- This topic has 7 ответов, 2 участника, and was last updated 15 years, 11 months назад by
.
-
Сообщения
-
та же проблема с всплывающим окном скрипта «mediamodule.js111»
попогите пожалуйста избавится от заразы!
Logfile of random’s system information tool 1.06 (written by random/random)
Run by Admin at 2009-10-23 13:45:38
Microsoft Windows XP Professional Service Pack 3
System drive C: has 3 GB (34%) free of 10 GB
Total RAM: 2046 MB (54% free)Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:45:52, on 23.10.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20978)
Boot mode: NormalRunning processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32Ati2evxx.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSsystem32Ati2evxx.exe
C:WINDOWSsystem32spoolsv.exe
C:Program FilesCommon FilesAcronisSchedule2schedul2.exe
C:WINDOWSExplorer.EXE
C:Program FilesCommon FilesDoctor WebScanning Enginedwengine.exe
C:Program FilesCommon FilesLightScribeLSSrvc.exe
C:WINDOWSsystem32oodag.exe
C:WINDOWSsystem32PnkBstrA.exe
C:Program FilesATI TechnologiesATI.ACECore-StaticMOM.EXE
C:PROGRA~1DrWebspidernt.exe
C:WINDOWSsystem32svchost.exe
C:Program FilesATI TechnologiesATI HYDRAVISIONHydraDM.exe
C:Program FilesNeoSmart TechnologiesToolTipFixerToolTipFixer.exe
C:WINDOWSRTHDCPL.EXE
C:Program FilesDrWebSpIDerAgent.exe
C:Program FilesDrWebspiderml.exe
C:Program FilesATI TechnologiesATI.ACECore-Staticccc.exe
C:Program FilesDrWebspidergate.exe
C:PROGRA~1DrWebspiderui.exe
C:Program FilesCommon FilesAcronisSchedule2schedhlp.exe
C:Program FilesAcronisTrueImageHomeTrueImageMonitor.exe
C:Program FilesAcronisTrueImageHomeTimounterMonitor.exe
C:Program FilesVistaDriveIconVistaDrv.exe
C:Program FilesCD Slow 2.4cdslow.exe
C:Program FilesDAEMON Tools Litedaemon.exe
C:WINDOWSsystem32ctfmon.exe
C:Program FilesTotal CommanderTotalcmd.exe
C:Program FilesuTorrentutorrent.exe
C:Program FilesPC Connectivity SolutionServiceLayer.exe
C:Program FilesPC Connectivity SolutionTransportsNclUSBSrv.exe
C:Program FilesPC Connectivity SolutionTransportsNclRSSrv.exe
C:Program FilesMozilla Firefoxfirefox.exe
C:Program FilesAlcohol SoftAlcohol 120alcohol.exe
C:Program FilesWinampwinamp.exe
C:Program FilesDownload Masterdmaster.exe
E:_ВнешкасофтRSIT.exe
C:Program Filestrend microAdmin.exeR0 — HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.ya.ru/
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 — HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 — HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Ссылки
R3 — URLSearchHook: (no name) — — (no file)
O1 — Hosts: 127.255.255.255 serial.alcohol-soft.com
O2 — BHO: SnagIt Toolbar Loader — {00C6482D-C502-44C8-8409-FCE54AD9C208} — C:Program FilesTechSmithSnagIt 8SnagItBHO.dll
O2 — BHO: SSVHelper Class — {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} — C:Program FilesJavajre1.6.0_06binssv.dll
O2 — BHO: IE 4.x-6.x BHO for Download Master — {9961627E-4059-41B4-8E0E-A7D6B3854ADF} — C:PROGRA~1DOWNLO~1dmiehlp.dll
O3 — Toolbar: SnagIt — {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} — C:Program FilesTechSmithSnagIt 8SnagItIEAddin.dll
O3 — Toolbar: DM Bar — {0E1230F8-EA50-42A9-983C-D22ABC2EED3C} — C:Program FilesDownload Masterdmbar.dll
O4 — HKLM..Run: [StartCCC] «C:Program FilesATI TechnologiesATI.ACECore-StaticCLIStart.exe»
O4 — HKLM..Run: [HydraVisionDesktopManager] C:Program FilesATI TechnologiesATI HYDRAVISIONHydraDM.exe
O4 — HKLM..Run: [RTHDCPL] RTHDCPL.EXE
O4 — HKLM..Run: [SpIDerAgent] «C:Program FilesDrWebSpIDerAgent.exe»
O4 — HKLM..Run: [SpIDerMail] «C:Program FilesDrWebspiderml.exe»
O4 — HKLM..Run: [SpIDerGate] «C:Program FilesDrWebspidergate.exe» -autorun
O4 — HKLM..Run: [SpIDerNT] C:PROGRA~1DrWebspiderui.exe /agent
O4 — HKLM..Run: [Acronis Scheduler2 Service] «C:Program FilesCommon FilesAcronisSchedule2schedhlp.exe»
O4 — HKLM..Run: [TrueImageMonitor.exe] C:Program FilesAcronisTrueImageHomeTrueImageMonitor.exe
O4 — HKLM..Run: [AcronisTimounterMonitor] C:Program FilesAcronisTrueImageHomeTimounterMonitor.exe
O4 — HKCU..Run: [VistaIcon] C:Program FilesVistaDriveIconVistaDrv.exe
O4 — HKCU..Run: [CDSlow] c:Program FilesCD Slow 2.4cdslow.exe
O4 — HKCU..Run: [DAEMON Tools Lite] «C:Program FilesDAEMON Tools Litedaemon.exe» -autorun
O4 — HKCU..Run: [PC Suite Tray] «C:Program FilesNokiaNokia PC Suite 7PCSuite.exe» -onlytray
O4 — HKCU..Run: [ctfmon.exe] C:WINDOWSsystem32ctfmon.exe
O4 — HKUSS-1-5-18..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘SYSTEM’)
O4 — HKUSS-1-5-18..Run: [VistaIcon] C:Program FilesVistaDriveIconVistaDrv.exe (User ‘SYSTEM’)
O4 — HKUSS-1-5-18..RunOnce: [ZZZZ2_FirstLogonSetting] %SystemRoot%System32rundll32.exe advpack.dll,LaunchINFSection C:WINDOWSINFcustom.inf,NewUserFirstLogonInstall,0 (User ‘SYSTEM’)
O4 — HKUS.DEFAULT..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘Default user’)
O4 — HKUS.DEFAULT..RunOnce: [ZZZZ2_FirstLogonSetting] %SystemRoot%System32rundll32.exe advpack.dll,LaunchINFSection C:WINDOWSINFcustom.inf,NewUserFirstLogonInstall,0 (User ‘Default user’)
O4 — S-1-5-18 Startup: µTorrent.lnk = C:Program FilesuTorrentutorrent.exe (User ‘SYSTEM’)
O4 — .DEFAULT Startup: µTorrent.lnk = C:Program FilesuTorrentutorrent.exe (User ‘Default user’)
O4 — Startup: µTorrent.lnk = C:Program FilesuTorrentutorrent.exe
O4 — Global Startup: Total Commander.lnk = C:Program FilesTotal CommanderTotalcmd.exe
O8 — Extra context menu item: &ICQ Toolbar Search — res://C:Program FilesICQToolbartoolbaru.dll/SEARCH.HTML
O8 — Extra context menu item: &Перевести — C:Program FilesArsenal CompanySOCRAT InternetHTMLWSocrat.js
O8 — Extra context menu item: &Экспорт в Microsoft Excel — res://C:PROGRA~1MICROS~1Office12EXCEL.EXE/3000
O8 — Extra context menu item: Download with Rapget — C:rapget140rapget.htm
O8 — Extra context menu item: Добавить страницу в URL-Album — C:Program FilesURL-Albumua.htm
O8 — Extra context menu item: Закачать ВСЕ при помощи Download Master — C:Program FilesDownload Masterdmieall.htm
O8 — Extra context menu item: Закачать при помощи Download Master — C:Program FilesDownload Masterdmie.htm
O8 — Extra context menu item: Передать на удаленную закачку DM — C:Program FilesDownload Masterremdown.htm
O9 — Extra button: (no name) — DctMapping — (no file)
O9 — Extra button: (no name) — {08B0E5C0-4FCB-11CF-AAA5-00401C608501} — C:Program FilesJavajre1.6.0_06binssv.dll
O9 — Extra ‘Tools’ menuitem: Sun Java Console — {08B0E5C0-4FCB-11CF-AAA5-00401C608501} — C:Program FilesJavajre1.6.0_06binssv.dll
O9 — Extra button: СОКРАТ Интернет 3.0 — {17FA5CD6-5737-45c2-B194-74C8A4A7F7E7} — C:Program FilesArsenal CompanySOCRAT InternetSocratInternet.dll
O9 — Extra button: Настройки СОКРАТ Интернет 3.0 — {71F65890-5ED6-11d4-9665-00E02962D81A} — C:Program FilesArsenal CompanySOCRAT InternetSocratInternetT.dll
O9 — Extra button: Download Master — {8DAE90AD-4583-4977-9DD4-4360F7A45C74} — C:Program FilesDownload Masterdmaster.exe
O9 — Extra ‘Tools’ menuitem: &Download Master — {8DAE90AD-4583-4977-9DD4-4360F7A45C74} — C:Program FilesDownload Masterdmaster.exe
O9 — Extra button: Research — {92780B25-18CC-41C8-B9BE-3C9C571A8263} — C:PROGRA~1MICROS~1Office12REFIEBAR.DLL
O9 — Extra button: ICQ Lite — {B863453A-26C3-4e1f-A54D-A2CD196348E9} — C:Program FilesICQLiteICQLite.exe (file missing)
O9 — Extra ‘Tools’ menuitem: ICQ Lite — {B863453A-26C3-4e1f-A54D-A2CD196348E9} — C:Program FilesICQLiteICQLite.exe (file missing)
O9 — Extra button: Перевести страницу — {DFDC8970-FD66-4385-B8C0-835A4AA1DA00} — C:Program FilesArsenal CompanySOCRAT InternetSocratInternet.dll
O9 — Extra button: (no name) — {e2e2dd38-d088-4134-82b7-f2ba38496583} — C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O9 — Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 — {e2e2dd38-d088-4134-82b7-f2ba38496583} — C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O9 — Extra button: Добавить страницу в URL-Album — {4D9BEE60-F894-11D4-9B21-AD4030B75053} — C:Program FilesURL-Albumua.htm (HKCU)
O9 — Extra button: (no name) — {4D9BEE60-F894-11D4-9B21-AD4030B75054} — C:Program FilesURL-Albumurlalbum.exe (HKCU)
O9 — Extra ‘Tools’ menuitem: Открыть URL-Album — {4D9BEE60-F894-11D4-9B21-AD4030B75054} — C:Program FilesURL-Albumurlalbum.exe (HKCU)
O17 — HKLMSystemCCSServicesTcpip..{600F14BB-6B06-4DE6-86C2-011E5A68679A}: NameServer = 89.189.129.66
O17 — HKLMSystemCCSServicesTcpip..{9A403CC4-D556-4C9A-BEB0-886B954517A3}: NameServer = 89.189.129.66 81.30.199.5
O17 — HKLMSystemCCSServicesTcpip..{9C943852-211E-49E0-9D16-39D1C9737A46}: NameServer = 89.189.129.66 81.30.199.5
O23 — Service: Acronis Scheduler2 Service (AcrSch2Svc) — Acronis — C:Program FilesCommon FilesAcronisSchedule2schedul2.exe
O23 — Service: Adobe LM Service — Unknown owner — C:Program FilesCommon FilesAdobe Systems SharedServiceAdobelmsvc.exe
O23 — Service: Application Driver Auto Removal Service (01) (appdrvrem01) — Protection Technology — C:WINDOWSSystem32appdrvrem01.exe
O23 — Service: Ati HotKey Poller — ATI Technologies Inc. — C:WINDOWSsystem32Ati2evxx.exe
O23 — Service: ATI Smart — Unknown owner — C:WINDOWSsystem32ati2sgag.exe
O23 — Service: Dr.Web ® Scanning Engine (DrWebEngine) (DrWebEngine) — Doctor Web, Ltd. — C:Program FilesCommon FilesDoctor WebScanning Enginedwengine.exe
O23 — Service: Журнал событий (Eventlog) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: GEST Service for program management. (GEST Service) — Unknown owner — C:Program FilesGIGABYTEGESTGSvr.exe
O23 — Service: InstallDriver Table Manager (IDriverT) — Macrovision Corporation — C:Program FilesCommon FilesInstallShieldDriver1150Intel 32IDriverT.exe
O23 — Service: Служба COM записи компакт-дисков IMAPI (ImapiService) — Корпорация Майкрософт — C:WINDOWSsystem32imapi.exe
O23 — Service: LightScribeService Direct Disc Labeling Service (LightScribeService) — Hewlett-Packard Company — C:Program FilesCommon FilesLightScribeLSSrvc.exe
O23 — Service: MSCSPTISRV — Sony Corporation — C:Program FilesCommon FilesSony SharedAVLibMSCSPTISRV.exe
O23 — Service: O&O Defrag — O&O Software GmbH — C:WINDOWSsystem32oodag.exe
O23 — Service: PACSPTISVR — Unknown owner — C:Program FilesCommon FilesSony SharedAVLibPACSPTISVR.exe
O23 — Service: Plug and Play (PlugPlay) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: PnkBstrA — Unknown owner — C:WINDOWSsystem32PnkBstrA.exe
O23 — Service: Диспетчер сеанса справки для удаленного рабочего стола (RDSessMgr) — Корпорация Майкрософт — C:WINDOWSsystem32sessmgr.exe
O23 — Service: Смарт-карты (SCardSvr) — Корпорация Майкрософт — C:WINDOWSSystem32SCardSvr.exe
O23 — Service: ServiceLayer — Nokia. — C:Program FilesPC Connectivity SolutionServiceLayer.exe
O23 — Service: FrontLine Drivers Auto Removal (v2) (sfrem02) — Protection Technology (StarForce) — C:WINDOWSsystem32sfrem02.exe
O23 — Service: SonicStage Back-End Service — Sony Corporation — C:Program FilesCommon FilesSony SharedAVLibSsBeSvc.exe
O23 — Service: SpIDer Guard for Windows (SPIDERNT) — Doctor Web, Ltd. — C:PROGRA~1DrWebspidernt.exe
O23 — Service: Sony SPTI Service (SPTISRV) — Sony Corporation — C:Program FilesCommon FilesSony SharedAVLibSPTISRV.exe
O23 — Service: SonicStage SCSI Service (SSScsiSV) — Sony Corporation — C:Program FilesCommon FilesSony SharedAVLibSSScsiSV.exe
O23 — Service: Журналы и оповещения производительности (SysmonLog) — Корпорация Майкрософт — C:WINDOWSsystem32smlogsvc.exe
O23 — Service: NST ToolTipFixer (TTFixerService) — NeoSmart Technologies — C:Program FilesNeoSmart TechnologiesToolTipFixerToolTipFixer.exe
O23 — Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) — TuneUp Software GmbH — C:Program FilesTuneUp Utilities 2006WinStylerThemeSvc.exe
O23 — Service: Теневое копирование тома (VSS) — Корпорация Майкрософт — C:WINDOWSSystem32vssvc.exe
O23 — Service: Адаптер производительности WMI (WmiApSrv) — Корпорация Майкрософт — C:WINDOWSsystem32wbemwmiapsrv.exe—
End of file — 12562 bytes======Scheduled tasks folder======
C:WINDOWStasks1-Click Maintenance.job
======Registry dump======
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{00C6482D-C502-44C8-8409-FCE54AD9C208}]
SnagIt Toolbar Loader — C:Program FilesTechSmithSnagIt 8SnagItBHO.dll [2007-05-01 63048][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class — C:Program FilesJavajre1.6.0_06binssv.dll [2008-03-25 509328][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{9961627E-4059-41B4-8E0E-A7D6B3854ADF}]
IE 4.x-6.x BHO for Download Master — C:PROGRA~1DOWNLO~1dmiehlp.dll [2009-04-16 158208][HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
{8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} — SnagIt — C:Program FilesTechSmithSnagIt 8SnagItIEAddin.dll [2007-05-01 161352]
{0E1230F8-EA50-42A9-983C-D22ABC2EED3C} — DM Bar — C:Program FilesDownload Masterdmbar.dll [2007-11-26 180224][HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun]
«StartCCC»=C:Program FilesATI TechnologiesATI.ACECore-StaticCLIStart.exe [2006-11-10 90112]
«HydraVisionDesktopManager»=C:Program FilesATI TechnologiesATI HYDRAVISIONHydraDM.exe [2003-09-15 270336]
«RTHDCPL»=C:WINDOWSRTHDCPL.EXE [2008-04-10 16861184]
«SpIDerAgent»=C:Program FilesDrWebSpIDerAgent.exe [2008-12-17 697584]
«SpIDerMail»=C:Program FilesDrWebspiderml.exe [2008-12-12 627952]
«SpIDerGate»=C:Program FilesDrWebspidergate.exe [2008-12-15 1402096]
«SpIDerNT»=C:PROGRA~1DrWebspiderui.exe [2008-12-09 197896]
«Acronis Scheduler2 Service»=C:Program FilesCommon FilesAcronisSchedule2schedhlp.exe [2008-11-04 165144]
«TrueImageMonitor.exe»=C:Program FilesAcronisTrueImageHomeTrueImageMonitor.exe [2008-11-04 4382376]
«AcronisTimounterMonitor»=C:Program FilesAcronisTrueImageHomeTimounterMonitor.exe [2008-11-04 962136][HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun]
«VistaIcon»=C:Program FilesVistaDriveIconVistaDrv.exe [2008-01-02 132096]
«CDSlow»=c:Program FilesCD Slow 2.4cdslow.exe [2004-02-27 73728]
«DAEMON Tools Lite»=C:Program FilesDAEMON Tools Litedaemon.exe [2008-12-29 687560]
«PC Suite Tray»=C:Program FilesNokiaNokia PC Suite 7PCSuite.exe [2009-06-12 1414144]
«ctfmon.exe»=C:WINDOWSsystem32ctfmon.exe [2008-06-21 30208][HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregAcronis Scheduler2 Service]
C:Program FilesCommon FilesAcronisSchedule2schedhlp.exe [2008-11-04 165144][HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregAcronis True Image Monitor]
C:Program FilesAcronisTrueImageTrueImageMonitor.exe [][HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregBluetoothAuthenticationAgent]
bthprops.cpl,,BluetoothAuthenticationAgent []C:Documents and SettingsAll UsersГлавное менюПрограммыАвтозагрузка
Total Commander.lnk — C:Program FilesTotal CommanderTotalcmd.exeC:Documents and SettingsAdminГлавное менюПрограммыАвтозагрузка
µTorrent.lnk — C:Program FilesuTorrentutorrent.exe[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifyAtiExtEvent]
C:WINDOWSsystem32Ati2evxx.dll [2007-11-02 122880][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad]
WPDShServiceObj — {AAA288BA-9A4C-45B0-95D7-94D524869DB5} — C:WINDOWSsystem32wpdshserviceobj.dll [2008-03-02 133632][HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootMinimalWdf01000.sys]
[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetworkWdf01000.sys]
[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
«dontdisplaylastusername»=0
«legalnoticecaption»=
«legalnoticetext»=
«shutdownwithoutlogon»=1
«undockwithoutlogon»=1[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoDriveTypeAutoRun»=323
«NoSharedDocuments»=1
«NoSMConfigurePrograms»=1
«NoInstrumentation»=0
«NoAddPrinter»=1
«NoSMHelp»=1
«NoDriveAutoRun»=67108863
«NoDrives»=0[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoDriveTypeAutoRun»=
«NoDriveAutoRun»=
«NoDrives»=[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicystandardprofileauthorizedapplicationslist]
«%windir%Network Diagnosticxpnetdiag.exe»=»%windir%Network Diagnosticxpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000»
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»
«C:Program FilesuTorrentutorrent.exe»=»C:Program FilesuTorrentutorrent.exe:*:Enabled:µTorrent»
«E:_Localsoftutorrent 1.8.2.14458.exe»=»E:_Localsoftutorrent 1.8.2.14458.exe:*:Enabled:µTorrent»
«C:Program FilesuTorrentLPutorrent_original.exe»=»C:Program FilesuTorrentLPutorrent_original.exe:*:Enabled:µTorrent»
«C:Program FilesuTorrentLPutorrent_noreport.exe»=»C:Program FilesuTorrentLPutorrent_noreport.exe:*:Enabled:µTorrent»
«C:Program FilesuTorrentutorrent_noreport.exe»=»C:Program FilesuTorrentutorrent_noreport.exe:*:Enabled:µTorrent»
«C:Program FilesuTorrentLPutorrent_mult100_leecher.exe»=»C:Program FilesuTorrentLPutorrent_mult100_leecher.exe:*:Enabled:µTorrent»
«C:Program FilesuTorrentutorrent_original.exe»=»C:Program FilesuTorrentutorrent_original.exe:*:Enabled:µTorrent»
«C:Program FilesuTorrentutorrent_mult10_seeder.exe»=»C:Program FilesuTorrentutorrent_mult10_seeder.exe:*:Enabled:µTorrent»
«C:Program FilesuTorrentutorrent_report.exe»=»C:Program FilesuTorrentutorrent_report.exe:*:Enabled:µTorrent»
«C:Program FilesuTorrentLPutorrent_fake2x_seeder.exe»=»C:Program FilesuTorrentLPutorrent_fake2x_seeder.exe:*:Enabled:µTorrent»
«C:WINDOWSsystem32PnkBstrA.exe»=»C:WINDOWSsystem32PnkBstrA.exe:*:Enabled:PnkBstrA»
«C:WINDOWSsystem32PnkBstrB.exe»=»C:WINDOWSsystem32PnkBstrB.exe:*:Enabled:PnkBstrB»
«E:Program FilesActivisionWolfensteinMPWolf2MP.exe»=»E:Program FilesActivisionWolfensteinMPWolf2MP.exe:*:Enabled:Wolfenstein(TM)»
«E:Program FilesActivisionWolfensteinMPWolf2MPLite.exe»=»E:Program FilesActivisionWolfensteinMPWolf2MPLite.exe:*:Enabled:Wolfenstein(TM)»
«C:Program FilesuTorrentLPutorrent_stealth.exe»=»C:Program FilesuTorrentLPutorrent_stealth.exe:*:Enabled:µTorrent»[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicydomainprofileauthorizedapplicationslist]
«%windir%Network Diagnosticxpnetdiag.exe»=»%windir%Network Diagnosticxpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000»
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{4c4db552-5985-11d7-96b4-aafdea2f41cb}]
shellAutoRuncommand — H:setup.exe======List of files/folders created in the last 1 months======
2009-10-23 13:45:39 —-D—- C:Program Filestrend micro
2009-10-23 13:45:38 —-D—- C:rsit
2009-10-21 14:14:09 —-D—- C:Program FilesISTool
2009-10-21 14:14:09 —-D—- C:Documents and SettingsAdminApplication DataISTool
2009-10-21 14:01:25 —-D—- C:Program FilesInno Setup 5
2009-10-19 17:22:50 —-SHD—- C:RECYCLER
2009-10-14 22:33:08 —-D—- C:Documents and SettingsAdminApplication DataThe Bat!
2009-10-14 16:28:50 —-D—- C:WINDOWStemp
2009-10-14 16:28:49 —-A—- C:ComboFix.txt
2009-10-14 16:15:00 —-D—- C:WINDOWSERDNT
2009-10-14 16:00:14 —-A—- C:logit.txt
2009-10-11 13:57:15 —-HD—- C:WINDOWSPIF
2009-10-06 20:21:35 —-D—- C:users
2009-10-06 18:53:17 —-D—- C:Program Filesmp3Tag 5
2009-10-06 11:54:50 —-A—- C:WINDOWSpro.INI
2009-10-06 11:41:11 —-D—- C:Program FilesTeleport.Backup
2009-10-06 11:36:44 —-D—- C:Program FilesTeleport Pro
2009-10-04 01:04:59 —-A—- C:WINDOWSboxworld.ini
2009-10-01 02:00:00 —-A—- C:WINDOWSsystem32DevCon.exe
2009-09-27 15:09:58 —-D—- C:Program FilesCheMaxRus
2009-09-27 10:39:29 —-SHD—- C:Documents and SettingsAll UsersApplication Data{55A29068-F2CE-456C-9148-C869879E2357}
2009-09-26 10:01:27 —-D—- C:Documents and SettingsAll UsersApplication Dataashampoo
2009-09-26 10:01:01 —-D—- C:Program FilesAshampoo======List of files/folders modified in the last 1 months======
2009-10-23 13:45:49 —-D—- C:Temp
2009-10-23 13:45:39 —-RD—- C:Program Files
2009-10-23 13:45:25 —-D—- C:Documents and SettingsAdminApplication DatauTorrent
2009-10-23 12:58:03 —-D—- C:Program FilesMozilla Firefox
2009-10-23 12:57:11 —-D—- C:Program FilesDrWeb
2009-10-23 12:51:38 —-D—- C:WINDOWSsystem32CatRoot2
2009-10-23 12:49:49 —-A—- C:WINDOWSSchedLgU.Txt
2009-10-23 04:44:42 —-D—- C:WINDOWSsystem32config
2009-10-21 14:55:59 —-RSHDC—- C:WINDOWSsystem32dllcache
2009-10-19 22:32:03 —-D—- C:WINDOWS
2009-10-19 17:30:25 —-D—- C:WINDOWSsystem32DirectX
2009-10-19 17:30:23 —-HD—- C:WINDOWSinf
2009-10-19 17:22:53 —-D—- C:WINDOWSsystem32Restore
2009-10-18 20:53:23 —-D—- C:Program FilesDownload Master
2009-10-14 22:31:47 —-SHD—- C:System Volume Information
2009-10-14 16:46:43 —-D—- C:WINDOWSsystem32
2009-10-14 16:28:51 —-D—- C:WINDOWSsystem32drivers
2009-10-14 16:26:07 —-A—- C:WINDOWSsystem.ini
2009-10-14 16:22:20 —-D—- C:WINDOWSAppPatch
2009-10-14 16:22:19 —-D—- C:Program FilesCommon Files
2009-10-14 15:58:53 —-HD—- C:Program FilesInstallShield Installation Information
2009-10-13 19:33:01 —-SHD—- C:WINDOWSInstaller
2009-10-13 19:33:00 —-D—- C:Program FilesThe Bat!
2009-10-11 22:39:04 —-D—- C:Documents and SettingsAdminApplication DataYandex
2009-10-11 15:35:09 —-D—- C:Documents and SettingsAll UsersApplication DataAdobe
2009-10-11 15:33:28 —-D—- C:Documents and SettingsAdminApplication DataAdobe
2009-10-11 14:01:17 —-D—- C:Program FilesuTorrentLP
2009-10-07 02:51:52 —-D—- C:Documents and SettingsAdminApplication DataDownload Master
2009-10-04 15:39:12 —-D—- C:Program FilesTotal Commander
2009-10-02 13:46:38 —-A—- C:Documents and SettingsAdminApplication Dataex_log.txt
2009-09-26 10:02:01 —-D—- C:Documents and SettingsAdminApplication DataAshampoo======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R1 appdrv01;Application Driver (01); C:WINDOWSSystem32Driversappdrv01.sys [2009-04-27 3110512]
R1 ASPI32;ASPI32; C:WINDOWSsystem32driversASPI32.sys [1999-09-10 25244]
R1 intelppm;Драйвер Intel процессора; C:WINDOWSsystem32DRIVERSintelppm.sys [2008-04-15 40704]
R1 prodrv05;StarForce Protection Environment Driver v5; C:WINDOWSSystem32driversprodrv05.sys [2002-12-26 53568]
R1 prodrv06;StarForce Protection Environment Driver v6; C:WINDOWSSystem32driversprodrv06.sys [2003-09-06 51744]
R1 VBoxDrv;VirtualBox Service; C:WINDOWSsystem32DRIVERSVBoxDrv.sys [2009-02-16 100560]
R1 VBoxUSBMon;VirtualBox USB Monitor Driver; C:WINDOWSsystem32DRIVERSVBoxUSBMon.sys [2009-02-16 41744]
R1 WS2IFSL;Среда Windows Socket 2.0 поддержки поставщиков не-IFS служб; C:WINDOWSSystem32driversws2ifsl.sys [2008-04-15 12032]
R2 atksgt;atksgt; C:WINDOWSsystem32DRIVERSatksgt.sys [2009-06-08 279712]
R2 ElbyCDIO;ElbyCDIO Driver; C:WINDOWSSystem32DriversElbyCDIO.sys [2005-04-21 10624]
R2 lirsgt;lirsgt; C:WINDOWSsystem32DRIVERSlirsgt.sys [2009-06-08 25888]
R2 rspndr;Ответчик обнаружения топологии уровня связи; C:WINDOWSsystem32DRIVERSrspndr.sys [2008-06-05 62336]
R2 SPIDER;SpIDer Guard File System Monitor; ??C:PROGRA~1DrWebspider.sys []
R2 tifsfilter;Acronis True Image FS Filter; C:WINDOWSsystem32DRIVERStifsfilt.sys [2009-02-21 44704]
R3 ati2mtag;ati2mtag; C:WINDOWSsystem32DRIVERSati2mtag.sys [2007-11-02 2644480]
R3 ElbyCDFL;ElbyCDFL; C:WINDOWSSystem32DriversElbyCDFL.sys [2005-05-03 27392]
R3 FStarForce;FStarForce; C:WINDOWSsystem32DRIVERSFStarForce.sys [2009-04-08 8704]
R3 HDAudBus;Драйвер шины Microsoft UAA для High Definition Audio; C:WINDOWSsystem32DRIVERSHDAudBus.sys [2008-04-15 144384]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:WINDOWSsystem32driversRtkHDAud.sys [2008-04-17 4707328]
R3 RTHDMIAzAudService;Service for HDMI; C:WINDOWSsystem32driversRtHDMI.sys [2007-05-14 3526464]
R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; C:WINDOWSsystem32DRIVERSRtenicxp.sys [2008-01-04 105856]
R3 usbehci;Драйвер минипорта Microsoft USB 2.0 расширенного хост-контроллера; C:WINDOWSsystem32DRIVERSusbehci.sys [2008-06-21 30336]
R3 usbhub;USB2 концентратор; C:WINDOWSsystem32DRIVERSusbhub.sys [2008-06-21 59520]
R3 usbuhci;Драйвер минипорта Microsoft USB универсального хост-контроллера; C:WINDOWSsystem32DRIVERSusbuhci.sys [2008-04-15 20608]
R3 VBoxNetFlt;VBoxNetFlt Service; C:WINDOWSsystem32DRIVERSVBoxNetFlt.sys [2009-02-16 87568]
S3 ahkwa0cu;ahkwa0cu; C:WINDOWSsystem32driversahkwa0cu.sys []
S3 angi9ik3;angi9ik3; C:WINDOWSsystem32driversangi9ik3.sys []
S3 Arp1394;Протокол клиента 1394 ARP; C:WINDOWSsystem32DRIVERSarp1394.sys [2008-06-21 60800]
S3 BlueletAudio;Bluetooth Audio Service; C:WINDOWSsystem32DRIVERSblueletaudio.sys [2004-10-19 20096]
S3 BT;Bluetooth PAN Network Adapter; C:WINDOWSsystem32DRIVERSbtnetdrv.sys [2004-09-21 10804]
S3 Btcsrusb;Bluetooth USB For Bluetooth Service; C:WINDOWSSystem32Driversbtcusb.sys [2005-01-17 23000]
S3 BthEnum;Драйвер блока запроса Bluetooth; C:WINDOWSsystem32DRIVERSBthEnum.sys [2008-06-21 17024]
S3 BTHidEnum;Bluetooth HID Enumerator; C:WINDOWSsystem32DRIVERSvbtenum.sys [2005-01-13 12500]
S3 BthPan;Bluetooth Device (Personal Area Network); C:WINDOWSsystem32DRIVERSbthpan.sys [2008-06-21 101120]
S3 BTHPORT;Драйвер порта Bluetooth; C:WINDOWSSystem32DriversBTHport.sys [2008-06-14 272512]
S3 BTHUSB;Драйвер порта USB радиомодуля Bluetooth; C:WINDOWSSystem32DriversBTHUSB.sys [2008-06-21 18944]
S3 BTNetFilter;Bluetooth Network Filter; ??C:WINDOWSsystem32driversBTNetFilter.sys []
S3 catchme;catchme; ??C:ComboFixcatchme.sys []
S3 CCDECODE;Closed Caption декодер; C:WINDOWSsystem32DRIVERSCCDECODE.sys [2004-07-09 16384]
S3 ET5Drv;ET5Drv; ??C:WINDOWSsystem32DriversET5Drv.sys []
S3 gdrv;gdrv; ??C:WINDOWSgdrv.sys []
S3 HdAudAddService;ATI Function Driver for High Definition Audio Service; C:WINDOWSsystem32driversAtiHdAud.sys [2006-12-28 84992]
S3 ltmodem5;Agere Modem Driver; C:WINDOWSsystem32DRIVERSltmdmnt.sys [2003-07-01 652497]
S3 MODEMCSA;Устройство фильтрации потока Unimodem; C:WINDOWSsystem32driversMODEMCSA.sys [2008-06-21 16128]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:WINDOWSsystem32driversMSTEE.sys [2002-12-12 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:WINDOWSsystem32DRIVERSNABTSFEC.sys [2004-07-09 83968]
S3 NdisIP;Microsoft TV/Video Connection; C:WINDOWSsystem32DRIVERSNdisIP.sys [2004-07-09 10112]
S3 NIC1394;Сетевой драйвер 1394; C:WINDOWSsystem32DRIVERSnic1394.sys [2008-06-21 61824]
S3 nmwcd;Nokia USB Phone Parent; C:WINDOWSsystem32driversccdcmb.sys [2009-02-09 17664]
S3 nmwcdc;Nokia USB Generic; C:WINDOWSsystem32driversccdcmbo.sys [2009-02-09 22016]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:WINDOWSsystem32DRIVERSpccsmcfd.sys [2008-08-26 18816]
S3 RFCOMM;Устройство Bluetooth (протокол RFCOMM TDI); C:WINDOWSsystem32DRIVERSrfcomm.sys [2008-06-21 59136]
S3 ROOTMODEM;Microsoft Legacy Modem Driver; C:WINDOWSSystem32DriversRootMdm.sys [2008-04-15 5888]
S3 SLIP;BDA Slip De-Framer; C:WINDOWSsystem32DRIVERSSLIP.sys [2004-07-09 10880]
S3 streamip;BDA IPSink; C:WINDOWSsystem32DRIVERSStreamIP.sys [2004-07-09 14976]
S3 upperdev;upperdev; C:WINDOWSsystem32DRIVERSusbser_lowerflt.sys [2009-02-09 7808]
S3 usbccgp;Драйвер универсального родительского устройства USB (Microsoft); C:WINDOWSsystem32DRIVERSusbccgp.sys [2008-06-21 32384]
S3 usbscan;Драйвер USB-сканера; C:WINDOWSsystem32DRIVERSusbscan.sys [2008-06-21 15104]
S3 usbser;USB Modem Driver; C:WINDOWSsystem32driversusbser.sys [2008-06-21 26112]
S3 UsbserFilt;UsbserFilt; C:WINDOWSsystem32DRIVERSusbser_lowerfltj.sys [2009-02-09 7808]
S3 USBSTOR;Драйвер запоминающих устройств для USB; C:WINDOWSsystem32DRIVERSUSBSTOR.SYS [2008-06-21 26368]
S3 usbvideo;USB-видеоустройство (WDM); C:WINDOWSSystem32Driversusbvideo.sys [2008-06-21 121984]
S3 VComm;Virtual Serial port driver; C:WINDOWSsystem32DRIVERSVComm.sys [2004-10-19 61312]
S3 VcommMgr;Bluetooth VComm Manager Service; C:WINDOWSSystem32DriversVcommMgr.sys [2004-11-05 82148]
S3 Wdf01000;Kernel Mode Driver Frameworks service; C:WINDOWSSystem32Driverswdf01000.sys [2008-03-27 503008]
S3 WSTCODEC;World Standard Teletext Codec; C:WINDOWSsystem32DRIVERSWSTCODEC.SYS [2004-07-09 18688]
S3 WudfRd;Windows Driver Foundation — User-mode Driver Framework Reflector; C:WINDOWSsystem32DRIVERSwudfrd.sys [2008-01-18 83328]
S4 dwshd;dwshd; C:WINDOWSSystem32driversdwshd.sys []
S4 IntelIde;IntelIde; C:WINDOWSsystem32driversIntelIde.sys []======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 AcrSch2Svc;Acronis Scheduler2 Service; C:Program FilesCommon FilesAcronisSchedule2schedul2.exe [2008-11-04 554264]
R2 Ati HotKey Poller;Ati HotKey Poller; C:WINDOWSsystem32Ati2evxx.exe [2007-11-02 495616]
R2 BthServ;Bluetooth Support Service; C:WINDOWSsystem32svchost.exe [2008-04-15 14336]
R2 DrWebEngine;Dr.Web ® Scanning Engine (DrWebEngine); C:Program FilesCommon FilesDoctor WebScanning Enginedwengine.exe [2008-10-17 869688]
R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:Program FilesCommon FilesLightScribeLSSrvc.exe [2007-08-23 79136]
R2 O&O Defrag;O&O Defrag; C:WINDOWSsystem32oodag.exe [2007-05-11 1050120]
R2 PnkBstrA;PnkBstrA; C:WINDOWSsystem32PnkBstrA.exe [2009-08-20 75064]
R2 SPIDERNT;SpIDer Guard for Windows; C:PROGRA~1DrWebspidernt.exe [2008-12-09 197896]
R2 TTFixerService;NST ToolTipFixer; C:Program FilesNeoSmart TechnologiesToolTipFixerToolTipFixer.exe [2007-06-27 10240]
R2 WudfSvc;Windows Driver Foundation — User-mode Driver Framework; C:WINDOWSsystem32svchost.exe [2008-04-15 14336]
R3 ServiceLayer;ServiceLayer; C:Program FilesPC Connectivity SolutionServiceLayer.exe [2009-06-02 637952]
S2 appdrvrem01;Application Driver Auto Removal Service (01); C:WINDOWSSystem32appdrvrem01.exe [2009-04-27 316816]
S2 ATI Smart;ATI Smart; C:WINDOWSsystem32ati2sgag.exe [2007-11-01 593920]
S2 sfrem02;FrontLine Drivers Auto Removal (v2); C:WINDOWSsystem32sfrem02.exe [2006-05-11 358008]
S3 Adobe LM Service;Adobe LM Service; C:Program FilesCommon FilesAdobe Systems SharedServiceAdobelmsvc.exe [2009-06-08 68096]
S3 aspnet_state;Служба состояний ASP.NET; C:WINDOWSMicrosoft.NETFrameworkv2.0.50727aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:WINDOWSMicrosoft.NETFrameworkv2.0.50727mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:WINDOWSMicrosoft.NETFrameworkv3.0WPFPresentationFontCache.exe [2008-07-29 46104]
S3 GEST Service;GEST Service for program management.; C:Program FilesGIGABYTEGESTGSvr.exe [2007-12-14 47624]
S3 IDriverT;InstallDriver Table Manager; C:Program FilesCommon FilesInstallShieldDriver1150Intel 32IDriverT.exe [2005-11-14 69632]
S3 idsvc;Windows CardSpace; C:WINDOWSMicrosoft.NETFrameworkv3.0Windows Communication Foundationinfocard.exe [2008-07-29 881664]
S3 MSCSPTISRV;MSCSPTISRV; C:Program FilesCommon FilesSony SharedAVLibMSCSPTISRV.exe [2006-12-14 45056]
S3 odserv;Microsoft Office Diagnostics Service; C:Program FilesCommon FilesMicrosoft SharedOFFICE12ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:Program FilesCommon FilesMicrosoft SharedSource EngineOSE.EXE [2006-10-26 145184]
S3 PACSPTISVR;PACSPTISVR; C:Program FilesCommon FilesSony SharedAVLibPACSPTISVR.exe [2006-12-14 57344]
S3 SonicStage Back-End Service;SonicStage Back-End Service; C:Program FilesCommon FilesSony SharedAVLibSsBeSvc.exe [2007-02-05 112184]
S3 SPTISRV;Sony SPTI Service; C:Program FilesCommon FilesSony SharedAVLibSPTISRV.exe [2006-12-14 69632]
S3 SSScsiSV;SonicStage SCSI Service; C:Program FilesCommon FilesSony SharedAVLibSSScsiSV.exe [2007-02-05 75320]
S3 TUWinStylerThemeSvc;TuneUp WinStyler Theme Service; C:Program FilesTuneUp Utilities 2006WinStylerThemeSvc.exe [2005-08-10 118272]
S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:Program FilesWindows Media Playerwmpnetwk.exe [2006-10-18 913408]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:WINDOWSMicrosoft.NETFrameworkv3.0Windows Communication FoundationSMSvcHost.exe [2008-07-29 132096]
EOF
info.txt logfile of random’s system information tool 1.06 2009-10-23 13:45:54======Uninstall list======
#1 DVD Ripper 7.2.3—>C:Program FilesNo1 DVD Ripperuninst.exe
—>MsiExec /X{B83FC356-B7C0-441F-8A4D-D71E088E7974}
—>rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:WINDOWSINFPCHealth.inf
7-Zip 4.57—>»C:Program Files7-ZipUninstall.exe»
Acronis True Image Home—>MsiExec.exe /X{37C8899D-FD70-481F-94AA-1F1B08765E22}
Adobe AIR—>C:Program FilesCommon FilesAdobe AIRVersions1.0ResourcesAdobe AIR Updater.exe -arp:uninstall
Adobe AIR—>MsiExec.exe /I{197A3012-8C85-4FD3-AB66-9EC7E13DB92E}
Adobe Flash Player 10 ActiveX—>C:WINDOWSsystem32MacromedFlashuninstall_activeX.exe
Adobe Flash Player 10 Plugin—>C:WINDOWSsystem32MacromedFlashuninstall_plugin.exe
Adobe Media Player—>msiexec /qb /x {5C74694C-A687-E3EB-FF18-B018D4A76ECD}
Adobe Media Player—>MsiExec.exe /I{5C74694C-A687-E3EB-FF18-B018D4A76ECD}
Ashampoo Burning Studio 9.12—>»C:Program FilesAshampooAshampoo Burning Studio 9unins000.exe»
ATI — Утилита деинсталляции—>C:Program FilesATI TechnologiesUninstallAllAtiCimUn.exe
ATI AVIVO Codecs—>MsiExec.exe /I{89DE67AD-08B8-4699-A55D-CA5C0AF82BF3}
ATI Catalyst Control Center—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1PROFES~1RunTime 9 1Intel32Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{055EE59D-217B-43A7-ABFF-507B966405D8}setup.exe» -l0x0
ATI Display Driver—>rundll32 C:WINDOWSsystem32atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
ATI HYDRAVISION—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1engine6INTEL3~1ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{3EA9D975-BFDC-4E8E-B88B-0446FBC8CA66}setup.exe»
CheMax Rus 8.9—>»C:Program FilesCheMaxRusunins000.exe»
CloneCD—>»C:Program FilesCloneCDccd-uninst.exe» /D=»C:Program FilesCloneCD»
Cover Commander 3.0 by Insofta Development—>C:Program FilesInsofta Cover Commanderuninstall.exe C:Program FilesInsofta Cover Commanderuninstall.log
CPU-Z and GPU-Z—>C:Program FilesCPU-ZUninstall.exe
Download Master version 5.5.14.1175—>»C:Program FilesDownload Masterunins000.exe»
Dr.Web Security Space 5.0—>MsiExec.exe /I{E96B3169-86F4-415E-8E87-F0B6251167FB}
DreamSpell v1.2—>C:Program FilesDreamSpell v1.2uninst.exe
Dynamic Energy Saver 1.0 B8.0128.1—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1PROFES~1RunTime11 0Intel32Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{5869CE1E-BC0B-4648-B1AE-6EF4A985590C}setup.exe» -l0x9 -removeonly
Easy DVD Shrink—>C:PROGRA~1EASYDV~1UNWISE.EXE C:PROGRA~1EASYDV~1INSTALL.LOG
Everest—>C:Program FilesEverestUninstall.exe
FastStone Image Viewer 3.5—>»C:Program FilesFSImgViewerunins000.exe»
Flash Player Pro—>C:Program FilesFlash Player ProUninstall.exe
FlylinkDC++ r(292)—>»C:Program FilesFlylinkDC++unins000.exe»
foobar2000 v0.9 beta 4—>»C:Program Filesfoobar2000uninstall.exe»
Foxit Reader—>C:Program FilesFoxit SoftwareFoxit ReaderUninstall.exe
Gigabyte Raid Configurer—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1PROFES~1RunTime11 0Intel32Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{3A1B5D40-41E9-43FA-8C7B-A8667F5586EF}SETUP.EXE» -l0x19 -removeonly
HDD Temperature—>MsiExec.exe /I{4442542F-CFF7-4BEB-9E7C-4316725D674A}
HijackThis 2.0.2—>»C:Program Filestrend microHijackThis.exe» /uninstall
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)—>C:WINDOWSsystem32msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall /qb+ REBOOTPROMPT=»»
ImgBurn—>»C:Program FilesImgBurnuninstall.exe»
Inno Setup, версия 5.2.2—>»C:Program FilesInno Setup 5unins000.exe»
IsoBuster 2.0—>»C:Program FilesIsoBusterUninstunins000.exe»
ISTool 5.2.1.0—>»C:Program FilesISToolunins000.exe»
Java(TM) 6 Update 6—>MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160060}
King’s Bounty: Легенда о Рыцаре—>»e:games1CKing’s Bounty. Легенда о Рыцареunins000.exe»
K-Lite Mega Codec Pack 4.8.5—>»C:Program FilesK-Lite Codec Packunins000.exe»
LANSafety—>»C:Program FilesLANSafetyunins000.exe»
LNetScan 1.0.2340.rc1—>C:PROGRA~1LNetScanUNWISE.EXE C:PROGRA~1LNetScanINSTALL.LOG
Majesty 2 The Fantasy Kingdom Sim—>»e:gamesMajesty 2 The Fantasy Kingdom Simunins000.exe»
Microsoft .NET Framework 1.1 Russian Language Pack—>MsiExec.exe /X{2BB372D9-52B4-410A-BC1A-FEAB63181EEF}
Microsoft .NET Framework 1.1—>msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1—>MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 2.0 Service Pack 2 Language Pack — RUS—>MsiExec.exe /I{736D8DEB-66C6-3655-9D59-DF6493A81F77}
Microsoft .NET Framework 2.0 Service Pack 2—>MsiExec.exe /I{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}
Microsoft .NET Framework 3.0 Service Pack 2 Language Pack — RUS—>MsiExec.exe /I{6CF6A814-CE65-39FC-BBBC-6CB340A4028B}
Microsoft .NET Framework 3.0 Service Pack 2—>MsiExec.exe /I{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}
Microsoft .NET Framework 3.5 Language Pack SP1 — rus—>MsiExec.exe /I{2744791F-4E7C-32F5-AB40-AEC6A6C86DBF}
Microsoft .NET Framework 3.5 SP1—>C:WINDOWSMicrosoft.NETFrameworkv3.5Microsoft .NET Framework 3.5 SP1setup.exe
Microsoft .NET Framework 3.5 SP1—>MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
Microsoft Connection Manager—>C:WINDOWSsystem32cmstp.exe /x C:WINDOWSsystem32instcm.inf
Microsoft Games for Windows — LIVE —>MsiExec.exe /X{4AA3D64E-9EC3-4B0F-AB91-5885AC55641F}
Microsoft Games for Windows — LIVE Redistributable—>MsiExec.exe /X{FD052FB9-FE90-4438-B355-15EDC89D8FB1}
Microsoft Kernel-Mode Driver Framework Feature Pack 1.7—>»C:WINDOWS$NtUninstallWdf01007$spuninstspuninst.exe»
Microsoft Office Excel 2007—>»C:Program FilesCommon FilesMicrosoft SharedOFFICE12Office Setup Controllersetup.exe» /uninstall EXCEL /dll OSETUP.DLL
Microsoft Office Excel 2007—>MsiExec.exe /X{90120000-0016-0000-0000-0000000FF1CE}
Microsoft Office Excel MUI (Russian) 2007—>MsiExec.exe /X{90120000-0016-0419-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007—>MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (German) 2007—>MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE}
Microsoft Office Proof (Russian) 2007—>MsiExec.exe /X{90120000-001F-0419-0000-0000000FF1CE}
Microsoft Office Proof (Ukrainian) 2007—>MsiExec.exe /X{90120000-001F-0422-0000-0000000FF1CE}
Microsoft Office Proofing (Russian) 2007—>MsiExec.exe /X{90120000-002C-0419-0000-0000000FF1CE}
Microsoft Office Shared MUI (Russian) 2007—>MsiExec.exe /X{90120000-006E-0419-0000-0000000FF1CE}
Microsoft Office Word 2007—>»C:Program FilesCommon FilesMicrosoft SharedOFFICE12Office Setup Controllersetup.exe» /uninstall WORD /dll OSETUP.DLL
Microsoft Office Word 2007—>MsiExec.exe /X{90120000-001B-0000-0000-0000000FF1CE}
Microsoft Office Word MUI (Russian) 2007—>MsiExec.exe /X{90120000-001B-0419-0000-0000000FF1CE}
Microsoft User-Mode Driver Framework Feature Pack 1.7—>»C:WINDOWS$NtUninstallWudf01007$spuninstspuninst.exe»
Microsoft Visual C++ 2005 Redistributable—>MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Visual C++ 2005 Redistributable—>MsiExec.exe /X{A49F249F-0C91-497F-86DF-B2585E8E76B7}
Microsoft Windows Media Video 9 VCM—>RunDll32 advpack.dll,LaunchINFSection C:WINDOWSINFwmv9vcm.inf, Uninstall
Mozilla Firefox (3.0.9)—>C:Program FilesMozilla Firefoxuninstallhelper.exe
MSVC80_x86—>MsiExec.exe /I{212748BB-0DA5-46DE-82A1-403736DC9F27}
MSXML 4.0 SP2 (KB936181)—>MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 Parser and SDK—>MsiExec.exe /I{716E0306-8318-4364-8B8F-0CC4E9376BAC}
neroxml—>MsiExec.exe /I{56C049BE-79E9-4502-BEA7-9754A3E60F9B}
Nokia Connectivity Cable Driver—>MsiExec.exe /I{52D02A2B-03D2-4E34-A358-DC5D951FD296}
Nokia Flashing Cable Driver—>MsiExec.exe /X{D99C322D-C21B-40C7-AE71-EE51AA096B6E}
Nokia PC Suite—>C:Documents and SettingsAll UsersApplication DataInstallations{55495E65-7C5B-48E4-BC7D-DE54F3DE5ED6}Nokia_PC_Suite_7_1_30_8_rus.exe
Nokia PC Suite—>MsiExec.exe /I{55495E65-7C5B-48E4-BC7D-DE54F3DE5ED6}
Nokia Software Updater—>MsiExec.exe /X{59367F7E-D7C1-4629-8AEC-71AA24A68F31}
NVIDIA PhysX—>MsiExec.exe /X{B83FC356-B7C0-441F-8A4D-D71E088E7974}
O&O Defrag Professional Edition—>MsiExec.exe /I{53480330-E1D1-41CA-B8F8-7F78644F7F50}
OpenMG Limited Patch 4.7-07-14-05-01—>C:Program FilesCommon FilesSony SharedOpenMGHotFixesHotFix4.7-07-14-05-01HotFixSetupsetup.exe /u
OpenMG Secure Module 4.7.00—>C:PROGRA~1COMMON~1INSTAL~1Driver1150INTEL3~1IDriver.exe /M{CCD663AE-610D-4BDF-AAB0-E914B044527D} UNINSTALL
Opera 9.63—>MsiExec.exe /X{2C0CD17D-0B06-4700-83FA-7344B868B0A2}
Paint.NET v3.31—>rundll32.exe advpack.dll,LaunchINFSection PaintDN.inf,Uninstall
PC Connectivity Solution—>MsiExec.exe /I{0C973594-7DDF-4BD0-84ED-3517F7622037}
Pcsx2 0.9.6—>MsiExec.exe /I{0E2B767B-EA6A-489B-BF83-8083FE1DB661}
PDF Manual NW-E010 Series—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1PROFES~1RunTime10 1Intel32Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{4038EAF0-6F8E-4068-88F6-A417958B8AC5}setup.exe» -l0x19 UNINSTALL -removeonly
Power Data Recovery 4.1.1—>C:Program FilesPower Data RecoveryUninstall.exe
PunkBuster Services—>C:WINDOWSsystem32pbsvc.exe -u
QIP Infium 2.0.9020 RC3—>»C:Program FilesQIPunins000.exe»
QiPSpeller—>»C:Program FilesQIPQiPSpelleruninstall.exe»
REALTEK GbE & FE Ethernet PCI-E NIC Driver—>C:Program FilesInstallShield Installation Information{C9BED750-1211-4480-B1A5-718A3BE15525}SETUP.EXE -runfromtemp -l0x0019 -removeonly
Realtek High Definition Audio Driver—>RtlUpd.exe -r -m -nrg2709
Right Click Image Converter—>C:Program FilesRight Click Image ConverterUninstall.exe
SMSDV v.1.7 (20 марта 2008г.)—>»C:Program FilesSMSDVunins000.exe»
SnagIt 8—>MsiExec.exe /I{DA0BF7AB-88EB-4675-8FA1-531EAD938821}
SonicStage 4.3—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1PROFES~1RunTime10 1Intel32Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{A0EB195B-5876-48E6-879D-33D4B2102610}setup.exe» -l0x9 UNINSTALL -removeonly
Steam—>MsiExec.exe /X{048298C9-A4D3-490B-9FF9-AB023A9238F3}
Sun xVM VirtualBox—>MsiExec.exe /I{9FD06147-BA7E-44F5-B5E8-B4F562A62098}
Teleport Pro—>C:Program FilesTeleport ProUninstall.exe
The Bat! Professional v4.2.10—>MsiExec.exe /I{5E5F4BCA-8064-4A39-83CB-9C086E571535}
The Bat!—>C:Program FilesThe Bat!Uninstall.exe
The KMPlayer (remove only)—>»C:Program FilesThe KMPlayeruninstall.exe»
ToolTipFixer 1.0.1—>C:Program FilesNeoSmart TechnologiesToolTipFixeruninstall.exe
Total Commander (Remove or Repair)—>C:Program Filestotalcmd6tcuninst.exe
Total Commander 7.50a ExtremePack—>»C:Program FilesTotal Commanderuninstall.exe»
TuneUp Utilities 2006—>MsiExec.exe /I{868D7896-99D4-4513-BC62-2B3AD3E24926}
UltraISO Premium (only 32bit) v9.1.2.2465 Rus—>»C:Program FilesUltraISOunins000.exe»
Uninstall Tool 2.3.2—>»C:Program FilesUninstall Toolunins000.exe»
URL-Album—>C:Program FilesURL-Albumurlalbum.exe remove
ViewFD 2.2.3—>»C:Program FilesViewFDUninstall.exe»
Vista Drive Icon—>rundll32.exe advpack.dll,LaunchINFSection C:WINDOWSINFVistaDrv.inf,Uninstall
WinRAR archiver—>C:Program FilesWinRARuninstall.exe
Wolfenstein—>C:Program FilesInstallShield Installation Information{F9B37992-968C-4264-8449-489032FC28DE}setup.exe -runfromtemp -l0x0419
Xfire (remove only)—>»C:Program FilesXfireuninst.exe»
XML Paper Specification Shared Components Language Pack 1.0—>»C:WINDOWS$NtUninstallXPSEPSCLP$spuninstspuninst.exe»
Xvid 1.1.2 final uninstall—>»C:Program FilesXvidunins000.exe»
Герои Меча и Магии 3.5: Во имя Богов—>C:WINDOWSIsUn0419.exe -f»e:gamesГерои Меча и Магии 3.5Uninst.isu»
Обновление безопасности для Windows Internet Explorer 7 (KB938127-v2)—>»C:WINDOWSie7updatesKB938127-v2-IE7spuninstspuninst.exe»
Обновление безопасности для Windows Internet Explorer 7 (KB961260)—>»C:WINDOWSie7updatesKB961260-IE7spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB938464)—>»C:WINDOWS$NtUninstallKB938464$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB950974)—>»C:WINDOWS$NtUninstallKB950974$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB951376-v2)—>»C:WINDOWS$NtUninstallKB951376-v2$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB951748)—>»C:WINDOWS$NtUninstallKB951748$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB952954)—>»C:WINDOWS$NtUninstallKB952954$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB954211)—>»C:WINDOWS$NtUninstallKB954211$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB954459)—>»C:WINDOWS$NtUninstallKB954459$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB954600)—>»C:WINDOWS$NtUninstallKB954600$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB955069)—>»C:WINDOWS$NtUninstallKB955069$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB956802)—>»C:WINDOWS$NtUninstallKB956802$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB956803)—>»C:WINDOWS$NtUninstallKB956803$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB956841)—>»C:WINDOWS$NtUninstallKB956841$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB957097)—>»C:WINDOWS$NtUninstallKB957097$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB958644)—>»C:WINDOWS$NtUninstallKB958644$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB958687)—>»C:WINDOWS$NtUninstallKB958687$spuninstspuninst.exe»
Обновление безопасности для Windows XP (KB960715)—>»C:WINDOWS$NtUninstallKB960715$spuninstspuninst.exe»
Обновление безопасности для проигрывателя Windows Media — (KB952069)—>»C:WINDOWS$NtUninstallKB952069_WM9$spuninstspuninst.exe»
Обновление безопасности для проигрывателя Windows Media 11 — (KB954154)—>»C:WINDOWS$NtUninstallKB954154_WM11$spuninstspuninst.exe»
Обновление для Windows XP (KB955839)—>»C:WINDOWS$NtUninstallKB955839$spuninstspuninst.exe»
Пакет драйверов Windows — Nokia Modem (06/01/2009 4.1)—>C:PROGRA~1DIFX270581355A767BF1dpinst.exe /u C:WINDOWSsystem32DRVSTOREnokia_blue_C08496D7A0050438DFE13C55799AE2D4157A8E7Anokia_bluetooth.inf
Пакет драйверов Windows — Nokia Modem (06/01/2009 7.01.0.3)—>C:PROGRA~1DIFX270581355A767BF1dpinst.exe /u C:WINDOWSsystem32DRVSTOREnokbtmdm_9C48E34C57B7D4AAE5FFF5FB9B476B538394FD30nokbtmdm.inf
Пакет драйверов Windows — Nokia pccsmcfd (08/22/2008 7.0.0.0)—>C:PROGRA~1DIFXB4723E9A0713E5B1dpinst.exe /u C:WINDOWSsystem32DRVSTOREpccsmcfd_A3B3916E5D8138F59EE218321B27B044D3B18294pccsmcfd.inf
Пакет обеспечения совместимости для выпуска 2007 системы Microsoft Office—>MsiExec.exe /X{90120000-0020-0419-0000-0000000FF1CE}
Сократ Персональный 4.1—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1engine6INTEL3~1ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{9CD789E2-B7CE-11D5-B7E9-00A0C9449F99}setup.exe»
Удалить игру—>e:gamesBukaTanksunins000.exe
Хроники Героев: Преисподняя—>C:WINDOWSIsUn0419.exe -f»e:gamesBukaHeroes ChroniclesConquest of the UnderworldHeroes Chronicles Conquest of the Underworld.isu» -c»C:Program FilesCommon Files3DO Shared3DOUnInst.dll
Языковой пакет Microsoft .NET Framework 3.5 SP1 — RUS—>C:WINDOWSMicrosoft.NETFrameworkv3.5Microsoft .NET Framework 3.5 Language Pack SP1 — russetup.exe======Hosts File======
127.255.255.255 serial.alcohol-soft.com
======Security center information======
AV: Doctor Web Anti-Virus
======System event log======
Computer Name: MICROSOF-462A51
Event Code: 7035
Message: Служба «Сервис iPod» успешно отправила управляющий элемент «запустить».Record Number: 21341
Source Name: Service Control Manager
Time Written: 20090219192336.000000+300
Event Type: информация
User: NT AUTHORITYSYSTEMComputer Name: MICROSOF-462A51
Event Code: 7036
Message: Служба «Служба шлюза уровня приложения» перешла в состояние Работает.Record Number: 21340
Source Name: Service Control Manager
Time Written: 20090219192336.000000+300
Event Type: информация
User:Computer Name: MICROSOF-462A51
Event Code: 7035
Message: Служба «Служба шлюза уровня приложения» успешно отправила управляющий элемент «запустить».Record Number: 21339
Source Name: Service Control Manager
Time Written: 20090219192336.000000+300
Event Type: информация
User: NT AUTHORITYSYSTEMComputer Name: MICROSOF-462A51
Event Code: 7036
Message: Служба «Диспетчер подключений удаленного доступа» перешла в состояние Работает.Record Number: 21338
Source Name: Service Control Manager
Time Written: 20090219192336.000000+300
Event Type: информация
User:Computer Name: MICROSOF-462A51
Event Code: 7035
Message: Служба «Диспетчер подключений удаленного доступа» успешно отправила управляющий элемент «запустить».Record Number: 21337
Source Name: Service Control Manager
Time Written: 20090219192336.000000+300
Event Type: информация
User: MICROSOF-462A51Admin=====Application event log=====
Computer Name: MICROSOF-462A51
Event Code: 85
Message: File cache is enabled
Record Number: 9416
Source Name: Dr.Web ® Engine
Time Written: 20091230220835.000000+300
Event Type: информация
User:Computer Name: MICROSOF-462A51
Event Code: 58
Message: File mapping mode is enabled
Record Number: 9415
Source Name: Dr.Web ® Engine
Time Written: 20091230220835.000000+300
Event Type: информация
User:Computer Name: MICROSOF-462A51
Event Code: 61
Message: Dr.Web (R) Engine will use «DeviceHarddiskVolume1WINDOWSTemp» path for temporary files
Record Number: 9414
Source Name: Dr.Web ® Engine
Time Written: 20091230220835.000000+300
Event Type: информация
User:Computer Name: MICROSOF-462A51
Event Code: 125
Message: Spam filter module directory is «C:Program FilesCommon FilesDoctor WebScanning Engine»
Record Number: 9413
Source Name: Dr.Web ® Engine
Time Written: 20091230220835.000000+300
Event Type: информация
User:Computer Name: MICROSOF-462A51
Event Code: 19
Message: Autodetected configuration:6 Dr.Web (R) Engine using 227MB (available 2046MB) will be loaded from «C:Program FilesCommon FilesDoctor WebScanning Engine» (virusbase path is «C:Documents and SettingsAll UsersApplication DataDoctor WebBases»)
Record Number: 9412
Source Name: Dr.Web ® Engine
Time Written: 20091230220835.000000+300
Event Type: информация
User:======Environment variables======
«ComSpec»=%SystemRoot%system32cmd.exe
«Path»=%systemroot%system32;%systemroot%;%systemroot%system32wbem;C:Program FilesPC Connectivity Solution;C:Program FilesATI TechnologiesATI.ACECore-Static;
«windir»=%SystemRoot%
«FP_NO_HOST_CHECK»=NO
«OS»=Windows_NT
«PROCESSOR_ARCHITECTURE»=x86
«PROCESSOR_LEVEL»=6
«PROCESSOR_IDENTIFIER»=x86 Family 6 Model 23 Stepping 6, GenuineIntel
«PROCESSOR_REVISION»=1706
«NUMBER_OF_PROCESSORS»=2
«PATHEXT»=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
«TEMP»=%SystemRoot%TEMP
«TMP»=%SystemRoot%TEMP
EOF
Здравствуйте, добро пожаловать на Spyware-ru форум.
Вижу вы запускали Combofix, запустите ещё раз и получившийся лог вставьте в ваше следующее сообщение.
логи делал не Комбофиксом, а «rsit»
лог через RSIT:
Logfile of random’s system information tool 1.06 (written by random/random)
Run by Admin at 2009-10-26 12:55:30
Microsoft Windows XP Professional Service Pack 3
System drive C: has 2 GB (21%) free of 10 GB
Total RAM: 2046 MB (64% free)Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:55:33, on 26.10.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20978)
Boot mode: NormalRunning processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32Ati2evxx.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSsystem32Ati2evxx.exe
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSExplorer.EXE
C:Program FilesCommon FilesAcronisSchedule2schedul2.exe
C:Program FilesCommon FilesDoctor WebScanning Enginedwengine.exe
C:Program FilesCommon FilesLightScribeLSSrvc.exe
C:WINDOWSsystem32oodag.exe
C:WINDOWSsystem32PnkBstrA.exe
C:PROGRA~1DrWebspidernt.exe
C:Program FilesATI TechnologiesATI HYDRAVISIONHydraDM.exe
C:Program FilesATI TechnologiesATI.ACECore-StaticMOM.EXE
C:WINDOWSsystem32svchost.exe
C:WINDOWSRTHDCPL.EXE
C:Program FilesNeoSmart TechnologiesToolTipFixerToolTipFixer.exe
C:Program FilesDrWebSpIDerAgent.exe
C:Program FilesDrWebspiderml.exe
C:Program FilesATI TechnologiesATI.ACECore-Staticccc.exe
C:Program FilesDrWebspidergate.exe
C:PROGRA~1DrWebspiderui.exe
C:Program FilesCommon FilesAcronisSchedule2schedhlp.exe
C:Program FilesAcronisTrueImageHomeTrueImageMonitor.exe
C:Program FilesAcronisTrueImageHomeTimounterMonitor.exe
C:Program FilesVistaDriveIconVistaDrv.exe
C:Program FilesCD Slow 2.4cdslow.exe
C:Program FilesDAEMON Tools Litedaemon.exe
C:Program FilesNokiaNokia PC Suite 7PCSuite.exe
C:WINDOWSsystem32ctfmon.exe
C:Program FilesTotal CommanderTotalcmd.exe
C:Program FilesuTorrentutorrent.exe
C:Program FilesPC Connectivity SolutionServiceLayer.exe
C:Program FilesPC Connectivity SolutionTransportsNclUSBSrv.exe
C:Program FilesPC Connectivity SolutionTransportsNclRSSrv.exe
C:Program FilesMozilla Firefoxfirefox.exe
E:_ВнешкасофтRSIT.exe
C:Program Filestrend microAdmin.exeR0 — HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.ya.ru/
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 — HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 — HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 — HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings,ProxyOverride = *.local
R0 — HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Ссылки
R3 — URLSearchHook: (no name) — — (no file)
O1 — Hosts: 127.255.255.255 serial.alcohol-soft.com
O2 — BHO: SnagIt Toolbar Loader — {00C6482D-C502-44C8-8409-FCE54AD9C208} — C:Program FilesTechSmithSnagIt 8SnagItBHO.dll
O2 — BHO: SSVHelper Class — {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} — C:Program FilesJavajre1.6.0_06binssv.dll
O2 — BHO: IE 4.x-6.x BHO for Download Master — {9961627E-4059-41B4-8E0E-A7D6B3854ADF} — C:PROGRA~1DOWNLO~1dmiehlp.dll
O3 — Toolbar: SnagIt — {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} — C:Program FilesTechSmithSnagIt 8SnagItIEAddin.dll
O3 — Toolbar: DM Bar — {0E1230F8-EA50-42A9-983C-D22ABC2EED3C} — C:Program FilesDownload Masterdmbar.dll
O4 — HKLM..Run: [StartCCC] «C:Program FilesATI TechnologiesATI.ACECore-StaticCLIStart.exe»
O4 — HKLM..Run: [HydraVisionDesktopManager] C:Program FilesATI TechnologiesATI HYDRAVISIONHydraDM.exe
O4 — HKLM..Run: [RTHDCPL] RTHDCPL.EXE
O4 — HKLM..Run: [SpIDerAgent] «C:Program FilesDrWebSpIDerAgent.exe»
O4 — HKLM..Run: [SpIDerMail] «C:Program FilesDrWebspiderml.exe»
O4 — HKLM..Run: [SpIDerGate] «C:Program FilesDrWebspidergate.exe» -autorun
O4 — HKLM..Run: [SpIDerNT] C:PROGRA~1DrWebspiderui.exe /agent
O4 — HKLM..Run: [Acronis Scheduler2 Service] «C:Program FilesCommon FilesAcronisSchedule2schedhlp.exe»
O4 — HKLM..Run: [TrueImageMonitor.exe] C:Program FilesAcronisTrueImageHomeTrueImageMonitor.exe
O4 — HKLM..Run: [AcronisTimounterMonitor] C:Program FilesAcronisTrueImageHomeTimounterMonitor.exe
O4 — HKLM..Run: [NeroFilterCheck] C:WINDOWSsystem32NeroCheck.exe
O4 — HKCU..Run: [VistaIcon] C:Program FilesVistaDriveIconVistaDrv.exe
O4 — HKCU..Run: [CDSlow] c:Program FilesCD Slow 2.4cdslow.exe
O4 — HKCU..Run: [DAEMON Tools Lite] «C:Program FilesDAEMON Tools Litedaemon.exe» -autorun
O4 — HKCU..Run: [PC Suite Tray] «C:Program FilesNokiaNokia PC Suite 7PCSuite.exe» -onlytray
O4 — HKCU..Run: [ctfmon.exe] C:WINDOWSsystem32ctfmon.exe
O4 — HKUSS-1-5-18..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘SYSTEM’)
O4 — HKUSS-1-5-18..Run: [VistaIcon] C:Program FilesVistaDriveIconVistaDrv.exe (User ‘SYSTEM’)
O4 — HKUSS-1-5-18..RunOnce: [ZZZZ2_FirstLogonSetting] %SystemRoot%System32rundll32.exe advpack.dll,LaunchINFSection C:WINDOWSINFcustom.inf,NewUserFirstLogonInstall,0 (User ‘SYSTEM’)
O4 — HKUS.DEFAULT..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User ‘Default user’)
O4 — HKUS.DEFAULT..RunOnce: [ZZZZ2_FirstLogonSetting] %SystemRoot%System32rundll32.exe advpack.dll,LaunchINFSection C:WINDOWSINFcustom.inf,NewUserFirstLogonInstall,0 (User ‘Default user’)
O4 — S-1-5-18 Startup: µTorrent.lnk = C:Program FilesuTorrentutorrent.exe (User ‘SYSTEM’)
O4 — .DEFAULT Startup: µTorrent.lnk = C:Program FilesuTorrentutorrent.exe (User ‘Default user’)
O4 — Startup: µTorrent.lnk = C:Program FilesuTorrentutorrent.exe
O4 — Global Startup: Total Commander.lnk = C:Program FilesTotal CommanderTotalcmd.exe
O8 — Extra context menu item: &ICQ Toolbar Search — res://C:Program FilesICQToolbartoolbaru.dll/SEARCH.HTML
O8 — Extra context menu item: &Перевести — C:Program FilesArsenal CompanySOCRAT InternetHTMLWSocrat.js
O8 — Extra context menu item: &Экспорт в Microsoft Excel — res://C:PROGRA~1MICROS~1Office12EXCEL.EXE/3000
O8 — Extra context menu item: Download with Rapget — C:rapget140rapget.htm
O8 — Extra context menu item: Добавить страницу в URL-Album — C:Program FilesURL-Albumua.htm
O8 — Extra context menu item: Закачать ВСЕ при помощи Download Master — C:Program FilesDownload Masterdmieall.htm
O8 — Extra context menu item: Закачать при помощи Download Master — C:Program FilesDownload Masterdmie.htm
O8 — Extra context menu item: Передать на удаленную закачку DM — C:Program FilesDownload Masterremdown.htm
O8 — Extra context menu item: Скачать при помощи USDownloader’а — c:USDownloader135Extdownloadie.html
O9 — Extra button: (no name) — DctMapping — (no file)
O9 — Extra button: (no name) — {08B0E5C0-4FCB-11CF-AAA5-00401C608501} — C:Program FilesJavajre1.6.0_06binssv.dll
O9 — Extra ‘Tools’ menuitem: Sun Java Console — {08B0E5C0-4FCB-11CF-AAA5-00401C608501} — C:Program FilesJavajre1.6.0_06binssv.dll
O9 — Extra button: СОКРАТ Интернет 3.0 — {17FA5CD6-5737-45c2-B194-74C8A4A7F7E7} — C:Program FilesArsenal CompanySOCRAT InternetSocratInternet.dll
O9 — Extra button: Настройки СОКРАТ Интернет 3.0 — {71F65890-5ED6-11d4-9665-00E02962D81A} — C:Program FilesArsenal CompanySOCRAT InternetSocratInternetT.dll
O9 — Extra button: Download Master — {8DAE90AD-4583-4977-9DD4-4360F7A45C74} — C:Program FilesDownload Masterdmaster.exe
O9 — Extra ‘Tools’ menuitem: &Download Master — {8DAE90AD-4583-4977-9DD4-4360F7A45C74} — C:Program FilesDownload Masterdmaster.exe
O9 — Extra button: Research — {92780B25-18CC-41C8-B9BE-3C9C571A8263} — C:PROGRA~1MICROS~1Office12REFIEBAR.DLL
O9 — Extra button: ICQ Lite — {B863453A-26C3-4e1f-A54D-A2CD196348E9} — C:Program FilesICQLiteICQLite.exe (file missing)
O9 — Extra ‘Tools’ menuitem: ICQ Lite — {B863453A-26C3-4e1f-A54D-A2CD196348E9} — C:Program FilesICQLiteICQLite.exe (file missing)
O9 — Extra button: Перевести страницу — {DFDC8970-FD66-4385-B8C0-835A4AA1DA00} — C:Program FilesArsenal CompanySOCRAT InternetSocratInternet.dll
O9 — Extra button: (no name) — {e2e2dd38-d088-4134-82b7-f2ba38496583} — C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O9 — Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 — {e2e2dd38-d088-4134-82b7-f2ba38496583} — C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O9 — Extra button: Добавить страницу в URL-Album — {4D9BEE60-F894-11D4-9B21-AD4030B75053} — C:Program FilesURL-Albumua.htm (HKCU)
O9 — Extra button: (no name) — {4D9BEE60-F894-11D4-9B21-AD4030B75054} — C:Program FilesURL-Albumurlalbum.exe (HKCU)
O9 — Extra ‘Tools’ menuitem: Открыть URL-Album — {4D9BEE60-F894-11D4-9B21-AD4030B75054} — C:Program FilesURL-Albumurlalbum.exe (HKCU)
O17 — HKLMSystemCCSServicesTcpip..{600F14BB-6B06-4DE6-86C2-011E5A68679A}: NameServer = 89.189.129.66
O17 — HKLMSystemCCSServicesTcpip..{9A403CC4-D556-4C9A-BEB0-886B954517A3}: NameServer = 89.189.129.66 81.30.199.5
O17 — HKLMSystemCCSServicesTcpip..{9C943852-211E-49E0-9D16-39D1C9737A46}: NameServer = 89.189.129.66 81.30.199.5
O23 — Service: Acronis Scheduler2 Service (AcrSch2Svc) — Acronis — C:Program FilesCommon FilesAcronisSchedule2schedul2.exe
O23 — Service: Adobe LM Service — Unknown owner — C:Program FilesCommon FilesAdobe Systems SharedServiceAdobelmsvc.exe
O23 — Service: Application Driver Auto Removal Service (01) (appdrvrem01) — Protection Technology — C:WINDOWSSystem32appdrvrem01.exe
O23 — Service: Ati HotKey Poller — ATI Technologies Inc. — C:WINDOWSsystem32Ati2evxx.exe
O23 — Service: ATI Smart — Unknown owner — C:WINDOWSsystem32ati2sgag.exe
O23 — Service: Dr.Web ® Scanning Engine (DrWebEngine) (DrWebEngine) — Doctor Web, Ltd. — C:Program FilesCommon FilesDoctor WebScanning Enginedwengine.exe
O23 — Service: Журнал событий (Eventlog) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: GEST Service for program management. (GEST Service) — Unknown owner — C:Program FilesGIGABYTEGESTGSvr.exe
O23 — Service: InstallDriver Table Manager (IDriverT) — Macrovision Corporation — C:Program FilesCommon FilesInstallShieldDriver1150Intel 32IDriverT.exe
O23 — Service: Служба COM записи компакт-дисков IMAPI (ImapiService) — Корпорация Майкрософт — C:WINDOWSsystem32imapi.exe
O23 — Service: LightScribeService Direct Disc Labeling Service (LightScribeService) — Hewlett-Packard Company — C:Program FilesCommon FilesLightScribeLSSrvc.exe
O23 — Service: MSCSPTISRV — Sony Corporation — C:Program FilesCommon FilesSony SharedAVLibMSCSPTISRV.exe
O23 — Service: O&O Defrag — O&O Software GmbH — C:WINDOWSsystem32oodag.exe
O23 — Service: PACSPTISVR — Unknown owner — C:Program FilesCommon FilesSony SharedAVLibPACSPTISVR.exe
O23 — Service: Plug and Play (PlugPlay) — Корпорация Майкрософт — C:WINDOWSsystem32services.exe
O23 — Service: PnkBstrA — Unknown owner — C:WINDOWSsystem32PnkBstrA.exe
O23 — Service: Диспетчер сеанса справки для удаленного рабочего стола (RDSessMgr) — Корпорация Майкрософт — C:WINDOWSsystem32sessmgr.exe
O23 — Service: Смарт-карты (SCardSvr) — Корпорация Майкрософт — C:WINDOWSSystem32SCardSvr.exe
O23 — Service: ServiceLayer — Nokia. — C:Program FilesPC Connectivity SolutionServiceLayer.exe
O23 — Service: FrontLine Drivers Auto Removal (v2) (sfrem02) — Protection Technology (StarForce) — C:WINDOWSsystem32sfrem02.exe
O23 — Service: SonicStage Back-End Service — Sony Corporation — C:Program FilesCommon FilesSony SharedAVLibSsBeSvc.exe
O23 — Service: SpIDer Guard for Windows (SPIDERNT) — Doctor Web, Ltd. — C:PROGRA~1DrWebspidernt.exe
O23 — Service: Sony SPTI Service (SPTISRV) — Sony Corporation — C:Program FilesCommon FilesSony SharedAVLibSPTISRV.exe
O23 — Service: SonicStage SCSI Service (SSScsiSV) — Sony Corporation — C:Program FilesCommon FilesSony SharedAVLibSSScsiSV.exe
O23 — Service: Журналы и оповещения производительности (SysmonLog) — Корпорация Майкрософт — C:WINDOWSsystem32smlogsvc.exe
O23 — Service: NST ToolTipFixer (TTFixerService) — NeoSmart Technologies — C:Program FilesNeoSmart TechnologiesToolTipFixerToolTipFixer.exe
O23 — Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) — TuneUp Software GmbH — C:Program FilesTuneUp Utilities 2006WinStylerThemeSvc.exe
O23 — Service: Теневое копирование тома (VSS) — Корпорация Майкрософт — C:WINDOWSSystem32vssvc.exe
O23 — Service: Адаптер производительности WMI (WmiApSrv) — Корпорация Майкрософт — C:WINDOWSsystem32wbemwmiapsrv.exe—
End of file — 12750 bytes======Scheduled tasks folder======
C:WINDOWStasks1-Click Maintenance.job
======Registry dump======
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{00C6482D-C502-44C8-8409-FCE54AD9C208}]
SnagIt Toolbar Loader — C:Program FilesTechSmithSnagIt 8SnagItBHO.dll [2007-05-01 63048][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class — C:Program FilesJavajre1.6.0_06binssv.dll [2008-03-25 509328][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{9961627E-4059-41B4-8E0E-A7D6B3854ADF}]
IE 4.x-6.x BHO for Download Master — C:PROGRA~1DOWNLO~1dmiehlp.dll [2009-04-16 158208][HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
{8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} — SnagIt — C:Program FilesTechSmithSnagIt 8SnagItIEAddin.dll [2007-05-01 161352]
{0E1230F8-EA50-42A9-983C-D22ABC2EED3C} — DM Bar — C:Program FilesDownload Masterdmbar.dll [2007-11-26 180224][HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun]
«StartCCC»=C:Program FilesATI TechnologiesATI.ACECore-StaticCLIStart.exe [2006-11-10 90112]
«HydraVisionDesktopManager»=C:Program FilesATI TechnologiesATI HYDRAVISIONHydraDM.exe [2003-09-15 270336]
«RTHDCPL»=C:WINDOWSRTHDCPL.EXE [2008-04-10 16861184]
«SpIDerAgent»=C:Program FilesDrWebSpIDerAgent.exe [2008-12-17 697584]
«SpIDerMail»=C:Program FilesDrWebspiderml.exe [2008-12-12 627952]
«SpIDerGate»=C:Program FilesDrWebspidergate.exe [2008-12-15 1402096]
«SpIDerNT»=C:PROGRA~1DrWebspiderui.exe [2008-12-09 197896]
«Acronis Scheduler2 Service»=C:Program FilesCommon FilesAcronisSchedule2schedhlp.exe [2008-11-04 165144]
«TrueImageMonitor.exe»=C:Program FilesAcronisTrueImageHomeTrueImageMonitor.exe [2008-11-04 4382376]
«AcronisTimounterMonitor»=C:Program FilesAcronisTrueImageHomeTimounterMonitor.exe [2008-11-04 962136]
«NeroFilterCheck»=C:WINDOWSsystem32NeroCheck.exe [2001-07-09 155648][HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun]
«VistaIcon»=C:Program FilesVistaDriveIconVistaDrv.exe [2008-01-02 132096]
«CDSlow»=c:Program FilesCD Slow 2.4cdslow.exe [2004-02-27 73728]
«DAEMON Tools Lite»=C:Program FilesDAEMON Tools Litedaemon.exe [2008-12-29 687560]
«PC Suite Tray»=C:Program FilesNokiaNokia PC Suite 7PCSuite.exe [2009-06-12 1414144]
«ctfmon.exe»=C:WINDOWSsystem32ctfmon.exe [2008-06-21 30208][HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregAcronis Scheduler2 Service]
C:Program FilesCommon FilesAcronisSchedule2schedhlp.exe [2008-11-04 165144][HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregAcronis True Image Monitor]
C:Program FilesAcronisTrueImageTrueImageMonitor.exe [][HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregBluetoothAuthenticationAgent]
bthprops.cpl,,BluetoothAuthenticationAgent []C:Documents and SettingsAll UsersГлавное менюПрограммыАвтозагрузка
Total Commander.lnk — C:Program FilesTotal CommanderTotalcmd.exeC:Documents and SettingsAdminГлавное менюПрограммыАвтозагрузка
µTorrent.lnk — C:Program FilesuTorrentutorrent.exe[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifyAtiExtEvent]
C:WINDOWSsystem32Ati2evxx.dll [2007-11-02 122880][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad]
WPDShServiceObj — {AAA288BA-9A4C-45B0-95D7-94D524869DB5} — C:WINDOWSsystem32wpdshserviceobj.dll [2008-03-02 133632][HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootMinimalWdf01000.sys]
[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootnetworkWdf01000.sys]
[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
«dontdisplaylastusername»=0
«legalnoticecaption»=
«legalnoticetext»=
«shutdownwithoutlogon»=1
«undockwithoutlogon»=1
«EnableLUA»=0[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoDriveTypeAutoRun»=323
«NoSharedDocuments»=1
«NoSMConfigurePrograms»=1
«NoInstrumentation»=0
«NoAddPrinter»=1
«NoSMHelp»=1
«NoDriveAutoRun»=67108863
«NoDrives»=0[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoDriveTypeAutoRun»=
«NoDriveAutoRun»=
«NoDrives»=[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicystandardprofileauthorizedapplicationslist]
«%windir%Network Diagnosticxpnetdiag.exe»=»%windir%Network Diagnosticxpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000»
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»
«C:Program FilesuTorrentutorrent.exe»=»C:Program FilesuTorrentutorrent.exe:*:Enabled:µTorrent»
«E:_Localsoftutorrent 1.8.2.14458.exe»=»E:_Localsoftutorrent 1.8.2.14458.exe:*:Enabled:µTorrent»
«C:Program FilesuTorrentLPutorrent_original.exe»=»C:Program FilesuTorrentLPutorrent_original.exe:*:Enabled:µTorrent»
«C:Program FilesuTorrentLPutorrent_noreport.exe»=»C:Program FilesuTorrentLPutorrent_noreport.exe:*:Enabled:µTorrent»
«C:Program FilesuTorrentutorrent_noreport.exe»=»C:Program FilesuTorrentutorrent_noreport.exe:*:Enabled:µTorrent»
«C:Program FilesuTorrentLPutorrent_mult100_leecher.exe»=»C:Program FilesuTorrentLPutorrent_mult100_leecher.exe:*:Enabled:µTorrent»
«C:Program FilesuTorrentutorrent_original.exe»=»C:Program FilesuTorrentutorrent_original.exe:*:Enabled:µTorrent»
«C:Program FilesuTorrentutorrent_mult10_seeder.exe»=»C:Program FilesuTorrentutorrent_mult10_seeder.exe:*:Enabled:µTorrent»
«C:Program FilesuTorrentutorrent_report.exe»=»C:Program FilesuTorrentutorrent_report.exe:*:Enabled:µTorrent»
«C:Program FilesuTorrentLPutorrent_fake2x_seeder.exe»=»C:Program FilesuTorrentLPutorrent_fake2x_seeder.exe:*:Enabled:µTorrent»
«C:WINDOWSsystem32PnkBstrA.exe»=»C:WINDOWSsystem32PnkBstrA.exe:*:Enabled:PnkBstrA»
«C:WINDOWSsystem32PnkBstrB.exe»=»C:WINDOWSsystem32PnkBstrB.exe:*:Enabled:PnkBstrB»
«E:Program FilesActivisionWolfensteinMPWolf2MP.exe»=»E:Program FilesActivisionWolfensteinMPWolf2MP.exe:*:Enabled:Wolfenstein(TM)»
«E:Program FilesActivisionWolfensteinMPWolf2MPLite.exe»=»E:Program FilesActivisionWolfensteinMPWolf2MPLite.exe:*:Enabled:Wolfenstein(TM)»
«C:Program FilesuTorrentLPutorrent_stealth.exe»=»C:Program FilesuTorrentLPutorrent_stealth.exe:*:Enabled:µTorrent»
«E:gamesDragon Age Origins Character Creatorbin_shipDAOCharacterCreator.exe»=»E:gamesDragon Age Origins Character Creatorbin_shipDAOCharacterCreator.exe:*:Enabled:Конструктор персонажей Dragon Age Начало»
«E:gamesDragon Age Origins Character CreatorDAOriginsLauncher.exe»=»E:gamesDragon Age Origins Character CreatorDAOriginsLauncher.exe:*:Enabled:Конструктор персонажей Dragon Age Начало Запуск»[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicydomainprofileauthorizedapplicationslist]
«%windir%Network Diagnosticxpnetdiag.exe»=»%windir%Network Diagnosticxpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000»
«%windir%system32sessmgr.exe»=»%windir%system32sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»======List of files/folders created in the last 1 months======
2009-10-24 21:32:18 —-D—- C:Program FilesCommon FilesBioWare
2009-10-24 20:41:51 —-A—- C:WINDOWSsystem32TwnLib20.dll
2009-10-24 20:41:50 —-N—- C:WINDOWSsystem32ImagXRA7.dll
2009-10-24 20:41:50 —-N—- C:WINDOWSsystem32ImagXR7.dll
2009-10-24 20:41:50 —-N—- C:WINDOWSsystem32ImagXpr7.dll
2009-10-24 20:41:50 —-N—- C:WINDOWSsystem32ImagX7.dll
2009-10-24 20:41:48 —-A—- C:WINDOWSsystem32NeroCheck.exe
2009-10-24 20:41:43 —-D—- C:Program FilesCommon FilesAhead
2009-10-24 20:41:42 —-D—- C:Program FilesAhead
2009-10-24 15:19:06 —-D—- C:Program FilesTotal Commander
2009-10-23 20:37:46 —-D—- C:Program Filestotalcmd6
2009-10-23 20:08:40 —-D—- C:Downloads
2009-10-23 20:04:44 —-D—- C:USDownloader135
2009-10-23 12:45:39 —-D—- C:Program Filestrend micro
2009-10-23 12:45:38 —-D—- C:rsit
2009-10-21 13:14:09 —-D—- C:Program FilesISTool
2009-10-21 13:14:09 —-D—- C:Documents and SettingsAdminApplication DataISTool
2009-10-21 13:01:25 —-D—- C:Program FilesInno Setup 5
2009-10-19 16:22:50 —-SHD—- C:RECYCLER
2009-10-14 21:33:08 —-D—- C:Documents and SettingsAdminApplication DataThe Bat!
2009-10-14 15:28:50 —-D—- C:WINDOWStemp
2009-10-14 15:28:49 —-A—- C:ComboFix.txt
2009-10-14 15:15:00 —-D—- C:WINDOWSERDNT
2009-10-14 15:00:14 —-A—- C:logit.txt
2009-10-11 12:57:15 —-HD—- C:WINDOWSPIF
2009-10-06 17:53:17 —-D—- C:Program Filesmp3Tag 5
2009-10-06 10:54:50 —-A—- C:WINDOWSpro.INI
2009-10-06 10:41:11 —-D—- C:Program FilesTeleport.Backup
2009-10-06 10:36:44 —-D—- C:Program FilesTeleport Pro
2009-10-04 00:04:59 —-A—- C:WINDOWSboxworld.ini
2009-10-01 01:00:00 —-A—- C:WINDOWSsystem32DevCon.exe
2009-09-27 14:09:58 —-D—- C:Program FilesCheMaxRus
2009-09-27 09:39:29 —-SHD—- C:Documents and SettingsAll UsersApplication Data{55A29068-F2CE-456C-9148-C869879E2357}======List of files/folders modified in the last 1 months======
2009-10-26 12:55:30 —-D—- C:Temp
2009-10-26 12:55:05 —-D—- C:Documents and SettingsAdminApplication DatauTorrent
2009-10-26 12:51:48 —-D—- C:Program FilesMozilla Firefox
2009-10-26 12:49:27 —-D—- C:WINDOWSsystem32CatRoot2
2009-10-26 05:07:14 —-A—- C:WINDOWSSchedLgU.Txt
2009-10-25 13:58:21 —-D—- C:WINDOWSsystem32
2009-10-25 13:58:21 —-A—- C:WINDOWSsystem32PerfStringBackup.INI
2009-10-25 13:54:32 —-D—- C:WINDOWS
2009-10-25 08:15:17 —-D—- C:WINDOWSsystem32config
2009-10-24 21:32:18 —-D—- C:Program FilesCommon Files
2009-10-24 21:32:16 —-HD—- C:WINDOWSinf
2009-10-24 21:31:53 —-RSD—- C:WINDOWSassembly
2009-10-24 21:31:30 —-D—- C:WINDOWSsystem32DirectX
2009-10-24 21:31:26 —-SHD—- C:WINDOWSInstaller
2009-10-24 21:31:25 —-D—- C:WINDOWSWinSxS
2009-10-24 20:42:08 —-D—- C:WINDOWSsystem32drivers
2009-10-24 20:41:42 —-RD—- C:Program Files
2009-10-23 20:52:21 —-D—- C:Program FilesQIP
2009-10-23 20:37:50 —-D—- C:Program FilesDrWeb
2009-10-21 13:55:59 —-RSHDC—- C:WINDOWSsystem32dllcache
2009-10-19 16:22:53 —-D—- C:WINDOWSsystem32Restore
2009-10-18 19:53:23 —-D—- C:Program FilesDownload Master
2009-10-14 21:31:47 —-SHD—- C:System Volume Information
2009-10-14 15:26:07 —-A—- C:WINDOWSsystem.ini
2009-10-14 15:22:20 —-D—- C:WINDOWSAppPatch
2009-10-14 14:58:53 —-HD—- C:Program FilesInstallShield Installation Information
2009-10-13 18:33:00 —-D—- C:Program FilesThe Bat!
2009-10-11 21:39:04 —-D—- C:Documents and SettingsAdminApplication DataYandex
2009-10-11 14:35:09 —-D—- C:Documents and SettingsAll UsersApplication DataAdobe
2009-10-11 14:33:28 —-D—- C:Documents and SettingsAdminApplication DataAdobe
2009-10-11 13:01:17 —-D—- C:Program FilesuTorrentLP
2009-10-07 01:51:52 —-D—- C:Documents and SettingsAdminApplication DataDownload Master
2009-10-02 12:46:38 —-A—- C:Documents and SettingsAdminApplication Dataex_log.txt======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R1 appdrv01;Application Driver (01); C:WINDOWSSystem32Driversappdrv01.sys [2009-04-27 3110512]
R1 ASPI32;ASPI32; C:WINDOWSsystem32driversASPI32.sys [1999-09-10 25244]
R1 intelppm;Драйвер Intel процессора; C:WINDOWSsystem32DRIVERSintelppm.sys [2008-04-15 40704]
R1 prodrv05;StarForce Protection Environment Driver v5; C:WINDOWSSystem32driversprodrv05.sys [2002-12-26 53568]
R1 prodrv06;StarForce Protection Environment Driver v6; C:WINDOWSSystem32driversprodrv06.sys [2003-09-06 51744]
R1 VBoxDrv;VirtualBox Service; C:WINDOWSsystem32DRIVERSVBoxDrv.sys [2009-02-16 100560]
R1 VBoxUSBMon;VirtualBox USB Monitor Driver; C:WINDOWSsystem32DRIVERSVBoxUSBMon.sys [2009-02-16 41744]
R1 WS2IFSL;Среда Windows Socket 2.0 поддержки поставщиков не-IFS служб; C:WINDOWSSystem32driversws2ifsl.sys [2008-04-15 12032]
R2 atksgt;atksgt; C:WINDOWSsystem32DRIVERSatksgt.sys [2009-06-07 279712]
R2 ElbyCDIO;ElbyCDIO Driver; C:WINDOWSSystem32DriversElbyCDIO.sys [2005-04-21 10624]
R2 lirsgt;lirsgt; C:WINDOWSsystem32DRIVERSlirsgt.sys [2009-06-07 25888]
R2 rspndr;Ответчик обнаружения топологии уровня связи; C:WINDOWSsystem32DRIVERSrspndr.sys [2008-06-05 62336]
R2 SPIDER;SpIDer Guard File System Monitor; ??C:PROGRA~1DrWebspider.sys []
R2 tifsfilter;Acronis True Image FS Filter; C:WINDOWSsystem32DRIVERStifsfilt.sys [2009-02-21 44704]
R3 ati2mtag;ati2mtag; C:WINDOWSsystem32DRIVERSati2mtag.sys [2007-11-02 2644480]
R3 ElbyCDFL;ElbyCDFL; C:WINDOWSSystem32DriversElbyCDFL.sys [2005-05-03 27392]
R3 FStarForce;FStarForce; C:WINDOWSsystem32DRIVERSFStarForce.sys [2009-04-08 8704]
R3 HDAudBus;Драйвер шины Microsoft UAA для High Definition Audio; C:WINDOWSsystem32DRIVERSHDAudBus.sys [2008-04-15 144384]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:WINDOWSsystem32driversRtkHDAud.sys [2008-04-17 4707328]
R3 RTHDMIAzAudService;Service for HDMI; C:WINDOWSsystem32driversRtHDMI.sys [2007-05-14 3526464]
R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; C:WINDOWSsystem32DRIVERSRtenicxp.sys [2008-01-04 105856]
R3 usbehci;Драйвер минипорта Microsoft USB 2.0 расширенного хост-контроллера; C:WINDOWSsystem32DRIVERSusbehci.sys [2008-06-21 30336]
R3 usbhub;USB2 концентратор; C:WINDOWSsystem32DRIVERSusbhub.sys [2008-06-21 59520]
R3 usbuhci;Драйвер минипорта Microsoft USB универсального хост-контроллера; C:WINDOWSsystem32DRIVERSusbuhci.sys [2008-04-15 20608]
R3 VBoxNetFlt;VBoxNetFlt Service; C:WINDOWSsystem32DRIVERSVBoxNetFlt.sys [2009-02-16 87568]
S3 Arp1394;Протокол клиента 1394 ARP; C:WINDOWSsystem32DRIVERSarp1394.sys [2008-06-21 60800]
S3 atqfrxm3;atqfrxm3; C:WINDOWSsystem32driversatqfrxm3.sys []
S3 aybxmy9k;aybxmy9k; C:WINDOWSsystem32driversaybxmy9k.sys []
S3 BlueletAudio;Bluetooth Audio Service; C:WINDOWSsystem32DRIVERSblueletaudio.sys [2004-10-19 20096]
S3 BT;Bluetooth PAN Network Adapter; C:WINDOWSsystem32DRIVERSbtnetdrv.sys [2004-09-21 10804]
S3 Btcsrusb;Bluetooth USB For Bluetooth Service; C:WINDOWSSystem32Driversbtcusb.sys [2005-01-17 23000]
S3 BthEnum;Драйвер блока запроса Bluetooth; C:WINDOWSsystem32DRIVERSBthEnum.sys [2008-06-21 17024]
S3 BTHidEnum;Bluetooth HID Enumerator; C:WINDOWSsystem32DRIVERSvbtenum.sys [2005-01-13 12500]
S3 BthPan;Bluetooth Device (Personal Area Network); C:WINDOWSsystem32DRIVERSbthpan.sys [2008-06-21 101120]
S3 BTHPORT;Драйвер порта Bluetooth; C:WINDOWSSystem32DriversBTHport.sys [2008-06-14 272512]
S3 BTHUSB;Драйвер порта USB радиомодуля Bluetooth; C:WINDOWSSystem32DriversBTHUSB.sys [2008-06-21 18944]
S3 BTNetFilter;Bluetooth Network Filter; ??C:WINDOWSsystem32driversBTNetFilter.sys []
S3 catchme;catchme; ??C:ComboFixcatchme.sys []
S3 CCDECODE;Closed Caption декодер; C:WINDOWSsystem32DRIVERSCCDECODE.sys [2004-07-09 16384]
S3 ET5Drv;ET5Drv; ??C:WINDOWSsystem32DriversET5Drv.sys []
S3 gdrv;gdrv; ??C:WINDOWSgdrv.sys []
S3 HdAudAddService;ATI Function Driver for High Definition Audio Service; C:WINDOWSsystem32driversAtiHdAud.sys [2006-12-28 84992]
S3 ltmodem5;Agere Modem Driver; C:WINDOWSsystem32DRIVERSltmdmnt.sys [2003-07-01 652497]
S3 MODEMCSA;Устройство фильтрации потока Unimodem; C:WINDOWSsystem32driversMODEMCSA.sys [2008-06-21 16128]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:WINDOWSsystem32driversMSTEE.sys [2002-12-12 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:WINDOWSsystem32DRIVERSNABTSFEC.sys [2004-07-09 83968]
S3 NdisIP;Microsoft TV/Video Connection; C:WINDOWSsystem32DRIVERSNdisIP.sys [2004-07-09 10112]
S3 NIC1394;Сетевой драйвер 1394; C:WINDOWSsystem32DRIVERSnic1394.sys [2008-06-21 61824]
S3 nmwcd;Nokia USB Phone Parent; C:WINDOWSsystem32driversccdcmb.sys [2009-02-09 17664]
S3 nmwcdc;Nokia USB Generic; C:WINDOWSsystem32driversccdcmbo.sys [2009-02-09 22016]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:WINDOWSsystem32DRIVERSpccsmcfd.sys [2008-08-26 18816]
S3 RFCOMM;Устройство Bluetooth (протокол RFCOMM TDI); C:WINDOWSsystem32DRIVERSrfcomm.sys [2008-06-21 59136]
S3 ROOTMODEM;Microsoft Legacy Modem Driver; C:WINDOWSSystem32DriversRootMdm.sys [2008-04-15 5888]
S3 SLIP;BDA Slip De-Framer; C:WINDOWSsystem32DRIVERSSLIP.sys [2004-07-09 10880]
S3 streamip;BDA IPSink; C:WINDOWSsystem32DRIVERSStreamIP.sys [2004-07-09 14976]
S3 upperdev;upperdev; C:WINDOWSsystem32DRIVERSusbser_lowerflt.sys [2009-02-09 7808]
S3 usbccgp;Драйвер универсального родительского устройства USB (Microsoft); C:WINDOWSsystem32DRIVERSusbccgp.sys [2008-06-21 32384]
S3 usbscan;Драйвер USB-сканера; C:WINDOWSsystem32DRIVERSusbscan.sys [2008-06-21 15104]
S3 usbser;USB Modem Driver; C:WINDOWSsystem32driversusbser.sys [2008-06-21 26112]
S3 UsbserFilt;UsbserFilt; C:WINDOWSsystem32DRIVERSusbser_lowerfltj.sys [2009-02-09 7808]
S3 USBSTOR;Драйвер запоминающих устройств для USB; C:WINDOWSsystem32DRIVERSUSBSTOR.SYS [2008-06-21 26368]
S3 usbvideo;USB-видеоустройство (WDM); C:WINDOWSSystem32Driversusbvideo.sys [2008-06-21 121984]
S3 VComm;Virtual Serial port driver; C:WINDOWSsystem32DRIVERSVComm.sys [2004-10-19 61312]
S3 VcommMgr;Bluetooth VComm Manager Service; C:WINDOWSSystem32DriversVcommMgr.sys [2004-11-05 82148]
S3 Wdf01000;Kernel Mode Driver Frameworks service; C:WINDOWSSystem32Driverswdf01000.sys [2008-03-27 503008]
S3 WSTCODEC;World Standard Teletext Codec; C:WINDOWSsystem32DRIVERSWSTCODEC.SYS [2004-07-09 18688]
S3 WudfRd;Windows Driver Foundation — User-mode Driver Framework Reflector; C:WINDOWSsystem32DRIVERSwudfrd.sys [2008-01-18 83328]
S4 dwshd;dwshd; C:WINDOWSSystem32driversdwshd.sys []
S4 IntelIde;IntelIde; C:WINDOWSsystem32driversIntelIde.sys []======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 AcrSch2Svc;Acronis Scheduler2 Service; C:Program FilesCommon FilesAcronisSchedule2schedul2.exe [2008-11-04 554264]
R2 Ati HotKey Poller;Ati HotKey Poller; C:WINDOWSsystem32Ati2evxx.exe [2007-11-02 495616]
R2 BthServ;Bluetooth Support Service; C:WINDOWSsystem32svchost.exe [2008-04-15 14336]
R2 DrWebEngine;Dr.Web ® Scanning Engine (DrWebEngine); C:Program FilesCommon FilesDoctor WebScanning Enginedwengine.exe [2008-10-17 869688]
R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:Program FilesCommon FilesLightScribeLSSrvc.exe [2007-08-23 79136]
R2 O&O Defrag;O&O Defrag; C:WINDOWSsystem32oodag.exe [2007-05-11 1050120]
R2 PnkBstrA;PnkBstrA; C:WINDOWSsystem32PnkBstrA.exe [2009-08-20 75064]
R2 SPIDERNT;SpIDer Guard for Windows; C:PROGRA~1DrWebspidernt.exe [2008-12-09 197896]
R2 TTFixerService;NST ToolTipFixer; C:Program FilesNeoSmart TechnologiesToolTipFixerToolTipFixer.exe [2007-06-27 10240]
R2 WudfSvc;Windows Driver Foundation — User-mode Driver Framework; C:WINDOWSsystem32svchost.exe [2008-04-15 14336]
R3 ServiceLayer;ServiceLayer; C:Program FilesPC Connectivity SolutionServiceLayer.exe [2009-06-02 637952]
S2 appdrvrem01;Application Driver Auto Removal Service (01); C:WINDOWSSystem32appdrvrem01.exe [2009-04-27 316816]
S2 ATI Smart;ATI Smart; C:WINDOWSsystem32ati2sgag.exe [2007-11-01 593920]
S2 sfrem02;FrontLine Drivers Auto Removal (v2); C:WINDOWSsystem32sfrem02.exe [2006-05-11 358008]
S3 Adobe LM Service;Adobe LM Service; C:Program FilesCommon FilesAdobe Systems SharedServiceAdobelmsvc.exe [2009-06-08 68096]
S3 aspnet_state;Служба состояний ASP.NET; C:WINDOWSMicrosoft.NETFrameworkv2.0.50727aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:WINDOWSMicrosoft.NETFrameworkv2.0.50727mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:WINDOWSMicrosoft.NETFrameworkv3.0WPFPresentationFontCache.exe [2008-07-29 46104]
S3 GEST Service;GEST Service for program management.; C:Program FilesGIGABYTEGESTGSvr.exe [2007-12-14 47624]
S3 IDriverT;InstallDriver Table Manager; C:Program FilesCommon FilesInstallShieldDriver1150Intel 32IDriverT.exe [2005-11-14 69632]
S3 idsvc;Windows CardSpace; C:WINDOWSMicrosoft.NETFrameworkv3.0Windows Communication Foundationinfocard.exe [2008-07-29 881664]
S3 MSCSPTISRV;MSCSPTISRV; C:Program FilesCommon FilesSony SharedAVLibMSCSPTISRV.exe [2006-12-14 45056]
S3 odserv;Microsoft Office Diagnostics Service; C:Program FilesCommon FilesMicrosoft SharedOFFICE12ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:Program FilesCommon FilesMicrosoft SharedSource EngineOSE.EXE [2006-10-26 145184]
S3 PACSPTISVR;PACSPTISVR; C:Program FilesCommon FilesSony SharedAVLibPACSPTISVR.exe [2006-12-14 57344]
S3 SonicStage Back-End Service;SonicStage Back-End Service; C:Program FilesCommon FilesSony SharedAVLibSsBeSvc.exe [2007-02-05 112184]
S3 SPTISRV;Sony SPTI Service; C:Program FilesCommon FilesSony SharedAVLibSPTISRV.exe [2006-12-14 69632]
S3 SSScsiSV;SonicStage SCSI Service; C:Program FilesCommon FilesSony SharedAVLibSSScsiSV.exe [2007-02-05 75320]
S3 TUWinStylerThemeSvc;TuneUp WinStyler Theme Service; C:Program FilesTuneUp Utilities 2006WinStylerThemeSvc.exe [2005-08-10 118272]
S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:Program FilesWindows Media Playerwmpnetwk.exe [2006-10-18 913408]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:WINDOWSMicrosoft.NETFrameworkv3.0Windows Communication FoundationSMSvcHost.exe [2008-07-29 132096]
EOF
или комбофиксом сделать?а вот и скрипт Сомбофикса
ComboFix 09-10-25.02 — Admin 26.10.2009 13:01.2.2 — NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1251.7.1049.18.2046.1238 [GMT 5:00]
Running from: e:_внешкасофтComboFix.exe
AV: Doctor Web Anti-Virus *On-access scanning enabled* (Updated) {3454C8F1-ECBC-4180-A6F4-04632FBA762B}
* Created a new restore point
* Resident AV is activeWARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.c:tempWLZC4CB.tmpburnlib.lng
c:tempWLZC4CB.tmpdsp_sps.lng
c:tempWLZC4CB.tmpenc_aacplus.lng
c:tempWLZC4CB.tmpenc_flac.lng
c:tempWLZC4CB.tmpenc_lame.lng
c:tempWLZC4CB.tmpenc_vorbis.lng
c:tempWLZC4CB.tmpenc_wav.lng
c:tempWLZC4CB.tmpenc_wma.lng
c:tempWLZC4CB.tmpgen_crasher.lng
c:tempWLZC4CB.tmpgen_ff.lng
c:tempWLZC4CB.tmpgen_hotkeys.lng
c:tempWLZC4CB.tmpgen_ml.lng
c:tempWLZC4CB.tmpgen_tray.lng
c:tempWLZC4CB.tmpin_cdda.lng
c:tempWLZC4CB.tmpin_dshow.lng
c:tempWLZC4CB.tmpin_flac.lng
c:tempWLZC4CB.tmpin_linein.lng
c:tempWLZC4CB.tmpin_midi.lng
c:tempWLZC4CB.tmpin_mod.lng
c:tempWLZC4CB.tmpin_mp3.lng
c:tempWLZC4CB.tmpin_mp4.lng
c:tempWLZC4CB.tmpin_nsv.lng
c:tempWLZC4CB.tmpin_vorbis.lng
c:tempWLZC4CB.tmpin_wave.lng
c:tempWLZC4CB.tmpin_wm.lng
c:tempWLZC4CB.tmpml_autotag.lng
c:tempWLZC4CB.tmpml_bookmarks.lng
c:tempWLZC4CB.tmpml_dash.lng
c:tempWLZC4CB.tmpml_disc.lng
c:tempWLZC4CB.tmpml_history.lng
c:tempWLZC4CB.tmpml_local.lng
c:tempWLZC4CB.tmpml_nowplaying.lng
c:tempWLZC4CB.tmpml_online.lng
c:tempWLZC4CB.tmpml_orb.lng
c:tempWLZC4CB.tmpml_playlists.lng
c:tempWLZC4CB.tmpml_plg.lng
c:tempWLZC4CB.tmpml_pmp.lng
c:tempWLZC4CB.tmpml_rg.lng
c:tempWLZC4CB.tmpml_transcode.lng
c:tempWLZC4CB.tmpml_wire.lng
c:tempWLZC4CB.tmpout_disk.lng
c:tempWLZC4CB.tmpout_ds.lng
c:tempWLZC4CB.tmpout_wave.lng
c:tempWLZC4CB.tmpplaylist.lng
c:tempWLZC4CB.tmppmp_activesync.lng
c:tempWLZC4CB.tmppmp_ipod.lng
c:tempWLZC4CB.tmppmp_njb.lng
c:tempWLZC4CB.tmppmp_p4s.lng
c:tempWLZC4CB.tmppmp_usb.lng
c:tempWLZC4CB.tmptagz.lng
c:tempWLZC4CB.tmpvis_avs.lng
c:tempWLZC4CB.tmpvis_avs_282.lng
c:tempWLZC4CB.tmpvis_milk.lng
c:tempWLZC4CB.tmpvis_milk2.lng
c:tempWLZC4CB.tmpvis_nsfs.lng
c:tempWLZC4CB.tmpwinamp.lng
d:њ®ё ¤®єг¬ґвлcc_20080708_2211.reg.
((((((((((((((((((((((((( Files Created from 2009-09-26 to 2009-10-26 )))))))))))))))))))))))))))))))
.2009-10-26 07:58 . 2009-10-26 08:05
d
w- c:tempWLZC4CB.tmp
2009-10-24 16:32 . 2009-10-24 16:32
d
w- c:program filesCommon FilesBioWare
2009-10-24 15:42 . 2004-03-02 11:37 125184
w- c:windowssystem32driversimagesrv.sys
2009-10-24 15:42 . 2004-03-02 11:37 5504
w- c:windowssystem32driversimagedrv.sys
2009-10-24 15:41 . 2000-06-26 05:45 106496 —-a-w- c:windowssystem32TwnLib20.dll
2009-10-24 15:41 . 2004-07-26 11:16 476320
w- c:windowssystem32ImagXpr7.dll
2009-10-24 15:41 . 2004-07-26 11:16 471040
w- c:windowssystem32ImagXRA7.dll
2009-10-24 15:41 . 2004-07-26 11:16 262144
w- c:windowssystem32ImagXR7.dll
2009-10-24 15:41 . 2004-07-26 11:16 1568768
w- c:windowssystem32ImagX7.dll
2009-10-24 15:41 . 2001-07-09 05:50 155648 —-a-w- c:windowssystem32NeroCheck.exe
2009-10-24 15:41 . 2009-10-24 15:41
d
w- c:program filesCommon FilesAhead
2009-10-24 15:41 . 2009-10-24 15:41
d
w- c:program filesAhead
2009-10-24 15:39 . 2009-10-24 15:39
d
w- c:tempapp_7EDA7873_temp
2009-10-24 15:33 . 2009-10-24 15:33
d
w- c:tempapp_20CC6F70_temp
2009-10-24 10:19 . 2009-10-24 10:26
d
w- c:program filesTotal Commander
2009-10-24 07:56 . 2009-10-26 08:04
d—h—w- c:tempNGLATempNokia
2009-10-23 15:37 . 2009-10-23 15:38
d
w- c:program filestotalcmd6
2009-10-23 15:08 . 2009-10-25 09:29
d
w- C:Downloads
2009-10-23 15:04 . 2009-10-24 11:26
d
w- C:USDownloader135
2009-10-23 07:45 . 2009-10-26 07:55
d
w- c:program filestrend micro
2009-10-23 07:45 . 2009-10-23 07:45
d
w- C:rsit
2009-10-21 08:14 . 2009-10-21 08:14
d
w- c:program filesISTool
2009-10-21 08:14 . 2009-10-21 08:14
d
w- c:documents and settingsAdminApplication DataISTool
2009-10-21 08:01 . 2009-10-21 08:01
d
w- c:program filesInno Setup 5
2009-10-14 16:33 . 2009-10-26 07:28
d
w- c:documents and settingsAdminApplication DataThe Bat!
2009-10-11 07:57 . 2009-10-11 07:57
d—h—w- c:windowsPIF
2009-10-06 12:53 . 2009-10-11 07:59
d
w- c:program filesmp3Tag 5
2009-10-06 05:41 . 2009-10-06 05:41
d
w- c:program filesTeleport.Backup
2009-10-06 05:36 . 2009-10-06 05:55
d
w- c:program filesTeleport Pro
2009-09-30 20:00 . 2009-09-30 20:00 55808 —-a-w- c:windowssystem32DevCon.exe
2009-09-30 20:00 . 2009-09-30 20:00 545 —-a-w- c:windowsUC.PIF
2009-09-30 20:00 . 2009-09-30 20:00 545 —-a-w- c:windowsRAR.PIF
2009-09-30 20:00 . 2009-09-30 20:00 545 —-a-w- c:windowsPKZIP.PIF
2009-09-30 20:00 . 2009-09-30 20:00 545 —-a-w- c:windowsPKUNZIP.PIF
2009-09-30 20:00 . 2009-09-30 20:00 545 —-a-w- c:windowsLHA.PIF
2009-09-30 20:00 . 2009-09-30 20:00 545 —-a-w- c:windowsARJ.PIF
2009-09-30 20:00 . 2009-09-30 20:00 24576 —-a-w- c:windowsNOCLOSE.PIF
2009-09-27 09:11 . 2009-09-27 09:11
d
w- c:documents and settingsAdminLocal SettingsApplication DataYandex
2009-09-27 09:09 . 2009-09-27 09:10
d
w- c:program filesCheMaxRus
2009-09-27 04:39 . 2009-09-27 04:39
d-sh—w- c:documents and settingsAll UsersApplication Data{55A29068-F2CE-456C-9148-C869879E2357}.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-26 08:05 . 2008-07-09 06:18
d
w- c:documents and settingsAdminApplication DatauTorrent
2009-10-26 08:01 . 2008-07-08 19:52
d
w- c:program filesDrWeb
2009-10-25 08:58 . 2008-04-15 12:00 84284 —-a-w- c:windowssystem32perfc019.dat
2009-10-25 08:58 . 2008-04-15 12:00 484670 —-a-w- c:windowssystem32perfh019.dat
2009-10-23 15:52 . 2008-07-08 16:35
d
w- c:program filesQIP
2009-10-23 14:20 . 2008-12-07 09:06
d
w- c:documents and settingsAdminApplication DataThinstall
2009-10-18 14:53 . 2008-07-09 06:15
d
w- c:program filesDownload Master
2009-10-14 09:58 . 2008-07-08 16:34
d—h—w- c:program filesInstallShield Installation Information
2009-10-13 13:33 . 2008-07-08 16:35
d
w- c:program filesThe Bat!
2009-10-11 16:39 . 2009-01-08 18:45
d
w- c:documents and settingsAdminApplication DataYandex
2009-10-11 08:01 . 2009-02-27 05:48
d
w- c:program filesuTorrentLP
2009-10-06 20:51 . 2008-07-09 06:15
d
w- c:documents and settingsAdminApplication DataDownload Master
2009-09-26 04:02 . 2008-12-07 09:09
d
w- c:documents and settingsAdminApplication DataAshampoo
2009-09-26 04:01 . 2009-09-26 04:01
d
w- c:documents and settingsAll UsersApplication Dataashampoo
2009-09-26 04:01 . 2009-09-26 04:01
d
w- c:program filesAshampoo
2009-09-22 16:21 . 2008-07-08 16:31
d
w- c:documents and settingsAll UsersApplication DataMicrosoft Help
2009-09-22 15:57 . 2008-07-12 06:23
d
w- c:documents and settingsAll UsersApplication DataNero
2009-09-17 12:47 . 2008-07-08 16:35
d
w- c:program filesCommon FilesWise Installation Wizard
2009-09-17 12:47 . 2008-07-11 09:42
d
w- c:program filesAGEIA Technologies
2009-09-17 02:12 . 2009-09-16 12:01
d
w- c:program filesUnlocker
2009-09-08 13:25 . 2008-07-08 16:38
d
w- c:program filesuTorrent
2009-09-08 13:25 . 2008-07-09 11:13
d
w- c:program filesMPEG Audio Collection
2009-09-08 13:25 . 2008-07-08 16:35
d
w- c:program filesSMSDV
2009-09-08 13:25 . 2009-03-11 17:23
d
w- c:program filesDreamSpell v1.2
2009-09-08 13:25 . 2009-02-10 13:42
d
w- c:program filesDCPRO
2009-09-08 13:25 . 2009-01-11 08:57
d
w- c:program filesfoobar2000
2009-08-30 13:10 . 2009-06-20 11:43
d
w- c:documents and settingsAdminApplication DataImgBurn
2009-08-20 16:50 . 2009-03-14 10:08 139152 —-a-w- c:documents and settingsAdminApplication DataPnkBstrK.sys
2009-08-20 16:50 . 2008-07-17 15:25 139152 —-a-w- c:windowssystem32driversPnkBstrK.sys
2009-08-20 16:49 . 2008-07-17 15:17 111928 —-a-w- c:windowssystem32PnkBstrB.exe
2009-08-20 16:49 . 2009-03-14 10:06 794408 —-a-w- c:windowssystem32pbsvc.exe
2009-08-20 16:49 . 2008-07-17 15:26 75064 —-a-w- c:windowssystem32PnkBstrA.exe
2009-08-10 13:30 . 2008-07-08 17:00 16608 —-a-w- c:windowsgdrv.sys
2009-04-07 06:43 . 2009-02-16 13:35 3260924 —-a-w- c:program filesuTorrent.rar
2009-03-24 18:54 . 2009-04-24 10:59 7977536 —-a-w- c:program filesFlylinkDC++378.rar
2009-03-24 18:43 . 2009-04-24 10:59 4656586 —-a-w- c:program filesFlylinkDC++.rar
2009-02-28 09:48 . 2009-02-28 09:48 216418 —-a-w- c:program filesD-Tools v3.40.rar
2009-02-17 09:54 . 2008-07-31 13:01 9220395 —-a-w- c:program filesTotal Commander.rar
2009-02-16 13:35 . 2009-02-16 13:35 584413 —-a-w- c:program filesuTorrent(Local).rar
2008-12-12 12:56 . 2008-12-12 12:56 1728549 —-a-w- c:program filesQIP.rar
2008-07-31 13:00 . 2008-07-31 13:00 4250229 —-a-w- c:program filesDownload Master.rar
2008-07-11 15:02 . 2008-07-11 15:02 23075353 —-a-w- c:program filestotalcmd6.rar
.
Sigcheck
[-] 2009-02-14 . 456E0F5B9BEB184521B0EE8FA7CC92C7 . 361600 . . [5.1.2600.5625] . . c:windowssystem32driverstcpip.sys
[-] 2008-06-21 . 030DC4D48CC2B894FEE2F390D8E66AD5 . 361344 . . [5.1.2600.5512] . . c:windows$NtUninstallKB951748$tcpip.sys
[7] 2008-06-20 . AD978A1B783B5719720CFF204B666C8E . 361600 . . [5.1.2600.5625] . . c:windows$hf_mig$KB951748SP3QFEtcpip.sys
[7] 2008-06-20 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . c:windowssystem32dllcachetcpip.sys[-] 2008-06-21 . D1E6FF38AD08A56D55A422D3D08DF22D . 80728 . . [7.1.6001.65] . . c:windowssystem32wuauclt.exe
[-] 2008-06-21 . 23B7D3F3F5EC8FEEA75EC381C71CBD5E . 579072 . . [5.1.2600.5512] . . c:windowssystem32user32.dll
[-] 2008-06-21 . DBE9BB4018832ED71BC288B2A38F225B . 1721344 . . [6.00.2900.5512] . . c:windowsexplorer.exe
[-] 2008-06-21 . 8A76B647BF35E4C8230F69FAADABD977 . 1571840 . . [5.1.2600.5512] . . c:windowssystem32sfcfiles.dll
[-] 2008-06-21 . 53DB04AA692F9E906E46127AB7E83252 . 30208 . . [5.1.2600.5512] . . c:windowssystem32ctfmon.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
«VistaIcon»=»c:program filesVistaDriveIconVistaDrv.exe» [2008-01-02 132096]
«CDSlow»=»c:program filesCD Slow 2.4cdslow.exe» [2004-02-26 73728]
«DAEMON Tools Lite»=»c:program filesDAEMON Tools Litedaemon.exe» [2008-12-29 687560]
«PC Suite Tray»=»c:program filesNokiaNokia PC Suite 7PCSuite.exe» [2009-06-12 1414144][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
«StartCCC»=»c:program filesATI TechnologiesATI.ACECore-StaticCLIStart.exe» [2006-11-10 90112]
«HydraVisionDesktopManager»=»c:program filesATI TechnologiesATI HYDRAVISIONHydraDM.exe» [2003-09-15 270336]
«SpIDerAgent»=»c:program filesDrWebSpIDerAgent.exe» [2008-12-17 697584]
«SpIDerMail»=»c:program filesDrWebspiderml.exe» [2008-12-12 627952]
«SpIDerGate»=»c:program filesDrWebspidergate.exe» [2008-12-15 1402096]
«SpIDerNT»=»c:progra~1DrWebspiderui.exe» [2008-12-09 197896]
«Acronis Scheduler2 Service»=»c:program filesCommon FilesAcronisSchedule2schedhlp.exe» [2008-11-04 165144]
«TrueImageMonitor.exe»=»c:program filesAcronisTrueImageHomeTrueImageMonitor.exe» [2008-11-04 4382376]
«AcronisTimounterMonitor»=»c:program filesAcronisTrueImageHomeTimounterMonitor.exe» [2008-11-04 962136]
«NeroFilterCheck»=»c:windowssystem32NeroCheck.exe» [2001-07-09 155648]
«RTHDCPL»=»RTHDCPL.EXE» — c:windowsRTHDCPL.EXE [2008-04-10 16861184][HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
«CTFMON.EXE»=»c:windowssystem32CTFMON.EXE» [2008-06-21 30208]
«VistaIcon»=»c:program filesVistaDriveIconVistaDrv.exe» [2008-01-02 132096][HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRunOnce]
«IE7_011″=»shell32» [X]
«ZZZZ2_FirstLogonSetting»=»advpack.dll» — c:windowssystem32advpack.dll [2008-12-20 124928]
«IE7_012″=»advpack.dll» — c:windowssystem32advpack.dll [2008-12-20 124928]c:documents and settingsAdminѓ« ў®Ґ ¬ҐоЏа®Ја ¬¬лЂўв®§ Јаг§Є
зTorrent.lnk — c:program filesuTorrentutorrent.exe [2008-1-27 270128]c:documents and settingsAdminѓ« ў®Ґ ¬ҐоЏа®Ја ¬¬лЂўв®§ Јаг§Є
зTorrent.lnk — c:program filesuTorrentutorrent.exe [2008-1-27 270128]c:documents and settingsAdminѓ« ў®Ґ ¬ҐоЏа®Ја ¬¬лЂўв®§ Јаг§Є
зTorrent.lnk — c:program filesuTorrentutorrent.exe [2008-1-27 270128]c:documents and settingsAll Usersѓ« ў®Ґ ¬ҐоЏа®Ја ¬¬лЂўв®§ Јаг§Є
Total Commander.lnk — c:program filesTotal CommanderTotalcmd.exe [2009-10-1 3520256]c:documents and settingsAdminѓ« ў®Ґ ¬ҐоЏа®Ја ¬¬лЂўв®§ Јаг§Є
зTorrent.lnk — c:program filesuTorrentutorrent.exe [2008-1-27 270128][HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoSMConfigurePrograms»= 1 (0x1)
«NoAddPrinter»= 1 (0x1)
«NoSMHelp»= 1 (0x1)[HKEY_USERS.defaultsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]
«NoSMConfigurePrograms»= 1 (0x1)[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetcontrolsession manager]
BootExecute REG_MULTI_SZ autocheck autochk *OODBS[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootMinimalWdf01000.sys]
@=»Driver»[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionrun-]
«KillCopy»=c:program filesKillSoftKillCopykcresume.exe /startup[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity center]
«FirewallOverride»=dword:00000001
«UpdatesOverride»=dword:00000001
«AntiVirusOverride»=dword:00000001[HKLM~servicessharedaccessparametersfirewallpolicystandardprofile]
«EnableFirewall»= 0 (0x0)[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
«%windir%\Network Diagnostic\xpnetdiag.exe»=
«%windir%\system32\sessmgr.exe»=
«c:\Program Files\uTorrent\utorrent.exe»=
«e:\_Local\soft\utorrent 1.8.2.14458.exe»=
«c:\Program Files\uTorrentLP\utorrent_original.exe»=
«c:\Program Files\uTorrentLP\utorrent_noreport.exe»=
«c:\Program Files\uTorrent\utorrent_noreport.exe»=
«c:\Program Files\uTorrentLP\utorrent_mult100_leecher.exe»=
«c:\Program Files\uTorrent\utorrent_original.exe»=
«c:\Program Files\uTorrent\utorrent_mult10_seeder.exe»=
«c:\Program Files\uTorrent\utorrent_report.exe»=
«c:\Program Files\uTorrentLP\utorrent_fake2x_seeder.exe»=
«c:\WINDOWS\system32\PnkBstrA.exe»=
«c:\WINDOWS\system32\PnkBstrB.exe»=
«e:\Program Files\Activision\Wolfenstein\MP\Wolf2MP.exe»=
«e:\Program Files\Activision\Wolfenstein\MP\Wolf2MPLite.exe»=
«c:\Program Files\uTorrentLP\utorrent_stealth.exe»=
«e:\games\Dragon Age Origins Character Creator\bin_ship\DAOCharacterCreator.exe»=
«e:\games\Dragon Age Origins Character Creator\DAOriginsLauncher.exe»=[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileGloballyOpenPortsList]
«26060:TCP»= 26060:TCP:BitComet 26060 TCP
«26060:UDP»= 26060:UDP:BitComet 26060 UDPR0 DwProt;DrWeb Protection;c:windowssystem32driversdwprot.sys [10.01.2009 19:15 98168]
R0 prohlp01;StarForce Protection Helper Driver v1;c:windowssystem32driversprohlp01.sys [26.12.2002 19:20 61728]
R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);c:windowssystem32driverssfsync03.sys [06.12.2005 20:11 35328]
R0 snapman380;Acronis Snapshots Manager (Build 380);c:windowssystem32driverssnman380.sys [21.02.2009 2:09 134272]
R0 tdrpman147;Acronis Try&Decide and Restore Points filter (build 147);c:windowssystem32driverstdrpm147.sys [21.02.2009 2:09 971232]
R1 appdrv01;Application Driver (01);c:windowssystem32driversappdrv01.sys [27.04.2009 19:49 3110512]
R1 prodrv05;StarForce Protection Environment Driver v5;c:windowssystem32driversprodrv05.sys [26.12.2002 19:14 53568]
R1 VBoxDrv;VirtualBox Service;c:windowssystem32driversVBoxDrv.sys [14.03.2009 13:53 100560]
R1 VBoxUSBMon;VirtualBox USB Monitor Driver;c:windowssystem32driversVBoxUSBMon.sys [14.03.2009 13:53 41744]
R2 DrWebEngine;Dr.Web ® Scanning Engine (DrWebEngine);c:program filesCommon FilesDoctor WebScanning Enginedwengine.exe [17.10.2008 13:26 869688]
R2 SPIDER;SpIDer Guard File System Monitor;c:progra~1DrWebspider.sys [09.12.2008 13:28 268328]
R2 SPIDERNT;SpIDer Guard for Windows;c:progra~1DrWebspidernt.exe [09.12.2008 13:28 197896]
R2 TTFixerService;NST ToolTipFixer;c:program filesNeoSmart TechnologiesToolTipFixerToolTipFixer.exe [27.06.2007 10:20 10240]
R3 FStarForce;FStarForce;c:windowssystem32driversFStarForce.sys [28.02.2009 14:37 8704]
R3 VBoxNetFlt;VBoxNetFlt Service;c:windowssystem32driversVBoxNetFlt.sys [14.03.2009 13:53 87568]
S2 appdrvrem01;Application Driver Auto Removal Service (01);c:windowsSystem32appdrvrem01.exe svc —> c:windowsSystem32appdrvrem01.exe svc [?]
S2 sfrem02;FrontLine Drivers Auto Removal (v2);c:windowssystem32sfrem02.exe svc —> c:windowssystem32sfrem02.exe svc [?]
S3 GEST Service;GEST Service for program management.;c:program filesGIGABYTEGESTGSvr.exe [08.07.2008 22:02 47624]— Other Services/Drivers In Memory —
*Deregistered* — mbr
[HKEY_LOCAL_MACHINEsoftwaremicrosoftactive setupinstalled components{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
«c:program filesCommon FilesLightScribeLSRunOnce.exe»
.
Contents of the ‘Scheduled Tasks’ folder2009-10-23 c:windowsTasks1-Click Maintenance.job
— c:program filesTuneUp Utilities 2006SystemOptimizer.exe [2005-09-21 08:38]
.
.
Supplementary Scan
.
uStart Page = hxxp://www.ya.ru/
uInternet Settings,ProxyOverride = *.local
IE: &ICQ Toolbar Search — c:program filesICQToolbartoolbaru.dll/SEARCH.HTML
IE: &Перевести — c:program filesArsenal CompanySOCRAT InternetHTMLWSocrat.js
IE: &Экспорт в Microsoft Excel — c:progra~1MICROS~1Office12EXCEL.EXE/3000
IE: Download with Rapget — c:rapget140rapget.htm
IE: Добавить страницу в URL-Album — c:program filesURL-Albumua.htm
IE: Закачать ВСЕ при помощи Download Master — c:program filesDownload Masterdmieall.htm
IE: Закачать при помощи Download Master — c:program filesDownload Masterdmie.htm
IE: Передать на удаленную закачку DM — c:program filesDownload Masterremdown.htm
IE: Скачать при помощи USDownloader’а — c:usdownloader135Extdownloadie.html
IE: {{8DAE90AD-4583-4977-9DD4-4360F7A45C74} — c:program filesDownload Masterdmaster.exe
IE: {{17FA5CD6-5737-45c2-B194-74C8A4A7F7E7} — {7E1F0737-53A5-4EDC-8734-DD94B50AAF83} — c:program filesArsenal CompanySOCRAT InternetSocratInternet.dll
IE: {{DFDC8970-FD66-4385-B8C0-835A4AA1DA00} — {A3400175-12F9-4220-83BF-A7210CA4003E} — c:program filesArsenal CompanySOCRAT InternetSocratInternet.dll
LSP: c:program filesDrWebdrwebsp.dll
TCP: {600F14BB-6B06-4DE6-86C2-011E5A68679A} = 89.189.129.66
FF — ProfilePath — c:documents and settingsAdminApplication DataMozillaFirefoxProfiles2s288ejl.default
FF — prefs.js: browser.search.defaulturl — hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1210541&SearchSource=3&q=
FF — prefs.js: browser.search.selectedEngine — Web Search
FF — prefs.js: browser.startup.homepage — hxxp://ya.ru/
FF — prefs.js: keyword.URL — hxxp://search.icq.com/search/afe_results.php?ch_id=afex&q=
FF — component: c:program filesNokiaNokia PC Suite 7bkmrksynccomponentsBkMrkExt.dll
FF — plugin: c:program filesK-Lite Codec PackRealbrowserpluginsnppl3260.dll
FF — plugin: c:program filesK-Lite Codec PackRealbrowserpluginsnprpjplug.dll
FF — plugin: c:program filesMozilla Firefoxpluginsnpdm.dll
FF — plugin: c:program filesOpera8programpluginsnpdm.dll
FF — plugin: c:program filesOpera8programpluginsnpdsplay.dll
FF — plugin: c:program filesOpera8programpluginsNPOFF12.DLL
FF — plugin: c:program filesOpera8programpluginsnppl3260.dll
FF — plugin: c:program filesOpera8programpluginsnprpjplug.dll
FF — plugin: c:program filesOpera8programpluginsNPSWF32.dll
FF — plugin: c:program filesOpera8programpluginsnpwmsdrm.dll—- FIREFOX POLICIES —-
FF — user.js: network.http.max-persistent-connections-per-server — 4
FF — user.js: content.max.tokenizing.time — 200000
FF — user.js: content.notify.interval — 100000
FF — user.js: content.switch.threshold — 650000
FF — user.js: nglayout.initialpaint.delay — 300
.**************************************************************************
catchme 0.3.1398 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-26 13:07
Windows 5.1.2600 Service Pack 3 NTFSscanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0**************************************************************************
.
DLLs Loaded Under Running Processes
— — — — — — — > ‘winlogon.exe'(976)
c:windowssystem32SETUPAPI.dll
c:windowssystem32Ati2evxx.dll
c:windowssystem32cscui.dll
c:windowssystem32COMRes.dll— — — — — — — > ‘lsass.exe'(1032)
c:windowssystem32setupapi.dll
c:program filesDrWebdrwebsp.dll— — — — — — — > ‘explorer.exe'(3028)
c:program filesATI TechnologiesATI HYDRAVISIONHydraDMH.dll
c:windowssystem32COMRes.dll
c:windowsSystem32cscui.dll
c:windowssystem32NETSHELL.dll
c:windowssystem32msi.dll
c:program filesCommon FilesMicrosoft SharedOFFICE12MSOXEV.DLL
c:windowssystem32wpdshserviceobj.dll
c:windowssystem32SETUPAPI.dll
c:program filesNokiaNokia PC Suite 7PhoneBrowser.dll
c:program filesNokiaNokia PC Suite 7NGSCM.DLL
c:program filesNokiaNokia PC Suite 7LangPhoneBrowser_rus.nlr
c:program filesNokiaNokia PC Suite 7ResourcePhoneBrowser_Nokia.ngr
c:windowssystem32portabledevicetypes.dll
c:windowssystem32portabledeviceapi.dll
.
Other Running Processes
.
c:windowssystem32Ati2evxx.exe
c:windowssystem32Ati2evxx.exe
c:program filesCommon FilesAcronisSchedule2schedul2.exe
c:program filesCommon FilesLightScribeLSSrvc.exe
c:windowssystem32oodag.exe
c:windowssystem32PnkBstrA.exe
c:combofixCF10026.exe
c:combofixhidec.exe
c:program filesATI TechnologiesATI.ACECore-StaticMOM.EXE
c:program filesATI TechnologiesATI.ACECore-Staticccc.exe
c:program filesPC Connectivity SolutionServiceLayer.exe
c:program filesPC Connectivity SolutionTransportsNclUSBSrv.exe
c:program filesPC Connectivity SolutionTransportsNclRSSrv.exe
c:combofixmbr.cfxxe
c:combofixPEV.cfxxe
.
**************************************************************************
.
Completion time: 2009-10-26 13:13 — machine was rebooted
ComboFix-quarantined-files.txt 2009-10-26 08:12
ComboFix2.txt 2009-10-14 10:28Pre-Run: 2 153 705 472 байт свободно
Post-Run: 2 147 438 592 байт свободно— — End Of File — — 5EC11018F182B6C3010D116D37584868
Combofix лог выглядит нормально.
Проблема с mediamodule.js сохранилась ? Если да, то в каком браузере ?
только в браузере Mozilla Firefox
з.ы. пробовал удалять браузер, чистка реестра и новая установка. проблема не решилась
помогите пожалуйста! другими браузерами не часто пользуюсь (на этом привык)з.ы. пробовал удалять браузер, чистка реестра и новая установка. проблема не решилась
Попробуйте ещё раз.
Если нужно сохранить закладки.
Запустите Firefox, кликните Закладки.
Кликните Управление закладками.
Кликните Файл, выберите пункт Экспорт. После переустановки вы можете зайти в это меню и выбрать Импорт для восстановления закладок.
Запишите файл на ваш рабочий стол.Кликните Пуск, Настройки, Панель управления, Панель удаления и добавления программ.
Удалите Firefox.
Зайдите в папку c:Program Files и удалите папку Mozilla Firefox.
Кликните Пуск, выполнить, введите %appdata% и нажмите Enter.
Откроется папка Application Data. Удалите папку Mozilla.
Скачайте свежйю версию Firefox с сайта http://www.getfirefox.com и установите на компьютер.
- Для ответа в этой теме необходимо авторизоваться.
