Порно-баннер на рабочем столе.

[Аноним]

Ситуация стандартная. Просит отправить смс или же 999 просмотров рекламы.
info:
info.txt logfile of random’s system information tool 1.06 2009-07-02 19:44:33

======Uninstall list======

—>MsiExec.exe /X{E9F81423-211E-46B6-9AE0-38568BC5CF6F}
—>MsiExec /X{699BAC7F-DC10-4709-97D8-45379301BBE7}
—>rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:WINDOWSINFPCHealth.inf
Acer eDisplay Management—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1PROFES~1RunTime110Intel32Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{A586DC50-B18D-48FB-B7CC-A598200457C2}setup.exe» -l0x19 -removeonly
Adobe Flash Player 10 ActiveX—>C:WINDOWSsystem32MacromedFlashuninstall_activeX.exe
Adobe Flash Player 10 Plugin—>C:WINDOWSsystem32MacromedFlashuninstall_plugin.exe
Adobe Reader 7.0.5—>MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A70500000002}
AVG Free 8.5—>C:Program FilesAVGAVG8setup.exe /UNINSTALL
Bluetooth Stack for Windows—>MsiExec.exe /X{CEBB6BFB-D708-4F99-A633-BC2600E01EF6}
FIFA Manager 09—>»C:Documents and SettingsМитяйкоMy DocumentsMy GamesФИФАFIFA Manager 09unins000.exe»
GOM Player—>»C:Program FilesGRETECHGomPlayerUninstall.exe»
Heroes of Might and Magic V—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1engine6INTEL3~1Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{CB9A636A-AF2D-4B03-AE8B-8FE99AC197E8}setup.exe» -l0x19
High Definition Audio Driver Package — KB888111—>»C:WINDOWS$NtUninstallKB888111WXPSP2$spuninstspuninst.exe»
HijackThis 2.0.2—>»C:Program Filestrend microHijackThis.exe» /uninstall
Microsoft Visual C++ 2005 Redistributable—>MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Mozilla Thunderbird (2.0.0.21)—>C:Program FilesMozilla Thunderbirduninstallhelper.exe
NVIDIA Drivers—>C:WINDOWSsystem32nvuninst.exe UninstallGUI
NVIDIA PhysX v8.08.01—>MsiExec.exe /X{699BAC7F-DC10-4709-97D8-45379301BBE7}
OpenOffice.org 3.0—>MsiExec.exe /I{87A1E0E0-BAA6-40DD-82D6-7CFEEA05B3F9}
Opera 9.63—>MsiExec.exe /X{1BC4026B-1957-4514-9058-2B542557F143}
Pivot Software—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1PROFES~1RunTime110Intel32Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{0217E1D1-BCEF-4A61-AF6D-F7740F65A066}setup.exe» -l0x19 -removeonly
Punto Switcher 3.0—>C:Program FilesPunto Switcheruninstall.exe
QIP Infium 2.0.9024 RC4—>»C:Program FilesQIP Infiumunins000.exe»
QIP.Online—>C:Program FilesQIP.OnlineUninstall.exe
Ragnarok Online—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1PROFES~1RunTime100Intel32Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{7D9A0F3A-975B-4B65-B8FD-B2E7DEF522A4}setup.exe» -l0x19 -removeonly
Realtek High Definition Audio Driver—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1PROFES~1RunTime1150Intel32Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}Setup.exe» -l0x19 -removeonly
Sable Universal Patcher for 1C:Enterprise—>C:PROGRA~1SableUNWISE.EXE C:PROGRA~1SableINSTALL.LOG
Sable Universal Patcher—>C:PROGRA~1SableUNWISE.EXE C:PROGRA~1SableINSTALL.LOG
SDK—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1PROFES~1RunTime110Intel32Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{0DEA342C-15CB-4F52-97B6-06A9C4B9C06F}setup.exe» -l0x9
Sid Meier’s Civilization IV: The Ancient Mediterranean—>»E:GamesЦивилизацияSid Meier’s Civilization IV — The Ancient Mediterraneanunins000.exe»
TeamSpeak 2 RC2—>»C:Program FilesTeamspeak2_RC2unins000.exe»
Ventrilo Client—>MsiExec.exe /I{789289CA-F73A-4A16-A331-54D498CE069F}
Архиватор WinRAR—>C:Program FilesWinRARuninstall.exe
Бесплатный контент Aldea—>C:Documents and SettingsМитяйкоApplication DataAldeaAldeaUninstall.exe
Доступ к условно бесплатному контенту AdSubscribe—>C:Documents and SettingsМитяйкоApplication DataAdSubscribeUninstall.exe
Русификатор Teamspeak 2 Client (RC2) v2.0.32.60—>C:Program FilesTeamspeak2_RC2uninstall.exe
Таня Гроттер и Магический контрабас—>»E:GamesТаня ГроттерТаня Гроттер и Магический контрабасunins000.exe»

======Security center information======

AV: AVG Anti-Virus Free

======System event log======

Computer Name: MITYAIKO
Event Code: 4226
Message: TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.

Record Number: 4800
Source Name: Tcpip
Time Written: 20090427012226.000000+240
Event Type: warning
User:

Computer Name: MITYAIKO
Event Code: 4226
Message: TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.

Record Number: 4799
Source Name: Tcpip
Time Written: 20090427005447.000000+240
Event Type: warning
User:

Computer Name: MITYAIKO
Event Code: 36
Message: The time service has not been able to synchronize the system time
for 49152 seconds because none of the time providers has been able to
provide a usable time stamp. The system clock is unsynchronized.

Record Number: 4798
Source Name: W32Time
Time Written: 20090427001610.000000+240
Event Type: warning
User:

Computer Name: MITYAIKO
Event Code: 4226
Message: TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.

Record Number: 4797
Source Name: Tcpip
Time Written: 20090426212107.000000+240
Event Type: warning
User:

Computer Name: MITYAIKO
Event Code: 14
Message: Unknown error on CMDre 00000000 00000640 00000101 00000004 00000084

Record Number: 4793
Source Name: nv
Time Written: 20090426103713.000000+240
Event Type: error
User:

=====Application event log=====

Computer Name: MITYAIKO
Event Code: 1000
Message: Faulting application dthtml.exe, version 1.0.0.1, faulting module ntdll.dll, version 5.1.2600.2180, fault address 0x000122ba.

Record Number: 432
Source Name: Application Error
Time Written: 20090110185841.000000+180
Event Type: error
User:

Computer Name: MITYAIKO
Event Code: 1002
Message: Hanging application opera.exe, version 9.63.10476.0, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Record Number: 419
Source Name: Application Hang
Time Written: 20090109194303.000000+180
Event Type: error
User:

Computer Name: MITYAIKO
Event Code: 1000
Message: Faulting application dthtml.exe, version 1.0.0.1, faulting module ntdll.dll, version 5.1.2600.2180, fault address 0x00010c27.

Record Number: 417
Source Name: Application Error
Time Written: 20090109170922.000000+180
Event Type: error
User:

Computer Name: MITYAIKO
Event Code: 1000
Message: Faulting application 1cv7.exe, version 7.70.0.25, faulting module 1cv7.exe, version 7.70.0.25, fault address 0x0003f639.

Record Number: 409
Source Name: Application Error
Time Written: 20090108224459.000000+180
Event Type: error
User:

Computer Name: MITYAIKO
Event Code: 1000
Message: Faulting application 1cv7.exe, version 7.70.0.25, faulting module 1cv7.exe, version 7.70.0.25, fault address 0x0003f639.

Record Number: 407
Source Name: Application Error
Time Written: 20090108224300.000000+180
Event Type: error
User:

======Environment variables======

«ComSpec»=%SystemRoot%system32cmd.exe
«Path»=%SystemRoot%system32;%SystemRoot%;%SystemRoot%System32Wbem
«windir»=%SystemRoot%
«FP_NO_HOST_CHECK»=NO
«OS»=Windows_NT
«PROCESSOR_ARCHITECTURE»=x86
«PROCESSOR_LEVEL»=6
«PROCESSOR_IDENTIFIER»=x86 Family 6 Model 23 Stepping 6, GenuineIntel
«PROCESSOR_REVISION»=1706
«NUMBER_OF_PROCESSORS»=2
«PATHEXT»=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
«TEMP»=%SystemRoot%TEMP
«TMP»=%SystemRoot%TEMP

---

EOF

---

log:
Logfile of random’s system information tool 1.06 (written by random/random)
Run by Митяйко at 2009-07-02 19:44:23
Microsoft Windows XP Professional Service Pack 2
System drive C: has 24 GB (58%) free of 41 GB
Total RAM: 3327 MB (79% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:44:33, on 02.07.2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSExplorer.EXE
C:WINDOWSsystem32RUNDLL32.EXE
C:Program FilesPortrait DisplaysPivot Softwarewpctrl.exe
C:WINDOWSRTHDCPL.EXE
C:PROGRA~1AVGAVG8avgtray.exe
C:Program FilesPunto Switcherpunto.exe
C:Program FilesQIP.Onlineqiponline.exe
C:Program FilesQIP Infiuminfium.exe
C:Program FilesToshibaBluetooth Toshiba StackTosBtMng.exe
C:Program FilesAcer DisplayeDisplay ManagementDTHtml.exe
C:Program FilesPortrait DisplaysPivot Softwarefloater.exe
C:Program FilesCommon FilesPortrait DisplaysSharedHookManager.exe
C:Program FilesToshibaBluetooth Toshiba StackTosA2dp.exe
C:Program FilesToshibaBluetooth Toshiba StackTosBtHid.exe
C:Program FilesToshibaBluetooth Toshiba StackTosBtHsp.exe
C:PROGRA~1AVGAVG8avgwdsvc.exe
C:Program FilesCommon FilesPortrait DisplaysSharedDTSRVC.exe
C:WINDOWSsystem32nvsvc32.exe
C:Program FilesCommon FilesPortrait DisplaysDriverspdisrvc.exe
C:WINDOWSsystem32svchost.exe
C:PROGRA~1AVGAVG8avgemc.exe
C:PROGRA~1AVGAVG8avgrsx.exe
C:PROGRA~1AVGAVG8avgnsx.exe
C:Program FilesAVGAVG8avgcsrvx.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32wuauclt.exe
C:WINDOWSsystem32wscntfy.exe
C:Program FilesOperaopera.exe
C:Program FilesAVGAVG8avgui.exe
C:Program FilesAVGAVG8avgscanx.exe
C:Program FilesAVGAVG8avgcsrvx.exe
C:Documents and SettingsМитяйкоDesktopRSIT.exe
C:Program Filestrend microМитяйко.exe

R0 — HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://google.com/
O2 — BHO: AcroIEHlprObj Class — {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} — C:Program FilesAdobeAcrobat 7.0ActiveXAcroIEHelper.dll
O2 — BHO: WormRadar.com IESiteBlocker.NavFilter — {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} — C:Program FilesAVGAVG8avgssie.dll
O2 — BHO: Доступ к платному контенту Aldea v1.5.2 — {B8F88615-A49E-4443-A26F-E97379BE1B1A} — C:DOCUME~17323~1APPLIC~1AldeaAldea.dll
O4 — HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSsystem32NvCpl.dll,NvStartup
O4 — HKLM..Run: [nwiz] nwiz.exe /install
O4 — HKLM..Run: [NvMediaCenter] RUNDLL32.EXE C:WINDOWSsystem32NvMcTray.dll,NvTaskbarInit
O4 — HKLM..Run: [PivotSoftware] «C:Program FilesPortrait DisplaysPivot Softwarewpctrl.exe»
O4 — HKLM..Run: [DT ACR] C:Program FilesCommon FilesPortrait DisplaysSharedDT_startup.exe -ACR
O4 — HKLM..Run: [RTHDCPL] RTHDCPL.EXE
O4 — HKLM..Run: [Alcmtr] ALCMTR.EXE
O4 — HKLM..Run: [AVG8_TRAY] C:PROGRA~1AVGAVG8avgtray.exe
O4 — HKCU..Run: [Punto Switcher] C:Program FilesPunto Switcherpunto.exe
O4 — HKCU..Run: [QIP.Online] C:Program FilesQIP.Onlineqiponline.exe auto_start
O4 — HKCU..Run: [Infium] «C:Program FilesQIP Infiuminfium.exe»
O4 — Startup: Start HASP-Emu.lnk = C:Program Files1C77SableWINNTinstnt.bat
O4 — Global Startup: Adobe Reader Speed Launch.lnk = C:Program FilesAdobeAcrobat 7.0Readerreader_sl.exe
O4 — Global Startup: Bluetooth Manager.lnk = ?
O9 — Extra button: Messenger — {FB5F1910-F110-11d2-BB9E-00C04F795683} — C:Program FilesMessengermsmsgs.exe
O9 — Extra ‘Tools’ menuitem: Windows Messenger — {FB5F1910-F110-11d2-BB9E-00C04F795683} — C:Program FilesMessengermsmsgs.exe
O16 — DPF: {7876E4A5-78B7-4020-B08F-C960A1ED54C9} (WebWatch Class) — http://78.111.176.34:1280/AL/WinWebPush.cab
O18 — Protocol: linkscanner — {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} — C:Program FilesAVGAVG8avgpp.dll
O20 — Winlogon Notify: avgrsstarter — C:WINDOWSSYSTEM32avgrsstx.dll
O23 — Service: Application Driver Auto Removal Service (01) (appdrvrem01) — Protection Technology — C:WINDOWSSystem32appdrvrem01.exe
O23 — Service: AVG Free8 E-mail Scanner (avg8emc) — AVG Technologies CZ, s.r.o. — C:PROGRA~1AVGAVG8avgemc.exe
O23 — Service: AVG Free8 WatchDog (avg8wd) — AVG Technologies CZ, s.r.o. — C:PROGRA~1AVGAVG8avgwdsvc.exe
O23 — Service: Portrait Displays Display Tune Service (DTSRVC) — Unknown owner — C:Program FilesCommon FilesPortrait DisplaysSharedDTSRVC.exe
O23 — Service: NVIDIA Display Driver Service (NVSvc) — NVIDIA Corporation — C:WINDOWSsystem32nvsvc32.exe
O23 — Service: Portrait Displays SDK Service (PdiService) — Portrait Displays, Inc. — C:Program FilesCommon FilesPortrait DisplaysDriverspdisrvc.exe

—
End of file — 4788 bytes

======Registry dump======

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class — C:Program FilesAdobeAcrobat 7.0ActiveXAcroIEHelper.dll [2005-09-23 63136]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}]
AVG Safe Search — C:Program FilesAVGAVG8avgssie.dll [2009-06-06 1107224]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{B8F88615-A49E-4443-A26F-E97379BE1B1A}]
Доступ к платному контенту Aldea v1.5.2 — C:DOCUME~17323~1APPLIC~1AldeaAldea.dll [2009-06-28 573440]

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun]
«NvCplDaemon»=C:WINDOWSsystem32NvCpl.dll [2008-08-02 13570048]
«nwiz»=nwiz.exe /install []
«NvMediaCenter»=C:WINDOWSsystem32NvMcTray.dll [2008-08-02 86016]
«PivotSoftware»=C:Program FilesPortrait DisplaysPivot Softwarewpctrl.exe [2007-02-09 694008]
«DT ACR»=C:Program FilesCommon FilesPortrait DisplaysSharedDT_startup.exe [2008-06-06 81920]
«RTHDCPL»=C:WINDOWSRTHDCPL.EXE [2008-02-13 16857600]
«Alcmtr»=C:WINDOWSALCMTR.EXE [2005-05-03 69632]
«AVG8_TRAY»=C:PROGRA~1AVGAVG8avgtray.exe [2009-06-12 1948440]

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun]
«Punto Switcher»=C:Program FilesPunto Switcherpunto.exe [2008-10-16 735016]
«QIP.Online»=C:Program FilesQIP.Onlineqiponline.exe [2009-06-23 3393024]
«Infium»=C:Program FilesQIP Infiuminfium.exe [2009-02-03 5136384]

C:Documents and SettingsAll UsersStart MenuProgramsStartup
Adobe Reader Speed Launch.lnk — C:Program FilesAdobeAcrobat 7.0Readerreader_sl.exe
Bluetooth Manager.lnk — C:Program FilesToshibaBluetooth Toshiba StackTosBtMng.exe

C:Documents and SettingsМитяйкоStart MenuProgramsStartup
Start HASP-Emu.lnk — C:Program Files1C77SableWINNTinstnt.bat

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifyavgrsstarter]
C:WINDOWSsystem32avgrsstx.dll [2009-06-06 11952]

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
«dontdisplaylastusername»=0
«legalnoticecaption»=
«legalnoticetext»=
«shutdownwithoutlogon»=1
«undockwithoutlogon»=1

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoDriveTypeAutoRun»=145

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicystandardprofileauthorizedapplicationslist]
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»
«C:Program FilesVentriloVentrilo.exe»=»C:Program FilesVentriloVentrilo.exe:*:Enabled:Ventrilo.exe»
«C:Program FilesAVGAVG8avgemc.exe»=»C:Program FilesAVGAVG8avgemc.exe:*:Enabled:avgemc.exe»
«C:Program FilesAVGAVG8avgupd.exe»=»C:Program FilesAVGAVG8avgupd.exe:*:Enabled:avgupd.exe»
«C:Program FilesAVGAVG8avgnsx.exe»=»C:Program FilesAVGAVG8avgnsx.exe:*:Enabled:avgnsx.exe»

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicydomainprofileauthorizedapplicationslist]
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{8acf39c2-caf0-11dd-95cf-0021853fa739}]
shellAutoRuncommand — F:AutoRun.exe

======List of files/folders created in the last 1 months======

2009-07-02 19:44:24 —-D—- C:Program Filestrend micro
2009-07-02 19:44:23 —-D—- C:rsit
2009-07-02 18:58:34 —-HT—- C:WINDOWSsystem328ba6f2e.dll
2009-07-02 18:58:34 —-HT—- C:WINDOWSsystem3275440e6.dll
2009-07-02 18:58:10 —-HT—- C:WINDOWSsystem328da93d1.dll
2009-07-02 18:58:10 —-HT—- C:WINDOWSsystem322bca42b.dll
2009-07-02 15:36:47 —-D—- C:Program FilesGravity
2009-06-28 13:50:30 —-D—- C:Documents and SettingsМитяйкоApplication DataAdSubscribe
2009-06-14 13:26:31 —-D—- C:Documents and SettingsМитяйкоApplication DataMy Games
2009-06-07 21:28:34 —-D—- C:Program FilesToshiba
2009-06-07 21:28:03 —-SHD—- C:Config.Msi
2009-06-07 21:06:31 —-A—- C:WINDOWSWirelessFTP.INI
2009-06-07 16:33:52 —-A—- C:WINDOWSIE4 Error Log.txt
2009-06-06 20:47:25 —-HD—- C:$AVG8.VAULT$
2009-06-06 20:43:29 —-A—- C:WINDOWSsystem32avgrsstx.dll
2009-06-06 20:43:14 —-D—- C:Program FilesAVG
2009-06-06 20:43:14 —-D—- C:Documents and SettingsAll UsersApplication Dataavg8

======List of files/folders modified in the last 1 months======

2009-07-02 19:44:24 —-RD—- C:Program Files
2009-07-02 19:32:33 —-D—- C:Documents and SettingsМитяйкоApplication DataQIP.Online
2009-07-02 18:58:34 —-D—- C:WINDOWSsystem32drivers
2009-07-02 18:58:34 —-D—- C:WINDOWSsystem32
2009-07-02 18:32:45 —-D—- C:WINDOWSTemp
2009-07-02 18:32:31 —-HD—- C:WINDOWSinf
2009-07-02 18:31:41 —-A—- C:WINDOWSSchedLgU.Txt
2009-07-02 15:36:47 —-D—- C:WINDOWSPrefetch
2009-06-29 14:10:14 —-D—- C:Documents and SettingsМитяйкоApplication DataAldea
2009-06-27 02:17:24 —-D—- C:Program FilesMozilla Thunderbird
2009-06-24 20:45:10 —-D—- C:Program FilesQIP.Online
2009-06-15 15:28:26 —-D—- C:Documents and Settings
2009-06-07 21:28:44 —-SHD—- C:WINDOWSInstaller
2009-06-07 21:06:31 —-D—- C:WINDOWS
2009-06-07 20:51:48 —-D—- C:WINDOWSsystem32CatRoot2
2009-06-07 10:03:05 —-D—- C:Program FilesEset
2009-06-06 20:43:12 —-D—- C:WINDOWSWinSxS
2009-06-06 20:43:12 —-D—- C:Program FilesCommon FilesMicrosoft Shared
2009-06-06 20:42:29 —-SD—- C:Documents and SettingsМитяйкоApplication DataMicrosoft
2009-06-04 15:51:14 —-RSHDC—- C:WINDOWSsystem32dllcache

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 appdrv01;Application Driver (01); C:WINDOWSSystem32Driversappdrv01.sys [2008-12-18 2283624]
R1 AvgLdx86;AVG Free AVI Loader Driver x86; C:WINDOWSSystem32Driversavgldx86.sys [2009-06-12 327688]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86; C:WINDOWSSystem32Driversavgmfx86.sys [2009-06-19 27784]
R1 AvgTdiX;AVG Free8 Network Redirector; C:WINDOWSSystem32Driversavgtdix.sys [2009-06-06 108552]
R1 intelppm;Intel Processor Driver; C:WINDOWSsystem32DRIVERSintelppm.sys [2006-02-28 36096]
R1 Pivot;Pivot; C:WINDOWSSystem32driverspivot.sys [2007-02-09 17465]
R1 Tosrfcom;Bluetooth RFCOMM from TOSHIBA; C:WINDOWSSystem32Driverstosrfcom.sys [2005-08-01 64896]
R2 HaspNT;HaspNT; ??C:WINDOWSsystem32haspnt.sys []
R3 EagleNT;EagleNT; ??C:WINDOWSsystem32driversEagleNT.sys []
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:WINDOWSsystem32DRIVERSHDAudBus.sys [2005-01-07 138752]
R3 HidUsb;Microsoft HID Class Driver; C:WINDOWSsystem32DRIVERShidusb.sys [2001-08-17 9600]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:WINDOWSsystem32driversRtkHDAud.sys [2008-02-14 4676096]
R3 mouhid;Mouse HID Driver; C:WINDOWSsystem32DRIVERSmouhid.sys [2001-08-17 12160]
R3 nv;nv; C:WINDOWSsystem32DRIVERSnv4_mini.sys [2008-08-02 6121856]
R3 PdiPorts;Portrait Displays low level device driver; C:WINDOWSSystem32DriversPdiPorts.sys [2008-06-04 17064]
R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; C:WINDOWSsystem32DRIVERSRtenicxp.sys [2008-01-03 105856]
R3 tosporte;Bluetooth Port Driver from Toshiba; C:WINDOWSsystem32DRIVERStosporte.sys [2005-11-24 47104]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:WINDOWSsystem32DRIVERSusbehci.sys [2006-02-28 26624]
R3 usbhub;USB2 Enabled Hub; C:WINDOWSsystem32DRIVERSusbhub.sys [2006-02-28 57600]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:WINDOWSsystem32DRIVERSusbuhci.sys [2006-02-28 20480]
S3 GMSIPCI;GMSIPCI; ??D:INSTALLGMSIPCI.SYS []
S3 NTACCESS;NTACCESS; ??D:NTACCESS.sys []
S3 pivotmou;Pivot Mouse/Pointers Filter Driver; ??C:WINDOWSsystem32driverspivotmou.sys []
S3 SetupNTGLM7X;SetupNTGLM7X; ??D:NTGLM7X.sys []
S3 toshidpt;TOSHIBA Bluetooth HID port driver; C:WINDOWSsystem32driversToshidpt.sys [2005-07-11 3712]
S3 Tosrfbd;Bluetooth RFBUS from TOSHIBA; C:WINDOWSSystem32Driverstosrfbd.sys [2006-02-02 108928]
S3 Tosrfbnp;Bluetooth RFBNEP from TOSHIBA; C:WINDOWSSystem32Driverstosrfbnp.sys [2005-12-14 37632]
S3 Tosrfhid;Bluetooth RFHID from TOSHIBA; C:WINDOWSsystem32DRIVERSTosrfhid.sys [2006-02-08 62848]
S3 tosrfnds;Bluetooth Personal Area Network from TOSHIBA; C:WINDOWSsystem32DRIVERStosrfnds.sys [2005-01-06 18612]
S3 TosRfSnd;Bluetooth Audio Device (WDM) from TOSHIBA; C:WINDOWSsystem32driversTosRfSnd.sys [2005-11-11 52864]
S3 Tosrfusb;Bluetooth USB Controller; C:WINDOWSSystem32Driverstosrfusb.sys [2006-01-31 39808]
S3 usbccgp;Microsoft USB Generic Parent Driver; C:WINDOWSsystem32DRIVERSusbccgp.sys [2004-08-03 31616]
S3 usbscan;USB Scanner Driver; C:WINDOWSsystem32DRIVERSusbscan.sys [2004-08-03 15104]
S3 USBSTOR;USB Mass Storage Driver; C:WINDOWSsystem32DRIVERSUSBSTOR.SYS [2004-08-04 26496]
S4 IntelIde;IntelIde; C:WINDOWSsystem32driversIntelIde.sys []
S4 WS2IFSL;Windows Socket 2.0 Non-IFS Service Provider Support Environment; C:WINDOWSSystem32driversws2ifsl.sys [2006-02-28 12032]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 avg8emc;AVG Free8 E-mail Scanner; C:PROGRA~1AVGAVG8avgemc.exe [2009-06-19 906520]
R2 avg8wd;AVG Free8 WatchDog; C:PROGRA~1AVGAVG8avgwdsvc.exe [2009-06-06 298776]
R2 DTSRVC;Portrait Displays Display Tune Service; C:Program FilesCommon FilesPortrait DisplaysSharedDTSRVC.exe [2008-06-06 69632]
R2 NVSvc;NVIDIA Display Driver Service; C:WINDOWSsystem32nvsvc32.exe [2008-08-02 163908]
R2 PdiService;Portrait Displays SDK Service; C:Program FilesCommon FilesPortrait DisplaysDriverspdisrvc.exe [2008-06-04 90112]
S2 appdrvrem01;Application Driver Auto Removal Service (01); C:WINDOWSSystem32appdrvrem01.exe [2008-12-18 304528]

---

EOF

---

Помогите, пожалуйста

[Admin]

Здравствуйте, добро пожаловать на Spyware-ru форум.

Скачайте программу Combofix. Закройте все открытые окна и запустите эту программу.
После выполнения будет создан лог файл, пожалуйста вставьте его в ваш ответ.

Примечание: перед использованием Combofix обязательно установите Recovery console. Как это сделать будет описано на странице, ссылку на которую я привёл выше.

[Автор]

Сообщения