- This topic has 8 ответов, 2 участника, and was last updated 16 years, 3 months назад by
.
-
Сообщения
-
- Темы:532
- Сообщений:1553
- ☆☆☆☆☆
На компе установлен QIP Infinium, проблема в том, о протокол QIP работает, а протокол ICQ нет, при попытке подключения выдается «Связь прервана. Проверьте настройки подключения». Данное появилось после удаления с компа System Security.
Результаты работы RSIT:
1. файл log
Logfile of random’s system information tool 1.06 (written by random/random)
Run by Andrew at 2009-05-16 13:48:29
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 29 GB (19%) free of 153 GB
Total RAM: 2047 MB (79% free)Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:48:31, on 16.05.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: NormalRunning processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:Program FilesAlwil SoftwareAvast4aswUpdSv.exe
C:Program FilesAlwil SoftwareAvast4ashServ.exe
C:WINDOWSExplorer.EXE
C:WINDOWSsystem32spoolsv.exe
C:Program FilesNeroNero8Nero BackItUpNBService.exe
C:WINDOWSsystem32nvsvc32.exe
C:WINDOWSsystem32IoctlSvc.exe
c:Program FilesCommon FilesProtexisLicense ServicePsiService_2.exe
C:Program FilesAdobeAcrobat 7.0DistillrAcrotray.exe
C:WINDOWSRTHDCPL.EXE
C:PROGRA~1ALWILS~1Avast4ashDisp.exe
C:Program FilesAlwil SoftwareAvast4ashMaiSv.exe
C:WINDOWSsystem32RUNDLL32.EXE
C:WINDOWSsystem32ctfmon.exe
C:Program FilesOlympus WinTraywintray.exe
C:Program FilesAlwil SoftwareAvast4ashWebSv.exe
C:Program FilesOpera AC 3.5.2opera.exe
C:Program FilesQIP Infiuminfium.exe
C:Documents and SettingsAndrewРабочий столRSIT.exe
C:Program Filestrend microAndrew.exeR1 — HKCUSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://search.qip.ru
R0 — HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.mail.ru
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 — HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 — HKCUSoftwareMicrosoftInternet ExplorerSearchURL,(Default) = http://search.qip.ru/search?query=%s&from=IE
R0 — HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Ссылки
O2 — BHO: AcroIEHlprObj Class — {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} — C:Program FilesAdobeAcrobat 7.0ActiveXAcroIEHelper.dll
O2 — BHO: Adobe PDF Conversion Toolbar Helper — {AE7CD045-E861-484f-8273-0445EE161910} — C:Program FilesAdobeAcrobat 7.0AcrobatAcroIEFavClient.dll
O2 — BHO: Ask.com Toolbar BHO — {D4027C7F-154A-4066-A1AD-4243D8127440} — C:Program FilesAsk.comSupertoolbarGenericAskToolbar.dll
O3 — Toolbar: Adobe PDF — {47833539-D0C5-4125-9FA8-0819E2EAAC93} — C:Program FilesAdobeAcrobat 7.0AcrobatAcroIEFavClient.dll
O3 — Toolbar: Ask.com Toolbar — {D4027C7F-154A-4066-A1AD-4243D8127440} — C:Program FilesAsk.comSupertoolbarGenericAskToolbar.dll
O4 — HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSsystem32NvCpl.dll,NvStartup
O4 — HKLM..Run: [Acrobat Assistant 7.0] «C:Program FilesAdobeAcrobat 7.0DistillrAcrotray.exe»
O4 — HKLM..Run: [RTHDCPL] RTHDCPL.EXE
O4 — HKLM..Run: [avast!] C:PROGRA~1ALWILS~1Avast4ashDisp.exe
O4 — HKLM..Run: [NeroFilterCheck] C:Program FilesCommon FilesNeroLibNeroCheck.exe
O4 — HKLM..Run: [nwiz] nwiz.exe /install
O4 — HKLM..Run: [NvMediaCenter] RUNDLL32.EXE C:WINDOWSsystem32NvMcTray.dll,NvTaskbarInit
O4 — HKCU..Run: [CTFMON.EXE] C:WINDOWSsystem32ctfmon.exe
O4 — HKUSS-1-5-18..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘SYSTEM’)
O4 — HKUSS-1-5-18..RunOnce: [TSClientMSIUninstaller] cmd.exe /C «cscript %systemroot%InstallerTSClientMsiTranstscuinst.vbs» (User ‘SYSTEM’)
O4 — HKUS.DEFAULT..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘Default user’)
O4 — HKUS.DEFAULT..RunOnce: [TSClientMSIUninstaller] cmd.exe /C «cscript %systemroot%InstallerTSClientMsiTranstscuinst.vbs» (User ‘Default user’)
O4 — Startup: Olympus P2P v4.0RC3.lnk = C:Program FilesOlympus P2PStrongDC.exe
O4 — Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 — Global Startup: Olympus Wintray.lnk = C:Program FilesOlympus WinTraywintray.exe
O8 — Extra context menu item: &Экспорт в Microsoft Excel — res://C:PROGRA~1MICROS~2OFFICE11EXCEL.EXE/3000
O8 — Extra context menu item: Convert link target to Adobe PDF — res://C:Program FilesAdobeAcrobat 7.0AcrobatAcroIEFavClient.dll/AcroIECapture.html
O8 — Extra context menu item: Convert link target to existing PDF — res://C:Program FilesAdobeAcrobat 7.0AcrobatAcroIEFavClient.dll/AcroIEAppend.html
O8 — Extra context menu item: Convert selected links to Adobe PDF — res://C:Program FilesAdobeAcrobat 7.0AcrobatAcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 — Extra context menu item: Convert selected links to existing PDF — res://C:Program FilesAdobeAcrobat 7.0AcrobatAcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 — Extra context menu item: Convert selection to Adobe PDF — res://C:Program FilesAdobeAcrobat 7.0AcrobatAcroIEFavClient.dll/AcroIECapture.html
O8 — Extra context menu item: Convert selection to existing PDF — res://C:Program FilesAdobeAcrobat 7.0AcrobatAcroIEFavClient.dll/AcroIEAppend.html
O8 — Extra context menu item: Convert to Adobe PDF — res://C:Program FilesAdobeAcrobat 7.0AcrobatAcroIEFavClient.dll/AcroIECapture.html
O8 — Extra context menu item: Convert to existing PDF — res://C:Program FilesAdobeAcrobat 7.0AcrobatAcroIEFavClient.dll/AcroIEAppend.html
O8 — Extra context menu item: Олимпус: Определить &тип трафика — C:Program FilesInternet ExplorerSIGNUPchecker.htm
O9 — Extra button: PokerStars — {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} — C:Program FilesPokerStarsPokerStarsUpdate.exe
O9 — Extra button: Справочные материалы — {92780B25-18CC-41C8-B9BE-3C9C571A8263} — C:PROGRA~1MICROS~2OFFICE11REFIEBAR.DLL
O9 — Extra button: (no name) — {e2e2dd38-d088-4134-82b7-f2ba38496583} — C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O9 — Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 — {e2e2dd38-d088-4134-82b7-f2ba38496583} — C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O9 — Extra button: Messenger — {FB5F1910-F110-11d2-BB9E-00C04F795683} — C:Program FilesMessengermsmsgs.exe
O9 — Extra ‘Tools’ menuitem: Windows Messenger — {FB5F1910-F110-11d2-BB9E-00C04F795683} — C:Program FilesMessengermsmsgs.exe
O14 — IERESET.INF: START_PAGE_URL=http://www.olympus.ru
O16 — DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) — http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1232784871546
O16 — DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) — http://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab
O17 — HKLMSystemCCSServicesTcpip..{93C193B1-08F8-45C9-92DD-0EE677979D26}: NameServer = 217.76.183.36 217.76.183.38
O17 — HKLMSystemCCSServicesTcpip..{CC2518A5-0FB9-4E54-90A0-44B7AC9237BC}: NameServer = 10.0.0.1,10.0.0.2
O18 — Protocol: skype4com — {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} — C:PROGRA~1COMMON~1SkypeSKYPE4~1.DLL
O23 — Service: Adobe LM Service — Adobe Systems — C:Program FilesCommon FilesAdobe Systems SharedServiceAdobelmsvc.exe
O23 — Service: avast! iAVS4 Control Service (aswUpdSv) — ALWIL Software — C:Program FilesAlwil SoftwareAvast4aswUpdSv.exe
O23 — Service: avast! Antivirus — ALWIL Software — C:Program FilesAlwil SoftwareAvast4ashServ.exe
O23 — Service: avast! Mail Scanner — ALWIL Software — C:Program FilesAlwil SoftwareAvast4ashMaiSv.exe
O23 — Service: avast! Web Scanner — ALWIL Software — C:Program FilesAlwil SoftwareAvast4ashWebSv.exe
O23 — Service: Журнал событий (Eventlog) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: getPlus(R) Helper — NOS Microsystems Ltd. — C:Program FilesNOSbingetPlus_HelperSvc.exe
O23 — Service: Служба COM записи компакт-дисков IMAPI (ImapiService) — Корпорация Майкрософт — C:WINDOWSsystem32imapi.exe
O23 — Service: Macromedia Licensing Service — Unknown owner — C:Program FilesCommon FilesMacromedia SharedServiceMacromedia Licensing.exe
O23 — Service: NetMeeting Remote Desktop Sharing (mnmsrvc) — Корпорация Майкрософт — C:WINDOWSsystem32mnmsrvc.exe
O23 — Service: Nero BackItUp Scheduler 3 — Nero AG — C:Program FilesNeroNero8Nero BackItUpNBService.exe
O23 — Service: NMIndexingService — Nero AG — C:Program FilesCommon FilesNeroLibNMIndexingService.exe
O23 — Service: NVIDIA Display Driver Service (NVSvc) — NVIDIA Corporation — C:WINDOWSsystem32nvsvc32.exe
O23 — Service: PLFlash DeviceIoControl Service — Prolific Technology Inc. — C:WINDOWSsystem32IoctlSvc.exe
O23 — Service: Plug and Play (PlugPlay) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: Protexis Licensing V2 (PSI_SVC_2) — Protexis Inc. — c:Program FilesCommon FilesProtexisLicense ServicePsiService_2.exe
O23 — Service: Диспетчер сеанса справки для удаленного рабочего стола (RDSessMgr) — Корпорация Майкрософт — C:WINDOWSsystem32sessmgr.exe
O23 — Service: Смарт-карты (SCardSvr) — Корпорация Майкрософт — C:WINDOWSSystem32SCardSvr.exe
O23 — Service: Журналы и оповещения производительности (SysmonLog) — Корпорация Майкрософт — C:WINDOWSsystem32smlogsvc.exe
O23 — Service: Теневое копирование тома (VSS) — Корпорация Майкрософт — C:WINDOWSSystem32vssvc.exe
O23 — Service: Адаптер производительности WMI (WmiApSrv) — Корпорация Майкрософт — C:WINDOWSsystem32wbemwmiapsrv.exe—
End of file — 9507 bytes======Scheduled tasks folder======
C:WINDOWStasksScheduled Update for Ask Toolbar.job
C:WINDOWStasksSmartDefrag.job======Registry dump======
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class — C:Program FilesAdobeAcrobat 7.0ActiveXAcroIEHelper.dll [2006-12-18 59032][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{AE7CD045-E861-484f-8273-0445EE161910}]
Adobe PDF Conversion Toolbar Helper — C:Program FilesAdobeAcrobat 7.0AcrobatAcroIEFavClient.dll [2006-12-18 231160][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{D4027C7F-154A-4066-A1AD-4243D8127440}]
Ask.com Toolbar — C:Program FilesAsk.comSupertoolbarGenericAskToolbar.dll [2008-10-21 741768][HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
{47833539-D0C5-4125-9FA8-0819E2EAAC93} — Adobe PDF — C:Program FilesAdobeAcrobat 7.0AcrobatAcroIEFavClient.dll [2006-12-18 231160]
{D4027C7F-154A-4066-A1AD-4243D8127440} — Ask.com Toolbar — C:Program FilesAsk.comSupertoolbarGenericAskToolbar.dll [2008-10-21 741768][HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun]
«NvCplDaemon»=C:WINDOWSsystem32NvCpl.dll [2009-03-28 13684736]
«Acrobat Assistant 7.0″=C:Program FilesAdobeAcrobat 7.0DistillrAcrotray.exe [2008-04-23 483328]
«RTHDCPL»=C:WINDOWSRTHDCPL.EXE [2008-05-07 16862208]
«avast!»=C:PROGRA~1ALWILS~1Avast4ashDisp.exe [2009-02-06 81000]
«NeroFilterCheck»=C:Program FilesCommon FilesNeroLibNeroCheck.exe [2008-02-28 570664]
«»= []
«nwiz»=nwiz.exe /install []
«NvMediaCenter»=C:WINDOWSsystem32NvMcTray.dll [2009-03-28 86016][HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=C:WINDOWSsystem32ctfmon.exe [2008-04-14 15360][HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregGREATZERO BOT]
C:WINDOWSkuJt.exe [2009-05-14 516608][HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregNBKeyScan]
C:Program FilesNeroNero8Nero BackItUpNBKeyScan.exe [2008-02-18 2221352][HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregnwiz]
nwiz.exe /install [][HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregPromoReg]
C:DOCUME~1AndrewLOCALS~1TempuFuh.exe [2009-05-14 479232][HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupfolderC:^Documents and Settings^All Users.WINDOWS^Главное меню^Программы^Автозагрузка^Adobe Acrobat Speed Launcher.lnk]
C:WINDOWSInstaller{AC76BA86-1033-0000-7760-000000000002}SC_Acrobat.exe [2009-05-13 25214]C:Documents and SettingsAll Users.WINDOWSГлавное менюПрограммыАвтозагрузка
Adobe Acrobat Speed Launcher.lnk — C:WINDOWSInstaller{AC76BA86-1033-0000-7760-000000000002}SC_Acrobat.exe
Olympus Wintray.lnk — C:Program FilesOlympus WinTraywintray.exeC:Documents and SettingsAndrewГлавное менюПрограммыАвтозагрузка
Olympus P2P v4.0RC3.lnk — C:Program FilesOlympus P2PStrongDC.exe[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad]
WPDShServiceObj — {AAA288BA-9A4C-45B0-95D7-94D524869DB5} — C:WINDOWSsystem32WPDShServiceObj.dll [2006-10-18 133632][HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetwork{1a3e09be-1e45-494b-9174-d7385b45bbf5}]
[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
«dontdisplaylastusername»=0
«legalnoticecaption»=
«legalnoticetext»=
«shutdownwithoutlogon»=1
«undockwithoutlogon»=1[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoDriveTypeAutoRun»=323
«NoDriveAutoRun»=67108863
«NoDrives»=0[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoDriveAutoRun»=
«NoDriveTypeAutoRun»=
«NoDrives»=
«HonorAutoRunSetting»=[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicystandardprofileauthorizedapplicationslist]
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»
«C:WINDOWSsystem32usmtmigwiz.exe»=»C:WINDOWSsystem32usmtmigwiz.exe:*:Enabled:Мастер переноса файлов и параметров»
«C:Program FilesOlympus WinTraywintray.exe»=»C:Program FilesOlympus WinTraywintray.exe:*:Enabled:Утилита для пользователей Олимпус»
«%windir%Network Diagnosticxpnetdiag.exe»=»%windir%Network Diagnosticxpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000»
«C:Program FilesSkypePhoneSkype.exe»=»C:Program FilesSkypePhoneSkype.exe:*:Enabled:Skype»
«C:Program FilesOlympus P2PStrongDC.exe»=»C:Program FilesOlympus P2PStrongDC.exe:*:Disabled:StrongDC++»
«C:Program FilesOlympus P2POlympusp2p.exe»=»C:Program FilesOlympus P2POlympusp2p.exe:*:Enabled:StrongDC++»[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicydomainprofileauthorizedapplicationslist]
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»
«%windir%Network Diagnosticxpnetdiag.exe»=»%windir%Network Diagnosticxpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000»[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{4fd76119-c41d-11dd-ad13-001a4d96ee7d}]
shellAutoRuncommand — SYSTEMS-1-5-21-1482476501-1644491937-682003330-1013USB.exe
shellopencommand — SYSTEMS-1-5-21-1482476501-1644491937-682003330-1013USB.exe======File associations======
.js — open — «C:Program FilesMacromediaDreamweaver MX 2004Dreamweaver.exe» «%1»
.txt — open — notepad.exe %1======List of files/folders created in the last 1 months======
2009-05-16 12:16:21 —-D—- C:Documents and SettingsAndrewApplication DataMalwarebytes
2009-05-16 12:16:16 —-D—- C:Program FilesMalwarebytes’ Anti-Malware
2009-05-16 12:16:16 —-D—- C:Documents and SettingsAll Users.WINDOWSApplication DataMalwarebytes
2009-05-16 12:14:49 —-A—- C:mbam-setup.exe
2009-05-15 18:55:57 —-D—- C:Program FilesAsk.com
2009-05-15 18:15:40 —-D—- C:Program FilesMiranda
2009-05-15 18:14:51 —-A—- C:mip_5.7.exe
2009-05-15 16:57:53 —-D—- C:Program Filestrend micro
2009-05-15 16:57:52 —-D—- C:rsit
2009-05-15 14:35:04 —-D—- C:Program FilesOpera AC 3.5.2
2009-05-14 22:42:13 —-D—- C:Program FilesStalker — Clear Sky
2009-05-14 14:53:54 —-A—- C:9uqe5ds8.exe
2009-05-14 11:08:12 —-D—- C:WINDOWSNV11682664.TMP
2009-05-14 11:07:39 —-A—- C:WINDOWSsystem32MRT.INI
2009-05-14 09:05:19 —-D—- C:Documents and SettingsAll Users.WINDOWSApplication Data96718276
2009-05-14 09:05:19 —-A—- C:Documents and SettingsAll Users.WINDOWSApplication Data96718276.ini
2009-05-14 08:56:25 —-A—- C:WINDOWSkuJt.exe
2009-05-14 08:56:25 —-A—- C:WINDOWShtml1.txt
2009-05-09 09:54:23 —-HDC—- C:WINDOWS$NtUninstallbasecsp$
2009-05-09 09:54:20 —-D—- C:Program FilesManaged DirectX (0901)
2009-05-06 12:28:06 —-D—- C:Documents and SettingsAndrewApplication DataMra
2009-05-04 15:55:27 —-SHD—- C:RECYCLER
2009-05-04 15:43:43 —-RASHD—- C:autorun.inf
2009-05-04 14:47:09 —-D—- C:Documents and SettingsAndrewApplication DataGoogle
2009-04-19 20:52:30 —-AD—- C:Documents and SettingsAll Users.WINDOWSApplication DataTEMP
2009-04-19 20:51:47 —-A—- C:WINDOWSsystem32wsatrace.dll
2009-04-19 17:44:37 —-D—- C:Program FilesPoker Tracker V2======List of files/folders modified in the last 1 months======
2009-05-16 13:47:33 —-D—- C:!Андрей
2009-05-16 13:44:15 —-D—- C:Program Files
2009-05-16 13:05:59 —-D—- C:WINDOWSTemp
2009-05-16 13:04:45 —-D—- C:WINDOWSsystem32drivers
2009-05-16 13:04:06 —-A—- C:WINDOWSSchedLgU.Txt
2009-05-16 12:01:27 —-D—- C:Program FilesOlympus P2P
2009-05-15 18:56:04 —-SHD—- C:WINDOWSInstaller
2009-05-15 18:56:00 —-SD—- C:WINDOWSTasks
2009-05-15 18:55:21 —-D—- C:WINDOWSsystem32
2009-05-15 18:11:18 —-D—- C:WINDOWS
2009-05-15 17:00:23 —-D—- C:WINDOWSsystem32CatRoot2
2009-05-15 15:03:52 —-D—- C:P2P
2009-05-15 14:14:11 —-D—- C:Program FilesQIP Infium
2009-05-15 12:58:37 —-D—- C:Музыка
2009-05-15 12:08:59 —-A—- C:WINDOWSNeroDigital.ini
2009-05-15 09:21:00 —-D—- C:WINDOWSPrefetch
2009-05-15 00:03:17 —-D—- C:Program FilesOlympus VLC Lite
2009-05-14 23:56:25 —-RD—- C:!Лещ
2009-05-14 19:25:15 —-D—- C:WINDOWSMinidump
2009-05-14 19:21:34 —-D—- C:WINDOWSpss
2009-05-14 12:51:11 —-D—- C:Documents and SettingsAll Users.WINDOWSApplication DataSkype
2009-05-14 12:37:03 —-A—- C:WINDOWSsystem32PerfStringBackup.INI
2009-05-14 12:11:37 —-D—- C:WINDOWSsystem32NtmsData
2009-05-14 11:46:59 —-D—- C:WINDOWSRegistration
2009-05-14 11:29:35 —-D—- C:WINDOWSDebug
2009-05-14 11:09:56 —-D—- C:WINDOWSHelp
2009-05-14 11:09:55 —-D—- C:WINDOWSnview
2009-05-14 11:08:05 —-RSHDC—- C:WINDOWSsystem32dllcache
2009-05-14 11:07:55 —-HD—- C:WINDOWSinf
2009-05-14 11:07:54 —-D—- C:WINDOWSsystem32ReinstallBackups
2009-05-13 21:54:04 —-D—- C:Documents and SettingsAndrewApplication DataAdobeUM
2009-05-13 21:47:53 —-D—- C:!Анечка
2009-05-13 21:43:57 —-D—- C:Program FilesCommon FilesAdobe
2009-05-13 11:56:39 —-D—- C:Documents and SettingsAndrewApplication DataAdobe
2009-05-11 12:41:38 —-D—- C:Program FilesPokerStars
2009-05-09 09:54:29 —-D—- C:WINDOWSsecurity
2009-05-09 09:54:21 —-RSD—- C:WINDOWSassembly
2009-05-09 09:54:21 —-D—- C:WINDOWSMicrosoft.NET
2009-05-07 13:16:29 —-A—- C:WINDOWSsystem32MRT.exe
2009-05-06 21:40:12 —-RD—- C:Плиз не удалять
2009-05-06 12:34:55 —-D—- C:Program FilesGoogle
2009-05-04 16:03:00 —-D—- C:Утилиты
2009-05-04 15:53:06 —-A—- C:WINDOWSsystem.ini
2009-05-04 15:52:41 —-D—- C:WINDOWSAppPatch
2009-05-04 15:52:38 —-D—- C:Program FilesCommon Files
2009-05-02 12:59:48 —-D—- C:Documents and SettingsAndrewApplication DataskypePM
2009-05-02 12:59:26 —-D—- C:Program FilesCommon FilesSkype
2009-05-01 15:36:46 —-A—- C:WINDOWSVFIND.exe
2009-04-27 19:55:11 —-D—- C:
2009-04-19 22:09:04 —-SD—- C:Documents and SettingsAndrewApplication DataMicrosoft
2009-04-19 00:10:49 —-D—- C:Фильмы
2009-04-18 20:09:19 —-D—- C:Program FilesQIP======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R1 Aavmker4;avast! Asynchronous Virus Monitor; C:WINDOWSsystem32driversAavmker4.sys [2009-02-06 26944]
R1 AmdK8;Драйвер AMD процессора; C:WINDOWSsystem32DRIVERSAmdK8.sys [2006-06-19 43520]
R1 aswSP;avast! Self Protection; C:WINDOWSsystem32driversaswSP.sys [2009-02-06 114768]
R1 aswTdi;avast! Network Shield Support; C:WINDOWSsystem32driversaswTdi.sys [2009-02-06 51376]
R1 WS2IFSL;Среда Windows Socket 2.0 поддержки поставщиков не-IFS служб; C:WINDOWSSystem32driversws2ifsl.sys [2006-03-02 12032]
R2 aswFsBlk;aswFsBlk; C:WINDOWSsystem32DRIVERSaswFsBlk.sys [2009-02-06 20560]
R2 aswMon2;avast! Standard Shield Support; C:WINDOWSsystem32driversaswMon2.sys [2009-02-06 94032]
R2 npf;NetGroup Packet Filter Driver; C:WINDOWSsystem32driversnpf.sys [2007-11-16 34064]
R3 Arp1394;Протокол клиента 1394 ARP; C:WINDOWSsystem32DRIVERSarp1394.sys [2008-04-14 60800]
R3 aswRdr;aswRdr; C:WINDOWSsystem32driversaswRdr.sys [2009-02-06 23152]
R3 HDAudBus;Драйвер шины Microsoft UAA для High Definition Audio; C:WINDOWSsystem32DRIVERSHDAudBus.sys [2008-04-13 144384]
R3 hidusb;Драйвер класса HID Microsoft; C:WINDOWSsystem32DRIVERShidusb.sys [2008-04-14 10368]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:WINDOWSsystem32driversRtkHDAud.sys [2008-05-07 4739072]
R3 mouhid;Драйвер мыши HID; C:WINDOWSsystem32DRIVERSmouhid.sys [2006-03-02 12160]
R3 NIC1394;Сетевой драйвер 1394; C:WINDOWSsystem32DRIVERSnic1394.sys [2008-04-14 61824]
R3 nv;nv; C:WINDOWSsystem32DRIVERSnv4_mini.sys [2009-03-28 6280416]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:WINDOWSsystem32DRIVERSNVENETFD.sys [2006-09-11 57856]
R3 nvnetbus;NVIDIA Network Bus Enumerator; C:WINDOWSsystem32DRIVERSnvnetbus.sys [2006-09-11 19968]
R3 usbehci;Драйвер минипорта Microsoft USB 2.0 расширенного хост-контроллера; C:WINDOWSsystem32DRIVERSusbehci.sys [2008-04-14 30208]
R3 usbhub;USB2 концентратор; C:WINDOWSsystem32DRIVERSusbhub.sys [2008-04-14 59520]
R3 usbohci;Драйвер минипорта Microsoft USB открытого хост-контроллера; C:WINDOWSsystem32DRIVERSusbohci.sys [2008-04-14 17152]
S3 catchme;catchme; ??C:DOCUME~1AndrewLOCALS~1Tempcatchme.sys []
S3 gdrv;gdrv; ??C:WINDOWSgdrv.sys []
S3 usbccgp;Драйвер универсального родительского устройства USB (Microsoft); C:WINDOWSsystem32DRIVERSusbccgp.sys [2008-04-14 32128]
S3 USBSTOR;Драйвер запоминающих устройств для USB; C:WINDOWSsystem32DRIVERSUSBSTOR.SYS [2008-04-14 26368]
S3 WudfPf;Windows Driver Foundation — User-mode Driver Framework Platform Driver; C:WINDOWSsystem32DRIVERSWudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation — User-mode Driver Framework Reflector; C:WINDOWSsystem32DRIVERSwudfrd.sys [2006-09-28 82944]
S4 IntelIde;IntelIde; C:WINDOWSsystem32driversIntelIde.sys []======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 aswUpdSv;avast! iAVS4 Control Service; C:Program FilesAlwil SoftwareAvast4aswUpdSv.exe [2009-02-06 18752]
R2 avast! Antivirus;avast! Antivirus; C:Program FilesAlwil SoftwareAvast4ashServ.exe [2009-02-06 138680]
R2 Nero BackItUp Scheduler 3;Nero BackItUp Scheduler 3; C:Program FilesNeroNero8Nero BackItUpNBService.exe [2008-02-18 877864]
R2 NVSvc;NVIDIA Display Driver Service; C:WINDOWSsystem32nvsvc32.exe [2009-03-28 163908]
R2 PLFlash DeviceIoControl Service;PLFlash DeviceIoControl Service; C:WINDOWSsystem32IoctlSvc.exe [2006-12-19 81920]
R2 PSI_SVC_2;Protexis Licensing V2; c:Program FilesCommon FilesProtexisLicense ServicePsiService_2.exe [2007-07-24 185632]
R3 avast! Mail Scanner;avast! Mail Scanner; C:Program FilesAlwil SoftwareAvast4ashMaiSv.exe [2009-02-06 254040]
R3 avast! Web Scanner;avast! Web Scanner; C:Program FilesAlwil SoftwareAvast4ashWebSv.exe [2009-02-06 352920]
S3 Adobe LM Service;Adobe LM Service; C:Program FilesCommon FilesAdobe Systems SharedServiceAdobelmsvc.exe [2009-01-10 69632]
S3 aspnet_state;Служба состояний ASP.NET; C:WINDOWSMicrosoft.NETFrameworkv2.0.50727aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:WINDOWSMicrosoft.NETFrameworkv2.0.50727mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:WINDOWSMicrosoft.NETFrameworkv3.0WPFPresentationFontCache.exe [2008-07-29 46104]
S3 getPlus(R) Helper;getPlus(R) Helper; C:Program FilesNOSbingetPlus_HelperSvc.exe [2008-12-01 33752]
S3 idsvc;Windows CardSpace; C:WINDOWSMicrosoft.NETFrameworkv3.0Windows Communication Foundationinfocard.exe [2008-07-29 881664]
S3 Macromedia Licensing Service;Macromedia Licensing Service; C:Program FilesCommon FilesMacromedia SharedServiceMacromedia Licensing.exe [2009-02-06 68096]
S3 NMIndexingService;NMIndexingService; C:Program FilesCommon FilesNeroLibNMIndexingService.exe [2008-02-28 529704]
S3 ose;Office Source Engine; C:Program FilesCommon FilesMicrosoft SharedSource EngineOSE.EXE [2003-07-28 89136]
S3 WMPNetworkSvc;Служба общих сетевых ресурсов проигрывателя Windows Media; C:Program FilesWindows Media PlayerWMPNetwk.exe [2006-11-03 914944]
S3 WudfSvc;Windows Driver Foundation — User-mode Driver Framework; C:WINDOWSsystem32svchost.exe [2008-04-14 14336]
S4 ATMsrvc;ATM Service; C:WINDOWSSystem32ATMsrvc.exe [2000-05-24 15360]
S4 NetTcpPortSharing;Служба общего доступа к портам Net.Tcp; C:WINDOWSMicrosoft.NETFrameworkv3.0Windows Communication FoundationSMSvcHost.exe [2008-07-29 132096]
EOF
2. файл info
info.txt logfile of random’s system information tool 1.06 2009-05-15 16:58:08======Uninstall list======
—>C:Program FilesNeroNero8\nerouninstallUNNERO.exe /UNINSTALL
—>C:WINDOWSUNNeroBackItUp.exe /UNINSTALL
—>C:WINDOWSUNNeroMediaHome.exe /UNINSTALL
—>C:WINDOWSUNNeroShowTime.exe /UNINSTALL
—>C:WINDOWSUNNeroVision.exe /UNINSTALL
—>C:WINDOWSUNRecode.exe /UNINSTALL
—>rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:WINDOWSINFPCHealth.inf
7-Zip 4.60 beta—>»C:Program Files7-ZipUninstall.exe»
Adobe Acrobat 7.1.0 Professional—>msiexec /I {AC76BA86-1033-0000-7760-000000000002}
Adobe Color — Photoshop Specific—>MsiExec.exe /I{A2D81E70-2A98-4A08-A628-94388B063C5E}
Adobe Device Central CS3—>MsiExec.exe /I{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}
Adobe ExtendScript Toolkit 2—>MsiExec.exe /I{1BCEA516-B4C5-4B2D-BFA0-AB7910BAD862}
Adobe Flash Player 10 ActiveX—>C:WINDOWSsystem32MacromedFlashuninstall_activeX.exe
Adobe Flash Player 10 Plugin—>C:WINDOWSsystem32MacromedFlashuninstall_plugin.exe
Adobe Photoshop CS3—>C:Program FilesCommon FilesAdobeInstallers719d6f144d0c086a0dfa7ff76bb9ac1Setup.exe
Adobe Photoshop CS3—>MsiExec.exe /I{3D7E3EC9-46CF-4359-9289-39CE01DFB82F}
Adobe Setup—>MsiExec.exe /I{FF11004C-F42A-4A31-9BCF-7F5C8FDBE53C}
Adobe Shockwave Player 11—>C:WINDOWSsystem32adobeSHOCKW~1UNWISE.EXE C:WINDOWSsystem32AdobeSHOCKW~1Install.log
Adobe Type Manager Deluxe 4.1—>C:WINDOWSuninst.exe -f»C:Program FilesAdobe Type ManagerDeIsL1.isu» -c»C:Program FilesAdobe Type ManagerUNINST.DLL»
avast! Antivirus—>C:Program FilesAlwil SoftwareAvast4aswRunDll.exe «C:Program FilesAlwil SoftwareAvast4Setupsetiface.dll»,RunSetup
CCleaner (remove only)—>»C:Program FilesCCleaneruninst.exe»
CorelDRAW Graphics Suite X4 — Capture—>MsiExec.exe /I{7F05E704-30A6-421A-97A7-8EEB1C7FF012}
CorelDRAW Graphics Suite X4 — Content—>MsiExec.exe /I{7F05E704-30A6-421A-97A7-8EEB1C7FF016}
CorelDRAW Graphics Suite X4 — Draw—>MsiExec.exe /I{7F05E704-30A6-421A-97A7-8EEB1C7FF013}
CorelDRAW Graphics Suite X4 — Filters—>MsiExec.exe /I{7F05E704-30A6-421A-97A7-8EEB1C7FF017}
CorelDRAW Graphics Suite X4 — FontNav—>MsiExec.exe /I{7F05E704-30A6-421A-97A7-8EEB1C7FF019}
CorelDRAW Graphics SUite X4 — ICA—>MsiExec.exe /I{7F05E704-30A6-421A-97A7-8EEB1C7FF010}
CorelDRAW Graphics Suite X4 — IPM—>MsiExec.exe /I{9D0798D0-AF6C-4E62-94B1-AEBF1A43E00A}
CorelDRAW Graphics Suite X4 — Lang EN—>MsiExec.exe /I{7F05E704-30A6-421A-97A7-8EEB1C7FF100}
CorelDRAW Graphics Suite X4 — PP—>MsiExec.exe /I{7F05E704-30A6-421A-97A7-8EEB1C7FF014}
CorelDRAW Graphics Suite X4 — VBA—>MsiExec.exe /I{BF439B41-0252-48DE-8B8B-0430CB26A181}
CorelDRAW Graphics Suite X4—>MsiExec.exe /I{44A27085-0616-4181-A0C3-81C7ECA17F73}
CorelDRAW(R) Graphics Suite X4 — Windows Shell Extension—>c:Program FilesCommon FilesCorelSharedShell ExtensionUninst.exe
CorelDRAW(R) Graphics Suite X4 — Windows Shell Extension—>MsiExec.exe /X{CE2DA11A-917F-4CF5-AB55-755EC115DD10}
CorelDRAW(R) Graphics Suite X4—>c:Program FilesCorelCorelDRAW Graphics Suite X4SetupSetupARP.exe /arp
getPlus(R) for Adobe—>»C:Program FilesNOSbingetPlus_HelperSvc.exe» /UninstallGet1
HijackThis 2.0.2—>»C:Program Filestrend microHijackThis.exe» /uninstall
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)—>C:WINDOWSsystem32msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall /qb+ REBOOTPROMPT=»»
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)—>C:WINDOWSsystem32msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=»»
K-Lite Mega Codec Pack 3.8.0—>»C:Program FilesK-Lite Codec Packunins000.exe»
Kyodai Mahjongg—>»C:Program FilesKyodai Mahjonggunins000.exe»
Macromedia Dreamweaver MX 2004—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1engine6INTEL3~1Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{05BB2EC5-6BEF-4DDC-9E75-BEE7B161157A}Setup.exe» -l0x9 mmUninstall
Macromedia Extension Manager—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1engine6INTEL3~1Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{A5BA14E0-7384-11D4-BAE7-00409631A2C8}setup.exe» -l0x9 mmUninstall
Macromedia HomeSite+—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1engine6INTEL3~1Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{8D3562E7-C795-4B5D-A091-6DAA3FF0DF3B}Setup.exe»
Microsoft .NET Framework 1.1 Hotfix (KB928366)—>»C:WINDOWSMicrosoft.NETFrameworkv1.1.4322Updateshotfix.exe» «C:WINDOWSMicrosoft.NETFrameworkv1.1.4322UpdatesM928366M928366Uninstall.msp»
Microsoft .NET Framework 1.1 Russian Language Pack—>MsiExec.exe /X{2BB372D9-52B4-410A-BC1A-FEAB63181EEF}
Microsoft .NET Framework 1.1—>msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1—>MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 2.0 Service Pack 2 Language Pack — RUS—>MsiExec.exe /I{736D8DEB-66C6-3655-9D59-DF6493A81F77}
Microsoft .NET Framework 2.0 Service Pack 2—>MsiExec.exe /I{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}
Microsoft .NET Framework 3.0 Russian Language Pack—>C:WINDOWSMicrosoft.NETFrameworkv3.0Microsoft .NET Framework 3.0 Russian Language Packsetup.exe
Microsoft .NET Framework 3.0 Russian Language Pack—>MsiExec.exe /X{855B04CC-4F7A-4FBB-B7BA-D965D23F7AD5}
Microsoft .NET Framework 3.0 Service Pack 2 Language Pack — RUS—>MsiExec.exe /I{6CF6A814-CE65-39FC-BBBC-6CB340A4028B}
Microsoft .NET Framework 3.0 Service Pack 2—>MsiExec.exe /I{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}
Microsoft .NET Framework 3.5 Language Pack SP1 — rus—>MsiExec.exe /I{2744791F-4E7C-32F5-AB40-AEC6A6C86DBF}
Microsoft .NET Framework 3.5 SP1—>C:WINDOWSMicrosoft.NETFrameworkv3.5Microsoft .NET Framework 3.5 SP1setup.exe
Microsoft .NET Framework 3.5 SP1—>MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
Microsoft Bootvis—>MsiExec.exe /I{0F9196C6-58B4-445B-B56E-B1200FECC151}
Microsoft Compression Client Pack 1.0 for Windows XP—>»C:WINDOWS$NtUninstallMSCompPackV1$spuninstspuninst.exe»
Microsoft Games for Windows — LIVE Redistributable—>MsiExec.exe /X{929CE49F-1CA7-4CF3-A9A1-6D757443C63F}
Microsoft Internationalized Domain Names Mitigation APIs—>»C:WINDOWS$NtServicePackUninstallIDNMitigationAPIs$spuninstspuninst.exe»
Microsoft National Language Support Downlevel APIs—>»C:WINDOWS$NtServicePackUninstallNLSDownlevelMapping$spuninstspuninst.exe»
Microsoft Office — профессиональный выпуск версии 2003—>MsiExec.exe /I{90110419-6000-11D3-8CFE-0150048383C9}
Microsoft Silverlight—>MsiExec.exe /I{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Microsoft User-Mode Driver Framework Feature Pack 1.0—>»C:WINDOWS$NtUninstallWudf01000$spuninstspuninst.exe»
Microsoft Visual C++ 2005 Redistributable—>MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Visual C++ 2008 Redistributable — x86 9.0.21022—>MsiExec.exe /X{DCB46B42-723F-350E-B18A-449BC6C21636}
Microsoft Visual C++ 2008 Redistributable — x86 9.0.21022—>MsiExec.exe /X{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}
MSXML 4.0 SP2 (KB954430)—>MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MSXML 6 Service Pack 2 (KB954459)—>MsiExec.exe /I{1A528690-6A2D-4BC5-B143-8C4AE8D19D96}
Nero 8—>MsiExec.exe /X{D6D5CB84-0E6E-4E69-B300-C690B6911049}
neroxml—>MsiExec.exe /I{56C049BE-79E9-4502-BEA7-9754A3E60F9B}
NVIDIA Drivers—>C:WINDOWSsystem32nvuninst.exe UninstallGUI
Olympus P2P v4.0RC3—>C:Program FilesOlympus P2Puninst.exe
Olympus VLC Lite (Work only in Wintray)—>C:Program FilesOlympus VLC Liteuninstall.exe
Olympus WinTray—>C:Program FilesOlympus WinTrayuninstall.exe
Poker Tracker Version 2.17.03j—>»C:Program FilesPoker Tracker V2unins000.exe»
PokerStars—>»C:Program FilesPokerStarsPokerStarsUninstall.exe» /u:PokerStars
QIP.Online—>C:Program FilesQIP.OnlineUninstall.exe
Realtek High Definition Audio Driver—>RtlUpd.exe -r -m -nrg2709
Stalker — Clear Sky—>»C:Program FilesStalker — Clear Skyunins001.exe»
TopStyle Lite (Version 2)—>C:WINDOWSunlite2.exe «C:Program FilesBradburyTopStyle2»
VCRedistSetup—>MsiExec.exe /I{3921A67A-5AB1-4E48-9444-C71814CF3027}
Windows Imaging Component—>»C:WINDOWS$NtUninstallWIC$spuninstspuninst.exe»
Windows Media Format 11 runtime—>»C:Program FilesWindows Media Playerwmsetsdk.exe» /UninstallAll
Windows Media Format 11 runtime—>»C:WINDOWS$NtUninstallWMFDist11$spuninstspuninst.exe»
Windows Media Player 11—>»C:WINDOWS$NtUninstallwmp11$spuninstspuninst.exe»
Windows Presentation Foundation Language Pack (RUS)—>MsiExec.exe /X{D83A3DFC-8528-4E31-93DC-0A41C477109C}
Windows Presentation Foundation—>MsiExec.exe /X{BAF78226-3200-4DB4-BE33-4D922A799840}
Windows XP Service Pack 3—>»C:WINDOWS$NtServicePackUninstall$spuninstspuninst.exe»
XML Paper Specification Shared Components Language Pack 1.0—>»C:WINDOWS$NtUninstallXPSEPSCLP$spuninstspuninst.exe»
Архиватор WinRAR—>C:Program FilesWinRARuninstall.exe
Базовый пакет поставщика службы криптографии смарт-карт (Microsoft)—>»C:WINDOWS$NtUninstallbasecsp$spuninstspuninst.exe»
Обновление безопасности для Windows Internet Explorer 7 (KB938127)—>»C:WINDOWSie7updatesKB938127-IE7spuninstspuninst.exe»
Обновление безопасности для Windows Internet Explorer 7 (KB938127-v2)—>»C:WINDOWSie7updatesKB938127-v2-IE7spuninstspuninst.exe»
Обновление безопасности для Windows Internet Explorer 7 (KB956390)—>»C:WINDOWSie7updatesKB956390-IE7spuninstspuninst.exe»
Обновление безопасности для Windows Internet Explorer 7 (KB958215)—>»C:WINDOWSie7updatesKB958215-IE7spuninstspuninst.exe»
Обновление безопасности для Windows Internet Explorer 7 (KB960714)—>»C:WINDOWSie7updatesKB960714-IE7spuninstspuninst.exe»
Обновление безопасности для Windows Internet Explorer 7 (KB961260)—>»C:WINDOWSie7updatesKB961260-IE7spuninstspuninst.exe»
Обновление безопасности для Windows Internet Explorer 7 (KB963027)—>»C:WINDOWSie7updatesKB963027-IE7spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB923789)—>C:WINDOWSsystem32MacroMedFlashgenuinst.exe C:WINDOWSsystem32MacroMedFlashKB923789.inf
Пакет драйверов Windows — Advanced Micro Devices (AmdK8) Processor (05/27/2006 1.3.2.0)—>C:PROGRA~1DIFX7B44739871F4D539FA473F57A832EA4B6A59EF06DPInst.exe /d /u C:WINDOWSsystem32DRVSTOREamdk8_A8D26169E6EDA9205D39A3918FEA7EFFFE870B0Aamdk8.inf
Проигрыватель Windows Media 11—>»C:Program FilesWindows Media PlayerSetup_wm.exe» /Uninstall
Языковой пакет Microsoft .NET Framework 3.5 SP1 — RUS—>c:WINDOWSMicrosoft.NETFrameworkv3.5Microsoft .NET Framework 3.5 Language Pack SP1 — russetup.exe======Hosts File======
127.0.0.1 localhost
127.0.0.1 vkontakte.ru
127.0.0.1 yandex.ru
127.0.0.1 mail.ru
127.0.0.1 google.com
127.0.0.1 http://www.vkontakte.ru
127.0.0.1 http://www.yandex.ru
127.0.0.1 http://www.mail.ru
127.0.0.1 http://www.google.com
127.0.0.1 icq.com======Security center information======
AV: avast! antivirus 4.8.1335 [VPS 090514-0]
======System event log======
Computer Name: alex6134
Event Code: 7036
Message: Служба «Служба администрирования диспетчера логических дисков» перешла в состояние Остановлена.Record Number: 4223
Source Name: Service Control Manager
Time Written: 20090514121107.000000+360
Event Type: информация
User:Computer Name: alex6134
Event Code: 7036
Message: Служба «Съемные ЗУ» перешла в состояние Работает.Record Number: 4222
Source Name: Service Control Manager
Time Written: 20090514121052.000000+360
Event Type: информация
User:Computer Name: alex6134
Event Code: 7035
Message: Служба «Съемные ЗУ» успешно отправила управляющий элемент «запустить».Record Number: 4221
Source Name: Service Control Manager
Time Written: 20090514121052.000000+360
Event Type: информация
User: NT AUTHORITYSYSTEMComputer Name: alex6134
Event Code: 20158
Message: Успешно выполнено подключение пользователя «alex6134″к «Olympus VPN», с помощью устройства «VPN3-1».Record Number: 4220
Source Name: RemoteAccess
Time Written: 20090514121034.000000+360
Event Type: информация
User:Computer Name: alex6134
Event Code: 20159
Message: Подключение пользователя «alex6134» к «Olympus VPN», выполненное с помощью устройства «VPN3-1», было прервано.Record Number: 4219
Source Name: RemoteAccess
Time Written: 20090514121009.000000+360
Event Type: информация
User:=====Application event log=====
Computer Name: alex6134
Event Code: 0
Message:
Record Number: 5
Source Name: Nero BackItUp Scheduler 3
Time Written: 20090506123505.000000+360
Event Type: информация
User:Computer Name: alex6134
Event Code: 11724
Message: Product: Google Toolbar for Internet Explorer — Removal completed successfully.Record Number: 4
Source Name: MsiInstaller
Time Written: 20090506121813.000000+360
Event Type: информация
User: alex6134AndrewComputer Name: alex6134
Event Code: 1800
Message: Служба центра обеспечения безопасности Windows запущена.Record Number: 3
Source Name: SecurityCenter
Time Written: 20090506065734.000000+360
Event Type: информация
User:Computer Name: alex6134
Event Code: 105
Message: The service was started.Record Number: 2
Source Name: PLFlash DeviceIoControl Service
Time Written: 20090506065732.000000+360
Event Type: информация
User:Computer Name: alex6134
Event Code: 0
Message:
Record Number: 1
Source Name: Nero BackItUp Scheduler 3
Time Written: 20090506065732.000000+360
Event Type: информация
User:======Environment variables======
«ComSpec»=%SystemRoot%system32cmd.exe
«Path»=%SystemRoot%system32;%SystemRoot%;%SystemRoot%System32Wbem
«windir»=%SystemRoot%
«FP_NO_HOST_CHECK»=NO
«OS»=Windows_NT
«PROCESSOR_ARCHITECTURE»=x86
«PROCESSOR_LEVEL»=15
«PROCESSOR_IDENTIFIER»=x86 Family 15 Model 67 Stepping 3, AuthenticAMD
«PROCESSOR_REVISION»=4303
«NUMBER_OF_PROCESSORS»=2
«PATHEXT»=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
«TEMP»=%SystemRoot%TEMP
«TMP»=%SystemRoot%TEMP
«Page2Chm»=C:Program FilesOpera AC 3.5.2Misc
EOF
Здравствуйте, добро пожаловать на Spyware-ru форум.
Нужно ещё немного подчистить компьютер.
Скачайте OTMoveIt3 by OldTimer кликнув по этой ссылке.
Запустите OTMoveIt3 и в большое поле ввода (заголовок этого поля выделен желтым цветом) скопируйте следующий текст.:Processes
explorer.exe
:reg
[-HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregGREATZERO BOT]
[-HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregPromoReg]
[-HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{4fd76119-c41d-11dd-ad13-001a4d96ee7d}]
:files
C:9uqe5ds8.exe
C:Documents and SettingsAll Users.WINDOWSApplication Data96718276
C:Documents and SettingsAll Users.WINDOWSApplication Data96718276.ini
C:WINDOWSkuJt.exe
C:WINDOWShtml1.txt
c:SYSTEMS-1-5-21-1482476501-1644491937-682003330-1013
:Commands
[emptytemp]
[start explorer]
[Reboot]Проверьте вставленный скрипт, если слева перед директивами появились пробелы, то удалите их, скрипт должен выглядеть так же как в сообщении. Кликните по кнопке MoveIt!. В процессе работы возможна перезагрузка компьютера.
По-завершении работы программы должен будет показан лог. Если лог не будет показан, то его можно найти в папке C:_OTMoveItMovedFiles.Вставьте в ваше ответное сообщение содержимое этого лога. И ещё приложите свежий RSIT лог (только log.txt).
- Темы:532
- Сообщений:1553
- ☆☆☆☆☆
========== PROCESSES ==========
Process explorer.exe killed successfully.
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregGREATZERO BOT\ deleted successfully.
Registry key HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregPromoReg\ deleted successfully.
Registry key HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{4fd76119-c41d-11dd-ad13-001a4d96ee7d}\ deleted successfully.
========== FILES ==========
C:9uqe5ds8.exe moved successfully.
C:Documents and SettingsAll Users.WINDOWSApplication Data96718276 moved successfully.
C:Documents and SettingsAll Users.WINDOWSApplication Data96718276.ini moved successfully.
File/Folder C:WINDOWSkuJt.exe not found.
C:WINDOWShtml1.txt moved successfully.
File/Folder c:SYSTEMS-1-5-21-1482476501-1644491937-682003330-1013 not found.
========== COMMANDS ==========
File delete failed. C:DOCUME~1AndrewLOCALS~1TemppngCE5F.tmp scheduled to be deleted on reboot.
User’s Temp folder emptied.
User’s Internet Explorer cache folder emptied.
File delete failed. C:Documents and SettingsAndrewLocal SettingsTemporary Internet FilesContent.IE5index.dat scheduled to be deleted on reboot.
User’s Temporary Internet Files folder emptied.
Local Service Temp folder emptied.
Local Service Temporary Internet Files folder emptied.
Network Service Temp folder emptied.
Network Service Temporary Internet Files folder emptied.
File delete failed. C:WINDOWStemp_avast4_Webshlock.txt scheduled to be deleted on reboot.
File delete failed. C:WINDOWStempPerflib_Perfdata_54c.dat scheduled to be deleted on reboot.
Windows Temp folder emptied.
FireFox cache emptied.
Opera cache emptied.
Temp folders emptied.
Explorer started successfullyOTMoveIt3 by OldTimer — Version 1.0.11.0 log created on 05182009_150439
Files moved on Reboot…
C:DOCUME~1AndrewLOCALS~1TemppngCE5F.tmp moved successfully.
File C:WINDOWStemp_avast4_Webshlock.txt not found!
C:WINDOWStempPerflib_Perfdata_54c.dat moved successfully.- Темы:532
- Сообщений:1553
- ☆☆☆☆☆
Лог RSIT:
Logfile of random’s system information tool 1.06 (written by random/random)
Run by Andrew at 2009-05-18 15:13:04
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 28 GB (18%) free of 153 GB
Total RAM: 2047 MB (78% free)Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:13:18, on 18.05.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: NormalRunning processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:Program FilesAlwil SoftwareAvast4aswUpdSv.exe
C:Program FilesAlwil SoftwareAvast4ashServ.exe
C:WINDOWSExplorer.EXE
C:WINDOWSsystem32spoolsv.exe
C:Program FilesNeroNero8Nero BackItUpNBService.exe
C:WINDOWSsystem32nvsvc32.exe
C:WINDOWSsystem32IoctlSvc.exe
c:Program FilesCommon FilesProtexisLicense ServicePsiService_2.exe
C:Program FilesAlwil SoftwareAvast4ashMaiSv.exe
C:Program FilesAlwil SoftwareAvast4ashWebSv.exe
C:Program FilesAdobeAcrobat 7.0DistillrAcrotray.exe
C:WINDOWSRTHDCPL.EXE
C:PROGRA~1ALWILS~1Avast4ashDisp.exe
C:WINDOWSsystem32RUNDLL32.EXE
C:WINDOWSsystem32ctfmon.exe
C:Program FilesAdobeAcrobat 7.0AcrobatAcrobat_sl.exe
C:Program FilesOlympus WinTraywintray.exe
C:Program FilesOlympus P2PStrongDC.exe
C:WINDOWSsystem32wuauclt.exe
C:Program FilesOpera AC 3.5.2opera.exe
C:Documents and SettingsAndrewРабочий столНе залезать!RSIT.exe
C:Program Filestrend microAndrew.exeR1 — HKCUSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://search.qip.ru
R0 — HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.mail.ru
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 — HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 — HKCUSoftwareMicrosoftInternet ExplorerSearchURL,(Default) = http://search.qip.ru/search?query=%s&from=IE
R0 — HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Ссылки
O2 — BHO: AcroIEHlprObj Class — {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} — C:Program FilesAdobeAcrobat 7.0ActiveXAcroIEHelper.dll
O2 — BHO: Adobe PDF Conversion Toolbar Helper — {AE7CD045-E861-484f-8273-0445EE161910} — C:Program FilesAdobeAcrobat 7.0AcrobatAcroIEFavClient.dll
O2 — BHO: Ask.com Toolbar BHO — {D4027C7F-154A-4066-A1AD-4243D8127440} — C:Program FilesAsk.comSupertoolbarGenericAskToolbar.dll
O3 — Toolbar: Adobe PDF — {47833539-D0C5-4125-9FA8-0819E2EAAC93} — C:Program FilesAdobeAcrobat 7.0AcrobatAcroIEFavClient.dll
O3 — Toolbar: Ask.com Toolbar — {D4027C7F-154A-4066-A1AD-4243D8127440} — C:Program FilesAsk.comSupertoolbarGenericAskToolbar.dll
O4 — HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSsystem32NvCpl.dll,NvStartup
O4 — HKLM..Run: [Acrobat Assistant 7.0] «C:Program FilesAdobeAcrobat 7.0DistillrAcrotray.exe»
O4 — HKLM..Run: [RTHDCPL] RTHDCPL.EXE
O4 — HKLM..Run: [avast!] C:PROGRA~1ALWILS~1Avast4ashDisp.exe
O4 — HKLM..Run: [NeroFilterCheck] C:Program FilesCommon FilesNeroLibNeroCheck.exe
O4 — HKLM..Run: [nwiz] nwiz.exe /install
O4 — HKLM..Run: [NvMediaCenter] RUNDLL32.EXE C:WINDOWSsystem32NvMcTray.dll,NvTaskbarInit
O4 — HKCU..Run: [CTFMON.EXE] C:WINDOWSsystem32ctfmon.exe
O4 — HKUSS-1-5-18..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘SYSTEM’)
O4 — HKUSS-1-5-18..RunOnce: [TSClientMSIUninstaller] cmd.exe /C «cscript %systemroot%InstallerTSClientMsiTranstscuinst.vbs» (User ‘SYSTEM’)
O4 — HKUS.DEFAULT..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘Default user’)
O4 — HKUS.DEFAULT..RunOnce: [TSClientMSIUninstaller] cmd.exe /C «cscript %systemroot%InstallerTSClientMsiTranstscuinst.vbs» (User ‘Default user’)
O4 — Startup: Olympus P2P v4.0RC3.lnk = C:Program FilesOlympus P2PStrongDC.exe
O4 — Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 — Global Startup: Olympus Wintray.lnk = C:Program FilesOlympus WinTraywintray.exe
O8 — Extra context menu item: &Экспорт в Microsoft Excel — res://C:PROGRA~1MICROS~2OFFICE11EXCEL.EXE/3000
O8 — Extra context menu item: Convert link target to Adobe PDF — res://C:Program FilesAdobeAcrobat 7.0AcrobatAcroIEFavClient.dll/AcroIECapture.html
O8 — Extra context menu item: Convert link target to existing PDF — res://C:Program FilesAdobeAcrobat 7.0AcrobatAcroIEFavClient.dll/AcroIEAppend.html
O8 — Extra context menu item: Convert selected links to Adobe PDF — res://C:Program FilesAdobeAcrobat 7.0AcrobatAcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 — Extra context menu item: Convert selected links to existing PDF — res://C:Program FilesAdobeAcrobat 7.0AcrobatAcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 — Extra context menu item: Convert selection to Adobe PDF — res://C:Program FilesAdobeAcrobat 7.0AcrobatAcroIEFavClient.dll/AcroIECapture.html
O8 — Extra context menu item: Convert selection to existing PDF — res://C:Program FilesAdobeAcrobat 7.0AcrobatAcroIEFavClient.dll/AcroIEAppend.html
O8 — Extra context menu item: Convert to Adobe PDF — res://C:Program FilesAdobeAcrobat 7.0AcrobatAcroIEFavClient.dll/AcroIECapture.html
O8 — Extra context menu item: Convert to existing PDF — res://C:Program FilesAdobeAcrobat 7.0AcrobatAcroIEFavClient.dll/AcroIEAppend.html
O8 — Extra context menu item: Олимпус: Определить &тип трафика — C:Program FilesInternet ExplorerSIGNUPchecker.htm
O9 — Extra button: PokerStars — {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} — C:Program FilesPokerStarsPokerStarsUpdate.exe
O9 — Extra button: Справочные материалы — {92780B25-18CC-41C8-B9BE-3C9C571A8263} — C:PROGRA~1MICROS~2OFFICE11REFIEBAR.DLL
O9 — Extra button: (no name) — {e2e2dd38-d088-4134-82b7-f2ba38496583} — C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O9 — Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 — {e2e2dd38-d088-4134-82b7-f2ba38496583} — C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O9 — Extra button: Messenger — {FB5F1910-F110-11d2-BB9E-00C04F795683} — C:Program FilesMessengermsmsgs.exe
O9 — Extra ‘Tools’ menuitem: Windows Messenger — {FB5F1910-F110-11d2-BB9E-00C04F795683} — C:Program FilesMessengermsmsgs.exe
O14 — IERESET.INF: START_PAGE_URL=http://www.olympus.ru
O16 — DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) — http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1232784871546
O16 — DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) — http://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab
O17 — HKLMSystemCCSServicesTcpip..{93C193B1-08F8-45C9-92DD-0EE677979D26}: NameServer = 217.76.183.36 217.76.183.38
O17 — HKLMSystemCCSServicesTcpip..{CC2518A5-0FB9-4E54-90A0-44B7AC9237BC}: NameServer = 10.0.0.1,10.0.0.2
O18 — Protocol: skype4com — {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} — C:PROGRA~1COMMON~1SkypeSKYPE4~1.DLL
O23 — Service: Adobe LM Service — Adobe Systems — C:Program FilesCommon FilesAdobe Systems SharedServiceAdobelmsvc.exe
O23 — Service: avast! iAVS4 Control Service (aswUpdSv) — ALWIL Software — C:Program FilesAlwil SoftwareAvast4aswUpdSv.exe
O23 — Service: avast! Antivirus — ALWIL Software — C:Program FilesAlwil SoftwareAvast4ashServ.exe
O23 — Service: avast! Mail Scanner — ALWIL Software — C:Program FilesAlwil SoftwareAvast4ashMaiSv.exe
O23 — Service: avast! Web Scanner — ALWIL Software — C:Program FilesAlwil SoftwareAvast4ashWebSv.exe
O23 — Service: Журнал событий (Eventlog) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: getPlus(R) Helper — NOS Microsystems Ltd. — C:Program FilesNOSbingetPlus_HelperSvc.exe
O23 — Service: Служба COM записи компакт-дисков IMAPI (ImapiService) — Корпорация Майкрософт — C:WINDOWSsystem32imapi.exe
O23 — Service: Macromedia Licensing Service — Unknown owner — C:Program FilesCommon FilesMacromedia SharedServiceMacromedia Licensing.exe
O23 — Service: NetMeeting Remote Desktop Sharing (mnmsrvc) — Корпорация Майкрософт — C:WINDOWSsystem32mnmsrvc.exe
O23 — Service: Nero BackItUp Scheduler 3 — Nero AG — C:Program FilesNeroNero8Nero BackItUpNBService.exe
O23 — Service: NMIndexingService — Nero AG — C:Program FilesCommon FilesNeroLibNMIndexingService.exe
O23 — Service: NVIDIA Display Driver Service (NVSvc) — NVIDIA Corporation — C:WINDOWSsystem32nvsvc32.exe
O23 — Service: PLFlash DeviceIoControl Service — Prolific Technology Inc. — C:WINDOWSsystem32IoctlSvc.exe
O23 — Service: Plug and Play (PlugPlay) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: Protexis Licensing V2 (PSI_SVC_2) — Protexis Inc. — c:Program FilesCommon FilesProtexisLicense ServicePsiService_2.exe
O23 — Service: Диспетчер сеанса справки для удаленного рабочего стола (RDSessMgr) — Корпорация Майкрософт — C:WINDOWSsystem32sessmgr.exe
O23 — Service: Смарт-карты (SCardSvr) — Корпорация Майкрософт — C:WINDOWSSystem32SCardSvr.exe
O23 — Service: Журналы и оповещения производительности (SysmonLog) — Корпорация Майкрософт — C:WINDOWSsystem32smlogsvc.exe
O23 — Service: Теневое копирование тома (VSS) — Корпорация Майкрософт — C:WINDOWSSystem32vssvc.exe
O23 — Service: Адаптер производительности WMI (WmiApSrv) — Корпорация Майкрософт — C:WINDOWSsystem32wbemwmiapsrv.exe—
End of file — 9615 bytes======Scheduled tasks folder======
C:WINDOWStasksScheduled Update for Ask Toolbar.job
C:WINDOWStasksSmartDefrag.job======Registry dump======
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class — C:Program FilesAdobeAcrobat 7.0ActiveXAcroIEHelper.dll [2006-12-18 59032][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{AE7CD045-E861-484f-8273-0445EE161910}]
Adobe PDF Conversion Toolbar Helper — C:Program FilesAdobeAcrobat 7.0AcrobatAcroIEFavClient.dll [2006-12-18 231160][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{D4027C7F-154A-4066-A1AD-4243D8127440}]
Ask.com Toolbar — C:Program FilesAsk.comSupertoolbarGenericAskToolbar.dll [2008-10-21 741768][HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
{47833539-D0C5-4125-9FA8-0819E2EAAC93} — Adobe PDF — C:Program FilesAdobeAcrobat 7.0AcrobatAcroIEFavClient.dll [2006-12-18 231160]
{D4027C7F-154A-4066-A1AD-4243D8127440} — Ask.com Toolbar — C:Program FilesAsk.comSupertoolbarGenericAskToolbar.dll [2008-10-21 741768][HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun]
«NvCplDaemon»=C:WINDOWSsystem32NvCpl.dll [2009-03-28 13684736]
«Acrobat Assistant 7.0″=C:Program FilesAdobeAcrobat 7.0DistillrAcrotray.exe [2008-04-23 483328]
«RTHDCPL»=C:WINDOWSRTHDCPL.EXE [2008-05-07 16862208]
«avast!»=C:PROGRA~1ALWILS~1Avast4ashDisp.exe [2009-02-06 81000]
«NeroFilterCheck»=C:Program FilesCommon FilesNeroLibNeroCheck.exe [2008-02-28 570664]
«»= []
«nwiz»=nwiz.exe /install []
«NvMediaCenter»=C:WINDOWSsystem32NvMcTray.dll [2009-03-28 86016][HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=C:WINDOWSsystem32ctfmon.exe [2008-04-14 15360][HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregNBKeyScan]
C:Program FilesNeroNero8Nero BackItUpNBKeyScan.exe [2008-02-18 2221352][HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregnwiz]
nwiz.exe /install [][HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupfolderC:^Documents and Settings^All Users.WINDOWS^Главное меню^Программы^Автозагрузка^Adobe Acrobat Speed Launcher.lnk]
C:WINDOWSInstaller{AC76BA86-1033-0000-7760-000000000002}SC_Acrobat.exe [2009-05-13 25214]C:Documents and SettingsAll Users.WINDOWSГлавное менюПрограммыАвтозагрузка
Adobe Acrobat Speed Launcher.lnk — C:WINDOWSInstaller{AC76BA86-1033-0000-7760-000000000002}SC_Acrobat.exe
Olympus Wintray.lnk — C:Program FilesOlympus WinTraywintray.exeC:Documents and SettingsAndrewГлавное менюПрограммыАвтозагрузка
Olympus P2P v4.0RC3.lnk — C:Program FilesOlympus P2PStrongDC.exe[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad]
WPDShServiceObj — {AAA288BA-9A4C-45B0-95D7-94D524869DB5} — C:WINDOWSsystem32WPDShServiceObj.dll [2006-10-18 133632][HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetwork{1a3e09be-1e45-494b-9174-d7385b45bbf5}]
[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
«dontdisplaylastusername»=0
«legalnoticecaption»=
«legalnoticetext»=
«shutdownwithoutlogon»=1
«undockwithoutlogon»=1[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoDriveTypeAutoRun»=323
«NoDriveAutoRun»=67108863
«NoDrives»=0[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoDriveAutoRun»=
«NoDriveTypeAutoRun»=
«NoDrives»=
«HonorAutoRunSetting»=[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicystandardprofileauthorizedapplicationslist]
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»
«C:WINDOWSsystem32usmtmigwiz.exe»=»C:WINDOWSsystem32usmtmigwiz.exe:*:Enabled:Мастер переноса файлов и параметров»
«C:Program FilesOlympus WinTraywintray.exe»=»C:Program FilesOlympus WinTraywintray.exe:*:Enabled:Утилита для пользователей Олимпус»
«%windir%Network Diagnosticxpnetdiag.exe»=»%windir%Network Diagnosticxpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000»
«C:Program FilesSkypePhoneSkype.exe»=»C:Program FilesSkypePhoneSkype.exe:*:Enabled:Skype»
«C:Program FilesOlympus P2PStrongDC.exe»=»C:Program FilesOlympus P2PStrongDC.exe:*:Disabled:StrongDC++»
«C:Program FilesOlympus P2POlympusp2p.exe»=»C:Program FilesOlympus P2POlympusp2p.exe:*:Enabled:StrongDC++»[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicydomainprofileauthorizedapplicationslist]
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»
«%windir%Network Diagnosticxpnetdiag.exe»=»%windir%Network Diagnosticxpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000»======File associations======
.js — open — «C:Program FilesMacromediaDreamweaver MX 2004Dreamweaver.exe» «%1»
.txt — open — notepad.exe %1======List of files/folders created in the last 1 months======
2009-05-18 15:13:04 —-D—- C:rsit
2009-05-18 15:04:39 —-D—- C:_OTMoveIt
2009-05-17 00:57:43 —-D—- C:Documents and SettingsAndrewApplication DataXRay Engine
2009-05-16 12:16:21 —-D—- C:Documents and SettingsAndrewApplication DataMalwarebytes
2009-05-16 12:16:16 —-D—- C:Program FilesMalwarebytes’ Anti-Malware
2009-05-16 12:16:16 —-D—- C:Documents and SettingsAll Users.WINDOWSApplication DataMalwarebytes
2009-05-16 12:14:49 —-A—- C:mbam-setup.exe
2009-05-15 18:55:57 —-D—- C:Program FilesAsk.com
2009-05-15 18:15:40 —-D—- C:Program FilesMiranda
2009-05-15 18:14:51 —-A—- C:mip_5.7.exe
2009-05-15 16:57:53 —-D—- C:Program Filestrend micro
2009-05-15 14:35:04 —-D—- C:Program FilesOpera AC 3.5.2
2009-05-14 22:42:13 —-D—- C:Program FilesStalker — Clear Sky
2009-05-14 11:08:12 —-D—- C:WINDOWSNV11682664.TMP
2009-05-14 11:07:39 —-A—- C:WINDOWSsystem32MRT.INI
2009-05-09 09:54:23 —-HDC—- C:WINDOWS$NtUninstallbasecsp$
2009-05-09 09:54:20 —-D—- C:Program FilesManaged DirectX (0901)
2009-05-06 12:28:06 —-D—- C:Documents and SettingsAndrewApplication DataMra
2009-05-04 15:55:27 —-SHD—- C:RECYCLER
2009-05-04 15:43:43 —-RASHD—- C:autorun.inf
2009-05-04 14:47:09 —-D—- C:Documents and SettingsAndrewApplication DataGoogle
2009-04-19 20:52:30 —-AD—- C:Documents and SettingsAll Users.WINDOWSApplication DataTEMP
2009-04-19 20:51:47 —-A—- C:WINDOWSsystem32wsatrace.dll
2009-04-19 17:44:37 —-D—- C:Program FilesPoker Tracker V2======List of files/folders modified in the last 1 months======
2009-05-18 15:12:03 —-D—- C:WINDOWSTemp
2009-05-18 15:04:40 —-D—- C:WINDOWS
2009-05-18 14:53:19 —-D—- C:Program FilesOlympus P2P
2009-05-18 13:36:55 —-D—- C:P2P
2009-05-17 23:57:30 —-A—- C:WINDOWSSchedLgU.Txt
2009-05-17 23:57:28 —-D—- C:WINDOWSsystem32CatRoot2
2009-05-17 12:35:35 —-RSHDC—- C:WINDOWSsystem32dllcache
2009-05-16 23:04:48 —-D—- C:!Андрей
2009-05-16 21:50:20 —-D—- C:WINDOWSsystem32drivers
2009-05-16 14:34:07 —-D—- C:WINDOWSHelp
2009-05-16 13:44:15 —-D—- C:Program Files
2009-05-15 18:56:04 —-SHD—- C:WINDOWSInstaller
2009-05-15 18:56:00 —-SD—- C:WINDOWSTasks
2009-05-15 18:55:21 —-D—- C:WINDOWSsystem32
2009-05-15 14:14:11 —-D—- C:Program FilesQIP Infium
2009-05-15 12:58:37 —-D—- C:Музыка
2009-05-15 12:08:59 —-A—- C:WINDOWSNeroDigital.ini
2009-05-15 09:21:00 —-D—- C:WINDOWSPrefetch
2009-05-15 00:03:17 —-D—- C:Program FilesOlympus VLC Lite
2009-05-14 23:56:25 —-RD—- C:!Лещ
2009-05-14 19:25:15 —-D—- C:WINDOWSMinidump
2009-05-14 19:21:34 —-D—- C:WINDOWSpss
2009-05-14 12:51:11 —-D—- C:Documents and SettingsAll Users.WINDOWSApplication DataSkype
2009-05-14 12:37:03 —-A—- C:WINDOWSsystem32PerfStringBackup.INI
2009-05-14 12:11:37 —-D—- C:WINDOWSsystem32NtmsData
2009-05-14 11:46:59 —-D—- C:WINDOWSRegistration
2009-05-14 11:29:35 —-D—- C:WINDOWSDebug
2009-05-14 11:09:55 —-D—- C:WINDOWSnview
2009-05-14 11:07:55 —-HD—- C:WINDOWSinf
2009-05-14 11:07:54 —-D—- C:WINDOWSsystem32ReinstallBackups
2009-05-13 21:54:04 —-D—- C:Documents and SettingsAndrewApplication DataAdobeUM
2009-05-13 21:47:53 —-D—- C:!Анечка
2009-05-13 21:43:57 —-D—- C:Program FilesCommon FilesAdobe
2009-05-13 11:56:39 —-D—- C:Documents and SettingsAndrewApplication DataAdobe
2009-05-11 12:41:38 —-D—- C:Program FilesPokerStars
2009-05-09 09:54:29 —-D—- C:WINDOWSsecurity
2009-05-09 09:54:21 —-RSD—- C:WINDOWSassembly
2009-05-09 09:54:21 —-D—- C:WINDOWSMicrosoft.NET
2009-05-07 13:16:29 —-A—- C:WINDOWSsystem32MRT.exe
2009-05-06 21:40:12 —-RD—- C:Плиз не удалять
2009-05-06 12:34:55 —-D—- C:Program FilesGoogle
2009-05-04 16:03:00 —-D—- C:Утилиты
2009-05-04 15:53:06 —-A—- C:WINDOWSsystem.ini
2009-05-04 15:52:41 —-D—- C:WINDOWSAppPatch
2009-05-04 15:52:38 —-D—- C:Program FilesCommon Files
2009-05-02 12:59:48 —-D—- C:Documents and SettingsAndrewApplication DataskypePM
2009-05-02 12:59:26 —-D—- C:Program FilesCommon FilesSkype
2009-05-01 15:36:46 —-A—- C:WINDOWSVFIND.exe
2009-04-27 19:55:11 —-D—- C:
2009-04-19 22:09:04 —-SD—- C:Documents and SettingsAndrewApplication DataMicrosoft
2009-04-19 00:10:49 —-D—- C:Фильмы======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R1 Aavmker4;avast! Asynchronous Virus Monitor; C:WINDOWSsystem32driversAavmker4.sys [2009-02-06 26944]
R1 AmdK8;Драйвер AMD процессора; C:WINDOWSsystem32DRIVERSAmdK8.sys [2006-06-19 43520]
R1 aswSP;avast! Self Protection; C:WINDOWSsystem32driversaswSP.sys [2009-02-06 114768]
R1 aswTdi;avast! Network Shield Support; C:WINDOWSsystem32driversaswTdi.sys [2009-02-06 51376]
R1 WS2IFSL;Среда Windows Socket 2.0 поддержки поставщиков не-IFS служб; C:WINDOWSSystem32driversws2ifsl.sys [2006-03-02 12032]
R2 aswFsBlk;aswFsBlk; C:WINDOWSsystem32DRIVERSaswFsBlk.sys [2009-02-06 20560]
R2 aswMon2;avast! Standard Shield Support; C:WINDOWSsystem32driversaswMon2.sys [2009-02-06 94032]
R2 npf;NetGroup Packet Filter Driver; C:WINDOWSsystem32driversnpf.sys [2007-11-16 34064]
R3 Arp1394;Протокол клиента 1394 ARP; C:WINDOWSsystem32DRIVERSarp1394.sys [2008-04-14 60800]
R3 aswRdr;aswRdr; C:WINDOWSsystem32driversaswRdr.sys [2009-02-06 23152]
R3 HDAudBus;Драйвер шины Microsoft UAA для High Definition Audio; C:WINDOWSsystem32DRIVERSHDAudBus.sys [2008-04-13 144384]
R3 hidusb;Драйвер класса HID Microsoft; C:WINDOWSsystem32DRIVERShidusb.sys [2008-04-14 10368]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:WINDOWSsystem32driversRtkHDAud.sys [2008-05-07 4739072]
R3 mouhid;Драйвер мыши HID; C:WINDOWSsystem32DRIVERSmouhid.sys [2006-03-02 12160]
R3 NIC1394;Сетевой драйвер 1394; C:WINDOWSsystem32DRIVERSnic1394.sys [2008-04-14 61824]
R3 nv;nv; C:WINDOWSsystem32DRIVERSnv4_mini.sys [2009-03-28 6280416]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:WINDOWSsystem32DRIVERSNVENETFD.sys [2006-09-11 57856]
R3 nvnetbus;NVIDIA Network Bus Enumerator; C:WINDOWSsystem32DRIVERSnvnetbus.sys [2006-09-11 19968]
R3 usbehci;Драйвер минипорта Microsoft USB 2.0 расширенного хост-контроллера; C:WINDOWSsystem32DRIVERSusbehci.sys [2008-04-14 30208]
R3 usbhub;USB2 концентратор; C:WINDOWSsystem32DRIVERSusbhub.sys [2008-04-14 59520]
R3 usbohci;Драйвер минипорта Microsoft USB открытого хост-контроллера; C:WINDOWSsystem32DRIVERSusbohci.sys [2008-04-14 17152]
S3 catchme;catchme; ??C:DOCUME~1AndrewLOCALS~1Tempcatchme.sys []
S3 gdrv;gdrv; ??C:WINDOWSgdrv.sys []
S3 usbccgp;Драйвер универсального родительского устройства USB (Microsoft); C:WINDOWSsystem32DRIVERSusbccgp.sys [2008-04-14 32128]
S3 USBSTOR;Драйвер запоминающих устройств для USB; C:WINDOWSsystem32DRIVERSUSBSTOR.SYS [2008-04-14 26368]
S3 WudfPf;Windows Driver Foundation — User-mode Driver Framework Platform Driver; C:WINDOWSsystem32DRIVERSWudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation — User-mode Driver Framework Reflector; C:WINDOWSsystem32DRIVERSwudfrd.sys [2006-09-28 82944]
S4 IntelIde;IntelIde; C:WINDOWSsystem32driversIntelIde.sys []======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 aswUpdSv;avast! iAVS4 Control Service; C:Program FilesAlwil SoftwareAvast4aswUpdSv.exe [2009-02-06 18752]
R2 avast! Antivirus;avast! Antivirus; C:Program FilesAlwil SoftwareAvast4ashServ.exe [2009-02-06 138680]
R2 Nero BackItUp Scheduler 3;Nero BackItUp Scheduler 3; C:Program FilesNeroNero8Nero BackItUpNBService.exe [2008-02-18 877864]
R2 NVSvc;NVIDIA Display Driver Service; C:WINDOWSsystem32nvsvc32.exe [2009-03-28 163908]
R2 PLFlash DeviceIoControl Service;PLFlash DeviceIoControl Service; C:WINDOWSsystem32IoctlSvc.exe [2006-12-19 81920]
R2 PSI_SVC_2;Protexis Licensing V2; c:Program FilesCommon FilesProtexisLicense ServicePsiService_2.exe [2007-07-24 185632]
R3 avast! Mail Scanner;avast! Mail Scanner; C:Program FilesAlwil SoftwareAvast4ashMaiSv.exe [2009-02-06 254040]
R3 avast! Web Scanner;avast! Web Scanner; C:Program FilesAlwil SoftwareAvast4ashWebSv.exe [2009-02-06 352920]
S3 Adobe LM Service;Adobe LM Service; C:Program FilesCommon FilesAdobe Systems SharedServiceAdobelmsvc.exe [2009-01-10 69632]
S3 aspnet_state;Служба состояний ASP.NET; C:WINDOWSMicrosoft.NETFrameworkv2.0.50727aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:WINDOWSMicrosoft.NETFrameworkv2.0.50727mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:WINDOWSMicrosoft.NETFrameworkv3.0WPFPresentationFontCache.exe [2008-07-29 46104]
S3 getPlus(R) Helper;getPlus(R) Helper; C:Program FilesNOSbingetPlus_HelperSvc.exe [2008-12-01 33752]
S3 idsvc;Windows CardSpace; C:WINDOWSMicrosoft.NETFrameworkv3.0Windows Communication Foundationinfocard.exe [2008-07-29 881664]
S3 Macromedia Licensing Service;Macromedia Licensing Service; C:Program FilesCommon FilesMacromedia SharedServiceMacromedia Licensing.exe [2009-02-06 68096]
S3 NMIndexingService;NMIndexingService; C:Program FilesCommon FilesNeroLibNMIndexingService.exe [2008-02-28 529704]
S3 ose;Office Source Engine; C:Program FilesCommon FilesMicrosoft SharedSource EngineOSE.EXE [2003-07-28 89136]
S3 WMPNetworkSvc;Служба общих сетевых ресурсов проигрывателя Windows Media; C:Program FilesWindows Media PlayerWMPNetwk.exe [2006-11-03 914944]
S3 WudfSvc;Windows Driver Foundation — User-mode Driver Framework; C:WINDOWSsystem32svchost.exe [2008-04-14 14336]
S4 ATMsrvc;ATM Service; C:WINDOWSSystem32ATMsrvc.exe [2000-05-24 15360]
S4 NetTcpPortSharing;Служба общего доступа к портам Net.Tcp; C:WINDOWSMicrosoft.NETFrameworkv3.0Windows Communication FoundationSMSvcHost.exe [2008-07-29 132096]
EOF
- Темы:532
- Сообщений:1553
- ☆☆☆☆☆
Работает так-же, протокол QIP загружается, протокол ICQ не загружается.
Скачайте программу Combofix. Закройте все открытые окна и запустите эту программу.
После выполнения будет создан лог файл, пожалуйста вставьте его в ваш ответ.Примечание: перед использованием Combofix обязательно установите Recovery console. Как это сделать будет описано на странице, ссылку на которую я привёл выше.
- Темы:532
- Сообщений:1553
- ☆☆☆☆☆
ComboFix 09-05-25.03 — Andrew 26.05.2009 2:33.9 — NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1251.7.1049.18.2047.1552 [GMT 6:00]
Running from: c:documents and settingsAndrewРабочий столНе залезать!ComboFix.exe
AV: avast! antivirus 4.8.1335 [VPS 090525-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.((((((((((((((((((((((((( Files Created from 2009-04-25 to 2009-05-25 )))))))))))))))))))))))))))))))
.2009-05-24 06:52 . 2009-05-24 06:57
d
w c:program filesStalker — Clear Sky
2009-05-23 06:50 . 2009-05-23 06:50
d
w c:program files2gis
2009-05-20 03:11 . 2009-05-20 03:11
d
w c:documents and settingsAndrewApplication DataROALDevelopment
2009-05-20 03:11 . 2009-05-20 03:11
d
w c:program filesRadioClicker LITE
2009-05-19 20:08 . 2009-05-20 08:06
d
w c:program filesRegistry Easy
2009-05-19 08:16 . 2009-05-19 08:18
d
w c:documents and settingsAndrewApplication DataJonDo
2009-05-19 07:38 . 2009-05-19 08:16
d
w c:program filesJAP
2009-05-19 00:40 . 2009-05-19 00:40
d
w c:documents and settingsAndrewApplication DataQIP
2009-05-19 00:40 . 2009-05-19 00:40
d
w c:program filesQIP Infium
2009-05-18 14:46 . 2009-05-18 14:46 410984 —-a-w c:windowssystem32deploytk.dll
2009-05-18 14:46 . 2009-05-18 14:46
d
w c:program filesJava
2009-05-18 14:46 . 2009-05-18 14:46 152576 —-a-w c:documents and settingsAndrewApplication DataSunJavajre1.6.0_13lzma.dll
2009-05-18 09:13 . 2009-05-18 09:13
d
w C:rsit
2009-05-18 09:04 . 2009-05-18 09:04
d
w C:_OTMoveIt
2009-05-17 06:34 . 2001-08-17 15:28 871388 -c—a-w c:windowssystem32dllcachebcmdm.sys
2009-05-17 06:33 . 2001-10-19 15:05 61952 -c—a-w c:windowssystem32dllcacheacerscad.dll
2009-05-16 18:57 . 2009-05-16 18:57
d
w c:documents and settingsAndrewApplication DataXRay Engine
2009-05-16 16:49 . 2009-05-25 20:31
d
w c:documents and settingsAndrewLocal SettingsApplication DataAskSuperBar
2009-05-16 06:16 . 2009-05-16 06:16
d
w c:documents and settingsAndrewApplication DataMalwarebytes
2009-05-16 06:16 . 2009-04-06 09:32 15504 —-a-w c:windowssystem32driversmbam.sys
2009-05-16 06:16 . 2009-04-06 09:32 38496 —-a-w c:windowssystem32driversmbamswissarmy.sys
2009-05-16 06:16 . 2009-05-16 06:16
d
w c:program filesMalwarebytes’ Anti-Malware
2009-05-16 06:16 . 2009-05-16 06:16
d
w c:documents and settingsAll Users.WINDOWSApplication DataMalwarebytes
2009-05-15 12:55 . 2009-05-15 12:55
d
w c:program filesAsk.com
2009-05-15 12:55 . 2009-05-15 12:55
d
w c:documents and settingsAndrew
2009-05-15 12:15 . 2009-05-19 17:27
d
w c:program filesMiranda
2009-05-15 10:57 . 2009-05-18 09:13
d
w c:program filestrend micro
2009-05-15 08:35 . 2009-05-15 08:36
d
w c:program filesOpera AC 3.5.2
2009-05-14 05:08 . 2009-05-14 05:09
d
w c:windowsNV11682664.TMP
2009-05-09 03:54 . 2009-05-09 03:54
d
w c:program filesManaged DirectX (0901)
2009-05-08 17:50 . 2009-05-08 17:50
d-sh—w c:documents and settingsAndrewUserData
2009-05-06 06:28 . 2009-05-06 06:28
d
w c:documents and settingsAndrewApplication DataMra
2009-05-04 08:47 . 2009-05-06 06:18
d
w c:documents and settingsAndrewLocal SettingsApplication DataGoogle.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-25 19:55 . 2009-01-10 11:29 2776 —sha-w c:documents and settingsAll Users.WINDOWSApplication DataKGyGaAvL.sys
2009-05-25 19:55 . 2009-01-10 11:29 2776 —sha-w c:documents and settingsAll Users.WINDOWSApplication DataKGyGaAvL.sys
2009-05-25 18:48 . 2008-07-05 17:35
d
w c:program filesOlympus P2P
2009-05-20 08:19 . 2009-01-10 11:04 161448 —-a-w c:documents and settingsAndrewLocal SettingsApplication DataGDIPFONTCACHEV1.DAT
2009-05-14 18:03 . 2009-01-29 16:58
d
w c:program filesOlympus VLC Lite
2009-05-14 06:51 . 2009-01-10 14:11
d
w c:documents and settingsAll Users.WINDOWSApplication DataSkype
2009-05-14 06:37 . 2006-03-02 12:00 84174 —-a-w c:windowssystem32perfc019.dat
2009-05-14 06:37 . 2006-03-02 12:00 483582 —-a-w c:windowssystem32perfh019.dat
2009-05-13 15:54 . 2009-01-10 14:51
d
w c:documents and settingsAndrewApplication DataAdobeUM
2009-05-13 15:43 . 2007-11-02 20:26
d
w c:program filesCommon FilesAdobe
2009-05-12 10:40 . 2009-04-19 14:52
d—a-w c:documents and settingsAll Users.WINDOWSApplication DataTEMP
2009-05-12 10:40 . 2009-04-19 11:44
d
w c:program filesPoker Tracker V2
2009-05-11 06:41 . 2009-04-16 14:21
d
w c:program filesPokerStars
2009-05-06 06:34 . 2007-11-01 22:32
d
w c:program filesGoogle
2009-05-02 06:59 . 2009-02-05 16:54
d
w c:documents and settingsAndrewApplication DataskypePM
2009-05-02 06:59 . 2008-10-05 07:46
d
w c:program filesCommon FilesSkype
2009-04-18 14:09 . 2009-01-18 17:40
d
w c:program filesQIP
2009-04-07 04:00 . 2009-04-03 17:03
d
w c:windowsFontsATMFolder
2009-04-05 17:54 . 2009-03-27 08:05
d
w c:program filesMicrosoft Bootvis
2009-04-05 17:40 . 2009-04-02 20:10
d
w c:documents and settingsAll Users.WINDOWSApplication Data2GIS
2009-04-05 14:31 . 2007-11-01 11:54
d—h—w c:program filesInstallShield Installation Information
2009-04-05 03:21 . 2009-04-05 03:21
d
w c:program filesAdobe Type Manager
2009-04-03 16:39 . 2009-04-03 16:38 83469504 —-a-w c:documents and settingsAndrewTRACE_BOOT+DRIVERS_1_1.BIN
2009-03-26 15:14 . 2009-03-26 15:14 1025 —-a-w c:windowssystem32sysprs7.dll
2009-03-26 15:14 . 2009-03-26 15:14 1025 —-a-w c:windowssystem32clauth2.dll
2009-03-26 15:14 . 2009-03-26 15:14 1025 —-a-w c:windowssystem32clauth1.dll
2009-03-06 14:23 . 2006-03-02 12:00 284672 —-a-w c:windowssystem32pdh.dll
2009-03-03 00:15 . 2006-03-02 12:00 826368 —-a-w c:windowssystem32wininet.dll
2008-12-11 16:07 . 2008-12-11 16:07 2185 —-a-w c:program filesCommon Filesunins000.dat
2008-12-11 16:05 . 2008-12-11 16:07 729520 —-a-w c:program filesCommon Filesunins000.exe
2008-03-09 02:25 . 2008-12-11 16:07 236 —ha-w c:program filesCommon Filesdx.reg
.((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4[HKEY_LOCAL_MACHINE~Browser Helper Objects{D4027C7F-154A-4066-A1AD-4243D8127440}]
2008-10-21 06:13 741768 —-a-w c:program filesAsk.comSupertoolbarGenericAskToolbar.dll[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32ctfmon.exe» [2008-04-14 15360][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«NvCplDaemon»=»c:windowssystem32NvCpl.dll» [2009-03-27 13684736]
«Acrobat Assistant 7.0″=»c:program filesAdobeAcrobat 7.0DistillrAcrotray.exe» [2008-04-22 483328]
«avast!»=»c:progra~1ALWILS~1Avast4ashDisp.exe» [2009-02-05 81000]
«SunJavaUpdateSched»=»c:program filesJavajre6binjusched.exe» [2009-05-18 148888]
«nwiz»=»nwiz.exe» — c:windowssystem32nwiz.exe [2009-03-27 1657376]
«RTHDCPL»=»RTHDCPL.EXE» — c:windowsRTHDCPL.exe [2008-05-07 16862208][HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32CTFMON.EXE» [2008-04-14 15360][HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRunOnce]
«TSClientMSIUninstaller»=»c:windowsInstallerTSClientMsiTranstscuinst.vbs» [2007-10-30 13801]
«TSClientAXDisabler»=»c:windowsInstallerTSClientMsiTranstscdsbl.bat» [2008-01-18 2247]c:documents and settingsAndrewѓ« ў®Ґ ¬ҐоЏа®Ја ¬¬лЂўв®§ Јаг§Є
Olympus P2P v4.0RC3.lnk — c:program filesOlympus P2PStrongDC.exe [2005-9-10 3002368]c:documents and settingsAll Users.WINDOWSѓ« ў®Ґ ¬ҐоЏа®Ја ¬¬лЂўв®§ Јаг§Є
Adobe Acrobat Speed Launcher.lnk — c:windowsInstaller{AC76BA86-1033-0000-7760-000000000002}SC_Acrobat.exe [2009-1-10 25214]
Olympus Wintray.lnk — c:program filesOlympus WinTraywintray.exe [2008-3-7 2251264][HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoResolveTrack»= 1 (0x1)[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoResolveTrack»= 1 (0x1)
«NoThumbnailCache»= 1 (0x1)[HKLM~startupfolderC:^Documents and Settings^All Users.WINDOWS^Главное меню^Программы^Автозагрузка^Adobe Acrobat Speed Launcher.lnk]
path=c:documents and settingsAll Users.WINDOWSГлавное менюПрограммыАвтозагрузкаAdobe Acrobat Speed Launcher.lnk
backup=c:windowspssAdobe Acrobat Speed Launcher.lnkCommon Startup[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity center]
«FirewallOverride»=dword:00000001[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\system32\sessmgr.exe»=
«c:\WINDOWS\system32\usmt\migwiz.exe»=
«c:\Program Files\Olympus WinTray\wintray.exe»=
«%windir%\Network Diagnostic\xpnetdiag.exe»=
«c:\Program Files\Olympus P2P\StrongDC.exe»=
«c:\Program Files\Olympus P2P\Olympusp2p.exe»=R1 aswSP;avast! Self Protection;c:windowssystem32driversaswSP.sys [19.02.2009 3:48 114768]
R2 aswFsBlk;aswFsBlk;c:windowssystem32driversaswFsBlk.sys [19.02.2009 3:48 20560]
S3 getPlus(R) Helper;getPlus(R) Helper;c:program filesNOSbingetPlus_HelperSvc.exe [06.02.2009 12:50 33752]
.
Contents of the ‘Scheduled Tasks’ folder2009-05-25 c:windowsTasksScheduled Update for Ask Toolbar.job
— c:program filesAsk.comSupertoolbarUpdateTask.exe [2008-10-21 06:13]
.
— — — — ORPHANS REMOVED — — — —SafeBoot-procexp90.Sys
.
Supplementary Scan
.
uStart Page = about:blank
uDefault_Search_URL = hxxp://search.qip.ru
uSearchURL,(Default) = hxxp://search.qip.ru/search?query=%s&from=IE
IE: &Экспорт в Microsoft Excel — c:progra~1MICROS~2OFFICE11EXCEL.EXE/3000
IE: Convert link target to Adobe PDF — c:program filesAdobeAcrobat 7.0AcrobatAcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF — c:program filesAdobeAcrobat 7.0AcrobatAcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF — c:program filesAdobeAcrobat 7.0AcrobatAcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF — c:program filesAdobeAcrobat 7.0AcrobatAcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF — c:program filesAdobeAcrobat 7.0AcrobatAcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF — c:program filesAdobeAcrobat 7.0AcrobatAcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF — c:program filesAdobeAcrobat 7.0AcrobatAcroIEFavClient.dll/AcroIECapture.html
IE: Convert to existing PDF — c:program filesAdobeAcrobat 7.0AcrobatAcroIEFavClient.dll/AcroIEAppend.html
IE: Олимпус: Определить &тип трафика — c:program filesInternet ExplorerSIGNUPchecker.htm
TCP: {93C193B1-08F8-45C9-92DD-0EE677979D26} = 217.76.183.36 217.76.183.38
TCP: {CC2518A5-0FB9-4E54-90A0-44B7AC9237BC} = 10.0.0.1,10.0.0.2
.**************************************************************************
catchme 0.3.1398 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-26 02:35
Windows 5.1.2600 Service Pack 3 NTFSscanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0**************************************************************************
.
DLLs Loaded Under Running Processes
— — — — — — — > ‘explorer.exe'(4080)
c:windowssystem32WPDShServiceObj.dll
c:windowssystem32PortableDeviceTypes.dll
c:windowssystem32PortableDeviceApi.dll
.
Completion time: 2009-05-25 2:37
ComboFix-quarantined-files.txt 2009-05-25 20:37Pre-Run: 15 062 896 640 байт свободно
Post-Run: 15 047 774 208 байт свободно169 — E O F — 2009-04-15 17:15
- Для ответа в этой теме необходимо авторизоваться.
