_4149_BFEB_2031230FF0FD.gif
c:documents and settingsAdminLocal SettingsTemporary Internet Files5C6C645F_BAA8_4149_BFEB_2031230FF0FD.jpg
c:documents and settingsAdminLocal SettingsTemporary Internet Files61EA7D69_19D4_421a_A899_0DF4D58CD119.gif
c:documents and settingsAdminLocal SettingsTemporary Internet Files61EA7D69_19D4_421a_A899_0DF4D58CD119.jpg
c:documents and settingsAdminLocal SettingsTemporary Internet Files777FDAFB_83CF_4960_AA71_4E5D7BCD8E57.gif
c:documents and settingsAdminLocal SettingsTemporary Internet Files8DA878D5_E80B_4721_B75A_17EFFAF1A700.gif
c:documents and settingsAdminLocal SettingsTemporary Internet Files98F6DF79_7171_452d_9C26_C0193E12DBDF.gif
c:documents and settingsAdminLocal SettingsTemporary Internet FilesA2B240D6_0386_419e_91C5_3F7D90437CD0.gif
c:documents and settingsAdminLocal SettingsTemporary Internet FilesA2B240D6_0386_419e_91C5_3F7D90437CD0.jpg
c:documents and settingsAdminLocal SettingsTemporary Internet FilesC75CEF8D_5AF4_4563_8594_C45A45E14E63.gif
c:documents and settingsAdminLocal SettingsTemporary Internet FilesE21285C1_40E6_435c_A69F_3387E7BD89CB.gif
c:documents and settingsAdminLocal SettingsTemporary Internet FilesE21285C1_40E6_435c_A69F_3387E7BD89CB.jpg
c:documents and settingsAdminLocal SettingsTemporary Internet FilesE9A4D648_ED73_4ea7_88B2_18332DBA4F3E.gif
c:documents and settingsAdminLocal SettingsTemporary Internet FilesE9A4D648_ED73_4ea7_88B2_18332DBA4F3E.jpg
c:documents and settingsAll UsersApplication Dataaqplib.dll
c:documents and settingsAll UsersApplication Datamlqlib.dll
c:documents and settingsAll UsersApplication Datayvulib.dll.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
Legacy_OREANS32
Service_oreans32((((((((((((((((((((((((( Files Created from 2009-01-10 to 2009-02-10 )))))))))))))))))))))))))))))))
.2009-02-09 15:45 . 2009-02-09 15:45
d
c:documents and settingsAdminApplication DataDivX
2009-02-09 09:44 . 2009-02-09 09:44d
C:rsit
2009-02-09 09:44 . 2009-02-09 15:02d
c:program filestrend micro
2009-02-08 22:09 . 2009-02-09 15:02d
C:SDFix
2009-02-08 21:54 . 2009-02-08 21:54d
C:_OTMoveIt
2009-02-08 20:44 . 2009-02-08 20:44d
c:windowsERUNT
2009-02-08 20:44 . 2009-02-08 20:44d
C:ERDNT
2009-02-08 20:44 . 2009-02-08 21:36d
C:!FixIEDef
2009-02-08 20:34 . 2009-02-08 20:34d
c:program filesMalwarebytes’ Anti-Malware
2009-02-08 20:34 . 2009-02-08 20:34d
c:documents and settingsAll UsersApplication DataMalwarebytes
2009-02-08 20:34 . 2009-02-08 20:34d
c:documents and settingsAdminApplication DataMalwarebytes
2009-02-08 20:34 . 2009-01-14 16:11 38,496 —a
c:windowssystem32driversmbamswissarmy.sys
2009-02-08 20:34 . 2009-01-14 16:11 15,504 —a
c:windowssystem32driversmbam.sys
2009-02-08 18:55 . 2009-02-08 18:55d—h
c:windows$hf_mig$
2009-02-08 15:56 . 2006-01-22 00:08d
c:tempIE7-WindowsXP-x86-enu-RUS
2009-02-08 15:56 . 2009-02-08 15:56d
C:TEMP
2009-02-08 09:42 . 2009-02-08 09:42d
c:program filesCommon FilesAdobe AIR
2009-02-08 09:42 . 2009-02-08 09:42d
c:program filesAdobe Media Player
2009-02-08 09:41 . 2009-02-08 09:41 0 —a
c:windowsnsreg.dat
2009-02-08 08:36 . 2009-02-08 08:36d
c:program filesDivX
2009-02-08 08:29 . 2009-02-08 22:19d
c:program filesGoogle
2009-01-25 01:49 . 2009-01-25 01:49d
c:documents and settingsAdminApplication DataImperium Romanum
2009-01-23 02:34 . 2009-01-23 02:34d
c:program filesBeholdTV
2009-01-23 02:33 . 2009-01-23 02:33d
c:documents and settingsAdminApplication DataBeholdTV
2009-01-15 22:48 . 2009-01-15 22:48d
c:program filesWMV9_VCM
2009-01-15 22:48 . 2009-01-15 22:48d
c:program filesMSXML 4.0
2009-01-15 22:48 . 2008-07-12 10:18 3,851,784 —a
c:windowssystem32D3DX9_39.dll
2009-01-15 22:48 . 2008-07-12 10:18 1,493,528 —a
c:windowssystem32D3DCompiler_39.dll
2009-01-15 22:48 . 2008-07-31 12:40 509,448 —a
c:windowssystem32XAudio2_2.dll
2009-01-15 22:48 . 2008-07-12 10:18 467,984 —a
c:windowssystem32d3dx10_39.dll
2009-01-15 22:48 . 2008-07-31 12:41 238,088 —a
c:windowssystem32xactengine3_2.dll
2009-01-15 22:48 . 2008-07-31 12:41 68,616 —a
c:windowssystem32XAPOFX1_1.dll
2009-01-14 13:09 . 2009-01-14 13:09d
c:program filesCommon FilesDirectX
2009-01-13 20:05 . 2009-01-13 20:05d
c:documents and settingsAdminApplication DataSierra Entertainment
2009-01-13 20:02 . 2009-01-13 20:02d—-c— c:windowssystem32DRVSTORE
2009-01-13 20:02 . 2009-01-13 20:02d
c:windowssystem32AGEIA
2009-01-13 20:02 . 2009-01-13 20:02d
c:program filesCommon FilesWise Installation Wizard
2009-01-13 20:02 . 2009-01-13 20:02d
c:program filesAGEIA Technologies.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-10 15:58
d
w c:documents and settingsAdminApplication DatauTorrent
2009-02-09 11:38 22,328 —-a-w c:windowssystem32driversPnkBstrK.sys
2009-02-08 14:40
d—h—w c:program filesInstallShield Installation Information
2009-01-05 20:58
d
w c:program filesFargus
2009-01-05 16:07
d
w c:documents and settingsAdminApplication DataInstallShield
2008-12-28 10:45 33,824 —-a-w c:windowssystem32driversoreans32.sys
2008-12-18 10:43
d
w c:program filesEverest
2008-12-12 14:40
d
w c:program filesAMD
2008-12-12 14:38
d
w c:program filesRealtek AC97
2008-12-12 14:38
d
w c:program filesAvRack
2008-12-12 14:37
d
w c:program filesNVIDIA Corporation
2008-12-12 12:50
d
w c:program filesATI Technologies
2008-12-12 12:48
d
w c:program filesCommon FilesInstallShield
2008-12-09 08:45 331,264 —-a-w c:documents and settingsAll UsersApplication Dataspvlib.dll
2008-11-22 13:49 72,748 —-a-w c:windowsunins000.exe
.
Sigcheck
2008-03-15 13:55 578560 196b409a7c1c39a5a0f7566c2741fad1 c:windowssystem32user32.dll2008-03-15 14:00 360832 edf9cac3e377b61b2581e28ce810a7e0 c:windowssystem32driverstcpip.sys
2008-03-15 13:53 1720832 c79d071054766fcc78077abd022b287f c:windowsexplorer.exe
2008-03-15 13:53 30208 2a48af162b14e978da2373a2f693f4fd c:windowssystem32ctfmon.exe
2008-03-15 13:55 80216 84c7654e3de78f92a82bf7ba932752aa c:windowssystem32wuauclt.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32ctfmon.exe» [2008-03-15 30208]
«VistaIcon»=»c:program filesVistaDriveIconVistaDrv.exe» [2008-01-02 132096]
«DAEMON Tools Lite»=»c:program filesDAEMON Tools Litedaemon.exe» [2008-02-14 486856]
«swg»=»c:program filesGoogleGoogleToolbarNotifier1.2.1128.5462GoogleToolbarNotifier.exe» [2009-02-08 171448][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«NeroFilterCheck»=»c:windowssystem32NeroCheck.exe» [2006-01-12 155648]
«GrooveMonitor»=»c:program filesMicrosoft OfficeOffice12GrooveMonitor.exe» [2006-10-27 31016]
«ATIPTA»=»c:program filesATI TechnologiesATI Control Panelatiptaxx.exe» [2004-08-25 339968]
«nTrayFw»=»c:program filesNVIDIA CorporationNetworkAccessManagerbinnTrayFw.exe» [2005-02-24 266240]
«MagicRotation»=»c:program filesMagicRotationMagicPvt.exe» [BU]
«SoundMan»=»SOUNDMAN.EXE» [2005-06-20 c:windowssoundman.exe][HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32CTFMON.EXE» [2008-03-15 30208]
«VistaIcon»=»c:program filesVistaDriveIconVistaDrv.exe» [2008-01-02 132096][HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRunOnce]
«IE7_011″=»shell32» [X]
«ZZZZ2_FirstLogonSetting»=»advpack.dll» [2008-03-15 c:windowssystem32advpack.dll]
«IE7_012″=»advpack.dll» [2008-03-15 c:windowssystem32advpack.dll]c:documents and settingsAdminѓ« ў®Ґ ¬ҐоЏа®Ја ¬¬лЂўв®§ Јаг§Є
authcliw.exe (3).lnk — d:їа®јёЇа®ЈЁauthcliw.exe [2008-11-19 577024]
utorrent.exe.lnk — c:program filesuTorrentutorrent.exe [2008-01-27 270128][HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoSMConfigurePrograms»= 1 (0x1)[HKEY_USERS.defaultsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoSMConfigurePrograms»= 1 (0x1)[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity center]
«FirewallOverride»=dword:00000001
«UpdatesDisableNotify»=dword:00000001
«UpdatesOverride»=dword:00000001
«AntiVirusDisableNotify»=dword:00000001
«AntiVirusOverride»=dword:00000001[HKLM~servicessharedaccessparametersfirewallpolicystandardprofile]
«EnableFirewall»= 0 (0x0)[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\system32\sessmgr.exe»=
«%windir%\Network Diagnostic\xpnetdiag.exe»=
«c:\Program Files\uTorrent\utorrent.exe»=
«d:\проги\проги\authcliw.exe»=
«d:\проги\GreyLink4.84_igro.ed\greylink.exe»=
«d:\games\Age of Chivalry\hl2.exe»=R0 nvcchflt;NVIDIA Disk Cache Filter Driver;c:windowssystem32driversnvcchflt.sys [2008-11-22 16640]
R1 magicpvt;magicpvt;c:windowssystem32driversmagicpvt.sys [2008-12-24 9728]
R2 ICQ Service;ICQ Service;c:program filesICQ6ToolbarICQ Service.exe [2008-12-09 222456]
R2 TTFixerService;NST ToolTipFixer;c:program filesNeoSmart TechnologiesToolTipFixerToolTipFixer.exe [2007-06-27 10240]— Other Services/Drivers In Memory —
*NewlyCreated* — WUAUSERV
[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{e2e30cd2-bbad-11dd-9084-000461a02382}]
ShellAutoRuncommand — WD_Windows_ToolsSetup.exe
.
.
Supplementary Scan
.
uStart Page = hxxp://igronet.ru/
IE: &Экспорт в Microsoft Excel — c:progra~1MICROS~2Office12EXCEL.EXE/3000
LSP: %SYSTEMROOT%system32nvappfilter.dll
Trusted Zone: drochinehochu.ru
Trusted Zone: vesti.ruwww
TCP: {A4811310-E4F0-4144-83A7-0DF416049921} = 195.64.220.2,195.64.192.35
FF — ProfilePath — c:documents and settingsAdminApplication DataMozillaFirefoxProfilescu6l3s6c.default
FF — prefs.js: browser.startup.homepage — about:blank
.**************************************************************************
catchme 0.3.1367 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-10 21:00:46
Windows 5.1.2600 Service Pack 2 NTFSscanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0**************************************************************************
.
DLLs Loaded Under Running Processes
— — — — — — — > ‘winlogon.exe'(712)
c:windowssystem32SETUPAPI.dll
c:windowssystem32Ati2evxx.dll
c:windowssystem32cscui.dll— — — — — — — > ‘lsass.exe'(776)
c:windowssystem32SETUPAPI.dll
c:windowssystem32nvappfilter.dll
.
Other Running Processes
.
c:windowssystem32ati2evxx.exe
c:windowssystem32ati2evxx.exe
c:program filesNVIDIA CorporationNetworkAccessManagerApache GroupApache2binApache.exe
c:program filesNVIDIA CorporationNetworkAccessManagerbinnSvcIp.exe
c:program filesNVIDIA CorporationNetworkAccessManagerbinnSvcLog.exe
c:windowssystem32PnkBstrA.exe
c:program filesNVIDIA CorporationNetworkAccessManagerApache GroupApache2binApache.exe
d:c:Program FilesuTorrentutorrent.exe
c:program filesNVIDIA CorporationNetworkAccessManagerbinnSvcAppFlt.exe
.
**************************************************************************
.
Completion time: 2009-02-10 21:03:13 — machine was rebooted
ComboFix-quarantined-files.txt 2009-02-10 16:03:07
ComboFix2.txt 2009-02-08 17:54:08
ComboFix3.txt 2009-02-08 17:47:45
ComboFix4.txt 2009-02-08 17:36:26Pre-Run: 53 019 594 752 байт свободно
Post-Run: 53,028,556,800 байт свободно225
Combofix лог выглядит нормально.
Несколько завершающих действий.
Обновите Java, у вас устаревшая версия. Прочитайте эту инструкцию: Как обновить Java.
Удалите Combofix с вашего компьютера, действуйте согласно инструкции: Как правильно удалить combofix с компьютера.
Удалите RSIT и другие скачанные вами сканеры и небольшие утилиты, а так же все файлы и каталоги который были созданы в процессе лечения компьютера.
На компьютере нет антивируса, нужно установить любой обязательно!
Кроме этого установите программу Spybot Search and Destroy, это довольно неплохая дополнительная защита от шпионских и других вредоносных программ..Удалите старые точки восстановления, так как в них возможно нахождения инфицированных файлов, троянов и других вредоносных программ. Для этого кликните по иконке Мой компьютер, выберите пункт Свойства. В открывшемся окне выберите вкладку Восстановление системы. Поставьте галочку напротив пункта Отключить восстановление системы на всех дисках. Кликните по кнопке Применить. Подтвердите свои действия кликнув по кнопке OK в открывшемся диалоге. Закройте окно Свойства системы, кликнув по кнопке OK.
После загрузки компьютера выполните действия описанные выше, только в этот раз снимите галочку.
Создайте новую точку восстановления. Это поможет вам в случае необходимости загрузить текущую конфигурацию Windows и быстро излечиться от спайваре/вируса. Для этого кликните по кнопке Пуск, далее выберите пункт Стандартные, в нём Служебные и запустите программу Восстановление системы. В открывшемся окне выберите задачу Создать точку восстановления и нажмите кнопку Далее и следуйте указаниям.
Не забывайте обновлять Windows, ваши программы и особенно ваш антивирус.
Всего доброго!
- Для ответа в этой теме необходимо авторизоваться.
