Посмотрите пожалуйста Лог

This topic has 1 ответ, 2 участника, and was last updated 16 years, 3 months назад by Admin.

Просмотр 2 сообщений - с 1 по 2 (из 2 всего)

Автор

Сообщения
24 января, 2009 в 10:21 дп #16187
King1977
Participant
- Темы:1
- Сообщений:1
Выгрузил Лог из вашей утилиты для проверки…
Прошу Вас оказать помощь в лечении данного компьютера.

Logfile of random’s system information tool 1.05 (written by random/random)
Run by Администратор at 2009-01-23 19:32:44
Microsoft Windows XP Professional Service Pack 2
System drive C: has 2 GB (19%) free of 8 GB
Total RAM: 511 MB (34% free)
info.txt logfile of random’s system information tool 1.05 2009-01-23 19:32:52

======Uninstall list======

—>C:Program FilesNeroNero 7nerouninstallUNNERO.exe /UNINSTALL
—>C:WINDOWSUNNeroBackItUp.exe /UNINSTALL
—>C:WINDOWSUNNeroMediaHome.exe /UNINSTALL
—>C:WINDOWSUNNeroShowTime.exe /UNINSTALL
—>C:WINDOWSUNNeroVision.exe /UNINSTALL
—>C:WINDOWSUNRecode.exe /UNINSTALL
—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1engine6INTEL3~1Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{2547E065-D92D-11D6-8586-006008CA5356}setup.exe» -l0x19 uninstall
—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1engine6INTEL3~1Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{333D93A7-505C-11D6-857A-006008CA5356}setup.exe» -l0x19 uninstall
—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1engine6INTEL3~1Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{501F5586-5040-11D6-857A-006008CA5356}setup.exe» -l0x19 uninstall
—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1engine6INTEL3~1Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{D94854D4-505E-11D6-857A-006008CA5356}setup.exe» -l0x19 uninstall
—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1engine6INTEL3~1Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{D9485541-505E-11D6-857A-006008CA5356}setup.exe» -l0x19 uninstall
—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1engine6INTEL3~1Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{D94855AD-505E-11D6-857A-006008CA5356}setup.exe» -l0x19 uninstall
—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1engine6INTEL3~1Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{E226D4BA-4FAD-11D6-857A-006008CA5356}setup.exe» -l0x19 uninstall
—>rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:WINDOWSINFPCHealth.inf
1С:Предприятие 7.7 для SQL—>C:WINDOWSUNIN0419.EXE -f»C:Program Files1Cv77DeIsL1.isu» enters -c»C:Program Files1Cv77BINuninst.dll
Adobe Flash Player 10 ActiveX—>C:WINDOWSsystem32MacromedFlashuninstall_activeX.exe
Adobe Reader 7.0.5 — Russian—>MsiExec.exe /I{AC76BA86-7AD7-1049-7B44-A70500000002}
BarCodeLib—>»C:BarCodeLibunins000.exe»
CheckXML—>»C:Program FilesCheckXMLuninstall.exe»
C-Media WDM Audio Driver—>C:WINDOWSsystem32cmirmdrv.exe
Color Network ScanGear Ver.2.21—>C:PROGRA~1COMMON~1INSTAL~1Driver11INTEL3~1IDriver.exe /M{8EDF23FC-A3FE-4E0F-8FBB-DEB0439D0A44} UNINSTALL
D-Link PCI Fast Ethernet Adapter—>Rundll32.exe vuins32.dll,vuins32Ex $Rhine $D-Link
Driver Magician 3.27—>»C:Program FilesDriver Magicianunins000.exe»
DSE Client — Компонент безопасности 1.6.0.114—>C:Program FilesCFTSKSBuninst.exe
FastStone Image Viewer 2.30 (Russian)—>C:Program FilesFastStone Image Vieweruninst.exe
FTC BCR Cryptoprovider 1.4.1—>C:Program FilesCFTFTC BCRuninst.exe
GemPCTwin—>MsiExec.exe /I{00DD6BBD-9EF2-409F-B66C-E2C6F77FACE1}
Gemplus Smart Card Reader Tools—>C:Program FilesGemplusReaderToolsInstallersetup.exe /u
Guardant driver—>»C:WINDOWSsystem32rundll32.exe» grddrv32.dll,GD_UninstallDriver 1
HijackThis 1.99.1—>C:Documents and SettingsАдминистраторРабочий столантивирусhijackthisHijackThis.exe /uninstall
Hotfix for Windows XP (KB926239)—>»C:WINDOWS$NtUninstallKB926239$spuninstspuninst.exe»
Kaspersky Internet Security 2009—>MsiExec.exe /I{8CB14A64-CEF4-4C8F-B1C8-1C3B8752CB55}
Kaspersky Internet Security 2009—>MsiExec.exe /I{8CB14A64-CEF4-4C8F-B1C8-1C3B8752CB55}
KLADR—>»C:Program FilesЗарплата 2008kladruninstall.exe»
Lizardtech DjVu Control—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1engine6INTEL3~1Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{105CFC7C-6992-11D5-BD9D-000102C10FD8}Setup.exe» -l0x9
Microsoft .NET Framework 2.0—>C:WINDOWSMicrosoft.NETFrameworkv2.0.50727Microsoft .NET Framework 2.0install.exe
Microsoft Compression Client Pack 1.0 for Windows XP—>»C:WINDOWS$NtUninstallMSCompPackV1$spuninstspuninst.exe»
Microsoft Office — профессиональный выпуск версии 2003—>MsiExec.exe /I{90110419-6000-11D3-8CFE-0150048383C9}
Microsoft User-Mode Driver Framework Feature Pack 1.0—>»C:WINDOWS$NtUninstallWudf01000$spuninstspuninst.exe»
Migo (remove only)—>C:Documents and SettingsАдминистраторApplication DataPowerhouseMigoMigoUninstall.exe
Nero 7 Ultra Edition—>MsiExec.exe /I{F14B8ECC-BDA0-4987-9201-D7B7DBE11049}
NevoSoft Magic Farm (remove only)—>»C:Documents and SettingsАдминистраторРабочий столНадеждаMagic Farmuninstall.exe»
NevoSoft Mahjongg Artifacts (remove only)—>»C:Program FilesИгрыMahjongg Artifactsuninstall.exe»
NevoSoft Mahjongg Artifacts 2 (remove only)—>»C:Program FilesИгрыMahjongg Artifacts 2uninstall.exe»
NVIDIA Drivers—>C:WINDOWSsystem32nvudisp.exe UninstallGUI
Samsung SCX-4×16 Series (TWAIN)—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1engine6INTEL3~1Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{0D2EDE81-878F-400D-A5C3-3EC445F47750}setup.exe» -l0x19
Samsung SCX-4×16 Series—>»C:WINDOWSSamsungSCX-4x16setup.exe» /UNINSTALL /L0019
SmarThru—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1engine6INTEL3~1Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{1CE06390-46D0-11D6-8578-006008CA5356}SETUP.EXE» -l0x19 uninstall -l0019
Windows Media Format 11 runtime—>»C:Program FilesWindows Media Playerwmsetsdk.exe» /UninstallAll
Windows Media Format 11 runtime—>»C:WINDOWS$NtUninstallWMFDist11$spuninstspuninst.exe»
Windows Media Player 11—>»C:WINDOWS$NtUninstallwmp11$spuninstspuninst.exe»
Архиватор WinRAR—>C:Program FilesWinRARuninstall.exe
Бланки—>»C:Program FilesБухсофтБланкиuninstall.exe»
БухСофт-Предприятие 2008—>»C:Program FilesБухСофт-Предприятие 2008uninstall.exe»
Дистанционная Панель Управления—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1engine6INTEL3~1Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{FCA6A663-110C-40C6-B085-9C2469923326}setup.exe»
Зарплата 2008—>»C:Program FilesЗарплата 2008uninstall.exe»
Компонент безопасности (DSE Client) 1.6.0.114—>C:Program FilesCFTDSE ClientUninst.exe
КриптоПро CSP—>MsiExec.exe /I{54A08450-B343-40B0-924E-68F031450996}
Обновление СБиС++ Электронная отчётность версии 2.2.173 от 17.1—>»C:СБиС++ Электронная отчетностьuninstallunins000.exe»
Отчет 2004—>»C:Otchet2004uninstall.exe»
Проигрыватель Windows Media 11—>»C:Program FilesWindows Media PlayerSetup_wm.exe» /Uninstall
Экспредо 1.20—>»D:Expredounins000.exe»

======Hosts File======

60.173.10.243 http://www.sznews.com
60.173.10.243 http://www.baidu.com
60.173.10.243 http://www.idoer.org
60.173.10.243 baidu.com
60.173.10.243 http://www.lhgz.com.cn
60.173.10.243 qq123.d189.5kweb.cn
60.173.10.243 http://www.taxexpert.com.cn
60.173.10.243 web.szds.gov.cn
60.173.10.243 http://www.szgs.gov.cn
60.173.10.243 http://www.szds.gov.cn

System event log

Computer Name: BUH
Event Code: 7035
Message: Служба «Office Source Engine» успешно отправила управляющий элемент «запустить».

Record Number: 22510
Source Name: Service Control Manager
Time Written: 20081208113617.000000+300
Event Type: информация
User: BUHАдминистратор

Computer Name: BUH
Event Code: 20169
Message: Не удалось подключиться к DHCP-серверу. Автоматический частный IP-адрес «169.254.147.135»
будет назначен входящим клиентам.
Клиенты не смогут получить доступ к сетевым ресурсам.

Record Number: 22509
Source Name: RemoteAccess
Time Written: 20081208113439.000000+300
Event Type: предупреждение
User:

Computer Name: BUH
Event Code: 7036
Message: Служба «Служба COM записи компакт-дисков IMAPI» перешла в состояние Остановлена.

Record Number: 22508
Source Name: Service Control Manager
Time Written: 20081208113345.000000+300
Event Type: информация
User:

Computer Name: BUH
Event Code: 7036
Message: Служба «Служба шлюза уровня приложения» перешла в состояние Работает.

Record Number: 22507
Source Name: Service Control Manager
Time Written: 20081208113340.000000+300
Event Type: информация
User:

Computer Name: BUH
Event Code: 7035
Message: Служба «Служба шлюза уровня приложения» успешно отправила управляющий элемент «запустить».

Record Number: 22506
Source Name: Service Control Manager
Time Written: 20081208113340.000000+300
Event Type: информация
User: NT AUTHORITYSYSTEM

Application event log

Computer Name: EARTH-F39453C3C
Event Code: 1800
Message: Служба центра обеспечения безопасности Windows запущена.

Record Number: 222
Source Name: SecurityCenter
Time Written: 20070531101812.000000+360
Event Type: информация
User:

Computer Name: EARTH-F39453C3C
Event Code: 1000
Message:
Record Number: 221
Source Name: Microsoft Office 11
Time Written: 20070530165302.000000+360
Event Type: ошибка
User:

Computer Name: EARTH-F39453C3C
Event Code: 1800
Message: Служба центра обеспечения безопасности Windows запущена.

Record Number: 220
Source Name: SecurityCenter
Time Written: 20070530092021.000000+360
Event Type: информация
User:

Computer Name: EARTH-F39453C3C
Event Code: 1800
Message: Служба центра обеспечения безопасности Windows запущена.

Record Number: 219
Source Name: SecurityCenter
Time Written: 20070529091951.000000+360
Event Type: информация
User:

Computer Name: EARTH-F39453C3C
Event Code: 1000
Message:
Record Number: 218
Source Name: Microsoft Office 11
Time Written: 20070528133050.000000+360
Event Type: ошибка
User:

======Environment variables======

«ComSpec»=%SystemRoot%system32cmd.exe
«Path»=%SystemRoot%system32;%SystemRoot%;%SystemRoot%System32Wbem
«windir»=%SystemRoot%
«FP_NO_HOST_CHECK»=NO
«OS»=Windows_NT
«PROCESSOR_ARCHITECTURE»=x86
«PROCESSOR_LEVEL»=15
«PROCESSOR_IDENTIFIER»=x86 Family 15 Model 2 Stepping 9, GenuineIntel
«PROCESSOR_REVISION»=0209
«NUMBER_OF_PROCESSORS»=1
«PATHEXT»=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
«TEMP»=%SystemRoot%TEMP
«TMP»=%SystemRoot%TEMP
«MIGO_DRIVE»=F

EOF

HijackThis download failed

======Registry dump======

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class — C:Program FilesAdobeAcrobat 7.0ActiveXAcroIEHelper.dll [2005-09-24 63136]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C}]
IEVkbdBHO Class — C:Program FilesKaspersky LabKaspersky Internet Security 2009ievkbd.dll [2008-04-25 62728]

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun]
«NvCplDaemon»=C:WINDOWSsystem32NvCpl.dll [2005-07-20 7110656]
«BluetoothAuthenticationAgent»=C:WINDOWSsystem32bthprops.cpl [2004-08-18 110592]
«Cmaudio»=RunDll32 cmicnfg.cpl []
«CorelDRAW Graphics Suite 11b»=C:Program FilesCorelCorel Graphics 12LanguagesENProgramsRegistration.exe /title=CorelDRAW Graphics Suite 12 /date=051808 serial=DR12WEX-1504397-KTY lang=EN []
«gemstrmw»=C:WINDOWSsystem32gemstrmw.exe [2003-08-29 24576]
«GW Port Controller»=D:Program FilesSamsungSmarThruPORTCTRL.EXE [2004-02-09 163840]
«NeroFilterCheck»=C:Program FilesCommon FilesAheadLibNeroCheck.exe [2006-01-12 155648]
«NevoDRM»=C:Program FilesИгрыNevoDRMNevoDRM.exe []
«nwiz»=nwiz.exe /install []

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerRun]
«qq»=C:DOCUME~19335~1LOCALS~1Tempniuca0113.jpg []

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun]
«Windows Serviece Agents»=twkkcsp.exe []
«Tester»=C:RECYCLERS-1-5-21-1482476501-1644491937-682003330-1013ise.exe []
«MSMSGS»=C:Program FilesMessengermsmsgs.exe [2004-10-13 1694208]
«CTFMON.EXE»=C:WINDOWSsystem32ctfmon.exe [2004-08-18 15360]
«BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}»=C:Program FilesCommon FilesAheadLibNMBgMonitor.exe [2006-10-09 139264]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWindows]
«AppInit_DLLS»=»C:PROGRA~1KASPER~1KASPER~1mzvkbd.dll,C:PROGRA~1KASPER~1KASPER~1adialhk.dll,C:PROGRA~1KASPER~1KASPER~1kloehk.dll»

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifycpcsp]
C:Program FilesCrypto ProCSPcpcspi2.dll [2008-08-15 710144]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifyklogon]
C:WINDOWSsystem32klogon.dll [2008-04-25 206088]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad]
WPDShServiceObj — {AAA288BA-9A4C-45B0-95D7-94D524869DB5} — C:WINDOWSsystem32WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
«dontdisplaylastusername»=0
«legalnoticecaption»=
«legalnoticetext»=
«shutdownwithoutlogon»=1
«undockwithoutlogon»=1

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoDriveTypeAutoRun»=145

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoDriveTypeAutoRun»=

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicystandardprofileauthorizedapplicationslist]

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicydomainprofileauthorizedapplicationslist]

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{1aece639-96b1-11dd-af86-001cf00d352e}]
shellAutoRuncommand — hdbifxd.exe
shellexplorecommand — hdbifxd.exe
shellopencommand — hdbifxd.exe

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{25a4e5f4-6aaa-11dd-af38-001cf00d352e}]
shell1command — autorun.pif
shell2command — autorun.pif
shellAutoRuncommand — C:WINDOWSsystem32RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL autorun.pif

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{29cc3c97-a2ef-11dc-adee-cefd3407b6a3}]
shellAutoRuncommand — C:WINDOWSsystem32RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL frwl.exe

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{2e1529de-5c42-11dd-af25-001cf00d352e}]
shellAutoRuncommand — F:
shellexplorecommand — WScript.exe .autorun.vbs
shellopencommand — WScript.exe .autorun.vbs

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{47c7a8c9-80a3-11dc-adbd-d59d43a704a3}]
shellAutoRuncommand — F:a3g3.bat
shellexplorecommand — F:a3g3.bat
shellopencommand — F:a3g3.bat

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{47cb1276-0aad-11dd-aea6-001cf00d352e}]
shellAutoRuncommand — F:RECYCLERS-1-5-21-1482476501-1644491937-682003330-1013ise.exe
shellopencommand — F:RECYCLERS-1-5-21-1482476501-1644491937-682003330-1013ise.exe

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{4b7edc85-d398-11db-aca5-b116a101e6a4}]
shellAutoRuncommand — G:
shellexplorecommand — WScript.exe .autorun.vbs
shellopencommand — WScript.exe .autorun.vbs

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{78df961e-abea-11dd-afb0-001cf00d352e}]
shellAutoRuncommand — rsxuhl.exe
shellexplorecommand — rsxuhl.exe
shellopencommand — rsxuhl.exe

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{7c98d6d2-d386-11db-aca2-cfb0998377a5}]
shellAutoRuncommand — F:
shellexplorecommand — WScript.exe .autorun.vbs
shellopencommand — WScript.exe .autorun.vbs

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{8622e758-1ce9-11dd-aebf-001cf00d352e}]
shellAutoRuncommand — F:RECYCLERS-1-5-21-1482476501-1644491937-682003330-1013ise.exe
shellopencommand — F:RECYCLERS-1-5-21-1482476501-1644491937-682003330-1013ise.exe

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{8a89b694-f58b-11dc-ae78-001cf00d352e}]
shellAutoRuncommand — F:RECYCLERS-1-5-21-1482476501-1644491937-682003330-1013ise32.exe
shellopencommand — F:RECYCLERS-1-5-21-1482476501-1644491937-682003330-1013ise32.exe

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{98844738-4f46-11dd-af15-001cf00d352e}]
shellAutoRuncommand — F:dosocom.com
shellexplorecommand — F:dosocom.com
shellopencommand — F:dosocom.com

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{a2ed33d6-e140-11dd-b023-001cf00d352e}]
shellAutoRuncommand — C:WINDOWSsystem32RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL far1.exe

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{aad42ef6-10d5-11dd-aeb0-001cf00d352e}]
shellAutoRuncommand — F:RECYCLERS-1-5-21-1482476501-1644491937-682003330-1013ise.exe
shellopencommand — F:RECYCLERS-1-5-21-1482476501-1644491937-682003330-1013ise.exe

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{b2ac42fa-ed01-11dc-ae68-97dd4a0d1ba3}]
shellAutoRuncommand — F:h.cmd
shellexplorecommand — F:h.cmd
shellopencommand — F:h.cmd

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{b57322f0-60de-11dc-ad8f-a1bb240ff1a3}]
shellAutoRuncommand — F:h.cmd
shellexplorecommand — F:h.cmd
shellopencommand — F:h.cmd

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{ca75f224-544a-11dc-ad76-b100a869d60d}]
shellAutoRuncommand — F:LaunchU3.exe -a

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{ca75f225-544a-11dc-ad76-b100a869d60d}]
shellAutoRuncommand — C:WINDOWSsystem32RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycledctfmon.exe
shellOpen(&0)command — Recycledctfmon.exe

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{cee470a1-53c8-11dd-af1b-001cf00d352e}]
shellAutoRuncommand — F:RECYCLERS-1-5-21-1482476501-1644491937-682003330-1013ise.exe
shellopencommand — F:RECYCLERS-1-5-21-1482476501-1644491937-682003330-1013ise.exe

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{d1dfe213-85d7-11dc-adc2-da0cf72715a3}]
shellAutoRuncommand — C:WINDOWSsystem32RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL frwl.exe

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{d219eb4a-4e79-11dd-af12-001cf00d352e}]
shellAutoRuncommand — F:RECYCLERS-1-5-21-1482476501-1644491937-682003330-1013ise32.exe
shellopencommand — F:RECYCLERS-1-5-21-1482476501-1644491937-682003330-1013ise32.exe

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{da2cd80d-e193-11db-acbe-b1e6baa684a3}]
shellAutoRuncommand — F:LaunchU3.exe -a

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{da2cd80e-e193-11db-acbe-b1e6baa684a3}]
shellAutoRuncommand — G:RECYCLERS-1-5-21-1482476501-1644491937-682003330-1013ise32.exe
shellopencommand — G:RECYCLERS-1-5-21-1482476501-1644491937-682003330-1013ise32.exe

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{e678421b-5a9b-11dc-ad82-a288921108a6}]
shellAutoRuncommand — uieguk.exe
shellexplorecommand — uieguk.exe
shellopencommand — uieguk.exe

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{f3ac2013-a3bd-11dc-adf0-81feebcb14a4}]
shellAutocommand — sxs.exe
shellAutoRuncommand — C:WINDOWSsystem32RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL sxs.exe

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{f9cca23e-f347-11dc-ae71-001cf00d352e}]
shellAutoRuncommand — F:RECYCLERS-1-5-21-1482476501-1644491937-682003330-1013ise.exe
shellopencommand — F:RECYCLERS-1-5-21-1482476501-1644491937-682003330-1013ise.exe

======List of files/folders created in the last 1 months======

2009-01-23 19:32:47 —-D—- C:Program Filestrend micro
2009-01-23 19:32:44 —-D—- C:rsit
2009-01-21 21:48:39 —-D—- C:Program FilesKaspersky Lab
2009-01-21 21:48:39 —-D—- C:Documents and SettingsAll UsersApplication DataKaspersky Lab
2009-01-21 20:53:26 —-D—- C:Documents and SettingsAll UsersApplication DataKaspersky Lab Setup Files
2009-01-16 16:53:31 —-D—- C:Program FilesCommon FilesCrypto Pro
2009-01-16 16:53:14 —-HD—- C:WINDOWSsystem32GroupPolicy
2009-01-16 16:53:06 —-D—- C:Program FilesCrypto Pro
2009-01-16 15:34:58 —-D—- C:Documents and SettingsАдминистраторApplication DataTeamViewer
2009-01-12 12:27:51 —-D—- C:Program FilesCheckXML
2009-01-11 20:01:57 —-H—- C:12~~.tmp
2009-01-11 20:01:55 —-A—- C:x1.tmp
2009-01-11 20:01:55 —-A—- C:x.tmp
2009-01-11 20:01:52 —-A—- C:WINDOWSsvchos.exe
2009-01-07 16:59:53 —-D—- C:WINDOWSsystem32SC
2009-01-07 16:59:39 —-D—- C:WINDOWSsystem32Common
2008-12-30 10:38:49 —-SH—- C:bot.txt
2008-12-29 16:50:12 —-D—- C:WINDOWSsystem32MN
2008-12-25 20:43:29 —-D—- C:WINDOWSsystem32RemInst
2008-12-25 15:07:05 —-D—- C:WINDOWSsystem32MSN

======List of files/folders modified in the last 1 months======

2009-01-23 19:32:47 —-RD—- C:Program Files
2009-01-23 19:28:18 —-D—- C:WINDOWSPrefetch
2009-01-23 18:31:50 —-D—- C:WINDOWSsystem32drivers
2009-01-23 18:31:50 —-D—- C:WINDOWSsystem32CatRoot2
2009-01-23 18:27:57 —-D—- C:WINDOWSTemp
2009-01-23 18:27:57 —-D—- C:WINDOWSsystem32ias
2009-01-21 23:06:10 —-A—- C:WINDOWSSchedLgU.Txt
2009-01-21 21:52:31 —-D—- C:WINDOWS
2009-01-21 21:49:23 —-SHD—- C:WINDOWSInstaller
2009-01-21 21:49:07 —-HD—- C:WINDOWSinf
2009-01-21 21:48:54 —-D—- C:WINDOWSsystem32
2009-01-21 21:36:52 —-D—- C:WINDOWSsystem
2009-01-21 21:10:37 —-D—- C:WINDOWSsystem32CatRoot
2009-01-21 20:57:02 —-AC—- C:WINDOWSsetuplog.txt
2009-01-21 19:21:03 —-D—- C:СБиС++ Электронная отчетность
2009-01-17 20:28:27 —-D—- C:Program FilesStatistXP
2009-01-17 20:24:36 —-D—- C:Program FilesИгры
2009-01-16 20:27:54 —-A—- C:WINDOWSimsins.BAK
2009-01-16 16:55:46 —-D—- C:WINDOWSWinSxS
2009-01-16 16:20:10 —-RSHDC—- C:WINDOWSsystem32dllcache
2009-01-16 16:15:16 —-D—- C:Program FilesCommon Files
2009-01-15 20:46:08 —-D—- C:Program FilesCommon FilesSystem
2009-01-15 20:23:04 —-A—- C:WINDOWSwin.ini
2009-01-15 05:01:33 —-A—- C:WINDOWSNeroDigital.ini
2009-01-11 20:07:24 —-SHD—- C:System Volume Information
2009-01-09 15:53:57 —-D—- C:ConsLocalUserData
2008-12-29 16:53:27 —-D—- C:WINDOWSsystem32wbem

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 CProCtrl;КриптоПро CSP драйвер; C:WINDOWSsystem32DRIVERSCProCtrl.sys [2008-08-08 54024]
R1 intelppm;Драйвер Intel процессора; C:WINDOWSsystem32DRIVERSintelppm.sys [2006-06-01 40448]
R1 KLIF;Kaspersky Lab Driver; C:WINDOWSsystem32DRIVERSklif.sys [2009-01-21 187408]
R1 NVKEYNT;NVKEYNT; ??C:WINDOWSsystem32DRIVERSNVKEYNT.SYS []
R1 prodrv06;StarForce Protection Environment Driver v6; C:WINDOWSSystem32driversprodrv06.sys [2004-09-03 54368]
R2 Consult;Consult; C:WINDOWSsystem32driversConsult.sys [1997-02-04 3008]
R2 DgiVecp;Team MFP Comm Driver; C:WINDOWSSystem32DriversDgiVecp.sys [2004-05-17 41984]
R2 GDEMGS;GDEMGS; C:WINDOWSSystem32driversGDEMGS.SYS [2005-12-31 19968]
R3 cmuda;C-Media WDM Audio Interface; C:WINDOWSsystem32driverscmuda.sys [2004-04-23 818496]
R3 FETNDISB;D-Link PCI Fast Ethernet Adapter Driver Service; C:WINDOWSsystem32DRIVERSdlkfet5b.sys [2006-12-27 46080]
R3 KLFLTDEV;Kaspersky Lab KLFltDev; C:WINDOWSsystem32DRIVERSklfltdev.sys [2008-03-13 26640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter; C:WINDOWSsystem32DRIVERSklim5.sys [2008-03-25 24592]
R3 nv;nv; C:WINDOWSsystem32DRIVERSnv4_mini.sys [2005-07-20 3198368]
R3 usbehci;Драйвер минипорта Microsoft USB 2.0 расширенного хост-контроллера; C:WINDOWSsystem32DRIVERSusbehci.sys [2005-10-26 27264]
R3 usbhub;USB2 концентратор; C:WINDOWSsystem32DRIVERSusbhub.sys [2004-08-03 57600]
R3 USBSTOR;Драйвер запоминающих устройств для USB; C:WINDOWSsystem32DRIVERSUSBSTOR.SYS [2004-08-03 26496]
R3 usbuhci;Драйвер минипорта Microsoft USB универсального хост-контроллера; C:WINDOWSsystem32DRIVERSusbuhci.sys [2004-08-03 20480]
S3 BthEnum;Драйвер блока запроса Bluetooth; C:WINDOWSsystem32DRIVERSBthEnum.sys [2004-08-03 17024]
S3 BthPan;Bluetooth Device (Personal Area Network); C:WINDOWSsystem32DRIVERSbthpan.sys [2004-08-03 100992]
S3 BTHPORT;Драйвер порта Bluetooth; C:WINDOWSSystem32DriversBTHport.sys [2004-08-17 274688]
S3 BTHUSB;Драйвер порта USB радиомодуля Bluetooth; C:WINDOWSSystem32DriversBTHUSB.sys [2004-08-03 18944]
S3 GKeyUSB;GKeyUSB; C:WINDOWSSystem32DriversGKeyUSB.sys [2002-12-12 62096]
S3 RESSDT;RESSDT; ??c:x1.tmp []
S3 RFCOMM;Устройство Bluetooth (протокол RFCOMM TDI); C:WINDOWSsystem32DRIVERSrfcomm.sys [2004-08-03 59648]
S3 usbprint;Класс принтеров Microsoft USB; C:WINDOWSsystem32DRIVERSusbprint.sys [2004-08-03 25856]
S3 utqwndey;AVZ Kernel Driver; ??C:WINDOWSsystem32Driversutqwndey.sys []
S3 WudfPf;Windows Driver Foundation — User-mode Driver Framework Platform Driver; C:WINDOWSsystem32DRIVERSWudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation — User-mode Driver Framework Reflector; C:WINDOWSsystem32DRIVERSwudfrd.sys [2006-09-28 82944]
S4 sr;Драйвер фильтра восстановления системы; C:WINDOWSsystem32DRIVERSsr.sys [2004-08-18 73472]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 BthServ;Bluetooth Support Service; C:WINDOWSsystem32svchost.exe [2004-08-18 14336]
R2 cpcsp2;КриптоПро CSP KC2; C:WINDOWSsystem32svchost.exe [2004-08-18 14336]
R2 MDM;Machine Debug Manager; C:Program FilesCommon FilesMicrosoft SharedVS7DEBUGMDM.EXE [2003-06-19 322120]
R2 NVSvc;NVIDIA Display Driver Service; C:WINDOWSsystem32nvsvc32.exe [2005-07-20 127043]
S2 AVP;Kaspersky Internet Security; C:Program FilesKaspersky LabKaspersky Internet Security 2009avp.exe [2008-04-25 201992]
S3 aspnet_state;ASP.NET State Service; C:WINDOWSMicrosoft.NETFrameworkv2.0.50727aspnet_state.exe [2005-09-23 29896]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:WINDOWSMicrosoft.NETFrameworkv2.0.50727mscorsvw.exe [2005-09-23 66240]
S3 IDriverT;InstallDriver Table Manager; C:Program FilesCommon FilesInstallShieldDriver11Intel 32IDriverT.exe [2005-04-03 69632]
S3 NBService;NBService; C:Program FilesNeroNero 7Nero BackItUpNBService.exe [2006-10-09 724992]
S3 ose;Office Source Engine; C:Program FilesCommon FilesMicrosoft SharedSource EngineOSE.EXE [2003-07-28 89136]
S3 WMPNetworkSvc;Служба общих сетевых ресурсов проигрывателя Windows Media; C:Program FilesWindows Media PlayerWMPNetwk.exe [2006-11-02 914944]
S3 WudfSvc;Windows Driver Foundation — User-mode Driver Framework; C:WINDOWSsystem32svchost.exe [2004-08-18 14336]

EOF
25 января, 2009 в 4:15 пп #21485
Admin
Keymaster
- Темы:40
- Сообщений:5676
Здравствуйте, добро пожаловать на Spyware-ru форум.

Судя по логу ваш компьютер заражён autorun.inf трояном.
Прочитайте эту инструкцию Flash_Disinfector ещё одно оружие против autorun.inf троянов. Скачайте и запустите Flash_Disinfector, не забудьте при этом по требованию программы вставить ваш флэш диск или подключить другие внешние устройства хранения информации.

Скачайте OTMoveIt3 by OldTimer кликнув по этой ссылке.
Запустите программу и в большое поле ввода (заголовок этого поля выделен желтым цветом) скопируйте следующий текст.
```
:Processes

explorer.exe



:services

RESSDT



:reg

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerRun]

"qq"=-



[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun]

"Windows Serviece Agents"=-

"Tester"=-



[-HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{1aece639-96b1-11dd-af86-001cf00d352e}]

[-HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{25a4e5f4-6aaa-11dd-af38-001cf00d352e}]

[-HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{29cc3c97-a2ef-11dc-adee-cefd3407b6a3}]

[-HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{2e1529de-5c42-11dd-af25-001cf00d352e}]

[-HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{47c7a8c9-80a3-11dc-adbd-d59d43a704a3}]

[-HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{47cb1276-0aad-11dd-aea6-001cf00d352e}]

[-HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{4b7edc85-d398-11db-aca5-b116a101e6a4}]

[-HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{78df961e-abea-11dd-afb0-001cf00d352e}]

[-HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{7c98d6d2-d386-11db-aca2-cfb0998377a5}]

[-HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{8622e758-1ce9-11dd-aebf-001cf00d352e}]

[-HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{8a89b694-f58b-11dc-ae78-001cf00d352e}]

[-HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{98844738-4f46-11dd-af15-001cf00d352e}]

[-HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{a2ed33d6-e140-11dd-b023-001cf00d352e}]

[-HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{aad42ef6-10d5-11dd-aeb0-001cf00d352e}]

[-HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{b2ac42fa-ed01-11dc-ae68-97dd4a0d1ba3}]

[-HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{b57322f0-60de-11dc-ad8f-a1bb240ff1a3}]

[-HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{ca75f224-544a-11dc-ad76-b100a869d60d}]

[-HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{ca75f225-544a-11dc-ad76-b100a869d60d}]

[-HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{cee470a1-53c8-11dd-af1b-001cf00d352e}]

[-HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{d1dfe213-85d7-11dc-adc2-da0cf72715a3}]

[-HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{d219eb4a-4e79-11dd-af12-001cf00d352e}]

[-HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{da2cd80d-e193-11db-acbe-b1e6baa684a3}]

[-HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{e678421b-5a9b-11dc-ad82-a288921108a6}]

[-HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{f3ac2013-a3bd-11dc-adf0-81feebcb14a4}]

[-HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{f9cca23e-f347-11dc-ae71-001cf00d352e}]



:files

C:RECYCLERS-1-5-21-1482476501-1644491937-682003330-1013



:Commands

[emptytemp]

[start explorer]

[Reboot]
```
Кликните по кнопке MoveIt!. В процессе работы возможна перезагрузка компьютера.
По-завершении работы программы должен будет показан лог, вставьте его в ваш ответ.
Так же приложите свежий RSIT лог.
Автор

Сообщения

Просмотр 2 сообщений - с 1 по 2 (из 2 всего)

Для ответа в этой теме необходимо авторизоваться.

Посмотрите пожалуйста Лог

Добро пожаловать

Поиск

Последние темы

СПАЙВАРЕ РУ

Нужна помощь?

Ссылки