! Проактивная защита

[P-Olga]

Обнаружен руткит…
Потенциально опасное ПО Hidden objekt
Инструкция по лечению требует загрузить MW в безопасном режиме и выполнить проверку компа. Но при запуске в б.р. антивирус. прог. не активна. Как быть?

—
End of file — 11250 bytes

======Scheduled tasks folder======

C:WINDOWStasksScheduled Update for Ask Toolbar.job

======Registry dump======

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper — C:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelperShim.dll [2010-09-22 75200]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{8984B388-A5BB-4DF7-B274-77B879E179DB}]
MailRuBHO Class — C:Program FilesMail.RuSputnikMailRuSputnik.dll [2010-08-30 666312]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{9961627E-4059-41B4-8E0E-A7D6B3854ADF}]
IE 4.x-6.x BHO for Download Master — C:PROGRA~1DOWNLO~1dmiehlp.dll [2009-04-16 158208]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{D4027C7F-154A-4066-A1AD-4243D8127440}]
SoThink Toolbar — C:Program FilesAsk.comGenericAskToolbar.dll [2010-05-26 1385864]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper — C:Program FilesJavajre6binjp2ssv.dll [2010-08-30 41760]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class — C:Program FilesJavajre6libdeployjqsiejqs_plugin.dll [2010-08-30 79648]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{FCBCCB87-9224-4B8D-B117-F56D924BEB18}]
WebMoney Advisor — BHO Helper — C:Program FilesWebMoney Advisortbcore3.dll [2010-02-24 2559608]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
{09900DE8-1DCA-443F-9243-26FF581438AF} — Спутник@Mail.Ru — C:Program FilesMail.RuSputnikMailRuSputnik.dll [2010-08-30 666312]
{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840} — WebMoney Advisor — C:Program FilesWebMoney Advisortbcore3.dll [2010-02-24 2559608]
{D4027C7F-154A-4066-A1AD-4243D8127440} — SoThink Toolbar — C:Program FilesAsk.comGenericAskToolbar.dll [2010-05-26 1385864]

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun]
«SoundMan»=C:WINDOWSSOUNDMAN.EXE [2007-04-16 577536]
«nwiz»=nwiz.exe /install []
«NvCplDaemon»=C:WINDOWSsystem32NvCpl.dll [2006-10-22 7700480]
«NeroFilterCheck»=C:WINDOWSsystem32NeroCheck.exe [2006-01-12 155648]
«AVP»=C:Program FilesKaspersky LabKaspersky Anti-Virus 7.0avp.exe [2008-02-08 227856]
«NvMediaCenter»=C:WINDOWSsystem32NvMcTray.dll [2006-10-22 86016]
«RemoteControl9″=C:Program FilesCyberLinkPowerDVD9PDVD9Serv.exe [2009-02-16 87336]
«PDVD9LanguageShortcut»=C:Program FilesCyberLinkPowerDVD9LanguageLanguage.exe [2008-10-13 50472]
«HP Software Update»=C:Program FilesHPHP Software UpdateHPWuSchd2.exe [2007-03-11 49152]
«wmagent.exe»=C:Program FilesWebMoney Agentwmagent.exe [2009-10-19 210400]
«Adobe Reader Speed Launcher»=C:Program FilesAdobeReader 9.0ReaderReader_sl.exe [2010-09-23 35760]
«Adobe ARM»=C:Program FilesCommon FilesAdobeARM1.0AdobeARM.exe [2010-09-20 932288]

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=C:WINDOWSsystem32ctfmon.exe [2010-03-12 30208]
«VistaIcon»=C:Program FilesVistaDriveIconVistaDrv.exe [2008-01-02 132096]
«LClock»=C:Program FilesLClocklclock.exe [2007-12-14 86016]
«Sidebar»=C:Program FilesWindows Sidebarsidebar.exe [2007-02-26 1254912]
«uTorrent»=D:ТоrrentuTorrent.exe [2010-09-26 328056]

C:Documents and SettingsAll UsersГлавное менюПрограммыАвтозагрузка
HP Digital Imaging Monitor.lnk — C:Program FilesHPDigital Imagingbinhpqtra08.exe

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifyklogon]
C:WINDOWSsystem32klogon.dll [2008-02-08 219664]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifyWgaLogon]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad]
WPDShServiceObj — {AAA288BA-9A4C-45B0-95D7-94D524869DB5} — C:WINDOWSsystem32wpdshserviceobj.dll [2008-05-18 133632]

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
«dontdisplaylastusername»=0
«legalnoticecaption»=
«legalnoticetext»=
«shutdownwithoutlogon»=1
«undockwithoutlogon»=1

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoDriveTypeAutoRun»=145
«NoSharedDocuments»=1
«NoSMConfigurePrograms»=1

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«HonorAutoRunSetting»=1

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicystandardprofileauthorizedapplicationslist]
«%windir%Network Diagnosticxpnetdiag.exe»=»%windir%Network Diagnosticxpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000»
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicydomainprofileauthorizedapplicationslist]
«%windir%Network Diagnosticxpnetdiag.exe»=»%windir%Network Diagnosticxpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000»
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»

======List of files/folders created in the last 1 months======

2011-01-21 05:51:49 —-D—- C:Program Filestrend micro
2011-01-21 05:51:48 —-D—- C:rsit
2011-01-20 10:37:05 —-A—- C:WINDOWSntbtlog.txt
2011-01-18 12:42:26 —-D—- C:Documents and SettingsAdminApplication DataReal
2011-01-18 12:32:18 —-A—- C:WINDOWSsystem32mssrv32.exe
2010-12-31 13:21:39 —-D—- C:WINDOWSLogs
2010-12-30 18:52:08 —-D—- C:Documents and SettingsAll UsersApplication DataOrion
2010-12-30 09:38:13 —-D—- C:WINDOWSsystem32DirectX

======List of files/folders modified in the last 1 months======

2011-01-21 05:51:49 —-RD—- C:Program Files
2011-01-21 05:46:40 —-D—- C:WINDOWSTemp
2011-01-21 05:43:13 —-D—- C:WINDOWSsystem32CatRoot2
2011-01-21 05:43:12 —-D—- C:Documents and SettingsAll UsersApplication DataKaspersky Lab
2011-01-21 05:42:23 —-D—- C:Documents and SettingsAdminApplication DatauTorrent
2011-01-20 18:25:15 —-A—- C:WINDOWSSchedLgU.Txt
2011-01-20 14:27:55 —-D—- C:WINDOWS
2011-01-18 12:32:27 —-A—- C:WINDOWSNeroDigital.ini
2011-01-18 12:32:18 —-D—- C:WINDOWSsystem32
2011-01-14 11:40:53 —-D—- C:Documents and SettingsAdminApplication DataAdobe
2010-12-31 21:23:32 —-D—- C:WINDOWSsystem32drivers
2010-12-31 13:23:37 —-HD—- C:WINDOWSinf
2010-12-31 09:41:37 —-HD—- C:Program FilesInstallShield Installation Information
2010-12-31 09:41:02 —-D—- C:Program FilesCommon FilesInstallShield
2010-12-30 18:29:31 —-SHD—- C:WINDOWSInstaller
2010-12-30 18:29:30 —-HD—- C:Config.Msi
2010-12-28 13:12:52 —-D—- C:Temp

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 agp440;Intel — фильтр шины AGP; C:WINDOWSsystem32DRIVERSagp440.sys [2008-04-14 42368]
R0 kl1;Kl1; C:WINDOWSsystem32driverskl1.sys [2007-10-31 110096]
R0 PxHelp20;PxHelp20; C:WINDOWSSystem32DriversPxHelp20.sys [2008-04-07 43872]
R0 WudfPf;Windows Driver Foundation — User-mode Driver Framework Platform Driver; C:WINDOWSsystem32DRIVERSWudfPf.sys [2008-05-18 77568]
R1 intelppm;Драйвер Intel процессора; C:WINDOWSsystem32DRIVERSintelppm.sys [2008-04-15 40704]
R1 klif;Klif; ??C:WINDOWSsystem32driversklif.sys []
R2 exFat;exFat; C:WINDOWSsystem32driversexFat.sys [2009-01-28 133632]
R2 rspndr;Ответчик обнаружения топологии уровня связи; C:WINDOWSsystem32DRIVERSrspndr.sys [2008-10-11 62848]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:WINDOWSsystem32driversALCXWDM.SYS [2008-09-24 4122368]
R3 FET5X86V;VIA Rhine-Family Fast-Ethernet Adapter Driver Service; C:WINDOWSsystem32DRIVERSfetnd5bv.sys [2008-12-04 43520]
R3 klim5;Kaspersky Anti-Virus NDIS Filter; C:WINDOWSsystem32DRIVERSklim5.sys [2007-12-13 24592]
R3 nv;nv; C:WINDOWSsystem32DRIVERSnv4_mini.sys [2006-10-22 3994624]
R3 nvmpu401;Service for NVIDIA(R) nForce(TM) MIDI UART; C:WINDOWSsystem32driversnvmpu401.sys [2006-02-26 10240]
R3 usbuhci;Драйвер минипорта Microsoft USB универсального хост-контроллера; C:WINDOWSsystem32DRIVERSusbuhci.sys [2008-04-15 20608]
S3 usbccgp;Драйвер универсального родительского устройства USB (Microsoft); C:WINDOWSsystem32DRIVERSusbccgp.sys [2008-04-13 32128]
S3 usbprint;Класс принтеров Microsoft USB; C:WINDOWSsystem32DRIVERSusbprint.sys [2008-04-13 25856]
S3 usbscan;Драйвер USB-сканера; C:WINDOWSsystem32DRIVERSusbscan.sys [2008-04-13 15104]
S3 USBSTOR;Драйвер запоминающих устройств для USB; C:WINDOWSsystem32DRIVERSUSBSTOR.SYS [2008-04-13 26368]
S3 WpdUsb;WpdUsb; C:WINDOWSsystem32DRIVERSwpdusb.sys [2008-05-18 38528]
S3 WudfRd;Windows Driver Foundation — User-mode Driver Framework Reflector; C:WINDOWSsystem32DRIVERSwudfrd.sys [2008-05-18 82944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 ABBYY.Licensing.FineReader.Professional.9.0;ABBYY FineReader 9.0 PE Licensing Service; C:Program FilesCommon FilesABBYYFineReader9.00LicensingPENetworkLicenseServer.exe [2007-12-06 660768]
R2 AVP;Kaspersky Anti-Virus 7.0; C:Program FilesKaspersky LabKaspersky Anti-Virus 7.0avp.exe [2008-02-08 227856]
R2 hpqddsvc;Служба HP CUE DeviceDiscovery; C:WINDOWSsystem32svchost.exe [2008-04-15 14336]
R2 nvsvc;NVIDIA Display Driver Service; C:WINDOWSsystem32nvsvc32.exe [2006-10-22 159810]
R2 WudfSvc;Windows Driver Foundation — User-mode Driver Framework; C:WINDOWSsystem32svchost.exe [2008-04-15 14336]
R3 hpqcxs08;hpqcxs08; C:WINDOWSsystem32svchost.exe [2008-04-15 14336]
S2 msupdate;Microsoft security update service; c:windowssystem32mssrv32.exe [2011-01-18 25088]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:Program FilesCommon FilesMacrovision SharedFLEXnet PublisherFNPLicensingService.exe [2010-08-30 654848]
S3 gusvc;Google Updater Service; C:Program FilesGoogleCommonGoogle UpdaterGoogleUpdaterService.exe [2008-04-07 136120]
S3 odserv;Microsoft Office Diagnostics Service; C:Program FilesCommon FilesMicrosoft SharedOFFICE12ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:Program FilesCommon FilesMicrosoft SharedSource EngineOSE.EXE [2006-10-26 145184]
S3 WMPNetworkSvc;Служба общих сетевых ресурсов проигрывателя Windows Media; C:Program FilesWindows Media Playerwmpnetwk.exe [2006-11-02 914944]
S4 JavaQuickStarterService;Java Quick Starter; C:Program FilesJavajre6binjqs.exe [2010-08-30 153376]

---

EOF

---

info.txt logfile of random’s system information tool 1.08 2011-01-21 05:52:18

======Uninstall list======

—>msiexec /package {90120000-0015-0000-0000-0000000FF1CE} /uninstall {10B5F4EF-C4DC-47AF-913B-EAF05C69C852}
—>msiexec /package {90120000-0016-0000-0000-0000000FF1CE} /uninstall {C5060182-C90D-4314-9AE9-5C0DCF8FD1EF}
—>msiexec /package {90120000-0018-0000-0000-0000000FF1CE} /uninstall {00E877D5-CDF8-4DDC-9AE0-E541B4BB6487}
—>msiexec /package {90120000-001A-0000-0000-0000000FF1CE} /uninstall {2A33A0C2-2B09-446E-9022-1508A85ECD2D}
—>msiexec /package {90120000-001B-0000-0000-0000000FF1CE} /uninstall {3520B304-0EF8-475D-8C52-47ABCCC75FC6}
—>MsiExec /X{8A809006-C25A-4A3A-9DAB-94659BCDB107}
—>rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:WINDOWSINFPCHealth.inf
µTorrent—>»D:ТоrrentuTorrent.exe» /UNINSTALL
7-Zip 4.65—>»C:Program Files7-ZipUninstall.exe»
ABBYY FineReader 9.0 Professional Edition—>MsiExec.exe /I{F9000000-0001-0000-0000-074957833700}
ACDSee Photo Manager 2009—>MsiExec.exe /I{300578F9-9EFF-4B93-9AB1-C0E5707EF463}
Adobe Anchor Service CS3—>MsiExec.exe /I{90176341-0A8B-4CCC-A78D-F862228A6B95}
Adobe Asset Services CS3—>MsiExec.exe /I{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}
Adobe Camera Raw 4.0—>MsiExec.exe /I{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}
Adobe CMaps—>MsiExec.exe /I{A2B242BD-FF8D-4840-9DAA-9170EABEC59C}
Adobe Color — Photoshop Specific—>MsiExec.exe /I{A2D81E70-2A98-4A08-A628-94388B063C5E}
Adobe Color Common Settings—>MsiExec.exe /I{DADD7B8A-BCB0-44F5-967A-ECB6B4F2ECD9}
Adobe Color EU Extra Settings—>MsiExec.exe /I{51846830-E7B2-4218-8968-B77F0FF475B8}
Adobe Color JA Extra Settings—>MsiExec.exe /I{DD7DB3C5-6FA3-4FA3-8A71-C2F2940EB029}
Adobe Color NA Recommended Settings—>MsiExec.exe /I{95655ED4-7CA5-46DF-907F-7144877A32E5}
Adobe Default Language CS3—>MsiExec.exe /I{B9B35331-B7E4-4E5C-BF4C-7BC87856124D}
Adobe Flash Player Plugin—>C:WINDOWSsystem32MacromedFlashuninstall_plugin.exe
Adobe Fonts All—>MsiExec.exe /I{6ABE0BEE-D572-4FE8-B434-9E72A289431B}
Adobe Linguistics CS3—>MsiExec.exe /I{54793AA1-5001-42F4-ABB6-C364617C6078}
Adobe PDF Library Files—>MsiExec.exe /I{D2559B88-CC9D-4B48-81BB-F492BAA9C48C}
Adobe Photoshop CS3—>C:Program FilesCommon FilesAdobeInstallers719d6f144d0c086a0dfa7ff76bb9ac1Setup.exe
Adobe Photoshop CS3—>MsiExec.exe /I{3D7E3EC9-46CF-4359-9289-39CE01DFB82F}
Adobe Reader 9.4.0 — Russian—>MsiExec.exe /I{AC76BA86-7AD7-1049-7B44-A94000000001}
Adobe Setup—>MsiExec.exe /I{FF11004C-F42A-4A31-9BCF-7F5C8FDBE53C}
Adobe Shockwave Player 11—>C:WINDOWSsystem32adobeSHOCKW~1UNWISE.EXE C:WINDOWSsystem32AdobeSHOCKW~1Install.log
Adobe Type Support—>MsiExec.exe /I{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}
Adobe Update Manager CS3—>MsiExec.exe /I{E69AE897-9E0B-485C-8552-7841F48D42D8}
Adobe Version Cue CS3 Client—>MsiExec.exe /I{D0DFF92A-492E-4C40-B862-A74A173C25C5}
Adobe WinSoft Linguistics Plugin—>MsiExec.exe /I{184CE391-7E0E-4C63-9935-D7A10EDFD3C6}
Adobe XMP Panels CS3—>MsiExec.exe /I{802771A9-A856-4A41-ACF7-1450E523C923}
Ask Toolbar—>MsiExec.exe /I{86D4B82A-ABED-442A-BE86-96357B70F4FE}
CyberLink PowerDVD 9—>»C:Program FilesInstallShield Installation Information{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}setup.exe» /z-uninstall
CyberLink PowerDVD 9—>»C:Program FilesInstallShield Installation Information{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}setup.exe» /z-uninstall
Download Master 5.6.2.1191—>»C:Program FilesDownload Masterunins000.exe»
FileZilla Client 3.3.5.1—>C:Program FilesFileZilla FTP Clientuninstall.exe
Foxit Phantom 1.0.3.0109—>C:Program FilesFoxit PhantomUninstall.exe
HP Customer Participation Program 9.0—>C:Program FilesHPDigital ImagingExtCapUninstallhpzscr01.exe -datfile hpqhsc01.dat
HP Deskjet Printer Driver Software 9.0—>C:Program FilesHPDigital Imaging{03E66394-42F0-4745-85F7-0A2F8F35C09F}setuphpzscr01.exe -datfile hphscr15.dat -showdisconnect -forcereboot
HP Imaging Device Functions 9.0—>C:Program FilesHPDigital ImagingDeviceManagementhpzscr01.exe -datfile hpqbud01.dat
HP Photosmart Essential 2.01—>C:Program FilesHPDigital ImagingPhotoSmartEssentialhpzscr01.exe -datfile hpqbud13.dat
HP Solution Center 9.0—>C:Program FilesHPDigital ImagingeSupporthpzscr01.exe -datfile hpqbud05.dat
HP Update—>MsiExec.exe /X{AB40272D-92AB-4F30-B36B-22EDE16F8FE5}
HPSSupply—>MsiExec.exe /X{487B0B9B-DCD4-440D-89A0-A6EDE1A545A3}
Java(TM) 6 Update 18—>MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216018FF}
K-Lite Mega Codec Pack 6.0.0—>»C:Program FilesK-Lite Codec Packunins000.exe»
LClock—>C:Program FilesLClockUninstall.exe
Light Alloy 4.3—>C:Program FilesLight Alloyuninst.exe
Mail.Ru Агент 5.2 (сборка 2400, для всех пользователей)—>C:Program FilesMail.RuAgentmagentsetup.exe -uninstalllm
Mail.Ru Спутник 2.0.1.26—>C:Program FilesMail.RuSputnikSputnikInstaller.exe -uninstall
Microsoft Office Access 2007—>»C:Program FilesCommon FilesMicrosoft SharedOFFICE12Office Setup Controllersetup.exe» /uninstall ACCESS /dll OSETUP.DLL
Microsoft Office Access 2007—>MsiExec.exe /X{90120000-0015-0000-0000-0000000FF1CE}
Microsoft Office Access MUI (Russian) 2007—>MsiExec.exe /X{90120000-0015-0419-0000-0000000FF1CE}
Microsoft Office Excel 2007—>»C:Program FilesCommon FilesMicrosoft SharedOFFICE12Office Setup Controllersetup.exe» /uninstall EXCEL /dll OSETUP.DLL
Microsoft Office Excel 2007—>MsiExec.exe /X{90120000-0016-0000-0000-0000000FF1CE}
Microsoft Office Excel MUI (Russian) 2007—>MsiExec.exe /X{90120000-0016-0419-0000-0000000FF1CE}
Microsoft Office Outlook 2007—>»C:Program FilesCommon FilesMicrosoft SharedOFFICE12Office Setup Controllersetup.exe» /uninstall OUTLOOK /dll OSETUP.DLL
Microsoft Office Outlook 2007—>MsiExec.exe /X{90120000-001A-0000-0000-0000000FF1CE}
Microsoft Office Outlook MUI (Russian) 2007—>MsiExec.exe /X{90120000-001A-0419-0000-0000000FF1CE}
Microsoft Office PowerPoint 2007—>»C:Program FilesCommon FilesMicrosoft SharedOFFICE12Office Setup Controllersetup.exe» /uninstall POWERPOINT /dll OSETUP.DLL
Microsoft Office PowerPoint 2007—>MsiExec.exe /X{90120000-0018-0000-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (Russian) 2007—>MsiExec.exe /X{90120000-0018-0419-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007—>MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (German) 2007—>MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE}
Microsoft Office Proof (Russian) 2007—>MsiExec.exe /X{90120000-001F-0419-0000-0000000FF1CE}
Microsoft Office Proof (Ukrainian) 2007—>MsiExec.exe /X{90120000-001F-0422-0000-0000000FF1CE}
Microsoft Office Proofing (Russian) 2007—>MsiExec.exe /X{90120000-002C-0419-0000-0000000FF1CE}
Microsoft Office Shared MUI (Russian) 2007—>MsiExec.exe /X{90120000-006E-0419-0000-0000000FF1CE}
Microsoft Office Word 2007—>»C:Program FilesCommon FilesMicrosoft SharedOFFICE12Office Setup Controllersetup.exe» /uninstall WORD /dll OSETUP.DLL
Microsoft Office Word 2007—>MsiExec.exe /X{90120000-001B-0000-0000-0000000FF1CE}
Microsoft Office Word MUI (Russian) 2007—>MsiExec.exe /X{90120000-001B-0419-0000-0000000FF1CE}
Microsoft Visual C++ 2005 Redistributable—>MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Visual C++ 2005 Redistributable—>MsiExec.exe /X{837b34e3-7c30-493c-8f6a-2b0f04e2912c}
Microsoft Visual C++ 2008 Redistributable — x86 9.0.30729.4148—>MsiExec.exe /X{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}
Mozilla Firefox 3.6—>C:Program FilesMozilla FirefoxUninstall.exe
MSXML 4.0 SP3 Parser (KB973685)—>MsiExec.exe /I{859DFA95-E4A6-48CD-B88E-A3E483E89B44}
Nero 6—>C:Program FilesAheadnerouninstallUNNERO.exe /UNINSTALL
NVIDIA Display Control Panel—>C:Program FilesNVIDIA CorporationUninstallnvuninst.exe DisplayControlPanel
NVIDIA Drivers—>C:WINDOWSsystem32nvudisp.exe UninstallGUI
NVIDIA PhysX—>MsiExec.exe /X{8A809006-C25A-4A3A-9DAB-94659BCDB107}
Opera 10.50.3296—>C:Program FilesOperaUninstall.exe
Opera 10.63—>MsiExec.exe /X{87CC8013-56D1-43E1-A0A5-AD406B4EBA95}
PDF Settings—>MsiExec.exe /I{AC5B0C19-D851-42F4-BDA0-410ECF7F70A5}
Picasa 3—>»C:Program FilesGooglePicasa3Uninstall.exe»
Plugins for Opera—>»C:Program FilesDUHALABPluginunins000.exe»
PROMT Expert 8 Giant Try-Buy—>MsiExec.exe /I{A4F761F7-FBC8-49BF-BC37-15550C3EAA85}
QIP 8095—>C:Program FilesQIPUninstall.exe
QIP Infium 9034—>C:Program FilesQIP InfiumUninstall.exe
Realtek AC’97 Audio—>Alcrmv.exe -r -m
Skype—>C:Program FilesSkypeUninstall.exe
Sothink FLV Player—>»C:Program FilesCommon FilesSourceTecSothink FLV Playerunins000.exe»
The Bat! 4.2.23—>C:Program FilesThe Bat!Uninstall.exe
Total Commander 7.50a—>C:Program FilesTotal CommanderUninstall.exe
uTorrent 2.0.18620—>C:Program FilesuTorrentUninstall.exe
VIA Rhine-Family Fast-Ethernet Adapter—>Rundll32.exe vuins32.dll,vuins32Ex $Rhine $VIA
Vista Drive Icon—>rundll32.exe advpack.dll,LaunchINFSection C:WINDOWSINFVistaDrv.inf,Uninstall
Vuescan 8.6.21—>C:Program FilesVuescanUninstall.exe
WebMoney Advisor—>MsiExec.exe /X{F0C20717-DA7A-4949-B979-8CBF57EE359D}
WebMoney Agent—>C:Program FilesWebMoney Agentuninst_wmagent.exe
WebMoney Keeper Classic 3.9.2.1—>»C:Program FilesWebMoneyUninstall.exe» «C:Program FilesWebMoneyinstall.log» -u
Winamp 5.572.2830—>C:Program FilesWinampUninstall.exe
WinDjView 1.0.3—>C:Program FilesWinDjViewuninstall.exe
Антивирус Касперского 7.0—>MsiExec.exe /I{4B9BB601-13E9-4042-A3BC-E7955BF4A98F}
Антивирус Касперского 7.0—>MsiExec.exe /I{4B9BB601-13E9-4042-A3BC-E7955BF4A98F}
Архиватор WinRAR—>C:Program FilesWinRARuninstall.exe
Боковая панель Windows—>rundll32.exe advpack.dll,LaunchINFSection C:WINDOWSINFSidebar.inf,DefaultUnInstall
Город юных математиков—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1PROFES~1RunTime91Intel32Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{2B98D1A3-9E51-4A49-9193-84A44BE643DB}Setup.exe» -l0x19
Сократ Персональный 4.1—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1engine6INTEL3~1ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{9CD789E2-B7CE-11D5-B7E9-00A0C9449F99}setup.exe»

======Security center information======

AV: Антивирус Касперского

======System event log======

Computer Name: MICROSOF-54303C
Event Code: 7036
Message: Служба «Совместимость быстрого переключения пользователей» перешла в состояние Работает.

Record Number: 6907
Source Name: Service Control Manager
Time Written: 20101226200940.000000+000
Event Type: информация
User:

Computer Name: MICROSOF-54303C
Event Code: 7035
Message: Служба «Совместимость быстрого переключения пользователей» успешно отправила управляющий элемент «запустить».

Record Number: 6906
Source Name: Service Control Manager
Time Written: 20101226200940.000000+000
Event Type: информация
User: NT AUTHORITYSYSTEM

Computer Name: MICROSOF-54303C
Event Code: 7036
Message: Служба «Службы терминалов» перешла в состояние Работает.

Record Number: 6905
Source Name: Service Control Manager
Time Written: 20101226200940.000000+000
Event Type: информация
User:

Computer Name: MICROSOF-54303C
Event Code: 7001
Message: Служба «Обозреватель компьютеров» является зависимой от службы «Сервер», которую не удалось запустить из-за ошибки
Не удается найти указанный файл.

Record Number: 6904
Source Name: Service Control Manager
Time Written: 20101226200940.000000+000
Event Type: ошибка
User:

Computer Name: MICROSOF-54303C
Event Code: 7023
Message: Служба «Сервер» завершена из-за ошибки
Не удается найти указанный файл.

Record Number: 6903
Source Name: Service Control Manager
Time Written: 20101226200940.000000+000
Event Type: ошибка
User:

=====Application event log=====

Computer Name: MICROSOF-54303C
Event Code: 0
Message:
Record Number: 1492
Source Name: hpqddsvc
Time Written: 20101205195323.000000+000
Event Type: информация
User:

Computer Name: MICROSOF-54303C
Event Code: 0
Message:
Record Number: 1491
Source Name: hpqcxs08
Time Written: 20101205190227.000000+000
Event Type: информация
User:

Computer Name: MICROSOF-54303C
Event Code: 0
Message:
Record Number: 1490
Source Name: hpqddsvc
Time Written: 20101205190146.000000+000
Event Type: информация
User:

Computer Name: MICROSOF-54303C
Event Code: 0
Message:
Record Number: 1489
Source Name: hpqcxs08
Time Written: 20101205185204.000000+000
Event Type: информация
User:

Computer Name: MICROSOF-54303C
Event Code: 0
Message:
Record Number: 1488
Source Name: hpqddsvc
Time Written: 20101205185124.000000+000
Event Type: информация
User:

======Environment variables======

«ComSpec»=%SystemRoot%system32cmd.exe
«Path»=C:Program FilesNVIDIA CorporationPhysXCommon;%SystemRoot%system32;%SystemRoot%;%SystemRoot%System32Wbem
«windir»=%SystemRoot%
«FP_NO_HOST_CHECK»=NO
«OS»=Windows_NT
«PROCESSOR_ARCHITECTURE»=x86
«PROCESSOR_LEVEL»=15
«PROCESSOR_IDENTIFIER»=x86 Family 15 Model 2 Stepping 9, GenuineIntel
«PROCESSOR_REVISION»=0209
«NUMBER_OF_PROCESSORS»=1
«PATHEXT»=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
«TEMP»=%SystemRoot%TEMP
«TMP»=%SystemRoot%TEMP

---

EOF

---

[CERBER]

Здравствуйте!
Добро пожаловать на Spyware-ru форум.
Лог не весь, возможно вирус блокирует работу РСИТ.
Выполните «Примечание 3:«, как описано вот в этой теме:
Как вылечить компьютер, первые шаги.

[Автор]

Сообщения