Помогите убрать ленту новостей

This topic has 1 ответ, 2 участника, and was last updated 16 years, 6 months назад by Admin.

Просмотр 2 сообщений - с 1 по 2 (из 2 всего)

Автор

Сообщения
20 января, 2009 в 6:16 пп #16166
alpha
Participant
- Темы:1
- Сообщений:1
Запустили программу RSIT, результаты работы программы:
Logfile of random’s system information tool 1.05 (written by random/random)
Run by uname at 2009-01-21 01:02:05
Microsoft Windows XP Professional Service Pack 2
System drive C: has 186 GB (78%) free of 238 GB
Total RAM: 2047 MB (71% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:03:01, on 21.01.2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32Ati2evxx.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32Ati2evxx.exe
C:WINDOWSExplorer.EXE
C:WINDOWSsystem32spoolsv.exe
C:PROGRA~1DrWeb444spidernt.exe
C:WINDOWSsystem32svchost.exe
C:Program FilesCyberLinkPowerDVDPDVDServ.exe
C:Program FilesCommon FilesACD SystemsENDevDetect.exe
C:Program FilesHPHP Software UpdateHPWuSchd2.exe
C:ppcableppchkcab.exe
C:WINDOWSRTHDCPL.EXE
C:Program FilesDrWeb444spiderml.exe
C:Program FilesDrWeb444DRWEBSCD.EXE
C:PROGRA~1DrWeb444spiderui.exe
C:Program FilesNokiaNokia PC Suite 6LaunchApplication.exe
C:Program FilesHPDigital Imagingbinhpqtra08.exe
C:Program FilesPC Connectivity SolutionServiceLayer.exe
C:UtilsDiskTempDTemp.exe
C:Program FilesHPDigital Imagingbinhpqimzone.exe
C:PROGRA~1COMMON~1PCSuiteDATALA~1DATALA~1.EXE
C:Program FilesHPDigital ImagingbinhpqSTE08.exe
C:Program FilesInternet ExplorerIEXPLORE.EXE
C:WINDOWSsystem32HPZipm12.exe
C:Documents and SettingsunameMy DocumentsMy MusicновоеRSIT.exe
C:Program Filestrend microuname.exe

R0 — HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.yandex.ru/?clid=40316
R3 — URLSearchHook: (no name) — {83821C2B-32A8-4DD7-B6D4-44309A78E668} — C:Documents and SettingsunameApplication DataMail.RuAgentMradllnewmrasearch.dll (file missing)
F2 — REG:system.ini: UserInit=C:WINDOWSsystem32userinit.exe,C:WINDOWSsorry.exe
O2 — BHO: AcroIEHlprObj Class — {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} — C:Program FilesAdobeAcrobat 5.0ReaderActiveXAcroIEHelper.ocx
O2 — BHO: mvvlibP — {1A6F66F8-04C0-414D-881B-91B2253C5960} — C:Documents and SettingsAll UsersApplication Datamvvlib.dll
O3 — Toolbar: PROMT — {FF284F5C-7CF9-4682-8701-D467C1DBB99F} — C:Program FilesPRMT6PRMTIEprmtie.dll
O4 — HKLM..Run: [NeroFilterCheck] C:WINDOWSsystem32NeroCheck.exe
O4 — HKLM..Run: [RemoteControl] «C:Program FilesCyberLinkPowerDVDPDVDServ.exe»
O4 — HKLM..Run: [WinampAgent] C:Program FilesWinampwinampa.exe
O4 — HKLM..Run: [Device Detector] «C:Program FilesCommon FilesACD SystemsENDevDetect.exe» -autorun
O4 — HKLM..Run: [SchedulingAgent] mstinit.exe /firstlogon
O4 — HKLM..Run: [HP Software Update] C:Program FilesHPHP Software UpdateHPWuSchd2.exe
O4 — HKLM..Run: [PenpowerCableTsr] C:ppcableppchkcab.exe
O4 — HKLM..Run: [RTHDCPL] RTHDCPL.EXE
O4 — HKLM..Run: [SkyTel] SkyTel.EXE
O4 — HKLM..Run: [Alcmtr] ALCMTR.EXE
O4 — HKLM..Run: [SpIDerMail] «C:Program FilesDrWeb444spiderml.exe»
O4 — HKLM..Run: [DrWebScheduler] «C:Program FilesDrWeb444DRWEBSCD.EXE»
O4 — HKLM..Run: [SpIDerNT] C:PROGRA~1DrWeb444spiderui.exe /agent
O4 — HKLM..Run: [PCSuiteTrayApplication] C:Program FilesNokiaNokia PC Suite 6LaunchApplication.exe -startup
O4 — HKLM..RunServices: [SchedulingAgent] mstask.exe
O4 — HKCU..Run: [NBJ] «C:Program FilesAheadNero BackItUpNBJ.exe»
O4 — HKCU..Run: [QIP.Online] C:Program FilesQIP.Onlineqiponline.exe auto_start
O4 — HKUSS-1-5-19..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘LOCAL SERVICE’)
O4 — HKUSS-1-5-20..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘NETWORK SERVICE’)
O4 — HKUSS-1-5-18..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘SYSTEM’)
O4 — HKUS.DEFAULT..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘Default user’)
O4 — Startup: Ярлык для DTemp.lnk = C:UtilsDiskTempDTemp.exe
O4 — Global Startup: HP Digital Imaging Monitor.lnk = C:Program FilesHPDigital Imagingbinhpqtra08.exe
O4 — Global Startup: Быстрый запуск HP Photosmart Premier.lnk = C:Program FilesHPDigital Imagingbinhpqthb08.exe
O8 — Extra context menu item: &Экспорт в Microsoft Excel — res://C:PROGRA~1MICROS~2OFFICE11EXCEL.EXE/3000
O9 — Extra button: (no name) — {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} — C:Program FilesPRMT6PRMTIEprmtie5.htm
O9 — Extra ‘Tools’ menuitem: Перевести — {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} — C:Program FilesPRMT6PRMTIEprmtie5.htm
O9 — Extra button: (no name) — {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} — C:Program FilesPRMT6PRMTIEoptions.htm
O9 — Extra ‘Tools’ menuitem: Настройка параметров перевода — {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} — C:Program FilesPRMT6PRMTIEoptions.htm
O9 — Extra button: Справочные материалы — {92780B25-18CC-41C8-B9BE-3C9C571A8263} — C:PROGRA~1MICROS~2OFFICE11REFIEBAR.DLL
O9 — Extra button: Messenger — {FB5F1910-F110-11d2-BB9E-00C04F795683} — C:Program FilesMessengermsmsgs.exe
O9 — Extra ‘Tools’ menuitem: Windows Messenger — {FB5F1910-F110-11d2-BB9E-00C04F795683} — C:Program FilesMessengermsmsgs.exe
O12 — Plugin for .spop: C:Program FilesInternet ExplorerPluginsNPDocBox.dll
O17 — HKLMSystemCCSServicesTcpip..{F34E25A6-8D6D-4600-81AC-F5B0EC78A593}: NameServer = 217.116.128.9,217.116.129.9
O18 — Protocol: mmdtp — {E62C17EA-223C-4022-881D-2796CCD31CA6} — C:Program FilesЗолотой фондmmdtp.dll
O23 — Service: Ati HotKey Poller — ATI Technologies Inc. — C:WINDOWSsystem32Ati2evxx.exe
O23 — Service: ATI Smart — Unknown owner — C:WINDOWSsystem32ati2sgag.exe
O23 — Service: Pml Driver HPZ12 — HP — C:WINDOWSsystem32HPZipm12.exe
O23 — Service: ServiceLayer — Nokia. — C:Program FilesPC Connectivity SolutionServiceLayer.exe
O23 — Service: SpIDer Guard for Windows (SPIDERNT) — Doctor Web, Ltd. — C:PROGRA~1DrWeb444spidernt.exe

—
End of file — 5878 bytes

======Registry dump======

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class — C:Program FilesAdobeAcrobat 5.0ReaderActiveXAcroIEHelper.ocx [2001-04-16 37808]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{1A6F66F8-04C0-414D-881B-91B2253C5960}]
WV Video Decoder — C:Documents and SettingsAll UsersApplication Datamvvlib.dll [2009-01-20 323072]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
{FF284F5C-7CF9-4682-8701-D467C1DBB99F} — PROMT — C:Program FilesPRMT6PRMTIEprmtie.dll [2005-11-10 434176]

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun]
«NeroFilterCheck»=C:WINDOWSsystem32NeroCheck.exe [2007-08-31 155648]
«RemoteControl»=C:Program FilesCyberLinkPowerDVDPDVDServ.exe [2004-11-02 32768]
«WinampAgent»=C:Program FilesWinampwinampa.exe []
«Device Detector»=C:Program FilesCommon FilesACD SystemsENDevDetect.exe [2003-09-17 212992]
«SchedulingAgent»=mstinit.exe /firstlogon []
«HP Software Update»=C:Program FilesHPHP Software UpdateHPWuSchd2.exe [2006-02-19 49152]
«PenpowerCableTsr»=C:ppcableppchkcab.exe [2006-07-25 90112]
«RTHDCPL»=C:WINDOWSRTHDCPL.EXE [2007-10-25 16855552]
«SkyTel»=C:WINDOWSSkyTel.EXE [2007-10-11 1826816]
«Alcmtr»=C:WINDOWSALCMTR.EXE [2005-05-03 69632]
«SpIDerMail»=C:Program FilesDrWeb444spiderml.exe [2008-06-10 501080]
«DrWebScheduler»=C:Program FilesDrWeb444DRWEBSCD.EXE [2008-05-05 283888]
«SpIDerNT»=C:PROGRA~1DrWeb444spiderui.exe [2008-10-23 197896]
«PCSuiteTrayApplication»=C:Program FilesNokiaNokia PC Suite 6LaunchApplication.exe [2007-03-23 227328]

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun]
«NBJ»=C:Program FilesAheadNero BackItUpNBJ.exe [2007-08-31 1937408]
«QIP.Online»=C:Program FilesQIP.Onlineqiponline.exe auto_start []

C:Documents and SettingsAll UsersStart MenuProgramsStartup
HP Digital Imaging Monitor.lnk — C:Program FilesHPDigital Imagingbinhpqtra08.exe
Быстрый запуск HP Photosmart Premier.lnk — C:Program FilesHPDigital Imagingbinhpqthb08.exe

C:Documents and SettingsunameStart MenuProgramsStartup
Ярлык для DTemp.lnk — C:UtilsDiskTempDTemp.exe

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifyAtiExtEvent]
C:WINDOWSsystem32Ati2evxx.dll [2008-07-04 139264]

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
«dontdisplaylastusername»=0
«legalnoticecaption»=
«legalnoticetext»=
«shutdownwithoutlogon»=1
«undockwithoutlogon»=1

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoDriveTypeAutoRun»=145
«EditLevel»=0
«NoRun»=0
«NoClose»=0
«NoCommonGroups»=0

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicystandardprofileauthorizedapplicationslist]
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»
«C:Program FilesBukaFar CryBin32FarCry.exe»=»C:Program FilesBukaFar CryBin32FarCry.exe:*:Disabled:Far Cry»
«C:Program FilesHPDigital Imagingbinhpqtra08.exe»=»C:Program FilesHPDigital Imagingbinhpqtra08.exe:*:Enabled:hpqtra08.exe»
«C:Program FilesHPDigital Imagingbinhpqste08.exe»=»C:Program FilesHPDigital Imagingbinhpqste08.exe:*:Enabled:hpqste08.exe»
«C:Program FilesHPDigital Imagingbinhpofxm08.exe»=»C:Program FilesHPDigital Imagingbinhpofxm08.exe:*:Enabled:hpofxm08.exe»
«C:Program FilesHPDigital Imagingbinhposfx08.exe»=»C:Program FilesHPDigital Imagingbinhposfx08.exe:*:Enabled:hposfx08.exe»
«C:Program FilesHPDigital Imagingbinhposid01.exe»=»C:Program FilesHPDigital Imagingbinhposid01.exe:*:Enabled:hposid01.exe»
«C:Program FilesHPDigital Imagingbinhpqscnvw.exe»=»C:Program FilesHPDigital Imagingbinhpqscnvw.exe:*:Enabled:hpqscnvw.exe»
«C:Program FilesHPDigital Imagingbinhpqkygrp.exe»=»C:Program FilesHPDigital Imagingbinhpqkygrp.exe:*:Enabled:hpqkygrp.exe»
«C:Program FilesHPDigital ImagingbinhpqCopy.exe»=»C:Program FilesHPDigital ImagingbinhpqCopy.exe:*:Enabled:hpqcopy.exe»
«C:Program FilesHPDigital Imagingbinhpfccopy.exe»=»C:Program FilesHPDigital Imagingbinhpfccopy.exe:*:Enabled:hpfccopy.exe»
«C:Program FilesHPDigital Imagingbinhpzwiz01.exe»=»C:Program FilesHPDigital Imagingbinhpzwiz01.exe:*:Enabled:hpzwiz01.exe»
«C:Program FilesHPDigital ImagingUnloadHpqPhUnl.exe»=»C:Program FilesHPDigital ImagingUnloadHpqPhUnl.exe:*:Enabled:hpqphunl.exe»
«C:Program FilesHPDigital ImagingUnloadHpqDIA.exe»=»C:Program FilesHPDigital ImagingUnloadHpqDIA.exe:*:Enabled:hpqdia.exe»
«C:Program FilesHPDigital Imagingbinhpoews01.exe»=»C:Program FilesHPDigital Imagingbinhpoews01.exe:*:Enabled:hpoews01.exe»
«C:Program FilesHPDigital Imagingbinhpqnrs08.exe»=»C:Program FilesHPDigital Imagingbinhpqnrs08.exe:*:Enabled:hpqnrs08.exe»
«C:Program FilesQIP Infiuminfium.exe»=»C:Program FilesQIP Infiuminfium.exe:*:Enabled:QIP Infium»

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicydomainprofileauthorizedapplicationslist]
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{988c9240-9ce7-11dc-bbb3-00115b6ebaa9}]
shellAutoRuncommand — E:RECYCLERS-1-5-21-1482476501-1644491937-682003330-1013spoolsv.exe
shellopencommand — E:RECYCLERS-1-5-21-1482476501-1644491937-682003330-1013spoolsv.exe

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{9ce73d04-447d-11db-b8af-00115b6ebaa9}]
shellAutoRuncommand — C:WINDOWSsystem32RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycledautorun.exe
shellOpencommand — E:Recycledautorun.exe

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{ade38362-25a2-11dd-bb03-00115b6ebaa9}]
shellAutoRuncommand — C:WINDOWSsystem32RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL copy.exe

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{c7661448-49a3-11dc-ba1e-00115b6ebaa9}]
shellAutoRuncommand — C:WINDOWSsystem32RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycledautorun.exe
shellOpencommand — E:Recycledautorun.exe

======List of files/folders created in the last 1 months======

2009-01-21 01:02:06 —-D—- C:Program Filestrend micro
2009-01-21 01:02:05 —-D—- C:rsit
2009-01-20 21:43:38 —-HD—- C:WINDOWSsystem32GroupPolicy
2009-01-20 21:28:59 —-A—- C:Documents and SettingsAll UsersApplication Datamvvlib.dll
2009-01-03 22:08:08 —-D—- C:Program Files1C
2009-01-03 18:24:21 —-D—- C:WINDOWSsystem32appmgmt
2009-01-03 17:53:16 —-D—- C:Program Filesubi.com
2009-01-03 15:14:32 —-D—- C:Program Filesdirectx
2008-12-27 18:37:32 —-D—- C:Documents and SettingsunameApplication DataMra
2008-12-26 16:00:12 —-D—- C:Documents and SettingsunameApplication DataQIP.Online
2008-12-26 15:46:28 —-D—- C:Documents and SettingsunameApplication DataQIP
2008-12-26 15:46:08 —-D—- C:Program FilesQIP Infium
2008-12-25 16:37:14 —-D—- C:Documents and SettingsunameApplication DataNokia Multimedia Player
2008-12-25 16:26:20 —-D—- C:Documents and SettingsAll UsersApplication DataPC Suite
2008-12-25 16:26:06 —-D—- C:Documents and SettingsunameApplication DataNokia
2008-12-25 16:25:53 —-D—- C:Program FilesCommon FilesPCSuite
2008-12-25 16:25:53 —-D—- C:Program FilesCommon FilesNokia
2008-12-25 16:25:46 —-D—- C:Program FilesDIFX
2008-12-25 16:25:45 —-D—- C:Documents and SettingsunameApplication DataPC Suite
2008-12-25 16:25:41 —-D—- C:Program FilesPC Connectivity Solution
2008-12-25 16:25:34 —-D—- C:Program FilesNokia
2008-12-25 16:24:20 —-D—- C:Documents and SettingsAll UsersApplication DataInstallations
2008-12-25 16:22:05 —-D—- C:Documents and SettingsunameApplication DataMacromedia
2008-12-23 15:44:09 —-A—- C:WINDOWSWINCMD.INI
2008-12-23 15:39:46 —-AT—- C:WINDOWSsystem32DRWEBSP.DLL
2008-12-23 15:39:36 —-D—- C:Program FilesDrWeb444
2008-12-23 15:39:14 —-D—- C:Documents and SettingsunameApplication DataInstallShield
2008-12-23 14:20:40 —-A—- C:Program Fileslaunch.exe
2008-12-23 14:20:26 —-A—- C:Program Filesdrweb-444-win-as-ru.exe
2008-12-23 14:19:18 —-D—- C:Program FilesAVZ
2008-12-23 13:57:18 —-RA—- C:WINDOWSsystem32ATIDEMGX.dll
2008-12-23 13:55:42 —-D—- C:WINDOWSsystem32Lang
2008-12-23 13:48:41 —-D—- C:WINDOWSsystem32Atheros_L1
2008-12-23 13:48:13 —-D—- C:WINDOWSsystem32RTCOM
2008-12-23 13:48:05 —-R—- C:WINDOWSSkyTel.exe
2008-12-23 13:48:04 —-R—- C:WINDOWSRtlUpd.exe
2008-12-23 13:48:01 —-R—- C:WINDOWSRTLCPL.exe
2008-12-23 13:47:54 —-R—- C:WINDOWSRTHDCPL.exe
2008-12-23 13:47:53 —-R—- C:WINDOWSMicCal.exe
2008-12-23 13:47:51 —-R—- C:WINDOWSAlcmtr.exe
2008-12-23 13:47:50 —-R—- C:WINDOWSalcwzrd.exe
2008-12-23 13:47:50 —-D—- C:Program FilesRealtek
2008-12-23 13:47:47 —-R—- C:WINDOWSRtlExUpd.dll
2008-12-23 13:47:47 —-A—- C:WINDOWSHideWin.exe
2008-12-23 13:46:44 —-A—- C:WINDOWSsystem32spupdsvc.exe
2008-12-23 13:46:43 —-HDC—- C:WINDOWS$NtUninstallKB888111WXPSP2$
2008-12-23 13:42:40 —-DC—- C:WINDOWSsystem32DRVSTORE
2008-12-23 13:41:18 —-D—- C:Intel
2008-12-23 12:06:37 —-A—- C:WINDOWSntbtlog.txt

======List of files/folders modified in the last 1 months======

2009-01-21 01:02:59 —-D—- C:Tempo
2009-01-21 01:02:40 —-D—- C:WINDOWSPrefetch
2009-01-21 01:02:06 —-RD—- C:Program Files
2009-01-21 00:17:41 —-D—- C:WINDOWS
2009-01-21 00:17:30 —-D—- C:WINDOWSTemp
2009-01-21 00:10:59 —-A—- C:WINDOWSSchedLgU.Txt
2009-01-20 23:45:35 —-A—- C:WINDOWSabtlfu.INI
2009-01-20 22:28:57 —-A—- C:WINDOWSwinamp.ini
2009-01-20 21:43:38 —-D—- C:WINDOWSsystem32
2009-01-19 01:18:08 —-D—- C:WINDOWSsecurity
2009-01-18 22:51:06 —-D—- C:WINDOWSsystem32CatRoot2
2009-01-18 16:13:56 —-D—- C:WINDOWSsystem32drivers
2009-01-15 15:57:14 —-A—- C:WINDOWSNeroDigital.ini
2009-01-03 21:04:05 —-HD—- C:WINDOWSinf
2009-01-03 21:04:05 —-D—- C:Program FilesMSN
2009-01-03 20:58:31 —-A—- C:WINDOWSRtlRack.ini
2009-01-03 18:19:28 —-SHD—- C:WINDOWSInstaller
2009-01-03 18:19:28 —-HD—- C:Program FilesInstallShield Installation Information
2009-01-03 18:19:26 —-HD—- C:Config.Msi
2009-01-03 18:17:21 —-D—- C:Program FilesCommon Files
2008-12-27 15:17:57 —-D—- C:Documents and SettingsunameApplication DataMail.Ru
2008-12-26 17:25:29 —-D—- C:Documents and SettingsunameApplication DataAdobe
2008-12-26 15:15:06 —-SD—- C:Documents and SettingsunameApplication DataMicrosoft
2008-12-24 09:51:35 —-D—- C:Документы
2008-12-23 22:00:50 —-SHD—- C:WINDOWSRecycled
2008-12-23 21:59:27 —-SHD—- C:RECYCLER
2008-12-23 14:22:54 —-D—- C:Program FilesEset
2008-12-23 14:17:03 —-RSHDC—- C:WINDOWSsystem32dllcache
2008-12-23 13:48:11 —-A—- C:WINDOWSsystem32PerfStringBackup.INI
2008-12-23 13:47:37 —-A—- C:WINDOWSAscd_tmp.ini
2008-12-23 13:42:08 —-SHD—- C:System Volume Information
2008-12-23 13:42:08 —-D—- C:WINDOWSsystem32Restore
2008-12-23 13:21:29 —-RSD—- C:WINDOWSassembly

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 intelppm;Intel Processor Driver; C:WINDOWSsystem32DRIVERSintelppm.sys [2004-08-04 36096]
R1 prodrv06;StarForce Protection Environment Driver v6; C:WINDOWSSystem32driversprodrv06.sys [2004-07-06 79232]
R1 WS2IFSL;Среда Windows Socket 2.0 поддержки поставщиков не-IFS служб; C:WINDOWSSystem32driversws2ifsl.sys [2001-08-23 12032]
R2 SPIDER;SpIDer Guard File System Monitor; ??C:PROGRA~1DrWeb444spider.sys []
R3 AtcL001;NDIS Miniport Driver for Atheros L1 Gigabit Ethernet Controller; C:WINDOWSsystem32DRIVERSl151x86.sys [2007-11-01 36864]
R3 ati2mtag;ati2mtag; C:WINDOWSsystem32DRIVERSati2mtag.sys [2008-07-04 3230720]
R3 AtiHdmiService;ATI Function Driver for HDMI Service; C:WINDOWSsystem32driversAtiHdmi.sys [2008-05-21 93696]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:WINDOWSsystem32DRIVERSHDAudBus.sys [2005-01-07 138752]
R3 HidUsb;Microsoft HID Class Driver; C:WINDOWSsystem32DRIVERShidusb.sys [2001-08-17 9600]
R3 HPZid412;IEEE-1284.4 Driver HPZid412; C:WINDOWSsystem32DRIVERSHPZid412.sys [2006-04-13 49664]
R3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:WINDOWSsystem32DRIVERSHPZipr12.sys [2006-04-13 16496]
R3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:WINDOWSsystem32DRIVERSHPZius12.sys [2006-04-13 21568]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:WINDOWSsystem32driversRtkHDAud.sys [2007-11-01 4620288]
R3 MTsensor;ATK0110 ACPI UTILITY; C:WINDOWSsystem32DRIVERSASACPI.sys [2004-08-13 5810]
R3 pfc;Padus ASPI Shell; C:WINDOWSsystem32driverspfc.sys [2005-06-14 9856]
R3 ROOTMODEM;Microsoft Legacy Modem Driver; C:WINDOWSSystem32DriversRootMdm.sys [2001-08-23 5888]
R3 RTL8023;Realtek RTL8139/810x/8169/8110 all in one NDIS NT Driver; C:WINDOWSsystem32DRIVERSRtlnic51.sys [2003-12-31 69504]
R3 usbccgp;Microsoft USB Generic Parent Driver; C:WINDOWSsystem32DRIVERSusbccgp.sys [2004-08-03 31616]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:WINDOWSsystem32DRIVERSusbehci.sys [2004-08-03 26624]
R3 usbhub;Microsoft USB Standard Hub Driver; C:WINDOWSsystem32DRIVERSusbhub.sys [2004-08-03 57600]
R3 usbprint;Microsoft USB PRINTER Class; C:WINDOWSsystem32DRIVERSusbprint.sys [2004-08-03 25856]
R3 usbscan;USB Scanner Driver; C:WINDOWSsystem32DRIVERSusbscan.sys [2004-08-03 15104]
R3 USBSTOR;USB Mass Storage Driver; C:WINDOWSsystem32DRIVERSUSBSTOR.SYS [2004-08-03 26496]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:WINDOWSsystem32DRIVERSusbuhci.sys [2004-08-03 20480]
S3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:WINDOWSsystem32driversALCXWDM.SYS [2004-09-21 2278784]
S3 ENTECH;ENTECH; ??C:WINDOWSsystem32DRIVERSENTECH.SYS []
S3 FXDRV;FXDRV; ??D:Fxdrv.sys []
S3 mouhid;Mouse HID Driver; C:WINDOWSsystem32DRIVERSmouhid.sys [2001-08-17 12160]
S3 Nokia USB Generic;Nokia USB Generic; C:WINDOWSsystem32driversnmwcdc.sys [2006-05-29 8704]
S3 Nokia USB Modem;Nokia USB Modem; C:WINDOWSsystem32driversnmwcdcm.sys [2006-05-29 13312]
S3 Nokia USB Phone Parent;Nokia USB Phone Parent; C:WINDOWSsystem32driversnmwcd.sys [2007-02-22 137216]
S3 Nokia USB Port;Nokia USB Port; C:WINDOWSsystem32driversnmwcdcj.sys [2006-05-29 13312]
S3 rtl8139;Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver; C:WINDOWSsystem32DRIVERSRTL8139.SYS [2004-08-03 20992]
S3 SONYPVU1;Sony USB Filter Driver (SONYPVU1); C:WINDOWSsystem32DRIVERSSONYPVU1.SYS [2001-08-17 7552]
S3 USB-100;Realtek RTL8150 USB 10/100 Fast Ethernet Adapter; C:WINDOWSsystem32DRIVERSRTL8150.SYS [2002-02-22 26505]
S3 usbohci;Microsoft USB Open Host Controller Miniport Driver; C:WINDOWSsystem32DRIVERSusbohci.sys [2004-08-04 17024]
S3 WpdUsb;WpdUsb; C:WINDOWSSystem32Driverswpdusb.sys [2004-08-11 18944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Ati HotKey Poller;Ati HotKey Poller; C:WINDOWSsystem32Ati2evxx.exe [2008-07-04 561152]
R2 Pml Driver HPZ12;Pml Driver HPZ12; C:WINDOWSsystem32HPZipm12.exe [2006-03-03 69632]
R2 SPIDERNT;SpIDer Guard for Windows; C:PROGRA~1DrWeb444spidernt.exe [2008-10-23 197896]
R2 UMWdf;Windows User Mode Driver Framework; C:WINDOWSsystem32wdfmgr.exe [2004-08-11 38912]
R3 ServiceLayer;ServiceLayer; C:Program FilesPC Connectivity SolutionServiceLayer.exe [2007-03-26 292864]
S2 ATI Smart;ATI Smart; C:WINDOWSsystem32ati2sgag.exe [2005-05-12 516096]
S3 aspnet_state;ASP.NET State Service; C:WINDOWSMicrosoft.NETFrameworkv1.1.4322aspnet_state.exe [2003-02-20 32768]
S3 ose;Office Source Engine; C:Program FilesCommon FilesMicrosoft SharedSource EngineOSE.EXE [2003-07-28 89136]

EOF

info.txt logfile of random’s system information tool 1.05 2009-01-21 01:03:02

======Uninstall list======

—>rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:WINDOWSINFPCHealth.inf
3DMark03—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1PROFES~1RunTime701Intel32Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{FF35F637-72B9-43BE-A281-06EB2854393A}Setup.exe» -l0x9
ACDSee 6.0 Standard Trial—>MsiExec.exe /I{E60EF56C-C330-4575-8463-921E70D1458B}
Adobe Acrobat 5.0—>C:WINDOWSISUNINST.EXE -f»C:Program FilesCommon FilesAdobeAcrobat 5.0NTUninst.isu» -c»C:Program FilesCommon FilesAdobeAcrobat 5.0NTUninst.dll»
Adobe Flash Player 10 ActiveX—>C:WINDOWSsystem32MacromedFlashuninstall_activeX.exe
Atheros Communications Inc.(R) L1 Gigabit Ethernet Driver—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1PROFES~1RunTime110Intel32Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{6E19F210-3813-4002-B561-94D66AA182B6}Setup.exe» -l0x9 -removeonly
ATI — Software Uninstall Utility—>C:Program FilesATI TechnologiesUninstallAllAtiCimUn.exe
ATI Display Driver—>rundll32 C:WINDOWSsystem32atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
Chicken Invaders v1.30—>»C:Program FilesChicken Invadersunins000.exe»
Dr.Web—>»C:Program FilesInstallShield Installation Information{BBE2F69C-4338-11D7-8F0C-00A0244F4E2D}setup.exe» -runfromtemp -l0x0019 -removeonly
EVEREST Ultimate Edition v2.00—>»C:Program FilesLavalysEVEREST Ultimate Editionunins000.exe»
FAR file manager—>C:Program FilesFarUninstall.exe
Freelancer—>C:PROGRA~1MICROS~3FREELA~1UNWISE.EXE C:PROGRA~1MICROS~3FREELA~1INSTALL.LOG
HD Tach version 3—>»C:Program FilesSimpli SoftwareHD Tachunins000.exe»
High Definition Audio Driver Package — KB888111—>»C:WINDOWS$NtUninstallKB888111WXPSP2$spuninstspuninst.exe»
HijackThis 2.0.2—>»C:Program Filestrend microHijackThis.exe» /uninstall
HP Customer Participation Program 7.0—>C:Program FilesHPDigital ImagingExtCapUninstallhpzscr01.exe -datfile hpqhsc01.dat
HP Document Viewer 7.0—>C:Program FilesHPDigital ImagingDocumentViewerhpzscr01.exe -datfile hpqbud04.dat
HP Imaging Device Functions 7.0—>C:Program FilesHPDigital ImagingDeviceManagementhpzscr01.exe -datfile hpqbud01.dat
HP Photosmart Premier Software 6.5—>C:Program FilesHPDigital Imaginguninstallhpzscr01.exe -datfile hpqscr01.dat
HP Photosmart, Officejet and Deskjet 7.0.A—>C:Program FilesHPDigital Imaging{BDBE2F3E-42DB-4d4a-8CB1-19BA765DBC6C}setuphpzscr01.exe -datfile hposcr11.dat
HP Software Update—>MsiExec.exe /X{BB85ED9C-AFC9-43BD-B8DC-258C3C7DF72E}
HP Solution Center 7.0—>C:Program FilesHPDigital ImagingeSupporthpzscr01.exe -datfile hpqbud05.dat
K-Lite Mega Codec Pack 1.29—>»C:Program FilesK-Lite Codec Packunins000.exe»
L&H TTS3000 Russian—>RunDll32 advpack.dll,LaunchINFSection C:WINDOWSINFLHTTSRUR.inf, Uninstall
Lernout & Hauspie TruVoice American English TTS Engine—>RunDll32 advpack.dll,LaunchINFSection C:WINDOWSINFtv_enua.inf, Uninstall
LogoManager for Nokia Phones—>C:Program FilesLogoManagerUninstall.exe
Microsoft .NET Framework 1.1 Russian Language Pack—>MsiExec.exe /X{2BB372D9-52B4-410A-BC1A-FEAB63181EEF}
Microsoft .NET Framework 1.1—>MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft Office — профессиональный выпуск версии 2003—>MsiExec.exe /I{90110419-6000-11D3-8CFE-0150048383C9}
Microsoft Visual C++ 2005 Redistributable—>MsiExec.exe /X{A49F249F-0C91-497F-86DF-B2585E8E76B7}
MobiMB Mobile Media Browser—>C:Program FilesMobiMB Mobile Media Browser_Unins.exe
Mobius Phone Explorer—>C:Program FilesMobius Phone Explorer_Unins.exe
MSN—>C:Program FilesMSNMsnInstallermsninst.exe /Action:ARP
Nero 6 Enterprise Edition—>C:Program FilesAheadnerouninstallUNNERO.exe /UNINSTALL
Nokia Connectivity Cable Driver—>MsiExec.exe /X{972B1D9B-0EAD-49E8-B7D6-3B83FD5665B1}
Nokia PC Suite—>C:Documents and SettingsAll UsersApplication DataInstallations{57A48477-92F0-4C1F-ADF9-4806C4EC3CF2}Nokia_PC_Suite_683_rel_14_1_EA.exe /LANG=»1049″
Nokia PC Suite—>MsiExec.exe /I{57A48477-92F0-4C1F-ADF9-4806C4EC3CF2}
OCR Software by I.R.I.S 7.0—>C:Program FilesHPDigital ImagingOCRhpzscr01.exe -datfile hpqbud11.dat
PC Connectivity Solution—>MsiExec.exe /I{066D65EA-ED53-44E4-A96A-F81B6E409D2E}
PenPower WorldPhone for Cable—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1PROFES~1RunTime1050Intel32Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{A0A45276-273D-41C1-84B6-0EFB5BF4CABB}setup.exe» -l0x19 -removeonly
PowerDVD—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1engine6INTEL3~1Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}Setup.exe» -uninstall
QIP Infium 2.0.9020 RC3—>»C:Program FilesQIP Infiumunins000.exe»
Realtek AC’97 Audio—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1engine6INTEL3~1ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{FB08F381-6533-4108-B7DD-039E11FBC27E}setup.exe» REMOVE
Realtek High Definition Audio Driver—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1PROFES~1RunTime1150Intel32Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}setup.exe» -l0x19 -removeonly
RoverMedia Aria M3—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1PROFES~1RunTime100Intel32Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{F1E6A335-D917-46C5-A8B8-20287261F4AD}Setup.exe» -l0x19 -removeonly
Skypad—>C:WINDOWSUSTORAGE-1.1.2.0.EXE -u
Snowboarding Championship 2004—>C:PROGRA~1SNOWBO~1UNWISE.EXE C:PROGRA~1SNOWBO~1INSTALL.LOG
Ultrafighters—>C:WINDOWSIsUninst.exe -fC:I-MagicUltrafightersUninst.isu
Winamp (remove only)—>»C:Program FilesWinampUninstWA.exe»
Windows Driver Package — Nokia (WUDFRd) WPD (03/19/2007 6.83.31.1)—>C:PROGRA~1DIFXD6ACC4BE676423A2B130B78A4B627FC457D98997dpinst.exe /u C:WINDOWSsystem32DRVSTOREpccswpddri_039E7E24575DBAE6A389611AF28F4EB97729D33Epccswpddriver.inf
Windows Driver Package — Nokia Modem (02/15/2007 3.1)—>C:PROGRA~1DIFXD6ACC4BE676423A2B130B78A4B627FC457D98997dpinst.exe /u C:WINDOWSsystem32DRVSTOREpccs_bluet_8B37DC72918CCD58A6EC20373AF6242B037A293Bpccs_bluetooth.inf
Windows Installer 3.1 (KB893803)—>»C:WINDOWS$MSI31Uninstall_KB893803v2$spuninstspuninst.exe»
Windows Media Format Runtime—>»C:Program FilesWindows Media Playerwmsetsdk.exe» /UninstallAll
Windows Media Player 10—>»C:Program FilesWindows Media PlayerSetup_wm.exe» /Uninstall
X-Translator Revolution ERRE—>MsiExec.exe /I{17630E88-477D-4423-92A8-62E64DC6DF38}
Архиватор WinRAR (только удаление)—>C:Program FilesWinRARuninstall.exe
Большая Советская энциклопедия—>C:Program FilesЗолотой фондUnInstall.exe 1
ИЛ-2 Штурмовик—>C:WINDOWSunin0419.exe -f»C:Program Files1CIL2DeIsL1.isu»
Каталог рекомендаций Castrol—>»C:WINDOWSКаталог рекомендаций Castroluninstall.exe» «/U:C:Program FilesCastrolUninstalluninstall.xml»
Пакет драйверов Windows — Nokia Modem (11/03/2006 6.82.0.1)—>C:PROGRA~1DIFX270581355A767BF1dpinst.exe /u C:WINDOWSsystem32DRVSTOREnokbtmdm_4EFFAAE27A08EDFDE145390033D8EF099DA65567nokbtmdm.inf

======Security center information======

AV: Doctor Web Anti-Virus

System event log

Computer Name: UNAMEC
Event Code: 7036
Message: Служба «Pml Driver HPZ12» перешла в состояние Работает.

Record Number: 86346
Source Name: Service Control Manager
Time Written: 20090120203624.000000+420
Event Type: информация
User:

Computer Name: UNAMEC
Event Code: 7036
Message: Служба «Pml Driver HPZ12» перешла в состояние Остановлена.

Record Number: 86345
Source Name: Service Control Manager
Time Written: 20090120203620.000000+420
Event Type: информация
User:

Computer Name: UNAMEC
Event Code: 7035
Message: Служба «Pml Driver HPZ12» успешно отправила управляющий элемент «запустить».

Record Number: 86344
Source Name: Service Control Manager
Time Written: 20090120203619.000000+420
Event Type: информация
User: UNAMECuname

Computer Name: UNAMEC
Event Code: 7036
Message: Служба «Pml Driver HPZ12» перешла в состояние Работает.

Record Number: 86343
Source Name: Service Control Manager
Time Written: 20090120203619.000000+420
Event Type: информация
User:

Computer Name: UNAMEC
Event Code: 7036
Message: Служба «Pml Driver HPZ12» перешла в состояние Работает.

Record Number: 86342
Source Name: Service Control Manager
Time Written: 20090120203604.000000+420
Event Type: информация
User:

Application event log

Computer Name: UNAMEC
Event Code: 1800
Message: Служба центра обеспечения безопасности Windows запущена.

Record Number: 6775
Source Name: SecurityCenter
Time Written: 20071226200520.000000+420
Event Type: информация
User:

Computer Name: UNAMEC
Event Code: 105
Message: The service was started.

Record Number: 6774
Source Name: ATI Smart
Time Written: 20071226200516.000000+420
Event Type: информация
User:

Computer Name: UNAMEC
Event Code: 1000
Message: Ошибка приложения devdetect.exe, версия 2.0.0.12, модуль unknown, версия 0.0.0.0, адрес 0x00000004.

Record Number: 6773
Source Name: Application Error
Time Written: 20071226190153.000000+420
Event Type: ошибка
User:

Computer Name: UNAMEC
Event Code: 101
Message: wuauclt (880) Ядро базы данных остановлено.

Record Number: 6772
Source Name: ESENT
Time Written: 20071226185839.000000+420
Event Type: информация
User:

Computer Name: UNAMEC
Event Code: 103
Message: wuaueng.dll (880) SUS20ClientDataStore: Ядро базы данных остановило работу экземпляра (0).

Record Number: 6771
Source Name: ESENT
Time Written: 20071226185839.000000+420
Event Type: информация
User:

======Environment variables======

«ComSpec»=%SystemRoot%system32cmd.exe
«FP_NO_HOST_CHECK»=NO
«NUMBER_OF_PROCESSORS»=2
«OS»=Windows_NT
«Path»=C:Program FilesPC Connectivity Solution;%SystemRoot%system32;%SystemRoot%;%SystemRoot%System32Wbem
«PATHEXT»=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
«PROCESSOR_ARCHITECTURE»=x86
«PROCESSOR_IDENTIFIER»=x86 Family 6 Model 23 Stepping 6, GenuineIntel
«PROCESSOR_LEVEL»=6
«PROCESSOR_REVISION»=1706
«TEMP»=%SystemRoot%TEMP
«TMP»=%SystemRoot%TEMP
«windir»=%SystemRoot%

EOF
22 января, 2009 в 10:45 дп #21393
Admin
Keymaster
- Темы:40
- Сообщений:5676
Здравствуйте, добро пожаловать на Spyware-ru форум.

Кроме описанной вами проблемы, ваш компьютер так же заражён autorun.inf трояном.
Прочитайте эту инструкцию Flash_Disinfector ещё одно оружие против autorun.inf троянов. Скачайте и запустите Flash_Disinfector, не забудьте при этом по требованию программы вставить ваш флэш диск или подключить другие внешние устройства хранения информации.

Запустите HijackThis, кликните по кнопке Do a system scan only.
Далее отметьте галочкой (слева) следующую строку:
```
F2 - REG:system.ini: UserInit=C:WINDOWSsystem32userinit.exe,C:WINDOWSsorry.exe
```
Кликните по кнопке Fix checked и подтвердите свои действия выбрав YES.

Скачайте OTMoveIt3 by OldTimer кликнув по этой ссылке.
Запустите программу и в большое поле ввода (заголовок этого поля выделен желтым цветом) скопируйте следующий текст.
```
:Processes

explorer.exe



:reg

[-HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{1A6F66F8-04C0-414D-881B-91B2253C5960}]

[-HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{988c9240-9ce7-11dc-bbb3-00115b6ebaa9}]

[-HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{9ce73d04-447d-11db-b8af-00115b6ebaa9}]

[-HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{ade38362-25a2-11dd-bb03-00115b6ebaa9}]

[-HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{c7661448-49a3-11dc-ba1e-00115b6ebaa9}]



:files

c:RECYCLERS-1-5-21-1482476501-1644491937-682003330-1013spoolsv.exe

c:Recycledautorun.exe

c:copy.exe

C:Documents and SettingsAll UsersApplication Datamvvlib.dll [2009-01-20 323072]

C:WINDOWSsorry.exe



:Commands

[emptytemp]

[start explorer]

[Reboot]
```
Кликните по кнопке MoveIt!. В процессе работы возможна перезагрузка компьютера.
По-завершении работы программы должен будет показан лог, вставьте его в ваш ответ.
Так же приложите к своему ответу свежий RSIT лог.
Автор

Сообщения

Просмотр 2 сообщений - с 1 по 2 (из 2 всего)

Для ответа в этой теме необходимо авторизоваться.

Помогите убрать ленту новостей

Добро пожаловать

Поиск

Последние темы

СПАЙВАРЕ РУ

Нужна помощь?

Ссылки