Помогите убрать порнобаннер со страниц в интернете!

This topic has 2 ответа, 2 участника, and was last updated 16 years назад by Admin.

Просмотр 3 сообщений - с 1 по 3 (из 3 всего)

Автор

Сообщения
25 октября, 2009 в 3:32 пп #17297
Alena01
Participant
- Темы:1
- Сообщений:2
Открывая любую страницу интернета на полэкрана занимает порно-баннер. Ребенок где-то нарыл:)))
Помогите пожалуйста!

Logfile of random’s system information tool 1.06 (written by random/random)
Run by Elena at 2009-10-25 18:20:14
Microsoft Windows XP Professional Service Pack 3
System drive C: has 8 GB (15%) free of 57 GB
Total RAM: 511 MB (38% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:20:42, on 25.10.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16915)
Boot mode: Normal

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32svchost.exe
C:Program FilesCommon FilesSymantec SharedccSetMgr.exe
C:WINDOWSExplorer.exe
C:Program FilesCommon FilesSymantec SharedccEvtMgr.exe
C:WINDOWSsystem32spoolsv.exe
C:Program FilesGlary UtilitiesIntegrator.exe
C:Program FilesIVT CorporationBlueSoleilBTNtService.exe
C:Program FilesSymantec AntiVirusDefWatch.exe
C:WINDOWSsystem32nvsvc32.exe
C:WINDOWSsystem32PGPserv.exe
C:Program FilesAnalog DevicesSoundMAXSMAgent.exe
C:WINDOWSsystem32svchost.exe
C:Program FilesSymantec AntiVirusRtvscan.exe
C:WINDOWSsystem32MsPMSPSv.exe
C:Program FilesCommon FilesSymantec SharedccApp.exe
C:PROGRA~1SYMANT~1VPTray.exe
C:Program FilesAnalog DevicesSoundMAXSMax4PNP.exe
C:Program FilesQuickTimeqttask.exe
C:WINDOWSsystem32RUNDLL32.EXE
C:WINDOWSsystem32ctfmon.exe
C:Program FilesMessengermsmsgs.exe
C:Program FilesDAEMON Tools Litedaemon.exe
C:Program FilesNokiaNokia PC Suite 7PCSync2.exe
C:Program FilesNokiaNokia PC Suite 7PCSuite.exe
C:Program FilesIVT CorporationBlueSoleilBlueSoleil.exe
C:Program FilesPGP CorporationPGP for Windows XPPGPtray.exe
C:Program FilesPC Connectivity SolutionServiceLayer.exe
C:Program FilesPC Connectivity SolutionTransportsNclUSBSrv.exe
C:Program FilesCommon FilesNokiaMPAPIMPAPI3s.exe
C:Program FilesPC Connectivity SolutionTransportsNclRSSrv.exe
C:Program FilesInternet Exploreriexplore.exe
C:Program FilesReGet SoftwareReGet DeluxeReGetDx.exe
C:Documents and SettingsElenaMy DocumentsMy DownloadsRSIT.exe
C:Program Filestrend microElena.exe

R0 — HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.yandex.ru/
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 — HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
F2 — REG:system.ini: Shell=Explorer.exe logon.exe
F2 — REG:system.ini: UserInit=C:WINDOWSsystem32userinit.exe
O2 — BHO: (no name) — {02478D38-C3F9-4efb-9B51-7695ECA05670} — (no file)
O2 — BHO: AcroIEHlprObj Class — {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} — C:Program FilesAdobeAcrobat 7.0ActiveXAcroIEHelper.dll
O2 — BHO: ClickCatcher MSIE handler — {16664845-0E00-11D2-8059-000000000000} — C:Program FilesCommon FilesReGet SharedCatcher.dll
O2 — BHO: (no name) — {88888888-8888-8888-8888-888888888888} — (no file)
O2 — BHO: MS Media Module — {9D64F819-9380-8473-DAB2-702FCB3D7A3E} — %APPDATA%msmedia.dll (file missing)
O3 — Toolbar: ReGet Bar — {17939A30-18E2-471E-9D3A-56DD725F1215} — C:Program FilesReGet SoftwareReGet DeluxeIEBar.dll
O4 — HKLM..Run: [ccApp] «C:Program FilesCommon FilesSymantec SharedccApp.exe»
O4 — HKLM..Run: [vptray] C:PROGRA~1SYMANT~1VPTray.exe
O4 — HKLM..Run: [SoundMAXPnP] C:Program FilesAnalog DevicesSoundMAXSMax4PNP.exe
O4 — HKLM..Run: [UpdReg] C:WINDOWSUpdreg.exe
O4 — HKLM..Run: [QuickTime Task] «C:Program FilesQuickTimeqttask.exe» -atboottime
O4 — HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSsystem32NvCpl.dll,NvStartup
O4 — HKLM..Run: [nwiz] nwiz.exe /install
O4 — HKLM..Run: [NvMediaCenter] RUNDLL32.EXE C:WINDOWSsystem32NvMcTray.dll,NvTaskbarInit
O4 — HKLM..Run: [lsass driver] C:WINDOWSmsauc.exe
O4 — HKLM..Run: [services] C:WINDOWSservices.exe
O4 — HKCU..Run: [CTFMON.EXE] C:WINDOWSsystem32ctfmon.exe
O4 — HKCU..Run: [MSMSGS] «C:Program FilesMessengermsmsgs.exe» /background
O4 — HKCU..Run: [DAEMON Tools Lite] «C:Program FilesDAEMON Tools Litedaemon.exe» -autorun
O4 — HKCU..Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] «C:Program FilesCommon FilesNeroLibNMIndexStoreSvr.exe» ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 — HKCU..Run: [Nokia.PCSync] «C:Program FilesNokiaNokia PC Suite 7PCSync2.exe» /NoDialog
O4 — HKCU..Run: [PC Suite Tray] «C:Program FilesNokiaNokia PC Suite 7PCSuite.exe» -onlytray
O4 — HKUSS-1-5-19..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘LOCAL SERVICE’)
O4 — HKUSS-1-5-20..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘NETWORK SERVICE’)
O4 — HKUSS-1-5-18..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘SYSTEM’)
O4 — HKUS.DEFAULT..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘Default user’)
O4 — Global Startup: BlueSoleil.lnk = C:Program FilesIVT CorporationBlueSoleilBlueSoleil.exe
O4 — Global Startup: PGPtray.lnk = ?
O4 — Global Startup: Ускоренный запуск Adobe Reader.lnk = C:Program FilesAdobeAcrobat 7.0Readerreader_sl.exe
O8 — Extra context menu item: E&xport to Microsoft Excel — res://C:PROGRA~1MICROS~2OFFICE11EXCEL.EXE/3000
O9 — Extra button: Research — {92780B25-18CC-41C8-B9BE-3C9C571A8263} — C:PROGRA~1MICROS~2OFFICE11REFIEBAR.DLL
O9 — Extra button: (no name) — {e2e2dd38-d088-4134-82b7-f2ba38496583} — C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O9 — Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 — {e2e2dd38-d088-4134-82b7-f2ba38496583} — C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O9 — Extra button: Messenger — {FB5F1910-F110-11d2-BB9E-00C04F795683} — C:Program FilesMessengermsmsgs.exe
O9 — Extra ‘Tools’ menuitem: Windows Messenger — {FB5F1910-F110-11d2-BB9E-00C04F795683} — C:Program FilesMessengermsmsgs.exe
O16 — DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) — http://go.microsoft.com/fwlink/?linkid=39204
O17 — HKLMSystemCCSServicesTcpip..{91789050-2AE5-468A-8DF7-BF25A8BA1217}: NameServer = 212.1.224.34 212.1.230.111
O20 — Winlogon Notify: crypt — crypts.dll (file missing)
O20 — Winlogon Notify: Csrss — csrss5.dll (file missing)
O20 — Winlogon Notify: WinCtrl32 — WinCtrl32.dll (file missing)
O23 — Service: BlueSoleil Hid Service — Unknown owner — C:Program FilesIVT CorporationBlueSoleilBTNtService.exe
O23 — Service: Symantec Event Manager (ccEvtMgr) — Symantec Corporation — C:Program FilesCommon FilesSymantec SharedccEvtMgr.exe
O23 — Service: Symantec Password Validation (ccPwdSvc) — Symantec Corporation — C:Program FilesCommon FilesSymantec SharedccPwdSvc.exe
O23 — Service: Symantec Settings Manager (ccSetMgr) — Symantec Corporation — C:Program FilesCommon FilesSymantec SharedccSetMgr.exe
O23 — Service: Symantec AntiVirus Definition Watcher (DefWatch) — Symantec Corporation — C:Program FilesSymantec AntiVirusDefWatch.exe
O23 — Service: InstallDriver Table Manager (IDriverT) — Macrovision Corporation — C:Program FilesCommon FilesInstallShieldDriver11Intel 32IDriverT.exe
O23 — Service: NVIDIA Display Driver Service (NVSvc) — NVIDIA Corporation — C:WINDOWSsystem32nvsvc32.exe
O23 — Service: PGPserv — PGP Corporation — C:WINDOWSsystem32PGPserv.exe
O23 — Service: Remote Access Auto Connection Manager RasAutoLmHosts (RasAutoLmHosts) — Unknown owner — C:WINDOWSsystem32actxprxyc.exe (file missing)
O23 — Service: SAVRoam (SavRoam) — symantec — C:Program FilesSymantec AntiVirusSavRoam.exe
O23 — Service: ServiceLayer — Nokia. — C:Program FilesPC Connectivity SolutionServiceLayer.exe
O23 — Service: Symantec Network Drivers Service (SNDSrvc) — Symantec Corporation — C:Program FilesCommon FilesSymantec SharedSNDSrvc.exe
O23 — Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) — Analog Devices, Inc. — C:Program FilesAnalog DevicesSoundMAXSMAgent.exe
O23 — Service: Symantec SPBBCSvc (SPBBCSvc) — Symantec Corporation — C:Program FilesCommon FilesSymantec SharedSPBBCSPBBCSvc.exe
O23 — Service: Symantec AntiVirus — Symantec Corporation — C:Program FilesSymantec AntiVirusRtvscan.exe

—
End of file — 8391 bytes

======Scheduled tasks folder======

C:WINDOWStasksAppleSoftwareUpdate.job
C:WINDOWStasksGlaryInitialize.job

======Registry dump======

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{02478D38-C3F9-4efb-9B51-7695ECA05670}]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class — C:Program FilesAdobeAcrobat 7.0ActiveXAcroIEHelper.dll [2005-09-24 63136]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{16664845-0E00-11D2-8059-000000000000}]
ClickCatcher MSIE handler — C:Program FilesCommon FilesReGet SharedCatcher.dll [2007-10-17 543168]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{88888888-8888-8888-8888-888888888888}]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{9D64F819-9380-8473-DAB2-702FCB3D7A3E}]
MS Media Module — C:Documents and SettingsElenaApplication Datamsmedia.dll [2009-09-28 14848]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
{17939A30-18E2-471E-9D3A-56DD725F1215} — ReGet Bar — C:Program FilesReGet SoftwareReGet DeluxeIEBar.dll [2007-10-17 199104]

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun]
«ccApp»=C:Program FilesCommon FilesSymantec SharedccApp.exe [2005-10-04 48752]
«vptray»=C:PROGRA~1SYMANT~1VPTray.exe [2005-11-15 85744]
«SoundMAXPnP»=C:Program FilesAnalog DevicesSoundMAXSMax4PNP.exe [2003-05-29 790528]
«UpdReg»=C:WINDOWSUpdreg.exe [2000-05-11 90112]
«QuickTime Task»=C:Program FilesQuickTimeqttask.exe [2007-02-16 282624]
«NvCplDaemon»=C:WINDOWSsystem32NvCpl.dll [2007-12-05 8523776]
«nwiz»=nwiz.exe /install []
«NvMediaCenter»=C:WINDOWSsystem32NvMcTray.dll [2007-12-05 81920]
«lsass driver»=C:WINDOWSmsauc.exe []
«services»=C:WINDOWSservices.exe []

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=C:WINDOWSsystem32ctfmon.exe [2008-04-14 15360]
«MSMSGS»=C:Program FilesMessengermsmsgs.exe [2008-04-14 1695232]
«DAEMON Tools Lite»=C:Program FilesDAEMON Tools Litedaemon.exe [2008-01-17 486856]
«IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}»=C:Program FilesCommon FilesNeroLibNMIndexStoreSvr.exe ASO-616B5711-6DAE-4795-A05F-39A1E5104020 []
«Nokia.PCSync»=C:Program FilesNokiaNokia PC Suite 7PCSync2.exe [2008-06-17 1249280]
«PC Suite Tray»=C:Program FilesNokiaNokia PC Suite 7PCSuite.exe [2008-08-11 1124352]

C:Documents and SettingsAll UsersStart MenuProgramsStartup
BlueSoleil.lnk — C:Program FilesIVT CorporationBlueSoleilBlueSoleil.exe
PGPtray.lnk — C:Program FilesPGP CorporationPGP for Windows XPPGPtray.exe
Ускоренный запуск Adobe Reader.lnk — C:Program FilesAdobeAcrobat 7.0Readerreader_sl.exe

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifycrypt]
crypts.dll []

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifyCsrss]
csrss5.dll []

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifyNavLogon]
C:WINDOWSsystem32NavLogon.dll [2005-11-15 43760]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifyWgaLogon]
C:WINDOWSsystem32WgaLogon.dll [2009-03-10 239496]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifyWinCtrl32]
WinCtrl32.dll []

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad]
WPDShServiceObj — {AAA288BA-9A4C-45B0-95D7-94D524869DB5} — C:WINDOWSsystem32WPDShServiceObj.dll [2006-10-18 133632]
UPnPMonitor — {e57ce738-33e8-4c51-8354-bb4de9d215d1} — C:WINDOWSsystem32upnpui.dll [2008-04-14 239616]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerShellExecuteHooks]
«{16664848-0E00-11D2-8059-000000000000}»= []

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetcontrolsecurityproviders]
«SecurityProviders»=msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, digeste.dll,, digiwet.dll

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
«NoDispScrSavPage»=0
«DisableTaskMgr»=0

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
«dontdisplaylastusername»=0
«legalnoticecaption»=
«legalnoticetext»=
«shutdownwithoutlogon»=1
«undockwithoutlogon»=1
«DisableTaskMgr»=0

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoDriveTypeAutoRun»=5F000000
«»=
«NoFolderOptions»=0

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«HonorAutoRunSetting»=

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicystandardprofileauthorizedapplicationslist]
«C:WINDOWSsystem32sessmgr.exe»=»C:WINDOWSsystem32sessmgr.exe:*:Disabled:@xpsp2res.dll,-22019»
«C:Program FilesIVT CorporationBlueSoleilBlueSoleil.exe»=»C:Program FilesIVT CorporationBlueSoleilBlueSoleil.exe:*:Enabled:BlueSoleil»
«C:Program FilesReGet SoftwareReGet DeluxeReGetDx.exe»=»C:Program FilesReGet SoftwareReGet DeluxeReGetDx.exe:*:Enabled:ReGet 5.2»
«%windir%Network Diagnosticxpnetdiag.exe»=»%windir%Network Diagnosticxpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000»
«C:Program FilesVenomvenom.dll»=»C:Program FilesVenomvenom.dll:*:Enabled:Codename: Outbrake»
«C:Documents and SettingsElenaLocal SettingsTempElectronicArts_Patcher_000.exe»=»C:Documents and SettingsElenaLocal SettingsTempElectronicArts_Patcher_000.exe:*:Enabled:Command and Conquer 3 Tiberium Wars™ Launcher»
«C:GamesAct_of_WarActofwar.exe»=»C:GamesAct_of_WarActofwar.exe:*:Enabled:Actofwar»
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»
«C:Documents and SettingsAll UsersApplication Datacsrss.exe»=»C:Documents and SettingsAll UsersApplication Datacsrss.exe:*:Enabled:svchost»

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicydomainprofileauthorizedapplicationslist]
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»
«%windir%Network Diagnosticxpnetdiag.exe»=»%windir%Network Diagnosticxpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000»

======List of files/folders created in the last 3 months======

2009-10-25 18:20:16 —-D—- C:Program Filestrend micro
2009-10-25 18:20:14 —-DC—- C:rsit
2009-10-25 17:43:24 —-AC—- C:logit.txt
2009-10-14 15:36:23 —-HDC—- C:WINDOWS$NtUninstallKB958869$
2009-10-14 15:32:59 —-HDC—- C:WINDOWS$NtUninstallKB969059$
2009-10-14 15:32:49 —-HDC—- C:WINDOWS$NtUninstallKB954155_WM9$
2009-10-14 15:32:41 —-HDC—- C:WINDOWS$NtUninstallKB974112$
2009-10-14 15:32:30 —-HDC—- C:WINDOWS$NtUninstallKB975025$
2009-10-14 15:31:36 —-HDC—- C:WINDOWS$NtUninstallKB974571$
2009-10-14 15:31:18 —-HDC—- C:WINDOWS$NtUninstallKB971486$
2009-10-14 15:31:05 —-HDC—- C:WINDOWS$NtUninstallKB973525$
2009-10-14 15:30:46 —-HDC—- C:WINDOWS$NtUninstallKB975467$
2009-09-28 04:42:13 —-A—- C:Documents and SettingsElenaApplication Datamsmedia.dll
2009-09-24 04:20:00 —-D—- C:Documents and SettingsElenaApplication DataMozilla
2009-09-24 04:19:41 —-D—- C:Program FilesMozilla Firefox
2009-09-14 11:00:01 —-A—- C:WINDOWSsystem32logon.exe
2009-09-10 05:03:49 —-HDC—- C:WINDOWS$NtUninstallKB968816_WM9$
2009-09-10 05:03:13 —-HDC—- C:WINDOWS$NtUninstallKB956844$
2009-09-10 05:02:45 —-HDC—- C:WINDOWS$NtUninstallKB971961$
2009-09-08 05:01:32 —-HDC—- C:WINDOWS$NtUninstallKB968389$
2009-09-07 13:52:08 —-HDC—- C:WINDOWS$NtUninstallKB960859$
2009-09-07 13:51:58 —-HDC—- C:WINDOWS$NtUninstallKB971657$
2009-09-07 13:51:49 —-HDC—- C:WINDOWS$NtUninstallKB971557$
2009-09-07 13:51:38 —-HDC—- C:WINDOWS$NtUninstallKB956744$
2009-09-07 13:51:27 —-HDC—- C:WINDOWS$NtUninstallKB973869$
2009-09-07 13:51:17 —-HDC—- C:WINDOWS$NtUninstallKB973507$
2009-09-07 13:51:05 —-HDC—- C:WINDOWS$NtUninstallKB973354$
2009-09-07 13:50:46 —-HDC—- C:WINDOWS$NtUninstallKB973540_WM9$
2009-09-07 13:47:39 —-HDC—- C:WINDOWS$NtUninstallKB973815$
2009-09-07 13:46:27 —-HDC—- C:WINDOWS$NtUninstallKB970653-v3$

======List of files/folders modified in the last 3 months======

2009-10-25 18:20:16 —-RD—- C:Program Files
2009-10-25 18:12:45 —-D—- C:Program FilesSymantec AntiVirus
2009-10-25 18:08:15 —-D—- C:WINDOWSTemp
2009-10-25 18:06:12 —-D—- C:Program FilesYahoo!
2009-10-25 18:05:07 —-A—- C:WINDOWSSchedLgU.Txt
2009-10-25 18:04:13 —-D—- C:Documents and SettingsElenaApplication DataReGet Software
2009-10-25 17:57:23 —-SHD—- C:WINDOWSInstaller
2009-10-25 17:57:22 —-D—- C:Program FilesMarvell
2009-10-25 17:57:21 —-D—- C:WINDOWSsystem32
2009-10-25 16:58:48 —-HD—- C:WINDOWSinf
2009-10-25 16:50:55 —-D—- C:WINDOWSPrefetch
2009-10-25 16:12:42 —-D—- C:WINDOWSsystem32CatRoot2
2009-10-25 03:47:41 —-AC—- C:WINDOWSsystem32PerfStringBackup.INI
2009-10-24 13:35:13 —-D—- C:Program FilesWarcraft III
2009-10-15 04:24:43 —-D—- C:WINDOWS
2009-10-14 15:36:24 —-D—- C:WINDOWSWinSxS
2009-10-14 15:33:03 —-A—- C:WINDOWSimsins.BAK
2009-10-14 15:33:01 —-RSHDC—- C:WINDOWSsystem32dllcache
2009-10-14 15:32:13 —-D—- C:WINDOWSsystem32en-US
2009-10-14 15:32:13 —-D—- C:Program FilesInternet Explorer
2009-10-14 15:31:13 —-HD—- C:WINDOWS$hf_mig$
2009-10-02 21:01:57 —-A—- C:WINDOWSsystem32MRT.exe
2009-10-01 08:08:06 —-D—- C:WINDOWSMinidump
2009-09-27 20:16:13 —-D—- C:Documents and SettingsElenaApplication DataAdobe
2009-09-11 17:18:39 —-A—- C:WINDOWSsystem32msv1_0.dll
2009-09-08 05:01:35 —-D—- C:WINDOWSsystem32drivers
2009-09-07 13:51:08 —-D—- C:Program FilesOutlook Express
2009-09-05 00:03:36 —-A—- C:WINDOWSsystem32msasn1.dll
2009-08-29 10:36:27 —-A—- C:WINDOWSsystem32wininet.dll
2009-08-29 10:36:27 —-A—- C:WINDOWSsystem32webcheck.dll
2009-08-29 10:36:27 —-A—- C:WINDOWSsystem32urlmon.dll
2009-08-29 10:36:26 —-N—- C:WINDOWSsystem32occache.dll
2009-08-29 10:36:26 —-N—- C:WINDOWSsystem32mstime.dll
2009-08-29 10:36:26 —-N—- C:WINDOWSsystem32msrating.dll
2009-08-29 10:36:26 —-A—- C:WINDOWSsystem32url.dll
2009-08-29 10:36:26 —-A—- C:WINDOWSsystem32pngfilt.dll
2009-08-29 10:36:26 —-A—- C:WINDOWSsystem32mshtmled.dll
2009-08-29 10:36:26 —-A—- C:WINDOWSsystem32mshtml.dll
2009-08-29 10:36:25 —-N—- C:WINDOWSsystem32jsproxy.dll
2009-08-29 10:36:25 —-N—- C:WINDOWSsystem32iernonce.dll
2009-08-29 10:36:25 —-A—- C:WINDOWSsystem32msfeedsbs.dll
2009-08-29 10:36:25 —-A—- C:WINDOWSsystem32msfeeds.dll
2009-08-29 10:36:25 —-A—- C:WINDOWSsystem32iertutil.dll
2009-08-29 10:36:25 —-A—- C:WINDOWSsystem32ieframe.dll
2009-08-29 10:36:24 —-N—- C:WINDOWSsystem32iedkcs32.dll
2009-08-29 10:36:24 —-N—- C:WINDOWSsystem32ieaksie.dll
2009-08-29 10:36:24 —-N—- C:WINDOWSsystem32ieakeng.dll
2009-08-29 10:36:24 —-N—- C:WINDOWSsystem32extmgr.dll
2009-08-29 10:36:24 —-N—- C:WINDOWSsystem32corpol.dll
2009-08-29 10:36:24 —-A—- C:WINDOWSsystem32ieencode.dll
2009-08-29 10:36:24 —-A—- C:WINDOWSsystem32ieapfltr.dll
2009-08-29 10:36:24 —-A—- C:WINDOWSsystem32icardie.dll
2009-08-29 10:36:24 —-A—- C:WINDOWSsystem32dxtrans.dll
2009-08-29 10:36:24 —-A—- C:WINDOWSsystem32dxtmsft.dll
2009-08-29 10:36:24 —-A—- C:WINDOWSsystem32advpack.dll
2009-08-28 13:28:59 —-N—- C:WINDOWSsystem32ie4uinit.exe
2009-08-28 13:28:59 —-A—- C:WINDOWSsystem32ieudinit.exe
2009-08-27 08:18:41 —-N—- C:WINDOWSsystem32ieakui.dll
2009-08-26 11:00:21 —-A—- C:WINDOWSsystem32strmdll.dll
2009-08-13 18:16:05 —-A—- C:WINDOWSsystem32jscript.dll
2009-08-05 12:01:48 —-A—- C:WINDOWSsystem32mswebdvd.dll
2009-08-04 19:44:46 —-A—- C:WINDOWSsystem32ntoskrnl.exe
2009-08-04 17:20:08 —-A—- C:WINDOWSsystem32ntkrnlpa.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 eeCtrl;Symantec Eraser Control driver; ??C:Program FilesCommon FilesSymantec SharedEENGINEeeCtrl.sys []
R1 intelppm;Intel Processor Driver; C:WINDOWSsystem32DRIVERSintelppm.sys [2008-04-13 36352]
R1 prodrv04;Star Force copy protection driver v4; C:WINDOWSSystem32driversprodrv04.sys [2007-03-21 114496]
R1 SAVRT;SAVRT; ??C:Program FilesSymantec AntiVirussavrt.sys []
R1 SAVRTPEL;SAVRTPEL; ??C:Program FilesSymantec AntiVirusSavrtpel.sys []
R1 SYMTDI;SYMTDI; C:WINDOWSSystem32DriversSYMTDI.SYS [2005-10-19 195728]
R2 PfModNT;PfModNT; ??C:WINDOWSsystem32PfModNT.sys []
R2 PGPdisk;PGPdisk; C:WINDOWSsystem32driversPGPdisk.sys [2004-06-09 169120]
R2 PGPsdkDriver;PGPsdkDriver; C:WINDOWSSystem32DriversPGPsdk.sys [2004-06-09 26624]
R2 U3sHlpDr;U3sHlpDr; ??C:WINDOWSSystem32DriversU3sHlpDr.sys []
R3 aeaudio;aeaudio; C:WINDOWSsystem32driversaeaudio.sys [2003-03-13 100224]
R3 BlueletAudio;Bluetooth Audio Service; C:WINDOWSsystem32DRIVERSblueletaudio.sys [2005-08-31 20480]
R3 BlueletSCOAudio;Bluetooth SCO Audio Service; C:WINDOWSsystem32DRIVERSBlueletSCOAudio.sys [2005-08-31 20480]
R3 BT;Bluetooth PAN Network Adapter; C:WINDOWSsystem32DRIVERSbtnetdrv.sys [2005-04-30 10804]
R3 BTHidEnum;Bluetooth HID Enumerator; C:WINDOWSsystem32DRIVERSvbtenum.sys [2005-07-29 11988]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv; ??C:Program FilesCommon FilesSymantec SharedEENGINEEraserUtilRebootDrv.sys []
R3 NAVENG;NAVENG; ??C:PROGRA~1COMMON~1SYMANT~1VIRUSD~120091024.005naveng.sys []
R3 NAVEX15;NAVEX15; ??C:PROGRA~1COMMON~1SYMANT~1VIRUSD~120091024.005navex15.sys []
R3 nv;nv; C:WINDOWSsystem32DRIVERSnv4_mini.sys [2007-12-05 7435392]
R3 ROOTMODEM;Microsoft Legacy Modem Driver; C:WINDOWSSystem32DriversRootMdm.sys [2004-08-04 5888]
R3 smwdm;smwdm; C:WINDOWSsystem32driverssmwdm.sys [2003-06-02 578304]
R3 SymEvent;SymEvent; ??C:Program FilesSymantecSYMEVENT.SYS []
R3 SYMREDRV;SYMREDRV; C:WINDOWSSystem32DriversSYMREDRV.SYS [2005-10-19 24720]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:WINDOWSsystem32DRIVERSusbehci.sys [2008-04-13 30208]
R3 usbhub;USB2 Enabled Hub; C:WINDOWSsystem32DRIVERSusbhub.sys [2008-04-13 59520]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:WINDOWSsystem32DRIVERSusbuhci.sys [2008-04-13 20608]
R3 VComm;Virtual Serial port driver; C:WINDOWSsystem32DRIVERSVComm.sys [2004-10-19 61312]
R3 VcommMgr;Bluetooth VComm Manager Service; C:WINDOWSSystem32DriversVcommMgr.sys [2005-03-25 82148]
R3 yukonwxp;NDIS5.1 Miniport Driver for Marvell Yukon Ethernet Controller; C:WINDOWSsystem32DRIVERSyk51x86.sys [2004-08-19 189568]
S1 prodrv03;Star Force copy protection driver v3; ??C:WINDOWSsystem32driversprodrv03.sys []
S2 cmgzjsryskn;cmgzjsryskn; ??C:WINDOWSsystem32driverswmlduswubxqg.sys []
S3 a1p346uc;a1p346uc; C:WINDOWSsystem32driversa1p346uc.sys []
S3 Btcsrusb;Bluetooth USB For Bluetooth Service; C:WINDOWSSystem32Driversbtcusb.sys [2005-07-29 23000]
S3 BTNetFilter;Bluetooth Network Filter; ??C:WINDOWSsystem32driversBTNetFilter.sys []
S3 CCDECODE;Closed Caption Decoder; C:WINDOWSsystem32DRIVERSCCDECODE.sys [2008-04-13 17024]
S3 MidiSyn;MidiSyn; C:WINDOWSsystem32driversMidiSyn.sys [2002-09-20 235100]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:WINDOWSsystem32driversMSTEE.sys [2008-04-13 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:WINDOWSsystem32DRIVERSNABTSFEC.sys [2008-04-13 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:WINDOWSsystem32DRIVERSNdisIP.sys [2008-04-13 10880]
S3 nmwcd;Nokia USB Phone Parent; C:WINDOWSsystem32driversccdcmb.sys [2008-05-07 17536]
S3 nmwcdc;Nokia USB Generic; C:WINDOWSsystem32driversccdcmbo.sys [2008-05-07 20864]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:WINDOWSsystem32DRIVERSpccsmcfd.sys [2007-09-17 21632]
S3 pcouffin;VSO Software pcouffin; C:WINDOWSSystem32Driverspcouffin.sys [2008-02-02 47360]
S3 SLIP;BDA Slip De-Framer; C:WINDOWSsystem32DRIVERSSLIP.sys [2008-04-13 11136]
S3 SPBBCDrv;SPBBCDrv; ??C:Program FilesCommon FilesSymantec SharedSPBBCSPBBCDrv.sys []
S3 streamip;BDA IPSink; C:WINDOWSsystem32DRIVERSStreamIP.sys [2008-04-13 15232]
S3 upperdev;upperdev; C:WINDOWSsystem32DRIVERSusbser_lowerflt.sys [2008-06-06 8064]
S3 usbprint;Microsoft USB PRINTER Class; C:WINDOWSsystem32DRIVERSusbprint.sys [2008-04-13 25856]
S3 usbser;USB Modem Driver; C:WINDOWSsystem32driversusbser.sys [2008-04-13 26112]
S3 usbserfilt;usbserfilt; C:WINDOWSsystem32DRIVERSusbser_lowerfltj.sys [2008-05-07 8064]
S3 USBSTOR;USB Mass Storage Driver; C:WINDOWSsystem32DRIVERSUSBSTOR.SYS [2008-04-13 26368]
S3 wdf01000;Wdf01000; C:WINDOWSsystem32DRIVERSWdf01000.sys [2006-11-02 492000]
S3 WpdUsb;WpdUsb; C:WINDOWSsystem32DRIVERSwpdusb.sys [2006-10-18 38528]
S3 WSTCODEC;World Standard Teletext Codec; C:WINDOWSsystem32DRIVERSWSTCODEC.SYS [2008-04-13 19200]
S3 WudfRd;Windows Driver Foundation — User-mode Driver Framework Reflector; C:WINDOWSsystem32DRIVERSwudfrd.sys [2006-09-15 82688]
S4 dwshd;dwshd; C:WINDOWSSystem32driversdwshd.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 BlueSoleil Hid Service;BlueSoleil Hid Service; C:Program FilesIVT CorporationBlueSoleilBTNtService.exe [2005-04-06 110592]
R2 ccEvtMgr;Symantec Event Manager; C:Program FilesCommon FilesSymantec SharedccEvtMgr.exe [2005-10-04 185968]
R2 ccSetMgr;Symantec Settings Manager; C:Program FilesCommon FilesSymantec SharedccSetMgr.exe [2005-10-04 177776]
R2 DefWatch;Symantec AntiVirus Definition Watcher; C:Program FilesSymantec AntiVirusDefWatch.exe [2005-11-15 20208]
R2 NVSvc;NVIDIA Display Driver Service; C:WINDOWSsystem32nvsvc32.exe [2007-12-05 155716]
R2 PGPserv;PGPserv; C:WINDOWSsystem32PGPserv.exe [2004-06-09 69632]
R2 SoundMAX Agent Service (default);SoundMAX Agent Service; C:Program FilesAnalog DevicesSoundMAXSMAgent.exe [2002-09-20 45056]
R2 Symantec AntiVirus;Symantec AntiVirus; C:Program FilesSymantec AntiVirusRtvscan.exe [2005-11-15 1756912]
R2 WMDM PMSP Service;WMDM PMSP Service; C:WINDOWSsystem32MsPMSPSv.exe [2000-06-26 53520]
R2 WudfSvc;Windows Driver Foundation — User-mode Driver Framework; C:WINDOWSsystem32svchost.exe [2008-04-14 14336]
R3 ServiceLayer;ServiceLayer; C:Program FilesPC Connectivity SolutionServiceLayer.exe [2008-08-07 575488]
S2 RasAutoLmHosts;Remote Access Auto Connection Manager RasAutoLmHosts; C:WINDOWSsystem32actxprxyc.exe srv []
S3 ccPwdSvc;Symantec Password Validation; C:Program FilesCommon FilesSymantec SharedccPwdSvc.exe [2005-10-04 83568]
S3 IDriverT;InstallDriver Table Manager; C:Program FilesCommon FilesInstallShieldDriver11Intel 32IDriverT.exe [2005-04-03 69632]
S3 ose;Office Source Engine; C:Program FilesCommon FilesMicrosoft SharedSource EngineOSE.EXE [2003-07-28 89136]
S3 SavRoam;SAVRoam; C:Program FilesSymantec AntiVirusSavRoam.exe [2005-11-15 169200]
S3 SNDSrvc;Symantec Network Drivers Service; C:Program FilesCommon FilesSymantec SharedSNDSrvc.exe [2005-10-19 214672]
S3 SPBBCSvc;Symantec SPBBCSvc; C:Program FilesCommon FilesSymantec SharedSPBBCSPBBCSvc.exe [2005-03-30 992864]

EOF
25 октября, 2009 в 3:35 пп #26500
Alena01
Participant
- Темы:1
- Сообщений:2
Logfile of random’s system information tool 1.06 (written by random/random)
Run by Elena at 2009-10-25 18:20:14
Microsoft Windows XP Professional Service Pack 3
System drive C: has 8 GB (15%) free of 57 GB
Total RAM: 511 MB (38% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:20:42, on 25.10.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16915)
Boot mode: Normal

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32svchost.exe
C:Program FilesCommon FilesSymantec SharedccSetMgr.exe
C:WINDOWSExplorer.exe
C:Program FilesCommon FilesSymantec SharedccEvtMgr.exe
C:WINDOWSsystem32spoolsv.exe
C:Program FilesGlary UtilitiesIntegrator.exe
C:Program FilesIVT CorporationBlueSoleilBTNtService.exe
C:Program FilesSymantec AntiVirusDefWatch.exe
C:WINDOWSsystem32nvsvc32.exe
C:WINDOWSsystem32PGPserv.exe
C:Program FilesAnalog DevicesSoundMAXSMAgent.exe
C:WINDOWSsystem32svchost.exe
C:Program FilesSymantec AntiVirusRtvscan.exe
C:WINDOWSsystem32MsPMSPSv.exe
C:Program FilesCommon FilesSymantec SharedccApp.exe
C:PROGRA~1SYMANT~1VPTray.exe
C:Program FilesAnalog DevicesSoundMAXSMax4PNP.exe
C:Program FilesQuickTimeqttask.exe
C:WINDOWSsystem32RUNDLL32.EXE
C:WINDOWSsystem32ctfmon.exe
C:Program FilesMessengermsmsgs.exe
C:Program FilesDAEMON Tools Litedaemon.exe
C:Program FilesNokiaNokia PC Suite 7PCSync2.exe
C:Program FilesNokiaNokia PC Suite 7PCSuite.exe
C:Program FilesIVT CorporationBlueSoleilBlueSoleil.exe
C:Program FilesPGP CorporationPGP for Windows XPPGPtray.exe
C:Program FilesPC Connectivity SolutionServiceLayer.exe
C:Program FilesPC Connectivity SolutionTransportsNclUSBSrv.exe
C:Program FilesCommon FilesNokiaMPAPIMPAPI3s.exe
C:Program FilesPC Connectivity SolutionTransportsNclRSSrv.exe
C:Program FilesInternet Exploreriexplore.exe
C:Program FilesReGet SoftwareReGet DeluxeReGetDx.exe
C:Documents and SettingsElenaMy DocumentsMy DownloadsRSIT.exe
C:Program Filestrend microElena.exe

R0 — HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.yandex.ru/
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 — HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
F2 — REG:system.ini: Shell=Explorer.exe logon.exe
F2 — REG:system.ini: UserInit=C:WINDOWSsystem32userinit.exe
O2 — BHO: (no name) — {02478D38-C3F9-4efb-9B51-7695ECA05670} — (no file)
O2 — BHO: AcroIEHlprObj Class — {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} — C:Program FilesAdobeAcrobat 7.0ActiveXAcroIEHelper.dll
O2 — BHO: ClickCatcher MSIE handler — {16664845-0E00-11D2-8059-000000000000} — C:Program FilesCommon FilesReGet SharedCatcher.dll
O2 — BHO: (no name) — {88888888-8888-8888-8888-888888888888} — (no file)
O2 — BHO: MS Media Module — {9D64F819-9380-8473-DAB2-702FCB3D7A3E} — %APPDATA%msmedia.dll (file missing)
O3 — Toolbar: ReGet Bar — {17939A30-18E2-471E-9D3A-56DD725F1215} — C:Program FilesReGet SoftwareReGet DeluxeIEBar.dll
O4 — HKLM..Run: [ccApp] «C:Program FilesCommon FilesSymantec SharedccApp.exe»
O4 — HKLM..Run: [vptray] C:PROGRA~1SYMANT~1VPTray.exe
O4 — HKLM..Run: [SoundMAXPnP] C:Program FilesAnalog DevicesSoundMAXSMax4PNP.exe
O4 — HKLM..Run: [UpdReg] C:WINDOWSUpdreg.exe
O4 — HKLM..Run: [QuickTime Task] «C:Program FilesQuickTimeqttask.exe» -atboottime
O4 — HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSsystem32NvCpl.dll,NvStartup
O4 — HKLM..Run: [nwiz] nwiz.exe /install
O4 — HKLM..Run: [NvMediaCenter] RUNDLL32.EXE C:WINDOWSsystem32NvMcTray.dll,NvTaskbarInit
O4 — HKLM..Run: [lsass driver] C:WINDOWSmsauc.exe
O4 — HKLM..Run: [services] C:WINDOWSservices.exe
O4 — HKCU..Run: [CTFMON.EXE] C:WINDOWSsystem32ctfmon.exe
O4 — HKCU..Run: [MSMSGS] «C:Program FilesMessengermsmsgs.exe» /background
O4 — HKCU..Run: [DAEMON Tools Lite] «C:Program FilesDAEMON Tools Litedaemon.exe» -autorun
O4 — HKCU..Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] «C:Program FilesCommon FilesNeroLibNMIndexStoreSvr.exe» ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 — HKCU..Run: [Nokia.PCSync] «C:Program FilesNokiaNokia PC Suite 7PCSync2.exe» /NoDialog
O4 — HKCU..Run: [PC Suite Tray] «C:Program FilesNokiaNokia PC Suite 7PCSuite.exe» -onlytray
O4 — HKUSS-1-5-19..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘LOCAL SERVICE’)
O4 — HKUSS-1-5-20..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘NETWORK SERVICE’)
O4 — HKUSS-1-5-18..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘SYSTEM’)
O4 — HKUS.DEFAULT..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘Default user’)
O4 — Global Startup: BlueSoleil.lnk = C:Program FilesIVT CorporationBlueSoleilBlueSoleil.exe
O4 — Global Startup: PGPtray.lnk = ?
O4 — Global Startup: Ускоренный запуск Adobe Reader.lnk = C:Program FilesAdobeAcrobat 7.0Readerreader_sl.exe
O8 — Extra context menu item: E&xport to Microsoft Excel — res://C:PROGRA~1MICROS~2OFFICE11EXCEL.EXE/3000
O9 — Extra button: Research — {92780B25-18CC-41C8-B9BE-3C9C571A8263} — C:PROGRA~1MICROS~2OFFICE11REFIEBAR.DLL
O9 — Extra button: (no name) — {e2e2dd38-d088-4134-82b7-f2ba38496583} — C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O9 — Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 — {e2e2dd38-d088-4134-82b7-f2ba38496583} — C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O9 — Extra button: Messenger — {FB5F1910-F110-11d2-BB9E-00C04F795683} — C:Program FilesMessengermsmsgs.exe
O9 — Extra ‘Tools’ menuitem: Windows Messenger — {FB5F1910-F110-11d2-BB9E-00C04F795683} — C:Program FilesMessengermsmsgs.exe
O16 — DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) — http://go.microsoft.com/fwlink/?linkid=39204
O17 — HKLMSystemCCSServicesTcpip..{91789050-2AE5-468A-8DF7-BF25A8BA1217}: NameServer = 212.1.224.34 212.1.230.111
O20 — Winlogon Notify: crypt — crypts.dll (file missing)
O20 — Winlogon Notify: Csrss — csrss5.dll (file missing)
O20 — Winlogon Notify: WinCtrl32 — WinCtrl32.dll (file missing)
O23 — Service: BlueSoleil Hid Service — Unknown owner — C:Program FilesIVT CorporationBlueSoleilBTNtService.exe
O23 — Service: Symantec Event Manager (ccEvtMgr) — Symantec Corporation — C:Program FilesCommon FilesSymantec SharedccEvtMgr.exe
O23 — Service: Symantec Password Validation (ccPwdSvc) — Symantec Corporation — C:Program FilesCommon FilesSymantec SharedccPwdSvc.exe
O23 — Service: Symantec Settings Manager (ccSetMgr) — Symantec Corporation — C:Program FilesCommon FilesSymantec SharedccSetMgr.exe
O23 — Service: Symantec AntiVirus Definition Watcher (DefWatch) — Symantec Corporation — C:Program FilesSymantec AntiVirusDefWatch.exe
O23 — Service: InstallDriver Table Manager (IDriverT) — Macrovision Corporation — C:Program FilesCommon FilesInstallShieldDriver11Intel 32IDriverT.exe
O23 — Service: NVIDIA Display Driver Service (NVSvc) — NVIDIA Corporation — C:WINDOWSsystem32nvsvc32.exe
O23 — Service: PGPserv — PGP Corporation — C:WINDOWSsystem32PGPserv.exe
O23 — Service: Remote Access Auto Connection Manager RasAutoLmHosts (RasAutoLmHosts) — Unknown owner — C:WINDOWSsystem32actxprxyc.exe (file missing)
O23 — Service: SAVRoam (SavRoam) — symantec — C:Program FilesSymantec AntiVirusSavRoam.exe
O23 — Service: ServiceLayer — Nokia. — C:Program FilesPC Connectivity SolutionServiceLayer.exe
O23 — Service: Symantec Network Drivers Service (SNDSrvc) — Symantec Corporation — C:Program FilesCommon FilesSymantec SharedSNDSrvc.exe
O23 — Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) — Analog Devices, Inc. — C:Program FilesAnalog DevicesSoundMAXSMAgent.exe
O23 — Service: Symantec SPBBCSvc (SPBBCSvc) — Symantec Corporation — C:Program FilesCommon FilesSymantec SharedSPBBCSPBBCSvc.exe
O23 — Service: Symantec AntiVirus — Symantec Corporation — C:Program FilesSymantec AntiVirusRtvscan.exe

—
End of file — 8391 bytes

======Scheduled tasks folder======

C:WINDOWStasksAppleSoftwareUpdate.job
C:WINDOWStasksGlaryInitialize.job

======Registry dump======

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{02478D38-C3F9-4efb-9B51-7695ECA05670}]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class — C:Program FilesAdobeAcrobat 7.0ActiveXAcroIEHelper.dll [2005-09-24 63136]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{16664845-0E00-11D2-8059-000000000000}]
ClickCatcher MSIE handler — C:Program FilesCommon FilesReGet SharedCatcher.dll [2007-10-17 543168]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{88888888-8888-8888-8888-888888888888}]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{9D64F819-9380-8473-DAB2-702FCB3D7A3E}]
MS Media Module — C:Documents and SettingsElenaApplication Datamsmedia.dll [2009-09-28 14848]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
{17939A30-18E2-471E-9D3A-56DD725F1215} — ReGet Bar — C:Program FilesReGet SoftwareReGet DeluxeIEBar.dll [2007-10-17 199104]

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun]
«ccApp»=C:Program FilesCommon FilesSymantec SharedccApp.exe [2005-10-04 48752]
«vptray»=C:PROGRA~1SYMANT~1VPTray.exe [2005-11-15 85744]
«SoundMAXPnP»=C:Program FilesAnalog DevicesSoundMAXSMax4PNP.exe [2003-05-29 790528]
«UpdReg»=C:WINDOWSUpdreg.exe [2000-05-11 90112]
«QuickTime Task»=C:Program FilesQuickTimeqttask.exe [2007-02-16 282624]
«NvCplDaemon»=C:WINDOWSsystem32NvCpl.dll [2007-12-05 8523776]
«nwiz»=nwiz.exe /install []
«NvMediaCenter»=C:WINDOWSsystem32NvMcTray.dll [2007-12-05 81920]
«lsass driver»=C:WINDOWSmsauc.exe []
«services»=C:WINDOWSservices.exe []

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=C:WINDOWSsystem32ctfmon.exe [2008-04-14 15360]
«MSMSGS»=C:Program FilesMessengermsmsgs.exe [2008-04-14 1695232]
«DAEMON Tools Lite»=C:Program FilesDAEMON Tools Litedaemon.exe [2008-01-17 486856]
«IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}»=C:Program FilesCommon FilesNeroLibNMIndexStoreSvr.exe ASO-616B5711-6DAE-4795-A05F-39A1E5104020 []
«Nokia.PCSync»=C:Program FilesNokiaNokia PC Suite 7PCSync2.exe [2008-06-17 1249280]
«PC Suite Tray»=C:Program FilesNokiaNokia PC Suite 7PCSuite.exe [2008-08-11 1124352]

C:Documents and SettingsAll UsersStart MenuProgramsStartup
BlueSoleil.lnk — C:Program FilesIVT CorporationBlueSoleilBlueSoleil.exe
PGPtray.lnk — C:Program FilesPGP CorporationPGP for Windows XPPGPtray.exe
Ускоренный запуск Adobe Reader.lnk — C:Program FilesAdobeAcrobat 7.0Readerreader_sl.exe

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifycrypt]
crypts.dll []

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifyCsrss]
csrss5.dll []

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifyNavLogon]
C:WINDOWSsystem32NavLogon.dll [2005-11-15 43760]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifyWgaLogon]
C:WINDOWSsystem32WgaLogon.dll [2009-03-10 239496]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifyWinCtrl32]
WinCtrl32.dll []

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad]
WPDShServiceObj — {AAA288BA-9A4C-45B0-95D7-94D524869DB5} — C:WINDOWSsystem32WPDShServiceObj.dll [2006-10-18 133632]
UPnPMonitor — {e57ce738-33e8-4c51-8354-bb4de9d215d1} — C:WINDOWSsystem32upnpui.dll [2008-04-14 239616]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerShellExecuteHooks]
«{16664848-0E00-11D2-8059-000000000000}»= []

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetcontrolsecurityproviders]
«SecurityProviders»=msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, digeste.dll,, digiwet.dll

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
«NoDispScrSavPage»=0
«DisableTaskMgr»=0

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
«dontdisplaylastusername»=0
«legalnoticecaption»=
«legalnoticetext»=
«shutdownwithoutlogon»=1
«undockwithoutlogon»=1
«DisableTaskMgr»=0

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoDriveTypeAutoRun»=5F000000
«»=
«NoFolderOptions»=0

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«HonorAutoRunSetting»=

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicystandardprofileauthorizedapplicationslist]
«C:WINDOWSsystem32sessmgr.exe»=»C:WINDOWSsystem32sessmgr.exe:*:Disabled:@xpsp2res.dll,-22019»
«C:Program FilesIVT CorporationBlueSoleilBlueSoleil.exe»=»C:Program FilesIVT CorporationBlueSoleilBlueSoleil.exe:*:Enabled:BlueSoleil»
«C:Program FilesReGet SoftwareReGet DeluxeReGetDx.exe»=»C:Program FilesReGet SoftwareReGet DeluxeReGetDx.exe:*:Enabled:ReGet 5.2»
«%windir%Network Diagnosticxpnetdiag.exe»=»%windir%Network Diagnosticxpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000»
«C:Program FilesVenomvenom.dll»=»C:Program FilesVenomvenom.dll:*:Enabled:Codename: Outbrake»
«C:Documents and SettingsElenaLocal SettingsTempElectronicArts_Patcher_000.exe»=»C:Documents and SettingsElenaLocal SettingsTempElectronicArts_Patcher_000.exe:*:Enabled:Command and Conquer 3 Tiberium Wars™ Launcher»
«C:GamesAct_of_WarActofwar.exe»=»C:GamesAct_of_WarActofwar.exe:*:Enabled:Actofwar»
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»
«C:Documents and SettingsAll UsersApplication Datacsrss.exe»=»C:Documents and SettingsAll UsersApplication Datacsrss.exe:*:Enabled:svchost»

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicydomainprofileauthorizedapplicationslist]
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»
«%windir%Network Diagnosticxpnetdiag.exe»=»%windir%Network Diagnosticxpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000»

======List of files/folders created in the last 3 months======

2009-10-25 18:20:16 —-D—- C:Program Filestrend micro
2009-10-25 18:20:14 —-DC—- C:rsit
2009-10-25 17:43:24 —-AC—- C:logit.txt
2009-10-14 15:36:23 —-HDC—- C:WINDOWS$NtUninstallKB958869$
2009-10-14 15:32:59 —-HDC—- C:WINDOWS$NtUninstallKB969059$
2009-10-14 15:32:49 —-HDC—- C:WINDOWS$NtUninstallKB954155_WM9$
2009-10-14 15:32:41 —-HDC—- C:WINDOWS$NtUninstallKB974112$
2009-10-14 15:32:30 —-HDC—- C:WINDOWS$NtUninstallKB975025$
2009-10-14 15:31:36 —-HDC—- C:WINDOWS$NtUninstallKB974571$
2009-10-14 15:31:18 —-HDC—- C:WINDOWS$NtUninstallKB971486$
2009-10-14 15:31:05 —-HDC—- C:WINDOWS$NtUninstallKB973525$
2009-10-14 15:30:46 —-HDC—- C:WINDOWS$NtUninstallKB975467$
2009-09-28 04:42:13 —-A—- C:Documents and SettingsElenaApplication Datamsmedia.dll
2009-09-24 04:20:00 —-D—- C:Documents and SettingsElenaApplication DataMozilla
2009-09-24 04:19:41 —-D—- C:Program FilesMozilla Firefox
2009-09-14 11:00:01 —-A—- C:WINDOWSsystem32logon.exe
2009-09-10 05:03:49 —-HDC—- C:WINDOWS$NtUninstallKB968816_WM9$
2009-09-10 05:03:13 —-HDC—- C:WINDOWS$NtUninstallKB956844$
2009-09-10 05:02:45 —-HDC—- C:WINDOWS$NtUninstallKB971961$
2009-09-08 05:01:32 —-HDC—- C:WINDOWS$NtUninstallKB968389$
2009-09-07 13:52:08 —-HDC—- C:WINDOWS$NtUninstallKB960859$
2009-09-07 13:51:58 —-HDC—- C:WINDOWS$NtUninstallKB971657$
2009-09-07 13:51:49 —-HDC—- C:WINDOWS$NtUninstallKB971557$
2009-09-07 13:51:38 —-HDC—- C:WINDOWS$NtUninstallKB956744$
2009-09-07 13:51:27 —-HDC—- C:WINDOWS$NtUninstallKB973869$
2009-09-07 13:51:17 —-HDC—- C:WINDOWS$NtUninstallKB973507$
2009-09-07 13:51:05 —-HDC—- C:WINDOWS$NtUninstallKB973354$
2009-09-07 13:50:46 —-HDC—- C:WINDOWS$NtUninstallKB973540_WM9$
2009-09-07 13:47:39 —-HDC—- C:WINDOWS$NtUninstallKB973815$
2009-09-07 13:46:27 —-HDC—- C:WINDOWS$NtUninstallKB970653-v3$

======List of files/folders modified in the last 3 months======

2009-10-25 18:20:16 —-RD—- C:Program Files
2009-10-25 18:12:45 —-D—- C:Program FilesSymantec AntiVirus
2009-10-25 18:08:15 —-D—- C:WINDOWSTemp
2009-10-25 18:06:12 —-D—- C:Program FilesYahoo!
2009-10-25 18:05:07 —-A—- C:WINDOWSSchedLgU.Txt
2009-10-25 18:04:13 —-D—- C:Documents and SettingsElenaApplication DataReGet Software
2009-10-25 17:57:23 —-SHD—- C:WINDOWSInstaller
2009-10-25 17:57:22 —-D—- C:Program FilesMarvell
2009-10-25 17:57:21 —-D—- C:WINDOWSsystem32
2009-10-25 16:58:48 —-HD—- C:WINDOWSinf
2009-10-25 16:50:55 —-D—- C:WINDOWSPrefetch
2009-10-25 16:12:42 —-D—- C:WINDOWSsystem32CatRoot2
2009-10-25 03:47:41 —-AC—- C:WINDOWSsystem32PerfStringBackup.INI
2009-10-24 13:35:13 —-D—- C:Program FilesWarcraft III
2009-10-15 04:24:43 —-D—- C:WINDOWS
2009-10-14 15:36:24 —-D—- C:WINDOWSWinSxS
2009-10-14 15:33:03 —-A—- C:WINDOWSimsins.BAK
2009-10-14 15:33:01 —-RSHDC—- C:WINDOWSsystem32dllcache
2009-10-14 15:32:13 —-D—- C:WINDOWSsystem32en-US
2009-10-14 15:32:13 —-D—- C:Program FilesInternet Explorer
2009-10-14 15:31:13 —-HD—- C:WINDOWS$hf_mig$
2009-10-02 21:01:57 —-A—- C:WINDOWSsystem32MRT.exe
2009-10-01 08:08:06 —-D—- C:WINDOWSMinidump
2009-09-27 20:16:13 —-D—- C:Documents and SettingsElenaApplication DataAdobe
2009-09-11 17:18:39 —-A—- C:WINDOWSsystem32msv1_0.dll
2009-09-08 05:01:35 —-D—- C:WINDOWSsystem32drivers
2009-09-07 13:51:08 —-D—- C:Program FilesOutlook Express
2009-09-05 00:03:36 —-A—- C:WINDOWSsystem32msasn1.dll
2009-08-29 10:36:27 —-A—- C:WINDOWSsystem32wininet.dll
2009-08-29 10:36:27 —-A—- C:WINDOWSsystem32webcheck.dll
2009-08-29 10:36:27 —-A—- C:WINDOWSsystem32urlmon.dll
2009-08-29 10:36:26 —-N—- C:WINDOWSsystem32occache.dll
2009-08-29 10:36:26 —-N—- C:WINDOWSsystem32mstime.dll
2009-08-29 10:36:26 —-N—- C:WINDOWSsystem32msrating.dll
2009-08-29 10:36:26 —-A—- C:WINDOWSsystem32url.dll
2009-08-29 10:36:26 —-A—- C:WINDOWSsystem32pngfilt.dll
2009-08-29 10:36:26 —-A—- C:WINDOWSsystem32mshtmled.dll
2009-08-29 10:36:26 —-A—- C:WINDOWSsystem32mshtml.dll
2009-08-29 10:36:25 —-N—- C:WINDOWSsystem32jsproxy.dll
2009-08-29 10:36:25 —-N—- C:WINDOWSsystem32iernonce.dll
2009-08-29 10:36:25 —-A—- C:WINDOWSsystem32msfeedsbs.dll
2009-08-29 10:36:25 —-A—- C:WINDOWSsystem32msfeeds.dll
2009-08-29 10:36:25 —-A—- C:WINDOWSsystem32iertutil.dll
2009-08-29 10:36:25 —-A—- C:WINDOWSsystem32ieframe.dll
2009-08-29 10:36:24 —-N—- C:WINDOWSsystem32iedkcs32.dll
2009-08-29 10:36:24 —-N—- C:WINDOWSsystem32ieaksie.dll
2009-08-29 10:36:24 —-N—- C:WINDOWSsystem32ieakeng.dll
2009-08-29 10:36:24 —-N—- C:WINDOWSsystem32extmgr.dll
2009-08-29 10:36:24 —-N—- C:WINDOWSsystem32corpol.dll
2009-08-29 10:36:24 —-A—- C:WINDOWSsystem32ieencode.dll
2009-08-29 10:36:24 —-A—- C:WINDOWSsystem32ieapfltr.dll
2009-08-29 10:36:24 —-A—- C:WINDOWSsystem32icardie.dll
2009-08-29 10:36:24 —-A—- C:WINDOWSsystem32dxtrans.dll
2009-08-29 10:36:24 —-A—- C:WINDOWSsystem32dxtmsft.dll
2009-08-29 10:36:24 —-A—- C:WINDOWSsystem32advpack.dll
2009-08-28 13:28:59 —-N—- C:WINDOWSsystem32ie4uinit.exe
2009-08-28 13:28:59 —-A—- C:WINDOWSsystem32ieudinit.exe
2009-08-27 08:18:41 —-N—- C:WINDOWSsystem32ieakui.dll
2009-08-26 11:00:21 —-A—- C:WINDOWSsystem32strmdll.dll
2009-08-13 18:16:05 —-A—- C:WINDOWSsystem32jscript.dll
2009-08-05 12:01:48 —-A—- C:WINDOWSsystem32mswebdvd.dll
2009-08-04 19:44:46 —-A—- C:WINDOWSsystem32ntoskrnl.exe
2009-08-04 17:20:08 —-A—- C:WINDOWSsystem32ntkrnlpa.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 eeCtrl;Symantec Eraser Control driver; ??C:Program FilesCommon FilesSymantec SharedEENGINEeeCtrl.sys []
R1 intelppm;Intel Processor Driver; C:WINDOWSsystem32DRIVERSintelppm.sys [2008-04-13 36352]
R1 prodrv04;Star Force copy protection driver v4; C:WINDOWSSystem32driversprodrv04.sys [2007-03-21 114496]
R1 SAVRT;SAVRT; ??C:Program FilesSymantec AntiVirussavrt.sys []
R1 SAVRTPEL;SAVRTPEL; ??C:Program FilesSymantec AntiVirusSavrtpel.sys []
R1 SYMTDI;SYMTDI; C:WINDOWSSystem32DriversSYMTDI.SYS [2005-10-19 195728]
R2 PfModNT;PfModNT; ??C:WINDOWSsystem32PfModNT.sys []
R2 PGPdisk;PGPdisk; C:WINDOWSsystem32driversPGPdisk.sys [2004-06-09 169120]
R2 PGPsdkDriver;PGPsdkDriver; C:WINDOWSSystem32DriversPGPsdk.sys [2004-06-09 26624]
R2 U3sHlpDr;U3sHlpDr; ??C:WINDOWSSystem32DriversU3sHlpDr.sys []
R3 aeaudio;aeaudio; C:WINDOWSsystem32driversaeaudio.sys [2003-03-13 100224]
R3 BlueletAudio;Bluetooth Audio Service; C:WINDOWSsystem32DRIVERSblueletaudio.sys [2005-08-31 20480]
R3 BlueletSCOAudio;Bluetooth SCO Audio Service; C:WINDOWSsystem32DRIVERSBlueletSCOAudio.sys [2005-08-31 20480]
R3 BT;Bluetooth PAN Network Adapter; C:WINDOWSsystem32DRIVERSbtnetdrv.sys [2005-04-30 10804]
R3 BTHidEnum;Bluetooth HID Enumerator; C:WINDOWSsystem32DRIVERSvbtenum.sys [2005-07-29 11988]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv; ??C:Program FilesCommon FilesSymantec SharedEENGINEEraserUtilRebootDrv.sys []
R3 NAVENG;NAVENG; ??C:PROGRA~1COMMON~1SYMANT~1VIRUSD~120091024.005naveng.sys []
R3 NAVEX15;NAVEX15; ??C:PROGRA~1COMMON~1SYMANT~1VIRUSD~120091024.005navex15.sys []
R3 nv;nv; C:WINDOWSsystem32DRIVERSnv4_mini.sys [2007-12-05 7435392]
R3 ROOTMODEM;Microsoft Legacy Modem Driver; C:WINDOWSSystem32DriversRootMdm.sys [2004-08-04 5888]
R3 smwdm;smwdm; C:WINDOWSsystem32driverssmwdm.sys [2003-06-02 578304]
R3 SymEvent;SymEvent; ??C:Program FilesSymantecSYMEVENT.SYS []
R3 SYMREDRV;SYMREDRV; C:WINDOWSSystem32DriversSYMREDRV.SYS [2005-10-19 24720]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:WINDOWSsystem32DRIVERSusbehci.sys [2008-04-13 30208]
R3 usbhub;USB2 Enabled Hub; C:WINDOWSsystem32DRIVERSusbhub.sys [2008-04-13 59520]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:WINDOWSsystem32DRIVERSusbuhci.sys [2008-04-13 20608]
R3 VComm;Virtual Serial port driver; C:WINDOWSsystem32DRIVERSVComm.sys [2004-10-19 61312]
R3 VcommMgr;Bluetooth VComm Manager Service; C:WINDOWSSystem32DriversVcommMgr.sys [2005-03-25 82148]
R3 yukonwxp;NDIS5.1 Miniport Driver for Marvell Yukon Ethernet Controller; C:WINDOWSsystem32DRIVERSyk51x86.sys [2004-08-19 189568]
S1 prodrv03;Star Force copy protection driver v3; ??C:WINDOWSsystem32driversprodrv03.sys []
S2 cmgzjsryskn;cmgzjsryskn; ??C:WINDOWSsystem32driverswmlduswubxqg.sys []
S3 a1p346uc;a1p346uc; C:WINDOWSsystem32driversa1p346uc.sys []
S3 Btcsrusb;Bluetooth USB For Bluetooth Service; C:WINDOWSSystem32Driversbtcusb.sys [2005-07-29 23000]
S3 BTNetFilter;Bluetooth Network Filter; ??C:WINDOWSsystem32driversBTNetFilter.sys []
S3 CCDECODE;Closed Caption Decoder; C:WINDOWSsystem32DRIVERSCCDECODE.sys [2008-04-13 17024]
S3 MidiSyn;MidiSyn; C:WINDOWSsystem32driversMidiSyn.sys [2002-09-20 235100]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:WINDOWSsystem32driversMSTEE.sys [2008-04-13 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:WINDOWSsystem32DRIVERSNABTSFEC.sys [2008-04-13 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:WINDOWSsystem32DRIVERSNdisIP.sys [2008-04-13 10880]
S3 nmwcd;Nokia USB Phone Parent; C:WINDOWSsystem32driversccdcmb.sys [2008-05-07 17536]
S3 nmwcdc;Nokia USB Generic; C:WINDOWSsystem32driversccdcmbo.sys [2008-05-07 20864]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:WINDOWSsystem32DRIVERSpccsmcfd.sys [2007-09-17 21632]
S3 pcouffin;VSO Software pcouffin; C:WINDOWSSystem32Driverspcouffin.sys [2008-02-02 47360]
S3 SLIP;BDA Slip De-Framer; C:WINDOWSsystem32DRIVERSSLIP.sys [2008-04-13 11136]
S3 SPBBCDrv;SPBBCDrv; ??C:Program FilesCommon FilesSymantec SharedSPBBCSPBBCDrv.sys []
S3 streamip;BDA IPSink; C:WINDOWSsystem32DRIVERSStreamIP.sys [2008-04-13 15232]
S3 upperdev;upperdev; C:WINDOWSsystem32DRIVERSusbser_lowerflt.sys [2008-06-06 8064]
S3 usbprint;Microsoft USB PRINTER Class; C:WINDOWSsystem32DRIVERSusbprint.sys [2008-04-13 25856]
S3 usbser;USB Modem Driver; C:WINDOWSsystem32driversusbser.sys [2008-04-13 26112]
S3 usbserfilt;usbserfilt; C:WINDOWSsystem32DRIVERSusbser_lowerfltj.sys [2008-05-07 8064]
S3 USBSTOR;USB Mass Storage Driver; C:WINDOWSsystem32DRIVERSUSBSTOR.SYS [2008-04-13 26368]
S3 wdf01000;Wdf01000; C:WINDOWSsystem32DRIVERSWdf01000.sys [2006-11-02 492000]
S3 WpdUsb;WpdUsb; C:WINDOWSsystem32DRIVERSwpdusb.sys [2006-10-18 38528]
S3 WSTCODEC;World Standard Teletext Codec; C:WINDOWSsystem32DRIVERSWSTCODEC.SYS [2008-04-13 19200]
S3 WudfRd;Windows Driver Foundation — User-mode Driver Framework Reflector; C:WINDOWSsystem32DRIVERSwudfrd.sys [2006-09-15 82688]
S4 dwshd;dwshd; C:WINDOWSSystem32driversdwshd.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 BlueSoleil Hid Service;BlueSoleil Hid Service; C:Program FilesIVT CorporationBlueSoleilBTNtService.exe [2005-04-06 110592]
R2 ccEvtMgr;Symantec Event Manager; C:Program FilesCommon FilesSymantec SharedccEvtMgr.exe [2005-10-04 185968]
R2 ccSetMgr;Symantec Settings Manager; C:Program FilesCommon FilesSymantec SharedccSetMgr.exe [2005-10-04 177776]
R2 DefWatch;Symantec AntiVirus Definition Watcher; C:Program FilesSymantec AntiVirusDefWatch.exe [2005-11-15 20208]
R2 NVSvc;NVIDIA Display Driver Service; C:WINDOWSsystem32nvsvc32.exe [2007-12-05 155716]
R2 PGPserv;PGPserv; C:WINDOWSsystem32PGPserv.exe [2004-06-09 69632]
R2 SoundMAX Agent Service (default);SoundMAX Agent Service; C:Program FilesAnalog DevicesSoundMAXSMAgent.exe [2002-09-20 45056]
R2 Symantec AntiVirus;Symantec AntiVirus; C:Program FilesSymantec AntiVirusRtvscan.exe [2005-11-15 1756912]
R2 WMDM PMSP Service;WMDM PMSP Service; C:WINDOWSsystem32MsPMSPSv.exe [2000-06-26 53520]
R2 WudfSvc;Windows Driver Foundation — User-mode Driver Framework; C:WINDOWSsystem32svchost.exe [2008-04-14 14336]
R3 ServiceLayer;ServiceLayer; C:Program FilesPC Connectivity SolutionServiceLayer.exe [2008-08-07 575488]
S2 RasAutoLmHosts;Remote Access Auto Connection Manager RasAutoLmHosts; C:WINDOWSsystem32actxprxyc.exe srv []
S3 ccPwdSvc;Symantec Password Validation; C:Program FilesCommon FilesSymantec SharedccPwdSvc.exe [2005-10-04 83568]
S3 IDriverT;InstallDriver Table Manager; C:Program FilesCommon FilesInstallShieldDriver11Intel 32IDriverT.exe [2005-04-03 69632]
S3 ose;Office Source Engine; C:Program FilesCommon FilesMicrosoft SharedSource EngineOSE.EXE [2003-07-28 89136]
S3 SavRoam;SAVRoam; C:Program FilesSymantec AntiVirusSavRoam.exe [2005-11-15 169200]
S3 SNDSrvc;Symantec Network Drivers Service; C:Program FilesCommon FilesSymantec SharedSNDSrvc.exe [2005-10-19 214672]
S3 SPBBCSvc;Symantec SPBBCSvc; C:Program FilesCommon FilesSymantec SharedSPBBCSPBBCSvc.exe [2005-03-30 992864]

EOF
28 октября, 2009 в 6:05 пп #26501
Admin
Keymaster
- Темы:40
- Сообщений:5676
Здравствуйте, добро пожаловать на Spyware-ru форум.

Запустите HijackThis, для этого кликните Пуск, Выполнить, введите
```
C:Program Filestrend microElena.exe
```
и нажмите Enter.
Кликните по кнопке Do a system scan only.
Далее отметьте галочкой (слева) следующие строки, если они присутствуют:
```
F2 - REG:system.ini: Shell=Explorer.exe logon.exe

F2 - REG:system.ini: UserInit=C:WINDOWSsystem32userinit.exe
```
Закройте все запущенные программы (включая InternetExplorer) и окна Windows.
Кликните по кнопке Fix checked и подтвердите свои действия выбрав YES.

Скачайте OTM by OldTimer кликнув по этой ссылке.
Запустите OTM и в большое поле ввода (заголовок этого поля выделен желтым цветом) скопируйте следующий текст.
```
:services

cmgzjsryskn

a1p346uc

dwshd



:reg

[-HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{88888888-8888-8888-8888-888888888888}]

[-HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{9D64F819-9380-8473-DAB2-702FCB3D7A3E}]



[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun]

"lsass driver"=-

"services"=-



[-HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifycrypt]

[-HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifyCsrss]

[-HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifyWinCtrl32]



[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerShellExecuteHooks]

"{16664848-0E00-11D2-8059-000000000000}"=-



[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetcontrolsecurityproviders]

"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"



:files

C:WINDOWSsystem32digeste.dll

C:WINDOWSsystem32digiwet.dll

C:Documents and SettingsElenaApplication Datamsmedia.dll

C:WINDOWSsystem32logon.exe

C:WINDOWSsystem32driverswmlduswubxqg.sys

C:WINDOWSsystem32driversa1p346uc.sys

C:WINDOWSSystem32driversdwshd.sys



:Commands

[emptytemp]

[Reboot]
```
Проверьте вставленный скрипт, если слева перед директивами появились пробелы, то удалите их, скрипт должен выглядеть так же как в сообщении. Кликните по кнопке MoveIt!. В процессе работы возможна перезагрузка компьютера.
По-завершении работы программы должен будет показан лог. Если лог не будет показан, то его можно найти в папке C:_OTMMovedFiles.

Вставьте в ваше ответное сообщение содержимое этого лога. И приложите свежий RSIT лог.
Автор

Сообщения

Просмотр 3 сообщений - с 1 по 3 (из 3 всего)

Для ответа в этой теме необходимо авторизоваться.

Помогите убрать порнобаннер со страниц в интернете!

Добро пожаловать

Поиск

Последние темы

СПАЙВАРЕ РУ

Нужна помощь?

Ссылки